@supacloud/cli 0.99.0 → 0.101.2

package/dist/index.js

@@ -3177,23 +3177,22 @@ function InstanceKeys(value) {
 function IsIEEE754(value) {
   return typeof value === "number";
 }
-var ByteMarker;
-(function(ByteMarker) {
-  ByteMarker[ByteMarker["Array"] = 0] = "Array";
-  ByteMarker[ByteMarker["BigInt"] = 1] = "BigInt";
-  ByteMarker[ByteMarker["Boolean"] = 2] = "Boolean";
-  ByteMarker[ByteMarker["Date"] = 3] = "Date";
-  ByteMarker[ByteMarker["Constructor"] = 4] = "Constructor";
-  ByteMarker[ByteMarker["Function"] = 5] = "Function";
-  ByteMarker[ByteMarker["Null"] = 6] = "Null";
-  ByteMarker[ByteMarker["Number"] = 7] = "Number";
-  ByteMarker[ByteMarker["Object"] = 8] = "Object";
-  ByteMarker[ByteMarker["RegExp"] = 9] = "RegExp";
-  ByteMarker[ByteMarker["String"] = 10] = "String";
-  ByteMarker[ByteMarker["Symbol"] = 11] = "Symbol";
-  ByteMarker[ByteMarker["TypeArray"] = 12] = "TypeArray";
-  ByteMarker[ByteMarker["Undefined"] = 13] = "Undefined";
-})(ByteMarker || (ByteMarker = {}));
+var ByteMarker = {
+  Array: 0,
+  BigInt: 1,
+  Boolean: 2,
+  Date: 3,
+  Constructor: 4,
+  Function: 5,
+  Null: 6,
+  Number: 7,
+  Object: 8,
+  RegExp: 9,
+  String: 10,
+  Symbol: 11,
+  TypeArray: 12,
+  Undefined: 13
+};
 var Accumulator = BigInt("14695981039346656037");
 var [Prime, Size] = [BigInt("1099511628211"), BigInt("18446744073709551616")];
 var Bytes = Array.from({ length: 256 }).map((_, i) => BigInt(i));
@@ -15196,7 +15195,7 @@ function scaffoldFiles(framework, slug) {
       "package.json": JSON.stringify({
         private: true,
         type: "module",
-        dependencies: { elysia: "2.0.0-beta.21" }
+        dependencies: { elysia: "2.0.0-beta.32" }
       }, null, 2) + `
 `,
       "index.ts": `import { Elysia } from "elysia";
@@ -21389,34 +21388,34 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.1"
+      version: "0.46.4"
     },
     app: {
-      version: "0.27.0",
+      version: "0.27.1",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.30.0"
+      version: "0.31.1"
     },
     commands: {
-      version: "0.9.2"
+      version: "0.9.3"
     },
     contracts: {
-      version: "0.9.0"
+      version: "0.10.0"
     },
     db: {
-      version: "0.17.0",
+      version: "0.17.1",
       peerDependencies: {
-        "drizzle-orm": "1.0.0-rc.5-169397b"
+        "drizzle-orm": "1.0.0-rc.5-5935859"
       },
       devDependencies: {
-        "drizzle-kit": "1.0.0-rc.5-ab785fc"
+        "drizzle-kit": "1.0.0-rc.5-5935859"
       }
     },
     sdk: {
-      version: "0.42.0",
+      version: "0.43.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -21759,8 +21758,8 @@ function baseFiles(name, sdkDependencies) {
       dependencies: {
         "@supacloud/app": `^${appMetadata.version}`,
         "@supacloud/elysia": `^${elysiaMetadata.version}`,
-        effect: "4.0.2",
-        elysia: "2.0.0-beta.21",
+        effect: "4.0.5",
+        elysia: "2.0.0-beta.32",
         ...sdkDependencies ?? { rxjs: appMetadata.dependencies.rxjs }
       },
       devDependencies: {
@@ -22223,6 +22222,8 @@ export type ReviewAttachmentInput = Static<typeof AttachmentInput>;
 export type ReviewAttachmentResult = Static<typeof AttachmentResult>;
 
 export interface ReviewAttachmentStore {
+  // Reauthorize before returning a committed result; null means execution is still needed.
+  readResult(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult | null>;
   // Resolve the immutable artifact under the worker's own authorization and current review revision.
   readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;
   // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.
@@ -22238,6 +22239,8 @@ export class VerifyReviewAttachment {
   constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}
 
   async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {
+    const committed = await this.store.readResult(input);
+    if (committed !== null) return committed;
     const source = await this.store.readAttachment(input);
     if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {
       throw new ApplicationError("Attachment size is outside the supported range", { code: "ATTACHMENT_SIZE_INVALID" });
@@ -22262,6 +22265,7 @@ const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", b
 test("attachment job awaits the authorized reader and the committed result", async () => {
   let recorded: ReviewAttachmentResult | undefined;
   const job = new VerifyReviewAttachment({
+    async readResult() { return null; },
     async readAttachment() { return { body, sha256 }; },
     async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },
   });
@@ -22278,16 +22282,33 @@ test("missing authorization, corrupted bytes and persistence failures are not su
     async () => ({ body: new Uint8Array(1048577), sha256 }),
   ]) {
     const job = new VerifyReviewAttachment({
+      async readResult() { return null; },
       readAttachment, async recordAttachment(_input, result) { records++; return result; },
     });
     await expect(job.run(input)).rejects.toThrow();
   }
   expect(records).toBe(0);
   await expect(new VerifyReviewAttachment({
+    async readResult() { return null; },
     async readAttachment() { return { body, sha256 }; },
     async recordAttachment() { throw new Error("Commit failed"); },
   }).run(input)).rejects.toThrow("Commit failed");
 });
+
+test("a reauthorized committed result avoids another download or write", async () => {
+  const result = { ...input, sha256, bytes: body.byteLength };
+  const job = new VerifyReviewAttachment({
+    async readResult() { return result; },
+    async readAttachment() { throw new Error("Must not download again"); },
+    async recordAttachment() { throw new Error("Must not write again"); },
+  });
+  expect(await job.run(input)).toEqual(result);
+  await expect(new VerifyReviewAttachment({
+    async readResult() { throw new Error("Access revoked"); },
+    async readAttachment() { throw new Error("Must not download"); },
+    async recordAttachment() { throw new Error("Must not write"); },
+  }).run(input)).rejects.toThrow("Access revoked");
+});
 `;
 
 // src/shared/tools/app-starter-attachments.ts
@@ -22308,7 +22329,8 @@ ALTER TABLE public.starter_attachment_results ENABLE ROW LEVEL SECURITY;
 var STARTER_ATTACHMENT_POSTGRES = `import { SupaCloudArtifactsClient } from "@supacloud/js";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CommandDatabase, CommandTransaction } from "@supacloud/db";
-import type { ReviewAttachmentInput, ReviewAttachmentResult, ReviewAttachmentStore } from "../review/attachment";
+import { createSchemaDecoder } from "@supacloud/elysia";
+import { AttachmentResult, type ReviewAttachmentInput, type ReviewAttachmentResult, type ReviewAttachmentStore } from "../review/attachment";
 
 export interface ReviewAttachmentOptions {
   database: CommandDatabase;
@@ -22329,14 +22351,13 @@ function record(value: unknown): Record<string, unknown> {
   if (!isRecord(value)) throw new TypeError("Invalid attachment record");
   return value;
 }
-function durableResult(value: unknown): ReviewAttachmentResult {
-  const item = record(value);
-  if (typeof item["reviewId"] !== "string" || typeof item["artifactId"] !== "string"
-    || typeof item["version"] !== "number" || typeof item["sha256"] !== "string"
-    || typeof item["bytes"] !== "number" || Object.keys(item).length !== 5) {
-    throw new Error("Invalid durable attachment result");
-  }
-  return { reviewId: item["reviewId"], artifactId: item["artifactId"], version: item["version"], sha256: item["sha256"], bytes: item["bytes"] };
+const durableResult = createSchemaDecoder(AttachmentResult, { normalize: false });
+
+function resultFor(input: ReviewAttachmentInput, value: unknown): ReviewAttachmentResult {
+  const result = durableResult(value);
+  if (result.reviewId !== input.reviewId || result.version !== input.version
+    || result.artifactId !== input.artifactId) throw new Error("Conflicting durable attachment result");
+  return result;
 }
 
 export async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{
@@ -22382,6 +22403,16 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
       ]);
     },
     store: {
+      async readResult(input) {
+        return database.transaction(async tx => {
+          await authorize(tx, input);
+          const saved = rows(await tx.query(
+            "SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3",
+            [input.reviewId, input.version, input.artifactId],
+          ));
+          return saved.length === 0 ? null : resultFor(input, saved[0]?.["result"]);
+        });
+      },
       async readAttachment(input) {
         const allowed = await database.transaction(tx => authorize(tx, input));
         const artifact = await artifacts.get(input.artifactId);
@@ -22395,24 +22426,19 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
         return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };
       },
       async recordAttachment(input, result) {
-        if (result.reviewId !== input.reviewId || result.version !== input.version
-          || result.artifactId !== input.artifactId || !/^[a-f0-9]{64}$/.test(result.sha256)
-          || !Number.isSafeInteger(result.bytes) || result.bytes < 1 || result.bytes > 1048576) {
-          throw new Error("Invalid attachment result");
-        }
+        const decoded = resultFor(input, result);
         return database.transaction(async tx => {
           await authorize(tx, input);
           await tx.query(
             "INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING",
-            [input.reviewId, input.version, input.artifactId, JSON.stringify(result)],
+            [input.reviewId, input.version, input.artifactId, JSON.stringify(decoded)],
           );
           const saved = rows(await tx.query(
             "SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3",
             [input.reviewId, input.version, input.artifactId],
           ))[0]?.["result"];
-          const value = durableResult(saved);
-          if (value.reviewId !== result.reviewId || value.version !== result.version || value.artifactId !== result.artifactId
-            || value.sha256 !== result.sha256 || value.bytes !== result.bytes) {
+          const value = resultFor(input, saved);
+          if (value.sha256 !== decoded.sha256 || value.bytes !== decoded.bytes) {
             throw new Error("Conflicting durable attachment result");
           }
           return value;
@@ -22958,20 +22984,21 @@ ALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;
 `;
-var STARTER_REVIEW_POSTGRES = `import { AsyncLocalStorage } from "node:async_hooks";
-import { createTransactionalCommand, plaintextCommandInput } from "@supacloud/commands";
+var STARTER_REVIEW_POSTGRES = `import { plaintextCommandInput } from "@supacloud/commands";
 import { CommandError } from "@supacloud/contracts";
 import { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from "@supacloud/db";
 import {
-  ApplicationError, createSupAuthRequestContext, requireTrustedIdentity, requireIdempotencyKey,
+  ApplicationError, createSchemaDecoder, createSupAuthRequestContext, requireTrustedIdentity,
+  createTransactionalCommandGovernance,
   type CommandInvocation, type SupAuthContextOptions,
 } from "@supacloud/elysia";
 import type { AppAdapters } from "../application";
 import type { ReviewStore } from "../review/review";
 import type { ReviewUploadPort } from "../review/uploads";
+import { ApprovalInput, ReviewResult } from "../review/contracts";
 
-interface Approval { id: string; expectedVersion: number }
-interface Review { state: "draft" | "approved"; version: number }
+const input = createSchemaDecoder(ApprovalInput, { normalize: false });
+const result = createSchemaDecoder(ReviewResult, { normalize: false });
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -22988,19 +23015,6 @@ function isPublicConflict(value: unknown): boolean {
   return value instanceof ApplicationError && value.status === 409
     || isRecord(value) && value["expose"] === true && value["status"] === 409 && typeof value["code"] === "string";
 }
-function input(value: unknown): Approval {
-  const item = record(value);
-  if (typeof item["id"] !== "string" || !item["id"].length || typeof item["expectedVersion"] !== "number"
-    || !Number.isSafeInteger(item["expectedVersion"]) || item["expectedVersion"] < 1) throw new TypeError("Invalid approval input");
-  return { id: item["id"], expectedVersion: item["expectedVersion"] };
-}
-function result(value: unknown): Review {
-  const item = record(value);
-  if ((item["state"] !== "draft" && item["state"] !== "approved") || typeof item["version"] !== "number"
-    || !Number.isSafeInteger(item["version"]) || item["version"] < 1) throw new TypeError("Invalid review result");
-  return { state: item["state"], version: item["version"] };
-}
-
 export interface ReviewPostgresOptions {
   database: CommandDatabase;
   tenantId: string;
@@ -23038,12 +23052,7 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
       } : null;
     },
   });
-  const scope = new AsyncLocalStorage<CommandTransaction>();
-  const transaction = () => {
-    const tx = scope.getStore();
-    if (!tx) throw new Error("Review storage requires its durable command transaction");
-    return tx;
-  };
+  const transaction = () => commandBinding.transaction();
   const store: ReviewStore = {
     ...options.uploads,
     async get(table, id) {
@@ -23072,64 +23081,30 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
     }
     return who.subject;
   }
-  const commandStore = createPostgresCommandStore(database);
-  return {
-    deps: { dbClient: store }, requestContext,
-    commandGovernance: {
-      authorize(invocation) {
-        const command = invocation.command;
-        if (command.name !== "review.approve" || command.permission !== "review.approve"
-          || command.transaction !== "required" || command.idempotency !== "required"
-          || command.audit !== "review.approved" || command.rpc !== undefined) {
-          throw new ApplicationError("Unsupported review command", { status: 501, code: "REVIEW_COMMAND_UNSUPPORTED" });
-        }
-        actor(invocation);
-      },
-      async idempotency(invocation, next) {
-        const command = createTransactionalCommand({
-          name: invocation.command.name, store: commandStore,
-          inputCodec: plaintextCommandInput, input, result,
-          async authorize(who, request, tx) {
-            const found = rows(await tx.query(
-              "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
-              "CROSS JOIN public.starter_application a " +
-              "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
-              "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
-              [request.id, who.actorId, projectId, who.tenantId],
-            ));
-            return found.length === 1 ? "allow" : "deny";
-          },
-          execute: tx => scope.run(tx, async () => {
-            try { return await next(); }
-            catch (error) {
-              if (isPublicConflict(error)) {
-                throw new CommandError("COMMAND_IDEMPOTENCY_CONFLICT");
-              }
-              throw error;
-            }
-          }),
-          audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
-        });
-        try {
-          const receipt = await command.execute(
-            { actorId: actor(invocation), tenantId }, requireIdempotencyKey(invocation),
-            { id: invocation.input.params["id"], expectedVersion: record(invocation.input.body)["expectedVersion"] },
-            invocation.request.signal,
-          );
-          if (receipt.status !== "confirmed") throw new CommandError("COMMAND_OUTCOME_UNKNOWN");
-          return receipt.result;
-        } catch (error) {
-          if (!(error instanceof CommandError)) throw error;
-          const status = error.code === "COMMAND_REJECTED" ? 403
-            : error.code === "COMMAND_IDEMPOTENCY_CONFLICT" ? 409 : 503;
-          throw new ApplicationError(error.code, { code: error.code, status });
-        }
+  const commandBinding = createTransactionalCommandGovernance({
+    permission: "review.approve",
+    identity: invocation => ({ actorId: actor(invocation), tenantId }),
+    input: invocation => ({
+      ...record(invocation.input.body), id: invocation.input.params["id"],
+    }),
+    rejection: error => isPublicConflict(error) ? new CommandError("COMMAND_IDEMPOTENCY_CONFLICT") : undefined,
+    definition: {
+      name: "review.approve", store: createPostgresCommandStore(database),
+      inputCodec: plaintextCommandInput, input, result,
+      async authorize(who, request, tx) {
+        const found = rows(await tx.query(
+          "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
+          "CROSS JOIN public.starter_application a " +
+          "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
+          "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
+          [request.id, who.actorId, projectId, who.tenantId],
+        ));
+        return found.length === 1 ? "allow" : "deny";
       },
-      transaction(_invocation, next) { transaction(); return next(); },
-      // The durable command owns the authoritative audit and receipt in the same transaction.
-      audit: { succeeded() { transaction(); }, failed() {} },
+      audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
     },
-  };
+  });
+  return { deps: { dbClient: store }, requestContext, commandGovernance: commandBinding.governance };
 }
 `;
 var STARTER_REVIEW_POSTGRES_TEST = `import { expect, test } from "bun:test";
@@ -23166,9 +23141,9 @@ test("PostgreSQL host never falls back to demo identity or unbound business stor
   await expect(adapters.requestContext(new Request("http://localhost/reviews/health")))
     .rejects.toMatchObject({ code: "AUTHENTICATION_REQUIRED" });
   const store = adapters.deps["dbClient"] as ReviewStore;
-  await expect(store.get("reviews", "example")).rejects.toThrow("durable command transaction");
+  await expect(store.get("reviews", "example")).rejects.toThrow("not active");
   await expect(store.set("reviews", "example", { state: "approved", version: 2 }))
-    .rejects.toThrow("durable command transaction");
+    .rejects.toThrow("not active");
   expect(db.queries).toHaveLength(1);
 });
 `;
@@ -23454,6 +23429,58 @@ export default defineConfig({
   };
 }
 
+// src/shared/tools/app-starter-query.ts
+var STARTER_REVIEW_QUERY = `import type { SupabaseClient } from "@supabase/supabase-js";
+import type { ReviewRow } from "../../db/schema";
+
+// This read projection uses SQL column names shared with the Drizzle source.
+// Do not expose camelCase Drizzle property names as PostgREST column names.
+export type ReviewSummary = Pick<ReviewRow, "id" | "state" | "version">;
+export type ReviewReadDatabase = {
+  public: {
+    Tables: {
+      starter_reviews: {
+        Row: ReviewSummary;
+        Insert: never;
+        Update: never;
+        Relationships: [];
+      };
+    };
+    Views: Record<never, never>;
+    Functions: Record<never, never>;
+  };
+};
+
+export interface ReviewPageOptions {
+  page?: number;
+  pageSize?: number;
+  signal?: AbortSignal;
+}
+
+// Reuse the application's user-scoped client. Identity verification and row
+// authorization belong to the gateway and database, never a caller-supplied owner.
+export async function listReviews(
+  client: SupabaseClient<ReviewReadDatabase>,
+  { page = 1, pageSize = 25, signal }: ReviewPageOptions = {},
+) {
+  if (!Number.isSafeInteger(page) || page < 1
+    || !Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 100
+    || !Number.isSafeInteger(page * pageSize)) {
+    throw new RangeError("Invalid review page: page >= 1 and pageSize between 1 and 100 are required");
+  }
+  signal?.throwIfAborted();
+  const start = (page - 1) * pageSize;
+  const query = client.from("starter_reviews")
+    .select("id,state,version", { count: "exact" })
+    .order("id", { ascending: true })
+    .range(start, start + pageSize - 1);
+  const { data, error, count } = await (signal ? query.abortSignal(signal) : query);
+  if (error) throw error;
+  if (data === null || count === null) throw new Error("Incomplete review page response");
+  return { data, total: count, page, pageSize, hasNextPage: start + data.length < count };
+}
+`;
+
 // src/shared/tools/app-starter.ts
 var { compiler: compilerMetadata2, app: appMetadata2, elysia: elysiaMetadata2, commands: commandsMetadata, contracts: contractsMetadata, db: dbMetadata, sdk: sdkMetadata } = starter_metadata_default.packages;
 var json2 = (value) => `${JSON.stringify(value, null, 2)}
@@ -23461,6 +23488,7 @@ var json2 = (value) => `${JSON.stringify(value, null, 2)}
 function appStarterFiles(name) {
   return {
     ...starterDatabaseFiles(),
+    "src/review/list-reviews.ts": STARTER_REVIEW_QUERY,
     "package.json": json2({
       name,
       version: "0.0.0",
@@ -23495,8 +23523,8 @@ function appStarterFiles(name) {
         "drizzle-orm": dbMetadata.peerDependencies["drizzle-orm"],
         "@supacloud/js": `^${sdkMetadata.version}`,
         "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"],
-        effect: "4.0.2",
-        elysia: "2.0.0-beta.21",
+        effect: "4.0.5",
+        elysia: "2.0.0-beta.32",
         rxjs: appMetadata2.dependencies.rxjs
       },
       devDependencies: {
@@ -23750,11 +23778,10 @@ import {
   Body, Command, Controller, DB_CLIENT, Get, Inject, Param, Post,
   defineFeatureSlice, defineFeatureSpec, type Aspect,
 } from "@supacloud/app";
-import { ApplicationError, assertFeatureTransition } from "@supacloud/elysia";
-import { ApproveBody, HealthResult, Params, ReviewResult } from "./contracts";
+import { ApplicationError, assertFeatureTransition, createSchemaDecoder } from "@supacloud/elysia";
+import { ApproveBody, HealthResult, Params, ReviewResult, type ApprovalBody, type Review } from "./contracts";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
-import type { ReviewRow } from "../../db/schema";
 
 export const reviewSpec = defineFeatureSpec({
   name: "review",
@@ -23769,7 +23796,6 @@ export const reviewSpec = defineFeatureSpec({
   },
 });
 
-type Review = Pick<ReviewRow, "state" | "version">;
 // Production implementations must bind both operations to the current transaction.
 export interface ReviewStore extends Partial<ReviewUploadPort> {
   get(table: string, key: string): unknown;
@@ -23782,13 +23808,12 @@ export const requireRequest: Aspect = (context, next) => {
   return next();
 };
 
+const decodeReview = createSchemaDecoder(ReviewResult, { normalize: false });
 function readReview(value: unknown): Review {
-  if (typeof value !== "object" || value === null ||
-      !("state" in value) || (value.state !== "draft" && value.state !== "approved") ||
-      !("version" in value) || typeof value.version !== "number") {
+  try { return decodeReview(value); }
+  catch {
     throw new ApplicationError("Review not found", { status: 404, code: "REVIEW_NOT_FOUND" });
   }
-  return { state: value.state, version: value.version };
 }
 
 @Command({
@@ -23820,7 +23845,7 @@ type ReviewError =
     | { readonly _tag: "FEATURE_TRANSITION_CONFLICT" }
     | { readonly _tag: "COMMAND_IDEMPOTENCY_CONFLICT" }
     | { readonly _tag: "COMMAND_REJECTED" }
-    | { readonly _tag: "REVIEW_COMMAND_UNSUPPORTED" }
+    | { readonly _tag: "COMMAND_BINDING_MISMATCH" }
     | { readonly _tag: "COMMAND_OUTCOME_UNKNOWN" };
 
 @Controller("/reviews")
@@ -23849,13 +23874,13 @@ export class ReviewController {
         { tag: "FEATURE_TRANSITION_CONFLICT", status: 409, code: "FEATURE_TRANSITION_CONFLICT" },
         { tag: "COMMAND_IDEMPOTENCY_CONFLICT", status: 409, code: "COMMAND_IDEMPOTENCY_CONFLICT" },
         { tag: "COMMAND_REJECTED", status: 403, code: "COMMAND_REJECTED" },
-        { tag: "REVIEW_COMMAND_UNSUPPORTED", status: 501, code: "REVIEW_COMMAND_UNSUPPORTED" },
+        { tag: "COMMAND_BINDING_MISMATCH", status: 501, code: "COMMAND_BINDING_MISMATCH" },
         { tag: "COMMAND_OUTCOME_UNKNOWN", status: 503, code: "COMMAND_OUTCOME_UNKNOWN" },
       ],
       retry: "none",
     },
   })
-  approve(@Param("id") id: string, @Body() body: { expectedVersion: number }): Effect.Effect<Review, ReviewError, never> {
+  approve(@Param("id") id: string, @Body() body: ApprovalBody): Effect.Effect<Review, ReviewError, never> {
     return Effect.promise(() => this.approveReview.execute(id, body.expectedVersion));
   }
 }
@@ -23867,13 +23892,16 @@ export const ReviewFeature = defineFeatureSlice({
 });
 `,
     "src/review/attachment.ts": STARTER_REVIEW_JOB,
-    "src/review/contracts.ts": `import { t } from "elysia";
+    "src/review/contracts.ts": `import { t, type UnwrapSchema } from "elysia";
 export const Params = t.Object({ id: t.String({ minLength: 1 }) });
-export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1 }) });
+export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1, maximum: 9007199254740991 }) });
+export const ApprovalInput = t.Object({ ...Params.properties, ...ApproveBody.properties }, { additionalProperties: false });
+export type ApprovalBody = UnwrapSchema<typeof ApproveBody>;
 export const ReviewResult = t.Object({
   state: t.Union([t.Literal("draft"), t.Literal("approved")]),
-  version: t.Integer({ minimum: 1 }),
+  version: t.Integer({ minimum: 1, maximum: 9007199254740991 }),
 });
+export type Review = UnwrapSchema<typeof ReviewResult>;
 export const HealthResult = t.Object({ ok: t.Boolean() });
 export const UploadParams = t.Object({ id: t.String({ format: "uuid" }) });
 export const UploadBody = t.Object({
@@ -24015,6 +24043,18 @@ Ordinary reads use PostgREST through the existing user-scoped
 Use the caller's session, RLS and grants; never introduce a second session store.
 Business writes continue through the governed Command/RPC boundary.
 
+Use listReviews from src/review/list-reviews.ts for the paginated review list.
+Type the existing client with ReviewReadDatabase (a read-only projection derived
+from db/schema.ts), then call listReviews(client, { page: 1, pageSize: 25, signal }).
+The helper returns data, total, page, pageSize and hasNextPage, orders by the unique
+id and preserves PostgREST errors. Pages are one-based and limited to 100 rows.
+Exact counts obey RLS but may be expensive on large tables; offset pages are not
+a cross-request snapshot when records change. No owner filter replaces RLS.
+Do not create a service-role client or a second auth session for this helper.
+Existing starters can add this file without a new migration only if their reviewed
+review-table grants and identity-mapping RLS from migration 003 are already applied.
+The projection is not a full database export and grants no write access.
+
 GraphQL is not generated or enabled by this starter. For a specific Query Contract,
 explicitly configure graphql.schema with a role-scoped database export and add
 checked query documents. Drizzle and append-only migrations remain the database
@@ -24169,6 +24209,15 @@ the existing Workflow and invokes the compiled Job with a ReviewAttachmentStore.
 Its reader authorizes the worker independently; its writer rechecks the review
 revision/artifact binding and persists the result idempotently before acknowledgement.
 After a lost acknowledgement, reconcile that result instead of repeating effects.
+The generated Job first calls store.readResult. The PostgreSQL adapter rechecks
+current permission, ownership, revision and project/tenant binding inside the
+read transaction, then validates a stored result with AttachmentResult. A valid
+committed result skips Storage download and result insertion on redelivery.
+Revoked access or a malformed/conflicting result fails closed, not as a cache miss.
+Existing custom ReviewAttachmentStore implementations must add readResult with
+these same authorization and validation guarantees when adopting this Job.
+This does not automatically restart a halted worker, reset the attempt budget,
+or make external side effects atomic with the database.
 
 src/host/review-attachments.ts supplies createReviewAttachmentAdapters with a
 durable store and enqueue callback for the approval adapter's afterApproved hook.
@@ -30513,7 +30562,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.99.0",
+  version: "0.101.2",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -30565,21 +30614,21 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.1",
-    "@supacloud/delivery": "0.18.0",
-    "@supacloud/db": "0.17.0",
-    typebox: "1.3.36"
+    "@supacloud/compiler": "^0.46.4",
+    "@supacloud/delivery": "0.18.1",
+    "@supacloud/db": "0.17.1",
+    typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.9.0",
-    "@supacloud/delivery": "0.18.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/contracts": "0.10.0",
+    "@supacloud/delivery": "0.18.1",
+    "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
-    "@supacloud/elysia": "^0.24.1",
+    "@supacloud/elysia": "0.31.1",
     "@types/bun": "^1.4.3",
-    effect: "4.0.2",
-    elysia: "2.0.0-beta.21",
+    effect: "4.0.5",
+    elysia: "2.0.0-beta.32",
     typescript: "^7.0.2"
   }
 };

package/dist/shared/tools/app-starter-attachments.d.ts

@@ -1,2 +1,2 @@
 export declare const STARTER_ATTACHMENT_SCHEMA = "-- Apply with the migration owner, never from an application process.\nCREATE TABLE public.starter_attachments (\n  review_id text PRIMARY KEY REFERENCES public.starter_reviews(id),\n  artifact_id uuid NOT NULL UNIQUE, owner_id text NOT NULL, run_id uuid NOT NULL UNIQUE,\n  object_path text NOT NULL UNIQUE\n);\nCREATE TABLE public.starter_attachment_results (\n  review_id text NOT NULL REFERENCES public.starter_reviews(id),\n  version integer NOT NULL CHECK (version >= 2), artifact_id uuid NOT NULL,\n  result jsonb NOT NULL, PRIMARY KEY(review_id,version,artifact_id)\n);\nALTER TABLE public.starter_attachments ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_attachment_results ENABLE ROW LEVEL SECURITY;\n";
-export declare const STARTER_ATTACHMENT_POSTGRES = "import { SupaCloudArtifactsClient } from \"@supacloud/js\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { CommandDatabase, CommandTransaction } from \"@supacloud/db\";\nimport type { ReviewAttachmentInput, ReviewAttachmentResult, ReviewAttachmentStore } from \"../review/attachment\";\n\nexport interface ReviewAttachmentOptions {\n  database: CommandDatabase;\n  // Provision this client for the same project as the database; never use a caller's bearer token.\n  service: SupabaseClient;\n  projectId: string;\n  tenantId: string;\n}\n\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid attachment database result\");\n  return value.map(record);\n}\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid attachment record\");\n  return value;\n}\nfunction durableResult(value: unknown): ReviewAttachmentResult {\n  const item = record(value);\n  if (typeof item[\"reviewId\"] !== \"string\" || typeof item[\"artifactId\"] !== \"string\"\n    || typeof item[\"version\"] !== \"number\" || typeof item[\"sha256\"] !== \"string\"\n    || typeof item[\"bytes\"] !== \"number\" || Object.keys(item).length !== 5) {\n    throw new Error(\"Invalid durable attachment result\");\n  }\n  return { reviewId: item[\"reviewId\"], artifactId: item[\"artifactId\"], version: item[\"version\"], sha256: item[\"sha256\"], bytes: item[\"bytes\"] };\n}\n\nexport async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{\n  store: ReviewAttachmentStore;\n  enqueue(tx: CommandTransaction, reviewId: string, version: number): Promise<void>;\n}> {\n  const { database, service, projectId, tenantId } = options;\n  if (!projectId.trim() || !tenantId.trim()) throw new TypeError(\"Attachment project/tenant is required\");\n  const artifacts = new SupaCloudArtifactsClient(service);\n  const binding = rows(await database.transaction(tx => tx.query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  )));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Attachment database project/tenant binding mismatch\");\n  }\n  async function authorize(tx: CommandTransaction, input: ReviewAttachmentInput) {\n    const allowed = rows(await tx.query(\n      \"SELECT a.object_path,a.run_id FROM public.starter_attachments a \" +\n      \"JOIN public.starter_reviews r ON r.id=a.review_id AND r.owner_id=a.owner_id \" +\n      \"JOIN public.starter_members m ON m.subject=a.owner_id AND m.enabled AND m.can_approve \" +\n      \"CROSS JOIN public.starter_application p \" +\n      \"WHERE a.review_id=$1 AND a.artifact_id=$2 AND r.version=$3 AND r.state='approved' \" +\n      \"AND p.singleton AND p.project_id=$4 AND p.tenant_id=$5 \" +\n      \"FOR UPDATE OF r,a,m FOR SHARE OF p\",\n      [input.reviewId, input.artifactId, input.version, projectId, tenantId],\n    ));\n    if (allowed.length !== 1 || typeof allowed[0]?.[\"object_path\"] !== \"string\") {\n      throw new Error(\"Attachment worker authorization or review revision is no longer valid\");\n    }\n    return allowed[0];\n  }\n  return {\n    async enqueue(tx, reviewId, version) {\n      const found = rows(await tx.query(\n        \"SELECT artifact_id FROM public.starter_attachments WHERE review_id=$1\", [reviewId],\n      ))[0];\n      if (!found) return;\n      const input = { reviewId, version, artifactId: String(found[\"artifact_id\"]) };\n      const allowed = await authorize(tx, input);\n      // Bind serialized JSON as text so drivers cannot encode the string as a JSON scalar.\n      await tx.query(\"SELECT supacloud_workflows.start_run($1::uuid,$2,'1','verify',$3::text::jsonb,3)\", [\n        String(allowed[\"run_id\"]), \"review.verify-attachment\", JSON.stringify(input),\n      ]);\n    },\n    store: {\n      async readAttachment(input) {\n        const allowed = await database.transaction(tx => authorize(tx, input));\n        const artifact = await artifacts.get(input.artifactId);\n        if (!artifact || artifact.bucketId !== \"review-attachments\"\n          || artifact.objectPath !== allowed[\"object_path\"] || artifact.artifactType !== \"review.attachment\"\n          || artifact.mimeType !== \"text/plain\" || !/^[1-9][0-9]*$/.test(artifact.sizeBytes)\n          || BigInt(artifact.sizeBytes) > 1048576n) throw new Error(\"Invalid attachment artifact\");\n        const downloaded = await service.storage.from(artifact.bucketId).download(artifact.objectPath);\n        if (downloaded.error || !downloaded.data) throw new Error(\"Attachment download failed\");\n        if (downloaded.data.size !== Number(artifact.sizeBytes)) throw new Error(\"Attachment size mismatch\");\n        return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };\n      },\n      async recordAttachment(input, result) {\n        if (result.reviewId !== input.reviewId || result.version !== input.version\n          || result.artifactId !== input.artifactId || !/^[a-f0-9]{64}$/.test(result.sha256)\n          || !Number.isSafeInteger(result.bytes) || result.bytes < 1 || result.bytes > 1048576) {\n          throw new Error(\"Invalid attachment result\");\n        }\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          await tx.query(\n            \"INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING\",\n            [input.reviewId, input.version, input.artifactId, JSON.stringify(result)],\n          );\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ))[0]?.[\"result\"];\n          const value = durableResult(saved);\n          if (value.reviewId !== result.reviewId || value.version !== result.version || value.artifactId !== result.artifactId\n            || value.sha256 !== result.sha256 || value.bytes !== result.bytes) {\n            throw new Error(\"Conflicting durable attachment result\");\n          }\n          return value;\n        });\n      },\n    },\n  };\n}\n";
+export declare const STARTER_ATTACHMENT_POSTGRES = "import { SupaCloudArtifactsClient } from \"@supacloud/js\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { CommandDatabase, CommandTransaction } from \"@supacloud/db\";\nimport { createSchemaDecoder } from \"@supacloud/elysia\";\nimport { AttachmentResult, type ReviewAttachmentInput, type ReviewAttachmentResult, type ReviewAttachmentStore } from \"../review/attachment\";\n\nexport interface ReviewAttachmentOptions {\n  database: CommandDatabase;\n  // Provision this client for the same project as the database; never use a caller's bearer token.\n  service: SupabaseClient;\n  projectId: string;\n  tenantId: string;\n}\n\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid attachment database result\");\n  return value.map(record);\n}\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid attachment record\");\n  return value;\n}\nconst durableResult = createSchemaDecoder(AttachmentResult, { normalize: false });\n\nfunction resultFor(input: ReviewAttachmentInput, value: unknown): ReviewAttachmentResult {\n  const result = durableResult(value);\n  if (result.reviewId !== input.reviewId || result.version !== input.version\n    || result.artifactId !== input.artifactId) throw new Error(\"Conflicting durable attachment result\");\n  return result;\n}\n\nexport async function createReviewAttachmentAdapters(options: ReviewAttachmentOptions): Promise<{\n  store: ReviewAttachmentStore;\n  enqueue(tx: CommandTransaction, reviewId: string, version: number): Promise<void>;\n}> {\n  const { database, service, projectId, tenantId } = options;\n  if (!projectId.trim() || !tenantId.trim()) throw new TypeError(\"Attachment project/tenant is required\");\n  const artifacts = new SupaCloudArtifactsClient(service);\n  const binding = rows(await database.transaction(tx => tx.query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  )));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Attachment database project/tenant binding mismatch\");\n  }\n  async function authorize(tx: CommandTransaction, input: ReviewAttachmentInput) {\n    const allowed = rows(await tx.query(\n      \"SELECT a.object_path,a.run_id FROM public.starter_attachments a \" +\n      \"JOIN public.starter_reviews r ON r.id=a.review_id AND r.owner_id=a.owner_id \" +\n      \"JOIN public.starter_members m ON m.subject=a.owner_id AND m.enabled AND m.can_approve \" +\n      \"CROSS JOIN public.starter_application p \" +\n      \"WHERE a.review_id=$1 AND a.artifact_id=$2 AND r.version=$3 AND r.state='approved' \" +\n      \"AND p.singleton AND p.project_id=$4 AND p.tenant_id=$5 \" +\n      \"FOR UPDATE OF r,a,m FOR SHARE OF p\",\n      [input.reviewId, input.artifactId, input.version, projectId, tenantId],\n    ));\n    if (allowed.length !== 1 || typeof allowed[0]?.[\"object_path\"] !== \"string\") {\n      throw new Error(\"Attachment worker authorization or review revision is no longer valid\");\n    }\n    return allowed[0];\n  }\n  return {\n    async enqueue(tx, reviewId, version) {\n      const found = rows(await tx.query(\n        \"SELECT artifact_id FROM public.starter_attachments WHERE review_id=$1\", [reviewId],\n      ))[0];\n      if (!found) return;\n      const input = { reviewId, version, artifactId: String(found[\"artifact_id\"]) };\n      const allowed = await authorize(tx, input);\n      // Bind serialized JSON as text so drivers cannot encode the string as a JSON scalar.\n      await tx.query(\"SELECT supacloud_workflows.start_run($1::uuid,$2,'1','verify',$3::text::jsonb,3)\", [\n        String(allowed[\"run_id\"]), \"review.verify-attachment\", JSON.stringify(input),\n      ]);\n    },\n    store: {\n      async readResult(input) {\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ));\n          return saved.length === 0 ? null : resultFor(input, saved[0]?.[\"result\"]);\n        });\n      },\n      async readAttachment(input) {\n        const allowed = await database.transaction(tx => authorize(tx, input));\n        const artifact = await artifacts.get(input.artifactId);\n        if (!artifact || artifact.bucketId !== \"review-attachments\"\n          || artifact.objectPath !== allowed[\"object_path\"] || artifact.artifactType !== \"review.attachment\"\n          || artifact.mimeType !== \"text/plain\" || !/^[1-9][0-9]*$/.test(artifact.sizeBytes)\n          || BigInt(artifact.sizeBytes) > 1048576n) throw new Error(\"Invalid attachment artifact\");\n        const downloaded = await service.storage.from(artifact.bucketId).download(artifact.objectPath);\n        if (downloaded.error || !downloaded.data) throw new Error(\"Attachment download failed\");\n        if (downloaded.data.size !== Number(artifact.sizeBytes)) throw new Error(\"Attachment size mismatch\");\n        return { body: new Uint8Array(await downloaded.data.arrayBuffer()), sha256: artifact.sha256 };\n      },\n      async recordAttachment(input, result) {\n        const decoded = resultFor(input, result);\n        return database.transaction(async tx => {\n          await authorize(tx, input);\n          await tx.query(\n            \"INSERT INTO public.starter_attachment_results VALUES($1,$2,$3,$4::text::jsonb) ON CONFLICT DO NOTHING\",\n            [input.reviewId, input.version, input.artifactId, JSON.stringify(decoded)],\n          );\n          const saved = rows(await tx.query(\n            \"SELECT result FROM public.starter_attachment_results WHERE review_id=$1 AND version=$2 AND artifact_id=$3\",\n            [input.reviewId, input.version, input.artifactId],\n          ))[0]?.[\"result\"];\n          const value = resultFor(input, saved);\n          if (value.sha256 !== decoded.sha256 || value.bytes !== decoded.bytes) {\n            throw new Error(\"Conflicting durable attachment result\");\n          }\n          return value;\n        });\n      },\n    },\n  };\n}\n";

package/dist/shared/tools/app-starter-postgres.d.ts

@@ -1,4 +1,4 @@
 export declare const STARTER_REVIEW_SCHEMA = "-- Apply with the platform migration owner, never from the HTTP process.\n-- One application database belongs to one explicitly provisioned project/tenant.\nCREATE TABLE public.starter_application (\n  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),\n  project_id text NOT NULL CHECK (length(project_id) > 0),\n  tenant_id text NOT NULL CHECK (length(tenant_id) > 0)\n);\nCREATE TABLE public.starter_reviews (\n  id text PRIMARY KEY, owner_id text NOT NULL,\n  state text NOT NULL CHECK (state IN ('draft','approved')),\n  version integer NOT NULL CHECK (version > 0)\n);\nCREATE TABLE public.starter_members (\n  subject text PRIMARY KEY, enabled boolean NOT NULL DEFAULT true,\n  can_approve boolean NOT NULL DEFAULT false\n);\nALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;\n";
-export declare const STARTER_REVIEW_POSTGRES = "import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createTransactionalCommand, plaintextCommandInput } from \"@supacloud/commands\";\nimport { CommandError } from \"@supacloud/contracts\";\nimport { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from \"@supacloud/db\";\nimport {\n  ApplicationError, createSupAuthRequestContext, requireTrustedIdentity, requireIdempotencyKey,\n  type CommandInvocation, type SupAuthContextOptions,\n} from \"@supacloud/elysia\";\nimport type { AppAdapters } from \"../application\";\nimport type { ReviewStore } from \"../review/review\";\nimport type { ReviewUploadPort } from \"../review/uploads\";\n\ninterface Approval { id: string; expectedVersion: number }\ninterface Review { state: \"draft\" | \"approved\"; version: number }\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid review record\");\n  return value;\n}\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid database result\");\n  return value.map(record);\n}\nfunction isPublicConflict(value: unknown): boolean {\n  return value instanceof ApplicationError && value.status === 409\n    || isRecord(value) && value[\"expose\"] === true && value[\"status\"] === 409 && typeof value[\"code\"] === \"string\";\n}\nfunction input(value: unknown): Approval {\n  const item = record(value);\n  if (typeof item[\"id\"] !== \"string\" || !item[\"id\"].length || typeof item[\"expectedVersion\"] !== \"number\"\n    || !Number.isSafeInteger(item[\"expectedVersion\"]) || item[\"expectedVersion\"] < 1) throw new TypeError(\"Invalid approval input\");\n  return { id: item[\"id\"], expectedVersion: item[\"expectedVersion\"] };\n}\nfunction result(value: unknown): Review {\n  const item = record(value);\n  if ((item[\"state\"] !== \"draft\" && item[\"state\"] !== \"approved\") || typeof item[\"version\"] !== \"number\"\n    || !Number.isSafeInteger(item[\"version\"]) || item[\"version\"] < 1) throw new TypeError(\"Invalid review result\");\n  return { state: item[\"state\"], version: item[\"version\"] };\n}\n\nexport interface ReviewPostgresOptions {\n  database: CommandDatabase;\n  tenantId: string;\n  identity: Omit<SupAuthContextOptions, \"resolveAccess\">;\n  uploads?: ReviewUploadPort;\n  // Only database effects here: they commit/rollback with the approval and receipt.\n  afterApproved?(tx: CommandTransaction, id: string, version: number): Promise<void>;\n}\n\nexport async function createReviewPostgresAdapters(options: ReviewPostgresOptions): Promise<\n  AppAdapters & { requestContext: ReturnType<typeof createSupAuthRequestContext> }\n> {\n  const { database, tenantId, identity } = options;\n  const projectId = identity.projectId;\n  const afterApproved = options.afterApproved;\n  if (!tenantId.trim()) throw new TypeError(\"Review tenantId is required\");\n  const query = (text: string, parameters: readonly string[] = []) =>\n    database.transaction(tx => tx.query(text, parameters));\n  const binding = rows(await query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  ));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Review database project/tenant binding mismatch\");\n  }\n  const requestContext = createSupAuthRequestContext({\n    ...identity,\n    async resolveAccess(who) {\n      const found = rows(await query(\n        \"SELECT m.can_approve FROM public.starter_members m,public.starter_application a \" +\n        \"WHERE m.subject=$1 AND m.enabled AND a.singleton AND a.project_id=$2 AND a.tenant_id=$3\",\n        [who.subject, projectId, tenantId],\n      ));\n      return found.length === 1 ? { projectId, tenantId,\n        permissions: found[0]?.[\"can_approve\"] === true ? [\"review.approve\"] : [],\n      } : null;\n    },\n  });\n  const scope = new AsyncLocalStorage<CommandTransaction>();\n  const transaction = () => {\n    const tx = scope.getStore();\n    if (!tx) throw new Error(\"Review storage requires its durable command transaction\");\n    return tx;\n  };\n  const store: ReviewStore = {\n    ...options.uploads,\n    async get(table, id) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      return rows(await transaction().query(\n        \"SELECT state,version FROM public.starter_reviews WHERE id=$1 FOR UPDATE\", [id],\n      ))[0];\n    },\n    async set(table, id, value) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      const review = result(value);\n      const updated = rows(await transaction().query(\n        \"UPDATE public.starter_reviews SET state=$2,version=$3 WHERE id=$1 RETURNING id\",\n        [id, review.state, review.version],\n      ));\n      if (updated.length !== 1) throw new Error(\"Review write did not update one record\");\n      await afterApproved?.(transaction(), id, review.version);\n    },\n  };\n  function actor(invocation: CommandInvocation): string {\n    const who = requireTrustedIdentity(invocation.requestContext);\n    const access = record(record(invocation.requestContext)[\"access\"]);\n    if (access[\"projectId\"] !== projectId || access[\"tenantId\"] !== tenantId\n      || !Array.isArray(access[\"permissions\"]) || !access[\"permissions\"].includes(\"review.approve\")) {\n      throw new ApplicationError(\"Command permission denied\", { status: 403, code: \"REVIEW_PERMISSION_DENIED\" });\n    }\n    return who.subject;\n  }\n  const commandStore = createPostgresCommandStore(database);\n  return {\n    deps: { dbClient: store }, requestContext,\n    commandGovernance: {\n      authorize(invocation) {\n        const command = invocation.command;\n        if (command.name !== \"review.approve\" || command.permission !== \"review.approve\"\n          || command.transaction !== \"required\" || command.idempotency !== \"required\"\n          || command.audit !== \"review.approved\" || command.rpc !== undefined) {\n          throw new ApplicationError(\"Unsupported review command\", { status: 501, code: \"REVIEW_COMMAND_UNSUPPORTED\" });\n        }\n        actor(invocation);\n      },\n      async idempotency(invocation, next) {\n        const command = createTransactionalCommand({\n          name: invocation.command.name, store: commandStore,\n          inputCodec: plaintextCommandInput, input, result,\n          async authorize(who, request, tx) {\n            const found = rows(await tx.query(\n              \"SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id \" +\n              \"CROSS JOIN public.starter_application a \" +\n              \"WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve \" +\n              \"AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a\",\n              [request.id, who.actorId, projectId, who.tenantId],\n            ));\n            return found.length === 1 ? \"allow\" : \"deny\";\n          },\n          execute: tx => scope.run(tx, async () => {\n            try { return await next(); }\n            catch (error) {\n              if (isPublicConflict(error)) {\n                throw new CommandError(\"COMMAND_IDEMPOTENCY_CONFLICT\");\n              }\n              throw error;\n            }\n          }),\n          audit: { event: \"review.approved\", details: request => ({ reviewId: request.id }) },\n        });\n        try {\n          const receipt = await command.execute(\n            { actorId: actor(invocation), tenantId }, requireIdempotencyKey(invocation),\n            { id: invocation.input.params[\"id\"], expectedVersion: record(invocation.input.body)[\"expectedVersion\"] },\n            invocation.request.signal,\n          );\n          if (receipt.status !== \"confirmed\") throw new CommandError(\"COMMAND_OUTCOME_UNKNOWN\");\n          return receipt.result;\n        } catch (error) {\n          if (!(error instanceof CommandError)) throw error;\n          const status = error.code === \"COMMAND_REJECTED\" ? 403\n            : error.code === \"COMMAND_IDEMPOTENCY_CONFLICT\" ? 409 : 503;\n          throw new ApplicationError(error.code, { code: error.code, status });\n        }\n      },\n      transaction(_invocation, next) { transaction(); return next(); },\n      // The durable command owns the authoritative audit and receipt in the same transaction.\n      audit: { succeeded() { transaction(); }, failed() {} },\n    },\n  };\n}\n";
-export declare const STARTER_REVIEW_POSTGRES_TEST = "import { expect, test } from \"bun:test\";\nimport { createReviewPostgresAdapters } from \"../src/host/review-postgres\";\nimport type { ReviewStore } from \"../src/review/review\";\n\nconst identity = {\n  issuer: \"https://identity.example.test\", audience: \"review-test\", clientId: \"review-client\",\n  projectId: \"review-test\", jwksUrl: \"https://identity.example.test/jwks\",\n};\nfunction database(binding: unknown) {\n  const queries: string[] = [];\n  return {\n    queries,\n    async transaction<T>(run: (tx: { query(text: string): Promise<unknown> }) => Promise<T>): Promise<T> {\n      return run({ async query(text) { queries.push(text); return binding; } });\n    },\n  };\n}\n\ntest(\"PostgreSQL host rejects missing or mismatched application ownership without creating data\", async () => {\n  for (const binding of [[], [{ project_id: \"other\", tenant_id: \"review-test\" }],\n    [{ project_id: \"review-test\", tenant_id: \"other\" }]]) {\n    const db = database(binding);\n    await expect(createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" }))\n      .rejects.toThrow(\"binding mismatch\");\n    expect(db.queries).toEqual([\"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\"]);\n  }\n});\n\ntest(\"PostgreSQL host never falls back to demo identity or unbound business storage\", async () => {\n  const db = database([{ project_id: \"review-test\", tenant_id: \"review-test\" }]);\n  const adapters = await createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" });\n  await expect(adapters.requestContext(new Request(\"http://localhost/reviews/health\")))\n    .rejects.toMatchObject({ code: \"AUTHENTICATION_REQUIRED\" });\n  const store = adapters.deps[\"dbClient\"] as ReviewStore;\n  await expect(store.get(\"reviews\", \"example\")).rejects.toThrow(\"durable command transaction\");\n  await expect(store.set(\"reviews\", \"example\", { state: \"approved\", version: 2 }))\n    .rejects.toThrow(\"durable command transaction\");\n  expect(db.queries).toHaveLength(1);\n});\n";
+export declare const STARTER_REVIEW_POSTGRES = "import { plaintextCommandInput } from \"@supacloud/commands\";\nimport { CommandError } from \"@supacloud/contracts\";\nimport { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from \"@supacloud/db\";\nimport {\n  ApplicationError, createSchemaDecoder, createSupAuthRequestContext, requireTrustedIdentity,\n  createTransactionalCommandGovernance,\n  type CommandInvocation, type SupAuthContextOptions,\n} from \"@supacloud/elysia\";\nimport type { AppAdapters } from \"../application\";\nimport type { ReviewStore } from \"../review/review\";\nimport type { ReviewUploadPort } from \"../review/uploads\";\nimport { ApprovalInput, ReviewResult } from \"../review/contracts\";\n\nconst input = createSchemaDecoder(ApprovalInput, { normalize: false });\nconst result = createSchemaDecoder(ReviewResult, { normalize: false });\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid review record\");\n  return value;\n}\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid database result\");\n  return value.map(record);\n}\nfunction isPublicConflict(value: unknown): boolean {\n  return value instanceof ApplicationError && value.status === 409\n    || isRecord(value) && value[\"expose\"] === true && value[\"status\"] === 409 && typeof value[\"code\"] === \"string\";\n}\nexport interface ReviewPostgresOptions {\n  database: CommandDatabase;\n  tenantId: string;\n  identity: Omit<SupAuthContextOptions, \"resolveAccess\">;\n  uploads?: ReviewUploadPort;\n  // Only database effects here: they commit/rollback with the approval and receipt.\n  afterApproved?(tx: CommandTransaction, id: string, version: number): Promise<void>;\n}\n\nexport async function createReviewPostgresAdapters(options: ReviewPostgresOptions): Promise<\n  AppAdapters & { requestContext: ReturnType<typeof createSupAuthRequestContext> }\n> {\n  const { database, tenantId, identity } = options;\n  const projectId = identity.projectId;\n  const afterApproved = options.afterApproved;\n  if (!tenantId.trim()) throw new TypeError(\"Review tenantId is required\");\n  const query = (text: string, parameters: readonly string[] = []) =>\n    database.transaction(tx => tx.query(text, parameters));\n  const binding = rows(await query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  ));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Review database project/tenant binding mismatch\");\n  }\n  const requestContext = createSupAuthRequestContext({\n    ...identity,\n    async resolveAccess(who) {\n      const found = rows(await query(\n        \"SELECT m.can_approve FROM public.starter_members m,public.starter_application a \" +\n        \"WHERE m.subject=$1 AND m.enabled AND a.singleton AND a.project_id=$2 AND a.tenant_id=$3\",\n        [who.subject, projectId, tenantId],\n      ));\n      return found.length === 1 ? { projectId, tenantId,\n        permissions: found[0]?.[\"can_approve\"] === true ? [\"review.approve\"] : [],\n      } : null;\n    },\n  });\n  const transaction = () => commandBinding.transaction();\n  const store: ReviewStore = {\n    ...options.uploads,\n    async get(table, id) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      return rows(await transaction().query(\n        \"SELECT state,version FROM public.starter_reviews WHERE id=$1 FOR UPDATE\", [id],\n      ))[0];\n    },\n    async set(table, id, value) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      const review = result(value);\n      const updated = rows(await transaction().query(\n        \"UPDATE public.starter_reviews SET state=$2,version=$3 WHERE id=$1 RETURNING id\",\n        [id, review.state, review.version],\n      ));\n      if (updated.length !== 1) throw new Error(\"Review write did not update one record\");\n      await afterApproved?.(transaction(), id, review.version);\n    },\n  };\n  function actor(invocation: CommandInvocation): string {\n    const who = requireTrustedIdentity(invocation.requestContext);\n    const access = record(record(invocation.requestContext)[\"access\"]);\n    if (access[\"projectId\"] !== projectId || access[\"tenantId\"] !== tenantId\n      || !Array.isArray(access[\"permissions\"]) || !access[\"permissions\"].includes(\"review.approve\")) {\n      throw new ApplicationError(\"Command permission denied\", { status: 403, code: \"REVIEW_PERMISSION_DENIED\" });\n    }\n    return who.subject;\n  }\n  const commandBinding = createTransactionalCommandGovernance({\n    permission: \"review.approve\",\n    identity: invocation => ({ actorId: actor(invocation), tenantId }),\n    input: invocation => ({\n      ...record(invocation.input.body), id: invocation.input.params[\"id\"],\n    }),\n    rejection: error => isPublicConflict(error) ? new CommandError(\"COMMAND_IDEMPOTENCY_CONFLICT\") : undefined,\n    definition: {\n      name: \"review.approve\", store: createPostgresCommandStore(database),\n      inputCodec: plaintextCommandInput, input, result,\n      async authorize(who, request, tx) {\n        const found = rows(await tx.query(\n          \"SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id \" +\n          \"CROSS JOIN public.starter_application a \" +\n          \"WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve \" +\n          \"AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a\",\n          [request.id, who.actorId, projectId, who.tenantId],\n        ));\n        return found.length === 1 ? \"allow\" : \"deny\";\n      },\n      audit: { event: \"review.approved\", details: request => ({ reviewId: request.id }) },\n    },\n  });\n  return { deps: { dbClient: store }, requestContext, commandGovernance: commandBinding.governance };\n}\n";
+export declare const STARTER_REVIEW_POSTGRES_TEST = "import { expect, test } from \"bun:test\";\nimport { createReviewPostgresAdapters } from \"../src/host/review-postgres\";\nimport type { ReviewStore } from \"../src/review/review\";\n\nconst identity = {\n  issuer: \"https://identity.example.test\", audience: \"review-test\", clientId: \"review-client\",\n  projectId: \"review-test\", jwksUrl: \"https://identity.example.test/jwks\",\n};\nfunction database(binding: unknown) {\n  const queries: string[] = [];\n  return {\n    queries,\n    async transaction<T>(run: (tx: { query(text: string): Promise<unknown> }) => Promise<T>): Promise<T> {\n      return run({ async query(text) { queries.push(text); return binding; } });\n    },\n  };\n}\n\ntest(\"PostgreSQL host rejects missing or mismatched application ownership without creating data\", async () => {\n  for (const binding of [[], [{ project_id: \"other\", tenant_id: \"review-test\" }],\n    [{ project_id: \"review-test\", tenant_id: \"other\" }]]) {\n    const db = database(binding);\n    await expect(createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" }))\n      .rejects.toThrow(\"binding mismatch\");\n    expect(db.queries).toEqual([\"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\"]);\n  }\n});\n\ntest(\"PostgreSQL host never falls back to demo identity or unbound business storage\", async () => {\n  const db = database([{ project_id: \"review-test\", tenant_id: \"review-test\" }]);\n  const adapters = await createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" });\n  await expect(adapters.requestContext(new Request(\"http://localhost/reviews/health\")))\n    .rejects.toMatchObject({ code: \"AUTHENTICATION_REQUIRED\" });\n  const store = adapters.deps[\"dbClient\"] as ReviewStore;\n  await expect(store.get(\"reviews\", \"example\")).rejects.toThrow(\"not active\");\n  await expect(store.set(\"reviews\", \"example\", { state: \"approved\", version: 2 }))\n    .rejects.toThrow(\"not active\");\n  expect(db.queries).toHaveLength(1);\n});\n";
 export declare const STARTER_REVIEW_DELIVERY_HOST = "import { SQL } from \"bun\";\nimport { createClient } from \"@supabase/supabase-js\";\nimport { createBunCommandDatabase } from \"@supacloud/db/bun\";\nimport { createApplication, type CompiledModule } from \"@supacloud/elysia\";\nimport { createReviewPostgresAdapters } from \"./host/review-postgres\";\nimport { createReviewAttachmentAdapters } from \"./host/review-attachments\";\nimport { createReviewUploadAdapters } from \"./host/review-uploads\";\n\nfunction required(name: string): string {\n  const value = process.env[name];\n  if (!value?.trim()) throw new Error(\"Missing required host setting: \" + name);\n  return value;\n}\n\nfunction databaseConnection(): SQL.Options {\n  const socket = process.env[\"DATABASE_SOCKET_PATH\"];\n  if (socket && process.env[\"DATABASE_URL\"]) throw new Error(\"Conflicting database connection settings\");\n  if (socket) {\n    return { adapter: \"postgres\", path: socket, database: required(\"DATABASE_NAME\"), username: required(\"DATABASE_USER\") };\n  }\n  const url = new URL(required(\"DATABASE_URL\"));\n  if (url.protocol !== \"postgres:\" && url.protocol !== \"postgresql:\") throw new Error(\"Invalid database URL\");\n  return {\n    adapter: \"postgres\", url: url.href, hostname: url.hostname.replace(/^\\[|\\]$/g, \"\"), port: Number(url.port || 5432),\n    username: decodeURIComponent(url.username), password: decodeURIComponent(url.password),\n    database: decodeURIComponent(url.pathname.slice(1)),\n  };\n}\n\nexport async function createDeliveryApplication(modules: CompiledModule[], lifecycle: { signal: AbortSignal }) {\n  lifecycle.signal.throwIfAborted();\n  const connection = databaseConnection();\n  const attachments = process.env[\"REVIEW_ATTACHMENTS\"];\n  if (attachments !== undefined && attachments !== \"enabled\") throw new Error(\"Invalid attachment configuration\");\n  const settings = {\n    tenantId: required(\"APP_TENANT_ID\"),\n    identity: {\n      issuer: required(\"SUPAUTH_ISSUER\"), audience: required(\"SUPAUTH_AUDIENCE\"),\n      clientId: required(\"SUPAUTH_CLIENT_ID\"), projectId: required(\"SUPACLOUD_PROJECT_ID\"),\n      jwksUrl: required(\"SUPAUTH_JWKS_URL\"),\n    },\n  };\n  const pool = new SQL({ ...connection, max: 12, connectionTimeout: 5 });\n  let closing: Promise<void> | undefined;\n  const close = () => closing ??= pool.close({ timeout: 5 });\n  let stage: \"attachments\" | \"uploads\" | \"postgres\" | \"application\" = \"attachments\";\n  try {\n    const database = createBunCommandDatabase(pool);\n    const attachmentOptions = attachments === \"enabled\" ? {\n      database, tenantId: settings.tenantId, projectId: settings.identity.projectId,\n      service: createClient(required(\"SUPACLOUD_URL\"), required(\"SUPACLOUD_SERVICE_ROLE_KEY\"), {\n        auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },\n      }),\n    } : undefined;\n    const durable = attachmentOptions ? await createReviewAttachmentAdapters(attachmentOptions) : undefined;\n    stage = \"uploads\";\n    const uploads = attachmentOptions ? await createReviewUploadAdapters(attachmentOptions) : undefined;\n    stage = \"postgres\";\n    const adapters = await createReviewPostgresAdapters({\n      database, tenantId: settings.tenantId, identity: settings.identity,\n      ...(uploads ? { uploads } : {}),\n      ...(durable ? { afterApproved: durable.enqueue } : {}),\n    });\n    lifecycle.signal.throwIfAborted();\n    stage = \"application\";\n    const app = createApplication({ name: \"review\", modules, ...adapters });\n    return { fetch: (request: Request) => app.handle(request), close };\n  } catch (error) {\n    await close();\n    const code = error !== null && typeof error === \"object\" && \"code\" in error\n      && typeof error.code === \"string\" && /^[A-Z0-9_]{1,64}$/.test(error.code) ? error.code : \"UNKNOWN\";\n    console.error(JSON.stringify({ event: \"review-host-initialization-failed\", stage, code }));\n    // Database/identity errors can contain connection details; never echo the underlying cause.\n    throw new Error(\"Review host initialization failed\");\n  }\n}\n";

package/dist/shared/tools/app-starter-query.d.ts

@@ -0,0 +1 @@
+export declare const STARTER_REVIEW_QUERY = "import type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { ReviewRow } from \"../../db/schema\";\n\n// This read projection uses SQL column names shared with the Drizzle source.\n// Do not expose camelCase Drizzle property names as PostgREST column names.\nexport type ReviewSummary = Pick<ReviewRow, \"id\" | \"state\" | \"version\">;\nexport type ReviewReadDatabase = {\n  public: {\n    Tables: {\n      starter_reviews: {\n        Row: ReviewSummary;\n        Insert: never;\n        Update: never;\n        Relationships: [];\n      };\n    };\n    Views: Record<never, never>;\n    Functions: Record<never, never>;\n  };\n};\n\nexport interface ReviewPageOptions {\n  page?: number;\n  pageSize?: number;\n  signal?: AbortSignal;\n}\n\n// Reuse the application's user-scoped client. Identity verification and row\n// authorization belong to the gateway and database, never a caller-supplied owner.\nexport async function listReviews(\n  client: SupabaseClient<ReviewReadDatabase>,\n  { page = 1, pageSize = 25, signal }: ReviewPageOptions = {},\n) {\n  if (!Number.isSafeInteger(page) || page < 1\n    || !Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 100\n    || !Number.isSafeInteger(page * pageSize)) {\n    throw new RangeError(\"Invalid review page: page >= 1 and pageSize between 1 and 100 are required\");\n  }\n  signal?.throwIfAborted();\n  const start = (page - 1) * pageSize;\n  const query = client.from(\"starter_reviews\")\n    .select(\"id,state,version\", { count: \"exact\" })\n    .order(\"id\", { ascending: true })\n    .range(start, start + pageSize - 1);\n  const { data, error, count } = await (signal ? query.abortSignal(signal) : query);\n  if (error) throw error;\n  if (data === null || count === null) throw new Error(\"Incomplete review page response\");\n  return { data, total: count, page, pageSize, hasNextPage: start + data.length < count };\n}\n";

package/dist/shared/tools/app-starter-review-job.d.ts

@@ -1,2 +1,2 @@
-export declare const STARTER_REVIEW_JOB = "import { DB_CLIENT, Inject, Injectable, Job } from \"@supacloud/app\";\nimport { ApplicationError } from \"@supacloud/elysia\";\nimport { t } from \"elysia\";\nimport type { Static } from \"elysia/type\";\n\nexport const AttachmentInput = t.Object({\n  reviewId: t.String({ minLength: 1, maxLength: 100 }),\n  version: t.Integer({ minimum: 2 }),\n  artifactId: t.String({ format: \"uuid\" }),\n}, { additionalProperties: false });\n\nexport const AttachmentResult = t.Object({\n  ...AttachmentInput.properties,\n  sha256: t.String({ pattern: \"^[a-f0-9]{64}$\" }),\n  bytes: t.Integer({ minimum: 1, maximum: 1048576 }),\n}, { additionalProperties: false });\n\nexport type ReviewAttachmentInput = Static<typeof AttachmentInput>;\nexport type ReviewAttachmentResult = Static<typeof AttachmentResult>;\n\nexport interface ReviewAttachmentStore {\n  // Resolve the immutable artifact under the worker's own authorization and current review revision.\n  readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;\n  // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.\n  recordAttachment(input: ReviewAttachmentInput, result: ReviewAttachmentResult): Promise<ReviewAttachmentResult>;\n}\n\n@Injectable({ scope: \"job\" })\n@Job({\n  name: \"review.verify-attachment\", mode: \"task\", idempotency: \"required\",\n  timeoutSec: 30, maxAttempts: 3, input: AttachmentInput, output: AttachmentResult,\n})\nexport class VerifyReviewAttachment {\n  constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}\n\n  async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {\n    const source = await this.store.readAttachment(input);\n    if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {\n      throw new ApplicationError(\"Attachment size is outside the supported range\", { code: \"ATTACHMENT_SIZE_INVALID\" });\n    }\n    const digest = await crypto.subtle.digest(\"SHA-256\", new Uint8Array(source.body));\n    const sha256 = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n    if (sha256 !== source.sha256) {\n      throw new ApplicationError(\"Attachment integrity check failed\", { code: \"ATTACHMENT_INTEGRITY_FAILED\" });\n    }\n    return this.store.recordAttachment(input, { ...input, sha256, bytes: source.body.byteLength });\n  }\n}\n";
-export declare const STARTER_REVIEW_JOB_TEST = "import { expect, test } from \"bun:test\";\nimport { VerifyReviewAttachment, type ReviewAttachmentResult } from \"../src/review/attachment\";\n\nconst input = { reviewId: \"review\", version: 2, artifactId: \"11111111-1111-4111-8111-111111111111\" };\nconst body = new TextEncoder().encode(\"review attachment\");\nconst sha256 = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", body)),\n  byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\ntest(\"attachment job awaits the authorized reader and the committed result\", async () => {\n  let recorded: ReviewAttachmentResult | undefined;\n  const job = new VerifyReviewAttachment({\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },\n  });\n  expect(await job.run(input)).toEqual({ ...input, sha256, bytes: body.byteLength });\n  expect(recorded).toEqual({ ...input, sha256, bytes: body.byteLength });\n});\n\ntest(\"missing authorization, corrupted bytes and persistence failures are not successful jobs\", async () => {\n  let records = 0;\n  for (const readAttachment of [\n    async () => { throw new Error(\"Access denied\"); },\n    async () => ({ body, sha256: \"0\".repeat(64) }),\n    async () => ({ body: new Uint8Array(), sha256 }),\n    async () => ({ body: new Uint8Array(1048577), sha256 }),\n  ]) {\n    const job = new VerifyReviewAttachment({\n      readAttachment, async recordAttachment(_input, result) { records++; return result; },\n    });\n    await expect(job.run(input)).rejects.toThrow();\n  }\n  expect(records).toBe(0);\n  await expect(new VerifyReviewAttachment({\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment() { throw new Error(\"Commit failed\"); },\n  }).run(input)).rejects.toThrow(\"Commit failed\");\n});\n";
+export declare const STARTER_REVIEW_JOB = "import { DB_CLIENT, Inject, Injectable, Job } from \"@supacloud/app\";\nimport { ApplicationError } from \"@supacloud/elysia\";\nimport { t } from \"elysia\";\nimport type { Static } from \"elysia/type\";\n\nexport const AttachmentInput = t.Object({\n  reviewId: t.String({ minLength: 1, maxLength: 100 }),\n  version: t.Integer({ minimum: 2 }),\n  artifactId: t.String({ format: \"uuid\" }),\n}, { additionalProperties: false });\n\nexport const AttachmentResult = t.Object({\n  ...AttachmentInput.properties,\n  sha256: t.String({ pattern: \"^[a-f0-9]{64}$\" }),\n  bytes: t.Integer({ minimum: 1, maximum: 1048576 }),\n}, { additionalProperties: false });\n\nexport type ReviewAttachmentInput = Static<typeof AttachmentInput>;\nexport type ReviewAttachmentResult = Static<typeof AttachmentResult>;\n\nexport interface ReviewAttachmentStore {\n  // Reauthorize before returning a committed result; null means execution is still needed.\n  readResult(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult | null>;\n  // Resolve the immutable artifact under the worker's own authorization and current review revision.\n  readAttachment(input: ReviewAttachmentInput): Promise<{ body: Uint8Array; sha256: string }>;\n  // Revalidate revision/ownership and persist idempotently in a transaction; return the durable result.\n  recordAttachment(input: ReviewAttachmentInput, result: ReviewAttachmentResult): Promise<ReviewAttachmentResult>;\n}\n\n@Injectable({ scope: \"job\" })\n@Job({\n  name: \"review.verify-attachment\", mode: \"task\", idempotency: \"required\",\n  timeoutSec: 30, maxAttempts: 3, input: AttachmentInput, output: AttachmentResult,\n})\nexport class VerifyReviewAttachment {\n  constructor(@Inject(DB_CLIENT) private readonly store: ReviewAttachmentStore) {}\n\n  async run(input: ReviewAttachmentInput): Promise<ReviewAttachmentResult> {\n    const committed = await this.store.readResult(input);\n    if (committed !== null) return committed;\n    const source = await this.store.readAttachment(input);\n    if (source.body.byteLength < 1 || source.body.byteLength > 1048576) {\n      throw new ApplicationError(\"Attachment size is outside the supported range\", { code: \"ATTACHMENT_SIZE_INVALID\" });\n    }\n    const digest = await crypto.subtle.digest(\"SHA-256\", new Uint8Array(source.body));\n    const sha256 = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n    if (sha256 !== source.sha256) {\n      throw new ApplicationError(\"Attachment integrity check failed\", { code: \"ATTACHMENT_INTEGRITY_FAILED\" });\n    }\n    return this.store.recordAttachment(input, { ...input, sha256, bytes: source.body.byteLength });\n  }\n}\n";
+export declare const STARTER_REVIEW_JOB_TEST = "import { expect, test } from \"bun:test\";\nimport { VerifyReviewAttachment, type ReviewAttachmentResult } from \"../src/review/attachment\";\n\nconst input = { reviewId: \"review\", version: 2, artifactId: \"11111111-1111-4111-8111-111111111111\" };\nconst body = new TextEncoder().encode(\"review attachment\");\nconst sha256 = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", body)),\n  byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\ntest(\"attachment job awaits the authorized reader and the committed result\", async () => {\n  let recorded: ReviewAttachmentResult | undefined;\n  const job = new VerifyReviewAttachment({\n    async readResult() { return null; },\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment(_input, result) { await Promise.resolve(); recorded = result; return result; },\n  });\n  expect(await job.run(input)).toEqual({ ...input, sha256, bytes: body.byteLength });\n  expect(recorded).toEqual({ ...input, sha256, bytes: body.byteLength });\n});\n\ntest(\"missing authorization, corrupted bytes and persistence failures are not successful jobs\", async () => {\n  let records = 0;\n  for (const readAttachment of [\n    async () => { throw new Error(\"Access denied\"); },\n    async () => ({ body, sha256: \"0\".repeat(64) }),\n    async () => ({ body: new Uint8Array(), sha256 }),\n    async () => ({ body: new Uint8Array(1048577), sha256 }),\n  ]) {\n    const job = new VerifyReviewAttachment({\n      async readResult() { return null; },\n      readAttachment, async recordAttachment(_input, result) { records++; return result; },\n    });\n    await expect(job.run(input)).rejects.toThrow();\n  }\n  expect(records).toBe(0);\n  await expect(new VerifyReviewAttachment({\n    async readResult() { return null; },\n    async readAttachment() { return { body, sha256 }; },\n    async recordAttachment() { throw new Error(\"Commit failed\"); },\n  }).run(input)).rejects.toThrow(\"Commit failed\");\n});\n\ntest(\"a reauthorized committed result avoids another download or write\", async () => {\n  const result = { ...input, sha256, bytes: body.byteLength };\n  const job = new VerifyReviewAttachment({\n    async readResult() { return result; },\n    async readAttachment() { throw new Error(\"Must not download again\"); },\n    async recordAttachment() { throw new Error(\"Must not write again\"); },\n  });\n  expect(await job.run(input)).toEqual(result);\n  await expect(new VerifyReviewAttachment({\n    async readResult() { throw new Error(\"Access revoked\"); },\n    async readAttachment() { throw new Error(\"Must not download\"); },\n    async recordAttachment() { throw new Error(\"Must not write\"); },\n  }).run(input)).rejects.toThrow(\"Access revoked\");\n});\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.99.0",
+  "version": "0.101.2",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,21 +52,21 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.46.1",
-    "@supacloud/delivery": "0.18.0",
-    "@supacloud/db": "0.17.0",
-    "typebox": "1.3.36"
+    "@supacloud/compiler": "^0.46.4",
+    "@supacloud/delivery": "0.18.1",
+    "@supacloud/db": "0.17.1",
+    "typebox": "1.3.37"
   },
   "overrides": {
-    "@supacloud/contracts": "0.9.0",
-    "@supacloud/delivery": "0.18.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/contracts": "0.10.0",
+    "@supacloud/delivery": "0.18.1",
+    "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
-    "@supacloud/elysia": "^0.24.1",
+    "@supacloud/elysia": "0.31.1",
     "@types/bun": "^1.4.3",
-    "effect": "4.0.2",
-    "elysia": "2.0.0-beta.21",
+    "effect": "4.0.5",
+    "elysia": "2.0.0-beta.32",
     "typescript": "^7.0.2"
   }
 }