@myelinbridge/cli 0.6.0 → 0.7.0

package/README.md

@@ -31,6 +31,10 @@ npx @myelinbridge/cli push  ./run_042 --dataset onco1-wes --submit
   too (S3 multipart). Uploads go direct to storage over short-lived presigned
   URLs — no credential is stored on your machine, and revoking the API key cuts
   off signing immediately.
+- **Every file is fingerprinted.** Since 0.7.0, `push` computes an MD5 of each
+  file while it uploads and records it with the delivery. If the client's
+  quality contract includes a checksum-manifest check, your delivery verifies
+  against your own `md5_manifest.csv` instead of reading as "unverifiable".
 - **Read the contract before you build the delivery.** `contract` prints what the
   client expects — every check as one plain sentence, grouped by what it answers
   (completeness, structure, validity, consistency, integrity, privacy), and marked
@@ -53,9 +57,10 @@ Two kinds of key exist, and they are not interchangeable. Everything above needs
 question your own systems ask once the data has landed: *the bucket is full of UUIDs —
 what is this?*
 
-By default a client key is **organisation-wide**: one key, every partner, one answer. Your
-organisation admin creates it in **Organisation → API keys**. If your governance is per-partner,
-a bridge owner can create a bridge-scoped one instead in **Bridge → API → "Your read keys"**.
+Where they live follows from what they are. A **partner key belongs to one bridge**, because a
+partner does. A **client key belongs to your organisation**: one key, every partner, one answer.
+Your organisation admin creates it in **Organisation → API keys**. To narrow one to a single
+partner's data, scope it to that partner's projects.
 
 ```bash
 export MYELIN_API_KEY=myl_live_…

package/bin/myelin.js

@@ -10,6 +10,7 @@
 
 import { readdirSync, statSync, createReadStream, readFileSync } from 'node:fs'
 import { resolve, join, relative, sep, basename } from 'node:path'
+import { createHash } from 'node:crypto'
 import process from 'node:process'
 
 const API_URL = (process.env.MYELIN_API_URL ?? 'https://myelinbridge.com/api/v1').replace(/\/$/, '')
@@ -158,6 +159,27 @@ async function readPart(absPath, start, end) {
   return Buffer.concat(chunks)
 }
 
+// Whole-file MD5, lowercase hex — the exact format md5sum-style manifests use
+// and the only one the platform's manifest_checksums_match check can verify.
+// A separate sequential read (parts upload 4-wide, out of order — a streaming
+// hash cannot ride along), overlapped with the upload by the caller. Returns
+// null on read failure: a hash miss must degrade the delivery to
+// "unverifiable", never kill the push.
+async function md5File(absPath) {
+  try {
+    const hash = createHash('md5')
+    await new Promise((res, rej) => {
+      const s = createReadStream(absPath)
+      s.on('data', (c) => hash.update(c))
+      s.on('end', res)
+      s.on('error', rej)
+    })
+    return hash.digest('hex')
+  } catch {
+    return null
+  }
+}
+
 async function uploadFileMultipart(absPath, size, fileId, partSize, onPartDone) {
   const numParts = Math.max(1, Math.ceil(size / partSize))
   const allParts = Array.from({ length: numParts }, (_, i) => i + 1)
@@ -389,8 +411,19 @@ async function cmdPush() {
       const d = queue.shift()
       if (!d) return
       const local = byPath.get(d.path)
-      const { upload_id, parts } = await uploadFileMultipart(local.abs, local.size, d.file_id, partSize)
-      const c = await api('POST', `/files/${d.file_id}/confirm`, { upload_id, parts })
+      // Hash and upload overlap — two independent reads of the same file. The
+      // checksum rides on confirm so files.checksum is populated for CLI
+      // pushes (0.7.0): without it every CLI delivery reads as "unverifiable"
+      // to the manifest_checksums_match quality check.
+      const [{ upload_id, parts }, checksum] = await Promise.all([
+        uploadFileMultipart(local.abs, local.size, d.file_id, partSize),
+        md5File(local.abs),
+      ])
+      const c = await api('POST', `/files/${d.file_id}/confirm`, {
+        upload_id,
+        parts,
+        ...(checksum ? { checksum, checksum_algorithm: 'md5' } : {}),
+      })
       if (c.status !== 200) die(`confirm ${d.path}: [${c.json?.code}] ${c.json?.detail ?? c.status}`)
       done++
       out(`  ✓ ${d.path} (${done}/${pending.length})`)
@@ -521,7 +554,7 @@ Commands:
   status <batch|name> [--watch]           review status + fix-loop findings
   sandbox <file>                          partner-side test transfer (bridge activation)
 
-Client-side commands (need a CLIENT key — Bridge → API → "Your read keys"):
+Client-side commands (need a CLIENT key — Organisation → API keys):
   deliveries [--project <id>]             what landed in your destination bucket
              [--dataset <id>] [--since <iso>] [--limit <n>]
   resolve <path|prefix|id>                what a path in your bucket actually is —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myelinbridge/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Myelin Partner Ingestion CLI — push R&D data deliveries from a pipeline: preflight against the client's quality rules, resumable upload, submit, track review outcomes.",
   "type": "module",
   "bin": {