@supacloud/cli 0.96.1 → 0.97.0

package/dist/index.js

@@ -10925,12 +10925,157 @@ function parseDeploymentEvidence(value) {
   }
   return structuredClone(value);
 }
-// node_modules/@supacloud/delivery/src/application-promotion.ts
+// node_modules/@supacloud/delivery/src/delivery-tuple.ts
+var sha2563 = String2({ pattern: "^[a-f0-9]{64}$" });
+var commit = String2({ pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" });
+var isoDate2 = String2({ minLength: 20, maxLength: 40 });
+var DELIVERY_TUPLE_SCHEMA = "supacloud.fa-delivery-tuple.v1";
+var FaDeliveryTupleSchema = _Object_({
+  schema: Literal(DELIVERY_TUPLE_SCHEMA),
+  customer: Literal("xigu-fa"),
+  fa_commit: commit,
+  cli: _Object_({
+    version: String2({ pattern: "^\\d+\\.\\d+\\.\\d+$" })
+  }, { additionalProperties: false }),
+  platform_commit: commit,
+  edge_runtime: _Object_({
+    version: String2({ minLength: 1, maxLength: 128 }),
+    artifact_sha256: sha2563
+  }, { additionalProperties: false }),
+  compatibility_window: _Object_({
+    contract_schema: String2({ minLength: 1, maxLength: 128 }),
+    starts_at: isoDate2,
+    ends_at: isoDate2,
+    old_client_supported: Boolean2(),
+    partial_deployment_supported: Boolean2()
+  }, { additionalProperties: false })
+}, { additionalProperties: false });
+// node_modules/@supacloud/delivery/src/contract-matrix.ts
 var closed6 = { additionalProperties: false };
+var sha2564 = String2({ pattern: "^[a-f0-9]{64}$" });
+var generation = Union([Literal("old"), Literal("new")]);
+var versions = _Object_({ old: sha2564, new: sha2564 }, closed6);
+var CONTRACT_MATRIX_SCHEMA = "supacloud.consumer-contract-matrix.v1";
+var FA_CONTRACT_SCENARIOS = [
+  "missing-display-field",
+  "missing-authority-field",
+  "added-field",
+  "legacy-envelope",
+  "lost-write-response",
+  "downgrade"
+];
+var ConsumerContractMatrixSchema = _Object_({
+  schema: Literal(CONTRACT_MATRIX_SCHEMA),
+  customer: Literal("xigu-fa"),
+  baseline_tuple_sha256: sha2564,
+  candidate_tuple_sha256: sha2564,
+  artifacts: _Object_({ frontend: versions, functions: versions, database: versions }, closed6),
+  cases: _Array_(_Object_({
+    frontend: generation,
+    functions: generation,
+    database: generation,
+    scenarios: _Array_(_Object_({
+      name: Enum(FA_CONTRACT_SCENARIOS),
+      expected: Union([Literal("compatible"), Literal("blocked-safely")])
+    }, closed6), { minItems: FA_CONTRACT_SCENARIOS.length, maxItems: FA_CONTRACT_SCENARIOS.length })
+  }, closed6), { minItems: 8, maxItems: 8 })
+}, closed6);
+// node_modules/@supacloud/delivery/src/fa-stability.ts
+var closed7 = { additionalProperties: false };
+var hash3 = String2({ pattern: "^[a-f0-9]{64}$" });
+var label = String2({ minLength: 1, maxLength: 256, pattern: "\\S" });
+var timestamp2 = String2({ minLength: 24, maxLength: 24 });
+var count = Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });
+var environment2 = Union([Literal("test"), Literal("production")]);
+var FA_REQUIRED_ACCEPTANCE = {
+  login: "real-browser",
+  permissions: "real-http",
+  upload: "real-http",
+  "async-task": "real-worker",
+  deploy: "real-http",
+  "database-migration": "real-database",
+  schedule: "real-worker",
+  rollback: "real-drill",
+  "error-policy": "real-http",
+  "alert-delivery": "real-drill"
+};
+var FA_BUSINESS_OPERATIONS = ["login", "permissions", "upload", "async-task", "report", "deploy"];
+var operation = Enum(FA_BUSINESS_OPERATIONS);
+var proof = _Object_({
+  path: String2({ pattern: "^[A-Za-z0-9_-][A-Za-z0-9_./-]{0,255}$" }),
+  sha256: hash3
+}, closed7);
+var FaBusinessObservationSchema = _Object_({
+  id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+  tuple_sha256: hash3,
+  operation,
+  started_at: timestamp2,
+  finished_at: timestamp2,
+  outcome: Enum(["success", "failure", "timeout", "unknown"]),
+  attempts: Integer({ minimum: 1, maximum: 1000 }),
+  rollbacks: count
+}, closed7);
+var FaServiceObjectivesSchema = _Object_({
+  status: Literal("approved"),
+  owner: label,
+  approval_reference: label,
+  approved_at: timestamp2,
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  environment: environment2,
+  alert_route: label,
+  window_hours: Number2({ exclusiveMinimum: 0, maximum: 8760 }),
+  max_evidence_age_hours: Number2({ exclusiveMinimum: 0, maximum: 168 }),
+  operations: _Array_(_Object_({
+    operation,
+    minimum_samples: Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+    availability_percent: Number2({ exclusiveMinimum: 0, maximum: 100 }),
+    p95_ms: Number2({ exclusiveMinimum: 0, maximum: Number.MAX_SAFE_INTEGER })
+  }, closed7), { minItems: FA_BUSINESS_OPERATIONS.length, maxItems: FA_BUSINESS_OPERATIONS.length })
+}, closed7);
+var FaStabilityEvidenceSchema = _Object_({
+  schema: Literal("supacloud.fa-stability-evidence.v1"),
+  environment: environment2,
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  tuple_sha256: hash3,
+  matrix_sha256: hash3,
+  objectives_sha256: hash3,
+  recorded_at: timestamp2,
+  window_start: timestamp2,
+  window_end: timestamp2,
+  reviewed_by: label,
+  review_reference: label,
+  acceptance: _Array_(_Object_({
+    id: Enum(Object.keys(FA_REQUIRED_ACCEPTANCE)),
+    execution: Enum([
+      "real-browser",
+      "real-http",
+      "real-worker",
+      "real-database",
+      "real-drill",
+      "local-fake"
+    ]),
+    passed: Boolean2(),
+    measured_at: timestamp2,
+    proof
+  }, closed7), { minItems: 10, maxItems: 10 }),
+  matrix: _Array_(_Object_({
+    combination: label,
+    scenario: label,
+    outcome: Union([Literal("compatible"), Literal("blocked-safely")]),
+    execution: Union([Literal("real-http-and-database"), Literal("local-fake")]),
+    passed: Boolean2(),
+    measured_at: timestamp2,
+    proof
+  }, closed7), { minItems: 48, maxItems: 48 }),
+  observation: proof,
+  alert: _Object_({ route: label, acknowledged_by: label, delivered_at: timestamp2 }, closed7)
+}, closed7);
+// node_modules/@supacloud/delivery/src/application-promotion.ts
+var closed8 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-var sha2563 = ApplicationReleaseIdSchema;
+var sha2565 = ApplicationReleaseIdSchema;
 var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-var nullableDigest = Union([sha2563, Null()]);
+var nullableDigest = Union([sha2565, Null()]);
 var observation = {
   activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
@@ -10956,33 +11101,33 @@ var ApplicationPromotionPlanSchema = _Object_({
   project_ref: projectRef2,
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  manifest_sha256: sha2563,
-  plan_sha256: sha2563,
+  manifest_sha256: sha2565,
+  plan_sha256: sha2565,
   source: _Object_({
     project_ref: projectRef2,
     environment_id: ApplicationIdSchema,
-    release_id: sha2563,
+    release_id: sha2565,
     ...observation
-  }, closed6),
+  }, closed8),
   target: _Object_({
-    candidate_release_id: sha2563,
-    current_release_id: Union([sha2563, Null()]),
+    candidate_release_id: sha2565,
+    current_release_id: Union([sha2565, Null()]),
     artifact_action: Union([Literal("materialize"), Literal("reuse")]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
-  }, closed6),
+  }, closed8),
   migrations: _Object_({
-    ledger_digest: sha2563,
+    ledger_digest: sha2565,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
     operator_provisioning_required: Boolean2()
-  }, closed6),
+  }, closed8),
   backup: _Object_({
     required: Boolean2(),
     confirmed: Literal(false)
-  }, closed6),
+  }, closed8),
   action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
   blockers: _Array_(Enum([...blocker]), {
     maxItems: blocker.length,
@@ -10991,7 +11136,7 @@ var ApplicationPromotionPlanSchema = _Object_({
   steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
   execution_performed: Literal(false),
   data_recovery: Literal("separate-required")
-}, closed6);
+}, closed8);
 function applicationPromotionPlanDigest(value) {
   return digest(canonical(value));
 }
@@ -17191,12 +17336,12 @@ async function fetchMutationStatus(http, ref, mutationId) {
 }
 
 // src/shared/tools/application-workflow-schemas.ts
-var closed7 = { additionalProperties: false };
+var closed9 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
 var uuid = ApplicationActivationIdSchema2;
 var nullableUuid = Union([uuid, Null()]);
 var nullableDigest2 = Union([ApplicationReleaseIdSchema2, Null()]);
-var timestamp2 = String2({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" });
+var timestamp3 = String2({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" });
 var scope2 = { project_ref: ref5, application_id: ApplicationIdSchema2, environment_id: ApplicationIdSchema2 };
 var ApplicationPromotionResultSchema = _Object_({
   ...scope2,
@@ -17205,7 +17350,7 @@ var ApplicationPromotionResultSchema = _Object_({
   plan_sha256: ApplicationReleaseIdSchema2,
   action: Literal("promote"),
   replayed: Boolean2()
-}, closed7);
+}, closed9);
 var ApplicationPromotionStatusSchema = _Object_({
   ...scope2,
   mutation: Unknown(),
@@ -17224,8 +17369,8 @@ var ApplicationPromotionStatusSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]),
     backup_id: Union([String2({ pattern: "^logical-full_[a-z0-9-]{1,20}_[a-f0-9]{32}$" }), Null()]),
     data_recovery: Literal("separate-required")
-  }, closed7)
-}, closed7);
+  }, closed9)
+}, closed9);
 var phase = Union([Literal("pending"), Literal("ready"), Literal("failed"), Literal("cleaned")]);
 var previewId = String2({ pattern: "^[a-f0-9-]{8,64}$" });
 var name = String2({ minLength: 1, maxLength: 256 });
@@ -17235,7 +17380,7 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
   ...scope2,
   preview_id: previewId,
   release_id: ApplicationReleaseIdSchema2,
-  expires_at: Union([timestamp2, Null()]),
+  expires_at: Union([timestamp3, Null()]),
   status: Union([
     Literal("planned"),
     Literal("provisioning"),
@@ -17244,35 +17389,35 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed7),
+    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed9),
     database_branch: _Object_({
       status: phase,
       branch_ref: ref5,
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed7),
-    queue_namespace: _Object_({ status: phase, namespace: name }, closed7),
-    storage_namespace: _Object_({ status: phase, namespace: name }, closed7),
-    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed7),
-    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed7),
-    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed7),
-    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed7)
-  }, closed7),
+    }, closed9),
+    queue_namespace: _Object_({ status: phase, namespace: name }, closed9),
+    storage_namespace: _Object_({ status: phase, namespace: name }, closed9),
+    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed9),
+    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed9),
+    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed9),
+    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed9)
+  }, closed9),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }), Null()])
-  }, closed7),
+  }, closed9),
   branch_name: Optional(String2({ minLength: 1, maxLength: 80 })),
   queue_name: Optional(name),
   test_secret_name: Optional(name),
   source_configuration_id: Optional(Union([ApplicationConfigurationIdSchema2, Null()])),
-  created_at: Optional(timestamp2),
-  updated_at: Optional(timestamp2)
-}, closed7);
+  created_at: Optional(timestamp3),
+  updated_at: Optional(timestamp3)
+}, closed9);
 var previewListSchema = _Object_({
   ...scope2,
   previews: _Array_(ApplicationPreviewReceiptSchema2, { maxItems: 1000 })
-}, closed7);
+}, closed9);
 function assertScope(value, identity) {
   if (value.project_ref !== identity.project_ref || value.application_id !== identity.application_id || value.environment_id !== identity.environment_id)
     throw new Error("Application workflow scope mismatch");
@@ -17466,14 +17611,14 @@ var actionFields = {
   reconcile_preview: ["preview_id"],
   cleanup_preview: ["preview_id"]
 };
-function timestamp3(value) {
+function timestamp4(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
 function receipt(value, identity) {
   if (!Check2(receiptSchema, value) || value.project_ref !== identity.ref || value.application_id !== identity.id || value.environment_id !== identity.environment || identity.previewId && value.preview_id !== identity.previewId || value.resources.build_artifact.release_id !== value.release_id || value.resources.storage_namespace.namespace !== value.resources.database_branch.branch_ref) {
     throw new Error("Invalid preview receipt");
   }
-  if (value.expires_at !== undefined && value.expires_at !== null && !timestamp3(value.expires_at) || value.created_at !== undefined && !timestamp3(value.created_at) || value.updated_at !== undefined && !timestamp3(value.updated_at) || value.expires_at !== undefined && value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
+  if (value.expires_at !== undefined && value.expires_at !== null && !timestamp4(value.expires_at) || value.created_at !== undefined && !timestamp4(value.created_at) || value.updated_at !== undefined && !timestamp4(value.updated_at) || value.expires_at !== undefined && value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
     throw new Error("Invalid preview expiry");
   }
   if (value.status === "ready") {
@@ -21200,22 +21345,22 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.0"
+      version: "0.46.1"
     },
     app: {
-      version: "0.26.1",
+      version: "0.27.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.29.2"
+      version: "0.30.0"
     },
     commands: {
       version: "0.9.2"
     },
     contracts: {
-      version: "0.8.1"
+      version: "0.9.0"
     },
     db: {
       version: "0.17.0",
@@ -24242,6 +24387,302 @@ test("${name} controller preserves an asynchronous read failure", async () => {
   };
 }
 
+// src/shared/tools/app-feature.ts
+function featureScaffold(name, className, governance) {
+  const commandName = `${name}.approve`;
+  const { permission, rpc } = governance;
+  return {
+    [`${name}.contracts.ts`]: `import { t } from "elysia";
+
+export const ${className}Params = t.Object({
+    id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }),
+});
+export const ${className}ListQuery = t.Object({
+    state: t.Optional(t.String({ minLength: 1, maxLength: 64 })),
+});
+export const ${className}ApproveBody = t.Object({
+    expectedVersion: t.Integer({ minimum: 1 }),
+    reason: t.Optional(t.String({ maxLength: 2000 })),
+});
+export const ${className}Row = t.Object({
+    id: t.String(),
+    state: t.String(),
+    version: t.Integer({ minimum: 1 }),
+});
+export const ${className}ListResponse = t.Array(${className}Row);
+`,
+    [`${name}.model.ts`]: `import { InjectionToken } from "@supacloud/app/core";
+import type {
+    ${className}ApproveBody,
+    ${className}ListQuery,
+    ${className}Row,
+} from "./${name}.contracts";
+import type { StaticDecode } from "typebox";
+
+export type ${className}ListInput = StaticDecode<typeof ${className}ListQuery>;
+export type ${className}ApproveInput = StaticDecode<typeof ${className}ApproveBody>;
+export type ${className}Result = StaticDecode<typeof ${className}Row>;
+
+export interface ${className}ReadPort {
+    list(input: ${className}ListInput): Promise<${className}Result[]>;
+    detail(id: string): Promise<${className}Result>;
+}
+
+export interface ${className}WritePort {
+    approve(input: {
+        id: string;
+        expectedVersion: number;
+        reason?: string;
+    }): Promise<${className}Result>;
+}
+
+export const ${className}Reader = new InjectionToken<${className}ReadPort>(
+    "${name}.reader", { scope: "request" },
+);
+export const ${className}Writer = new InjectionToken<${className}WritePort>(
+    "${name}.writer", { scope: "request" },
+);
+`,
+    [`${name}.service.ts`]: `import { Inject, Injectable, Optional } from "@supacloud/app/core";
+import {
+    ${className}Reader,
+    ${className}Writer,
+    type ${className}ApproveInput,
+    type ${className}ReadPort,
+    type ${className}Result,
+    type ${className}WritePort,
+} from "./${name}.model";
+
+@Injectable({ scope: "request" })
+export class ${className}Service {
+    constructor(
+        @Inject(${className}Reader) @Optional() private readonly reader?: ${className}ReadPort,
+        @Inject(${className}Writer) @Optional() private readonly writer?: ${className}WritePort,
+    ) {}
+
+    async list(input: Parameters<${className}ReadPort["list"]>[0]): Promise<${className}Result[]> {
+        if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
+        return this.reader.list(input);
+    }
+
+    async detail(id: string): Promise<${className}Result> {
+        if (!this.reader) throw new Error("Bind ${className}Reader with verified identity and tenant scope");
+        return this.reader.detail(id);
+    }
+
+    async approve(id: string, input: ${className}ApproveInput): Promise<${className}Result> {
+        if (!this.writer) throw new Error("Bind ${className}Writer with durable command governance");
+        return this.writer.approve({ ...input, id });
+    }
+}
+`,
+    [`${name}.feature.ts`]: `import { Effect } from "effect";
+import {
+    Body, Command, Controller, defineFeatureSlice, defineFeatureSpec, Get, Inject,
+    Injectable, Job, Param, Post, Query, type FeatureState,
+} from "@supacloud/app/core";
+import {
+    ${className}ApproveBody,
+    ${className}ListQuery,
+    ${className}ListResponse,
+    ${className}Params,
+    ${className}Row,
+} from "./${name}.contracts";
+import { ${className}Service } from "./${name}.service";
+import type { ${className}ApproveInput, ${className}ListInput, ${className}Result } from "./${name}.model";
+
+export const featureSpec = defineFeatureSpec({
+    name: ${JSON.stringify(name)},
+    states: ["draft", "approved"],
+    transitions: {
+        approve: {
+            from: "draft", to: "approved", command: "Approve${className}Command",
+            permission: ${JSON.stringify(permission)}, transaction: "required",
+            idempotency: "required", audit: ${JSON.stringify(`${name}.approved`)},
+            route: "POST /${name}/:id/approve",
+        },
+    },
+});
+export type ${className}State = FeatureState<typeof featureSpec>;
+
+@Injectable({ scope: "request" })
+@Query({ name: "${name}.list" })
+export class List${className}Query {
+    constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
+    execute(input: ${className}ListInput): Promise<${className}Result[]> {
+        return this.service.list(input);
+    }
+}
+
+@Injectable({ scope: "request" })
+@Command({
+    name: ${JSON.stringify(commandName)},
+    permission: ${JSON.stringify(permission)},
+    transaction: "required",
+    audit: ${JSON.stringify(`${name}.approved`)},
+    idempotency: "required",
+    rpc: ${JSON.stringify(rpc)},
+})
+export class Approve${className}Command {
+    constructor(@Inject(${className}Service) private readonly service: ${className}Service) {}
+    execute(id: string, input: ${className}ApproveInput): Promise<${className}Result> {
+        return this.service.approve(id, input);
+    }
+}
+
+@Job({
+    name: ${JSON.stringify(`${name}.refresh`)},
+    mode: "task",
+    idempotency: "required",
+})
+export class Refresh${className}Job {
+    run(_input: { id: string; version: number }): Promise<void> {
+        throw new Error("Bind the existing Workflow/Queue adapter before dispatching ${name}.refresh");
+    }
+}
+
+@Controller("/${name}")
+export class ${className}Controller {
+    constructor(
+        @Inject(List${className}Query) private readonly listQuery: List${className}Query,
+        @Inject(Approve${className}Command) private readonly approveCommand: Approve${className}Command,
+        @Inject(${className}Service) private readonly service: ${className}Service,
+    ) {}
+
+    @Get("/", {
+        query: ${className}ListQuery,
+        responses: { 200: ${className}ListResponse },
+        effect: { required: true, dependencies: [], errors: [], retry: "none" },
+    })
+    list(@Query("state") state?: string): Effect.Effect<${className}Result[], never, never> {
+        return Effect.promise(() => this.listQuery.execute(state === undefined ? {} : { state }));
+    }
+
+    @Get("/:id", {
+        params: ${className}Params,
+        responses: { 200: ${className}Row },
+        effect: { required: true, dependencies: [], errors: [], retry: "none" },
+    })
+    detail(@Param("id") id: string): Effect.Effect<${className}Result, never, never> {
+        return Effect.promise(() => this.service.detail(id));
+    }
+
+    @Post("/:id/approve", {
+        params: ${className}Params,
+        body: ${className}ApproveBody,
+        responses: { 200: ${className}Row },
+        command: Approve${className}Command,
+        effect: { required: true, dependencies: [], errors: [], retry: "none" },
+    })
+    approve(
+        @Param("id") id: string,
+        @Body() body: ${className}ApproveInput,
+    ): Effect.Effect<${className}Result, never, never> {
+        return Effect.promise(() => this.approveCommand.execute(id, body));
+    }
+}
+
+export const ${className}Feature = defineFeatureSlice({
+    name: ${JSON.stringify(name)},
+    tags: ["type:feature"],
+    spec: featureSpec,
+    providers: [${className}Service, List${className}Query, Approve${className}Command],
+    controllers: [${className}Controller],
+    jobs: [Refresh${className}Job],
+});
+`,
+    [`${name}.feature.test.ts`]: `import { expect, test } from "bun:test";
+import { ${className}Service } from "./${name}.service";
+
+test("${name} fails closed until verified read and durable write ports are bound", async () => {
+    const service = new ${className}Service();
+    await expect(service.list({})).rejects.toThrow("Bind ${className}Reader");
+    await expect(service.detail("example")).rejects.toThrow("Bind ${className}Reader");
+    await expect(service.approve("example", { expectedVersion: 1 })).rejects.toThrow("Bind ${className}Writer");
+});
+
+test("${name} preserves denied reads and rejected writes without fallback or retry", async () => {
+    const denied = new Error("denied");
+    let attempts = 0;
+    const service = new ${className}Service({
+        list: async () => { throw denied; },
+        detail: async () => { throw denied; },
+    }, {
+        approve: async () => { attempts++; throw denied; },
+    });
+    await expect(service.list({})).rejects.toBe(denied);
+    await expect(service.detail("example")).rejects.toBe(denied);
+    await expect(service.approve("example", { expectedVersion: 1 })).rejects.toBe(denied);
+    expect(attempts).toBe(1);
+});
+
+test("${name} forwards the authoritative version and result without inventing persistence", async () => {
+    const row = { id: "example", state: "approved", version: 2 };
+    const service = new ${className}Service(undefined, {
+        async approve(input) {
+            expect(input).toEqual({ id: "example", expectedVersion: 1, reason: "reviewed" });
+            return row;
+        },
+    });
+    expect(await service.approve("example", { expectedVersion: 1, reason: "reviewed" })).toBe(row);
+});
+`,
+    [`${name}.deployment.md`]: `# ${className} feature delivery checklist
+
+- [ ] Bind ${className}Reader to a tenant-scoped, authenticated database read path.
+- [ ] Bind ${className}Writer to a transactional RPC or persistent Command adapter.
+- [ ] Register the \`${rpc}\` compiler and runtime RPC capability.
+- [ ] Verify RLS, permission denial, stale version, identical replay and conflicting replay.
+- [ ] Verify the refresh job uses the existing Workflow/Queue delivery path.
+- [ ] Run the generated client contract and authenticated E2E test.
+- [ ] Run \`supacloud app check --format json\`, package tests and the selected deployment receipt.
+
+The scaffold does not create migrations, infer permissions, or provide an in-memory
+production fallback. Database migrations remain the database source of truth.
+The HTTP schemas describe the boundary, not a second database model. Bind their
+fields to the existing database-source contract checker before delivery.
+
+The named RPC adapter must invoke the continuation in the same database transaction
+used by the request-scoped Writer, or own the complete command instead; never execute
+both paths. Lock/check the version and state, reauthorize replays, and commit the
+business write, receipt, audit and outbox together. Do not put a network side effect
+inside this transaction. The refresh Job is an explicit unimplemented integration
+point, not an automatically scheduled workflow.
+
+Compile the routes with the existing client generator and use @supacloud/query for
+identity-scoped caching/invalidation. There is deliberately no second hand-maintained
+HTTP client. A committed approval followed by a failed refresh is still committed;
+recover its receipt instead of resending. Use the host's standard error translation
+and requestId propagation; the scaffold does not claim to implement those adapters.
+
+## Required acceptance (not executed by generation)
+
+\`\`\`gherkin
+Scenario: Authorization and tenant isolation
+  Given two tenants and a revoked reviewer
+  When list, detail, approval or receipt replay is requested
+  Then unauthorized records and prior success receipts are not disclosed
+
+Scenario: Atomic approval
+  Given a draft and its authoritative version
+  When an authorized reviewer approves and repeats the same request
+  Then one transition, audit event and asynchronous intent commit
+  And changed input or a stale version is rejected
+
+Scenario: Unknown outcome
+  Given a committed approval whose response was lost
+  When the client recovers the original receipt
+  Then it does not create a new approval or automatic compensation
+
+Scenario: Delivery
+  Given verified migrations, RLS and generated client contracts
+  When the selected environment is deployed
+  Then its receipt and authenticated list/detail/approval flow are read back
+\`\`\`
+`
+  };
+}
+
 // src/shared/tools/app-local-dev.ts
 import { spawn } from "node:child_process";
 import { readFile as readFile2 } from "node:fs/promises";
@@ -24733,6 +25174,12 @@ function requireIdentifier(value, flag) {
   }
   return trimmed;
 }
+function requireFeatureCapability(value, flag) {
+  if (typeof value !== "string" || !/^[A-Za-z][A-Za-z0-9_.:-]{0,127}$/.test(value)) {
+    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `feature requires an explicit valid --${flag}; capabilities are not inferred`);
+  }
+  return value;
+}
 function moduleScaffold(name) {
   return `import { Module } from "@supacloud/app";
 
@@ -24751,6 +25198,9 @@ function commandScaffold(moduleName, name) {
 @Command({
     name: ${JSON.stringify(`${moduleName}.${camelName(name)}`)},
     permission: ${JSON.stringify(`${moduleName}.${camelName(name)}`)},
+    transaction: "required",
+    audit: ${JSON.stringify(`${moduleName}.${camelName(name)}.completed`)},
+    idempotency: "required",
 })
 export class ${pascalName(name)}Command {
     execute(): void {
@@ -24805,8 +25255,8 @@ export const ${prefix}Response = t.Object({});
 }
 async function generateScaffold(args) {
   const kind = args.kind;
-  if (!kind || !["module", "command", "query", "controller", "job", "contract", "resource"].includes(kind)) {
-    throw new ScaffoldError("SCAFFOLD_KIND_INVALID", "app generate requires --kind (module|command|query|controller|job|contract|resource)");
+  if (!kind || !["module", "command", "query", "controller", "job", "contract", "resource", "feature"].includes(kind)) {
+    throw new ScaffoldError("SCAFFOLD_KIND_INVALID", "app generate requires --kind (module|command|query|controller|job|contract|resource|feature)");
   }
   for (const flag of ["dry_run", "force"]) {
     if (args[flag] !== undefined && typeof args[flag] !== "boolean") {
@@ -24817,24 +25267,31 @@ async function generateScaffold(args) {
   const dir = args.dir ?? "src/features";
   if (dir !== ".")
     scaffoldPath(root, dir);
-  if (args.register_in !== undefined && kind !== "resource" && kind !== "module") {
-    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--register-in is only supported for a new module or resource");
+  if (args.register_in !== undefined && kind !== "resource" && kind !== "module" && kind !== "feature") {
+    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--register-in is only supported for a new module, resource or feature");
+  }
+  if ((kind === "resource" || kind === "feature") && (args.force || args.module !== undefined)) {
+    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `${kind} creates its own module; use --name and optionally --register-in, never --force or --module`);
   }
-  if (kind === "resource" && (args.force || args.module !== undefined)) {
-    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "resource creates its own module; use --name and optionally --register-in, never --force or --module");
+  if (kind !== "feature" && (args.permission !== undefined || args.rpc !== undefined)) {
+    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--permission and --rpc are only supported for feature generation");
   }
+  const featureGovernance = kind === "feature" ? {
+    permission: requireFeatureCapability(args.permission, "permission"),
+    rpc: requireFeatureCapability(args.rpc, "rpc")
+  } : undefined;
   const writes = [];
   let modulePath;
   let moduleSymbol;
   let contractName;
-  if (kind === "module" || kind === "resource") {
+  if (kind === "module" || kind === "resource" || kind === "feature") {
     const name = requireIdentifier(args.name, "name");
-    modulePath = join13(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
-    moduleSymbol = `${pascalName(name)}Module`;
+    modulePath = join13(dir, name, kind === "feature" ? `${name}.feature.ts` : `${name}.module.ts`).replaceAll("\\", "/");
+    moduleSymbol = kind === "feature" ? `${pascalName(name)}Feature` : `${pascalName(name)}Module`;
     if (kind === "module")
       writes.push({ path: modulePath, content: moduleScaffold(name), overwrite: args.force === true });
     else
-      for (const [file, content] of Object.entries(resourceScaffold(name, pascalName(name)))) {
+      for (const [file, content] of Object.entries(kind === "feature" ? featureScaffold(name, pascalName(name), featureGovernance) : resourceScaffold(name, pascalName(name)))) {
         writes.push({ path: join13(dir, name, file).replaceAll("\\", "/"), content });
       }
   } else {
@@ -24896,6 +25353,8 @@ async function generateScaffold(args) {
     lines.push("No files written. Omit --dry-run to apply this generation.");
   if (kind === "resource")
     lines.push("Service and controller are registered in the generated module. No root module is guessed.", "Use --register-in <module.ts> to add an explicit parent import. Implement the read port before exposing the resource.", "Run app compile, app check --format json and your tests. No writes, permissions or persistence are inferred.");
+  if (kind === "feature")
+    lines.push(`Approval feature scaffold ${args.dry_run ? "planned" : "created"}; no database, authorization or job adapter is fabricated.`, "Bind the explicit RPC in compiler capabilities and runtime governance. Review the generated delivery checklist.", "Generate the client through app compile; no handwritten transport or database schema is created.");
   if (contractName) {
     const prefix = pascalName(contractName);
     lines.push("", "Next, bind the contract to a route so the compiler can check route/schema drift:", `  import { ${prefix}Body, ${prefix}Response } from "./contracts/${contractName}.contract";`, `  @Post("/", { body: ${prefix}Body, responses: { 200: ${prefix}Response } })`, "Fill in the schema fields and reuse them in command decoders; never widen them to unknown.");
@@ -26185,15 +26644,17 @@ function registerAppTools(server, options = {}) {
       "promote-status",
       "promote-reconcile"
     ]), "App action; promote obtains and verifies its plan before one mutation request"),
-    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource"]), "[generate] Scaffold kind"),
+    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
     template: optional(stringEnum(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
     name: optional(String2(), "[init/generate] Project or object name"),
     module: optional(String2(), "[generate] Target feature module (required for command/query/controller)"),
+    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
     dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
-    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/controller never overwrite"),
+    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
     dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
     "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
-    register_in: optional(String2(), "[generate] Existing parent module file for module/resource; uses the compiler AST editor"),
+    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
     "register-in": optional(String2(), "[generate] CLI alias of register_in"),
     root: optional(String2(), "[dev/plan/build/release/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
     include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
@@ -26215,14 +26676,16 @@ function registerAppTools(server, options = {}) {
 var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
 function registerAppAliases(server) {
   const schema = {
-    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource"]), "[generate] Scaffold kind"),
+    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
     name: optional(String2(), "[generate] Object name"),
     module: optional(String2(), "[generate] Target feature module"),
+    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
     dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
-    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/controller never overwrite"),
+    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
     dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
     "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
-    register_in: optional(String2(), "[generate] Existing parent module file for module/resource; uses the compiler AST editor"),
+    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
     "register-in": optional(String2(), "[generate] CLI alias of register_in"),
     root: optional(String2(), "Project directory containing supacloud.config.ts (default: current directory)"),
     include: optional(String2(), "[compile/check] Comma-separated glob patterns for source files"),
@@ -26262,7 +26725,7 @@ import {
   reverseDatabase
 } from "@supacloud/db";
 import { parseDatabaseSourcesConfig } from "@supacloud/db/source-contracts";
-var hash3 = (content) => createHash7("sha256").update(content).digest("hex");
+var hash4 = (content) => createHash7("sha256").update(content).digest("hex");
 var result = (value, isError = false) => ({
   isError,
   content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
@@ -26393,7 +26856,7 @@ async function initializeCandidate(stage, majorVersion = 17) {
   await mkdir6(join14(stage, "supabase/migrations"), { recursive: true });
   await mkdir6(join14(stage, "supabase/schemas"), { recursive: true });
   await writeFile5(join14(stage, "supabase/config.toml"), [
-    `project_id = "supacloud-candidate-${hash3(stage).slice(0, 12)}"`,
+    `project_id = "supacloud-candidate-${hash4(stage).slice(0, 12)}"`,
     "[db]",
     `major_version = ${majorVersion}`,
     "[db.migrations]",
@@ -26521,7 +26984,7 @@ async function migrations(root, path) {
   const files = [];
   for (const file of names) {
     const text = await readFile5(await projectPath2(root, `${path}/${file}`), "utf8");
-    files.push({ file, text, sha256: hash3(text) });
+    files.push({ file, text, sha256: hash4(text) });
   }
   return { dir, files };
 }
@@ -26551,7 +27014,7 @@ async function migrationAction(args, root, options) {
       files: input.files.map(({ file, sha256 }) => ({ file, sha256 })),
       dryRun
     };
-    const digest = hash3(JSON.stringify(report));
+    const digest = hash4(JSON.stringify(report));
     if (dryRun.isError)
       return result({ ...report, ok: false, digest, executionPerformed: false }, true);
     if (args.action === "plan")
@@ -28168,7 +28631,7 @@ async function requireProjectDeploymentProtocol(http, projectRef, environmentId)
     throw new Error("DEPLOYMENT_PROTOCOL_MISMATCH: Upgrade the SupaCloud server and CLI together (`npm install -g @supacloud/cli@latest`), then retry `supacloud deploy`. No upload or deployment was attempted; legacy endpoints will not be used.");
   }
 }
-var operation = "applications.project_deploy";
+var operation2 = "applications.project_deploy";
 var scopeSchema = _Object_({
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
@@ -28217,7 +28680,7 @@ async function runProjectDeployment(http, args) {
     ...args.web_release === undefined ? {} : { web_release: args.web_release }
   };
   if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
-    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
   }
   const expected = { ...scope, request };
   const identity = {
@@ -28235,13 +28698,13 @@ async function runProjectDeployment(http, args) {
   }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
   if (result.ok && result.status === 200) {
     try {
-      return releaseControlSuccess(operation, {
+      return releaseControlSuccess(operation2, {
         ...responseReceipt(result.data, expected),
         deployment_id: mutation_id
       });
     } catch {}
   } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
-    return releaseControlMutationFailure(operation, result, identity);
+    return releaseControlMutationFailure(operation2, result, identity);
   }
   const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
     retry: false,
@@ -28255,14 +28718,14 @@ async function runProjectDeployment(http, args) {
     if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
       throw new Error;
     const receipt = parseApplicationDeployResult(state.receipt, expected);
-    return releaseControlSuccess(operation, {
+    return releaseControlSuccess(operation2, {
       ...receipt,
       deployment_id: mutation_id,
       replayed: true,
       execution_performed: false
     });
   } catch {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+    return releaseControlFailure(operation2, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
   }
 }
 
@@ -29392,7 +29855,7 @@ function registerDeveloperExperienceTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.96.1",
+  version: "0.97.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29444,14 +29907,14 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.0",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/compiler": "^0.46.1",
+    "@supacloud/delivery": "0.18.0",
     "@supacloud/db": "0.17.0",
     typebox: "1.3.36"
   },
   overrides: {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/contracts": "0.9.0",
+    "@supacloud/delivery": "0.18.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {

package/dist/shared/tools/app-feature-generation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/tools/app-feature.d.ts

@@ -0,0 +1,9 @@
+/**
+ * An editable vertical feature slice. The generated ports are deliberately
+ * fail-closed: database access, authorization and durable command adapters
+ * remain application-owned and cannot be fabricated by the scaffold.
+ */
+export declare function featureScaffold(name: string, className: string, governance: {
+    permission: string;
+    rpc: string;
+}): Record<string, string>;

package/dist/shared/tools/app-tools.d.ts

@@ -65,10 +65,12 @@ export interface AppToolArguments {
     ttl_seconds?: number;
     wait?: boolean;
     timeout_seconds?: number;
-    kind?: "module" | "command" | "query" | "controller" | "job" | "contract" | "resource";
+    kind?: "module" | "command" | "query" | "controller" | "job" | "contract" | "resource" | "feature";
     template?: "minimal" | "http" | "command" | "edge";
     name?: string;
     module?: string;
+    permission?: string;
+    rpc?: string;
     dir?: string;
     force?: boolean;
     dry_run?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.96.1",
+  "version": "0.97.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,14 +52,14 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.46.0",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/compiler": "^0.46.1",
+    "@supacloud/delivery": "0.18.0",
     "@supacloud/db": "0.17.0",
     "typebox": "1.3.36"
   },
   "overrides": {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/contracts": "0.9.0",
+    "@supacloud/delivery": "0.18.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {