@specverse/engines 6.6.3 → 6.7.8

package/dist/libs/instance-factories/applications/templates/generic/backend-package-json-generator.js

@@ -1,6 +1,27 @@
+function resolveOrmName(manifest) {
+  if (!manifest) return "PrismaORM";
+  const inner = manifest.manifests ? Object.values(manifest.manifests)[0] : manifest;
+  if (!inner) return "PrismaORM";
+  const caps = Array.isArray(inner.capabilityMappings) ? inner.capabilityMappings : [];
+  const ormCap = caps.find((m) => m?.capability === "orm.client") || caps.find((m) => m?.capability === "orm.schema");
+  if (ormCap) return ormCap.implementation || ormCap.instanceFactory || "PrismaORM";
+  return inner.defaultMappings?.orm || "PrismaORM";
+}
 function generateBackendPackageJson(context) {
-  const { spec } = context;
+  const { spec, manifest } = context;
   const appName = (spec.metadata?.component || "app").toLowerCase().replace(/\s+/g, "-");
+  const orm = resolveOrmName(manifest);
+  const isMongoNative = orm === "MongoDBNativeDriver";
+  const dbScripts = isMongoNative ? {} : {
+    "db:setup": "prisma generate && prisma db push",
+    "db:generate": "prisma generate",
+    "db:push": "prisma db push",
+    "db:migrate": "prisma migrate dev",
+    "db:studio": "prisma studio",
+    "db:seed": "tsx prisma/seed.ts"
+  };
+  const ormDeps = isMongoNative ? { "mongodb": "^6.3.0" } : { "@prisma/client": "^5.7.0" };
+  const ormDevDeps = isMongoNative ? {} : { "prisma": "^5.7.0" };
   const pkg = {
     name: `${appName}-backend`,
     version: spec.metadata?.version || "1.0.0",
@@ -18,13 +39,8 @@ function generateBackendPackageJson(context) {
       "build:watch": "tsc --watch",
       // Production
       "start": "node dist/main.js",
-      // Database
-      "db:setup": "prisma generate && prisma db push",
-      "db:generate": "prisma generate",
-      "db:push": "prisma db push",
-      "db:migrate": "prisma migrate dev",
-      "db:studio": "prisma studio",
-      "db:seed": "tsx prisma/seed.ts",
+      // Database (ORM-specific; empty for native driver)
+      ...dbScripts,
       // Testing
       "test": "vitest run --passWithNoTests",
       "test:watch": "vitest watch",
@@ -36,7 +52,7 @@ function generateBackendPackageJson(context) {
       "typecheck": "tsc --noEmit"
     },
     dependencies: {
-      "@prisma/client": "^5.7.0",
+      ...ormDeps,
       "fastify": "^5.8.3",
       "@fastify/cors": "^10.0.0",
       "@fastify/helmet": "^12.0.0",
@@ -51,7 +67,7 @@ function generateBackendPackageJson(context) {
       "typescript": "^5.3.0",
       "@types/node": "^20.10.0",
       "tsx": "^4.7.0",
-      "prisma": "^5.7.0",
+      ...ormDevDeps,
       "vitest": "^3.0.0",
       "@vitest/coverage-v8": "^3.0.0",
       "eslint": "^9.0.0",

package/dist/libs/instance-factories/controllers/templates/fastify/server-generator.js

@@ -39,7 +39,7 @@ function generateFastifyServer(context) {
 // workspace before running the script.
 import { config as loadEnv } from 'dotenv';
 import { existsSync } from 'fs';
-import { resolve as resolvePath, dirname, join } from 'path';
+import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 {
   let dir = dirname(fileURLToPath(import.meta.url));

package/dist/libs/instance-factories/services/templates/mongodb-native/controller-generator.js

@@ -8,7 +8,7 @@ function generateMongoNativeController(context) {
   const modelVar = lowerFirst(modelName);
   const collection = collectionName(model);
   const curedOps = controller.cured || {};
-  const customActions = generateCustomActions(controller, modelName);
+  const customActions = generateCustomActions(controller);
   const validate = generateValidateMethod(model, modelName);
   const create = curedOps.create ? generateCreateMethod(model, modelName, modelVar, collection) : "";
   const retrieve = curedOps.retrieve ? generateRetrieveMethod(modelName, modelVar, collection) : "";
@@ -24,7 +24,6 @@ function generateMongoNativeController(context) {
 import { ObjectId, type Filter, type Document } from 'mongodb';
 import { getCollection } from '../db/mongoClient.js';
 ${hasEventPublishing ? `import { eventBus } from '../events/eventBus.js';` : ""}
-${customActions.needsAiBehaviors ? `import * as aiBehaviors from '../behaviors/${modelName}Controller.ai.js';` : ""}
 
 const COLLECTION_NAME = '${collection}';
 
@@ -107,7 +106,7 @@ function generateCreateMethod(model, modelName, modelVar, collection) {
     const validation = this.validate(data, { operation: 'create' });
     if (!validation.valid) throw new Error(\`Validation failed: \${validation.errors.join(', ')}\`);
 
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const result = await collection.insertOne({ ...data });
     const ${modelVar} = { _id: result.insertedId, ...data };
 
@@ -122,7 +121,7 @@ function generateRetrieveMethod(modelName, modelVar, collection) {
    * Retrieve ${modelName} by id. Returns null when not found.
    */
   public async retrieve(id: string): Promise<any | null> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     return await collection.findOne(byId(id));
   }
 
@@ -130,7 +129,7 @@ function generateRetrieveMethod(modelName, modelVar, collection) {
    * Retrieve a page of ${modelName}s.
    */
   public async retrieveAll(options: { skip?: number; take?: number } = {}): Promise<any[]> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const cursor = collection.find({});
     if (options.skip) cursor.skip(options.skip);
     if (options.take) cursor.limit(options.take);
@@ -156,7 +155,7 @@ function generateUpdateMethod(modelName, modelVar, collection) {
       updateData[key] = value;
     }
 
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     await collection.updateOne(byId(id), { $set: updateData });
     const ${modelVar} = await collection.findOne(byId(id));
     if (!${modelVar}) throw new Error('${modelName} not found after update');
@@ -181,7 +180,7 @@ function generateEvolveMethod(model, modelName, modelVar, collection) {
    * States: ${states.join(" \u2192 ") || "(none declared)"}
    */
   public async evolve(id: string, data: any): Promise<any> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const current = await collection.findOne(byId(id));
     if (!current) throw new Error('${modelName} not found');
 
@@ -213,7 +212,7 @@ function generateDeleteMethod(modelName, modelVar, collection) {
    * Delete ${modelName}.
    */
   public async delete(id: string): Promise<void> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const ${modelVar} = await collection.findOne(byId(id));
     await collection.deleteOne(byId(id));
     if (${modelVar}) {
@@ -222,13 +221,12 @@ function generateDeleteMethod(modelName, modelVar, collection) {
   }
 `;
 }
-function generateCustomActions(controller, modelName) {
+function generateCustomActions(controller) {
   if (!controller.actions || Object.keys(controller.actions).length === 0) {
-    return { code: "", needsAiBehaviors: false };
+    return { code: "" };
   }
   const out = [];
   for (const [actionName, action] of Object.entries(controller.actions)) {
-    const params = generateActionParams(action);
     const stepsHeader = action.steps && action.steps.length > 0 ? action.steps.map((s) => `   *   - ${typeof s === "string" ? s : s.action || JSON.stringify(s)}`).join("\n") : "   *   (no spec steps declared)";
     out.push(`
   /**
@@ -238,21 +236,16 @@ function generateCustomActions(controller, modelName) {
    * Spec steps:
 ${stepsHeader}
    */
-  public async ${actionName}(${params}): Promise<any> {
-    return await aiBehaviors.${actionName}({ controller: this, ...args });
+  public async ${actionName}(_args: any = {}): Promise<any> {
+    // TODO (#43F): translate spec steps into native MongoDB driver calls
+    // via a mongodb-native step-conventions library (mirror of the prisma
+    // one). For now this is a stub so realize completes and the action
+    // surface is callable for parity tests.
+    throw new Error('${controller.name}.${actionName} is not implemented');
   }
 `);
   }
-  return { code: out.join("\n"), needsAiBehaviors: true };
-}
-function generateActionParams(action) {
-  if (Array.isArray(action.parameters) && action.parameters.length > 0) {
-    return "args: any";
-  }
-  if (action.parameters && typeof action.parameters === "object" && Object.keys(action.parameters).length > 0) {
-    return "args: any";
-  }
-  return "args: any = {}";
+  return { code: out.join("\n") };
 }
 export {
   generateMongoNativeController as default

package/dist/libs/instance-factories/services/templates/prisma/ai-behaviors-generator.js

@@ -16,7 +16,66 @@ async function validateTypeScript(code) {
     return msg;
   }
 }
-const PROMPT_VERSION = "9.1.0";
+async function validateTypeScriptTypes(code) {
+  let ts;
+  try {
+    ts = await import("typescript");
+    if (ts.default) ts = ts.default;
+  } catch {
+    return null;
+  }
+  try {
+    const fileName = "aiBehavior.ts";
+    const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.ES2022, true);
+    const compilerOptions = {
+      target: ts.ScriptTarget.ES2022,
+      module: ts.ModuleKind.ESNext,
+      moduleResolution: ts.ModuleResolutionKind.NodeNext,
+      strict: true,
+      noImplicitAny: false,
+      // body uses `any` extensively for inputs
+      noUnusedLocals: true,
+      noUnusedParameters: true,
+      noImplicitReturns: true,
+      noUncheckedIndexedAccess: true,
+      noFallthroughCasesInSwitch: true,
+      noEmit: true,
+      skipLibCheck: true,
+      types: [],
+      // Without `lib`, tsc can't resolve Promise / Array / RegExp etc., and
+      // every body fails the basic-types check before it even gets to the
+      // strict-null-check rules we actually want to validate.
+      lib: ["lib.es2022.d.ts"]
+    };
+    const defaultHost = ts.createCompilerHost(compilerOptions);
+    const host = {
+      ...defaultHost,
+      getSourceFile: (n, target) => {
+        if (n === fileName) return sourceFile;
+        return defaultHost.getSourceFile(n, target);
+      },
+      writeFile: () => {
+      },
+      fileExists: (n) => n === fileName || defaultHost.fileExists(n),
+      readFile: (n) => n === fileName ? code : defaultHost.readFile(n)
+    };
+    const program = ts.createProgram([fileName], compilerOptions, host);
+    const diagnostics = [
+      ...program.getSyntacticDiagnostics(sourceFile),
+      ...program.getSemanticDiagnostics(sourceFile)
+    ];
+    if (diagnostics.length === 0) return null;
+    const formatted = diagnostics.slice(0, 5).map((d) => {
+      const msg = ts.flattenDiagnosticMessageText(d.messageText, "\n");
+      const pos = d.file && d.start !== void 0 ? d.file.getLineAndCharacterOfPosition(d.start) : null;
+      return pos ? `line ${pos.line + 1}, col ${pos.character + 1}: ${msg}` : msg;
+    });
+    return formatted.join("; ");
+  } catch {
+    return null;
+  }
+}
+const PROMPT_VERSION = "9.2.0";
 function cacheKey(step, modelName, operationName, functionName, inputs) {
   const payload = JSON.stringify({ step, modelName, operationName, functionName, inputs: [...inputs].sort(), v: PROMPT_VERSION });
   return createHash("sha256").update(payload).digest("hex").slice(0, 16);
@@ -124,8 +183,33 @@ async function generateAiBehaviorsFile(opts) {
   let cacheHits = 0;
   let cacheMisses = 0;
   for (const { functionName, step, operationName, parameterNames, inputs, returns, modelName } of unmatchedFunctions) {
-    const signature = inputs.length > 0 ? `input: { ${inputs.map((n) => `${n}: any`).join("; ")} }` : "input: Record<string, never>";
-    const destructure = inputs.length > 0 ? `  const { ${inputs.join(", ")} } = input;` : "";
+    const stripLiteralsAndComments = (src) => {
+      return src.replace(/\/\*[\s\S]*?\*\//g, (m) => " ".repeat(m.length)).replace(/\/\/[^\n]*/g, (m) => " ".repeat(m.length)).replace(/(['"])(?:\\.|(?!\1).)*\1/g, (m) => m[0] + " ".repeat(m.length - 2) + m[0]).replace(/`(?:\\.|\$\{[^}]*\}|(?!`).)*`/g, (m) => "`" + " ".repeat(m.length - 2) + "`");
+    };
+    const bodyHandlesInputItself = (body2) => {
+      const codeOnly = stripLiteralsAndComments(body2);
+      if (/(?:const|let|var)\s*\{[^}]+\}\s*=\s*input\b/.test(codeOnly)) return true;
+      if (/(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*input\.[A-Za-z_$][\w$]*/.test(codeOnly)) return true;
+      return false;
+    };
+    const isRealReference = (n, codeOnly) => {
+      const escaped = n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const re = new RegExp(`(?<![A-Za-z0-9_$])${escaped}(?![A-Za-z0-9_$:])`, "g");
+      return re.test(codeOnly);
+    };
+    const buildSignatureAndDestructure = (body2) => {
+      if (inputs.length === 0) {
+        return { signature: "input: Record<string, never>", destructure: "" };
+      }
+      const codeOnly = stripLiteralsAndComments(body2);
+      const referenced = inputs.filter((n) => isRealReference(n, codeOnly));
+      const usesInputObject = /(?<![A-Za-z0-9_$])input(?![A-Za-z0-9_$])/.test(codeOnly);
+      const sigName = referenced.length > 0 || usesInputObject ? "input" : "_input";
+      const sig = `${sigName}: { ${inputs.map((n) => `${n}: any`).join("; ")} }`;
+      const bodyAccessesInputProps = /(?<![A-Za-z0-9_$])input\.[A-Za-z_$]/.test(codeOnly);
+      const destructure = referenced.length > 0 && !bodyHandlesInputItself(body2) && !bodyAccessesInputProps ? `  const { ${referenced.join(", ")} } = input;` : "";
+      return { signature: sig, destructure };
+    };
     let returnType = "any";
     if (typeof returns === "string") {
       returnType = returns;
@@ -140,9 +224,10 @@ async function generateAiBehaviorsFile(opts) {
       const testCode = `export async function ${functionName}(input: any): Promise<any> {
 ${body}
 }`;
-      const validationError = await validateTypeScript(testCode);
-      if (validationError) {
-        console.warn(`      [ai-validate] cached ${functionName} failed validation: ${validationError}`);
+      const syntaxError = await validateTypeScript(testCode);
+      const typeError = syntaxError ? null : await validateTypeScriptTypes(testCode);
+      if (syntaxError || typeError) {
+        console.warn(`      [ai-validate] cached ${functionName} failed validation: ${syntaxError || typeError}`);
         body = null;
         source = "STUB";
       } else {
@@ -168,16 +253,65 @@ ${body}
           const testCode = `export async function ${functionName}(input: any): Promise<any> {
 ${body}
 }`;
-          const validationError = await validateTypeScript(testCode);
-          if (validationError) {
-            console.warn(`      [ai-validate] ${functionName} has syntax error: ${validationError}`);
-            body = `// AI-generated code failed validation: ${validationError}
+          const syntaxError = await validateTypeScript(testCode);
+          if (syntaxError) {
+            console.warn(`      [ai-validate] ${functionName} has syntax error: ${syntaxError}`);
+            body = `// AI-generated code failed validation: ${syntaxError}
   // Step: ${step}
   throw new Error('AI behavior has invalid syntax \u2014 see comment above');`;
             source = "AI-INVALID";
           } else {
-            source = "AI-GENERATED";
-            cacheWrite(key, body);
+            const typeError = await validateTypeScriptTypes(testCode);
+            if (typeError) {
+              console.warn(`      [ai-validate] ${functionName} type errors: ${typeError}`);
+              try {
+                const retryHint = `Your previous output produced TypeScript type errors:
+${typeError}
+
+Fix these specifically \u2014 common causes:
+- RegExp match indices are 'string | undefined'; use non-null assertion or extract to a typed variable
+- Strict null checks: guard or assert before use
+- Don't declare locals you never reference
+
+IMPORTANT: The destructure line \`const { ... } = input;\` is added by the wrapper, NOT by you. Output ONLY the function body that goes AFTER that line \u2014 do not repeat the destructure or you will produce duplicate-declaration errors.`;
+                const retried = await aiService.generateBehavior({
+                  step: `${step}
+
+${retryHint}`,
+                  modelName,
+                  operationName,
+                  functionName,
+                  parameterNames: inputs,
+                  availableModels,
+                  spec,
+                  returnType
+                });
+                if (retried) {
+                  const retryCode = `export async function ${functionName}(input: any): Promise<any> {
+${retried}
+}`;
+                  const retrySyntaxError = await validateTypeScript(retryCode);
+                  const retryTypeError = retrySyntaxError ? null : await validateTypeScriptTypes(retryCode);
+                  if (!retrySyntaxError && !retryTypeError) {
+                    body = retried;
+                    source = "AI-GENERATED";
+                    cacheWrite(key, body);
+                  } else {
+                    source = "AI-INVALID";
+                    cacheWrite(key, body);
+                  }
+                } else {
+                  source = "AI-INVALID";
+                  cacheWrite(key, body);
+                }
+              } catch {
+                source = "AI-INVALID";
+                cacheWrite(key, body);
+              }
+            } else {
+              source = "AI-GENERATED";
+              cacheWrite(key, body);
+            }
           }
         }
       } catch {
@@ -204,8 +338,14 @@ ${inputsDoc}${returnsDoc} * Source: ${source}
  * All data comes in via \`input\`; all effects happen in the calling controller.
  * ${source === "AI-GENERATED" ? "AI-generated implementation. Review and test before deploying." : source === "AI-CACHED" ? "Restored from AI cache (.specverse/ai-cache/). Delete cache entry to regenerate." : source === "AI-INVALID" ? "AI returned code with syntax errors \u2014 function throws at runtime. Fix or regenerate." : "STUB \u2014 Claude CLI unavailable. Install Claude Code or implement manually."}
  */
-export async function ${functionName}(${signature}): Promise<${returnType}> {
-${destructure ? destructure + "\n" : ""}${body}
+export async function ${functionName}(${(() => {
+      const { signature: sig } = buildSignatureAndDestructure(body);
+      return sig;
+    })()}): Promise<${returnType}> {
+${(() => {
+      const { destructure } = buildSignatureAndDestructure(body);
+      return destructure ? destructure + "\n" : "";
+    })()}${body}
 }`);
   }
   if (aiService?.endSession) aiService.endSession();
@@ -220,27 +360,28 @@ ${destructure ? destructure + "\n" : ""}${body}
  * These functions could not be generated from convention patterns.
  * They are called by ${ownerName} when executing operations.
  *
+ * PURE-FUNCTION CONTRACT \u2014 these bodies must NOT touch the database, the
+ * event bus, or any external service. Persistence and side effects happen
+ * in the calling controller; this file does pure transformations only.
+ *
  * Options for each function:
  * - Implement manually (recommended for business-critical logic)
  * - Use AI generation: specverse ai generate <function>
  * - Refactor the spec step to use a convention pattern
  *
- * Convention patterns that ARE auto-generated (no AI needed):
- *   "Find {Model} by {field}" \u2192 prisma.model.findUniqueOrThrow(...)
- *   "Create {Model}" \u2192 prisma.model.create(...)
- *   "Update {Model} {field} to {value}" \u2192 prisma.model.update(...)
- *   "Delete {Model}" \u2192 prisma.model.delete(...)
- *   "Transition {Model} to {state}" \u2192 prisma.model.update({ status: ... })
- *   "Count {Model}s per {Group}" \u2192 prisma.model.groupBy(...)
- *   See step-conventions.ts for the full list.
+ * Convention patterns that ARE auto-generated by the realize engine (no
+ * AI needed) \u2014 these are emitted inline in the controller, not here:
+ *   "Find {Model} by {field}" \u2192 ORM-specific find call
+ *   "Create {Model}"          \u2192 ORM-specific create call
+ *   "Update {Model} {field} to {value}"
+ *   "Delete {Model}"
+ *   "Transition {Model} to {state}"
+ *   "Count {Model}s per {Group}"
+ *   See the ORM's step-conventions module for the full list.
  *
  * Generated: ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}
  */
 
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
 ${functions.join("\n\n")}
 `;
 }

package/libs/instance-factories/applications/templates/generic/backend-package-json-generator.ts

@@ -1,15 +1,56 @@
 /**
  * Backend Package.json Generator
  *
- * Generates package.json for backend workspace in monorepo
+ * Generates package.json for backend workspace in monorepo. Adapts deps +
+ * scripts to the manifest's resolved ORM/storage so a manifest pinning
+ * MongoDBNativeDriver doesn't get stuck with Prisma scripts and
+ * `@prisma/client` in dependencies.
  */
 
 import type { TemplateContext } from '@specverse/types';
 
-export default function generateBackendPackageJson(context: TemplateContext): string {
-  const { spec } = context;
+/** Read the manifest's resolved orm name (e.g. "PrismaORM", "MongoDBNativeDriver"). */
+function resolveOrmName(manifest: any): string {
+  if (!manifest) return 'PrismaORM';
+  const inner = manifest.manifests
+    ? Object.values(manifest.manifests)[0] as any
+    : manifest;
+  if (!inner) return 'PrismaORM';
+  // Prefer explicit capabilityMappings for orm.client; fall back to defaultMappings.orm.
+  const caps = Array.isArray(inner.capabilityMappings) ? inner.capabilityMappings : [];
+  const ormCap = caps.find((m: any) => m?.capability === 'orm.client') ||
+                 caps.find((m: any) => m?.capability === 'orm.schema');
+  if (ormCap) return ormCap.implementation || ormCap.instanceFactory || 'PrismaORM';
+  return inner.defaultMappings?.orm || 'PrismaORM';
+}
 
+export default function generateBackendPackageJson(context: TemplateContext): string {
+  const { spec, manifest } = context as any;
   const appName = (spec.metadata?.component || 'app').toLowerCase().replace(/\s+/g, '-');
+  const orm = resolveOrmName(manifest);
+  const isMongoNative = orm === 'MongoDBNativeDriver';
+
+  // Database scripts are ORM-specific. Prisma has db:setup/generate/push;
+  // MongoDB native has nothing to generate (collections are dynamic), so
+  // we drop those scripts entirely rather than emit no-op placeholders.
+  const dbScripts: Record<string, string> = isMongoNative
+    ? {}
+    : {
+        'db:setup': 'prisma generate && prisma db push',
+        'db:generate': 'prisma generate',
+        'db:push': 'prisma db push',
+        'db:migrate': 'prisma migrate dev',
+        'db:studio': 'prisma studio',
+        'db:seed': 'tsx prisma/seed.ts',
+      };
+
+  const ormDeps: Record<string, string> = isMongoNative
+    ? { 'mongodb': '^6.3.0' }
+    : { '@prisma/client': '^5.7.0' };
+
+  const ormDevDeps: Record<string, string> = isMongoNative
+    ? {}
+    : { 'prisma': '^5.7.0' };
 
   const pkg: Record<string, any> = {
     name: `${appName}-backend`,
@@ -32,13 +73,8 @@ export default function generateBackendPackageJson(context: TemplateContext): st
       // Production
       'start': 'node dist/main.js',
 
-      // Database
-      'db:setup': 'prisma generate && prisma db push',
-      'db:generate': 'prisma generate',
-      'db:push': 'prisma db push',
-      'db:migrate': 'prisma migrate dev',
-      'db:studio': 'prisma studio',
-      'db:seed': 'tsx prisma/seed.ts',
+      // Database (ORM-specific; empty for native driver)
+      ...dbScripts,
 
       // Testing
       'test': 'vitest run --passWithNoTests',
@@ -54,7 +90,7 @@ export default function generateBackendPackageJson(context: TemplateContext): st
     },
 
     dependencies: {
-      '@prisma/client': '^5.7.0',
+      ...ormDeps,
       'fastify': '^5.8.3',
       '@fastify/cors': '^10.0.0',
       '@fastify/helmet': '^12.0.0',
@@ -70,7 +106,7 @@ export default function generateBackendPackageJson(context: TemplateContext): st
       'typescript': '^5.3.0',
       '@types/node': '^20.10.0',
       'tsx': '^4.7.0',
-      'prisma': '^5.7.0',
+      ...ormDevDeps,
       'vitest': '^3.0.0',
       '@vitest/coverage-v8': '^3.0.0',
       'eslint': '^9.0.0',

package/libs/instance-factories/controllers/templates/fastify/server-generator.ts

@@ -59,7 +59,7 @@ export default function generateFastifyServer(context: TemplateContext): string
 // workspace before running the script.
 import { config as loadEnv } from 'dotenv';
 import { existsSync } from 'fs';
-import { resolve as resolvePath, dirname, join } from 'path';
+import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 {
   let dir = dirname(fileURLToPath(import.meta.url));

package/libs/instance-factories/services/templates/mongodb-native/__tests__/controller-generator.test.ts

@@ -94,7 +94,9 @@ describe('MongoDB native — controller-generator', () => {
       model: { ...baseModel, storage: { collection: 'custom_todos' } },
     } as any);
     expect(out).toContain(`COLLECTION_NAME = 'custom_todos'`);
-    expect(out).toContain(`getCollection('custom_todos')`);
+    // CURVED ops reference the constant, not the literal — keeps the
+    // generator output noUnusedLocals-clean under strict tsc.
+    expect(out).toContain(`getCollection(COLLECTION_NAME)`);
   });
 
   it('omits CURVED ops not declared on the controller', () => {

package/libs/instance-factories/services/templates/mongodb-native/controller-generator.ts

@@ -36,7 +36,7 @@ export default function generateMongoNativeController(context: TemplateContext):
   const collection = collectionName(model);
   const curedOps = controller.cured || {};
 
-  const customActions = generateCustomActions(controller, modelName);
+  const customActions = generateCustomActions(controller);
 
   const validate = generateValidateMethod(model, modelName);
   const create = curedOps.create ? generateCreateMethod(model, modelName, modelVar, collection) : '';
@@ -56,7 +56,6 @@ export default function generateMongoNativeController(context: TemplateContext):
 import { ObjectId, type Filter, type Document } from 'mongodb';
 import { getCollection } from '../db/mongoClient.js';
 ${hasEventPublishing ? `import { eventBus } from '../events/eventBus.js';` : ''}
-${customActions.needsAiBehaviors ? `import * as aiBehaviors from '../behaviors/${modelName}Controller.ai.js';` : ''}
 
 const COLLECTION_NAME = '${collection}';
 
@@ -147,7 +146,7 @@ function generateCreateMethod(model: any, modelName: string, modelVar: string, c
     const validation = this.validate(data, { operation: 'create' });
     if (!validation.valid) throw new Error(\`Validation failed: \${validation.errors.join(', ')}\`);
 
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const result = await collection.insertOne({ ...data });
     const ${modelVar} = { _id: result.insertedId, ...data };
 
@@ -163,7 +162,7 @@ function generateRetrieveMethod(modelName: string, modelVar: string, collection:
    * Retrieve ${modelName} by id. Returns null when not found.
    */
   public async retrieve(id: string): Promise<any | null> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     return await collection.findOne(byId(id));
   }
 
@@ -171,7 +170,7 @@ function generateRetrieveMethod(modelName: string, modelVar: string, collection:
    * Retrieve a page of ${modelName}s.
    */
   public async retrieveAll(options: { skip?: number; take?: number } = {}): Promise<any[]> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const cursor = collection.find({});
     if (options.skip) cursor.skip(options.skip);
     if (options.take) cursor.limit(options.take);
@@ -198,7 +197,7 @@ function generateUpdateMethod(modelName: string, modelVar: string, collection: s
       updateData[key] = value;
     }
 
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     await collection.updateOne(byId(id), { $set: updateData });
     const ${modelVar} = await collection.findOne(byId(id));
     if (!${modelVar}) throw new Error('${modelName} not found after update');
@@ -231,7 +230,7 @@ function generateEvolveMethod(model: any, modelName: string, modelVar: string, c
    * States: ${states.join(' → ') || '(none declared)'}
    */
   public async evolve(id: string, data: any): Promise<any> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const current = await collection.findOne(byId(id));
     if (!current) throw new Error('${modelName} not found');
 
@@ -264,7 +263,7 @@ function generateDeleteMethod(modelName: string, modelVar: string, collection: s
    * Delete ${modelName}.
    */
   public async delete(id: string): Promise<void> {
-    const collection = await getCollection('${collection}');
+    const collection = await getCollection(COLLECTION_NAME);
     const ${modelVar} = await collection.findOne(byId(id));
     await collection.deleteOne(byId(id));
     if (${modelVar}) {
@@ -276,16 +275,26 @@ function generateDeleteMethod(modelName: string, modelVar: string, collection: s
 
 interface CustomActionsResult {
   code: string;
-  needsAiBehaviors: boolean;
 }
 
-function generateCustomActions(controller: any, modelName: string): CustomActionsResult {
+/**
+ * Custom actions emit TODO stubs that throw "not implemented".
+ *
+ * Why not delegate to `aiBehaviors.<actionName>`? Because the AI-behaviors
+ * generator only emits functions for STEPS that didn't match a convention
+ * pattern — not for actions themselves. So `aiBehaviors.rotate` would not
+ * exist even when an action named `rotate` is declared on the controller.
+ *
+ * Real implementation of action bodies is deferred to the MongoDB-native
+ * step-conventions library (#43F follow-up — mirror Prisma's
+ * step-conventions.ts but emit native-driver collection calls).
+ */
+function generateCustomActions(controller: any): CustomActionsResult {
   if (!controller.actions || Object.keys(controller.actions).length === 0) {
-    return { code: '', needsAiBehaviors: false };
+    return { code: '' };
   }
   const out: string[] = [];
   for (const [actionName, action] of Object.entries<any>(controller.actions)) {
-    const params = generateActionParams(action);
     const stepsHeader = (action.steps && action.steps.length > 0)
       ? action.steps.map((s: any) => `   *   - ${typeof s === 'string' ? s : (s.action || JSON.stringify(s))}`).join('\n')
       : '   *   (no spec steps declared)';
@@ -297,20 +306,14 @@ function generateCustomActions(controller: any, modelName: string): CustomAction
    * Spec steps:
 ${stepsHeader}
    */
-  public async ${actionName}(${params}): Promise<any> {
-    return await aiBehaviors.${actionName}({ controller: this, ...args });
+  public async ${actionName}(_args: any = {}): Promise<any> {
+    // TODO (#43F): translate spec steps into native MongoDB driver calls
+    // via a mongodb-native step-conventions library (mirror of the prisma
+    // one). For now this is a stub so realize completes and the action
+    // surface is callable for parity tests.
+    throw new Error('${controller.name}.${actionName} is not implemented');
   }
 `);
   }
-  return { code: out.join('\n'), needsAiBehaviors: true };
-}
-
-function generateActionParams(action: any): string {
-  if (Array.isArray(action.parameters) && action.parameters.length > 0) {
-    return 'args: any';
-  }
-  if (action.parameters && typeof action.parameters === 'object' && Object.keys(action.parameters).length > 0) {
-    return 'args: any';
-  }
-  return 'args: any = {}';
+  return { code: out.join('\n') };
 }

package/libs/instance-factories/services/templates/prisma/ai-behaviors-generator.ts

@@ -46,6 +46,85 @@ async function validateTypeScript(code: string): Promise<string | null> {
   }
 }
 
+/**
+ * Type-check the generated body in isolation using the TypeScript compiler
+ * API. Returns null if clean, or a concise error string suitable for
+ * passing back to the LLM as a fix-up hint. Skipped silently if the `typescript`
+ * package isn't installed (the realize pipeline still runs full tsc against
+ * the realized output downstream — this is a faster, generator-side filter
+ * to catch the most common LLM mistakes before they hit the user).
+ *
+ * Why bother: the LLM regularly emits patterns that are valid syntax but
+ * fail strict tsc — RegExp index access (`m[1]` is `string | undefined`),
+ * unused locals, undefined references. Reprompting with the tsc error
+ * lets the LLM self-correct without burning a per-step retry.
+ */
+async function validateTypeScriptTypes(code: string): Promise<string | null> {
+  let ts: any;
+  try {
+    ts = await import('typescript');
+    if (ts.default) ts = ts.default;
+  } catch {
+    return null;  // typescript not available — skip
+  }
+  try {
+    const fileName = 'aiBehavior.ts';
+    const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.ES2022, true);
+    // Mirror the strict shape used by the realized backend's tsconfig so
+    // a body that passes here also passes downstream. Failing to match the
+    // realized strictness means we'd ship code that fails user-side tsc
+    // (defeating the whole point of generator-side validation).
+    const compilerOptions: any = {
+      target: ts.ScriptTarget.ES2022,
+      module: ts.ModuleKind.ESNext,
+      moduleResolution: ts.ModuleResolutionKind.NodeNext,
+      strict: true,
+      noImplicitAny: false,  // body uses `any` extensively for inputs
+      noUnusedLocals: true,
+      noUnusedParameters: true,
+      noImplicitReturns: true,
+      noUncheckedIndexedAccess: true,
+      noFallthroughCasesInSwitch: true,
+      noEmit: true,
+      skipLibCheck: true,
+      types: [],
+      // Without `lib`, tsc can't resolve Promise / Array / RegExp etc., and
+      // every body fails the basic-types check before it even gets to the
+      // strict-null-check rules we actually want to validate.
+      lib: ['lib.es2022.d.ts'],
+    };
+    const defaultHost = ts.createCompilerHost(compilerOptions);
+    const host: any = {
+      ...defaultHost,
+      getSourceFile: (n: string, target: any) => {
+        if (n === fileName) return sourceFile;
+        return defaultHost.getSourceFile(n, target);
+      },
+      writeFile: () => {},
+      fileExists: (n: string) => n === fileName || defaultHost.fileExists(n),
+      readFile: (n: string) => (n === fileName ? code : defaultHost.readFile(n)),
+    };
+    const program = ts.createProgram([fileName], compilerOptions, host);
+    const diagnostics = [
+      ...program.getSyntacticDiagnostics(sourceFile),
+      ...program.getSemanticDiagnostics(sourceFile),
+    ];
+    if (diagnostics.length === 0) return null;
+    const formatted = diagnostics.slice(0, 5).map((d: any) => {
+      const msg = ts.flattenDiagnosticMessageText(d.messageText, '\n');
+      const pos = d.file && d.start !== undefined
+        ? d.file.getLineAndCharacterOfPosition(d.start)
+        : null;
+      return pos
+        ? `line ${pos.line + 1}, col ${pos.character + 1}: ${msg}`
+        : msg;
+    });
+    return formatted.join('; ');
+  } catch {
+    return null;  // never let validation crash the generator
+  }
+}
+
 /**
  * AI output cache — avoids re-calling Claude for unchanged steps.
  *
@@ -56,7 +135,7 @@ async function validateTypeScript(code: string): Promise<string | null> {
  * produces a new hash. The prompt version is part of the hash so
  * prompt upgrades also invalidate.
  */
-const PROMPT_VERSION = '9.1.0';
+const PROMPT_VERSION = '9.2.0';
 
 function cacheKey(step: string, modelName: string, operationName: string, functionName: string, inputs: string[]): string {
   const payload = JSON.stringify({ step, modelName, operationName, functionName, inputs: [...inputs].sort(), v: PROMPT_VERSION });
@@ -229,15 +308,76 @@ export async function generateAiBehaviorsFile(opts: {
   let cacheHits = 0;
   let cacheMisses = 0;
   for (const { functionName, step, operationName, parameterNames, inputs, returns, modelName } of unmatchedFunctions) {
-    // Pure function signature: all inputs as a typed destructured object
-    const signature = inputs.length > 0
-      ? `input: { ${inputs.map(n => `${n}: any`).join('; ')} }`
-      : 'input: Record<string, never>';
-
-    // Inside the body, destructure for readability
-    const destructure = inputs.length > 0
-      ? `  const { ${inputs.join(', ')} } = input;`
-      : '';
+    // Pure function signature + destructure are built AFTER the body so we
+    // can match what the LLM actually references — strict tsc's
+    // noUnusedLocals / noUnusedParameters fire on every input the body
+    // didn't touch. We tolerate underuse rather than re-prompting the LLM:
+    // the body is correct as-is, we just trim the wrapper to fit it.
+    //
+    // Three cases:
+    //   - body uses some inputs: destructure only those
+    //   - body uses none directly but references `input.X`: keep `input`
+    //   - body doesn't touch input at all: prefix signature with `_` so
+    //     noUnusedParameters is happy
+    /** Strip string/template/comment content so identifier-reference checks
+     * don't match `reward` inside a kebab-case string like `'reward-not-granted'`
+     * or `// reward stays as text`. We replace the literal contents with
+     * spaces so positions stay roughly aligned in case of debugging. */
+    const stripLiteralsAndComments = (src: string): string => {
+      return src
+        .replace(/\/\*[\s\S]*?\*\//g, (m) => ' '.repeat(m.length))
+        .replace(/\/\/[^\n]*/g, (m) => ' '.repeat(m.length))
+        .replace(/(['"])(?:\\.|(?!\1).)*\1/g, (m) => m[0] + ' '.repeat(m.length - 2) + m[0])
+        .replace(/`(?:\\.|\$\{[^}]*\}|(?!`).)*`/g, (m) => '`' + ' '.repeat(m.length - 2) + '`');
+    };
+
+    /** Detect whether the body manages its own input access (so adding our
+     * own destructure would either duplicate-declare or leave us with
+     * unused-locals). Three shapes the LLM emits:
+     *   1. `const { X, Y } = input;`           (destructure)
+     *   2. `const X = input.X;`                (per-property)
+     *   3. `const _X = input.X;`               (per-property with rename)
+     * If ANY of these appear, the body is its own input setup and we
+     * should leave it alone. */
+    const bodyHandlesInputItself = (body: string): boolean => {
+      const codeOnly = stripLiteralsAndComments(body);
+      // Destructure: `const { ... } = input;`
+      if (/(?:const|let|var)\s*\{[^}]+\}\s*=\s*input\b/.test(codeOnly)) return true;
+      // Per-property access: any `(const|let|var) <name> = input.<name>`
+      if (/(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*input\.[A-Za-z_$][\w$]*/.test(codeOnly)) return true;
+      return false;
+    };
+
+    /** Does the body actually USE the local variable `n` (vs only mention
+     * it as an object-literal property name like `step1Result:` in a
+     * return object)? A real usage is `n` followed by something other than
+     * `:` — i.e. accessed in an expression. We approximate by requiring
+     * the next non-whitespace char to be a code-meaningful operator/end. */
+    const isRealReference = (n: string, codeOnly: string): boolean => {
+      const escaped = n.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      const re = new RegExp(`(?<![A-Za-z0-9_$])${escaped}(?![A-Za-z0-9_$:])`, 'g');
+      return re.test(codeOnly);
+    };
+
+    const buildSignatureAndDestructure = (body: string): { signature: string; destructure: string } => {
+      if (inputs.length === 0) {
+        return { signature: 'input: Record<string, never>', destructure: '' };
+      }
+      const codeOnly = stripLiteralsAndComments(body);
+      const referenced = inputs.filter((n) => isRealReference(n, codeOnly));
+      const usesInputObject = /(?<![A-Za-z0-9_$])input(?![A-Za-z0-9_$])/.test(codeOnly);
+      const sigName = (referenced.length > 0 || usesInputObject) ? 'input' : '_input';
+      const sig = `${sigName}: { ${inputs.map(n => `${n}: any`).join('; ')} }`;
+      // If the body already manages its own input access (destructure or
+      // per-property) OR accesses input.X directly, don't add a wrapper
+      // destructure — would leave us with unused locals (TS6198) or
+      // duplicate declarations (TS2451).
+      const bodyAccessesInputProps = /(?<![A-Za-z0-9_$])input\.[A-Za-z_$]/.test(codeOnly);
+      const destructure = (referenced.length > 0 && !bodyHandlesInputItself(body) && !bodyAccessesInputProps)
+        ? `  const { ${referenced.join(', ')} } = input;`
+        : '';
+      return { signature: sig, destructure };
+    };
 
     // Build return type from spec declaration (if provided)
     // returns can be:
@@ -258,11 +398,14 @@ export async function generateAiBehaviorsFile(opts: {
     let source: 'AI-CACHED' | 'AI-GENERATED' | 'AI-INVALID' | 'STUB' = body ? 'AI-CACHED' : 'STUB';
     if (body) {
       // Validate cache entry — a previously valid entry may have been
-      // corrupted on disk or the validator rules may have changed
+      // corrupted on disk OR the validation rules may have tightened
+      // (e.g. tsc type checks added). A cache hit must still be re-validated
+      // through both gates so old bodies don't leak past the new bar.
       const testCode = `export async function ${functionName}(input: any): Promise<any> {\n${body}\n}`;
-      const validationError = await validateTypeScript(testCode);
-      if (validationError) {
-        console.warn(`      [ai-validate] cached ${functionName} failed validation: ${validationError}`);
+      const syntaxError = await validateTypeScript(testCode);
+      const typeError = syntaxError ? null : await validateTypeScriptTypes(testCode);
+      if (syntaxError || typeError) {
+        console.warn(`      [ai-validate] cached ${functionName} failed validation: ${syntaxError || typeError}`);
         body = null;  // Force regeneration
         source = 'STUB';
       } else {
@@ -285,17 +428,62 @@ export async function generateAiBehaviorsFile(opts: {
         });
 
         if (body) {
-          // Validate the generated body as a standalone function
+          // Two-tier validation:
+          //   1. esbuild syntax check — fast, catches unbalanced braces, etc.
+          //   2. tsc type check — slower, catches `string | undefined` index
+          //      access, unused locals, and undefined references the LLM
+          //      regularly produces. On tsc failure, we re-prompt the LLM
+          //      with the error message appended; only ONE retry to bound
+          //      cost. If that still fails we keep the body but mark it
+          //      AI-INVALID so the user sees it needs review.
           const testCode = `export async function ${functionName}(input: any): Promise<any> {\n${body}\n}`;
-          const validationError = await validateTypeScript(testCode);
-          if (validationError) {
-            console.warn(`      [ai-validate] ${functionName} has syntax error: ${validationError}`);
-            // Don't cache invalid output; treat as failed generation
-            body = `// AI-generated code failed validation: ${validationError}\n  // Step: ${step}\n  throw new Error('AI behavior has invalid syntax — see comment above');`;
+          const syntaxError = await validateTypeScript(testCode);
+          if (syntaxError) {
+            console.warn(`      [ai-validate] ${functionName} has syntax error: ${syntaxError}`);
+            body = `// AI-generated code failed validation: ${syntaxError}\n  // Step: ${step}\n  throw new Error('AI behavior has invalid syntax — see comment above');`;
             source = 'AI-INVALID';
           } else {
-            source = 'AI-GENERATED';
-            cacheWrite(key, body);
+            const typeError = await validateTypeScriptTypes(testCode);
+            if (typeError) {
+              console.warn(`      [ai-validate] ${functionName} type errors: ${typeError}`);
+              try {
+                const retryHint = `Your previous output produced TypeScript type errors:\n${typeError}\n\nFix these specifically — common causes:\n- RegExp match indices are 'string | undefined'; use non-null assertion or extract to a typed variable\n- Strict null checks: guard or assert before use\n- Don't declare locals you never reference\n\nIMPORTANT: The destructure line \`const { ... } = input;\` is added by the wrapper, NOT by you. Output ONLY the function body that goes AFTER that line — do not repeat the destructure or you will produce duplicate-declaration errors.`;
+                const retried = await aiService.generateBehavior({
+                  step: `${step}\n\n${retryHint}`,
+                  modelName,
+                  operationName,
+                  functionName,
+                  parameterNames: inputs,
+                  availableModels,
+                  spec,
+                  returnType,
+                });
+                if (retried) {
+                  const retryCode = `export async function ${functionName}(input: any): Promise<any> {\n${retried}\n}`;
+                  const retrySyntaxError = await validateTypeScript(retryCode);
+                  const retryTypeError = retrySyntaxError ? null : await validateTypeScriptTypes(retryCode);
+                  if (!retrySyntaxError && !retryTypeError) {
+                    body = retried;
+                    source = 'AI-GENERATED';
+                    cacheWrite(key, body);
+                  } else {
+                    // Retry didn't help — keep the original body so the user can fix
+                    // manually, but mark it as INVALID so it stands out.
+                    source = 'AI-INVALID';
+                    cacheWrite(key, body);
+                  }
+                } else {
+                  source = 'AI-INVALID';
+                  cacheWrite(key, body);
+                }
+              } catch {
+                source = 'AI-INVALID';
+                cacheWrite(key, body);
+              }
+            } else {
+              source = 'AI-GENERATED';
+              cacheWrite(key, body);
+            }
           }
         }
       } catch {
@@ -335,8 +523,14 @@ ${inputsDoc}${returnsDoc} * Source: ${source}
    ? 'AI returned code with syntax errors — function throws at runtime. Fix or regenerate.'
    : 'STUB — Claude CLI unavailable. Install Claude Code or implement manually.'}
  */
-export async function ${functionName}(${signature}): Promise<${returnType}> {
-${destructure ? destructure + '\n' : ''}${body}
+export async function ${functionName}(${(() => {
+  const { signature: sig } = buildSignatureAndDestructure(body);
+  return sig;
+})()}): Promise<${returnType}> {
+${(() => {
+  const { destructure } = buildSignatureAndDestructure(body);
+  return destructure ? destructure + '\n' : '';
+})()}${body}
 }`);
   }
 
@@ -356,27 +550,28 @@ ${destructure ? destructure + '\n' : ''}${body}
  * These functions could not be generated from convention patterns.
  * They are called by ${ownerName} when executing operations.
  *
+ * PURE-FUNCTION CONTRACT — these bodies must NOT touch the database, the
+ * event bus, or any external service. Persistence and side effects happen
+ * in the calling controller; this file does pure transformations only.
+ *
  * Options for each function:
  * - Implement manually (recommended for business-critical logic)
  * - Use AI generation: specverse ai generate <function>
  * - Refactor the spec step to use a convention pattern
  *
- * Convention patterns that ARE auto-generated (no AI needed):
- *   "Find {Model} by {field}" → prisma.model.findUniqueOrThrow(...)
- *   "Create {Model}" → prisma.model.create(...)
- *   "Update {Model} {field} to {value}" → prisma.model.update(...)
- *   "Delete {Model}" → prisma.model.delete(...)
- *   "Transition {Model} to {state}" → prisma.model.update({ status: ... })
- *   "Count {Model}s per {Group}" → prisma.model.groupBy(...)
- *   See step-conventions.ts for the full list.
+ * Convention patterns that ARE auto-generated by the realize engine (no
+ * AI needed) — these are emitted inline in the controller, not here:
+ *   "Find {Model} by {field}" → ORM-specific find call
+ *   "Create {Model}"          → ORM-specific create call
+ *   "Update {Model} {field} to {value}"
+ *   "Delete {Model}"
+ *   "Transition {Model} to {state}"
+ *   "Count {Model}s per {Group}"
+ *   See the ORM's step-conventions module for the full list.
  *
  * Generated: ${new Date().toISOString().split('T')[0]}
  */
 
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
 ${functions.join('\n\n')}
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specverse/engines",
-  "version": "6.6.3",
+  "version": "6.7.8",
   "description": "SpecVerse toolchain — parser, inference, realize, generators, AI, registry, bundles",
   "type": "module",
   "main": "dist/index.js",
@@ -62,26 +62,25 @@
     "@ai-sdk/openai-compatible": "^2.0.41",
     "@ai-sdk/provider": "^3.0.8",
     "@specverse/assets": "^1.6.0",
-    "@specverse/engines": "^6.6.1",
     "@specverse/entities": "^5.1.0",
     "@specverse/runtime": "^5.0.1",
     "@specverse/types": "^5.1.0",
     "ai": "^6.0.168",
     "ajv": "^8.17.0",
     "ajv-formats": "^2.1.0",
+    "esbuild": "^0.25.0",
     "glob": "^10.0.0",
     "graphology": "^0.26.0",
     "graphology-communities-louvain": "^2.0.2",
     "handlebars": "^4.7.9",
     "js-yaml": "^4.1.0",
     "semver": "^7.0.0",
+    "typescript": "^5.4.0",
     "yaml": "^2.8.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@types/node": "^25.5.0",
-    "esbuild": "^0.25.0",
-    "typescript": "^5.4.0"
+    "@types/node": "^25.5.0"
   },
   "files": [
     "dist",