@supacloud/compiler 0.44.0 → 0.45.0

package/dist/cli.js

@@ -4096,7 +4096,7 @@ var init_graphql_options = __esm(() => {
 });
 
 // src/graphql-inputs.ts
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 import * as ts11 from "@typescript/typescript6";
 function graphqlInputPaths(options) {
   if (!options.graphql)
@@ -4106,9 +4106,9 @@ function graphqlInputPaths(options) {
   } catch {
     return [];
   }
-  const root = resolve5(options.rootDir);
-  const schema = resolve5(root, options.graphql.schema);
-  const documents = ts11.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve5(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve5(path)).filter((path) => path !== schema);
+  const root = resolve6(options.rootDir);
+  const schema = resolve6(root, options.graphql.schema);
+  const documents = ts11.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve6(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve6(path)).filter((path) => path !== schema);
   return [schema, ...[...new Set(documents)].sort()];
 }
 var init_graphql_inputs = __esm(() => {
@@ -4117,9 +4117,9 @@ var init_graphql_inputs = __esm(() => {
 
 // src/graphql-runtime.ts
 import * as ts12 from "@typescript/typescript6";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function renderGraphqlValidators(source, operationNames, operationKinds = new Map) {
-  const fileName = resolve6("/__supacloud_graphql__/contracts.ts");
+  const fileName = resolve7("/__supacloud_graphql__/contracts.ts");
   const options = {
     strict: true,
     noUncheckedIndexedAccess: true,
@@ -4135,7 +4135,7 @@ function renderGraphqlValidators(source, operationNames, operationKinds = new Ma
   };
   const host = ts12.createCompilerHost(options);
   const getSourceFile = host.getSourceFile.bind(host);
-  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve6(path) === fileName ? ts12.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve7(path) === fileName ? ts12.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
   const program = ts12.createProgram([fileName], options, host);
   const diagnostics = ts12.getPreEmitDiagnostics(program);
   if (diagnostics.length) {
@@ -13169,7 +13169,7 @@ function FromObject10(context, type, value) {
     return value;
   const additionalProperties = GetAdditionalProperties(type);
   for (const key of Keys(value)) {
-    if (HasPropertyKey(type.properties, key)) {
+    if (HasPropertyKey(type.properties, key) && IsSchema(type.properties[key])) {
       value[key] = FromType19(context, type.properties[key], value[key]);
       continue;
     }
@@ -13301,6 +13301,9 @@ function FromProperties4(properties) {
     result[key] = FromType20(properties[key]);
   return result;
 }
+function FromRecordKey(type) {
+  return String2({ pattern: RecordPattern(type) });
+}
 function FromPriorityTypes(types) {
   return FromTypes6(Priority(types));
 }
@@ -13308,7 +13311,7 @@ function FromTypes6(types) {
   return types.map((type) => FromType20(type));
 }
 function FromType20(type) {
-  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(RecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
+  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(FromRecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
   return Modifiers(type, next);
 }
 function UnionPrioritySort(type) {
@@ -13324,6 +13327,7 @@ var init_union_priority_sort = __esm(() => {
   init_type3();
   init_type3();
   init_type3();
+  init_type3();
 });
 
 // node_modules/typebox/build/value/clean/clean.mjs
@@ -15838,7 +15842,7 @@ var init_delivery_schema = __esm(() => {
 import { createHash as createHash7 } from "node:crypto";
 import { constants as constants2 } from "node:fs";
 import { lstat, mkdir as mkdir2, open as open3, readFile as readFile3, readdir, realpath, rename as rename2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join6, relative as relative6, resolve as resolve8, sep as sep6 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join6, relative as relative6, resolve as resolve9, sep as sep6 } from "node:path";
 function canonical2(value) {
   return JSON.stringify(value, (_key, item) => item !== null && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : item);
 }
@@ -15901,7 +15905,7 @@ async function reserveOutput(project, requested) {
   if (!inside(project, requested))
     throw new Error("Delivery output must be inside the application project.");
   const base = await realpath(project);
-  const path = resolve8(base, relative6(project, requested));
+  const path = resolve9(base, relative6(project, requested));
   if (relative6(base, path).split(sep6).some((part) => part === ".git" || part === "node_modules")) {
     throw new Error("Delivery output cannot use repository or dependency internals.");
   }
@@ -16109,9 +16113,9 @@ var init_delivery_build_schema = __esm(() => {
 
 // node_modules/@supacloud/delivery/src/delivery-artifact.ts
 import { readdir as readdir2, realpath as realpath2 } from "node:fs/promises";
-import { basename, dirname as dirname6, join as join7, resolve as resolve9 } from "node:path";
+import { basename, dirname as dirname6, join as join7, resolve as resolve10 } from "node:path";
 async function readDeliveryManifest(manifestPath) {
-  const selected = resolve9(manifestPath);
+  const selected = resolve10(manifestPath);
   const root = await realpath2(dirname6(selected));
   const manifest = parseDeliveryBuildManifest(JSON.parse((await readBoundedOwned(root, join7(root, basename(selected)), JSON_LIMIT)).toString("utf8")));
   return { root, manifest };
@@ -16263,13 +16267,13 @@ var init_delivery_context = __esm(() => {
 // src/fixes.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { lstat as lstat2, readFile as readFile5, realpath as realpath3, rename as rename3, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute4, relative as relative9, resolve as resolve13, sep as sep9 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, relative as relative9, resolve as resolve14, sep as sep9 } from "node:path";
 import * as ts13 from "@typescript/typescript6";
 async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
   const root = await realpath3(options.rootDir ?? process.cwd());
-  const file = resolve13(root, fix.targetFile);
+  const file = resolve14(root, fix.targetFile);
   const stat = await lstat2(file);
   const resolved = await realpath3(file);
   const relativePath = relative9(root, resolved);
@@ -16444,8 +16448,8 @@ function moduleObjects(source) {
 }
 function importSymbol(source, path, symbol) {
   identifier2(symbol);
-  const current = resolve13(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
-  const target = resolve13(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
+  const current = resolve14(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
+  const target = resolve14(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
   if (current === target)
     return source.text;
   const matches = source.statements.filter((item) => ts13.isImportDeclaration(item) && ts13.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
@@ -16656,37 +16660,67 @@ var init_application_deploy_plan = __esm(() => {
   }, { additionalProperties: false });
 });
 
-// node_modules/@supacloud/delivery/src/application-release-operation.ts
-var closed6, nullableActivation, ApplicationReleaseRequestSchema, ApplicationReleaseResultSchema;
-var init_application_release_operation = __esm(() => {
+// node_modules/@supacloud/delivery/src/application-deploy-operation.ts
+var closed6, sha256, nullableActivation, ApplicationDeployWebReleaseSchema, ApplicationDeployRequestSchema, ApplicationBackendReceiptSchema, ApplicationDeployResultSchema;
+var init_application_deploy_operation = __esm(() => {
   init_build();
   init_value2();
   init_application_activation();
   init_application_configuration();
   init_application_release();
   closed6 = { additionalProperties: false };
+  sha256 = ApplicationReleaseIdSchema;
   nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
-  ApplicationReleaseRequestSchema = _Object_({
-    release_id: ApplicationReleaseIdSchema,
+  ApplicationDeployWebReleaseSchema = _Object_({
+    deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+    release_id: sha256
+  }, closed6);
+  ApplicationDeployRequestSchema = _Object_({
+    mutation_id: ApplicationActivationIdSchema,
+    release_id: sha256,
     configuration_id: Optional(ApplicationConfigurationIdSchema),
     configuration_write: Optional(ApplicationConfigurationWriteSchema),
-    activation_id: Optional(ApplicationActivationIdSchema),
-    expected_activation_id: Optional(nullableActivation),
-    expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+    expected_plan_sha256: Optional(sha256),
+    approved_migration_digest: Optional(sha256),
+    web_release: Optional(ApplicationDeployWebReleaseSchema)
   }, closed6);
-  ApplicationReleaseResultSchema = _Object_({
-    schema: Literal("supacloud.application-release.v1"),
+  ApplicationBackendReceiptSchema = _Object_({
+    schema: Literal("supacloud.application-backend-receipt.v1"),
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema,
-    release_id: ApplicationReleaseIdSchema,
+    release_id: sha256,
+    manifest_sha256: sha256,
+    mutation_id: ApplicationActivationIdSchema,
+    plan_sha256: sha256,
+    backup_id: Union([String2(), Null()]),
+    before_ledger_digest: sha256,
+    after_ledger_digest: sha256,
+    applied_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { uniqueItems: true }),
+    schema_reloaded: Boolean2(),
+    postgrest_healthy: Boolean2()
+  }, closed6);
+  ApplicationDeployResultSchema = _Object_({
+    schema: Literal("supacloud.application-deploy.v1"),
+    project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+    application_id: ApplicationIdSchema,
+    environment_id: ApplicationIdSchema,
+    mutation_id: ApplicationActivationIdSchema,
+    release_id: sha256,
     configuration_id: ApplicationConfigurationIdSchema,
     activation_id: ApplicationActivationIdSchema,
     expected_activation_id: nullableActivation,
-    plan_sha256: ApplicationReleaseIdSchema,
+    plan_sha256: sha256,
     action: Union([Literal("activate"), Literal("no-op")]),
     replayed: Boolean2(),
-    execution_performed: Boolean2()
+    execution_performed: Boolean2(),
+    backend_receipt: ApplicationBackendReceiptSchema,
+    web: Optional(_Object_({
+      deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+      release_id: sha256,
+      activation_id: ApplicationActivationIdSchema,
+      replayed: Boolean2()
+    }, closed6))
   }, closed6);
 });
 
@@ -16842,14 +16876,14 @@ var init_application_release_transfer = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed8, sha256, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
+var closed8, sha2562, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
 var init_deployment_evidence = __esm(() => {
   init_build();
   init_value2();
   init_application_configuration();
   init_application_release();
   closed8 = { additionalProperties: false };
-  sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
+  sha2562 = String2({ pattern: "^[a-f0-9]{64}$" });
   isoDate = String2({ minLength: 20, maxLength: 40 });
   status = Union([
     Literal("confirmed"),
@@ -16868,7 +16902,7 @@ var init_deployment_evidence = __esm(() => {
     topology: Union([Literal("single-node"), Literal("distributed")]),
     migration: _Object_({
       status,
-      inventory_sha256: Union([sha256, Null()]),
+      inventory_sha256: Union([sha2562, Null()]),
       compatibility: Union([
         Literal("verified"),
         Literal("not-proven"),
@@ -16916,9 +16950,9 @@ var init_deployment_evidence = __esm(() => {
     }, closed8),
     source: _Object_({
       commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
-      manifest_sha256: sha256,
+      manifest_sha256: sha2562,
       contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
-      environment_binding_version: Union([sha256, Null()])
+      environment_binding_version: Union([sha2562, Null()])
     }, closed8),
     database: DatabaseProviderSchema,
     components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
@@ -16943,7 +16977,7 @@ var init_deployment_evidence = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed9, projectRef2, sha2562, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
+var closed9, projectRef2, sha2563, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
 var init_application_promotion = __esm(() => {
   init_build();
   init_value2();
@@ -16953,9 +16987,9 @@ var init_application_promotion = __esm(() => {
   init_application_release();
   closed9 = { additionalProperties: false };
   projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-  sha2562 = ApplicationReleaseIdSchema;
+  sha2563 = ApplicationReleaseIdSchema;
   nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-  nullableDigest = Union([sha2562, Null()]);
+  nullableDigest = Union([sha2563, Null()]);
   observation = {
     activation_id: nullableActivation2,
     receipt_confirmed: Boolean2(),
@@ -16981,24 +17015,24 @@ var init_application_promotion = __esm(() => {
     project_ref: projectRef2,
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema,
-    manifest_sha256: sha2562,
-    plan_sha256: sha2562,
+    manifest_sha256: sha2563,
+    plan_sha256: sha2563,
     source: _Object_({
       project_ref: projectRef2,
       environment_id: ApplicationIdSchema,
-      release_id: sha2562,
+      release_id: sha2563,
       ...observation
     }, closed9),
     target: _Object_({
-      candidate_release_id: sha2562,
-      current_release_id: Union([sha2562, Null()]),
+      candidate_release_id: sha2563,
+      current_release_id: Union([sha2563, Null()]),
       artifact_action: Union([Literal("materialize"), Literal("reuse")]),
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
       configuration: Union([ApplicationConfigurationViewSchema, Null()]),
       ...observation
     }, closed9),
     migrations: _Object_({
-      ledger_digest: sha2562,
+      ledger_digest: sha2563,
       ledger_compatible: Boolean2(),
       project_migrations_applied: Boolean2(),
       pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
@@ -17141,7 +17175,7 @@ var init_src = __esm(() => {
   init_worker_execution();
   init_application_activation();
   init_application_deploy_plan();
-  init_application_release_operation();
+  init_application_deploy_operation();
   init_application_history();
   init_application_release();
   init_application_preview();
@@ -17271,7 +17305,7 @@ var init_release_evidence = __esm(() => {
 });
 
 // src/release-evidence-cli.ts
-import { resolve as resolve22 } from "node:path";
+import { resolve as resolve23 } from "node:path";
 async function runReleaseEvidenceCommand(args) {
   try {
     const values = new Map;
@@ -17295,7 +17329,7 @@ async function runReleaseEvidenceCommand(args) {
     if (!manifest || !target || manifest.length > 4096 || !/^[a-z][a-z0-9-]{0,62}$/.test(target)) {
       throw new ReleaseEvidenceError("RELEASE_EVIDENCE_INVALID");
     }
-    const evidence = await createReleaseEvidence(resolve22(manifest), target);
+    const evidence = await createReleaseEvidence(resolve23(manifest), target);
     console.log(json ? JSON.stringify(evidence, null, 2) : formatReleaseEvidence(evidence));
   } catch (error) {
     console.error(`Error: ${error instanceof ReleaseEvidenceError ? error.code : "RELEASE_EVIDENCE_INVALID"}`);
@@ -17309,7 +17343,7 @@ var init_release_evidence_cli = __esm(() => {
 // src/database-contracts.ts
 import { createHash as createHash12 } from "node:crypto";
 import { mkdir as mkdir5, readFile as readFile13 } from "node:fs/promises";
-import { dirname as dirname11, relative as relative12, resolve as resolve23 } from "node:path";
+import { dirname as dirname11, relative as relative12, resolve as resolve24 } from "node:path";
 import * as ts18 from "@typescript/typescript6";
 function hash3(value) {
   return createHash12("sha256").update(value).digest("hex");
@@ -17337,18 +17371,18 @@ function parseDatabaseContractsOptions(value, directory) {
     throw new TypeError("migrations must be an ordered list of SQL files");
   }
   return {
-    rootDir: resolve23(directory, field("rootDir")),
-    outDir: resolve23(directory, field("outDir")),
-    postgrestTypes: resolve23(directory, field("postgrestTypes")),
-    drizzleSchema: resolve23(directory, field("drizzleSchema")),
+    rootDir: resolve24(directory, field("rootDir")),
+    outDir: resolve24(directory, field("outDir")),
+    postgrestTypes: resolve24(directory, field("postgrestTypes")),
+    drizzleSchema: resolve24(directory, field("drizzleSchema")),
     role: field("role"),
-    graphql: { ...graphql, schema: resolve23(directory, graphql.schema) },
-    migrations: migrations.map((file) => resolve23(directory, file))
+    graphql: { ...graphql, schema: resolve24(directory, graphql.schema) },
+    migrations: migrations.map((file) => resolve24(directory, file))
   };
 }
 async function generateDatabaseContracts(options, check = false) {
-  const rootDir = resolve23(options.rootDir), outDir = resolve23(options.outDir);
-  const postgrestTypes = resolve23(rootDir, options.postgrestTypes), drizzleSchema = resolve23(rootDir, options.drizzleSchema);
+  const rootDir = resolve24(options.rootDir), outDir = resolve24(options.outDir);
+  const postgrestTypes = resolve24(rootDir, options.postgrestTypes), drizzleSchema = resolve24(rootDir, options.drizzleSchema);
   const snapshot = await readFile13(postgrestTypes, "utf8");
   const syntax = ts18.createSourceFile(postgrestTypes, snapshot, ts18.ScriptTarget.Latest, true);
   const database = syntax.statements.find((node) => (ts18.isTypeAliasDeclaration(node) || ts18.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts18.SyntaxKind.ExportKeyword));
@@ -17376,7 +17410,7 @@ async function generateDatabaseContracts(options, check = false) {
   }
   const inputs = {};
   const addInput = async (path) => {
-    const absolute = resolve23(rootDir, path);
+    const absolute = resolve24(rootDir, path);
     inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash3(await readFile13(absolute, "utf8"));
   };
   await addInput(postgrestTypes);
@@ -17393,8 +17427,8 @@ async function generateDatabaseContracts(options, check = false) {
     if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
       await addInput(source.fileName);
   }
-  await addInput(resolve23(rootDir, options.graphql.schema));
-  if (new Set(options.migrations.map((path) => resolve23(rootDir, path))).size !== options.migrations.length) {
+  await addInput(resolve24(rootDir, options.graphql.schema));
+  if (new Set(options.migrations.map((path) => resolve24(rootDir, path))).size !== options.migrations.length) {
     throw new Error("Duplicate migration in database contracts configuration");
   }
   for (const path of options.migrations)
@@ -17415,14 +17449,14 @@ async function generateDatabaseContracts(options, check = false) {
     version: 1,
     role: options.role,
     inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => a.localeCompare(b))),
-    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve23(rootDir, path)).replaceAll("\\", "/")),
+    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve24(rootDir, path)).replaceAll("\\", "/")),
     outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash3(text)]))
   };
   files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
 `;
   const mismatches = [];
   for (const [file, content] of Object.entries(files)) {
-    const path = resolve23(outDir, file);
+    const path = resolve24(outDir, file);
     let current;
     try {
       current = await readFile13(path, "utf8");
@@ -17436,12 +17470,12 @@ async function generateDatabaseContracts(options, check = false) {
   if (!check) {
     await mkdir5(outDir, { recursive: true });
     for (const [file, content] of Object.entries(files))
-      await writeFileIfChanged(resolve23(outDir, file), content);
+      await writeFileIfChanged(resolve24(outDir, file), content);
   }
   return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
 }
 async function runDatabaseContractsFile(path, check = false) {
-  const absolute = resolve23(path);
+  const absolute = resolve24(path);
   const value = JSON.parse(await readFile13(absolute, "utf8"));
   return generateDatabaseContracts(parseDatabaseContractsOptions(value, dirname11(absolute)), check);
 }
@@ -17453,7 +17487,7 @@ var init_database_contracts = __esm(() => {
 
 // src/graphql-schema.ts
 import { mkdir as mkdir6, readFile as readFile14 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve24 } from "node:path";
+import { dirname as dirname12, resolve as resolve25 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -17493,7 +17527,7 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema(data));
-  const path = resolve24(options.output);
+  const path = resolve25(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
@@ -17521,7 +17555,7 @@ var init_graphql_schema = __esm(() => {
 });
 
 // src/cli.ts
-import { resolve as resolve25 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 import { readFile as readFile15 } from "node:fs/promises";
 
 // src/analyze.ts
@@ -21666,6 +21700,52 @@ function validateEffectPolicies(graph, options = {}) {
   return diagnostics;
 }
 
+// src/database-governance.ts
+import { execFile } from "node:child_process";
+import { resolve as resolve5 } from "node:path";
+import { fileURLToPath } from "node:url";
+function assertDatabaseGovernance(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid databaseGovernance configuration.");
+  const entry = value;
+  if (entry["mode"] !== "off" && entry["mode"] !== "check" && entry["mode"] !== "enforce" || Object.keys(entry).some((key) => !["mode", "projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv", "schemas"].includes(key)) || ["projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv"].some((key) => entry[key] !== undefined && (typeof entry[key] !== "string" || !entry[key].trim())) || entry["databaseUrlEnv"] !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(entry["databaseUrlEnv"])) || entry["schemas"] !== undefined && (!Array.isArray(entry["schemas"]) || !entry["schemas"].length || !entry["schemas"].every((schema) => typeof schema === "string" && schema.trim()))) {
+    throw new Error("Invalid databaseGovernance mode, paths, connection or schemas.");
+  }
+}
+async function checkDatabaseGovernance(rootDir, value) {
+  if (value === undefined)
+    return [];
+  const failure = () => [{
+    severity: "error",
+    code: "database-governance",
+    message: "Database governance could not be verified. Check configuration, installed @supacloud/db, Bun and read-only database access."
+  }];
+  try {
+    assertDatabaseGovernance(value);
+    if (value.mode === "off")
+      return [];
+    const options = { ...value, projectRoot: resolve5(rootDir, value.projectRoot ?? ".") };
+    const worker = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "./database-governance-worker.ts" : "./database-governance-worker.js", import.meta.url));
+    const output = await new Promise((accept, reject) => {
+      const child = execFile(process.versions.bun ? process.execPath : "bun", ["--no-env-file", worker], { timeout: 30000, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 }, (error, stdout) => error ? reject(error) : accept(stdout));
+      child.stdin?.on("error", reject);
+      child.stdin?.end(JSON.stringify(options));
+    });
+    const report = JSON.parse(output);
+    if (!report || typeof report !== "object" || !("diagnostics" in report) || !Array.isArray(report.diagnostics))
+      return failure();
+    const diagnostics = [];
+    for (const item of report.diagnostics) {
+      if (!item || typeof item !== "object" || !("code" in item) || typeof item.code !== "string" || !item.code.startsWith("database-") || !("message" in item) || typeof item.message !== "string" || !("severity" in item) || item.severity !== "error")
+        return failure();
+      diagnostics.push({ severity: "error", code: item.code, message: item.message });
+    }
+    return diagnostics;
+  } catch {
+    return failure();
+  }
+}
+
 // src/compile.ts
 function withDefaultGovernance(options) {
   return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
@@ -21688,6 +21768,10 @@ async function compileProject(options) {
     ...validateClientSchemaBoundaries(graph, options),
     ...validateEffectPolicies(graph, options.effect)
   ];
+  const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
+  diagnostics.push(...databaseDiagnostics);
+  if (databaseDiagnostics.length)
+    return { diagnostics, graph, written: [] };
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, written: [] };
   }
@@ -21754,6 +21838,11 @@ async function checkProject(options) {
     ...validateClientSchemaBoundaries(graph, options),
     ...validateEffectPolicies(graph, options.effect)
   ];
+  const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
+  diagnostics.push(...databaseDiagnostics);
+  if (databaseDiagnostics.length) {
+    return { diagnostics, graph, upToDate: false, mismatches: ["Database governance verification failed."] };
+  }
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, upToDate: false, mismatches: ["Runtime DI must be migrated to constructor injection."] };
   }
@@ -22086,12 +22175,12 @@ init_delivery_context();
 
 // src/watch.ts
 import { existsSync as existsSync4, watch } from "node:fs";
-import { dirname as dirname7, relative as relative8, resolve as resolve11, sep as sep8 } from "node:path";
+import { dirname as dirname7, relative as relative8, resolve as resolve12, sep as sep8 } from "node:path";
 
 // src/incremental.ts
 import { createHash as createHash8 } from "node:crypto";
 import { access as access3, readdir as readdir3, readFile as readFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve10, sep as sep7 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve11, sep as sep7 } from "node:path";
 init_graphql_inputs();
 function createDependencyGraphCache() {
   return {
@@ -22160,11 +22249,11 @@ async function readSourceBytes(path) {
   return readFile4(path);
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve10(options.rootDir);
-  const outDir = resolve10(options.outDir);
+  const rootDir = resolve11(options.rootDir);
+  const outDir = resolve11(options.outDir);
   const files = { ...previous.files };
   await Promise.all(changedPaths.map(async (changedPath) => {
-    const absolutePath = isAbsolute3(changedPath) ? resolve10(changedPath) : resolve10(rootDir, changedPath);
+    const absolutePath = isAbsolute3(changedPath) ? resolve11(changedPath) : resolve11(rootDir, changedPath);
     const relativeChangedPath = relative7(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep7}`))
       return;
@@ -22182,8 +22271,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve10(options.rootDir);
-  const outDir = resolve10(options.outDir);
+  const rootDir = resolve11(options.rootDir);
+  const outDir = resolve11(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   const entries = await Promise.all(paths.map(async (path) => {
@@ -22206,8 +22295,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve10(options.rootDir),
-    outDir: resolve10(options.outDir),
+    rootDir: resolve11(options.rootDir),
+    outDir: resolve11(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -22223,6 +22312,10 @@ function optionsKeyOf(options) {
     openApi: options.openApi,
     generatePermissions: options.generatePermissions,
     typeSafety: options.typeSafety,
+    databaseGovernance: options.databaseGovernance && {
+      ...options.databaseGovernance,
+      databaseUrl: undefined
+    },
     effect: options.effect,
     treeShakeUnusedProviders: options.treeShakeUnusedProviders,
     graphql: options.graphql
@@ -22232,7 +22325,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir3(directory, { withFileTypes: true })) {
-      const path = resolve10(directory, entry.name);
+      const path = resolve11(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -22367,8 +22460,8 @@ function isCompilerConfigurationPath(rootDir, changedPath) {
   ].includes(relativePath) || /^tsconfig\.[^/]+\.json$/.test(relativePath);
 }
 function watchProject(options) {
-  const rootDir = resolve11(options.rootDir);
-  const outDir = resolve11(options.outDir);
+  const rootDir = resolve12(options.rootDir);
+  const outDir = resolve12(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -22378,7 +22471,9 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve11(rootDir, options.graphql.schema) : undefined;
+  let databaseWatcher;
+  const databaseRoot = options.databaseGovernance && options.databaseGovernance.mode !== "off" ? resolve12(rootDir, options.databaseGovernance.projectRoot ?? ".") : undefined;
+  const schemaPath = options.graphql ? resolve12(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -22405,6 +22500,7 @@ function watchProject(options) {
       clearTimeout(timer);
     watcher?.close();
     schemaWatcher?.close();
+    databaseWatcher?.close();
   };
   const compile = (initial, changedPaths = []) => {
     if (closed && !initial)
@@ -22479,6 +22575,13 @@ function watchProject(options) {
       startRecompile(paths);
     }, debounceMs);
   };
+  const isDatabaseInput = (path) => {
+    if (!databaseRoot)
+      return false;
+    const local = relative8(databaseRoot, path);
+    const output = relative8(outDir, path);
+    return local !== ".." && !local.startsWith(`..${sep8}`) && output !== "" && (output === ".." || output.startsWith(`..${sep8}`)) && !local.split(sep8).some((part) => ["node_modules", ".git", ".wt", ".worktrees", "dist", "output"].includes(part)) && /\.(?:sql|json|[cm]?[jt]s)$/.test(path);
+  };
   const startup = compile(true).then(() => {
     if (closed) {
       if (initialEvent)
@@ -22488,20 +22591,27 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve11(rootDir, filename.toString());
+      const changedPath = resolve12(rootDir, filename.toString());
       const relativePath = relative8(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
-      if (/\.(tsx?|mts|cts)$/.test(changedPath) || isCompilerConfigurationPath(rootDir, changedPath) || options.graphql && (/\.(graphql|gql)$/.test(changedPath) || changedPath === schemaPath)) {
+      if (/\.(tsx?|mts|cts)$/.test(changedPath) || isCompilerConfigurationPath(rootDir, changedPath) || isDatabaseInput(changedPath) || options.graphql && (/\.(graphql|gql)$/.test(changedPath) || changedPath === schemaPath)) {
         schedule(relative8(rootDir, changedPath));
       }
     });
+    if (databaseRoot && databaseRoot !== rootDir) {
+      databaseWatcher = watch(databaseRoot, { recursive: true }, (_eventType, filename) => {
+        const path = filename ? resolve12(databaseRoot, filename.toString()) : undefined;
+        if (!path || isDatabaseInput(path))
+          schedule(path);
+      });
+    }
     if (schemaPath && relative8(rootDir, schemaPath).startsWith(`..${sep8}`)) {
       let directory = dirname7(schemaPath);
       while (!existsSync4(directory) && dirname7(directory) !== directory)
         directory = dirname7(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve11(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve12(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -22526,7 +22636,7 @@ function watchProject(options) {
 // src/config.ts
 init_graphql_options();
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join8, resolve as resolve12 } from "node:path";
+import { join as join8, resolve as resolve13 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/delivery-schema.ts
@@ -22534,6 +22644,7 @@ init_delivery_schema();
 
 // src/config.ts
 var DEFAULT_SUPACLOUD_CONFIG = {
+  databaseGovernance: { mode: "off" },
   graphql: false,
   root: "src",
   outDir: "generated",
@@ -22564,6 +22675,8 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   }
 };
 function defineSupacloudConfig(config = {}) {
+  if (config.databaseGovernance !== undefined)
+    assertDatabaseGovernance(config.databaseGovernance);
   if (config.delivery !== undefined)
     parseDeliveryOptions(config.delivery);
   if (config.graphql !== undefined && config.graphql !== false)
@@ -22663,8 +22776,8 @@ function validateGovernanceConfig(config) {
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve12(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve12(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve13(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve13(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -22676,6 +22789,12 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     commandCapabilities: resolved.commandCapabilities ?? DEFAULT_SUPACLOUD_CONFIG.commandCapabilities,
     ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
     ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
+    ...resolved.databaseGovernance === undefined ? {} : {
+      databaseGovernance: {
+        ...resolved.databaseGovernance,
+        projectRoot: resolve13(cwd, resolved.databaseGovernance.projectRoot ?? ".")
+      }
+    },
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
     ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
     ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
@@ -22683,7 +22802,7 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     ...resolved.graphql === undefined || resolved.graphql === false ? {} : { graphql: {
       ...resolved.graphql,
-      schema: resolve12(cwd, resolved.graphql.schema)
+      schema: resolve13(cwd, resolved.graphql.schema)
     } }
   };
 }
@@ -23011,7 +23130,7 @@ function formatDeliveryPlan(result) {
 // src/delivery-build.ts
 import { mkdir as mkdir3, mkdtemp, readFile as readFile7, realpath as realpath4, rename as rename4, rm as rm2 } from "node:fs/promises";
 import { readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname9, join as join10, relative as relative10, resolve as resolve16, sep as sep10 } from "node:path";
+import { dirname as dirname9, join as join10, relative as relative10, resolve as resolve17, sep as sep10 } from "node:path";
 import * as ts16 from "@typescript/typescript6";
 
 // src/delivery-build-schema.ts
@@ -23053,7 +23172,7 @@ function renderDeliveryTarget(graph, target, options) {
 init_delivery_files2();
 import { isBuiltin } from "node:module";
 import { readFile as readFile6 } from "node:fs/promises";
-import { join as join9, resolve as resolve14 } from "node:path";
+import { join as join9, resolve as resolve15 } from "node:path";
 import * as ts15 from "@typescript/typescript6";
 
 // src/delivery-imports.ts
@@ -23230,7 +23349,7 @@ async function bundleDeliveryTarget(name, code, project, generatedDirectory, opt
 async function bundleDeliveryTargetInProcess(name, code, project, generatedDirectory, options) {
   const inputs = new Map;
   const workingDirectory = process.cwd();
-  const entry = resolve14(generatedDirectory, `delivery-${name}.ts`);
+  const entry = resolve15(generatedDirectory, `delivery-${name}.ts`);
   const entryPattern = new RegExp(`^${entry.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`);
   const result = await Bun.build({
     entrypoints: [entry],
@@ -23253,7 +23372,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
           if (args.path === entry)
             return { contents: code, loader: "ts" };
           const bytes = await readFile6(args.path);
-          inputs.set(resolve14(args.path), digest(bytes));
+          inputs.set(resolve15(args.path), digest(bytes));
           return { contents: staticDeliveryImports(args.path, bytes), loader: args.loader };
         });
       }
@@ -23263,7 +23382,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
     throw new Error("Independent bundle failed or has no dependency metadata.");
   const runtimeImports = new Set;
   for (const [path, metadata] of Object.entries(result.metafile.inputs)) {
-    if (resolve14(workingDirectory, path) !== entry && !inputs.has(resolve14(workingDirectory, path))) {
+    if (resolve15(workingDirectory, path) !== entry && !inputs.has(resolve15(workingDirectory, path))) {
       throw new Error("Bundler reported an input that was not captured by the delivery snapshot.");
     }
     for (const imported of metadata.imports) {
@@ -23602,14 +23721,14 @@ interface DeliveryWorkerHost {
 
 // src/delivery-migrations.ts
 init_delivery_files2();
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 async function prepareDeliveryMigrations(project, generatedRoot, declarations = []) {
   const entries = [];
   const files = new Map;
   const inputs = new Map;
   let totalBytes = 0;
   for (const declaration of [...declarations].sort((a, b) => BigInt(a.version) < BigInt(b.version) ? -1 : BigInt(a.version) > BigInt(b.version) ? 1 : 0)) {
-    const source = resolve15(project, declaration.source);
+    const source = resolve16(project, declaration.source);
     if (!inside(project, source) || inside(generatedRoot, source))
       throw new Error("Invalid migration source.");
     const bytes = await readBoundedOwned(project, source, 1048576);
@@ -23660,7 +23779,7 @@ async function buildDeliveryProject(options, delivery) {
     const settings = parseDeliveryOptions(delivery);
     if (typeof Bun === "undefined")
       throw new Error("Independent delivery builds require Bun.");
-    const configPath = ts16.findConfigFile(resolve16(options.rootDir), ts16.sys.fileExists);
+    const configPath = ts16.findConfigFile(resolve17(options.rootDir), ts16.sys.fileExists);
     if (!configPath)
       throw new Error("Independent delivery builds require a project tsconfig.json.");
     const lexicalProject = dirname9(configPath);
@@ -23668,11 +23787,11 @@ async function buildDeliveryProject(options, delivery) {
     const sourceRoot = await realpath4(options.rootDir);
     if (!inside(project, sourceRoot))
       throw new Error("Application sources must be inside the project.");
-    const requested = resolve16(options.outDir, "delivery");
+    const requested = resolve17(options.outDir, "delivery");
     if (!inside(lexicalProject, requested))
       throw new Error("Output must be inside the application project.");
-    const buildRoot = resolve16(project, relative10(lexicalProject, requested));
-    const generatedRoot = resolve16(project, relative10(lexicalProject, options.outDir));
+    const buildRoot = resolve17(project, relative10(lexicalProject, requested));
+    const generatedRoot = resolve17(project, relative10(lexicalProject, options.outDir));
     if (inside(generatedRoot, sourceRoot))
       throw new Error("Output must not contain the application source root.");
     const configInputs = new Map;
@@ -23680,7 +23799,7 @@ async function buildDeliveryProject(options, delivery) {
       ...ts16.sys,
       readFile(path) {
         const contents = readFileSync3(path, "utf8");
-        configInputs.set(resolve16(path), digest(contents));
+        configInputs.set(resolve17(path), digest(contents));
         return contents;
       },
       onUnRecoverableConfigFileDiagnostic() {
@@ -23718,7 +23837,7 @@ async function buildDeliveryProject(options, delivery) {
         if (!target || (kind === "worker" ? target.kind !== "jobs" : target.kind === "jobs")) {
           throw new Error("Delivery host kind does not match its target.");
         }
-        const path = resolve16(sourceRoot, app.source);
+        const path = resolve17(sourceRoot, app.source);
         if (inside(generatedRoot, path) || !/\.[cm]?ts$/.test(path))
           throw new Error("Hosts require application TypeScript source.");
         hosts.set(app.target, { path, kind, hash: digest(await readOwned(sourceRoot, path)) });
@@ -23845,7 +23964,7 @@ async function buildDeliveryProject(options, delivery) {
       }));
       const assetInputs = {};
       for (const asset of assets.filter((asset) => asset.target === target.name)) {
-        const path = resolve16(sourceRoot, asset.source);
+        const path = resolve17(sourceRoot, asset.source);
         const bytes = await readOwned(sourceRoot, path);
         const hash = digest(bytes);
         const previousHash = snapshots.get(path);
@@ -23955,19 +24074,19 @@ async function buildDeliveryProject(options, delivery) {
 
 // src/migrations.ts
 import { rename as rename5, readFile as readFile9, writeFile as writeFile4, rm as rm3 } from "node:fs/promises";
-import { relative as relative11, resolve as resolve18 } from "node:path";
+import { relative as relative11, resolve as resolve19 } from "node:path";
 import * as ts17 from "@typescript/typescript6";
 
 // src/migration-policy.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve18 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.26.0";
+var MIGRATION_APP_VERSION = "0.26.1";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.29.1";
+var MIGRATION_ELYSIA_VERSION = "0.29.2";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;
@@ -23994,7 +24113,7 @@ async function checkMigrationDependencies(rootDir) {
   const problems = [];
   for (const [name, expected] of Object.entries(migrationDependencies())) {
     try {
-      const manifest = JSON.parse(await readFile8(resolve17(rootDir, "node_modules", name, "package.json"), "utf8"));
+      const manifest = JSON.parse(await readFile8(resolve18(rootDir, "node_modules", name, "package.json"), "utf8"));
       if (!manifest || typeof manifest !== "object" || !("name" in manifest) || manifest.name !== name || !("version" in manifest) || manifest.version !== expected) {
         problems.push(`${name}: requires tested installed version ${expected}`);
       }
@@ -24109,10 +24228,10 @@ function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
   const fileExists = host.fileExists.bind(host);
   const readFile = host.readFile.bind(host);
   const currentDirectory = host.getCurrentDirectory.bind(host);
-  host.fileExists = (fileName) => sourceOverrides.has(resolve18(fileName)) || fileExists(fileName);
-  host.readFile = (fileName) => sourceOverrides.get(resolve18(fileName)) ?? readFile(fileName);
+  host.fileExists = (fileName) => sourceOverrides.has(resolve19(fileName)) || fileExists(fileName);
+  host.readFile = (fileName) => sourceOverrides.get(resolve19(fileName)) ?? readFile(fileName);
   host.getSourceFile = (fileName, languageVersion, onError, shouldCreateNewSourceFile) => {
-    const source = sourceOverrides.get(resolve18(fileName));
+    const source = sourceOverrides.get(resolve19(fileName));
     return source === undefined ? getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile) : ts17.createSourceFile(fileName, source, languageVersion, true);
   };
   host.getCurrentDirectory = () => rootDir ?? currentDirectory();
@@ -24138,7 +24257,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
     issues.push(issue);
   };
   for (const sourceFile of sourceFiles) {
-    const sourcePath = resolve18(sourceFile.fileName);
+    const sourcePath = resolve19(sourceFile.fileName);
     if (!includedFiles.has(sourcePath))
       continue;
     const visit = (node) => {
@@ -24146,7 +24265,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         const options = node.arguments[1];
         const object = options && resolveStaticObjectLiteral2(options, checker);
         if (object) {
-          const objectPath = resolve18(object.getSourceFile().fileName);
+          const objectPath = resolve19(object.getSourceFile().fileName);
           const properties = routeResponseProperties(object);
           if (properties.response) {
             if (!includedFiles.has(objectPath)) {
@@ -24189,13 +24308,13 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         line: lineOf2(sourceFile, response)
       });
     } else {
-      const replacements = replacementsByFile.get(resolve18(sourceFile.fileName)) ?? [];
+      const replacements = replacementsByFile.get(resolve19(sourceFile.fileName)) ?? [];
       replacements.push({
         start: response.getStart(sourceFile),
         end: response.getEnd(),
         text: `responses: { 200: ${response.initializer.getText(sourceFile)} }`
       });
-      replacementsByFile.set(resolve18(sourceFile.fileName), replacements);
+      replacementsByFile.set(resolve19(sourceFile.fileName), replacements);
     }
   }
   return { replacementsByFile, issues };
@@ -24208,7 +24327,7 @@ function applyReplacements(source, replacements) {
   return content;
 }
 function migrateRouteResponse(source, fileName) {
-  const absoluteFile = resolve18(fileName);
+  const absoluteFile = resolve19(fileName);
   const sourceOverrides = new Map([[absoluteFile, source]]);
   const program = createMigrationProgram([absoluteFile], sourceOverrides);
   const sourceFile = program.getSourceFile(absoluteFile);
@@ -24224,7 +24343,7 @@ function migrateRouteResponse(source, fileName) {
       }]
     };
   }
-  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve18("."), new Set([absoluteFile]));
+  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve19("."), new Set([absoluteFile]));
   const replacements = plan.replacementsByFile.get(absoluteFile) ?? [];
   return {
     changed: replacements.length > 0,
@@ -24234,7 +24353,7 @@ function migrateRouteResponse(source, fileName) {
   };
 }
 function migrateRouteResponseProject(files, rootDir, sourceByPath) {
-  const absoluteFiles = files.map((file) => resolve18(file));
+  const absoluteFiles = files.map((file) => resolve19(file));
   const program = createMigrationProgram(absoluteFiles, sourceByPath, rootDir);
   const sourceFiles = absoluteFiles.map((file) => program.getSourceFile(file)).filter((file) => file !== undefined);
   const plan = planRouteResponseMigration(sourceFiles, program.getTypeChecker(), rootDir, new Set(absoluteFiles));
@@ -24247,11 +24366,11 @@ function migrateRouteResponseProject(files, rootDir, sourceByPath) {
       changed: replacements.length > 0,
       content: applyReplacements(source, replacements),
       replacements: replacements.length,
-      issues: plan.issues.filter((issue) => resolve18(rootDir, issue.file) === file)
+      issues: plan.issues.filter((issue) => resolve19(rootDir, issue.file) === file)
     });
   }
   for (const issue of plan.issues) {
-    const path = resolve18(rootDir, issue.file);
+    const path = resolve19(rootDir, issue.file);
     if (!results.has(path) && sourceByPath.has(path)) {
       results.set(path, {
         changed: false,
@@ -24289,7 +24408,7 @@ async function writeAtomically(path, content) {
   }
 }
 async function migrateProject(options) {
-  const rootDir = resolve18(options.rootDir);
+  const rootDir = resolve19(options.rootDir);
   let migrations = SUPACLOUD_MIGRATIONS;
   const preflightIssues = [];
   if (options.fromVersion !== undefined || options.toVersion !== undefined) {
@@ -24345,7 +24464,7 @@ async function migrateProject(options) {
     }
   };
   for (const filePath of files) {
-    sourceByPath.set(resolve18(filePath), await readFile9(filePath, "utf8"));
+    sourceByPath.set(resolve19(filePath), await readFile9(filePath, "utf8"));
   }
   const originalSources = new Map(sourceByPath);
   const writtenFiles = new Set;
@@ -24354,7 +24473,7 @@ async function migrateProject(options) {
     if (projectResults)
       appendIssues(projectResults.issues);
     for (const filePath of files) {
-      const absoluteFile = resolve18(filePath);
+      const absoluteFile = resolve19(filePath);
       const file = relative11(rootDir, absoluteFile) || absoluteFile;
       const before = sourceByPath.get(absoluteFile);
       if (before === undefined)
@@ -24416,11 +24535,11 @@ async function migrateProject(options) {
 // src/migration-assess.ts
 import { createHash as createHash11 } from "node:crypto";
 import { readFile as readFile11 } from "node:fs/promises";
-import { join as join11, resolve as resolve20 } from "node:path";
+import { join as join11, resolve as resolve21 } from "node:path";
 
 // src/openapi-tools.ts
 import { mkdir as mkdir4, readFile as readFile10, rename as rename6, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve19 } from "node:path";
+import { dirname as dirname10, resolve as resolve20 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 class OpenApiDocumentError extends Error {
@@ -24811,7 +24930,7 @@ function serializeOpenApiJson(document, space = 2) {
 }
 async function readOpenApiJson(path) {
   try {
-    const value = JSON.parse(await readFile10(resolve19(path), "utf8"));
+    const value = JSON.parse(await readFile10(resolve20(path), "utf8"));
     return parseOpenApiDocument(value);
   } catch (error) {
     if (error instanceof OpenApiDocumentError)
@@ -24820,7 +24939,7 @@ async function readOpenApiJson(path) {
   }
 }
 async function writeOpenApiJson(document, outputPath, space = 2) {
-  const path = resolve19(outputPath);
+  const path = resolve20(outputPath);
   const content = serializeOpenApiJson(document, space);
   await mkdir4(dirname10(path), { recursive: true });
   try {
@@ -24841,7 +24960,7 @@ async function writeOpenApiJson(document, outputPath, space = 2) {
 }
 async function loadGeneratedOpenApiDocument(modulePath) {
   try {
-    const moduleUrl = pathToFileURL2(resolve19(modulePath));
+    const moduleUrl = pathToFileURL2(resolve20(modulePath));
     moduleUrl.searchParams.set("supacloud-openapi-export", "1");
     const loaded = await import(moduleUrl.href);
     if (!isRecord(loaded))
@@ -24937,18 +25056,18 @@ function isRecord2(value) {
 function arrayLength(value) {
   return Array.isArray(value) ? value.length : undefined;
 }
-async function sha2563(path) {
+async function sha2564(path) {
   return createHash11("sha256").update(await readFile11(path)).digest("hex");
 }
 function overallStatus(findings) {
   return findings.reduce((current, finding) => STATUS_PRIORITY[finding.status] > STATUS_PRIORITY[current] ? finding.status : current, "compatible");
 }
 async function assessMigration(options) {
-  const projectDir = resolve20(options.projectDir);
+  const projectDir = resolve21(options.projectDir);
   const compile = {
     ...options.compile,
-    rootDir: resolve20(options.compile.rootDir),
-    outDir: resolve20(options.compile.outDir)
+    rootDir: resolve21(options.compile.rootDir),
+    outDir: resolve21(options.compile.outDir)
   };
   const findings = [];
   const dependencyProblems = await checkMigrationDependencies(projectDir);
@@ -25014,7 +25133,7 @@ async function assessMigration(options) {
     contractsManifest = {
       path: contractsManifestPath,
       present: true,
-      sha256: await sha2563(contractsManifestPath),
+      sha256: await sha2564(contractsManifestPath),
       version: 1,
       ...commands === undefined ? {} : { commands },
       ...routes === undefined ? {} : { routes },
@@ -25031,15 +25150,15 @@ async function assessMigration(options) {
   }
   let openApi;
   if (options.baselineOpenApiPath && options.currentOpenApiPath) {
-    const baselinePath = resolve20(projectDir, options.baselineOpenApiPath);
-    const currentPath = resolve20(projectDir, options.currentOpenApiPath);
+    const baselinePath = resolve21(projectDir, options.baselineOpenApiPath);
+    const currentPath = resolve21(projectDir, options.currentOpenApiPath);
     try {
       const diff = diffOpenApiDocuments(await readOpenApiJson(baselinePath), await readOpenApiJson(currentPath));
       openApi = {
         baselinePath,
-        baselineSha256: await sha2563(baselinePath),
+        baselineSha256: await sha2564(baselinePath),
         currentPath,
-        currentSha256: await sha2563(currentPath),
+        currentSha256: await sha2564(currentPath),
         diff
       };
       if (!diff.ok) {
@@ -25115,7 +25234,7 @@ function formatMigrationAssessment(result) {
 // src/graphql-governance.ts
 init_graphql_schema_hashes();
 import { readFile as readFile12 } from "node:fs/promises";
-import { resolve as resolve21 } from "node:path";
+import { resolve as resolve22 } from "node:path";
 import {
   buildClientSchema as buildClientSchema2,
   buildSchema as buildSchema2,
@@ -25135,7 +25254,7 @@ function schemaFromSource(source, path = "schema.graphql") {
   return buildSchema2(source);
 }
 async function readGraphqlSchema(path) {
-  const absolute = resolve21(path);
+  const absolute = resolve22(path);
   const source = await readFile12(absolute, "utf8");
   const hashes = graphqlSchemaHashes(source);
   return { path: absolute, source, schema: schemaFromSource(source, absolute), ...hashes };
@@ -25495,11 +25614,11 @@ async function runGraphqlGovernanceCommand(args) {
     if (!schemaPath || documentPaths.length === 0)
       throw new Error("graphql compatibility requires --schema and at least one --documents");
     const schema = await readGraphqlSchema(schemaPath);
-    const documents = await Promise.all(documentPaths.map(async (path) => ({ path, source: await readFile15(resolve25(path), "utf8") })));
+    const documents = await Promise.all(documentPaths.map(async (path) => ({ path, source: await readFile15(resolve26(path), "utf8") })));
     let policy = {};
     const policyPath = one("--policy");
     if (policyPath)
-      policy = JSON.parse(await readFile15(resolve25(policyPath), "utf8"));
+      policy = JSON.parse(await readFile15(resolve26(policyPath), "utf8"));
     const report = checkGraphqlCompatibility(schema.schema, documents, policy);
     const result = {
       ok: report.ok,
@@ -25535,7 +25654,7 @@ async function runGraphqlGovernanceCommand(args) {
         throw new Error("--role must use name=schema");
       const role = value.slice(0, separator);
       const path = value.slice(separator + 1);
-      return { role, path, source: await readFile15(resolve25(path), "utf8") };
+      return { role, path, source: await readFile15(resolve26(path), "utf8") };
     }));
     const result = createRoleSnapshotReport(roles);
     console.log(JSON.stringify(result, null, 2));
@@ -25805,7 +25924,7 @@ async function run() {
       throw new Error("Build context requires a manifest, target, subject, events, request ID and --json");
     }
     try {
-      const pack = await createDeliveryExecutionContextPack(contextManifest, contextTarget, query, await readExecutionMetadata(resolve25(executionEventsPath)), executionRequestId);
+      const pack = await createDeliveryExecutionContextPack(contextManifest, contextTarget, query, await readExecutionMetadata(resolve26(executionEventsPath)), executionRequestId);
       console.log(JSON.stringify(pack, null, 2));
     } catch (error) {
       console.log(JSON.stringify({
@@ -25824,7 +25943,7 @@ async function run() {
     const currentPath = openApiDiffPaths[1];
     if (!basePath || !currentPath)
       throw new Error("openapi-diff requires two JSON file paths");
-    const result = diffOpenApiDocuments(await readOpenApiJson(resolve25(process.cwd(), basePath)), await readOpenApiJson(resolve25(process.cwd(), currentPath)));
+    const result = diffOpenApiDocuments(await readOpenApiJson(resolve26(process.cwd(), basePath)), await readOpenApiJson(resolve26(process.cwd(), currentPath)));
     console.log(json ? JSON.stringify(result, null, 2) : formatOpenApiDiff(result));
     if (!result.ok)
       process.exitCode = 1;
@@ -25839,8 +25958,8 @@ async function run() {
     if (!modulePath || !outputPath)
       throw new Error("openapi-export requires an OpenAPI module and output path");
     const result = await exportGeneratedOpenApiJson({
-      modulePath: resolve25(process.cwd(), modulePath),
-      outputPath: resolve25(process.cwd(), outputPath),
+      modulePath: resolve26(process.cwd(), modulePath),
+      outputPath: resolve26(process.cwd(), outputPath),
       ...openApiExportSpace === undefined ? {} : { space: openApiExportSpace }
     });
     console.log(json ? JSON.stringify({ ok: true, ...result }, null, 2) : result.written ? `OpenAPI JSON written: ${result.path}` : `OpenAPI JSON matches: ${result.path}`);
@@ -25848,7 +25967,7 @@ async function run() {
   }
   if (command === "migrate") {
     const result = await migrateProject({
-      rootDir: rootDir ? resolve25(process.cwd(), rootDir) : process.cwd(),
+      rootDir: rootDir ? resolve26(process.cwd(), rootDir) : process.cwd(),
       write: !dryRun,
       ...fromVersion === undefined ? {} : { fromVersion },
       ...toVersion === undefined ? {} : { toVersion }
@@ -25886,8 +26005,8 @@ async function run() {
   if (checkSchema && command !== "graphql-schema")
     throw new Error("--check is only supported by graphql-schema");
   const defaults = resolveSupacloudConfig(loadedConfig, process.cwd());
-  const resolvedRoot = rootDir ? resolve25(process.cwd(), rootDir) : defaults.rootDir;
-  const resolvedOut = outDir ? resolve25(process.cwd(), outDir) : defaults.outDir;
+  const resolvedRoot = rootDir ? resolve26(process.cwd(), rootDir) : defaults.rootDir;
+  const resolvedOut = outDir ? resolve26(process.cwd(), outDir) : defaults.outDir;
   const configured = compileOptionsFromConfig({
     ...loadedConfig,
     root: resolvedRoot,
@@ -25906,7 +26025,7 @@ async function run() {
     let delivery = loadedConfig.delivery;
     if (deliveryPath !== undefined) {
       try {
-        delivery = JSON.parse(await readFile15(resolve25(process.cwd(), deliveryPath), "utf8"));
+        delivery = JSON.parse(await readFile15(resolve26(process.cwd(), deliveryPath), "utf8"));
       } catch {
         throw new DeliveryConfigurationError;
       }
@@ -25964,7 +26083,7 @@ ${item.suggestion ?? ""}`).join(`
   } else if (command === "fix") {
     if (!query)
       throw new Error("fix requires a JSON file containing one DiagnosticFix");
-    const input = JSON.parse(await readFile15(resolve25(process.cwd(), query), "utf8"));
+    const input = JSON.parse(await readFile15(resolve26(process.cwd(), query), "utf8"));
     const envelope = input && typeof input === "object" && "fix" in input;
     if (envelope && (typeof input.expectedSourceHash !== "string" || !/^[a-f0-9]{64}$/.test(input.expectedSourceHash))) {
       throw new Error("Editor fix requires the source hash from its validated preview");
@@ -26105,7 +26224,7 @@ Source change detected; compiling...`);
       process.exitCode = 1;
       return;
     }
-    const file = resolve25(rootDir ? resolve25(process.cwd(), rootDir) : process.cwd(), bindingsFile ?? "supacloud.environments.json");
+    const file = resolve26(rootDir ? resolve26(process.cwd(), rootDir) : process.cwd(), bindingsFile ?? "supacloud.environments.json");
     try {
       const document = await readEnvironmentBindingsFile(file);
       const graph = await analyzeProject(resolvedRoot);
@@ -26140,7 +26259,7 @@ Source change detected; compiling...`);
     try {
       const result = await checkProject(compileDefaults);
       if (executionEventsPath && executionRequestId) {
-        const pack = createExecutionContextPack({ ...result.graph, diagnostics: result.diagnostics }, query, await readExecutionMetadata(resolve25(process.cwd(), executionEventsPath)), executionRequestId);
+        const pack = createExecutionContextPack({ ...result.graph, diagnostics: result.diagnostics }, query, await readExecutionMetadata(resolve26(process.cwd(), executionEventsPath)), executionRequestId);
         console.log(JSON.stringify(pack, null, 2));
         return;
       }