@supacloud/compiler 0.13.0 → 0.14.0

package/dist/config.d.ts

@@ -10,10 +10,15 @@ export interface SupaCloudConfig {
     generateClient?: boolean;
     generatePermissions?: boolean;
     moduleBoundaryPreset?: ModuleBoundaryPresetName;
+    moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
+    typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    allowRouteCommandBindings?: boolean;
+    disallowControllerDirectDb?: boolean;
+    detectOrphanModules?: boolean;
     commandCapabilities?: CommandExecutionCapabilities;
     treeShakeUnusedProviders?: boolean;
 }
-export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "commandCapabilities">> & {
+export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "commandCapabilities" | "moduleBoundaries" | "typeSafety" | "allowRouteCommandBindings" | "disallowControllerDirectDb" | "detectOrphanModules">> & {
     include: string[];
     moduleBoundaryPreset: ModuleBoundaryPresetName;
 };
@@ -28,6 +33,11 @@ export declare function resolveSupacloudConfig(config?: SupaCloudConfig, cwd?: s
     generatePermissions: boolean;
     moduleBoundaryPreset: ModuleBoundaryPresetName;
     commandCapabilities?: CommandExecutionCapabilities;
+    moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
+    typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    allowRouteCommandBindings?: boolean;
+    disallowControllerDirectDb?: boolean;
+    detectOrphanModules?: boolean;
     treeShakeUnusedProviders: boolean;
     graphql?: GraphqlOptions;
 };

package/dist/graphql-client.d.ts

@@ -1,2 +1,2 @@
 /** Appended to the generated SDK; browser consumers need only the platform fetch API. */
-export declare const GRAPHQL_CLIENT_SOURCE = "\nexport interface GraphqlClientOptions {\n  /** Project base URL, not the management API URL. HTTPS is required outside loopback. */\n  url: string;\n  /** Public project key only. Never put a service-role or management key in a browser. */\n  publishableKey?: string;\n  /** Resolved on every request so session refresh and logout are observed. */\n  getAccessToken?: () => string | null | undefined | Promise<string | null | undefined>;\n  fetch?: (url: string, init: RequestInit) => Promise<Response>;\n}\n\nexport interface GraphqlRequestOptions {\n  signal?: AbortSignal;\n}\n\nexport class GraphqlRequestError extends Error {\n  constructor(\n    public readonly code: \"http\" | \"graphql\" | \"invalid-response\",\n    message: string,\n    public readonly status?: number,\n    public readonly errors?: readonly unknown[],\n  ) {\n    super(message);\n    this.name = \"GraphqlRequestError\";\n  }\n}\n\nexport function createGraphqlClient(options: GraphqlClientOptions) {\n  const endpoint = new URL(options.url);\n  const loopback = [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(endpoint.hostname);\n  if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n    throw new Error(\"GraphQL requires HTTPS outside loopback development.\");\n  }\n  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {\n    throw new Error(\"GraphQL project URLs must not contain credentials, query parameters or fragments.\");\n  }\n  endpoint.pathname = endpoint.pathname.replace(/\\/$/, \"\") + \"/graphql/v1\";\n  const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return getSdk<GraphqlRequestOptions>(async <R, V>(\n    query: string,\n    variables?: V,\n    request?: GraphqlRequestOptions,\n  ): Promise<R> => {\n    const headers = new Headers({ \"Content-Type\": \"application/json\", Accept: \"application/json\" });\n    if (options.publishableKey) headers.set(\"apikey\", options.publishableKey);\n    const token = await options.getAccessToken?.();\n    if (token) headers.set(\"Authorization\", \"Bearer \" + token);\n    const response = await fetcher(endpoint.toString(), {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ query, variables }),\n      signal: request?.signal,\n      redirect: \"error\",\n    });\n    if (!response.ok) {\n      throw new GraphqlRequestError(\"http\", \"GraphQL HTTP request failed (\" + response.status + \").\", response.status);\n    }\n    let envelope: unknown;\n    try {\n      envelope = await response.json();\n    } catch {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid JSON.\", response.status);\n    }\n    if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned an invalid envelope.\", response.status);\n    }\n    if (\"errors\" in envelope) {\n      if (!Array.isArray(envelope.errors)) {\n        throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid errors.\", response.status);\n      }\n      if (envelope.errors.length > 0) {\n        throw new GraphqlRequestError(\"graphql\", \"GraphQL query failed.\", response.status, envelope.errors);\n      }\n    }\n    if (!(\"data\" in envelope) || !envelope.data || typeof envelope.data !== \"object\" || Array.isArray(envelope.data)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned no result object.\", response.status);\n    }\n    // Operation types describe the schema snapshot, not runtime response validation.\n    return envelope.data as R;\n  });\n}\n";
+export declare const GRAPHQL_CLIENT_SOURCE = "\nexport interface GraphqlClientOptions {\n  /** Project base URL, not the management API URL. HTTPS is required outside loopback. */\n  url: string;\n  /** Public project key only. Never put a service-role or management key in a browser. */\n  publishableKey?: string;\n  /** Resolved on every request so session refresh and logout are observed. */\n  getAccessToken?: () => string | null | undefined | Promise<string | null | undefined>;\n  fetch?: (url: string, init: RequestInit) => Promise<Response>;\n}\n\nexport interface GraphqlRequestOptions {\n  signal?: AbortSignal;\n}\n\nexport class GraphqlRequestError extends Error {\n  constructor(\n    public readonly code: \"http\" | \"graphql\" | \"invalid-response\",\n    message: string,\n    public readonly status?: number,\n    public readonly errors?: readonly unknown[],\n  ) {\n    super(message);\n    this.name = \"GraphqlRequestError\";\n  }\n}\n\nexport function createGraphqlClient(options: GraphqlClientOptions) {\n  const endpoint = new URL(options.url);\n  const loopback = [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(endpoint.hostname);\n  if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n    throw new Error(\"GraphQL requires HTTPS outside loopback development.\");\n  }\n  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {\n    throw new Error(\"GraphQL project URLs must not contain credentials, query parameters or fragments.\");\n  }\n  endpoint.pathname = endpoint.pathname.replace(/\\/$/, \"\") + \"/graphql/v1\";\n  const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return getSdk<GraphqlRequestOptions>(async (\n    query: string,\n    variables?: unknown,\n    request?: GraphqlRequestOptions,\n  ): Promise<unknown> => {\n    const headers = new Headers({ \"Content-Type\": \"application/json\", Accept: \"application/json\" });\n    if (options.publishableKey) headers.set(\"apikey\", options.publishableKey);\n    const token = await options.getAccessToken?.();\n    if (token) headers.set(\"Authorization\", \"Bearer \" + token);\n    const response = await fetcher(endpoint.toString(), {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ query, variables }),\n      ...(request?.signal ? { signal: request.signal } : {}),\n      redirect: \"error\",\n    });\n    if (!response.ok) {\n      throw new GraphqlRequestError(\"http\", \"GraphQL HTTP request failed (\" + response.status + \").\", response.status);\n    }\n    let envelope: unknown;\n    try {\n      envelope = await response.json();\n    } catch {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid JSON.\", response.status);\n    }\n    if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned an invalid envelope.\", response.status);\n    }\n    if (\"errors\" in envelope) {\n      if (!Array.isArray(envelope.errors)) {\n        throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid errors.\", response.status);\n      }\n      if (envelope.errors.length > 0) {\n        throw new GraphqlRequestError(\"graphql\", \"GraphQL query failed.\", response.status, envelope.errors);\n      }\n    }\n    if (!(\"data\" in envelope) || !envelope.data || typeof envelope.data !== \"object\" || Array.isArray(envelope.data)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned no result object.\", response.status);\n    }\n    // The operation-specific parser in getSdk validates selected field values.\n    return envelope.data;\n  });\n}\n";

package/dist/graphql-runtime.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Project the standard Codegen result types, rather than independently interpreting
+ * selections, fragments and conditional fields. Unsupported wire types fail closed.
+ */
+export declare function renderGraphqlValidators(source: string, operationNames: readonly string[]): string;

package/dist/index.js

@@ -1212,11 +1212,11 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
   }
   endpoint.pathname = endpoint.pathname.replace(/\\/$/, "") + "/graphql/v1";
   const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);
-  return getSdk<GraphqlRequestOptions>(async <R, V>(
+  return getSdk<GraphqlRequestOptions>(async (
     query: string,
-    variables?: V,
+    variables?: unknown,
     request?: GraphqlRequestOptions,
-  ): Promise<R> => {
+  ): Promise<unknown> => {
     const headers = new Headers({ "Content-Type": "application/json", Accept: "application/json" });
     if (options.publishableKey) headers.set("apikey", options.publishableKey);
     const token = await options.getAccessToken?.();
@@ -1225,7 +1225,7 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
       method: "POST",
       headers,
       body: JSON.stringify({ query, variables }),
-      signal: request?.signal,
+      ...(request?.signal ? { signal: request.signal } : {}),
       redirect: "error",
     });
     if (!response.ok) {
@@ -1251,8 +1251,8 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
     if (!("data" in envelope) || !envelope.data || typeof envelope.data !== "object" || Array.isArray(envelope.data)) {
       throw new GraphqlRequestError("invalid-response", "GraphQL returned no result object.", response.status);
     }
-    // Operation types describe the schema snapshot, not runtime response validation.
-    return envelope.data as R;
+    // The operation-specific parser in getSdk validates selected field values.
+    return envelope.data;
   });
 }
 `;
@@ -1326,6 +1326,165 @@ var init_graphql_inputs = __esm(() => {
   init_graphql_options();
 });
 
+// src/graphql-runtime.ts
+import * as ts7 from "@typescript/typescript6";
+import { resolve as resolve5 } from "node:path";
+function renderGraphqlValidators(source, operationNames) {
+  const fileName = resolve5("/__supacloud_graphql__/contracts.ts");
+  const options = {
+    strict: true,
+    noUncheckedIndexedAccess: true,
+    exactOptionalPropertyTypes: true,
+    noImplicitOverride: true,
+    noPropertyAccessFromIndexSignature: true,
+    noFallthroughCasesInSwitch: true,
+    skipLibCheck: false,
+    target: ts7.ScriptTarget.ES2022,
+    lib: ["lib.es2022.d.ts"],
+    types: [],
+    noEmit: true
+  };
+  const host = ts7.createCompilerHost(options);
+  const getSourceFile = host.getSourceFile.bind(host);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => path === fileName ? ts7.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  const program = ts7.createProgram([fileName], options, host);
+  const diagnostics = ts7.getPreEmitDiagnostics(program);
+  if (diagnostics.length) {
+    throw new Error(`Generated GraphQL types cannot be validated: ${diagnostics.map((item) => ts7.flattenDiagnosticMessageText(item.messageText, `
+`)).join("; ")}`);
+  }
+  const checker = program.getTypeChecker();
+  const entry = program.getSourceFile(fileName);
+  const module = entry && checker.getSymbolAtLocation(entry);
+  if (!module)
+    throw new Error("Generated GraphQL types have no module");
+  const exports = new Map(checker.getExportsOfModule(module).map((symbol) => [symbol.name, symbol]));
+  if (exports.has("GraphqlQueryResults")) {
+    throw new Error("GraphQL type GraphqlQueryResults conflicts with the generated result registry.");
+  }
+  const names = new Map;
+  const definitions = new Map;
+  function unsupported(type) {
+    throw new Error(`Unsupported GraphQL result wire type: ${checker.typeToString(type)}. Map custom scalars to JSON wire types or unknown.`);
+  }
+  function reference(type) {
+    const existing = names.get(type);
+    if (existing)
+      return existing;
+    const name = `checkGraphqlValue${names.size}`;
+    names.set(type, name);
+    definitions.set(name, "");
+    definitions.set(name, `function ${name}(value: unknown): boolean {
+  return ${expression(type)};
+}`);
+    return name;
+  }
+  function expression(type) {
+    if (type.flags & ts7.TypeFlags.Any)
+      return unsupported(type);
+    if (type.flags & ts7.TypeFlags.Unknown)
+      return "true";
+    if (type.flags & ts7.TypeFlags.Never)
+      return "false";
+    if (type.flags & ts7.TypeFlags.Null)
+      return "value === null";
+    if (type.flags & ts7.TypeFlags.Undefined)
+      return "value === undefined";
+    if (type.isStringLiteral() || type.isNumberLiteral())
+      return `value === ${JSON.stringify(type.value)}`;
+    if (type.flags & ts7.TypeFlags.BooleanLiteral)
+      return `value === ${checker.typeToString(type)}`;
+    if (type.flags & ts7.TypeFlags.String)
+      return 'typeof value === "string"';
+    if (type.flags & ts7.TypeFlags.Number)
+      return 'typeof value === "number" && Number.isFinite(value)';
+    if (type.flags & ts7.TypeFlags.Boolean)
+      return 'typeof value === "boolean"';
+    if (type.isUnion())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" || ");
+    if (type.isIntersection())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" && ");
+    if (checker.isTupleType(type))
+      return unsupported(type);
+    if (checker.isArrayType(type)) {
+      const item = checker.getIndexTypeOfType(type, ts7.IndexKind.Number);
+      if (!item)
+        return unsupported(type);
+      return `isGraphqlArray(value) && Array.from(value).every(${reference(item)})`;
+    }
+    if (type.flags & ts7.TypeFlags.Object) {
+      if (type.getCallSignatures().length || type.getConstructSignatures().length)
+        return unsupported(type);
+      const indexes = checker.getIndexInfosOfType(type);
+      if (indexes.some((index) => !(index.keyType.flags & ts7.TypeFlags.String)))
+        return unsupported(type);
+      const properties = checker.getPropertiesOfType(type).map((property2) => {
+        const declaration = property2.valueDeclaration ?? property2.declarations?.[0];
+        if (!declaration)
+          return unsupported(type);
+        const check = reference(checker.getTypeOfSymbolAtLocation(property2, declaration));
+        const key = JSON.stringify(property2.name);
+        const present = `Object.prototype.hasOwnProperty.call(value, ${key})`;
+        return property2.flags & ts7.SymbolFlags.Optional ? `(!${present} || ${check}(value[${key}]))` : `(${present} && ${check}(value[${key}]))`;
+      });
+      const indexedValues = indexes.map((index) => `Object.values(value).every(${reference(index.type)})`);
+      return ["isGraphqlRecord(value)", ...properties, ...indexedValues].join(" && ");
+    }
+    return unsupported(type);
+  }
+  const operations = [...operationNames].sort();
+  const parsers = operations.map((name) => {
+    const typeName = `${name}Query`;
+    const symbol = exports.get(typeName);
+    if (!symbol)
+      throw new Error(`Missing generated operation type: ${typeName}`);
+    const check = reference(checker.getDeclaredTypeOfSymbol(symbol));
+    return `export function is${typeName}(value: unknown): value is ${typeName} {
+  return ${check}(value);
+}
+export function parse${typeName}(value: unknown): ${typeName} {
+  if (!is${typeName}(value)) {
+    throw new GraphqlRequestError("invalid-response", ${JSON.stringify(`GraphQL result does not match ${name}.`)});
+  }
+  return value;
+}`;
+  });
+  return `
+function isGraphqlRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isGraphqlArray(value: unknown): value is unknown[] {
+  return Array.isArray(value);
+}
+${[...definitions.values()].join(`
+`)}
+${parsers.join(`
+`)}
+export interface GraphqlQueryResults {
+${operations.map((name) => `  ${JSON.stringify(name)}: ${name}Query;`).join(`
+`)}
+}
+export function isGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): value is GraphqlQueryResults[Name] {
+  switch (name) {
+${operations.map((name) => `    case ${JSON.stringify(name)}: return is${name}Query(value);`).join(`
+`)}
+    default: return false;
+  }
+}
+export function parseGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): GraphqlQueryResults[Name] {
+  if (!isGraphqlResult(name, value)) {
+    throw new GraphqlRequestError("invalid-response", "GraphQL result does not match operation " + name + ".");
+  }
+  return value;
+}
+`;
+}
+var init_graphql_runtime = () => {};
+
 // src/graphql.ts
 var exports_graphql = {};
 __export(exports_graphql, {
@@ -1349,7 +1508,6 @@ import {
   validateSchema
 } from "graphql";
 import { codegen } from "@graphql-codegen/core";
-import * as typescript from "@graphql-codegen/typescript";
 import * as operations from "@graphql-codegen/typescript-operations";
 async function renderGraphql(options) {
   const result = { diagnostics: [], files: {} };
@@ -1455,9 +1613,8 @@ async function renderGraphql(options) {
   try {
     const config = {
       useTypeImports: true,
-      skipTypename: true,
-      enumsAsTypes: true,
-      onlyOperationTypes: true,
+      nonOptionalTypename: false,
+      enumType: "string-literal",
       namingConvention: "keep",
       dedupeOperationSuffix: false,
       omitOperationSuffix: false,
@@ -1470,21 +1627,21 @@ async function renderGraphql(options) {
       schemaAst: schema,
       documents,
       config,
-      plugins: [{ typescript: {} }, { operations: {} }],
-      pluginMap: { typescript, operations }
+      plugins: [{ operations: {} }],
+      pluginMap: { operations }
     });
     const separated = separateOperations(combined);
     const methods = Object.entries(separated).sort(([a], [b]) => a.localeCompare(b)).map(([name, document]) => {
       const operation = document.definitions.find((node) => node.kind === Kind.OPERATION_DEFINITION);
-      if (operation.kind !== Kind.OPERATION_DEFINITION)
+      if (!operation || operation.kind !== Kind.OPERATION_DEFINITION)
         throw new Error("Missing query operation");
       const required = operation.variableDefinitions?.some((variable) => variable.type.kind === Kind.NON_NULL_TYPE && !variable.defaultValue);
-      return `    ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
-      return requester<${name}Query, ${name}QueryVariables>(${JSON.stringify(print(document))}, variables, options);
+      return `    async ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
+      return parse${name}Query(await requester(${JSON.stringify(print(document))}, variables, options));
     }`;
     });
     const facade = `
-export type Requester<C> = <R, V>(query: string, variables?: V, options?: C) => Promise<R>;
+export type Requester<C> = (query: string, variables?: unknown, options?: C) => Promise<unknown>;
 export function getSdk<C>(requester: Requester<C>) {
   return {
 ${methods.join(`,
@@ -1492,8 +1649,9 @@ ${methods.join(`,
   };
 }
 `;
+    const validators = renderGraphqlValidators(generated, queryEntries.map((entry) => entry.name));
     result.files["graphql.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
-` + generated + facade + GRAPHQL_CLIENT_SOURCE;
+` + generated + validators + facade + GRAPHQL_CLIENT_SOURCE;
     if (options.graphql.typedDocuments) {
       const typedDocuments = await import("@graphql-codegen/typed-document-node");
       result.files["graphql.documents.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
@@ -1503,8 +1661,8 @@ ${methods.join(`,
         schemaAst: schema,
         documents,
         config,
-        plugins: [{ typescript: {} }, { operations: {} }, { typedDocuments: {} }],
-        pluginMap: { typescript, operations, typedDocuments }
+        plugins: [{ operations: {} }, { typedDocuments: {} }],
+        pluginMap: { operations, typedDocuments }
       });
     }
     result.files["graphql.manifest.json"] = JSON.stringify({
@@ -1522,6 +1680,7 @@ ${methods.join(`,
 var init_graphql = __esm(() => {
   init_graphql_inputs();
   init_graphql_options();
+  init_graphql_runtime();
 });
 
 // src/graphql-schema.ts
@@ -1531,7 +1690,7 @@ __export(exports_graphql_schema, {
 });
 import { mkdir as mkdir2, readFile as readFile4 } from "node:fs/promises";
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname7, resolve as resolve8 } from "node:path";
+import { dirname as dirname7, resolve as resolve9 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -1571,7 +1730,7 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema2(data));
-  const path = resolve8(options.output);
+  const path = resolve9(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
@@ -5626,12 +5785,12 @@ function resolveTypeSafety(options) {
 }
 // src/watch.ts
 import { existsSync as existsSync4, watch } from "node:fs";
-import { dirname as dirname5, relative as relative7, resolve as resolve6, sep as sep7 } from "node:path";
+import { dirname as dirname5, relative as relative7, resolve as resolve7, sep as sep7 } from "node:path";
 
 // src/incremental.ts
 import { createHash as createHash6 } from "node:crypto";
 import { access as access2, readdir, readFile as readFile3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve5, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve6, sep as sep6 } from "node:path";
 init_graphql_inputs();
 function createDependencyGraphCache() {
   return {
@@ -5706,11 +5865,11 @@ function createIncrementalCompiler() {
   };
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve5(options.rootDir);
-  const outDir = resolve5(options.outDir);
+  const rootDir = resolve6(options.rootDir);
+  const outDir = resolve6(options.outDir);
   const files = { ...previous.files };
   for (const changedPath of changedPaths) {
-    const absolutePath = isAbsolute2(changedPath) ? resolve5(changedPath) : resolve5(rootDir, changedPath);
+    const absolutePath = isAbsolute2(changedPath) ? resolve6(changedPath) : resolve6(rootDir, changedPath);
     const relativeChangedPath = relative6(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep6}`))
       continue;
@@ -5728,8 +5887,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve5(options.rootDir);
-  const outDir = resolve5(options.outDir);
+  const rootDir = resolve6(options.rootDir);
+  const outDir = resolve6(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   for (const path of paths) {
@@ -5748,8 +5907,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve5(options.rootDir),
-    outDir: resolve5(options.outDir),
+    rootDir: resolve6(options.rootDir),
+    outDir: resolve6(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -5771,7 +5930,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const path = resolve5(directory, entry.name);
+      const path = resolve6(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -5895,8 +6054,8 @@ function findAffectedModules(previous, current, changedFiles) {
 // src/watch.ts
 var DEFAULT_DEBOUNCE_MS = 100;
 function watchProject(options) {
-  const rootDir = resolve6(options.rootDir);
-  const outDir = resolve6(options.outDir);
+  const rootDir = resolve7(options.rootDir);
+  const outDir = resolve7(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -5905,7 +6064,7 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve6(rootDir, options.graphql.schema) : undefined;
+  const schemaPath = options.graphql ? resolve7(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -5982,7 +6141,7 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve6(rootDir, filename.toString());
+      const changedPath = resolve7(rootDir, filename.toString());
       const relativePath = relative7(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
@@ -5995,7 +6154,7 @@ function watchProject(options) {
       while (!existsSync4(directory) && dirname5(directory) !== directory)
         directory = dirname5(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve6(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve7(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -6293,7 +6452,7 @@ init_generate();
 // src/config.ts
 init_graphql_options();
 import { existsSync as existsSync6 } from "node:fs";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { join as join6, resolve as resolve8 } from "node:path";
 import { pathToFileURL } from "node:url";
 var DEFAULT_SUPACLOUD_CONFIG = {
   graphql: false,
@@ -6310,6 +6469,7 @@ var DEFAULT_SUPACLOUD_CONFIG = {
 function defineSupacloudConfig(config = {}) {
   if (config.graphql !== undefined && config.graphql !== false)
     assertGraphqlOptions(config.graphql);
+  validateGovernanceConfig(config);
   return {
     ...DEFAULT_SUPACLOUD_CONFIG,
     ...config,
@@ -6317,11 +6477,35 @@ function defineSupacloudConfig(config = {}) {
     graphql: config.graphql ?? DEFAULT_SUPACLOUD_CONFIG.graphql
   };
 }
+function validateGovernanceConfig(config) {
+  const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+  const isStrings = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string" && item.trim().length > 0);
+  if (config.moduleBoundaries !== undefined) {
+    if (!Array.isArray(config.moduleBoundaries))
+      throw new Error("moduleBoundaries must be an array of module tag rules.");
+    const rules = config.moduleBoundaries;
+    for (const rule of rules) {
+      if (!isRecord(rule) || typeof rule["sourceTag"] !== "string" || !rule["sourceTag"].trim() || Object.keys(rule).some((key) => !["sourceTag", "onlyDependOnLibsWithTags", "bannedDependenciesWithTags"].includes(key)) || rule["onlyDependOnLibsWithTags"] !== undefined && !isStrings(rule["onlyDependOnLibsWithTags"]) || rule["bannedDependenciesWithTags"] !== undefined && !isStrings(rule["bannedDependenciesWithTags"])) {
+        throw new Error("moduleBoundaries rules require sourceTag and optional string arrays onlyDependOnLibsWithTags/bannedDependenciesWithTags.");
+      }
+    }
+  }
+  if (config.typeSafety !== undefined) {
+    const rules = config.typeSafety;
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    }
+  }
+  for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
+    if (config[key] !== undefined && typeof config[key] !== "boolean")
+      throw new Error(`${key} must be a boolean.`);
+  }
+}
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve7(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve7(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve8(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve8(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -6329,10 +6513,15 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     generatePermissions: resolved.generatePermissions ?? DEFAULT_SUPACLOUD_CONFIG.generatePermissions,
     moduleBoundaryPreset: resolved.moduleBoundaryPreset ?? DEFAULT_SUPACLOUD_CONFIG.moduleBoundaryPreset,
     commandCapabilities: resolved.commandCapabilities,
+    ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
+    ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
+    ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
+    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
+    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     graphql: resolved.graphql ? {
       ...resolved.graphql,
-      schema: resolve7(cwd, resolved.graphql.schema)
+      schema: resolve8(cwd, resolved.graphql.schema)
     } : undefined
   };
 }
@@ -6350,20 +6539,7 @@ async function loadSupacloudConfig(cwd = process.cwd()) {
   return defineSupacloudConfig(imported.default ?? {});
 }
 function compileOptionsFromConfig(config, cwd = process.cwd()) {
-  const resolved = resolveSupacloudConfig(config, cwd);
-  return {
-    rootDir: resolved.rootDir,
-    outDir: resolved.outDir,
-    include: resolved.include,
-    strict: resolved.strict,
-    requireRouteContracts: resolved.requireRouteContracts,
-    generateClient: resolved.generateClient,
-    generatePermissions: resolved.generatePermissions,
-    moduleBoundaryPreset: resolved.moduleBoundaryPreset,
-    commandCapabilities: resolved.commandCapabilities,
-    treeShakeUnusedProviders: resolved.treeShakeUnusedProviders,
-    graphql: resolved.graphql
-  };
+  return resolveSupacloudConfig(config, cwd);
 }
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/compiler",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,9 @@
     "build:js": "bun build src/index.ts src/cli.ts --outdir dist --target node --external @typescript/typescript6 --external graphql --external '@graphql-codegen/*'",
     "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
     "clean": "rm -rf dist",
-    "prepublishOnly": "bun run build",
+    "prepublishOnly": "bun run build && bun run test:package",
     "test": "bun test",
+    "test:package": "SUPACLOUD_COMPILER_TEST_CLI=\"$PWD/dist/cli.js\" bun test src/graphql-package.test.ts",
     "benchmark": "bun run src/benchmark.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
@@ -47,7 +48,6 @@
   "dependencies": {
     "@graphql-codegen/core": "^6.2.0",
     "@graphql-codegen/typed-document-node": "^7.1.0",
-    "@graphql-codegen/typescript": "^6.1.0",
     "@graphql-codegen/typescript-operations": "^6.1.6",
     "@graphql-typed-document-node/core": "^3.2.0",
     "@typescript/typescript6": "^6.0.2",