@supatype/cli 0.2.1 → 0.3.0

package/tests/native-keyspace.test.ts

@@ -0,0 +1,130 @@
+import { describe, it, expect, afterEach } from "vitest"
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { createServer } from "node:net"
+import {
+  firstFreePort,
+  nativeKeyspaceLibraryPresent,
+  nativeMaskLibraryPresent,
+  pgServerOptions,
+} from "../src/postgres-ctl.js"
+
+/**
+ * Native `supatype dev` starts one Postgres, and what that Postgres can do
+ * depends on which libraries the downloaded archive happens to carry. An
+ * archive from before pg_keyspace was bundled, and the Windows archive that
+ * cannot carry it at all, are both ordinary states — and naming a library that
+ * is not there stops the server starting, which turns a missing cache into no
+ * database.
+ */
+const roots: string[] = []
+
+function install(libs: string[], layout: "unix" | "windows" = "unix"): string {
+  const root = mkdtempSync(join(tmpdir(), "supatype-pg-"))
+  roots.push(root)
+  const binDir = join(root, "bin")
+  const libDir = layout === "unix" ? join(root, "lib") : join(root, "lib", "postgresql")
+  mkdirSync(binDir, { recursive: true })
+  mkdirSync(libDir, { recursive: true })
+  for (const lib of libs) writeFileSync(join(libDir, lib), "")
+  return binDir
+}
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
+})
+
+describe("which libraries the archive carries", () => {
+  it("finds each library in both layouts", () => {
+    for (const layout of ["unix", "windows"] as const) {
+      const ext = layout === "unix" ? "so" : "dll"
+      const both = install([`pg_keyspace.${ext}`, `supatype_mask.${ext}`], layout)
+      expect(nativeKeyspaceLibraryPresent(both)).toBe(true)
+      expect(nativeMaskLibraryPresent(both)).toBe(true)
+    }
+    expect(nativeKeyspaceLibraryPresent(install(["pg_keyspace.dylib"]))).toBe(true)
+  })
+
+  it("says no for an archive without them, and for no archive at all", () => {
+    const bare = install([])
+    expect(nativeKeyspaceLibraryPresent(bare)).toBe(false)
+    expect(nativeMaskLibraryPresent(bare)).toBe(false)
+    for (const absent of [null, undefined, ""]) {
+      expect(nativeKeyspaceLibraryPresent(absent)).toBe(false)
+    }
+  })
+})
+
+describe("the options pg_ctl hands the server", () => {
+  const opts = (pgBinDir: string, extra: Record<string, unknown> = {}) => ({
+    pgBinDir,
+    dataDir: "/tmp/data",
+    port: 55432,
+    ...extra,
+  })
+
+  it("preloads nothing an archive does not carry", () => {
+    expect(pgServerOptions(opts(install([]), { keyspacePort: 6379 }))).toBe("-p 55432")
+  })
+
+  it("preloads the mask alone, as it did before the keyspace existed", () => {
+    const o = pgServerOptions(opts(install(["supatype_mask.so"]), { keyspacePort: 6379 }))
+    expect(o).toBe("-p 55432 -c shared_preload_libraries=supatype_mask")
+  })
+
+  // pg_keyspace refuses to serve when the mask loads before it, because RESP
+  // would hand back rows the mask never rewrote. The order is the safety
+  // property, not a style choice.
+  it("loads pg_keyspace before the mask, so the mask stays outermost", () => {
+    const o = pgServerOptions(opts(install(["pg_keyspace.so", "supatype_mask.so"]), { keyspacePort: 6379 }))
+    expect(o).toContain("-c shared_preload_libraries=pg_keyspace,supatype_mask")
+  })
+
+  it("sizes the keyspace for a laptop and keeps it ephemeral", () => {
+    const o = pgServerOptions(
+      opts(install(["pg_keyspace.so"]), { keyspacePort: 6380, keyspaceDatabase: "acme" }),
+    )
+    expect(o).toContain("-c pg_keyspace.port=6380")
+    expect(o).toContain("-c pg_keyspace.durability=ephemeral")
+    expect(o).toContain("-c pg_keyspace.keys=50000")
+    expect(o).toContain("-c pg_keyspace.ring_mb=8")
+    expect(o).toContain("-c pg_keyspace.rowcache_mb=1")
+    expect(o).toContain("-c pg_keyspace.database=acme")
+  })
+
+  // No port means the caller decided against RESP — an archive that has the
+  // library is not a reason to serve on a port nobody chose.
+  it("serves no keyspace without a port, even with the library present", () => {
+    const o = pgServerOptions(opts(install(["pg_keyspace.so", "supatype_mask.so"])))
+    expect(o).toBe("-p 55432 -c shared_preload_libraries=supatype_mask")
+  })
+})
+
+describe("choosing the keyspace port", () => {
+  it("takes the base port when it is free", async () => {
+    await expect(firstFreePort(6390, 5)).resolves.toBe(6390)
+  })
+
+  // 6379 is the first port a developer's own Redis, or a sidecar left running
+  // from a previous `supatype dev`, will be holding.
+  it("steps past a port something else is holding", async () => {
+    const held = createServer()
+    await new Promise<void>((done) => held.listen(6391, "127.0.0.1", done))
+    try {
+      await expect(firstFreePort(6391, 5)).resolves.toBe(6392)
+    } finally {
+      await new Promise<void>((done) => held.close(() => done()))
+    }
+  })
+
+  it("gives up rather than returning a port it could not get", async () => {
+    const held = createServer()
+    await new Promise<void>((done) => held.listen(6393, "127.0.0.1", done))
+    try {
+      await expect(firstFreePort(6393, 1)).resolves.toBeNull()
+    } finally {
+      await new Promise<void>((done) => held.close(() => done()))
+    }
+  })
+})

package/tests/preview-config-check.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "vitest"
+import {
+  modelsWithUnresolvablePreview,
+  unresolvablePreviewMessage,
+} from "../src/preview-config-check.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+
+// A preview address may be a path, because with `app.mode` of `static` or `proxy` this deployment
+// serves the project's app at `/` on the same origin as the API. Studio resolves the path against
+// the origin it is loaded from, so the origin never has to be written down or kept in step.
+//
+// With `app.mode: "none"` nothing is served at `/`. The path then resolves against an origin that
+// answers 404, and the failure lands in front of whoever was *sent* the link rather than whoever
+// configured it. That is the worst possible place for it, so the push refuses instead.
+
+function project(
+  mode: SupatypeProjectConfig["app"]["mode"],
+  livePreview?: Record<string, { url?: string; urlPattern?: string }>,
+): SupatypeProjectConfig {
+  return {
+    project: { name: "acme" },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode },
+    versions: { engine: "0", server: "0", postgres: "0", deno: "0" },
+    ...(livePreview !== undefined && { admin: { livePreview } }),
+  } as SupatypeProjectConfig
+}
+
+describe("preview addresses that could never open", () => {
+  it("refuses a path when nothing is served at /", () => {
+    expect(
+      modelsWithUnresolvablePreview(project("none", { Post: { urlPattern: "/preview/{slug}" } })),
+    ).toEqual(["Post"])
+  })
+
+  it("allows a path when this deployment serves the app", () => {
+    for (const mode of ["static", "proxy"] as const) {
+      expect(
+        modelsWithUnresolvablePreview(project(mode, { Post: { urlPattern: "/preview/{slug}" } })),
+      ).toEqual([])
+    }
+  })
+
+  it("allows an absolute URL in any mode, since it carries its own origin", () => {
+    expect(
+      modelsWithUnresolvablePreview(
+        project("none", { Post: { urlPattern: "https://example.com/p/{slug}" } }),
+      ),
+    ).toEqual([])
+    expect(
+      modelsWithUnresolvablePreview(project("none", { Post: { url: "https://example.com/p" } })),
+    ).toEqual([])
+  })
+
+  it("allows a protocol-relative URL, which already names a host", () => {
+    expect(
+      modelsWithUnresolvablePreview(project("none", { Post: { urlPattern: "//cdn.example/{s}" } })),
+    ).toEqual([])
+  })
+
+  it("says nothing about a model that configured no preview at all", () => {
+    // Not misconfigured, just not configured. Studio asks for the setting where it is needed; a
+    // push has no business refusing over a feature the project has not opted into.
+    expect(modelsWithUnresolvablePreview(project("none", { Post: {} }))).toEqual([])
+    expect(modelsWithUnresolvablePreview(project("none", { Post: { urlPattern: "" } }))).toEqual([])
+    expect(modelsWithUnresolvablePreview(project("none"))).toEqual([])
+  })
+
+  it("names every model at fault, in one go", () => {
+    // An operator fixing these one push at a time is an operator running the push four times.
+    const models = modelsWithUnresolvablePreview(
+      project("none", {
+        Post: { urlPattern: "/p/{slug}" },
+        Author: { urlPattern: "/a/{slug}" },
+        Page: { urlPattern: "https://ok.example/{slug}" },
+      }),
+    )
+    expect(models).toEqual(["Author", "Post"])
+  })
+
+  it("prefers the pattern over the url, which is what Studio does", () => {
+    // A project giving both gets the pattern. Checking the url instead would pass a config that
+    // then renders from the path and breaks.
+    expect(
+      modelsWithUnresolvablePreview(
+        project("none", { Post: { url: "https://example.com", urlPattern: "/p/{slug}" } }),
+      ),
+    ).toEqual(["Post"])
+  })
+})
+
+describe("what the refusal says", () => {
+  it("names the models and the mode that make it unresolvable", () => {
+    const message = unresolvablePreviewMessage(["Author", "Post"])
+    expect(message).toContain("Author, Post")
+    expect(message).toContain('app.mode is "none"')
+  })
+
+  it("reads correctly for a single model", () => {
+    expect(unresolvablePreviewMessage(["Post"])).toContain("that path")
+    expect(unresolvablePreviewMessage(["Post", "Author"])).toContain("those paths")
+  })
+})

package/tests/rest-cache-admin.test.ts

@@ -26,3 +26,39 @@ describe("listRestCacheEntries", () => {
     }
   })
 })
+
+/**
+ * The server answers 503 with "keyspace not configured" now and "valkey not
+ * configured" before the rename. A CLI is routinely newer than the deployment
+ * it is pointed at — and older than one, on a machine that has not updated —
+ * so both have to land on the same explanation.
+ */
+describe("the message for a cache server that is not there", () => {
+  const listAgainst = async (body: string) => {
+    const { listRestCacheEntries } = await import("../src/rest-cache-admin.js")
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = vi.fn(async () => new Response(body, { status: 503 }))
+    try {
+      return await listRestCacheEntries(process.cwd()).then(
+        () => null,
+        (e: unknown) => (e instanceof Error ? e.message : String(e)),
+      )
+    } finally {
+      globalThis.fetch = originalFetch
+    }
+  }
+
+  it("explains either spelling without naming a product the user may not run", async () => {
+    for (const body of ['{"error":"keyspace not configured"}', '{"error":"valkey not configured"}']) {
+      const message = await listAgainst(body)
+      expect(message).toContain("No cache server is configured")
+      expect(message).toContain("supatype dev")
+    }
+  })
+
+  it("does not claim that explanation for an unrelated 503", async () => {
+    const message = await listAgainst('{"error":"upstream timeout"}')
+    expect(message).not.toContain("No cache server is configured")
+    expect(message).toContain("upstream timeout")
+  })
+})

package/tests/runtime-contract.test.ts

@@ -22,6 +22,19 @@ const baseConfig: SupatypeProjectConfig = {
   },
 }
 
+/**
+ * The same project with no `versions.postgres` pin.
+ *
+ * The keyspace is served by the image, and an image pinned to a release older than the toggle
+ * ignores `SUPATYPE_KEYSPACE_ENABLED` and comes up with no RESP listener — which is not an error
+ * anywhere. So a pin resolves the default to Valkey, and the tests about the default have to say
+ * which world they are in rather than inheriting one by accident.
+ */
+const unpinnedPostgres = (config: SupatypeProjectConfig): SupatypeProjectConfig => {
+  const { postgres: _dropped, ...rest } = config.versions ?? {}
+  return { ...config, versions: rest }
+}
+
 describe("runtime contract", () => {
   it("includes core route families", () => {
     const paths = runtimeRouteSpec().flatMap((r) => r.paths)
@@ -568,6 +581,11 @@ export default defineConfig({
       expect(compose).toContain("${SUPATYPE_SERVER_IMAGE:-${SUPATYPE_AUTH_IMAGE:-supatype/server:latest}}")
       expect(compose).toContain("${SUPATYPE_STORAGE_IMAGE:-supatype/storage:latest}")
       expect(compose).toContain("${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}")
+      // SeaweedFS is the object store, and the only one: MinIO's community edition is archived and
+      // its image was withdrawn, so a stack that still named it could not start at all.
+      expect(compose).toContain("  seaweedfs:")
+      expect(compose).toContain("S3_ENDPOINT: http://seaweedfs:8333")
+      expect(compose).not.toContain("minio")
       expect(compose).toContain("SUPATYPE_POSTGREST_URL: http://postgrest:3000")
       expect(compose).toContain("unified gateway")
       const kong = readFileSync(out.kongPath, "utf8")
@@ -579,32 +597,161 @@ export default defineConfig({
     }
   })
 
+  it("renders SeaweedFS with its identities and its own volume", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-seaweed-"))
+    try {
+      const out = writeSelfHostCompose(dir, { ...baseConfig, app: { mode: "none" } })
+      const compose = readFileSync(out.composePath, "utf8")
+
+      expect(compose).toContain("  seaweedfs:")
+      // The storage service has to be pointed at the server that is actually running. Getting this
+      // wrong renders a stack that starts cleanly and fails on the first upload.
+      expect(compose).toContain("S3_ENDPOINT: http://seaweedfs:8333")
+      expect(compose).toContain("-s3.config=/etc/seaweedfs/s3.json")
+      expect(compose).toContain(".supatype/self-host/s3.json:/etc/seaweedfs/s3.json:ro")
+      expect(compose).toContain("  storage-data:")
+
+      // Same credentials in both halves, checked rather than assumed: a mismatch here does not
+      // fail at start, it fails at the first upload, which is a much worse place to find it.
+      const identities = JSON.parse(readFileSync(out.s3ConfigPath, "utf8")) as {
+        identities: { name: string; credentials: { accessKey: string; secretKey: string }[] }[]
+      }
+      const credential = identities.identities[0]?.credentials[0]
+      expect(compose).toContain(`S3_ACCESS_KEY: ${credential?.accessKey}`)
+      expect(compose).toContain(`S3_SECRET_KEY: ${credential?.secretKey}`)
+
+      // No anonymous identity: a bucket is public because of its policy, not because the server is.
+      expect(identities.identities.map((i) => i.name)).not.toContain("anonymous")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
   const tlsConfig: SupatypeProjectConfig = {
     ...baseConfig,
     server: { mode: "standalone", domain: "api.example.com", tls: { email: "ops@example.com" } },
   }
 
-  it("self-host compose renders Kong TLS + Valkey when standalone domain + email are set", () => {
-    const compose = renderSelfHostCompose(tlsConfig)
-    expect(compose).toContain("\n  valkey:\n")
-    expect(compose).toContain("valkey/valkey:8-alpine")
+  it("self-host compose renders Kong TLS with the certificate store in Postgres", () => {
+    const compose = renderSelfHostCompose(unpinnedPostgres(tlsConfig))
     expect(compose).toContain('- "80:8000"')
     expect(compose).toContain('- "443:8443"')
     expect(compose).toContain("KONG_PROXY_LISTEN")
-    expect(compose).toContain("- valkey")
     expect(compose).toContain("https://api.example.com")
-    expect(compose).toMatch(/^\s{2}valkey-data:/m)
     expect(compose).not.toContain("HTTPS is off")
+    // The cert store is the db container, which Kong now depends on instead of a sidecar.
+    expect(compose).toContain("SUPATYPE_VALKEY_ADDR: db:6379")
+    expect(compose).not.toContain("\n  valkey:\n")
   })
 
-  it("self-host compose always includes Valkey and SUPATYPE_VALKEY_ADDR on server", () => {
-    const compose = renderSelfHostCompose(baseConfig)
+  it("self-host compose renders Kong TLS + Valkey where the project keeps the sidecar", () => {
+    const compose = renderSelfHostCompose({ ...tlsConfig, cache: { provider: "valkey" } })
+    expect(compose).toContain("\n  valkey:\n")
+    expect(compose).toContain("valkey/valkey:8-alpine")
+    expect(compose).toContain("- valkey")
+    expect(compose).toMatch(/^\s{2}valkey-data:/m)
+    expect(compose).toContain('- "443:8443"')
+  })
+
+  it("self-host compose includes Valkey and SUPATYPE_VALKEY_ADDR when it is the chosen provider", () => {
+    const compose = renderSelfHostCompose({ ...baseConfig, cache: { provider: "valkey" } })
     expect(compose).toContain("\n  valkey:\n")
     expect(compose).toContain("valkey/valkey:8-alpine")
     expect(compose).toContain("SUPATYPE_VALKEY_ADDR: valkey:6379")
     expect(compose).toMatch(/^\s{2}valkey-data:/m)
   })
 
+  it("self-host compose serves the keyspace from Postgres, which is what it does by default", () => {
+    // Asserted without a `cache` section at all: the default is the behaviour, and a test that
+    // only ever passed `provider: "pg_keyspace"` would go on passing after the default moved back.
+    const compose = renderSelfHostCompose(unpinnedPostgres(baseConfig))
+    // No second stateful service, and nothing left pointing at one.
+    expect(compose).not.toContain("\n  valkey:\n")
+    expect(compose).not.toContain("valkey/valkey:8-alpine")
+    expect(compose).not.toMatch(/^\s{2}valkey-data:/m)
+    expect(compose).not.toContain("      valkey:\n        condition: service_started")
+    expect(compose).toContain("SUPATYPE_VALKEY_ADDR: db:6379")
+    // Turned on from the environment, so the image owns its own preload list.
+    // A copy of that list here would go stale the first time it gains a library.
+    expect(compose).toContain('SUPATYPE_KEYSPACE_ENABLED: "1"')
+    expect(compose).not.toContain("shared_preload_libraries")
+    // Durable keys are rows in a database, and it has to be this one.
+    expect(compose).toContain("SUPATYPE_KEYSPACE_DATABASE: ${POSTGRES_DB:-supatype}")
+    // A cache by default, with certificates the one thing kept.
+    expect(compose).toContain("SUPATYPE_KEYSPACE_DURABILITY: ephemeral")
+    expect(compose).toContain('SUPATYPE_KEYSPACE_DURABILITY_OVERRIDES: "kong_acme:=durable"')
+    // Shared memory is reserved at postmaster start whether or not it is used,
+    // so an unsized keyspace is memory a small host does not have.
+    expect(compose).toContain('SUPATYPE_KEYSPACE_KEYS: "200000"')
+    expect(compose).toContain('SUPATYPE_KEYSPACE_RING_MB: "16"')
+    expect(compose).toContain('SUPATYPE_KEYSPACE_ROWCACHE_MB: "64"')
+    // Reachable to the compose network, not published: RESP on a public
+    // interface is an unauthenticated read of every cached response.
+    expect(compose).toMatch(/expose:\n\s+- "6379"/)
+    expect(compose).not.toMatch(/- "\d+:6379"/)
+  })
+
+  it("self-host compose keeps the certificates durable whether or not TLS is on today", () => {
+    // The override costs nothing while no key matches it, and turning TLS on
+    // later should not need a database restart to make certificates safe.
+    for (const tls of [false, true]) {
+      const compose = renderSelfHostCompose({
+        ...baseConfig,
+        ...(tls
+          ? { server: { ...baseConfig.server, mode: "standalone" as const, domain: "example.test", tls: { email: "ops@example.test" } } }
+          : {}),
+        cache: { provider: "pg_keyspace" },
+      })
+      expect(compose).toContain('SUPATYPE_KEYSPACE_DURABILITY_OVERRIDES: "kong_acme:=durable"')
+    }
+  })
+
+  it("self-host compose keeps Valkey where the project asks for it", () => {
+    // Selectable, not deprecated: a project that wrote this down keeps the sidecar, and the
+    // Postgres it runs beside is left without a keyspace rather than quietly serving one too.
+    const compose = renderSelfHostCompose({ ...baseConfig, cache: { provider: "valkey" } })
+    expect(compose).toContain("\n  valkey:\n")
+    expect(compose).not.toContain("SUPATYPE_KEYSPACE_ENABLED")
+  })
+
+  it("self-host compose keeps Valkey for a project that pins its Postgres image", () => {
+    // The toggle is honoured by the image, from the release that introduced it. An older pinned
+    // image ignores it and starts with no RESP listener — a stack that comes up, and a cache that
+    // never hits. A pin says the image is fixed, and a default must not assume something about a
+    // fixed image it cannot check; `cache: { provider: "pg_keyspace" }` is how a project on a
+    // capable pin says so.
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).toContain("\n  valkey:\n")
+    expect(compose).not.toContain("SUPATYPE_KEYSPACE_ENABLED")
+
+    const asked = renderSelfHostCompose({ ...baseConfig, cache: { provider: "pg_keyspace" } })
+    expect(asked).toContain('SUPATYPE_KEYSPACE_ENABLED: "1"')
+  })
+
+  it("self-host compose gives an external database Valkey, because nothing else can run", () => {
+    // pg_keyspace is loaded through shared_preload_libraries, which is a property of a Postgres
+    // this stack starts. The default has to resolve by itself here: an absent `cache.provider`
+    // cannot mean the same thing beside a managed database and an unmanaged one.
+    const compose = renderSelfHostCompose({
+      ...unpinnedPostgres(baseConfig),
+      database: { external: { url: "postgres://u:p@h:5432/d" } },
+    })
+    expect(compose).toContain("\n  valkey:\n")
+    expect(compose).not.toContain("SUPATYPE_KEYSPACE_ENABLED")
+  })
+
+  it("self-host compose persists the named prefixes alongside the certificates", () => {
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      cache: { provider: "pg_keyspace", durablePrefixes: ["session:", "flag:"] },
+    })
+    expect(compose).toContain("SUPATYPE_KEYSPACE_DURABILITY: ephemeral")
+    // ACME first: a project cannot displace it by naming prefixes of its own.
+    expect(compose).toContain(
+      'SUPATYPE_KEYSPACE_DURABILITY_OVERRIDES: "kong_acme:=durable, session:=durable, flag:=durable"',
+    )
+  })
+
   it("self-host compose stays plain HTTP with a discoverable hint when TLS is off", () => {
     const compose = renderSelfHostCompose(baseConfig)
     expect(compose).not.toContain('- "443:8443"')
@@ -617,23 +764,30 @@ export default defineConfig({
       ...baseConfig,
       server: { mode: "standalone", domain: "api.example.com" },
     })
-    expect(compose).toContain("\n  valkey:\n")
     expect(compose).not.toContain('- "443:8443"')
   })
 
-  it("writeSelfHostCompose emits a Kong acme plugin backed by Valkey when TLS is on", () => {
-    const dir = mkdtempSync(join(tmpdir(), "supatype-tls-"))
-    try {
-      const out = writeSelfHostCompose(dir, tlsConfig)
-      const kong = readFileSync(out.kongPath, "utf8")
-      expect(kong).toContain("name: acme")
-      expect(kong).toContain('account_email: "ops@example.com"')
-      expect(kong).toContain("tos_accepted: true")
-      expect(kong).toContain('- "api.example.com"')
-      expect(kong).toContain("storage: redis")
-      expect(kong).toContain('host: "valkey"')
-    } finally {
-      rmSync(dir, { recursive: true, force: true })
+  it("writeSelfHostCompose emits a Kong acme plugin pointed at whichever RESP server runs", () => {
+    // The certificates are the one thing in the keyspace that must survive a restart, so the host
+    // Kong is told about has to be the one the stack actually started. Both directions asserted:
+    // a mismatch here is a Kong that cannot store its certificate, found on the first renewal.
+    for (const { cache, host } of [
+      { cache: undefined, host: "db" },
+      { cache: { provider: "valkey" as const }, host: "valkey" },
+    ]) {
+      const dir = mkdtempSync(join(tmpdir(), "supatype-tls-"))
+      try {
+        const out = writeSelfHostCompose(dir, { ...unpinnedPostgres(tlsConfig), ...(cache ? { cache } : {}) })
+        const kong = readFileSync(out.kongPath, "utf8")
+        expect(kong).toContain("name: acme")
+        expect(kong).toContain('account_email: "ops@example.com"')
+        expect(kong).toContain("tos_accepted: true")
+        expect(kong).toContain('- "api.example.com"')
+        expect(kong).toContain("storage: redis")
+        expect(kong).toContain(`host: "${host}"`)
+      } finally {
+        rmSync(dir, { recursive: true, force: true })
+      }
     }
   })
 

package/tests/studio-admin-roles.test.ts

@@ -25,3 +25,35 @@ describe("studioAdminRoles", () => {
     expect(merged).toEqual({ models: [], adminRoles: ["ops"] })
   })
 })
+
+describe("where the project says its models render", () => {
+  const livePreview = {
+    Post: { url: "https://example.com", urlPattern: "https://example.com/preview/{slug}" },
+  }
+
+  it("carries livePreview through to the admin config Studio reads", () => {
+    // Studio cannot derive this from the schema: it is a fact about a deployment, not a shape. It
+    // reaches Studio only if this merge puts it in the file.
+    const merged = withAdminRoles({ models: [] }, { ...baseConfig, admin: { livePreview } })
+    expect(merged["livePreview"]).toEqual(livePreview)
+  })
+
+  it("says nothing at all when the project has not configured it", () => {
+    // Absent, not empty. Studio treats an absent entry as "this project has not said", which is
+    // what makes it ask for the setting instead of offering a share link that opens nowhere. An
+    // empty object would read as "configured, with no models".
+    const merged = withAdminRoles({ models: [] }, baseConfig)
+    expect(merged).not.toHaveProperty("livePreview")
+
+    const empty = withAdminRoles({ models: [] }, { ...baseConfig, admin: { livePreview: {} } })
+    expect(empty).not.toHaveProperty("livePreview")
+  })
+
+  it("keeps the roles alongside it, since one merge writes both", () => {
+    const merged = withAdminRoles(
+      { models: [] },
+      { ...baseConfig, admin: { roles: ["ops"], livePreview } },
+    )
+    expect(merged).toEqual({ models: [], adminRoles: ["ops"], livePreview })
+  })
+})