rastack 0.0.50 → 0.0.52

package/test/compile.spec.ts

@@ -81,7 +81,10 @@ describe("rastack compile — resource analysis & FK inference", () => {
 
     const airportField = terminal.fields.find((f) => f.name === "airport");
     expect(airportField?.type).toBe("fk");
-    expect(airportField?.relation).toEqual({ app: "airports", model: "airport" });
+    expect(airportField?.relation).toEqual({
+      app: "airports",
+      model: "airport",
+    });
 
     expect(terminal.relations).toEqual([
       { field: "airport", target: "airports.airport", kind: "fk" },
@@ -132,7 +135,9 @@ describe("rastack compile — resource analysis & FK inference", () => {
     });
 
     // Resources without an access block stay unstamped.
-    expect(findResource(resources, "airports", "airport").access).toBeUndefined();
+    expect(
+      findResource(resources, "airports", "airport").access,
+    ).toBeUndefined();
   });
 
   it("reports no collisions for a valid graph", () => {
@@ -176,9 +181,9 @@ describe("rastack compile — OpenAPI emission", () => {
     // Local-mode sync extensions, confirmed on update.
     const flightList = doc.paths["/api/airports/v1/flight/"];
     expect(flightList.get["x-rastack-sync"]).toBe("local");
-    expect(doc.paths["/api/airports/v1/flight/{id}/"].put["x-rastack-sync"]).toBe(
-      "confirmed",
-    );
+    expect(
+      doc.paths["/api/airports/v1/flight/{id}/"].put["x-rastack-sync"],
+    ).toBe("confirmed");
     expect(doc.paths["/api/airports/v1/gate/"].get["x-rastack-sync-load"]).toBe(
       "lazy",
     );
@@ -186,19 +191,25 @@ describe("rastack compile — OpenAPI emission", () => {
       doc.paths["/api/airports/v1/booking/"].post["x-rastack-sync-client-ids"],
     ).toBe(true);
 
-    // Access-controlled resource carries the access extension on every op.
+    // Access-controlled resource carries the full policy on every op — the
+    // permission gate plus the access block `rastack/auth` mirrors in the UI.
     const itineraryList = doc.paths["/api/airports/v1/itinerary/"];
+    expect(itineraryList.get["x-rastack-permission"]).toBe("authenticated");
     expect(itineraryList.get["x-rastack-access"]).toEqual({
       ownerField: "owner",
       scope: "owner",
+      adminGroups: ["staff"],
     });
     expect(
       doc.paths["/api/airports/v1/itinerary/{id}/"].delete["x-rastack-access"],
-    ).toEqual({ ownerField: "owner", scope: "owner" });
+    ).toEqual({ ownerField: "owner", scope: "owner", adminGroups: ["staff"] });
     // Unscoped resources stay unstamped.
     expect(
       doc.paths["/api/airports/v1/airport/"].get["x-rastack-access"],
     ).toBeUndefined();
+    expect(
+      doc.paths["/api/airports/v1/airport/"].get["x-rastack-permission"],
+    ).toBeUndefined();
   });
 
   it("round-trips through the existing hooks codegen", async () => {

package/test/components.spec.ts

@@ -16,6 +16,7 @@ import {
   resolveFieldSpecs,
 } from "../components/auto-form/fields";
 import { buildAutoFormModel } from "../components/auto-form/use-auto-form";
+import { anonymousAuth, userAuth, type ResourcePolicy } from "../auth/core";
 import type {
   TableQuery,
   AutoFormLike,
@@ -406,3 +407,118 @@ describe("buildAutoFormModel — wiring a form hook into field descriptors", ()
     expect(transition).toHaveBeenCalledWith("board");
   });
 });
+
+// Auth handling built into the components: the models mirror the server's
+// `permission` gate + row-level security (rastack/auth) so the UI never
+// offers a write the API would reject.
+describe("component models — authorization gating", () => {
+  const rls: ResourcePolicy = {
+    permission: "authenticated",
+    access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
+  };
+  const readOnly: ResourcePolicy = { permission: "authenticatedOrReadOnly" };
+
+  const makeField = (): AutoFormField =>
+    ({
+      value: "",
+      error: "",
+      type: "text",
+      isChecked: false,
+      isError: false,
+      isDisabled: false,
+      isRequired: false,
+      setValue: jest.fn(),
+      setTouched: jest.fn(),
+    }) as unknown as AutoFormField;
+
+  const form: AutoFormLike = {
+    formValues: { owner: "u1", notes: "hi" },
+    getFormField: () => makeField(),
+    onSubmit: jest.fn(),
+    resetForm: jest.fn(),
+    isSubmitDisabled: false,
+    isSubmitting: false,
+    errors: {},
+  };
+
+  it("auto-form: anonymous writes are blocked by the permission gate", () => {
+    const model = buildAutoFormModel(form, {
+      auth: anonymousAuth(),
+      policy: readOnly,
+      action: "update",
+    });
+    expect(model.canWrite).toBe(false);
+    expect(model.canSubmit).toBe(false);
+
+    const asUser = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: readOnly,
+    });
+    expect(asUser.canWrite).toBe(true);
+  });
+
+  it("auto-form: no identity wired up ⇒ ungated (server stays the enforcer)", () => {
+    const model = buildAutoFormModel(form, { policy: rls });
+    expect(model.canWrite).toBe(true);
+    expect(model.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+  });
+
+  it("auto-form: hides the server-stamped owner field, except for RLS bypassers", () => {
+    const model = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: rls,
+    });
+    expect(model.fields.map((f) => f.name)).toEqual(["notes"]);
+
+    const staff = buildAutoFormModel(form, {
+      auth: userAuth("u1", ["staff"]),
+      policy: rls,
+    });
+    expect(staff.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+
+    // An explicit field list is the author's call — never overridden.
+    const explicit = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: rls,
+      fields: ["owner", "notes"],
+    });
+    expect(explicit.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+  });
+
+  it("data-table: canRead / can / canActOnRow mirror the server's rules", () => {
+    const query = {
+      data: [
+        { id: 1, owner: "u1" },
+        { id: 2, owner: "u2" },
+      ],
+      isLoading: false,
+    } as TableQuery<{ id: number; owner: string }>;
+
+    const anon = buildDataTableModel(query, {
+      auth: anonymousAuth(),
+      policy: rls,
+    });
+    expect(anon.canRead).toBe(false);
+
+    const mine = buildDataTableModel(query, {
+      auth: userAuth("u1"),
+      policy: rls,
+    });
+    expect(mine.canRead).toBe(true);
+    expect(mine.can("delete")).toBe(true);
+    expect(mine.canActOnRow("delete", { id: 1, owner: "u1" })).toBe(true);
+    expect(mine.canActOnRow("delete", { id: 2, owner: "u2" })).toBe(false);
+
+    const anonPublicRead = buildDataTableModel(query, {
+      auth: anonymousAuth(),
+      policy: readOnly,
+    });
+    expect(anonPublicRead.canRead).toBe(true);
+    expect(anonPublicRead.can("create")).toBe(false);
+
+    // No identity wired up ⇒ everything stays enabled.
+    const ungated = buildDataTableModel(query, { policy: rls });
+    expect(ungated.canRead).toBe(true);
+    expect(ungated.can("delete")).toBe(true);
+  });
+});

package/test/entities.spec.ts

@@ -17,6 +17,7 @@ import {
 const workRoot = join(__dirname, "entities-fixtures");
 const appDir = join(workRoot, "app");
 const classesDir = join(workRoot, "classes");
+const authDir = join(workRoot, "auth");
 const cycleDir = join(workRoot, "cycles");
 const hardCycleDir = join(workRoot, "hard-cycles");
 const mixedDir = join(workRoot, "mixed");
@@ -82,7 +83,7 @@ import {
   PrimaryKey,
   Unique,
   UUID,
-} from "rastack/types";
+} from "rastack/db";
 import { Terminal } from "./airports";
 
 /** A reusable column config — "extend DbConfig once, use it everywhere". */
@@ -184,6 +185,60 @@ export class BoardingService {
 export class SplashScreen extends BoardingService {}
 `;
 
+const AUTH_TS = `
+import {
+  AdminGroups,
+  Group,
+  IsAuthenticated,
+  IsAuthenticatedOrReadOnly,
+  Owner,
+  OwnerScoped,
+  SharedStorage,
+} from "rastack/auth";
+
+// Per-user rows: RLS on owner, physically partitioned per identity. The
+// implements clause is policy, not behaviour — still a plain data class.
+export class Itinerary
+  implements IsAuthenticated, AdminGroups<"staff">, OwnerScoped
+{
+  owner!: string & Owner;
+  notes!: string;
+}
+
+// A group-owned dataset — physically partitioned per group by default.
+export class Report
+  implements IsAuthenticatedOrReadOnly, AdminGroups<"staff" | "ops">
+{
+  team!: string & Group;
+  title!: string;
+}
+
+// Group RLS, but explicitly opted out of per-group storage.
+export class Note implements SharedStorage {
+  team!: string & Group;
+  body!: string;
+}
+
+// Interfaces attach the same markers with extends.
+export interface Memo extends IsAuthenticated, AdminGroups<"staff"> {
+  body: string;
+}
+
+/** JSDoc equivalents, tag-for-marker.
+ * @rastackResource
+ * @rastackPermission public
+ * @rastackAdminGroups staff, ops
+ */
+export interface Bulletin {
+  /** @owner */
+  author: string;
+  text: string;
+}
+
+declare function useEntityList<T>(name: string): T[];
+export const m = useEntityList<Memo>("memos");
+`;
+
 function findResource(
   resources: ResourceModel[],
   app: string,
@@ -202,6 +257,8 @@ beforeAll(() => {
   writeFileSync(join(appDir, "screens.tsx"), SCREENS_TSX);
   mkdirSync(classesDir, { recursive: true });
   writeFileSync(join(classesDir, "airports.ts"), CLASSES_TS);
+  mkdirSync(authDir, { recursive: true });
+  writeFileSync(join(authDir, "workspace.ts"), AUTH_TS);
   mkdirSync(cycleDir, { recursive: true });
   writeFileSync(join(cycleDir, "org.ts"), SOFT_CYCLE_TS);
   mkdirSync(hardCycleDir, { recursive: true });
@@ -254,7 +311,10 @@ describe("interface entities — datatypes from the type system", () => {
     expect(field("onTime")).toMatchObject({ type: "bool" });
     expect(field("departure")).toMatchObject({ type: "datetime" });
     expect(field("notes")).toMatchObject({ type: "string", null: true });
-    expect(field("status")).toMatchObject({ type: "string", default: "scheduled" });
+    expect(field("status")).toMatchObject({
+      type: "string",
+      default: "scheduled",
+    });
   });
 
   it("reads constraint tags (@maxLength/@unique) off interface properties", () => {
@@ -270,13 +330,17 @@ describe("interface entities — datatypes from the type system", () => {
   it("reads column config from DbConfig brand types", () => {
     const { resources } = analyzeProject(appDir);
     const passenger = findResource(resources, "passengers", "passenger");
-    const field = (name: string) => passenger.fields.find((f) => f.name === name);
+    const field = (name: string) =>
+      passenger.fields.find((f) => f.name === name);
 
     expect(field("id")).toMatchObject({ type: "uuid", primaryKey: true });
     expect(field("fullName")).toMatchObject({ type: "string", maxLength: 80 });
     expect(field("age")).toMatchObject({ type: "int" });
     expect(field("loyaltyPoints")).toMatchObject({ type: "float", default: 0 });
-    expect(field("status")).toMatchObject({ type: "string", default: "active" });
+    expect(field("status")).toMatchObject({
+      type: "string",
+      default: "active",
+    });
     expect(field("terminal")).toMatchObject({
       type: "fk",
       null: true,
@@ -305,7 +369,8 @@ describe("interface entities — datatypes from the type system", () => {
     expect(flight.fields.find((f) => f.name === "tags")).toBeUndefined();
     expect(
       diagnostics.some(
-        (d) => d.severity === "warning" && d.message.includes("flights.flight.tags"),
+        (d) =>
+          d.severity === "warning" && d.message.includes("flights.flight.tags"),
       ),
     ).toBe(true);
   });
@@ -406,10 +471,62 @@ describe("class entities — plain data classes", () => {
   });
 });
 
+describe("entity access policy — auth as types", () => {
+  it("reads permission / adminGroups / scope markers off a class's implements clause", () => {
+    const { resources } = analyzeProject(authDir);
+    const itinerary = findResource(resources, "workspace", "itinerary");
+    expect(itinerary.permission).toBe("authenticated");
+    expect(itinerary.access).toEqual({
+      ownerField: "owner",
+      scope: "owner",
+      adminGroups: ["staff"],
+    });
+  });
+
+  it("a Group field makes a group-owned dataset — partitioned per group by default", () => {
+    const { resources } = analyzeProject(authDir);
+    const report = findResource(resources, "workspace", "report");
+    expect(report.permission).toBe("authenticatedOrReadOnly");
+    expect(report.access).toEqual({
+      groupField: "team",
+      scope: "group",
+      adminGroups: ["ops", "staff"],
+    });
+    // The group column is an ordinary string field in the schema.
+    expect(report.fields.find((f) => f.name === "team")?.type).toBe("string");
+  });
+
+  it("SharedStorage opts a Group dataset out of physical partitioning", () => {
+    const { resources } = analyzeProject(authDir);
+    const note = findResource(resources, "workspace", "note");
+    expect(note.access).toEqual({ groupField: "team", scope: "shared" });
+  });
+
+  it("interfaces attach markers via extends; markers add no columns", () => {
+    const { resources } = analyzeProject(authDir);
+    const memo = findResource(resources, "workspace", "memo");
+    expect(memo.permission).toBe("authenticated");
+    expect(memo.access).toEqual({ adminGroups: ["staff"] });
+    expect(memo.fields.map((f) => f.name)).toEqual(["body"]);
+  });
+
+  it("JSDoc tags mirror every marker (@rastackPermission/@rastackAdminGroups/@owner)", () => {
+    const { resources } = analyzeProject(authDir);
+    const bulletin = findResource(resources, "workspace", "bulletin");
+    expect(bulletin.permission).toBe("public");
+    expect(bulletin.access).toEqual({
+      ownerField: "author",
+      adminGroups: ["staff", "ops"],
+    });
+  });
+});
+
 describe("interface entities — circular dependencies", () => {
   it("reports a breakable cycle (optional self-FK) as a warning", () => {
     const { diagnostics } = analyzeProject(cycleDir);
-    const cycle = diagnostics.find((d) => d.message.includes("Circular dependency"));
+    const cycle = diagnostics.find((d) =>
+      d.message.includes("Circular dependency"),
+    );
     expect(cycle).toBeDefined();
     expect(cycle!.severity).toBe("warning");
     expect(cycle!.message).toContain("org.employee → org.employee");

package/test/plugin.spec.ts

@@ -0,0 +1,315 @@
+/**
+ * The dev-server schema compiler (`rastack/plugin`) — the way around
+ * "classes need a compile step". The plugin runs the same
+ * `analyzeProject`/`compile` pass as the CLI *inside* the bundler: entities
+ * authored as plain classes/interfaces become the `virtual:rastack-manifest`
+ * module, recompiled on save, with `rastack-env.d.ts` kept fresh and the
+ * last good manifest served through broken in-progress edits.
+ */
+
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import {
+  GLOBAL_MANIFEST_KEY,
+  isEntitySource,
+  manifestModuleCode,
+  rastackPlugin,
+  registerModuleCode,
+  resolveOptions,
+  RESOLVED_MANIFEST_ID,
+  startRastackWatcher,
+  VIRTUAL_MANIFEST_ID,
+  VIRTUAL_REGISTER_ID,
+  virtualModuleDts,
+} from "../src/plugin";
+import { getGlobalManifest } from "../hooks/manifest";
+import { resolveEntityRef } from "../hooks/entity";
+
+const workRoot = join(__dirname, "plugin-fixtures");
+const resourcesDir = join(workRoot, "entities");
+const outDir = join(workRoot, ".rastack");
+
+// Plain classes + a hook-rooted interface — no resource() DSL anywhere.
+const GOOD_SOURCE = `
+export class Airport {
+  code!: string;
+  name!: string;
+}
+
+export class Terminal {
+  airport!: Airport;   // FK — inferred from the type
+  label!: string;
+}
+`;
+
+// An all-required FK cycle — a compile *error* (the mid-edit breakage case).
+const BROKEN_SOURCE = `
+export class Airport {
+  code!: string;
+  home!: Terminal;
+}
+
+export class Terminal {
+  airport!: Airport;
+  label!: string;
+}
+`;
+
+function writeEntities(source: string): void {
+  writeFileSync(join(resourcesDir, "airports.ts"), source);
+}
+
+beforeEach(() => {
+  rmSync(workRoot, { recursive: true, force: true });
+  mkdirSync(resourcesDir, { recursive: true });
+  writeEntities(GOOD_SOURCE);
+});
+
+afterAll(() => {
+  rmSync(workRoot, { recursive: true, force: true });
+});
+
+function makePlugin(overrides: Record<string, unknown> = {}) {
+  return rastackPlugin({
+    resourcesDir,
+    outDir,
+    onError: () => {},
+    ...overrides,
+  });
+}
+
+describe("rastackPlugin — the bundler hooks", () => {
+  it("serves class entities as the virtual manifest module", () => {
+    const plugin = makePlugin();
+    plugin.buildStart();
+
+    expect(plugin.resolveId(VIRTUAL_MANIFEST_ID)).toBe(RESOLVED_MANIFEST_ID);
+    expect(plugin.resolveId("some/other/module")).toBeUndefined();
+
+    const code = plugin.load(RESOLVED_MANIFEST_ID)!;
+    expect(code).toContain("export default manifest");
+    const manifest = plugin.api.manifest();
+    expect(code).toContain(JSON.stringify(manifest));
+
+    // The classes were compiled: fields read off the type system, the
+    // Airport-typed property inferred as a foreign key.
+    // The app name derives from the defining file (airports.ts → "airports").
+    const terminal = manifest.resources.find((r) => r.model === "terminal")!;
+    expect(terminal.relations).toEqual([
+      { field: "airport", target: "airports.airport", kind: "fk" },
+    ]);
+    expect(manifestModuleCode(manifest)).toBe(code);
+  });
+
+  it("writes the artifacts — schema, openapi, env.d.ts, virtual-module types", () => {
+    makePlugin().buildStart();
+    expect(existsSync(join(outDir, "schema.rastack.json"))).toBe(true);
+    expect(existsSync(join(outDir, "openapi.json"))).toBe(true);
+
+    const env = readFileSync(join(outDir, "rastack-env.d.ts"), "utf8");
+    expect(env).toContain('"airports.airport": import("../entities/airports").Airport;');
+
+    const dts = readFileSync(join(outDir, "rastack-plugin.d.ts"), "utf8");
+    expect(dts).toBe(virtualModuleDts());
+    expect(dts).toContain(`declare module "${VIRTUAL_MANIFEST_ID}"`);
+  });
+
+  it("recompiles when a watched entity changes", () => {
+    const plugin = makePlugin();
+    plugin.buildStart();
+    expect(
+      plugin.api.manifest().resources.map((r) => r.model),
+    ).toEqual(["airport", "terminal"]);
+
+    writeEntities(GOOD_SOURCE + "\nexport class Gate { number!: string }\n");
+    plugin.watchChange(join(resourcesDir, "airports.ts"));
+
+    expect(plugin.api.manifest().resources.map((r) => r.model)).toEqual([
+      "airport",
+      "gate",
+      "terminal",
+    ]);
+    expect(plugin.load(RESOLVED_MANIFEST_ID)).toContain('"gate"');
+  });
+
+  it("keeps serving the last good manifest through a broken edit", () => {
+    const errors: unknown[] = [];
+    const plugin = makePlugin({ onError: (e: unknown) => errors.push(e) });
+    plugin.buildStart();
+    const goodCode = plugin.load(RESOLVED_MANIFEST_ID);
+
+    writeEntities(BROKEN_SOURCE);
+    plugin.watchChange(join(resourcesDir, "airports.ts"));
+
+    // The compile failed (reported), but the app keeps its manifest.
+    expect(plugin.load(RESOLVED_MANIFEST_ID)).toBe(goodCode);
+    expect(errors).toHaveLength(1);
+    expect(String((errors[0] as Error).message)).toMatch(/circular/i);
+    expect(plugin.api.error()).toBe(errors[0]);
+
+    // Fixing the file recovers on the next change (load() recompiles).
+    writeEntities(GOOD_SOURCE);
+    plugin.watchChange(join(resourcesDir, "airports.ts"));
+    expect(plugin.load(RESOLVED_MANIFEST_ID)).toBe(goodCode);
+    expect(plugin.api.error()).toBeUndefined();
+  });
+
+  it("throws at startup when there is no good manifest to fall back to", () => {
+    writeEntities(BROKEN_SOURCE);
+    const plugin = makePlugin();
+    expect(() => plugin.buildStart()).toThrow(/circular/i);
+  });
+
+  it("hot-invalidates the virtual module in a Vite-shaped server", () => {
+    const plugin = makePlugin();
+    plugin.buildStart();
+
+    const virtualModule = { id: RESOLVED_MANIFEST_ID };
+    const invalidated: unknown[] = [];
+    const server = {
+      moduleGraph: {
+        getModuleById: (id: string) =>
+          id === RESOLVED_MANIFEST_ID ? virtualModule : undefined,
+        invalidateModule: (mod: unknown) => invalidated.push(mod),
+      },
+    };
+
+    const changed = { id: "changed" };
+    const result = plugin.handleHotUpdate({
+      file: join(resourcesDir, "airports.ts"),
+      server,
+      modules: [changed],
+    });
+    expect(invalidated).toEqual([virtualModule]);
+    expect(result).toEqual([changed, virtualModule]);
+
+    // Unrelated files don't touch the schema.
+    expect(
+      plugin.handleHotUpdate({
+        file: join(workRoot, "App.tsx"),
+        server,
+        modules: [changed],
+      }),
+    ).toBeUndefined();
+  });
+});
+
+describe("auto-registration — no manifest prop anywhere", () => {
+  afterEach(() => {
+    delete (globalThis as Record<string, unknown>)[GLOBAL_MANIFEST_KEY];
+  });
+
+  it("serves a register module that publishes the manifest globally", () => {
+    const plugin = makePlugin();
+    plugin.buildStart();
+
+    expect(plugin.resolveId(VIRTUAL_REGISTER_ID)).toBe(VIRTUAL_REGISTER_ID);
+    const code = plugin.load(VIRTUAL_REGISTER_ID)!;
+    expect(code).toBe(registerModuleCode());
+    expect(code).toContain(`import manifest from "${VIRTUAL_MANIFEST_ID}"`);
+    expect(code).toContain(`globalThis.${GLOBAL_MANIFEST_KEY} = manifest`);
+  });
+
+  it("injects the register script into index.html (dev src, build inline)", () => {
+    const plugin = makePlugin();
+    expect(plugin.transformIndexHtml.order).toBe("pre");
+
+    const dev = plugin.transformIndexHtml.handler("<html/>", { server: {} });
+    expect(dev).toEqual([
+      {
+        tag: "script",
+        attrs: { type: "module", src: `/@id/${VIRTUAL_REGISTER_ID}` },
+        injectTo: "head-prepend",
+      },
+    ]);
+
+    const build = plugin.transformIndexHtml.handler("<html/>", {});
+    expect(build).toEqual([
+      {
+        tag: "script",
+        attrs: { type: "module" },
+        children: `import "${VIRTUAL_REGISTER_ID}";`,
+        injectTo: "head-prepend",
+      },
+    ]);
+  });
+
+  it("the runtime falls back to the registered global manifest", () => {
+    class Airport {
+      code!: string;
+    }
+    // Nothing registered → the class cannot resolve without a manifest.
+    expect(getGlobalManifest()).toBeUndefined();
+    expect(() => resolveEntityRef(Airport, getGlobalManifest())).toThrow(
+      /manifest/,
+    );
+
+    // What the injected register module does at boot:
+    (globalThis as Record<string, unknown>)[GLOBAL_MANIFEST_KEY] = {
+      version: 1,
+      resources: [
+        { app: "airports", model: "airport", fields: [], relations: [] },
+      ],
+    };
+
+    const manifest = getGlobalManifest()!;
+    expect(manifest.resources).toHaveLength(1);
+    expect(getGlobalManifest()).toBe(manifest); // cached per assignment
+    // useRastackManifest (which useData/useForm read outside any provider)
+    // falls back to this global, so a bare useData(Airport) resolves with
+    // zero schema wiring in app code.
+    expect(resolveEntityRef(Airport, getGlobalManifest()).listUrl).toBe(
+      "/api/airports/v1/airport/",
+    );
+  });
+});
+
+describe("isEntitySource — what triggers a recompile", () => {
+  const options = resolveOptions({ resourcesDir, outDir }, workRoot);
+
+  it("accepts .ts/.tsx under the resources dir and nothing else", () => {
+    expect(isEntitySource(join(resourcesDir, "a.ts"), options)).toBe(true);
+    expect(isEntitySource(join(resourcesDir, "deep", "b.tsx"), options)).toBe(true);
+    expect(isEntitySource(join(resourcesDir, "a.d.ts"), options)).toBe(false);
+    expect(isEntitySource(join(resourcesDir, "notes.md"), options)).toBe(false);
+    expect(isEntitySource(join(workRoot, "elsewhere.ts"), options)).toBe(false);
+    // The emitted artifacts must never re-trigger the compiler.
+    expect(isEntitySource(join(outDir, "rastack-env.d.ts"), options)).toBe(false);
+  });
+});
+
+describe("startRastackWatcher — the non-Rollup dev servers", () => {
+  it("compiles at start and rewrites artifacts on save", async () => {
+    const watcher = startRastackWatcher({
+      resourcesDir,
+      outDir,
+      onError: () => {},
+    });
+    try {
+      expect(existsSync(join(outDir, "schema.rastack.json"))).toBe(true);
+      expect(
+        watcher.state.manifest().resources.map((r) => r.model),
+      ).toEqual(["airport", "terminal"]);
+
+      writeEntities(GOOD_SOURCE + "\nexport class Gate { number!: string }\n");
+      await waitFor(() =>
+        readFileSync(join(outDir, "schema.rastack.json"), "utf8").includes(
+          '"gate"',
+        ),
+      );
+    } finally {
+      watcher.close();
+    }
+  });
+});
+
+async function waitFor(check: () => boolean, timeoutMs = 5000): Promise<void> {
+  const start = Date.now();
+  for (;;) {
+    if (check()) return;
+    if (Date.now() - start > timeoutMs) {
+      throw new Error("waitFor: condition not met in time");
+    }
+    await new Promise((r) => setTimeout(r, 50));
+  }
+}