@supacloud/cli 0.101.0 → 0.101.2

package/dist/index.js

@@ -21388,7 +21388,7 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.3"
+      version: "0.46.4"
     },
     app: {
       version: "0.27.1",
@@ -21397,13 +21397,13 @@ var starter_metadata_default = {
       }
     },
     elysia: {
-      version: "0.31.0"
+      version: "0.31.1"
     },
     commands: {
       version: "0.9.3"
     },
     contracts: {
-      version: "0.9.0"
+      version: "0.10.0"
     },
     db: {
       version: "0.17.1",
@@ -22222,6 +22222,8 @@ export type ReviewAttachmentInput = Static<typeof AttachmentInput>;
 export type ReviewAttachmentResult = Static<typeof AttachmentResult>;
 
 export interface ReviewAttachmentStore {
+  // Reauthorize before returning a committed result; null means execution is still needed.
+  readResult(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult | null>;
   // Resolve the immutable artifact under the worker's own authorization and current review revision.
   readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;
   // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.
@@ -22237,6 +22239,8 @@ export class VerifyReviewAttachment {
   constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}
 
   async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {
+    const committed = await this.store.readResult(input);
+    if (committed !== null) return committed;
     const source = await this.store.readAttachment(input);
     if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {
       throw new ApplicationError("Attachment size is outside the supported range", { code: "ATTACHMENT_SIZE_INVALID" });
@@ -22261,6 +22265,7 @@ const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", b
 test("attachment job awaits the authorized reader and the committed result", async () => {
   let recorded: ReviewAttachmentResult | undefined;
   const job = new VerifyReviewAttachment({
+    async readResult() { return null; },
     async readAttachment() { return { body, sha256 }; },
     async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },
   });
@@ -22277,16 +22282,33 @@ test("missing authorization, corrupted bytes and persistence failures are not su
     async () => ({ body: new Uint8Array(1048577), sha256 }),
   ]) {
     const job = new VerifyReviewAttachment({
+      async readResult() { return null; },
       readAttachment, async recordAttachment(_input, result) { records++; return result; },
     });
     await expect(job.run(input)).rejects.toThrow();
   }
   expect(records).toBe(0);
   await expect(new VerifyReviewAttachment({
+    async readResult() { return null; },
     async readAttachment() { return { body, sha256 }; },
     async recordAttachment() { throw new Error("Commit failed"); },
   }).run(input)).rejects.toThrow("Commit failed");
 });
+
+test("a reauthorized committed result avoids another download or write", async () => {
+  const result = { ...input, sha256, bytes: body.byteLength };
+  const job = new VerifyReviewAttachment({
+    async readResult() { return result; },
+    async readAttachment() { throw new Error("Must not download again"); },
+    async recordAttachment() { throw new Error("Must not write again"); },
+  });
+  expect(await job.run(input)).toEqual(result);
+  await expect(new VerifyReviewAttachment({
+    async readResult() { throw new Error("Access revoked"); },
+    async readAttachment() { throw new Error("Must not download"); },
+    async recordAttachment() { throw new Error("Must not write"); },
+  }).run(input)).rejects.toThrow("Access revoked");
+});
 `;
 
 // src/shared/tools/app-starter-attachments.ts
@@ -22307,7 +22329,8 @@ ALTER TABLE public.starter_attachment_results ENABLE ROW LEVEL SECURITY;
 var STARTER_ATTACHMENT_POSTGRES = `import { SupaCloudArtifactsClient } from "@supacloud/js";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CommandDatabase, CommandTransaction } from "@supacloud/db";
-import type { ReviewAttachmentInput, ReviewAttachmentResult, ReviewAttachmentStore } from "../review/attachment";
+import { createSchemaDecoder } from "@supacloud/elysia";
+import { AttachmentResult, type ReviewAttachmentInput, type ReviewAttachmentResult, type ReviewAttachmentStore } from "../review/attachment";
 
 export interface ReviewAttachmentOptions {
   database: CommandDatabase;
@@ -22328,14 +22351,13 @@ function record(value: unknown): Record<string, unknown> {
   if (!isRecord(value)) throw new TypeError("Invalid attachment record");
   return value;
 }
-function durableResult(value: unknown): ReviewAttachmentResult {
-  const item = record(value);
-  if (typeof item["reviewId"] !== "string" || typeof item["artifactId"] !== "string"
-    || typeof item["version"] !== "number" || typeof item["sha256"] !== "string"
-    || typeof item["bytes"] !== "number" || Object.keys(item).length !== 5) {
-    throw new Error("Invalid durable attachment result");
-  }
-  return { reviewId: item["reviewId"], artifactId: item["artifactId"], version: item["version"], sha256: item["sha256"], bytes: item["bytes"] };
+const durableResult = createSchemaDecoder(AttachmentResult, { normalize: false });
+
+function resultFor(input: ReviewAttachmentInput, value: unknown): ReviewAttachmentResult {
+  const result = durableResult(value);
+  if (result.reviewId !== input.reviewId || result.version !== input.version
+    || result.artifactId !== input.artifactId) throw new Error("Conflicting durable attachment result");
+  return result;
 }
 
 export async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{
@@ -22381,6 +22403,16 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
       ]);
     },
     store: {
+      async readResult(input) {
+        return database.transaction(async tx => {
+          await authorize(tx, input);
+          const saved = rows(await tx.query(
+            "SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3",
+            [input.reviewId, input.version, input.artifactId],
+          ));
+          return saved.length === 0 ? null : resultFor(input, saved[0]?.["result"]);
+        });
+      },
       async readAttachment(input) {
         const allowed = await database.transaction(tx => authorize(tx, input));
         const artifact = await artifacts.get(input.artifactId);
@@ -22394,24 +22426,19 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
         return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };
       },
       async recordAttachment(input, result) {
-        if (result.reviewId !== input.reviewId || result.version !== input.version
-          || result.artifactId !== input.artifactId || !/^[a-f0-9]{64}$/.test(result.sha256)
-          || !Number.isSafeInteger(result.bytes) || result.bytes < 1 || result.bytes > 1048576) {
-          throw new Error("Invalid attachment result");
-        }
+        const decoded = resultFor(input, result);
         return database.transaction(async tx => {
           await authorize(tx, input);
           await tx.query(
             "INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING",
-            [input.reviewId, input.version, input.artifactId, JSON.stringify(result)],
+            [input.reviewId, input.version, input.artifactId, JSON.stringify(decoded)],
           );
           const saved = rows(await tx.query(
             "SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3",
             [input.reviewId, input.version, input.artifactId],
           ))[0]?.["result"];
-          const value = durableResult(saved);
-          if (value.reviewId !== result.reviewId || value.version !== result.version || value.artifactId !== result.artifactId
-            || value.sha256 !== result.sha256 || value.bytes !== result.bytes) {
+          const value = resultFor(input, saved);
+          if (value.sha256 !== decoded.sha256 || value.bytes !== decoded.bytes) {
             throw new Error("Conflicting durable attachment result");
           }
           return value;
@@ -24182,6 +24209,15 @@ the existing Workflow and invokes the compiled Job with a ReviewAttachmentStore.
 Its reader authorizes the worker independently; its writer rechecks the review
 revision/artifact binding and persists the result idempotently before acknowledgement.
 After a lost acknowledgement, reconcile that result instead of repeating effects.
+The generated Job first calls store.readResult. The PostgreSQL adapter rechecks
+current permission, ownership, revision and project/tenant binding inside the
+read transaction, then validates a stored result with AttachmentResult. A valid
+committed result skips Storage download and result insertion on redelivery.
+Revoked access or a malformed/conflicting result fails closed, not as a cache miss.
+Existing custom ReviewAttachmentStore implementations must add readResult with
+these same authorization and validation guarantees when adopting this Job.
+This does not automatically restart a halted worker, reset the attempt budget,
+or make external side effects atomic with the database.
 
 src/host/review-attachments.ts supplies createReviewAttachmentAdapters with a
 durable store and enqueue callback for the approval adapter's afterApproved hook.
@@ -30526,7 +30562,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.101.0",
+  version: "0.101.2",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -30578,18 +30614,18 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.3",
+    "@supacloud/compiler": "^0.46.4",
     "@supacloud/delivery": "0.18.1",
     "@supacloud/db": "0.17.1",
     typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.9.0",
+    "@supacloud/contracts": "0.10.0",
     "@supacloud/delivery": "0.18.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
-    "@supacloud/elysia": "0.31.0",
+    "@supacloud/elysia": "0.31.1",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",

package/dist/shared/tools/app-starter-attachments.d.ts

@@ -1,2 +1,2 @@
 export declare const STARTER_ATTACHMENT_SCHEMA = "-- Apply with the migration owner, never from an application process.\nCREATE TABLE public.starter_attachments (\n  review_id text PRIMARY KEY REFERENCES public.starter_reviews(id),\n  artifact_id uuid NOT NULL UNIQUE, owner_id text NOT NULL, run_id uuid NOT NULL UNIQUE,\n  object_path text NOT NULL UNIQUE\n);\nCREATE TABLE public.starter_attachment_results (\n  review_id text NOT NULL REFERENCES public.starter_reviews(id),\n  version integer NOT NULL CHECK (version >= 2), artifact_id uuid NOT NULL,\n  result jsonb NOT NULL, PRIMARY KEY(review_id,version,artifact_id)\n);\nALTER TABLE public.starter_attachments ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_attachment_results ENABLE ROW LEVEL SECURITY;\n";
-export declare const STARTER_ATTACHMENT_POSTGRES = "import { SupaCloudArtifactsClient } from \"@supacloud/js\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { CommandDatabase, CommandTransaction } from \"@supacloud/db\";\nimport type { ReviewAttachmentInput, ReviewAttachmentResult, ReviewAttachmentStore } from \"../review/attachment\";\n\nexport interface ReviewAttachmentOptions {\n  database: CommandDatabase;\n  // Provision this client for the same project as the database; never use a caller's bearer token.\n  service: SupabaseClient;\n  projectId: string;\n  tenantId: string;\n}\n\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid attachment database result\");\n  return value.map(record);\n}\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid attachment record\");\n  return value;\n}\nfunction durableResult(value: unknown): ReviewAttachmentResult {\n  const item = record(value);\n  if (typeof item[\"reviewId\"] !== \"string\" || typeof item[\"artifactId\"] !== \"string\"\n    || typeof item[\"version\"] !== \"number\" || typeof item[\"sha256\"] !== \"string\"\n    || typeof item[\"bytes\"] !== \"number\" || Object.keys(item).length !== 5) {\n    throw new Error(\"Invalid durable attachment result\");\n  }\n  return { reviewId: item[\"reviewId\"], artifactId: item[\"artifactId\"], version: item[\"version\"], sha256: item[\"sha256\"], bytes: item[\"bytes\"] };\n}\n\nexport async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{\n  store: ReviewAttachmentStore;\n  enqueue(tx: CommandTransaction, reviewId: string, version: number): Promise<void>;\n}> {\n  const { database, service, projectId, tenantId } = options;\n  if (!projectId.trim() || !tenantId.trim()) throw new TypeError(\"Attachment project/tenant is required\");\n  const artifacts = new SupaCloudArtifactsClient(service);\n  const binding = rows(await database.transaction(tx => tx.query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  )));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Attachment database project/tenant binding mismatch\");\n  }\n  async function authorize(tx: CommandTransaction, input: ReviewAttachmentInput) {\n    const allowed = rows(await tx.query(\n      \"SELECT a.object_path,a.run_id FROM public.starter_attachments a \" +\n      \"JOIN public.starter_reviews r ON r.id=a.review_id AND r.owner_id=a.owner_id \" +\n      \"JOIN public.starter_members m ON m.subject=a.owner_id AND m.enabled AND m.can_approve \" +\n      \"CROSS JOIN public.starter_application p \" +\n      \"WHERE a.review_id=$1 AND a.artifact_id=$2 AND r.version=$3 AND r.state='approved' \" +\n      \"AND p.singleton AND p.project_id=$4 AND p.tenant_id=$5 \" +\n      \"FOR UPDATE OF r,a,m FOR SHARE OF p\",\n      [input.reviewId, input.artifactId, input.version, projectId, tenantId],\n    ));\n    if (allowed.length !== 1 || typeof allowed[0]?.[\"object_path\"] !== \"string\") {\n      throw new Error(\"Attachment worker authorization or review revision is no longer valid\");\n    }\n    return allowed[0];\n  }\n  return {\n    async enqueue(tx, reviewId, version) {\n      const found = rows(await tx.query(\n        \"SELECT artifact_id FROM public.starter_attachments WHERE review_id=$1\", [reviewId],\n      ))[0];\n      if (!found) return;\n      const input = { reviewId, version, artifactId: String(found[\"artifact_id\"]) };\n      const allowed = await authorize(tx, input);\n      // Bind serialized JSON as text so drivers cannot encode the string as a JSON scalar.\n      await tx.query(\"SELECT supacloud_workflows.start_run($1::uuid,$2,'1','verify',$3::text::jsonb,3)\", [\n        String(allowed[\"run_id\"]), \"review.verify-attachment\", JSON.stringify(input),\n      ]);\n    },\n    store: {\n      async readAttachment(input) {\n        const allowed = await database.transaction(tx => authorize(tx, input));\n        const artifact = await artifacts.get(input.artifactId);\n        if (!artifact || artifact.bucketId !== \"review-attachments\"\n          || artifact.objectPath !== allowed[\"object_path\"] || artifact.artifactType !== \"review.attachment\"\n          || artifact.mimeType !== \"text/plain\" || !/^[1-9][0-9]*$/.test(artifact.sizeBytes)\n          || BigInt(artifact.sizeBytes) > 1048576n) throw new Error(\"Invalid attachment artifact\");\n        const downloaded = await service.storage.from(artifact.bucketId).download(artifact.objectPath);\n        if (downloaded.error || !downloaded.data) throw new Error(\"Attachment download failed\");\n        if (downloaded.data.size !== Number(artifact.sizeBytes)) throw new Error(\"Attachment size mismatch\");\n        return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };\n      },\n      async recordAttachment(input, result) {\n        if (result.reviewId !== input.reviewId || result.version !== input.version\n          || result.artifactId !== input.artifactId || !/^[a-f0-9]{64}$/.test(result.sha256)\n          || !Number.isSafeInteger(result.bytes) || result.bytes < 1 || result.bytes > 1048576) {\n          throw new Error(\"Invalid attachment result\");\n        }\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          await tx.query(\n            \"INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING\",\n            [input.reviewId, input.version, input.artifactId, JSON.stringify(result)],\n          );\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ))[0]?.[\"result\"];\n          const value = durableResult(saved);\n          if (value.reviewId !== result.reviewId || value.version !== result.version || value.artifactId !== result.artifactId\n            || value.sha256 !== result.sha256 || value.bytes !== result.bytes) {\n            throw new Error(\"Conflicting durable attachment result\");\n          }\n          return value;\n        });\n      },\n    },\n  };\n}\n";
+export declare const STARTER_ATTACHMENT_POSTGRES = "import { SupaCloudArtifactsClient } from \"@supacloud/js\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { CommandDatabase, CommandTransaction } from \"@supacloud/db\";\nimport { createSchemaDecoder } from \"@supacloud/elysia\";\nimport { AttachmentResult, type ReviewAttachmentInput, type ReviewAttachmentResult, type ReviewAttachmentStore } from \"../review/attachment\";\n\nexport interface ReviewAttachmentOptions {\n  database: CommandDatabase;\n  // Provision this client for the same project as the database; never use a caller's bearer token.\n  service: SupabaseClient;\n  projectId: string;\n  tenantId: string;\n}\n\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid attachment database result\");\n  return value.map(record);\n}\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid attachment record\");\n  return value;\n}\nconst durableResult = createSchemaDecoder(AttachmentResult, { normalize: false });\n\nfunction resultFor(input: ReviewAttachmentInput, value: unknown): ReviewAttachmentResult {\n  const result = durableResult(value);\n  if (result.reviewId !== input.reviewId || result.version !== input.version\n    || result.artifactId !== input.artifactId) throw new Error(\"Conflicting durable attachment result\");\n  return result;\n}\n\nexport async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{\n  store: ReviewAttachmentStore;\n  enqueue(tx: CommandTransaction, reviewId: string, version: number): Promise<void>;\n}> {\n  const { database, service, projectId, tenantId } = options;\n  if (!projectId.trim() || !tenantId.trim()) throw new TypeError(\"Attachment project/tenant is required\");\n  const artifacts = new SupaCloudArtifactsClient(service);\n  const binding = rows(await database.transaction(tx => tx.query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  )));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Attachment database project/tenant binding mismatch\");\n  }\n  async function authorize(tx: CommandTransaction, input: ReviewAttachmentInput) {\n    const allowed = rows(await tx.query(\n      \"SELECT a.object_path,a.run_id FROM public.starter_attachments a \" +\n      \"JOIN public.starter_reviews r ON r.id=a.review_id AND r.owner_id=a.owner_id \" +\n      \"JOIN public.starter_members m ON m.subject=a.owner_id AND m.enabled AND m.can_approve \" +\n      \"CROSS JOIN public.starter_application p \" +\n      \"WHERE a.review_id=$1 AND a.artifact_id=$2 AND r.version=$3 AND r.state='approved' \" +\n      \"AND p.singleton AND p.project_id=$4 AND p.tenant_id=$5 \" +\n      \"FOR UPDATE OF r,a,m FOR SHARE OF p\",\n      [input.reviewId, input.artifactId, input.version, projectId, tenantId],\n    ));\n    if (allowed.length !== 1 || typeof allowed[0]?.[\"object_path\"] !== \"string\") {\n      throw new Error(\"Attachment worker authorization or review revision is no longer valid\");\n    }\n    return allowed[0];\n  }\n  return {\n    async enqueue(tx, reviewId, version) {\n      const found = rows(await tx.query(\n        \"SELECT artifact_id FROM public.starter_attachments WHERE review_id=$1\", [reviewId],\n      ))[0];\n      if (!found) return;\n      const input = { reviewId, version, artifactId: String(found[\"artifact_id\"]) };\n      const allowed = await authorize(tx, input);\n      // Bind serialized JSON as text so drivers cannot encode the string as a JSON scalar.\n      await tx.query(\"SELECT supacloud_workflows.start_run($1::uuid,$2,'1','verify',$3::text::jsonb,3)\", [\n        String(allowed[\"run_id\"]), \"review.verify-attachment\", JSON.stringify(input),\n      ]);\n    },\n    store: {\n      async readResult(input) {\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ));\n          return saved.length === 0 ? null : resultFor(input, saved[0]?.[\"result\"]);\n        });\n      },\n      async readAttachment(input) {\n        const allowed = await database.transaction(tx => authorize(tx, input));\n        const artifact = await artifacts.get(input.artifactId);\n        if (!artifact || artifact.bucketId !== \"review-attachments\"\n          || artifact.objectPath !== allowed[\"object_path\"] || artifact.artifactType !== \"review.attachment\"\n          || artifact.mimeType !== \"text/plain\" || !/^[1-9][0-9]*$/.test(artifact.sizeBytes)\n          || BigInt(artifact.sizeBytes) > 1048576n) throw new Error(\"Invalid attachment artifact\");\n        const downloaded = await service.storage.from(artifact.bucketId).download(artifact.objectPath);\n        if (downloaded.error || !downloaded.data) throw new Error(\"Attachment download failed\");\n        if (downloaded.data.size !== Number(artifact.sizeBytes)) throw new Error(\"Attachment size mismatch\");\n        return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };\n      },\n      async recordAttachment(input, result) {\n        const decoded = resultFor(input, result);\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          await tx.query(\n            \"INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING\",\n            [input.reviewId, input.version, input.artifactId, JSON.stringify(decoded)],\n          );\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ))[0]?.[\"result\"];\n          const value = resultFor(input, saved);\n          if (value.sha256 !== decoded.sha256 || value.bytes !== decoded.bytes) {\n            throw new Error(\"Conflicting durable attachment result\");\n          }\n          return value;\n        });\n      },\n    },\n  };\n}\n";

package/dist/shared/tools/app-starter-review-job.d.ts

@@ -1,2 +1,2 @@
-export declare const STARTER_REVIEW_JOB = "import { DB_CLIENT, Inject, Injectable, Job } from \"@supacloud/app\";\nimport { ApplicationError } from \"@supacloud/elysia\";\nimport { t } from \"elysia\";\nimport type { Static } from \"elysia/type\";\n\nexport const AttachmentInput = t.Object({\n  reviewId: t.String({ minLength: 1, maxLength: 100 }),\n  version: t.Integer({ minimum: 2 }),\n  artifactId: t.String({ format: \"uuid\" }),\n}, { additionalProperties: false });\n\nexport const AttachmentResult = t.Object({\n  ...AttachmentInput.properties,\n  sha256: t.String({ pattern: \"^[a-f0-9]{64}$\" }),\n  bytes: t.Integer({ minimum: 1, maximum: 1048576 }),\n}, { additionalProperties: false });\n\nexport type ReviewAttachmentInput = Static<typeof AttachmentInput>;\nexport type ReviewAttachmentResult = Static<typeof AttachmentResult>;\n\nexport interface ReviewAttachmentStore {\n  // Resolve the immutable artifact under the worker's own authorization and current review revision.\n  readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;\n  // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.\n  recordAttachment(input: ReviewAttachmentInput, result: ReviewAttachmentResult): Promise<ReviewAttachmentResult>;\n}\n\n@Injectable({ scope: \"job\" })\n@Job({\n  name: \"review.verify-attachment\", mode: \"task\", idempotency: \"required\",\n  timeoutSec: 30, maxAttempts: 3, input: AttachmentInput, output: AttachmentResult,\n})\nexport class VerifyReviewAttachment {\n  constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}\n\n  async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {\n    const source = await this.store.readAttachment(input);\n    if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {\n      throw new ApplicationError(\"Attachment size is outside the supported range\", { code: \"ATTACHMENT_SIZE_INVALID\" });\n    }\n    const digest = await crypto.subtle.digest(\"SHA-256\", new Uint8Array(source.body));\n    const sha256 = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n    if (sha256 !== source.sha256) {\n      throw new ApplicationError(\"Attachment integrity check failed\", { code: \"ATTACHMENT_INTEGRITY_FAILED\" });\n    }\n    return this.store.recordAttachment(input, { ...input, sha256, bytes: source.body.byteLength });\n  }\n}\n";
-export declare const STARTER_REVIEW_JOB_TEST = "import { expect, test } from \"bun:test\";\nimport { VerifyReviewAttachment, type ReviewAttachmentResult } from \"../src/review/attachment\";\n\nconst input = { reviewId: \"review\", version: 2, artifactId: \"11111111-1111-4111-8111-111111111111\" };\nconst body = new TextEncoder().encode(\"review attachment\");\nconst sha256 = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", body)),\n  byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\ntest(\"attachment job awaits the authorized reader and the committed result\", async () => {\n  let recorded: ReviewAttachmentResult | undefined;\n  const job = new VerifyReviewAttachment({\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },\n  });\n  expect(await job.run(input)).toEqual({ ...input, sha256, bytes: body.byteLength });\n  expect(recorded).toEqual({ ...input, sha256, bytes: body.byteLength });\n});\n\ntest(\"missing authorization, corrupted bytes and persistence failures are not successful jobs\", async () => {\n  let records = 0;\n  for (const readAttachment of [\n    async () => { throw new Error(\"Access denied\"); },\n    async () => ({ body, sha256: \"0\".repeat(64) }),\n    async () => ({ body: new Uint8Array(), sha256 }),\n    async () => ({ body: new Uint8Array(1048577), sha256 }),\n  ]) {\n    const job = new VerifyReviewAttachment({\n      readAttachment, async recordAttachment(_input, result) { records++; return result; },\n    });\n    await expect(job.run(input)).rejects.toThrow();\n  }\n  expect(records).toBe(0);\n  await expect(new VerifyReviewAttachment({\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment() { throw new Error(\"Commit failed\"); },\n  }).run(input)).rejects.toThrow(\"Commit failed\");\n});\n";
+export declare const STARTER_REVIEW_JOB = "import { DB_CLIENT, Inject, Injectable, Job } from \"@supacloud/app\";\nimport { ApplicationError } from \"@supacloud/elysia\";\nimport { t } from \"elysia\";\nimport type { Static } from \"elysia/type\";\n\nexport const AttachmentInput = t.Object({\n  reviewId: t.String({ minLength: 1, maxLength: 100 }),\n  version: t.Integer({ minimum: 2 }),\n  artifactId: t.String({ format: \"uuid\" }),\n}, { additionalProperties: false });\n\nexport const AttachmentResult = t.Object({\n  ...AttachmentInput.properties,\n  sha256: t.String({ pattern: \"^[a-f0-9]{64}$\" }),\n  bytes: t.Integer({ minimum: 1, maximum: 1048576 }),\n}, { additionalProperties: false });\n\nexport type ReviewAttachmentInput = Static<typeof AttachmentInput>;\nexport type ReviewAttachmentResult = Static<typeof AttachmentResult>;\n\nexport interface ReviewAttachmentStore {\n  // Reauthorize before returning a committed result; null means execution is still needed.\n  readResult(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult | null>;\n  // Resolve the immutable artifact under the worker's own authorization and current review revision.\n  readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;\n  // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.\n  recordAttachment(input: ReviewAttachmentInput, result: ReviewAttachmentResult): Promise<ReviewAttachmentResult>;\n}\n\n@Injectable({ scope: \"job\" })\n@Job({\n  name: \"review.verify-attachment\", mode: \"task\", idempotency: \"required\",\n  timeoutSec: 30, maxAttempts: 3, input: AttachmentInput, output: AttachmentResult,\n})\nexport class VerifyReviewAttachment {\n  constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}\n\n  async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {\n    const committed = await this.store.readResult(input);\n    if (committed !== null) return committed;\n    const source = await this.store.readAttachment(input);\n    if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {\n      throw new ApplicationError(\"Attachment size is outside the supported range\", { code: \"ATTACHMENT_SIZE_INVALID\" });\n    }\n    const digest = await crypto.subtle.digest(\"SHA-256\", new Uint8Array(source.body));\n    const sha256 = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n    if (sha256 !== source.sha256) {\n      throw new ApplicationError(\"Attachment integrity check failed\", { code: \"ATTACHMENT_INTEGRITY_FAILED\" });\n    }\n    return this.store.recordAttachment(input, { ...input, sha256, bytes: source.body.byteLength });\n  }\n}\n";
+export declare const STARTER_REVIEW_JOB_TEST = "import { expect, test } from \"bun:test\";\nimport { VerifyReviewAttachment, type ReviewAttachmentResult } from \"../src/review/attachment\";\n\nconst input = { reviewId: \"review\", version: 2, artifactId: \"11111111-1111-4111-8111-111111111111\" };\nconst body = new TextEncoder().encode(\"review attachment\");\nconst sha256 = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", body)),\n  byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\ntest(\"attachment job awaits the authorized reader and the committed result\", async () => {\n  let recorded: ReviewAttachmentResult | undefined;\n  const job = new VerifyReviewAttachment({\n    async readResult() { return null; },\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },\n  });\n  expect(await job.run(input)).toEqual({ ...input, sha256, bytes: body.byteLength });\n  expect(recorded).toEqual({ ...input, sha256, bytes: body.byteLength });\n});\n\ntest(\"missing authorization, corrupted bytes and persistence failures are not successful jobs\", async () => {\n  let records = 0;\n  for (const readAttachment of [\n    async () => { throw new Error(\"Access denied\"); },\n    async () => ({ body, sha256: \"0\".repeat(64) }),\n    async () => ({ body: new Uint8Array(), sha256 }),\n    async () => ({ body: new Uint8Array(1048577), sha256 }),\n  ]) {\n    const job = new VerifyReviewAttachment({\n      async readResult() { return null; },\n      readAttachment, async recordAttachment(_input, result) { records++; return result; },\n    });\n    await expect(job.run(input)).rejects.toThrow();\n  }\n  expect(records).toBe(0);\n  await expect(new VerifyReviewAttachment({\n    async readResult() { return null; },\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment() { throw new Error(\"Commit failed\"); },\n  }).run(input)).rejects.toThrow(\"Commit failed\");\n});\n\ntest(\"a reauthorized committed result avoids another download or write\", async () => {\n  const result = { ...input, sha256, bytes: body.byteLength };\n  const job = new VerifyReviewAttachment({\n    async readResult() { return result; },\n    async readAttachment() { throw new Error(\"Must not download again\"); },\n    async recordAttachment() { throw new Error(\"Must not write again\"); },\n  });\n  expect(await job.run(input)).toEqual(result);\n  await expect(new VerifyReviewAttachment({\n    async readResult() { throw new Error(\"Access revoked\"); },\n    async readAttachment() { throw new Error(\"Must not download\"); },\n    async recordAttachment() { throw new Error(\"Must not write\"); },\n  }).run(input)).rejects.toThrow(\"Access revoked\");\n});\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.101.0",
+  "version": "0.101.2",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,18 +52,18 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.46.3",
+    "@supacloud/compiler": "^0.46.4",
     "@supacloud/delivery": "0.18.1",
     "@supacloud/db": "0.17.1",
     "typebox": "1.3.37"
   },
   "overrides": {
-    "@supacloud/contracts": "0.9.0",
+    "@supacloud/contracts": "0.10.0",
     "@supacloud/delivery": "0.18.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
-    "@supacloud/elysia": "0.31.0",
+    "@supacloud/elysia": "0.31.1",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
     "elysia": "2.0.0-beta.32",