@supacloud/cli 0.68.2 → 0.69.0

package/dist/index.js

@@ -216908,7 +216908,7 @@ function registerAiTools(server2) {
 // src/shared/tools/app-tools.ts
 import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 import { mkdir as mkdir6, readFile as readFile9, readdir as readdir6, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname13, join as join16, relative as relative13, resolve as resolve21 } from "node:path";
+import { basename as basename8, dirname as dirname13, join as join16, relative as relative13, resolve as resolve23 } from "node:path";
 
 // node_modules/@supacloud/compiler/dist/index.js
 import { dirname as dirname22, relative as relative6, sep as sep4 } from "node:path";
@@ -216919,8 +216919,8 @@ var ts10 = __toESM(require_typescript(), 1);
 var ts11 = __toESM(require_typescript(), 1);
 var import_graphql64 = __toESM(require_graphql2(), 1);
 import { extname as extname3 } from "node:path";
-import { resolve as resolve42 } from "node:path";
 import { resolve as resolve52 } from "node:path";
+import { resolve as resolve62 } from "node:path";
 import { createHash as createHash52 } from "node:crypto";
 import { readFile as readFile2 } from "node:fs/promises";
 import { relative as relative42, sep as sep42 } from "node:path";
@@ -219314,14 +219314,14 @@ var findTransformedDefinitions = (visitedResult) => {
 import { createHash as createHash7 } from "node:crypto";
 import { constants as constants2 } from "node:fs";
 import { lstat as lstat2, mkdir as mkdir22, open as open3, readFile as readFile3, readdir as readdir3, realpath as realpath3, rename as rename22, rm as rm2, writeFile as writeFile22 } from "node:fs/promises";
-import { dirname as dirname42, isAbsolute as isAbsolute5, join as join52, relative as relative52, resolve as resolve72, sep as sep5 } from "node:path";
+import { dirname as dirname42, isAbsolute as isAbsolute5, join as join52, relative as relative52, resolve as resolve82, sep as sep5 } from "node:path";
 import { existsSync as existsSync32 } from "node:fs";
 import { dirname as dirname52, join as join62, relative as relative62, sep as sep6 } from "node:path";
 import { isAbsolute as isAbsolute22 } from "node:path";
 var ts15 = __toESM(require_typescript(), 1);
 import { createHash as createHash8, randomUUID } from "node:crypto";
 import { lstat as lstat22, readFile as readFile6, realpath as realpath4, rename as rename4, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute32, relative as relative8, resolve as resolve122, sep as sep8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute32, relative as relative8, resolve as resolve13, sep as sep8 } from "node:path";
 var ts17 = __toESM(require_typescript(), 1);
 var ts7 = __toESM(require_typescript(), 1);
 var ts2 = __toESM(require_typescript(), 1);
@@ -219334,7 +219334,7 @@ import { createHash as createHash32 } from "node:crypto";
 import { relative as relative22, resolve as resolvePath, sep as sep22 } from "node:path";
 import { createHash as createHash22 } from "node:crypto";
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join10, resolve as resolve13 } from "node:path";
+import { dirname as dirname6, join as join10, resolve as resolve14 } from "node:path";
 import { createHash as createHash9 } from "node:crypto";
 import { resolve as resolve22 } from "node:path";
 var ts9 = __toESM(require_typescript(), 1);
@@ -219345,21 +219345,22 @@ import { access as access2, readFile as readFile22 } from "node:fs/promises";
 import { join as join42 } from "node:path";
 import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
 import { dirname as dirname32, join as join32, relative as relative32, resolve as resolve32, sep as sep32 } from "node:path";
+import { resolve as resolve42 } from "node:path";
 import { mkdir as mkdir3, mkdtemp, readFile as readFile5, realpath as realpath32, rename as rename3, rm as rm22 } from "node:fs/promises";
 import { readFileSync as readFileSync32 } from "node:fs";
-import { dirname as dirname7, join as join92, relative as relative7, resolve as resolve112, sep as sep7 } from "node:path";
+import { dirname as dirname7, join as join92, relative as relative7, resolve as resolve122, sep as sep7 } from "node:path";
 var ts13 = __toESM(require_typescript(), 1);
 var ts12 = __toESM(require_typescript(), 1);
-import { join as join72, resolve as resolve82 } from "node:path";
-import { resolve as resolve102 } from "node:path";
+import { join as join72, resolve as resolve92 } from "node:path";
+import { resolve as resolve112 } from "node:path";
 import { existsSync as existsSync42, watch } from "node:fs";
-import { dirname as dirname9, relative as relative10, resolve as resolve14, sep as sep10 } from "node:path";
+import { dirname as dirname9, relative as relative10, resolve as resolve15, sep as sep10 } from "node:path";
 import { createHash as createHash92 } from "node:crypto";
 import { access as access3, readdir as readdir32, readFile as readFile7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute42, relative as relative9, resolve as resolve132, sep as sep9 } from "node:path";
+import { isAbsolute as isAbsolute42, relative as relative9, resolve as resolve142, sep as sep9 } from "node:path";
 var ts16 = __toESM(require_typescript(), 1);
 import { existsSync as existsSync52 } from "node:fs";
-import { join as join11, resolve as resolve19 } from "node:path";
+import { join as join11, resolve as resolve20 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var __defProp2 = Object.defineProperty;
 var __returnValue2 = (v) => v;
@@ -220734,9 +220735,9 @@ function renderApplication(graph, options) {
     "}",
     "",
     "export async function initializeApplication(services: Record<string, unknown>): Promise<void> {",
-    '  const initializers = [services.environmentInitializer ?? services["supacloud.environment-initializer"], services.appInitializer ?? services["supacloud.app-initializer"]];',
+    '  const initializers = [services["environmentInitializer"] ?? services["supacloud.environment-initializer"], services["appInitializer"] ?? services["supacloud.app-initializer"]];',
     "  for (const group of initializers) {",
-    "    if (Array.isArray(group)) {",
+    "    if (isUnknownArray(group)) {",
     "      for (const init of group) {",
     "        if (isFunction(init)) await init();",
     "      }",
@@ -220747,21 +220748,21 @@ function renderApplication(graph, options) {
     "}",
     "",
     "export async function destroyApplication(services: Record<string, unknown>): Promise<void> {",
-    '  const destroyRef = (Object.prototype.propertyIsEnumerable.call(services, "destroyRef") ? services.destroyRef : undefined)',
+    '  const destroyRef = (Object.prototype.propertyIsEnumerable.call(services, "destroyRef") ? services["destroyRef"] : undefined)',
     '    ?? (Object.prototype.propertyIsEnumerable.call(services, "supacloud.destroy-ref") ? services["supacloud.destroy-ref"] : undefined);',
-    "  if (isRecord(destroyRef) && isFunction(destroyRef.destroy)) {",
-    "    await destroyRef.destroy();",
-    "  } else if (isRecord(destroyRef) && Array.isArray(destroyRef._teardowns)) {",
-    "    for (const teardown of [...destroyRef._teardowns].reverse()) {",
+    '  if (isRecord(destroyRef) && isFunction(destroyRef["destroy"])) {',
+    '    await destroyRef["destroy"]();',
+    '  } else if (isRecord(destroyRef) && isUnknownArray(destroyRef["_teardowns"])) {',
+    '    for (const teardown of [...destroyRef["_teardowns"]].reverse()) {',
     "      if (isFunction(teardown)) await teardown();",
     "    }",
     "  }",
     "  const instances = Object.values(services);",
     "  for (const inst of instances.reverse()) {",
-    "    if (isRecord(inst) && isFunction(inst.onDestroy)) {",
-    "      await inst.onDestroy();",
-    "    } else if (isRecord(inst) && isFunction(inst.ngOnDestroy)) {",
-    "      await inst.ngOnDestroy();",
+    '    if (isRecord(inst) && isFunction(inst["onDestroy"])) {',
+    '      await inst["onDestroy"]();',
+    '    } else if (isRecord(inst) && isFunction(inst["ngOnDestroy"])) {',
+    '      await inst["ngOnDestroy"]();',
     "    }",
     "  }",
     "}",
@@ -221155,7 +221156,7 @@ class ModuleGenerator {
           return "undefined";
         });
         const callArgs = invokerArgs.length > 0 ? invokerArgs.join(", ") : "req";
-        fields.push(`invoker: async (ctrl: unknown, req: { params?: Record<string, unknown>; query?: Record<string, unknown>; body?: unknown; headers?: Record<string, unknown>; cookie?: Record<string, unknown>; context?: unknown }) => { ` + `if (!isRecord(ctrl)) throw new TypeError("Route controller is not an object"); ` + `const handler = ctrl[${JSON.stringify(route.handler)}]; ` + `if (typeof handler !== "function") throw new TypeError("Route handler ${route.handler} is not callable"); ` + `return await Reflect.apply(handler, ctrl, [${callArgs}]); }`);
+        fields.push(`invoker: async (ctrl: unknown, req: { params?: Record<string, unknown>; query?: Record<string, unknown>; body?: unknown; headers?: Record<string, unknown>; cookie?: Record<string, unknown>; context?: unknown }) => { ` + `if (!isRecord(ctrl)) throw new TypeError("Route controller is not an object"); ` + `const handler = ctrl[${JSON.stringify(route.handler)}]; ` + `if (!isFunction(handler)) throw new TypeError("Route handler ${route.handler} is not callable"); ` + `return await Reflect.apply(handler, ctrl, [${callArgs}]); }`);
         if (route.contract !== undefined) {
           fields.push(`contract: ${JSON.stringify(route.contract)}`);
         }
@@ -221327,7 +221328,7 @@ ${indent3(item, 2)}`).join(",")}
         if (emitted.constLine)
           lines.push(emitted.constLine);
         if (scoped) {
-          lines.push(`scope[${JSON.stringify(emitted.key)}] = [...(Array.isArray(scope[${JSON.stringify(emitted.key)}]) ? scope[${JSON.stringify(emitted.key)}] : []), ${emitted.expr}];`);
+          lines.push(`scope[${JSON.stringify(emitted.key)}] = [...(isUnknownArray(scope[${JSON.stringify(emitted.key)}]) ? scope[${JSON.stringify(emitted.key)}] : []), ${emitted.expr}];`);
         }
         const list = multiGroups.get(emitted.key) ?? [];
         list.push(emitted.expr);
@@ -221369,14 +221370,14 @@ ${indent3(item, 2)}`).join(",")}
           continue;
         const key = camelName(token);
         const expression = this.depExpr(token, scopeKind, this.depOptions(node, token));
-        if (expression === `services.${key}` || expression === `(services.${key} ?? undefined)`) {
+        if (expression === `services[${JSON.stringify(key)}]` || expression === `(services[${JSON.stringify(key)}] ?? undefined)`) {
           if (!returns.has(key))
             borrowed.add(key);
         }
       }
     }
     if (borrowed.size > 0) {
-      const descriptors = [...borrowed].map((key) => `${key}: { value: deps.${key} }`);
+      const descriptors = [...borrowed].map((key) => `${key}: { value: deps[${JSON.stringify(key)}] }`);
       lines.push(`return retainPlatformDependencies(Object.defineProperties({ ${entries.join(", ")} }, { ${descriptors.join(", ")} }), deps);`);
     } else {
       lines.push(`return retainPlatformDependencies({ ${entries.join(", ")} }, deps);`);
@@ -221482,34 +221483,34 @@ ${indent3(item, 2)}`).join(",")}
       }
     }
     if (own && factoryOfScope(own.scope) === "services" && kind !== "services" && !isSkipSelf && !isSelf) {
-      return `services.${camelName(token)}`;
+      return `services[${JSON.stringify(camelName(token))}]`;
     }
     if (isSelf) {
-      return isOptional ? "undefined" : `services.${camelName(token)}`;
+      return isOptional ? "undefined" : `services[${JSON.stringify(camelName(token))}]`;
     }
     for (const importName of this.module.imports) {
       const imported = this.graph.modules.find((m) => m.name === importName);
       if (!imported?.exports.includes(token))
         continue;
       if (kind === "services")
-        return `imported.${importName}.${camelName(token)}`;
-      return `imported.${importName}.${camelName(token)}`;
+        return `imported[${JSON.stringify(importName)}][${JSON.stringify(camelName(token))}]`;
+      return `imported[${JSON.stringify(importName)}][${JSON.stringify(camelName(token))}]`;
     }
     for (const mod of this.graph.modules) {
       const rootProv = mod.providers.find((p) => p.token === token && p.providedIn === "root");
       if (rootProv) {
-        return `imported.${mod.name}.${camelName(token)}`;
+        return `imported[${JSON.stringify(mod.name)}][${JSON.stringify(camelName(token))}]`;
       }
     }
     if (isSelf)
-      return isOptional ? "undefined" : `services.${camelName(token)}`;
+      return isOptional ? "undefined" : `services[${JSON.stringify(camelName(token))}]`;
     if (kind === "services")
-      return isOptional ? `(deps.${camelName(token)} ?? undefined)` : `deps.${camelName(token)}`;
+      return isOptional ? `(deps[${JSON.stringify(camelName(token))}] ?? undefined)` : `deps[${JSON.stringify(camelName(token))}]`;
     if (isSkipSelf) {
-      const external = `platformDependencies.get(services)?.${camelName(token)}`;
+      const external = `platformDependencies.get(services)?.[${JSON.stringify(camelName(token))}]`;
       return isOptional ? `(${external} ?? undefined)` : external;
     }
-    return isOptional ? `(services.${camelName(token)} ?? undefined)` : `services.${camelName(token)}`;
+    return isOptional ? `(services[${JSON.stringify(camelName(token))}] ?? undefined)` : `services[${JSON.stringify(camelName(token))}]`;
   }
 }
 function orderProviders(providers) {
@@ -223026,9 +223027,13 @@ function isFunction(value: unknown): value is (...args: unknown[]) => unknown {
   return typeof value === "function";
 }
 
+function isUnknownArray(value: unknown): value is unknown[] {
+  return Array.isArray(value);
+}
+
 function resolveFactoryValue(value: unknown): unknown {
-  if (!isRecord(value) || !isFunction(value.factory)) return undefined;
-  return value.factory();
+  if (!isRecord(value) || !isFunction(value["factory"])) return undefined;
+  return value["factory"]();
 }
 
 const scopeDestructions = new WeakMap<object, Promise<void>>();
@@ -223051,14 +223056,14 @@ function destroyScopeInstances(
     for (const entry of [...plan].reverse()) {
       const value = scope[entry.key];
       const instance = entry.index === undefined ? value
-        : Array.isArray(value) ? value[entry.index] : undefined;
+        : isUnknownArray(value) ? value[entry.index] : undefined;
       if (seen.has(instance)) continue;
       seen.add(instance);
       try {
-        if (isRecord(instance) && isFunction(instance.onDestroy)) {
-          await instance.onDestroy();
-        } else if (isRecord(instance) && isFunction(instance.ngOnDestroy)) {
-          await instance.ngOnDestroy();
+        if (isRecord(instance) && isFunction(instance["onDestroy"])) {
+          await instance["onDestroy"]();
+        } else if (isRecord(instance) && isFunction(instance["ngOnDestroy"])) {
+          await instance["ngOnDestroy"]();
         }
       } catch (error) {
         errors.push(error);
@@ -223081,11 +223086,11 @@ async function initializeServiceInstances(
     const value = services[entry.key];
     const instance = entry.index === undefined
       ? value
-      : Array.isArray(value) ? value[entry.index] : undefined;
+      : isUnknownArray(value) ? value[entry.index] : undefined;
     if (seen.has(instance)) continue;
     seen.add(instance);
-    if (!isRecord(instance) || !isFunction(instance.onInit)) continue;
-    await instance.onInit();
+    if (!isRecord(instance) || !isFunction(instance["onInit"])) continue;
+    await instance["onInit"]();
   }
 }
 
@@ -223099,13 +223104,13 @@ async function destroyServiceInstances(
     const value = services[entry.key];
     const instance = entry.index === undefined
       ? value
-      : Array.isArray(value) ? value[entry.index] : undefined;
+      : isUnknownArray(value) ? value[entry.index] : undefined;
     if (seen.has(instance)) continue;
     seen.add(instance);
     if (!isRecord(instance)) continue;
-    const hook = isFunction(instance.onDestroy)
-      ? instance.onDestroy
-      : isFunction(instance.ngOnDestroy) ? instance.ngOnDestroy : undefined;
+    const hook = isFunction(instance["onDestroy"])
+      ? instance["onDestroy"]
+      : isFunction(instance["ngOnDestroy"]) ? instance["ngOnDestroy"] : undefined;
     if (!hook) continue;
     try {
       await hook.call(instance);
@@ -223337,16 +223342,16 @@ function graphqlInputPaths(options) {
   } catch {
     return [];
   }
-  const root = resolve42(options.rootDir);
-  const schema = resolve42(root, options.graphql.schema);
-  const documents = ts10.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve42(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve42(path)).filter((path) => path !== schema);
+  const root = resolve52(options.rootDir);
+  const schema = resolve52(root, options.graphql.schema);
+  const documents = ts10.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve52(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve52(path)).filter((path) => path !== schema);
   return [schema, ...[...new Set(documents)].sort()];
 }
 var init_graphql_inputs = __esm2(() => {
   init_graphql_options();
 });
 function renderGraphqlValidators(source, operationNames) {
-  const fileName = resolve52("/__supacloud_graphql__/contracts.ts");
+  const fileName = resolve62("/__supacloud_graphql__/contracts.ts");
   const options = {
     strict: true,
     noUncheckedIndexedAccess: true,
@@ -223362,7 +223367,7 @@ function renderGraphqlValidators(source, operationNames) {
   };
   const host = ts11.createCompilerHost(options);
   const getSourceFile = host.getSourceFile.bind(host);
-  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve52(path) === fileName ? ts11.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve62(path) === fileName ? ts11.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
   const program = ts11.createProgram([fileName], options, host);
   const diagnostics = ts11.getPreEmitDiagnostics(program);
   if (diagnostics.length) {
@@ -232775,7 +232780,7 @@ async function reserveOutput(project, requested) {
   if (!inside2(project, requested))
     throw new Error("Delivery output must be inside the application project.");
   const base = await realpath3(project);
-  const path = resolve72(base, relative52(project, requested));
+  const path = resolve82(base, relative52(project, requested));
   if (relative52(base, path).split(sep5).some((part) => part === ".git" || part === "node_modules")) {
     throw new Error("Delivery output cannot use repository or dependency internals.");
   }
@@ -234074,7 +234079,7 @@ async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
   const root = await realpath4(options.rootDir ?? process.cwd());
-  const file = resolve122(root, fix.targetFile);
+  const file = resolve13(root, fix.targetFile);
   const stat = await lstat22(file);
   const resolved = await realpath4(file);
   const relativePath = relative8(root, resolved);
@@ -234247,8 +234252,8 @@ function moduleObjects(source) {
 }
 function importSymbol(source, path, symbol) {
   identifier2(symbol);
-  const current = resolve122(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
-  const target = resolve122(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
+  const current = resolve13(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
+  const target = resolve13(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
   if (current === target)
     return source.text;
   const matches = source.statements.filter((item) => ts15.isImportDeclaration(item) && ts15.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
@@ -234464,7 +234469,7 @@ function decoratedDeclaration(decorator) {
   };
 }
 function createIncrementalProgramSession(projectRoot) {
-  const rootDir = resolve13(projectRoot);
+  const rootDir = resolve14(projectRoot);
   let projectConfig = readProjectConfig(rootDir);
   let projectConfigKey = configKey(projectConfig);
   let builder;
@@ -234493,8 +234498,8 @@ function createIncrementalProgramSession(projectRoot) {
       }
       projectConfig = nextProjectConfig;
       projectConfigKey = nextProjectConfigKey;
-      const normalizedRoots = [...new Set(rootNames.map((file) => resolve13(rootDir, file)))].sort();
-      const normalizedChanged = [...new Set(changedPaths.map((file) => resolve13(rootDir, file)))];
+      const normalizedRoots = [...new Set(rootNames.map((file) => resolve14(rootDir, file)))].sort();
+      const normalizedChanged = [...new Set(changedPaths.map((file) => resolve14(rootDir, file)))];
       const invalidatedPaths = new Set(normalizedChanged.map(canonical3));
       for (const sourceFile of oldSourceFiles.values()) {
         if (sourceVersion(sourceFile.fileName) !== sourceFileVersion(sourceFile)) {
@@ -234595,7 +234600,7 @@ function createHost(options, rootDir, sourceFileCache, invalidatedPaths, invalid
   return host;
 }
 function canonical3(fileName) {
-  const normalized = resolve13(fileName);
+  const normalized = resolve14(fileName);
   return ts2.sys.useCaseSensitiveFileNames ? normalized : normalized.toLowerCase();
 }
 function sourceFileParseKey(languageVersion) {
@@ -237651,6 +237656,50 @@ function isAnyKeyword(node) {
   return node.kind === ts9.SyntaxKind.AnyKeyword;
 }
 init_route_contracts();
+function validateClientSchemaBoundaries(graph, options) {
+  if (!options.generateClient)
+    return [];
+  const identity = (path) => resolve42(options.rootDir, path).replace(/\.(?:[cm]?ts|[cm]?js)$/, "");
+  const runtimeModules = new Set(graph.modules.flatMap((module) => [
+    module.file,
+    ...module.controllers.map((controller) => controller.file),
+    ...module.providers.map((provider) => provider.file)
+  ]).filter((file) => typeof file === "string").map(identity));
+  const diagnostics = [];
+  const seen = new Set;
+  for (const module of graph.modules) {
+    for (const controller of module.controllers) {
+      for (const route of controller.routes) {
+        const symbols = [
+          route.body,
+          route.params,
+          route.query,
+          route.headers,
+          route.cookie,
+          ...route.responses && Object.keys(route.responses).length ? Object.values(route.responses) : [route.response]
+        ];
+        for (const symbol of symbols) {
+          if (!symbol)
+            continue;
+          const importedFrom = controller.schemaImports?.[symbol];
+          if (!importedFrom || !runtimeModules.has(identity(importedFrom)))
+            continue;
+          const key = `${identity(importedFrom)}:${symbol}`;
+          if (seen.has(key))
+            continue;
+          seen.add(key);
+          diagnostics.push({
+            severity: "warn",
+            code: "client-schema-runtime-import",
+            file: controller.file,
+            message: `Generated client schema "${symbol}" imports application runtime module "${importedFrom}". Move the schema to a shared contract-only module and import it into the controller. This also avoids checking server decorators in the browser TypeScript project.`
+          });
+        }
+      }
+    }
+  }
+  return diagnostics;
+}
 function withDefaultGovernance(options) {
   return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
     requirePersistentAdapters: true,
@@ -237668,7 +237717,8 @@ async function compileProject(options) {
   const graph = await analyzeProject(options.rootDir, options.include, options.cache, options.changedPaths);
   const diagnostics = [
     ...graph.diagnostics ?? [],
-    ...validateGraph(graph, options)
+    ...validateGraph(graph, options),
+    ...validateClientSchemaBoundaries(graph, options)
   ];
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, written: [] };
@@ -237731,7 +237781,8 @@ async function checkProject(options) {
   const graph = await analyzeProject(options.rootDir, options.include, options.cache, options.changedPaths);
   const diagnostics = [
     ...graph.diagnostics ?? [],
-    ...validateGraph(graph, options)
+    ...validateGraph(graph, options),
+    ...validateClientSchemaBoundaries(graph, options)
   ];
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, upToDate: false, mismatches: ["Runtime DI must be migrated to constructor injection."] };
@@ -238463,7 +238514,7 @@ async function prepareDeliveryMigrations(project, generatedRoot, declarations =
   const inputs = new Map;
   let totalBytes = 0;
   for (const declaration of [...declarations].sort((a, b) => BigInt(a.version) < BigInt(b.version) ? -1 : BigInt(a.version) > BigInt(b.version) ? 1 : 0)) {
-    const source = resolve102(project, declaration.source);
+    const source = resolve112(project, declaration.source);
     if (!inside2(project, source) || inside2(generatedRoot, source))
       throw new Error("Invalid migration source.");
     const bytes = await readBoundedOwned2(project, source, 1048576);
@@ -238512,7 +238563,7 @@ async function buildDeliveryProject(options, delivery) {
     const settings = parseDeliveryOptions(delivery);
     if (typeof Bun === "undefined")
       throw new Error("Independent delivery builds require Bun.");
-    const configPath = ts14.findConfigFile(resolve112(options.rootDir), ts14.sys.fileExists);
+    const configPath = ts14.findConfigFile(resolve122(options.rootDir), ts14.sys.fileExists);
     if (!configPath)
       throw new Error("Independent delivery builds require a project tsconfig.json.");
     const lexicalProject = dirname7(configPath);
@@ -238520,11 +238571,11 @@ async function buildDeliveryProject(options, delivery) {
     const sourceRoot = await realpath32(options.rootDir);
     if (!inside2(project, sourceRoot))
       throw new Error("Application sources must be inside the project.");
-    const requested = resolve112(options.outDir, "delivery");
+    const requested = resolve122(options.outDir, "delivery");
     if (!inside2(lexicalProject, requested))
       throw new Error("Output must be inside the application project.");
-    const buildRoot = resolve112(project, relative7(lexicalProject, requested));
-    const generatedRoot = resolve112(project, relative7(lexicalProject, options.outDir));
+    const buildRoot = resolve122(project, relative7(lexicalProject, requested));
+    const generatedRoot = resolve122(project, relative7(lexicalProject, options.outDir));
     if (inside2(generatedRoot, sourceRoot))
       throw new Error("Output must not contain the application source root.");
     const configInputs = new Map;
@@ -238532,7 +238583,7 @@ async function buildDeliveryProject(options, delivery) {
       ...ts14.sys,
       readFile(path) {
         const contents = readFileSync32(path, "utf8");
-        configInputs.set(resolve112(path), digest3(contents));
+        configInputs.set(resolve122(path), digest3(contents));
         return contents;
       },
       onUnRecoverableConfigFileDiagnostic() {
@@ -238570,7 +238621,7 @@ async function buildDeliveryProject(options, delivery) {
         if (!target || (kind === "worker" ? target.kind !== "jobs" : target.kind === "jobs")) {
           throw new Error("Delivery host kind does not match its target.");
         }
-        const path = resolve112(sourceRoot, app.source);
+        const path = resolve122(sourceRoot, app.source);
         if (inside2(generatedRoot, path) || !/\.[cm]?ts$/.test(path))
           throw new Error("Hosts require application TypeScript source.");
         hosts.set(app.target, { path, kind, hash: digest3(await readOwned(sourceRoot, path)) });
@@ -238697,7 +238748,7 @@ async function buildDeliveryProject(options, delivery) {
       }));
       const assetInputs = {};
       for (const asset of assets.filter((asset) => asset.target === target.name)) {
-        const path = resolve112(sourceRoot, asset.source);
+        const path = resolve122(sourceRoot, asset.source);
         const bytes = await readOwned(sourceRoot, path);
         const hash = digest3(bytes);
         const previousHash = snapshots.get(path);
@@ -238904,11 +238955,11 @@ async function readSourceBytes(path) {
   return readFile7(path);
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve132(options.rootDir);
-  const outDir = resolve132(options.outDir);
+  const rootDir = resolve142(options.rootDir);
+  const outDir = resolve142(options.outDir);
   const files = { ...previous.files };
   await Promise.all(changedPaths.map(async (changedPath) => {
-    const absolutePath = isAbsolute42(changedPath) ? resolve132(changedPath) : resolve132(rootDir, changedPath);
+    const absolutePath = isAbsolute42(changedPath) ? resolve142(changedPath) : resolve142(rootDir, changedPath);
     const relativeChangedPath = relative9(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep9}`))
       return;
@@ -238926,8 +238977,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve132(options.rootDir);
-  const outDir = resolve132(options.outDir);
+  const rootDir = resolve142(options.rootDir);
+  const outDir = resolve142(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   const entries = await Promise.all(paths.map(async (path) => {
@@ -238950,8 +239001,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve132(options.rootDir),
-    outDir: resolve132(options.outDir),
+    rootDir: resolve142(options.rootDir),
+    outDir: resolve142(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -238975,7 +239026,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir32(directory, { withFileTypes: true })) {
-      const path = resolve132(directory, entry.name);
+      const path = resolve142(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -239108,8 +239159,8 @@ function isCompilerConfigurationPath(rootDir, changedPath) {
   ].includes(relativePath) || /^tsconfig\.[^/]+\.json$/.test(relativePath);
 }
 function watchProject(options) {
-  const rootDir = resolve14(options.rootDir);
-  const outDir = resolve14(options.outDir);
+  const rootDir = resolve15(options.rootDir);
+  const outDir = resolve15(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -239119,7 +239170,7 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve14(rootDir, options.graphql.schema) : undefined;
+  const schemaPath = options.graphql ? resolve15(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -239229,7 +239280,7 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve14(rootDir, filename.toString());
+      const changedPath = resolve15(rootDir, filename.toString());
       const relativePath = relative10(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
@@ -239242,7 +239293,7 @@ function watchProject(options) {
       while (!existsSync42(directory) && dirname9(directory) !== directory)
         directory = dirname9(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve14(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve15(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -239367,8 +239418,8 @@ function validateGovernanceConfig(config) {
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve19(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve19(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve20(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve20(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -239386,7 +239437,7 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     graphql: resolved.graphql ? {
       ...resolved.graphql,
-      schema: resolve19(cwd, resolved.graphql.schema)
+      schema: resolve20(cwd, resolved.graphql.schema)
     } : undefined
   };
 }
@@ -239530,7 +239581,7 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.38.2"
+      version: "0.39.0"
     },
     app: {
       version: "0.23.0",
@@ -239539,7 +239590,7 @@ var starter_metadata_default = {
       }
     },
     elysia: {
-      version: "0.25.0"
+      version: "0.26.0"
     },
     commands: {
       version: "0.9.1"
@@ -239657,7 +239708,7 @@ test("cancelled stream consumers release their subscription", async () => {
 
 // src/shared/tools/app-starter.ts
 import { lstat as lstat3, mkdir as mkdir4, readdir as readdir4, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname10, join as join12, resolve as resolve15 } from "node:path";
+import { basename as basename7, dirname as dirname10, join as join12, resolve as resolve16 } from "node:path";
 
 // src/shared/tools/app-starter-environment.ts
 var STARTER_ENVIRONMENT = String.raw`import { existsSync, readFileSync } from "node:fs";
@@ -239959,14 +240010,15 @@ export default defineSupacloudConfig({
 function httpTemplate(name) {
   return {
     ...baseFiles(name),
-    "src/orders/orders.ts": `import { Body, Controller, Get, Param, Post, defineFeatureSlice } from "@supacloud/app";
-import { status, t } from "elysia";
-
+    "src/orders/contracts.ts": `import { t } from "elysia";
 export const OrderParams = t.Object({ id: t.String({ minLength: 1 }) });
 export const CreateOrderBody = t.Object({ name: t.String({ minLength: 1 }) });
 export const OrderResult = t.Object({ id: t.String(), name: t.String() });
 export const HealthResult = t.Object({ ok: t.Boolean() });
-
+`,
+    "src/orders/orders.ts": `import { Body, Controller, Get, Param, Post, defineFeatureSlice } from "@supacloud/app";
+import { status } from "elysia";
+import { OrderParams, CreateOrderBody, OrderResult, HealthResult } from "./contracts";
 @Controller("/orders")
 export class OrdersController {
   @Get("/health", { responses: { 200: HealthResult } })
@@ -240148,11 +240200,11 @@ supacloud doctor --root .
 function minimalTemplate(name, sdkDependencies) {
   return {
     ...baseFiles(name, sdkDependencies),
-    "src/features/health/health.ts": `import { Controller, Get, Module } from "@supacloud/app/core";
-import { t } from "elysia";
-
+    "src/features/health/contracts.ts": `import { t } from "elysia";
 export const HealthResult = t.Object({ ok: t.Boolean() });
-
+`,
+    "src/features/health/health.ts": `import { Controller, Get, Module } from "@supacloud/app/core";
+import { HealthResult } from "./contracts";
 @Controller("/health")
 export class HealthController {
   @Get("/", { responses: { 200: HealthResult } })
@@ -240693,7 +240745,7 @@ export async function createDeliveryWorker(modules: CompiledModule[], lifecycle:
 // src/shared/tools/app-starter-upload.ts
 var STARTER_UPLOAD_FEATURE = `import { Body, Controller, Inject, Injectable, Param, Post, DB_CLIENT, REQUEST_CONTEXT } from "@supacloud/app";
 import { ApplicationError } from "@supacloud/elysia";
-import { t } from "elysia";
+import { UploadBody, UploadLocation, UploadParams, UploadResult } from "./contracts";
 
 export interface ReviewUploadInput { reviewId: string; artifactId: string; expectedVersion: number }
 export interface ReviewUploadLocation { artifactId: string; bucketId: string; objectPath: string }
@@ -240702,18 +240754,6 @@ export interface ReviewUploadPort {
   previewUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadLocation>;
   registerUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadResult>;
 }
-export const UploadParams = t.Object({ id: t.String({ format: "uuid" }) });
-export const UploadBody = t.Object({
-  artifactId: t.String({ format: "uuid" }), expectedVersion: t.Integer({ minimum: 1 }),
-}, { additionalProperties: false });
-export const UploadLocation = t.Object({
-  artifactId: t.String({ format: "uuid" }), bucketId: t.String(), objectPath: t.String(),
-});
-export const UploadResult = t.Object({
-  artifactId: t.String({ format: "uuid" }), runId: t.String({ format: "uuid" }),
-  objectPath: t.String(), sha256: t.String({ pattern: "^[a-f0-9]{64}$" }), bytes: t.Integer({ minimum: 1, maximum: 1048576 }),
-});
-
 @Injectable({ scope: "request" })
 export class ReviewUploads {
   constructor(@Inject(DB_CLIENT) private readonly store: Partial<ReviewUploadPort>,
@@ -241706,7 +241746,7 @@ export function createCompiledModules(): never {
   defineFeatureSlice, defineFeatureSpec, type Aspect,
 } from "@supacloud/app";
 import { ApplicationError, assertFeatureTransition } from "@supacloud/elysia";
-import { t } from "elysia";
+import { ApproveBody, HealthResult, Params, ReviewResult } from "./contracts";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
 import type { ReviewRow } from "../../db/schema";
@@ -241731,14 +241771,6 @@ export interface ReviewStore extends Partial<ReviewUploadPort> {
   set(table: string, key: string, value: Review): void | Promise<void>;
 }
 
-export const Params = t.Object({ id: t.String({ minLength: 1 }) });
-export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1 }) });
-export const ReviewResult = t.Object({
-  state: t.Union([t.Literal("draft"), t.Literal("approved")]),
-  version: t.Integer({ minimum: 1 }),
-});
-export const HealthResult = t.Object({ ok: t.Boolean() });
-
 // Explicit, statically compiled AOP. Do not log identity, request bodies or secrets.
 export const requireRequest: Aspect = (context, next) => {
   if (!context.request) throw new ApplicationError("Request context required", { code: "REQUEST_REQUIRED" });
@@ -241795,6 +241827,26 @@ export const ReviewFeature = defineFeatureSlice({
 });
 `,
     "src/review/attachment.ts": STARTER_REVIEW_JOB,
+    "src/review/contracts.ts": `import { t } from "elysia";
+export const Params = t.Object({ id: t.String({ minLength: 1 }) });
+export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1 }) });
+export const ReviewResult = t.Object({
+  state: t.Union([t.Literal("draft"), t.Literal("approved")]),
+  version: t.Integer({ minimum: 1 }),
+});
+export const HealthResult = t.Object({ ok: t.Boolean() });
+export const UploadParams = t.Object({ id: t.String({ format: "uuid" }) });
+export const UploadBody = t.Object({
+  artifactId: t.String({ format: "uuid" }), expectedVersion: t.Integer({ minimum: 1 }),
+}, { additionalProperties: false });
+export const UploadLocation = t.Object({
+  artifactId: t.String({ format: "uuid" }), bucketId: t.String(), objectPath: t.String(),
+});
+export const UploadResult = t.Object({
+  artifactId: t.String({ format: "uuid" }), runId: t.String({ format: "uuid" }),
+  objectPath: t.String(), sha256: t.String({ pattern: "^[a-f0-9]{64}$" }), bytes: t.Integer({ minimum: 1, maximum: 1048576 }),
+});
+`,
     "src/review/uploads.ts": STARTER_UPLOAD_FEATURE,
     "src/host/review-uploads.ts": STARTER_UPLOAD_ADAPTER,
     "src/host/review-postgres.ts": STARTER_REVIEW_POSTGRES,
@@ -242199,7 +242251,7 @@ and governance; TypeScript checks both application and generated source.
   };
 }
 async function initializeAppProject(options) {
-  const root = resolve15(options.root ?? process.cwd());
+  const root = resolve16(options.root ?? process.cwd());
   const name = options.name ?? basename7(root);
   if (!/^[a-z][a-z0-9-]*$/.test(name) || name.length > 100) {
     throw new Error("Project name must be lowercase kebab-case (1-100 characters)");
@@ -242226,7 +242278,7 @@ async function initializeAppProject(options) {
 
 // src/shared/tools/app-database-check.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join13, resolve as resolve16 } from "node:path";
+import { join as join13, resolve as resolve17 } from "node:path";
 var CHECK_ENTRY = `
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -242237,7 +242289,7 @@ process.argv = [process.execPath, cli, "check", "--root", root];
 await import(pathToFileURL(cli).href);
 `;
 function checkAppDatabaseSources(projectRoot) {
-  const root = resolve16(projectRoot);
+  const root = resolve17(projectRoot);
   if (!existsSync11(join13(root, "database.sources.json")))
     return;
   const name = "database-source-contracts";
@@ -242369,7 +242421,7 @@ test("${name} controller preserves an asynchronous read failure", async () => {
 // src/shared/tools/app-local-dev.ts
 import { spawn } from "node:child_process";
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join14, resolve as resolve17 } from "node:path";
+import { join as join14, resolve as resolve18 } from "node:path";
 function localDatabaseUrl(value) {
   try {
     if (!value || /[\x00-\x20\x7f]/.test(value))
@@ -242416,7 +242468,7 @@ async function probeDatabase(url, signal) {
   }
 }
 async function runLocalDevelopment(options) {
-  const root = resolve17(options.root);
+  const root = resolve18(options.root);
   const profile = options.profile ?? "fast";
   if (profile !== "fast" && profile !== "integration")
     throw new Error("Unknown development profile");
@@ -242517,7 +242569,7 @@ async function runLocalDevelopment(options) {
 
 // src/shared/tools/app-verification-plan.ts
 import { readdir as readdir5, realpath as realpath5 } from "node:fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute6, relative as relative11, resolve as resolve18 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute6, relative as relative11, resolve as resolve19 } from "node:path";
 function inside3(root, file) {
   const path = relative11(root, file).replaceAll("\\", "/");
   return path !== ".." && !path.startsWith("../") && !isAbsolute6(path);
@@ -242528,13 +242580,13 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     throw new Error("Select one unambiguous module or owned symbol for verification");
   const owner = owners[0];
   const project = await realpath5(root);
-  const requestedRoot = resolve18(root);
+  const requestedRoot = resolve19(root);
   const sources = [
     owner.file,
     ...owner.providers.map((item) => item.file),
     ...owner.controllers.map((item) => item.file)
   ].filter((file) => typeof file === "string");
-  const directories = [...new Set(sources.map((file) => dirname11(resolve18(sourceRoot, file))))].sort();
+  const directories = [...new Set(sources.map((file) => dirname11(resolve19(sourceRoot, file))))].sort();
   const tests = new Set;
   const manual = [];
   for (const directory of directories) {
@@ -242549,7 +242601,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     }
     for (const entry of await readdir5(actual, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-        tests.add(relative11(project, resolve18(actual, entry.name)).replaceAll("\\", "/"));
+        tests.add(relative11(project, resolve19(actual, entry.name)).replaceAll("\\", "/"));
       }
     }
   }
@@ -242563,7 +242615,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     source: "declaration",
     target: owner.name,
     ready: manual.length === 0,
-    files: [...new Set(sources.map((file) => relative11(requestedRoot, resolve18(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
+    files: [...new Set(sources.map((file) => relative11(requestedRoot, resolve19(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
     tests: selected.slice(0, 32),
     commands: selected.length <= 32 ? [
       ...selected.map((file) => ["bun", "test", `./${file}`]),
@@ -242578,7 +242630,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
 // src/shared/tools/app-scaffold-writes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { link, lstat as lstat4, mkdir as mkdir5, open as open4, readFile as readFile8, realpath as realpath6, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname12, isAbsolute as isAbsolute7, join as join15, relative as relative12, resolve as resolve20, sep as sep11, win32 } from "node:path";
+import { dirname as dirname12, isAbsolute as isAbsolute7, join as join15, relative as relative12, resolve as resolve21, sep as sep11, win32 } from "node:path";
 
 class ScaffoldError extends Error {
   code;
@@ -242599,7 +242651,7 @@ function scaffoldPath(root, path) {
   if (parts.some((part) => /[<>:"|?*\u0000-\u001f]/.test(part) || /[ .]$/.test(part) && part !== "." && part !== ".." || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part) || part.toLowerCase() === ".git" || part.toLowerCase() === ".supacloud-generate.lock")) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is reserved or not portable");
   }
-  const target = resolve20(root, path);
+  const target = resolve21(root, path);
   const local = relative12(root, target);
   if (!local || local === ".." || local.startsWith(`..${sep11}`) || isAbsolute7(local)) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is outside the project root");
@@ -242638,7 +242690,7 @@ function sameFile(a, b) {
   return a === null ? b === null : b !== null && a.content === b.content && a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;
 }
 async function planScaffoldWrites(root, writes) {
-  const canonical = await realpath6(resolve20(root));
+  const canonical = await realpath6(resolve21(root));
   const targets = new Set;
   const planned = [];
   for (const write of writes) {
@@ -242898,7 +242950,7 @@ async function generateScaffold(args) {
       throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `--${flag.replaceAll("_", "-")} must be boolean`);
     }
   }
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const dir = args.dir ?? "src/features";
   if (dir !== ".")
     scaffoldPath(root, dir);
@@ -242945,7 +242997,7 @@ async function generateScaffold(args) {
     if (new RegExp(`\\b${moduleSymbol}\\b`).test(original)) {
       throw new ScaffoldError("SCAFFOLD_REGISTRATION_CONFLICT", `Registration target already references ${moduleSymbol}; review the import manually`);
     }
-    let importPath = relative13(dirname13(target), resolve21(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
+    let importPath = relative13(dirname13(target), resolve23(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
     if (!importPath.startsWith("."))
       importPath = `./${importPath}`;
     const edit = await applyDiagnosticFix({
@@ -243016,13 +243068,13 @@ function sourceRoot(args, root, configured) {
   return args.root && !hasConfig ? "." : configured;
 }
 async function projectCompileConfig(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join16(root, `supacloud.config.${extension}`)).find((candidate) => existsSync12(candidate)) ?? null;
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve23(root, args.out_dir) : defaults.outDir;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
@@ -243186,11 +243238,11 @@ async function runDoctor(args) {
 `), doctor.errors > 0);
 }
 async function runFix(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const fixPath = args.fix?.trim();
   if (!fixPath)
     throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile9(resolve21(root, fixPath), "utf8"));
+  const parsed = JSON.parse(await readFile9(resolve23(root, fixPath), "utf8"));
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
@@ -243276,12 +243328,12 @@ async function runAppDev(args, options) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "app dev --profile must be fast or integration");
   }
   const database = devDatabase(profile, args.database_url);
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve23(root, args.out_dir) : defaults.outDir;
   const watch = args.once !== true && args.watch !== false;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
@@ -243367,7 +243419,7 @@ async function runAppDev(args, options) {
   return report(lastEvent, "stopped");
 }
 async function runCompile(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -243376,7 +243428,7 @@ async function runCompile(args) {
     ...compileOptionsFromConfig({
       ...loadedConfig,
       ...configuredRoot === undefined ? {} : { root: configuredRoot },
-      outDir: args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir,
+      outDir: args.out_dir ? resolve23(root, args.out_dir) : defaults.outDir,
       ...include === undefined ? {} : { include },
       strict: args.strict ?? loadedConfig.strict ?? false
     }, root),
@@ -243400,7 +243452,7 @@ async function runCompile(args) {
   return textResult(text, hasError);
 }
 async function runCheck(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const database = checkAppDatabaseSources(root);
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
@@ -243409,7 +243461,7 @@ async function runCheck(args) {
   const config = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
-    outDir: args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir,
+    outDir: args.out_dir ? resolve23(root, args.out_dir) : defaults.outDir,
     ...include === undefined ? {} : { include },
     strict: args.strict ?? loadedConfig.strict ?? false
   }, root);
@@ -243439,7 +243491,7 @@ async function runCheck(args) {
 }
 async function readManifest(root, args) {
   const config = await loadSupacloudConfig(root);
-  const outDir = args.out_dir ? resolve21(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
+  const outDir = args.out_dir ? resolve23(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
   const manifestPath = join16(outDir, "app.manifest.json");
   if (!existsSync12(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
@@ -243484,7 +243536,7 @@ function formatGraphText(manifest) {
 `);
 }
 async function runGraph(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   if (args.format === "json")
     return textResult(JSON.stringify(manifest, null, 2));
@@ -243552,7 +243604,7 @@ async function runExplain(args) {
   const target = args.target?.trim();
   if (!target)
     throw new Error("app explain requires --target（provider 类名 / token 名 / command 名 / job 名）");
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   for (const module of manifest.modules) {
     const job = module.jobs?.find((entry) => entry.name === target || entry.className === target);
@@ -243627,10 +243679,10 @@ async function runExplain(args) {
   return textResult(`未找到对象: ${target}`, true);
 }
 async function runExportTools(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   const manifest = await readManifest(root, { ...args, out_dir: undefined });
   const definitions = buildToolDefinitions(manifest);
-  const outDir = resolve21(args.out_dir || join16(root, "generated"));
+  const outDir = resolve23(args.out_dir || join16(root, "generated"));
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
@@ -243651,7 +243703,7 @@ async function runExportTools(args) {
   return textResult(summary);
 }
 async function runDelivery(args) {
-  const root = resolve21(args.root || process.cwd());
+  const root = resolve23(args.root || process.cwd());
   if (args.action === "build") {
     const database = checkAppDatabaseSources(root);
     if (database && !database.ok) {
@@ -243661,7 +243713,7 @@ async function runDelivery(args) {
   const loaded = await loadSupacloudConfig(root);
   const options = compileOptionsFromConfig({
     ...loaded,
-    ...args.out_dir === undefined ? {} : { outDir: resolve21(root, args.out_dir) },
+    ...args.out_dir === undefined ? {} : { outDir: resolve23(root, args.out_dir) },
     ...args.include === undefined ? {} : { include: parseInclude(args.include) },
     ...args.strict === undefined ? {} : { strict: args.strict }
   }, root);
@@ -243831,7 +243883,7 @@ function registerAppAliases(server2) {
 
 // src/shared/tools/db-governance-tools.ts
 import { existsSync as existsSync13 } from "node:fs";
-import { join as join17, resolve as resolve23 } from "node:path";
+import { join as join17, resolve as resolve24 } from "node:path";
 
 // node_modules/@supacloud/db/dist/index.js
 var TABLES_SQL = `
@@ -244283,7 +244335,7 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve23(root, moduleFile) : join17(root, "db", "modules.ts");
+  const filePath = moduleFile ? resolve24(root, moduleFile) : join17(root, "db", "modules.ts");
   if (!existsSync13(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
@@ -244332,7 +244384,7 @@ async function runLint(args, root) {
   const issues = [];
   for (const module of selected) {
     const readSqlFile = async (path) => {
-      const absolute = resolve23(root, path);
+      const absolute = resolve24(root, path);
       try {
         return await Bun.file(absolute).text();
       } catch (error) {
@@ -244368,14 +244420,14 @@ var defaultLiteSpawn = async (command, cwd) => {
   return { exitCode, stdout, stderr };
 };
 async function runModuleCheckLite(args, root, spawn, liteBinary) {
-  const projectDir = resolve23(args.project_dir?.trim() || root);
+  const projectDir = resolve24(args.project_dir?.trim() || root);
   const binary = liteBinary === undefined ? Bun.which("supacloud-lite") : liteBinary;
   if (!binary) {
     throw new Error("db module_check --lite 需要本机可用的 supacloud-lite（npm i -g @supacloud/lite，或加入 PATH）");
   }
   const command = [binary, "db", "check", "--project-dir", projectDir];
   if (args.module_file?.trim())
-    command.push("--module-file", resolve23(root, args.module_file.trim()));
+    command.push("--module-file", resolve24(root, args.module_file.trim()));
   const result = await spawn(command, projectDir);
   const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(`
 `);
@@ -244426,7 +244478,7 @@ function registerDbGovernanceTools(server2, options = {}) {
     lite: optional(Boolean2(), "[module_check] Reconcile against a local SupaCloud Lite project (runs supacloud-lite db check)"),
     project_dir: optional(String2(), "[module_check] Lite project directory (with --lite; default: --root)")
   }, async (request) => {
-    const root = resolve23(request.root || fallbackRoot);
+    const root = resolve24(request.root || fallbackRoot);
     switch (request.action) {
       case "lint":
         return runLint(request, root);
@@ -244443,7 +244495,7 @@ function registerDbGovernanceTools(server2, options = {}) {
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
-import { resolve as resolve24 } from "node:path";
+import { resolve as resolve25 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -244527,7 +244579,7 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve24(bodyPathInput);
+  const bodyPath = resolve25(bodyPathInput);
   const bodyStat = statSync7(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
@@ -245110,7 +245162,7 @@ var MUTATION_TOOL_SCHEMA = {
 // src/shared/tools/release-tools.ts
 import { createHash as createHash10 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname14, join as join18, relative as relative14, resolve as resolve25 } from "node:path";
+import { dirname as dirname14, join as join18, relative as relative14, resolve as resolve26 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -245398,13 +245450,13 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   const results = [];
   const resolvePathWithFallbacks = (filePath) => {
     const trimmed = filePath.trim();
-    const resolved = resolve25(cwd, trimmed);
+    const resolved = resolve26(cwd, trimmed);
     if (existsSync14(resolved))
       return resolved;
     const candidates = [
-      resolve25(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve25(cwd, "release-scopes", trimmed),
-      resolve25(cwd, "scopes", trimmed)
+      resolve26(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve26(cwd, "release-scopes", trimmed),
+      resolve26(cwd, "scopes", trimmed)
     ];
     const found = candidates.find(existsSync14);
     if (found)
@@ -245427,10 +245479,10 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   if (!taskFilter && (!dir || typeof dir !== "string" || !dir.trim())) {
     throw new Error("At least one of --file, --files, or --task is required for scope_rebind");
   }
-  const candidates = typeof dir === "string" && dir.trim() ? [resolve25(cwd, dir.trim())] : [
-    resolve25(cwd, "supacloud/fa/release-scopes"),
-    resolve25(cwd, "release-scopes"),
-    resolve25(cwd, "scopes")
+  const candidates = typeof dir === "string" && dir.trim() ? [resolve26(cwd, dir.trim())] : [
+    resolve26(cwd, "supacloud/fa/release-scopes"),
+    resolve26(cwd, "release-scopes"),
+    resolve26(cwd, "scopes")
   ];
   for (const directory of candidates) {
     if (existsSync14(directory)) {
@@ -245464,7 +245516,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   return [...new Set(results)];
 }
 function handleScopeRebind(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve26(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
   const dryRun = args.dry_run === true;
@@ -245516,17 +245568,17 @@ function handleScopeRebind(args) {
   });
 }
 function handleScopeInspect(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve26(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
   const trimmed = args.file.trim();
-  let filePath = resolve25(cwd, trimmed);
+  let filePath = resolve26(cwd, trimmed);
   if (!existsSync14(filePath)) {
     const candidates = [
-      resolve25(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve25(cwd, "release-scopes", trimmed),
-      resolve25(cwd, "scopes", trimmed)
+      resolve26(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve26(cwd, "release-scopes", trimmed),
+      resolve26(cwd, "scopes", trimmed)
     ];
     const found = candidates.find(existsSync14);
     if (found)
@@ -245586,7 +245638,7 @@ function parseCommaList(value) {
   return [];
 }
 function handleScopeCreate(args, fallbackRef) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve26(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_create");
   }
@@ -245601,7 +245653,7 @@ function handleScopeCreate(args, fallbackRef) {
     throw new Error("'ref' is invalid for release controls");
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
-  const filePath = resolve25(cwd, args.file.trim());
+  const filePath = resolve26(cwd, args.file.trim());
   mkdirSync4(dirname14(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
@@ -245826,7 +245878,7 @@ function registerReleaseTools(server2, http, options = {}) {
 import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile10, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { createHash as createHash11 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename9, dirname as dirname15, join as join19, relative as relative15, resolve as resolve26, sep as sep12 } from "node:path";
+import { basename as basename9, dirname as dirname15, join as join19, relative as relative15, resolve as resolve27, sep as sep12 } from "node:path";
 
 // node_modules/fflate/esm/index.mjs
 import { createRequire as createRequire3 } from "module";
@@ -246517,13 +246569,13 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory) {
-  let directory = resolve26(startDirectory);
+  let directory = resolve27(startDirectory);
   while (true) {
     if (await pathExists(join19(directory, "supacloud.json")))
       return directory;
     const parent = dirname15(directory);
     if (parent === directory)
-      return resolve26(startDirectory);
+      return resolve27(startDirectory);
     directory = parent;
   }
 }
@@ -246641,9 +246693,9 @@ function selectDeployment(deployments, requestedId, projectName) {
   throw new Error(deployments.length === 0 ? "No frontend deployments exist for this project" : `Multiple frontend deployments found (${ids}). Set frontend.id in supacloud.json or pass --id`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve26(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve26(configRoot)}${sep12}`;
-  if (root !== resolve26(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve27(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve27(configRoot)}${sep12}`;
+  if (root !== resolve27(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -246694,8 +246746,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve26(projectDirectory, candidate);
-  const projectRoot = resolve26(projectDirectory);
+  const resolved = resolve27(projectDirectory, candidate);
+  const projectRoot = resolve27(projectDirectory);
   const projectPrefix = `${projectRoot}${sep12}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -246805,7 +246857,7 @@ function deployResponse(result, json) {
 }
 function registerDeployTools(server2, http, options = {}) {
   server2.tool("deploy", "Build and publish the linked frontend with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve26(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve27(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -246981,7 +247033,7 @@ import { existsSync as existsSync15 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
 import { readdir as readdir7 } from "node:fs/promises";
 import { createHash as createHash12 } from "node:crypto";
-import { join as join20, resolve as resolve27 } from "node:path";
+import { join as join20, resolve as resolve28 } from "node:path";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
 var remoteDevToolSchema = {
@@ -247022,12 +247074,12 @@ function toolFailed(value) {
   return value?.isError === true || value?.content?.some((chunk) => typeof chunk?.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve28(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve27(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve28(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
   if (!existsSync15(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
@@ -247098,13 +247150,13 @@ function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "functions") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "edge_function" && (!functionSlug || String(entry.slug || "") === functionSlug));
-    const base = match?.root ? resolve27(root, String(match.root)) : join20(root, "supabase", "functions");
+    const base = match?.root ? resolve28(root, String(match.root)) : join20(root, "supabase", "functions");
     return match?.root ? base : functionSlug ? join20(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "frontend");
-    return match?.root ? resolve27(root, String(match.root)) : join20(root, "apps", "web");
+    return match?.root ? resolve28(root, String(match.root)) : join20(root, "apps", "web");
   }
   return root;
 }
@@ -247143,10 +247195,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve27(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve28(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve27(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve28(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -247158,7 +247210,7 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve28(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
@@ -247167,8 +247219,8 @@ async function syncOnce(args, options) {
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve27(root, config.compileRoot || ".");
-    const compileOutDir = resolve27(root, config.compileOutDir || "generated");
+    const compileRoot = resolve28(root, config.compileRoot || ".");
+    const compileOutDir = resolve28(root, config.compileOutDir || "generated");
     const compilation = await compileProject({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -247206,7 +247258,7 @@ function registerRemoteDevTools(server2, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve28(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -247220,7 +247272,7 @@ function registerRemoteDevTools(server2, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve28(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -247241,7 +247293,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.68.2",
+  version: "0.69.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -247275,7 +247327,7 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.38.2",
+    "@supacloud/compiler": "^0.39.0",
     "@supacloud/delivery": "0.8.0",
     "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3",