@supacloud/cli 0.103.7 → 0.105.0

package/dist/index.js

@@ -9405,9 +9405,9 @@ var $pack = require_pack();
 var FRONTEND_ARCHIVE_FORMAT = "tar.zst";
 var FRONTEND_ARCHIVE_RELEASE_SCHEMA = "supacloud.frontend-release.v2";
 var FRONTEND_ARCHIVE_CONTENT_TYPE = "application/vnd.supacloud.frontend.tar+zstd";
-var FRONTEND_ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
+var FRONTEND_ARCHIVE_MAX_BYTES = 500 * 1024 * 1024;
 var FRONTEND_ARCHIVE_MAX_FILES = 1e4;
-var FRONTEND_ARCHIVE_MAX_SOURCE_BYTES = 300 * 1024 * 1024;
+var FRONTEND_ARCHIVE_MAX_SOURCE_BYTES = 500 * 1024 * 1024;
 var FRONTEND_ARCHIVE_MAX_TAR_BYTES = FRONTEND_ARCHIVE_MAX_SOURCE_BYTES + FRONTEND_ARCHIVE_MAX_FILES * 2048 + 1024;
 function assertFrontendArchivePath(path) {
   if (!path || path.length > 1024 || Buffer.byteLength(path) > 4096 || path.startsWith("/") || path.includes("\\") || /[\u0000-\u001f\u007f]/u.test(path) || path.split("/").some((segment) => !segment || segment === "." || segment === "..") || /^[A-Za-z]:/u.test(path))
@@ -9996,6 +9996,7 @@ var reference = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za
 var references = _Array_(reference, { uniqueItems: true });
 var kind = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
 var isolation = Union([Literal("shared"), Literal("process")]);
+var mode = Union([Literal("required"), Literal("none")]);
 var DeliveryFilePathSchema = String2({
   maxLength: 512,
   pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
@@ -10069,6 +10070,7 @@ var routeSchema = _Object_({
   ]),
   path: String2(),
   command: Optional(String2()),
+  idempotency: Optional(mode),
   reason: Union([Literal("default-http"), Literal("explicit-module")])
 }, objectOptions);
 var jobSchema = _Object_({
@@ -10213,7 +10215,8 @@ var DeliveryBuildManifestSchema = _Object_({
   routes: _Array_(_Object_({
     method: String2(),
     path: String2(),
-    target: String2()
+    target: String2(),
+    idempotency: Optional(Union([Literal("required"), Literal("none")]))
   }, closed2)),
   jobs: _Array_(_Object_({ name: String2(), target: String2() }, closed2))
 }, closed2);
@@ -10275,7 +10278,12 @@ function parseDeliveryBuildManifest(value) {
       throw new Error("Invalid delivery object inventory.");
     }
   }
-  const routes = value.plan.targets.flatMap((target) => target.routes.map((route) => ({ method: route.method, path: route.path, target: target.name })));
+  const routes = value.plan.targets.flatMap((target) => target.routes.map((route) => ({
+    method: route.method,
+    path: route.path,
+    target: target.name,
+    ...route.idempotency === undefined ? {} : { idempotency: route.idempotency }
+  })));
   const jobs = value.plan.targets.flatMap((target) => target.jobs.map((job) => ({ name: job.name, target: target.name })));
   if (canonical(value.routes) !== canonical(routes) || canonical(value.jobs) !== canonical(jobs)) {
     throw new Error("Delivery mappings do not match planned ownership.");
@@ -10285,6 +10293,8 @@ function parseDeliveryBuildManifest(value) {
 
 // node_modules/@supacloud/delivery/src/delivery-artifact.ts
 var JSON_LIMIT = 1048576;
+var DELIVERY_ARTIFACT_MAX_FILE_BYTES = 500 * 1024 * 1024;
+var DELIVERY_ARTIFACT_MAX_TOTAL_BYTES = 500 * 1024 * 1024;
 async function readDeliveryManifest(manifestPath) {
   const selected = resolve4(manifestPath);
   const root = await realpath2(dirname2(selected));
@@ -10298,7 +10308,7 @@ async function readDeliverySelection(manifestPath, target) {
   return { root, object, planned };
 }
 async function readVerifiedDeliveryFiles(root, object, target, selectedPaths) {
-  if (object.files.length > 1024 || object.files.some((file) => file.bytes > 64 * 1024 * 1024) || object.files.reduce((bytes, file) => bytes + file.bytes, 0) > 128 * 1024 * 1024) {
+  if (object.files.length > 1024 || object.files.some((file) => file.bytes > DELIVERY_ARTIFACT_MAX_FILE_BYTES) || object.files.reduce((bytes, file) => bytes + file.bytes, 0) > DELIVERY_ARTIFACT_MAX_TOTAL_BYTES) {
     throw new Error("Artifact inventory exceeds limits.");
   }
   const objectRoot = join2(root, "objects", object.objectId);
@@ -11420,7 +11430,7 @@ function buildDeliveryMigrationPlan(archive, inventory, ref) {
 // node_modules/@supacloud/delivery/src/index.ts
 async function readDeliveryExecutableArchive(manifestPath) {
   const { root, manifest } = await readDeliveryManifest(manifestPath);
-  if (manifest.objects.length === 0 || manifest.objects.length > 32 || manifest.objects.some((object) => object.entryKind === "compiled-module-factory") || manifest.objects.reduce((total, object) => total + object.files.reduce((bytes, file) => bytes + file.bytes, 0), 0) > 128 * 1024 * 1024) {
+  if (manifest.objects.length === 0 || manifest.objects.length > 32 || manifest.objects.some((object) => object.entryKind === "compiled-module-factory") || manifest.objects.reduce((total, object) => total + object.files.reduce((bytes, file) => bytes + file.bytes, 0), 0) > DELIVERY_ARTIFACT_MAX_TOTAL_BYTES) {
     throw new Error("Invalid executable delivery inventory.");
   }
   const objects = [];
@@ -21479,9 +21489,13 @@ function uniqueToolName(name, moduleName, used) {
 }
 function findRouteForCommand(manifest, commandClassName) {
   for (const module of manifest.modules) {
+    const command = module.commands.find((candidate) => candidate.className === commandClassName || candidate.name === commandClassName);
+    if (!command)
+      continue;
     for (const controller of module.controllers) {
       for (const route of controller.routes) {
-        if (route.command !== commandClassName)
+        const transition = module.featureSpec?.transitions.find((candidate) => candidate.route !== undefined && (candidate.command === command.className || candidate.command === command.name) && candidate.route === `${route.method} ${controller.path}${route.path}`);
+        if (route.command !== command.className && route.command !== command.name && transition === undefined)
           continue;
         return {
           httpMethod: route.method,
@@ -21574,25 +21588,25 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.47.3"
+      version: "0.49.0"
     },
     app: {
-      version: "0.28.3",
+      version: "0.30.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.33.5"
+      version: "0.35.0"
     },
     commands: {
-      version: "0.9.7"
+      version: "0.11.0"
     },
     contracts: {
-      version: "0.11.5"
+      version: "0.13.0"
     },
     db: {
-      version: "0.18.4",
+      version: "0.20.0",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21601,7 +21615,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.43.4",
+      version: "0.45.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -26246,8 +26260,12 @@ function featureScaffold(name, className, governance) {
 export const ${className}Params = t.Object({
     id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
 });
+export const ${className}ReceiptParams = t.Object({
+    id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
+    operationId: t.String({ minLength: 1, maxLength: 512, pattern: "^[A-Za-z0-9._:-]+$" }),
+});
 export const ${className}ListQuery = t.Object({
-    state: t.Optional(t.String({ minLength: 1, maxLength: 64 })),
+    state: t.Optional(t.Union([t.Literal("draft"), t.Literal("approved")])),
 });
 export const ${className}ApproveBody = t.Object({
     expectedVersion: t.Integer({ minimum: 1 }),
@@ -26258,13 +26276,50 @@ export const ${className}Row = t.Object({
     state: t.String(),
     version: t.Integer({ minimum: 1 }),
 });
+export const ${className}Receipt = t.Object({
+    operationId: t.String({ minLength: 1, maxLength: 512 }),
+    status: t.Union([
+        t.Literal("pending"), t.Literal("confirmed"), t.Literal("failed"), t.Literal("unknown"),
+    ]),
+    state: t.String(),
+    version: t.Integer({ minimum: 1 }),
+});
+export const ${className}JobStatus = t.Object({
+    operationId: t.String({ minLength: 1, maxLength: 512 }),
+    status: t.Union([
+        t.Literal("queued"), t.Literal("running"), t.Literal("completed"),
+        t.Literal("failed"), t.Literal("cancelled"), t.Literal("unknown"),
+    ]),
+    errorCode: t.Optional(t.String({ minLength: 1, maxLength: 128 })),
+});
+/** Query tags are explicit cache contracts; use them with @supacloud/query. */
+export const ${className}QueryTags = {
+    list: ${JSON.stringify(`${name}.list`)},
+    detail: ${JSON.stringify(`${name}.detail`)},
+    receipt: ${JSON.stringify(`${name}.receipt`)},
+} as const;
+export const ${className}ApproveInvalidateTags = [
+    ${className}QueryTags.list,
+    ${className}QueryTags.detail,
+    ${className}QueryTags.receipt,
+] as const;
 export const ${className}ListResponse = t.Array(${className}Row);
+export const ${className}RefreshInput = t.Object({
+    id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
+    version: t.Integer({ minimum: 1 }),
+});
 `,
-    [`${name}.model.ts`]: `import { InjectionToken } from "@supacloud/app/core";
+    [`${name}.model.ts`]: `import {
+    InjectionToken, type FeatureRequestContext,
+} from "@supacloud/app/core";
 import type {
     ${className}ApproveBody,
     ${className}ListQuery,
+    ${className}Receipt,
+    ${className}ReceiptParams,
+    ${className}JobStatus,
     ${className}Row,
+    ${className}RefreshInput,
 } from "./${name}.contracts";
 import type { StaticDecode } from "typebox";
 
@@ -26272,14 +26327,25 @@ export type ${className}ListInput = StaticDecode<typeof ${className}ListQuery>;
 export type ${className}ApproveInput = StaticDecode<typeof ${className}ApproveBody>;
 export type ${className}ApproveCommand = ${className}ApproveInput & { id: string };
 export type ${className}Result = StaticDecode<typeof ${className}Row>;
+export type ${className}ReceiptResult = StaticDecode<typeof ${className}Receipt>;
+export type ${className}RefreshJobInput = StaticDecode<typeof ${className}RefreshInput>;
+export type ${className}JobStatusResult = StaticDecode<typeof ${className}JobStatus>;
 
 export interface ${className}ReadPort {
-    list(input: ${className}ListInput): Promise<${className}Result[]>;
-    detail(id: string): Promise<${className}Result>;
+    list(context: FeatureRequestContext, input: ${className}ListInput): Promise<${className}Result[]>;
+    detail(context: FeatureRequestContext, id: string): Promise<${className}Result>;
 }
 
 export interface ${className}WritePort {
-    approve(input: ${className}ApproveCommand): Promise<${className}Result>;
+    approve(context: FeatureRequestContext, input: ${className}ApproveCommand): Promise<${className}Result>;
+}
+
+export interface ${className}ReceiptPort {
+    lookup(context: FeatureRequestContext, input: { id: string; operationId: string }): Promise<${className}ReceiptResult>;
+}
+
+export interface ${className}JobStatusPort {
+    lookup(context: FeatureRequestContext, input: { id: string; operationId: string }): Promise<${className}JobStatusResult>;
 }
 
 export const ${className}Reader = new InjectionToken<${className}ReadPort>(
@@ -26288,63 +26354,117 @@ export const ${className}Reader = new InjectionToken<${className}ReadPort>(
 export const ${className}Writer = new InjectionToken<${className}WritePort>(
     "${name}.writer", { scope: "request" },
 );
+export const ${className}Receipts = new InjectionToken<${className}ReceiptPort>(
+    "${name}.receipts", { scope: "request" },
+);
+export const ${className}JobStatuses = new InjectionToken<${className}JobStatusPort>(
+    "${name}.job-statuses", { scope: "request" },
+);
 `,
-    [`${name}.service.ts`]: `import { Inject, Injectable, Optional } from "@supacloud/app/core";
+    [`${name}.service.ts`]: `import {
+    Inject, Injectable, Optional, REQUEST_CONTEXT, requireFeatureRequestContext,
+    type FeatureRequestContext,
+} from "@supacloud/app/core";
 import {
     ${className}Reader,
+    ${className}JobStatuses,
+    ${className}Receipts,
     ${className}Writer,
     type ${className}ApproveInput,
     type ${className}ReadPort,
     type ${className}Result,
+    type ${className}ReceiptPort,
+    type ${className}JobStatusPort,
+    type ${className}JobStatusResult,
     type ${className}WritePort,
 } from "./${name}.model";
 
 @Injectable({ scope: "request" })
 export class ${className}Service {
     constructor(
+        @Inject(REQUEST_CONTEXT) private readonly requestContext: unknown,
         @Inject(${className}Reader) @Optional() private readonly reader?: ${className}ReadPort,
         @Inject(${className}Writer) @Optional() private readonly writer?: ${className}WritePort,
+        @Inject(${className}Receipts) @Optional() private readonly receipts?: ${className}ReceiptPort,
+        @Inject(${className}JobStatuses) @Optional() private readonly jobStatuses?: ${className}JobStatusPort,
     ) {}
 
-    async list(input: Parameters<${className}ReadPort["list"]>[0]): Promise<${className}Result[]> {
+    private context(): FeatureRequestContext {
+        return requireFeatureRequestContext(this.requestContext);
+    }
+
+    async list(input: Parameters<${className}ReadPort["list"]>[1]): Promise<${className}Result[]> {
         if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
-        return this.reader.list(input);
+        return this.reader.list(this.context(), input);
     }
 
     async detail(id: string): Promise<${className}Result> {
         if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
-        return this.reader.detail(id);
+        return this.reader.detail(this.context(), id);
     }
 
     async approve(id: string, input: ${className}ApproveInput): Promise<${className}Result> {
         if (!this.writer) throw new Error("Bind ${className}Writer with durable command governance");
-        return this.writer.approve({ ...input, id });
+        return this.writer.approve(this.context(), { ...input, id });
+    }
+
+    async receipt(id: string, operationId: string): Promise<Awaited<ReturnType<${className}ReceiptPort["lookup"]>>> {
+        if (!this.receipts) throw new Error("Bind ${className}Receipts with durable receipt lookup");
+        return this.receipts.lookup(this.context(), { id, operationId });
+    }
+
+    async jobStatus(id: string, operationId: string): Promise<${className}JobStatusResult> {
+        if (!this.jobStatuses) throw new Error("Bind ${className}JobStatuses with the existing Workflow/Queue status adapter");
+        return this.jobStatuses.lookup(this.context(), { id, operationId });
     }
 }
 `,
     [`${name}.feature.ts`]: `import { Effect } from "effect";
 import {
-    Body, Command, Controller, defineFeatureSlice, defineFeatureSpec, Get, Inject,
-    Injectable, Job, Param, Post, Query, type FeatureState,
+    Body, Command, Controller, defineFeatureSlice, defineFeatureSpec, Get, Inject, JOB_CONTEXT,
+    Injectable, Job, Param, Post, Query, requireFeatureRequestContext, type FeatureRequestContext,
+    type FeatureState,
 } from "@supacloud/app/core";
 import {
     ${className}ApproveBody,
     ${className}ListQuery,
+    ${className}Receipt,
+    ${className}ReceiptParams,
+    ${className}JobStatus,
     ${className}ListResponse,
     ${className}Params,
+    ${className}RefreshInput,
     ${className}Row,
 } from "./${name}.contracts";
 import { ${className}Service } from "./${name}.service";
-import type { ${className}ApproveInput, ${className}ListInput, ${className}Result } from "./${name}.model";
+import type {
+    ${className}ApproveInput,
+    ${className}ListInput,
+    ${className}ReceiptResult,
+    ${className}JobStatusResult,
+    ${className}RefreshJobInput,
+    ${className}Result,
+} from "./${name}.model";
 
 export const featureSpec = defineFeatureSpec({
     name: ${JSON.stringify(name)},
     states: ["draft", "approved"],
+    tenantField: "tenant_id",
     transitions: {
         approve: {
             from: "draft", to: "approved", command: "Approve${className}Command",
             permission: ${JSON.stringify(permission)}, transaction: "required",
             idempotency: "required", audit: ${JSON.stringify(`${name}.approved`)},
+            job: ${JSON.stringify(`${name}.refresh`)},
+            invalidateTags: [
+                ${JSON.stringify(`${name}.list`)},
+                ${JSON.stringify(`${name}.detail`)},
+                ${JSON.stringify(`${name}.receipt`)},
+            ],
+            persistence: {
+                boundary: "database", optimisticLock: "required", versionField: "version", tenantField: "tenant_id", stateField: "state",
+                receipt: "required", reconciliation: "none",
+            },
             route: "POST /${name}/:id/approve",
         },
     },
@@ -26352,7 +26472,7 @@ export const featureSpec = defineFeatureSpec({
 export type ${className}State = FeatureState<typeof featureSpec>;
 
 @Injectable({ scope: "request" })
-@Query({ name: "${name}.list" })
+@Query({ name: "${name}.list", tenantScope: "required" })
 export class List${className}Query {
     constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
     execute(input: ${className}ListInput): Promise<${className}Result[]> {
@@ -26367,6 +26487,7 @@ export class List${className}Query {
     transaction: "required",
     audit: ${JSON.stringify(`${name}.approved`)},
     idempotency: "required",
+    tenantScope: "required",
     rpc: ${JSON.stringify(rpc)},
 })
 export class Approve${className}Command {
@@ -26378,11 +26499,17 @@ export class Approve${className}Command {
 
 @Job({
     name: ${JSON.stringify(`${name}.refresh`)},
+    input: ${className}RefreshInput,
     mode: "task",
     idempotency: "required",
+    tenantScope: "required",
 })
 export class Refresh${className}Job {
-    run(_input: { id: string; version: number }): Promise<void> {
+    constructor(@Inject(JOB_CONTEXT) private readonly jobContext: unknown) {}
+
+    async run(_input: ${className}RefreshJobInput): Promise<void> {
+        const context: FeatureRequestContext = requireFeatureRequestContext(this.jobContext);
+        void context;
         throw new Error("Bind the existing Workflow/Queue adapter before dispatching ${name}.refresh");
     }
 }
@@ -26397,15 +26524,17 @@ export class ${className}Controller {
 
     @Get("/", {
         query: ${className}ListQuery,
+        tags: [${JSON.stringify(`${name}.list`)}],
         responses: { 200: ${className}ListResponse },
         effect: { required: true, dependencies: [], errors: [], retry: "none" },
     })
-    list(@Query("state") state?: string): Effect.Effect<${className}Result[], never, never> {
+    list(@Query("state") state?: ${className}State): Effect.Effect<${className}Result[], never, never> {
         return Effect.promise(() => this.listQuery.execute(state === undefined ? {} : { state }));
     }
 
     @Get("/:id", {
         params: ${className}Params,
+        tags: [${JSON.stringify(`${name}.detail`)}],
         responses: { 200: ${className}Row },
         effect: { required: true, dependencies: [], errors: [], retry: "none" },
     })
@@ -26418,6 +26547,7 @@ export class ${className}Controller {
         body: ${className}ApproveBody,
         responses: { 200: ${className}Row },
         command: Approve${className}Command,
+        idempotency: "required",
         effect: { required: true, dependencies: [], errors: [], retry: "none" },
     })
     approve(
@@ -26426,6 +26556,32 @@ export class ${className}Controller {
     ): Effect.Effect<${className}Result, never, never> {
         return Effect.promise(() => this.approveCommand.execute(id, body));
     }
+
+    @Get("/:id/operations/:operationId", {
+        params: ${className}ReceiptParams,
+        tags: [${JSON.stringify(`${name}.receipt`)}],
+        responses: { 200: ${className}Receipt },
+        effect: { required: true, dependencies: [], errors: [], retry: "none" },
+    })
+    receipt(
+        @Param("id") id: string,
+        @Param("operationId") operationId: string,
+    ): Effect.Effect<${className}ReceiptResult, never, never> {
+        return Effect.promise(() => this.service.receipt(id, operationId));
+    }
+
+    @Get("/:id/operations/:operationId/status", {
+        params: ${className}ReceiptParams,
+        tags: [${JSON.stringify(`${name}.job-status`)}],
+        responses: { 200: ${className}JobStatus },
+        effect: { required: true, dependencies: [], errors: [], retry: "none" },
+    })
+    jobStatus(
+        @Param("id") id: string,
+        @Param("operationId") operationId: string,
+    ): Effect.Effect<${className}JobStatusResult, never, never> {
+        return Effect.promise(() => this.service.jobStatus(id, operationId));
+    }
 }
 
 export const ${className}Feature = defineFeatureSlice({
@@ -26438,19 +26594,37 @@ export const ${className}Feature = defineFeatureSlice({
 });
 `,
     [`${name}.feature.test.ts`]: `import { expect, test } from "bun:test";
+import { Refresh${className}Job } from "./${name}.feature";
 import { ${className}Service } from "./${name}.service";
+import { ${className}Fixture, ${className}RequestContext, ${className}RequestEnvelope } from "./${name}.fixture";
+
+test("${name} rejects missing trusted tenant context before adapter execution", async () => {
+    let calls = 0;
+    const service = new ${className}Service(undefined, {
+        list: async () => { calls++; return []; },
+        detail: async () => { calls++; return { id: "example", state: "draft", version: 1 }; },
+    });
+    await expect(service.list({})).rejects.toThrow("FEATURE_CONTEXT_REQUIRED");
+    expect(calls).toBe(0);
+});
+
+test("${name} rejects missing trusted job context before dispatch", async () => {
+    const job = new Refresh${className}Job({});
+    await expect(job.run({ id: "example", version: 1 })).rejects.toThrow("FEATURE_CONTEXT_REQUIRED");
+});
 
 test("${name} fails closed until verified read and durable write ports are bound", async () => {
-    const service = new ${className}Service();
+    const service = new ${className}Service(${className}RequestEnvelope);
     await expect(service.list({})).rejects.toThrow("Bind ${className}Reader");
     await expect(service.detail("example")).rejects.toThrow("Bind ${className}Reader");
     await expect(service.approve("example", { expectedVersion: 1 })).rejects.toThrow("Bind ${className}Writer");
+    await expect(service.jobStatus("example", "operation-example")).rejects.toThrow("Bind ${className}JobStatuses");
 });
 
 test("${name} preserves denied reads and rejected writes without fallback or retry", async () => {
     const denied = new Error("denied");
     let attempts = 0;
-    const service = new ${className}Service({
+    const service = new ${className}Service(${className}RequestEnvelope, {
         list: async () => { throw denied; },
         detail: async () => { throw denied; },
     }, {
@@ -26463,14 +26637,166 @@ test("${name} preserves denied reads and rejected writes without fallback or ret
 });
 
 test("${name} forwards the authoritative version and result without inventing persistence", async () => {
-    const row = { id: "example", state: "approved", version: 2 };
-    const service = new ${className}Service(undefined, {
-        async approve(input) {
-            expect(input).toEqual({ id: "example", expectedVersion: 1, reason: "reviewed" });
+    const row = { id: ${className}Fixture.id, state: "approved", version: 2 };
+    const service = new ${className}Service(${className}RequestEnvelope, undefined, {
+        async approve(requestContext, input) {
+            expect(requestContext).toMatchObject(${className}RequestContext);
+            expect(input).toEqual({ id: ${className}Fixture.id, ...${className}Fixture.approve });
             return row;
         },
     });
-    expect(await service.approve("example", { expectedVersion: 1, reason: "reviewed" })).toBe(row);
+    expect(await service.approve(${className}Fixture.id, ${className}Fixture.approve)).toBe(row);
+});
+`,
+    [`${name}.fixture.ts`]: `import type { ${className}ApproveInput, ${className}Result } from "./${name}.model";
+
+/**
+ * Test data only. Production adapters must load authoritative rows and
+ * identity from the database/authentication boundary.
+ */
+export const ${className}Fixture = {
+    id: "example",
+    approve: { expectedVersion: 1, reason: "reviewed" } satisfies ${className}ApproveInput,
+    row: { id: "example", state: "draft", version: 1 } satisfies ${className}Result,
+} as const;
+
+export const ${className}RequestContext = {
+    requestId: "request-example",
+    tenantId: "tenant-example",
+    actorId: "reviewer-example",
+    permissions: [${JSON.stringify(permission)}],
+} as const;
+
+export const ${className}RequestEnvelope = {
+    ...${className}RequestContext,
+    identity: { authenticated: true, subject: "reviewer-example" },
+    access: { tenantId: "tenant-example", permissions: [${JSON.stringify(permission)}] },
+} as const satisfies Record<string, unknown>;
+`,
+    [`${name}.e2e.test.ts`]: `import { expect, test } from "bun:test";
+import { ${className}Fixture } from "./${name}.fixture";
+
+const baseUrl = process.env["SUPACLOUD_FEATURE_E2E_URL"];
+const authorization = process.env["SUPACLOUD_FEATURE_E2E_AUTHORIZATION"];
+const otherAuthorization = process.env["SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION"];
+const fixtureId = process.env["SUPACLOUD_FEATURE_E2E_ID"] ?? ${className}Fixture.id;
+const idempotencyKey = process.env["SUPACLOUD_FEATURE_E2E_IDEMPOTENCY_KEY"];
+const enabled = Boolean(baseUrl && authorization && idempotencyKey);
+const tenantIsolationEnabled = Boolean(enabled && otherAuthorization);
+
+function requireConfig(): { baseUrl: string; authorization: string; idempotencyKey: string } {
+    if (!baseUrl || !authorization || !idempotencyKey) {
+        throw new Error(
+            "Set SUPACLOUD_FEATURE_E2E_URL, SUPACLOUD_FEATURE_E2E_AUTHORIZATION and " +
+            "SUPACLOUD_FEATURE_E2E_IDEMPOTENCY_KEY before running this generated E2E test.",
+        );
+    }
+    return { baseUrl, authorization, idempotencyKey };
+}
+
+async function json(response: Response): Promise<unknown> {
+    const text = await response.text();
+    if (!text) return undefined;
+    try {
+        return JSON.parse(text) as unknown;
+    } catch {
+        return text;
+    }
+}
+
+function containsFixture(value: unknown): boolean {
+    return JSON.stringify(value).includes(fixtureId);
+}
+
+test.skipIf(!enabled)("${name} authenticated list/detail/approval E2E", async () => {
+    const config = requireConfig();
+    const headers = { authorization: config.authorization, "content-type": "application/json" };
+    const list = await fetch(new URL("/${name}", config.baseUrl), { headers });
+    expect(list.ok).toBe(true);
+    const detail = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId), config.baseUrl),
+        { headers },
+    );
+    expect(detail.ok).toBe(true);
+    const approve = (key: string, body = ${className}Fixture.approve) => fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/approve", config.baseUrl),
+        {
+            method: "POST",
+            headers: { ...headers, "idempotency-key": key },
+            body: JSON.stringify(body),
+        },
+    );
+    const first = await approve(config.idempotencyKey);
+    const firstBody = await json(first);
+    expect([200, 409, 422]).toContain(first.status);
+
+    // A lost response is recovered through the durable receipt, never by
+    // submitting the approval again.
+    const recovered = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/operations/" + encodeURIComponent(config.idempotencyKey), config.baseUrl),
+        { headers },
+    );
+    expect(recovered.ok).toBe(true);
+    const recoveredBody = await json(recovered);
+    expect(recoveredBody).toMatchObject({ operationId: config.idempotencyKey });
+    const jobStatus = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/operations/" + encodeURIComponent(config.idempotencyKey) + "/status", config.baseUrl),
+        { headers },
+    );
+    expect(jobStatus.ok).toBe(true);
+    expect(await json(jobStatus)).toMatchObject({ operationId: config.idempotencyKey });
+
+    // Replaying an identical command may return the original success or a
+    // domain conflict, but it must never create a second successful transition.
+    const replay = await approve(config.idempotencyKey);
+    const replayBody = await json(replay);
+    expect(replay.status).toBe(first.status);
+    expect(replayBody).toEqual(firstBody);
+
+    // Reusing a key with a different payload must be rejected by the receipt
+    // boundary instead of being treated as a new approval.
+    const conflicting = await approve(
+        config.idempotencyKey,
+        { ...${className}Fixture.approve, reason: "conflicting replay" },
+    );
+    expect([400, 409, 422]).toContain(conflicting.status);
+
+    // Two distinct keys racing on one version may commit at most one state
+    // transition. A fixture that is already terminal may reject both.
+    const [raceA, raceB] = await Promise.all([
+        approve(config.idempotencyKey + "-race-a"),
+        approve(config.idempotencyKey + "-race-b"),
+    ]);
+    expect([raceA.status, raceB.status].filter((status) => status >= 200 && status < 300).length)
+        .toBeLessThanOrEqual(1);
+});
+
+test.skipIf(!tenantIsolationEnabled)("${name} rejects cross-tenant access", async () => {
+    const config = requireConfig();
+    if (!otherAuthorization) throw new Error("Missing SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION");
+    const headers = {
+        authorization: otherAuthorization,
+        "content-type": "application/json",
+    };
+    const list = await fetch(new URL("/${name}", config.baseUrl), { headers });
+    expect(list.ok).toBe(true);
+    expect(containsFixture(await json(list))).toBe(false);
+
+    const detail = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId), config.baseUrl),
+        { headers },
+    );
+    expect([403, 404]).toContain(detail.status);
+
+    const approval = await fetch(
+        new URL("/${name}/" + encodeURIComponent(fixtureId) + "/approve", config.baseUrl),
+        {
+            method: "POST",
+            headers: { ...headers, "idempotency-key": config.idempotencyKey + "-other-tenant" },
+            body: JSON.stringify(${className}Fixture.approve),
+        },
+    );
+    expect([403, 404]).toContain(approval.status);
 });
 `,
     [`${name}.deployment.md`]: `# ${className} feature delivery checklist
@@ -26479,12 +26805,19 @@ test("${name} forwards the authoritative version and result without inventing pe
 - [ ] Bind ${className}Writer to a transactional RPC or persistent Command adapter.
 - [ ] Register the \`${rpc}\` compiler and runtime RPC capability.
 - [ ] Verify RLS, permission denial, stale version, identical replay and conflicting replay.
+- [ ] Verify receipt lookup recovers a lost response without resubmitting the Command.
+- [ ] Pass \`${className}ApproveInvalidateTags\` to the generated mutation's \`invalidateTags\` option.
+- [ ] Bind \`${className}JobStatuses\` to the existing Workflow/Queue status read path.
+- [ ] Verify status lookup is tenant-scoped and distinguishes queued, running, completed, failed and cancelled.
 - [ ] Verify the refresh job uses the existing Workflow/Queue delivery path.
 - [ ] Run the generated client contract and authenticated E2E test.
 - [ ] Run \`supacloud app check --format json\`, package tests and the selected deployment receipt.
 
 The scaffold does not create migrations, infer permissions, or provide an in-memory
 production fallback. Database migrations remain the database source of truth.
+Every adapter receives a trusted framework context whose tenant and actor values
+come from verified identity/access data. Do not add tenant, actor, or permission
+fields to the request body as a substitute for this context.
 The HTTP schemas describe the boundary, not a second database model. Bind their
 fields to the existing database-source contract checker before delivery.
 The Writer input is derived from the approval body contract plus the route ID.
@@ -26492,15 +26825,24 @@ Add request fields in the contract, not a second handwritten Writer interface.
 Typecheck application adapters after changing a field type; the derived Port
 must expose incompatible assumptions in business code.
 
+For authenticated tenant-isolation acceptance, also provide
+\`SUPACLOUD_FEATURE_E2E_OTHER_AUTHORIZATION\` for a principal from another tenant.
+The generated E2E then verifies that the fixture is absent from list results and that
+cross-tenant detail and approval are rejected.
+
 The named RPC adapter must invoke the continuation in the same database transaction
 used by the request-scoped Writer, or own the complete command instead; never execute
 both paths. Lock/check the version and state, reauthorize replays, and commit the
 business write, receipt, audit and outbox together. Do not put a network side effect
 inside this transaction. The refresh Job is an explicit unimplemented integration
-point, not an automatically scheduled workflow.
+point, not an automatically scheduled workflow. The generated status route is also
+an explicit read adapter boundary; it does not treat a queue message ID or current
+business row as proof of task completion.
 
 Compile the routes with the existing client generator and use @supacloud/query for
-identity-scoped caching/invalidation. There is deliberately no second hand-maintained
+identity-scoped caching/invalidation. Use the generated \`${className}ApproveInvalidateTags\`
+constant for the approval mutation; tags are explicit and never inferred from route names.
+There is deliberately no second hand-maintained
 HTTP client. A committed approval followed by a failed refresh is still committed;
 recover its receipt instead of resending. Use the host's standard error translation
 and requestId propagation; the scaffold does not claim to implement those adapters.
@@ -26683,7 +27025,7 @@ async function runLocalDevelopment(options) {
 }
 
 // src/shared/tools/app-verification-plan.ts
-import { readdir as readdir4, realpath as realpath3 } from "node:fs/promises";
+import { readdir as readdir4, realpath as realpath3, stat } from "node:fs/promises";
 import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve16 } from "node:path";
 function inside2(root, file) {
   const path = relative5(root, file).replaceAll("\\", "/");
@@ -26708,37 +27050,50 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     ...(owner.jobs ?? []).flatMap((item) => (item.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])),
     ...owner.controllers.flatMap((item) => item.routes.flatMap((route) => (route.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])))
   ].filter((file) => typeof file === "string");
-  const directories = [...new Set(sources.map((file) => dirname7(resolve16(sourceRoot, file))))].sort();
-  const tests = new Set;
   const manual = [];
-  const coverage = [];
-  for (const directory of directories) {
-    if (!inside2(requestedRoot, directory)) {
-      manual.push("A source directory is outside the project; select its owning project explicitly");
+  const validatedSources = [];
+  for (const source of new Set(sources)) {
+    const requested = resolve16(sourceRoot, source);
+    if (!inside2(requestedRoot, requested)) {
+      manual.push("A source file is outside the project; select its owning project explicitly");
       continue;
     }
-    const actual = await realpath3(directory).catch((error) => {
+    const actual = await realpath3(requested).catch((error) => {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return null;
       throw error;
     });
     if (actual === null) {
-      manual.push(`Source directory is missing: ${relative5(requestedRoot, directory).replaceAll("\\", "/")}`);
+      manual.push(`Source file is missing: ${relative5(requestedRoot, requested).replaceAll("\\", "/")}`);
       continue;
     }
     if (!inside2(project, actual)) {
+      manual.push("A source file is outside the project; select its owning project explicitly");
+      continue;
+    }
+    if (!(await stat(actual)).isFile()) {
+      manual.push(`Source is not a regular file: ${relative5(requestedRoot, requested).replaceAll("\\", "/")}`);
+      continue;
+    }
+    validatedSources.push(actual);
+  }
+  const directories = [...new Set(validatedSources.map((file) => dirname7(file)))].sort();
+  const tests = new Set;
+  const coverage = [];
+  for (const directory of directories) {
+    if (!inside2(project, await realpath3(directory))) {
       manual.push("A source directory is outside the project; select its owning project explicitly");
       continue;
     }
     const local = [];
-    for (const entry of await readdir4(actual, { withFileTypes: true })) {
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-        const file = relative5(project, resolve16(actual, entry.name)).replaceAll("\\", "/");
+        const file = relative5(project, resolve16(directory, entry.name)).replaceAll("\\", "/");
         tests.add(file);
         local.push(file);
       }
     }
-    const path = relative5(project, actual).replaceAll("\\", "/") || ".";
+    const path = relative5(project, directory).replaceAll("\\", "/") || ".";
     coverage.push({ directory: path, tests: local.sort(), basis: "colocated-not-proven" });
     if (!local.length)
       manual.push(`No colocated tests for source directory: ${path}`);
@@ -26753,7 +27108,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     source: "declaration",
     target: owner.name,
     ready: manual.length === 0,
-    files: [...new Set(sources.map((file) => relative5(requestedRoot, resolve16(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
+    files: [...new Set(validatedSources.map((file) => relative5(project, file).replaceAll("\\", "/")))].sort(),
     tests: selected.slice(0, 32),
     commands: selected.length <= 32 ? [
       ...selected.map((file) => ["bun", "test", `./${file}`]),
@@ -27289,16 +27644,19 @@ async function projectCompileConfig(args) {
 }
 async function readAllowedDependencies(root) {
   const path = join13(root, "package.json");
-  if (!existsSync11(path))
-    return { dependencies: [], devDependencies: [] };
+  if (!existsSync11(path)) {
+    return { dependencies: [], devDependencies: [], optionalDependencies: [], peerDependencies: [] };
+  }
   try {
     const parsed = JSON.parse(await readFile4(path, "utf8"));
     return {
       dependencies: Object.keys(parsed.dependencies ?? {}).sort(),
-      devDependencies: Object.keys(parsed.devDependencies ?? {}).sort()
+      devDependencies: Object.keys(parsed.devDependencies ?? {}).sort(),
+      optionalDependencies: Object.keys(parsed.optionalDependencies ?? {}).sort(),
+      peerDependencies: Object.keys(parsed.peerDependencies ?? {}).sort()
     };
   } catch {
-    return { dependencies: [], devDependencies: [] };
+    return { dependencies: [], devDependencies: [], optionalDependencies: [], peerDependencies: [] };
   }
 }
 function formatModuleContextPack(pack) {
@@ -27399,6 +27757,9 @@ async function runContext(args) {
     `  modules: ${project.modules.map((module) => module.name).join(", ") || "-"}`,
     `  external tokens: ${project.externalTokens.join(", ") || "-"}`,
     `  dependencies: ${project.allowedDependencies.dependencies.join(", ") || "-"}`,
+    `  dev dependencies: ${project.allowedDependencies.devDependencies.join(", ") || "-"}`,
+    `  optional dependencies: ${project.allowedDependencies.optionalDependencies.join(", ") || "-"}`,
+    `  peer dependencies: ${project.allowedDependencies.peerDependencies.join(", ") || "-"}`,
     ...project.diagnostics.map(formatDiagnostic)
   ].join(`
 `));
@@ -32365,7 +32726,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.103.7",
+  version: "0.105.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -32417,19 +32778,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.47.3",
-    "@supacloud/delivery": "0.19.4",
-    "@supacloud/db": "0.18.4",
+    "@supacloud/compiler": "^0.49.0",
+    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.0",
     typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/delivery": "0.19.4",
+    "@supacloud/contracts": "0.13.0",
+    "@supacloud/delivery": "0.21.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
     "@supabase/supabase-js": "2.117.3",
-    "@supacloud/elysia": "0.33.5",
+    "@supacloud/elysia": "0.35.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",

package/dist/shared/tools/app-feature.d.ts

@@ -1,7 +1,6 @@
 /**
- * An editable vertical feature slice. The generated ports are deliberately
- * fail-closed: database access, authorization and durable command adapters
- * remain application-owned and cannot be fabricated by the scaffold.
+ * An editable vertical feature slice. Persistence remains application-owned,
+ * while every generated port receives the trusted framework request context.
  */
 export declare function featureScaffold(name: string, className: string, governance: {
     permission: string;

package/dist/shared/tools/app-tool-export.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.103.7",
+  "version": "0.105.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,19 +52,19 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.47.3",
-    "@supacloud/delivery": "0.19.4",
-    "@supacloud/db": "0.18.4",
+    "@supacloud/compiler": "^0.49.0",
+    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.0",
     "typebox": "1.3.37"
   },
   "overrides": {
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/delivery": "0.19.4",
+    "@supacloud/contracts": "0.13.0",
+    "@supacloud/delivery": "0.21.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.117.3",
-    "@supacloud/elysia": "0.33.5",
+    "@supacloud/elysia": "0.35.0",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
     "elysia": "2.0.0-beta.32",