@supacloud/compiler 0.50.0 → 0.51.0

package/dist/cli.js

@@ -270,6 +270,16 @@ function validateFeatureSpec(spec, module) {
   if (spec.tenantField !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(spec.tenantField)) {
     error("feature-tenant-boundary-invalid", `Feature ${spec.name} declares an unsafe tenant field.`);
   }
+  if (spec.requiredAdapters !== undefined) {
+    if (spec.requiredAdapters.length === 0 || spec.requiredAdapters.some((token) => !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(token)) || new Set(spec.requiredAdapters).size !== spec.requiredAdapters.length) {
+      error("feature-adapter-requirements-invalid", `Feature ${spec.name} must declare unique, non-empty adapter token identifiers.`);
+    }
+  }
+  if (spec.requiredAdapterScopes !== undefined) {
+    if (spec.requiredAdapters === undefined || Object.keys(spec.requiredAdapterScopes).some((token) => !spec.requiredAdapters?.includes(token))) {
+      error("feature-adapter-requirements-invalid", `Feature ${spec.name} must scope only declared required adapters.`);
+    }
+  }
   const databaseTransition = spec.transitions.some((transition) => transition.persistence?.boundary === "database");
   if (databaseTransition && spec.database === undefined && spec.file !== undefined) {
     error("feature-database-source-required", `Database Feature ${spec.name} must declare its database source, table and rowType.`);
@@ -286,6 +296,19 @@ function validateFeatureSpec(spec, module) {
     }
   }
   const names = new Set;
+  if (module && spec.requiredAdapters !== undefined) {
+    for (const token of spec.requiredAdapters) {
+      const provider = module.providers.find((candidate) => candidate.token === token || candidate.useClass === token);
+      if (!provider) {
+        error("feature-adapter-unresolved", `Feature ${spec.name} requires adapter ${token}, but module ${module.name} does not register a provider for it.`);
+      } else {
+        const expectedScope = spec.requiredAdapterScopes?.[token];
+        if (expectedScope !== undefined && provider.scope !== expectedScope) {
+          error("feature-adapter-provider-scope", `Feature ${spec.name} requires adapter ${token} to use ${expectedScope} scope, but module ${module.name} registers it with ${provider.scope} scope.`);
+        }
+      }
+    }
+  }
   for (const transition of spec.transitions) {
     if (!transition.name.trim() || names.has(transition.name)) {
       error("duplicate-feature-transition", `Feature ${spec.name} has duplicate/empty transition '${transition.name}'.`);
@@ -325,11 +348,20 @@ function validateFeatureSpec(spec, module) {
     }
     if (!module)
       continue;
-    if (transition.persistence?.boundary === "database") {
+    if (transition.persistence !== undefined) {
       for (const query of module.queries) {
+        const queryProvider = module.providers.find((provider) => provider.token === query.className || provider.useClass === query.className);
+        if (!queryProvider) {
+          error("feature-query-provider-unresolved", `Feature query ${query.className} is not registered as a runtime provider in module ${module.name}.`);
+        } else if (queryProvider.scope !== "request") {
+          error("feature-query-provider-scope", `Feature query ${query.className} must use request scope, but module ${module.name} registers it with ${queryProvider.scope} scope.`);
+        }
         if (query.tenantScope !== "required") {
           error("feature-query-tenant-boundary", `Query ${query.className} in Feature ${spec.name} must declare tenantScope: "required".`);
         }
+        if (spec.readPermission !== undefined && query.permission !== spec.readPermission) {
+          error("feature-query-permission", `Query ${query.className} in Feature ${spec.name} must declare read permission '${spec.readPermission}'.`);
+        }
       }
       for (const job of module.jobs ?? []) {
         if (job.tenantScope !== "required") {
@@ -346,6 +378,12 @@ function validateFeatureSpec(spec, module) {
       error("feature-command-unresolved", `Transition ${transition.name} declares governance without a command binding.`);
     }
     if (command) {
+      const commandProvider = module.providers.find((provider) => provider.token === command.className || provider.useClass === command.className);
+      if (!commandProvider) {
+        error("feature-command-provider-unresolved", `Feature transition ${transition.name} references command ${command.className}, but the command is not registered as a provider in module ${module.name}.`);
+      } else if (commandProvider.scope !== "request") {
+        error("feature-command-provider-scope", `Feature command ${command.className} must use request scope, but module ${module.name} registers it with ${commandProvider.scope} scope.`);
+      }
       for (const key of ["permission", "transaction", "idempotency", "audit"]) {
         if (transition[key] !== undefined && transition[key] !== command[key]) {
           error("feature-governance-drift", `Transition ${transition.name} ${key} differs from command ${command.className}.`);
@@ -372,6 +410,12 @@ function validateFeatureSpec(spec, module) {
         error("feature-job-unresolved", `Transition ${transition.name} must reference exactly one Job in module ${module.name}.`);
       } else {
         const job = jobs[0];
+        const jobProvider = module.providers.find((provider) => provider.token === job.className || provider.useClass === job.className);
+        if (!jobProvider) {
+          error("feature-job-provider-unresolved", `Feature transition ${transition.name} references Job ${job.className}, but the Job is not registered as a runtime provider in module ${module.name}.`);
+        } else if (jobProvider.scope !== "job") {
+          error("feature-job-provider-scope", `Feature Job ${job.className} must use job scope, but module ${module.name} registers it with ${jobProvider.scope} scope.`);
+        }
         if (job.tenantScope !== "required") {
           error("feature-job-tenant-boundary", `Job ${job.className} in Feature ${spec.name} must declare tenantScope: "required".`);
         }
@@ -390,6 +434,17 @@ function validateFeatureSpec(spec, module) {
         }
       }
     }
+    const declaredTags = module ? new Set(module.controllers.flatMap((controller) => controller.routes.flatMap((route) => route.tags ?? []))) : new Set;
+    if (transition.persistence !== undefined && declaredTags.size > 0 && transition.invalidateTags === undefined) {
+      error("feature-invalidation-tags-required", `Persistent transition ${transition.name} must declare invalidateTags when Feature ${spec.name} exposes query tags.`);
+    }
+    if (transition.invalidateTags !== undefined && declaredTags.size > 0) {
+      for (const tag of transition.invalidateTags) {
+        if (!declaredTags.has(tag)) {
+          error("feature-invalidation-tag-unresolved", `Transition ${transition.name} invalidates '${tag}', but Feature ${spec.name} does not declare that query tag.`);
+        }
+      }
+    }
     if (transition.route) {
       const routes = module.controllers.flatMap((controller) => controller.routes.filter((route) => `${route.method} ${joinRoutePaths(controller.path, route.path)}` === transition.route));
       if (routes.length !== 1) {
@@ -1437,15 +1492,26 @@ var init_validate = __esm(() => {
     "duplicate-feature-transition": { code: "SC6102", docsUrl: "https://supacloud.dev/errors/SC6102" },
     "invalid-feature-transition": { code: "SC6103", docsUrl: "https://supacloud.dev/errors/SC6103" },
     "feature-command-unresolved": { code: "SC6104", docsUrl: "https://supacloud.dev/errors/SC6104" },
+    "feature-command-provider-unresolved": { code: "SC6128", docsUrl: "https://supacloud.dev/errors/SC6128" },
+    "feature-command-provider-scope": { code: "SC6134", docsUrl: "https://supacloud.dev/errors/SC6134" },
+    "feature-adapter-unresolved": { code: "SC6135", docsUrl: "https://supacloud.dev/errors/SC6135" },
+    "feature-adapter-requirements-invalid": { code: "SC6136", docsUrl: "https://supacloud.dev/errors/SC6136" },
+    "feature-adapter-provider-scope": { code: "SC6137", docsUrl: "https://supacloud.dev/errors/SC6137" },
     "feature-governance-drift": { code: "SC6105", docsUrl: "https://supacloud.dev/errors/SC6105" },
     "feature-persistence-invalid": { code: "SC6110", docsUrl: "https://supacloud.dev/errors/SC6110" },
     "feature-persistence-drift": { code: "SC6111", docsUrl: "https://supacloud.dev/errors/SC6111" },
+    "feature-invalidation-tag-unresolved": { code: "SC6113", docsUrl: "https://supacloud.dev/errors/SC6113" },
     "feature-tenant-boundary-invalid": { code: "SC6112", docsUrl: "https://supacloud.dev/errors/SC6112" },
-    "feature-tenant-boundary-drift": { code: "SC6113", docsUrl: "https://supacloud.dev/errors/SC6113" },
+    "feature-tenant-boundary-drift": { code: "SC6127", docsUrl: "https://supacloud.dev/errors/SC6127" },
     "feature-query-tenant-boundary": { code: "SC6114", docsUrl: "https://supacloud.dev/errors/SC6114" },
+    "feature-query-provider-unresolved": { code: "SC6130", docsUrl: "https://supacloud.dev/errors/SC6130" },
+    "feature-query-provider-scope": { code: "SC6131", docsUrl: "https://supacloud.dev/errors/SC6131" },
+    "feature-query-permission": { code: "SC6138", docsUrl: "https://supacloud.dev/errors/SC6138" },
     "feature-job-tenant-boundary": { code: "SC6115", docsUrl: "https://supacloud.dev/errors/SC6115" },
     "feature-command-tenant-boundary": { code: "SC6116", docsUrl: "https://supacloud.dev/errors/SC6116" },
     "feature-job-unresolved": { code: "SC6117", docsUrl: "https://supacloud.dev/errors/SC6117" },
+    "feature-job-provider-unresolved": { code: "SC6129", docsUrl: "https://supacloud.dev/errors/SC6129" },
+    "feature-job-provider-scope": { code: "SC6132", docsUrl: "https://supacloud.dev/errors/SC6132" },
     "feature-job-idempotency": { code: "SC6118", docsUrl: "https://supacloud.dev/errors/SC6118" },
     "feature-job-mode": { code: "SC6119", docsUrl: "https://supacloud.dev/errors/SC6119" },
     "feature-job-contract": { code: "SC6120", docsUrl: "https://supacloud.dev/errors/SC6120" },
@@ -1454,6 +1520,7 @@ var init_validate = __esm(() => {
     "feature-database-source-invalid": { code: "SC6123", docsUrl: "https://supacloud.dev/errors/SC6123" },
     "feature-database-table-invalid": { code: "SC6124", docsUrl: "https://supacloud.dev/errors/SC6124" },
     "feature-database-row-type-invalid": { code: "SC6125", docsUrl: "https://supacloud.dev/errors/SC6125" },
+    "feature-invalidation-tags-required": { code: "SC6126", docsUrl: "https://supacloud.dev/errors/SC6126" },
     "feature-route-unresolved": { code: "SC6106", docsUrl: "https://supacloud.dev/errors/SC6106" },
     "feature-route-drift": { code: "SC6107", docsUrl: "https://supacloud.dev/errors/SC6107" },
     "invalid-feature-spec": { code: "SC6108", docsUrl: "https://supacloud.dev/errors/SC6108" }
@@ -1509,10 +1576,13 @@ function buildContractManifest(graph, artifacts) {
       });
     }
     for (const query of module.queries) {
+      if (query.permission)
+        permissions.add(query.permission);
       queries.push({
         name: query.name,
         className: query.className,
         module: module.name,
+        ...query.permission === undefined ? {} : { permission: query.permission },
         ...query.tenantScope === undefined ? {} : { tenantScope: query.tenantScope }
       });
     }
@@ -1536,6 +1606,7 @@ function buildContractManifest(graph, artifacts) {
         states: [...module.featureSpec.states],
         ...module.featureSpec.database === undefined ? {} : { database: module.featureSpec.database },
         ...module.featureSpec.tenantField === undefined ? {} : { tenantField: module.featureSpec.tenantField },
+        ...module.featureSpec.readPermission === undefined ? {} : { readPermission: module.featureSpec.readPermission },
         transitions: module.featureSpec.transitions.map((transition) => {
           const job = transition.job === undefined ? undefined : (module.jobs ?? []).find((candidate) => candidate.className === transition.job || candidate.name === transition.job);
           return {
@@ -1577,8 +1648,9 @@ function buildContractManifest(graph, artifacts) {
         const governedCommand = command ?? featureCommand;
         const effectiveCommand = route.command ?? featureTransition?.command;
         const idempotency = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency;
-        if (governedCommand?.permission)
-          permissions.add(governedCommand.permission);
+        const permission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
+        if (permission)
+          permissions.add(permission);
         if (route.contract?.evidence)
           fixtures.add(route.contract.evidence);
         routes.push({
@@ -1588,7 +1660,7 @@ function buildContractManifest(graph, artifacts) {
           controller: controller.className,
           handler: route.handler,
           ...effectiveCommand === undefined ? {} : { command: effectiveCommand },
-          ...governedCommand?.permission === undefined ? {} : { permission: governedCommand.permission },
+          ...permission === undefined ? {} : { permission },
           ...idempotency === undefined ? {} : { idempotency },
           ...route.tags === undefined ? {} : { tags: [...route.tags] },
           requestSchemas: Object.fromEntries(["body", "params", "query", "headers", "cookie"].flatMap((key) => route[key] === undefined ? [] : [[key, route[key]]])),
@@ -2650,6 +2722,7 @@ function renderClient(graph, options) {
         const featureTransition = featureTransitionForRoute(module, controller, route);
         const featureCommand = featureTransition?.command === undefined ? undefined : commandByClassName.get(featureTransition.command);
         const governedCommand = command ?? featureCommand;
+        const routePermission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const idempotencyMode = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency ?? "none";
         const transitionRoute = `${route.method} ${fullPath}`;
         const invalidationTags = featureInvalidationTags.get(`${module.name}:${transitionRoute}`);
@@ -2676,6 +2749,7 @@ function renderClient(graph, options) {
           ["parse", route.parse],
           ["allowDeleteBody", route.allowDeleteBody],
           ["idempotency", idempotencyMode === "none" ? undefined : idempotencyMode],
+          ["permission", routePermission],
           ["tags", route.tags],
           ["invalidateTags", invalidationTags]
         ]) {
@@ -2717,6 +2791,7 @@ function renderClient(graph, options) {
           path: fullPath,
           controller: controller.className,
           handler: route.handler,
+          ...routePermission === undefined ? {} : { permission: routePermission },
           kind: procedureKind,
           idempotency: idempotencyMode,
           ...route.tags === undefined ? {} : { tags: route.tags },
@@ -2729,7 +2804,7 @@ function renderClient(graph, options) {
           handler: route.handler,
           kind: procedureKind,
           ...governedCommand?.name === undefined ? {} : { command: governedCommand.name },
-          ...governedCommand?.permission === undefined ? {} : { permission: governedCommand.permission },
+          ...routePermission === undefined ? {} : { permission: routePermission },
           idempotency: idempotencyMode,
           ...route.tags === undefined ? {} : { tags: [...route.tags] },
           ...invalidationTags === undefined ? {} : { invalidateTags: [...invalidationTags] }
@@ -2785,6 +2860,7 @@ ${procedureMethods.join(`
     "  controller: string;",
     "  handler: string;",
     "  kind: Kind;",
+    "  permission?: string;",
     "  idempotency: Idempotency;",
     "  tags?: readonly string[];",
     "  invalidateTags?: readonly string[];",
@@ -3423,7 +3499,7 @@ function renderOpenApi(graph, options) {
         const featureCommand = featureTransition?.command === undefined ? undefined : commandByClass.get(featureTransition.command);
         const governedCommand = command ?? featureCommand;
         const idempotencyMode = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency ?? "none";
-        const permission = governedCommand?.permission ?? featureTransition?.permission;
+        const permission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const requiresAuth = (route.guards?.length ?? 0) > 0 || permission !== undefined || governedCommand !== undefined;
         const responseKind = route.contract?.response;
         const responseContentType = responseKind === "binary" || responseKind === "stream" ? "application/octet-stream" : "application/json";
@@ -3876,6 +3952,10 @@ function renderPermissions(graph) {
       if (command.permission)
         permissions.add(command.permission);
     }
+    for (const query of module.queries) {
+      if (query.permission)
+        permissions.add(query.permission);
+    }
     for (const controller of module.controllers) {
       for (const route of controller.routes) {
         const featureTransition = featureTransitionForRoute(module, controller, route);
@@ -3883,7 +3963,7 @@ function renderPermissions(graph) {
         const featureCommand = featureTransition?.command === undefined ? undefined : module.commands.find((candidate) => candidate.className === featureTransition.command || candidate.name === featureTransition.command);
         const governedCommand = command ?? featureCommand;
         const effectiveCommand = route.command ?? featureTransition?.command;
-        const perm = governedCommand?.permission ?? featureTransition?.permission;
+        const perm = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const idempotency = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency;
         if (perm)
           permissions.add(perm);
@@ -19575,10 +19655,12 @@ function parseModule(candidate, nameByNode, ctx) {
     if (queryDec) {
       const meta = decoratorObjectArg(queryDec);
       if (meta) {
+        const permission = stringLiteralProp(meta, "permission");
         const tenantScope = commandModeProp(meta, "tenantScope");
         queries.push({
           className: cls.name?.text ?? "<anonymous>",
           name: stringLiteralProp(meta, "name") ?? cls.name?.text ?? "<anonymous>",
+          ...permission === undefined ? {} : { permission },
           ...tenantScope === undefined ? {} : { tenantScope }
         });
       }
@@ -19639,11 +19721,23 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
   if (databaseExpr !== undefined && database === undefined)
     return invalid();
   const tenantField = stringLiteralProp(input, "tenantField");
+  const readPermission = stringLiteralProp(input, "readPermission");
+  const requiredAdaptersExpr = getProp(input, "requiredAdapters");
+  const requiredAdapterScopesExpr = getProp(input, "requiredAdapterScopes");
   const statesExpr = getProp(input, "states");
   const transitionObject = getProp(input, "transitions");
   if (!name || !statesExpr || !ts7.isArrayLiteralExpression(statesExpr) || statesExpr.elements.some((state) => !ts7.isStringLiteral(state)) || !transitionObject || !ts7.isObjectLiteralExpression(transitionObject) || input.properties.some((property) => !ts7.isPropertyAssignment(property))) {
     return invalid();
   }
+  const requiredAdapters = requiredAdaptersExpr === undefined ? undefined : ts7.isArrayLiteralExpression(requiredAdaptersExpr) && requiredAdaptersExpr.elements.every((element) => ts7.isStringLiteral(element) && element.text.trim().length > 0) ? requiredAdaptersExpr.elements.map((element) => element.text) : undefined;
+  if (requiredAdaptersExpr !== undefined && requiredAdapters === undefined)
+    return invalid();
+  const requiredAdapterScopes = requiredAdapterScopesExpr === undefined ? undefined : ts7.isObjectLiteralExpression(requiredAdapterScopesExpr) && requiredAdapterScopesExpr.properties.every((property) => ts7.isPropertyAssignment(property) && !ts7.isComputedPropertyName(property.name) && ts7.isStringLiteral(property.initializer) && isScope(property.initializer.text)) ? Object.fromEntries(requiredAdapterScopesExpr.properties.map((property) => [
+    propertyName(property.name),
+    property.initializer.getText().slice(1, -1)
+  ])) : undefined;
+  if (requiredAdapterScopesExpr !== undefined && requiredAdapterScopes === undefined)
+    return invalid();
   const states = [];
   for (const state of statesExpr.elements) {
     if (!ts7.isStringLiteral(state))
@@ -19699,6 +19793,9 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
     states,
     ...database === undefined ? {} : { database },
     ...tenantField === undefined ? {} : { tenantField },
+    ...readPermission === undefined ? {} : { readPermission },
+    ...requiredAdapters === undefined ? {} : { requiredAdapters },
+    ...requiredAdapterScopes === undefined ? {} : { requiredAdapterScopes },
     transitions,
     file: sourcePath(ctx.rootDir, input.getSourceFile().fileName),
     line: lineOf(input)
@@ -20635,6 +20732,9 @@ function parseController(input, ctx) {
       const optionsArg = args[1];
       const optionsObject = resolveStaticObjectLiteral(optionsArg, ctx);
       if (optionsObject) {
+        const permission = stringLiteralProp(optionsObject, "permission");
+        if (permission !== undefined)
+          route.permission = permission;
         const parsePolicy = routePolicyProperty(optionsObject, "parse", ctx);
         const deletePolicy = routePolicyProperty(optionsObject, "allowDeleteBody", ctx);
         const idempotency = checkedRouteIdempotency(optionsObject, ctx, route.handler);
@@ -24993,10 +25093,10 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve18 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.31.0";
+var MIGRATION_APP_VERSION = "0.32.0";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.35.1";
+var MIGRATION_ELYSIA_VERSION = "0.36.0";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;

package/dist/contract-manifest.d.ts

@@ -24,6 +24,7 @@ export interface ContractManifest {
         name: string;
         className: string;
         module: string;
+        permission?: string;
         tenantScope?: "required" | "none";
     }>;
     jobs: Array<{

package/dist/index.js

@@ -269,6 +269,16 @@ function validateFeatureSpec(spec, module) {
   if (spec.tenantField !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(spec.tenantField)) {
     error("feature-tenant-boundary-invalid", `Feature ${spec.name} declares an unsafe tenant field.`);
   }
+  if (spec.requiredAdapters !== undefined) {
+    if (spec.requiredAdapters.length === 0 || spec.requiredAdapters.some((token) => !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(token)) || new Set(spec.requiredAdapters).size !== spec.requiredAdapters.length) {
+      error("feature-adapter-requirements-invalid", `Feature ${spec.name} must declare unique, non-empty adapter token identifiers.`);
+    }
+  }
+  if (spec.requiredAdapterScopes !== undefined) {
+    if (spec.requiredAdapters === undefined || Object.keys(spec.requiredAdapterScopes).some((token) => !spec.requiredAdapters?.includes(token))) {
+      error("feature-adapter-requirements-invalid", `Feature ${spec.name} must scope only declared required adapters.`);
+    }
+  }
   const databaseTransition = spec.transitions.some((transition) => transition.persistence?.boundary === "database");
   if (databaseTransition && spec.database === undefined && spec.file !== undefined) {
     error("feature-database-source-required", `Database Feature ${spec.name} must declare its database source, table and rowType.`);
@@ -285,6 +295,19 @@ function validateFeatureSpec(spec, module) {
     }
   }
   const names = new Set;
+  if (module && spec.requiredAdapters !== undefined) {
+    for (const token of spec.requiredAdapters) {
+      const provider = module.providers.find((candidate) => candidate.token === token || candidate.useClass === token);
+      if (!provider) {
+        error("feature-adapter-unresolved", `Feature ${spec.name} requires adapter ${token}, but module ${module.name} does not register a provider for it.`);
+      } else {
+        const expectedScope = spec.requiredAdapterScopes?.[token];
+        if (expectedScope !== undefined && provider.scope !== expectedScope) {
+          error("feature-adapter-provider-scope", `Feature ${spec.name} requires adapter ${token} to use ${expectedScope} scope, but module ${module.name} registers it with ${provider.scope} scope.`);
+        }
+      }
+    }
+  }
   for (const transition of spec.transitions) {
     if (!transition.name.trim() || names.has(transition.name)) {
       error("duplicate-feature-transition", `Feature ${spec.name} has duplicate/empty transition '${transition.name}'.`);
@@ -324,11 +347,20 @@ function validateFeatureSpec(spec, module) {
     }
     if (!module)
       continue;
-    if (transition.persistence?.boundary === "database") {
+    if (transition.persistence !== undefined) {
       for (const query of module.queries) {
+        const queryProvider = module.providers.find((provider) => provider.token === query.className || provider.useClass === query.className);
+        if (!queryProvider) {
+          error("feature-query-provider-unresolved", `Feature query ${query.className} is not registered as a runtime provider in module ${module.name}.`);
+        } else if (queryProvider.scope !== "request") {
+          error("feature-query-provider-scope", `Feature query ${query.className} must use request scope, but module ${module.name} registers it with ${queryProvider.scope} scope.`);
+        }
         if (query.tenantScope !== "required") {
           error("feature-query-tenant-boundary", `Query ${query.className} in Feature ${spec.name} must declare tenantScope: "required".`);
         }
+        if (spec.readPermission !== undefined && query.permission !== spec.readPermission) {
+          error("feature-query-permission", `Query ${query.className} in Feature ${spec.name} must declare read permission '${spec.readPermission}'.`);
+        }
       }
       for (const job of module.jobs ?? []) {
         if (job.tenantScope !== "required") {
@@ -345,6 +377,12 @@ function validateFeatureSpec(spec, module) {
       error("feature-command-unresolved", `Transition ${transition.name} declares governance without a command binding.`);
     }
     if (command) {
+      const commandProvider = module.providers.find((provider) => provider.token === command.className || provider.useClass === command.className);
+      if (!commandProvider) {
+        error("feature-command-provider-unresolved", `Feature transition ${transition.name} references command ${command.className}, but the command is not registered as a provider in module ${module.name}.`);
+      } else if (commandProvider.scope !== "request") {
+        error("feature-command-provider-scope", `Feature command ${command.className} must use request scope, but module ${module.name} registers it with ${commandProvider.scope} scope.`);
+      }
       for (const key of ["permission", "transaction", "idempotency", "audit"]) {
         if (transition[key] !== undefined && transition[key] !== command[key]) {
           error("feature-governance-drift", `Transition ${transition.name} ${key} differs from command ${command.className}.`);
@@ -371,6 +409,12 @@ function validateFeatureSpec(spec, module) {
         error("feature-job-unresolved", `Transition ${transition.name} must reference exactly one Job in module ${module.name}.`);
       } else {
         const job = jobs[0];
+        const jobProvider = module.providers.find((provider) => provider.token === job.className || provider.useClass === job.className);
+        if (!jobProvider) {
+          error("feature-job-provider-unresolved", `Feature transition ${transition.name} references Job ${job.className}, but the Job is not registered as a runtime provider in module ${module.name}.`);
+        } else if (jobProvider.scope !== "job") {
+          error("feature-job-provider-scope", `Feature Job ${job.className} must use job scope, but module ${module.name} registers it with ${jobProvider.scope} scope.`);
+        }
         if (job.tenantScope !== "required") {
           error("feature-job-tenant-boundary", `Job ${job.className} in Feature ${spec.name} must declare tenantScope: "required".`);
         }
@@ -389,6 +433,17 @@ function validateFeatureSpec(spec, module) {
         }
       }
     }
+    const declaredTags = module ? new Set(module.controllers.flatMap((controller) => controller.routes.flatMap((route) => route.tags ?? []))) : new Set;
+    if (transition.persistence !== undefined && declaredTags.size > 0 && transition.invalidateTags === undefined) {
+      error("feature-invalidation-tags-required", `Persistent transition ${transition.name} must declare invalidateTags when Feature ${spec.name} exposes query tags.`);
+    }
+    if (transition.invalidateTags !== undefined && declaredTags.size > 0) {
+      for (const tag of transition.invalidateTags) {
+        if (!declaredTags.has(tag)) {
+          error("feature-invalidation-tag-unresolved", `Transition ${transition.name} invalidates '${tag}', but Feature ${spec.name} does not declare that query tag.`);
+        }
+      }
+    }
     if (transition.route) {
       const routes = module.controllers.flatMap((controller) => controller.routes.filter((route) => `${route.method} ${joinRoutePaths(controller.path, route.path)}` === transition.route));
       if (routes.length !== 1) {
@@ -1436,15 +1491,26 @@ var init_validate = __esm(() => {
     "duplicate-feature-transition": { code: "SC6102", docsUrl: "https://supacloud.dev/errors/SC6102" },
     "invalid-feature-transition": { code: "SC6103", docsUrl: "https://supacloud.dev/errors/SC6103" },
     "feature-command-unresolved": { code: "SC6104", docsUrl: "https://supacloud.dev/errors/SC6104" },
+    "feature-command-provider-unresolved": { code: "SC6128", docsUrl: "https://supacloud.dev/errors/SC6128" },
+    "feature-command-provider-scope": { code: "SC6134", docsUrl: "https://supacloud.dev/errors/SC6134" },
+    "feature-adapter-unresolved": { code: "SC6135", docsUrl: "https://supacloud.dev/errors/SC6135" },
+    "feature-adapter-requirements-invalid": { code: "SC6136", docsUrl: "https://supacloud.dev/errors/SC6136" },
+    "feature-adapter-provider-scope": { code: "SC6137", docsUrl: "https://supacloud.dev/errors/SC6137" },
     "feature-governance-drift": { code: "SC6105", docsUrl: "https://supacloud.dev/errors/SC6105" },
     "feature-persistence-invalid": { code: "SC6110", docsUrl: "https://supacloud.dev/errors/SC6110" },
     "feature-persistence-drift": { code: "SC6111", docsUrl: "https://supacloud.dev/errors/SC6111" },
+    "feature-invalidation-tag-unresolved": { code: "SC6113", docsUrl: "https://supacloud.dev/errors/SC6113" },
     "feature-tenant-boundary-invalid": { code: "SC6112", docsUrl: "https://supacloud.dev/errors/SC6112" },
-    "feature-tenant-boundary-drift": { code: "SC6113", docsUrl: "https://supacloud.dev/errors/SC6113" },
+    "feature-tenant-boundary-drift": { code: "SC6127", docsUrl: "https://supacloud.dev/errors/SC6127" },
     "feature-query-tenant-boundary": { code: "SC6114", docsUrl: "https://supacloud.dev/errors/SC6114" },
+    "feature-query-provider-unresolved": { code: "SC6130", docsUrl: "https://supacloud.dev/errors/SC6130" },
+    "feature-query-provider-scope": { code: "SC6131", docsUrl: "https://supacloud.dev/errors/SC6131" },
+    "feature-query-permission": { code: "SC6138", docsUrl: "https://supacloud.dev/errors/SC6138" },
     "feature-job-tenant-boundary": { code: "SC6115", docsUrl: "https://supacloud.dev/errors/SC6115" },
     "feature-command-tenant-boundary": { code: "SC6116", docsUrl: "https://supacloud.dev/errors/SC6116" },
     "feature-job-unresolved": { code: "SC6117", docsUrl: "https://supacloud.dev/errors/SC6117" },
+    "feature-job-provider-unresolved": { code: "SC6129", docsUrl: "https://supacloud.dev/errors/SC6129" },
+    "feature-job-provider-scope": { code: "SC6132", docsUrl: "https://supacloud.dev/errors/SC6132" },
     "feature-job-idempotency": { code: "SC6118", docsUrl: "https://supacloud.dev/errors/SC6118" },
     "feature-job-mode": { code: "SC6119", docsUrl: "https://supacloud.dev/errors/SC6119" },
     "feature-job-contract": { code: "SC6120", docsUrl: "https://supacloud.dev/errors/SC6120" },
@@ -1453,6 +1519,7 @@ var init_validate = __esm(() => {
     "feature-database-source-invalid": { code: "SC6123", docsUrl: "https://supacloud.dev/errors/SC6123" },
     "feature-database-table-invalid": { code: "SC6124", docsUrl: "https://supacloud.dev/errors/SC6124" },
     "feature-database-row-type-invalid": { code: "SC6125", docsUrl: "https://supacloud.dev/errors/SC6125" },
+    "feature-invalidation-tags-required": { code: "SC6126", docsUrl: "https://supacloud.dev/errors/SC6126" },
     "feature-route-unresolved": { code: "SC6106", docsUrl: "https://supacloud.dev/errors/SC6106" },
     "feature-route-drift": { code: "SC6107", docsUrl: "https://supacloud.dev/errors/SC6107" },
     "invalid-feature-spec": { code: "SC6108", docsUrl: "https://supacloud.dev/errors/SC6108" }
@@ -1508,10 +1575,13 @@ function buildContractManifest(graph, artifacts) {
       });
     }
     for (const query of module.queries) {
+      if (query.permission)
+        permissions.add(query.permission);
       queries.push({
         name: query.name,
         className: query.className,
         module: module.name,
+        ...query.permission === undefined ? {} : { permission: query.permission },
         ...query.tenantScope === undefined ? {} : { tenantScope: query.tenantScope }
       });
     }
@@ -1535,6 +1605,7 @@ function buildContractManifest(graph, artifacts) {
         states: [...module.featureSpec.states],
         ...module.featureSpec.database === undefined ? {} : { database: module.featureSpec.database },
         ...module.featureSpec.tenantField === undefined ? {} : { tenantField: module.featureSpec.tenantField },
+        ...module.featureSpec.readPermission === undefined ? {} : { readPermission: module.featureSpec.readPermission },
         transitions: module.featureSpec.transitions.map((transition) => {
           const job = transition.job === undefined ? undefined : (module.jobs ?? []).find((candidate) => candidate.className === transition.job || candidate.name === transition.job);
           return {
@@ -1576,8 +1647,9 @@ function buildContractManifest(graph, artifacts) {
         const governedCommand = command ?? featureCommand;
         const effectiveCommand = route.command ?? featureTransition?.command;
         const idempotency = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency;
-        if (governedCommand?.permission)
-          permissions.add(governedCommand.permission);
+        const permission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
+        if (permission)
+          permissions.add(permission);
         if (route.contract?.evidence)
           fixtures.add(route.contract.evidence);
         routes.push({
@@ -1587,7 +1659,7 @@ function buildContractManifest(graph, artifacts) {
           controller: controller.className,
           handler: route.handler,
           ...effectiveCommand === undefined ? {} : { command: effectiveCommand },
-          ...governedCommand?.permission === undefined ? {} : { permission: governedCommand.permission },
+          ...permission === undefined ? {} : { permission },
           ...idempotency === undefined ? {} : { idempotency },
           ...route.tags === undefined ? {} : { tags: [...route.tags] },
           requestSchemas: Object.fromEntries(["body", "params", "query", "headers", "cookie"].flatMap((key) => route[key] === undefined ? [] : [[key, route[key]]])),
@@ -2649,6 +2721,7 @@ function renderClient(graph, options) {
         const featureTransition = featureTransitionForRoute(module, controller, route);
         const featureCommand = featureTransition?.command === undefined ? undefined : commandByClassName.get(featureTransition.command);
         const governedCommand = command ?? featureCommand;
+        const routePermission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const idempotencyMode = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency ?? "none";
         const transitionRoute = `${route.method} ${fullPath}`;
         const invalidationTags = featureInvalidationTags.get(`${module.name}:${transitionRoute}`);
@@ -2675,6 +2748,7 @@ function renderClient(graph, options) {
           ["parse", route.parse],
           ["allowDeleteBody", route.allowDeleteBody],
           ["idempotency", idempotencyMode === "none" ? undefined : idempotencyMode],
+          ["permission", routePermission],
           ["tags", route.tags],
           ["invalidateTags", invalidationTags]
         ]) {
@@ -2716,6 +2790,7 @@ function renderClient(graph, options) {
           path: fullPath,
           controller: controller.className,
           handler: route.handler,
+          ...routePermission === undefined ? {} : { permission: routePermission },
           kind: procedureKind,
           idempotency: idempotencyMode,
           ...route.tags === undefined ? {} : { tags: route.tags },
@@ -2728,7 +2803,7 @@ function renderClient(graph, options) {
           handler: route.handler,
           kind: procedureKind,
           ...governedCommand?.name === undefined ? {} : { command: governedCommand.name },
-          ...governedCommand?.permission === undefined ? {} : { permission: governedCommand.permission },
+          ...routePermission === undefined ? {} : { permission: routePermission },
           idempotency: idempotencyMode,
           ...route.tags === undefined ? {} : { tags: [...route.tags] },
           ...invalidationTags === undefined ? {} : { invalidateTags: [...invalidationTags] }
@@ -2784,6 +2859,7 @@ ${procedureMethods.join(`
     "  controller: string;",
     "  handler: string;",
     "  kind: Kind;",
+    "  permission?: string;",
     "  idempotency: Idempotency;",
     "  tags?: readonly string[];",
     "  invalidateTags?: readonly string[];",
@@ -3422,7 +3498,7 @@ function renderOpenApi(graph, options) {
         const featureCommand = featureTransition?.command === undefined ? undefined : commandByClass.get(featureTransition.command);
         const governedCommand = command ?? featureCommand;
         const idempotencyMode = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency ?? "none";
-        const permission = governedCommand?.permission ?? featureTransition?.permission;
+        const permission = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const requiresAuth = (route.guards?.length ?? 0) > 0 || permission !== undefined || governedCommand !== undefined;
         const responseKind = route.contract?.response;
         const responseContentType = responseKind === "binary" || responseKind === "stream" ? "application/octet-stream" : "application/json";
@@ -3875,6 +3951,10 @@ function renderPermissions(graph) {
       if (command.permission)
         permissions.add(command.permission);
     }
+    for (const query of module.queries) {
+      if (query.permission)
+        permissions.add(query.permission);
+    }
     for (const controller of module.controllers) {
       for (const route of controller.routes) {
         const featureTransition = featureTransitionForRoute(module, controller, route);
@@ -3882,7 +3962,7 @@ function renderPermissions(graph) {
         const featureCommand = featureTransition?.command === undefined ? undefined : module.commands.find((candidate) => candidate.className === featureTransition.command || candidate.name === featureTransition.command);
         const governedCommand = command ?? featureCommand;
         const effectiveCommand = route.command ?? featureTransition?.command;
-        const perm = governedCommand?.permission ?? featureTransition?.permission;
+        const perm = route.permission ?? governedCommand?.permission ?? featureTransition?.permission;
         const idempotency = route.idempotency ?? command?.idempotency ?? featureTransition?.idempotency;
         if (perm)
           permissions.add(perm);
@@ -19534,10 +19614,12 @@ function parseModule(candidate, nameByNode, ctx) {
     if (queryDec) {
       const meta = decoratorObjectArg(queryDec);
       if (meta) {
+        const permission = stringLiteralProp(meta, "permission");
         const tenantScope = commandModeProp(meta, "tenantScope");
         queries.push({
           className: cls.name?.text ?? "<anonymous>",
           name: stringLiteralProp(meta, "name") ?? cls.name?.text ?? "<anonymous>",
+          ...permission === undefined ? {} : { permission },
           ...tenantScope === undefined ? {} : { tenantScope }
         });
       }
@@ -19598,11 +19680,23 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
   if (databaseExpr !== undefined && database === undefined)
     return invalid();
   const tenantField = stringLiteralProp(input, "tenantField");
+  const readPermission = stringLiteralProp(input, "readPermission");
+  const requiredAdaptersExpr = getProp(input, "requiredAdapters");
+  const requiredAdapterScopesExpr = getProp(input, "requiredAdapterScopes");
   const statesExpr = getProp(input, "states");
   const transitionObject = getProp(input, "transitions");
   if (!name || !statesExpr || !ts7.isArrayLiteralExpression(statesExpr) || statesExpr.elements.some((state) => !ts7.isStringLiteral(state)) || !transitionObject || !ts7.isObjectLiteralExpression(transitionObject) || input.properties.some((property) => !ts7.isPropertyAssignment(property))) {
     return invalid();
   }
+  const requiredAdapters = requiredAdaptersExpr === undefined ? undefined : ts7.isArrayLiteralExpression(requiredAdaptersExpr) && requiredAdaptersExpr.elements.every((element) => ts7.isStringLiteral(element) && element.text.trim().length > 0) ? requiredAdaptersExpr.elements.map((element) => element.text) : undefined;
+  if (requiredAdaptersExpr !== undefined && requiredAdapters === undefined)
+    return invalid();
+  const requiredAdapterScopes = requiredAdapterScopesExpr === undefined ? undefined : ts7.isObjectLiteralExpression(requiredAdapterScopesExpr) && requiredAdapterScopesExpr.properties.every((property) => ts7.isPropertyAssignment(property) && !ts7.isComputedPropertyName(property.name) && ts7.isStringLiteral(property.initializer) && isScope(property.initializer.text)) ? Object.fromEntries(requiredAdapterScopesExpr.properties.map((property) => [
+    propertyName(property.name),
+    property.initializer.getText().slice(1, -1)
+  ])) : undefined;
+  if (requiredAdapterScopesExpr !== undefined && requiredAdapterScopes === undefined)
+    return invalid();
   const states = [];
   for (const state of statesExpr.elements) {
     if (!ts7.isStringLiteral(state))
@@ -19658,6 +19752,9 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
     states,
     ...database === undefined ? {} : { database },
     ...tenantField === undefined ? {} : { tenantField },
+    ...readPermission === undefined ? {} : { readPermission },
+    ...requiredAdapters === undefined ? {} : { requiredAdapters },
+    ...requiredAdapterScopes === undefined ? {} : { requiredAdapterScopes },
     transitions,
     file: sourcePath(ctx.rootDir, input.getSourceFile().fileName),
     line: lineOf(input)
@@ -20594,6 +20691,9 @@ function parseController(input, ctx) {
       const optionsArg = args[1];
       const optionsObject = resolveStaticObjectLiteral(optionsArg, ctx);
       if (optionsObject) {
+        const permission = stringLiteralProp(optionsObject, "permission");
+        if (permission !== undefined)
+          route.permission = permission;
         const parsePolicy = routePolicyProperty(optionsObject, "parse", ctx);
         const deletePolicy = routePolicyProperty(optionsObject, "allowDeleteBody", ctx);
         const idempotency = checkedRouteIdempotency(optionsObject, ctx, route.handler);
@@ -24675,10 +24775,10 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve17 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.31.0";
+var MIGRATION_APP_VERSION = "0.32.0";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.35.1";
+var MIGRATION_ELYSIA_VERSION = "0.36.0";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;

package/dist/migration-app-version.d.ts

@@ -1 +1 @@
-export declare const MIGRATION_APP_VERSION = "0.31.0";
+export declare const MIGRATION_APP_VERSION = "0.32.0";

package/dist/migration-elysia-version.d.ts

@@ -1 +1 @@
-export declare const MIGRATION_ELYSIA_VERSION = "0.35.1";
+export declare const MIGRATION_ELYSIA_VERSION = "0.36.0";

package/dist/types.d.ts

@@ -201,6 +201,7 @@ export interface EffectRouteNode {
     timeoutMs?: number;
 }
 export interface RouteNode {
+    permission?: string;
     /** Transport-level idempotency contract, independent of route command binding. */
     idempotency?: "required" | "none";
     /** Explicit query cache tags exposed to generated clients. */
@@ -344,6 +345,7 @@ export interface JobNode {
 export interface QueryNode {
     className: string;
     name: string;
+    permission?: string;
     tenantScope?: "required" | "none";
 }
 export interface FeatureTransitionNode {
@@ -382,6 +384,9 @@ export interface FeatureSpecNode {
     states: string[];
     database?: FeatureDatabaseSourceNode;
     tenantField?: string;
+    readPermission?: string;
+    requiredAdapters?: string[];
+    requiredAdapterScopes?: Record<string, Scope>;
     transitions: FeatureTransitionNode[];
     file?: string;
     line?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/compiler",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   "type": "module",
   "main": "./dist/index.js",