@supacloud/compiler 0.21.1 → 0.23.0

package/dist/index.js

@@ -196,10 +196,24 @@ function renderApplication(graph, options) {
     ""
   ].join(`
 `);
+  const commandGovernance = graph.modules.flatMap((module) => module.commands.map((command) => ({
+    module: module.name,
+    className: command.className,
+    name: command.name,
+    permission: command.permission ?? null,
+    rpc: command.rpc ?? null,
+    transaction: command.transaction ?? null,
+    audit: command.audit ?? null,
+    idempotency: command.idempotency ?? null
+  }))).sort((left, right) => `${left.module}:${left.name}`.localeCompare(`${right.module}:${right.name}`));
   const manifest = {
     version: 1,
     modules: graph.modules,
-    externalTokens: graph.externalTokens
+    externalTokens: graph.externalTokens,
+    commandGovernance: {
+      defaults: { authorization: "required", audit: "required", idempotency: "required", transaction: "required" },
+      commands: commandGovernance
+    }
   };
   const clientCode = options.generateClient ? renderClient(graph, options) : undefined;
   const openApiCode = options.generateOpenApi ? renderOpenApi(graph, options) : undefined;
@@ -354,7 +368,7 @@ class ModuleGenerator {
     this.imports = imports;
     this.pascal = pascalName(module.name);
     if (module.providers.some((provider) => (provider.functionalInjects?.length ?? 0) > 0) || module.controllers.some((controller) => (controller.functionalInjects?.length ?? 0) > 0)) {
-      imports.add("runInInjectionContext", undefined, "@supacloud/app");
+      throw new Error("SC2012: Compiled DI requires constructor injection; property inject() is not supported.");
     }
   }
   renderFactories() {
@@ -388,6 +402,7 @@ class ModuleGenerator {
     lines.push(`  jobs: ${this.renderJobs()},`);
     if (this.module.aspects && this.module.aspects.length > 0) {
       lines.push(`  aspects: ${this.renderAspects(this.module.aspects)},`);
+      lines.push(`  aspectPipeline: ${this.renderAspectPipeline(this.module.aspects)},`);
     }
     lines.push(`}`);
     return lines.join(`
@@ -464,6 +479,7 @@ class ModuleGenerator {
         }
         if (route.aspects && route.aspects.length > 0) {
           fields.push(`aspects: ${this.renderAspects(route.aspects)}`);
+          fields.push(`aspectPipeline: ${this.renderAspectPipeline(route.aspects)}`);
         }
         const invokerArgs = (route.handlerParams ?? []).map((hp) => {
           if (hp.kind === "param") {
@@ -544,7 +560,7 @@ ${indent(item, 2)}`).join(",")}
         `idempotency: ${JSON.stringify(command.idempotency)}`,
         ...command.rpc ? [`rpc: ${JSON.stringify(command.rpc)}`] : [],
         ...command.standalone ? ["standalone: true"] : [],
-        ...command.aspects && command.aspects.length > 0 ? [`aspects: ${this.renderAspects(command.aspects)}`] : []
+        ...command.aspects && command.aspects.length > 0 ? [`aspects: ${this.renderAspects(command.aspects)}`, `aspectPipeline: ${this.renderAspectPipeline(command.aspects)}`] : []
       ];
       return `{ ${fields.join(", ")} }`;
     }).join(", ")}]`;
@@ -577,6 +593,7 @@ ${indent(item, 2)}`).join(",")}
         fields.push(`idempotency: ${JSON.stringify(job.idempotency)}`);
       if (job.aspects && job.aspects.length > 0) {
         fields.push(`aspects: ${this.renderAspects(job.aspects)}`);
+        fields.push(`aspectPipeline: ${this.renderAspectPipeline(job.aspects)}`);
       }
       return `{ ${fields.join(", ")}, }`;
     }).join(", ")}]`;
@@ -584,6 +601,24 @@ ${indent(item, 2)}`).join(",")}
   renderAspects(aspects) {
     return `[${aspects.map((aspect) => this.imports.add(aspect.name, aspect.importPath, aspect.importModule)).join(", ")}]`;
   }
+  renderAspectPipeline(aspects) {
+    const lines = [
+      `async (context, next, observe) => {`,
+      `  const state = { active: true };`,
+      `  const step${aspects.length} = compiledAspectNext(next, state);`
+    ];
+    for (let index = aspects.length - 1;index >= 0; index--) {
+      const aspect = aspects[index];
+      if (!aspect)
+        continue;
+      const name = this.imports.add(aspect.name, aspect.importPath, aspect.importModule);
+      const stage = JSON.stringify(`aspect[${index}]:${aspect.name}`);
+      lines.push(`  const step${index} = compiledAspectNext(() => observeCompiledAspect(observe, ${stage}, () => ${name}(context, step${index + 1})), state);`);
+    }
+    lines.push(`  try { return await step0(); } finally { state.active = false; }`, `}`);
+    return lines.join(`
+`);
+  }
   renderServicesFactory() {
     return [
       `function create${this.pascal}Services(`,
@@ -698,7 +733,7 @@ ${indent(item, 2)}`).join(",")}
         const args = provider.deps.map((dep, index) => this.typedDepExpr(dep, kind, this.depOptions(provider, dep), `ConstructorParameters<typeof ${useClass}>[${index}]`)).join(", ");
         const local = this.localVar(isMulti ? provider.useClass ?? `${provider.token}Item` : provider.token, kind);
         return {
-          constLine: `const ${local} = ${this.instantiate(useClass, args, kind, provider.functionalInjects)};`,
+          constLine: `const ${local} = new ${useClass}(${args});`,
           key,
           expr: local
         };
@@ -734,32 +769,11 @@ ${indent(item, 2)}`).join(",")}
     const key = camelName(controller.className);
     const local = this.localVar(controller.className, kind);
     return {
-      constLine: `const ${local} = ${this.instantiate(className, args, kind, controller.functionalInjects)};`,
+      constLine: `const ${local} = new ${className}(${args});`,
       key,
       expr: local
     };
   }
-  instantiate(className, args, kind, functionalInjects) {
-    if (!functionalInjects || functionalInjects.length === 0) {
-      return `new ${className}(${args})`;
-    }
-    const clauses = functionalInjects.map((entry) => {
-      const token = this.imports.add(entry.expression, entry.importPath, entry.importModule);
-      const value = this.depExpr(entry.token, kind, entry);
-      return `if (token === ${token}) return ${value} as T;`;
-    });
-    const missing = `if (options?.optional) return undefined; throw new Error("Static inject token not available: " + String(token));`;
-    const injector = [
-      `{`,
-      `get<T>(token: unknown, options?: { optional?: boolean; self?: boolean; skipSelf?: boolean; host?: boolean }): T | undefined {`,
-      ...clauses,
-      missing,
-      `},`,
-      `}`
-    ].join(`
-`);
-    return `runInInjectionContext(${injector}, () => new ${className}(${args}))`;
-  }
   localVar(token, kind) {
     const locals = this.locals[kind];
     const existing = locals.get(token);
@@ -1932,6 +1946,7 @@ var HEADER = "// GENERATED BY @supacloud/compiler — do not edit", INTERFACES =
   title?: string;
   data?: Record<string, unknown>;
   aspects?: CompiledAspect[];
+  aspectPipeline?: CompiledAspectPipeline;
   invoker?: (
     controller: unknown,
     request: {
@@ -1955,6 +1970,7 @@ export interface CompiledCommand {
   idempotency: "required" | "none";
   standalone?: boolean;
   aspects?: CompiledAspect[];
+  aspectPipeline?: CompiledAspectPipeline;
 }
 
 export interface CompiledJob {
@@ -1969,6 +1985,7 @@ export interface CompiledJob {
   maxAttempts?: number;
   idempotency?: "required" | "none";
   aspects?: CompiledAspect[];
+  aspectPipeline?: CompiledAspectPipeline;
 }
 
 export interface CompiledAspectContext {
@@ -2016,7 +2033,24 @@ export interface CompiledModule {
   commands: CompiledCommand[];
   jobs: CompiledJob[];
   aspects?: CompiledAspect[];
-}`, TYPE_GUARDS = `function isRecord(value: unknown): value is Record<string, unknown> {
+  aspectPipeline?: CompiledAspectPipeline;
+}`, TYPE_GUARDS = `type CompiledAspectObserver = (stage: string, run: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
+type CompiledAspectPipeline = (context: CompiledAspectContext, next: () => unknown | Promise<unknown>, observe?: CompiledAspectObserver) => unknown | Promise<unknown>;
+
+function compiledAspectNext(next: () => unknown | Promise<unknown>, state: { active: boolean }): () => Promise<unknown> {
+  let called = false;
+  return async () => {
+    if (!state.active) throw new Error("Aspect continuation is closed");
+    if (called) throw new Error("Aspect continuation called multiple times");
+    called = true;
+    return await next();
+  };
+}
+function observeCompiledAspect(observe: CompiledAspectObserver | undefined, stage: string, run: () => unknown | Promise<unknown>): unknown | Promise<unknown> {
+  return observe ? observe(stage, run) : run();
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null;
 }
 
@@ -2198,7 +2232,7 @@ var init_graphql_options = __esm(() => {
 
 // src/graphql-inputs.ts
 import { resolve as resolve3 } from "node:path";
-import * as ts5 from "@typescript/typescript6";
+import * as ts7 from "@typescript/typescript6";
 function graphqlInputPaths(options) {
   if (!options.graphql)
     return [];
@@ -2209,7 +2243,7 @@ function graphqlInputPaths(options) {
   }
   const root = resolve3(options.rootDir);
   const schema = resolve3(root, options.graphql.schema);
-  const documents = ts5.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve3(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve3(path)).filter((path) => path !== schema);
+  const documents = ts7.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve3(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve3(path)).filter((path) => path !== schema);
   return [schema, ...[...new Set(documents)].sort()];
 }
 var init_graphql_inputs = __esm(() => {
@@ -2217,7 +2251,7 @@ var init_graphql_inputs = __esm(() => {
 });
 
 // src/graphql-runtime.ts
-import * as ts6 from "@typescript/typescript6";
+import * as ts8 from "@typescript/typescript6";
 import { resolve as resolve4 } from "node:path";
 function renderGraphqlValidators(source, operationNames) {
   const fileName = resolve4("/__supacloud_graphql__/contracts.ts");
@@ -2229,18 +2263,18 @@ function renderGraphqlValidators(source, operationNames) {
     noPropertyAccessFromIndexSignature: true,
     noFallthroughCasesInSwitch: true,
     skipLibCheck: false,
-    target: ts6.ScriptTarget.ES2022,
+    target: ts8.ScriptTarget.ES2022,
     lib: ["lib.es2022.d.ts"],
     types: [],
     noEmit: true
   };
-  const host = ts6.createCompilerHost(options);
+  const host = ts8.createCompilerHost(options);
   const getSourceFile = host.getSourceFile.bind(host);
-  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => path === fileName ? ts6.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
-  const program = ts6.createProgram([fileName], options, host);
-  const diagnostics = ts6.getPreEmitDiagnostics(program);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => path === fileName ? ts8.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  const program = ts8.createProgram([fileName], options, host);
+  const diagnostics = ts8.getPreEmitDiagnostics(program);
   if (diagnostics.length) {
-    throw new Error(`Generated GraphQL types cannot be validated: ${diagnostics.map((item) => ts6.flattenDiagnosticMessageText(item.messageText, `
+    throw new Error(`Generated GraphQL types cannot be validated: ${diagnostics.map((item) => ts8.flattenDiagnosticMessageText(item.messageText, `
 `)).join("; ")}`);
   }
   const checker = program.getTypeChecker();
@@ -2270,25 +2304,25 @@ function renderGraphqlValidators(source, operationNames) {
     return name;
   }
   function expression(type) {
-    if (type.flags & ts6.TypeFlags.Any)
+    if (type.flags & ts8.TypeFlags.Any)
       return unsupported(type);
-    if (type.flags & ts6.TypeFlags.Unknown)
+    if (type.flags & ts8.TypeFlags.Unknown)
       return "true";
-    if (type.flags & ts6.TypeFlags.Never)
+    if (type.flags & ts8.TypeFlags.Never)
       return "false";
-    if (type.flags & ts6.TypeFlags.Null)
+    if (type.flags & ts8.TypeFlags.Null)
       return "value === null";
-    if (type.flags & ts6.TypeFlags.Undefined)
+    if (type.flags & ts8.TypeFlags.Undefined)
       return "value === undefined";
     if (type.isStringLiteral() || type.isNumberLiteral())
       return `value === ${JSON.stringify(type.value)}`;
-    if (type.flags & ts6.TypeFlags.BooleanLiteral)
+    if (type.flags & ts8.TypeFlags.BooleanLiteral)
       return `value === ${checker.typeToString(type)}`;
-    if (type.flags & ts6.TypeFlags.String)
+    if (type.flags & ts8.TypeFlags.String)
       return 'typeof value === "string"';
-    if (type.flags & ts6.TypeFlags.Number)
+    if (type.flags & ts8.TypeFlags.Number)
       return 'typeof value === "number" && Number.isFinite(value)';
-    if (type.flags & ts6.TypeFlags.Boolean)
+    if (type.flags & ts8.TypeFlags.Boolean)
       return 'typeof value === "boolean"';
     if (type.isUnion())
       return type.types.map((part) => `${reference(part)}(value)`).join(" || ");
@@ -2297,16 +2331,16 @@ function renderGraphqlValidators(source, operationNames) {
     if (checker.isTupleType(type))
       return unsupported(type);
     if (checker.isArrayType(type)) {
-      const item = checker.getIndexTypeOfType(type, ts6.IndexKind.Number);
+      const item = checker.getIndexTypeOfType(type, ts8.IndexKind.Number);
       if (!item)
         return unsupported(type);
       return `isGraphqlArray(value) && Array.from(value).every(${reference(item)})`;
     }
-    if (type.flags & ts6.TypeFlags.Object) {
+    if (type.flags & ts8.TypeFlags.Object) {
       if (type.getCallSignatures().length || type.getConstructSignatures().length)
         return unsupported(type);
       const indexes = checker.getIndexInfosOfType(type);
-      if (indexes.some((index) => !(index.keyType.flags & ts6.TypeFlags.String)))
+      if (indexes.some((index) => !(index.keyType.flags & ts8.TypeFlags.String)))
         return unsupported(type);
       const properties = checker.getPropertiesOfType(type).map((property) => {
         const declaration = property.valueDeclaration ?? property.declarations?.[0];
@@ -2315,7 +2349,7 @@ function renderGraphqlValidators(source, operationNames) {
         const check = reference(checker.getTypeOfSymbolAtLocation(property, declaration));
         const key = JSON.stringify(property.name);
         const present = `Object.prototype.hasOwnProperty.call(value, ${key})`;
-        return property.flags & ts6.SymbolFlags.Optional ? `(!${present} || ${check}(value[${key}]))` : `(${present} && ${check}(value[${key}]))`;
+        return property.flags & ts8.SymbolFlags.Optional ? `(!${present} || ${check}(value[${key}]))` : `(${present} && ${check}(value[${key}]))`;
       });
       const indexedValues = indexes.map((index) => `Object.values(value).every(${reference(index.type)})`);
       return ["isGraphqlRecord(value)", ...properties, ...indexedValues].join(" && ");
@@ -2642,10 +2676,155 @@ var init_graphql_schema = __esm(() => {
   init_graphql_options();
 });
 
+// src/database-contracts.ts
+import { createHash as createHash10 } from "node:crypto";
+import { mkdir as mkdir6, readFile as readFile12 } from "node:fs/promises";
+import { dirname as dirname11, relative as relative12, resolve as resolve16 } from "node:path";
+import * as ts13 from "@typescript/typescript6";
+function hash2(value) {
+  return createHash10("sha256").update(value).digest("hex");
+}
+function importPath(out, path) {
+  const value = relative12(out, path).replaceAll("\\", "/").replace(/\.(?:d\.)?[cm]?ts$/, "");
+  return value.startsWith(".") ? value : `./${value}`;
+}
+function parseDatabaseContractsOptions(value, directory) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError("Expected database contracts configuration");
+  const allowed = ["rootDir", "outDir", "postgrestTypes", "drizzleSchema", "role", "graphql", "migrations"];
+  if (Object.keys(value).some((name) => !allowed.includes(name)))
+    throw new TypeError("Unknown database contracts option");
+  const field = (name) => {
+    const result = Reflect.get(value, name);
+    if (typeof result !== "string" || !result.trim())
+      throw new TypeError(`Missing database contracts ${name}`);
+    return result;
+  };
+  const graphql = Reflect.get(value, "graphql");
+  assertGraphqlOptions(graphql);
+  const migrations = Reflect.get(value, "migrations");
+  if (!Array.isArray(migrations) || !migrations.every((entry) => typeof entry === "string" && entry.endsWith(".sql"))) {
+    throw new TypeError("migrations must be an ordered list of SQL files");
+  }
+  return {
+    rootDir: resolve16(directory, field("rootDir")),
+    outDir: resolve16(directory, field("outDir")),
+    postgrestTypes: resolve16(directory, field("postgrestTypes")),
+    drizzleSchema: resolve16(directory, field("drizzleSchema")),
+    role: field("role"),
+    graphql: { ...graphql, schema: resolve16(directory, graphql.schema) },
+    migrations: migrations.map((file) => resolve16(directory, file))
+  };
+}
+async function generateDatabaseContracts(options, check = false) {
+  const rootDir = resolve16(options.rootDir), outDir = resolve16(options.outDir);
+  const postgrestTypes = resolve16(rootDir, options.postgrestTypes), drizzleSchema = resolve16(rootDir, options.drizzleSchema);
+  const snapshot = await readFile12(postgrestTypes, "utf8");
+  const syntax = ts13.createSourceFile(postgrestTypes, snapshot, ts13.ScriptTarget.Latest, true);
+  const database = syntax.statements.find((node) => (ts13.isTypeAliasDeclaration(node) || ts13.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts13.SyntaxKind.ExportKeyword));
+  if (!database)
+    throw new Error("PostgREST snapshot must export Database from the official type generator");
+  const program = ts13.createProgram([postgrestTypes], {
+    strict: true,
+    noEmit: true,
+    skipLibCheck: true,
+    types: [],
+    target: ts13.ScriptTarget.ES2022,
+    module: ts13.ModuleKind.ESNext,
+    moduleResolution: ts13.ModuleResolutionKind.Bundler
+  });
+  if (ts13.getPreEmitDiagnostics(program).length)
+    throw new Error("PostgREST snapshot has TypeScript errors");
+  const artifacts = await renderGraphql({
+    rootDir,
+    outDir,
+    graphql: options.graphql
+  });
+  if (artifacts.diagnostics.some((item) => item.severity === "error")) {
+    throw new Error(artifacts.diagnostics.map((item) => item.message).join(`
+`));
+  }
+  const inputs = {};
+  const addInput = async (path) => {
+    const absolute = resolve16(rootDir, path);
+    inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash2(await readFile12(absolute, "utf8"));
+  };
+  await addInput(postgrestTypes);
+  await addInput(drizzleSchema);
+  const drizzleProgram = ts13.createProgram([drizzleSchema], {
+    noEmit: true,
+    moduleResolution: ts13.ModuleResolutionKind.Bundler,
+    module: ts13.ModuleKind.ESNext,
+    target: ts13.ScriptTarget.ES2022,
+    types: [],
+    skipLibCheck: true
+  });
+  for (const source of drizzleProgram.getSourceFiles()) {
+    if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
+      await addInput(source.fileName);
+  }
+  await addInput(resolve16(rootDir, options.graphql.schema));
+  if (new Set(options.migrations.map((path) => resolve16(rootDir, path))).size !== options.migrations.length) {
+    throw new Error("Duplicate migration in database contracts configuration");
+  }
+  for (const path of options.migrations)
+    await addInput(path);
+  const files = {
+    ...artifacts.files,
+    "database.ts": [
+      "// GENERATED BY @supacloud/compiler database-contracts. Do not edit.",
+      `export type { Database } from ${JSON.stringify(importPath(outDir, postgrestTypes))};`,
+      'export type { QueryData, QueryResult, QueryError } from "@supabase/supabase-js";',
+      `export type DrizzleSchema = typeof import(${JSON.stringify(importPath(outDir, drizzleSchema))});`,
+      'export * from "./graphql";',
+      ""
+    ].join(`
+`)
+  };
+  const manifest = {
+    version: 1,
+    role: options.role,
+    inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => a.localeCompare(b))),
+    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve16(rootDir, path)).replaceAll("\\", "/")),
+    outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash2(text)]))
+  };
+  files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
+`;
+  const mismatches = [];
+  for (const [file, content] of Object.entries(files)) {
+    const path = resolve16(outDir, file);
+    let current;
+    try {
+      current = await readFile12(path, "utf8");
+    } catch (error) {
+      if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT"))
+        throw error;
+    }
+    if (current !== content)
+      mismatches.push(file);
+  }
+  if (!check) {
+    await mkdir6(outDir, { recursive: true });
+    for (const [file, content] of Object.entries(files))
+      await writeFileIfChanged(resolve16(outDir, file), content);
+  }
+  return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
+}
+async function runDatabaseContractsFile(path, check = false) {
+  const absolute = resolve16(path);
+  const value = JSON.parse(await readFile12(absolute, "utf8"));
+  return generateDatabaseContracts(parseDatabaseContractsOptions(value, dirname11(absolute)), check);
+}
+var init_database_contracts = __esm(() => {
+  init_graphql();
+  init_generate();
+  init_graphql_options();
+});
+
 // src/analyze.ts
 import { createHash as createHash3 } from "node:crypto";
 import { relative as relative2, resolve as resolvePath, sep as sep2 } from "node:path";
-import * as ts3 from "@typescript/typescript6";
+import * as ts4 from "@typescript/typescript6";
 
 // src/program.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -3295,6 +3474,7 @@ var COMPILER_DIAGNOSTIC_CODES = {
   "missing-token-factory": { code: "SC2009", docsUrl: "https://supacloud.dev/errors/SC2009" },
   "provider-type-mismatch": { code: "SC2010", docsUrl: "https://supacloud.dev/errors/SC2010" },
   "unsupported-provider-helper": { code: "SC2011", docsUrl: "https://supacloud.dev/errors/SC2011" },
+  "runtime-injection-disallowed": { code: "SC2012", docsUrl: "https://supacloud.dev/errors/SC2012" },
   "command-missing-permission": { code: "SC4001", docsUrl: "https://supacloud.dev/errors/SC4001" },
   "duplicate-command": { code: "SC4002", docsUrl: "https://supacloud.dev/errors/SC4002" },
   "route-command-unresolved": { code: "SC4003", docsUrl: "https://supacloud.dev/errors/SC4003" },
@@ -3341,6 +3521,20 @@ var COMPILER_DIAGNOSTIC_CODES = {
 function validateGraph(graph, options = false) {
   const strict = typeof options === "boolean" ? options : options.strict ?? false;
   const diagnostics = [];
+  for (const module of graph.modules) {
+    for (const owner of [...module.providers, ...module.controllers]) {
+      if (owner.functionalInjects?.length)
+        diagnostics.push({
+          severity: "error",
+          code: "runtime-injection-disallowed",
+          errorCode: "SC2012",
+          docsUrl: "https://supacloud.dev/errors/SC2012",
+          file: owner.file,
+          message: "Property inject() requires runtime token resolution. Compiled applications require constructor injection.",
+          suggestion: "Move injected fields into typed constructor parameters with @Inject(TOKEN) where needed."
+        });
+    }
+  }
   let moduleBoundaries;
   if (typeof options === "object") {
     try {
@@ -3768,7 +3962,7 @@ function validateGraph(graph, options = false) {
       if (typeof options === "object" && options.commandCapabilities) {
         const hostCaps = options.commandCapabilities;
         const rpcCaps = command.rpc && Object.hasOwn(hostCaps.rpc ?? {}, command.rpc) ? hostCaps.rpc?.[command.rpc] : undefined;
-        if (hostCaps.requirePersistentAdapters && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || rpcCaps.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required"))) {
+        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required"))) {
           error("command-persistence-required", `Command ${command.name} requires an explicit persistent adapter, permission, audit and idempotency policy.`, module.file, module.line, "Register a named database/external adapter, enable permission checks and declare permission, audit and required idempotency on the command.");
         }
         if (rpcCaps?.boundary === "external" && (command.transaction === "required" || rpcCaps.transaction === true)) {
@@ -4121,6 +4315,67 @@ function detectOrphanModules(graph) {
   }
   return diagnostics;
 }
+// src/static-di.ts
+import * as ts3 from "@typescript/typescript6";
+var runtimeApis = new Set([
+  "inject",
+  "createEnvironmentInjector",
+  "runInInjectionContext",
+  "EnvironmentInjector",
+  "bootstrapBun",
+  "runInScope",
+  "runInRequestContext",
+  "runInJobContext",
+  "runInTransactionContext"
+]);
+function scanRuntimeDi(source, file) {
+  const diagnostics = [];
+  const namespaces = new Set;
+  const report = (node) => diagnostics.push({
+    severity: "error",
+    code: "runtime-injection-disallowed",
+    errorCode: "SC2012",
+    docsUrl: "https://supacloud.dev/errors/SC2012",
+    file,
+    line: source.getLineAndCharacterOfPosition(node.getStart()).line + 1,
+    message: "Compiled applications cannot import runtime DI. Use explicit constructors and generated scope factories."
+  });
+  for (const statement of source.statements) {
+    if (!(ts3.isImportDeclaration(statement) || ts3.isExportDeclaration(statement)) || !statement.moduleSpecifier || !ts3.isStringLiteral(statement.moduleSpecifier) || !/^@supacloud\/app(?:\/|$)/.test(statement.moduleSpecifier.text))
+      continue;
+    if (ts3.isImportDeclaration(statement)) {
+      if (statement.importClause?.isTypeOnly)
+        continue;
+      const binding = statement.importClause?.namedBindings;
+      if (binding && ts3.isNamespaceImport(binding))
+        namespaces.add(binding.name.text);
+      if (binding && ts3.isNamedImports(binding))
+        for (const item of binding.elements) {
+          if (!item.isTypeOnly && runtimeApis.has((item.propertyName ?? item.name).text))
+            report(item);
+        }
+    } else if (!statement.isTypeOnly) {
+      if (!statement.exportClause)
+        report(statement);
+      else if (ts3.isNamedExports(statement.exportClause))
+        for (const item of statement.exportClause.elements) {
+          if (!item.isTypeOnly && runtimeApis.has((item.propertyName ?? item.name).text))
+            report(item);
+        }
+    }
+  }
+  const visit = (node) => {
+    if (ts3.isPropertyAccessExpression(node) && ts3.isIdentifier(node.expression) && namespaces.has(node.expression.text) && runtimeApis.has(node.name.text))
+      report(node);
+    if (ts3.isElementAccessExpression(node) && ts3.isIdentifier(node.expression) && namespaces.has(node.expression.text) && (!ts3.isStringLiteral(node.argumentExpression) || runtimeApis.has(node.argumentExpression.text)))
+      report(node);
+    if (ts3.isVariableDeclaration(node) && node.initializer && ts3.isIdentifier(node.initializer) && namespaces.has(node.initializer.text))
+      report(node);
+    ts3.forEachChild(node, visit);
+  };
+  visit(source);
+  return diagnostics;
+}
 
 // src/analyze.ts
 var DEFAULT_INCLUDE = ["**/*.module.ts", "**/*.ts"];
@@ -4162,26 +4417,26 @@ function lineOf(node) {
   return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
 }
 function variableName(decl) {
-  return ts3.isIdentifier(decl.name) ? decl.name.text : nodeText(decl.name);
+  return ts4.isIdentifier(decl.name) ? decl.name.text : nodeText(decl.name);
 }
 function propertyName(name) {
-  if (ts3.isIdentifier(name) || ts3.isPrivateIdentifier(name))
+  if (ts4.isIdentifier(name) || ts4.isPrivateIdentifier(name))
     return name.text;
-  if (ts3.isStringLiteral(name) || ts3.isNumericLiteral(name))
+  if (ts4.isStringLiteral(name) || ts4.isNumericLiteral(name))
     return name.text;
   return nodeText(name);
 }
 function parameterName(param) {
-  return ts3.isIdentifier(param.name) ? param.name.text : nodeText(param.name);
+  return ts4.isIdentifier(param.name) ? param.name.text : nodeText(param.name);
 }
 function decoratorsOf(node) {
-  return ts3.canHaveDecorators(node) ? ts3.getDecorators(node) ?? [] : [];
+  return ts4.canHaveDecorators(node) ? ts4.getDecorators(node) ?? [] : [];
 }
 function decoratorArguments(dec) {
-  return ts3.isCallExpression(dec.expression) ? dec.expression.arguments : [];
+  return ts4.isCallExpression(dec.expression) ? dec.expression.arguments : [];
 }
 function hasMethod(cls, name) {
-  return cls.members.some((member) => (ts3.isMethodDeclaration(member) || ts3.isGetAccessorDeclaration(member) || ts3.isSetAccessorDeclaration(member)) && member.name !== undefined && propertyName(member.name) === name);
+  return cls.members.some((member) => (ts4.isMethodDeclaration(member) || ts4.isGetAccessorDeclaration(member) || ts4.isSetAccessorDeclaration(member)) && member.name !== undefined && propertyName(member.name) === name);
 }
 function hasDestroyHook(cls) {
   return hasMethod(cls, "onDestroy") || hasMethod(cls, "ngOnDestroy");
@@ -4191,7 +4446,7 @@ function descendantsOfKind(root, predicate) {
   const visit = (node) => {
     if (predicate(node))
       result.push(node);
-    ts3.forEachChild(node, visit);
+    ts4.forEachChild(node, visit);
   };
   visit(root);
   return result;
@@ -4200,7 +4455,7 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
   const session = cache?.programSession ?? createIncrementalProgramSession(rootDir);
   if (cache)
     cache.programSession = session;
-  const rootNames = ts3.sys.readDirectory(rootDir, [".ts", ".tsx"], ["node_modules", "dist"], include ?? DEFAULT_INCLUDE);
+  const rootNames = ts4.sys.readDirectory(rootDir, [".ts", ".tsx"], ["node_modules", "dist"], include ?? DEFAULT_INCLUDE);
   const update = session.update(rootNames, changedPaths);
   const program = update.program;
   const checker = program.getTypeChecker();
@@ -4224,13 +4479,16 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
     nativeTraitFiles.set(trait.file, kinds);
   }
   for (const sf of sourceFiles) {
+    if (!/\.(?:test|spec)\.[cm]?tsx?$/.test(sf.fileName)) {
+      ctx.diagnostics.push(...scanRuntimeDi(sf, sourcePath(rootDir, sf.fileName)));
+    }
     indexFile(sf, ctx);
   }
   const candidates = [];
   for (const sf of sourceFiles) {
     const traits = nativeTraitFiles.get(sf.fileName);
     if (!cache || traits?.has("module")) {
-      for (const cls of sf.statements.filter(ts3.isClassDeclaration)) {
+      for (const cls of sf.statements.filter(ts4.isClassDeclaration)) {
         const moduleDec = findDecorator(cls, "Module");
         if (!moduleDec)
           continue;
@@ -4247,14 +4505,14 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
       }
     }
     if (!cache || traits?.has("defineModule") || traits?.has("defineFeatureSlice")) {
-      for (const call of descendantsOfKind(sf, ts3.isCallExpression)) {
+      for (const call of descendantsOfKind(sf, ts4.isCallExpression)) {
         if (!["defineModule", "defineFeatureSlice"].includes(nodeText(call.expression)))
           continue;
         const parent = call.parent;
-        if (!parent || !ts3.isVariableDeclaration(parent))
+        if (!parent || !ts4.isVariableDeclaration(parent))
           continue;
         const arg = call.arguments[0];
-        if (!arg || !ts3.isObjectLiteralExpression(arg))
+        if (!arg || !ts4.isObjectLiteralExpression(arg))
           continue;
         candidates.push({
           node: parent,
@@ -4398,7 +4656,7 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
       const controllerDec = findDecorator(classInfo.decl, "Controller");
       if (controllerDec) {
         const arg = decoratorArguments(controllerDec)[0];
-        const isStandalone = arg && ts3.isObjectLiteralExpression(arg) && booleanProp(arg, "standalone");
+        const isStandalone = arg && ts4.isObjectLiteralExpression(arg) && booleanProp(arg, "standalone");
         if (isStandalone) {
           const ctrl = parseController(classInfo.decl, ctx);
           if (ctrl)
@@ -4523,16 +4781,16 @@ function collectModuleSourceClosure(module, ctx) {
     ownedFiles.add(relativeFile);
     for (const statement of sourceFile.statements) {
       let moduleName;
-      if (ts3.isImportDeclaration(statement) && ts3.isStringLiteral(statement.moduleSpecifier)) {
+      if (ts4.isImportDeclaration(statement) && ts4.isStringLiteral(statement.moduleSpecifier)) {
         moduleName = statement.moduleSpecifier.text;
-      } else if (ts3.isExportDeclaration(statement) && statement.moduleSpecifier && ts3.isStringLiteral(statement.moduleSpecifier)) {
+      } else if (ts4.isExportDeclaration(statement) && statement.moduleSpecifier && ts4.isStringLiteral(statement.moduleSpecifier)) {
         moduleName = statement.moduleSpecifier.text;
-      } else if (ts3.isImportEqualsDeclaration(statement) && ts3.isExternalModuleReference(statement.moduleReference) && ts3.isStringLiteral(statement.moduleReference.expression)) {
+      } else if (ts4.isImportEqualsDeclaration(statement) && ts4.isExternalModuleReference(statement.moduleReference) && ts4.isStringLiteral(statement.moduleReference.expression)) {
         moduleName = statement.moduleReference.expression.text;
       }
       if (!moduleName || moduleName.startsWith("node:"))
         continue;
-      const resolved = ts3.resolveModuleName(moduleName, sourceFile.fileName, ctx.program.getCompilerOptions(), ts3.sys).resolvedModule?.resolvedFileName;
+      const resolved = ts4.resolveModuleName(moduleName, sourceFile.fileName, ctx.program.getCompilerOptions(), ts4.sys).resolvedModule?.resolvedFileName;
       if (resolved && isProjectSourcePath(resolved, ctx.rootDir) && !enqueued.has(resolved)) {
         enqueued.add(resolved);
         queue.push(resolved);
@@ -4554,15 +4812,15 @@ function isProjectSourceFile(sourceFile, rootDir) {
   return isProjectSourcePath(sourceFile.fileName, rootDir) && /\.(tsx?|mts|cts)$/.test(sourceFile.fileName);
 }
 function indexFile(sf, ctx) {
-  for (const cls of sf.statements.filter(ts3.isClassDeclaration)) {
+  for (const cls of sf.statements.filter(ts4.isClassDeclaration)) {
     const name = cls.name?.text;
     if (name && !ctx.classesByName.has(name)) {
       ctx.classesByName.set(name, { name, decl: cls, file: sf.fileName });
     }
   }
-  for (const statement of sf.statements.filter(ts3.isVariableStatement)) {
+  for (const statement of sf.statements.filter(ts4.isVariableStatement)) {
     for (const decl of statement.declarationList.declarations) {
-      if (ts3.isIdentifier(decl.name) && !ctx.variablesByName.has(decl.name.text)) {
+      if (ts4.isIdentifier(decl.name) && !ctx.variablesByName.has(decl.name.text)) {
         ctx.variablesByName.set(decl.name.text, decl);
       }
       const info = parseTokenVariable(decl, sf.fileName);
@@ -4574,16 +4832,16 @@ function indexFile(sf, ctx) {
 }
 function parseTokenVariable(decl, file) {
   const init = decl.initializer;
-  if (!init || !ts3.isNewExpression(init))
+  if (!init || !ts4.isNewExpression(init))
     return;
   if (nodeText(init.expression) !== "InjectionToken")
     return;
   const [nameArg, optionsArg] = init.arguments ?? [];
   const info = { name: variableName(decl), file, line: lineOf(decl) };
-  if (nameArg && ts3.isStringLiteral(nameArg)) {
+  if (nameArg && ts4.isStringLiteral(nameArg)) {
     info.stringName = nameArg.text;
   }
-  if (optionsArg && ts3.isObjectLiteralExpression(optionsArg)) {
+  if (optionsArg && ts4.isObjectLiteralExpression(optionsArg)) {
     const scope = stringLiteralProp(optionsArg, "scope");
     if (scope && isScope(scope)) {
       info.scope = scope;
@@ -4603,22 +4861,22 @@ function parseModule(candidate, nameByNode, ctx) {
   const { options, className, file, line } = candidate;
   const name = nameByNode.get(candidate.node) ?? className;
   const featureSpec = parseFeatureSpec(getProp(options, "spec"), ctx);
-  const tags = arrayProp(options, "tags").map((el) => ts3.isStringLiteral(el) ? el.text : nodeText(el).replace(/['"]/g, "")).filter(Boolean);
+  const tags = arrayProp(options, "tags").map((el) => ts4.isStringLiteral(el) ? el.text : nodeText(el).replace(/['"]/g, "")).filter(Boolean);
   const aspects = parseAspectRefs(getProp(options, "aspects"), ctx, `module ${name}`);
   const imports = arrayProp(options, "imports").map((el) => {
     const unwrapped = unwrapForwardRef(el);
-    const decl = ts3.isIdentifier(unwrapped) ? resolveDeclaration(unwrapped, ctx)[0] : undefined;
+    const decl = ts4.isIdentifier(unwrapped) ? resolveDeclaration(unwrapped, ctx)[0] : undefined;
     if (decl) {
       const known = nameByNode.get(decl);
       if (known)
         return known;
-      if (ts3.isClassDeclaration(decl)) {
+      if (ts4.isClassDeclaration(decl)) {
         const dec = findDecorator(decl, "Module");
         const decOptions = dec && decoratorObjectArg(dec);
         const decName = decOptions && stringLiteralProp(decOptions, "name");
         return decName ?? decl.name?.text ?? nodeText(el);
       }
-      if (ts3.isVariableDeclaration(decl))
+      if (ts4.isVariableDeclaration(decl))
         return variableName(decl);
     }
     return nodeText(el);
@@ -4632,7 +4890,7 @@ function parseModule(candidate, nameByNode, ctx) {
       providers.push(...parsedProviders);
       continue;
     }
-    if (ts3.isCallExpression(el)) {
+    if (ts4.isCallExpression(el)) {
       const helper = nodeText(el.expression).split(".").pop() ?? nodeText(el.expression);
       warn(ctx, "unsupported-provider-helper", `无法静态展开 provider helper '${helper}'；请改用显式 Provider 或实现编译器支持的 helper`, sourcePath(ctx.rootDir, el.getSourceFile().fileName), lineOf(el));
       continue;
@@ -4642,10 +4900,10 @@ function parseModule(candidate, nameByNode, ctx) {
       providers.push(provider);
   }
   for (const el of arrayProp(options, "jobs")) {
-    if (!ts3.isIdentifier(el))
+    if (!ts4.isIdentifier(el))
       continue;
     const decl = resolveDeclaration(el, ctx)[0];
-    if (!decl || !ts3.isClassDeclaration(decl))
+    if (!decl || !ts4.isClassDeclaration(decl))
       continue;
     const className = decl.name?.text ?? el.text;
     const registeredProvider = providers.find((provider) => provider.token === className || provider.useClass === className);
@@ -4682,18 +4940,18 @@ function parseModule(candidate, nameByNode, ctx) {
   const handlerClasses = [];
   const seenHandlers = new Set;
   const collectHandler = (expr) => {
-    if (!ts3.isIdentifier(expr))
+    if (!ts4.isIdentifier(expr))
       return;
     const decl = resolveDeclaration(expr, ctx)[0];
-    if (decl && ts3.isClassDeclaration(decl) && !seenHandlers.has(decl.name?.text ?? "")) {
+    if (decl && ts4.isClassDeclaration(decl) && !seenHandlers.has(decl.name?.text ?? "")) {
       seenHandlers.add(decl.name?.text ?? "");
       handlerClasses.push(decl);
     }
   };
   for (const el of arrayProp(options, "providers")) {
-    if (ts3.isIdentifier(el))
+    if (ts4.isIdentifier(el))
       collectHandler(el);
-    if (ts3.isObjectLiteralExpression(el)) {
+    if (ts4.isObjectLiteralExpression(el)) {
       const useClass = getProp(el, "useClass");
       if (useClass)
         collectHandler(useClass);
@@ -4793,17 +5051,17 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
   if (seen.has(input))
     return;
   seen.add(input);
-  if (ts3.isIdentifier(input)) {
-    const local = input.getSourceFile().statements.flatMap((statement) => ts3.isVariableStatement(statement) ? [...statement.declarationList.declarations] : []);
+  if (ts4.isIdentifier(input)) {
+    const local = input.getSourceFile().statements.flatMap((statement) => ts4.isVariableStatement(statement) ? [...statement.declarationList.declarations] : []);
     const resolved = resolveDeclaration(input, ctx)[0];
-    const decl = (resolved && ts3.isVariableDeclaration(resolved) ? resolved : undefined) ?? ctx.variablesByName.get(input.text) ?? local.find((candidate) => ts3.isIdentifier(candidate.name) && candidate.name.text === input.text) ?? descendantsOfKind(input.getSourceFile(), ts3.isVariableDeclaration).find((candidate) => ts3.isIdentifier(candidate.name) && candidate.name.text === input.text);
-    if (decl && ts3.isVariableDeclaration(decl))
+    const decl = (resolved && ts4.isVariableDeclaration(resolved) ? resolved : undefined) ?? ctx.variablesByName.get(input.text) ?? local.find((candidate) => ts4.isIdentifier(candidate.name) && candidate.name.text === input.text) ?? descendantsOfKind(input.getSourceFile(), ts4.isVariableDeclaration).find((candidate) => ts4.isIdentifier(candidate.name) && candidate.name.text === input.text);
+    if (decl && ts4.isVariableDeclaration(decl))
       return parseFeatureSpec(decl.initializer, ctx, seen);
   }
-  if (ts3.isCallExpression(input) && nodeText(input.expression) === "defineFeatureSpec") {
+  if (ts4.isCallExpression(input) && nodeText(input.expression) === "defineFeatureSpec") {
     return parseFeatureSpec(input.arguments[0], ctx, seen);
   }
-  if (ts3.isAsExpression(input) || ts3.isSatisfiesExpression(input) || ts3.isParenthesizedExpression(input)) {
+  if (ts4.isAsExpression(input) || ts4.isSatisfiesExpression(input) || ts4.isParenthesizedExpression(input)) {
     return parseFeatureSpec(input.expression, ctx, seen);
   }
   const invalid = () => {
@@ -4816,28 +5074,28 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
     });
     return;
   };
-  if (!ts3.isObjectLiteralExpression(input))
+  if (!ts4.isObjectLiteralExpression(input))
     return invalid();
   const name = stringLiteralProp(input, "name");
   const statesExpr = getProp(input, "states");
   const transitionObject = getProp(input, "transitions");
-  if (!name || !statesExpr || !ts3.isArrayLiteralExpression(statesExpr) || statesExpr.elements.some((state) => !ts3.isStringLiteral(state)) || !transitionObject || !ts3.isObjectLiteralExpression(transitionObject) || input.properties.some((property) => !ts3.isPropertyAssignment(property))) {
+  if (!name || !statesExpr || !ts4.isArrayLiteralExpression(statesExpr) || statesExpr.elements.some((state) => !ts4.isStringLiteral(state)) || !transitionObject || !ts4.isObjectLiteralExpression(transitionObject) || input.properties.some((property) => !ts4.isPropertyAssignment(property))) {
     return invalid();
   }
   const states = [];
   for (const state of statesExpr.elements) {
-    if (!ts3.isStringLiteral(state))
+    if (!ts4.isStringLiteral(state))
       return invalid();
     states.push(state.text);
   }
   const transitions = [];
   for (const property of transitionObject.properties) {
-    if (!ts3.isPropertyAssignment(property) || ts3.isComputedPropertyName(property.name) || !ts3.isObjectLiteralExpression(property.initializer))
+    if (!ts4.isPropertyAssignment(property) || ts4.isComputedPropertyName(property.name) || !ts4.isObjectLiteralExpression(property.initializer))
       return invalid();
     const options = property.initializer;
     const from = stringLiteralProp(options, "from");
     const to = stringLiteralProp(options, "to");
-    if (!from || !to || options.properties.some((prop) => !ts3.isPropertyAssignment(prop)) || ["permission", "command", "route", "audit"].some((key) => getProp(options, key) && !stringLiteralProp(options, key)) || ["transaction", "idempotency"].some((key) => getProp(options, key) && !commandModeProp(options, key))) {
+    if (!from || !to || options.properties.some((prop) => !ts4.isPropertyAssignment(prop)) || ["permission", "command", "route", "audit"].some((key) => getProp(options, key) && !stringLiteralProp(options, key)) || ["transaction", "idempotency"].some((key) => getProp(options, key) && !commandModeProp(options, key))) {
       return invalid();
     }
     const permission = stringLiteralProp(options, "permission");
@@ -4864,21 +5122,21 @@ function resolveStaticObjectLiteral(input, ctx, seen = new Set) {
   if (!input || seen.has(input))
     return;
   seen.add(input);
-  if (ts3.isAsExpression(input) || ts3.isSatisfiesExpression(input) || ts3.isParenthesizedExpression(input)) {
+  if (ts4.isAsExpression(input) || ts4.isSatisfiesExpression(input) || ts4.isParenthesizedExpression(input)) {
     return resolveStaticObjectLiteral(input.expression, ctx, seen);
   }
-  if (ts3.isIdentifier(input)) {
-    const declaration = resolveDeclaration(input, ctx).find(ts3.isVariableDeclaration);
+  if (ts4.isIdentifier(input)) {
+    const declaration = resolveDeclaration(input, ctx).find(ts4.isVariableDeclaration);
     return declaration?.initializer ? resolveStaticObjectLiteral(declaration.initializer, ctx, seen) : undefined;
   }
-  if (ts3.isCallExpression(input)) {
+  if (ts4.isCallExpression(input)) {
     const expressionName = nodeText(input.expression);
     if (expressionName === "defineRouteContract" || expressionName.endsWith(".defineRouteContract")) {
       return resolveStaticObjectLiteral(input.arguments[0], ctx, seen);
     }
     return;
   }
-  return ts3.isObjectLiteralExpression(input) ? input : undefined;
+  return ts4.isObjectLiteralExpression(input) ? input : undefined;
 }
 function commandModeProp(object, name) {
   const value = stringLiteralProp(object, name);
@@ -4913,9 +5171,9 @@ function parseProvider(el, exportsSet, ctx) {
   const file = sourcePath(ctx.rootDir, el.getSourceFile().fileName);
   const line = lineOf(el);
   const unwrappedEl = unwrapForwardRef(el);
-  if (ts3.isIdentifier(unwrappedEl)) {
+  if (ts4.isIdentifier(unwrappedEl)) {
     const decl = resolveDeclaration(unwrappedEl, ctx)[0];
-    const cls = decl && ts3.isClassDeclaration(decl) ? decl : undefined;
+    const cls = decl && ts4.isClassDeclaration(decl) ? decl : undefined;
     const className = cls?.name?.text ?? unwrappedEl.text;
     const { deps, optionalDeps, selfDeps, skipSelfDeps, hostDeps, functionalInjects, missing } = cls ? classDeps(cls, ctx) : { deps: [], optionalDeps: [], selfDeps: [], skipSelfDeps: [], hostDeps: [], functionalInjects: [], missing: false };
     const injectable = cls ? parseInjectableOptions(cls, ctx) : undefined;
@@ -4942,7 +5200,7 @@ function parseProvider(el, exportsSet, ctx) {
       ...cls ? { importPath: modulePath(ctx.rootDir, cls.getSourceFile().fileName) } : {}
     };
   }
-  if (!ts3.isObjectLiteralExpression(el))
+  if (!ts4.isObjectLiteralExpression(el))
     return;
   const provideExpr = getProp(el, "provide");
   if (!provideExpr)
@@ -4957,8 +5215,8 @@ function parseProvider(el, exportsSet, ctx) {
   const useExistingExpr = getProp(el, "useExisting");
   if (useClassExpr) {
     const unwrappedClass = unwrapForwardRef(useClassExpr);
-    const decl = ts3.isIdentifier(unwrappedClass) ? resolveDeclaration(unwrappedClass, ctx)[0] : undefined;
-    const cls = decl && ts3.isClassDeclaration(decl) ? decl : undefined;
+    const decl = ts4.isIdentifier(unwrappedClass) ? resolveDeclaration(unwrappedClass, ctx)[0] : undefined;
+    const cls = decl && ts4.isClassDeclaration(decl) ? decl : undefined;
     const useClass = cls?.name?.text ?? nodeText(unwrappedClass);
     let deps = explicitDeps;
     let optionalDeps = [];
@@ -5014,7 +5272,7 @@ function parseProvider(el, exportsSet, ctx) {
   }
   if (useValueExpr) {
     validateProviderCompatibility(provideExpr, useValueExpr, "value", token, ctx, file, line);
-    const importPath = ts3.isIdentifier(useValueExpr) ? importPathOf(useValueExpr, ctx) : undefined;
+    const importPath = ts4.isIdentifier(useValueExpr) ? importPathOf(useValueExpr, ctx) : undefined;
     return {
       token,
       tokenKind,
@@ -5030,12 +5288,12 @@ function parseProvider(el, exportsSet, ctx) {
     };
   }
   if (useFactoryExpr) {
-    const factoryName = ts3.isIdentifier(useFactoryExpr) ? (() => {
+    const factoryName = ts4.isIdentifier(useFactoryExpr) ? (() => {
       const decl = resolveDeclaration(useFactoryExpr, ctx)[0];
-      return decl && (ts3.isFunctionDeclaration(decl) || ts3.isVariableDeclaration(decl)) ? (ts3.isFunctionDeclaration(decl) ? decl.name?.text : variableName(decl)) ?? useFactoryExpr.text : useFactoryExpr.text;
+      return decl && (ts4.isFunctionDeclaration(decl) || ts4.isVariableDeclaration(decl)) ? (ts4.isFunctionDeclaration(decl) ? decl.name?.text : variableName(decl)) ?? useFactoryExpr.text : useFactoryExpr.text;
     })() : nodeText(useFactoryExpr);
     validateProviderCompatibility(provideExpr, useFactoryExpr, "factory", token, ctx, file, line);
-    const importPath = ts3.isIdentifier(useFactoryExpr) ? importPathOf(useFactoryExpr, ctx) : undefined;
+    const importPath = ts4.isIdentifier(useFactoryExpr) ? importPathOf(useFactoryExpr, ctx) : undefined;
     return {
       token,
       tokenKind,
@@ -5071,20 +5329,20 @@ function parseProvider(el, exportsSet, ctx) {
 function expandProviderExpressions(expressions, ctx, seen = new Set) {
   const result = [];
   for (const expression of expressions) {
-    if (ts3.isSpreadElement(expression)) {
+    if (ts4.isSpreadElement(expression)) {
       result.push(...expandProviderExpressions([expression.expression], ctx, seen));
       continue;
     }
-    if (ts3.isIdentifier(expression)) {
+    if (ts4.isIdentifier(expression)) {
       const declaration = resolveDeclaration(expression, ctx)[0];
-      if (declaration && ts3.isVariableDeclaration(declaration) && declaration.initializer) {
+      if (declaration && ts4.isVariableDeclaration(declaration) && declaration.initializer) {
         const key = `${declaration.getSourceFile().fileName}:${declaration.pos}`;
         if (seen.has(key))
           continue;
         const initializer = declaration.initializer;
-        if (ts3.isCallExpression(initializer) && isProviderHelper(initializer, "makeEnvironmentProviders")) {
+        if (ts4.isCallExpression(initializer) && isProviderHelper(initializer, "makeEnvironmentProviders")) {
           const nested = initializer.arguments[0];
-          if (nested && ts3.isArrayLiteralExpression(nested)) {
+          if (nested && ts4.isArrayLiteralExpression(nested)) {
             seen.add(key);
             result.push(...expandProviderExpressions([...nested.elements], ctx, seen));
             seen.delete(key);
@@ -5093,9 +5351,9 @@ function expandProviderExpressions(expressions, ctx, seen = new Set) {
         }
       }
     }
-    if (ts3.isCallExpression(expression) && isProviderHelper(expression, "makeEnvironmentProviders")) {
+    if (ts4.isCallExpression(expression) && isProviderHelper(expression, "makeEnvironmentProviders")) {
       const nested = expression.arguments[0];
-      if (nested && ts3.isArrayLiteralExpression(nested)) {
+      if (nested && ts4.isArrayLiteralExpression(nested)) {
         result.push(...expandProviderExpressions([...nested.elements], ctx, seen));
         continue;
       }
@@ -5108,7 +5366,7 @@ function isProviderHelper(expression, name) {
   return nodeText(expression.expression).split(".").pop() === name;
 }
 function parseFunctionalProvider(expression, exportsSet, ctx) {
-  if (!ts3.isCallExpression(expression))
+  if (!ts4.isCallExpression(expression))
     return;
   const helper = nodeText(expression.expression).split(".").pop();
   const args = expression.arguments;
@@ -5121,7 +5379,7 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
       return [];
     const { name: token, kind: tokenKind } = tokenNameOf(tokenExpr, ctx);
     validateProviderCompatibility(tokenExpr, valueExpr, "value", token, ctx, file, line);
-    const importPath = ts3.isIdentifier(valueExpr) ? importPathOf(valueExpr, ctx) : undefined;
+    const importPath = ts4.isIdentifier(valueExpr) ? importPathOf(valueExpr, ctx) : undefined;
     return [{
       token,
       tokenKind,
@@ -5140,7 +5398,7 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
     if (!initializer)
       return [];
     const token = helper === "provideAppInitializer" ? "APP_INITIALIZER" : "ENVIRONMENT_INITIALIZER";
-    const importPath = ts3.isIdentifier(initializer) ? importPathOf(initializer, ctx) : undefined;
+    const importPath = ts4.isIdentifier(initializer) ? importPathOf(initializer, ctx) : undefined;
     return [{
       token,
       tokenKind: "injection-token",
@@ -5159,7 +5417,7 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
     const providers = [];
     const routes = args[0];
     if (routes) {
-      const importPath = ts3.isIdentifier(routes) ? importPathOf(routes, ctx) : undefined;
+      const importPath = ts4.isIdentifier(routes) ? importPathOf(routes, ctx) : undefined;
       providers.push({
         token: "ROUTE_CONFIG",
         tokenKind: "injection-token",
@@ -5174,7 +5432,7 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
       });
     }
     for (const feature of args.slice(1)) {
-      if (!ts3.isCallExpression(feature))
+      if (!ts4.isCallExpression(feature))
         continue;
       const featureName = nodeText(feature.expression).split(".").pop();
       if (featureName === "withRouterConfig" && feature.arguments[0]) {
@@ -5191,8 +5449,8 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
         });
       } else if (featureName === "withTitleStrategy" && feature.arguments[0]) {
         const strategy = feature.arguments[0];
-        const isClass = ts3.isIdentifier(strategy) && Boolean(resolveDeclaration(strategy, ctx).find((declaration) => ts3.isClassDeclaration(declaration)));
-        const importPath = ts3.isIdentifier(strategy) ? importPathOf(strategy, ctx) : undefined;
+        const isClass = ts4.isIdentifier(strategy) && Boolean(resolveDeclaration(strategy, ctx).find((declaration) => ts4.isClassDeclaration(declaration)));
+        const importPath = ts4.isIdentifier(strategy) ? importPathOf(strategy, ctx) : undefined;
         providers.push({
           token: "TITLE_STRATEGY",
           tokenKind: "injection-token",
@@ -5224,14 +5482,14 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
       importModule: "@supacloud/app"
     }];
     for (const feature of args) {
-      if (!ts3.isCallExpression(feature))
+      if (!ts4.isCallExpression(feature))
         continue;
       const featureName = nodeText(feature.expression).split(".").pop();
       if (featureName === "withInterceptors") {
         for (const interceptorArg of feature.arguments) {
-          const values = ts3.isArrayLiteralExpression(interceptorArg) ? [...interceptorArg.elements] : [interceptorArg];
+          const values = ts4.isArrayLiteralExpression(interceptorArg) ? [...interceptorArg.elements] : [interceptorArg];
           for (const value of values) {
-            const importPath = ts3.isIdentifier(value) ? importPathOf(value, ctx) : undefined;
+            const importPath = ts4.isIdentifier(value) ? importPathOf(value, ctx) : undefined;
             providers.push({
               token: "HTTP_INTERCEPTORS",
               tokenKind: "injection-token",
@@ -5278,9 +5536,9 @@ function providerTokenValueType(expr, ctx) {
   const typeArguments = typeArgumentsOf(type, ctx);
   if (typeArguments.length > 0)
     return typeArguments[0];
-  if (ts3.isIdentifier(expr)) {
+  if (ts4.isIdentifier(expr)) {
     const declaration = resolveDeclaration(expr, ctx)[0];
-    if (declaration && ts3.isClassDeclaration(declaration)) {
+    if (declaration && ts4.isClassDeclaration(declaration)) {
       return declaredClassType(declaration, ctx);
     }
   }
@@ -5288,9 +5546,9 @@ function providerTokenValueType(expr, ctx) {
 }
 function providerImplementationType(expr, kind, ctx) {
   if (kind === "class" || kind === "existing") {
-    if (ts3.isIdentifier(expr)) {
+    if (ts4.isIdentifier(expr)) {
       const declaration = resolveDeclaration(expr, ctx)[0];
-      if (declaration && ts3.isClassDeclaration(declaration)) {
+      if (declaration && ts4.isClassDeclaration(declaration)) {
         return declaredClassType(declaration, ctx);
       }
     }
@@ -5300,7 +5558,7 @@ function providerImplementationType(expr, kind, ctx) {
   }
   if (kind === "factory") {
     const type = ctx.checker.getTypeAtLocation(expr);
-    const signature = ctx.checker.getSignaturesOfType(type, ts3.SignatureKind.Call)[0];
+    const signature = ctx.checker.getSignaturesOfType(type, ts4.SignatureKind.Call)[0];
     return signature?.getReturnType();
   }
   return ctx.checker.getTypeAtLocation(expr);
@@ -5319,16 +5577,16 @@ function isTypeReference(type) {
   return "target" in type;
 }
 function isUnknownOrAny(type) {
-  return (type.flags & (ts3.TypeFlags.Any | ts3.TypeFlags.Unknown)) !== 0;
+  return (type.flags & (ts4.TypeFlags.Any | ts4.TypeFlags.Unknown)) !== 0;
 }
 function parseController(input, ctx) {
   let decl;
-  if (ts3.isClassDeclaration(input)) {
+  if (ts4.isClassDeclaration(input)) {
     decl = input;
   } else {
     const unwrapped = unwrapForwardRef(input);
-    const resolved = ts3.isIdentifier(unwrapped) ? resolveDeclaration(unwrapped, ctx)[0] : undefined;
-    if (resolved && ts3.isClassDeclaration(resolved)) {
+    const resolved = ts4.isIdentifier(unwrapped) ? resolveDeclaration(unwrapped, ctx)[0] : undefined;
+    if (resolved && ts4.isClassDeclaration(resolved)) {
       decl = resolved;
     }
   }
@@ -5341,9 +5599,9 @@ function parseController(input, ctx) {
   let standalone;
   const pathArg = decoratorArguments(controllerDec)[0];
   if (pathArg) {
-    if (ts3.isStringLiteral(pathArg)) {
+    if (ts4.isStringLiteral(pathArg)) {
       path = pathArg.text;
-    } else if (ts3.isObjectLiteralExpression(pathArg)) {
+    } else if (ts4.isObjectLiteralExpression(pathArg)) {
       const p = stringLiteralProp(pathArg, "path");
       if (p)
         path = p;
@@ -5366,7 +5624,7 @@ function parseController(input, ctx) {
       }
     }
   }
-  for (const method of decl.members.filter(ts3.isMethodDeclaration)) {
+  for (const method of decl.members.filter(ts4.isMethodDeclaration)) {
     for (const dec of decoratorsOf(method)) {
       const name = decoratorName2(dec);
       const httpMethod = name ? ROUTE_DECORATORS[name] : undefined;
@@ -5374,7 +5632,7 @@ function parseController(input, ctx) {
         continue;
       const args = decoratorArguments(dec);
       const pathArg = args[0];
-      const routePath = pathArg && ts3.isStringLiteral(pathArg) ? pathArg.text : "/";
+      const routePath = pathArg && ts4.isStringLiteral(pathArg) ? pathArg.text : "/";
       const route = {
         method: httpMethod,
         path: routePath,
@@ -5445,12 +5703,12 @@ function parseController(input, ctx) {
           } else if (dName === "Headers") {
             hasBindingDecorator = true;
             const argument = dArgs[0];
-            const bindingName = argument !== undefined && ts3.isStringLiteral(argument) ? argument.text : undefined;
+            const bindingName = argument !== undefined && ts4.isStringLiteral(argument) ? argument.text : undefined;
             paramNode = { name: pName, kind: "headers", ...bindingName === undefined ? {} : { bindingName } };
           } else if (dName === "Cookie") {
             hasBindingDecorator = true;
             const argument = dArgs[0];
-            const bindingName = argument !== undefined && ts3.isStringLiteral(argument) ? argument.text : undefined;
+            const bindingName = argument !== undefined && ts4.isStringLiteral(argument) ? argument.text : undefined;
             paramNode = { name: pName, kind: "cookie", ...bindingName === undefined ? {} : { bindingName } };
           }
         }
@@ -5512,20 +5770,20 @@ function parseController(input, ctx) {
           }
         } else if (dName === "Title") {
           const tArg = mArgs[0];
-          if (tArg && ts3.isStringLiteral(tArg)) {
+          if (tArg && ts4.isStringLiteral(tArg)) {
             route.title = tArg.text;
           }
         } else if (dName === "Data") {
           const dArg = mArgs[0];
-          if (dArg && ts3.isObjectLiteralExpression(dArg)) {
+          if (dArg && ts4.isObjectLiteralExpression(dArg)) {
             route.data = { ...route.data, ...parseObjectLiteralValues(dArg) };
           }
         } else if (dName === "Resolve") {
           const rArg = mArgs[0];
-          if (rArg && ts3.isObjectLiteralExpression(rArg)) {
+          if (rArg && ts4.isObjectLiteralExpression(rArg)) {
             const resolvers = route.resolvers ?? {};
             for (const prop of rArg.properties) {
-              if (ts3.isPropertyAssignment(prop)) {
+              if (ts4.isPropertyAssignment(prop)) {
                 const rName = propertyName(prop.name);
                 const init = prop.initializer;
                 if (init)
@@ -5556,7 +5814,7 @@ function parseController(input, ctx) {
           });
         }
         const contract = getProp(optionsObject, "contract");
-        if (contract && ts3.isObjectLiteralExpression(contract)) {
+        if (contract && ts4.isObjectLiteralExpression(contract)) {
           route.contract = {};
           for (const field of ["body", "response", "evidence"]) {
             const value = stringLiteralProp(contract, field);
@@ -5574,15 +5832,15 @@ function parseController(input, ctx) {
         }
         for (const field of ["body", "params", "query", "headers", "cookie", "response"]) {
           const schemaExpr = getProp(optionsObject, field);
-          if (schemaExpr && ts3.isIdentifier(schemaExpr)) {
+          if (schemaExpr && ts4.isIdentifier(schemaExpr)) {
             route[field] = nodeText(schemaExpr);
             const importPath = importPathOf(schemaExpr, ctx);
             if (importPath)
               schemaImports[schemaExpr.text] = importPath;
             const declaration = resolveDeclaration(schemaExpr, ctx)[0];
             const typeName = ctx.checker.typeToString(ctx.checker.getTypeAtLocation(schemaExpr));
-            const initializer = declaration && ts3.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
-            const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts3.isCallExpression(initializer) && ts3.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
+            const initializer = declaration && ts4.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
+            const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts4.isCallExpression(initializer) && ts4.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
             (route.schemaKinds ??= {})[field] = opaque ? "opaque" : "declared";
           }
         }
@@ -5591,7 +5849,7 @@ function parseController(input, ctx) {
           const responses = {};
           const selectors = new Map;
           for (const property of responsesObject.properties) {
-            if (!ts3.isPropertyAssignment(property) || ts3.isComputedPropertyName(property.name))
+            if (!ts4.isPropertyAssignment(property) || ts4.isComputedPropertyName(property.name))
               continue;
             const status = propertyName(property.name);
             if (!isRouteResponseSelector(status)) {
@@ -5623,7 +5881,7 @@ function parseController(input, ctx) {
             }
             selectors.set(canonical, status);
             const schemaExpr = property.initializer;
-            if (!ts3.isIdentifier(schemaExpr)) {
+            if (!ts4.isIdentifier(schemaExpr)) {
               ctx.diagnostics.push({
                 severity: "error",
                 code: "invalid-route-response-map",
@@ -5638,8 +5896,8 @@ function parseController(input, ctx) {
               schemaImports[schemaExpr.text] = importPath;
             const declaration = resolveDeclaration(schemaExpr, ctx)[0];
             const typeName = ctx.checker.typeToString(ctx.checker.getTypeAtLocation(schemaExpr));
-            const initializer = declaration && ts3.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
-            const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts3.isCallExpression(initializer) && ts3.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
+            const initializer = declaration && ts4.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
+            const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts4.isCallExpression(initializer) && ts4.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
             const previousKind = route.schemaKinds?.response;
             (route.schemaKinds ??= {}).response = opaque || previousKind === "opaque" ? "opaque" : "declared";
           }
@@ -5647,18 +5905,18 @@ function parseController(input, ctx) {
             route.responses = responses;
         }
         const commandExpr = getProp(optionsObject, "command");
-        if (commandExpr && ts3.isIdentifier(commandExpr)) {
+        if (commandExpr && ts4.isIdentifier(commandExpr)) {
           const commandDecl = resolveDeclaration(commandExpr, ctx)[0];
-          route.command = commandDecl && ts3.isClassDeclaration(commandDecl) ? commandDecl.name?.text ?? commandExpr.text : commandExpr.text;
+          route.command = commandDecl && ts4.isClassDeclaration(commandDecl) ? commandDecl.name?.text ?? commandExpr.text : commandExpr.text;
         }
         const guardsExpr = getProp(optionsObject, "guards");
-        if (guardsExpr && ts3.isArrayLiteralExpression(guardsExpr)) {
+        if (guardsExpr && ts4.isArrayLiteralExpression(guardsExpr)) {
           for (const el of guardsExpr.elements) {
             routeGuards.push(tokenText(el, ctx));
           }
         }
         const canMatchExpr = getProp(optionsObject, "canMatch");
-        if (canMatchExpr && ts3.isArrayLiteralExpression(canMatchExpr)) {
+        if (canMatchExpr && ts4.isArrayLiteralExpression(canMatchExpr)) {
           const canMatchList = [];
           for (const el of canMatchExpr.elements) {
             canMatchList.push(tokenText(el, ctx));
@@ -5668,16 +5926,16 @@ function parseController(input, ctx) {
           }
         }
         const canDeactivateExpr = getProp(optionsObject, "canDeactivate");
-        if (canDeactivateExpr && ts3.isArrayLiteralExpression(canDeactivateExpr)) {
+        if (canDeactivateExpr && ts4.isArrayLiteralExpression(canDeactivateExpr)) {
           for (const el of canDeactivateExpr.elements) {
             routeCanDeactivate.push(tokenText(el, ctx));
           }
         }
         const resolversExpr = getProp(optionsObject, "resolvers");
-        if (resolversExpr && ts3.isObjectLiteralExpression(resolversExpr)) {
+        if (resolversExpr && ts4.isObjectLiteralExpression(resolversExpr)) {
           const resolvers = {};
           for (const prop of resolversExpr.properties) {
-            if (ts3.isPropertyAssignment(prop)) {
+            if (ts4.isPropertyAssignment(prop)) {
               const rName = propertyName(prop.name);
               const init = prop.initializer;
               if (init)
@@ -5689,22 +5947,22 @@ function parseController(input, ctx) {
           }
         }
         const redirectToExpr = getProp(optionsObject, "redirectTo");
-        if (redirectToExpr && ts3.isStringLiteral(redirectToExpr)) {
+        if (redirectToExpr && ts4.isStringLiteral(redirectToExpr)) {
           route.redirectTo = redirectToExpr.text;
         }
         const pathMatchExpr = getProp(optionsObject, "pathMatch");
-        if (pathMatchExpr && ts3.isStringLiteral(pathMatchExpr)) {
+        if (pathMatchExpr && ts4.isStringLiteral(pathMatchExpr)) {
           const val = pathMatchExpr.text;
           if (val === "full" || val === "prefix") {
             route.pathMatch = val;
           }
         }
         const titleExpr = getProp(optionsObject, "title");
-        if (titleExpr && ts3.isStringLiteral(titleExpr)) {
+        if (titleExpr && ts4.isStringLiteral(titleExpr)) {
           route.title = titleExpr.text;
         }
         const dataExpr = getProp(optionsObject, "data");
-        if (dataExpr && ts3.isObjectLiteralExpression(dataExpr)) {
+        if (dataExpr && ts4.isObjectLiteralExpression(dataExpr)) {
           route.data = { ...route.data, ...parseObjectLiteralValues(dataExpr) };
         }
         const aspects = parseAspectRefs(getProp(optionsObject, "aspects"), ctx, `route ${httpMethod} ${routePath}`);
@@ -5759,7 +6017,7 @@ function parseJobOptions(meta, owner, ctx) {
     const expression = getProp(meta, field);
     if (!expression)
       continue;
-    if (!ts3.isIdentifier(expression)) {
+    if (!ts4.isIdentifier(expression)) {
       jobOptionError(ctx, "invalid-job-schema", `${owner} 的 ${field} schema 必须是可静态解析的标识符引用，不能使用内联调用或动态表达式`, expression, "SC4019", `将 schema 提取为命名导出，例如 ${field}: ${field === "input" ? "JobInput" : "JobOutput"}。`);
       continue;
     }
@@ -5783,7 +6041,7 @@ function parseJobEnum(meta, field, allowed, owner, ctx, code, errorCode) {
   const expression = getProp(meta, field);
   if (!expression)
     return;
-  if (!ts3.isStringLiteral(expression) || !allowed.includes(expression.text)) {
+  if (!ts4.isStringLiteral(expression) || !allowed.includes(expression.text)) {
     jobOptionError(ctx, code, `${owner} 的 ${field} 必须是 ${allowed.map((value) => JSON.stringify(value)).join(" 或 ")} 字符串字面量`, expression, errorCode);
     return;
   }
@@ -5793,7 +6051,7 @@ function parseJobInteger(meta, field, min, max, owner, ctx, code, errorCode) {
   const expression = getProp(meta, field);
   if (!expression)
     return;
-  const value = ts3.isNumericLiteral(expression) ? Number(expression.text) : Number.NaN;
+  const value = ts4.isNumericLiteral(expression) ? Number(expression.text) : Number.NaN;
   if (!Number.isSafeInteger(value) || value < min || value > max) {
     jobOptionError(ctx, code, `${owner} 的 ${field} 必须是 ${min} 到 ${max} 之间的安全整数`, expression, errorCode);
     return;
@@ -5814,8 +6072,8 @@ function jobOptionError(ctx, code, message, node, errorCode, suggestion) {
 }
 function jobSchemaKind(identifier, declaration, ctx) {
   const typeName = ctx.checker.typeToString(ctx.checker.getTypeAtLocation(identifier));
-  const initializer = ts3.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
-  const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts3.isCallExpression(initializer) && ts3.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
+  const initializer = ts4.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
+  const opaque = /\bT(?:Unknown|Any)\b/.test(typeName) || initializer && ts4.isCallExpression(initializer) && ts4.isPropertyAccessExpression(initializer.expression) && ["Unknown", "Any"].includes(initializer.expression.name.text);
   return opaque ? "opaque" : "declared";
 }
 function checkedRpc(meta, ctx) {
@@ -5837,7 +6095,7 @@ function checkedRpc(meta, ctx) {
 }
 function classDeps(cls, ctx) {
   const injectable = parseInjectableOptions(cls, ctx);
-  const ctor = cls.members.find(ts3.isConstructorDeclaration);
+  const ctor = cls.members.find(ts4.isConstructorDeclaration);
   const deps = injectable?.deps ? [...injectable.deps] : [];
   const optionalDeps = [];
   const selfDeps = [];
@@ -5871,23 +6129,23 @@ function classDeps(cls, ctx) {
       }
     });
   }
-  for (const prop of cls.members.filter(ts3.isPropertyDeclaration)) {
+  for (const prop of cls.members.filter(ts4.isPropertyDeclaration)) {
     const init = prop.initializer;
-    if (init && ts3.isCallExpression(init)) {
+    if (init && ts4.isCallExpression(init)) {
       const callName = nodeText(init.expression).split(".").pop();
       if (callName === "inject") {
         const [tokenArg, optionsArg] = init.arguments;
         if (tokenArg) {
           const tokenName = tokenText(tokenArg, ctx);
           const unwrappedToken = unwrapForwardRef(tokenArg);
-          const known = ts3.isStringLiteral(unwrappedToken) || ts3.isIdentifier(unwrappedToken) && (ctx.tokensByName.has(tokenName) || ctx.classesByName.has(tokenName));
+          const known = ts4.isStringLiteral(unwrappedToken) || ts4.isIdentifier(unwrappedToken) && (ctx.tokensByName.has(tokenName) || ctx.classesByName.has(tokenName));
           if (!known) {
             missing = true;
             continue;
           }
           if (!deps.includes(tokenName))
             deps.push(tokenName);
-          const options = optionsArg && ts3.isObjectLiteralExpression(optionsArg) ? {
+          const options = optionsArg && ts4.isObjectLiteralExpression(optionsArg) ? {
             optional: booleanProp(optionsArg, "optional") ?? false,
             self: booleanProp(optionsArg, "self") ?? false,
             skipSelf: booleanProp(optionsArg, "skipSelf") ?? false,
@@ -5902,9 +6160,9 @@ function classDeps(cls, ctx) {
           if (options.host && !hostDeps.includes(tokenName))
             hostDeps.push(tokenName);
           if (!functionalInjects.some((entry) => entry.token === tokenName)) {
-            const declaration = ts3.isIdentifier(unwrappedToken) ? resolveDeclaration(unwrappedToken, ctx)[0] : undefined;
+            const declaration = ts4.isIdentifier(unwrappedToken) ? resolveDeclaration(unwrappedToken, ctx)[0] : undefined;
             const localFile = declaration && isProjectSourcePath(declaration.getSourceFile().fileName, ctx.rootDir) ? declaration.getSourceFile().fileName : undefined;
-            const importModule = declaration && !localFile && ts3.isIdentifier(unwrappedToken) ? importModuleOf(unwrappedToken, ctx) : undefined;
+            const importModule = declaration && !localFile && ts4.isIdentifier(unwrappedToken) ? importModuleOf(unwrappedToken, ctx) : undefined;
             functionalInjects.push({
               token: tokenName,
               expression: nodeText(unwrappedToken),
@@ -5948,7 +6206,7 @@ function parseInjectableOptions(cls, ctx) {
 }
 function parseInjectParams(cls, ctx) {
   const result = new Map;
-  const ctor = cls.members.find(ts3.isConstructorDeclaration);
+  const ctor = cls.members.find(ts4.isConstructorDeclaration);
   if (!ctor)
     return result;
   ctor.parameters.forEach((param, index) => {
@@ -5964,7 +6222,7 @@ function parseInjectParams(cls, ctx) {
 }
 function parseOptionalParams(cls) {
   const result = new Set;
-  const ctor = cls.members.find(ts3.isConstructorDeclaration);
+  const ctor = cls.members.find(ts4.isConstructorDeclaration);
   if (!ctor)
     return result;
   ctor.parameters.forEach((param, index) => {
@@ -5979,7 +6237,7 @@ function parseOptionalParams(cls) {
 }
 function parseModifierParams(cls, modifierName) {
   const result = new Set;
-  const ctor = cls.members.find(ts3.isConstructorDeclaration);
+  const ctor = cls.members.find(ts4.isConstructorDeclaration);
   if (!ctor)
     return result;
   ctor.parameters.forEach((param, index) => {
@@ -5991,13 +6249,13 @@ function parseModifierParams(cls, modifierName) {
   return result;
 }
 function unwrapForwardRef(expr) {
-  if (ts3.isCallExpression(expr)) {
+  if (ts4.isCallExpression(expr)) {
     const exprText = nodeText(expr.expression);
     if (exprText === "forwardRef" || exprText.endsWith(".forwardRef")) {
       const arg = expr.arguments[0];
-      if (arg && (ts3.isArrowFunction(arg) || ts3.isFunctionExpression(arg))) {
+      if (arg && (ts4.isArrowFunction(arg) || ts4.isFunctionExpression(arg))) {
         const body = arg.body;
-        if (body && ts3.isExpression(body)) {
+        if (body && ts4.isExpression(body)) {
           return unwrapForwardRef(body);
         }
       }
@@ -6007,13 +6265,13 @@ function unwrapForwardRef(expr) {
 }
 function tokenText(expr, ctx) {
   const unwrapped = unwrapForwardRef(expr);
-  if (ts3.isStringLiteral(unwrapped))
+  if (ts4.isStringLiteral(unwrapped))
     return unwrapped.text;
-  if (ts3.isIdentifier(unwrapped)) {
+  if (ts4.isIdentifier(unwrapped)) {
     const decl = resolveDeclaration(unwrapped, ctx)[0];
-    if (decl && ts3.isClassDeclaration(decl))
+    if (decl && ts4.isClassDeclaration(decl))
       return decl.name?.text ?? unwrapped.text;
-    if (decl && ts3.isVariableDeclaration(decl))
+    if (decl && ts4.isVariableDeclaration(decl))
       return variableName(decl);
   }
   return nodeText(unwrapped);
@@ -6033,12 +6291,12 @@ function resolveScope(input, ctx) {
 }
 function tokenNameOf(expr, ctx) {
   const unwrapped = unwrapForwardRef(expr);
-  if (ts3.isIdentifier(unwrapped)) {
+  if (ts4.isIdentifier(unwrapped)) {
     const decl = resolveDeclaration(unwrapped, ctx)[0];
-    if (decl && ts3.isClassDeclaration(decl)) {
+    if (decl && ts4.isClassDeclaration(decl)) {
       return { name: decl.name?.text ?? nodeText(expr), kind: "class" };
     }
-    if (decl && ts3.isVariableDeclaration(decl)) {
+    if (decl && ts4.isVariableDeclaration(decl)) {
       const name = variableName(decl);
       return { name, kind: ctx.tokensByName.has(name) ? "injection-token" : "class" };
     }
@@ -6054,10 +6312,10 @@ function resolveDeclaration(id, ctx) {
     return [];
   let declarations = symbol.declarations ?? [];
   for (let guard = 0;guard < 4; guard += 1) {
-    const isAlias = declarations.some((d) => ts3.isImportSpecifier(d) || ts3.isImportClause(d) || ts3.isNamespaceImport(d));
+    const isAlias = declarations.some((d) => ts4.isImportSpecifier(d) || ts4.isImportClause(d) || ts4.isNamespaceImport(d));
     if (!isAlias)
       break;
-    if (!(symbol.flags & ts3.SymbolFlags.Alias))
+    if (!(symbol.flags & ts4.SymbolFlags.Alias))
       break;
     const aliased = ctx.checker.getAliasedSymbol(symbol);
     symbol = aliased;
@@ -6077,9 +6335,9 @@ function importModuleOf(id, ctx) {
   for (const declaration of declarations) {
     let current = declaration;
     while (current) {
-      if (ts3.isImportDeclaration(current)) {
+      if (ts4.isImportDeclaration(current)) {
         const moduleSpecifier = current.moduleSpecifier;
-        return ts3.isStringLiteral(moduleSpecifier) ? moduleSpecifier.text : undefined;
+        return ts4.isStringLiteral(moduleSpecifier) ? moduleSpecifier.text : undefined;
       }
       current = current.parent;
     }
@@ -6091,27 +6349,27 @@ function findDecorator(cls, name) {
 }
 function decoratorName2(dec) {
   const expr = dec.expression;
-  if (ts3.isCallExpression(expr)) {
+  if (ts4.isCallExpression(expr)) {
     return nodeText(expr.expression).split(".").pop();
   }
-  if (ts3.isIdentifier(expr))
+  if (ts4.isIdentifier(expr))
     return expr.text;
   return;
 }
 function decoratorObjectArg(dec) {
   const expr = dec.expression;
-  if (!ts3.isCallExpression(expr))
+  if (!ts4.isCallExpression(expr))
     return;
   const arg = expr.arguments[0];
-  return arg && ts3.isObjectLiteralExpression(arg) ? arg : undefined;
+  return arg && ts4.isObjectLiteralExpression(arg) ? arg : undefined;
 }
 function getProp(obj, name) {
-  const prop = obj.properties.find((item) => (ts3.isPropertyAssignment(item) || ts3.isShorthandPropertyAssignment(item)) && propertyName(item.name) === name);
+  const prop = obj.properties.find((item) => (ts4.isPropertyAssignment(item) || ts4.isShorthandPropertyAssignment(item)) && propertyName(item.name) === name);
   if (!prop)
     return;
-  if (ts3.isPropertyAssignment(prop))
+  if (ts4.isPropertyAssignment(prop))
     return prop.initializer;
-  if (ts3.isShorthandPropertyAssignment(prop))
+  if (ts4.isShorthandPropertyAssignment(prop))
     return prop.name;
   return;
 }
@@ -6119,10 +6377,10 @@ function toCompilerDiagnostic(diagnostic, rootDir) {
   const file = diagnostic.file;
   const position = file && diagnostic.start !== undefined ? file.getLineAndCharacterOfPosition(diagnostic.start) : undefined;
   return {
-    severity: diagnostic.category === ts3.DiagnosticCategory.Error ? "error" : "warn",
+    severity: diagnostic.category === ts4.DiagnosticCategory.Error ? "error" : "warn",
     code: `typescript-${diagnostic.code}`,
     errorCode: `TS${diagnostic.code}`,
-    message: ts3.flattenDiagnosticMessageText(diagnostic.messageText, `
+    message: ts4.flattenDiagnosticMessageText(diagnostic.messageText, `
 `),
     ...file ? { file: sourcePath(rootDir, file.fileName) } : {},
     ...position ? { line: position.line + 1 } : {}
@@ -6130,16 +6388,16 @@ function toCompilerDiagnostic(diagnostic, rootDir) {
 }
 function stringLiteralProp(obj, name) {
   const expr = getProp(obj, name);
-  return expr && ts3.isStringLiteral(expr) ? expr.text : undefined;
+  return expr && ts4.isStringLiteral(expr) ? expr.text : undefined;
 }
 function arrayProp(obj, name) {
   const expr = getProp(obj, name);
-  return expr && ts3.isArrayLiteralExpression(expr) ? [...expr.elements] : [];
+  return expr && ts4.isArrayLiteralExpression(expr) ? [...expr.elements] : [];
 }
 function parseAspectRefs(expression, ctx, owner) {
   if (!expression)
     return [];
-  if (!ts3.isArrayLiteralExpression(expression)) {
+  if (!ts4.isArrayLiteralExpression(expression)) {
     ctx.diagnostics.push({
       severity: "error",
       code: "dynamic-aspect-reference",
@@ -6154,7 +6412,7 @@ function parseAspectRefs(expression, ctx, owner) {
   }
   const refs = [];
   for (const element of expression.elements) {
-    if (ts3.isSpreadElement(element) || !ts3.isIdentifier(element)) {
+    if (ts4.isSpreadElement(element) || !ts4.isIdentifier(element)) {
       ctx.diagnostics.push({
         severity: "error",
         code: "dynamic-aspect-reference",
@@ -6167,7 +6425,7 @@ function parseAspectRefs(expression, ctx, owner) {
       });
       continue;
     }
-    const declaration = resolveDeclaration(element, ctx).find((candidate) => ts3.isFunctionDeclaration(candidate) || ts3.isVariableDeclaration(candidate) && candidate.initializer !== undefined && (ts3.isArrowFunction(candidate.initializer) || ts3.isFunctionExpression(candidate.initializer)));
+    const declaration = resolveDeclaration(element, ctx).find((candidate) => ts4.isFunctionDeclaration(candidate) || ts4.isVariableDeclaration(candidate) && candidate.initializer !== undefined && (ts4.isArrowFunction(candidate.initializer) || ts4.isFunctionExpression(candidate.initializer)));
     if (!declaration) {
       ctx.diagnostics.push({
         severity: "error",
@@ -6181,7 +6439,7 @@ function parseAspectRefs(expression, ctx, owner) {
       });
       continue;
     }
-    const name = ts3.isFunctionDeclaration(declaration) ? declaration.name?.text : ts3.isVariableDeclaration(declaration) ? variableName(declaration) : undefined;
+    const name = ts4.isFunctionDeclaration(declaration) ? declaration.name?.text : ts4.isVariableDeclaration(declaration) ? variableName(declaration) : undefined;
     if (!name)
       continue;
     const declaredFile = declaration.getSourceFile().fileName;
@@ -6201,9 +6459,9 @@ function booleanProp(obj, name) {
   const expr = getProp(obj, name);
   if (!expr)
     return;
-  if (expr.kind === ts3.SyntaxKind.TrueKeyword)
+  if (expr.kind === ts4.SyntaxKind.TrueKeyword)
     return true;
-  if (expr.kind === ts3.SyntaxKind.FalseKeyword)
+  if (expr.kind === ts4.SyntaxKind.FalseKeyword)
     return false;
   return;
 }
@@ -6217,15 +6475,15 @@ function parseBindingOptions(args, defaultName) {
   let defaultValue;
   const first = args[0];
   const second = args[1];
-  if (first && ts3.isStringLiteral(first)) {
+  if (first && ts4.isStringLiteral(first)) {
     name = first.text;
-  } else if (first && ts3.isObjectLiteralExpression(first)) {
+  } else if (first && ts4.isObjectLiteralExpression(first)) {
     const nameProp = getProp(first, "name");
-    if (nameProp && ts3.isStringLiteral(nameProp)) {
+    if (nameProp && ts4.isStringLiteral(nameProp)) {
       name = nameProp.text;
     }
     const trProp = getProp(first, "transform");
-    if (trProp && ts3.isStringLiteral(trProp)) {
+    if (trProp && ts4.isStringLiteral(trProp)) {
       const val = trProp.text;
       if (val === "number" || val === "boolean" || val === "string") {
         transform = val;
@@ -6236,9 +6494,9 @@ function parseBindingOptions(args, defaultName) {
       defaultValue = parseLiteralValue(defProp);
     }
   }
-  if (second && ts3.isObjectLiteralExpression(second)) {
+  if (second && ts4.isObjectLiteralExpression(second)) {
     const trProp = getProp(second, "transform");
-    if (trProp && ts3.isStringLiteral(trProp)) {
+    if (trProp && ts4.isStringLiteral(trProp)) {
       const val = trProp.text;
       if (val === "number" || val === "boolean" || val === "string") {
         transform = val;
@@ -6252,18 +6510,18 @@ function parseBindingOptions(args, defaultName) {
   return { name, ...transform ? { transform } : {}, default: defaultValue };
 }
 function parseLiteralValue(node) {
-  if (ts3.isStringLiteral(node))
+  if (ts4.isStringLiteral(node))
     return node.text;
-  if (ts3.isNumericLiteral(node))
+  if (ts4.isNumericLiteral(node))
     return Number(node.text);
-  if (node.kind === ts3.SyntaxKind.TrueKeyword)
+  if (node.kind === ts4.SyntaxKind.TrueKeyword)
     return true;
-  if (node.kind === ts3.SyntaxKind.FalseKeyword)
+  if (node.kind === ts4.SyntaxKind.FalseKeyword)
     return false;
-  if (ts3.isArrayLiteralExpression(node)) {
+  if (ts4.isArrayLiteralExpression(node)) {
     return node.elements.map(parseLiteralValue);
   }
-  if (ts3.isObjectLiteralExpression(node)) {
+  if (ts4.isObjectLiteralExpression(node)) {
     return parseObjectLiteralValues(node);
   }
   return;
@@ -6271,7 +6529,7 @@ function parseLiteralValue(node) {
 function parseObjectLiteralValues(obj) {
   const result = {};
   for (const prop of obj.properties) {
-    if (ts3.isPropertyAssignment(prop)) {
+    if (ts4.isPropertyAssignment(prop)) {
       const name = propertyName(prop.name);
       const init = prop.initializer;
       if (init) {
@@ -6307,7 +6565,50 @@ import { join as join4 } from "node:path";
 // src/type-safety.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join3, relative as relative3, resolve as resolve2, sep as sep3 } from "node:path";
-import * as ts4 from "@typescript/typescript6";
+import * as ts6 from "@typescript/typescript6";
+
+// src/sql-safety.ts
+import * as ts5 from "@typescript/typescript6";
+var SQL_SAFETY_DIAGNOSTIC_CODES = {
+  "sql-result-assertion": { errorCode: "SC6007", docsUrl: "https://supacloud.dev/errors/SC6007" },
+  "sql-raw-dynamic": { errorCode: "SC6008", docsUrl: "https://supacloud.dev/errors/SC6008" }
+};
+function scanDrizzleSql(sourceFile, checker, file, strict) {
+  const diagnostics = [];
+  const importedSql = (expression) => {
+    const symbol = checker.getSymbolAtLocation(ts5.isPropertyAccessExpression(expression) ? expression.name : expression);
+    if (!symbol)
+      return false;
+    const target = symbol.flags & ts5.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
+    return target.name === "sql" && (target.declarations ?? []).some((declaration) => /(?:^|\/)node_modules\/drizzle-orm\//.test(declaration.getSourceFile().fileName.replaceAll("\\", "/")));
+  };
+  const report = (code, node, message) => {
+    diagnostics.push({
+      severity: strict ? "error" : "warn",
+      code,
+      ...SQL_SAFETY_DIAGNOSTIC_CODES[code],
+      message,
+      file,
+      line: sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1
+    });
+  };
+  const visit = (node) => {
+    if (ts5.isTaggedTemplateExpression(node) && importedSql(node.tag) && node.typeArguments?.some((type) => type.kind !== ts5.SyntaxKind.UnknownKeyword)) {
+      report("sql-result-assertion", node, "Drizzle sql<T> asserts a result type without checking SQL or decoding rows. Use sql<unknown> and a schema decoder at the result boundary.");
+    }
+    if (ts5.isCallExpression(node) && ts5.isPropertyAccessExpression(node.expression) && node.expression.name.text === "raw" && importedSql(node.expression.expression)) {
+      const argument = node.arguments[0];
+      if (!argument || !ts5.isStringLiteral(argument) && !ts5.isNoSubstitutionTemplateLiteral(argument)) {
+        report("sql-raw-dynamic", node, "Dynamic sql.raw bypasses parameter binding. Interpolate values with sql templates; keep reviewed static DDL in migrations.");
+      }
+    }
+    ts5.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return diagnostics;
+}
+
+// src/type-safety.ts
 var DEFAULT_EXCLUDES = [
   "**/*.test.ts",
   "**/*.spec.ts",
@@ -6320,6 +6621,7 @@ var DEFAULT_EXCLUDES = [
   "**/*.d.ts"
 ];
 var TYPE_SAFETY_DIAGNOSTIC_CODES = {
+  ...SQL_SAFETY_DIAGNOSTIC_CODES,
   "generated-any": { errorCode: "SC6001", docsUrl: "https://supacloud.dev/errors/SC6001" },
   "source-any": { errorCode: "SC6002", docsUrl: "https://supacloud.dev/errors/SC6002" },
   "source-type-assertion": { errorCode: "SC6003", docsUrl: "https://supacloud.dev/errors/SC6003" },
@@ -6332,7 +6634,7 @@ function scanGeneratedArtifacts(artifacts, strict = true) {
   for (const [file, content] of Object.entries(artifacts)) {
     if (content === undefined)
       continue;
-    const sourceFile = ts4.createSourceFile(file, content, ts4.ScriptTarget.Latest, true, ts4.ScriptKind.TS);
+    const sourceFile = ts6.createSourceFile(file, content, ts6.ScriptTarget.Latest, true, ts6.ScriptKind.TS);
     for (const node of descendantsOfKind2(sourceFile, isAnyKeyword)) {
       diagnostics.push(makeDiagnostic("generated-any", `生成产物 ${file} 包含 any；严格生成模式要求使用 unknown、具体接口或泛型约束。`, sourceFile, node, strict));
     }
@@ -6341,30 +6643,30 @@ function scanGeneratedArtifacts(artifacts, strict = true) {
 }
 function scanProductionSource(options) {
   const rootDir = resolve2(options.rootDir);
-  const configPath = ts4.findConfigFile(rootDir, ts4.sys.fileExists) ?? join3(rootDir, "tsconfig.json");
+  const configPath = ts6.findConfigFile(rootDir, ts6.sys.fileExists) ?? join3(rootDir, "tsconfig.json");
   const projectConfig = existsSync2(configPath) ? readProjectConfig2(configPath) : {
     options: {
       strict: true,
       skipLibCheck: true,
-      target: ts4.ScriptTarget.ES2022,
-      module: ts4.ModuleKind.ESNext,
-      moduleResolution: ts4.ModuleResolutionKind.Bundler
+      target: ts6.ScriptTarget.ES2022,
+      module: ts6.ModuleKind.ESNext,
+      moduleResolution: ts6.ModuleResolutionKind.Bundler
     },
     errors: []
   };
   const include = options.include ?? ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"];
-  const rootNames = ts4.sys.readDirectory(rootDir, [".ts", ".tsx", ".mts", ".cts"], ["node_modules", "dist"], include).filter((file) => isProductionSourcePath(rootDir, file, [...DEFAULT_EXCLUDES, ...options.exclude ?? []]));
+  const rootNames = ts6.sys.readDirectory(rootDir, [".ts", ".tsx", ".mts", ".cts"], ["node_modules", "dist"], include).filter((file) => isProductionSourcePath(rootDir, file, [...DEFAULT_EXCLUDES, ...options.exclude ?? []]));
   const compilerOptions = { ...projectConfig.options, noEmit: true };
-  const host = ts4.createCompilerHost(compilerOptions);
+  const host = ts6.createCompilerHost(compilerOptions);
   host.getCurrentDirectory = () => dirname3(configPath);
-  const program = ts4.createProgram(rootNames, compilerOptions, host);
+  const program = ts6.createProgram(rootNames, compilerOptions, host);
   const outDir = options.outDir ? normalizeRelative(rootDir, options.outDir) : undefined;
   const excludes = [...DEFAULT_EXCLUDES, ...options.exclude ?? []];
   const sourceFiles = program.getSourceFiles().filter((sourceFile) => isProductionSource(rootDir, sourceFile, excludes, outDir));
   const diagnostics = [...projectConfig.errors, ...program.getOptionsDiagnostics()].map((diagnostic) => ({
     severity: "error",
     code: "source-config",
-    message: ts4.flattenDiagnosticMessageText(diagnostic.messageText, `
+    message: ts6.flattenDiagnosticMessageText(diagnostic.messageText, `
 `),
     file: diagnostic.file ? normalizeRelative(rootDir, diagnostic.file.fileName) : normalizeRelative(rootDir, configPath),
     ...diagnostic.file && diagnostic.start !== undefined ? { line: diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start).line + 1 } : {},
@@ -6381,7 +6683,7 @@ function scanProductionSource(options) {
     diagnostics.push({
       severity: "error",
       code: "source-typescript",
-      message: ts4.flattenDiagnosticMessageText(diagnostic.messageText, `
+      message: ts6.flattenDiagnosticMessageText(diagnostic.messageText, `
 `),
       ...diagnostic.file ? { file: normalizeRelative(rootDir, diagnostic.file.fileName) } : {},
       ...diagnostic.file && diagnostic.start !== undefined ? { line: diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start).line + 1 } : {},
@@ -6390,9 +6692,10 @@ function scanProductionSource(options) {
   }
   for (const sourceFile of sourceFiles) {
     scanSourceFile(sourceFile, checker, rootDir, diagnostics, options.strict ?? false);
-    const scanner = ts4.createScanner(ts4.ScriptTarget.Latest, false, sourceFile.languageVariant, sourceFile.text);
-    for (let kind = scanner.scan();kind !== ts4.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
-      if ((kind === ts4.SyntaxKind.SingleLineCommentTrivia || kind === ts4.SyntaxKind.MultiLineCommentTrivia) && /@ts-(?:ignore|nocheck|expect-error)\b/.test(scanner.getTokenText())) {
+    diagnostics.push(...scanDrizzleSql(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), options.strict ?? false));
+    const scanner = ts6.createScanner(ts6.ScriptTarget.Latest, false, sourceFile.languageVariant, sourceFile.text);
+    for (let kind = scanner.scan();kind !== ts6.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
+      if ((kind === ts6.SyntaxKind.SingleLineCommentTrivia || kind === ts6.SyntaxKind.MultiLineCommentTrivia) && /@ts-(?:ignore|nocheck|expect-error)\b/.test(scanner.getTokenText())) {
         diagnostics.push({
           severity: "error",
           code: "source-type-suppression",
@@ -6412,22 +6715,22 @@ function scanSourceFile(sourceFile, checker, rootDir, diagnostics, strict) {
     diagnostics.push(makeDiagnostic("source-any", "生产源码使用了显式 any；请改用 unknown、具体接口或泛型约束。", sourceFile, node, strict, rootDir));
   }
   for (const node of descendants(sourceFile)) {
-    if (ts4.isAsExpression(node)) {
-      if (ts4.isAsExpression(node.parent) || ts4.isTypeAssertionExpression(node.parent))
+    if (ts6.isAsExpression(node)) {
+      if (ts6.isAsExpression(node.parent) || ts6.isTypeAssertionExpression(node.parent))
         continue;
       const assertedType = node.type.getText(sourceFile);
       if (assertedType === "const")
         continue;
       diagnostics.push(makeDiagnostic("source-type-assertion", `生产源码包含类型断言 ${node.getText(sourceFile)}；请优先使用类型守卫、satisfies 或显式边界解析。`, sourceFile, node, strict, rootDir));
-    } else if (ts4.isTypeAssertionExpression(node)) {
-      if (ts4.isAsExpression(node.parent) || ts4.isTypeAssertionExpression(node.parent))
+    } else if (ts6.isTypeAssertionExpression(node)) {
+      if (ts6.isAsExpression(node.parent) || ts6.isTypeAssertionExpression(node.parent))
         continue;
       diagnostics.push(makeDiagnostic("source-type-assertion", `生产源码包含类型断言 ${node.getText(sourceFile)}；请优先使用类型守卫、satisfies 或显式边界解析。`, sourceFile, node, strict, rootDir));
-    } else if (ts4.isNonNullExpression(node)) {
+    } else if (ts6.isNonNullExpression(node)) {
       diagnostics.push(makeDiagnostic("source-non-null-assertion", `生产源码包含非空断言 ${node.getText(sourceFile)}；请显式处理 null/undefined。`, sourceFile, node, strict, rootDir));
     }
   }
-  for (const declaration of descendantsOfKind2(sourceFile, ts4.isVariableDeclaration)) {
+  for (const declaration of descendantsOfKind2(sourceFile, ts6.isVariableDeclaration)) {
     const initializer = declaration.initializer;
     if (!initializer || declaration.type)
       continue;
@@ -6443,11 +6746,11 @@ function scanSourceFile(sourceFile, checker, rootDir, diagnostics, strict) {
     if (isLetDeclaration(declaration) && isLiteralSyntax(initializer) && !isLiteralType(declarationType)) {
       diagnostics.push(makeDiagnostic("source-implicit-widening", `变量 ${declaration.name.getText(sourceFile)} 的字面量类型从 ${checker.typeToString(initializerType, initializer)} 隐式宽化为 ${checker.typeToString(declarationType, declaration)}；请补充类型或使用 const。`, sourceFile, declaration, strict, rootDir));
     }
-    if (ts4.isObjectLiteralExpression(initializer) && isConstDeclaration(declaration) && initializer.getText(sourceFile).length > 0 && initializer.properties.some((property) => ts4.isPropertyAssignment(property) && property.initializer !== undefined && !ts4.isAsExpression(property.initializer) && isLiteralExpression(property.initializer))) {
+    if (ts6.isObjectLiteralExpression(initializer) && isConstDeclaration(declaration) && initializer.getText(sourceFile).length > 0 && initializer.properties.some((property) => ts6.isPropertyAssignment(property) && property.initializer !== undefined && !ts6.isAsExpression(property.initializer) && isLiteralExpression(property.initializer))) {
       diagnostics.push(makeDiagnostic("source-implicit-widening", `常量对象 ${declaration.name.getText(sourceFile)} 的字面量属性会隐式宽化；请补充对象类型或使用 as const。`, sourceFile, declaration, strict, rootDir));
     }
   }
-  for (const parameter of descendantsOfKind2(sourceFile, ts4.isParameter)) {
+  for (const parameter of descendantsOfKind2(sourceFile, ts6.isParameter)) {
     if (parameter.type)
       continue;
     for (const name of bindingNames(parameter.name)) {
@@ -6458,10 +6761,10 @@ function scanSourceFile(sourceFile, checker, rootDir, diagnostics, strict) {
   }
 }
 function readProjectConfig2(configPath) {
-  const config = ts4.readConfigFile(configPath, (file) => readFileSync2(file, "utf8"));
+  const config = ts6.readConfigFile(configPath, (file) => readFileSync2(file, "utf8"));
   if (config.error)
     return { options: {}, errors: [config.error] };
-  const parsed = ts4.parseJsonConfigFileContent(config.config, ts4.sys, dirname3(configPath));
+  const parsed = ts6.parseJsonConfigFileContent(config.config, ts6.sys, dirname3(configPath));
   return { options: parsed.options, errors: parsed.errors };
 }
 function isProductionSource(rootDir, sourceFile, excludes, outDir) {
@@ -6481,42 +6784,42 @@ function globMatches(value, pattern) {
   return new RegExp(`^${escaped}$`).test(value);
 }
 function bindingNames(name) {
-  if (ts4.isIdentifier(name))
+  if (ts6.isIdentifier(name))
     return [name];
-  return name.elements.flatMap((element) => ts4.isBindingElement(element) ? bindingNames(element.name) : []);
+  return name.elements.flatMap((element) => ts6.isBindingElement(element) ? bindingNames(element.name) : []);
 }
 function isLiteralExpression(node) {
   if (!node)
     return false;
   return [
-    ts4.SyntaxKind.StringLiteral,
-    ts4.SyntaxKind.NumericLiteral,
-    ts4.SyntaxKind.TrueKeyword,
-    ts4.SyntaxKind.FalseKeyword
+    ts6.SyntaxKind.StringLiteral,
+    ts6.SyntaxKind.NumericLiteral,
+    ts6.SyntaxKind.TrueKeyword,
+    ts6.SyntaxKind.FalseKeyword
   ].includes(node.kind);
 }
 function isLiteralSyntax(node) {
-  return ts4.isStringLiteral(node) || ts4.isNumericLiteral(node) || node.kind === ts4.SyntaxKind.TrueKeyword || node.kind === ts4.SyntaxKind.FalseKeyword;
+  return ts6.isStringLiteral(node) || ts6.isNumericLiteral(node) || node.kind === ts6.SyntaxKind.TrueKeyword || node.kind === ts6.SyntaxKind.FalseKeyword;
 }
 function isLiteralType(type) {
-  return (type.flags & (ts4.TypeFlags.StringLiteral | ts4.TypeFlags.NumberLiteral | ts4.TypeFlags.BooleanLiteral | ts4.TypeFlags.BigIntLiteral)) !== 0;
+  return (type.flags & (ts6.TypeFlags.StringLiteral | ts6.TypeFlags.NumberLiteral | ts6.TypeFlags.BooleanLiteral | ts6.TypeFlags.BigIntLiteral)) !== 0;
 }
 function isAnyType(type) {
-  return (type.flags & ts4.TypeFlags.Any) !== 0;
+  return (type.flags & ts6.TypeFlags.Any) !== 0;
 }
 function isLetDeclaration(declaration) {
-  return ts4.isVariableDeclarationList(declaration.parent) && (declaration.parent.flags & ts4.NodeFlags.Let) !== 0;
+  return ts6.isVariableDeclarationList(declaration.parent) && (declaration.parent.flags & ts6.NodeFlags.Let) !== 0;
 }
 function isConstDeclaration(declaration) {
-  return ts4.isVariableDeclarationList(declaration.parent) && (declaration.parent.flags & ts4.NodeFlags.Const) !== 0;
+  return ts6.isVariableDeclarationList(declaration.parent) && (declaration.parent.flags & ts6.NodeFlags.Const) !== 0;
 }
 function descendants(root) {
   const result = [];
   const visit = (node) => {
     result.push(node);
-    ts4.forEachChild(node, visit);
+    ts6.forEachChild(node, visit);
   };
-  ts4.forEachChild(root, visit);
+  ts6.forEachChild(root, visit);
   return result;
 }
 function descendantsOfKind2(root, predicate) {
@@ -6524,9 +6827,9 @@ function descendantsOfKind2(root, predicate) {
   const visit = (node) => {
     if (predicate(node))
       result.push(node);
-    ts4.forEachChild(node, visit);
+    ts6.forEachChild(node, visit);
   };
-  ts4.forEachChild(root, visit);
+  ts6.forEachChild(root, visit);
   return result;
 }
 function makeDiagnostic(code, message, fileOrSourceFile, node, strict, rootDir) {
@@ -6547,7 +6850,7 @@ function normalizeRelative(rootDir, filePath) {
   return relative3(rootDir, filePath).split(sep3).join("/").replace(/^\.\//, "");
 }
 function isAnyKeyword(node) {
-  return node.kind === ts4.SyntaxKind.AnyKeyword;
+  return node.kind === ts6.SyntaxKind.AnyKeyword;
 }
 
 // src/route-contracts.ts
@@ -6631,15 +6934,28 @@ function validateRouteContracts(graph) {
 }
 
 // src/compile.ts
+function withDefaultGovernance(options) {
+  return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
+    requirePersistentAdapters: true,
+    permission: true,
+    audit: true,
+    idempotency: true,
+    transaction: true
+  } } : options;
+}
 async function renderOptionalGraphql(options) {
   return options.graphql ? (await Promise.resolve().then(() => (init_graphql(), exports_graphql))).renderGraphql(options) : { diagnostics: [], files: {} };
 }
 async function compileProject(options) {
+  options = withDefaultGovernance(options);
   const graph = await analyzeProject(options.rootDir, options.include, options.cache, options.changedPaths);
   const diagnostics = [
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options)
   ];
+  if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
+    return { diagnostics, graph, written: [] };
+  }
   if (options.strict) {
     for (const diagnostic of diagnostics) {
       if (diagnostic.severity === "warn")
@@ -6693,11 +7009,15 @@ async function compileProject(options) {
   return { diagnostics, graph, written, ...stats ? { stats } : {} };
 }
 async function checkProject(options) {
+  options = withDefaultGovernance(options);
   const graph = await analyzeProject(options.rootDir, options.include, options.cache, options.changedPaths);
   const diagnostics = [
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options)
   ];
+  if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
+    return { diagnostics, graph, upToDate: false, mismatches: ["Runtime DI must be migrated to constructor injection."] };
+  }
   if (options.strict) {
     for (const diagnostic of diagnostics) {
       if (diagnostic.severity === "warn")
@@ -10248,7 +10568,7 @@ function formatDeliveryPlan(result) {
 import { mkdir as mkdir3, mkdtemp, readFile as readFile5, realpath as realpath2, rename as rename3, rm as rm2 } from "node:fs/promises";
 import { readFileSync as readFileSync3 } from "node:fs";
 import { dirname as dirname5, join as join6, relative as relative6, resolve as resolve7, sep as sep6 } from "node:path";
-import * as ts8 from "@typescript/typescript6";
+import * as ts10 from "@typescript/typescript6";
 
 // src/delivery-files.ts
 import { createHash as createHash7 } from "node:crypto";
@@ -10482,19 +10802,19 @@ function renderDeliveryTarget(graph, target, options) {
 import { isBuiltin } from "node:module";
 import { readFile as readFile4 } from "node:fs/promises";
 import { resolve as resolve6 } from "node:path";
-import * as ts7 from "@typescript/typescript6";
+import * as ts9 from "@typescript/typescript6";
 function checkStaticImports(path, contents) {
   if (!/\.[cm]?[jt]sx?$/.test(path))
     return;
-  const source = ts7.createSourceFile(path, new TextDecoder().decode(contents), ts7.ScriptTarget.Latest, true);
+  const source = ts9.createSourceFile(path, new TextDecoder().decode(contents), ts9.ScriptTarget.Latest, true);
   function visit(node) {
-    if (ts7.isCallExpression(node) && (node.expression.kind === ts7.SyntaxKind.ImportKeyword || ts7.isIdentifier(node.expression) && node.expression.text === "require")) {
+    if (ts9.isCallExpression(node) && (node.expression.kind === ts9.SyntaxKind.ImportKeyword || ts9.isIdentifier(node.expression) && node.expression.text === "require")) {
       const argument = node.arguments[0];
-      if (!argument || !ts7.isStringLiteral(argument) && !ts7.isNoSubstitutionTemplateLiteral(argument)) {
+      if (!argument || !ts9.isStringLiteral(argument) && !ts9.isNoSubstitutionTemplateLiteral(argument)) {
         throw new Error("Computed module loading is not supported in independent delivery bundles.");
       }
     }
-    ts7.forEachChild(node, visit);
+    ts9.forEachChild(node, visit);
   }
   visit(source);
 }
@@ -10583,7 +10903,7 @@ async function buildDeliveryProject(options, delivery) {
     const settings = parseDeliveryOptions(delivery);
     if (typeof Bun === "undefined")
       throw new Error("Independent delivery builds require Bun.");
-    const configPath = ts8.findConfigFile(resolve7(options.rootDir), ts8.sys.fileExists);
+    const configPath = ts10.findConfigFile(resolve7(options.rootDir), ts10.sys.fileExists);
     if (!configPath)
       throw new Error("Independent delivery builds require a project tsconfig.json.");
     const lexicalProject = dirname5(configPath);
@@ -10599,8 +10919,8 @@ async function buildDeliveryProject(options, delivery) {
     if (inside(generatedRoot, sourceRoot))
       throw new Error("Output must not contain the application source root.");
     const configInputs = new Map;
-    const parsedConfig = ts8.getParsedCommandLineOfConfigFile(await realpath2(configPath), {}, {
-      ...ts8.sys,
+    const parsedConfig = ts10.getParsedCommandLineOfConfigFile(await realpath2(configPath), {}, {
+      ...ts10.sys,
       readFile(path) {
         const contents = readFileSync3(path, "utf8");
         configInputs.set(resolve7(path), digest(contents));
@@ -10686,7 +11006,7 @@ async function buildDeliveryProject(options, delivery) {
       for (const [name, contents] of Object.entries(generated))
         await writeArtifact(stage, `generated/${name}`, contents);
       {
-        const program = ts8.createProgram({
+        const program = ts10.createProgram({
           rootNames: [
             ...parsedConfig.fileNames.filter((path) => !inside(generatedRoot, path)),
             ...Object.keys(generated).map((name) => join6(stage, "generated", name))
@@ -10694,12 +11014,12 @@ async function buildDeliveryProject(options, delivery) {
           options: { ...parsedConfig.options, rootDir: project },
           ...parsedConfig.projectReferences ? { projectReferences: parsedConfig.projectReferences } : {}
         });
-        const diagnostics = ts8.getPreEmitDiagnostics(program);
-        if (diagnostics.some((item) => item.category === ts8.DiagnosticCategory.Error)) {
-          return failed(diagnostics.filter((item) => item.category === ts8.DiagnosticCategory.Error).map((item) => ({
+        const diagnostics = ts10.getPreEmitDiagnostics(program);
+        if (diagnostics.some((item) => item.category === ts10.DiagnosticCategory.Error)) {
+          return failed(diagnostics.filter((item) => item.category === ts10.DiagnosticCategory.Error).map((item) => ({
             severity: "error",
             code: "delivery-generated-type-error",
-            message: ts8.flattenDiagnosticMessageText(item.messageText, `
+            message: ts10.flattenDiagnosticMessageText(item.messageText, `
 `),
             ...item.file ? { file: item.file.fileName } : {}
           })));
@@ -10831,7 +11151,7 @@ async function buildDeliveryProject(options, delivery) {
 import { randomUUID } from "node:crypto";
 import { lstat as lstat2, readFile as readFile6, realpath as realpath3, rename as rename4, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname6, isAbsolute as isAbsolute2, relative as relative7, resolve as resolve8, sep as sep7 } from "node:path";
-import * as ts9 from "@typescript/typescript6";
+import * as ts11 from "@typescript/typescript6";
 async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
@@ -10856,7 +11176,7 @@ async function applyDiagnosticFix(fix, options = {}) {
       if (!current || current.initializer.getText(source) !== fix.expectedExpression) {
         throw new Error("Command mode changed since diagnosis; analyze the project again");
       }
-      content = replaceProperty(source, object, fix.property, ts9.factory.createStringLiteral(fix.value));
+      content = replaceProperty(source, object, fix.property, ts11.factory.createStringLiteral(fix.value));
       break;
     }
     case "add_module_import": {
@@ -10867,15 +11187,15 @@ async function applyDiagnosticFix(fix, options = {}) {
       source = parse3(file, withImport);
       const object = unique(moduleObjects(source).filter((candidate) => !fix.targetModule || stringProperty(candidate, "name") === fix.targetModule), "target module");
       const imports = property(object, "imports");
-      if (imports && !ts9.isArrayLiteralExpression(imports.initializer)) {
+      if (imports && !ts11.isArrayLiteralExpression(imports.initializer)) {
         throw new Error("Module imports must be a static array");
       }
-      const values = imports && ts9.isArrayLiteralExpression(imports.initializer) ? imports.initializer.elements : [];
-      if (values.some(ts9.isSpreadElement))
+      const values = imports && ts11.isArrayLiteralExpression(imports.initializer) ? imports.initializer.elements : [];
+      if (values.some(ts11.isSpreadElement))
         throw new Error("Module imports cannot contain spread elements");
-      content = values.some((value) => ts9.isIdentifier(value) && value.text === fix.symbol) ? withImport : replaceProperty(source, object, "imports", ts9.factory.createArrayLiteralExpression([
+      content = values.some((value) => ts11.isIdentifier(value) && value.text === fix.symbol) ? withImport : replaceProperty(source, object, "imports", ts11.factory.createArrayLiteralExpression([
         ...values,
-        ts9.factory.createIdentifier(fix.symbol)
+        ts11.factory.createIdentifier(fix.symbol)
       ]));
       break;
     }
@@ -10887,24 +11207,24 @@ async function applyDiagnosticFix(fix, options = {}) {
       const command = findClass(source, fix.command);
       const object = decoratorObject(command, "Command");
       const current = property(object, "permission");
-      if (current && (!ts9.isStringLiteral(current.initializer) || current.initializer.text !== permission)) {
+      if (current && (!ts11.isStringLiteral(current.initializer) || current.initializer.text !== permission)) {
         throw new Error("Command permission already exists with a different value");
       }
-      content = current ? original : replaceProperty(source, object, "permission", ts9.factory.createStringLiteral(permission));
+      content = current ? original : replaceProperty(source, object, "permission", ts11.factory.createStringLiteral(permission));
       break;
     }
     case "add_route_parameter_binding": {
       const controller = findClass(source, fix.controller);
-      const method = unique(controller.members.filter((member) => ts9.isMethodDeclaration(member) && nameOf(member.name) === fix.route), "route handler");
-      const parameter = unique(method.parameters.filter((candidate) => ts9.isIdentifier(candidate.name) && candidate.name.text === fix.parameter), "same-named route parameter");
+      const method = unique(controller.members.filter((member) => ts11.isMethodDeclaration(member) && nameOf(member.name) === fix.route), "route handler");
+      const parameter = unique(method.parameters.filter((candidate) => ts11.isIdentifier(candidate.name) && candidate.name.text === fix.parameter), "same-named route parameter");
       const binding = fix.binding === "param" ? "Param" : fix.binding === "query" ? "Query" : undefined;
       if (!binding)
         throw new Error("Invalid route binding");
-      const decorators = ts9.getDecorators(parameter) ?? [];
+      const decorators = ts11.getDecorators(parameter) ?? [];
       if (decorators.length > 0)
         throw new Error("Parameter already has a decorator");
-      const framework = unique(source.statements.filter((statement) => ts9.isImportDeclaration(statement) && statement.importClause?.namedBindings && ts9.isNamedImports(statement.importClause.namedBindings) && statement.importClause.namedBindings.elements.some((element) => ["Controller", "Get", "Post", "Put", "Patch", "Delete", "Head", "Options"].includes(element.name.text))), "framework import");
-      if (!ts9.isImportDeclaration(framework) || !ts9.isStringLiteral(framework.moduleSpecifier)) {
+      const framework = unique(source.statements.filter((statement) => ts11.isImportDeclaration(statement) && statement.importClause?.namedBindings && ts11.isNamedImports(statement.importClause.namedBindings) && statement.importClause.namedBindings.elements.some((element) => ["Controller", "Get", "Post", "Put", "Patch", "Delete", "Head", "Options"].includes(element.name.text))), "framework import");
+      if (!ts11.isImportDeclaration(framework) || !ts11.isStringLiteral(framework.moduleSpecifier)) {
         throw new Error("Framework import must be static");
       }
       const edited = original.slice(0, parameter.getStart(source)) + `@${binding}(${JSON.stringify(fix.parameter)}) ` + original.slice(parameter.getStart(source));
@@ -10930,15 +11250,15 @@ async function applyDiagnosticFix(fix, options = {}) {
   return result;
 }
 function parse3(file, text) {
-  const result = ts9.transpileModule(text, {
+  const result = ts11.transpileModule(text, {
     fileName: file,
     reportDiagnostics: true,
-    compilerOptions: { target: ts9.ScriptTarget.ESNext, experimentalDecorators: true }
+    compilerOptions: { target: ts11.ScriptTarget.ESNext, experimentalDecorators: true }
   });
-  if (result.diagnostics?.some((item) => item.category === ts9.DiagnosticCategory.Error)) {
+  if (result.diagnostics?.some((item) => item.category === ts11.DiagnosticCategory.Error)) {
     throw new Error("Cannot fix syntactically invalid TypeScript");
   }
-  return ts9.createSourceFile(file, text, ts9.ScriptTarget.Latest, true, ts9.ScriptKind.TS);
+  return ts11.createSourceFile(file, text, ts11.ScriptTarget.Latest, true, ts11.ScriptKind.TS);
 }
 function unique(items, description) {
   if (items.length !== 1)
@@ -10952,50 +11272,50 @@ function identifier(value) {
 function nameOf(name) {
   if (!name)
     return "";
-  return ts9.isIdentifier(name) || ts9.isStringLiteral(name) || ts9.isNumericLiteral(name) ? name.text : "";
+  return ts11.isIdentifier(name) || ts11.isStringLiteral(name) || ts11.isNumericLiteral(name) ? name.text : "";
 }
 function property(object, key) {
-  if (object.properties.some((item) => !ts9.isPropertyAssignment(item) || ts9.isComputedPropertyName(item.name))) {
+  if (object.properties.some((item) => !ts11.isPropertyAssignment(item) || ts11.isComputedPropertyName(item.name))) {
     throw new Error("Fix requires explicit static object properties");
   }
-  const values = object.properties.filter((item) => ts9.isPropertyAssignment(item) && nameOf(item.name) === key);
+  const values = object.properties.filter((item) => ts11.isPropertyAssignment(item) && nameOf(item.name) === key);
   if (values.length > 1)
     throw new Error(`Duplicate '${key}' property`);
   return values[0];
 }
 function stringProperty(object, key) {
   const value = property(object, key)?.initializer;
-  return value && ts9.isStringLiteral(value) ? value.text : undefined;
+  return value && ts11.isStringLiteral(value) ? value.text : undefined;
 }
 function replaceProperty(source, object, key, value) {
   const previous = property(object, key);
-  const replacement = ts9.factory.createPropertyAssignment(key, value);
+  const replacement = ts11.factory.createPropertyAssignment(key, value);
   const properties = object.properties.map((item) => item === previous ? replacement : item);
   if (!previous)
     properties.push(replacement);
-  const updated = ts9.factory.updateObjectLiteralExpression(object, properties);
-  return source.text.slice(0, object.getStart(source)) + ts9.createPrinter().printNode(ts9.EmitHint.Expression, updated, source) + source.text.slice(object.end);
+  const updated = ts11.factory.updateObjectLiteralExpression(object, properties);
+  return source.text.slice(0, object.getStart(source)) + ts11.createPrinter().printNode(ts11.EmitHint.Expression, updated, source) + source.text.slice(object.end);
 }
 function findClass(source, name) {
-  return unique(source.statements.filter((statement) => ts9.isClassDeclaration(statement) && statement.name?.text === name), `class '${name}'`);
+  return unique(source.statements.filter((statement) => ts11.isClassDeclaration(statement) && statement.name?.text === name), `class '${name}'`);
 }
 function decoratorObject(node, name) {
-  const decorator = unique((ts9.getDecorators(node) ?? []).filter((item) => ts9.isCallExpression(item.expression) && item.expression.expression.getText() === name), `@${name} decorator`);
-  const argument = ts9.isCallExpression(decorator.expression) ? decorator.expression.arguments[0] : undefined;
-  if (!argument || !ts9.isObjectLiteralExpression(argument))
+  const decorator = unique((ts11.getDecorators(node) ?? []).filter((item) => ts11.isCallExpression(item.expression) && item.expression.expression.getText() === name), `@${name} decorator`);
+  const argument = ts11.isCallExpression(decorator.expression) ? decorator.expression.arguments[0] : undefined;
+  if (!argument || !ts11.isObjectLiteralExpression(argument))
     throw new Error(`@${name} requires a static object`);
   return argument;
 }
 function moduleObjects(source) {
   const result = [];
   for (const statement of source.statements) {
-    if (ts9.isClassDeclaration(statement) && (ts9.getDecorators(statement) ?? []).some((item) => ts9.isCallExpression(item.expression) && item.expression.expression.getText() === "Module")) {
+    if (ts11.isClassDeclaration(statement) && (ts11.getDecorators(statement) ?? []).some((item) => ts11.isCallExpression(item.expression) && item.expression.expression.getText() === "Module")) {
       result.push(decoratorObject(statement, "Module"));
     }
-    if (ts9.isVariableStatement(statement)) {
+    if (ts11.isVariableStatement(statement)) {
       for (const declaration of statement.declarationList.declarations) {
         const call = declaration.initializer;
-        if (call && ts9.isCallExpression(call) && ["defineModule", "defineFeatureSlice"].includes(call.expression.getText()) && call.arguments[0] && ts9.isObjectLiteralExpression(call.arguments[0])) {
+        if (call && ts11.isCallExpression(call) && ["defineModule", "defineFeatureSlice"].includes(call.expression.getText()) && call.arguments[0] && ts11.isObjectLiteralExpression(call.arguments[0])) {
           result.push(call.arguments[0]);
         }
       }
@@ -11009,19 +11329,19 @@ function importSymbol(source, path, symbol) {
   const target = resolve8(dirname6(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
   if (current === target)
     return source.text;
-  const matches = source.statements.filter((item) => ts9.isImportDeclaration(item) && ts9.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
+  const matches = source.statements.filter((item) => ts11.isImportDeclaration(item) && ts11.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
   if (matches.length > 1)
     throw new Error(`Ambiguous imports from '${path}'`);
   const match = matches[0];
-  if (match && ts9.isImportDeclaration(match) && match.importClause?.namedBindings && ts9.isNamedImports(match.importClause.namedBindings) && !match.importClause.isTypeOnly) {
+  if (match && ts11.isImportDeclaration(match) && match.importClause?.namedBindings && ts11.isNamedImports(match.importClause.namedBindings) && !match.importClause.isTypeOnly) {
     if (match.importClause.namedBindings.elements.some((item) => item.name.text === symbol))
       return source.text;
     const bindings = match.importClause.namedBindings;
-    const updated = ts9.factory.updateNamedImports(bindings, [
+    const updated = ts11.factory.updateNamedImports(bindings, [
       ...bindings.elements,
-      ts9.factory.createImportSpecifier(false, undefined, ts9.factory.createIdentifier(symbol))
+      ts11.factory.createImportSpecifier(false, undefined, ts11.factory.createIdentifier(symbol))
     ]);
-    return source.text.slice(0, bindings.getStart(source)) + ts9.createPrinter().printNode(ts9.EmitHint.Unspecified, updated, source) + source.text.slice(bindings.end);
+    return source.text.slice(0, bindings.getStart(source)) + ts11.createPrinter().printNode(ts11.EmitHint.Unspecified, updated, source) + source.text.slice(bindings.end);
   }
   if (match)
     throw new Error(`Import from '${path}' is not a named value import`);
@@ -11436,7 +11756,7 @@ function watchProject(options) {
 // src/migrations.ts
 import { rename as rename5, readFile as readFile9, writeFile as writeFile4, rm as rm3 } from "node:fs/promises";
 import { relative as relative10, resolve as resolve12 } from "node:path";
-import * as ts10 from "@typescript/typescript6";
+import * as ts12 from "@typescript/typescript6";
 
 // src/migration-policy.ts
 import { readFile as readFile8 } from "node:fs/promises";
@@ -11455,9 +11775,9 @@ function compilerVersion() {
 }
 function migrationDependencies() {
   return {
-    "@supacloud/app": "0.14.0",
+    "@supacloud/app": "0.15.0",
     "@supacloud/compiler": compilerVersion(),
-    "@supacloud/elysia": "0.16.0",
+    "@supacloud/elysia": "0.18.0",
     elysia: "1.4.30",
     typescript: "7.0.2"
   };
@@ -11480,29 +11800,29 @@ async function checkMigrationDependencies(rootDir) {
 // src/migrations.ts
 var ROUTE_DECORATORS2 = new Set(["Get", "Post", "Put", "Patch", "Delete", "Head", "Options"]);
 var MIGRATION_COMPILER_OPTIONS = {
-  target: ts10.ScriptTarget.ES2022,
-  module: ts10.ModuleKind.ESNext,
-  moduleResolution: ts10.ModuleResolutionKind.Bundler,
+  target: ts12.ScriptTarget.ES2022,
+  module: ts12.ModuleKind.ESNext,
+  moduleResolution: ts12.ModuleResolutionKind.Bundler,
   noEmit: true,
   skipLibCheck: true
 };
 function migrationCompilerOptions(rootDir) {
   if (!rootDir)
     return MIGRATION_COMPILER_OPTIONS;
-  const configPath = ts10.findConfigFile(rootDir, ts10.sys.fileExists);
+  const configPath = ts12.findConfigFile(rootDir, ts12.sys.fileExists);
   if (!configPath)
     return MIGRATION_COMPILER_OPTIONS;
   const configHost = {
-    ...ts10.sys,
+    ...ts12.sys,
     onUnRecoverableConfigFileDiagnostic: (_diagnostic) => {}
   };
-  const parsed = ts10.getParsedCommandLineOfConfigFile(configPath, {}, configHost);
+  const parsed = ts12.getParsedCommandLineOfConfigFile(configPath, {}, configHost);
   if (!parsed || parsed.errors.length > 0)
     return MIGRATION_COMPILER_OPTIONS;
   return { ...parsed.options, noEmit: true, skipLibCheck: true };
 }
 function propertyName2(property) {
-  if (ts10.isIdentifier(property) || ts10.isStringLiteral(property) || ts10.isNumericLiteral(property))
+  if (ts12.isIdentifier(property) || ts12.isStringLiteral(property) || ts12.isNumericLiteral(property))
     return property.text;
   return;
 }
@@ -11512,7 +11832,7 @@ function lineOf2(sourceFile, node) {
 function resolveSymbol(symbol, checker) {
   if (!symbol)
     return;
-  for (let guard = 0;guard < 4 && (symbol.flags & ts10.SymbolFlags.Alias) !== 0; guard += 1) {
+  for (let guard = 0;guard < 4 && (symbol.flags & ts12.SymbolFlags.Alias) !== 0; guard += 1) {
     const aliased = checker.getAliasedSymbol(symbol);
     if (aliased === symbol)
       break;
@@ -11521,12 +11841,12 @@ function resolveSymbol(symbol, checker) {
   return symbol;
 }
 function symbolForExpression(expression, checker) {
-  const location = ts10.isIdentifier(expression) ? expression : ts10.isPropertyAccessExpression(expression) ? expression.name : ts10.isElementAccessExpression(expression) && expression.argumentExpression && ts10.isStringLiteral(expression.argumentExpression) ? expression : undefined;
+  const location = ts12.isIdentifier(expression) ? expression : ts12.isPropertyAccessExpression(expression) ? expression.name : ts12.isElementAccessExpression(expression) && expression.argumentExpression && ts12.isStringLiteral(expression.argumentExpression) ? expression : undefined;
   return location ? resolveSymbol(checker.getSymbolAtLocation(location), checker) : undefined;
 }
 function unwrapExpression(expression) {
   let current = expression;
-  while (ts10.isAsExpression(current) || ts10.isSatisfiesExpression(current) || ts10.isParenthesizedExpression(current) || ts10.isTypeAssertionExpression(current)) {
+  while (ts12.isAsExpression(current) || ts12.isSatisfiesExpression(current) || ts12.isParenthesizedExpression(current) || ts12.isTypeAssertionExpression(current)) {
     current = current.expression;
   }
   return current;
@@ -11539,7 +11859,7 @@ function isDefineRouteContractCall(node, checker) {
 }
 function isRouteDecoratorCall(node, checker) {
   const name = node.expression.getText(node.getSourceFile());
-  if (ts10.isIdentifier(node.expression) && ROUTE_DECORATORS2.has(node.expression.text))
+  if (ts12.isIdentifier(node.expression) && ROUTE_DECORATORS2.has(node.expression.text))
     return true;
   if (ROUTE_DECORATORS2.has(name))
     return true;
@@ -11553,14 +11873,14 @@ function resolveStaticObjectLiteral2(input, checker, seen = new Set) {
   if (seen.has(expression))
     return;
   seen.add(expression);
-  if (ts10.isObjectLiteralExpression(expression))
+  if (ts12.isObjectLiteralExpression(expression))
     return expression;
-  if (ts10.isCallExpression(expression) && isDefineRouteContractCall(expression, checker)) {
+  if (ts12.isCallExpression(expression) && isDefineRouteContractCall(expression, checker)) {
     return resolveStaticObjectLiteral2(expression.arguments[0], checker, seen);
   }
   const symbol = symbolForExpression(expression, checker);
   for (const declaration of symbol?.declarations ?? []) {
-    if (ts10.isVariableDeclaration(declaration) && declaration.initializer) {
+    if (ts12.isVariableDeclaration(declaration) && declaration.initializer) {
       const resolved = resolveStaticObjectLiteral2(declaration.initializer, checker, seen);
       if (resolved)
         return resolved;
@@ -11574,7 +11894,7 @@ function displayFile(rootDir, fileName) {
 }
 function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
   const compilerOptions = migrationCompilerOptions(rootDir);
-  const host = ts10.createCompilerHost(compilerOptions);
+  const host = ts12.createCompilerHost(compilerOptions);
   const getSourceFile = host.getSourceFile.bind(host);
   const fileExists = host.fileExists.bind(host);
   const readFile = host.readFile.bind(host);
@@ -11583,16 +11903,16 @@ function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
   host.readFile = (fileName) => sourceOverrides.get(resolve12(fileName)) ?? readFile(fileName);
   host.getSourceFile = (fileName, languageVersion, onError, shouldCreateNewSourceFile) => {
     const source = sourceOverrides.get(resolve12(fileName));
-    return source === undefined ? getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile) : ts10.createSourceFile(fileName, source, languageVersion, true);
+    return source === undefined ? getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile) : ts12.createSourceFile(fileName, source, languageVersion, true);
   };
   host.getCurrentDirectory = () => rootDir ?? currentDirectory();
-  return ts10.createProgram(fileNames, compilerOptions, host);
+  return ts12.createProgram(fileNames, compilerOptions, host);
 }
 function routeResponseProperties(object) {
-  const responseProperties = object.properties.filter((property) => ts10.isPropertyAssignment(property) && propertyName2(property.name) === "response");
+  const responseProperties = object.properties.filter((property) => ts12.isPropertyAssignment(property) && propertyName2(property.name) === "response");
   return {
     response: responseProperties[0],
-    hasResponses: object.properties.some((property) => (ts10.isPropertyAssignment(property) || ts10.isShorthandPropertyAssignment(property)) && propertyName2(property.name) === "responses"),
+    hasResponses: object.properties.some((property) => (ts12.isPropertyAssignment(property) || ts12.isShorthandPropertyAssignment(property)) && propertyName2(property.name) === "responses"),
     duplicateResponse: responseProperties.length > 1
   };
 }
@@ -11612,7 +11932,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
     if (!includedFiles.has(sourcePath))
       continue;
     const visit = (node) => {
-      if (ts10.isCallExpression(node) && isRouteDecoratorCall(node, checker)) {
+      if (ts12.isCallExpression(node) && isRouteDecoratorCall(node, checker)) {
         const options = node.arguments[1];
         const object = options && resolveStaticObjectLiteral2(options, checker);
         if (object) {
@@ -11632,7 +11952,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
           }
         }
       }
-      ts10.forEachChild(node, visit);
+      ts12.forEachChild(node, visit);
     };
     visit(sourceFile);
   }
@@ -11792,7 +12112,7 @@ async function migrateProject(options) {
     }
   }
   const include = options.include ?? ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"];
-  const files = ts10.sys.readDirectory(rootDir, [".ts", ".tsx", ".mts", ".cts"], ["node_modules", "dist", "generated"], include).sort();
+  const files = ts12.sys.readDirectory(rootDir, [".ts", ".tsx", ".mts", ".cts"], ["node_modules", "dist", "generated"], include).sort();
   const results = [];
   const issues = [];
   const pendingWrites = new Map;
@@ -12678,6 +12998,13 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   generateOpenApi: true,
   generatePermissions: true,
   treeShakeUnusedProviders: true,
+  commandCapabilities: {
+    requirePersistentAdapters: true,
+    permission: true,
+    audit: true,
+    idempotency: true,
+    transaction: true
+  },
   moduleBoundaryPreset: "modular-monolith"
 };
 function defineSupacloudConfig(config = {}) {
@@ -12761,7 +13088,7 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     ...resolved.openApi === undefined ? {} : { openApi: resolved.openApi },
     generatePermissions: resolved.generatePermissions ?? DEFAULT_SUPACLOUD_CONFIG.generatePermissions,
     moduleBoundaryPreset: resolved.moduleBoundaryPreset ?? DEFAULT_SUPACLOUD_CONFIG.moduleBoundaryPreset,
-    commandCapabilities: resolved.commandCapabilities,
+    commandCapabilities: resolved.commandCapabilities ?? DEFAULT_SUPACLOUD_CONFIG.commandCapabilities,
     ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
     ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
@@ -12793,6 +13120,7 @@ function compileOptionsFromConfig(config, cwd = process.cwd()) {
 
 // src/index.ts
 init_graphql_schema();
+init_database_contracts();
 export {
   ANGULAR_ENTERPRISE_RULES,
   CLEAN_ARCHITECTURE_RULES,
@@ -12809,6 +13137,7 @@ export {
   MODULE_BOUNDARY_PROFILES,
   ModuleDependencyGraph,
   OpenApiDocumentError,
+  SQL_SAFETY_DIAGNOSTIC_CODES,
   SUPACLOUD_MIGRATIONS,
   TYPE_SAFETY_DIAGNOSTIC_CODES,
   TraitCompiler,
@@ -12837,6 +13166,7 @@ export {
   formatGraph,
   formatOpenApiDiff,
   generateApplication,
+  generateDatabaseContracts,
   generateFeatureSource,
   getModuleBoundaryPreset,
   getModuleBoundaryProfile,
@@ -12845,6 +13175,7 @@ export {
   loadSupacloudConfig,
   migrateProject,
   migrateRouteResponse,
+  parseDatabaseContractsOptions,
   parseDeliveryBuildManifest,
   parseDeliveryBuildResult,
   parseDeliveryOptions,
@@ -12858,6 +13189,8 @@ export {
   renderOpenApi,
   resolveModuleBoundaries,
   resolveSupacloudConfig,
+  runDatabaseContractsFile,
+  scanDrizzleSql,
   scanGeneratedArtifacts,
   scanProductionSource,
   serializeOpenApiJson,