@selvajs/supabase-provider 0.14.2 → 0.14.4-beta.0

package/src/data/SupabaseProjectStore.ts

@@ -8,9 +8,18 @@ import type {
 	ListOptions,
 	Page
 } from '@selvajs/platform';
-import { ProviderError, auditSoftDelete, actorFrom, NoopEventSink } from '@selvajs/platform';
+import { ProviderError, actorFrom, NoopEventSink } from '@selvajs/platform';
 import type { ClientBundle } from './client.js';
+import { mapPostgrestError } from './errors.js';
 import { nextCursorFromRange, orderColumn, toRange } from './pagination.js';
+import { stampSoftDelete, stampUpdate } from './rowStamp.js';
+
+/** Explicit column list for `projects` — every field `rowToProject` consumes. */
+const PROJECT_COLUMNS =
+	'id, org_id, name, slug, description, visibility, owner_id, created_by, updated_by, auto_join_on_upload, created_at, updated_at, deleted_at';
+/** Explicit column list for `project_members` — every field `rowToProjectMember` consumes. */
+const PROJECT_MEMBER_COLUMNS =
+	'project_id, user_id, role, joined_at, updated_at, updated_by, deleted_at';
 
 /**
  * Project + project-membership store backed by Postgres. Visibility semantics
@@ -42,12 +51,12 @@ export class SupabaseProjectStore implements IProjectStore {
 		const { data, error, count } = await this.clients
 			.forRequest(ctx)
 			.from('projects')
-			.select('*', { count: 'exact' })
+			.select(PROJECT_COLUMNS, { count: 'exact' })
 			.eq('org_id', orgId)
 			.is('deleted_at', null)
 			.order(orderColumn(opts?.orderBy), { ascending: direction === 'asc' })
 			.range(range.from, range.to);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const items = (data ?? []).map(rowToProject);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
@@ -56,11 +65,11 @@ export class SupabaseProjectStore implements IProjectStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('projects')
-			.select('*')
+			.select(PROJECT_COLUMNS)
 			.eq('id', id)
 			.is('deleted_at', null)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToProject(data) : null;
 	}
 
@@ -72,19 +81,19 @@ export class SupabaseProjectStore implements IProjectStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('projects')
-			.select('*')
+			.select(PROJECT_COLUMNS)
 			.eq('org_id', orgId)
 			.eq('slug', slug)
 			.is('deleted_at', null)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToProject(data) : null;
 	}
 
 	async createProject(ctx: RequestContext, project: Project): Promise<void> {
 		const client = this.clients.forRequest(ctx);
 		const { error } = await client.from('projects').insert(projectToRow(project));
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 
 		// Seed owner membership so user-scoped reads see the project post-create.
 		// Upsert so a stale soft-deleted row from a prior project with the same id
@@ -99,7 +108,7 @@ export class SupabaseProjectStore implements IProjectStore {
 			},
 			{ onConflict: 'project_id,user_id' }
 		);
-		if (memberError) throw mapError(memberError);
+		if (memberError) throw mapPostgrestError(memberError);
 		await this.events.emit({
 			type: 'project.created',
 			projectId: project.id,
@@ -122,7 +131,7 @@ export class SupabaseProjectStore implements IProjectStore {
 		if (patch.visibility !== undefined) row.visibility = patch.visibility;
 		if (patch.autoJoinOnUpload !== undefined) row.auto_join_on_upload = patch.autoJoinOnUpload;
 		if (Object.keys(row).length === 0) return;
-		if (ctx.userId) row.updated_by = ctx.userId;
+		Object.assign(row, stampUpdate(ctx));
 
 		const { data, error } = await this.clients
 			.forRequest(ctx)
@@ -131,7 +140,7 @@ export class SupabaseProjectStore implements IProjectStore {
 			.eq('id', id)
 			.is('deleted_at', null)
 			.select('id');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
 	}
 
@@ -140,8 +149,7 @@ export class SupabaseProjectStore implements IProjectStore {
 		// project_members, definitions. FK CASCADE doesn't fire on soft-delete,
 		// so the cascade is in app code.
 		const client = this.clients.forRequest(ctx);
-		const stamp = auditSoftDelete(ctx, ctx.userId);
-		const stampRow = stampToRow(stamp);
+		const stampRow = stampSoftDelete(ctx);
 
 		const { data, error } = await client
 			.from('projects')
@@ -149,7 +157,7 @@ export class SupabaseProjectStore implements IProjectStore {
 			.eq('id', id)
 			.is('deleted_at', null)
 			.select('id');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
 
 		const { error: pmErr } = await client
@@ -157,14 +165,28 @@ export class SupabaseProjectStore implements IProjectStore {
 			.update(stampRow)
 			.eq('project_id', id)
 			.is('deleted_at', null);
-		if (pmErr) throw mapError(pmErr);
-
-		const { error: defErr } = await client
+		if (pmErr) throw mapPostgrestError(pmErr);
+
+		// Cascade to definitions. `select('guid')` returns the tombstoned rows so
+		// we emit one `definition.deleted` per record — parity with the single
+		// `delete` path and with `SupabaseDefinitionStore.deleteByProject` /
+		// `LocalProjectStore.deleteProject`. (Kept inline rather than delegating to
+		// the definition store to avoid a cross-store constructor dependency; the
+		// behavior must stay identical to `deleteByProject`.)
+		const { data: deletedDefs, error: defErr } = await client
 			.from('definitions')
 			.update(stampRow)
 			.eq('project_id', id)
-			.is('deleted_at', null);
-		if (defErr) throw mapError(defErr);
+			.is('deleted_at', null)
+			.select('guid');
+		if (defErr) throw mapPostgrestError(defErr);
+		for (const row of deletedDefs ?? []) {
+			await this.events.emit({
+				type: 'definition.deleted',
+				definitionId: row.guid,
+				actorId: actorFrom(ctx)
+			});
+		}
 
 		await this.events.emit({ type: 'project.deleted', projectId: id, actorId: actorFrom(ctx) });
 	}
@@ -185,9 +207,9 @@ export class SupabaseProjectStore implements IProjectStore {
 			.eq('org_id', orgId)
 			.eq('slug', slug)
 			.not('deleted_at', 'is', null)
-			.select('*')
+			.select(PROJECT_COLUMNS)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data) return null;
 
 		// Reactivate the owner's project_members row (deleteProject cascades to it).
@@ -197,7 +219,7 @@ export class SupabaseProjectStore implements IProjectStore {
 			.eq('project_id', data.id)
 			.eq('user_id', data.owner_id)
 			.not('deleted_at', 'is', null);
-		if (pmErr) throw mapError(pmErr);
+		if (pmErr) throw mapPostgrestError(pmErr);
 
 		const project = rowToProject(data);
 		await this.events.emit({
@@ -221,12 +243,12 @@ export class SupabaseProjectStore implements IProjectStore {
 		const { data, error, count } = await this.clients
 			.forRequest(ctx)
 			.from('project_members')
-			.select('*', { count: 'exact' })
+			.select(PROJECT_MEMBER_COLUMNS, { count: 'exact' })
 			.eq('project_id', projectId)
 			.is('deleted_at', null)
 			.order('joined_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
 			.range(range.from, range.to);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const items = (data ?? []).map(rowToProjectMember);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
@@ -239,12 +261,12 @@ export class SupabaseProjectStore implements IProjectStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('project_members')
-			.select('*')
+			.select(PROJECT_MEMBER_COLUMNS)
 			.eq('project_id', projectId)
 			.eq('user_id', userId)
 			.is('deleted_at', null)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToProjectMember(data) : null;
 	}
 
@@ -253,14 +275,14 @@ export class SupabaseProjectStore implements IProjectStore {
 		// duplicate-key. Mirrors LocalProjectStore.addProjectMember.
 		const row: Record<string, unknown> = {
 			...projectMemberToRow(member),
-			deleted_at: null
+			deleted_at: null,
+			...stampUpdate(ctx)
 		};
-		if (ctx.userId) row.updated_by = ctx.userId;
 		const { error } = await this.clients
 			.forRequest(ctx)
 			.from('project_members')
 			.upsert(row, { onConflict: 'project_id,user_id' });
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'project_member.added',
 			projectId: member.projectId,
@@ -275,8 +297,7 @@ export class SupabaseProjectStore implements IProjectStore {
 		userId: string,
 		role: ProjectRole
 	): Promise<void> {
-		const row: Record<string, unknown> = { role };
-		if (ctx.userId) row.updated_by = ctx.userId;
+		const row: Record<string, unknown> = { role, ...stampUpdate(ctx) };
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('project_members')
@@ -285,7 +306,7 @@ export class SupabaseProjectStore implements IProjectStore {
 			.eq('user_id', userId)
 			.is('deleted_at', null)
 			.select('user_id');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0)
 			throw new ProviderError(`Project member '${userId}' not found`, 404);
 		await this.events.emit({
@@ -298,15 +319,14 @@ export class SupabaseProjectStore implements IProjectStore {
 	}
 
 	async removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void> {
-		const stamp = auditSoftDelete(ctx, ctx.userId);
 		const { error } = await this.clients
 			.forRequest(ctx)
 			.from('project_members')
-			.update(stampToRow(stamp))
+			.update(stampSoftDelete(ctx))
 			.eq('project_id', projectId)
 			.eq('user_id', userId)
 			.is('deleted_at', null);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'project_member.removed',
 			projectId,
@@ -409,46 +429,3 @@ function projectMemberToRow(m: ProjectMember): ProjectMemberRow {
 		joined_at: m.joinedAt
 	};
 }
-
-// ============================================================================
-// Error translation
-// ============================================================================
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-/**
- * Build a row payload from an audit-soft-delete stamp. `updated_by` only goes
- * into the row when ctx.userId is set — passing `''` would violate the
- * `references auth.users(id)` FK on system contexts. The DB trigger sets
- * `updated_at`, but for soft-delete we set it explicitly so it matches
- * `deleted_at` (single timestamp for the deletion event).
- */
-function stampToRow(stamp: {
-	updatedAt: string;
-	updatedBy: string;
-	deletedAt: string;
-}): Record<string, unknown> {
-	const row: Record<string, unknown> = {
-		deleted_at: stamp.deletedAt,
-		updated_at: stamp.updatedAt
-	};
-	if (stamp.updatedBy) row.updated_by = stamp.updatedBy;
-	return row;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; details?: string; hint?: string; code?: string };
-		const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
-		const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
-		Object.assign(err, obj);
-		return err;
-	}
-	return new Error(String(e));
-}

package/src/data/SupabaseShareLinkStore.ts

@@ -6,10 +6,15 @@ import type {
 	ListOptions,
 	Page
 } from '@selvajs/platform';
-import { ProviderError, actorFrom, NoopEventSink } from '@selvajs/platform';
+import { actorFrom, NoopEventSink } from '@selvajs/platform';
 import type { ClientBundle } from './client.js';
+import { mapPostgrestError } from './errors.js';
 import { nextCursorFromRange, toRange } from './pagination.js';
 
+/** Explicit column list for `share_links` — every field `rowToLink` consumes. */
+const SHARE_LINK_COLUMNS =
+	'id, definition_guid, channel, token_hash, name, created_by, created_at, expires_at, revoked_at, allow_solve, max_solves, solve_count';
+
 /**
  * Spec §7 — share-link store backed by Postgres.
  *
@@ -37,7 +42,7 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 			.forRequest(ctx)
 			.from('share_links')
 			.insert(linkToRow(link));
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'share_link.minted',
 			linkId: link.id,
@@ -55,12 +60,12 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 		const { data, error, count } = await this.clients
 			.forRequest(ctx)
 			.from('share_links')
-			.select('*', { count: 'exact' })
+			.select(SHARE_LINK_COLUMNS, { count: 'exact' })
 			.eq('definition_guid', definitionId)
 			.is('revoked_at', null)
 			.order('created_at', { ascending: false })
 			.range(range.from, range.to);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const items = (data ?? []).map(rowToLink);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
@@ -69,10 +74,10 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('share_links')
-			.select('*')
+			.select(SHARE_LINK_COLUMNS)
 			.eq('id', id)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToLink(data) : null;
 	}
 
@@ -82,12 +87,12 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 		// — exactly the wrong semantic for token-credentialed access.
 		const { data, error } = await this.clients.serviceClient
 			.from('share_links')
-			.select('*, definitions!inner(deleted_at)')
+			.select(`${SHARE_LINK_COLUMNS}, definitions!inner(deleted_at)`)
 			.eq('token_hash', tokenHash)
 			.is('revoked_at', null)
 			.is('definitions.deleted_at', null)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToLink(data) : null;
 	}
 
@@ -101,7 +106,7 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 			.update({ revoked_at: new Date().toISOString() })
 			.eq('id', id)
 			.is('revoked_at', null);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({ type: 'share_link.revoked', linkId: id, actorId: actorFrom(ctx) });
 	}
 
@@ -113,7 +118,7 @@ export class SupabaseShareLinkStore implements IShareLinkStore {
 			'try_increment_share_link_solve_count',
 			{ link_id: id }
 		);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return typeof data === 'number' ? data : null;
 	}
 }
@@ -169,23 +174,3 @@ function linkToRow(l: ShareLink): Record<string, unknown> {
 		solve_count: l.solveCount
 	};
 }
-
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; details?: string; hint?: string; code?: string };
-		const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
-		const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
-		Object.assign(err, obj);
-		return err;
-	}
-	return new Error(String(e));
-}

package/src/data/__tests__/compute-server-conformance.test.ts

@@ -1,10 +1,16 @@
 import { describe, beforeEach, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
 import { runComputeServerStoreConformance } from '@selvajs/platform/testing';
 import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
 import { readEnv, resetAllData, seedUser } from './test-helpers.js';
 
 const envCtx = readEnv();
 
+// A throwaway at-rest key so the store encrypts apiKeys during the suite. The
+// round-trip (encrypt on write, decrypt on read) must be transparent to the
+// conformance assertions, which compare plaintext apiKeys.
+const TEST_SECRET_KEY = randomBytes(32);
+
 if (!envCtx) {
 	describe.skip('SupabaseComputeServerStore (skipped: no live stack)', () => {
 		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
@@ -17,7 +23,7 @@ if (!envCtx) {
 
 		runComputeServerStoreConformance({
 			name: 'SupabaseComputeServerStore',
-			createStore: () => new SupabaseComputeServerStore(envCtx.bundle),
+			createStore: () => new SupabaseComputeServerStore(envCtx.bundle, TEST_SECRET_KEY),
 			seedOrg: async (orgId) => {
 				// `compute_servers.owner_org_id` and `compute_server_org_defaults.org_id`
 				// FK to `orgs(id)`; the suite invents an `orgId` per org-scoped test,

package/src/data/__tests__/compute-server-encryption.test.ts

@@ -0,0 +1,173 @@
+/**
+ * CI-runnable (no live stack) unit tests for at-rest encryption of
+ * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
+ * that records `insert` payloads and serves canned `select` rows, so we can
+ * assert the exact bytes that would reach the DB without a real Postgres.
+ *
+ * The security property under test: a plaintext apiKey handed to the store is
+ * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
+ * round-trips back to plaintext on read.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { isEncryptedSecret, decryptSecret } from '@selvajs/platform/computeServer';
+import type { RequestContext } from '@selvajs/platform';
+import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
+import type { ClientBundle } from '../client.js';
+
+const SYSTEM_CTX = { userId: '', system: true } as unknown as RequestContext;
+const KEY = randomBytes(32);
+
+/**
+ * Records every `insert` payload and returns canned rows for each table's
+ * `select`. Only the fragments the store actually chains are implemented; the
+ * builder is thenable so `await client.from(...).select(...)` resolves.
+ */
+function fakeBundle(selectRows: Record<string, unknown[]> = {}) {
+	const inserted: Record<string, unknown[]> = {};
+
+	function builder(table: string) {
+		const result = { data: selectRows[table] ?? [], error: null };
+		const chain: Record<string, unknown> = {
+			select: () => ({
+				...chain,
+				eq: () => ({ ...chain, maybeSingle: async () => ({ data: null, error: null }) }),
+				then: (resolve: (v: unknown) => unknown) => resolve(result)
+			}),
+			insert: (rows: unknown) => {
+				inserted[table] = (inserted[table] ?? []).concat(rows as unknown[]);
+				return { error: null };
+			},
+			delete: () => ({ eq: () => ({ eq: () => ({ error: null }), error: null }) }),
+			update: () => ({ eq: () => ({ error: null }) }),
+			upsert: () => ({ error: null })
+		};
+		return chain;
+	}
+
+	const client = { from: (t: string) => builder(t) };
+	const bundle = {
+		serviceClient: client,
+		forRequest: () => client
+	} as unknown as ClientBundle;
+	return { bundle, inserted };
+}
+
+describe('SupabaseComputeServerStore — apiKey encryption at rest', () => {
+	beforeEach(() => vi.restoreAllMocks());
+
+	it('encrypts apiKey before insert — DB never sees plaintext', async () => {
+		const { bundle, inserted } = fakeBundle();
+		const store = new SupabaseComputeServerStore(bundle, KEY);
+
+		await store.savePlatformServers(
+			SYSTEM_CTX,
+			[
+				{
+					id: 's1',
+					label: 'prod',
+					serverUrl: 'https://compute.example.com',
+					apiKey: 'super-secret-key',
+					scope: 'platform',
+					sharedWith: 'all'
+				}
+			],
+			's1'
+		);
+
+		const rows = inserted['compute_servers'] as Array<{ api_key: string }>;
+		expect(rows).toHaveLength(1);
+		expect(rows[0].api_key).not.toBe('super-secret-key');
+		expect(isEncryptedSecret(rows[0].api_key)).toBe(true);
+		// And it's genuinely our plaintext under the envelope.
+		expect(decryptSecret(rows[0].api_key, KEY)).toBe('super-secret-key');
+	});
+
+	it('decrypts apiKey on read — callers see plaintext', async () => {
+		// Seed the "DB" with an already-encrypted row.
+		const { encryptSecret } = await import('@selvajs/platform/computeServer');
+		const envelope = encryptSecret('round-trip-key', KEY);
+		const { bundle } = fakeBundle({
+			compute_servers: [
+				{
+					id: 's1',
+					scope: 'platform',
+					owner_org_id: null,
+					shared_with_all: true,
+					label: 'prod',
+					server_url: 'https://compute.example.com',
+					api_key: envelope,
+					timeout_ms: null,
+					retry_count: null
+				}
+			]
+		});
+		const store = new SupabaseComputeServerStore(bundle, KEY);
+
+		const config = await store.getConfig(SYSTEM_CTX);
+		expect(config.servers).toHaveLength(1);
+		expect(config.servers[0].apiKey).toBe('round-trip-key');
+	});
+
+	it('throws rather than persist plaintext when no key is configured', async () => {
+		const { bundle } = fakeBundle();
+		const store = new SupabaseComputeServerStore(bundle); // no key
+
+		await expect(
+			store.savePlatformServers(
+				SYSTEM_CTX,
+				[
+					{
+						id: 's1',
+						label: 'prod',
+						serverUrl: 'https://compute.example.com',
+						apiKey: 'secret',
+						scope: 'platform',
+						sharedWith: 'all'
+					}
+				],
+				's1'
+			)
+		).rejects.toThrow(/SELVA_AT_REST_KEY/);
+	});
+
+	it('verifySecrets flags a plaintext row', async () => {
+		const { bundle } = fakeBundle({
+			compute_servers: [{ id: 's1', label: 'legacy', api_key: 'raw-plaintext' }]
+		});
+		const store = new SupabaseComputeServerStore(bundle, KEY);
+
+		const report = await store.verifySecrets();
+		expect(report.ok).toBe(false);
+		expect(report.plaintextFound).toBe(true);
+		expect(report.failures).toEqual([
+			{ serverId: 's1', serverLabel: 'legacy', reason: 'plaintext_on_disk' }
+		]);
+	});
+
+	it('verifySecrets reports key_mismatch when the at-rest key rotated', async () => {
+		const { encryptSecret } = await import('@selvajs/platform/computeServer');
+		const envelope = encryptSecret('secret', randomBytes(32)); // different key
+		const { bundle } = fakeBundle({
+			compute_servers: [{ id: 's1', label: 'prod', api_key: envelope }]
+		});
+		const store = new SupabaseComputeServerStore(bundle, KEY);
+
+		const report = await store.verifySecrets();
+		expect(report.ok).toBe(false);
+		expect(report.plaintextFound).toBe(false);
+		expect(report.failures[0]).toMatchObject({ serverId: 's1', reason: 'key_mismatch' });
+	});
+
+	it('verifySecrets returns ok when every apiKey decrypts', async () => {
+		const { encryptSecret } = await import('@selvajs/platform/computeServer');
+		const { bundle } = fakeBundle({
+			compute_servers: [{ id: 's1', label: 'prod', api_key: encryptSecret('k', KEY) }]
+		});
+		const store = new SupabaseComputeServerStore(bundle, KEY);
+
+		const report = await store.verifySecrets();
+		expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
+	});
+});