@supatype/cli 0.1.6 → 0.1.7

package/tests/hooks-generator.test.ts

@@ -0,0 +1,212 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { execFileSync } from "node:child_process"
+import { afterEach, describe, expect, it } from "vitest"
+import { generateHooksModule } from "../src/hooks-generator.js"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function astFor(schema: string): unknown {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-hooksgen-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(schemaPath, schema, "utf8")
+  return extractSchemaAstFromTypes(schemaPath, dir)
+}
+
+const HOOKED_SCHEMA = `
+import type { Model, Optional, RichText, Timestamp, UUID } from "@supatype/types"
+
+export type Post = Model<{
+  id: UUID
+  title: string
+  body: RichText
+  views: Optional<number>
+  created_at: Timestamp
+}, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post"; afterDelete: "purge-post" }
+}>
+
+export type Comment = Model<{ id: UUID; body: string }, { tableName: "comments" }>
+`
+
+describe("generateHooksModule", () => {
+  it("returns null when nothing declares a hook", () => {
+    const ast = astFor(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    // A generated file nobody imports is a file somebody eventually edits.
+    expect(generateHooksModule(ast)).toBeNull()
+  })
+
+  it("includes only the tables that declare a hook", () => {
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA))
+    expect(module).not.toBeNull()
+    expect(module).toContain('"posts": {')
+    // `HookedTable` is what makes `BeforeChange<"comments">` a compile error, so an unhooked table
+    // must not appear at all.
+    expect(module).not.toContain('"comments": {')
+  })
+
+  it("carries the model's real columns into Row, Insert and Update", () => {
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA)) ?? ""
+    expect(module).toContain("title: string")
+    // `created_at` is server-generated, so it is optional on insert but present on a row.
+    expect(module).toMatch(/Insert: \{[\s\S]*created_at\?:/)
+    expect(module).toMatch(/Row: \{[\s\S]*created_at: string/)
+    // Every column is optional on a patch.
+    expect(module).toMatch(/Update: \{[\s\S]*title\?: string/)
+  })
+})
+
+describe("the generated module compiles", () => {
+  /**
+   * The generator emits TypeScript, so the only test that really proves it works is a compiler.
+   * A missing brace or a type that does not resolve would otherwise reach a user's editor — and this
+   * file is imported by their hook, so a broken emit breaks their function rather than our build.
+   */
+  it("typechecks under strict mode, together with a handler that uses it", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-hookscompile-"))
+    dirs.push(dir)
+
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA))
+    expect(module).not.toBeNull()
+    writeFileSync(join(dir, "hooks.ts"), module ?? "", "utf8")
+
+    // `supatype functions new` writes a `functions/deno.d.ts`, which is where a real project gets
+    // this. The generated module uses `Deno.env` to find the API, so the fixture needs it too.
+    writeFileSync(
+      join(dir, "deno.d.ts"),
+      `declare namespace Deno {
+  const env: { get(key: string): string | undefined }
+}
+`,
+      "utf8",
+    )
+
+    // A handler written the way the docs will show it, including the narrowing that the
+    // discriminated union is there to provide.
+    writeFileSync(
+      join(dir, "handler.ts"),
+      `import { hook, type AfterDelete, type BeforeChange } from "./hooks.ts"
+
+const moderate: BeforeChange<"posts"> = async (ctx) => {
+  if (ctx.operation === "insert") {
+    if (ctx.rows.some((r) => r.title.trim() === "")) return { reject: "A post needs a title" }
+    return { rows: ctx.rows.map((r) => ({ ...r, title: r.title.trim() })) }
+  }
+  const { rows, truncated } = await ctx.previous()
+  if (truncated) return { reject: { message: "Too many rows", status: 409 } }
+  if (rows.length === 0) return {}
+  return { patch: { ...ctx.patch, title: ctx.patch.title ?? rows[0]!.title } }
+}
+
+const purge: AfterDelete<"posts"> = async (ctx) => {
+  void ctx.filter
+}
+
+export default hook(moderate)
+export const alsoPurge = hook(purge)
+`,
+      "utf8",
+    )
+
+    writeFileSync(
+      join(dir, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: {
+          strict: true,
+          exactOptionalPropertyTypes: true,
+          noEmit: true,
+          target: "ES2022",
+          module: "Preserve",
+          moduleResolution: "bundler",
+          allowImportingTsExtensions: true,
+          lib: ["ES2022", "DOM"],
+          types: [],
+        },
+        include: ["*.ts"],
+      }),
+      "utf8",
+    )
+
+    const tsc = join(__dirname, "..", "..", "..", "node_modules", "typescript", "bin", "tsc")
+    let output = ""
+    try {
+      execFileSync(process.execPath, [tsc, "-p", join(dir, "tsconfig.json")], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    } catch (err) {
+      const failure = err as { stdout?: string; stderr?: string }
+      output = `${failure.stdout ?? ""}${failure.stderr ?? ""}`
+    }
+    expect(output).toBe("")
+  })
+
+  it("rejects a handler for a table that declares no hook", () => {
+    // The point of `HookedTable`: naming an unhooked table must not silently produce a handler that
+    // never runs.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-hooksneg-"))
+    dirs.push(dir)
+    writeFileSync(join(dir, "hooks.ts"), generateHooksModule(astFor(HOOKED_SCHEMA)) ?? "", "utf8")
+    // `supatype functions new` writes a `functions/deno.d.ts`, which is where a real project gets
+    // this. The generated module uses `Deno.env` to find the API, so the fixture needs it too.
+    writeFileSync(
+      join(dir, "deno.d.ts"),
+      `declare namespace Deno {
+  const env: { get(key: string): string | undefined }
+}
+`,
+      "utf8",
+    )
+
+    writeFileSync(
+      join(dir, "handler.ts"),
+      `import type { BeforeChange } from "./hooks.ts"
+const nope: BeforeChange<"comments"> = async () => ({})
+export default nope
+`,
+      "utf8",
+    )
+    writeFileSync(
+      join(dir, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: {
+          strict: true,
+          noEmit: true,
+          target: "ES2022",
+          module: "Preserve",
+          moduleResolution: "bundler",
+          allowImportingTsExtensions: true,
+          lib: ["ES2022", "DOM"],
+          types: [],
+        },
+        include: ["*.ts"],
+      }),
+      "utf8",
+    )
+
+    const tsc = join(__dirname, "..", "..", "..", "node_modules", "typescript", "bin", "tsc")
+    let output = ""
+    try {
+      execFileSync(process.execPath, [tsc, "-p", join(dir, "tsconfig.json")], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    } catch (err) {
+      const failure = err as { stdout?: string; stderr?: string }
+      output = `${failure.stdout ?? ""}${failure.stderr ?? ""}`
+    }
+    expect(output).toContain("comments")
+  })
+})

package/tests/init.test.ts

@@ -289,6 +289,9 @@ describe("scaffold()", () => {
     expect(existsSync(join(tmpRoot, "functions/hello/index.ts"))).toBe(true)
     expect(existsSync(join(tmpRoot, "functions/_shared/README.md"))).toBe(true)
     expect(existsSync(join(tmpRoot, "functions/.env.local"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/deno.d.ts"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/tsconfig.json"))).toBe(true)
+    expect(readFileSync(join(tmpRoot, "functions/hello/index.ts"), "utf8")).toContain("Deno.env.get")
     const pkg = readFileSync(join(tmpRoot, "package.json"), "utf8")
     expect(pkg).toContain("supatype functions serve")
   })

package/tests/local-secrets.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from "vitest"
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import {
+  FALLBACK_AUTHENTICATOR_PASSWORD,
+  FALLBACK_JWT_SECRET,
+  FALLBACK_POSTGRES_PASSWORD,
+  devAuthenticatorPassword,
+  devJwtSecret,
+  devPostgresPassword,
+  secretFingerprint,
+} from "../src/local-secrets.js"
+import { upsertEnvFile } from "../src/env-file.js"
+
+// The bug these exist to prevent: `supatype dev` used to pin POSTGRES_PASSWORD and JWT_SECRET
+// to published constants in `.env` on every run — the same `.env` a self-host deployment reads.
+// A generated secret survived until the developer's next `dev`, then reverted silently, and the
+// deployment went out with a secret anyone can look up.
+
+function project(env?: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-secrets-"))
+  if (env !== undefined) writeFileSync(join(dir, ".env"), env, "utf8")
+  return dir
+}
+
+describe("resolving local secrets", () => {
+  it("prefers the project's own values", () => {
+    const dir = project("JWT_SECRET=mine\nPOSTGRES_PASSWORD=pg-mine\nAUTHENTICATOR_PASSWORD=auth-mine\n")
+    expect(devJwtSecret(dir)).toBe("mine")
+    expect(devPostgresPassword(dir)).toBe("pg-mine")
+    expect(devAuthenticatorPassword(dir)).toBe("auth-mine")
+  })
+
+  // A project with no `.env` still has to start, so the constants remain — as fallbacks only.
+  it("falls back when the project has none", () => {
+    const dir = project()
+    expect(devJwtSecret(dir)).toBe(FALLBACK_JWT_SECRET)
+    expect(devPostgresPassword(dir)).toBe(FALLBACK_POSTGRES_PASSWORD)
+    expect(devAuthenticatorPassword(dir)).toBe(FALLBACK_AUTHENTICATOR_PASSWORD)
+  })
+})
+
+describe("the dev env write does not clobber secrets", () => {
+  // This is the regression. `upsertEnvFile` replaces any key handed to it, so the guarantee has
+  // to be that the dev path never hands it these — asserted here at the level that matters:
+  // write what dev writes, then check the secrets are byte-identical.
+  it("leaves generated secrets untouched across repeated writes", () => {
+    const dir = project(
+      "JWT_SECRET=generated-secret-value\nPOSTGRES_PASSWORD=generated-pg-value\nAUTHENTICATOR_PASSWORD=generated-auth-value\n",
+    )
+    const before = readFileSync(join(dir, ".env"), "utf8")
+
+    // The keys `upsertDevComposeEnv` legitimately owns: derived values and local ports.
+    for (let run = 0; run < 2; run++) {
+      upsertEnvFile(dir, {
+        POSTGRES_USER: "supatype_admin",
+        POSTGRES_DB: "supatype",
+        AUTHENTICATOR_PASSWORD: devAuthenticatorPassword(dir),
+        ANON_KEY: `anon-${run}`,
+        SERVICE_ROLE_KEY: `service-${run}`,
+        SUPATYPE_KONG_PORT: "18473",
+      })
+    }
+
+    const after = readFileSync(join(dir, ".env"), "utf8")
+    const value = (content: string, key: string): string | undefined =>
+      content.match(new RegExp(`^${key}=(.*)$`, "m"))?.[1]
+
+    for (const key of ["JWT_SECRET", "POSTGRES_PASSWORD", "AUTHENTICATOR_PASSWORD"]) {
+      expect(value(after, key), `${key} must survive a dev run`).toBe(value(before, key))
+    }
+    // Derived keys are still expected to move.
+    expect(value(after, "ANON_KEY")).toBe("anon-1")
+  })
+})
+
+describe("secretFingerprint", () => {
+  // The ready panel used to echo the JWT secret in full. Harmless for a published constant,
+  // wrong once it is the project's own.
+  it("does not reveal the secret", () => {
+    const secret = "super-secret-value-that-must-not-be-printed"
+    const tag = secretFingerprint(secret)
+    expect(secret).not.toContain(tag)
+    expect(tag).toMatch(/^[0-9a-f]{8}$/)
+  })
+
+  it("is stable and distinguishes secrets", () => {
+    expect(secretFingerprint("a")).toBe(secretFingerprint("a"))
+    expect(secretFingerprint("a")).not.toBe(secretFingerprint("b"))
+  })
+})

package/tests/model-hooks.test.ts

@@ -0,0 +1,322 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import {
+  DEFAULT_HOOK_TIMEOUT_MS,
+  declaredHooks,
+  manifestHooks,
+  syncManifestHooks,
+  hooksReport,
+  validateModelHooks,
+  writeHooksModule,
+} from "../src/model-hooks.js"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function project(schema: string): { dir: string; ast: unknown } {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-hooks-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(schemaPath, schema, "utf8")
+  return { dir, ast: extractSchemaAstFromTypes(schemaPath, dir) }
+}
+
+/** A function the worker would discover: a directory with an index.ts. */
+function addFunction(dir: string, name: string): void {
+  mkdirSync(join(dir, "functions", name), { recursive: true })
+  writeFileSync(join(dir, "functions", name, "index.ts"), "export default () => new Response()", "utf8")
+}
+
+describe("model hooks — declaration", () => {
+  it("extracts both the shorthand and the options form", () => {
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID; title: string }, {
+  tableName: "posts"
+  hooks: {
+    beforeChange: "moderate-post"
+    afterChange: { function: "index-post"; timeout: 5000; onUnavailable: "log" }
+  }
+}>
+`)
+    expect(declaredHooks(ast)).toEqual([
+      { model: "Post", event: "afterChange", function: "index-post" },
+      { model: "Post", event: "beforeChange", function: "moderate-post" },
+    ])
+
+    const models = (ast as { models: { annotations: { platform: { hooks?: Record<string, unknown> } } }[] }).models
+    expect(models[0]?.annotations.platform.hooks).toEqual({
+      beforeChange: { function: "moderate-post" },
+      afterChange: { function: "index-post", timeout: 5000, onUnavailable: "log" },
+    })
+  })
+
+  it("carries no hooks annotation when a model declares none", () => {
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    const models = (ast as { models: { annotations: { platform: Record<string, unknown> } }[] }).models
+    expect(models[0]?.annotations.platform["hooks"]).toBeUndefined()
+    expect(declaredHooks(ast)).toEqual([])
+  })
+
+  it("ignores an event name that is not a lifecycle hook", () => {
+    // `beforeRead` was dropped from the design. Extracting it would put a hook in the manifest that
+    // the server has no point at which to call, which reads as "declared and silently ignored".
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeRead: "nope"; beforeChange: "yes" }
+}>
+`)
+    expect(declaredHooks(ast).map((h) => h.event)).toEqual(["beforeChange"])
+  })
+})
+
+describe("model hooks — push-time validation", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post" }
+}>
+`
+
+  it("passes when the named function exists", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    expect(validateModelHooks(ast, join(dir, "functions"), dir)).toEqual([])
+  })
+
+  it("reports the hook, the path searched, and what is available", () => {
+    // The failure this prevents: a typo'd name extracts cleanly, reaches the manifest, never fires,
+    // and the write it was meant to validate succeeds looking perfectly normal.
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-posts") // note the plural
+    const problems = validateModelHooks(ast, join(dir, "functions"), dir)
+
+    expect(problems.join("\n")).toContain("Post.beforeChange")
+    expect(problems.join("\n")).toContain('"moderate-post"')
+    expect(problems.join("\n")).toContain("moderate-posts")
+  })
+
+  it("says how to create one when the hooks directory is empty", () => {
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, "hooks"), { recursive: true })
+    expect(validateModelHooks(ast, join(dir, "hooks"), dir).join("\n")).toContain(
+      "supatype hooks new",
+    )
+  })
+
+  it("does not require a functions directory when no hooks are declared", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    expect(validateModelHooks(ast, join(dir, "functions"), dir)).toEqual([])
+  })
+
+  it("ignores a file and an underscore directory when listing functions", () => {
+    // Matches how the worker discovers handlers: `_shared` is shared code, not a function.
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, "functions", "_shared"), { recursive: true })
+    writeFileSync(join(dir, "functions", "_shared", "index.ts"), "export const x = 1", "utf8")
+    writeFileSync(join(dir, "functions", "readme.md"), "notes", "utf8")
+
+    const problems = validateModelHooks(ast, join(dir, "functions"), dir).join("\n")
+    expect(problems).toContain("No hooks found")
+    expect(problems).not.toContain("_shared")
+  })
+})
+
+describe("model hooks — manifest map", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post"; afterChange: { function: "index-post"; timeout: 9000 } }
+}>
+`
+
+  it("keys by table name and fills the safe default per phase", () => {
+    const { ast } = project(schema)
+    // Keyed by table, not model: the server matches a request path.
+    expect(manifestHooks(ast)).toEqual({
+      posts: {
+        beforeChange: {
+          function: "moderate-post",
+          timeout: DEFAULT_HOOK_TIMEOUT_MS,
+          // Unreachable before a write must not let the write through...
+          onUnavailable: "reject",
+        },
+        afterChange: {
+          function: "index-post",
+          timeout: 9000,
+          // ...but after one there is nothing left to fail.
+          onUnavailable: "log",
+        },
+      },
+    })
+  })
+
+  it("merges into an existing manifest and leaves its other keys alone", () => {
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ schema: "tenant_7", functions_enabled: true }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    expect(manifest["schema"]).toBe("tenant_7")
+    expect(manifest["functions_enabled"]).toBe(true)
+    expect(Object.keys(manifest["hooks"] as object)).toEqual(["posts"])
+  })
+
+  it("never creates a manifest from scratch", () => {
+    // `functions_enabled` is a plain bool on the server's side, so a manifest carrying only hooks
+    // would read as functions *disabled* — the defect fixed one commit earlier, by another door.
+    const { dir, ast } = project(schema)
+    expect(syncManifestHooks(dir, ast)).toBe(false)
+    expect(existsSync(join(dir, ".supatype", "manifest.json"))).toBe(false)
+  })
+
+  it("removes the hook map when the last hook goes away", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true, hooks: { posts: { beforeChange: { function: "gone" } } } }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    expect(manifest["hooks"]).toBeUndefined()
+  })
+})
+
+describe("model hooks — generated module on disk", () => {
+  it("removes a stale module when the last hook is deleted", () => {
+    // Otherwise a typed module sits there claiming tables are hooked, and a handler importing it
+    // keeps compiling while never running.
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    const functionsDir = join(dir, "functions")
+    mkdirSync(join(functionsDir, "_supatype"), { recursive: true })
+    writeFileSync(join(functionsDir, "_supatype", "hooks.ts"), "export type Stale = true", "utf8")
+
+    expect(writeHooksModule(dir, functionsDir, ast)).toBeNull()
+    expect(existsSync(join(functionsDir, "_supatype", "hooks.ts"))).toBe(false)
+  })
+
+  it("writes the module beside the functions that import it", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts"; hooks: { beforeChange: "x" } }>
+`)
+    const functionsDir = join(dir, "functions")
+    const written = writeHooksModule(dir, functionsDir, ast)
+    expect(written).toContain(join("functions", "_supatype", "hooks.ts"))
+    expect(readFileSync(join(functionsDir, "_supatype", "hooks.ts"), "utf8")).toContain("HookedTable")
+  })
+})
+
+describe("model hooks — doctor report", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post" }
+}>
+`
+
+  it("reports nothing for a schema with no hooks", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    expect(hooksReport(dir, join(dir, "functions"), ast).declared).toEqual([])
+  })
+
+  it("marks a hook whose function is absent", () => {
+    const { dir, ast } = project(schema)
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.declared).toHaveLength(1)
+    expect(report.missing).toHaveLength(1)
+  })
+
+  it("catches functions being switched off, which makes every hook inert silently", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: false, hooks: { posts: {} } }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.missing).toEqual([])
+    expect(report.functionsDisabled).toBe(true)
+  })
+
+  it("catches a manifest with no hook map, so the server has nothing to call", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.mapMissing).toBe(true)
+    expect(report.functionsDisabled).toBe(false)
+  })
+
+  it("is clean when the function exists and the manifest agrees", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true, hooks: { posts: { beforeChange: { function: "moderate-post" } } } }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report).toMatchObject({ missing: [], functionsDisabled: false, mapMissing: false })
+  })
+})