@supacloud/compiler 0.13.1 → 0.15.0

package/README.md

@@ -119,12 +119,49 @@ const result = await queries.ReviewList({ first: 20 });
 
 Method names and types come from named operations. The generated client is
 dependency-free and refreshes identity per request; `getSdk(requester)` integrates
-an existing transport. It rejects HTTP errors, GraphQL errors and malformed
-response envelopes, but does not runtime-decode selected field values.
+an existing transport returning `Promise<unknown>`. It rejects HTTP errors,
+GraphQL errors, malformed response envelopes and invalid selected field values.
+Both clients run generated operation parsers before returning typed data. No
+customer TypeScript-to-TypeBox postprocessor or extra runtime dependency is needed.
+The same module exports `parseReviewListQuery(value: unknown)` and
+`isReviewListQuery(value: unknown)` for other integration boundaries (names follow
+your operations). Validation follows the generated selected JSON shape, including
+aliases, fragments, enums, lists, nullability and optional conditional fields.
+Unmapped scalars remain `unknown`; scalar domain formats and authorization still
+need business validation. Non-JSON scalar mappings such as `Date` fail compilation;
+map the wire value to `string` and convert it after validation instead.
+Generic application adapters can use `GraphqlQueryResults[Name]`,
+`parseGraphqlResult(name, value)` and `isGraphqlResult(name, value)` instead of
+maintaining their own result-type registry. Registry keys are operation names
+such as `"ReviewList"`, without the `Query` type suffix.
 `graphql.manifest.json` records query locations and the schema hash; context packs
 include colocated queries. RLS/grants, real database acceptance and query resource
 limits remain deployment responsibilities. Business writes stay in Commands.
 
+Use project configuration instead of a custom compile wrapper for shared rules:
+
+```ts
+export default defineSupacloudConfig({
+  root: "src",
+  graphql: { schema: "graphql/schema.graphql" },
+  moduleBoundaries: [{
+    sourceTag: "type:feature",
+    bannedDependenciesWithTags: ["type:feature"],
+  }],
+  typeSafety: { scanProductionSource: true, noAnyInGenerated: true },
+  allowRouteCommandBindings: false,
+});
+```
+
+`compile`, `check` and `dev` apply these options through the same compiler pipeline.
+`check` also compares generated validators without temporary directories or writes.
+`allowRouteCommandBindings: false` prevents duplicate governance when an application
+executes Commands inside its own service boundary. `disallowControllerDirectDb`
+and `detectOrphanModules` expose the existing optional architecture checks too.
+Keep application-specific governance and business queries in the application.
+See `docs/compiler-consumer-simplification.md` in the repository for the ownership
+checklist and migration boundaries.
+
 ## 安装
 
 ```bash

package/dist/cli.js

@@ -26,10 +26,11 @@ function camelName(token) {
   return token.charAt(0).toLowerCase() + token.slice(1);
 }
 function relativeImportPath(fromDir, toFile) {
-  const fromParts = fromDir.split("/").filter(Boolean);
-  const toParts = toFile.split("/").filter(Boolean);
+  const fromParts = fromDir.split(/[\\/]/).filter(Boolean);
+  const toParts = toFile.split(/[\\/]/).filter(Boolean);
+  const isWindows = process.platform === "win32" || /^[a-zA-Z]:/.test(fromParts[0] ?? "") || /^[a-zA-Z]:/.test(toParts[0] ?? "");
   let common = 0;
-  while (common < fromParts.length && common < toParts.length && fromParts[common] === toParts[common]) {
+  while (common < fromParts.length && common < toParts.length && (fromParts[common] === toParts[common] || isWindows && fromParts[common].toLowerCase() === toParts[common].toLowerCase())) {
     common += 1;
   }
   const ups = fromParts.length - common;
@@ -1213,11 +1214,11 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
   }
   endpoint.pathname = endpoint.pathname.replace(/\\/$/, "") + "/graphql/v1";
   const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);
-  return getSdk<GraphqlRequestOptions>(async <R, V>(
+  return getSdk<GraphqlRequestOptions>(async (
     query: string,
-    variables?: V,
+    variables?: unknown,
     request?: GraphqlRequestOptions,
-  ): Promise<R> => {
+  ): Promise<unknown> => {
     const headers = new Headers({ "Content-Type": "application/json", Accept: "application/json" });
     if (options.publishableKey) headers.set("apikey", options.publishableKey);
     const token = await options.getAccessToken?.();
@@ -1252,8 +1253,8 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
     if (!("data" in envelope) || !envelope.data || typeof envelope.data !== "object" || Array.isArray(envelope.data)) {
       throw new GraphqlRequestError("invalid-response", "GraphQL returned no result object.", response.status);
     }
-    // Operation types describe the schema snapshot, not runtime response validation.
-    return envelope.data as R;
+    // The operation-specific parser in getSdk validates selected field values.
+    return envelope.data;
   });
 }
 `;
@@ -1327,6 +1328,165 @@ var init_graphql_inputs = __esm(() => {
   init_graphql_options();
 });
 
+// src/graphql-runtime.ts
+import * as ts6 from "@typescript/typescript6";
+import { resolve as resolve4 } from "node:path";
+function renderGraphqlValidators(source, operationNames) {
+  const fileName = resolve4("/__supacloud_graphql__/contracts.ts");
+  const options = {
+    strict: true,
+    noUncheckedIndexedAccess: true,
+    exactOptionalPropertyTypes: true,
+    noImplicitOverride: true,
+    noPropertyAccessFromIndexSignature: true,
+    noFallthroughCasesInSwitch: true,
+    skipLibCheck: false,
+    target: ts6.ScriptTarget.ES2022,
+    lib: ["lib.es2022.d.ts"],
+    types: [],
+    noEmit: true
+  };
+  const host = ts6.createCompilerHost(options);
+  const getSourceFile = host.getSourceFile.bind(host);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => path === fileName ? ts6.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  const program = ts6.createProgram([fileName], options, host);
+  const diagnostics = ts6.getPreEmitDiagnostics(program);
+  if (diagnostics.length) {
+    throw new Error(`Generated GraphQL types cannot be validated: ${diagnostics.map((item) => ts6.flattenDiagnosticMessageText(item.messageText, `
+`)).join("; ")}`);
+  }
+  const checker = program.getTypeChecker();
+  const entry = program.getSourceFile(fileName);
+  const module = entry && checker.getSymbolAtLocation(entry);
+  if (!module)
+    throw new Error("Generated GraphQL types have no module");
+  const exports = new Map(checker.getExportsOfModule(module).map((symbol) => [symbol.name, symbol]));
+  if (exports.has("GraphqlQueryResults")) {
+    throw new Error("GraphQL type GraphqlQueryResults conflicts with the generated result registry.");
+  }
+  const names = new Map;
+  const definitions = new Map;
+  function unsupported(type) {
+    throw new Error(`Unsupported GraphQL result wire type: ${checker.typeToString(type)}. Map custom scalars to JSON wire types or unknown.`);
+  }
+  function reference(type) {
+    const existing = names.get(type);
+    if (existing)
+      return existing;
+    const name = `checkGraphqlValue${names.size}`;
+    names.set(type, name);
+    definitions.set(name, "");
+    definitions.set(name, `function ${name}(value: unknown): boolean {
+  return ${expression(type)};
+}`);
+    return name;
+  }
+  function expression(type) {
+    if (type.flags & ts6.TypeFlags.Any)
+      return unsupported(type);
+    if (type.flags & ts6.TypeFlags.Unknown)
+      return "true";
+    if (type.flags & ts6.TypeFlags.Never)
+      return "false";
+    if (type.flags & ts6.TypeFlags.Null)
+      return "value === null";
+    if (type.flags & ts6.TypeFlags.Undefined)
+      return "value === undefined";
+    if (type.isStringLiteral() || type.isNumberLiteral())
+      return `value === ${JSON.stringify(type.value)}`;
+    if (type.flags & ts6.TypeFlags.BooleanLiteral)
+      return `value === ${checker.typeToString(type)}`;
+    if (type.flags & ts6.TypeFlags.String)
+      return 'typeof value === "string"';
+    if (type.flags & ts6.TypeFlags.Number)
+      return 'typeof value === "number" && Number.isFinite(value)';
+    if (type.flags & ts6.TypeFlags.Boolean)
+      return 'typeof value === "boolean"';
+    if (type.isUnion())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" || ");
+    if (type.isIntersection())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" && ");
+    if (checker.isTupleType(type))
+      return unsupported(type);
+    if (checker.isArrayType(type)) {
+      const item = checker.getIndexTypeOfType(type, ts6.IndexKind.Number);
+      if (!item)
+        return unsupported(type);
+      return `isGraphqlArray(value) && Array.from(value).every(${reference(item)})`;
+    }
+    if (type.flags & ts6.TypeFlags.Object) {
+      if (type.getCallSignatures().length || type.getConstructSignatures().length)
+        return unsupported(type);
+      const indexes = checker.getIndexInfosOfType(type);
+      if (indexes.some((index) => !(index.keyType.flags & ts6.TypeFlags.String)))
+        return unsupported(type);
+      const properties = checker.getPropertiesOfType(type).map((property) => {
+        const declaration = property.valueDeclaration ?? property.declarations?.[0];
+        if (!declaration)
+          return unsupported(type);
+        const check = reference(checker.getTypeOfSymbolAtLocation(property, declaration));
+        const key = JSON.stringify(property.name);
+        const present = `Object.prototype.hasOwnProperty.call(value, ${key})`;
+        return property.flags & ts6.SymbolFlags.Optional ? `(!${present} || ${check}(value[${key}]))` : `(${present} && ${check}(value[${key}]))`;
+      });
+      const indexedValues = indexes.map((index) => `Object.values(value).every(${reference(index.type)})`);
+      return ["isGraphqlRecord(value)", ...properties, ...indexedValues].join(" && ");
+    }
+    return unsupported(type);
+  }
+  const operations = [...operationNames].sort();
+  const parsers = operations.map((name) => {
+    const typeName = `${name}Query`;
+    const symbol = exports.get(typeName);
+    if (!symbol)
+      throw new Error(`Missing generated operation type: ${typeName}`);
+    const check = reference(checker.getDeclaredTypeOfSymbol(symbol));
+    return `export function is${typeName}(value: unknown): value is ${typeName} {
+  return ${check}(value);
+}
+export function parse${typeName}(value: unknown): ${typeName} {
+  if (!is${typeName}(value)) {
+    throw new GraphqlRequestError("invalid-response", ${JSON.stringify(`GraphQL result does not match ${name}.`)});
+  }
+  return value;
+}`;
+  });
+  return `
+function isGraphqlRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isGraphqlArray(value: unknown): value is unknown[] {
+  return Array.isArray(value);
+}
+${[...definitions.values()].join(`
+`)}
+${parsers.join(`
+`)}
+export interface GraphqlQueryResults {
+${operations.map((name) => `  ${JSON.stringify(name)}: ${name}Query;`).join(`
+`)}
+}
+export function isGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): value is GraphqlQueryResults[Name] {
+  switch (name) {
+${operations.map((name) => `    case ${JSON.stringify(name)}: return is${name}Query(value);`).join(`
+`)}
+    default: return false;
+  }
+}
+export function parseGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): GraphqlQueryResults[Name] {
+  if (!isGraphqlResult(name, value)) {
+    throw new GraphqlRequestError("invalid-response", "GraphQL result does not match operation " + name + ".");
+  }
+  return value;
+}
+`;
+}
+var init_graphql_runtime = () => {};
+
 // src/graphql.ts
 var exports_graphql = {};
 __export(exports_graphql, {
@@ -1475,15 +1635,15 @@ async function renderGraphql(options) {
     const separated = separateOperations(combined);
     const methods = Object.entries(separated).sort(([a], [b]) => a.localeCompare(b)).map(([name, document]) => {
       const operation = document.definitions.find((node) => node.kind === Kind.OPERATION_DEFINITION);
-      if (operation.kind !== Kind.OPERATION_DEFINITION)
+      if (!operation || operation.kind !== Kind.OPERATION_DEFINITION)
         throw new Error("Missing query operation");
       const required = operation.variableDefinitions?.some((variable) => variable.type.kind === Kind.NON_NULL_TYPE && !variable.defaultValue);
-      return `    ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
-      return requester<${name}Query, ${name}QueryVariables>(${JSON.stringify(print(document))}, variables, options);
+      return `    async ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
+      return parse${name}Query(await requester(${JSON.stringify(print(document))}, variables, options));
     }`;
     });
     const facade = `
-export type Requester<C> = <R, V>(query: string, variables?: V, options?: C) => Promise<R>;
+export type Requester<C> = (query: string, variables?: unknown, options?: C) => Promise<unknown>;
 export function getSdk<C>(requester: Requester<C>) {
   return {
 ${methods.join(`,
@@ -1491,8 +1651,9 @@ ${methods.join(`,
   };
 }
 `;
+    const validators = renderGraphqlValidators(generated, queryEntries.map((entry) => entry.name));
     result.files["graphql.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
-` + generated + facade + GRAPHQL_CLIENT_SOURCE;
+` + generated + validators + facade + GRAPHQL_CLIENT_SOURCE;
     if (options.graphql.typedDocuments) {
       const typedDocuments = await import("@graphql-codegen/typed-document-node");
       result.files["graphql.documents.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
@@ -1521,6 +1682,7 @@ ${methods.join(`,
 var init_graphql = __esm(() => {
   init_graphql_inputs();
   init_graphql_options();
+  init_graphql_runtime();
 });
 
 // src/graphql-schema.ts
@@ -1530,7 +1692,7 @@ __export(exports_graphql_schema, {
 });
 import { mkdir as mkdir2, readFile as readFile4 } from "node:fs/promises";
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname7, resolve as resolve8 } from "node:path";
+import { dirname as dirname7, resolve as resolve9 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -1570,11 +1732,10 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema2(data));
-  const path = resolve8(options.output);
+  const path = resolve9(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
-# Database First: change database declarations, apply migrations, then re-export for the intended role.
 ` + printSchema2(schema) + `
 `;
   let previous;
@@ -1598,7 +1759,7 @@ var init_graphql_schema = __esm(() => {
 });
 
 // src/cli.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 import { readFile as readFile5 } from "node:fs/promises";
 
 // src/analyze.ts
@@ -5701,12 +5862,12 @@ function exportGraphDot(graph) {
 
 // src/watch.ts
 import { existsSync as existsSync5, watch } from "node:fs";
-import { dirname as dirname5, relative as relative7, resolve as resolve5, sep as sep7 } from "node:path";
+import { dirname as dirname5, relative as relative7, resolve as resolve6, sep as sep7 } from "node:path";
 
 // src/incremental.ts
 import { createHash as createHash6 } from "node:crypto";
 import { access as access2, readdir, readFile as readFile2 } from "node:fs/promises";
-import { isAbsolute, relative as relative6, resolve as resolve4, sep as sep6 } from "node:path";
+import { isAbsolute, relative as relative6, resolve as resolve5, sep as sep6 } from "node:path";
 init_graphql_inputs();
 function createDependencyGraphCache() {
   return {
@@ -5781,11 +5942,11 @@ function createIncrementalCompiler() {
   };
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve4(options.rootDir);
-  const outDir = resolve4(options.outDir);
+  const rootDir = resolve5(options.rootDir);
+  const outDir = resolve5(options.outDir);
   const files = { ...previous.files };
   for (const changedPath of changedPaths) {
-    const absolutePath = isAbsolute(changedPath) ? resolve4(changedPath) : resolve4(rootDir, changedPath);
+    const absolutePath = isAbsolute(changedPath) ? resolve5(changedPath) : resolve5(rootDir, changedPath);
     const relativeChangedPath = relative6(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep6}`))
       continue;
@@ -5803,8 +5964,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve4(options.rootDir);
-  const outDir = resolve4(options.outDir);
+  const rootDir = resolve5(options.rootDir);
+  const outDir = resolve5(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   for (const path of paths) {
@@ -5823,8 +5984,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve4(options.rootDir),
-    outDir: resolve4(options.outDir),
+    rootDir: resolve5(options.rootDir),
+    outDir: resolve5(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -5846,7 +6007,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const path = resolve4(directory, entry.name);
+      const path = resolve5(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -5970,8 +6131,8 @@ function findAffectedModules(previous, current, changedFiles) {
 // src/watch.ts
 var DEFAULT_DEBOUNCE_MS = 100;
 function watchProject(options) {
-  const rootDir = resolve5(options.rootDir);
-  const outDir = resolve5(options.outDir);
+  const rootDir = resolve6(options.rootDir);
+  const outDir = resolve6(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -5980,7 +6141,7 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve5(rootDir, options.graphql.schema) : undefined;
+  const schemaPath = options.graphql ? resolve6(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -6057,7 +6218,7 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve5(rootDir, filename.toString());
+      const changedPath = resolve6(rootDir, filename.toString());
       const relativePath = relative7(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
@@ -6070,7 +6231,7 @@ function watchProject(options) {
       while (!existsSync5(directory) && dirname5(directory) !== directory)
         directory = dirname5(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve5(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve6(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -6097,7 +6258,7 @@ function watchProject(options) {
 // src/config.ts
 init_graphql_options();
 import { existsSync as existsSync6 } from "node:fs";
-import { join as join6, resolve as resolve6 } from "node:path";
+import { join as join6, resolve as resolve7 } from "node:path";
 import { pathToFileURL } from "node:url";
 var DEFAULT_SUPACLOUD_CONFIG = {
   graphql: false,
@@ -6114,6 +6275,7 @@ var DEFAULT_SUPACLOUD_CONFIG = {
 function defineSupacloudConfig(config = {}) {
   if (config.graphql !== undefined && config.graphql !== false)
     assertGraphqlOptions(config.graphql);
+  validateGovernanceConfig(config);
   return {
     ...DEFAULT_SUPACLOUD_CONFIG,
     ...config,
@@ -6121,11 +6283,35 @@ function defineSupacloudConfig(config = {}) {
     graphql: config.graphql ?? DEFAULT_SUPACLOUD_CONFIG.graphql
   };
 }
+function validateGovernanceConfig(config) {
+  const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+  const isStrings = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string" && item.trim().length > 0);
+  if (config.moduleBoundaries !== undefined) {
+    if (!Array.isArray(config.moduleBoundaries))
+      throw new Error("moduleBoundaries must be an array of module tag rules.");
+    const rules = config.moduleBoundaries;
+    for (const rule of rules) {
+      if (!isRecord(rule) || typeof rule["sourceTag"] !== "string" || !rule["sourceTag"].trim() || Object.keys(rule).some((key) => !["sourceTag", "onlyDependOnLibsWithTags", "bannedDependenciesWithTags"].includes(key)) || rule["onlyDependOnLibsWithTags"] !== undefined && !isStrings(rule["onlyDependOnLibsWithTags"]) || rule["bannedDependenciesWithTags"] !== undefined && !isStrings(rule["bannedDependenciesWithTags"])) {
+        throw new Error("moduleBoundaries rules require sourceTag and optional string arrays onlyDependOnLibsWithTags/bannedDependenciesWithTags.");
+      }
+    }
+  }
+  if (config.typeSafety !== undefined) {
+    const rules = config.typeSafety;
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    }
+  }
+  for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
+    if (config[key] !== undefined && typeof config[key] !== "boolean")
+      throw new Error(`${key} must be a boolean.`);
+  }
+}
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve6(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve6(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve7(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve7(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -6133,10 +6319,15 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     generatePermissions: resolved.generatePermissions ?? DEFAULT_SUPACLOUD_CONFIG.generatePermissions,
     moduleBoundaryPreset: resolved.moduleBoundaryPreset ?? DEFAULT_SUPACLOUD_CONFIG.moduleBoundaryPreset,
     commandCapabilities: resolved.commandCapabilities,
+    ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
+    ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
+    ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
+    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
+    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     graphql: resolved.graphql ? {
       ...resolved.graphql,
-      schema: resolve6(cwd, resolved.graphql.schema)
+      schema: resolve7(cwd, resolved.graphql.schema)
     } : undefined
   };
 }
@@ -6154,32 +6345,19 @@ async function loadSupacloudConfig(cwd = process.cwd()) {
   return defineSupacloudConfig(imported.default ?? {});
 }
 function compileOptionsFromConfig(config, cwd = process.cwd()) {
-  const resolved = resolveSupacloudConfig(config, cwd);
-  return {
-    rootDir: resolved.rootDir,
-    outDir: resolved.outDir,
-    include: resolved.include,
-    strict: resolved.strict,
-    requireRouteContracts: resolved.requireRouteContracts,
-    generateClient: resolved.generateClient,
-    generatePermissions: resolved.generatePermissions,
-    moduleBoundaryPreset: resolved.moduleBoundaryPreset,
-    commandCapabilities: resolved.commandCapabilities,
-    treeShakeUnusedProviders: resolved.treeShakeUnusedProviders,
-    graphql: resolved.graphql
-  };
+  return resolveSupacloudConfig(config, cwd);
 }
 
 // src/fixes.ts
 import { randomUUID } from "node:crypto";
 import { lstat, readFile as readFile3, realpath, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, relative as relative8, resolve as resolve7, sep as sep8 } from "node:path";
-import * as ts6 from "@typescript/typescript6";
+import { dirname as dirname6, isAbsolute as isAbsolute2, relative as relative8, resolve as resolve8, sep as sep8 } from "node:path";
+import * as ts7 from "@typescript/typescript6";
 async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
   const root = await realpath(options.rootDir ?? process.cwd());
-  const file = resolve7(root, fix.targetFile);
+  const file = resolve8(root, fix.targetFile);
   const stat = await lstat(file);
   const resolved = await realpath(file);
   const relativePath = relative8(root, resolved);
@@ -6199,7 +6377,7 @@ async function applyDiagnosticFix(fix, options = {}) {
       if (!current || current.initializer.getText(source) !== fix.expectedExpression) {
         throw new Error("Command mode changed since diagnosis; analyze the project again");
       }
-      content = replaceProperty(source, object, fix.property, ts6.factory.createStringLiteral(fix.value));
+      content = replaceProperty(source, object, fix.property, ts7.factory.createStringLiteral(fix.value));
       break;
     }
     case "add_module_import": {
@@ -6210,15 +6388,15 @@ async function applyDiagnosticFix(fix, options = {}) {
       source = parse2(file, withImport);
       const object = unique(moduleObjects(source).filter((candidate) => !fix.targetModule || stringProperty(candidate, "name") === fix.targetModule), "target module");
       const imports = property(object, "imports");
-      if (imports && !ts6.isArrayLiteralExpression(imports.initializer)) {
+      if (imports && !ts7.isArrayLiteralExpression(imports.initializer)) {
         throw new Error("Module imports must be a static array");
       }
-      const values = imports && ts6.isArrayLiteralExpression(imports.initializer) ? imports.initializer.elements : [];
-      if (values.some(ts6.isSpreadElement))
+      const values = imports && ts7.isArrayLiteralExpression(imports.initializer) ? imports.initializer.elements : [];
+      if (values.some(ts7.isSpreadElement))
         throw new Error("Module imports cannot contain spread elements");
-      content = values.some((value) => ts6.isIdentifier(value) && value.text === fix.symbol) ? withImport : replaceProperty(source, object, "imports", ts6.factory.createArrayLiteralExpression([
+      content = values.some((value) => ts7.isIdentifier(value) && value.text === fix.symbol) ? withImport : replaceProperty(source, object, "imports", ts7.factory.createArrayLiteralExpression([
         ...values,
-        ts6.factory.createIdentifier(fix.symbol)
+        ts7.factory.createIdentifier(fix.symbol)
       ]));
       break;
     }
@@ -6230,24 +6408,24 @@ async function applyDiagnosticFix(fix, options = {}) {
       const command = findClass(source, fix.command);
       const object = decoratorObject(command, "Command");
       const current = property(object, "permission");
-      if (current && (!ts6.isStringLiteral(current.initializer) || current.initializer.text !== permission)) {
+      if (current && (!ts7.isStringLiteral(current.initializer) || current.initializer.text !== permission)) {
         throw new Error("Command permission already exists with a different value");
       }
-      content = current ? original : replaceProperty(source, object, "permission", ts6.factory.createStringLiteral(permission));
+      content = current ? original : replaceProperty(source, object, "permission", ts7.factory.createStringLiteral(permission));
       break;
     }
     case "add_route_parameter_binding": {
       const controller = findClass(source, fix.controller);
-      const method = unique(controller.members.filter((member) => ts6.isMethodDeclaration(member) && nameOf(member.name) === fix.route), "route handler");
-      const parameter = unique(method.parameters.filter((candidate) => ts6.isIdentifier(candidate.name) && candidate.name.text === fix.parameter), "same-named route parameter");
+      const method = unique(controller.members.filter((member) => ts7.isMethodDeclaration(member) && nameOf(member.name) === fix.route), "route handler");
+      const parameter = unique(method.parameters.filter((candidate) => ts7.isIdentifier(candidate.name) && candidate.name.text === fix.parameter), "same-named route parameter");
       const binding = fix.binding === "param" ? "Param" : fix.binding === "query" ? "Query" : undefined;
       if (!binding)
         throw new Error("Invalid route binding");
-      const decorators = ts6.getDecorators(parameter) ?? [];
+      const decorators = ts7.getDecorators(parameter) ?? [];
       if (decorators.length > 0)
         throw new Error("Parameter already has a decorator");
-      const framework = unique(source.statements.filter((statement) => ts6.isImportDeclaration(statement) && statement.importClause?.namedBindings && ts6.isNamedImports(statement.importClause.namedBindings) && statement.importClause.namedBindings.elements.some((element) => ["Controller", "Get", "Post", "Put", "Patch", "Delete", "Head", "Options"].includes(element.name.text))), "framework import");
-      if (!ts6.isImportDeclaration(framework) || !ts6.isStringLiteral(framework.moduleSpecifier)) {
+      const framework = unique(source.statements.filter((statement) => ts7.isImportDeclaration(statement) && statement.importClause?.namedBindings && ts7.isNamedImports(statement.importClause.namedBindings) && statement.importClause.namedBindings.elements.some((element) => ["Controller", "Get", "Post", "Put", "Patch", "Delete", "Head", "Options"].includes(element.name.text))), "framework import");
+      if (!ts7.isImportDeclaration(framework) || !ts7.isStringLiteral(framework.moduleSpecifier)) {
         throw new Error("Framework import must be static");
       }
       const edited = original.slice(0, parameter.getStart(source)) + `@${binding}(${JSON.stringify(fix.parameter)}) ` + original.slice(parameter.getStart(source));
@@ -6273,15 +6451,15 @@ async function applyDiagnosticFix(fix, options = {}) {
   return result;
 }
 function parse2(file, text) {
-  const result = ts6.transpileModule(text, {
+  const result = ts7.transpileModule(text, {
     fileName: file,
     reportDiagnostics: true,
-    compilerOptions: { target: ts6.ScriptTarget.ESNext, experimentalDecorators: true }
+    compilerOptions: { target: ts7.ScriptTarget.ESNext, experimentalDecorators: true }
   });
-  if (result.diagnostics?.some((item) => item.category === ts6.DiagnosticCategory.Error)) {
+  if (result.diagnostics?.some((item) => item.category === ts7.DiagnosticCategory.Error)) {
     throw new Error("Cannot fix syntactically invalid TypeScript");
   }
-  return ts6.createSourceFile(file, text, ts6.ScriptTarget.Latest, true, ts6.ScriptKind.TS);
+  return ts7.createSourceFile(file, text, ts7.ScriptTarget.Latest, true, ts7.ScriptKind.TS);
 }
 function unique(items, description) {
   if (items.length !== 1)
@@ -6295,50 +6473,50 @@ function identifier(value) {
 function nameOf(name) {
   if (!name)
     return "";
-  return ts6.isIdentifier(name) || ts6.isStringLiteral(name) || ts6.isNumericLiteral(name) ? name.text : "";
+  return ts7.isIdentifier(name) || ts7.isStringLiteral(name) || ts7.isNumericLiteral(name) ? name.text : "";
 }
 function property(object, key) {
-  if (object.properties.some((item) => !ts6.isPropertyAssignment(item) || ts6.isComputedPropertyName(item.name))) {
+  if (object.properties.some((item) => !ts7.isPropertyAssignment(item) || ts7.isComputedPropertyName(item.name))) {
     throw new Error("Fix requires explicit static object properties");
   }
-  const values = object.properties.filter((item) => ts6.isPropertyAssignment(item) && nameOf(item.name) === key);
+  const values = object.properties.filter((item) => ts7.isPropertyAssignment(item) && nameOf(item.name) === key);
   if (values.length > 1)
     throw new Error(`Duplicate '${key}' property`);
   return values[0];
 }
 function stringProperty(object, key) {
   const value = property(object, key)?.initializer;
-  return value && ts6.isStringLiteral(value) ? value.text : undefined;
+  return value && ts7.isStringLiteral(value) ? value.text : undefined;
 }
 function replaceProperty(source, object, key, value) {
   const previous = property(object, key);
-  const replacement = ts6.factory.createPropertyAssignment(key, value);
+  const replacement = ts7.factory.createPropertyAssignment(key, value);
   const properties = object.properties.map((item) => item === previous ? replacement : item);
   if (!previous)
     properties.push(replacement);
-  const updated = ts6.factory.updateObjectLiteralExpression(object, properties);
-  return source.text.slice(0, object.getStart(source)) + ts6.createPrinter().printNode(ts6.EmitHint.Expression, updated, source) + source.text.slice(object.end);
+  const updated = ts7.factory.updateObjectLiteralExpression(object, properties);
+  return source.text.slice(0, object.getStart(source)) + ts7.createPrinter().printNode(ts7.EmitHint.Expression, updated, source) + source.text.slice(object.end);
 }
 function findClass(source, name) {
-  return unique(source.statements.filter((statement) => ts6.isClassDeclaration(statement) && statement.name?.text === name), `class '${name}'`);
+  return unique(source.statements.filter((statement) => ts7.isClassDeclaration(statement) && statement.name?.text === name), `class '${name}'`);
 }
 function decoratorObject(node, name) {
-  const decorator = unique((ts6.getDecorators(node) ?? []).filter((item) => ts6.isCallExpression(item.expression) && item.expression.expression.getText() === name), `@${name} decorator`);
-  const argument = ts6.isCallExpression(decorator.expression) ? decorator.expression.arguments[0] : undefined;
-  if (!argument || !ts6.isObjectLiteralExpression(argument))
+  const decorator = unique((ts7.getDecorators(node) ?? []).filter((item) => ts7.isCallExpression(item.expression) && item.expression.expression.getText() === name), `@${name} decorator`);
+  const argument = ts7.isCallExpression(decorator.expression) ? decorator.expression.arguments[0] : undefined;
+  if (!argument || !ts7.isObjectLiteralExpression(argument))
     throw new Error(`@${name} requires a static object`);
   return argument;
 }
 function moduleObjects(source) {
   const result = [];
   for (const statement of source.statements) {
-    if (ts6.isClassDeclaration(statement) && (ts6.getDecorators(statement) ?? []).some((item) => ts6.isCallExpression(item.expression) && item.expression.expression.getText() === "Module")) {
+    if (ts7.isClassDeclaration(statement) && (ts7.getDecorators(statement) ?? []).some((item) => ts7.isCallExpression(item.expression) && item.expression.expression.getText() === "Module")) {
       result.push(decoratorObject(statement, "Module"));
     }
-    if (ts6.isVariableStatement(statement)) {
+    if (ts7.isVariableStatement(statement)) {
       for (const declaration of statement.declarationList.declarations) {
         const call = declaration.initializer;
-        if (call && ts6.isCallExpression(call) && ["defineModule", "defineFeatureSlice"].includes(call.expression.getText()) && call.arguments[0] && ts6.isObjectLiteralExpression(call.arguments[0])) {
+        if (call && ts7.isCallExpression(call) && ["defineModule", "defineFeatureSlice"].includes(call.expression.getText()) && call.arguments[0] && ts7.isObjectLiteralExpression(call.arguments[0])) {
           result.push(call.arguments[0]);
         }
       }
@@ -6348,23 +6526,23 @@ function moduleObjects(source) {
 }
 function importSymbol(source, path, symbol) {
   identifier(symbol);
-  const current = resolve7(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
-  const target = resolve7(dirname6(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
+  const current = resolve8(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
+  const target = resolve8(dirname6(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
   if (current === target)
     return source.text;
-  const matches = source.statements.filter((item) => ts6.isImportDeclaration(item) && ts6.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
+  const matches = source.statements.filter((item) => ts7.isImportDeclaration(item) && ts7.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
   if (matches.length > 1)
     throw new Error(`Ambiguous imports from '${path}'`);
   const match = matches[0];
-  if (match && ts6.isImportDeclaration(match) && match.importClause?.namedBindings && ts6.isNamedImports(match.importClause.namedBindings) && !match.importClause.isTypeOnly) {
+  if (match && ts7.isImportDeclaration(match) && match.importClause?.namedBindings && ts7.isNamedImports(match.importClause.namedBindings) && !match.importClause.isTypeOnly) {
     if (match.importClause.namedBindings.elements.some((item) => item.name.text === symbol))
       return source.text;
     const bindings = match.importClause.namedBindings;
-    const updated = ts6.factory.updateNamedImports(bindings, [
+    const updated = ts7.factory.updateNamedImports(bindings, [
       ...bindings.elements,
-      ts6.factory.createImportSpecifier(false, undefined, ts6.factory.createIdentifier(symbol))
+      ts7.factory.createImportSpecifier(false, undefined, ts7.factory.createIdentifier(symbol))
     ]);
-    return source.text.slice(0, bindings.getStart(source)) + ts6.createPrinter().printNode(ts6.EmitHint.Unspecified, updated, source) + source.text.slice(bindings.end);
+    return source.text.slice(0, bindings.getStart(source)) + ts7.createPrinter().printNode(ts7.EmitHint.Unspecified, updated, source) + source.text.slice(bindings.end);
   }
   if (match)
     throw new Error(`Import from '${path}' is not a named value import`);
@@ -6515,8 +6693,8 @@ async function run() {
   if (checkSchema && command !== "graphql-schema")
     throw new Error("--check is only supported by graphql-schema");
   const defaults = resolveSupacloudConfig(loadedConfig, process.cwd());
-  const resolvedRoot = rootDir ? resolve9(process.cwd(), rootDir) : defaults.rootDir;
-  const resolvedOut = outDir ? resolve9(process.cwd(), outDir) : defaults.outDir;
+  const resolvedRoot = rootDir ? resolve10(process.cwd(), rootDir) : defaults.rootDir;
+  const resolvedOut = outDir ? resolve10(process.cwd(), outDir) : defaults.outDir;
   const configured = compileOptionsFromConfig({
     ...loadedConfig,
     root: resolvedRoot,
@@ -6557,7 +6735,7 @@ async function run() {
   } else if (command === "fix") {
     if (!query)
       throw new Error("fix requires a JSON file containing one DiagnosticFix");
-    const fix = JSON.parse(await readFile5(resolve9(process.cwd(), query), "utf8"));
+    const fix = JSON.parse(await readFile5(resolve10(process.cwd(), query), "utf8"));
     const result = await applyDiagnosticFix(fix, { rootDir: resolvedRoot, dryRun });
     console.log(JSON.stringify({ ok: true, ...result }, null, 2));
   } else if (command === "compile") {

package/dist/config.d.ts

@@ -10,10 +10,15 @@ export interface SupaCloudConfig {
     generateClient?: boolean;
     generatePermissions?: boolean;
     moduleBoundaryPreset?: ModuleBoundaryPresetName;
+    moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
+    typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    allowRouteCommandBindings?: boolean;
+    disallowControllerDirectDb?: boolean;
+    detectOrphanModules?: boolean;
     commandCapabilities?: CommandExecutionCapabilities;
     treeShakeUnusedProviders?: boolean;
 }
-export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "commandCapabilities">> & {
+export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "commandCapabilities" | "moduleBoundaries" | "typeSafety" | "allowRouteCommandBindings" | "disallowControllerDirectDb" | "detectOrphanModules">> & {
     include: string[];
     moduleBoundaryPreset: ModuleBoundaryPresetName;
 };
@@ -28,6 +33,11 @@ export declare function resolveSupacloudConfig(config?: SupaCloudConfig, cwd?: s
     generatePermissions: boolean;
     moduleBoundaryPreset: ModuleBoundaryPresetName;
     commandCapabilities?: CommandExecutionCapabilities;
+    moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
+    typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    allowRouteCommandBindings?: boolean;
+    disallowControllerDirectDb?: boolean;
+    detectOrphanModules?: boolean;
     treeShakeUnusedProviders: boolean;
     graphql?: GraphqlOptions;
 };

package/dist/graphql-client.d.ts

@@ -1,2 +1,2 @@
 /** Appended to the generated SDK; browser consumers need only the platform fetch API. */
-export declare const GRAPHQL_CLIENT_SOURCE = "\nexport interface GraphqlClientOptions {\n  /** Project base URL, not the management API URL. HTTPS is required outside loopback. */\n  url: string;\n  /** Public project key only. Never put a service-role or management key in a browser. */\n  publishableKey?: string;\n  /** Resolved on every request so session refresh and logout are observed. */\n  getAccessToken?: () => string | null | undefined | Promise<string | null | undefined>;\n  fetch?: (url: string, init: RequestInit) => Promise<Response>;\n}\n\nexport interface GraphqlRequestOptions {\n  signal?: AbortSignal;\n}\n\nexport class GraphqlRequestError extends Error {\n  constructor(\n    public readonly code: \"http\" | \"graphql\" | \"invalid-response\",\n    message: string,\n    public readonly status?: number,\n    public readonly errors?: readonly unknown[],\n  ) {\n    super(message);\n    this.name = \"GraphqlRequestError\";\n  }\n}\n\nexport function createGraphqlClient(options: GraphqlClientOptions) {\n  const endpoint = new URL(options.url);\n  const loopback = [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(endpoint.hostname);\n  if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n    throw new Error(\"GraphQL requires HTTPS outside loopback development.\");\n  }\n  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {\n    throw new Error(\"GraphQL project URLs must not contain credentials, query parameters or fragments.\");\n  }\n  endpoint.pathname = endpoint.pathname.replace(/\\/$/, \"\") + \"/graphql/v1\";\n  const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return getSdk<GraphqlRequestOptions>(async <R, V>(\n    query: string,\n    variables?: V,\n    request?: GraphqlRequestOptions,\n  ): Promise<R> => {\n    const headers = new Headers({ \"Content-Type\": \"application/json\", Accept: \"application/json\" });\n    if (options.publishableKey) headers.set(\"apikey\", options.publishableKey);\n    const token = await options.getAccessToken?.();\n    if (token) headers.set(\"Authorization\", \"Bearer \" + token);\n    const response = await fetcher(endpoint.toString(), {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ query, variables }),\n      ...(request?.signal ? { signal: request.signal } : {}),\n      redirect: \"error\",\n    });\n    if (!response.ok) {\n      throw new GraphqlRequestError(\"http\", \"GraphQL HTTP request failed (\" + response.status + \").\", response.status);\n    }\n    let envelope: unknown;\n    try {\n      envelope = await response.json();\n    } catch {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid JSON.\", response.status);\n    }\n    if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned an invalid envelope.\", response.status);\n    }\n    if (\"errors\" in envelope) {\n      if (!Array.isArray(envelope.errors)) {\n        throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid errors.\", response.status);\n      }\n      if (envelope.errors.length > 0) {\n        throw new GraphqlRequestError(\"graphql\", \"GraphQL query failed.\", response.status, envelope.errors);\n      }\n    }\n    if (!(\"data\" in envelope) || !envelope.data || typeof envelope.data !== \"object\" || Array.isArray(envelope.data)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned no result object.\", response.status);\n    }\n    // Operation types describe the schema snapshot, not runtime response validation.\n    return envelope.data as R;\n  });\n}\n";
+export declare const GRAPHQL_CLIENT_SOURCE = "\nexport interface GraphqlClientOptions {\n  /** Project base URL, not the management API URL. HTTPS is required outside loopback. */\n  url: string;\n  /** Public project key only. Never put a service-role or management key in a browser. */\n  publishableKey?: string;\n  /** Resolved on every request so session refresh and logout are observed. */\n  getAccessToken?: () => string | null | undefined | Promise<string | null | undefined>;\n  fetch?: (url: string, init: RequestInit) => Promise<Response>;\n}\n\nexport interface GraphqlRequestOptions {\n  signal?: AbortSignal;\n}\n\nexport class GraphqlRequestError extends Error {\n  constructor(\n    public readonly code: \"http\" | \"graphql\" | \"invalid-response\",\n    message: string,\n    public readonly status?: number,\n    public readonly errors?: readonly unknown[],\n  ) {\n    super(message);\n    this.name = \"GraphqlRequestError\";\n  }\n}\n\nexport function createGraphqlClient(options: GraphqlClientOptions) {\n  const endpoint = new URL(options.url);\n  const loopback = [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(endpoint.hostname);\n  if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n    throw new Error(\"GraphQL requires HTTPS outside loopback development.\");\n  }\n  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {\n    throw new Error(\"GraphQL project URLs must not contain credentials, query parameters or fragments.\");\n  }\n  endpoint.pathname = endpoint.pathname.replace(/\\/$/, \"\") + \"/graphql/v1\";\n  const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return getSdk<GraphqlRequestOptions>(async (\n    query: string,\n    variables?: unknown,\n    request?: GraphqlRequestOptions,\n  ): Promise<unknown> => {\n    const headers = new Headers({ \"Content-Type\": \"application/json\", Accept: \"application/json\" });\n    if (options.publishableKey) headers.set(\"apikey\", options.publishableKey);\n    const token = await options.getAccessToken?.();\n    if (token) headers.set(\"Authorization\", \"Bearer \" + token);\n    const response = await fetcher(endpoint.toString(), {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ query, variables }),\n      ...(request?.signal ? { signal: request.signal } : {}),\n      redirect: \"error\",\n    });\n    if (!response.ok) {\n      throw new GraphqlRequestError(\"http\", \"GraphQL HTTP request failed (\" + response.status + \").\", response.status);\n    }\n    let envelope: unknown;\n    try {\n      envelope = await response.json();\n    } catch {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid JSON.\", response.status);\n    }\n    if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned an invalid envelope.\", response.status);\n    }\n    if (\"errors\" in envelope) {\n      if (!Array.isArray(envelope.errors)) {\n        throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned invalid errors.\", response.status);\n      }\n      if (envelope.errors.length > 0) {\n        throw new GraphqlRequestError(\"graphql\", \"GraphQL query failed.\", response.status, envelope.errors);\n      }\n    }\n    if (!(\"data\" in envelope) || !envelope.data || typeof envelope.data !== \"object\" || Array.isArray(envelope.data)) {\n      throw new GraphqlRequestError(\"invalid-response\", \"GraphQL returned no result object.\", response.status);\n    }\n    // The operation-specific parser in getSdk validates selected field values.\n    return envelope.data;\n  });\n}\n";

package/dist/graphql-runtime.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Project the standard Codegen result types, rather than independently interpreting
+ * selections, fragments and conditional fields. Unsupported wire types fail closed.
+ */
+export declare function renderGraphqlValidators(source: string, operationNames: readonly string[]): string;

package/dist/index.js

@@ -25,10 +25,11 @@ function camelName(token) {
   return token.charAt(0).toLowerCase() + token.slice(1);
 }
 function relativeImportPath(fromDir, toFile) {
-  const fromParts = fromDir.split("/").filter(Boolean);
-  const toParts = toFile.split("/").filter(Boolean);
+  const fromParts = fromDir.split(/[\\/]/).filter(Boolean);
+  const toParts = toFile.split(/[\\/]/).filter(Boolean);
+  const isWindows = process.platform === "win32" || /^[a-zA-Z]:/.test(fromParts[0] ?? "") || /^[a-zA-Z]:/.test(toParts[0] ?? "");
   let common = 0;
-  while (common < fromParts.length && common < toParts.length && fromParts[common] === toParts[common]) {
+  while (common < fromParts.length && common < toParts.length && (fromParts[common] === toParts[common] || isWindows && fromParts[common].toLowerCase() === toParts[common].toLowerCase())) {
     common += 1;
   }
   const ups = fromParts.length - common;
@@ -1212,11 +1213,11 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
   }
   endpoint.pathname = endpoint.pathname.replace(/\\/$/, "") + "/graphql/v1";
   const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);
-  return getSdk<GraphqlRequestOptions>(async <R, V>(
+  return getSdk<GraphqlRequestOptions>(async (
     query: string,
-    variables?: V,
+    variables?: unknown,
     request?: GraphqlRequestOptions,
-  ): Promise<R> => {
+  ): Promise<unknown> => {
     const headers = new Headers({ "Content-Type": "application/json", Accept: "application/json" });
     if (options.publishableKey) headers.set("apikey", options.publishableKey);
     const token = await options.getAccessToken?.();
@@ -1251,8 +1252,8 @@ export function createGraphqlClient(options: GraphqlClientOptions) {
     if (!("data" in envelope) || !envelope.data || typeof envelope.data !== "object" || Array.isArray(envelope.data)) {
       throw new GraphqlRequestError("invalid-response", "GraphQL returned no result object.", response.status);
     }
-    // Operation types describe the schema snapshot, not runtime response validation.
-    return envelope.data as R;
+    // The operation-specific parser in getSdk validates selected field values.
+    return envelope.data;
   });
 }
 `;
@@ -1326,6 +1327,165 @@ var init_graphql_inputs = __esm(() => {
   init_graphql_options();
 });
 
+// src/graphql-runtime.ts
+import * as ts7 from "@typescript/typescript6";
+import { resolve as resolve5 } from "node:path";
+function renderGraphqlValidators(source, operationNames) {
+  const fileName = resolve5("/__supacloud_graphql__/contracts.ts");
+  const options = {
+    strict: true,
+    noUncheckedIndexedAccess: true,
+    exactOptionalPropertyTypes: true,
+    noImplicitOverride: true,
+    noPropertyAccessFromIndexSignature: true,
+    noFallthroughCasesInSwitch: true,
+    skipLibCheck: false,
+    target: ts7.ScriptTarget.ES2022,
+    lib: ["lib.es2022.d.ts"],
+    types: [],
+    noEmit: true
+  };
+  const host = ts7.createCompilerHost(options);
+  const getSourceFile = host.getSourceFile.bind(host);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => path === fileName ? ts7.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  const program = ts7.createProgram([fileName], options, host);
+  const diagnostics = ts7.getPreEmitDiagnostics(program);
+  if (diagnostics.length) {
+    throw new Error(`Generated GraphQL types cannot be validated: ${diagnostics.map((item) => ts7.flattenDiagnosticMessageText(item.messageText, `
+`)).join("; ")}`);
+  }
+  const checker = program.getTypeChecker();
+  const entry = program.getSourceFile(fileName);
+  const module = entry && checker.getSymbolAtLocation(entry);
+  if (!module)
+    throw new Error("Generated GraphQL types have no module");
+  const exports = new Map(checker.getExportsOfModule(module).map((symbol) => [symbol.name, symbol]));
+  if (exports.has("GraphqlQueryResults")) {
+    throw new Error("GraphQL type GraphqlQueryResults conflicts with the generated result registry.");
+  }
+  const names = new Map;
+  const definitions = new Map;
+  function unsupported(type) {
+    throw new Error(`Unsupported GraphQL result wire type: ${checker.typeToString(type)}. Map custom scalars to JSON wire types or unknown.`);
+  }
+  function reference(type) {
+    const existing = names.get(type);
+    if (existing)
+      return existing;
+    const name = `checkGraphqlValue${names.size}`;
+    names.set(type, name);
+    definitions.set(name, "");
+    definitions.set(name, `function ${name}(value: unknown): boolean {
+  return ${expression(type)};
+}`);
+    return name;
+  }
+  function expression(type) {
+    if (type.flags & ts7.TypeFlags.Any)
+      return unsupported(type);
+    if (type.flags & ts7.TypeFlags.Unknown)
+      return "true";
+    if (type.flags & ts7.TypeFlags.Never)
+      return "false";
+    if (type.flags & ts7.TypeFlags.Null)
+      return "value === null";
+    if (type.flags & ts7.TypeFlags.Undefined)
+      return "value === undefined";
+    if (type.isStringLiteral() || type.isNumberLiteral())
+      return `value === ${JSON.stringify(type.value)}`;
+    if (type.flags & ts7.TypeFlags.BooleanLiteral)
+      return `value === ${checker.typeToString(type)}`;
+    if (type.flags & ts7.TypeFlags.String)
+      return 'typeof value === "string"';
+    if (type.flags & ts7.TypeFlags.Number)
+      return 'typeof value === "number" && Number.isFinite(value)';
+    if (type.flags & ts7.TypeFlags.Boolean)
+      return 'typeof value === "boolean"';
+    if (type.isUnion())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" || ");
+    if (type.isIntersection())
+      return type.types.map((part) => `${reference(part)}(value)`).join(" && ");
+    if (checker.isTupleType(type))
+      return unsupported(type);
+    if (checker.isArrayType(type)) {
+      const item = checker.getIndexTypeOfType(type, ts7.IndexKind.Number);
+      if (!item)
+        return unsupported(type);
+      return `isGraphqlArray(value) && Array.from(value).every(${reference(item)})`;
+    }
+    if (type.flags & ts7.TypeFlags.Object) {
+      if (type.getCallSignatures().length || type.getConstructSignatures().length)
+        return unsupported(type);
+      const indexes = checker.getIndexInfosOfType(type);
+      if (indexes.some((index) => !(index.keyType.flags & ts7.TypeFlags.String)))
+        return unsupported(type);
+      const properties = checker.getPropertiesOfType(type).map((property2) => {
+        const declaration = property2.valueDeclaration ?? property2.declarations?.[0];
+        if (!declaration)
+          return unsupported(type);
+        const check = reference(checker.getTypeOfSymbolAtLocation(property2, declaration));
+        const key = JSON.stringify(property2.name);
+        const present = `Object.prototype.hasOwnProperty.call(value, ${key})`;
+        return property2.flags & ts7.SymbolFlags.Optional ? `(!${present} || ${check}(value[${key}]))` : `(${present} && ${check}(value[${key}]))`;
+      });
+      const indexedValues = indexes.map((index) => `Object.values(value).every(${reference(index.type)})`);
+      return ["isGraphqlRecord(value)", ...properties, ...indexedValues].join(" && ");
+    }
+    return unsupported(type);
+  }
+  const operations = [...operationNames].sort();
+  const parsers = operations.map((name) => {
+    const typeName = `${name}Query`;
+    const symbol = exports.get(typeName);
+    if (!symbol)
+      throw new Error(`Missing generated operation type: ${typeName}`);
+    const check = reference(checker.getDeclaredTypeOfSymbol(symbol));
+    return `export function is${typeName}(value: unknown): value is ${typeName} {
+  return ${check}(value);
+}
+export function parse${typeName}(value: unknown): ${typeName} {
+  if (!is${typeName}(value)) {
+    throw new GraphqlRequestError("invalid-response", ${JSON.stringify(`GraphQL result does not match ${name}.`)});
+  }
+  return value;
+}`;
+  });
+  return `
+function isGraphqlRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isGraphqlArray(value: unknown): value is unknown[] {
+  return Array.isArray(value);
+}
+${[...definitions.values()].join(`
+`)}
+${parsers.join(`
+`)}
+export interface GraphqlQueryResults {
+${operations.map((name) => `  ${JSON.stringify(name)}: ${name}Query;`).join(`
+`)}
+}
+export function isGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): value is GraphqlQueryResults[Name] {
+  switch (name) {
+${operations.map((name) => `    case ${JSON.stringify(name)}: return is${name}Query(value);`).join(`
+`)}
+    default: return false;
+  }
+}
+export function parseGraphqlResult<Name extends keyof GraphqlQueryResults>(
+  name: Name, value: unknown,
+): GraphqlQueryResults[Name] {
+  if (!isGraphqlResult(name, value)) {
+    throw new GraphqlRequestError("invalid-response", "GraphQL result does not match operation " + name + ".");
+  }
+  return value;
+}
+`;
+}
+var init_graphql_runtime = () => {};
+
 // src/graphql.ts
 var exports_graphql = {};
 __export(exports_graphql, {
@@ -1474,15 +1634,15 @@ async function renderGraphql(options) {
     const separated = separateOperations(combined);
     const methods = Object.entries(separated).sort(([a], [b]) => a.localeCompare(b)).map(([name, document]) => {
       const operation = document.definitions.find((node) => node.kind === Kind.OPERATION_DEFINITION);
-      if (operation.kind !== Kind.OPERATION_DEFINITION)
+      if (!operation || operation.kind !== Kind.OPERATION_DEFINITION)
         throw new Error("Missing query operation");
       const required = operation.variableDefinitions?.some((variable) => variable.type.kind === Kind.NON_NULL_TYPE && !variable.defaultValue);
-      return `    ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
-      return requester<${name}Query, ${name}QueryVariables>(${JSON.stringify(print(document))}, variables, options);
+      return `    async ${JSON.stringify(name)}(variables${required ? "" : "?"}: ${name}QueryVariables, options?: C): Promise<${name}Query> {
+      return parse${name}Query(await requester(${JSON.stringify(print(document))}, variables, options));
     }`;
     });
     const facade = `
-export type Requester<C> = <R, V>(query: string, variables?: V, options?: C) => Promise<R>;
+export type Requester<C> = (query: string, variables?: unknown, options?: C) => Promise<unknown>;
 export function getSdk<C>(requester: Requester<C>) {
   return {
 ${methods.join(`,
@@ -1490,8 +1650,9 @@ ${methods.join(`,
   };
 }
 `;
+    const validators = renderGraphqlValidators(generated, queryEntries.map((entry) => entry.name));
     result.files["graphql.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
-` + generated + facade + GRAPHQL_CLIENT_SOURCE;
+` + generated + validators + facade + GRAPHQL_CLIENT_SOURCE;
     if (options.graphql.typedDocuments) {
       const typedDocuments = await import("@graphql-codegen/typed-document-node");
       result.files["graphql.documents.ts"] = `// GENERATED BY @supacloud/compiler. DO NOT EDIT.
@@ -1520,6 +1681,7 @@ ${methods.join(`,
 var init_graphql = __esm(() => {
   init_graphql_inputs();
   init_graphql_options();
+  init_graphql_runtime();
 });
 
 // src/graphql-schema.ts
@@ -1529,7 +1691,7 @@ __export(exports_graphql_schema, {
 });
 import { mkdir as mkdir2, readFile as readFile4 } from "node:fs/promises";
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname7, resolve as resolve8 } from "node:path";
+import { dirname as dirname7, resolve as resolve9 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -1569,7 +1731,7 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema2(data));
-  const path = resolve8(options.output);
+  const path = resolve9(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
@@ -5624,12 +5786,12 @@ function resolveTypeSafety(options) {
 }
 // src/watch.ts
 import { existsSync as existsSync4, watch } from "node:fs";
-import { dirname as dirname5, relative as relative7, resolve as resolve6, sep as sep7 } from "node:path";
+import { dirname as dirname5, relative as relative7, resolve as resolve7, sep as sep7 } from "node:path";
 
 // src/incremental.ts
 import { createHash as createHash6 } from "node:crypto";
 import { access as access2, readdir, readFile as readFile3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve5, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve6, sep as sep6 } from "node:path";
 init_graphql_inputs();
 function createDependencyGraphCache() {
   return {
@@ -5704,11 +5866,11 @@ function createIncrementalCompiler() {
   };
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve5(options.rootDir);
-  const outDir = resolve5(options.outDir);
+  const rootDir = resolve6(options.rootDir);
+  const outDir = resolve6(options.outDir);
   const files = { ...previous.files };
   for (const changedPath of changedPaths) {
-    const absolutePath = isAbsolute2(changedPath) ? resolve5(changedPath) : resolve5(rootDir, changedPath);
+    const absolutePath = isAbsolute2(changedPath) ? resolve6(changedPath) : resolve6(rootDir, changedPath);
     const relativeChangedPath = relative6(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep6}`))
       continue;
@@ -5726,8 +5888,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve5(options.rootDir);
-  const outDir = resolve5(options.outDir);
+  const rootDir = resolve6(options.rootDir);
+  const outDir = resolve6(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   for (const path of paths) {
@@ -5746,8 +5908,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve5(options.rootDir),
-    outDir: resolve5(options.outDir),
+    rootDir: resolve6(options.rootDir),
+    outDir: resolve6(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -5769,7 +5931,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const path = resolve5(directory, entry.name);
+      const path = resolve6(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -5893,8 +6055,8 @@ function findAffectedModules(previous, current, changedFiles) {
 // src/watch.ts
 var DEFAULT_DEBOUNCE_MS = 100;
 function watchProject(options) {
-  const rootDir = resolve6(options.rootDir);
-  const outDir = resolve6(options.outDir);
+  const rootDir = resolve7(options.rootDir);
+  const outDir = resolve7(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -5903,7 +6065,7 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve6(rootDir, options.graphql.schema) : undefined;
+  const schemaPath = options.graphql ? resolve7(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -5980,7 +6142,7 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve6(rootDir, filename.toString());
+      const changedPath = resolve7(rootDir, filename.toString());
       const relativePath = relative7(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
@@ -5993,7 +6155,7 @@ function watchProject(options) {
       while (!existsSync4(directory) && dirname5(directory) !== directory)
         directory = dirname5(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve6(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve7(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -6291,7 +6453,7 @@ init_generate();
 // src/config.ts
 init_graphql_options();
 import { existsSync as existsSync6 } from "node:fs";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { join as join6, resolve as resolve8 } from "node:path";
 import { pathToFileURL } from "node:url";
 var DEFAULT_SUPACLOUD_CONFIG = {
   graphql: false,
@@ -6308,6 +6470,7 @@ var DEFAULT_SUPACLOUD_CONFIG = {
 function defineSupacloudConfig(config = {}) {
   if (config.graphql !== undefined && config.graphql !== false)
     assertGraphqlOptions(config.graphql);
+  validateGovernanceConfig(config);
   return {
     ...DEFAULT_SUPACLOUD_CONFIG,
     ...config,
@@ -6315,11 +6478,35 @@ function defineSupacloudConfig(config = {}) {
     graphql: config.graphql ?? DEFAULT_SUPACLOUD_CONFIG.graphql
   };
 }
+function validateGovernanceConfig(config) {
+  const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+  const isStrings = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string" && item.trim().length > 0);
+  if (config.moduleBoundaries !== undefined) {
+    if (!Array.isArray(config.moduleBoundaries))
+      throw new Error("moduleBoundaries must be an array of module tag rules.");
+    const rules = config.moduleBoundaries;
+    for (const rule of rules) {
+      if (!isRecord(rule) || typeof rule["sourceTag"] !== "string" || !rule["sourceTag"].trim() || Object.keys(rule).some((key) => !["sourceTag", "onlyDependOnLibsWithTags", "bannedDependenciesWithTags"].includes(key)) || rule["onlyDependOnLibsWithTags"] !== undefined && !isStrings(rule["onlyDependOnLibsWithTags"]) || rule["bannedDependenciesWithTags"] !== undefined && !isStrings(rule["bannedDependenciesWithTags"])) {
+        throw new Error("moduleBoundaries rules require sourceTag and optional string arrays onlyDependOnLibsWithTags/bannedDependenciesWithTags.");
+      }
+    }
+  }
+  if (config.typeSafety !== undefined) {
+    const rules = config.typeSafety;
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    }
+  }
+  for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
+    if (config[key] !== undefined && typeof config[key] !== "boolean")
+      throw new Error(`${key} must be a boolean.`);
+  }
+}
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve7(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve7(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve8(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve8(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -6327,10 +6514,15 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     generatePermissions: resolved.generatePermissions ?? DEFAULT_SUPACLOUD_CONFIG.generatePermissions,
     moduleBoundaryPreset: resolved.moduleBoundaryPreset ?? DEFAULT_SUPACLOUD_CONFIG.moduleBoundaryPreset,
     commandCapabilities: resolved.commandCapabilities,
+    ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
+    ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
+    ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
+    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
+    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     graphql: resolved.graphql ? {
       ...resolved.graphql,
-      schema: resolve7(cwd, resolved.graphql.schema)
+      schema: resolve8(cwd, resolved.graphql.schema)
     } : undefined
   };
 }
@@ -6348,20 +6540,7 @@ async function loadSupacloudConfig(cwd = process.cwd()) {
   return defineSupacloudConfig(imported.default ?? {});
 }
 function compileOptionsFromConfig(config, cwd = process.cwd()) {
-  const resolved = resolveSupacloudConfig(config, cwd);
-  return {
-    rootDir: resolved.rootDir,
-    outDir: resolved.outDir,
-    include: resolved.include,
-    strict: resolved.strict,
-    requireRouteContracts: resolved.requireRouteContracts,
-    generateClient: resolved.generateClient,
-    generatePermissions: resolved.generatePermissions,
-    moduleBoundaryPreset: resolved.moduleBoundaryPreset,
-    commandCapabilities: resolved.commandCapabilities,
-    treeShakeUnusedProviders: resolved.treeShakeUnusedProviders,
-    graphql: resolved.graphql
-  };
+  return resolveSupacloudConfig(config, cwd);
 }
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/compiler",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   "type": "module",
   "main": "./dist/index.js",