@flowdular/sdk 0.3.0 → 0.3.1

package/modules/connectors/src/services/migration.ts

@@ -111,6 +111,28 @@ async function combined(
 	return 'partial';
 }
 
+/* Mirrors migrations/0003_connectors_rotation_inventory.up.sql byte for byte. */
+export const CONNECTORS_MIGRATION_003 = `-- The credential key rotation has to find the instances still sealed with a
+-- retired key before it knows whose they are, so the cross-tenant role may read
+-- the key id of every row that holds an envelope and nothing else: the nonce,
+-- the tag, the ciphertext and the fingerprint stay unreadable on this
+-- connection, and every row it re-seals is read again under the workspace that
+-- row named. PostgreSQL checks column privileges in WHERE too, so the key id is
+-- part of the grant.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY connectors_instances_background_policy ON connectors_instances
+  FOR SELECT TO coreloom_background
+  USING (credential_key_id IS NOT NULL);
+REVOKE SELECT ON connectors_instances FROM coreloom_background;
+GRANT SELECT (tenant_id, credential_key_id) ON connectors_instances TO coreloom_background;
+`;
+
 export const databaseMigrations: readonly DatabaseMigration[] = [
 	{
 		id: '0001_connectors_core',
@@ -163,4 +185,18 @@ export const databaseMigrations: readonly DatabaseMigration[] = [
 				],
 			),
 	},
+	{
+		id: '0003_connectors_rotation_inventory',
+		sql: { postgresql: CONNECTORS_MIGRATION_003 },
+		/* A policy and a column grant leave no schema object behind, so the
+		   privilege itself is what proves this migration ran. */
+		inspectExisting: async (database) => {
+			const result = await database.query<{ granted: boolean }>({
+				text: `SELECT CASE WHEN to_regclass('connectors_instances') IS NOT NULL THEN
+				  has_column_privilege('coreloom_background', 'connectors_instances', 'credential_key_id', 'SELECT')
+				ELSE false END AS granted`,
+			});
+			return result.rows[0]?.granted === true ? 'complete' : 'absent';
+		},
+	},
 ];

package/modules/documents/migrations/0003_documents_rotation_inventory.down.sql

@@ -0,0 +1,2 @@
+REVOKE SELECT (tenant_id, status) ON documents_files FROM coreloom_background;
+DROP POLICY IF EXISTS documents_files_background_policy ON documents_files;

package/modules/documents/migrations/0003_documents_rotation_inventory.up.sql

@@ -0,0 +1,18 @@
+-- The storage key rotation has to find the workspaces that still hold objects
+-- before it knows which objects those are, so the cross-tenant role may count
+-- stored rows by workspace and nothing else: the storage key, the record and
+-- the file name stay invisible to it, and every object it names is read again
+-- under the workspace that row named. PostgreSQL checks column privileges in
+-- WHERE too, so `status` is part of the grant.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY documents_files_background_policy ON documents_files
+  FOR SELECT TO coreloom_background
+  USING (status = 'stored');
+REVOKE SELECT ON documents_files FROM coreloom_background;
+GRANT SELECT (tenant_id, status) ON documents_files TO coreloom_background;

package/modules/documents/module.json

@@ -3,10 +3,10 @@
 	"schemaVersion": 1,
 	"id": "documents.core",
 	"package": "@flowdular/module-documents",
-	"version": "0.1.8",
+	"version": "0.1.9",
 	"platformApi": "^0.1.0",
 	"profile": "full",
-	"capabilities": ["api", "database", "client", "translations"],
+	"capabilities": ["api", "database", "client", "translations", "cli"],
 	"platform": {
 		"server": true,
 		"client": true
@@ -24,5 +24,9 @@
 	"provides": ["documents.attachments.v1"],
 	"tenancy": "required",
 	"locales": ["en", "pl"],
-	"stability": "experimental"
+	"stability": "experimental",
+	"cli": {
+		"catalog": "src/cli/commands.json",
+		"entry": "src/cli/index.ts"
+	}
 }

package/modules/documents/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-documents",
-	"version": "0.1.8",
+	"version": "0.1.9",
 	"private": true,
 	"type": "module",
 	"exports": {
@@ -28,6 +28,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
+		"@flowdular/cli-protocol": "workspace:*",
 		"@flowdular/client": "workspace:*",
 		"@flowdular/contracts": "workspace:*",
 		"@flowdular/database": "workspace:*",

package/modules/documents/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: documents.core
-specVersion: 0.1.8
+specVersion: 0.1.9
 status: approved
 name: Documents Core
 description: Lets a workspace attach files to its records through the platform storage port, owning only the document metadata and the reference to the record, with tenant-scoped keys, encrypted bytes, size and type limits, and a scan state, so a module attaches by reference and never holds bytes.
@@ -10,6 +10,7 @@ capabilities:
   - database
   - client
   - translations
+  - cli
 dependencies:
   - id: system.core
     range: ^0.7.0

package/modules/documents/src/cli/commands.json

@@ -0,0 +1,17 @@
+{
+	"protocolVersion": 1,
+	"moduleId": "documents.core",
+	"commands": [
+		{
+			"path": ["documents", "secrets-rotate"],
+			"capability": {
+				"id": "documents.storage.rotate",
+				"version": 1,
+				"summary": "Re-seal stored document objects with the current storage encryption key.",
+				"risk": "process",
+				"requiresApprovedSpec": false,
+				"supportsDryRun": true
+			}
+		}
+	]
+}

package/modules/documents/src/cli/index.ts

@@ -0,0 +1,145 @@
+import {
+	defineCliExtension,
+	type CliExtensionContext,
+} from '@flowdular/sdk/cli-protocol';
+import {
+	DATABASE_CAPABILITY_IDS,
+	DATABASE_DIALECT_IDS,
+	type DatabaseAdapterLease,
+} from '@flowdular/sdk/database';
+import {
+	createStorageKeyring,
+	createStoragePort,
+	storageConfigFromEnvironment,
+} from '@flowdular/sdk/storage';
+import { migrateDocumentsDatabase } from '../services/database-repository.ts';
+import {
+	rotateDocumentObjects,
+	type StorageRotationReport,
+} from '../services/storage-rotation.ts';
+
+const rotateCapability = {
+	id: 'documents.storage.rotate',
+	version: 1,
+	summary:
+		'Re-seal stored document objects with the current storage encryption key.',
+	risk: 'process' as const,
+	requiresApprovedSpec: false,
+	supportsDryRun: true,
+};
+
+interface OpenDatabase {
+	readonly leases: readonly DatabaseAdapterLease[];
+	readonly runtime: DatabaseAdapterLease;
+	readonly background: DatabaseAdapterLease;
+}
+
+/* The operator command reads the same deployment database the platform does;
+   the runner owns the provider and a module owns no driver, so it arrives on
+   the context. It may be the first thing to touch a fresh database, so it
+   migrates before reading. */
+async function open(context: CliExtensionContext): Promise<OpenDatabase> {
+	const databases = context.databases;
+	if (!databases) {
+		throw new Error(
+			'documents.core CLI commands read the deployment database, and this workspace has none configured.',
+		);
+	}
+	const requirements = {
+		dialectIds: [DATABASE_DIALECT_IDS.postgresql],
+		capabilities: [DATABASE_CAPABILITY_IDS.TRANSACTIONS],
+	};
+	const migration = await databases.acquire({
+		namespace: 'documents.core',
+		purpose: 'migration',
+		requirements,
+	});
+	await migrateDocumentsDatabase(migration.database);
+	const runtime = await databases.acquire({
+		namespace: 'documents.core',
+		purpose: 'runtime',
+		requirements,
+	});
+	/* The inventory lists workspaces across the whole deployment, which only
+	   the cross-tenant read-only role may do. */
+	const background = await databases.acquire({
+		namespace: 'documents.core',
+		purpose: 'background',
+		requirements,
+	});
+	return { leases: [migration, runtime, background], runtime, background };
+}
+
+/* The provider belongs to the runner; only the leases this command took are
+   released here. */
+async function close(open: OpenDatabase): Promise<void> {
+	for (const lease of open.leases) await lease.release();
+}
+
+export function storageRotationWarnings(
+	report: StorageRotationReport,
+	variable: string,
+): string[] {
+	const warnings: string[] = [];
+	if (report.unknown > 0) {
+		warnings.push(
+			`${report.unknown} objects are sealed under a key this ring does not hold and were left as they are. Put that key back in ${variable}_PREVIOUS before retiring it.`,
+		);
+	}
+	if (report.refused > 0) {
+		warnings.push(
+			`${report.refused} objects failed authentication under the key they name and were left as they are. Restore them from the object store backup.`,
+		);
+	}
+	if (report.missing > 0) {
+		warnings.push(
+			`${report.missing} rows name an object the store no longer holds.`,
+		);
+	}
+	return warnings;
+}
+
+export const cliExtension = defineCliExtension({
+	protocolVersion: 1,
+	moduleId: 'documents.core',
+	commands: [
+		{
+			path: ['documents', 'secrets-rotate'],
+			capability: rotateCapability,
+			execute: async (context) => {
+				/* The report names key ids and counts only; no object content
+				   reaches the command output. The port is the platform's own, built
+				   from the same environment the server reads. */
+				const storage = createStoragePort(
+					storageConfigFromEnvironment(process.env, context.workspaceRoot),
+					{ keyring: createStorageKeyring(process.env, context.workspaceRoot) },
+				);
+				const opened = await open(context);
+				try {
+					const report = await rotateDocumentObjects({
+						runtime: opened.runtime.database,
+						background: opened.background.database,
+						storage,
+						apply: context.apply,
+					});
+					return {
+						data: { moduleId: 'documents.core', ...report },
+						evidence: [
+							'modules/documents/spec/module.yaml',
+							'docs/operations.md',
+						],
+						warnings: storageRotationWarnings(
+							report,
+							'FD_STORAGE_ENCRYPTION_KEY',
+						),
+					};
+				} finally {
+					await close(opened);
+					await storage.dispose();
+				}
+			},
+		},
+	],
+});
+
+export default cliExtension;

package/modules/documents/src/services/database-repository.ts

@@ -69,6 +69,9 @@ const SQL = {
 	 WHERE tenant_id = $1 AND owner_module = $2 AND record_ref = $3 AND id = $4`,
 	create: `INSERT INTO documents_files (${COLUMNS})
 	 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+	lockStored: `SELECT id FROM documents_files
+	 WHERE tenant_id = $1 AND id = $2 AND status = 'stored'
+	 FOR UPDATE`,
 	markDeleted: `UPDATE documents_files SET status = 'deleted'
 	 WHERE tenant_id = $1 AND id = $2 AND status = 'stored'
 	 RETURNING ${COLUMNS}`,
@@ -226,16 +229,24 @@ export class DatabaseDocumentsRepository implements DocumentsRepository {
 	async markDeleted(
 		tenantId: string,
 		id: string,
+		discard: () => Promise<void>,
 	): Promise<DocumentsFile | null> {
 		const result = await this.database.transaction(
-			(transaction) =>
-				transaction.query<DocumentsFileRow>({
+			async (transaction) => {
+				const locked = await transaction.query<{ id: string }>({
+					text: SQL.lockStored,
+					parameters: [tenantId, id],
+				});
+				if (locked.rows.length === 0) return null;
+				await discard();
+				return transaction.query<DocumentsFileRow>({
 					text: SQL.markDeleted,
 					parameters: [tenantId, id],
-				}),
+				});
+			},
 			{ access: 'write', tenantId },
 		);
-		const row = result.rows[0];
+		const row = result?.rows[0];
 		return row ? fromRow(row) : null;
 	}
 

package/modules/documents/src/services/documents-service.ts

@@ -381,19 +381,20 @@ export class DocumentsService {
 		};
 	}
 
-	/** The object first, the row after, so no row ever outlives its bytes. */
+	/**
+	 * The object first, the row after, so no row ever outlives its bytes; both
+	 * under the row lock, so a rewrite of the object cannot slip in between.
+	 */
 	async remove(tenantId: string, id: string): Promise<DocumentsFile> {
 		const tenant = this.tenant(tenantId);
 		const record = await this.require(tenant, id);
 		if (record.status === 'deleted') return record;
-		await this.storage.delete(this.referenceOf(record));
 		/* A null means another request deleted the row between the read and the
-		   update; the object is gone either way, so the answer is the same. */
+		   lock; the object is gone either way, so the answer is the same. */
 		return (
-			(await this.repository.markDeleted(tenant, id)) ?? {
-				...record,
-				status: 'deleted',
-			}
+			(await this.repository.markDeleted(tenant, id, () =>
+				this.storage.delete(this.referenceOf(record)).then(() => undefined),
+			)) ?? { ...record, status: 'deleted' }
 		);
 	}
 
@@ -469,8 +470,11 @@ export class DocumentsService {
 			bounded(id, 'id', 1, DOCUMENT_LIMITS.id),
 		);
 		if (!record || record.status === 'deleted') return false;
-		await this.storage.delete(this.referenceOf(record));
-		return (await this.repository.markDeleted(tenant, id)) !== null;
+		return (
+			(await this.repository.markDeleted(tenant, id, () =>
+				this.storage.delete(this.referenceOf(record)).then(() => undefined),
+			)) !== null
+		);
 	}
 
 	private async remainingBytes(tenantId: string): Promise<number> {

package/modules/documents/src/services/migration.ts

@@ -52,6 +52,27 @@ CREATE INDEX IF NOT EXISTS documents_files_page_idx
   ON documents_files (tenant_id, created_at DESC, id DESC);
 `;
 
+/* Mirrors migrations/0003_documents_rotation_inventory.up.sql byte for byte. */
+export const DOCUMENTS_MIGRATION_003 = `-- The storage key rotation has to find the workspaces that still hold objects
+-- before it knows which objects those are, so the cross-tenant role may count
+-- stored rows by workspace and nothing else: the storage key, the record and
+-- the file name stay invisible to it, and every object it names is read again
+-- under the workspace that row named. PostgreSQL checks column privileges in
+-- WHERE too, so \`status\` is part of the grant.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY documents_files_background_policy ON documents_files
+  FOR SELECT TO coreloom_background
+  USING (status = 'stored');
+REVOKE SELECT ON documents_files FROM coreloom_background;
+GRANT SELECT (tenant_id, status) ON documents_files TO coreloom_background;
+`;
+
 export const databaseMigrations: readonly DatabaseMigration[] = [
 	{
 		id: '0001_documents_core',
@@ -79,4 +100,18 @@ export const databaseMigrations: readonly DatabaseMigration[] = [
 				() => database.schema.hasIndex('documents_files_page_idx'),
 			]),
 	},
+	{
+		id: '0003_documents_rotation_inventory',
+		sql: { postgresql: DOCUMENTS_MIGRATION_003 },
+		/* A policy and a column grant leave no schema object behind, so the
+		   privilege itself is what proves this migration ran. */
+		inspectExisting: async (database) => {
+			const result = await database.query<{ granted: boolean }>({
+				text: `SELECT CASE WHEN to_regclass('documents_files') IS NOT NULL THEN
+				  has_column_privilege('coreloom_background', 'documents_files', 'status', 'SELECT')
+				ELSE false END AS granted`,
+			});
+			return result.rows[0]?.granted === true ? 'complete' : 'absent';
+		},
+	},
 ];

package/modules/documents/src/services/repository.ts

@@ -41,8 +41,18 @@ export interface DocumentsRepository {
 		id: string,
 	): Promise<DocumentsFile | null>;
 	create(record: DocumentsFile): Promise<DocumentsFile>;
-	/** The updated row, or null when it was already deleted or never existed. */
-	markDeleted(tenantId: string, id: string): Promise<DocumentsFile | null>;
+	/**
+	 * Locks the stored row, runs `discard` while it is held, then marks the row
+	 * deleted. Null when it was already deleted or never existed, in which case
+	 * `discard` does not run. The lock orders the delete against a pass that
+	 * rewrites the object under the same lock, so neither can leave an object
+	 * the other does not see.
+	 */
+	markDeleted(
+		tenantId: string,
+		id: string,
+		discard: () => Promise<void>,
+	): Promise<DocumentsFile | null>;
 	/** Bytes the workspace still stores; the quota is measured against it. */
 	storedBytes(tenantId: string): Promise<number>;
 }

package/modules/documents/src/services/storage-rotation.ts

@@ -0,0 +1,157 @@
+import type { DatabaseHandle } from '@flowdular/sdk/database';
+import type {
+	StorageObjectRef,
+	StorageResealCount,
+	StorageResealPort,
+} from '@flowdular/sdk/storage';
+
+/** Objects walked inside one tenant-scoped transaction. */
+export const STORAGE_ROTATION_BATCH = 200;
+
+export const STORAGE_ROTATION_TABLE = 'documents_files';
+
+export interface StorageRotationReport {
+	readonly table: string;
+	/** Key id every object should end on: the current key of the storage ring. */
+	readonly currentKeyId: string;
+	readonly counts: readonly StorageResealCount[];
+	readonly tenants: number;
+	/** Stored rows the pass walked. */
+	readonly objects: number;
+	/** Objects on a retired key the ring still holds when the run started. */
+	readonly stale: number;
+	readonly resealed: number;
+	/** Objects under a key id the ring does not hold; left as they are. */
+	readonly unknown: number;
+	/** Objects that failed authentication; left as they are. */
+	readonly refused: number;
+	/** Stored rows whose object the store no longer holds. */
+	readonly missing: number;
+}
+
+export interface StorageRotationOptions {
+	/** Tenant-scoped handle. Every row is read on it. */
+	readonly runtime: DatabaseHandle;
+	/** Cross-tenant handle. It is granted the tenant id and the status and nothing else. */
+	readonly background: DatabaseHandle;
+	readonly storage: StorageResealPort;
+	readonly apply?: boolean;
+	readonly batchSize?: number;
+}
+
+const SQL = {
+	tenants: `SELECT tenant_id, count(*) AS row_count
+	          FROM documents_files
+	          WHERE status = 'stored'
+	          GROUP BY tenant_id
+	          ORDER BY tenant_id`,
+	/* Paged by primary key. The rows are locked while their objects are
+	   rewritten, so a delete that marks one of them waits for the batch and
+	   then removes the re-sealed object instead of racing its rewrite. */
+	batch: `SELECT id, storage_key
+	        FROM documents_files
+	        WHERE tenant_id = $1 AND status = 'stored' AND id > $2
+	        ORDER BY id
+	        LIMIT $3
+	        FOR UPDATE`,
+	inventoryBatch: `SELECT id, storage_key
+	                 FROM documents_files
+	                 WHERE tenant_id = $1 AND status = 'stored' AND id > $2
+	                 ORDER BY id
+	                 LIMIT $3`,
+};
+
+function count(value: number | bigint | string): number {
+	const normalized = Number(value);
+	if (!Number.isSafeInteger(normalized)) {
+		throw new Error('The documents database returned an invalid count.');
+	}
+	return normalized;
+}
+
+/* The row is the inventory, and its key names the tenant it was written under;
+   a row whose key names another tenant is a defect, not an object to rewrite. */
+function referenceOf(tenantId: string, storageKey: string): StorageObjectRef {
+	const [tenant, moduleId, objectId, ...rest] = storageKey.split('/');
+	if (tenant !== tenantId || !moduleId || !objectId || rest.length > 0) {
+		throw new Error(
+			`A documents_files row of ${tenantId} names the storage key ${storageKey}, which is not one of its objects.`,
+		);
+	}
+	return { tenantId, moduleId, objectId };
+}
+
+/**
+ * Re-seals every stored document object that is not on the current storage
+ * key. The workspaces are listed once on the cross-tenant role, and each batch
+ * of rows is read under its own tenant; the objects they name are read from
+ * the store, and the stale ones rewritten in place. It is idempotent: a second
+ * run finds nothing to do.
+ */
+export async function rotateDocumentObjects(
+	options: StorageRotationOptions,
+): Promise<StorageRotationReport> {
+	const apply = options.apply === true;
+	const batchSize = options.batchSize ?? STORAGE_ROTATION_BATCH;
+	const inventory = await options.background.transaction(
+		(transaction) =>
+			transaction.query<{
+				tenant_id: string;
+				row_count: number | bigint | string;
+			}>({ text: SQL.tenants }),
+		{ access: 'read' },
+	);
+	const counts = new Map<string, number>();
+	let objects = 0;
+	let stale = 0;
+	let resealed = 0;
+	let unknown = 0;
+	let refused = 0;
+	let missing = 0;
+	for (const { tenant_id: tenantId, row_count: rowCount } of inventory.rows) {
+		objects += count(rowCount);
+		let cursor = '';
+		for (;;) {
+			const batch = await options.runtime.transaction(
+				async (transaction) => {
+					const rows = (
+						await transaction.query<{ id: string; storage_key: string }>({
+							text: apply ? SQL.batch : SQL.inventoryBatch,
+							parameters: [tenantId, cursor, batchSize],
+						})
+					).rows;
+					const report = await options.storage.reseal(
+						rows.map((row) => referenceOf(tenantId, row.storage_key)),
+						{ apply },
+					);
+					return { read: rows.length, last: rows.at(-1)?.id, report };
+				},
+				{ access: apply ? 'write' : 'read', tenantId },
+			);
+			for (const entry of batch.report.counts) {
+				counts.set(entry.keyId, (counts.get(entry.keyId) ?? 0) + entry.objects);
+			}
+			stale += batch.report.stale;
+			resealed += batch.report.resealed;
+			unknown += batch.report.unknown;
+			refused += batch.report.refused;
+			missing += batch.report.missing;
+			if (batch.read < batchSize || batch.last === undefined) break;
+			cursor = batch.last;
+		}
+	}
+	return {
+		table: STORAGE_ROTATION_TABLE,
+		currentKeyId: options.storage.keyId,
+		counts: [...counts]
+			.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+			.map(([keyId, total]) => ({ keyId, objects: total })),
+		tenants: inventory.rows.length,
+		objects,
+		stale,
+		resealed,
+		unknown,
+		refused,
+		missing,
+	};
+}

package/modules/exports/migrations/0003_exports_rotation_inventory.down.sql

@@ -0,0 +1 @@
+DROP POLICY IF EXISTS exports_jobs_rotation_policy ON exports_jobs;

package/modules/exports/migrations/0003_exports_rotation_inventory.up.sql

@@ -0,0 +1,9 @@
+-- The storage key rotation has to find the workspaces that still hold export
+-- files before it knows which files those are. The routing policy shows the
+-- background role only waiting and running jobs; this one adds the completed
+-- jobs under the same four routing columns, so the object id, the list, the
+-- requester and every count stay invisible to it, and every file it names is
+-- read again under the workspace that row named.
+CREATE POLICY exports_jobs_rotation_policy ON exports_jobs
+  FOR SELECT TO coreloom_background
+  USING (status = 'completed');

package/modules/exports/module.json

@@ -3,10 +3,10 @@
 	"schemaVersion": 1,
 	"id": "exports.core",
 	"package": "@flowdular/module-exports",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"platformApi": "^0.1.2",
 	"profile": "full",
-	"capabilities": ["api", "database", "client", "translations"],
+	"capabilities": ["api", "database", "client", "translations", "cli"],
 	"platform": {
 		"server": true,
 		"client": true
@@ -24,5 +24,9 @@
 	"provides": ["exports.lists.v1"],
 	"tenancy": "required",
 	"locales": ["en", "pl"],
-	"stability": "experimental"
+	"stability": "experimental",
+	"cli": {
+		"catalog": "src/cli/commands.json",
+		"entry": "src/cli/index.ts"
+	}
 }

package/modules/exports/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-exports",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"private": true,
 	"type": "module",
 	"exports": {
@@ -23,6 +23,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
+		"@flowdular/cli-protocol": "workspace:*",
 		"@flowdular/client": "workspace:*",
 		"@flowdular/contracts": "workspace:*",
 		"@flowdular/database": "workspace:*",

package/modules/exports/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: exports.core
-specVersion: 0.2.2
+specVersion: 0.2.3
 status: approved
 name: Exports Core
 description: Exports any list endpoint that already pages with the platform keyset helpers as one CSV file, through an export job that streams the list's own pages under the requester's grants, writes an RFC 4180 file with a UTF-8 byte order mark to the storage port, bounds the result by rows and by bytes, and answers a short-lived signed read URL; the list itself stays with the module that owns it and registers a declaration through the public capability exports.lists.v1.
@@ -10,6 +10,7 @@ capabilities:
   - database
   - client
   - translations
+  - cli
 dependencies:
   - id: system.core
     range: ^0.7.0