@supacloud/cli 0.106.3 → 0.107.0

package/dist/index.js

@@ -21588,16 +21588,16 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.50.1"
+      version: "0.51.0"
     },
     app: {
-      version: "0.31.1",
+      version: "0.32.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.35.2"
+      version: "0.36.0"
     },
     commands: {
       version: "0.11.0"
@@ -25364,7 +25364,7 @@ export function createCompiledModules(): never {
 `,
     "src/review/review.ts": `import { Effect } from "effect";
 import {
-  Body, Command, Controller, DB_CLIENT, Get, Inject, Param, Post,
+  Body, Command, Controller, DB_CLIENT, Get, Inject, Injectable, Param, Post,
   defineFeatureSlice, defineFeatureSpec, type Aspect,
 } from "@supacloud/app";
 import { ApplicationError, assertFeatureTransition, createSchemaDecoder } from "@supacloud/elysia";
@@ -25408,6 +25408,7 @@ function readReview(value: unknown): Review {
   }
 }
 
+@Injectable({ scope: "request" })
 @Command({
   name: "review.approve", permission: "review.approve", transaction: "required",
   idempotency: "required", audit: "review.approved", aspects: [requireRequest],
@@ -26253,7 +26254,7 @@ test("${name} controller preserves an asynchronous read failure", async () => {
 // src/shared/tools/app-feature.ts
 function featureScaffold(name, className, governance) {
   const commandName = `${name}.approve`;
-  const { permission, rpc, database } = governance;
+  const { permission, readPermission, rpc, database } = governance;
   const databaseImportPath = governance.databaseImportPath ?? `../../../${database.source.replace(/\.(?:[cm]?tsx?|mts|cts)$/, "")}`;
   const rowTypeRoot = database.rowType.split(".")[0];
   return {
@@ -26375,6 +26376,7 @@ export const ${className}Refresher = new InjectionToken<${className}RefreshPort>
 `,
     [`${name}.service.ts`]: `import {
     FeatureAdapterError, Inject, Injectable, Optional, REQUEST_CONTEXT, requireFeatureOperationResult,
+    requireFeaturePermission,
     requireFeatureRequestContext, requireFeatureTransitionResult,
     type FeatureRequestContext,
 } from "@supacloud/app/core";
@@ -26407,13 +26409,17 @@ export class ${className}Service {
     }
 
     async list(input: Parameters<${className}ReadPort["list"]>[1]): Promise<${className}Result[]> {
+        const context = this.context();
+        requireFeaturePermission(context, ${JSON.stringify(readPermission)});
         if (!this.reader) throw new FeatureAdapterError("${name}.reader");
-        return this.reader.list(this.context(), input);
+        return this.reader.list(context, input);
     }
 
     async detail(id: string): Promise<${className}Result> {
+        const context = this.context();
+        requireFeaturePermission(context, ${JSON.stringify(readPermission)});
         if (!this.reader) throw new FeatureAdapterError("${name}.reader");
-        return this.reader.detail(this.context(), id);
+        return this.reader.detail(context, id);
     }
 
     async approve(id: string, input: ${className}ApproveInput): Promise<${className}Result> {
@@ -26427,17 +26433,21 @@ export class ${className}Service {
     }
 
     async receipt(id: string, operationId: string): Promise<Awaited<ReturnType<${className}ReceiptPort["lookup"]>>> {
+        const context = this.context();
+        requireFeaturePermission(context, ${JSON.stringify(readPermission)});
         if (!this.receipts) throw new FeatureAdapterError("${name}.receipts");
         const input = { id, operationId };
         // Keep the comparison identity separate from mutable adapter arguments.
-        return requireFeatureOperationResult(input, await this.receipts.lookup(this.context(), { ...input }));
+        return requireFeatureOperationResult(input, await this.receipts.lookup(context, { ...input }));
     }
 
     async jobStatus(id: string, operationId: string): Promise<${className}JobStatusResult> {
+        const context = this.context();
+        requireFeaturePermission(context, ${JSON.stringify(readPermission)});
         if (!this.jobStatuses) throw new FeatureAdapterError("${name}.job-statuses");
         const input = { id, operationId };
         // Keep the comparison identity separate from mutable adapter arguments.
-        return requireFeatureOperationResult(input, await this.jobStatuses.lookup(this.context(), { ...input }));
+        return requireFeatureOperationResult(input, await this.jobStatuses.lookup(context, { ...input }));
     }
 }
 `,
@@ -26475,6 +26485,21 @@ export const featureSpec = defineFeatureSpec({
     states: ["draft", "approved"],
     database: ${JSON.stringify(database)},
     tenantField: "tenant_id",
+    readPermission: ${JSON.stringify(readPermission)},
+    requiredAdapters: [
+        "${className}Reader",
+        "${className}Writer",
+        "${className}Receipts",
+        "${className}JobStatuses",
+        "${className}Refresher",
+    ],
+    requiredAdapterScopes: {
+        ${className}Reader: "request",
+        ${className}Writer: "request",
+        ${className}Receipts: "request",
+        ${className}JobStatuses: "request",
+        ${className}Refresher: "job",
+    },
     transitions: {
         approve: {
             from: "draft", to: "approved", command: "Approve${className}Command",
@@ -26531,7 +26556,7 @@ type ${className}JobStatusError =
     | { readonly _tag: "FEATURE_ADAPTER_UNAVAILABLE" };
 
 @Injectable({ scope: "request" })
-@Query({ name: "${name}.list", tenantScope: "required" })
+@Query({ name: "${name}.list", permission: ${JSON.stringify(readPermission)}, tenantScope: "required" })
 export class List${className}Query {
     constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
     execute(input: ${className}ListInput): Promise<${className}Result[]> {
@@ -26539,6 +26564,33 @@ export class List${className}Query {
     }
 }
 
+@Injectable({ scope: "request" })
+@Query({ name: "${name}.detail", permission: ${JSON.stringify(readPermission)}, tenantScope: "required" })
+export class Detail${className}Query {
+    constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
+    execute(id: string): Promise<${className}Result> {
+        return this.service.detail(id);
+    }
+}
+
+@Injectable({ scope: "request" })
+@Query({ name: "${name}.receipt", permission: ${JSON.stringify(readPermission)}, tenantScope: "required" })
+export class Receipt${className}Query {
+    constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
+    execute(id: string, operationId: string): Promise<${className}ReceiptResult> {
+        return this.service.receipt(id, operationId);
+    }
+}
+
+@Injectable({ scope: "request" })
+@Query({ name: "${name}.job-status", permission: ${JSON.stringify(readPermission)}, tenantScope: "required" })
+export class JobStatus${className}Query {
+    constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
+    execute(id: string, operationId: string): Promise<${className}JobStatusResult> {
+        return this.service.jobStatus(id, operationId);
+    }
+}
+
 @Injectable({ scope: "request" })
 @Command({
     name: ${JSON.stringify(commandName)},
@@ -26580,11 +26632,14 @@ export class Refresh${className}Job {
 export class ${className}Controller {
     constructor(
         @Inject(List${className}Query) private readonly listQuery: List${className}Query,
+        @Inject(Detail${className}Query) private readonly detailQuery: Detail${className}Query,
+        @Inject(Receipt${className}Query) private readonly receiptQuery: Receipt${className}Query,
+        @Inject(JobStatus${className}Query) private readonly jobStatusQuery: JobStatus${className}Query,
         @Inject(Approve${className}Command) private readonly approveCommand: Approve${className}Command,
-        @Inject(${className}Service) private readonly service: ${className}Service,
     ) {}
 
     @Get("/", {
+        permission: ${JSON.stringify(readPermission)},
         query: ${className}ListQuery,
         tags: [${JSON.stringify(`${name}.list`)}],
         responses: { 200: ${className}ListResponse },
@@ -26604,6 +26659,7 @@ export class ${className}Controller {
     }
 
     @Get("/:id", {
+        permission: ${JSON.stringify(readPermission)},
         params: ${className}Params,
         tags: [${JSON.stringify(`${name}.detail`)}],
         responses: { 200: ${className}Row },
@@ -26619,7 +26675,7 @@ export class ${className}Controller {
         },
     })
     detail(@Param("id") id: string): Effect.Effect<${className}Result, ${className}ListError, never> {
-        return Effect.promise(() => this.service.detail(id));
+        return Effect.promise(() => this.detailQuery.execute(id));
     }
 
     @Post("/:id/approve", {
@@ -26651,6 +26707,7 @@ export class ${className}Controller {
     }
 
     @Get("/:id/operations/:operationId", {
+        permission: ${JSON.stringify(readPermission)},
         params: ${className}ReceiptParams,
         tags: [${JSON.stringify(`${name}.receipt`)}],
         responses: { 200: ${className}Receipt },
@@ -26672,10 +26729,11 @@ export class ${className}Controller {
         @Param("id") id: string,
         @Param("operationId") operationId: string,
     ): Effect.Effect<${className}ReceiptResult, ${className}ReceiptError, never> {
-        return Effect.promise(() => this.service.receipt(id, operationId));
+        return Effect.promise(() => this.receiptQuery.execute(id, operationId));
     }
 
     @Get("/:id/operations/:operationId/status", {
+        permission: ${JSON.stringify(readPermission)},
         params: ${className}ReceiptParams,
         tags: [${JSON.stringify(`${name}.job-status`)}],
         responses: { 200: ${className}JobStatus },
@@ -26696,7 +26754,7 @@ export class ${className}Controller {
         @Param("id") id: string,
         @Param("operationId") operationId: string,
     ): Effect.Effect<${className}JobStatusResult, ${className}JobStatusError, never> {
-        return Effect.promise(() => this.service.jobStatus(id, operationId));
+        return Effect.promise(() => this.jobStatusQuery.execute(id, operationId));
     }
 }
 
@@ -26704,7 +26762,14 @@ export const ${className}Feature = defineFeatureSlice({
     name: ${JSON.stringify(name)},
     tags: ["type:feature"],
     spec: featureSpec,
-    providers: [${className}Service, List${className}Query, Approve${className}Command],
+    providers: [
+        ${className}Service,
+        List${className}Query,
+        Detail${className}Query,
+        Receipt${className}Query,
+        JobStatus${className}Query,
+        Approve${className}Command,
+    ],
     controllers: [${className}Controller],
     jobs: [Refresh${className}Job],
 });
@@ -26880,13 +26945,13 @@ export const ${className}RequestContext = {
     requestId: "request-example",
     tenantId: "tenant-example",
     actorId: "reviewer-example",
-    permissions: [${JSON.stringify(permission)}],
+    permissions: [${JSON.stringify(permission)}, ${JSON.stringify(readPermission)}],
 } as const;
 
 export const ${className}RequestEnvelope = {
     ...${className}RequestContext,
     identity: { authenticated: true, subject: "reviewer-example" },
-    access: { tenantId: "tenant-example", permissions: [${JSON.stringify(permission)}] },
+    access: { tenantId: "tenant-example", permissions: [${JSON.stringify(permission)}, ${JSON.stringify(readPermission)}] },
 } as const satisfies Record<string, unknown>;
 
 export const ${className}JobRequestEnvelope = {
@@ -27739,11 +27804,12 @@ async function generateScaffold(args) {
   if ((kind === "resource" || kind === "feature") && (args.force || args.module !== undefined)) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `${kind} creates its own module; use --name and optionally --register-in, never --force or --module`);
   }
-  if (kind !== "feature" && (args.permission !== undefined || args.rpc !== undefined)) {
-    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--permission and --rpc are only supported for feature generation");
+  if (kind !== "feature" && (args.permission !== undefined || args.read_permission !== undefined || args.rpc !== undefined)) {
+    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--permission, --read-permission and --rpc are only supported for feature generation");
   }
   const featureGovernance = kind === "feature" ? {
     permission: requireFeatureCapability(args.permission, "permission"),
+    readPermission: requireFeatureCapability(args.read_permission, "read-permission"),
     rpc: requireFeatureCapability(args.rpc, "rpc"),
     database: {
       source: requireFeatureDatabase(args.database_source, "database-source", /^(?!\/)(?!.*\\)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/),
@@ -29033,7 +29099,7 @@ Execution: skipped`);
   return format === "json" || json ? result : formatPromotionExecution(result);
 }
 async function runAppTool(request, options = {}) {
-  if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined || request.database_source !== undefined && request["database-source"] !== undefined || request.database_table !== undefined && request["database-table"] !== undefined || request.database_type !== undefined && request["database-type"] !== undefined || request.request_id !== undefined && request["request-id"] !== undefined) {
+  if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined || request.database_source !== undefined && request["database-source"] !== undefined || request.database_table !== undefined && request["database-table"] !== undefined || request.database_type !== undefined && request["database-type"] !== undefined || request.read_permission !== undefined && request["read-permission"] !== undefined || request.request_id !== undefined && request["request-id"] !== undefined) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "Do not combine hyphenated and underscored aliases of the same flag");
   }
   request = {
@@ -29044,6 +29110,7 @@ async function runAppTool(request, options = {}) {
     ...request["database-source"] === undefined ? {} : { database_source: request["database-source"] },
     ...request["database-table"] === undefined ? {} : { database_table: request["database-table"] },
     ...request["database-type"] === undefined ? {} : { database_type: request["database-type"] },
+    ...request["read-permission"] === undefined ? {} : { read_permission: request["read-permission"] },
     ...request["request-id"] === undefined ? {} : { request_id: request["request-id"] }
   };
   if (request.events !== undefined || request.request_id !== undefined) {
@@ -29218,6 +29285,8 @@ function registerAppTools(server, options = {}) {
     name: optional(String2(), "[init/generate] Project or object name"),
     module: optional(String2(), "[generate] Target feature module (required for command/query/controller)"),
     permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    read_permission: optional(String2(), "[generate feature] Explicit read permission; not inferred from name"),
+    "read-permission": optional(String2(), "[generate feature] CLI alias of read_permission"),
     rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
     database_source: optional(String2(), "[generate feature] Project-relative database source path"),
     database_table: optional(String2(), "[generate feature] Schema-qualified table owned by the feature"),
@@ -29258,6 +29327,8 @@ function registerAppAliases(server) {
     name: optional(String2(), "[generate] Object name"),
     module: optional(String2(), "[generate] Target feature module"),
     permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    read_permission: optional(String2(), "[generate feature] Explicit read permission; not inferred from name"),
+    "read-permission": optional(String2(), "[generate feature] CLI alias of read_permission"),
     rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
     database_source: optional(String2(), "[generate feature] Project-relative database source path"),
     database_table: optional(String2(), "[generate feature] Schema-qualified table owned by the feature"),
@@ -32983,7 +33054,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.106.3",
+  version: "0.107.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -33035,7 +33106,7 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.50.1",
+    "@supacloud/compiler": "^0.51.0",
     "@supacloud/delivery": "0.21.0",
     "@supacloud/db": "0.20.0",
     typebox: "1.3.37"
@@ -33047,7 +33118,7 @@ var package_default = {
   },
   devDependencies: {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.35.2",
+    "@supacloud/elysia": "0.36.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",

package/dist/shared/tools/app-feature.d.ts

@@ -4,6 +4,7 @@
  */
 export declare function featureScaffold(name: string, className: string, governance: {
     permission: string;
+    readPermission: string;
     rpc: string;
     database: {
         source: string;

package/dist/shared/tools/app-tools.d.ts

@@ -71,6 +71,8 @@ export interface AppToolArguments {
     name?: string;
     module?: string;
     permission?: string;
+    read_permission?: string;
+    "read-permission"?: string;
     rpc?: string;
     database_source?: string;
     database_table?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.106.3",
+  "version": "0.107.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,7 +52,7 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.50.1",
+    "@supacloud/compiler": "^0.51.0",
     "@supacloud/delivery": "0.21.0",
     "@supacloud/db": "0.20.0",
     "typebox": "1.3.37"
@@ -64,7 +64,7 @@
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.35.2",
+    "@supacloud/elysia": "0.36.0",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
     "elysia": "2.0.0-beta.32",