@supacloud/compiler 0.31.2 → 0.33.0

package/dist/cli.js

@@ -2245,6 +2245,8 @@ function renderClient(graph, options) {
   const schemaLocals = new Map;
   const usedTypeNames = new Set;
   const allRoutes = [];
+  const allProcedures = [];
+  const commandByClassName = new Map(graph.modules.flatMap((module) => module.commands.map((command) => [command.className, command])));
   let usesStatic = false;
   let usesValue = false;
   const uniqueTypeName = (candidate) => {
@@ -2375,8 +2377,21 @@ function renderClient(graph, options) {
         const responseSchemaEntries = hasResponseMap ? Object.entries(responseSchemas).map(([status, ref]) => [status, ref.local]) : responseSchema ? [["200", responseSchema.local]] : [];
         const responseSchemaArgument = responseSchemaEntries.length > 0 ? `{ ${responseSchemaEntries.map(([status, local]) => `${JSON.stringify(status)}: ${local}`).join(", ")} }` : "undefined";
         const responseKindArgument = responseKind === undefined ? "undefined" : JSON.stringify(responseKind);
+        const command = route.command === undefined ? undefined : commandByClassName.get(route.command);
+        const procedureKind = route.method === "GET" || route.method === "HEAD" ? "query" : "mutation";
+        const idempotencyMode = command?.idempotency ?? "none";
+        allProcedures.push({
+          method: route.method,
+          path: fullPath,
+          controller: controller.className,
+          handler: route.handler,
+          kind: procedureKind,
+          ...command?.name === undefined ? {} : { command: command.name },
+          ...command?.permission === undefined ? {} : { permission: command.permission },
+          idempotency: idempotencyMode
+        });
         routeMethods.push(`
-    ${route.handler}: makeRoute<${requestTypeName}, ${responseType === "never" ? "never" : responseTypeName}>(${JSON.stringify(route.method)}, ${JSON.stringify(fullPath)}, ${responseSchemaArgument}, ${responseKindArgument}, ${route.parse === "none"}),`);
+    ${route.handler}: makeRoute<${requestTypeName}, ${responseType === "never" ? "never" : responseTypeName}, ${JSON.stringify(procedureKind)}, ${JSON.stringify(idempotencyMode)}>(${JSON.stringify(route.method)}, ${JSON.stringify(fullPath)}, ${responseSchemaArgument}, ${responseKindArgument}, ${route.parse === "none"}, ${JSON.stringify(procedureKind)}, ${JSON.stringify(idempotencyMode)}),`);
       }
       controllerEntries.push(`
   ${controllerKey}: {${routeMethods.join("")}
@@ -2407,6 +2422,43 @@ function renderClient(graph, options) {
     "",
     "export type ResponseDecoder<T> = (value: unknown) => T;",
     "",
+    'export type ProcedureKind = "query" | "mutation";',
+    'export type IdempotencyMode = "required" | "none";',
+    "",
+    "export interface ProcedureExecutionOptions {",
+    "  /** Reuse the same key when retrying an uncertain mutation. */",
+    "  idempotencyKey?: string;",
+    "  signal?: AbortSignal;",
+    "}",
+    "",
+    "export type RequiredProcedureExecutionOptions = ProcedureExecutionOptions & { idempotencyKey: string };",
+    "",
+    "type ProcedureResult<Result> = [Result] extends [never] ? unknown : Result;",
+    "",
+    "type ProcedureArgs<Options extends ClientRequestOptions, Idempotency extends IdempotencyMode> =",
+    '  Idempotency extends "required"',
+    "    ? {} extends Options",
+    "      ? [execution: RequiredProcedureExecutionOptions] | [input: Options, execution: RequiredProcedureExecutionOptions]",
+    "      : [input: Options, execution: RequiredProcedureExecutionOptions]",
+    "    : {} extends Options",
+    "      ? [input?: Options, execution?: ProcedureExecutionOptions]",
+    "      : [input: Options, execution?: ProcedureExecutionOptions];",
+    "",
+    "export type ProcedureCall<",
+    "  Options extends ClientRequestOptions = ClientRequestOptions,",
+    "  Result = never,",
+    '  Idempotency extends IdempotencyMode = "none",',
+    "> = (...args: ProcedureArgs<Options, Idempotency>) => Promise<ProcedureResult<Result>>;",
+    "",
+    "export type ProcedureMember<",
+    "  Options extends ClientRequestOptions,",
+    "  Result,",
+    "  Kind extends ProcedureKind,",
+    "  Idempotency extends IdempotencyMode,",
+    '> = Kind extends "query"',
+    "  ? { query: ProcedureCall<Options, Result, Idempotency> }",
+    "  : { mutate: ProcedureCall<Options, Result, Idempotency> };",
+    "",
     'export type ApiClientErrorCode = "API_HTTP_ERROR" | "API_RESPONSE_INVALID" | "API_RESPONSE_UNDECLARED";',
     "",
     "export interface ApiClientErrorDetails {",
@@ -2450,6 +2502,17 @@ function renderClient(graph, options) {
     "    : { (options: Options): Promise<Result>; <T>(options: Options, decode: ResponseDecoder<T>): Promise<T> }",
     ") & ((...args: {} extends Options ? [options?: Options] : [options: Options]) => Promise<[Result] extends [never] ? unknown : Result>);",
     "",
+    "export interface ApiProcedureDefinition {",
+    "  method: string;",
+    "  path: string;",
+    "  controller: string;",
+    "  handler: string;",
+    "  kind: ProcedureKind;",
+    "  command?: string;",
+    "  permission?: string;",
+    "  idempotency: IdempotencyMode;",
+    "}",
+    "",
     ...routeTypes,
     ...routeTypes.length > 0 ? [""] : [],
     "export interface HttpInterceptorRequest {",
@@ -2457,6 +2520,7 @@ function renderClient(graph, options) {
     "  url: string;",
     "  headers: Record<string, string>;",
     "  body?: unknown;",
+    "  signal?: AbortSignal;",
     "}",
     "",
     "export type HttpInterceptorFn = (",
@@ -2475,6 +2539,8 @@ function renderClient(graph, options) {
     "",
     "export const API_ROUTES = " + JSON.stringify(allRoutes, null, 2) + " as const;",
     "",
+    "export const API_PROCEDURES: readonly ApiProcedureDefinition[] = " + JSON.stringify(allProcedures, null, 2) + ";",
+    "",
     "export type AppRoutePath = typeof API_ROUTES[number]['path'];",
     "",
     "export const API_SCHEMAS = [",
@@ -2700,6 +2766,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw?: boolean,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T>;",
     "  async function request<T>(",
     "    method: string,",
@@ -2709,6 +2776,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw?: boolean,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T | unknown>;",
     "  async function request(",
     "    method: string,",
@@ -2723,6 +2791,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw = false,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T | unknown> {",
     "    const url = `${baseUrl}${buildRouteUrl(path, options.params, options.query)}`;",
     '    const customHeaders = typeof config.headers === "function" ? await config.headers() : config.headers;',
@@ -2748,9 +2817,10 @@ function renderClient(graph, options) {
     "        headers: reqPayload.headers,",
     "        ...(reqPayload.body === undefined ? {} : { body: raw ? rawBody(reqPayload.body) : JSON.stringify(reqPayload.body) }),",
     '        ...(raw && reqPayload.body instanceof ReadableStream ? { duplex: "half" } : {}),',
+    "        ...(reqPayload.signal === undefined ? {} : { signal: reqPayload.signal }),",
     "      });",
     "    };",
-    "    const response = await executeChain(0, { method, url, headers, body: options.body });",
+    "    const response = await executeChain(0, { method, url, headers, body: options.body, ...(execution?.signal === undefined ? {} : { signal: execution.signal }) });",
     "    const declaredSchema = responseSchemas ? selectResponseSchema(response.status, responseSchemas) : undefined;",
     "    const failure = (code: ApiClientErrorCode, message: string) => new ApiClientError(message, {",
     '      code, method, path, status: response.status, requestId: response.headers.get("x-request-id"),',
@@ -2788,7 +2858,44 @@ function renderClient(graph, options) {
     "    return decode ? decode(checked) : checked;",
     "  }",
     "",
-    `  function makeRoute<Options extends ClientRequestOptions, Result = never>(method: string, path: string, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false): RouteMethod<Options, Result> {`,
+    "  function hasHeader(headers: Record<string, string>, name: string): boolean {",
+    "    return Object.keys(headers).some((key) => key.toLowerCase() === name.toLowerCase());",
+    "  }",
+    "",
+    "  function withProcedureExecution(",
+    "    options: ClientRequestOptions,",
+    "    execution: ProcedureExecutionOptions | undefined,",
+    "    idempotency: IdempotencyMode,",
+    "  ): ClientRequestOptions {",
+    "    const headers = { ...(options.headers as Record<string, string> | undefined) };",
+    "    if (execution?.idempotencyKey !== undefined) {",
+    "      if (!/^[A-Za-z0-9._:-]{1,512}$/.test(execution.idempotencyKey)) {",
+    '        throw new TypeError("idempotencyKey must contain only safe header characters and be at most 512 characters");',
+    "      }",
+    '      headers["idempotency-key"] = execution.idempotencyKey;',
+    "    }",
+    '    if (idempotency === "required" && !hasHeader(headers, "idempotency-key")) {',
+    '      throw new TypeError("This mutation requires an idempotencyKey");',
+    "    }",
+    "    return Object.keys(headers).length === 0 ? options : { ...options, headers };",
+    "  }",
+    "",
+    "  function isProcedureExecution(value: unknown): value is ProcedureExecutionOptions {",
+    '    if (value === null || typeof value !== "object" || Array.isArray(value)) return false;',
+    '    return Object.hasOwn(value, "idempotencyKey") || Object.hasOwn(value, "signal");',
+    "  }",
+    "",
+    `  function makeProcedure<Options extends ClientRequestOptions, Result = never, Idempotency extends IdempotencyMode = "none">(method: string, path: string, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false, idempotency: Idempotency = "none" as Idempotency): ProcedureCall<Options, Result, Idempotency> {`,
+    "    const procedure = async (first?: Options | ProcedureExecutionOptions, second?: ProcedureExecutionOptions): Promise<unknown> => {",
+    "      const execution = second ?? (isProcedureExecution(first) ? first : undefined);",
+    "      const input = (execution === first ? undefined : first) ?? {};",
+    "      const requestOptions = withProcedureExecution(input as ClientRequestOptions, execution, idempotency);",
+    "      return request(method, path, requestOptions, undefined, responseSchemas, responseKind, raw, execution);",
+    "    };",
+    "    return procedure as ProcedureCall<Options, Result, Idempotency>;",
+    "  }",
+    "",
+    `  function makeRoute<Options extends ClientRequestOptions, Result = never, Kind extends ProcedureKind = never, Idempotency extends IdempotencyMode = "none">(method: string, path: string, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false, kind?: Kind, idempotency: Idempotency = "none" as Idempotency): RouteMethod<Options, Result> & ProcedureMember<Options, Result, Kind, Idempotency> {`,
     "    function route<T>(options: Options, decode: ResponseDecoder<T>): Promise<T>;",
     "    function route(options: Options): Promise<Result>;",
     "    function route(options?: Options): Promise<unknown>;",
@@ -2796,13 +2903,16 @@ function renderClient(graph, options) {
     "      const requestOptions = options ?? {};",
     "      return request(method, path, requestOptions, decode, responseSchemas, responseKind, raw);",
     "    }",
-    "    return route as RouteMethod<Options, Result>;",
+    '    if (kind === "query") Object.assign(route, { query: makeProcedure<Options, Result, Idempotency>(method, path, responseSchemas, responseKind, raw, idempotency) });',
+    '    if (kind === "mutation") Object.assign(route, { mutate: makeProcedure<Options, Result, Idempotency>(method, path, responseSchemas, responseKind, raw, idempotency) });',
+    "    return route as RouteMethod<Options, Result> & ProcedureMember<Options, Result, Kind, Idempotency>;",
     "  }",
     "",
     "  return {",
     "    request,",
     "    buildRouteUrl,",
     "    routes: API_ROUTES,",
+    "    procedures: API_PROCEDURES,",
     ...controllerEntries,
     "  };",
     "}",
@@ -15283,6 +15393,65 @@ var init_application_development2 = __esm(() => {
   };
 });
 
+// node_modules/@supacloud/delivery/src/worker-execution.ts
+function parseWorkerExecutionGroup(value) {
+  if (!Check2(WorkerExecutionGroupSchema, value) || value.replicas > value.maxReplicas || !value.queue.endsWith(`_v${value.definitionVersion}`) || value.lifecycle.visibilityTimeoutSeconds < value.lifecycle.executionTimeoutSeconds + value.lifecycle.shutdownGraceSeconds + 30) {
+    throw new Error("WORKER_EXECUTION_INVALID");
+  }
+  return structuredClone(value);
+}
+function validateWorkerExecution(groups) {
+  const names = new Set, targets = new Set, queues = new Set, routes = new Set;
+  for (const candidate of groups) {
+    const group = parseWorkerExecutionGroup(candidate);
+    const route = `${group.taskKey}:${group.definitionVersion}`;
+    if (names.has(group.name) || targets.has(group.target) || queues.has(group.queue) || routes.has(route)) {
+      throw new Error("WORKER_EXECUTION_CONFLICT");
+    }
+    names.add(group.name);
+    targets.add(group.target);
+    queues.add(group.queue);
+    routes.add(route);
+  }
+}
+var closed3, positive = (maximum) => Integer({ minimum: 1, maximum }), WorkerExecutionGroupSchema, WorkerExecutionSchema;
+var init_worker_execution = __esm(() => {
+  init_build();
+  init_value2();
+  closed3 = { additionalProperties: false };
+  WorkerExecutionGroupSchema = _Object_({
+    name: String2({ pattern: "^[a-z][a-z0-9-]{0,47}$" }),
+    target: String2({ pattern: "^[a-z][a-z0-9-]{0,53}$" }),
+    workloadClass: Union([Literal("interactive"), Literal("batch")]),
+    executor: Literal("pgflow-queue"),
+    runtime: Literal("bun"),
+    queue: String2({ pattern: "^scw_[a-z0-9_]{1,40}$" }),
+    taskKey: String2({ pattern: "^[a-z][a-z0-9_.-]{0,99}$" }),
+    definitionVersion: String2({ pattern: "^[1-9][0-9]{0,8}$" }),
+    replicas: positive(16),
+    maxReplicas: positive(16),
+    concurrencyPerReplica: positive(32),
+    resources: _Object_({
+      cpuLimit: Number2({ minimum: 0.1, maximum: 64, multipleOf: 0.1 }),
+      memoryLimitMiB: Integer({ minimum: 64, maximum: 262144 })
+    }, closed3),
+    database: _Object_({
+      engineConnectionsPerReplica: positive(16),
+      handlerConnectionsPerReplica: positive(16)
+    }, closed3),
+    lifecycle: _Object_({
+      executionTimeoutSeconds: positive(3500),
+      visibilityTimeoutSeconds: Integer({ minimum: 15, maximum: 3600 }),
+      shutdownGraceSeconds: positive(300)
+    }, closed3),
+    retry: _Object_({ maxAttempts: Integer({ minimum: 1, maximum: 10 }) }, closed3),
+    admission: _Object_({ maxOutstandingOperations: positive(1e6) }, closed3)
+  }, closed3);
+  WorkerExecutionSchema = _Object_({
+    groups: _Array_(WorkerExecutionGroupSchema, { minItems: 1, maxItems: 32 })
+  }, closed3);
+});
+
 // node_modules/@supacloud/delivery/src/delivery-schema.ts
 function parseDeliveryOptions(value) {
   if (value === undefined)
@@ -15290,6 +15459,11 @@ function parseDeliveryOptions(value) {
   if (!Check2(DeliveryOptionsSchema, value))
     throw new DeliveryConfigurationError;
   const migrations = value.build?.migrations ?? [];
+  try {
+    validateWorkerExecution(value.execution?.groups ?? []);
+  } catch {
+    throw new DeliveryConfigurationError;
+  }
   if (new Set(migrations.map((item) => item.version)).size !== migrations.length || new Set(migrations.map((item) => item.source)).size !== migrations.length || migrations.some((item) => BigInt(item.version) > 9223372036854775807n || !/\.sql$/i.test(item.source) || item.source.split("/").includes("node_modules"))) {
     throw new DeliveryConfigurationError;
   }
@@ -15304,6 +15478,7 @@ var objectOptions, reference2, references, kind2, isolation, DeliveryFilePathSch
 var init_delivery_schema = __esm(() => {
   init_build();
   init_value2();
+  init_worker_execution();
   objectOptions = { additionalProperties: false };
   reference2 = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
   references = _Array_(reference2, { uniqueItems: true });
@@ -15315,6 +15490,7 @@ var init_delivery_schema = __esm(() => {
   });
   DeliveryOptionsSchema = _Object_({
     version: Literal(1),
+    execution: Optional(WorkerExecutionSchema),
     targets: Optional(_Array_(_Object_({
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       kind: kind2,
@@ -15387,6 +15563,7 @@ var init_delivery_schema = __esm(() => {
     name: String2(),
     kind: kind2,
     isolation,
+    execution: Optional(WorkerExecutionGroupSchema),
     roots: _Array_(String2()),
     modules: _Array_(_Object_({
       name: String2(),
@@ -15602,6 +15779,15 @@ function deliveryObjectDigest(object) {
 function parseDeliveryBuildManifest(value) {
   if (!Check2(DeliveryBuildManifestSchema, value))
     throw new Error("Invalid delivery build manifest.");
+  validateWorkerExecution(value.plan.targets.flatMap((target) => target.execution ? [target.execution] : []));
+  if (value.plan.targets.reduce((count, target) => count + (target.execution?.replicas ?? 1), 0) > 32) {
+    throw new Error("Invalid delivery replica count.");
+  }
+  for (const target of value.plan.targets) {
+    if (target.execution && (target.kind !== "jobs" || target.isolation !== "process" || target.execution.target !== target.name || target.jobs.length !== 1 || target.jobs[0]?.name !== target.execution.taskKey || value.objects.find((object) => object.name === target.name)?.entryKind !== "bun-worker-application")) {
+      throw new Error("Invalid delivery execution binding.");
+    }
+  }
   if (new Set(value.objects.map((item) => item.name)).size !== value.objects.length) {
     throw new Error("Duplicate delivery object owner.");
   }
@@ -15610,7 +15796,7 @@ function parseDeliveryBuildManifest(value) {
   }
   for (const object of value.objects) {
     const target = value.plan.targets.find((target) => target.name === object.name);
-    if (object.entryKind === "bun-worker-application" && target?.kind !== "jobs" || object.entryKind === "bun-http-application" && target?.kind === "jobs") {
+    if (["bun-worker-application", "go-worker-application", "scriptc-worker-application"].includes(object.entryKind) && target?.kind !== "jobs" || object.entryKind === "bun-http-application" && target?.kind === "jobs") {
       throw new Error("Delivery executable kind does not match its target.");
     }
     if (new Set(object.files.map((file) => file.path)).size !== object.files.length || !object.files.some((file) => file.path === object.entrypoint) || deliveryObjectDigest(object) !== object.objectId) {
@@ -15631,13 +15817,14 @@ function parseDeliveryBuildResult(value) {
     parseDeliveryBuildManifest(value.manifest);
   return value;
 }
-var closed3, digest2, DeliveryObjectSchema, DeliveryBuildManifestSchema, resultFields, DeliveryBuildResultSchema;
+var closed4, digest2, DeliveryObjectSchema, DeliveryBuildManifestSchema, resultFields, DeliveryBuildResultSchema;
 var init_delivery_build_schema = __esm(() => {
   init_build();
   init_value2();
   init_delivery_schema();
   init_delivery_files();
-  closed3 = { additionalProperties: false };
+  init_worker_execution();
+  closed4 = { additionalProperties: false };
   digest2 = String2({ pattern: "^[a-f0-9]{64}$" });
   DeliveryObjectSchema = _Object_({
     name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
@@ -15647,15 +15834,17 @@ var init_delivery_build_schema = __esm(() => {
     entryKind: Union([
       Literal("compiled-module-factory"),
       Literal("bun-http-application"),
-      Literal("bun-worker-application")
+      Literal("bun-worker-application"),
+      Literal("go-worker-application"),
+      Literal("scriptc-worker-application")
     ]),
     runtimeImports: _Array_(String2()),
     files: _Array_(_Object_({
       path: DeliveryFilePathSchema,
       sha256: digest2,
       bytes: Integer({ minimum: 0 })
-    }, closed3), { minItems: 1 })
-  }, closed3);
+    }, closed4), { minItems: 1 })
+  }, closed4);
   DeliveryBuildManifestSchema = _Object_({
     schemaVersion: Literal(1),
     producer: Literal("@supacloud/compiler/delivery-build-v1"),
@@ -15666,9 +15855,9 @@ var init_delivery_build_schema = __esm(() => {
       method: String2(),
       path: String2(),
       target: String2()
-    }, closed3)),
-    jobs: _Array_(_Object_({ name: String2(), target: String2() }, closed3))
-  }, closed3);
+    }, closed4)),
+    jobs: _Array_(_Object_({ name: String2(), target: String2() }, closed4))
+  }, closed4);
   resultFields = {
     diagnostics: _Array_(DeliveryDiagnosticSchema),
     written: _Array_(String2()),
@@ -15682,13 +15871,13 @@ var init_delivery_build_schema = __esm(() => {
       changedTargets: _Array_(String2()),
       unchangedTargets: _Array_(String2()),
       removedTargets: _Array_(String2())
-    }, closed3),
+    }, closed4),
     _Object_({
       ...resultFields,
       written: _Array_(String2(), { maxItems: 0 }),
       ok: Literal(false),
       manifest: Null()
-    }, closed3)
+    }, closed4)
   ]);
 });
 
@@ -16063,6 +16252,7 @@ var init_application_release = __esm(() => {
   init_build();
   init_value2();
   init_delivery_files();
+  init_worker_execution();
   ApplicationIdSchema = String2({ pattern: "^[A-Za-z0-9_-]{1,64}$" });
   ApplicationReleaseIdSchema = String2({ pattern: "^[a-f0-9]{64}$" });
   ApplicationReleaseRecordSchema = _Object_({
@@ -16076,7 +16266,8 @@ var init_application_release = __esm(() => {
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       object_id: ApplicationReleaseIdSchema,
       kind: Union([Literal("http"), Literal("worker")]),
-      entrypoint: Literal("bundle/index.js")
+      entrypoint: Literal("bundle/index.js"),
+      execution: Optional(WorkerExecutionGroupSchema)
     }, { additionalProperties: false }), { minItems: 1, maxItems: 32 })
   }, { additionalProperties: false });
 });
@@ -16140,7 +16331,9 @@ var init_application_configuration = __esm(() => {
     "SUPACLOUD_ACTIVATION_ID",
     "SUPACLOUD_ENVIRONMENT_ID",
     "SUPACLOUD_TARGET",
-    "SUPACLOUD_OBJECT_ID"
+    "SUPACLOUD_OBJECT_ID",
+    "SUPACLOUD_WORKER_EXECUTION",
+    "SUPACLOUD_WORKER_REPLICA"
   ]);
 });
 
@@ -16174,6 +16367,107 @@ var init_application_activation = __esm(() => {
   }, { additionalProperties: false });
 });
 
+// node_modules/@supacloud/delivery/src/deployment-evidence.ts
+var closed6, sha256, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
+var init_deployment_evidence = __esm(() => {
+  init_build();
+  init_value2();
+  init_application_configuration();
+  init_application_release();
+  closed6 = { additionalProperties: false };
+  sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
+  isoDate = String2({ minLength: 20, maxLength: 40 });
+  status = Union([
+    Literal("confirmed"),
+    Literal("failed"),
+    Literal("unknown")
+  ]);
+  evidenceStatus = Union([
+    Literal("confirmed"),
+    Literal("failed"),
+    Literal("unknown"),
+    Literal("incomplete")
+  ]);
+  DatabaseProviderSchema = _Object_({
+    provider: String2({ minLength: 1, maxLength: 64, pattern: "^[a-z][a-z0-9_.-]*$" }),
+    version: String2({ minLength: 1, maxLength: 64 }),
+    topology: Union([Literal("single-node"), Literal("distributed")]),
+    migration: _Object_({
+      status,
+      inventory_sha256: Union([sha256, Null()]),
+      compatibility: Union([
+        Literal("verified"),
+        Literal("not-proven"),
+        Literal("failed")
+      ])
+    }, closed6),
+    backup: _Object_({
+      status,
+      latest_success_at: Union([isoDate, Null()]),
+      freshness_seconds: Union([Integer({ minimum: 0 }), Null()])
+    }, closed6),
+    recovery: _Object_({
+      status,
+      drill_id: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
+      rpo_seconds: Union([Integer({ minimum: 0 }), Null()]),
+      rto_seconds: Union([Integer({ minimum: 0 }), Null()])
+    }, closed6)
+  }, closed6);
+  componentName = Union([
+    Literal("management-api"),
+    Literal("web-console"),
+    Literal("edge-runtime"),
+    Literal("worker"),
+    Literal("postgres"),
+    Literal("postgrest"),
+    Literal("gotrue"),
+    Literal("storage"),
+    Literal("realtime")
+  ]);
+  DeploymentComponentEvidenceSchema = _Object_({
+    name: componentName,
+    version: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
+    status,
+    health_check: Union([String2({ minLength: 1, maxLength: 256 }), Null()]),
+    checked_at: Union([isoDate, Null()])
+  }, closed6);
+  DeploymentEvidenceSchema = _Object_({
+    schema: Literal(DEPLOYMENT_EVIDENCE_SCHEMA),
+    status: evidenceStatus,
+    recorded_at: isoDate,
+    scope: _Object_({
+      project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+      application_id: ApplicationIdSchema,
+      environment_id: ApplicationIdSchema
+    }, closed6),
+    source: _Object_({
+      commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
+      manifest_sha256: sha256,
+      contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
+      environment_binding_version: Union([sha256, Null()])
+    }, closed6),
+    database: DatabaseProviderSchema,
+    components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
+    activation: _Object_({
+      release_id: ApplicationReleaseIdSchema,
+      configuration_id: ApplicationConfigurationIdSchema,
+      activation_id: ApplicationConfigurationIdSchema
+    }, closed6),
+    health: _Object_({
+      status,
+      checked_at: Union([isoDate, Null()]),
+      authenticated_smoke: status
+    }, closed6),
+    rollback: _Object_({
+      release_id: Union([ApplicationReleaseIdSchema, Null()]),
+      configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
+      status: Union([Literal("ready"), Literal("not-ready"), Literal("unknown")]),
+      result: Union([status, Null()])
+    }, closed6),
+    notes: _Array_(String2({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
+  }, closed6);
+});
+
 // node_modules/@supacloud/delivery/src/application-runtime-identity.ts
 var APPLICATION_RUNTIME_PROBE_PATH = "/.well-known/supacloud/runtime", ApplicationRuntimeIdentitySchema, ApplicationReadinessReportSchema;
 var init_application_runtime_identity = __esm(() => {
@@ -16292,9 +16586,11 @@ var init_delivery_migration_plan = () => {};
 // node_modules/@supacloud/delivery/src/index.ts
 var init_src = __esm(() => {
   init_delivery_artifact();
+  init_worker_execution();
   init_application_activation();
   init_application_release();
   init_application_configuration();
+  init_deployment_evidence();
   init_application_runtime_identity();
   init_delivery_build_schema();
   init_delivery_migration_archive();
@@ -21352,6 +21648,17 @@ function createDeliveryPlan(graph, input) {
       }
     }
   }
+  for (const group of options.execution?.groups ?? []) {
+    const target = targets.get(group.target);
+    if (!target || target.kind !== "jobs" || target.isolation !== "process" || target.jobs.length !== 1 || target.jobs[0]?.name !== group.taskKey || !options.build?.workerApplications?.some((item) => item.target === group.target)) {
+      fail("delivery-execution-binding-invalid", `Execution group "${group.name}" requires one matching compiled Job and a Worker host.`, "Bind one versioned queue/task to one process-isolated jobs target with build.workerApplications.");
+    } else {
+      target.execution = group;
+    }
+  }
+  if ([...targets.values()].reduce((count, target) => count + (target.execution?.replicas ?? 1), 0) > 32) {
+    fail("delivery-execution-replica-limit", "A release supports at most 32 runtime targets including replicas.", "Reduce the replica count or split independent applications.");
+  }
   const canonicalDiagnostics = [...new Map(diagnostics.map((item) => [JSON.stringify(item), item])).values()].sort((a, b) => compare2(JSON.stringify(a), JSON.stringify(b)));
   if (canonicalDiagnostics.some((item) => item.severity === "error")) {
     return parseDeliveryPlanResult({ ok: false, plan: null, diagnostics: canonicalDiagnostics, written: [] });
@@ -21531,7 +21838,7 @@ function staticDeliveryImports(path, contents) {
 // src/delivery-bundle-protocol.ts
 init_build();
 init_value2();
-var closed4 = { additionalProperties: false };
+var closed5 = { additionalProperties: false };
 var requestSchema = _Object_({
   parentPid: Integer({ minimum: 1 }),
   name: String2(),
@@ -21539,15 +21846,15 @@ var requestSchema = _Object_({
   project: String2(),
   generatedDirectory: String2(),
   options: DeliveryOptionsSchema
-}, closed4);
+}, closed5);
 var responseSchema = Union([
   _Object_({
     ok: Literal(true),
     files: _Array_(Tuple([DeliveryFilePathSchema, String2({ pattern: "^[A-Za-z0-9+/]*={0,2}$" })])),
     inputs: _Array_(Tuple([String2(), String2({ pattern: "^[a-f0-9]{64}$" })])),
     runtimeImports: _Array_(String2())
-  }, closed4),
-  _Object_({ ok: Literal(false) }, closed4)
+  }, closed5),
+  _Object_({ ok: Literal(false) }, closed5)
 ]);
 function parseDeliveryBundleRequest(input) {
   if (!Check2(requestSchema, input))
@@ -21863,6 +22170,7 @@ function renderDeliveryWorkerEntry(generatedDirectory, hostPath) {
   const specifier = relativeImportPath(generatedDirectory, hostPath);
   return `
 import deliveryProcess from "node:process";
+import { isDeepStrictEqual as deliveryPolicyEqual } from "node:util";
 import { createDeliveryWorker } from ${JSON.stringify(specifier)};
 ${renderDeliveryRuntimeIdentity()}
 
@@ -21870,6 +22178,8 @@ interface DeliveryWorkerHost {
   start(): void | Promise<void>;
   close(): void | Promise<void>;
   failure?: Promise<never>;
+  execution?: unknown;
+  health?(): Promise<{ ready: boolean; active: number; completed: number; failed: number; timedOut: number }>;
 }
 
 {
@@ -21881,6 +22191,7 @@ interface DeliveryWorkerHost {
   let closing: Promise<void> | undefined;
   let deadline: ReturnType<typeof setTimeout> | undefined;
   let keepAlive: ReturnType<typeof setInterval> | undefined;
+  let healthPending = false;
   const finish = (failed: boolean) => {
     clearTimeout(deadline);
     clearInterval(keepAlive);
@@ -21941,6 +22252,13 @@ interface DeliveryWorkerHost {
     const candidate = await createHost(createCompiledModules(), { signal: lifecycle.signal });
     if (!candidate || typeof candidate.close !== "function") throw new Error("Invalid delivery worker host.");
     host = candidate;
+    const execution = deliveryProcess.env.SUPACLOUD_WORKER_EXECUTION;
+    if (execution) {
+      const expected: unknown = JSON.parse(Buffer.from(execution, "base64").toString("utf8"));
+      if (!deliveryPolicyEqual(host.execution, expected) || typeof host.health !== "function" || !host.failure) {
+        throw new Error("Delivery worker execution policy was not adopted.");
+      }
+    }
     if (typeof host.start !== "function") throw new Error("Invalid delivery worker host.");
     if (host.failure !== undefined) {
       if (!host.failure || typeof host.failure.then !== "function") throw new Error("Invalid worker failure signal.");
@@ -21952,7 +22270,18 @@ interface DeliveryWorkerHost {
       await finishShutdown();
     } else {
       running = true;
-      keepAlive = setInterval(() => {}, 1000);
+      const health = async () => {
+        if (!execution || !host?.health || healthPending || lifecycle.signal.aborted) return;
+        healthPending = true;
+        try {
+          const status = await host.health();
+          console.log(JSON.stringify({ event: "delivery-worker-health", identity, observedAt: new Date().toISOString(), ...status }));
+        } catch {
+          console.log(JSON.stringify({ event: "delivery-worker-health", identity, observedAt: new Date().toISOString(), ready: false }));
+        } finally { healthPending = false; }
+      };
+      keepAlive = setInterval(() => { void health(); }, execution ? 5000 : 1000);
+      await health();
       console.log(JSON.stringify({ event: "delivery-worker-started", ...(identity ? { identity } : {}) }));
     }
   } catch {
@@ -23296,7 +23625,7 @@ function isRecord2(value) {
 function arrayLength(value) {
   return Array.isArray(value) ? value.length : undefined;
 }
-async function sha256(path) {
+async function sha2562(path) {
   return createHash10("sha256").update(await readFile11(path)).digest("hex");
 }
 function overallStatus(findings) {
@@ -23370,7 +23699,7 @@ async function assessMigration(options) {
     contractsManifest = {
       path: contractsManifestPath,
       present: true,
-      sha256: await sha256(contractsManifestPath),
+      sha256: await sha2562(contractsManifestPath),
       version: 1,
       ...arrayLength(parsed.commands) === undefined ? {} : { commands: arrayLength(parsed.commands) },
       ...arrayLength(parsed.routes) === undefined ? {} : { routes: arrayLength(parsed.routes) },
@@ -23393,9 +23722,9 @@ async function assessMigration(options) {
       const diff = diffOpenApiDocuments(await readOpenApiJson(baselinePath), await readOpenApiJson(currentPath));
       openApi = {
         baselinePath,
-        baselineSha256: await sha256(baselinePath),
+        baselineSha256: await sha2562(baselinePath),
         currentPath,
-        currentSha256: await sha256(currentPath),
+        currentSha256: await sha2562(currentPath),
         diff
       };
       if (!diff.ok) {