@supacloud/compiler 0.44.0 → 0.45.0

package/dist/index.js

@@ -4095,7 +4095,7 @@ var init_graphql_options = __esm(() => {
 });
 
 // src/graphql-inputs.ts
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 import * as ts11 from "@typescript/typescript6";
 function graphqlInputPaths(options) {
   if (!options.graphql)
@@ -4105,9 +4105,9 @@ function graphqlInputPaths(options) {
   } catch {
     return [];
   }
-  const root = resolve5(options.rootDir);
-  const schema = resolve5(root, options.graphql.schema);
-  const documents = ts11.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve5(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve5(path)).filter((path) => path !== schema);
+  const root = resolve6(options.rootDir);
+  const schema = resolve6(root, options.graphql.schema);
+  const documents = ts11.sys.readDirectory(root, [".graphql", ".gql"], ["**/node_modules/**", "**/.git/**", resolve6(options.outDir)], options.graphql.documents ?? ["**/*.graphql", "**/*.gql"]).map((path) => resolve6(path)).filter((path) => path !== schema);
   return [schema, ...[...new Set(documents)].sort()];
 }
 var init_graphql_inputs = __esm(() => {
@@ -4116,9 +4116,9 @@ var init_graphql_inputs = __esm(() => {
 
 // src/graphql-runtime.ts
 import * as ts12 from "@typescript/typescript6";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function renderGraphqlValidators(source, operationNames, operationKinds = new Map) {
-  const fileName = resolve6("/__supacloud_graphql__/contracts.ts");
+  const fileName = resolve7("/__supacloud_graphql__/contracts.ts");
   const options = {
     strict: true,
     noUncheckedIndexedAccess: true,
@@ -4134,7 +4134,7 @@ function renderGraphqlValidators(source, operationNames, operationKinds = new Ma
   };
   const host = ts12.createCompilerHost(options);
   const getSourceFile = host.getSourceFile.bind(host);
-  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve6(path) === fileName ? ts12.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
+  host.getSourceFile = (path, languageVersion, onError, shouldCreateNewSourceFile) => resolve7(path) === fileName ? ts12.createSourceFile(path, source, languageVersion, true) : getSourceFile(path, languageVersion, onError, shouldCreateNewSourceFile);
   const program = ts12.createProgram([fileName], options, host);
   const diagnostics = ts12.getPreEmitDiagnostics(program);
   if (diagnostics.length) {
@@ -12868,7 +12868,7 @@ function FromObject10(context, type, value) {
     return value;
   const additionalProperties = GetAdditionalProperties(type);
   for (const key of Keys(value)) {
-    if (HasPropertyKey(type.properties, key)) {
+    if (HasPropertyKey(type.properties, key) && IsSchema(type.properties[key])) {
       value[key] = FromType19(context, type.properties[key], value[key]);
       continue;
     }
@@ -13000,6 +13000,9 @@ function FromProperties4(properties) {
     result[key] = FromType20(properties[key]);
   return result;
 }
+function FromRecordKey(type) {
+  return String2({ pattern: RecordPattern(type) });
+}
 function FromPriorityTypes(types) {
   return FromTypes6(Priority(types));
 }
@@ -13007,7 +13010,7 @@ function FromTypes6(types) {
   return types.map((type) => FromType20(type));
 }
 function FromType20(type) {
-  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(RecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
+  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(FromRecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
   return Modifiers(type, next);
 }
 function UnionPrioritySort(type) {
@@ -13023,6 +13026,7 @@ var init_union_priority_sort = __esm(() => {
   init_type3();
   init_type3();
   init_type3();
+  init_type3();
 });
 
 // node_modules/typebox/build/value/clean/clean.mjs
@@ -14712,7 +14716,7 @@ var init_delivery_schema = __esm(() => {
 import { createHash as createHash8 } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, mkdir as mkdir2, open, readFile as readFile3, readdir, realpath, rename as rename2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute, join as join5, relative as relative5, resolve as resolve8, sep as sep5 } from "node:path";
+import { dirname as dirname4, isAbsolute, join as join5, relative as relative5, resolve as resolve9, sep as sep5 } from "node:path";
 function canonical2(value) {
   return JSON.stringify(value, (_key, item) => item !== null && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : item);
 }
@@ -14775,7 +14779,7 @@ async function reserveOutput(project, requested) {
   if (!inside(project, requested))
     throw new Error("Delivery output must be inside the application project.");
   const base = await realpath(project);
-  const path = resolve8(base, relative5(project, requested));
+  const path = resolve9(base, relative5(project, requested));
   if (relative5(base, path).split(sep5).some((part) => part === ".git" || part === "node_modules")) {
     throw new Error("Delivery output cannot use repository or dependency internals.");
   }
@@ -15864,9 +15868,9 @@ var init_delivery_files2 = __esm(() => {
 
 // node_modules/@supacloud/delivery/src/delivery-artifact.ts
 import { readdir as readdir2, realpath as realpath2 } from "node:fs/promises";
-import { basename, dirname as dirname6, join as join8, resolve as resolve10 } from "node:path";
+import { basename, dirname as dirname6, join as join8, resolve as resolve11 } from "node:path";
 async function readDeliveryManifest(manifestPath) {
-  const selected = resolve10(manifestPath);
+  const selected = resolve11(manifestPath);
   const root = await realpath2(dirname6(selected));
   const manifest = parseDeliveryBuildManifest(JSON.parse((await readBoundedOwned(root, join8(root, basename(selected)), JSON_LIMIT)).toString("utf8")));
   return { root, manifest };
@@ -16105,37 +16109,67 @@ var init_application_deploy_plan = __esm(() => {
   }, { additionalProperties: false });
 });
 
-// node_modules/@supacloud/delivery/src/application-release-operation.ts
-var closed6, nullableActivation, ApplicationReleaseRequestSchema, ApplicationReleaseResultSchema;
-var init_application_release_operation = __esm(() => {
+// node_modules/@supacloud/delivery/src/application-deploy-operation.ts
+var closed6, sha256, nullableActivation, ApplicationDeployWebReleaseSchema, ApplicationDeployRequestSchema, ApplicationBackendReceiptSchema, ApplicationDeployResultSchema;
+var init_application_deploy_operation = __esm(() => {
   init_build();
   init_value2();
   init_application_activation();
   init_application_configuration();
   init_application_release();
   closed6 = { additionalProperties: false };
+  sha256 = ApplicationReleaseIdSchema;
   nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
-  ApplicationReleaseRequestSchema = _Object_({
-    release_id: ApplicationReleaseIdSchema,
+  ApplicationDeployWebReleaseSchema = _Object_({
+    deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+    release_id: sha256
+  }, closed6);
+  ApplicationDeployRequestSchema = _Object_({
+    mutation_id: ApplicationActivationIdSchema,
+    release_id: sha256,
     configuration_id: Optional(ApplicationConfigurationIdSchema),
     configuration_write: Optional(ApplicationConfigurationWriteSchema),
-    activation_id: Optional(ApplicationActivationIdSchema),
-    expected_activation_id: Optional(nullableActivation),
-    expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+    expected_plan_sha256: Optional(sha256),
+    approved_migration_digest: Optional(sha256),
+    web_release: Optional(ApplicationDeployWebReleaseSchema)
   }, closed6);
-  ApplicationReleaseResultSchema = _Object_({
-    schema: Literal("supacloud.application-release.v1"),
+  ApplicationBackendReceiptSchema = _Object_({
+    schema: Literal("supacloud.application-backend-receipt.v1"),
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema,
-    release_id: ApplicationReleaseIdSchema,
+    release_id: sha256,
+    manifest_sha256: sha256,
+    mutation_id: ApplicationActivationIdSchema,
+    plan_sha256: sha256,
+    backup_id: Union([String2(), Null()]),
+    before_ledger_digest: sha256,
+    after_ledger_digest: sha256,
+    applied_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { uniqueItems: true }),
+    schema_reloaded: Boolean2(),
+    postgrest_healthy: Boolean2()
+  }, closed6);
+  ApplicationDeployResultSchema = _Object_({
+    schema: Literal("supacloud.application-deploy.v1"),
+    project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+    application_id: ApplicationIdSchema,
+    environment_id: ApplicationIdSchema,
+    mutation_id: ApplicationActivationIdSchema,
+    release_id: sha256,
     configuration_id: ApplicationConfigurationIdSchema,
     activation_id: ApplicationActivationIdSchema,
     expected_activation_id: nullableActivation,
-    plan_sha256: ApplicationReleaseIdSchema,
+    plan_sha256: sha256,
     action: Union([Literal("activate"), Literal("no-op")]),
     replayed: Boolean2(),
-    execution_performed: Boolean2()
+    execution_performed: Boolean2(),
+    backend_receipt: ApplicationBackendReceiptSchema,
+    web: Optional(_Object_({
+      deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+      release_id: sha256,
+      activation_id: ApplicationActivationIdSchema,
+      replayed: Boolean2()
+    }, closed6))
   }, closed6);
 });
 
@@ -16291,14 +16325,14 @@ var init_application_release_transfer = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed8, sha256, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
+var closed8, sha2562, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
 var init_deployment_evidence = __esm(() => {
   init_build();
   init_value2();
   init_application_configuration();
   init_application_release();
   closed8 = { additionalProperties: false };
-  sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
+  sha2562 = String2({ pattern: "^[a-f0-9]{64}$" });
   isoDate = String2({ minLength: 20, maxLength: 40 });
   status = Union([
     Literal("confirmed"),
@@ -16317,7 +16351,7 @@ var init_deployment_evidence = __esm(() => {
     topology: Union([Literal("single-node"), Literal("distributed")]),
     migration: _Object_({
       status,
-      inventory_sha256: Union([sha256, Null()]),
+      inventory_sha256: Union([sha2562, Null()]),
       compatibility: Union([
         Literal("verified"),
         Literal("not-proven"),
@@ -16365,9 +16399,9 @@ var init_deployment_evidence = __esm(() => {
     }, closed8),
     source: _Object_({
       commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
-      manifest_sha256: sha256,
+      manifest_sha256: sha2562,
       contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
-      environment_binding_version: Union([sha256, Null()])
+      environment_binding_version: Union([sha2562, Null()])
     }, closed8),
     database: DatabaseProviderSchema,
     components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
@@ -16392,7 +16426,7 @@ var init_deployment_evidence = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed9, projectRef2, sha2562, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
+var closed9, projectRef2, sha2563, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
 var init_application_promotion = __esm(() => {
   init_build();
   init_value2();
@@ -16402,9 +16436,9 @@ var init_application_promotion = __esm(() => {
   init_application_release();
   closed9 = { additionalProperties: false };
   projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-  sha2562 = ApplicationReleaseIdSchema;
+  sha2563 = ApplicationReleaseIdSchema;
   nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-  nullableDigest = Union([sha2562, Null()]);
+  nullableDigest = Union([sha2563, Null()]);
   observation = {
     activation_id: nullableActivation2,
     receipt_confirmed: Boolean2(),
@@ -16430,24 +16464,24 @@ var init_application_promotion = __esm(() => {
     project_ref: projectRef2,
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema,
-    manifest_sha256: sha2562,
-    plan_sha256: sha2562,
+    manifest_sha256: sha2563,
+    plan_sha256: sha2563,
     source: _Object_({
       project_ref: projectRef2,
       environment_id: ApplicationIdSchema,
-      release_id: sha2562,
+      release_id: sha2563,
       ...observation
     }, closed9),
     target: _Object_({
-      candidate_release_id: sha2562,
-      current_release_id: Union([sha2562, Null()]),
+      candidate_release_id: sha2563,
+      current_release_id: Union([sha2563, Null()]),
       artifact_action: Union([Literal("materialize"), Literal("reuse")]),
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
       configuration: Union([ApplicationConfigurationViewSchema, Null()]),
       ...observation
     }, closed9),
     migrations: _Object_({
-      ledger_digest: sha2562,
+      ledger_digest: sha2563,
       ledger_compatible: Boolean2(),
       project_migrations_applied: Boolean2(),
       pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
@@ -16590,7 +16624,7 @@ var init_src = __esm(() => {
   init_worker_execution();
   init_application_activation();
   init_application_deploy_plan();
-  init_application_release_operation();
+  init_application_deploy_operation();
   init_application_history();
   init_application_release();
   init_application_preview();
@@ -16612,13 +16646,13 @@ var init_delivery_migration_archive2 = __esm(() => {
 // src/fixes.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { lstat as lstat2, readFile as readFile6, realpath as realpath4, rename as rename4, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute3, relative as relative8, resolve as resolve13, sep as sep8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute3, relative as relative8, resolve as resolve14, sep as sep8 } from "node:path";
 import * as ts16 from "@typescript/typescript6";
 async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
   const root = await realpath4(options.rootDir ?? process.cwd());
-  const file = resolve13(root, fix.targetFile);
+  const file = resolve14(root, fix.targetFile);
   const stat = await lstat2(file);
   const resolved = await realpath4(file);
   const relativePath = relative8(root, resolved);
@@ -16793,8 +16827,8 @@ function moduleObjects(source) {
 }
 function importSymbol(source, path, symbol) {
   identifier2(symbol);
-  const current = resolve13(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
-  const target = resolve13(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
+  const current = resolve14(source.fileName).replace(/\.(tsx?|mts|cts)$/, "");
+  const target = resolve14(dirname8(source.fileName), path).replace(/\.(tsx?|mts|cts)$/, "");
   if (current === target)
     return source.text;
   const matches = source.statements.filter((item) => ts16.isImportDeclaration(item) && ts16.isStringLiteral(item.moduleSpecifier) && item.moduleSpecifier.text === path);
@@ -17271,7 +17305,7 @@ var init_release_evidence = __esm(() => {
 
 // src/graphql-schema.ts
 import { mkdir as mkdir5, readFile as readFile12 } from "node:fs/promises";
-import { dirname as dirname11, resolve as resolve21 } from "node:path";
+import { dirname as dirname11, resolve as resolve22 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -17311,7 +17345,7 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema(data));
-  const path = resolve21(options.output);
+  const path = resolve22(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
@@ -17341,7 +17375,7 @@ var init_graphql_schema = __esm(() => {
 // src/database-contracts.ts
 import { createHash as createHash12 } from "node:crypto";
 import { mkdir as mkdir6, readFile as readFile14 } from "node:fs/promises";
-import { dirname as dirname12, relative as relative12, resolve as resolve23 } from "node:path";
+import { dirname as dirname12, relative as relative12, resolve as resolve24 } from "node:path";
 import * as ts18 from "@typescript/typescript6";
 function hash3(value) {
   return createHash12("sha256").update(value).digest("hex");
@@ -17369,18 +17403,18 @@ function parseDatabaseContractsOptions(value, directory) {
     throw new TypeError("migrations must be an ordered list of SQL files");
   }
   return {
-    rootDir: resolve23(directory, field("rootDir")),
-    outDir: resolve23(directory, field("outDir")),
-    postgrestTypes: resolve23(directory, field("postgrestTypes")),
-    drizzleSchema: resolve23(directory, field("drizzleSchema")),
+    rootDir: resolve24(directory, field("rootDir")),
+    outDir: resolve24(directory, field("outDir")),
+    postgrestTypes: resolve24(directory, field("postgrestTypes")),
+    drizzleSchema: resolve24(directory, field("drizzleSchema")),
     role: field("role"),
-    graphql: { ...graphql, schema: resolve23(directory, graphql.schema) },
-    migrations: migrations.map((file) => resolve23(directory, file))
+    graphql: { ...graphql, schema: resolve24(directory, graphql.schema) },
+    migrations: migrations.map((file) => resolve24(directory, file))
   };
 }
 async function generateDatabaseContracts(options, check = false) {
-  const rootDir = resolve23(options.rootDir), outDir = resolve23(options.outDir);
-  const postgrestTypes = resolve23(rootDir, options.postgrestTypes), drizzleSchema = resolve23(rootDir, options.drizzleSchema);
+  const rootDir = resolve24(options.rootDir), outDir = resolve24(options.outDir);
+  const postgrestTypes = resolve24(rootDir, options.postgrestTypes), drizzleSchema = resolve24(rootDir, options.drizzleSchema);
   const snapshot = await readFile14(postgrestTypes, "utf8");
   const syntax = ts18.createSourceFile(postgrestTypes, snapshot, ts18.ScriptTarget.Latest, true);
   const database = syntax.statements.find((node) => (ts18.isTypeAliasDeclaration(node) || ts18.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts18.SyntaxKind.ExportKeyword));
@@ -17408,7 +17442,7 @@ async function generateDatabaseContracts(options, check = false) {
   }
   const inputs = {};
   const addInput = async (path) => {
-    const absolute = resolve23(rootDir, path);
+    const absolute = resolve24(rootDir, path);
     inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash3(await readFile14(absolute, "utf8"));
   };
   await addInput(postgrestTypes);
@@ -17425,8 +17459,8 @@ async function generateDatabaseContracts(options, check = false) {
     if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
       await addInput(source.fileName);
   }
-  await addInput(resolve23(rootDir, options.graphql.schema));
-  if (new Set(options.migrations.map((path) => resolve23(rootDir, path))).size !== options.migrations.length) {
+  await addInput(resolve24(rootDir, options.graphql.schema));
+  if (new Set(options.migrations.map((path) => resolve24(rootDir, path))).size !== options.migrations.length) {
     throw new Error("Duplicate migration in database contracts configuration");
   }
   for (const path of options.migrations)
@@ -17447,14 +17481,14 @@ async function generateDatabaseContracts(options, check = false) {
     version: 1,
     role: options.role,
     inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => a.localeCompare(b))),
-    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve23(rootDir, path)).replaceAll("\\", "/")),
+    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve24(rootDir, path)).replaceAll("\\", "/")),
     outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash3(text)]))
   };
   files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
 `;
   const mismatches = [];
   for (const [file, content] of Object.entries(files)) {
-    const path = resolve23(outDir, file);
+    const path = resolve24(outDir, file);
     let current;
     try {
       current = await readFile14(path, "utf8");
@@ -17468,12 +17502,12 @@ async function generateDatabaseContracts(options, check = false) {
   if (!check) {
     await mkdir6(outDir, { recursive: true });
     for (const [file, content] of Object.entries(files))
-      await writeFileIfChanged(resolve23(outDir, file), content);
+      await writeFileIfChanged(resolve24(outDir, file), content);
   }
   return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
 }
 async function runDatabaseContractsFile(path, check = false) {
-  const absolute = resolve23(path);
+  const absolute = resolve24(path);
   const value = JSON.parse(await readFile14(absolute, "utf8"));
   return generateDatabaseContracts(parseDatabaseContractsOptions(value, dirname12(absolute)), check);
 }
@@ -21627,6 +21661,52 @@ function validateEffectPolicies(graph, options = {}) {
   return diagnostics;
 }
 
+// src/database-governance.ts
+import { execFile } from "node:child_process";
+import { resolve as resolve5 } from "node:path";
+import { fileURLToPath } from "node:url";
+function assertDatabaseGovernance(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid databaseGovernance configuration.");
+  const entry = value;
+  if (entry["mode"] !== "off" && entry["mode"] !== "check" && entry["mode"] !== "enforce" || Object.keys(entry).some((key) => !["mode", "projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv", "schemas"].includes(key)) || ["projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv"].some((key) => entry[key] !== undefined && (typeof entry[key] !== "string" || !entry[key].trim())) || entry["databaseUrlEnv"] !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(entry["databaseUrlEnv"])) || entry["schemas"] !== undefined && (!Array.isArray(entry["schemas"]) || !entry["schemas"].length || !entry["schemas"].every((schema) => typeof schema === "string" && schema.trim()))) {
+    throw new Error("Invalid databaseGovernance mode, paths, connection or schemas.");
+  }
+}
+async function checkDatabaseGovernance(rootDir, value) {
+  if (value === undefined)
+    return [];
+  const failure = () => [{
+    severity: "error",
+    code: "database-governance",
+    message: "Database governance could not be verified. Check configuration, installed @supacloud/db, Bun and read-only database access."
+  }];
+  try {
+    assertDatabaseGovernance(value);
+    if (value.mode === "off")
+      return [];
+    const options = { ...value, projectRoot: resolve5(rootDir, value.projectRoot ?? ".") };
+    const worker = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "./database-governance-worker.ts" : "./database-governance-worker.js", import.meta.url));
+    const output = await new Promise((accept, reject) => {
+      const child = execFile(process.versions.bun ? process.execPath : "bun", ["--no-env-file", worker], { timeout: 30000, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 }, (error, stdout) => error ? reject(error) : accept(stdout));
+      child.stdin?.on("error", reject);
+      child.stdin?.end(JSON.stringify(options));
+    });
+    const report = JSON.parse(output);
+    if (!report || typeof report !== "object" || !("diagnostics" in report) || !Array.isArray(report.diagnostics))
+      return failure();
+    const diagnostics = [];
+    for (const item of report.diagnostics) {
+      if (!item || typeof item !== "object" || !("code" in item) || typeof item.code !== "string" || !item.code.startsWith("database-") || !("message" in item) || typeof item.message !== "string" || !("severity" in item) || item.severity !== "error")
+        return failure();
+      diagnostics.push({ severity: "error", code: item.code, message: item.message });
+    }
+    return diagnostics;
+  } catch {
+    return failure();
+  }
+}
+
 // src/compile.ts
 function withDefaultGovernance(options) {
   return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
@@ -21649,6 +21729,10 @@ async function compileProject(options) {
     ...validateClientSchemaBoundaries(graph, options),
     ...validateEffectPolicies(graph, options.effect)
   ];
+  const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
+  diagnostics.push(...databaseDiagnostics);
+  if (databaseDiagnostics.length)
+    return { diagnostics, graph, written: [] };
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, written: [] };
   }
@@ -21715,6 +21799,11 @@ async function checkProject(options) {
     ...validateClientSchemaBoundaries(graph, options),
     ...validateEffectPolicies(graph, options.effect)
   ];
+  const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
+  diagnostics.push(...databaseDiagnostics);
+  if (databaseDiagnostics.length) {
+    return { diagnostics, graph, upToDate: false, mismatches: ["Database governance verification failed."] };
+  }
   if (diagnostics.some((item) => item.code === "runtime-injection-disallowed")) {
     return { diagnostics, graph, upToDate: false, mismatches: ["Runtime DI must be migrated to constructor injection."] };
   }
@@ -22041,7 +22130,7 @@ function formatDeliveryPlan(result) {
 // src/delivery-build.ts
 import { mkdir as mkdir3, mkdtemp, readFile as readFile5, realpath as realpath3, rename as rename3, rm as rm2 } from "node:fs/promises";
 import { readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname7, join as join9, relative as relative7, resolve as resolve12, sep as sep7 } from "node:path";
+import { dirname as dirname7, join as join9, relative as relative7, resolve as resolve13, sep as sep7 } from "node:path";
 import * as ts15 from "@typescript/typescript6";
 
 // src/delivery-build-schema.ts
@@ -22083,7 +22172,7 @@ function renderDeliveryTarget(graph, target, options) {
 init_delivery_files2();
 import { isBuiltin } from "node:module";
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join7, resolve as resolve9 } from "node:path";
+import { join as join7, resolve as resolve10 } from "node:path";
 import * as ts14 from "@typescript/typescript6";
 
 // src/delivery-imports.ts
@@ -22260,7 +22349,7 @@ async function bundleDeliveryTarget(name, code, project, generatedDirectory, opt
 async function bundleDeliveryTargetInProcess(name, code, project, generatedDirectory, options) {
   const inputs = new Map;
   const workingDirectory = process.cwd();
-  const entry = resolve9(generatedDirectory, `delivery-${name}.ts`);
+  const entry = resolve10(generatedDirectory, `delivery-${name}.ts`);
   const entryPattern = new RegExp(`^${entry.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`);
   const result = await Bun.build({
     entrypoints: [entry],
@@ -22283,7 +22372,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
           if (args.path === entry)
             return { contents: code, loader: "ts" };
           const bytes = await readFile4(args.path);
-          inputs.set(resolve9(args.path), digest(bytes));
+          inputs.set(resolve10(args.path), digest(bytes));
           return { contents: staticDeliveryImports(args.path, bytes), loader: args.loader };
         });
       }
@@ -22293,7 +22382,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
     throw new Error("Independent bundle failed or has no dependency metadata.");
   const runtimeImports = new Set;
   for (const [path, metadata] of Object.entries(result.metafile.inputs)) {
-    if (resolve9(workingDirectory, path) !== entry && !inputs.has(resolve9(workingDirectory, path))) {
+    if (resolve10(workingDirectory, path) !== entry && !inputs.has(resolve10(workingDirectory, path))) {
       throw new Error("Bundler reported an input that was not captured by the delivery snapshot.");
     }
     for (const imported of metadata.imports) {
@@ -22632,14 +22721,14 @@ interface DeliveryWorkerHost {
 
 // src/delivery-migrations.ts
 init_delivery_files2();
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 async function prepareDeliveryMigrations(project, generatedRoot, declarations = []) {
   const entries = [];
   const files = new Map;
   const inputs = new Map;
   let totalBytes = 0;
   for (const declaration of [...declarations].sort((a, b) => BigInt(a.version) < BigInt(b.version) ? -1 : BigInt(a.version) > BigInt(b.version) ? 1 : 0)) {
-    const source = resolve11(project, declaration.source);
+    const source = resolve12(project, declaration.source);
     if (!inside(project, source) || inside(generatedRoot, source))
       throw new Error("Invalid migration source.");
     const bytes = await readBoundedOwned(project, source, 1048576);
@@ -22690,7 +22779,7 @@ async function buildDeliveryProject(options, delivery) {
     const settings = parseDeliveryOptions(delivery);
     if (typeof Bun === "undefined")
       throw new Error("Independent delivery builds require Bun.");
-    const configPath = ts15.findConfigFile(resolve12(options.rootDir), ts15.sys.fileExists);
+    const configPath = ts15.findConfigFile(resolve13(options.rootDir), ts15.sys.fileExists);
     if (!configPath)
       throw new Error("Independent delivery builds require a project tsconfig.json.");
     const lexicalProject = dirname7(configPath);
@@ -22698,11 +22787,11 @@ async function buildDeliveryProject(options, delivery) {
     const sourceRoot = await realpath3(options.rootDir);
     if (!inside(project, sourceRoot))
       throw new Error("Application sources must be inside the project.");
-    const requested = resolve12(options.outDir, "delivery");
+    const requested = resolve13(options.outDir, "delivery");
     if (!inside(lexicalProject, requested))
       throw new Error("Output must be inside the application project.");
-    const buildRoot = resolve12(project, relative7(lexicalProject, requested));
-    const generatedRoot = resolve12(project, relative7(lexicalProject, options.outDir));
+    const buildRoot = resolve13(project, relative7(lexicalProject, requested));
+    const generatedRoot = resolve13(project, relative7(lexicalProject, options.outDir));
     if (inside(generatedRoot, sourceRoot))
       throw new Error("Output must not contain the application source root.");
     const configInputs = new Map;
@@ -22710,7 +22799,7 @@ async function buildDeliveryProject(options, delivery) {
       ...ts15.sys,
       readFile(path) {
         const contents = readFileSync3(path, "utf8");
-        configInputs.set(resolve12(path), digest(contents));
+        configInputs.set(resolve13(path), digest(contents));
         return contents;
       },
       onUnRecoverableConfigFileDiagnostic() {
@@ -22748,7 +22837,7 @@ async function buildDeliveryProject(options, delivery) {
         if (!target || (kind === "worker" ? target.kind !== "jobs" : target.kind === "jobs")) {
           throw new Error("Delivery host kind does not match its target.");
         }
-        const path = resolve12(sourceRoot, app.source);
+        const path = resolve13(sourceRoot, app.source);
         if (inside(generatedRoot, path) || !/\.[cm]?ts$/.test(path))
           throw new Error("Hosts require application TypeScript source.");
         hosts.set(app.target, { path, kind, hash: digest(await readOwned(sourceRoot, path)) });
@@ -22875,7 +22964,7 @@ async function buildDeliveryProject(options, delivery) {
       }));
       const assetInputs = {};
       for (const asset of assets.filter((asset) => asset.target === target.name)) {
-        const path = resolve12(sourceRoot, asset.source);
+        const path = resolve13(sourceRoot, asset.source);
         const bytes = await readOwned(sourceRoot, path);
         const hash = digest(bytes);
         const previousHash = snapshots.get(path);
@@ -23210,12 +23299,12 @@ init_release_evidence();
 
 // src/watch.ts
 import { existsSync as existsSync4, watch } from "node:fs";
-import { dirname as dirname9, relative as relative10, resolve as resolve15, sep as sep10 } from "node:path";
+import { dirname as dirname9, relative as relative10, resolve as resolve16, sep as sep10 } from "node:path";
 
 // src/incremental.ts
 import { createHash as createHash10 } from "node:crypto";
 import { access as access3, readdir as readdir3, readFile as readFile7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, relative as relative9, resolve as resolve14, sep as sep9 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative9, resolve as resolve15, sep as sep9 } from "node:path";
 init_graphql_inputs();
 function createDependencyGraphCache() {
   return {
@@ -23284,11 +23373,11 @@ async function readSourceBytes(path) {
   return readFile7(path);
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve14(options.rootDir);
-  const outDir = resolve14(options.outDir);
+  const rootDir = resolve15(options.rootDir);
+  const outDir = resolve15(options.outDir);
   const files = { ...previous.files };
   await Promise.all(changedPaths.map(async (changedPath) => {
-    const absolutePath = isAbsolute4(changedPath) ? resolve14(changedPath) : resolve14(rootDir, changedPath);
+    const absolutePath = isAbsolute4(changedPath) ? resolve15(changedPath) : resolve15(rootDir, changedPath);
     const relativeChangedPath = relative9(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep9}`))
       return;
@@ -23306,8 +23395,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve14(options.rootDir);
-  const outDir = resolve14(options.outDir);
+  const rootDir = resolve15(options.rootDir);
+  const outDir = resolve15(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   const entries = await Promise.all(paths.map(async (path) => {
@@ -23330,8 +23419,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve14(options.rootDir),
-    outDir: resolve14(options.outDir),
+    rootDir: resolve15(options.rootDir),
+    outDir: resolve15(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -23347,6 +23436,10 @@ function optionsKeyOf(options) {
     openApi: options.openApi,
     generatePermissions: options.generatePermissions,
     typeSafety: options.typeSafety,
+    databaseGovernance: options.databaseGovernance && {
+      ...options.databaseGovernance,
+      databaseUrl: undefined
+    },
     effect: options.effect,
     treeShakeUnusedProviders: options.treeShakeUnusedProviders,
     graphql: options.graphql
@@ -23356,7 +23449,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir3(directory, { withFileTypes: true })) {
-      const path = resolve14(directory, entry.name);
+      const path = resolve15(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -23491,8 +23584,8 @@ function isCompilerConfigurationPath(rootDir, changedPath) {
   ].includes(relativePath) || /^tsconfig\.[^/]+\.json$/.test(relativePath);
 }
 function watchProject(options) {
-  const rootDir = resolve15(options.rootDir);
-  const outDir = resolve15(options.outDir);
+  const rootDir = resolve16(options.rootDir);
+  const outDir = resolve16(options.outDir);
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let timer;
   let closed = false;
@@ -23502,7 +23595,9 @@ function watchProject(options) {
   const pendingPaths = new Set;
   let watcher;
   let schemaWatcher;
-  const schemaPath = options.graphql ? resolve15(rootDir, options.graphql.schema) : undefined;
+  let databaseWatcher;
+  const databaseRoot = options.databaseGovernance && options.databaseGovernance.mode !== "off" ? resolve16(rootDir, options.databaseGovernance.projectRoot ?? ".") : undefined;
+  const schemaPath = options.graphql ? resolve16(rootDir, options.graphql.schema) : undefined;
   const incremental = createIncrementalCompiler();
   let initialEvent;
   let resolveReady = () => {
@@ -23529,6 +23624,7 @@ function watchProject(options) {
       clearTimeout(timer);
     watcher?.close();
     schemaWatcher?.close();
+    databaseWatcher?.close();
   };
   const compile = (initial, changedPaths = []) => {
     if (closed && !initial)
@@ -23603,6 +23699,13 @@ function watchProject(options) {
       startRecompile(paths);
     }, debounceMs);
   };
+  const isDatabaseInput = (path) => {
+    if (!databaseRoot)
+      return false;
+    const local = relative10(databaseRoot, path);
+    const output = relative10(outDir, path);
+    return local !== ".." && !local.startsWith(`..${sep10}`) && output !== "" && (output === ".." || output.startsWith(`..${sep10}`)) && !local.split(sep10).some((part) => ["node_modules", ".git", ".wt", ".worktrees", "dist", "output"].includes(part)) && /\.(?:sql|json|[cm]?[jt]s)$/.test(path);
+  };
   const startup = compile(true).then(() => {
     if (closed) {
       if (initialEvent)
@@ -23612,20 +23715,27 @@ function watchProject(options) {
     watcher = watch(rootDir, { recursive: true }, (_eventType, filename) => {
       if (!filename)
         return schedule();
-      const changedPath = resolve15(rootDir, filename.toString());
+      const changedPath = resolve16(rootDir, filename.toString());
       const relativePath = relative10(outDir, changedPath);
       if (!relativePath.startsWith("..") && relativePath !== "")
         return;
-      if (/\.(tsx?|mts|cts)$/.test(changedPath) || isCompilerConfigurationPath(rootDir, changedPath) || options.graphql && (/\.(graphql|gql)$/.test(changedPath) || changedPath === schemaPath)) {
+      if (/\.(tsx?|mts|cts)$/.test(changedPath) || isCompilerConfigurationPath(rootDir, changedPath) || isDatabaseInput(changedPath) || options.graphql && (/\.(graphql|gql)$/.test(changedPath) || changedPath === schemaPath)) {
         schedule(relative10(rootDir, changedPath));
       }
     });
+    if (databaseRoot && databaseRoot !== rootDir) {
+      databaseWatcher = watch(databaseRoot, { recursive: true }, (_eventType, filename) => {
+        const path = filename ? resolve16(databaseRoot, filename.toString()) : undefined;
+        if (!path || isDatabaseInput(path))
+          schedule(path);
+      });
+    }
     if (schemaPath && relative10(rootDir, schemaPath).startsWith(`..${sep10}`)) {
       let directory = dirname9(schemaPath);
       while (!existsSync4(directory) && dirname9(directory) !== directory)
         directory = dirname9(directory);
       schemaWatcher = watch(directory, { recursive: true }, (_eventType, filename) => {
-        if (!filename || resolve15(directory, filename.toString()) === schemaPath)
+        if (!filename || resolve16(directory, filename.toString()) === schemaPath)
           schedule(schemaPath);
       });
     }
@@ -23648,19 +23758,19 @@ function watchProject(options) {
 }
 // src/migrations.ts
 import { rename as rename5, readFile as readFile9, writeFile as writeFile4, rm as rm3 } from "node:fs/promises";
-import { relative as relative11, resolve as resolve17 } from "node:path";
+import { relative as relative11, resolve as resolve18 } from "node:path";
 import * as ts17 from "@typescript/typescript6";
 
 // src/migration-policy.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.26.0";
+var MIGRATION_APP_VERSION = "0.26.1";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.29.1";
+var MIGRATION_ELYSIA_VERSION = "0.29.2";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;
@@ -23687,7 +23797,7 @@ async function checkMigrationDependencies(rootDir) {
   const problems = [];
   for (const [name, expected] of Object.entries(migrationDependencies())) {
     try {
-      const manifest = JSON.parse(await readFile8(resolve16(rootDir, "node_modules", name, "package.json"), "utf8"));
+      const manifest = JSON.parse(await readFile8(resolve17(rootDir, "node_modules", name, "package.json"), "utf8"));
       if (!manifest || typeof manifest !== "object" || !("name" in manifest) || manifest.name !== name || !("version" in manifest) || manifest.version !== expected) {
         problems.push(`${name}: requires tested installed version ${expected}`);
       }
@@ -23802,10 +23912,10 @@ function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
   const fileExists = host.fileExists.bind(host);
   const readFile = host.readFile.bind(host);
   const currentDirectory = host.getCurrentDirectory.bind(host);
-  host.fileExists = (fileName) => sourceOverrides.has(resolve17(fileName)) || fileExists(fileName);
-  host.readFile = (fileName) => sourceOverrides.get(resolve17(fileName)) ?? readFile(fileName);
+  host.fileExists = (fileName) => sourceOverrides.has(resolve18(fileName)) || fileExists(fileName);
+  host.readFile = (fileName) => sourceOverrides.get(resolve18(fileName)) ?? readFile(fileName);
   host.getSourceFile = (fileName, languageVersion, onError, shouldCreateNewSourceFile) => {
-    const source = sourceOverrides.get(resolve17(fileName));
+    const source = sourceOverrides.get(resolve18(fileName));
     return source === undefined ? getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile) : ts17.createSourceFile(fileName, source, languageVersion, true);
   };
   host.getCurrentDirectory = () => rootDir ?? currentDirectory();
@@ -23831,7 +23941,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
     issues.push(issue);
   };
   for (const sourceFile of sourceFiles) {
-    const sourcePath = resolve17(sourceFile.fileName);
+    const sourcePath = resolve18(sourceFile.fileName);
     if (!includedFiles.has(sourcePath))
       continue;
     const visit = (node) => {
@@ -23839,7 +23949,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         const options = node.arguments[1];
         const object = options && resolveStaticObjectLiteral2(options, checker);
         if (object) {
-          const objectPath = resolve17(object.getSourceFile().fileName);
+          const objectPath = resolve18(object.getSourceFile().fileName);
           const properties = routeResponseProperties(object);
           if (properties.response) {
             if (!includedFiles.has(objectPath)) {
@@ -23882,13 +23992,13 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         line: lineOf2(sourceFile, response)
       });
     } else {
-      const replacements = replacementsByFile.get(resolve17(sourceFile.fileName)) ?? [];
+      const replacements = replacementsByFile.get(resolve18(sourceFile.fileName)) ?? [];
       replacements.push({
         start: response.getStart(sourceFile),
         end: response.getEnd(),
         text: `responses: { 200: ${response.initializer.getText(sourceFile)} }`
       });
-      replacementsByFile.set(resolve17(sourceFile.fileName), replacements);
+      replacementsByFile.set(resolve18(sourceFile.fileName), replacements);
     }
   }
   return { replacementsByFile, issues };
@@ -23901,7 +24011,7 @@ function applyReplacements(source, replacements) {
   return content;
 }
 function migrateRouteResponse(source, fileName) {
-  const absoluteFile = resolve17(fileName);
+  const absoluteFile = resolve18(fileName);
   const sourceOverrides = new Map([[absoluteFile, source]]);
   const program = createMigrationProgram([absoluteFile], sourceOverrides);
   const sourceFile = program.getSourceFile(absoluteFile);
@@ -23917,7 +24027,7 @@ function migrateRouteResponse(source, fileName) {
       }]
     };
   }
-  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve17("."), new Set([absoluteFile]));
+  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve18("."), new Set([absoluteFile]));
   const replacements = plan.replacementsByFile.get(absoluteFile) ?? [];
   return {
     changed: replacements.length > 0,
@@ -23927,7 +24037,7 @@ function migrateRouteResponse(source, fileName) {
   };
 }
 function migrateRouteResponseProject(files, rootDir, sourceByPath) {
-  const absoluteFiles = files.map((file) => resolve17(file));
+  const absoluteFiles = files.map((file) => resolve18(file));
   const program = createMigrationProgram(absoluteFiles, sourceByPath, rootDir);
   const sourceFiles = absoluteFiles.map((file) => program.getSourceFile(file)).filter((file) => file !== undefined);
   const plan = planRouteResponseMigration(sourceFiles, program.getTypeChecker(), rootDir, new Set(absoluteFiles));
@@ -23940,11 +24050,11 @@ function migrateRouteResponseProject(files, rootDir, sourceByPath) {
       changed: replacements.length > 0,
       content: applyReplacements(source, replacements),
       replacements: replacements.length,
-      issues: plan.issues.filter((issue) => resolve17(rootDir, issue.file) === file)
+      issues: plan.issues.filter((issue) => resolve18(rootDir, issue.file) === file)
     });
   }
   for (const issue of plan.issues) {
-    const path = resolve17(rootDir, issue.file);
+    const path = resolve18(rootDir, issue.file);
     if (!results.has(path) && sourceByPath.has(path)) {
       results.set(path, {
         changed: false,
@@ -23982,7 +24092,7 @@ async function writeAtomically(path, content) {
   }
 }
 async function migrateProject(options) {
-  const rootDir = resolve17(options.rootDir);
+  const rootDir = resolve18(options.rootDir);
   let migrations = SUPACLOUD_MIGRATIONS;
   const preflightIssues = [];
   if (options.fromVersion !== undefined || options.toVersion !== undefined) {
@@ -24038,7 +24148,7 @@ async function migrateProject(options) {
     }
   };
   for (const filePath of files) {
-    sourceByPath.set(resolve17(filePath), await readFile9(filePath, "utf8"));
+    sourceByPath.set(resolve18(filePath), await readFile9(filePath, "utf8"));
   }
   const originalSources = new Map(sourceByPath);
   const writtenFiles = new Set;
@@ -24047,7 +24157,7 @@ async function migrateProject(options) {
     if (projectResults)
       appendIssues(projectResults.issues);
     for (const filePath of files) {
-      const absoluteFile = resolve17(filePath);
+      const absoluteFile = resolve18(filePath);
       const file = relative11(rootDir, absoluteFile) || absoluteFile;
       const before = sourceByPath.get(absoluteFile);
       if (before === undefined)
@@ -24108,11 +24218,11 @@ async function migrateProject(options) {
 // src/migration-assess.ts
 import { createHash as createHash11 } from "node:crypto";
 import { readFile as readFile11 } from "node:fs/promises";
-import { join as join10, resolve as resolve19 } from "node:path";
+import { join as join10, resolve as resolve20 } from "node:path";
 
 // src/openapi-tools.ts
 import { mkdir as mkdir4, readFile as readFile10, rename as rename6, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve18 } from "node:path";
+import { dirname as dirname10, resolve as resolve19 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 class OpenApiDocumentError extends Error {
@@ -24503,7 +24613,7 @@ function serializeOpenApiJson(document, space = 2) {
 }
 async function readOpenApiJson(path) {
   try {
-    const value = JSON.parse(await readFile10(resolve18(path), "utf8"));
+    const value = JSON.parse(await readFile10(resolve19(path), "utf8"));
     return parseOpenApiDocument(value);
   } catch (error) {
     if (error instanceof OpenApiDocumentError)
@@ -24512,7 +24622,7 @@ async function readOpenApiJson(path) {
   }
 }
 async function writeOpenApiJson(document, outputPath, space = 2) {
-  const path = resolve18(outputPath);
+  const path = resolve19(outputPath);
   const content = serializeOpenApiJson(document, space);
   await mkdir4(dirname10(path), { recursive: true });
   try {
@@ -24533,7 +24643,7 @@ async function writeOpenApiJson(document, outputPath, space = 2) {
 }
 async function loadGeneratedOpenApiDocument(modulePath) {
   try {
-    const moduleUrl = pathToFileURL(resolve18(modulePath));
+    const moduleUrl = pathToFileURL(resolve19(modulePath));
     moduleUrl.searchParams.set("supacloud-openapi-export", "1");
     const loaded = await import(moduleUrl.href);
     if (!isRecord(loaded))
@@ -24629,18 +24739,18 @@ function isRecord2(value) {
 function arrayLength(value) {
   return Array.isArray(value) ? value.length : undefined;
 }
-async function sha2563(path) {
+async function sha2564(path) {
   return createHash11("sha256").update(await readFile11(path)).digest("hex");
 }
 function overallStatus(findings) {
   return findings.reduce((current, finding) => STATUS_PRIORITY[finding.status] > STATUS_PRIORITY[current] ? finding.status : current, "compatible");
 }
 async function assessMigration(options) {
-  const projectDir = resolve19(options.projectDir);
+  const projectDir = resolve20(options.projectDir);
   const compile = {
     ...options.compile,
-    rootDir: resolve19(options.compile.rootDir),
-    outDir: resolve19(options.compile.outDir)
+    rootDir: resolve20(options.compile.rootDir),
+    outDir: resolve20(options.compile.outDir)
   };
   const findings = [];
   const dependencyProblems = await checkMigrationDependencies(projectDir);
@@ -24706,7 +24816,7 @@ async function assessMigration(options) {
     contractsManifest = {
       path: contractsManifestPath,
       present: true,
-      sha256: await sha2563(contractsManifestPath),
+      sha256: await sha2564(contractsManifestPath),
       version: 1,
       ...commands === undefined ? {} : { commands },
       ...routes === undefined ? {} : { routes },
@@ -24723,15 +24833,15 @@ async function assessMigration(options) {
   }
   let openApi;
   if (options.baselineOpenApiPath && options.currentOpenApiPath) {
-    const baselinePath = resolve19(projectDir, options.baselineOpenApiPath);
-    const currentPath = resolve19(projectDir, options.currentOpenApiPath);
+    const baselinePath = resolve20(projectDir, options.baselineOpenApiPath);
+    const currentPath = resolve20(projectDir, options.currentOpenApiPath);
     try {
       const diff = diffOpenApiDocuments(await readOpenApiJson(baselinePath), await readOpenApiJson(currentPath));
       openApi = {
         baselinePath,
-        baselineSha256: await sha2563(baselinePath),
+        baselineSha256: await sha2564(baselinePath),
         currentPath,
-        currentSha256: await sha2563(currentPath),
+        currentSha256: await sha2564(currentPath),
         diff
       };
       if (!diff.ok) {
@@ -24813,9 +24923,10 @@ init_validate();
 // src/config.ts
 init_graphql_options();
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join11, resolve as resolve20 } from "node:path";
+import { join as join11, resolve as resolve21 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var DEFAULT_SUPACLOUD_CONFIG = {
+  databaseGovernance: { mode: "off" },
   graphql: false,
   root: "src",
   outDir: "generated",
@@ -24846,6 +24957,8 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   }
 };
 function defineSupacloudConfig(config = {}) {
+  if (config.databaseGovernance !== undefined)
+    assertDatabaseGovernance(config.databaseGovernance);
   if (config.delivery !== undefined)
     parseDeliveryOptions(config.delivery);
   if (config.graphql !== undefined && config.graphql !== false)
@@ -24945,8 +25058,8 @@ function validateGovernanceConfig(config) {
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
   const resolved = defineSupacloudConfig(config);
   return {
-    rootDir: resolve20(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
-    outDir: resolve20(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
+    rootDir: resolve21(cwd, resolved.root ?? DEFAULT_SUPACLOUD_CONFIG.root),
+    outDir: resolve21(cwd, resolved.outDir ?? DEFAULT_SUPACLOUD_CONFIG.outDir),
     include: resolved.include ?? [...DEFAULT_SUPACLOUD_CONFIG.include],
     strict: resolved.strict ?? DEFAULT_SUPACLOUD_CONFIG.strict,
     requireRouteContracts: resolved.requireRouteContracts ?? DEFAULT_SUPACLOUD_CONFIG.requireRouteContracts,
@@ -24958,6 +25071,12 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     commandCapabilities: resolved.commandCapabilities ?? DEFAULT_SUPACLOUD_CONFIG.commandCapabilities,
     ...resolved.moduleBoundaries ? { moduleBoundaries: resolved.moduleBoundaries } : {},
     ...resolved.typeSafety ? { typeSafety: resolved.typeSafety } : {},
+    ...resolved.databaseGovernance === undefined ? {} : {
+      databaseGovernance: {
+        ...resolved.databaseGovernance,
+        projectRoot: resolve21(cwd, resolved.databaseGovernance.projectRoot ?? ".")
+      }
+    },
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
     ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
     ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
@@ -24965,7 +25084,7 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     ...resolved.graphql === undefined || resolved.graphql === false ? {} : { graphql: {
       ...resolved.graphql,
-      schema: resolve20(cwd, resolved.graphql.schema)
+      schema: resolve21(cwd, resolved.graphql.schema)
     } }
   };
 }
@@ -24994,7 +25113,7 @@ init_graphql_schema();
 // src/graphql-governance.ts
 init_graphql_schema_hashes();
 import { readFile as readFile13 } from "node:fs/promises";
-import { resolve as resolve22 } from "node:path";
+import { resolve as resolve23 } from "node:path";
 import {
   buildClientSchema as buildClientSchema2,
   buildSchema as buildSchema2,
@@ -25014,7 +25133,7 @@ function schemaFromSource(source, path = "schema.graphql") {
   return buildSchema2(source);
 }
 async function readGraphqlSchema(path) {
-  const absolute = resolve22(path);
+  const absolute = resolve23(path);
   const source = await readFile13(absolute, "utf8");
   const hashes = graphqlSchemaHashes(source);
   return { path: absolute, source, schema: schemaFromSource(source, absolute), ...hashes };