@supatype/cli 0.1.6 → 0.1.9

package/tests/runtime-contract.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest"
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { tmpdir } from "node:os"
 import { runtimeRouteSpec } from "../src/runtime-routes.js"
@@ -89,6 +89,25 @@ describe("runtime contract", () => {
     expect(first).toBe(second)
   })
 
+  it("self-host compose exposes the managed schema over REST, not a hardcoded public", () => {
+    // The literal here was the reason a non-default pg_schema pushed correctly and then answered
+    // PGRST106 on every request: the engine had moved and PostgREST was never told.
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      schema: { pg_schema: "app" },
+    })
+    expect(compose).toContain('PGRST_DB_SCHEMA: "app, supatype, graphql_public, auth"')
+    expect(compose).not.toContain('PGRST_DB_SCHEMA: "public,')
+  })
+
+  it("self-host compose honours an explicit api_schemas list verbatim", () => {
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      schema: { pg_schema: "app", api_schemas: ["app", "reporting"] },
+    })
+    expect(compose).toContain('PGRST_DB_SCHEMA: "app, reporting"')
+  })
+
   it("self-host compose does not inject a synthetic app-proxy service", () => {
     const compose = renderSelfHostCompose({ ...baseConfig, app: { mode: "proxy", upstream: "http://app:3000" } })
     expect(compose).not.toContain("ghcr.io/supatype/app-proxy")
@@ -109,6 +128,49 @@ describe("runtime contract", () => {
     expect(compose).toContain("supatype/schema-engine:latest")
   })
 
+  // PostgREST must connect as `authenticator`, never as POSTGRES_USER. POSTGRES_USER is
+  // `supatype_admin`, a superuser, and a superuser session may SET ROLE to any role in the
+  // cluster: so a request whose JWT named one got it. Verified against a live stack: a
+  // token with `role: "supatype_admin"` returned every row of an RLS-protected table.
+  it("self-host compose connects PostgREST as authenticator, not the superuser", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).toContain("PGRST_DB_URI: postgresql://authenticator:")
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*POSTGRES_USER/)
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*supatype_admin/)
+  })
+
+  // A separate credential, so rotating the operator's POSTGRES_PASSWORD cannot take the REST
+  // API down with it. Unset is a hard compose error rather than an empty password.
+  it("gives PostgREST its own credential, not POSTGRES_PASSWORD", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).toMatch(/PGRST_DB_URI:.*\$\{AUTHENTICATOR_PASSWORD:\?/)
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*POSTGRES_PASSWORD/)
+    expect(compose).toMatch(/AUTHENTICATOR_PASSWORD: \$\{AUTHENTICATOR_PASSWORD:\?/)
+  })
+
+  // `supatype dev --provider docker` renders *this* file, so a `${VAR:?}` with no default
+  // takes local dev down before anything starts, `docker compose` refuses to interpolate and
+  // exits 1. Adding one therefore means wiring it into `upsertDevComposeEnv` as well. This
+  // list is the reminder; if it fails, do that rather than just updating the list.
+  it("requires only variables the dev path also sets", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    const required = [...compose.matchAll(/\$\{([A-Z0-9_]+):\?/g)].map((m) => m[1])
+    expect([...new Set(required)].sort()).toEqual([
+      "AUTHENTICATOR_PASSWORD",
+      "JWT_SECRET",
+      "POSTGRES_PASSWORD",
+    ])
+  })
+
+  // The whole point of requiring them: a service must never fall back to a secret published in
+  // this repository. That default used to reach PostgREST, storage and GoTrue.
+  it("never defaults a secret to a published constant", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).not.toContain("super-secret-jwt-token")
+    expect(compose).not.toMatch(/\$\{JWT_SECRET:-/)
+    expect(compose).not.toMatch(/\$\{POSTGRES_PASSWORD:-/)
+  })
+
   it("composeDockerImageEnv maps pinned versions to SUPATYPE_*_IMAGE", () => {
     expect(composeDockerImageEnv(baseConfig)).toEqual({
       SUPATYPE_ENGINE_IMAGE: "supatype/schema-engine:v0.4.2",
@@ -251,6 +313,55 @@ describe("runtime contract", () => {
     }
   })
 
+  it("manifest switches functions on, because the compose file always runs a worker", () => {
+    // The generated compose file starts a `functions-worker` and hands the server
+    // SUPATYPE_FUNCTIONS_WORKER_URL, while the manifest beside it said functions were disabled. The
+    // server reads the manifest, so every function 404'd in a stack that was running a worker for
+    // them. Docker `supatype dev` renders this same file, so one flag broke both paths.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-fn-manifest-"))
+    try {
+      writeSelfHostCompose(dir, baseConfig)
+      const compose = readFileSync(join(dir, ".supatype", "self-host", "docker-compose.yml"), "utf8")
+      expect(compose).toContain("  functions-worker:")
+      expect(compose).toContain("SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001")
+
+      const manifest = JSON.parse(
+        readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+      ) as Record<string, unknown>
+      expect(manifest["functions_enabled"]).toBe(true)
+      expect(manifest["functions_worker_url"]).toBe("http://functions-worker:8001")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("repairs a manifest written by an older CLI without touching its other keys", () => {
+    // Regenerating the compose file is the obvious fix to try, so it has to work: without the
+    // repair, only brand-new projects get functions and an existing stack stays broken.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-fn-repair-"))
+    try {
+      mkdirSync(join(dir, ".supatype"), { recursive: true })
+      writeFileSync(
+        join(dir, ".supatype", "manifest.json"),
+        JSON.stringify({ schema: "tenant_7", postgrest_url: "http://pg:3000", functions_enabled: false }),
+        "utf8",
+      )
+
+      writeSelfHostCompose(dir, baseConfig)
+
+      const manifest = JSON.parse(
+        readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+      ) as Record<string, unknown>
+      expect(manifest["functions_enabled"]).toBe(true)
+      expect(manifest["functions_worker_url"]).toBe("http://functions-worker:8001")
+      // Values `push` put there survive: the schema is not "public" and must stay as found.
+      expect(manifest["schema"]).toBe("tenant_7")
+      expect(manifest["postgrest_url"]).toBe("http://pg:3000")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
   it("devLocal compose enables STUDIO_OPEN_DEV on supatype-server", () => {
     const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
     expect(compose).toContain('STUDIO_OPEN_DEV: "1"')
@@ -276,6 +387,7 @@ describe("runtime contract", () => {
     expect(compose).toContain("\n  functions-worker:\n")
     expect(compose).toContain("SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001")
     expect(compose).toContain("SUPATYPE_FUNCTIONS_ROOT: /project/functions")
+    expect(compose).toContain("SUPATYPE_URL: http://kong:8000")
     expect(compose).not.toContain("deploy/functions")
     expect(compose).not.toContain("supatype-functions")
   })

package/tests/service-role-check.test.ts

@@ -0,0 +1,109 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { checkServiceRoleRoutes, serviceRoleProblemLines } from "../src/service-role-check.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+import { DENO_RELEASE_PIN } from "../src/release-pins.js"
+
+function config(serviceRole?: string[]): SupatypeProjectConfig {
+  return {
+    project: { name: "p" },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode: "none" },
+    versions: { engine: "0.4.2", server: "0.1.0", postgres: "17.2", deno: DENO_RELEASE_PIN },
+    ...(serviceRole !== undefined && { functions: { serviceRole } }),
+  } as SupatypeProjectConfig
+}
+
+/** A project whose functions/ holds the named directories, each with an index.ts. */
+function projectWith(names: string[], bareFiles: string[] = []): string {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-svcrole-check-"))
+  const dir = join(cwd, "functions")
+  mkdirSync(dir, { recursive: true })
+  for (const name of names) {
+    mkdirSync(join(dir, name), { recursive: true })
+    writeFileSync(join(dir, name, "index.ts"), "export default () => new Response()\n", "utf8")
+  }
+  for (const file of bareFiles) {
+    writeFileSync(join(dir, `${file}.ts`), "export default () => new Response()\n", "utf8")
+  }
+  return cwd
+}
+
+describe("checkServiceRoleRoutes", () => {
+  it("says nothing when a project grants nothing", () => {
+    const problems = checkServiceRoleRoutes(config(), projectWith([]))
+    expect(problems.errors).toEqual([])
+    expect(problems.warnings).toEqual([])
+  })
+
+  it("accepts a name that matches a function directory", () => {
+    const problems = checkServiceRoleRoutes(config(["send-email"]), projectWith(["send-email"]))
+    expect(problems.errors).toEqual([])
+  })
+
+  it("accepts a bare <name>.ts function, which the worker also serves", () => {
+    const problems = checkServiceRoleRoutes(config(["audit"]), projectWith([], ["audit"]))
+    expect(problems.errors).toEqual([])
+  })
+
+  it("reports a typo, which would otherwise grant nothing in silence", () => {
+    // The failure this exists for: the grant fails closed, so the function reads no key at runtime in a
+    // deploy that reported success.
+    const problems = checkServiceRoleRoutes(config(["send-emial"]), projectWith(["send-email"]))
+    expect(problems.errors).toHaveLength(1)
+    expect(problems.errors[0]).toContain("send-emial")
+    // Structural too, so `doctor` can mark the entry without parsing the printed line back apart.
+    expect(problems.missing).toEqual(["send-emial"])
+  })
+
+  it("reports a name whose function was renamed away", () => {
+    const problems = checkServiceRoleRoutes(config(["send-email"]), projectWith(["mailer"]))
+    expect(problems.errors).toHaveLength(1)
+  })
+
+  it("warns rather than fails on a hook entry", () => {
+    // It was the documented form once, and the worker grants hooks whatever the list says, so it is
+    // harmless, and worth saying because a reader would assume the line is what grants.
+    const problems = checkServiceRoleRoutes(config(["hooks/moderate-post"]), projectWith([]))
+    expect(problems.errors).toEqual([])
+    expect(problems.warnings).toHaveLength(1)
+    expect(problems.warnings[0]).toContain("not needed")
+  })
+
+  it("ignores an index-less directory, matching how the worker discovers routes", () => {
+    const cwd = projectWith([])
+    mkdirSync(join(cwd, "functions", "half-written"), { recursive: true })
+    const problems = checkServiceRoleRoutes(config(["half-written"]), cwd)
+    expect(problems.errors).toHaveLength(1)
+  })
+})
+
+describe("serviceRoleProblemLines", () => {
+  it("is empty when nothing is wrong", () => {
+    expect(serviceRoleProblemLines({ errors: [], missing: [], warnings: [], available: ["a"] })).toEqual([])
+  })
+
+  it("lists what could have been named instead", () => {
+    const lines = serviceRoleProblemLines({
+      errors: ['  "x": no functions/x/index.ts'],
+      missing: ["x"],
+      warnings: [],
+      available: ["audit", "send-email"],
+    })
+    expect(lines.join("\n")).toContain("Functions found: audit, send-email")
+  })
+
+  it("says so when there are no functions at all", () => {
+    const lines = serviceRoleProblemLines({
+      errors: ['  "x": nope'],
+      missing: ["x"],
+      warnings: [],
+      available: [],
+    })
+    expect(lines.join("\n")).toContain("No functions found")
+  })
+})

package/tests/service-role-routes.test.ts

@@ -0,0 +1,51 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { serviceRoleRoutesFor } from "../src/commands/functions.js"
+import { DENO_RELEASE_PIN } from "../src/release-pins.js"
+
+/** A config the loader accepts, plus whatever the test is actually about. */
+function projectWith(extra: Record<string, unknown>): string {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-svcrole-"))
+  mkdirSync(cwd, { recursive: true })
+  const body = {
+    project: { name: "p" },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode: "none" },
+    versions: { engine: "0.4.2", server: "0.1.0", postgres: "17.2", deno: DENO_RELEASE_PIN },
+    schema: { path: "./schema/index.ts" },
+    ...extra,
+  }
+  writeFileSync(join(cwd, "supatype.config.ts"), `export default ${JSON.stringify(body)}\n`, "utf8")
+  return cwd
+}
+
+describe("serviceRoleRoutesFor", () => {
+  it("reads the declared list", () => {
+    const cwd = projectWith({ functions: { serviceRole: ["send-email"] } })
+    expect(serviceRoleRoutesFor(cwd)).toEqual(["send-email"])
+  })
+
+  it("is an empty list when a project declares none", () => {
+    // Distinct from the case below: this project *has* said something, and it said nobody. The platform
+    // stores that as a real revocation.
+    expect(serviceRoleRoutesFor(projectWith({}))).toEqual([])
+  })
+
+  it("is undefined when the config cannot be read at all", () => {
+    // Not []: the platform replaces its stored list wholesale whenever the field is present, so an
+    // unreadable config sending [] would revoke every grant the project has.
+    expect(serviceRoleRoutesFor(mkdtempSync(join(tmpdir(), "supatype-svcrole-none-")))).toBeUndefined()
+  })
+
+  it("sends what the project declared, hook entries included", () => {
+    // Filtering hook routes out is the platform's job, not this one's: a hook is granted the key by the
+    // worker anyway, and dropping the entry here would hide a mistake in the config rather than making
+    // it harmless. Sorted, so an unchanged config produces an unchanged request.
+    const cwd = projectWith({ functions: { serviceRole: ["send-email", "hooks/moderate-post"] } })
+    expect(serviceRoleRoutesFor(cwd)).toEqual(["hooks/moderate-post", "send-email"])
+  })
+})

package/tests/storage-provision.test.ts

@@ -80,7 +80,7 @@ describe("provisionBuckets", () => {
 
     await provisionBuckets("http://localhost:54321/storage/v1", "key", [{ id: "photos", public: false }])
 
-    expect(warn).toHaveBeenCalledWith('[storage] Storage API unreachable — skipped bucket "photos"')
+    expect(warn).toHaveBeenCalledWith('[storage] Storage API unreachable, skipped bucket "photos"')
   })
 })
 

package/tests/target-client-refresh.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it, vi, afterEach } from "vitest"
+import { targetFetch, TargetApiError } from "../src/target-client.js"
+
+describe("targetFetch cloud auth refresh", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+    vi.restoreAllMocks()
+  })
+
+  it("refreshes once on TOKEN_EXPIRED then retries", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 401,
+        json: async () => ({ message: "Token expired", code: "TOKEN_EXPIRED" }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => ({
+          access_token: "new-access",
+          refresh_token: "new-refresh",
+          expires_in: 3600,
+        }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => ({ data: { ok: true } }),
+      })
+
+    vi.stubGlobal("fetch", fetchMock)
+
+    const onRefreshed = vi.fn()
+    const result = await targetFetch<{ ok: boolean }>("http://api.test", "/api/v1", {
+      method: "GET",
+      path: "/projects/x/status",
+      token: "old-access",
+      authRefresh: {
+        cloudApiUrl: "http://api.test",
+        refreshToken: "old-refresh",
+        onRefreshed,
+      },
+    })
+
+    expect(result).toEqual({ ok: true })
+    expect(onRefreshed).toHaveBeenCalledWith({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+    })
+    expect(fetchMock).toHaveBeenCalledTimes(3)
+    const retryAuth = (fetchMock.mock.calls[2]![1] as RequestInit).headers as Record<string, string>
+    expect(retryAuth.Authorization).toBe("Bearer new-access")
+  })
+
+  it("points to supatype login when expired without refresh token", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 401,
+        json: async () => ({ message: "Token expired", code: "TOKEN_EXPIRED" }),
+      }),
+    )
+
+    await expect(
+      targetFetch("http://api.test", "/api/v1", {
+        method: "GET",
+        path: "/projects/x/status",
+        token: "old",
+      }),
+    ).rejects.toThrow(/supatype login/)
+  })
+
+  it("throws TargetApiError with status", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 500,
+        json: async () => ({ message: "boom" }),
+      }),
+    )
+
+    await expect(
+      targetFetch("http://api.test", "/api/v1", {
+        method: "GET",
+        path: "/x",
+        token: "t",
+      }),
+    ).rejects.toMatchObject({ name: "TargetApiError", status: 500 } satisfies Partial<TargetApiError>)
+  })
+})

package/tests/type-extractor.test.ts

@@ -1135,4 +1135,191 @@ export type User = Model<{ id: UUID; email: NonNullable<string> }>
 
     expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(/Unknown Supatype type "NonNullable"/)
   })
+  // Regression: access factored into a shared type alias silently produced NO
+  // rules, so every model using the pattern was published without RLS.
+  it("resolves model access from a shared type alias in another file", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-alias-"))
+    dirs.push(dir)
+    writeFileSync(
+      join(dir, "shared.ts"),
+      `
+import type { Public, Role } from "@supatype/types"
+
+export type CmsPublicReadAdminWrite = {
+  read: Public
+  create: Role<"admin">
+  update: Role<"admin">
+  delete: Role<"admin">
+}
+`,
+      "utf8",
+    )
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID } from "@supatype/types"
+import type { CmsPublicReadAdminWrite } from "./shared.js"
+
+export type Article = Model<{ id: UUID; title: string }, {
+  tableName: "articles"
+  access: CmsPublicReadAdminWrite
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const access = modelAccess(ast?.models.find((m) => m.name === "Article"))
+    expect(access).toEqual({
+      read: { type: "public" },
+      create: { type: "role", roles: ["admin"] },
+      update: { type: "role", roles: ["admin"] },
+      delete: { type: "role", roles: ["admin"] },
+    })
+  })
+
+  it("resolves model access from an intersection of aliases", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-intersection-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID, Public, Role } from "@supatype/types"
+
+type PublicRead = { read: Public }
+type AdminWrite = { create: Role<"admin">; delete: Role<"admin"> }
+
+export type Article = Model<{ id: UUID; title: string }, {
+  access: PublicRead & AdminWrite
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const access = modelAccess(ast?.models.find((m) => m.name === "Article"))
+    expect(Object.keys(access).sort()).toEqual(["create", "delete", "read"])
+  })
+
+  // The dangerous case: `const … as const` cannot express access (the rule names
+  // are types), and silently ignoring it published an unprotected table.
+  it("throws when model access cannot be resolved instead of dropping the rules", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-unresolvable-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID } from "@supatype/types"
+
+export type Article = Model<{ id: UUID; title: string }, {
+  access: typeof someRuntimeValue
+}>
+`,
+      "utf8",
+    )
+
+    expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(
+      /Model "Article": could not resolve its `access` rules/,
+    )
+  })
+
+  it("carries Decimal precision and scale through to the AST", () => {
+    // `Decimal<10, 2>` used to extract as an unbounded NUMERIC: the engine renders `NUMERIC(p, s)`
+    // from these two facts, and nothing read the type arguments. A money column silently lost its
+    // constraint, which no error surfaced and no test caught.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-decimal-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Decimal, Model, UUID } from "@supatype/types"
+
+export type Invoice = Model<{
+  id: UUID
+  total: Decimal<10, 2>
+  rate: Decimal<5, 4>
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const invoice = ast?.models.find((m) => m.name === "Invoice")
+    expect(invoice?.fields["total"]).toMatchObject({ kind: "decimal", precision: 10, scale: 2 })
+    expect(invoice?.fields["rate"]).toMatchObject({ kind: "decimal", precision: 5, scale: 4 })
+  })
+
+  it("extracts Code and Currency as JSONB carrying their declared shape", () => {
+    // Both were exported from `@supatype/types` and rejected by the extractor, so a schema using
+    // either failed the push with "unknown type". Each carries two values, a language with its
+    // source, an amount with its currency, so JSONB is the column that does not drop one.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-code-currency-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Code, Currency, Model, UUID } from "@supatype/types"
+
+export type Snippet = Model<{
+  id: UUID
+  body: Code<"sql">
+  anyLang: Code
+  price: Currency<"USD">
+  anyCurrency: Currency
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const snippet = ast?.models.find((m) => m.name === "Snippet")
+
+    expect(snippet?.fields["body"]).toMatchObject({
+      kind: "json",
+      annotations: { db: { pgType: "JSONB" } },
+      tsType: '{ lang: "sql"; source: string }',
+    })
+    expect(snippet?.fields["price"]).toMatchObject({
+      kind: "json",
+      annotations: { db: { pgType: "JSONB" } },
+      tsType: '{ amount: string; code: "USD" }',
+    })
+
+    // Without a literal argument the currency is not known statically, so the row carries it.
+    expect(snippet?.fields["anyLang"]).toMatchObject({ tsType: "{ lang: string; source: string }" })
+    expect(snippet?.fields["anyCurrency"]).toMatchObject({ tsType: "{ amount: string; code: string }" })
+
+    // Both are JSONB, so the column kind cannot tell Studio which editor to show. The `editor`
+    // annotation is what separates a code snippet from a money amount from a raw JSON blob.
+    expect(snippet?.fields["body"]).toMatchObject({ annotations: { platform: { editor: "code" } } })
+    expect(snippet?.fields["price"]).toMatchObject({
+      annotations: { platform: { editor: "currency" } },
+    })
+  })
+
+  it("throws when bucket access cannot be resolved", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-bucket-access-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Bucket } from "@supatype/types"
+
+export type Media = Bucket<"media", {
+  access: typeof someRuntimeValue
+}>
+`,
+      "utf8",
+    )
+
+    expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(
+      /Bucket "media": could not resolve its `access` rules/,
+    )
+  })
 })