@supacloud/compiler 0.45.0 → 0.46.0

package/DELIVERY.md

@@ -62,6 +62,26 @@ their kind. HTTP and Job ownership are independent, so one module can contribute
 HTTP to `api` and Jobs to `jobs`. Two HTTP targets cannot both own the same module.
 `api` and `jobs` are reserved for their matching workload kinds.
 
+`kind: "function"` declares an Edge Function target instead of an app-module
+target. It carries a `function` descriptor (`slug`, `entrypoint`, `verifyJwt`)
+and must not declare `modules`. Function targets own no HTTP routes or Jobs, so
+the plan surfaces them alongside the module-owned targets:
+
+```ts
+{
+  version: 1,
+  targets: [
+    { name: "intake-hooks", kind: "function",
+      function: { slug: "fa-intake-hooks", entrypoint: "functions/intake/index.ts", verifyJwt: false } },
+  ],
+}
+```
+
+This version only **plans** function targets. The local delivery build still
+rejects them with `delivery-function-build-unsupported`; rendering, upload and
+activation belong to a later delivery phase (see the project deployment
+Function/schedule work). Existing HTTP/Worker configuration is unaffected.
+
 No unused explicit target is accepted. Unknown modules, duplicate ownership,
 unresolved imports, cyclic dependencies, duplicate job names, and conflicting
 method/path patterns reject the plan. Parameter-name aliases such as `/:id` and

package/README.md

@@ -2,16 +2,18 @@
 
 ## Enforced Database Governance
 
-Existing compiler callers retain `off`. Newly generated `command` starters set
-`databaseGovernance: { mode: "check" }`: compile/check/dev run the existing
-`@supacloud/db` source-boundary and contract-freshness gate offline, including
-incremental cache hits. Missing adoption files or stale contracts block generation
-even with `writeOnError`; checks never generate contracts. This mode does not
-import database modules, lint their SQL or connect to a database.
+Existing compiler callers retain `off` as a compatibility migration exception.
+Newly generated `command` starters set
+`databaseGovernance: { mode: "enforce", moduleFile: "db/modules.ts" }`:
+compile/check/build run the existing `@supacloud/db` source-boundary and
+contract-freshness gate, SQL lint and live Catalog reconciliation, including
+incremental cache hits. Missing adoption files, stale contracts, SQL findings or
+Catalog drift block generation even with `writeOnError`; checks never generate
+contracts or migrations.
 The minimal/http/edge starters remain database-free.
 
-For SQL lint and live Catalog reconciliation, declare the real database modules
-and explicitly set the following in `supacloud.config.ts`:
+For an existing database project, adopt the governed path by declaring the real
+database modules and explicitly setting the following in `supacloud.config.ts`:
 
 ```ts
 export default {
@@ -26,10 +28,12 @@ export default {
 ```
 
 `projectRoot` is relative to the configuration directory (or `rootDir` when
-calling `compileProject` / `checkProject` directly). The default mode is `off`.
-Use a read-only PostgreSQL credential in the named environment variable, targeting
-an explicitly selected local or test database. The compiler does not load `.env`
-files for this worker, generate migrations, repair contracts, or apply SQL.
+calling `compileProject` / `checkProject` directly). Use a read-only PostgreSQL
+credential in the named environment variable, targeting an explicitly selected
+local or test database. The compiler does not load `.env` files for this worker,
+generate migrations, repair contracts, or apply SQL. Setting `mode: "off"` is
+reserved for an explicit migration exception and should not be used in a new
+database starter.
 
 In `enforce` mode, compile/check/dev must pass the existing
 `@supacloud/db` source-boundary and contract-freshness check, SQL lint and live

package/dist/cli.js

@@ -808,12 +808,15 @@ function validateGraph(graph, options = false) {
       if (typeof options === "object" && options.commandCapabilities) {
         const hostCaps = options.commandCapabilities;
         const rpcCaps = command.rpc && Object.hasOwn(hostCaps.rpc ?? {}, command.rpc) ? hostCaps.rpc?.[command.rpc] : undefined;
-        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required"))) {
+        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required") || command.rpc !== undefined && rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true)) {
           error("command-persistence-required", `Command ${command.name} requires an explicit persistent adapter, permission, audit and idempotency policy.`, module.file, module.line, "Register a named database/external adapter, enable permission checks and declare permission, audit and required idempotency on the command.");
         }
         if (rpcCaps?.boundary === "external" && (command.transaction === "required" || rpcCaps.transaction === true)) {
           error("command-external-transaction", `Command ${command.name} calls an external service; use durable intent and reconciliation, not transaction: 'required'.`, module.file, module.line, "Use transaction: 'none' with createExternalCommand; recover with read-only reconciliation. Do not claim a database transaction covers a remote request.");
         }
+        if (rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true) {
+          error("command-reconcile-required", `Command ${command.name} uses an external adapter without a receipt reconciliation capability.`, module.file, module.line, "Declare reconcile: true only when the adapter can look up the same idempotency key and resolve unknown outcomes without redispatching.");
+        }
         const caps = command.rpc ? {
           permission: hostCaps.permission,
           audit: rpcCaps?.audit === true,
@@ -1230,6 +1233,7 @@ var init_validate = __esm(() => {
     "invalid-job-timeout": { code: "SC4015", docsUrl: "https://supacloud.dev/errors/SC4015" },
     "invalid-job-attempts": { code: "SC4016", docsUrl: "https://supacloud.dev/errors/SC4016" },
     "invalid-job-idempotency": { code: "SC4017", docsUrl: "https://supacloud.dev/errors/SC4017" },
+    "job-retry-idempotency-required": { code: "SC4027", docsUrl: "https://supacloud.dev/errors/SC4027" },
     "invalid-job-mode": { code: "SC4018", docsUrl: "https://supacloud.dev/errors/SC4018" },
     "invalid-job-schema": { code: "SC4019", docsUrl: "https://supacloud.dev/errors/SC4019" },
     "command-persistence-required": { code: "SC4020", docsUrl: "https://supacloud.dev/errors/SC4020" },
@@ -1239,6 +1243,7 @@ var init_validate = __esm(() => {
     "command-idempotency-unsupported": { code: "SC4024", docsUrl: "https://supacloud.dev/errors/SC4024" },
     "command-transaction-rpc-only": { code: "SC4025", docsUrl: "https://supacloud.dev/errors/SC4025" },
     "command-transaction-unsupported": { code: "SC4026", docsUrl: "https://supacloud.dev/errors/SC4026" },
+    "command-reconcile-required": { code: "SC4028", docsUrl: "https://supacloud.dev/errors/SC4028" },
     "invalid-route-contract": { code: "SC3020", docsUrl: "https://supacloud.dev/errors/SC3020" },
     "route-contract-required": { code: "SC3021", docsUrl: "https://supacloud.dev/errors/SC3021" },
     "route-contract-unverified": { code: "SC3022", docsUrl: "https://supacloud.dev/errors/SC3022" },
@@ -4592,7 +4597,7 @@ function createContextPack(graph, subject) {
       }
     }
   }
-  const modules = graph.modules.filter((module) => selected.has(module.name));
+  const modules = graph.modules.filter((module) => selected.has(module.name)).map(sanitizeContextModule);
   const queryDocuments = graph.graphql?.documents.filter((file) => modules.some((module) => {
     const path = relative5(dirname4(module.file), file);
     return path !== ".." && !path.startsWith(`..${sep5}`);
@@ -4634,7 +4639,12 @@ function createContextPack(graph, subject) {
       singleResult: "async-await",
       eventComposition: "rxjs",
       angularHost: "@supacloud/app/angular",
-      cancellation: "explicit-owner-signal"
+      cancellation: "explicit-owner-signal",
+      readTransport: "postgrest-supabase-js",
+      writeTransport: "command-rpc",
+      writeRetry: "disabled",
+      externalOutcome: "receipt-reconcile",
+      databaseSource: "drizzle-append-only"
     },
     relatedModules: {
       imports: subjectModule.imports.filter((name) => selected.has(name)),
@@ -4642,6 +4652,44 @@ function createContextPack(graph, subject) {
     }
   };
 }
+function sanitizeContextModule(module) {
+  const sanitizeAspect = (aspect) => ({
+    ...aspect,
+    expression: "[omitted]"
+  });
+  return {
+    ...module,
+    providers: module.providers.map((provider) => ({
+      ...provider,
+      ...provider.useValueExpr === undefined ? {} : { useValueExpr: "[omitted]" },
+      ...provider.useFactoryName === undefined ? {} : { useFactoryName: "[omitted]" },
+      ...provider.functionalInjects === undefined ? {} : {
+        functionalInjects: provider.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      }
+    })),
+    ...module.aspects === undefined ? {} : { aspects: module.aspects.map(sanitizeAspect) },
+    controllers: module.controllers.map((controller) => ({
+      ...controller,
+      ...controller.functionalInjects === undefined ? {} : {
+        functionalInjects: controller.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      },
+      routes: controller.routes.map((route) => ({
+        ...route,
+        ...route.aspects === undefined ? {} : { aspects: route.aspects.map(sanitizeAspect) }
+      }))
+    })),
+    commands: module.commands.map((command) => ({
+      ...command,
+      ...command.aspects === undefined ? {} : { aspects: command.aspects.map(sanitizeAspect) }
+    })),
+    ...module.jobs === undefined ? {} : {
+      jobs: module.jobs.map((job) => ({
+        ...job,
+        ...job.aspects === undefined ? {} : { aspects: job.aspects.map(sanitizeAspect) }
+      }))
+    }
+  };
+}
 function resolveContextModule(graph, subject) {
   const exact = graph.modules.find((module) => module.name === subject);
   if (exact)
@@ -15683,6 +15731,11 @@ function parseDeliveryOptions(value) {
   if (value.targets?.some((target) => target.compute && target.isolation === "shared")) {
     throw new DeliveryConfigurationError;
   }
+  for (const target of value.targets ?? []) {
+    const invalidShape = target.kind === "function" ? target.function === undefined || target.modules !== undefined || target.compute !== undefined : target.modules === undefined || target.function !== undefined;
+    if (invalidShape)
+      throw new DeliveryConfigurationError;
+  }
   const migrations = value.build?.migrations ?? [];
   try {
     validateWorkerExecution(value.execution?.groups ?? []);
@@ -15699,7 +15752,7 @@ function parseDeliveryPlanResult(value) {
     throw new Error("Invalid delivery plan result.");
   return value;
 }
-var objectOptions, reference2, references, kind2, isolation, DeliveryFilePathSchema, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
+var objectOptions, reference2, references, kind2, isolation, DeliveryFilePathSchema, functionTarget, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
 var init_delivery_schema = __esm(() => {
   init_build();
   init_value2();
@@ -15707,22 +15760,28 @@ var init_delivery_schema = __esm(() => {
   objectOptions = { additionalProperties: false };
   reference2 = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
   references = _Array_(reference2, { uniqueItems: true });
-  kind2 = Union([Literal("api"), Literal("jobs"), Literal("webhook")]);
+  kind2 = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
   isolation = Union([Literal("shared"), Literal("process")]);
   DeliveryFilePathSchema = String2({
     maxLength: 512,
     pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
   });
+  functionTarget = _Object_({
+    slug: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
+    entrypoint: DeliveryFilePathSchema,
+    verifyJwt: Boolean2()
+  }, objectOptions);
   DeliveryOptionsSchema = _Object_({
     version: Literal(1),
     execution: Optional(WorkerExecutionSchema),
     targets: Optional(_Array_(_Object_({
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       kind: kind2,
-      modules: _Array_(reference2, { minItems: 1, uniqueItems: true }),
+      modules: Optional(_Array_(reference2, { minItems: 1, uniqueItems: true })),
       isolation: Optional(isolation),
       capabilities: Optional(references),
-      compute: Optional(ComputeResourcesSchema)
+      compute: Optional(ComputeResourcesSchema),
+      function: Optional(functionTarget)
     }, objectOptions))),
     runtime: Optional(_Object_({
       processIsolation: Boolean2(),
@@ -15800,6 +15859,7 @@ var init_delivery_schema = __esm(() => {
     routes: _Array_(routeSchema),
     jobs: _Array_(jobSchema),
     externalTokens: _Array_(String2()),
+    function: Optional(functionTarget),
     requirements: _Object_({
       processIsolation: Boolean2(),
       durableQueue: Boolean2(),
@@ -21143,9 +21203,25 @@ import * as ts9 from "@typescript/typescript6";
 var SOURCE_SEMANTIC_DIAGNOSTIC_CODES = {
   "source-unsafe-any": { errorCode: "SC6009", docsUrl: "https://supacloud.dev/errors/SC6009" },
   "source-floating-promise": { errorCode: "SC6010", docsUrl: "https://supacloud.dev/errors/SC6010" },
-  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" }
+  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" },
+  "source-alternative-library": { errorCode: "SC6012", docsUrl: "https://supacloud.dev/errors/SC6012" }
 };
-function scanSourceSemantics(source, checker, file, rootDir) {
+var DEFAULT_ALTERNATIVE_LIBRARIES = [
+  "@apollo/client",
+  "@urql/core",
+  "graphql-request",
+  "kefir",
+  "most",
+  "@pgflow",
+  "pgflow",
+  "pg_durable",
+  "react-relay",
+  "redux-observable",
+  "urql",
+  "wonka",
+  "xstream"
+];
+function scanSourceSemantics(source, checker, file, rootDir, options = {}) {
   const diagnostics = [];
   const report = (code, node, message) => {
     diagnostics.push({
@@ -21157,6 +21233,16 @@ function scanSourceSemantics(source, checker, file, rootDir) {
       line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
     });
   };
+  const allowedLibraries = new Set(options.allowAlternativeLibraries ?? []);
+  for (const statement of source.statements) {
+    if (!ts9.isImportDeclaration(statement) || !ts9.isStringLiteral(statement.moduleSpecifier))
+      continue;
+    const moduleName = statement.moduleSpecifier.text;
+    const alternative = DEFAULT_ALTERNATIVE_LIBRARIES.find((name) => moduleName === name || moduleName.startsWith(`${name}/`));
+    if (alternative && !allowedLibraries.has(alternative) && !allowedLibraries.has(moduleName)) {
+      report("source-alternative-library", statement.moduleSpecifier, `Production source imports alternative library "${moduleName}". Use the governed Supabase client/PostgREST transport and RxJS event composition by default, or allow this package explicitly in typeSafety.allowAlternativeLibraries for a documented boundary.`);
+    }
+  }
   const unsafe = (value, target) => {
     if (isUnknownBoundary(target, checker) || containsAny(target, checker, new Set, rootDir))
       return;
@@ -21437,7 +21523,7 @@ function scanProductionSource(options) {
   }
   for (const sourceFile of sourceFiles) {
     scanSourceFile(sourceFile, checker, rootDir, diagnostics, options.strict ?? false);
-    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir));
+    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir, options.allowAlternativeLibraries === undefined ? {} : { allowAlternativeLibraries: options.allowAlternativeLibraries }));
     diagnostics.push(...scanDrizzleSql(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), options.strict ?? false));
     const scanner = ts10.createScanner(ts10.ScriptTarget.Latest, false, sourceFile.languageVariant, sourceFile.text);
     for (let kind = scanner.scan();kind !== ts10.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
@@ -21699,6 +21785,17 @@ function validateEffectPolicies(graph, options = {}) {
   }
   return diagnostics;
 }
+function validateJobPolicies(graph) {
+  const diagnostics = [];
+  for (const module of graph.modules) {
+    for (const job of module.jobs ?? []) {
+      if (job.maxAttempts !== undefined && job.maxAttempts > 1 && job.idempotency !== "required") {
+        diagnostics.push(diagnostic("job-retry-idempotency-required", `Job ${job.name} (${job.className}) enables ${job.maxAttempts} attempts without an idempotency contract.`, module.file, 'Use idempotency: "required" with a durable receipt, or set maxAttempts: 1.'));
+      }
+    }
+  }
+  return diagnostics;
+}
 
 // src/database-governance.ts
 import { execFile } from "node:child_process";
@@ -21748,13 +21845,19 @@ async function checkDatabaseGovernance(rootDir, value) {
 
 // src/compile.ts
 function withDefaultGovernance(options) {
-  return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
-    requirePersistentAdapters: true,
-    permission: true,
-    audit: true,
-    idempotency: true,
-    transaction: true
-  } } : options;
+  return {
+    ...options,
+    requireRouteContracts: options.requireRouteContracts ?? true,
+    disallowControllerDirectDb: options.disallowControllerDirectDb ?? true,
+    detectOrphanModules: options.detectOrphanModules ?? true,
+    ...options.commandCapabilities === undefined ? { commandCapabilities: {
+      requirePersistentAdapters: true,
+      permission: true,
+      audit: true,
+      idempotency: true,
+      transaction: true
+    } } : {}
+  };
 }
 async function renderOptionalGraphql(options) {
   return options.graphql ? (await Promise.resolve().then(() => (init_graphql(), exports_graphql))).renderGraphql(options) : { diagnostics: [], files: {} };
@@ -21766,7 +21869,8 @@ async function compileProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21836,7 +21940,8 @@ async function checkProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21916,7 +22021,8 @@ function resolveTypeSafety(options) {
   return {
     noAnyInGenerated: true,
     scanProductionSource: true,
-    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {}
+    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {},
+    ...options.typeSafety?.allowAlternativeLibraries ? { allowAlternativeLibraries: options.typeSafety.allowAlternativeLibraries } : {}
   };
 }
 
@@ -22650,11 +22756,13 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   outDir: "generated",
   include: ["**/*.module.ts", "**/*.ts"],
   strict: true,
-  requireRouteContracts: false,
+  requireRouteContracts: true,
   generateClient: true,
   generateOpenApi: true,
   generatePermissions: true,
   treeShakeUnusedProviders: true,
+  disallowControllerDirectDb: true,
+  detectOrphanModules: true,
   commandCapabilities: {
     requirePersistentAdapters: true,
     permission: true,
@@ -22709,9 +22817,9 @@ function validateGovernanceConfig(config) {
       if (!isRecord(adapters))
         throw new Error("commandCapabilities.rpc must contain named adapters.");
       for (const [name, adapter] of Object.entries(adapters)) {
-        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "transaction", "boundary"].includes(key)))
+        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "reconcile", "transaction", "boundary"].includes(key)))
           throw new Error("Invalid command adapter.");
-        for (const key of ["audit", "idempotency", "transaction"]) {
+        for (const key of ["audit", "idempotency", "reconcile", "transaction"]) {
           if (adapter[key] !== undefined && typeof adapter[key] !== "boolean")
             throw new Error("Invalid command adapter capability.");
         }
@@ -22736,8 +22844,8 @@ function validateGovernanceConfig(config) {
   }
   if (config.typeSafety !== undefined) {
     const rules = config.typeSafety;
-    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
-      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude", "allowAlternativeLibraries"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"]) || rules["allowAlternativeLibraries"] !== undefined && !isStrings(rules["allowAlternativeLibraries"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and string arrays exclude/allowAlternativeLibraries.");
     }
   }
   for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
@@ -22796,8 +22904,8 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
       }
     },
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
-    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
-    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
+    disallowControllerDirectDb: resolved.disallowControllerDirectDb ?? DEFAULT_SUPACLOUD_CONFIG.disallowControllerDirectDb,
+    detectOrphanModules: resolved.detectOrphanModules ?? DEFAULT_SUPACLOUD_CONFIG.detectOrphanModules,
     effect: resolved.effect === undefined ? { ...DEFAULT_SUPACLOUD_CONFIG.effect } : { ...DEFAULT_SUPACLOUD_CONFIG.effect, ...resolved.effect },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     ...resolved.graphql === undefined || resolved.graphql === false ? {} : { graphql: {
@@ -22897,7 +23005,7 @@ function diagnostic2(error) {
     ...error.suggestion === undefined ? {} : { suggestion: error.suggestion }
   };
 }
-function createDeliveryPlan(graph, input) {
+function createDeliveryPlan(graph, input, validation) {
   let options;
   try {
     options = parseDeliveryOptions(input);
@@ -22913,7 +23021,7 @@ function createDeliveryPlan(graph, input) {
   }
   const diagnostics = [
     ...(graph.diagnostics ?? []).map(diagnostic2),
-    ...validateGraph(graph, { strict: true }).map(diagnostic2)
+    ...validateGraph(graph, validation === undefined ? { strict: true } : { ...validation, strict: true }).map(diagnostic2)
   ];
   const fail = (code, message, suggestion) => {
     diagnostics.push({ severity: "error", code, message, suggestion });
@@ -22931,7 +23039,7 @@ function createDeliveryPlan(graph, input) {
     if (target.name === "api" && target.kind !== "api" || target.name === "jobs" && target.kind !== "jobs") {
       fail("delivery-reserved-target", `"${target.name}" is reserved for its matching workload kind.`, "Rename the target or use the matching kind.");
     }
-    for (const name of sorted(target.modules)) {
+    for (const name of sorted(target.modules ?? [])) {
       if (!modules.has(name)) {
         fail("delivery-unknown-module", `Target "${target.name}" refers to unknown module "${name}".`, "Select a module name from the compiler graph.");
         continue;
@@ -22945,6 +23053,23 @@ function createDeliveryPlan(graph, input) {
     }
   }
   const targets = new Map;
+  for (const declaration of declarations.values()) {
+    if (declaration.kind !== "function" || declaration.function === undefined)
+      continue;
+    targets.set(declaration.name, {
+      name: declaration.name,
+      kind: "function",
+      isolation: "shared",
+      roots: [],
+      modules: [],
+      routes: [],
+      jobs: [],
+      externalTokens: [],
+      function: declaration.function,
+      requirements: { processIsolation: false, durableQueue: false, capabilities: sorted(declaration.capabilities ?? []) },
+      runtimeStatus: options.runtime === undefined ? "unchecked" : "declared-compatible"
+    });
+  }
   function getTarget(name, fallback) {
     const existing = targets.get(name);
     if (existing)
@@ -23110,7 +23235,7 @@ async function planDeliveryProject(options, delivery) {
     return createDeliveryPlan({ modules: [], externalTokens: [] }, delivery);
   }
   const checked = await checkProject(options);
-  return createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, delivery);
+  return createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, delivery, options);
 }
 function formatDeliveryPlan(result) {
   const lines = result.ok ? [
@@ -23811,9 +23936,17 @@ async function buildDeliveryProject(options, delivery) {
     phase = "compiler-checks";
     const sources = await sourceInventory(sourceRoot, generatedRoot);
     const checked = await checkProject(options);
-    const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings);
+    const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings, options);
     if (!planned.ok)
       return failed(planned.diagnostics);
+    if (planned.plan.targets.some((target) => target.kind === "function")) {
+      return failed([{
+        severity: "error",
+        code: "delivery-function-build-unsupported",
+        message: "Function target rendering is not implemented yet; the delivery build only produces HTTP and Worker application objects.",
+        suggestion: "Declare HTTP/Worker application targets for now; Function and schedule delivery is tracked separately."
+      }]);
+    }
     if (options.graphql && checked.mismatches.some((mismatch) => mismatch.startsWith("graphql"))) {
       throw new Error("Refresh GraphQL artifacts with compile before building independent targets.");
     }

package/dist/config.d.ts

@@ -25,7 +25,7 @@ export interface SupaCloudConfig {
     commandCapabilities?: CommandExecutionCapabilities;
     treeShakeUnusedProviders?: boolean;
 }
-export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "moduleBoundaries" | "typeSafety" | "delivery" | "allowRouteCommandBindings" | "disallowControllerDirectDb" | "detectOrphanModules" | "openApi" | "effect">> & {
+export declare const DEFAULT_SUPACLOUD_CONFIG: Required<Omit<SupaCloudConfig, "include" | "moduleBoundaryPreset" | "moduleBoundaries" | "typeSafety" | "delivery" | "allowRouteCommandBindings" | "openApi" | "effect">> & {
     include: string[];
     moduleBoundaryPreset: ModuleBoundaryPresetName;
     effect: NonNullable<CompileOptions["effect"]>;
@@ -47,8 +47,8 @@ export declare function resolveSupacloudConfig(config?: SupaCloudConfig, cwd?: s
     typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
     databaseGovernance?: NonNullable<CompileOptions["databaseGovernance"]>;
     allowRouteCommandBindings?: boolean;
-    disallowControllerDirectDb?: boolean;
-    detectOrphanModules?: boolean;
+    disallowControllerDirectDb: boolean;
+    detectOrphanModules: boolean;
     effect?: NonNullable<CompileOptions["effect"]>;
     treeShakeUnusedProviders: boolean;
     graphql?: GraphqlOptions;

package/dist/delivery-bundle-protocol.d.ts

@@ -43,14 +43,19 @@ declare const requestSchema: Type.TObject<{
         }>>;
         targets: Type.TOptional<Type.TArray<Type.TObject<{
             name: Type.TString;
-            kind: Type.TUnion<[Type.TLiteral<"api">, Type.TLiteral<"jobs">, Type.TLiteral<"webhook">]>;
-            modules: Type.TArray<Type.TString>;
+            kind: Type.TUnion<[Type.TLiteral<"api">, Type.TLiteral<"jobs">, Type.TLiteral<"webhook">, Type.TLiteral<"function">]>;
+            modules: Type.TOptional<Type.TArray<Type.TString>>;
             isolation: Type.TOptional<Type.TUnion<[Type.TLiteral<"shared">, Type.TLiteral<"process">]>>;
             capabilities: Type.TOptional<Type.TArray<Type.TString>>;
             compute: Type.TOptional<Type.TObject<{
                 cpuLimit: Type.TNumber;
                 memoryLimitMiB: Type.TInteger;
             }>>;
+            function: Type.TOptional<Type.TObject<{
+                slug: Type.TString;
+                entrypoint: Type.TString;
+                verifyJwt: Type.TBoolean;
+            }>>;
         }>>>;
         runtime: Type.TOptional<Type.TObject<{
             processIsolation: Type.TBoolean;

package/dist/delivery-bundle-worker.js

@@ -10064,6 +10064,11 @@ function parseDeliveryOptions(value) {
   if (value.targets?.some((target) => target.compute && target.isolation === "shared")) {
     throw new DeliveryConfigurationError;
   }
+  for (const target of value.targets ?? []) {
+    const invalidShape = target.kind === "function" ? target.function === undefined || target.modules !== undefined || target.compute !== undefined : target.modules === undefined || target.function !== undefined;
+    if (invalidShape)
+      throw new DeliveryConfigurationError;
+  }
   const migrations = value.build?.migrations ?? [];
   try {
     validateWorkerExecution(value.execution?.groups ?? []);
@@ -10080,7 +10085,7 @@ function parseDeliveryPlanResult(value) {
     throw new Error("Invalid delivery plan result.");
   return value;
 }
-var objectOptions, reference, references, kind, isolation, DeliveryFilePathSchema, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
+var objectOptions, reference, references, kind, isolation, DeliveryFilePathSchema, functionTarget, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
 var init_delivery_schema = __esm(() => {
   init_build2();
   init_value2();
@@ -10088,22 +10093,28 @@ var init_delivery_schema = __esm(() => {
   objectOptions = { additionalProperties: false };
   reference = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
   references = _Array_(reference, { uniqueItems: true });
-  kind = Union([Literal("api"), Literal("jobs"), Literal("webhook")]);
+  kind = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
   isolation = Union([Literal("shared"), Literal("process")]);
   DeliveryFilePathSchema = String2({
     maxLength: 512,
     pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
   });
+  functionTarget = _Object_({
+    slug: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
+    entrypoint: DeliveryFilePathSchema,
+    verifyJwt: Boolean2()
+  }, objectOptions);
   DeliveryOptionsSchema = _Object_({
     version: Literal(1),
     execution: Optional(WorkerExecutionSchema),
     targets: Optional(_Array_(_Object_({
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       kind,
-      modules: _Array_(reference, { minItems: 1, uniqueItems: true }),
+      modules: Optional(_Array_(reference, { minItems: 1, uniqueItems: true })),
       isolation: Optional(isolation),
       capabilities: Optional(references),
-      compute: Optional(ComputeResourcesSchema)
+      compute: Optional(ComputeResourcesSchema),
+      function: Optional(functionTarget)
     }, objectOptions))),
     runtime: Optional(_Object_({
       processIsolation: Boolean2(),
@@ -10181,6 +10192,7 @@ var init_delivery_schema = __esm(() => {
     routes: _Array_(routeSchema),
     jobs: _Array_(jobSchema),
     externalTokens: _Array_(String2()),
+    function: Optional(functionTarget),
     requirements: _Object_({
       processIsolation: Boolean2(),
       durableQueue: Boolean2(),

package/dist/delivery-plan.d.ts

@@ -1,7 +1,7 @@
 import { type DeliveryPlanResult } from "./delivery-schema";
-import type { ApplicationGraph, CompileOptions } from "./types";
+import type { ApplicationGraph, CompileOptions, ValidateOptions } from "./types";
 /** Trusted compiler graph in, validated topology preview out. No file or remote writes. */
-export declare function createDeliveryPlan(graph: ApplicationGraph, input?: unknown): DeliveryPlanResult;
+export declare function createDeliveryPlan(graph: ApplicationGraph, input?: unknown, validation?: ValidateOptions): DeliveryPlanResult;
 /** Reuse all compiler gates without requiring generated files to already exist. */
 export declare function planDeliveryProject(options: CompileOptions, delivery?: unknown): Promise<DeliveryPlanResult>;
 export declare function formatDeliveryPlan(result: DeliveryPlanResult): string;

package/dist/effect-governance.d.ts

@@ -1,3 +1,5 @@
 import type { ApplicationGraph, Diagnostic, EffectCompilerOptions } from "./types";
 /** Validates the static Effect contract without inspecting Effect runtime internals. */
 export declare function validateEffectPolicies(graph: ApplicationGraph, options?: EffectCompilerOptions): Diagnostic[];
+/** A retrying job must replay the same request without duplicating a write. */
+export declare function validateJobPolicies(graph: ApplicationGraph): Diagnostic[];

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export { camelName } from "./util";
 export { ANGULAR_ENTERPRISE_RULES, CLEAN_ARCHITECTURE_RULES, MODULAR_MONOLITH_RULES, MODULE_BOUNDARY_PROFILES, getModuleBoundaryPreset, getModuleBoundaryProfile, resolveModuleBoundaries, } from "./profiles";
 export type { ApplicationGraph, AspectRefNode, CachedModuleEntry, CheckProjectResult, CommandExecutionCapabilities, CommandNode, CompileOptions, DatabaseGovernanceOptions, CompileResult, CompileStats, ControllerNode, DependencyGraphCache, DependencyGraphIndex, Diagnostic, DiagnosticFix, EffectCompilerOptions, EffectErrorMappingNode, EffectRetryPolicy, EffectRouteNode, ModuleBoundaryPresetName, ModuleBoundaryProfile, ModuleBoundaryRule, ModuleNode, JobNode, ProviderKind, ProviderNode, QueryNode, RouteNode, Scope, TokenKind, TypeSafetyOptions, ValidateOptions, WatchEvent, WatchHandle, WatchOptions, FeatureSpecNode, FeatureTransitionNode, GraphqlOptions, GraphqlContractSummary, OpenApiOptions, OpenApiSecurityScheme, OpenApiServer, } from "./types";
 export { inspectRouteContracts, validateRouteContracts } from "./route-contracts";
-export { validateEffectPolicies } from "./effect-governance";
+export { validateEffectPolicies, validateJobPolicies } from "./effect-governance";
 export { pullGraphqlSchema } from "./graphql-schema";
 export type { PullGraphqlSchemaOptions } from "./graphql-schema";
 export { checkGraphqlCompatibility, createRoleSnapshotReport, diffGraphqlSchemas, graphqlFeatureMatrix, introspectionQuery, readGraphqlSchema, schemaFromSource, } from "./graphql-governance";

package/dist/index.js

@@ -807,12 +807,15 @@ function validateGraph(graph, options = false) {
       if (typeof options === "object" && options.commandCapabilities) {
         const hostCaps = options.commandCapabilities;
         const rpcCaps = command.rpc && Object.hasOwn(hostCaps.rpc ?? {}, command.rpc) ? hostCaps.rpc?.[command.rpc] : undefined;
-        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required"))) {
+        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required") || command.rpc !== undefined && rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true)) {
           error("command-persistence-required", `Command ${command.name} requires an explicit persistent adapter, permission, audit and idempotency policy.`, module.file, module.line, "Register a named database/external adapter, enable permission checks and declare permission, audit and required idempotency on the command.");
         }
         if (rpcCaps?.boundary === "external" && (command.transaction === "required" || rpcCaps.transaction === true)) {
           error("command-external-transaction", `Command ${command.name} calls an external service; use durable intent and reconciliation, not transaction: 'required'.`, module.file, module.line, "Use transaction: 'none' with createExternalCommand; recover with read-only reconciliation. Do not claim a database transaction covers a remote request.");
         }
+        if (rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true) {
+          error("command-reconcile-required", `Command ${command.name} uses an external adapter without a receipt reconciliation capability.`, module.file, module.line, "Declare reconcile: true only when the adapter can look up the same idempotency key and resolve unknown outcomes without redispatching.");
+        }
         const caps = command.rpc ? {
           permission: hostCaps.permission,
           audit: rpcCaps?.audit === true,
@@ -1229,6 +1232,7 @@ var init_validate = __esm(() => {
     "invalid-job-timeout": { code: "SC4015", docsUrl: "https://supacloud.dev/errors/SC4015" },
     "invalid-job-attempts": { code: "SC4016", docsUrl: "https://supacloud.dev/errors/SC4016" },
     "invalid-job-idempotency": { code: "SC4017", docsUrl: "https://supacloud.dev/errors/SC4017" },
+    "job-retry-idempotency-required": { code: "SC4027", docsUrl: "https://supacloud.dev/errors/SC4027" },
     "invalid-job-mode": { code: "SC4018", docsUrl: "https://supacloud.dev/errors/SC4018" },
     "invalid-job-schema": { code: "SC4019", docsUrl: "https://supacloud.dev/errors/SC4019" },
     "command-persistence-required": { code: "SC4020", docsUrl: "https://supacloud.dev/errors/SC4020" },
@@ -1238,6 +1242,7 @@ var init_validate = __esm(() => {
     "command-idempotency-unsupported": { code: "SC4024", docsUrl: "https://supacloud.dev/errors/SC4024" },
     "command-transaction-rpc-only": { code: "SC4025", docsUrl: "https://supacloud.dev/errors/SC4025" },
     "command-transaction-unsupported": { code: "SC4026", docsUrl: "https://supacloud.dev/errors/SC4026" },
+    "command-reconcile-required": { code: "SC4028", docsUrl: "https://supacloud.dev/errors/SC4028" },
     "invalid-route-contract": { code: "SC3020", docsUrl: "https://supacloud.dev/errors/SC3020" },
     "route-contract-required": { code: "SC3021", docsUrl: "https://supacloud.dev/errors/SC3021" },
     "route-contract-unverified": { code: "SC3022", docsUrl: "https://supacloud.dev/errors/SC3022" },
@@ -14557,6 +14562,11 @@ function parseDeliveryOptions(value) {
   if (value.targets?.some((target) => target.compute && target.isolation === "shared")) {
     throw new DeliveryConfigurationError;
   }
+  for (const target of value.targets ?? []) {
+    const invalidShape = target.kind === "function" ? target.function === undefined || target.modules !== undefined || target.compute !== undefined : target.modules === undefined || target.function !== undefined;
+    if (invalidShape)
+      throw new DeliveryConfigurationError;
+  }
   const migrations = value.build?.migrations ?? [];
   try {
     validateWorkerExecution(value.execution?.groups ?? []);
@@ -14573,7 +14583,7 @@ function parseDeliveryPlanResult(value) {
     throw new Error("Invalid delivery plan result.");
   return value;
 }
-var objectOptions, reference, references, kind, isolation, DeliveryFilePathSchema, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
+var objectOptions, reference, references, kind, isolation, DeliveryFilePathSchema, functionTarget, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
 var init_delivery_schema = __esm(() => {
   init_build();
   init_value2();
@@ -14581,22 +14591,28 @@ var init_delivery_schema = __esm(() => {
   objectOptions = { additionalProperties: false };
   reference = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
   references = _Array_(reference, { uniqueItems: true });
-  kind = Union([Literal("api"), Literal("jobs"), Literal("webhook")]);
+  kind = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
   isolation = Union([Literal("shared"), Literal("process")]);
   DeliveryFilePathSchema = String2({
     maxLength: 512,
     pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
   });
+  functionTarget = _Object_({
+    slug: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
+    entrypoint: DeliveryFilePathSchema,
+    verifyJwt: Boolean2()
+  }, objectOptions);
   DeliveryOptionsSchema = _Object_({
     version: Literal(1),
     execution: Optional(WorkerExecutionSchema),
     targets: Optional(_Array_(_Object_({
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       kind,
-      modules: _Array_(reference, { minItems: 1, uniqueItems: true }),
+      modules: Optional(_Array_(reference, { minItems: 1, uniqueItems: true })),
       isolation: Optional(isolation),
       capabilities: Optional(references),
-      compute: Optional(ComputeResourcesSchema)
+      compute: Optional(ComputeResourcesSchema),
+      function: Optional(functionTarget)
     }, objectOptions))),
     runtime: Optional(_Object_({
       processIsolation: Boolean2(),
@@ -14674,6 +14690,7 @@ var init_delivery_schema = __esm(() => {
     routes: _Array_(routeSchema),
     jobs: _Array_(jobSchema),
     externalTokens: _Array_(String2()),
+    function: Optional(functionTarget),
     requirements: _Object_({
       processIsolation: Boolean2(),
       durableQueue: Boolean2(),
@@ -15059,7 +15076,7 @@ function createContextPack(graph, subject) {
       }
     }
   }
-  const modules = graph.modules.filter((module) => selected.has(module.name));
+  const modules = graph.modules.filter((module) => selected.has(module.name)).map(sanitizeContextModule);
   const queryDocuments = graph.graphql?.documents.filter((file) => modules.some((module) => {
     const path = relative6(dirname5(module.file), file);
     return path !== ".." && !path.startsWith(`..${sep6}`);
@@ -15101,7 +15118,12 @@ function createContextPack(graph, subject) {
       singleResult: "async-await",
       eventComposition: "rxjs",
       angularHost: "@supacloud/app/angular",
-      cancellation: "explicit-owner-signal"
+      cancellation: "explicit-owner-signal",
+      readTransport: "postgrest-supabase-js",
+      writeTransport: "command-rpc",
+      writeRetry: "disabled",
+      externalOutcome: "receipt-reconcile",
+      databaseSource: "drizzle-append-only"
     },
     relatedModules: {
       imports: subjectModule.imports.filter((name) => selected.has(name)),
@@ -15109,6 +15131,44 @@ function createContextPack(graph, subject) {
     }
   };
 }
+function sanitizeContextModule(module) {
+  const sanitizeAspect = (aspect) => ({
+    ...aspect,
+    expression: "[omitted]"
+  });
+  return {
+    ...module,
+    providers: module.providers.map((provider) => ({
+      ...provider,
+      ...provider.useValueExpr === undefined ? {} : { useValueExpr: "[omitted]" },
+      ...provider.useFactoryName === undefined ? {} : { useFactoryName: "[omitted]" },
+      ...provider.functionalInjects === undefined ? {} : {
+        functionalInjects: provider.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      }
+    })),
+    ...module.aspects === undefined ? {} : { aspects: module.aspects.map(sanitizeAspect) },
+    controllers: module.controllers.map((controller) => ({
+      ...controller,
+      ...controller.functionalInjects === undefined ? {} : {
+        functionalInjects: controller.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      },
+      routes: controller.routes.map((route) => ({
+        ...route,
+        ...route.aspects === undefined ? {} : { aspects: route.aspects.map(sanitizeAspect) }
+      }))
+    })),
+    commands: module.commands.map((command) => ({
+      ...command,
+      ...command.aspects === undefined ? {} : { aspects: command.aspects.map(sanitizeAspect) }
+    })),
+    ...module.jobs === undefined ? {} : {
+      jobs: module.jobs.map((job) => ({
+        ...job,
+        ...job.aspects === undefined ? {} : { aspects: job.aspects.map(sanitizeAspect) }
+      }))
+    }
+  };
+}
 function resolveContextModule(graph, subject) {
   const exact = graph.modules.find((module) => module.name === subject);
   if (exact)
@@ -21104,9 +21164,25 @@ import * as ts9 from "@typescript/typescript6";
 var SOURCE_SEMANTIC_DIAGNOSTIC_CODES = {
   "source-unsafe-any": { errorCode: "SC6009", docsUrl: "https://supacloud.dev/errors/SC6009" },
   "source-floating-promise": { errorCode: "SC6010", docsUrl: "https://supacloud.dev/errors/SC6010" },
-  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" }
+  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" },
+  "source-alternative-library": { errorCode: "SC6012", docsUrl: "https://supacloud.dev/errors/SC6012" }
 };
-function scanSourceSemantics(source, checker, file, rootDir) {
+var DEFAULT_ALTERNATIVE_LIBRARIES = [
+  "@apollo/client",
+  "@urql/core",
+  "graphql-request",
+  "kefir",
+  "most",
+  "@pgflow",
+  "pgflow",
+  "pg_durable",
+  "react-relay",
+  "redux-observable",
+  "urql",
+  "wonka",
+  "xstream"
+];
+function scanSourceSemantics(source, checker, file, rootDir, options = {}) {
   const diagnostics = [];
   const report = (code, node, message) => {
     diagnostics.push({
@@ -21118,6 +21194,16 @@ function scanSourceSemantics(source, checker, file, rootDir) {
       line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
     });
   };
+  const allowedLibraries = new Set(options.allowAlternativeLibraries ?? []);
+  for (const statement of source.statements) {
+    if (!ts9.isImportDeclaration(statement) || !ts9.isStringLiteral(statement.moduleSpecifier))
+      continue;
+    const moduleName = statement.moduleSpecifier.text;
+    const alternative = DEFAULT_ALTERNATIVE_LIBRARIES.find((name) => moduleName === name || moduleName.startsWith(`${name}/`));
+    if (alternative && !allowedLibraries.has(alternative) && !allowedLibraries.has(moduleName)) {
+      report("source-alternative-library", statement.moduleSpecifier, `Production source imports alternative library "${moduleName}". Use the governed Supabase client/PostgREST transport and RxJS event composition by default, or allow this package explicitly in typeSafety.allowAlternativeLibraries for a documented boundary.`);
+    }
+  }
   const unsafe = (value, target) => {
     if (isUnknownBoundary(target, checker) || containsAny(target, checker, new Set, rootDir))
       return;
@@ -21398,7 +21484,7 @@ function scanProductionSource(options) {
   }
   for (const sourceFile of sourceFiles) {
     scanSourceFile(sourceFile, checker, rootDir, diagnostics, options.strict ?? false);
-    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir));
+    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir, options.allowAlternativeLibraries === undefined ? {} : { allowAlternativeLibraries: options.allowAlternativeLibraries }));
     diagnostics.push(...scanDrizzleSql(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), options.strict ?? false));
     const scanner = ts10.createScanner(ts10.ScriptTarget.Latest, false, sourceFile.languageVariant, sourceFile.text);
     for (let kind = scanner.scan();kind !== ts10.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
@@ -21660,6 +21746,17 @@ function validateEffectPolicies(graph, options = {}) {
   }
   return diagnostics;
 }
+function validateJobPolicies(graph) {
+  const diagnostics = [];
+  for (const module of graph.modules) {
+    for (const job of module.jobs ?? []) {
+      if (job.maxAttempts !== undefined && job.maxAttempts > 1 && job.idempotency !== "required") {
+        diagnostics.push(diagnostic("job-retry-idempotency-required", `Job ${job.name} (${job.className}) enables ${job.maxAttempts} attempts without an idempotency contract.`, module.file, 'Use idempotency: "required" with a durable receipt, or set maxAttempts: 1.'));
+      }
+    }
+  }
+  return diagnostics;
+}
 
 // src/database-governance.ts
 import { execFile } from "node:child_process";
@@ -21709,13 +21806,19 @@ async function checkDatabaseGovernance(rootDir, value) {
 
 // src/compile.ts
 function withDefaultGovernance(options) {
-  return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
-    requirePersistentAdapters: true,
-    permission: true,
-    audit: true,
-    idempotency: true,
-    transaction: true
-  } } : options;
+  return {
+    ...options,
+    requireRouteContracts: options.requireRouteContracts ?? true,
+    disallowControllerDirectDb: options.disallowControllerDirectDb ?? true,
+    detectOrphanModules: options.detectOrphanModules ?? true,
+    ...options.commandCapabilities === undefined ? { commandCapabilities: {
+      requirePersistentAdapters: true,
+      permission: true,
+      audit: true,
+      idempotency: true,
+      transaction: true
+    } } : {}
+  };
 }
 async function renderOptionalGraphql(options) {
   return options.graphql ? (await Promise.resolve().then(() => (init_graphql(), exports_graphql))).renderGraphql(options) : { diagnostics: [], files: {} };
@@ -21727,7 +21830,8 @@ async function compileProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21797,7 +21901,8 @@ async function checkProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21877,7 +21982,8 @@ function resolveTypeSafety(options) {
   return {
     noAnyInGenerated: true,
     scanProductionSource: true,
-    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {}
+    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {},
+    ...options.typeSafety?.allowAlternativeLibraries ? { allowAlternativeLibraries: options.typeSafety.allowAlternativeLibraries } : {}
   };
 }
 
@@ -21898,7 +22004,7 @@ function diagnostic2(error) {
     ...error.suggestion === undefined ? {} : { suggestion: error.suggestion }
   };
 }
-function createDeliveryPlan(graph, input) {
+function createDeliveryPlan(graph, input, validation) {
   let options;
   try {
     options = parseDeliveryOptions(input);
@@ -21914,7 +22020,7 @@ function createDeliveryPlan(graph, input) {
   }
   const diagnostics = [
     ...(graph.diagnostics ?? []).map(diagnostic2),
-    ...validateGraph(graph, { strict: true }).map(diagnostic2)
+    ...validateGraph(graph, validation === undefined ? { strict: true } : { ...validation, strict: true }).map(diagnostic2)
   ];
   const fail = (code, message, suggestion) => {
     diagnostics.push({ severity: "error", code, message, suggestion });
@@ -21932,7 +22038,7 @@ function createDeliveryPlan(graph, input) {
     if (target.name === "api" && target.kind !== "api" || target.name === "jobs" && target.kind !== "jobs") {
       fail("delivery-reserved-target", `"${target.name}" is reserved for its matching workload kind.`, "Rename the target or use the matching kind.");
     }
-    for (const name of sorted(target.modules)) {
+    for (const name of sorted(target.modules ?? [])) {
       if (!modules.has(name)) {
         fail("delivery-unknown-module", `Target "${target.name}" refers to unknown module "${name}".`, "Select a module name from the compiler graph.");
         continue;
@@ -21946,6 +22052,23 @@ function createDeliveryPlan(graph, input) {
     }
   }
   const targets = new Map;
+  for (const declaration of declarations.values()) {
+    if (declaration.kind !== "function" || declaration.function === undefined)
+      continue;
+    targets.set(declaration.name, {
+      name: declaration.name,
+      kind: "function",
+      isolation: "shared",
+      roots: [],
+      modules: [],
+      routes: [],
+      jobs: [],
+      externalTokens: [],
+      function: declaration.function,
+      requirements: { processIsolation: false, durableQueue: false, capabilities: sorted(declaration.capabilities ?? []) },
+      runtimeStatus: options.runtime === undefined ? "unchecked" : "declared-compatible"
+    });
+  }
   function getTarget(name, fallback) {
     const existing = targets.get(name);
     if (existing)
@@ -22111,7 +22234,7 @@ async function planDeliveryProject(options, delivery) {
     return createDeliveryPlan({ modules: [], externalTokens: [] }, delivery);
   }
   const checked = await checkProject(options);
-  return createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, delivery);
+  return createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, delivery, options);
 }
 function formatDeliveryPlan(result) {
   const lines = result.ok ? [
@@ -22811,9 +22934,17 @@ async function buildDeliveryProject(options, delivery) {
     phase = "compiler-checks";
     const sources = await sourceInventory(sourceRoot, generatedRoot);
     const checked = await checkProject(options);
-    const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings);
+    const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings, options);
     if (!planned.ok)
       return failed(planned.diagnostics);
+    if (planned.plan.targets.some((target) => target.kind === "function")) {
+      return failed([{
+        severity: "error",
+        code: "delivery-function-build-unsupported",
+        message: "Function target rendering is not implemented yet; the delivery build only produces HTTP and Worker application objects.",
+        suggestion: "Declare HTTP/Worker application targets for now; Function and schedule delivery is tracked separately."
+      }]);
+    }
     if (options.graphql && checked.mismatches.some((mismatch) => mismatch.startsWith("graphql"))) {
       throw new Error("Refresh GraphQL artifacts with compile before building independent targets.");
     }
@@ -24932,11 +25063,13 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   outDir: "generated",
   include: ["**/*.module.ts", "**/*.ts"],
   strict: true,
-  requireRouteContracts: false,
+  requireRouteContracts: true,
   generateClient: true,
   generateOpenApi: true,
   generatePermissions: true,
   treeShakeUnusedProviders: true,
+  disallowControllerDirectDb: true,
+  detectOrphanModules: true,
   commandCapabilities: {
     requirePersistentAdapters: true,
     permission: true,
@@ -24991,9 +25124,9 @@ function validateGovernanceConfig(config) {
       if (!isRecord(adapters))
         throw new Error("commandCapabilities.rpc must contain named adapters.");
       for (const [name, adapter] of Object.entries(adapters)) {
-        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "transaction", "boundary"].includes(key)))
+        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "reconcile", "transaction", "boundary"].includes(key)))
           throw new Error("Invalid command adapter.");
-        for (const key of ["audit", "idempotency", "transaction"]) {
+        for (const key of ["audit", "idempotency", "reconcile", "transaction"]) {
           if (adapter[key] !== undefined && typeof adapter[key] !== "boolean")
             throw new Error("Invalid command adapter capability.");
         }
@@ -25018,8 +25151,8 @@ function validateGovernanceConfig(config) {
   }
   if (config.typeSafety !== undefined) {
     const rules = config.typeSafety;
-    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
-      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude", "allowAlternativeLibraries"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"]) || rules["allowAlternativeLibraries"] !== undefined && !isStrings(rules["allowAlternativeLibraries"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and string arrays exclude/allowAlternativeLibraries.");
     }
   }
   for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
@@ -25078,8 +25211,8 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
       }
     },
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
-    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
-    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
+    disallowControllerDirectDb: resolved.disallowControllerDirectDb ?? DEFAULT_SUPACLOUD_CONFIG.disallowControllerDirectDb,
+    detectOrphanModules: resolved.detectOrphanModules ?? DEFAULT_SUPACLOUD_CONFIG.detectOrphanModules,
     effect: resolved.effect === undefined ? { ...DEFAULT_SUPACLOUD_CONFIG.effect } : { ...DEFAULT_SUPACLOUD_CONFIG.effect, ...resolved.effect },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     ...resolved.graphql === undefined || resolved.graphql === false ? {} : { graphql: {
@@ -25494,6 +25627,7 @@ export {
   validateEffectPolicies,
   validateFeatureSpec,
   validateGraph,
+  validateJobPolicies,
   validateRouteContracts,
   watchProject,
   writeOpenApiJson

package/dist/inspect.d.ts

@@ -22,6 +22,11 @@ export interface ContextPack {
         eventComposition: "rxjs";
         angularHost: "@supacloud/app/angular";
         cancellation: "explicit-owner-signal";
+        readTransport: "postgrest-supabase-js";
+        writeTransport: "command-rpc";
+        writeRetry: "disabled";
+        externalOutcome: "receipt-reconcile";
+        databaseSource: "drizzle-append-only";
     };
     relatedModules: {
         importedBy: string[];

package/dist/source-semantics.d.ts

@@ -13,6 +13,12 @@ export declare const SOURCE_SEMANTIC_DIAGNOSTIC_CODES: {
         readonly errorCode: "SC6011";
         readonly docsUrl: "https://supacloud.dev/errors/SC6011";
     };
+    readonly "source-alternative-library": {
+        readonly errorCode: "SC6012";
+        readonly docsUrl: "https://supacloud.dev/errors/SC6012";
+    };
 };
 /** Inspect values at use sites, including types resolved through imported declarations. */
-export declare function scanSourceSemantics(source: ts.SourceFile, checker: ts.TypeChecker, file: string, rootDir: string): Diagnostic[];
+export declare function scanSourceSemantics(source: ts.SourceFile, checker: ts.TypeChecker, file: string, rootDir: string, options?: {
+    allowAlternativeLibraries?: readonly string[];
+}): Diagnostic[];

package/dist/type-safety.d.ts

@@ -36,6 +36,10 @@ export declare const TYPE_SAFETY_DIAGNOSTIC_CODES: {
         readonly errorCode: "SC6011";
         readonly docsUrl: "https://supacloud.dev/errors/SC6011";
     };
+    readonly "source-alternative-library": {
+        readonly errorCode: "SC6012";
+        readonly docsUrl: "https://supacloud.dev/errors/SC6012";
+    };
     readonly "sql-result-assertion": {
         readonly errorCode: "SC6007";
         readonly docsUrl: "https://supacloud.dev/errors/SC6007";

package/dist/types.d.ts

@@ -536,6 +536,8 @@ export interface TypeSafetyOptions {
     scanProductionSource?: boolean;
     /** Additional relative glob patterns excluded from the production-source scan. */
     exclude?: string[];
+    /** Explicitly approved alternatives to the default client/stream libraries. */
+    allowAlternativeLibraries?: string[];
 }
 export interface DatabaseGovernanceOptions {
     /** Off for existing callers; check validates sources offline, enforce also checks SQL and Catalog. */
@@ -590,6 +592,7 @@ export interface CommandExecutionCapabilities {
     rpc?: Record<string, {
         audit?: boolean;
         idempotency?: boolean;
+        reconcile?: boolean;
         transaction?: boolean;
         boundary?: "database" | "external";
     }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/compiler",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,8 +57,8 @@
     "directory": "packages/compiler"
   },
   "dependencies": {
-    "@supacloud/db": "0.16.2",
-    "@supacloud/delivery": "0.16.0",
+    "@supacloud/db": "0.17.0",
+    "@supacloud/delivery": "0.17.0",
     "typebox": "1.3.36",
     "@graphql-codegen/core": "^6.2.2",
     "@graphql-codegen/typed-document-node": "^7.1.1",
@@ -75,7 +75,7 @@
   "devDependencies": {
     "@supabase/supabase-js": "2.117.3",
     "drizzle-orm": "1.0.0-rc.5-169397b",
-    "@types/bun": "^1.4.2",
+    "@types/bun": "^1.4.3",
     "typescript": "^7.0.2"
   }
 }