@supacloud/cli 0.95.0 → 0.96.0

package/README.md

@@ -476,7 +476,7 @@ Example configuration write file:
   "configuration_id": "01234567-89ab-4def-8123-456789abcdef",
   "expected_configuration_id": null,
   "configuration": {
-    "bun_version": "1.4.2",
+    "bun_version": "1.4.3",
     "targets": [
       {
         "name": "api",

package/dist/index.js

@@ -9964,22 +9964,28 @@ function validateWorkerExecution(groups) {
 var objectOptions = { additionalProperties: false };
 var reference = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
 var references = _Array_(reference, { uniqueItems: true });
-var kind = Union([Literal("api"), Literal("jobs"), Literal("webhook")]);
+var kind = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
 var isolation = Union([Literal("shared"), Literal("process")]);
 var DeliveryFilePathSchema = String2({
   maxLength: 512,
   pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
 });
+var functionTarget = _Object_({
+  slug: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
+  entrypoint: DeliveryFilePathSchema,
+  verifyJwt: Boolean2()
+}, objectOptions);
 var DeliveryOptionsSchema = _Object_({
   version: Literal(1),
   execution: Optional(WorkerExecutionSchema),
   targets: Optional(_Array_(_Object_({
     name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
     kind,
-    modules: _Array_(reference, { minItems: 1, uniqueItems: true }),
+    modules: Optional(_Array_(reference, { minItems: 1, uniqueItems: true })),
     isolation: Optional(isolation),
     capabilities: Optional(references),
-    compute: Optional(ComputeResourcesSchema)
+    compute: Optional(ComputeResourcesSchema),
+    function: Optional(functionTarget)
   }, objectOptions))),
   runtime: Optional(_Object_({
     processIsolation: Boolean2(),
@@ -10057,6 +10063,7 @@ var DeliveryTargetSchema = _Object_({
   routes: _Array_(routeSchema),
   jobs: _Array_(jobSchema),
   externalTokens: _Array_(String2()),
+  function: Optional(functionTarget),
   requirements: _Object_({
     processIsolation: Boolean2(),
     durableQueue: Boolean2(),
@@ -21099,7 +21106,7 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.45.0"
+      version: "0.46.0"
     },
     app: {
       version: "0.26.1",
@@ -21117,7 +21124,7 @@ var starter_metadata_default = {
       version: "0.8.1"
     },
     db: {
-      version: "0.16.2",
+      version: "0.17.0",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-169397b"
       },
@@ -21126,7 +21133,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.41.2",
+      version: "0.42.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -21451,7 +21458,7 @@ function baseFiles(name, sdkDependencies) {
       version: "0.0.0",
       private: true,
       type: "module",
-      engines: { bun: ">=1.4.2" },
+      engines: { bun: ">=1.4.3" },
       scripts: {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
@@ -21475,7 +21482,7 @@ function baseFiles(name, sdkDependencies) {
       },
       devDependencies: {
         "@supacloud/compiler": `^${compilerMetadata.version}`,
-        "@types/bun": "^1.4.2",
+        "@types/bun": "^1.4.3",
         typescript: "^7.0.2"
       }
     }),
@@ -22135,7 +22142,11 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
 
 // src/shared/tools/app-starter-attachment-worker.ts
 var STARTER_ATTACHMENT_WORKER = `import { createWorker, type CompiledModule } from "@supacloud/elysia";
-import type { SupaCloudWorkflowClaim, SupaCloudWorkflowsClient } from "@supacloud/js";
+import {
+  createSupaCloudWorkflowTransport,
+  type SupaCloudWorkflowClaim,
+  type SupaCloudWorkflowsClient,
+} from "@supacloud/js";
 import { createReviewAttachmentAdapters, type ReviewAttachmentOptions } from "./review-attachments";
 
 export interface ReviewAttachmentWorkerOptions extends ReviewAttachmentOptions {
@@ -22160,9 +22171,6 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
     halted = true;
     failure.reject(new Error("Attachment worker requires recovery"));
   };
-  const attempt = (claim: SupaCloudWorkflowClaim) => ({
-    stepId: claim.stepId, messageId: claim.messageId, attempt: claim.attempt, workerId: claim.workerId,
-  });
   async function ownedClaim(claim: SupaCloudWorkflowClaim) {
     if (claim.workflowName !== "review.verify-attachment" || claim.workflowVersion !== "1"
       || claim.stepKey !== "verify" || claim.maxAttempts !== 3 || claim.workerId !== workerId) {
@@ -22178,6 +22186,9 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
     ));
     if (!Array.isArray(bound) || bound.length !== 1) throw new Error("Attachment workflow ownership mismatch");
   }
+  const workflowTransport = createSupaCloudWorkflowTransport({
+    workflows, workerId, visibilityTimeoutSeconds: 120, retryDelaySeconds: 5, acceptClaim: ownedClaim,
+  });
   const worker = createWorker({
     modules: options.modules, deps: { dbClient: store }, workerId, concurrency: 1,
     pollIntervalMs: options.pollIntervalMs ?? 1000,
@@ -22186,11 +22197,7 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
       async claim(signal): Promise<SupaCloudWorkflowClaim | null> {
         if (halted || signal.aborted) return null;
         try {
-          const claim = await workflows.claim({ workerId, visibilityTimeoutSeconds: 120 });
-          if (signal.aborted || halted) return null;
-          if (!claim || claim.status !== "claimed") return null;
-          await ownedClaim(claim);
-          return claim;
+          return await workflowTransport.claim(signal);
         } catch {
           if (!signal.aborted) fatal();
           throw new Error("Attachment workflow claim failed");
@@ -22198,9 +22205,7 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
       },
       async ack(claim, output) {
         try {
-          if (!output || typeof output !== "object" || Array.isArray(output)) throw new Error("Invalid Job output");
-          // The compiled Job validates output; Workflow SDK validates the receipt.
-          await workflows.complete({ ...attempt(claim), runOutput: { ...output } });
+          await workflowTransport.ack(claim, output);
         } catch {
           fatal();
           throw new Error("Attachment workflow completion is unconfirmed");
@@ -22208,9 +22213,7 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
       },
       async fail(claim) {
         try {
-          const request: Parameters<typeof workflows.fail>[0] = { ...attempt(claim), errorMessage: "Attachment verification failed" };
-          if (claim.attempt < claim.maxAttempts) await workflows.retry({ ...request, delaySeconds: 5 });
-          else await workflows.fail(request);
+          await workflowTransport.fail(claim, "Attachment verification failed");
         } catch {
           fatal();
           throw new Error("Attachment workflow failure receipt is unconfirmed");
@@ -22394,9 +22397,11 @@ export class ReviewUploadsController {
 var STARTER_UPLOAD_SCHEMA = `-- Apply explicitly with the migration owner.
 ALTER TABLE public.starter_members ADD COLUMN storage_subject uuid UNIQUE;
 GRANT SELECT (subject,enabled,can_approve,storage_subject) ON public.starter_members TO authenticated;
+DROP POLICY IF EXISTS starter_member_read ON public.starter_members;
 CREATE POLICY starter_member_read ON public.starter_members FOR SELECT TO authenticated
   USING (subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND storage_subject=auth.uid());
 GRANT SELECT ON public.starter_reviews TO authenticated;
+DROP POLICY IF EXISTS starter_review_read ON public.starter_reviews;
 CREATE POLICY starter_review_read ON public.starter_reviews FOR SELECT TO authenticated
   USING (owner_id=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND EXISTS (
     SELECT 1 FROM public.starter_members m WHERE m.subject=owner_id
@@ -22404,11 +22409,14 @@ CREATE POLICY starter_review_read ON public.starter_reviews FOR SELECT TO authen
   ));
 INSERT INTO storage.buckets(id,name,public,file_size_limit,allowed_mime_types)
   VALUES ('review-attachments','review-attachments',false,1048576,ARRAY['text/plain']);
+DROP POLICY IF EXISTS starter_attachment_read ON storage.objects;
 CREATE POLICY starter_attachment_read ON storage.objects FOR SELECT TO authenticated
   USING (bucket_id='review-attachments');
+DROP POLICY IF EXISTS starter_attachment_insert ON storage.objects;
 CREATE POLICY starter_attachment_insert ON storage.objects FOR INSERT TO authenticated
   WITH CHECK (bucket_id='review-attachments');
 -- Restrictive fences also apply when the host already has permissive Storage policies.
+DROP POLICY IF EXISTS starter_attachment_owner_fence ON storage.objects;
 CREATE POLICY starter_attachment_owner_fence ON storage.objects AS RESTRICTIVE FOR ALL TO authenticated
   USING (bucket_id<>'review-attachments' OR (split_part(name,'/',1)=auth.uid()::text AND EXISTS (
     SELECT 1 FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id
@@ -22421,8 +22429,10 @@ CREATE POLICY starter_attachment_owner_fence ON storage.objects AS RESTRICTIVE F
       WHERE r.id=split_part(name,'/',2) AND r.state='draft' AND m.subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub')
         AND m.storage_subject=auth.uid() AND m.enabled AND m.can_approve
     )));
+DROP POLICY IF EXISTS starter_attachment_update_fence ON storage.objects;
 CREATE POLICY starter_attachment_update_fence ON storage.objects AS RESTRICTIVE FOR UPDATE TO authenticated
   USING (bucket_id<>'review-attachments') WITH CHECK (bucket_id<>'review-attachments');
+DROP POLICY IF EXISTS starter_attachment_delete_fence ON storage.objects;
 CREATE POLICY starter_attachment_delete_fence ON storage.objects AS RESTRICTIVE FOR DELETE TO authenticated
   USING (bucket_id<>'review-attachments');
 `;
@@ -22570,6 +22580,11 @@ function renderStarterRuntimeRolesSchema(httpRole, workerRole) {
 CREATE ROLE ${httpRole} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
 CREATE ROLE ${workerRole} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
 GRANT USAGE ON SCHEMA public TO ${httpRole}, ${workerRole};
+ALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.starter_attachments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.starter_attachment_results ENABLE ROW LEVEL SECURITY;
 GRANT SELECT ON public.starter_application, public.starter_members,
   public.starter_reviews, public.starter_attachments TO ${httpRole}, ${workerRole};
 
@@ -22583,34 +22598,49 @@ GRANT UPDATE(id) ON public.starter_reviews TO ${workerRole};
 GRANT INSERT ON public.starter_attachments TO ${httpRole};
 GRANT SELECT,INSERT ON public.starter_attachment_results TO ${workerRole};
 
+DROP POLICY IF EXISTS starter_backend_binding_read ON public.starter_application;
 CREATE POLICY starter_backend_binding_read ON public.starter_application FOR SELECT
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_binding_lock ON public.starter_application;
 CREATE POLICY starter_backend_binding_lock ON public.starter_application FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_binding_immutable ON public.starter_application;
 CREATE POLICY starter_backend_binding_immutable ON public.starter_application AS RESTRICTIVE FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true) WITH CHECK (false);
+DROP POLICY IF EXISTS starter_backend_member_read ON public.starter_members;
 CREATE POLICY starter_backend_member_read ON public.starter_members FOR SELECT
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_member_lock ON public.starter_members;
 CREATE POLICY starter_backend_member_lock ON public.starter_members FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_member_immutable ON public.starter_members;
 CREATE POLICY starter_backend_member_immutable ON public.starter_members AS RESTRICTIVE FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true) WITH CHECK (false);
+DROP POLICY IF EXISTS starter_backend_review_read ON public.starter_reviews;
 CREATE POLICY starter_backend_review_read ON public.starter_reviews FOR SELECT
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_review_update ON public.starter_reviews;
 CREATE POLICY starter_backend_review_update ON public.starter_reviews FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_worker_review_immutable ON public.starter_reviews;
 CREATE POLICY starter_worker_review_immutable ON public.starter_reviews AS RESTRICTIVE FOR UPDATE
   TO ${workerRole} USING (true) WITH CHECK (false);
+DROP POLICY IF EXISTS starter_backend_attachment_read ON public.starter_attachments;
 CREATE POLICY starter_backend_attachment_read ON public.starter_attachments FOR SELECT
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_attachment_lock ON public.starter_attachments;
 CREATE POLICY starter_backend_attachment_lock ON public.starter_attachments FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_backend_attachment_immutable ON public.starter_attachments;
 CREATE POLICY starter_backend_attachment_immutable ON public.starter_attachments AS RESTRICTIVE FOR UPDATE
   TO ${httpRole}, ${workerRole} USING (true) WITH CHECK (false);
+DROP POLICY IF EXISTS starter_http_attachment_insert ON public.starter_attachments;
 CREATE POLICY starter_http_attachment_insert ON public.starter_attachments FOR INSERT
   TO ${httpRole} WITH CHECK (true);
+DROP POLICY IF EXISTS starter_worker_result_read ON public.starter_attachment_results;
 CREATE POLICY starter_worker_result_read ON public.starter_attachment_results FOR SELECT
   TO ${workerRole} USING (true);
+DROP POLICY IF EXISTS starter_worker_result_insert ON public.starter_attachment_results;
 CREATE POLICY starter_worker_result_insert ON public.starter_attachment_results FOR INSERT
   TO ${workerRole} WITH CHECK (true);
 
@@ -23001,6 +23031,80 @@ export const attachmentResults = pgTable.withRLS("starter_attachment_results", {
 export type ReviewRow = typeof reviews.$inferSelect;
 export type NewReview = typeof reviews.$inferInsert;
 `;
+var STARTER_DATABASE_MODULES = `import { defineDatabaseModule } from "@supacloud/db";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import { application, reviews, members, attachments, attachmentResults } from "./schema";
+
+const backendPolicies = [
+  ["starter_backend_binding_read", "public.starter_application", "select", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_binding_lock", "public.starter_application", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_binding_immutable", "public.starter_application", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_member_read", "public.starter_members", "select", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_member_lock", "public.starter_members", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_member_immutable", "public.starter_members", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_review_read", "public.starter_reviews", "select", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_review_update", "public.starter_reviews", "update", ["starter_review_http"]],
+  ["starter_worker_review_immutable", "public.starter_reviews", "update", ["starter_review_worker"]],
+  ["starter_backend_attachment_read", "public.starter_attachments", "select", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_attachment_lock", "public.starter_attachments", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_backend_attachment_immutable", "public.starter_attachments", "update", ["starter_review_http", "starter_review_worker"]],
+  ["starter_http_attachment_insert", "public.starter_attachments", "insert", ["starter_review_http"]],
+  ["starter_worker_result_read", "public.starter_attachment_results", "select", ["starter_review_worker"]],
+  ["starter_worker_result_insert", "public.starter_attachment_results", "insert", ["starter_review_worker"]],
+] as const;
+
+// The module is the single live-Catalog ownership contract for starter tables.
+export default defineDatabaseModule({
+  name: "starter",
+  tables: [application, reviews, members, attachments, attachmentResults].map(table => {
+    const config = getTableConfig(table);
+    return (config.schema ?? "public") + "." + config.name;
+  }),
+  policies: [
+    ...backendPolicies.map(([name, table, operation, roles]) => ({
+      name, table, operation, roles: [...roles], source: "migrations/004-review-runtime-roles.sql",
+      tests: ["tests/database-governance.sql"],
+    })),
+    {
+      name: "starter_member_read", table: "public.starter_members", operation: "select",
+      roles: ["authenticated"], source: "migrations/003-review-uploads.sql",
+      tests: ["tests/database-governance.sql"],
+    },
+    {
+      name: "starter_review_read", table: "public.starter_reviews", operation: "select",
+      roles: ["authenticated"], source: "migrations/003-review-uploads.sql",
+      tests: ["tests/database-governance.sql"],
+    },
+  ],
+});
+`;
+var STARTER_DATABASE_TEST = `-- Read-only catalog assertions; behavioral authorization tests remain separate.
+BEGIN READ ONLY;
+DO $test$
+DECLARE
+  owned text[] := ARRAY['starter_application','starter_reviews','starter_members',
+    'starter_attachments','starter_attachment_results'];
+BEGIN
+  IF (SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+      WHERE n.nspname='public' AND c.relname=ANY(owned) AND c.relrowsecurity) <> 5 THEN
+    RAISE EXCEPTION 'All starter tables must exist with RLS enabled';
+  END IF;
+  IF (SELECT count(*) FROM pg_policy p JOIN pg_class c ON c.oid=p.polrelid
+      JOIN pg_namespace n ON n.oid=c.relnamespace
+      WHERE n.nspname='public' AND c.relname=ANY(owned)) <> 17 THEN
+    RAISE EXCEPTION 'Starter policy inventory changed; reconcile db/modules.ts';
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')
+      AND (rolsuper OR rolbypassrls)) THEN
+    RAISE EXCEPTION 'Starter roles must not bypass row security';
+  END IF;
+  IF (SELECT count(*) FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')) <> 2 THEN
+    RAISE EXCEPTION 'Starter runtime roles are missing';
+  END IF;
+END
+$test$;
+ROLLBACK;
+`;
 var STARTER_DATABASE_GUIDE = `
 ## Database Source Workflow
 
@@ -23012,13 +23116,14 @@ Opaque JSON still needs runtime decoding.
 After installing dependencies, run \`bun run db:generate\` once and commit db/contracts/.
 The default \`bun run check\` and build fail on stale database contracts before any
 compiler regeneration. After an intentional source change, run db:generate again,
-review the diff, then run check. Ordinary checks are offline.
-The compiler also runs this source-contract gate on compile/check/dev through
-databaseGovernance.mode = "check", including incremental cache hits. Missing
-adoption files or stale contracts fail closed; no contracts are silently regenerated.
-This is not SQL lint or live Catalog reconciliation. Before promotion, declare
-the real database modules, their SQL and tests, then explicitly use mode "enforce"
-with a separately selected read-only local/test database connection.
+review the diff, then run check.
+The command starter registers databaseGovernance.moduleFile = "db/modules.ts" and
+keeps the default \`databaseGovernance.mode = "check"\`: compile/check/build run
+the offline source-contract gate without a database. Use \`bun run dev:integration\`
+with the CLI's explicit loopback database URL, or set databaseGovernance.mode to
+"enforce" with an explicitly supplied \`DATABASE_URL\`, to run SQL lint and live
+Catalog reconciliation. Missing connections, stale source contracts and Catalog
+drift fail closed; no contracts or migrations are silently regenerated.
 
 - Maintain one schema-qualified function with explicit grants per db/functions/*.sql.
 - Preserve migrations/ and its existing executor/ledger. Add forward migrations only.
@@ -23042,6 +23147,8 @@ function starterDatabaseFiles() {
     "database.sources.json": JSON.stringify(STARTER_DATABASE_CONFIG, null, 2) + `
 `,
     "db/schema.ts": STARTER_DATABASE_SCHEMA,
+    "db/modules.ts": STARTER_DATABASE_MODULES,
+    "tests/database-governance.sql": STARTER_DATABASE_TEST,
     "db/functions/README.md": `Maintain one schema-qualified function and its explicit EXECUTE ACL per SQL file. No RPC functions are needed by the initial transactional starter.
 `,
     "drizzle.config.ts": `import { defineConfig } from "drizzle-kit";
@@ -23076,7 +23183,7 @@ function appStarterFiles(name) {
       version: "0.0.0",
       private: true,
       type: "module",
-      engines: { bun: ">=1.4.2" },
+      engines: { bun: ">=1.4.3" },
       scripts: {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
@@ -23112,7 +23219,7 @@ function appStarterFiles(name) {
       devDependencies: {
         "@supacloud/compiler": `^${compilerMetadata2.version}`,
         "drizzle-kit": dbMetadata.devDependencies["drizzle-kit"],
-        "@types/bun": "^1.4.2",
+        "@types/bun": "^1.4.3",
         typescript: "^7.0.2"
       }
     }),
@@ -23134,7 +23241,7 @@ function appStarterFiles(name) {
         noEmit: true,
         types: ["bun"]
       },
-      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "db/schema.ts", "db/contracts/**/*.ts", "supacloud.config.ts", "drizzle*.config.ts"]
+      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "db/schema.ts", "db/modules.ts", "db/contracts/**/*.ts", "supacloud.config.ts", "drizzle*.config.ts"]
     }),
     "bunfig.toml": `env = false
 `,
@@ -23168,7 +23275,7 @@ export default defineSupacloudConfig({
   outDir: "generated",
   strict: true,
   moduleBoundaryPreset: "modular-monolith",
-  databaseGovernance: { mode: "check" },
+  databaseGovernance: { mode: "check", moduleFile: "db/modules.ts", databaseUrlEnv: "DATABASE_URL" },
   effect: {
     requireRouteEffects: true,
     requireErrorMappings: true,
@@ -23182,7 +23289,6 @@ export default defineSupacloudConfig({
   typeSafety: { scanProductionSource: true, noAnyInGenerated: true },
   disallowControllerDirectDb: true,
   detectOrphanModules: true,
-  graphql: { schema: "graphql/schema.graphql" },
   commandCapabilities: { permission: true, transaction: true, idempotency: true, audit: true },
   delivery: {
     version: 1,
@@ -23196,50 +23302,6 @@ export default defineSupacloudConfig({
     },
   },
 });
-`,
-    "graphql/schema.graphql": `# Offline query-contract example, not a deployed database schema.
-# SYNTHETIC TEST FIXTURE ONLY. Database First is the sole server-schema model.
-# Do not extend this fixture as a server schema; change database declarations and export.
-# Replace using a snapshot exported with the intended caller role before integration.
-type Query {
-  reviewCollection(first: Int): ReviewConnection!
-}
-type ReviewConnection {
-  edges: [ReviewEdge!]!
-}
-type ReviewEdge {
-  node: Review!
-}
-type Review {
-  id: ID!
-  state: String!
-  version: Int!
-}
-`,
-    "src/review/reviews.graphql": `query ReviewList($first: Int = 20) {
-  reviewCollection(first: $first) {
-    edges { node { id state version } }
-  }
-}
-`,
-    "tests/graphql.test.ts": `import { expect, test } from "bun:test";
-import { createGraphqlClient, type ReviewListQuery } from "../generated/graphql";
-
-test("generated query client preserves its read contract without a live database", async () => {
-  const data: ReviewListQuery = {
-    reviewCollection: { edges: [{ node: { id: "demo", state: "draft", version: 1 } }] },
-  };
-  const queries = createGraphqlClient({
-    url: "https://project.example.test",
-    getAccessToken: async () => "synthetic-user-token",
-    fetch: async (_url, request) => {
-      expect(new Headers(request?.headers).get("Authorization")).toBe("Bearer synthetic-user-token");
-      expect(JSON.parse(String(request?.body)).variables).toEqual({ first: 10 });
-      return Response.json({ data });
-    },
-  });
-  expect(await queries.ReviewList({ first: 10 })).toEqual(data);
-});
 `,
     "REACTIVE.md": STARTER_REACTIVE_GUIDE,
     "AGENTS.md": STARTER_REACTIVE_AGENTS + STARTER_DATABASE_GUIDE,
@@ -23249,11 +23311,30 @@ test("generated query client preserves its read contract without a live database
     "scripts/dev.ts": `import { watchProject, compileOptionsFromConfig, loadSupacloudConfig } from "@supacloud/compiler";
 
 if (process.env["APP_ENV"] !== "development") throw new Error("The demo server is development-only");
+const profile = process.env["SUPACLOUD_DEV_PROFILE"] === "integration" ? "integration" : "fast";
+if (profile === "integration") {
+  const databaseUrl = process.env["SUPACLOUD_DEV_DATABASE_URL"];
+  if (!databaseUrl) throw new Error("Integration requires an explicit loopback PostgreSQL database");
+  const url = new URL(databaseUrl);
+  if (!["postgres:", "postgresql:"].includes(url.protocol)
+    || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+    || url.pathname.length <= 1 || url.search || url.hash
+    || process.env["DATABASE_SOCKET_PATH"]
+    || (process.env["DATABASE_URL"] && process.env["DATABASE_URL"] !== databaseUrl)) {
+    throw new Error("Integration requires an explicit loopback PostgreSQL database without conflicting settings");
+  }
+  process.env["DATABASE_URL"] = databaseUrl;
+}
+const configured = compileOptionsFromConfig(await loadSupacloudConfig());
+const governanceMode = profile === "integration" ? "enforce" as const : "check" as const;
+const options = configured.databaseGovernance
+  ? { ...configured, databaseGovernance: { ...configured.databaseGovernance, mode: governanceMode } }
+  : configured;
 let server: ReturnType<typeof Bun.spawn> | undefined;
 let restarts = Promise.resolve();
 let closing = false;
 const watcher = watchProject({
-  ...compileOptionsFromConfig(await loadSupacloudConfig()),
+  ...options,
   writeOnError: false,
   onEvent: (event) => {
     if (event.type === "compile-error") console.error(event.diagnostics);
@@ -23603,7 +23684,6 @@ test("the production composition root rejects missing governance adapters", () =
 \`\`\`sh
 bun install
 bun run db:generate
-bun run check
 bun run dev
 \`\`\`
 
@@ -23639,55 +23719,23 @@ origin. The authenticated transport rejects missing credentials and redirects
 and does not replay a write after 401. Its underlying fetch must also be
 single-attempt.
 
-Reuse the same session resolver for generated/graphql.ts when adopting queries.
 The local memory demo is not this authenticated production integration.
 Never use supacloud.commands or supacloud.workflows from a browser action:
 those RPCs require service-role credentials. Browser business commands use
 application endpoints, optionally composed through @supacloud/js/contracts.
 Management API tokens and service-role keys remain on trusted servers.
 
-## Typed Queries
-
-This starter uses Database First as its only GraphQL server-schema model.
-Drizzle and reviewed SQL define the database; pg_graphql reflects the migrated
-database under the caller's role. Do not add GraphQL resolver/decorator classes
-or independently authored server SDL. Business writes continue through Commands.
+## Reads
 
-GraphQL is preconfigured as the recommended read path. Edit src/review/reviews.graphql;
-compile, check and dev validate it against graphql/schema.graphql and generate
-generated/graphql.ts. Import createGraphqlClient from that file and call
-queries.ReviewList({ first: 20 }). Its variables and selected results are typed.
-Pass a public project key and a getAccessToken callback that reads the current
-user session. Never pass a service-role key to browser code.
+Ordinary reads use PostgREST through the existing user-scoped
+@supabase/supabase-js client: client.from("starter_reviews").select("id,state,version").
+Use the caller's session, RLS and grants; never introduce a second session store.
+Business writes continue through the governed Command/RPC boundary.
 
-The included schema is a synthetic offline test fixture, not a deployed database.
-Do not hand-edit graphql/schema.graphql to add application fields. Change database
-declarations, apply migrations and export the actual schema. Replace the fixture
-with a snapshot exported under the intended caller role before real integration:
-
-\`\`\`sh
-bun node_modules/@supacloud/compiler/dist/cli.js graphql-schema \\
-  --url https://your-project.example \\
-  --key-env SUPACLOUD_PUBLISHABLE_KEY --token-env APP_USER_ACCESS_TOKEN
-\`\`\`
-
-After migrations or grants change, and before promotion, run the same command
-with --check --json to detect drift without writing. If it fails, explicitly
-re-export, review the snapshot diff, compile and run application typechecks and
-role/RLS tests. Normal compile/check/dev remain offline; they cannot prove that
-a snapshot came from a database or is current. Keep the exported snapshot and
-generated types in version control.
-
-The flags name environment variables, not credential values. Export requires
-GraphQL and introspection already enabled on the selected development project.
-The compiler does not enable extensions or alter database permissions.
-Production introspection may remain disabled. Queries do not pass through
-application Command/AOP; RLS and grants remain mandatory. Business writes stay
-in Commands. Existing projects without GraphQL configuration remain unaffected.
-Enabled contracts always reject invalid queries, including with strict: false.
-To opt this starter out entirely, set graphql: false and remove its example
-query test and unused generated client; do not replace checked queries with
-untyped calls to bypass validation.
+GraphQL is not generated or enabled by this starter. For a specific Query Contract,
+explicitly configure graphql.schema with a role-scoped database export and add
+checked query documents. Drizzle and append-only migrations remain the database
+authority; the export is a protocol snapshot, not a second schema source.
 
 ## Environments
 
@@ -23903,8 +23951,8 @@ bunx supacloud-compiler fix ./fix.json --dry-run
 \`\`\`
 
 Context packs include directional dependencies, relevant aspect files, diagnostics
-and static execution plans. Ordinary context can include declared source expressions;
-inspect it before sharing. The optional --events example expects a trusted host
+and static execution plans, without provider values or source expressions.
+The optional --events example expects a trusted host
 to capture approved onExecution metadata in { "version": 1, "events": [...] }.
 It selects one opaque request ID, omits payloads and source expressions, and applies
 input/output size limits. It does not read arbitrary logs, prove deployment versions,
@@ -24861,6 +24909,13 @@ async function runContext(args) {
       fix: "supacloud app fix --fix <fix.json>",
       graph: "supacloud app graph --format json",
       explain: "supacloud app explain --target <name>"
+    },
+    defaults: {
+      readTransport: "postgrest-supabase-js",
+      writeTransport: "command-rpc",
+      writeRetry: "disabled",
+      externalOutcome: "receipt-reconcile",
+      databaseSource: "drizzle-append-only"
     }
   };
   if (args.format === "json")
@@ -29210,7 +29265,7 @@ function registerDeveloperExperienceTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.95.0",
+  version: "0.96.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29262,19 +29317,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.45.0",
-    "@supacloud/delivery": "0.16.0",
-    "@supacloud/db": "0.16.2",
+    "@supacloud/compiler": "^0.46.0",
+    "@supacloud/delivery": "0.17.0",
+    "@supacloud/db": "0.17.0",
     typebox: "1.3.36"
   },
   overrides: {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.16.0",
+    "@supacloud/delivery": "0.17.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
     "@supacloud/elysia": "^0.24.1",
-    "@types/bun": "^1.4.2",
+    "@types/bun": "^1.4.3",
     effect: "4.0.2",
     elysia: "2.0.0-beta.21",
     typescript: "^7.0.2"

package/dist/shared/tools/app-starter-attachment-worker.d.ts

@@ -1,2 +1,2 @@
-export declare const STARTER_ATTACHMENT_WORKER = "import { createWorker, type CompiledModule } from \"@supacloud/elysia\";\nimport type { SupaCloudWorkflowClaim, SupaCloudWorkflowsClient } from \"@supacloud/js\";\nimport { createReviewAttachmentAdapters, type ReviewAttachmentOptions } from \"./review-attachments\";\n\nexport interface ReviewAttachmentWorkerOptions extends ReviewAttachmentOptions {\n  modules: readonly CompiledModule[];\n  workflows: Pick<SupaCloudWorkflowsClient, \"claim\" | \"complete\" | \"retry\" | \"fail\">;\n  workerId: string;\n  queueOwnership: \"exclusive-review-attachments\";\n  pollIntervalMs?: number;\n}\n\nexport async function createReviewAttachmentWorker(options: ReviewAttachmentWorkerOptions) {\n  if (options.queueOwnership !== \"exclusive-review-attachments\") {\n    throw new Error(\"Attachment worker requires an exclusively owned Workflow queue\");\n  }\n  const { store } = await createReviewAttachmentAdapters(options);\n  const { workflows, workerId } = options;\n  const failure = Promise.withResolvers<never>();\n  // The executable attaches its fatal listener after this async factory returns.\n  void failure.promise.catch(() => {});\n  let halted: boolean = false;\n  const fatal = () => {\n    halted = true;\n    failure.reject(new Error(\"Attachment worker requires recovery\"));\n  };\n  const attempt = (claim: SupaCloudWorkflowClaim) => ({\n    stepId: claim.stepId, messageId: claim.messageId, attempt: claim.attempt, workerId: claim.workerId,\n  });\n  async function ownedClaim(claim: SupaCloudWorkflowClaim) {\n    if (claim.workflowName !== \"review.verify-attachment\" || claim.workflowVersion !== \"1\"\n      || claim.stepKey !== \"verify\" || claim.maxAttempts !== 3 || claim.workerId !== workerId) {\n      throw new Error(\"Unsupported attachment workflow\");\n    }\n    const { reviewId, artifactId } = claim.input;\n    if (typeof reviewId !== \"string\" || typeof artifactId !== \"string\") {\n      throw new Error(\"Invalid attachment workflow input\");\n    }\n    const bound = await options.database.transaction(tx => tx.query(\n      \"SELECT run_id FROM public.starter_attachments WHERE review_id=$1 AND artifact_id=$2 AND run_id=$3\",\n      [reviewId, artifactId, claim.runId],\n    ));\n    if (!Array.isArray(bound) || bound.length !== 1) throw new Error(\"Attachment workflow ownership mismatch\");\n  }\n  const worker = createWorker({\n    modules: options.modules, deps: { dbClient: store }, workerId, concurrency: 1,\n    pollIntervalMs: options.pollIntervalMs ?? 1000,\n    onError: fatal,\n    transport: {\n      async claim(signal): Promise<SupaCloudWorkflowClaim | null> {\n        if (halted || signal.aborted) return null;\n        try {\n          const claim = await workflows.claim({ workerId, visibilityTimeoutSeconds: 120 });\n          if (signal.aborted || halted) return null;\n          if (!claim || claim.status !== \"claimed\") return null;\n          await ownedClaim(claim);\n          return claim;\n        } catch {\n          if (!signal.aborted) fatal();\n          throw new Error(\"Attachment workflow claim failed\");\n        }\n      },\n      async ack(claim, output) {\n        try {\n          if (!output || typeof output !== \"object\" || Array.isArray(output)) throw new Error(\"Invalid Job output\");\n          // The compiled Job validates output; Workflow SDK validates the receipt.\n          await workflows.complete({ ...attempt(claim), runOutput: { ...output } });\n        } catch {\n          fatal();\n          throw new Error(\"Attachment workflow completion is unconfirmed\");\n        }\n      },\n      async fail(claim) {\n        try {\n          const request: Parameters<typeof workflows.fail>[0] = { ...attempt(claim), errorMessage: \"Attachment verification failed\" };\n          if (claim.attempt < claim.maxAttempts) await workflows.retry({ ...request, delaySeconds: 5 });\n          else await workflows.fail(request);\n        } catch {\n          fatal();\n          throw new Error(\"Attachment workflow failure receipt is unconfirmed\");\n        }\n      },\n    },\n    mapClaim: (claim: SupaCloudWorkflowClaim) => ({\n      id: claim.stepId, jobName: claim.workflowName, input: claim.input, attempt: claim.attempt,\n      requestContext: { workerId, jobId: claim.stepId, requestId: claim.runId },\n    }),\n  });\n  if (worker.jobNames.length !== 1 || worker.jobNames[0] !== \"review.verify-attachment\") {\n    throw new Error(\"Attachment worker requires its compiled reference Job\");\n  }\n  let closing: Promise<void> | undefined;\n  return {\n    failure: failure.promise,\n    async start() {\n      if (halted) throw new Error(\"Attachment worker is not startable\");\n      await worker.start();\n    },\n    close() {\n      halted = true;\n      return closing ??= worker.stop();\n    },\n  };\n}\n";
+export declare const STARTER_ATTACHMENT_WORKER = "import { createWorker, type CompiledModule } from \"@supacloud/elysia\";\nimport {\n  createSupaCloudWorkflowTransport,\n  type SupaCloudWorkflowClaim,\n  type SupaCloudWorkflowsClient,\n} from \"@supacloud/js\";\nimport { createReviewAttachmentAdapters, type ReviewAttachmentOptions } from \"./review-attachments\";\n\nexport interface ReviewAttachmentWorkerOptions extends ReviewAttachmentOptions {\n  modules: readonly CompiledModule[];\n  workflows: Pick<SupaCloudWorkflowsClient, \"claim\" | \"complete\" | \"retry\" | \"fail\">;\n  workerId: string;\n  queueOwnership: \"exclusive-review-attachments\";\n  pollIntervalMs?: number;\n}\n\nexport async function createReviewAttachmentWorker(options: ReviewAttachmentWorkerOptions) {\n  if (options.queueOwnership !== \"exclusive-review-attachments\") {\n    throw new Error(\"Attachment worker requires an exclusively owned Workflow queue\");\n  }\n  const { store } = await createReviewAttachmentAdapters(options);\n  const { workflows, workerId } = options;\n  const failure = Promise.withResolvers<never>();\n  // The executable attaches its fatal listener after this async factory returns.\n  void failure.promise.catch(() => {});\n  let halted: boolean = false;\n  const fatal = () => {\n    halted = true;\n    failure.reject(new Error(\"Attachment worker requires recovery\"));\n  };\n  async function ownedClaim(claim: SupaCloudWorkflowClaim) {\n    if (claim.workflowName !== \"review.verify-attachment\" || claim.workflowVersion !== \"1\"\n      || claim.stepKey !== \"verify\" || claim.maxAttempts !== 3 || claim.workerId !== workerId) {\n      throw new Error(\"Unsupported attachment workflow\");\n    }\n    const { reviewId, artifactId } = claim.input;\n    if (typeof reviewId !== \"string\" || typeof artifactId !== \"string\") {\n      throw new Error(\"Invalid attachment workflow input\");\n    }\n    const bound = await options.database.transaction(tx => tx.query(\n      \"SELECT run_id FROM public.starter_attachments WHERE review_id=$1 AND artifact_id=$2 AND run_id=$3\",\n      [reviewId, artifactId, claim.runId],\n    ));\n    if (!Array.isArray(bound) || bound.length !== 1) throw new Error(\"Attachment workflow ownership mismatch\");\n  }\n  const workflowTransport = createSupaCloudWorkflowTransport({\n    workflows, workerId, visibilityTimeoutSeconds: 120, retryDelaySeconds: 5, acceptClaim: ownedClaim,\n  });\n  const worker = createWorker({\n    modules: options.modules, deps: { dbClient: store }, workerId, concurrency: 1,\n    pollIntervalMs: options.pollIntervalMs ?? 1000,\n    onError: fatal,\n    transport: {\n      async claim(signal): Promise<SupaCloudWorkflowClaim | null> {\n        if (halted || signal.aborted) return null;\n        try {\n          return await workflowTransport.claim(signal);\n        } catch {\n          if (!signal.aborted) fatal();\n          throw new Error(\"Attachment workflow claim failed\");\n        }\n      },\n      async ack(claim, output) {\n        try {\n          await workflowTransport.ack(claim, output);\n        } catch {\n          fatal();\n          throw new Error(\"Attachment workflow completion is unconfirmed\");\n        }\n      },\n      async fail(claim) {\n        try {\n          await workflowTransport.fail(claim, \"Attachment verification failed\");\n        } catch {\n          fatal();\n          throw new Error(\"Attachment workflow failure receipt is unconfirmed\");\n        }\n      },\n    },\n    mapClaim: (claim: SupaCloudWorkflowClaim) => ({\n      id: claim.stepId, jobName: claim.workflowName, input: claim.input, attempt: claim.attempt,\n      requestContext: { workerId, jobId: claim.stepId, requestId: claim.runId },\n    }),\n  });\n  if (worker.jobNames.length !== 1 || worker.jobNames[0] !== \"review.verify-attachment\") {\n    throw new Error(\"Attachment worker requires its compiled reference Job\");\n  }\n  let closing: Promise<void> | undefined;\n  return {\n    failure: failure.promise,\n    async start() {\n      if (halted) throw new Error(\"Attachment worker is not startable\");\n      await worker.start();\n    },\n    close() {\n      halted = true;\n      return closing ??= worker.stop();\n    },\n  };\n}\n";
 export declare const STARTER_ATTACHMENT_DELIVERY_WORKER = "import { SQL } from \"bun\";\nimport { createClient } from \"@supabase/supabase-js\";\nimport { SupaCloudWorkflowsClient } from \"@supacloud/js\";\nimport { createBunCommandDatabase } from \"@supacloud/db/bun\";\nimport type { CompiledModule } from \"@supacloud/elysia\";\nimport { createReviewAttachmentWorker } from \"./host/review-attachment-worker\";\n\nfunction required(name: string): string {\n  const value = process.env[name];\n  if (!value?.trim()) throw new Error(\"Missing required worker setting: \" + name);\n  return value;\n}\n\nfunction databaseConnection(): SQL.Options {\n  const socket = process.env[\"DATABASE_SOCKET_PATH\"];\n  if (socket && process.env[\"DATABASE_URL\"]) throw new Error(\"Conflicting database connection settings\");\n  if (socket) {\n    return { adapter: \"postgres\", path: socket, database: required(\"DATABASE_NAME\"), username: required(\"DATABASE_USER\") };\n  }\n  const url = new URL(required(\"DATABASE_URL\"));\n  if (url.protocol !== \"postgres:\" && url.protocol !== \"postgresql:\") throw new Error(\"Invalid database URL\");\n  return {\n    adapter: \"postgres\", url: url.href, hostname: url.hostname.replace(/^\\[|\\]$/g, \"\"), port: Number(url.port || 5432),\n    username: decodeURIComponent(url.username), password: decodeURIComponent(url.password),\n    database: decodeURIComponent(url.pathname.slice(1)),\n  };\n}\n\nexport async function createDeliveryWorker(modules: CompiledModule[], lifecycle: { signal: AbortSignal }) {\n  lifecycle.signal.throwIfAborted();\n  if (required(\"REVIEW_QUEUE_OWNERSHIP\") !== \"exclusive-review-attachments\") {\n    throw new Error(\"Attachment worker requires an exclusively owned Workflow queue\");\n  }\n  const connection = databaseConnection();\n  const settings = {\n    projectId: required(\"SUPACLOUD_PROJECT_ID\"), tenantId: required(\"APP_TENANT_ID\"),\n    workerId: required(\"REVIEW_WORKER_ID\"), url: required(\"SUPACLOUD_URL\"), key: required(\"SUPACLOUD_SERVICE_ROLE_KEY\"),\n  };\n  const service = createClient(settings.url, settings.key, {\n    auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },\n  });\n  const pool = new SQL({ ...connection, max: 4, connectionTimeout: 5 });\n  let closing: Promise<void> | undefined;\n  const closePool = () => closing ??= pool.close({ timeout: 5 });\n  try {\n    const worker = await createReviewAttachmentWorker({\n      database: createBunCommandDatabase(pool), service, projectId: settings.projectId,\n      tenantId: settings.tenantId, modules, workerId: settings.workerId,\n      workflows: new SupaCloudWorkflowsClient(service), queueOwnership: \"exclusive-review-attachments\",\n    });\n    lifecycle.signal.throwIfAborted();\n    return {\n      start: () => worker.start(), failure: worker.failure,\n      async close() { try { await worker.close(); } finally { await closePool(); } },\n    };\n  } catch (error) {\n    await closePool();\n    const code = error !== null && typeof error === \"object\" && \"code\" in error\n      && typeof error.code === \"string\" && /^[A-Z0-9_]{1,64}$/.test(error.code) ? error.code : \"UNKNOWN\";\n    console.error(JSON.stringify({ event: \"review-worker-initialization-failed\", code }));\n    throw new Error(\"Attachment worker initialization failed\");\n  }\n}\n";

package/dist/shared/tools/app-starter-database.d.ts

@@ -10,5 +10,7 @@ export declare const STARTER_DATABASE_CONFIG: {
     role: string;
 };
 export declare const STARTER_DATABASE_SCHEMA = "import { sql } from \"drizzle-orm\";\nimport { boolean, check, integer, jsonb, pgTable, primaryKey, text, uuid } from \"drizzle-orm/pg-core\";\n\n// Structure for the reviewed starter migrations. Grants/policies stay in those migrations.\nexport const application = pgTable.withRLS(\"starter_application\", {\n  singleton: boolean().default(true).primaryKey(),\n  projectId: text(\"project_id\").notNull(),\n  tenantId: text(\"tenant_id\").notNull(),\n}, table => [\n  check(\"starter_application_singleton_check\", sql`${table.singleton}`),\n  check(\"starter_application_project_id_check\", sql`length(${table.projectId}) > 0`),\n  check(\"starter_application_tenant_id_check\", sql`length(${table.tenantId}) > 0`),\n]);\n\nexport const reviews = pgTable.withRLS(\"starter_reviews\", {\n  id: text().primaryKey(),\n  ownerId: text(\"owner_id\").notNull(),\n  state: text({ enum: [\"draft\", \"approved\"] }).notNull(),\n  version: integer().notNull(),\n}, table => [\n  check(\"starter_reviews_state_check\", sql`${table.state} IN ('draft', 'approved')`),\n  check(\"starter_reviews_version_check\", sql`${table.version} > 0`),\n]);\n\nexport const members = pgTable.withRLS(\"starter_members\", {\n  subject: text().primaryKey(),\n  enabled: boolean().default(true).notNull(),\n  canApprove: boolean(\"can_approve\").default(false).notNull(),\n  storageSubject: uuid(\"storage_subject\").unique(),\n});\n\nexport const attachments = pgTable.withRLS(\"starter_attachments\", {\n  reviewId: text(\"review_id\").primaryKey().references(() => reviews.id),\n  artifactId: uuid(\"artifact_id\").notNull().unique(),\n  ownerId: text(\"owner_id\").notNull(),\n  runId: uuid(\"run_id\").notNull().unique(),\n  objectPath: text(\"object_path\").notNull().unique(),\n});\n\nexport const attachmentResults = pgTable.withRLS(\"starter_attachment_results\", {\n  reviewId: text(\"review_id\").notNull().references(() => reviews.id),\n  version: integer().notNull(),\n  artifactId: uuid(\"artifact_id\").notNull(),\n  result: jsonb().$type<unknown>().notNull(),\n}, table => [\n  primaryKey({ columns: [table.reviewId, table.version, table.artifactId] }),\n  check(\"starter_attachment_results_version_check\", sql`${table.version} >= 2`),\n]);\n\nexport type ReviewRow = typeof reviews.$inferSelect;\nexport type NewReview = typeof reviews.$inferInsert;\n";
-export declare const STARTER_DATABASE_GUIDE = "\n## Database Source Workflow\n\nDrizzle owns table declarations and inferred row types in db/schema.ts.\nUse the existing @supacloud/db/drizzle-bun adapters for typed queries and governed\ntransactions; never replace permission, idempotency or audit checks with plain CRUD.\nOpaque JSON still needs runtime decoding.\n\nAfter installing dependencies, run `bun run db:generate` once and commit db/contracts/.\nThe default `bun run check` and build fail on stale database contracts before any\ncompiler regeneration. After an intentional source change, run db:generate again,\nreview the diff, then run check. Ordinary checks are offline.\nThe compiler also runs this source-contract gate on compile/check/dev through\ndatabaseGovernance.mode = \"check\", including incremental cache hits. Missing\nadoption files or stale contracts fail closed; no contracts are silently regenerated.\nThis is not SQL lint or live Catalog reconciliation. Before promotion, declare\nthe real database modules, their SQL and tests, then explicitly use mode \"enforce\"\nwith a separately selected read-only local/test database connection.\n\n- Maintain one schema-qualified function with explicit grants per db/functions/*.sql.\n- Preserve migrations/ and its existing executor/ledger. Add forward migrations only.\n- `bun run db:diff` generates Drizzle drafts under db/migration-candidates/, never\n  into the deployment directory. The starter has existing SQL history, so establish\n  and review a matching Drizzle baseline before promoting any draft; the first\n  draft is not automatically an incremental production migration.\n- `bun run db:pull` requires an explicitly selected DATABASE_URL and writes only\n  output/database-audit/drizzle-candidate/. Review candidates; never overwrite source blindly.\n- Full SQL dumps belong under the ignored output/database-audit/ directory. They are\n  audit/recovery artifacts, never ordinary type, application or test inputs.\n- `bun run db:assess` explains adoption/findings without writing or connecting.\n- GraphQL/PostgREST exports remain legitimate protocol contracts. This check is not\n  proof of deployed schema, effective role permissions or complete RLS equivalence.\n\nDo not introduce any/@ts-ignore to bypass a contract. Use Drizzle-inferred types,\npreserve bigint/numeric precision and decode unknown results at the boundary.\n";
+export declare const STARTER_DATABASE_MODULES = "import { defineDatabaseModule } from \"@supacloud/db\";\nimport { getTableConfig } from \"drizzle-orm/pg-core\";\nimport { application, reviews, members, attachments, attachmentResults } from \"./schema\";\n\nconst backendPolicies = [\n  [\"starter_backend_binding_read\", \"public.starter_application\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_binding_lock\", \"public.starter_application\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_binding_immutable\", \"public.starter_application\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_read\", \"public.starter_members\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_lock\", \"public.starter_members\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_immutable\", \"public.starter_members\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_review_read\", \"public.starter_reviews\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_review_update\", \"public.starter_reviews\", \"update\", [\"starter_review_http\"]],\n  [\"starter_worker_review_immutable\", \"public.starter_reviews\", \"update\", [\"starter_review_worker\"]],\n  [\"starter_backend_attachment_read\", \"public.starter_attachments\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_attachment_lock\", \"public.starter_attachments\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_attachment_immutable\", \"public.starter_attachments\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_http_attachment_insert\", \"public.starter_attachments\", \"insert\", [\"starter_review_http\"]],\n  [\"starter_worker_result_read\", \"public.starter_attachment_results\", \"select\", [\"starter_review_worker\"]],\n  [\"starter_worker_result_insert\", \"public.starter_attachment_results\", \"insert\", [\"starter_review_worker\"]],\n] as const;\n\n// The module is the single live-Catalog ownership contract for starter tables.\nexport default defineDatabaseModule({\n  name: \"starter\",\n  tables: [application, reviews, members, attachments, attachmentResults].map(table => {\n    const config = getTableConfig(table);\n    return (config.schema ?? \"public\") + \".\" + config.name;\n  }),\n  policies: [\n    ...backendPolicies.map(([name, table, operation, roles]) => ({\n      name, table, operation, roles: [...roles], source: \"migrations/004-review-runtime-roles.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    })),\n    {\n      name: \"starter_member_read\", table: \"public.starter_members\", operation: \"select\",\n      roles: [\"authenticated\"], source: \"migrations/003-review-uploads.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    },\n    {\n      name: \"starter_review_read\", table: \"public.starter_reviews\", operation: \"select\",\n      roles: [\"authenticated\"], source: \"migrations/003-review-uploads.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    },\n  ],\n});\n";
+export declare const STARTER_DATABASE_TEST = "-- Read-only catalog assertions; behavioral authorization tests remain separate.\nBEGIN READ ONLY;\nDO $test$\nDECLARE\n  owned text[] := ARRAY['starter_application','starter_reviews','starter_members',\n    'starter_attachments','starter_attachment_results'];\nBEGIN\n  IF (SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace\n      WHERE n.nspname='public' AND c.relname=ANY(owned) AND c.relrowsecurity) <> 5 THEN\n    RAISE EXCEPTION 'All starter tables must exist with RLS enabled';\n  END IF;\n  IF (SELECT count(*) FROM pg_policy p JOIN pg_class c ON c.oid=p.polrelid\n      JOIN pg_namespace n ON n.oid=c.relnamespace\n      WHERE n.nspname='public' AND c.relname=ANY(owned)) <> 17 THEN\n    RAISE EXCEPTION 'Starter policy inventory changed; reconcile db/modules.ts';\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')\n      AND (rolsuper OR rolbypassrls)) THEN\n    RAISE EXCEPTION 'Starter roles must not bypass row security';\n  END IF;\n  IF (SELECT count(*) FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')) <> 2 THEN\n    RAISE EXCEPTION 'Starter runtime roles are missing';\n  END IF;\nEND\n$test$;\nROLLBACK;\n";
+export declare const STARTER_DATABASE_GUIDE = "\n## Database Source Workflow\n\nDrizzle owns table declarations and inferred row types in db/schema.ts.\nUse the existing @supacloud/db/drizzle-bun adapters for typed queries and governed\ntransactions; never replace permission, idempotency or audit checks with plain CRUD.\nOpaque JSON still needs runtime decoding.\n\nAfter installing dependencies, run `bun run db:generate` once and commit db/contracts/.\nThe default `bun run check` and build fail on stale database contracts before any\ncompiler regeneration. After an intentional source change, run db:generate again,\nreview the diff, then run check.\nThe command starter registers databaseGovernance.moduleFile = \"db/modules.ts\" and\nkeeps the default `databaseGovernance.mode = \"check\"`: compile/check/build run\nthe offline source-contract gate without a database. Use `bun run dev:integration`\nwith the CLI's explicit loopback database URL, or set databaseGovernance.mode to\n\"enforce\" with an explicitly supplied `DATABASE_URL`, to run SQL lint and live\nCatalog reconciliation. Missing connections, stale source contracts and Catalog\ndrift fail closed; no contracts or migrations are silently regenerated.\n\n- Maintain one schema-qualified function with explicit grants per db/functions/*.sql.\n- Preserve migrations/ and its existing executor/ledger. Add forward migrations only.\n- `bun run db:diff` generates Drizzle drafts under db/migration-candidates/, never\n  into the deployment directory. The starter has existing SQL history, so establish\n  and review a matching Drizzle baseline before promoting any draft; the first\n  draft is not automatically an incremental production migration.\n- `bun run db:pull` requires an explicitly selected DATABASE_URL and writes only\n  output/database-audit/drizzle-candidate/. Review candidates; never overwrite source blindly.\n- Full SQL dumps belong under the ignored output/database-audit/ directory. They are\n  audit/recovery artifacts, never ordinary type, application or test inputs.\n- `bun run db:assess` explains adoption/findings without writing or connecting.\n- GraphQL/PostgREST exports remain legitimate protocol contracts. This check is not\n  proof of deployed schema, effective role permissions or complete RLS equivalence.\n\nDo not introduce any/@ts-ignore to bypass a contract. Use Drizzle-inferred types,\npreserve bigint/numeric precision and decode unknown results at the boundary.\n";
 export declare function starterDatabaseFiles(): Record<string, string>;

package/dist/shared/tools/app-starter-upload.d.ts

@@ -1,3 +1,3 @@
 export declare const STARTER_UPLOAD_FEATURE = "import { Effect } from \"effect\";\nimport { Body, Controller, Inject, Injectable, Param, Post, DB_CLIENT, REQUEST_CONTEXT } from \"@supacloud/app\";\nimport { ApplicationError } from \"@supacloud/elysia\";\nimport { UploadBody, UploadLocation, UploadParams, UploadResult } from \"./contracts\";\n\nexport interface ReviewUploadInput { reviewId: string; artifactId: string; expectedVersion: number }\nexport interface ReviewUploadLocation { artifactId: string; bucketId: string; objectPath: string }\nexport interface ReviewUploadResult { artifactId: string; runId: string; objectPath: string; sha256: string; bytes: number }\ntype PreviewUploadError =\n  | { readonly _tag: \"AUTHENTICATION_REQUIRED\" }\n  | { readonly _tag: \"UPLOAD_INPUT_INVALID\" }\n  | { readonly _tag: \"UPLOAD_DENIED\" }\n  | { readonly _tag: \"UPLOADS_UNAVAILABLE\" };\ntype RegisterUploadError =\n  | PreviewUploadError\n  | { readonly _tag: \"UPLOAD_CONTENT_INVALID\" }\n  | { readonly _tag: \"COMMAND_IDEMPOTENCY_CONFLICT\" }\n  | { readonly _tag: \"COMMAND_REJECTED\" }\n  | { readonly _tag: \"UPLOAD_OUTCOME_UNKNOWN\" };\nexport interface ReviewUploadPort {\n  previewUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadLocation>;\n  registerUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadResult>;\n}\n@Injectable({ scope: \"request\" })\nexport class ReviewUploads {\n  constructor(@Inject(DB_CLIENT) private readonly store: Partial<ReviewUploadPort>,\n    @Inject(REQUEST_CONTEXT) private readonly context: unknown) {}\n\n  preview(input: ReviewUploadInput): Promise<ReviewUploadLocation> {\n    if (!this.store.previewUpload) throw new ApplicationError(\"Attachment uploads are not configured\", { status: 501, code: \"UPLOADS_UNAVAILABLE\" });\n    return this.store.previewUpload(this.context, input);\n  }\n  register(input: ReviewUploadInput): Promise<ReviewUploadResult> {\n    if (!this.store.registerUpload) throw new ApplicationError(\"Attachment uploads are not configured\", { status: 501, code: \"UPLOADS_UNAVAILABLE\" });\n    return this.store.registerUpload(this.context, input);\n  }\n}\n\n@Controller(\"/reviews\")\nexport class ReviewUploadsController {\n  constructor(@Inject(ReviewUploads) private readonly uploads: ReviewUploads) {}\n\n  @Post(\"/:id/attachment-upload\", {\n    params: UploadParams,\n    body: UploadBody,\n    responses: { 200: UploadLocation },\n    effect: {\n      required: true,\n      dependencies: [],\n      errors: [\n        { tag: \"AUTHENTICATION_REQUIRED\", status: 401, code: \"AUTHENTICATION_REQUIRED\" },\n        { tag: \"UPLOAD_INPUT_INVALID\", status: 400, code: \"UPLOAD_INPUT_INVALID\" },\n        { tag: \"UPLOAD_DENIED\", status: 403, code: \"UPLOAD_DENIED\" },\n        { tag: \"UPLOADS_UNAVAILABLE\", status: 501, code: \"UPLOADS_UNAVAILABLE\" },\n      ],\n      retry: \"none\",\n    },\n  })\n  preview(@Param(\"id\") id: string, @Body() body: { artifactId: string; expectedVersion: number }): Effect.Effect<ReviewUploadLocation, PreviewUploadError, never> {\n    return Effect.promise(() => this.uploads.preview({ reviewId: id, artifactId: body.artifactId, expectedVersion: body.expectedVersion }));\n  }\n  @Post(\"/:id/attachment-registration\", {\n    params: UploadParams,\n    body: UploadBody,\n    responses: { 200: UploadResult },\n    effect: {\n      required: true,\n      dependencies: [],\n      errors: [\n        { tag: \"AUTHENTICATION_REQUIRED\", status: 401, code: \"AUTHENTICATION_REQUIRED\" },\n        { tag: \"UPLOAD_INPUT_INVALID\", status: 400, code: \"UPLOAD_INPUT_INVALID\" },\n        { tag: \"UPLOAD_DENIED\", status: 403, code: \"UPLOAD_DENIED\" },\n        { tag: \"UPLOAD_CONTENT_INVALID\", status: 400, code: \"UPLOAD_CONTENT_INVALID\" },\n        { tag: \"COMMAND_IDEMPOTENCY_CONFLICT\", status: 409, code: \"COMMAND_IDEMPOTENCY_CONFLICT\" },\n        { tag: \"COMMAND_REJECTED\", status: 403, code: \"COMMAND_REJECTED\" },\n        { tag: \"UPLOADS_UNAVAILABLE\", status: 501, code: \"UPLOADS_UNAVAILABLE\" },\n        { tag: \"UPLOAD_OUTCOME_UNKNOWN\", status: 503, code: \"UPLOAD_OUTCOME_UNKNOWN\" },\n      ],\n      retry: \"none\",\n    },\n  })\n  register(@Param(\"id\") id: string, @Body() body: { artifactId: string; expectedVersion: number }): Effect.Effect<ReviewUploadResult, RegisterUploadError, never> {\n    return Effect.promise(() => this.uploads.register({ reviewId: id, artifactId: body.artifactId, expectedVersion: body.expectedVersion }));\n  }\n}\n";
-export declare const STARTER_UPLOAD_SCHEMA = "-- Apply explicitly with the migration owner.\nALTER TABLE public.starter_members ADD COLUMN storage_subject uuid UNIQUE;\nGRANT SELECT (subject,enabled,can_approve,storage_subject) ON public.starter_members TO authenticated;\nCREATE POLICY starter_member_read ON public.starter_members FOR SELECT TO authenticated\n  USING (subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND storage_subject=auth.uid());\nGRANT SELECT ON public.starter_reviews TO authenticated;\nCREATE POLICY starter_review_read ON public.starter_reviews FOR SELECT TO authenticated\n  USING (owner_id=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND EXISTS (\n    SELECT 1 FROM public.starter_members m WHERE m.subject=owner_id\n      AND m.enabled AND m.can_approve AND m.storage_subject=auth.uid()\n  ));\nINSERT INTO storage.buckets(id,name,public,file_size_limit,allowed_mime_types)\n  VALUES ('review-attachments','review-attachments',false,1048576,ARRAY['text/plain']);\nCREATE POLICY starter_attachment_read ON storage.objects FOR SELECT TO authenticated\n  USING (bucket_id='review-attachments');\nCREATE POLICY starter_attachment_insert ON storage.objects FOR INSERT TO authenticated\n  WITH CHECK (bucket_id='review-attachments');\n-- Restrictive fences also apply when the host already has permissive Storage policies.\nCREATE POLICY starter_attachment_owner_fence ON storage.objects AS RESTRICTIVE FOR ALL TO authenticated\n  USING (bucket_id<>'review-attachments' OR (split_part(name,'/',1)=auth.uid()::text AND EXISTS (\n    SELECT 1 FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id\n    WHERE r.id=split_part(name,'/',2) AND m.subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub')\n      AND m.storage_subject=auth.uid() AND m.enabled AND m.can_approve\n  )))\n  WITH CHECK (bucket_id<>'review-attachments' OR (split_part(name,'/',1)=auth.uid()::text\n    AND name ~ '^[a-f0-9-]{36}/[a-f0-9-]{36}/[a-f0-9-]{36}[.]txt$' AND EXISTS (\n      SELECT 1 FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id\n      WHERE r.id=split_part(name,'/',2) AND r.state='draft' AND m.subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub')\n        AND m.storage_subject=auth.uid() AND m.enabled AND m.can_approve\n    )));\nCREATE POLICY starter_attachment_update_fence ON storage.objects AS RESTRICTIVE FOR UPDATE TO authenticated\n  USING (bucket_id<>'review-attachments') WITH CHECK (bucket_id<>'review-attachments');\nCREATE POLICY starter_attachment_delete_fence ON storage.objects AS RESTRICTIVE FOR DELETE TO authenticated\n  USING (bucket_id<>'review-attachments');\n";
+export declare const STARTER_UPLOAD_SCHEMA = "-- Apply explicitly with the migration owner.\nALTER TABLE public.starter_members ADD COLUMN storage_subject uuid UNIQUE;\nGRANT SELECT (subject,enabled,can_approve,storage_subject) ON public.starter_members TO authenticated;\nDROP POLICY IF EXISTS starter_member_read ON public.starter_members;\nCREATE POLICY starter_member_read ON public.starter_members FOR SELECT TO authenticated\n  USING (subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND storage_subject=auth.uid());\nGRANT SELECT ON public.starter_reviews TO authenticated;\nDROP POLICY IF EXISTS starter_review_read ON public.starter_reviews;\nCREATE POLICY starter_review_read ON public.starter_reviews FOR SELECT TO authenticated\n  USING (owner_id=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub') AND EXISTS (\n    SELECT 1 FROM public.starter_members m WHERE m.subject=owner_id\n      AND m.enabled AND m.can_approve AND m.storage_subject=auth.uid()\n  ));\nINSERT INTO storage.buckets(id,name,public,file_size_limit,allowed_mime_types)\n  VALUES ('review-attachments','review-attachments',false,1048576,ARRAY['text/plain']);\nDROP POLICY IF EXISTS starter_attachment_read ON storage.objects;\nCREATE POLICY starter_attachment_read ON storage.objects FOR SELECT TO authenticated\n  USING (bucket_id='review-attachments');\nDROP POLICY IF EXISTS starter_attachment_insert ON storage.objects;\nCREATE POLICY starter_attachment_insert ON storage.objects FOR INSERT TO authenticated\n  WITH CHECK (bucket_id='review-attachments');\n-- Restrictive fences also apply when the host already has permissive Storage policies.\nDROP POLICY IF EXISTS starter_attachment_owner_fence ON storage.objects;\nCREATE POLICY starter_attachment_owner_fence ON storage.objects AS RESTRICTIVE FOR ALL TO authenticated\n  USING (bucket_id<>'review-attachments' OR (split_part(name,'/',1)=auth.uid()::text AND EXISTS (\n    SELECT 1 FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id\n    WHERE r.id=split_part(name,'/',2) AND m.subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub')\n      AND m.storage_subject=auth.uid() AND m.enabled AND m.can_approve\n  )))\n  WITH CHECK (bucket_id<>'review-attachments' OR (split_part(name,'/',1)=auth.uid()::text\n    AND name ~ '^[a-f0-9-]{36}/[a-f0-9-]{36}/[a-f0-9-]{36}[.]txt$' AND EXISTS (\n      SELECT 1 FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id\n      WHERE r.id=split_part(name,'/',2) AND r.state='draft' AND m.subject=COALESCE(NULLIF(auth.jwt()->>'external_sub',''),auth.jwt()->>'sub')\n        AND m.storage_subject=auth.uid() AND m.enabled AND m.can_approve\n    )));\nDROP POLICY IF EXISTS starter_attachment_update_fence ON storage.objects;\nCREATE POLICY starter_attachment_update_fence ON storage.objects AS RESTRICTIVE FOR UPDATE TO authenticated\n  USING (bucket_id<>'review-attachments') WITH CHECK (bucket_id<>'review-attachments');\nDROP POLICY IF EXISTS starter_attachment_delete_fence ON storage.objects;\nCREATE POLICY starter_attachment_delete_fence ON storage.objects AS RESTRICTIVE FOR DELETE TO authenticated\n  USING (bucket_id<>'review-attachments');\n";
 export declare const STARTER_UPLOAD_ADAPTER = "import { MIMEType } from \"node:util\";\nimport { SupaCloudArtifactsClient } from \"@supacloud/js\";\nimport { createTransactionalCommand, plaintextCommandInput } from \"@supacloud/commands\";\nimport { CommandError } from \"@supacloud/contracts\";\nimport { createPostgresCommandStore, type CommandTransaction } from \"@supacloud/db\";\nimport { ApplicationError, requireTrustedIdentity } from \"@supacloud/elysia\";\nimport type { ReviewAttachmentOptions } from \"./review-attachments\";\nimport type { ReviewUploadInput, ReviewUploadPort, ReviewUploadResult } from \"../review/uploads\";\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid upload record\");\n  return value;\n}\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid upload database result\");\n  return value.map(record);\n}\nfunction capture(value: unknown): ReviewUploadInput {\n  const item = record(value), uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n  if (typeof item[\"reviewId\"] !== \"string\" || !uuid.test(item[\"reviewId\"])\n    || typeof item[\"artifactId\"] !== \"string\" || !uuid.test(item[\"artifactId\"])\n    || typeof item[\"expectedVersion\"] !== \"number\" || !Number.isSafeInteger(item[\"expectedVersion\"]) || item[\"expectedVersion\"] < 1) {\n    throw new ApplicationError(\"Invalid upload input\", { status: 400, code: \"UPLOAD_INPUT_INVALID\" });\n  }\n  return { reviewId: item[\"reviewId\"].toLowerCase(), artifactId: item[\"artifactId\"].toLowerCase(), expectedVersion: item[\"expectedVersion\"] };\n}\nfunction result(value: unknown): ReviewUploadResult {\n  const item = record(value);\n  if (typeof item[\"artifactId\"] !== \"string\" || typeof item[\"runId\"] !== \"string\" || typeof item[\"objectPath\"] !== \"string\"\n    || typeof item[\"sha256\"] !== \"string\" || typeof item[\"bytes\"] !== \"number\") throw new TypeError(\"Invalid upload receipt\");\n  return { artifactId: item[\"artifactId\"], runId: item[\"runId\"], objectPath: item[\"objectPath\"], sha256: item[\"sha256\"], bytes: item[\"bytes\"] };\n}\n\nexport async function createReviewUploadAdapters(options: ReviewAttachmentOptions): Promise<ReviewUploadPort> {\n  const { database, service, projectId, tenantId } = options;\n  const binding = rows(await database.transaction(tx => tx.query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  )));\n  if (!projectId.trim() || !tenantId.trim() || binding.length !== 1\n    || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Upload database project/tenant binding mismatch\");\n  }\n  const artifacts = new SupaCloudArtifactsClient(service);\n  function actor(context: unknown): string {\n    const who = requireTrustedIdentity(context);\n    const access = record(record(context)[\"access\"]);\n    if (access[\"projectId\"] !== projectId || access[\"tenantId\"] !== tenantId\n      || !Array.isArray(access[\"permissions\"]) || !access[\"permissions\"].includes(\"review.approve\")) {\n      throw new ApplicationError(\"Upload permission denied\", { status: 403, code: \"UPLOAD_DENIED\" });\n    }\n    return who.subject;\n  }\n  async function authorize(tx: CommandTransaction, subject: string, input: ReviewUploadInput, replay = false) {\n    const allowed = rows(await tx.query(\n      \"SELECT m.storage_subject::text AS storage_subject FROM public.starter_reviews r \" +\n      \"JOIN public.starter_members m ON m.subject=r.owner_id CROSS JOIN public.starter_application p \" +\n      \"WHERE r.id=$1 AND r.owner_id=$2 AND ((r.state='draft' AND r.version=$3) OR \" +\n      \"($6::boolean AND r.state='approved' AND r.version=$3+1 AND EXISTS (\" +\n      \"SELECT 1 FROM public.starter_attachments b WHERE b.review_id=r.id AND b.artifact_id=$7::uuid AND b.owner_id=$2 \" +\n      \"AND b.object_path=m.storage_subject::text || '/' || r.id || '/' || $7::text || '.txt'))) \" +\n      \"AND m.enabled AND m.can_approve AND m.storage_subject IS NOT NULL \" +\n      \"AND p.singleton AND p.project_id=$4 AND p.tenant_id=$5 FOR UPDATE OF r,m FOR SHARE OF p\",\n      [input.reviewId, subject, input.expectedVersion, projectId, tenantId, replay, input.artifactId],\n    ));\n    if (allowed.length !== 1 || typeof allowed[0]?.[\"storage_subject\"] !== \"string\") {\n      throw new ApplicationError(\"Upload ownership, permission or revision changed\", { status: 403, code: \"UPLOAD_DENIED\" });\n    }\n    return allowed[0][\"storage_subject\"] + \"/\" + input.reviewId + \"/\" + input.artifactId + \".txt\";\n  }\n  return {\n    async previewUpload(context, value) {\n      const input = capture(value), subject = actor(context);\n      const objectPath = await database.transaction(tx => authorize(tx, subject, input));\n      return { artifactId: input.artifactId, bucketId: \"review-attachments\", objectPath };\n    },\n    async registerUpload(context, value) {\n      const input = capture(value), subject = actor(context);\n      const objectPath = await database.transaction(tx => authorize(tx, subject, input, true));\n      try {\n        const downloaded = await service.storage.from(\"review-attachments\").download(objectPath);\n        if (downloaded.error || !downloaded.data) throw new Error(\"Upload unavailable\");\n        const blob = downloaded.data;\n        if (blob.size < 1 || blob.size > 1048576 || new MIMEType(blob.type).essence !== \"text/plain\") {\n          throw new ApplicationError(\"Unsupported upload\", { status: 400, code: \"UPLOAD_CONTENT_INVALID\" });\n        }\n        const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", await blob.arrayBuffer())),\n          byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n        await artifacts.register({ artifactId: input.artifactId, bucketId: \"review-attachments\", objectPath,\n          artifactType: \"review.attachment\", sha256, sizeBytes: blob.size, mimeType: \"text/plain\" });\n        const command = createTransactionalCommand({\n          name: \"review.attach\", store: createPostgresCommandStore(database), inputCodec: plaintextCommandInput,\n          input: capture, result,\n          async authorize(who, request, tx) {\n            try {\n              const currentPath = await authorize(tx, who.actorId, request, true);\n              return currentPath === objectPath ? \"allow\" : \"deny\";\n            } catch (error) {\n              if (error instanceof ApplicationError && error.code === \"UPLOAD_DENIED\") return \"deny\";\n              throw error;\n            }\n          },\n          async execute(tx, request) {\n            const existing = rows(await tx.query(\"SELECT artifact_id FROM public.starter_attachments WHERE review_id=$1\", [request.reviewId]));\n            if (existing.length) throw new CommandError(\"COMMAND_IDEMPOTENCY_CONFLICT\");\n            const bound: ReviewUploadResult = { artifactId: request.artifactId, runId: request.artifactId, objectPath, sha256, bytes: blob.size };\n            await tx.query(\"INSERT INTO public.starter_attachments VALUES($1,$2,$3,$4,$5)\",\n              [request.reviewId, bound.artifactId, subject, bound.runId, bound.objectPath]);\n            return bound;\n          },\n          audit: { event: \"review.attachment-bound\", details: request => ({ reviewId: request.reviewId, artifactId: request.artifactId }) },\n        });\n        const receipt = await command.execute({ actorId: subject, tenantId }, input.artifactId, input);\n        if (receipt.status !== \"confirmed\") throw new CommandError(\"COMMAND_OUTCOME_UNKNOWN\");\n        return receipt.result;\n      } catch (error) {\n        if (error instanceof ApplicationError) throw error;\n        if (error instanceof CommandError && error.code === \"COMMAND_IDEMPOTENCY_CONFLICT\") {\n          throw new ApplicationError(\"Conflicting attachment binding\", { status: 409, code: error.code });\n        }\n        if (error instanceof CommandError && error.code === \"COMMAND_REJECTED\") {\n          throw new ApplicationError(\"Upload permission denied\", { status: 403, code: error.code });\n        }\n        // Registration may have committed even when binding failed; never delete immutable evidence here.\n        throw new ApplicationError(\"Upload registration could not be confirmed\", { status: 503, code: \"UPLOAD_OUTCOME_UNKNOWN\" });\n      }\n    },\n  };\n}\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,19 +52,19 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.45.0",
-    "@supacloud/delivery": "0.16.0",
-    "@supacloud/db": "0.16.2",
+    "@supacloud/compiler": "^0.46.0",
+    "@supacloud/delivery": "0.17.0",
+    "@supacloud/db": "0.17.0",
     "typebox": "1.3.36"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.16.0",
+    "@supacloud/delivery": "0.17.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {
     "@supacloud/elysia": "^0.24.1",
-    "@types/bun": "^1.4.2",
+    "@types/bun": "^1.4.3",
     "effect": "4.0.2",
     "elysia": "2.0.0-beta.21",
     "typescript": "^7.0.2"