nucleus-core-ts 0.9.781 → 0.9.783

package/dist/src/Services/Integrations/types.d.ts

@@ -0,0 +1,208 @@
+/**
+ * Types for the data-integration engine.
+ *
+ * The engine pulls records from a third-party HTTP API and writes them into one
+ * of this app's own entities. Everything here describes that translation; none of
+ * it knows which customer, which API, or which table — a source is whatever an
+ * operator registered.
+ */
+/** A per-field transform applied to a source value before it lands in a column. */
+export type MappingTransform = 'none' | 'trim' | 'upper' | 'lower' | 'toString' | 'toNumber' | 'toBoolean' | 'dateOnly';
+/** One field of a mapping: external `source` path → internal `target` column. */
+export type FieldMapping = {
+    /** Dot-path into the external record, e.g. `employeeNo` or `department.code`. */
+    source: string;
+    /** Target column, camelCase, e.g. `code` or `locationCode`. */
+    target: string;
+    transform?: MappingTransform;
+    /** Used INSTEAD of reading `source` — a fixed value for every row. */
+    constant?: string;
+    /** Used when the source value resolves to null/undefined/empty. */
+    fallback?: string;
+};
+/**
+ * Where one path/query parameter of an endpoint gets its value.
+ *
+ * `endpoint` is the interesting one: the parent endpoint is fetched first and the
+ * child is called once per parent record. That is how an API that exposes
+ * `/thing/{id}` and nothing else can still be imported in full.
+ *
+ * `entity` closes the other half — the values may already be in OUR table, e.g.
+ * "for every employee I have, fetch their detail record".
+ */
+export type ParamBinding = {
+    param: string;
+    from: 'static';
+    value: string;
+} | {
+    param: string;
+    from: 'endpoint';
+    endpointId: string;
+    field: string;
+} | {
+    param: string;
+    from: 'entity';
+    entity: string;
+    field: string;
+};
+/** A resolved parameter set for ONE child call, plus the parent row it came from. */
+export type ResolvedParams = {
+    values: Record<string, unknown>;
+    /**
+     * The parent record this call was derived from, so a mapping can write parent
+     * fields onto the child's rows (`__parent.name`). Absent for a root endpoint.
+     */
+    parent?: unknown;
+};
+/**
+ * How an endpoint pages, chosen explicitly by the operator.
+ *
+ * Never inferred. A wrong guess reads page one and reports success, and if the
+ * mapping is in `replace` mode that silently destroys everything the first page
+ * did not contain.
+ */
+export type PaginationProfile = {
+    kind: 'none';
+} | {
+    kind: 'page_number';
+    pageParam: string;
+    sizeParam?: string;
+    pageSize?: number;
+    /** First page's number — 0 for Spring, 1 for most others. */
+    firstPage?: number;
+    /** Dot-path to the total RECORD count in the response, if the API reports one. */
+    totalPath?: string;
+    /** Dot-path to a boolean saying this is the final page, if the API reports one. */
+    lastPagePath?: string;
+} | {
+    kind: 'offset';
+    offsetParam: string;
+    limitParam: string;
+    pageSize?: number;
+    totalPath?: string;
+} | {
+    kind: 'cursor';
+    cursorParam: string;
+    /** Dot-path to the next cursor in the response. Absent/empty ends the walk. */
+    nextCursorPath: string;
+    sizeParam?: string;
+    pageSize?: number;
+} | {
+    kind: 'link_header';
+    sizeParam?: string;
+    pageSize?: number;
+};
+/** One page's worth of the walk: what came back, and whether to keep going. */
+export type PageOutcome = {
+    records: unknown[];
+    /** Params to add to the NEXT request, or null when the walk is finished. */
+    nextParams: Record<string, string> | null;
+    /** Total the source claims to hold, when it reports one. */
+    reportedTotal: number | null;
+};
+/** A mapped internal row plus the provenance needed to report on it. */
+export type MappedRecord = {
+    /** Row payload (camelCase target fields), ready for validation. */
+    data: Record<string, unknown>;
+    /** Value of the dedup column, when the mapping configures one. */
+    dedupKey: string | null;
+    /** Zero-based index in the fetched set, so an issue can name the record. */
+    sourceIndex: number;
+};
+export type WriteMode = 'upsert' | 'append' | 'replace';
+export type MissingRecordPolicy = 'ignore' | 'deactivate' | 'delete';
+export type RunStatus = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled' | 'reverted';
+/**
+ * A problem with ONE source record.
+ *
+ * Distinct from a run-level error: issues describe records, errors describe the
+ * run. A run that skips two records for missing fields has two issues and no
+ * errors, and it still succeeds.
+ */
+export type RunIssue = {
+    sourceIndex: number;
+    kind: 'missing_required' | 'missing_dedup_key' | 'duplicate_in_batch' | 'invalid_value' | 'unmapped';
+    message: string;
+    dedupKey?: string | null;
+};
+/** Why a run refused to start or had to stop. */
+export type RunFailure = {
+    kind: 'fetch_failed';
+    message: string;
+} | {
+    kind: 'validation_failed';
+    message: string;
+    issues: RunIssue[];
+} | {
+    kind: 'incomplete_source';
+    message: string;
+    fetched: number;
+    reported: number;
+} | {
+    kind: 'too_many_records';
+    message: string;
+    fetched: number;
+    limit: number;
+} | {
+    kind: 'cycle_detected';
+    message: string;
+    chain: string[];
+} | {
+    kind: 'already_running';
+    message: string;
+} | {
+    kind: 'cancelled';
+    message: string;
+} | {
+    kind: 'write_failed';
+    message: string;
+};
+/** What a run would do, computed without writing anything. */
+export type RunPlan = {
+    targetEntity: string;
+    writeMode: WriteMode;
+    totalFetched: number;
+    reportedTotal: number | null;
+    toCreate: number;
+    toUpdate: number;
+    toSkip: number;
+    /** Rows here but no longer in the source, and what the policy does with them. */
+    missing: number;
+    missingPolicy: MissingRecordPolicy;
+    existingCount: number;
+    dedupConfigured: boolean;
+    issues: RunIssue[];
+    warnings: string[];
+    /** A few mapped rows so an operator can eyeball the mapping before committing. */
+    sample: Record<string, unknown>[];
+};
+/** The outcome of an applied run. */
+export type RunReport = {
+    runId: string;
+    status: RunStatus;
+    targetEntity: string;
+    writeMode: WriteMode;
+    totalFetched: number;
+    reportedTotal: number | null;
+    createdCount: number;
+    updatedCount: number;
+    skippedCount: number;
+    deletedCount: number;
+    deactivatedCount: number;
+    externalCallCount: number;
+    issues: RunIssue[];
+    errors: string[];
+    failure: RunFailure | null;
+    /** False once the before-images have aged out. */
+    revertible: boolean;
+};
+/** Progress published on the run's realtime topic while it works. */
+export type RunProgress = {
+    runId: string;
+    phase: 'fetching' | 'mapping' | 'validating' | 'writing' | 'done';
+    /** Records seen so far. Absent when the phase has no meaningful count. */
+    processed?: number;
+    /** Total the engine expects, when it knows it. */
+    total?: number;
+    message?: string;
+};

package/dist/src/Services/Integrations/writer.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Applying a run's writes — all of them, or none of them.
+ *
+ * ## Why this exists at all
+ *
+ * The engine this replaces wrote through its own HTTP API, looping back to
+ * `127.0.0.1` for every batch. A ten-thousand-record replace became roughly a
+ * hundred loopback requests, and nucleus opened and committed a SEPARATE
+ * transaction for each one. So a failure at request forty left thirty-nine
+ * batches permanently written, with nothing to roll back to — the table half
+ * deleted and half rewritten, and a report that said "success" because the
+ * caller only ever checked HTTP status codes.
+ *
+ * Here the writes go straight to the database inside ONE transaction. Atomicity
+ * stops being something to arrange and becomes the default: any throw unwinds
+ * everything.
+ *
+ * ## The ordering that makes it safe
+ *
+ * 1. Validate EVERY payload — before the transaction opens. A single invalid row
+ *    aborts the run having written nothing. Doing this inside the transaction is
+ *    what let a partially-applied batch commit elsewhere in this codebase, and
+ *    the mistake is easy to repeat: returning early from inside a drizzle
+ *    transaction callback COMMITS, because only a throw rolls back.
+ * 2. Read the before-images of everything about to change, so a run that lands
+ *    correctly can still be undone later.
+ * 3. Write, inside the transaction, deletes first so a unique constraint freed by
+ *    a delete is available to an insert in the same run.
+ *
+ * ## Ownership
+ *
+ * `scopeConditions` come from the caller's own claims and are ANDed onto every
+ * update and delete. A scoped grant must not become "any row" just because the
+ * write arrived through the integration engine rather than the entity routes.
+ */
+import { type SQL } from 'drizzle-orm';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import type { NucleusColumn } from '../../types';
+import type { Logger } from '../Logger';
+import type { WriteOperations } from './plan';
+import type { RunFailure, RunIssue } from './types';
+type DrizzleTable = any;
+export type ValidatePayload = (payload: Record<string, unknown>, columns: NucleusColumn[], isPartial?: boolean) => {
+    valid: boolean;
+    errors: {
+        field: string;
+        message: string;
+    }[];
+};
+export type WriterDeps = {
+    db: NodePgDatabase;
+    drizzleTable: DrizzleTable;
+    /** Maps a field name to its drizzle column, or undefined when it does not exist. */
+    resolveCol: (field: string) => unknown;
+    columns: NucleusColumn[];
+    logger: Logger;
+    /** Injected so this module does not import the plugin's util barrel. */
+    validatePayload: ValidatePayload;
+};
+/** What a row looked like before this run touched it. */
+export type PreImage = {
+    targetEntity: string;
+    rowId: string | null;
+    action: 'create' | 'update' | 'delete' | 'deactivate';
+    before: Record<string, unknown> | null;
+    after: Record<string, unknown> | null;
+};
+export type ApplyInput = {
+    ops: WriteOperations;
+    targetEntity: string;
+    userId: string;
+    /** Ownership predicates from the caller's claims. ANDed onto updates/deletes. */
+    scopeConditions?: SQL[];
+    /** Column and value written to rows the source no longer carries. */
+    missingColumn?: string | null;
+    missingValue?: string | null;
+    /** Checked between statements so a cancel actually stops the work. */
+    isCancelled?: () => boolean;
+};
+export type ApplyResult = {
+    ok: true;
+    created: number;
+    updated: number;
+    deleted: number;
+    deactivated: number;
+    preImages: PreImage[];
+} | {
+    ok: false;
+    failure: RunFailure;
+};
+/**
+ * Validates every payload the run would write.
+ *
+ * Deliberately separate and called FIRST: an operator finding out at record 5000
+ * that record 12 was invalid, with 4999 rows already committed, is the failure
+ * this ordering exists to prevent.
+ */
+export declare function validateAll(ops: WriteOperations, columns: NucleusColumn[], validatePayload: ValidatePayload): RunIssue[];
+/**
+ * Executes the plan. Returns a failure instead of throwing for the cases a caller
+ * must report (invalid data, cancellation); a genuine database error unwinds the
+ * transaction and comes back as `write_failed`.
+ */
+export declare function applyWrites(deps: WriterDeps, input: ApplyInput): Promise<ApplyResult>;
+export {};

package/dist/src/Services/Integrations/writer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/Utils/cron.d.ts

@@ -0,0 +1,65 @@
+/**
+ * A standard five-field cron evaluator: "when does this expression next fire?"
+ *
+ * Written because the backup scheduler had its own parser that read the minute
+ * and hour and silently discarded day-of-month, month and day-of-week
+ * (`Services/Backup/BackupService.ts`, `getNextDelayMs`). `0 2 * * 0` — a job
+ * an operator wrote to mean "Sundays at 02:00" — ran every night. Nothing
+ * errored, and the only symptom was seven times the expected number of backups.
+ *
+ * Kept as a general utility rather than a backup detail: any scheduled work in
+ * nucleus needs the same answer, and a second hand-rolled parser is how the
+ * first one's bug gets recreated.
+ *
+ * ## Time zones
+ *
+ * `nextCronRun` interprets the expression in an IANA zone, defaulting to UTC.
+ * The old scheduler used `Date.setHours`, i.e. the container's local zone —
+ * which in these deployments is UTC, so an operator in Istanbul asking for
+ * 02:00 got 05:00 local and had no way to say otherwise.
+ *
+ * An unknown zone falls back to UTC instead of throwing: a typo in a config
+ * string must not stop a service from booting.
+ *
+ * ## What is supported
+ *
+ * Five fields with `*`, values, `a-b` ranges, `/step`, and comma lists; the
+ * three-letter month and day names (`JAN`, `MON`); and the `@daily`-family
+ * macros. Names and macros are here because refusing them is not a neutral act:
+ * a caller that treats null as "do not schedule" then stops scheduling
+ * altogether, which is how supporting fewer forms turned into taking no backups.
+ *
+ * ## What is not
+ *
+ * `L`, `W`, `#`, `@reboot`, and second-resolution (six-field) expressions.
+ * `parseCron` returns null for these rather than guessing. A caller must decide
+ * what null means for it — and for anything whose job is to run periodically,
+ * the safe reading is "fall back to a known-good schedule and say so loudly",
+ * not "do nothing".
+ */
+export type CronFields = {
+    minute: Set<number>;
+    hour: Set<number>;
+    /** Day of month, 1-31. */
+    day: Set<number>;
+    /** Month, 1-12. */
+    month: Set<number>;
+    /** Day of week, 0-6 with 0 = Sunday. A `7` in the expression normalizes to 0. */
+    weekday: Set<number>;
+    /** True when the field was literally `*`, which decides the day-of-month/weekday OR. */
+    dayUnrestricted: boolean;
+    weekdayUnrestricted: boolean;
+};
+/** Parses a five-field expression or an `@`-macro; null when not fully understood. */
+export declare function parseCron(expression: string): CronFields | null;
+/**
+ * The next instant strictly after `from` at which `expression` fires.
+ *
+ * Returns null when the expression cannot be parsed, or when it matches nothing
+ * within roughly four years (`0 0 30 2 *` — 30 February). Callers must treat
+ * null as "do not schedule": inventing a fallback interval is how a job that
+ * was never meant to run ends up running daily.
+ */
+export declare function nextCronRun(expression: string, from?: Date, timeZone?: string): Date | null;
+/** Milliseconds until the next run, or null when the expression never fires. */
+export declare function msUntilNextCronRun(expression: string, from?: Date, timeZone?: string): number | null;

package/dist/src/Utils/cron.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/types.d.ts

@@ -1,6 +1,6 @@
 /** biome-ignore-all lint/suspicious/noExplicitAny: <drizzle column builders are complex> */
 import type { Algorithm, AuditSeverity } from 'src/Services';
-export type SystemTableFeatureSets = 'authentication' | 'authorization' | 'audit' | 'backup' | 'notification' | 'verification' | 'multi-tenant' | 'payment' | 'storage' | 'chat' | 'monitoring' | 'domains' | 'secrets';
+export type SystemTableFeatureSets = 'authentication' | 'authorization' | 'audit' | 'backup' | 'notification' | 'verification' | 'multi-tenant' | 'payment' | 'storage' | 'chat' | 'monitoring' | 'domains' | 'secrets' | 'integrations';
 export type GenericNucleusMethods = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'TOGGLE' | 'VERIFICATION';
 export type NucleusColumnType = 'integer' | 'smallint' | 'bigint' | 'serial' | 'smallserial' | 'bigserial' | 'real' | 'doublePrecision' | 'numeric' | 'decimal' | 'text' | 'varchar' | 'char' | 'uuid' | 'boolean' | 'date' | 'time' | 'timestamp' | 'timestamptz' | 'interval' | 'json' | 'jsonb' | 'bytea' | 'inet' | 'cidr' | 'macaddr' | 'macaddr8' | 'bit' | 'bitVarying' | 'point' | 'line' | 'lseg' | 'box' | 'path' | 'polygon' | 'circle' | 'tsvector' | 'tsquery' | 'xml' | 'money' | 'int4range' | 'int8range' | 'numrange' | 'tsrange' | 'tstzrange' | 'daterange' | 'int4multirange' | 'int8multirange' | 'nummultirange' | 'tsmultirange' | 'tstzmultirange' | 'datemultirange' | 'vector' | 'geometry' | 'geography' | 'customType';
 export type NucleusFKAction = 'cascade' | 'restrict' | 'no action' | 'set null' | 'set default';
@@ -691,6 +691,50 @@ export interface NucleusConfigOptions {
             basePath?: string;
         };
     };
+    /**
+     * Pulls data from third-party HTTP APIs into this app's own entities.
+     *
+     * An operator registers a source (base URL + credentials), the endpoints on it,
+     * and a mapping from each endpoint's response onto a target entity. A run then
+     * fetches, maps, validates and writes — as ONE database transaction, so a run
+     * either lands completely or leaves nothing behind.
+     *
+     * The source's address carries no scheme requirement: `http://` to a service in
+     * the same cluster is as valid as `https://` to the public internet.
+     */
+    integrations?: {
+        enabled?: boolean;
+        /** Route prefix for the run/test/preview endpoints. Default: `/integrations`. */
+        basePath?: string;
+        /**
+         * Roles allowed to configure sources and start runs, alongside godmin. A run
+         * writes to arbitrary entities, so this is effectively an administrative
+         * grant; empty means godmin only.
+         */
+        adminRoles?: string[];
+        /**
+         * Ceiling on records held for one run. A run assembles everything before it
+         * writes anything — that is what makes it atomic — so the ceiling is real
+         * memory, and exceeding it fails the run instead of the process. Default: 50000.
+         */
+        maxRecordsPerRun?: number;
+        /**
+         * Concurrent child requests when an endpoint fans out over another endpoint's
+         * records (one call per parent row). Default: 4 — deliberately low, because
+         * the far side is somebody else's production API.
+         */
+        maxConcurrentFanout?: number;
+        /**
+         * How long a SUCCEEDED run stays revertible. Before-images are kept for this
+         * long; after it, the run reports that it can no longer be undone rather than
+         * offering a button that quietly does nothing. Default: `30d`.
+         */
+        retainPreImagesFor?: string;
+        /** Fallback per-request timeout when a source doesn't set its own. Default: 30000. */
+        requestTimeoutMs?: number;
+        /** Prefix for the realtime topic a run publishes progress on. Default: `integrations`. */
+        realtimeTopicPrefix?: string;
+    };
     notification?: {
         enabled?: boolean;
         channels?: {
@@ -949,8 +993,30 @@ export interface NucleusConfigOptions {
         encryptionKey?: string;
         schedule?: {
             enabled?: boolean;
+            /**
+             * Standard five-field cron: `minute hour day-of-month month day-of-week`,
+             * with `*`, values, `a-b` ranges, `/step`, comma lists, three-letter names
+             * (`MON`, `JAN`) and the `@daily` family of macros.
+             *
+             * All five fields are honoured. They were not always: the previous
+             * evaluator read only minute and hour, so `0 3 * * 0` — Sundays at 03:00 —
+             * ran every night.
+             *
+             * An expression that cannot be read falls back to `0 2 * * *` and logs an
+             * error. Refusing to schedule would be worse: the old evaluator ran
+             * anything it did not understand every 24h, so a deployment with an exotic
+             * expression was being backed up, and silently stopping that trades a
+             * backup at the wrong hour for no backup at all.
+             */
             cron?: string;
             retentionDays?: number;
+            /**
+             * IANA time zone the cron expression is read in, e.g. `Europe/Istanbul`.
+             * Defaults to UTC. Previously the container's own clock decided, which
+             * meant the configured hour and the operator's hour were different numbers
+             * with nothing saying so.
+             */
+            timeZone?: string;
         };
     };
     entities: NucleusTable[];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.781",
+	"version": "0.9.783",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",

package/schemas/config.nucleus.json

@@ -1032,6 +1032,49 @@
         }
       }
     },
+    "integrations": {
+      "type": "object",
+      "description": "Pulls data from third-party HTTP APIs into this app's own entities. A run fetches, maps, validates and writes as ONE transaction.",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "basePath": {
+          "type": "string",
+          "description": "Route prefix for run/test/preview endpoints. Default: /integrations"
+        },
+        "adminRoles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Roles allowed to configure sources and start runs, alongside godmin. Empty means godmin only."
+        },
+        "maxRecordsPerRun": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Ceiling on records held for one run. Default: 50000"
+        },
+        "maxConcurrentFanout": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Concurrent child requests when an endpoint fans out over another endpoint's records. Default: 4"
+        },
+        "retainPreImagesFor": {
+          "type": "string",
+          "description": "How long a succeeded run stays revertible, e.g. 30d. Default: 30d"
+        },
+        "requestTimeoutMs": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Fallback per-request timeout when a source doesn't set its own. Default: 30000"
+        },
+        "realtimeTopicPrefix": {
+          "type": "string",
+          "description": "Prefix for the realtime topic a run publishes progress on. Default: integrations"
+        }
+      }
+    },
     "notification": {
       "type": "object",
       "properties": {

package/schemas/table.schema.json

@@ -25,7 +25,8 @@
           "chat",
           "monitoring",
           "domains",
-          "secrets"
+          "secrets",
+          "integrations"
         ]
       }
     },

package/scripts/generate-schema.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'bun:test'
+import { selectEmittedTables } from './generate-schema'
+
+const table = (table_name: string) => ({ table_name })
+
+const sets = (over: { system?: string[]; enabled?: string[]; custom?: string[] }) => ({
+  systemTableNames: new Set(over.system ?? []),
+  enabledTableNames: new Set(over.enabled ?? []),
+  customTableNames: new Set(over.custom ?? []),
+})
+
+describe('selectEmittedTables', () => {
+  it('emits a plain config entity', () => {
+    const out = selectEmittedTables([table('employees')], sets({ custom: ['employees'] }))
+    expect(out.map((t) => t.table_name)).toEqual(['employees'])
+  })
+
+  it('emits a system table whose feature is on', () => {
+    const out = selectEmittedTables(
+      [table('verifications')],
+      sets({ system: ['verifications'], enabled: ['verifications'] })
+    )
+    expect(out).toHaveLength(1)
+  })
+
+  it('drops a system table whose feature is off', () => {
+    const out = selectEmittedTables([table('verifications')], sets({ system: ['verifications'] }))
+    expect(out).toEqual([])
+  })
+
+  describe('a new built-in must not delete an app table of the same name', () => {
+    // The regression: nucleus shipped `integration_sources` as a system table.
+    // An app that already had its OWN table by that name, and has not turned the
+    // new feature on, saw it vanish from the generated schema — and on a
+    // deployment with allowDataLoss the next push DROPS it, with its contents.
+    it('keeps the app’s table when the new feature is off', () => {
+      const out = selectEmittedTables(
+        [table('integration_sources')],
+        sets({ system: ['integration_sources'], custom: ['integration_sources'] })
+      )
+      expect(out.map((t) => t.table_name)).toEqual(['integration_sources'])
+    })
+
+    it('still keeps it when the feature is on — the app definition won the merge', () => {
+      const out = selectEmittedTables(
+        [table('integration_sources')],
+        sets({
+          system: ['integration_sources'],
+          enabled: ['integration_sources'],
+          custom: ['integration_sources'],
+        })
+      )
+      expect(out).toHaveLength(1)
+    })
+
+    it('does not resurrect a built-in the app never declared', () => {
+      // The other half: a table only nucleus knows about stays gated by its
+      // feature, so enabling nothing adds nothing.
+      const out = selectEmittedTables(
+        [table('integration_run_items')],
+        sets({ system: ['integration_run_items'], custom: ['integration_sources'] })
+      )
+      expect(out).toEqual([])
+    })
+  })
+
+  it('preserves order', () => {
+    const out = selectEmittedTables(
+      [table('a'), table('b'), table('c')],
+      sets({ custom: ['a', 'b', 'c'] })
+    )
+    expect(out.map((t) => t.table_name)).toEqual(['a', 'b', 'c'])
+  })
+
+  it('emits nothing from nothing', () => {
+    expect(selectEmittedTables([], sets({}))).toEqual([])
+  })
+})