@supacloud/compiler 0.45.1 → 0.46.1

package/dist/cli.js

@@ -808,12 +808,15 @@ function validateGraph(graph, options = false) {
       if (typeof options === "object" && options.commandCapabilities) {
         const hostCaps = options.commandCapabilities;
         const rpcCaps = command.rpc && Object.hasOwn(hostCaps.rpc ?? {}, command.rpc) ? hostCaps.rpc?.[command.rpc] : undefined;
-        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required"))) {
+        if (hostCaps.requirePersistentAdapters && (command.rpc !== undefined && (!rpcCaps?.boundary || rpcCaps.audit !== true || rpcCaps.idempotency !== true) || hostCaps.permission !== true || !command.permission || !command.audit || command.idempotency !== "required" || command.rpc !== undefined && rpcCaps?.boundary === "database" && (rpcCaps.transaction !== true || command.transaction !== "required") || command.rpc === undefined && (hostCaps.audit !== true || hostCaps.idempotency !== true || hostCaps.transaction !== true || command.transaction !== "required") || command.rpc !== undefined && rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true)) {
           error("command-persistence-required", `Command ${command.name} requires an explicit persistent adapter, permission, audit and idempotency policy.`, module.file, module.line, "Register a named database/external adapter, enable permission checks and declare permission, audit and required idempotency on the command.");
         }
         if (rpcCaps?.boundary === "external" && (command.transaction === "required" || rpcCaps.transaction === true)) {
           error("command-external-transaction", `Command ${command.name} calls an external service; use durable intent and reconciliation, not transaction: 'required'.`, module.file, module.line, "Use transaction: 'none' with createExternalCommand; recover with read-only reconciliation. Do not claim a database transaction covers a remote request.");
         }
+        if (rpcCaps?.boundary === "external" && rpcCaps.reconcile !== true) {
+          error("command-reconcile-required", `Command ${command.name} uses an external adapter without a receipt reconciliation capability.`, module.file, module.line, "Declare reconcile: true only when the adapter can look up the same idempotency key and resolve unknown outcomes without redispatching.");
+        }
         const caps = command.rpc ? {
           permission: hostCaps.permission,
           audit: rpcCaps?.audit === true,
@@ -1230,6 +1233,7 @@ var init_validate = __esm(() => {
     "invalid-job-timeout": { code: "SC4015", docsUrl: "https://supacloud.dev/errors/SC4015" },
     "invalid-job-attempts": { code: "SC4016", docsUrl: "https://supacloud.dev/errors/SC4016" },
     "invalid-job-idempotency": { code: "SC4017", docsUrl: "https://supacloud.dev/errors/SC4017" },
+    "job-retry-idempotency-required": { code: "SC4027", docsUrl: "https://supacloud.dev/errors/SC4027" },
     "invalid-job-mode": { code: "SC4018", docsUrl: "https://supacloud.dev/errors/SC4018" },
     "invalid-job-schema": { code: "SC4019", docsUrl: "https://supacloud.dev/errors/SC4019" },
     "command-persistence-required": { code: "SC4020", docsUrl: "https://supacloud.dev/errors/SC4020" },
@@ -1239,6 +1243,7 @@ var init_validate = __esm(() => {
     "command-idempotency-unsupported": { code: "SC4024", docsUrl: "https://supacloud.dev/errors/SC4024" },
     "command-transaction-rpc-only": { code: "SC4025", docsUrl: "https://supacloud.dev/errors/SC4025" },
     "command-transaction-unsupported": { code: "SC4026", docsUrl: "https://supacloud.dev/errors/SC4026" },
+    "command-reconcile-required": { code: "SC4028", docsUrl: "https://supacloud.dev/errors/SC4028" },
     "invalid-route-contract": { code: "SC3020", docsUrl: "https://supacloud.dev/errors/SC3020" },
     "route-contract-required": { code: "SC3021", docsUrl: "https://supacloud.dev/errors/SC3021" },
     "route-contract-unverified": { code: "SC3022", docsUrl: "https://supacloud.dev/errors/SC3022" },
@@ -4592,7 +4597,7 @@ function createContextPack(graph, subject) {
       }
     }
   }
-  const modules = graph.modules.filter((module) => selected.has(module.name));
+  const modules = graph.modules.filter((module) => selected.has(module.name)).map(sanitizeContextModule);
   const queryDocuments = graph.graphql?.documents.filter((file) => modules.some((module) => {
     const path = relative5(dirname4(module.file), file);
     return path !== ".." && !path.startsWith(`..${sep5}`);
@@ -4634,7 +4639,12 @@ function createContextPack(graph, subject) {
       singleResult: "async-await",
       eventComposition: "rxjs",
       angularHost: "@supacloud/app/angular",
-      cancellation: "explicit-owner-signal"
+      cancellation: "explicit-owner-signal",
+      readTransport: "postgrest-supabase-js",
+      writeTransport: "command-rpc",
+      writeRetry: "disabled",
+      externalOutcome: "receipt-reconcile",
+      databaseSource: "drizzle-append-only"
     },
     relatedModules: {
       imports: subjectModule.imports.filter((name) => selected.has(name)),
@@ -4642,6 +4652,44 @@ function createContextPack(graph, subject) {
     }
   };
 }
+function sanitizeContextModule(module) {
+  const sanitizeAspect = (aspect) => ({
+    ...aspect,
+    expression: "[omitted]"
+  });
+  return {
+    ...module,
+    providers: module.providers.map((provider) => ({
+      ...provider,
+      ...provider.useValueExpr === undefined ? {} : { useValueExpr: "[omitted]" },
+      ...provider.useFactoryName === undefined ? {} : { useFactoryName: "[omitted]" },
+      ...provider.functionalInjects === undefined ? {} : {
+        functionalInjects: provider.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      }
+    })),
+    ...module.aspects === undefined ? {} : { aspects: module.aspects.map(sanitizeAspect) },
+    controllers: module.controllers.map((controller) => ({
+      ...controller,
+      ...controller.functionalInjects === undefined ? {} : {
+        functionalInjects: controller.functionalInjects.map((inject) => ({ ...inject, expression: "[omitted]" }))
+      },
+      routes: controller.routes.map((route) => ({
+        ...route,
+        ...route.aspects === undefined ? {} : { aspects: route.aspects.map(sanitizeAspect) }
+      }))
+    })),
+    commands: module.commands.map((command) => ({
+      ...command,
+      ...command.aspects === undefined ? {} : { aspects: command.aspects.map(sanitizeAspect) }
+    })),
+    ...module.jobs === undefined ? {} : {
+      jobs: module.jobs.map((job) => ({
+        ...job,
+        ...job.aspects === undefined ? {} : { aspects: job.aspects.map(sanitizeAspect) }
+      }))
+    }
+  };
+}
 function resolveContextModule(graph, subject) {
   const exact = graph.modules.find((module) => module.name === subject);
   if (exact)
@@ -15683,6 +15731,11 @@ function parseDeliveryOptions(value) {
   if (value.targets?.some((target) => target.compute && target.isolation === "shared")) {
     throw new DeliveryConfigurationError;
   }
+  for (const target of value.targets ?? []) {
+    const invalidShape = target.kind === "function" ? target.function === undefined || target.modules !== undefined || target.compute !== undefined : target.modules === undefined || target.function !== undefined;
+    if (invalidShape)
+      throw new DeliveryConfigurationError;
+  }
   const migrations = value.build?.migrations ?? [];
   try {
     validateWorkerExecution(value.execution?.groups ?? []);
@@ -15699,7 +15752,7 @@ function parseDeliveryPlanResult(value) {
     throw new Error("Invalid delivery plan result.");
   return value;
 }
-var objectOptions, reference2, references, kind2, isolation, DeliveryFilePathSchema, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
+var objectOptions, reference2, references, kind2, isolation, DeliveryFilePathSchema, functionTarget, DeliveryOptionsSchema, DeliveryDiagnosticSchema, routeSchema, jobSchema, DeliveryTargetSchema, DeliveryPlanSchema, DeliveryPlanResultSchema, DeliveryConfigurationError;
 var init_delivery_schema = __esm(() => {
   init_build();
   init_value2();
@@ -15707,22 +15760,28 @@ var init_delivery_schema = __esm(() => {
   objectOptions = { additionalProperties: false };
   reference2 = String2({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z][A-Za-z0-9_.:/-]*$" });
   references = _Array_(reference2, { uniqueItems: true });
-  kind2 = Union([Literal("api"), Literal("jobs"), Literal("webhook")]);
+  kind2 = Union([Literal("api"), Literal("jobs"), Literal("webhook"), Literal("function")]);
   isolation = Union([Literal("shared"), Literal("process")]);
   DeliveryFilePathSchema = String2({
     maxLength: 512,
     pattern: "^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*$"
   });
+  functionTarget = _Object_({
+    slug: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
+    entrypoint: DeliveryFilePathSchema,
+    verifyJwt: Boolean2()
+  }, objectOptions);
   DeliveryOptionsSchema = _Object_({
     version: Literal(1),
     execution: Optional(WorkerExecutionSchema),
     targets: Optional(_Array_(_Object_({
       name: String2({ pattern: "^[a-z][a-z0-9-]{0,62}$" }),
       kind: kind2,
-      modules: _Array_(reference2, { minItems: 1, uniqueItems: true }),
+      modules: Optional(_Array_(reference2, { minItems: 1, uniqueItems: true })),
       isolation: Optional(isolation),
       capabilities: Optional(references),
-      compute: Optional(ComputeResourcesSchema)
+      compute: Optional(ComputeResourcesSchema),
+      function: Optional(functionTarget)
     }, objectOptions))),
     runtime: Optional(_Object_({
       processIsolation: Boolean2(),
@@ -15800,6 +15859,7 @@ var init_delivery_schema = __esm(() => {
     routes: _Array_(routeSchema),
     jobs: _Array_(jobSchema),
     externalTokens: _Array_(String2()),
+    function: Optional(functionTarget),
     requirements: _Object_({
       processIsolation: Boolean2(),
       durableQueue: Boolean2(),
@@ -16976,8 +17036,172 @@ var init_deployment_evidence = __esm(() => {
   }, closed8);
 });
 
+// node_modules/@supacloud/delivery/src/delivery-tuple.ts
+var sha2563, commit, isoDate2, DELIVERY_TUPLE_SCHEMA = "supacloud.fa-delivery-tuple.v1", FaDeliveryTupleSchema;
+var init_delivery_tuple = __esm(() => {
+  init_build();
+  init_value2();
+  sha2563 = String2({ pattern: "^[a-f0-9]{64}$" });
+  commit = String2({ pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" });
+  isoDate2 = String2({ minLength: 20, maxLength: 40 });
+  FaDeliveryTupleSchema = _Object_({
+    schema: Literal(DELIVERY_TUPLE_SCHEMA),
+    customer: Literal("xigu-fa"),
+    fa_commit: commit,
+    cli: _Object_({
+      version: String2({ pattern: "^\\d+\\.\\d+\\.\\d+$" })
+    }, { additionalProperties: false }),
+    platform_commit: commit,
+    edge_runtime: _Object_({
+      version: String2({ minLength: 1, maxLength: 128 }),
+      artifact_sha256: sha2563
+    }, { additionalProperties: false }),
+    compatibility_window: _Object_({
+      contract_schema: String2({ minLength: 1, maxLength: 128 }),
+      starts_at: isoDate2,
+      ends_at: isoDate2,
+      old_client_supported: Boolean2(),
+      partial_deployment_supported: Boolean2()
+    }, { additionalProperties: false })
+  }, { additionalProperties: false });
+});
+
+// node_modules/@supacloud/delivery/src/contract-matrix.ts
+var closed9, sha2564, generation, versions, CONTRACT_MATRIX_SCHEMA = "supacloud.consumer-contract-matrix.v1", FA_CONTRACT_SCENARIOS, ConsumerContractMatrixSchema;
+var init_contract_matrix = __esm(() => {
+  init_build();
+  init_value2();
+  closed9 = { additionalProperties: false };
+  sha2564 = String2({ pattern: "^[a-f0-9]{64}$" });
+  generation = Union([Literal("old"), Literal("new")]);
+  versions = _Object_({ old: sha2564, new: sha2564 }, closed9);
+  FA_CONTRACT_SCENARIOS = [
+    "missing-display-field",
+    "missing-authority-field",
+    "added-field",
+    "legacy-envelope",
+    "lost-write-response",
+    "downgrade"
+  ];
+  ConsumerContractMatrixSchema = _Object_({
+    schema: Literal(CONTRACT_MATRIX_SCHEMA),
+    customer: Literal("xigu-fa"),
+    baseline_tuple_sha256: sha2564,
+    candidate_tuple_sha256: sha2564,
+    artifacts: _Object_({ frontend: versions, functions: versions, database: versions }, closed9),
+    cases: _Array_(_Object_({
+      frontend: generation,
+      functions: generation,
+      database: generation,
+      scenarios: _Array_(_Object_({
+        name: Enum(FA_CONTRACT_SCENARIOS),
+        expected: Union([Literal("compatible"), Literal("blocked-safely")])
+      }, closed9), { minItems: FA_CONTRACT_SCENARIOS.length, maxItems: FA_CONTRACT_SCENARIOS.length })
+    }, closed9), { minItems: 8, maxItems: 8 })
+  }, closed9);
+});
+
+// node_modules/@supacloud/delivery/src/fa-stability.ts
+var closed10, hash3, label, timestamp2, count2, environment2, FA_REQUIRED_ACCEPTANCE, FA_BUSINESS_OPERATIONS, operation, proof, FaBusinessObservationSchema, FaServiceObjectivesSchema, FaStabilityEvidenceSchema;
+var init_fa_stability = __esm(() => {
+  init_build();
+  init_value2();
+  init_delivery_files();
+  init_contract_matrix();
+  init_delivery_tuple();
+  closed10 = { additionalProperties: false };
+  hash3 = String2({ pattern: "^[a-f0-9]{64}$" });
+  label = String2({ minLength: 1, maxLength: 256, pattern: "\\S" });
+  timestamp2 = String2({ minLength: 24, maxLength: 24 });
+  count2 = Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });
+  environment2 = Union([Literal("test"), Literal("production")]);
+  FA_REQUIRED_ACCEPTANCE = {
+    login: "real-browser",
+    permissions: "real-http",
+    upload: "real-http",
+    "async-task": "real-worker",
+    deploy: "real-http",
+    "database-migration": "real-database",
+    schedule: "real-worker",
+    rollback: "real-drill",
+    "error-policy": "real-http",
+    "alert-delivery": "real-drill"
+  };
+  FA_BUSINESS_OPERATIONS = ["login", "permissions", "upload", "async-task", "report", "deploy"];
+  operation = Enum(FA_BUSINESS_OPERATIONS);
+  proof = _Object_({
+    path: String2({ pattern: "^[A-Za-z0-9_-][A-Za-z0-9_./-]{0,255}$" }),
+    sha256: hash3
+  }, closed10);
+  FaBusinessObservationSchema = _Object_({
+    id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+    tuple_sha256: hash3,
+    operation,
+    started_at: timestamp2,
+    finished_at: timestamp2,
+    outcome: Enum(["success", "failure", "timeout", "unknown"]),
+    attempts: Integer({ minimum: 1, maximum: 1000 }),
+    rollbacks: count2
+  }, closed10);
+  FaServiceObjectivesSchema = _Object_({
+    status: Literal("approved"),
+    owner: label,
+    approval_reference: label,
+    approved_at: timestamp2,
+    project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+    environment: environment2,
+    alert_route: label,
+    window_hours: Number2({ exclusiveMinimum: 0, maximum: 8760 }),
+    max_evidence_age_hours: Number2({ exclusiveMinimum: 0, maximum: 168 }),
+    operations: _Array_(_Object_({
+      operation,
+      minimum_samples: Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+      availability_percent: Number2({ exclusiveMinimum: 0, maximum: 100 }),
+      p95_ms: Number2({ exclusiveMinimum: 0, maximum: Number.MAX_SAFE_INTEGER })
+    }, closed10), { minItems: FA_BUSINESS_OPERATIONS.length, maxItems: FA_BUSINESS_OPERATIONS.length })
+  }, closed10);
+  FaStabilityEvidenceSchema = _Object_({
+    schema: Literal("supacloud.fa-stability-evidence.v1"),
+    environment: environment2,
+    project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+    tuple_sha256: hash3,
+    matrix_sha256: hash3,
+    objectives_sha256: hash3,
+    recorded_at: timestamp2,
+    window_start: timestamp2,
+    window_end: timestamp2,
+    reviewed_by: label,
+    review_reference: label,
+    acceptance: _Array_(_Object_({
+      id: Enum(Object.keys(FA_REQUIRED_ACCEPTANCE)),
+      execution: Enum([
+        "real-browser",
+        "real-http",
+        "real-worker",
+        "real-database",
+        "real-drill",
+        "local-fake"
+      ]),
+      passed: Boolean2(),
+      measured_at: timestamp2,
+      proof
+    }, closed10), { minItems: 10, maxItems: 10 }),
+    matrix: _Array_(_Object_({
+      combination: label,
+      scenario: label,
+      outcome: Union([Literal("compatible"), Literal("blocked-safely")]),
+      execution: Union([Literal("real-http-and-database"), Literal("local-fake")]),
+      passed: Boolean2(),
+      measured_at: timestamp2,
+      proof
+    }, closed10), { minItems: 48, maxItems: 48 }),
+    observation: proof,
+    alert: _Object_({ route: label, acknowledged_by: label, delivered_at: timestamp2 }, closed10)
+  }, closed10);
+});
+
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed9, projectRef2, sha2563, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
+var closed11, projectRef2, sha2565, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
 var init_application_promotion = __esm(() => {
   init_build();
   init_value2();
@@ -16985,11 +17209,11 @@ var init_application_promotion = __esm(() => {
   init_application_activation();
   init_application_configuration();
   init_application_release();
-  closed9 = { additionalProperties: false };
+  closed11 = { additionalProperties: false };
   projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-  sha2563 = ApplicationReleaseIdSchema;
+  sha2565 = ApplicationReleaseIdSchema;
   nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-  nullableDigest = Union([sha2563, Null()]);
+  nullableDigest = Union([sha2565, Null()]);
   observation = {
     activation_id: nullableActivation2,
     receipt_confirmed: Boolean2(),
@@ -17015,33 +17239,33 @@ var init_application_promotion = __esm(() => {
     project_ref: projectRef2,
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema,
-    manifest_sha256: sha2563,
-    plan_sha256: sha2563,
+    manifest_sha256: sha2565,
+    plan_sha256: sha2565,
     source: _Object_({
       project_ref: projectRef2,
       environment_id: ApplicationIdSchema,
-      release_id: sha2563,
+      release_id: sha2565,
       ...observation
-    }, closed9),
+    }, closed11),
     target: _Object_({
-      candidate_release_id: sha2563,
-      current_release_id: Union([sha2563, Null()]),
+      candidate_release_id: sha2565,
+      current_release_id: Union([sha2565, Null()]),
       artifact_action: Union([Literal("materialize"), Literal("reuse")]),
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
       configuration: Union([ApplicationConfigurationViewSchema, Null()]),
       ...observation
-    }, closed9),
+    }, closed11),
     migrations: _Object_({
-      ledger_digest: sha2563,
+      ledger_digest: sha2565,
       ledger_compatible: Boolean2(),
       project_migrations_applied: Boolean2(),
       pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
       operator_provisioning_required: Boolean2()
-    }, closed9),
+    }, closed11),
     backup: _Object_({
       required: Boolean2(),
       confirmed: Literal(false)
-    }, closed9),
+    }, closed11),
     action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
     blockers: _Array_(Enum([...blocker]), {
       maxItems: blocker.length,
@@ -17050,7 +17274,7 @@ var init_application_promotion = __esm(() => {
     steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
     execution_performed: Literal(false),
     data_recovery: Literal("separate-required")
-  }, closed9);
+  }, closed11);
 });
 
 // node_modules/@supacloud/delivery/src/application-runtime-identity.ts
@@ -17182,6 +17406,9 @@ var init_src = __esm(() => {
   init_application_release_transfer();
   init_application_configuration();
   init_deployment_evidence();
+  init_delivery_tuple();
+  init_contract_matrix();
+  init_fa_stability();
   init_application_promotion();
   init_application_runtime_identity();
   init_delivery_build_schema();
@@ -17345,7 +17572,7 @@ import { createHash as createHash12 } from "node:crypto";
 import { mkdir as mkdir5, readFile as readFile13 } from "node:fs/promises";
 import { dirname as dirname11, relative as relative12, resolve as resolve24 } from "node:path";
 import * as ts18 from "@typescript/typescript6";
-function hash3(value) {
+function hash4(value) {
   return createHash12("sha256").update(value).digest("hex");
 }
 function importPath(out, path) {
@@ -17411,7 +17638,7 @@ async function generateDatabaseContracts(options, check = false) {
   const inputs = {};
   const addInput = async (path) => {
     const absolute = resolve24(rootDir, path);
-    inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash3(await readFile13(absolute, "utf8"));
+    inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash4(await readFile13(absolute, "utf8"));
   };
   await addInput(postgrestTypes);
   await addInput(drizzleSchema);
@@ -17450,7 +17677,7 @@ async function generateDatabaseContracts(options, check = false) {
     role: options.role,
     inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => a.localeCompare(b))),
     migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve24(rootDir, path)).replaceAll("\\", "/")),
-    outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash3(text)]))
+    outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash4(text)]))
   };
   files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
 `;
@@ -21143,9 +21370,25 @@ import * as ts9 from "@typescript/typescript6";
 var SOURCE_SEMANTIC_DIAGNOSTIC_CODES = {
   "source-unsafe-any": { errorCode: "SC6009", docsUrl: "https://supacloud.dev/errors/SC6009" },
   "source-floating-promise": { errorCode: "SC6010", docsUrl: "https://supacloud.dev/errors/SC6010" },
-  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" }
+  "source-non-exhaustive-switch": { errorCode: "SC6011", docsUrl: "https://supacloud.dev/errors/SC6011" },
+  "source-alternative-library": { errorCode: "SC6012", docsUrl: "https://supacloud.dev/errors/SC6012" }
 };
-function scanSourceSemantics(source, checker, file, rootDir) {
+var DEFAULT_ALTERNATIVE_LIBRARIES = [
+  "@apollo/client",
+  "@urql/core",
+  "graphql-request",
+  "kefir",
+  "most",
+  "@pgflow",
+  "pgflow",
+  "pg_durable",
+  "react-relay",
+  "redux-observable",
+  "urql",
+  "wonka",
+  "xstream"
+];
+function scanSourceSemantics(source, checker, file, rootDir, options = {}) {
   const diagnostics = [];
   const report = (code, node, message) => {
     diagnostics.push({
@@ -21157,6 +21400,16 @@ function scanSourceSemantics(source, checker, file, rootDir) {
       line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
     });
   };
+  const allowedLibraries = new Set(options.allowAlternativeLibraries ?? []);
+  for (const statement of source.statements) {
+    if (!ts9.isImportDeclaration(statement) || !ts9.isStringLiteral(statement.moduleSpecifier))
+      continue;
+    const moduleName = statement.moduleSpecifier.text;
+    const alternative = DEFAULT_ALTERNATIVE_LIBRARIES.find((name) => moduleName === name || moduleName.startsWith(`${name}/`));
+    if (alternative && !allowedLibraries.has(alternative) && !allowedLibraries.has(moduleName)) {
+      report("source-alternative-library", statement.moduleSpecifier, `Production source imports alternative library "${moduleName}". Use the governed Supabase client/PostgREST transport and RxJS event composition by default, or allow this package explicitly in typeSafety.allowAlternativeLibraries for a documented boundary.`);
+    }
+  }
   const unsafe = (value, target) => {
     if (isUnknownBoundary(target, checker) || containsAny(target, checker, new Set, rootDir))
       return;
@@ -21437,7 +21690,7 @@ function scanProductionSource(options) {
   }
   for (const sourceFile of sourceFiles) {
     scanSourceFile(sourceFile, checker, rootDir, diagnostics, options.strict ?? false);
-    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir));
+    diagnostics.push(...scanSourceSemantics(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), rootDir, options.allowAlternativeLibraries === undefined ? {} : { allowAlternativeLibraries: options.allowAlternativeLibraries }));
     diagnostics.push(...scanDrizzleSql(sourceFile, checker, normalizeRelative(rootDir, sourceFile.fileName), options.strict ?? false));
     const scanner = ts10.createScanner(ts10.ScriptTarget.Latest, false, sourceFile.languageVariant, sourceFile.text);
     for (let kind = scanner.scan();kind !== ts10.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
@@ -21699,6 +21952,17 @@ function validateEffectPolicies(graph, options = {}) {
   }
   return diagnostics;
 }
+function validateJobPolicies(graph) {
+  const diagnostics = [];
+  for (const module of graph.modules) {
+    for (const job of module.jobs ?? []) {
+      if (job.maxAttempts !== undefined && job.maxAttempts > 1 && job.idempotency !== "required") {
+        diagnostics.push(diagnostic("job-retry-idempotency-required", `Job ${job.name} (${job.className}) enables ${job.maxAttempts} attempts without an idempotency contract.`, module.file, 'Use idempotency: "required" with a durable receipt, or set maxAttempts: 1.'));
+      }
+    }
+  }
+  return diagnostics;
+}
 
 // src/database-governance.ts
 import { execFile } from "node:child_process";
@@ -21748,13 +22012,19 @@ async function checkDatabaseGovernance(rootDir, value) {
 
 // src/compile.ts
 function withDefaultGovernance(options) {
-  return options.commandCapabilities === undefined ? { ...options, commandCapabilities: {
-    requirePersistentAdapters: true,
-    permission: true,
-    audit: true,
-    idempotency: true,
-    transaction: true
-  } } : options;
+  return {
+    ...options,
+    requireRouteContracts: options.requireRouteContracts ?? true,
+    disallowControllerDirectDb: options.disallowControllerDirectDb ?? true,
+    detectOrphanModules: options.detectOrphanModules ?? true,
+    ...options.commandCapabilities === undefined ? { commandCapabilities: {
+      requirePersistentAdapters: true,
+      permission: true,
+      audit: true,
+      idempotency: true,
+      transaction: true
+    } } : {}
+  };
 }
 async function renderOptionalGraphql(options) {
   return options.graphql ? (await Promise.resolve().then(() => (init_graphql(), exports_graphql))).renderGraphql(options) : { diagnostics: [], files: {} };
@@ -21766,7 +22036,8 @@ async function compileProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21836,7 +22107,8 @@ async function checkProject(options) {
     ...graph.diagnostics ?? [],
     ...validateGraph(graph, options),
     ...validateClientSchemaBoundaries(graph, options),
-    ...validateEffectPolicies(graph, options.effect)
+    ...validateEffectPolicies(graph, options.effect),
+    ...validateJobPolicies(graph)
   ];
   const databaseDiagnostics = await checkDatabaseGovernance(options.rootDir, options.databaseGovernance);
   diagnostics.push(...databaseDiagnostics);
@@ -21916,7 +22188,8 @@ function resolveTypeSafety(options) {
   return {
     noAnyInGenerated: true,
     scanProductionSource: true,
-    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {}
+    ...options.typeSafety?.exclude ? { exclude: options.typeSafety.exclude } : {},
+    ...options.typeSafety?.allowAlternativeLibraries ? { allowAlternativeLibraries: options.typeSafety.allowAlternativeLibraries } : {}
   };
 }
 
@@ -22650,11 +22923,13 @@ var DEFAULT_SUPACLOUD_CONFIG = {
   outDir: "generated",
   include: ["**/*.module.ts", "**/*.ts"],
   strict: true,
-  requireRouteContracts: false,
+  requireRouteContracts: true,
   generateClient: true,
   generateOpenApi: true,
   generatePermissions: true,
   treeShakeUnusedProviders: true,
+  disallowControllerDirectDb: true,
+  detectOrphanModules: true,
   commandCapabilities: {
     requirePersistentAdapters: true,
     permission: true,
@@ -22709,9 +22984,9 @@ function validateGovernanceConfig(config) {
       if (!isRecord(adapters))
         throw new Error("commandCapabilities.rpc must contain named adapters.");
       for (const [name, adapter] of Object.entries(adapters)) {
-        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "transaction", "boundary"].includes(key)))
+        if (!name.trim() || !isRecord(adapter) || Object.keys(adapter).some((key) => !["audit", "idempotency", "reconcile", "transaction", "boundary"].includes(key)))
           throw new Error("Invalid command adapter.");
-        for (const key of ["audit", "idempotency", "transaction"]) {
+        for (const key of ["audit", "idempotency", "reconcile", "transaction"]) {
           if (adapter[key] !== undefined && typeof adapter[key] !== "boolean")
             throw new Error("Invalid command adapter capability.");
         }
@@ -22736,8 +23011,8 @@ function validateGovernanceConfig(config) {
   }
   if (config.typeSafety !== undefined) {
     const rules = config.typeSafety;
-    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"])) {
-      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and a string array exclude.");
+    if (!isRecord(rules) || Object.keys(rules).some((key) => !["scanProductionSource", "noAnyInGenerated", "exclude", "allowAlternativeLibraries"].includes(key)) || rules["scanProductionSource"] !== undefined && typeof rules["scanProductionSource"] !== "boolean" || rules["noAnyInGenerated"] !== undefined && typeof rules["noAnyInGenerated"] !== "boolean" || rules["exclude"] !== undefined && !isStrings(rules["exclude"]) || rules["allowAlternativeLibraries"] !== undefined && !isStrings(rules["allowAlternativeLibraries"])) {
+      throw new Error("typeSafety accepts boolean scanProductionSource/noAnyInGenerated and string arrays exclude/allowAlternativeLibraries.");
     }
   }
   for (const key of ["allowRouteCommandBindings", "disallowControllerDirectDb", "detectOrphanModules"]) {
@@ -22796,8 +23071,8 @@ function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
       }
     },
     ...resolved.allowRouteCommandBindings === undefined ? {} : { allowRouteCommandBindings: resolved.allowRouteCommandBindings },
-    ...resolved.disallowControllerDirectDb === undefined ? {} : { disallowControllerDirectDb: resolved.disallowControllerDirectDb },
-    ...resolved.detectOrphanModules === undefined ? {} : { detectOrphanModules: resolved.detectOrphanModules },
+    disallowControllerDirectDb: resolved.disallowControllerDirectDb ?? DEFAULT_SUPACLOUD_CONFIG.disallowControllerDirectDb,
+    detectOrphanModules: resolved.detectOrphanModules ?? DEFAULT_SUPACLOUD_CONFIG.detectOrphanModules,
     effect: resolved.effect === undefined ? { ...DEFAULT_SUPACLOUD_CONFIG.effect } : { ...DEFAULT_SUPACLOUD_CONFIG.effect, ...resolved.effect },
     treeShakeUnusedProviders: resolved.treeShakeUnusedProviders ?? DEFAULT_SUPACLOUD_CONFIG.treeShakeUnusedProviders,
     ...resolved.graphql === undefined || resolved.graphql === false ? {} : { graphql: {
@@ -22931,7 +23206,7 @@ function createDeliveryPlan(graph, input, validation) {
     if (target.name === "api" && target.kind !== "api" || target.name === "jobs" && target.kind !== "jobs") {
       fail("delivery-reserved-target", `"${target.name}" is reserved for its matching workload kind.`, "Rename the target or use the matching kind.");
     }
-    for (const name of sorted(target.modules)) {
+    for (const name of sorted(target.modules ?? [])) {
       if (!modules.has(name)) {
         fail("delivery-unknown-module", `Target "${target.name}" refers to unknown module "${name}".`, "Select a module name from the compiler graph.");
         continue;
@@ -22945,6 +23220,23 @@ function createDeliveryPlan(graph, input, validation) {
     }
   }
   const targets = new Map;
+  for (const declaration of declarations.values()) {
+    if (declaration.kind !== "function" || declaration.function === undefined)
+      continue;
+    targets.set(declaration.name, {
+      name: declaration.name,
+      kind: "function",
+      isolation: "shared",
+      roots: [],
+      modules: [],
+      routes: [],
+      jobs: [],
+      externalTokens: [],
+      function: declaration.function,
+      requirements: { processIsolation: false, durableQueue: false, capabilities: sorted(declaration.capabilities ?? []) },
+      runtimeStatus: options.runtime === undefined ? "unchecked" : "declared-compatible"
+    });
+  }
   function getTarget(name, fallback) {
     const existing = targets.get(name);
     if (existing)
@@ -23814,6 +24106,14 @@ async function buildDeliveryProject(options, delivery) {
     const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings, options);
     if (!planned.ok)
       return failed(planned.diagnostics);
+    if (planned.plan.targets.some((target) => target.kind === "function")) {
+      return failed([{
+        severity: "error",
+        code: "delivery-function-build-unsupported",
+        message: "Function target rendering is not implemented yet; the delivery build only produces HTTP and Worker application objects.",
+        suggestion: "Declare HTTP/Worker application targets for now; Function and schedule delivery is tracked separately."
+      }]);
+    }
     if (options.graphql && checked.mismatches.some((mismatch) => mismatch.startsWith("graphql"))) {
       throw new Error("Refresh GraphQL artifacts with compile before building independent targets.");
     }
@@ -24083,10 +24383,10 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve18 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.26.1";
+var MIGRATION_APP_VERSION = "0.27.0";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.29.2";
+var MIGRATION_ELYSIA_VERSION = "0.30.0";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;
@@ -25056,7 +25356,7 @@ function isRecord2(value) {
 function arrayLength(value) {
   return Array.isArray(value) ? value.length : undefined;
 }
-async function sha2564(path) {
+async function sha2566(path) {
   return createHash11("sha256").update(await readFile11(path)).digest("hex");
 }
 function overallStatus(findings) {
@@ -25133,7 +25433,7 @@ async function assessMigration(options) {
     contractsManifest = {
       path: contractsManifestPath,
       present: true,
-      sha256: await sha2564(contractsManifestPath),
+      sha256: await sha2566(contractsManifestPath),
       version: 1,
       ...commands === undefined ? {} : { commands },
       ...routes === undefined ? {} : { routes },
@@ -25156,9 +25456,9 @@ async function assessMigration(options) {
       const diff = diffOpenApiDocuments(await readOpenApiJson(baselinePath), await readOpenApiJson(currentPath));
       openApi = {
         baselinePath,
-        baselineSha256: await sha2564(baselinePath),
+        baselineSha256: await sha2566(baselinePath),
         currentPath,
-        currentSha256: await sha2564(currentPath),
+        currentSha256: await sha2566(currentPath),
         diff
       };
       if (!diff.ok) {