@supacloud/cli 0.103.6 → 0.104.0

package/dist/index.js

@@ -9405,9 +9405,9 @@ var $pack = require_pack();
 var FRONTEND_ARCHIVE_FORMAT = "tar.zst";
 var FRONTEND_ARCHIVE_RELEASE_SCHEMA = "supacloud.frontend-release.v2";
 var FRONTEND_ARCHIVE_CONTENT_TYPE = "application/vnd.supacloud.frontend.tar+zstd";
-var FRONTEND_ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
+var FRONTEND_ARCHIVE_MAX_BYTES = 500 * 1024 * 1024;
 var FRONTEND_ARCHIVE_MAX_FILES = 1e4;
-var FRONTEND_ARCHIVE_MAX_SOURCE_BYTES = 300 * 1024 * 1024;
+var FRONTEND_ARCHIVE_MAX_SOURCE_BYTES = 500 * 1024 * 1024;
 var FRONTEND_ARCHIVE_MAX_TAR_BYTES = FRONTEND_ARCHIVE_MAX_SOURCE_BYTES + FRONTEND_ARCHIVE_MAX_FILES * 2048 + 1024;
 function assertFrontendArchivePath(path) {
   if (!path || path.length > 1024 || Buffer.byteLength(path) > 4096 || path.startsWith("/") || path.includes("\\") || /[\u0000-\u001f\u007f]/u.test(path) || path.split("/").some((segment) => !segment || segment === "." || segment === "..") || /^[A-Za-z]:/u.test(path))
@@ -10285,6 +10285,8 @@ function parseDeliveryBuildManifest(value) {
 
 // node_modules/@supacloud/delivery/src/delivery-artifact.ts
 var JSON_LIMIT = 1048576;
+var DELIVERY_ARTIFACT_MAX_FILE_BYTES = 500 * 1024 * 1024;
+var DELIVERY_ARTIFACT_MAX_TOTAL_BYTES = 500 * 1024 * 1024;
 async function readDeliveryManifest(manifestPath) {
   const selected = resolve4(manifestPath);
   const root = await realpath2(dirname2(selected));
@@ -10298,7 +10300,7 @@ async function readDeliverySelection(manifestPath, target) {
   return { root, object, planned };
 }
 async function readVerifiedDeliveryFiles(root, object, target, selectedPaths) {
-  if (object.files.length > 1024 || object.files.some((file) => file.bytes > 64 * 1024 * 1024) || object.files.reduce((bytes, file) => bytes + file.bytes, 0) > 128 * 1024 * 1024) {
+  if (object.files.length > 1024 || object.files.some((file) => file.bytes > DELIVERY_ARTIFACT_MAX_FILE_BYTES) || object.files.reduce((bytes, file) => bytes + file.bytes, 0) > DELIVERY_ARTIFACT_MAX_TOTAL_BYTES) {
     throw new Error("Artifact inventory exceeds limits.");
   }
   const objectRoot = join2(root, "objects", object.objectId);
@@ -11420,7 +11422,7 @@ function buildDeliveryMigrationPlan(archive, inventory, ref) {
 // node_modules/@supacloud/delivery/src/index.ts
 async function readDeliveryExecutableArchive(manifestPath) {
   const { root, manifest } = await readDeliveryManifest(manifestPath);
-  if (manifest.objects.length === 0 || manifest.objects.length > 32 || manifest.objects.some((object) => object.entryKind === "compiled-module-factory") || manifest.objects.reduce((total, object) => total + object.files.reduce((bytes, file) => bytes + file.bytes, 0), 0) > 128 * 1024 * 1024) {
+  if (manifest.objects.length === 0 || manifest.objects.length > 32 || manifest.objects.some((object) => object.entryKind === "compiled-module-factory") || manifest.objects.reduce((total, object) => total + object.files.reduce((bytes, file) => bytes + file.bytes, 0), 0) > DELIVERY_ARTIFACT_MAX_TOTAL_BYTES) {
     throw new Error("Invalid executable delivery inventory.");
   }
   const objects = [];
@@ -21574,25 +21576,25 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.47.2"
+      version: "0.48.0"
     },
     app: {
-      version: "0.28.2",
+      version: "0.29.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.33.4"
+      version: "0.34.0"
     },
     commands: {
-      version: "0.9.6"
+      version: "0.10.0"
     },
     contracts: {
-      version: "0.11.4"
+      version: "0.12.0"
     },
     db: {
-      version: "0.18.3",
+      version: "0.19.0",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21601,7 +21603,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.43.3",
+      version: "0.44.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -26247,7 +26249,7 @@ export const ${className}Params = t.Object({
     id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
 });
 export const ${className}ListQuery = t.Object({
-    state: t.Optional(t.String({ minLength: 1, maxLength: 64 })),
+    state: t.Optional(t.Union([t.Literal("draft"), t.Literal("approved")])),
 });
 export const ${className}ApproveBody = t.Object({
     expectedVersion: t.Integer({ minimum: 1 }),
@@ -26259,12 +26261,19 @@ export const ${className}Row = t.Object({
     version: t.Integer({ minimum: 1 }),
 });
 export const ${className}ListResponse = t.Array(${className}Row);
+export const ${className}RefreshInput = t.Object({
+    id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
+    version: t.Integer({ minimum: 1 }),
+});
 `,
-    [`${name}.model.ts`]: `import { InjectionToken } from "@supacloud/app/core";
+    [`${name}.model.ts`]: `import {
+    InjectionToken, type FeatureRequestContext,
+} from "@supacloud/app/core";
 import type {
     ${className}ApproveBody,
     ${className}ListQuery,
     ${className}Row,
+    ${className}RefreshInput,
 } from "./${name}.contracts";
 import type { StaticDecode } from "typebox";
 
@@ -26272,14 +26281,15 @@ export type ${className}ListInput = StaticDecode<typeof ${className}ListQuery>;
 export type ${className}ApproveInput = StaticDecode<typeof ${className}ApproveBody>;
 export type ${className}ApproveCommand = ${className}ApproveInput & { id: string };
 export type ${className}Result = StaticDecode<typeof ${className}Row>;
+export type ${className}RefreshJobInput = StaticDecode<typeof ${className}RefreshInput>;
 
 export interface ${className}ReadPort {
-    list(input: ${className}ListInput): Promise<${className}Result[]>;
-    detail(id: string): Promise<${className}Result>;
+    list(context: FeatureRequestContext, input: ${className}ListInput): Promise<${className}Result[]>;
+    detail(context: FeatureRequestContext, id: string): Promise<${className}Result>;
 }
 
 export interface ${className}WritePort {
-    approve(input: ${className}ApproveCommand): Promise<${className}Result>;
+    approve(context: FeatureRequestContext, input: ${className}ApproveCommand): Promise<${className}Result>;
 }
 
 export const ${className}Reader = new InjectionToken<${className}ReadPort>(
@@ -26289,7 +26299,10 @@ export const ${className}Writer = new InjectionToken<${className}WritePort>(
     "${name}.writer", { scope: "request" },
 );
 `,
-    [`${name}.service.ts`]: `import { Inject, Injectable, Optional } from "@supacloud/app/core";
+    [`${name}.service.ts`]: `import {
+    Inject, Injectable, Optional, REQUEST_CONTEXT, requireFeatureRequestContext,
+    type FeatureRequestContext,
+} from "@supacloud/app/core";
 import {
     ${className}Reader,
     ${className}Writer,
@@ -26302,49 +26315,67 @@ import {
 @Injectable({ scope: "request" })
 export class ${className}Service {
     constructor(
+        @Inject(REQUEST_CONTEXT) private readonly requestContext: unknown,
         @Inject(${className}Reader) @Optional() private readonly reader?: ${className}ReadPort,
         @Inject(${className}Writer) @Optional() private readonly writer?: ${className}WritePort,
     ) {}
 
-    async list(input: Parameters<${className}ReadPort["list"]>[0]): Promise<${className}Result[]> {
+    private context(): FeatureRequestContext {
+        return requireFeatureRequestContext(this.requestContext);
+    }
+
+    async list(input: Parameters<${className}ReadPort["list"]>[1]): Promise<${className}Result[]> {
         if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
-        return this.reader.list(input);
+        return this.reader.list(this.context(), input);
     }
 
     async detail(id: string): Promise<${className}Result> {
         if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
-        return this.reader.detail(id);
+        return this.reader.detail(this.context(), id);
     }
 
     async approve(id: string, input: ${className}ApproveInput): Promise<${className}Result> {
         if (!this.writer) throw new Error("Bind ${className}Writer with durable command governance");
-        return this.writer.approve({ ...input, id });
+        return this.writer.approve(this.context(), { ...input, id });
     }
 }
 `,
     [`${name}.feature.ts`]: `import { Effect } from "effect";
 import {
-    Body, Command, Controller, defineFeatureSlice, defineFeatureSpec, Get, Inject,
-    Injectable, Job, Param, Post, Query, type FeatureState,
+    Body, Command, Controller, defineFeatureSlice, defineFeatureSpec, Get, Inject, JOB_CONTEXT,
+    Injectable, Job, Param, Post, Query, requireFeatureRequestContext, type FeatureRequestContext,
+    type FeatureState,
 } from "@supacloud/app/core";
 import {
     ${className}ApproveBody,
     ${className}ListQuery,
     ${className}ListResponse,
     ${className}Params,
+    ${className}RefreshInput,
     ${className}Row,
 } from "./${name}.contracts";
 import { ${className}Service } from "./${name}.service";
-import type { ${className}ApproveInput, ${className}ListInput, ${className}Result } from "./${name}.model";
+import type {
+    ${className}ApproveInput,
+    ${className}ListInput,
+    ${className}RefreshJobInput,
+    ${className}Result,
+} from "./${name}.model";
 
 export const featureSpec = defineFeatureSpec({
     name: ${JSON.stringify(name)},
     states: ["draft", "approved"],
+    tenantField: "tenant_id",
     transitions: {
         approve: {
             from: "draft", to: "approved", command: "Approve${className}Command",
             permission: ${JSON.stringify(permission)}, transaction: "required",
             idempotency: "required", audit: ${JSON.stringify(`${name}.approved`)},
+            job: ${JSON.stringify(`${name}.refresh`)},
+            persistence: {
+                boundary: "database", optimisticLock: "required", versionField: "version", tenantField: "tenant_id", stateField: "state",
+                receipt: "required", reconciliation: "none",
+            },
             route: "POST /${name}/:id/approve",
         },
     },
@@ -26352,7 +26383,7 @@ export const featureSpec = defineFeatureSpec({
 export type ${className}State = FeatureState<typeof featureSpec>;
 
 @Injectable({ scope: "request" })
-@Query({ name: "${name}.list" })
+@Query({ name: "${name}.list", tenantScope: "required" })
 export class List${className}Query {
     constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
     execute(input: ${className}ListInput): Promise<${className}Result[]> {
@@ -26367,6 +26398,7 @@ export class List${className}Query {
     transaction: "required",
     audit: ${JSON.stringify(`${name}.approved`)},
     idempotency: "required",
+    tenantScope: "required",
     rpc: ${JSON.stringify(rpc)},
 })
 export class Approve${className}Command {
@@ -26378,11 +26410,17 @@ export class Approve${className}Command {
 
 @Job({
     name: ${JSON.stringify(`${name}.refresh`)},
+    input: ${className}RefreshInput,
     mode: "task",
     idempotency: "required",
+    tenantScope: "required",
 })
 export class Refresh${className}Job {
-    run(_input: { id: string; version: number }): Promise<void> {
+    constructor(@Inject(JOB_CONTEXT) private readonly jobContext: unknown) {}
+
+    async run(_input: ${className}RefreshJobInput): Promise<void> {
+        const context: FeatureRequestContext = requireFeatureRequestContext(this.jobContext);
+        void context;
         throw new Error("Bind the existing Workflow/Queue adapter before dispatching ${name}.refresh");
     }
 }
@@ -26400,7 +26438,7 @@ export class ${className}Controller {
         responses: { 200: ${className}ListResponse },
         effect: { required: true, dependencies: [], errors: [], retry: "none" },
     })
-    list(@Query("state") state?: string): Effect.Effect<${className}Result[], never, never> {
+    list(@Query("state") state?: ${className}State): Effect.Effect<${className}Result[], never, never> {
         return Effect.promise(() => this.listQuery.execute(state === undefined ? {} : { state }));
     }
 
@@ -26438,10 +26476,27 @@ export const ${className}Feature = defineFeatureSlice({
 });
 `,
     [`${name}.feature.test.ts`]: `import { expect, test } from "bun:test";
+import { Refresh${className}Job } from "./${name}.feature";
 import { ${className}Service } from "./${name}.service";
+import { ${className}Fixture, ${className}RequestContext, ${className}RequestEnvelope } from "./${name}.fixture";
+
+test("${name} rejects missing trusted tenant context before adapter execution", async () => {
+    let calls = 0;
+    const service = new ${className}Service(undefined, {
+        list: async () => { calls++; return []; },
+        detail: async () => { calls++; return { id: "example", state: "draft", version: 1 }; },
+    });
+    await expect(service.list({})).rejects.toThrow("FEATURE_CONTEXT_REQUIRED");
+    expect(calls).toBe(0);
+});
+
+test("${name} rejects missing trusted job context before dispatch", async () => {
+    const job = new Refresh${className}Job({});
+    await expect(job.run({ id: "example", version: 1 })).rejects.toThrow("FEATURE_CONTEXT_REQUIRED");
+});
 
 test("${name} fails closed until verified read and durable write ports are bound", async () => {
-    const service = new ${className}Service();
+    const service = new ${className}Service(${className}RequestEnvelope);
     await expect(service.list({})).rejects.toThrow("Bind ${className}Reader");
     await expect(service.detail("example")).rejects.toThrow("Bind ${className}Reader");
     await expect(service.approve("example", { expectedVersion: 1 })).rejects.toThrow("Bind ${className}Writer");
@@ -26450,7 +26505,7 @@ test("${name} fails closed until verified read and durable write ports are bound
 test("${name} preserves denied reads and rejected writes without fallback or retry", async () => {
     const denied = new Error("denied");
     let attempts = 0;
-    const service = new ${className}Service({
+    const service = new ${className}Service(${className}RequestEnvelope, {
         list: async () => { throw denied; },
         detail: async () => { throw denied; },
     }, {
@@ -26463,14 +26518,150 @@ test("${name} preserves denied reads and rejected writes without fallback or ret
 });
 
 test("${name} forwards the authoritative version and result without inventing persistence", async () => {
-    const row = { id: "example", state: "approved", version: 2 };
-    const service = new ${className}Service(undefined, {
-        async approve(input) {
-            expect(input).toEqual({ id: "example", expectedVersion: 1, reason: "reviewed" });
+    const row = { id: ${className}Fixture.id, state: "approved", version: 2 };
+    const service = new ${className}Service(${className}RequestEnvelope, undefined, {
+        async approve(requestContext, input) {
+            expect(requestContext).toMatchObject(${className}RequestContext);
+            expect(input).toEqual({ id: ${className}Fixture.id, ...${className}Fixture.approve });
             return row;
         },
     });
-    expect(await service.approve("example", { expectedVersion: 1, reason: "reviewed" })).toBe(row);
+    expect(await service.approve(${className}Fixture.id, ${className}Fixture.approve)).toBe(row);
+});
+`,
+    [`${name}.fixture.ts`]: `import type { ${className}ApproveInput, ${className}Result } from "./${name}.model";
+
+/**
+ * Test data only. Production adapters must load authoritative rows and
+ * identity from the database/authentication boundary.
+ */
+export const ${className}Fixture = {
+    id: "example",
+    approve: { expectedVersion: 1, reason: "reviewed" } satisfies ${className}ApproveInput,
+    row: { id: "example", state: "draft", version: 1 } satisfies ${className}Result,
+} as const;
+
+export const ${className}RequestContext = {
+    requestId: "request-example",
+    tenantId: "tenant-example",
+    actorId: "reviewer-example",
+    permissions: [${JSON.stringify(permission)}],
+} as const;
+
+export const ${className}RequestEnvelope = {
+    ...${className}RequestContext,
+    identity: { authenticated: true, subject: "reviewer-example" },
+    access: { tenantId: "tenant-example", permissions: [${JSON.stringify(permission)}] },
+} as const satisfies Record<string, unknown>;
+`,
+    [`${name}.e2e.test.ts`]: `import { expect, test } from "bun:test";
+import { ${className}Fixture } from "./${name}.fixture";
+
+const baseUrl = process.env["SUPACLOUD_FEATURE_E2E_URL"];
+const authorization = process.env["SUPACLOUD_FEATURE_E2E_AUTHORIZATION"];
+const otherAuthorization = process.env["SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION"];
+const fixtureId = process.env["SUPACLOUD_FEATURE_E2E_ID"] ?? ${className}Fixture.id;
+const idempotencyKey = process.env["SUPACLOUD_FEATURE_E2E_IDEMPOTENCY_KEY"];
+const enabled = Boolean(baseUrl && authorization && idempotencyKey);
+const tenantIsolationEnabled = Boolean(enabled && otherAuthorization);
+
+function requireConfig(): { baseUrl: string; authorization: string; idempotencyKey: string } {
+    if (!baseUrl || !authorization || !idempotencyKey) {
+        throw new Error(
+            "Set SUPACLOUD_FEATURE_E2E_URL, SUPACLOUD_FEATURE_E2E_AUTHORIZATION and " +
+            "SUPACLOUD_FEATURE_E2E_IDEMPOTENCY_KEY before running this generated E2E test.",
+        );
+    }
+    return { baseUrl, authorization, idempotencyKey };
+}
+
+async function json(response: Response): Promise<unknown> {
+    const text = await response.text();
+    if (!text) return undefined;
+    try {
+        return JSON.parse(text) as unknown;
+    } catch {
+        return text;
+    }
+}
+
+function containsFixture(value: unknown): boolean {
+    return JSON.stringify(value).includes(fixtureId);
+}
+
+test.skipIf(!enabled)("${name} authenticated list/detail/approval E2E", async () => {
+    const config = requireConfig();
+    const headers = { authorization: config.authorization, "content-type": "application/json" };
+    const list = await fetch(new URL("/${name}", config.baseUrl), { headers });
+    expect(list.ok).toBe(true);
+    const detail = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId), config.baseUrl),
+        { headers },
+    );
+    expect(detail.ok).toBe(true);
+    const approve = (key: string, body = ${className}Fixture.approve) => fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/approve", config.baseUrl),
+        {
+            method: "POST",
+            headers: { ...headers, "idempotency-key": key },
+            body: JSON.stringify(body),
+        },
+    );
+    const first = await approve(config.idempotencyKey);
+    const firstBody = await json(first);
+    expect([200, 409, 422]).toContain(first.status);
+
+    // Replaying an identical command may return the original success or a
+    // domain conflict, but it must never create a second successful transition.
+    const replay = await approve(config.idempotencyKey);
+    const replayBody = await json(replay);
+    expect(replay.status).toBe(first.status);
+    expect(replayBody).toEqual(firstBody);
+
+    // Reusing a key with a different payload must be rejected by the receipt
+    // boundary instead of being treated as a new approval.
+    const conflicting = await approve(
+        config.idempotencyKey,
+        { ...${className}Fixture.approve, reason: "conflicting replay" },
+    );
+    expect([400, 409, 422]).toContain(conflicting.status);
+
+    // Two distinct keys racing on one version may commit at most one state
+    // transition. A fixture that is already terminal may reject both.
+    const [raceA, raceB] = await Promise.all([
+        approve(config.idempotencyKey + "-race-a"),
+        approve(config.idempotencyKey + "-race-b"),
+    ]);
+    expect([raceA.status, raceB.status].filter((status) => status >= 200 && status < 300).length)
+        .toBeLessThanOrEqual(1);
+});
+
+test.skipIf(!tenantIsolationEnabled)("${name} rejects cross-tenant access", async () => {
+    const config = requireConfig();
+    if (!otherAuthorization) throw new Error("Missing SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION");
+    const headers = {
+        authorization: otherAuthorization,
+        "content-type": "application/json",
+    };
+    const list = await fetch(new URL("/${name}", config.baseUrl), { headers });
+    expect(list.ok).toBe(true);
+    expect(containsFixture(await json(list))).toBe(false);
+
+    const detail = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId), config.baseUrl),
+        { headers },
+    );
+    expect([403, 404]).toContain(detail.status);
+
+    const approval = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/approve", config.baseUrl),
+        {
+            method: "POST",
+            headers: { ...headers, "idempotency-key": config.idempotencyKey + "-other-tenant" },
+            body: JSON.stringify(${className}Fixture.approve),
+        },
+    );
+    expect([403, 404]).toContain(approval.status);
 });
 `,
     [`${name}.deployment.md`]: `# ${className} feature delivery checklist
@@ -26485,6 +26676,9 @@ test("${name} forwards the authoritative version and result without inventing pe
 
 The scaffold does not create migrations, infer permissions, or provide an in-memory
 production fallback. Database migrations remain the database source of truth.
+Every adapter receives a trusted framework context whose tenant and actor values
+come from verified identity/access data. Do not add tenant, actor, or permission
+fields to the request body as a substitute for this context.
 The HTTP schemas describe the boundary, not a second database model. Bind their
 fields to the existing database-source contract checker before delivery.
 The Writer input is derived from the approval body contract plus the route ID.
@@ -26492,6 +26686,11 @@ Add request fields in the contract, not a second handwritten Writer interface.
 Typecheck application adapters after changing a field type; the derived Port
 must expose incompatible assumptions in business code.
 
+For authenticated tenant-isolation acceptance, also provide
+\`SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION\` for a principal from another tenant.
+The generated E2E then verifies that the fixture is absent from list results and that
+cross-tenant detail and approval are rejected.
+
 The named RPC adapter must invoke the continuation in the same database transaction
 used by the request-scoped Writer, or own the complete command instead; never execute
 both paths. Lock/check the version and state, reauthorize replays, and commit the
@@ -26683,14 +26882,15 @@ async function runLocalDevelopment(options) {
 }
 
 // src/shared/tools/app-verification-plan.ts
-import { readdir as readdir4, realpath as realpath3 } from "node:fs/promises";
+import { readdir as readdir4, realpath as realpath3, stat } from "node:fs/promises";
 import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve16 } from "node:path";
 function inside2(root, file) {
   const path = relative5(root, file).replaceAll("\\", "/");
   return path !== ".." && !path.startsWith("../") && !isAbsolute4(path);
 }
 async function createVerificationPlan(root, graph, target, sourceRoot = root) {
-  const owners = graph.modules.filter((module) => module.name === target || module.className === target || [...module.providers, ...module.controllers, ...module.commands, ...module.jobs ?? [], ...module.queries ?? []].some((item) => ("className" in item) && item.className === target || ("name" in item) && item.name === target || ("token" in item) && item.token === target || ("useClass" in item) && item.useClass === target));
+  const exact = graph.modules.filter((module) => module.name === target);
+  const owners = exact.length > 0 ? exact : graph.modules.filter((module) => module.className === target || [...module.providers, ...module.controllers, ...module.commands, ...module.jobs ?? [], ...module.queries ?? []].some((item) => ("className" in item) && item.className === target || ("name" in item) && item.name === target || ("token" in item) && item.token === target || ("useClass" in item) && item.useClass === target || ("serviceKey" in item) && item.serviceKey === target));
   if (owners.length !== 1)
     throw new Error("Select one unambiguous module or owned symbol for verification");
   const owner = owners[0];
@@ -26707,37 +26907,50 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     ...(owner.jobs ?? []).flatMap((item) => (item.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])),
     ...owner.controllers.flatMap((item) => item.routes.flatMap((route) => (route.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])))
   ].filter((file) => typeof file === "string");
-  const directories = [...new Set(sources.map((file) => dirname7(resolve16(sourceRoot, file))))].sort();
-  const tests = new Set;
   const manual = [];
-  const coverage = [];
-  for (const directory of directories) {
-    if (!inside2(requestedRoot, directory)) {
-      manual.push("A source directory is outside the project; select its owning project explicitly");
+  const validatedSources = [];
+  for (const source of new Set(sources)) {
+    const requested = resolve16(sourceRoot, source);
+    if (!inside2(requestedRoot, requested)) {
+      manual.push("A source file is outside the project; select its owning project explicitly");
       continue;
     }
-    const actual = await realpath3(directory).catch((error) => {
+    const actual = await realpath3(requested).catch((error) => {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return null;
       throw error;
     });
     if (actual === null) {
-      manual.push(`Source directory is missing: ${relative5(requestedRoot, directory).replaceAll("\\", "/")}`);
+      manual.push(`Source file is missing: ${relative5(requestedRoot, requested).replaceAll("\\", "/")}`);
       continue;
     }
     if (!inside2(project, actual)) {
+      manual.push("A source file is outside the project; select its owning project explicitly");
+      continue;
+    }
+    if (!(await stat(actual)).isFile()) {
+      manual.push(`Source is not a regular file: ${relative5(requestedRoot, requested).replaceAll("\\", "/")}`);
+      continue;
+    }
+    validatedSources.push(actual);
+  }
+  const directories = [...new Set(validatedSources.map((file) => dirname7(file)))].sort();
+  const tests = new Set;
+  const coverage = [];
+  for (const directory of directories) {
+    if (!inside2(project, await realpath3(directory))) {
       manual.push("A source directory is outside the project; select its owning project explicitly");
       continue;
     }
     const local = [];
-    for (const entry of await readdir4(actual, { withFileTypes: true })) {
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-        const file = relative5(project, resolve16(actual, entry.name)).replaceAll("\\", "/");
+        const file = relative5(project, resolve16(directory, entry.name)).replaceAll("\\", "/");
         tests.add(file);
         local.push(file);
       }
     }
-    const path = relative5(project, actual).replaceAll("\\", "/") || ".";
+    const path = relative5(project, directory).replaceAll("\\", "/") || ".";
     coverage.push({ directory: path, tests: local.sort(), basis: "colocated-not-proven" });
     if (!local.length)
       manual.push(`No colocated tests for source directory: ${path}`);
@@ -26752,7 +26965,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     source: "declaration",
     target: owner.name,
     ready: manual.length === 0,
-    files: [...new Set(sources.map((file) => relative5(requestedRoot, resolve16(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
+    files: [...new Set(validatedSources.map((file) => relative5(project, file).replaceAll("\\", "/")))].sort(),
     tests: selected.slice(0, 32),
     commands: selected.length <= 32 ? [
       ...selected.map((file) => ["bun", "test", `./${file}`]),
@@ -27288,16 +27501,19 @@ async function projectCompileConfig(args) {
 }
 async function readAllowedDependencies(root) {
   const path = join13(root, "package.json");
-  if (!existsSync11(path))
-    return { dependencies: [], devDependencies: [] };
+  if (!existsSync11(path)) {
+    return { dependencies: [], devDependencies: [], optionalDependencies: [], peerDependencies: [] };
+  }
   try {
     const parsed = JSON.parse(await readFile4(path, "utf8"));
     return {
       dependencies: Object.keys(parsed.dependencies ?? {}).sort(),
-      devDependencies: Object.keys(parsed.devDependencies ?? {}).sort()
+      devDependencies: Object.keys(parsed.devDependencies ?? {}).sort(),
+      optionalDependencies: Object.keys(parsed.optionalDependencies ?? {}).sort(),
+      peerDependencies: Object.keys(parsed.peerDependencies ?? {}).sort()
     };
   } catch {
-    return { dependencies: [], devDependencies: [] };
+    return { dependencies: [], devDependencies: [], optionalDependencies: [], peerDependencies: [] };
   }
 }
 function formatModuleContextPack(pack) {
@@ -27398,6 +27614,9 @@ async function runContext(args) {
     `  modules: ${project.modules.map((module) => module.name).join(", ") || "-"}`,
     `  external tokens: ${project.externalTokens.join(", ") || "-"}`,
     `  dependencies: ${project.allowedDependencies.dependencies.join(", ") || "-"}`,
+    `  dev dependencies: ${project.allowedDependencies.devDependencies.join(", ") || "-"}`,
+    `  optional dependencies: ${project.allowedDependencies.optionalDependencies.join(", ") || "-"}`,
+    `  peer dependencies: ${project.allowedDependencies.peerDependencies.join(", ") || "-"}`,
     ...project.diagnostics.map(formatDiagnostic)
   ].join(`
 `));
@@ -32364,7 +32583,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.103.6",
+  version: "0.104.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -32416,19 +32635,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.47.2",
-    "@supacloud/delivery": "0.19.3",
-    "@supacloud/db": "0.18.3",
+    "@supacloud/compiler": "^0.48.0",
+    "@supacloud/delivery": "0.20.0",
+    "@supacloud/db": "0.19.0",
     typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.11.4",
-    "@supacloud/delivery": "0.19.3",
+    "@supacloud/contracts": "0.12.0",
+    "@supacloud/delivery": "0.20.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
     "@supabase/supabase-js": "2.117.3",
-    "@supacloud/elysia": "0.33.4",
+    "@supacloud/elysia": "0.34.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",

package/dist/shared/tools/app-feature.d.ts

@@ -1,7 +1,6 @@
 /**
- * An editable vertical feature slice. The generated ports are deliberately
- * fail-closed: database access, authorization and durable command adapters
- * remain application-owned and cannot be fabricated by the scaffold.
+ * An editable vertical feature slice. Persistence remains application-owned,
+ * while every generated port receives the trusted framework request context.
  */
 export declare function featureScaffold(name: string, className: string, governance: {
     permission: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.103.6",
+  "version": "0.104.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,19 +52,19 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.47.2",
-    "@supacloud/delivery": "0.19.3",
-    "@supacloud/db": "0.18.3",
+    "@supacloud/compiler": "^0.48.0",
+    "@supacloud/delivery": "0.20.0",
+    "@supacloud/db": "0.19.0",
     "typebox": "1.3.37"
   },
   "overrides": {
-    "@supacloud/contracts": "0.11.4",
-    "@supacloud/delivery": "0.19.3",
+    "@supacloud/contracts": "0.12.0",
+    "@supacloud/delivery": "0.20.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.117.3",
-    "@supacloud/elysia": "0.33.4",
+    "@supacloud/elysia": "0.34.0",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
     "elysia": "2.0.0-beta.32",