@supacloud/compiler 0.52.2 → 0.53.0

package/dist/cli.js

@@ -17126,11 +17126,6 @@ ${source.text}`;
 }
 var init_fixes = () => {};
 
-// src/delivery-files.ts
-var init_delivery_files2 = __esm(() => {
-  init_delivery_files();
-});
-
 // node_modules/@supacloud/delivery/src/application-release.ts
 var ApplicationIdSchema, ApplicationReleaseIdSchema, ApplicationReleaseRecordSchema;
 var init_application_release = __esm(() => {
@@ -17314,20 +17309,20 @@ var init_application_deploy_plan = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/application-deploy-operation.ts
-var closed6, sha256, nullableActivation, ApplicationDeployWebReleaseSchema, ApplicationDeployRequestSchema, ApplicationBackendReceiptSchema, ApplicationDeployResultSchema;
+var closed5, sha256, nullableActivation, ApplicationDeployWebReleaseSchema, ApplicationDeployRequestSchema, ApplicationBackendReceiptSchema, ApplicationDeployResultSchema;
 var init_application_deploy_operation = __esm(() => {
   init_build();
   init_value2();
   init_application_activation();
   init_application_configuration();
   init_application_release();
-  closed6 = { additionalProperties: false };
+  closed5 = { additionalProperties: false };
   sha256 = ApplicationReleaseIdSchema;
   nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
   ApplicationDeployWebReleaseSchema = _Object_({
     deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
     release_id: sha256
-  }, closed6);
+  }, closed5);
   ApplicationDeployRequestSchema = _Object_({
     mutation_id: ApplicationActivationIdSchema,
     release_id: sha256,
@@ -17336,7 +17331,7 @@ var init_application_deploy_operation = __esm(() => {
     expected_plan_sha256: Optional(sha256),
     approved_migration_digest: Optional(sha256),
     web_release: Optional(ApplicationDeployWebReleaseSchema)
-  }, closed6);
+  }, closed5);
   ApplicationBackendReceiptSchema = _Object_({
     schema: Literal("supacloud.application-backend-receipt.v1"),
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -17352,7 +17347,7 @@ var init_application_deploy_operation = __esm(() => {
     applied_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { uniqueItems: true }),
     schema_reloaded: Boolean2(),
     postgrest_healthy: Boolean2()
-  }, closed6);
+  }, closed5);
   ApplicationDeployResultSchema = _Object_({
     schema: Literal("supacloud.application-deploy.v1"),
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -17373,8 +17368,8 @@ var init_application_deploy_operation = __esm(() => {
       release_id: sha256,
       activation_id: ApplicationActivationIdSchema,
       replayed: Boolean2()
-    }, closed6))
-  }, closed6);
+    }, closed5))
+  }, closed5);
 });
 
 // node_modules/@supacloud/delivery/src/application-history.ts
@@ -17421,7 +17416,12 @@ var init_application_history = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/application-preview.ts
-var phaseStatus, closed7, ApplicationPreviewReceiptSchema;
+function applicationPreviewBranchRef(previewId) {
+  if (!/^[a-f0-9-]{8,64}$/.test(previewId))
+    throw new Error("Invalid preview ID");
+  return `pv${previewId.replace(/-/g, "").slice(0, 18)}`;
+}
+var phaseStatus, closed6, ApplicationPreviewReceiptSchema;
 var init_application_preview = __esm(() => {
   init_build();
   init_value2();
@@ -17434,7 +17434,7 @@ var init_application_preview = __esm(() => {
     Literal("failed"),
     Literal("cleaned")
   ]);
-  closed7 = { additionalProperties: false };
+  closed6 = { additionalProperties: false };
   ApplicationPreviewReceiptSchema = _Object_({
     schema: Literal("supacloud.application-preview.v1"),
     preview_id: String2({ pattern: "^[a-f0-9-]{8,64}$" }),
@@ -17454,46 +17454,50 @@ var init_application_preview = __esm(() => {
       Literal("cleaned")
     ]),
     resources: _Object_({
-      build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed7),
+      build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed6),
       database_branch: _Object_({
         status: phaseStatus,
         branch_ref: String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }),
         data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-      }, closed7),
+      }, closed6),
       queue_namespace: _Object_({
         status: phaseStatus,
         namespace: String2({ minLength: 1, maxLength: 128 })
-      }, closed7),
+      }, closed6),
       storage_namespace: _Object_({
         status: phaseStatus,
         namespace: String2({ minLength: 1, maxLength: 128 })
-      }, closed7),
+      }, closed6),
       test_secret: _Object_({
         status: phaseStatus,
         name: String2({ minLength: 1, maxLength: 128 }),
         value_issued: Literal(false)
-      }, closed7),
+      }, closed6),
       configuration_revision: _Object_({
         status: phaseStatus,
         configuration_id: Union([ApplicationConfigurationIdSchema, Null()])
-      }, closed7),
+      }, closed6),
       application_activation: _Object_({
         status: phaseStatus,
         activation_id: Union([ApplicationActivationIdSchema, Null()])
-      }, closed7),
+      }, closed6),
+      functions: Optional(_Object_({
+        status: phaseStatus,
+        slugs: _Array_(String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }), { maxItems: 64 })
+      }, closed6)),
       smoke_test: _Object_({
         status: phaseStatus,
         checks: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
         passed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
         failed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 })
-      }, closed7)
-    }, closed7),
+      }, closed6)
+    }, closed6),
     cleanup: _Object_({
       required: Boolean2(),
       completed: Boolean2(),
       error: Union([String2({ minLength: 1, maxLength: 128 }), Null()])
-    }, closed7)
-  }, closed7);
+    }, closed6)
+  }, closed6);
 });
 
 // node_modules/@supacloud/delivery/src/application-release-transfer.ts
@@ -17529,13 +17533,13 @@ var init_application_release_transfer = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed8, sha2562, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
+var closed7, sha2562, isoDate, status, evidenceStatus, DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1", DatabaseProviderSchema, componentName, DeploymentComponentEvidenceSchema, DeploymentEvidenceSchema;
 var init_deployment_evidence = __esm(() => {
   init_build();
   init_value2();
   init_application_configuration();
   init_application_release();
-  closed8 = { additionalProperties: false };
+  closed7 = { additionalProperties: false };
   sha2562 = String2({ pattern: "^[a-f0-9]{64}$" });
   isoDate = String2({ minLength: 20, maxLength: 40 });
   status = Union([
@@ -17561,19 +17565,19 @@ var init_deployment_evidence = __esm(() => {
         Literal("not-proven"),
         Literal("failed")
       ])
-    }, closed8),
+    }, closed7),
     backup: _Object_({
       status,
       latest_success_at: Union([isoDate, Null()]),
       freshness_seconds: Union([Integer({ minimum: 0 }), Null()])
-    }, closed8),
+    }, closed7),
     recovery: _Object_({
       status,
       drill_id: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
       rpo_seconds: Union([Integer({ minimum: 0 }), Null()]),
       rto_seconds: Union([Integer({ minimum: 0 }), Null()])
-    }, closed8)
-  }, closed8);
+    }, closed7)
+  }, closed7);
   componentName = Union([
     Literal("management-api"),
     Literal("web-console"),
@@ -17591,7 +17595,7 @@ var init_deployment_evidence = __esm(() => {
     status,
     health_check: Union([String2({ minLength: 1, maxLength: 256 }), Null()]),
     checked_at: Union([isoDate, Null()])
-  }, closed8);
+  }, closed7);
   DeploymentEvidenceSchema = _Object_({
     schema: Literal(DEPLOYMENT_EVIDENCE_SCHEMA),
     status: evidenceStatus,
@@ -17600,33 +17604,33 @@ var init_deployment_evidence = __esm(() => {
       project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
       application_id: ApplicationIdSchema,
       environment_id: ApplicationIdSchema
-    }, closed8),
+    }, closed7),
     source: _Object_({
       commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
       manifest_sha256: sha2562,
       contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
       environment_binding_version: Union([sha2562, Null()])
-    }, closed8),
+    }, closed7),
     database: DatabaseProviderSchema,
     components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
     activation: _Object_({
       release_id: ApplicationReleaseIdSchema,
       configuration_id: ApplicationConfigurationIdSchema,
       activation_id: ApplicationConfigurationIdSchema
-    }, closed8),
+    }, closed7),
     health: _Object_({
       status,
       checked_at: Union([isoDate, Null()]),
       authenticated_smoke: status
-    }, closed8),
+    }, closed7),
     rollback: _Object_({
       release_id: Union([ApplicationReleaseIdSchema, Null()]),
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
       status: Union([Literal("ready"), Literal("not-ready"), Literal("unknown")]),
       result: Union([status, Null()])
-    }, closed8),
+    }, closed7),
     notes: _Array_(String2({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
-  }, closed8);
+  }, closed7);
 });
 
 // node_modules/@supacloud/delivery/src/delivery-tuple.ts
@@ -17660,14 +17664,14 @@ var init_delivery_tuple = __esm(() => {
 });
 
 // node_modules/@supacloud/delivery/src/contract-matrix.ts
-var closed9, sha2564, generation, versions, CONTRACT_MATRIX_SCHEMA = "supacloud.consumer-contract-matrix.v1", FA_CONTRACT_SCENARIOS, ConsumerContractMatrixSchema;
+var closed8, sha2564, generation, versions, CONTRACT_MATRIX_SCHEMA = "supacloud.consumer-contract-matrix.v1", FA_CONTRACT_SCENARIOS, ConsumerContractMatrixSchema;
 var init_contract_matrix = __esm(() => {
   init_build();
   init_value2();
-  closed9 = { additionalProperties: false };
+  closed8 = { additionalProperties: false };
   sha2564 = String2({ pattern: "^[a-f0-9]{64}$" });
   generation = Union([Literal("old"), Literal("new")]);
-  versions = _Object_({ old: sha2564, new: sha2564 }, closed9);
+  versions = _Object_({ old: sha2564, new: sha2564 }, closed8);
   FA_CONTRACT_SCENARIOS = [
     "missing-display-field",
     "missing-authority-field",
@@ -17681,7 +17685,7 @@ var init_contract_matrix = __esm(() => {
     customer: Literal("xigu-fa"),
     baseline_tuple_sha256: sha2564,
     candidate_tuple_sha256: sha2564,
-    artifacts: _Object_({ frontend: versions, functions: versions, database: versions }, closed9),
+    artifacts: _Object_({ frontend: versions, functions: versions, database: versions }, closed8),
     cases: _Array_(_Object_({
       frontend: generation,
       functions: generation,
@@ -17689,20 +17693,20 @@ var init_contract_matrix = __esm(() => {
       scenarios: _Array_(_Object_({
         name: Enum(FA_CONTRACT_SCENARIOS),
         expected: Union([Literal("compatible"), Literal("blocked-safely")])
-      }, closed9), { minItems: FA_CONTRACT_SCENARIOS.length, maxItems: FA_CONTRACT_SCENARIOS.length })
-    }, closed9), { minItems: 8, maxItems: 8 })
-  }, closed9);
+      }, closed8), { minItems: FA_CONTRACT_SCENARIOS.length, maxItems: FA_CONTRACT_SCENARIOS.length })
+    }, closed8), { minItems: 8, maxItems: 8 })
+  }, closed8);
 });
 
 // node_modules/@supacloud/delivery/src/fa-stability.ts
-var closed10, hash3, label, timestamp2, count2, environment2, FA_REQUIRED_ACCEPTANCE, FA_BUSINESS_OPERATIONS, operation, proof, FaBusinessObservationSchema, FaServiceObjectivesSchema, FaStabilityEvidenceSchema;
+var closed9, hash3, label, timestamp2, count2, environment2, FA_REQUIRED_ACCEPTANCE, FA_BUSINESS_OPERATIONS, operation, proof, FaBusinessObservationSchema, FaServiceObjectivesSchema, FaStabilityEvidenceSchema;
 var init_fa_stability = __esm(() => {
   init_build();
   init_value2();
   init_delivery_files();
   init_contract_matrix();
   init_delivery_tuple();
-  closed10 = { additionalProperties: false };
+  closed9 = { additionalProperties: false };
   hash3 = String2({ pattern: "^[a-f0-9]{64}$" });
   label = String2({ minLength: 1, maxLength: 256, pattern: "\\S" });
   timestamp2 = String2({ minLength: 24, maxLength: 24 });
@@ -17725,7 +17729,7 @@ var init_fa_stability = __esm(() => {
   proof = _Object_({
     path: String2({ pattern: "^[A-Za-z0-9_-][A-Za-z0-9_./-]{0,255}$" }),
     sha256: hash3
-  }, closed10);
+  }, closed9);
   FaBusinessObservationSchema = _Object_({
     id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
     tuple_sha256: hash3,
@@ -17735,7 +17739,7 @@ var init_fa_stability = __esm(() => {
     outcome: Enum(["success", "failure", "timeout", "unknown"]),
     attempts: Integer({ minimum: 1, maximum: 1000 }),
     rollbacks: count2
-  }, closed10);
+  }, closed9);
   FaServiceObjectivesSchema = _Object_({
     status: Literal("approved"),
     owner: label,
@@ -17751,8 +17755,8 @@ var init_fa_stability = __esm(() => {
       minimum_samples: Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
       availability_percent: Number2({ exclusiveMinimum: 0, maximum: 100 }),
       p95_ms: Number2({ exclusiveMinimum: 0, maximum: Number.MAX_SAFE_INTEGER })
-    }, closed10), { minItems: FA_BUSINESS_OPERATIONS.length, maxItems: FA_BUSINESS_OPERATIONS.length })
-  }, closed10);
+    }, closed9), { minItems: FA_BUSINESS_OPERATIONS.length, maxItems: FA_BUSINESS_OPERATIONS.length })
+  }, closed9);
   FaStabilityEvidenceSchema = _Object_({
     schema: Literal("supacloud.fa-stability-evidence.v1"),
     environment: environment2,
@@ -17778,7 +17782,7 @@ var init_fa_stability = __esm(() => {
       passed: Boolean2(),
       measured_at: timestamp2,
       proof
-    }, closed10), { minItems: 10, maxItems: 10 }),
+    }, closed9), { minItems: 10, maxItems: 10 }),
     matrix: _Array_(_Object_({
       combination: label,
       scenario: label,
@@ -17787,14 +17791,14 @@ var init_fa_stability = __esm(() => {
       passed: Boolean2(),
       measured_at: timestamp2,
       proof
-    }, closed10), { minItems: 48, maxItems: 48 }),
+    }, closed9), { minItems: 48, maxItems: 48 }),
     observation: proof,
-    alert: _Object_({ route: label, acknowledged_by: label, delivered_at: timestamp2 }, closed10)
-  }, closed10);
+    alert: _Object_({ route: label, acknowledged_by: label, delivered_at: timestamp2 }, closed9)
+  }, closed9);
 });
 
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed11, projectRef2, sha2565, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
+var closed10, projectRef2, sha2565, nullableActivation2, nullableDigest, observation, blocker, ApplicationPromotionPlanSchema;
 var init_application_promotion = __esm(() => {
   init_build();
   init_value2();
@@ -17802,7 +17806,7 @@ var init_application_promotion = __esm(() => {
   init_application_activation();
   init_application_configuration();
   init_application_release();
-  closed11 = { additionalProperties: false };
+  closed10 = { additionalProperties: false };
   projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
   sha2565 = ApplicationReleaseIdSchema;
   nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
@@ -17839,7 +17843,7 @@ var init_application_promotion = __esm(() => {
       environment_id: ApplicationIdSchema,
       release_id: sha2565,
       ...observation
-    }, closed11),
+    }, closed10),
     target: _Object_({
       candidate_release_id: sha2565,
       current_release_id: Union([sha2565, Null()]),
@@ -17847,18 +17851,18 @@ var init_application_promotion = __esm(() => {
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
       configuration: Union([ApplicationConfigurationViewSchema, Null()]),
       ...observation
-    }, closed11),
+    }, closed10),
     migrations: _Object_({
       ledger_digest: sha2565,
       ledger_compatible: Boolean2(),
       project_migrations_applied: Boolean2(),
       pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
       operator_provisioning_required: Boolean2()
-    }, closed11),
+    }, closed10),
     backup: _Object_({
       required: Boolean2(),
       confirmed: Literal(false)
-    }, closed11),
+    }, closed10),
     action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
     blockers: _Array_(Enum([...blocker]), {
       maxItems: blocker.length,
@@ -17867,7 +17871,7 @@ var init_application_promotion = __esm(() => {
     steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
     execution_performed: Literal(false),
     data_recovery: Literal("separate-required")
-  }, closed11);
+  }, closed10);
 });
 
 // node_modules/@supacloud/delivery/src/application-runtime-identity.ts
@@ -18024,6 +18028,11 @@ var init_src = __esm(() => {
   init_release_contract();
 });
 
+// src/delivery-files.ts
+var init_delivery_files2 = __esm(() => {
+  init_delivery_files();
+});
+
 // src/delivery-migration-archive.ts
 var init_delivery_migration_archive2 = __esm(() => {
   init_src();
@@ -18140,7 +18149,7 @@ var init_release_evidence = __esm(() => {
 });
 
 // src/release-evidence-cli.ts
-import { resolve as resolve23 } from "node:path";
+import { resolve as resolve24 } from "node:path";
 async function runReleaseEvidenceCommand(args) {
   try {
     const values = new Map;
@@ -18164,7 +18173,7 @@ async function runReleaseEvidenceCommand(args) {
     if (!manifest || !target || manifest.length > 4096 || !/^[a-z][a-z0-9-]{0,62}$/.test(target)) {
       throw new ReleaseEvidenceError("RELEASE_EVIDENCE_INVALID");
     }
-    const evidence = await createReleaseEvidence(resolve23(manifest), target);
+    const evidence = await createReleaseEvidence(resolve24(manifest), target);
     console.log(json ? JSON.stringify(evidence, null, 2) : formatReleaseEvidence(evidence));
   } catch (error) {
     console.error(`Error: ${error instanceof ReleaseEvidenceError ? error.code : "RELEASE_EVIDENCE_INVALID"}`);
@@ -18176,15 +18185,15 @@ var init_release_evidence_cli = __esm(() => {
 });
 
 // src/database-contracts.ts
-import { createHash as createHash12 } from "node:crypto";
-import { mkdir as mkdir5, readFile as readFile13 } from "node:fs/promises";
-import { dirname as dirname11, relative as relative12, resolve as resolve24 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import { mkdir as mkdir5, readFile as readFile14 } from "node:fs/promises";
+import { dirname as dirname11, relative as relative13, resolve as resolve25 } from "node:path";
 import * as ts18 from "@typescript/typescript6";
 function hash4(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function importPath(out, path) {
-  const value = relative12(out, path).replaceAll("\\", "/").replace(/\.(?:d\.)?[cm]?ts$/, "");
+  const value = relative13(out, path).replaceAll("\\", "/").replace(/\.(?:d\.)?[cm]?ts$/, "");
   return value.startsWith(".") ? value : `./${value}`;
 }
 function parseDatabaseContractsOptions(value, directory) {
@@ -18206,19 +18215,19 @@ function parseDatabaseContractsOptions(value, directory) {
     throw new TypeError("migrations must be an ordered list of SQL files");
   }
   return {
-    rootDir: resolve24(directory, field("rootDir")),
-    outDir: resolve24(directory, field("outDir")),
-    postgrestTypes: resolve24(directory, field("postgrestTypes")),
-    drizzleSchema: resolve24(directory, field("drizzleSchema")),
+    rootDir: resolve25(directory, field("rootDir")),
+    outDir: resolve25(directory, field("outDir")),
+    postgrestTypes: resolve25(directory, field("postgrestTypes")),
+    drizzleSchema: resolve25(directory, field("drizzleSchema")),
     role: field("role"),
-    graphql: { ...graphql, schema: resolve24(directory, graphql.schema) },
-    migrations: migrations.map((file) => resolve24(directory, file))
+    graphql: { ...graphql, schema: resolve25(directory, graphql.schema) },
+    migrations: migrations.map((file) => resolve25(directory, file))
   };
 }
 async function generateDatabaseContracts(options, check = false) {
-  const rootDir = resolve24(options.rootDir), outDir = resolve24(options.outDir);
-  const postgrestTypes = resolve24(rootDir, options.postgrestTypes), drizzleSchema = resolve24(rootDir, options.drizzleSchema);
-  const snapshot = await readFile13(postgrestTypes, "utf8");
+  const rootDir = resolve25(options.rootDir), outDir = resolve25(options.outDir);
+  const postgrestTypes = resolve25(rootDir, options.postgrestTypes), drizzleSchema = resolve25(rootDir, options.drizzleSchema);
+  const snapshot = await readFile14(postgrestTypes, "utf8");
   const syntax = ts18.createSourceFile(postgrestTypes, snapshot, ts18.ScriptTarget.Latest, true);
   const database = syntax.statements.find((node) => (ts18.isTypeAliasDeclaration(node) || ts18.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts18.SyntaxKind.ExportKeyword));
   if (!database)
@@ -18245,8 +18254,8 @@ async function generateDatabaseContracts(options, check = false) {
   }
   const inputs = {};
   const addInput = async (path) => {
-    const absolute = resolve24(rootDir, path);
-    inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash4(await readFile13(absolute, "utf8"));
+    const absolute = resolve25(rootDir, path);
+    inputs[relative13(rootDir, absolute).replaceAll("\\", "/")] = hash4(await readFile14(absolute, "utf8"));
   };
   await addInput(postgrestTypes);
   await addInput(drizzleSchema);
@@ -18262,8 +18271,8 @@ async function generateDatabaseContracts(options, check = false) {
     if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
       await addInput(source.fileName);
   }
-  await addInput(resolve24(rootDir, options.graphql.schema));
-  if (new Set(options.migrations.map((path) => resolve24(rootDir, path))).size !== options.migrations.length) {
+  await addInput(resolve25(rootDir, options.graphql.schema));
+  if (new Set(options.migrations.map((path) => resolve25(rootDir, path))).size !== options.migrations.length) {
     throw new Error("Duplicate migration in database contracts configuration");
   }
   for (const path of options.migrations)
@@ -18284,17 +18293,17 @@ async function generateDatabaseContracts(options, check = false) {
     version: 1,
     role: options.role,
     inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => a.localeCompare(b))),
-    migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve24(rootDir, path)).replaceAll("\\", "/")),
+    migrationOrder: options.migrations.map((path) => relative13(rootDir, resolve25(rootDir, path)).replaceAll("\\", "/")),
     outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash4(text)]))
   };
   files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
 `;
   const mismatches = [];
   for (const [file, content] of Object.entries(files)) {
-    const path = resolve24(outDir, file);
+    const path = resolve25(outDir, file);
     let current;
     try {
-      current = await readFile13(path, "utf8");
+      current = await readFile14(path, "utf8");
     } catch (error) {
       if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT"))
         throw error;
@@ -18305,13 +18314,13 @@ async function generateDatabaseContracts(options, check = false) {
   if (!check) {
     await mkdir5(outDir, { recursive: true });
     for (const [file, content] of Object.entries(files))
-      await writeFileIfChanged(resolve24(outDir, file), content);
+      await writeFileIfChanged(resolve25(outDir, file), content);
   }
   return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
 }
 async function runDatabaseContractsFile(path, check = false) {
-  const absolute = resolve24(path);
-  const value = JSON.parse(await readFile13(absolute, "utf8"));
+  const absolute = resolve25(path);
+  const value = JSON.parse(await readFile14(absolute, "utf8"));
   return generateDatabaseContracts(parseDatabaseContractsOptions(value, dirname11(absolute)), check);
 }
 var init_database_contracts = __esm(() => {
@@ -18321,8 +18330,8 @@ var init_database_contracts = __esm(() => {
 });
 
 // src/graphql-schema.ts
-import { mkdir as mkdir6, readFile as readFile14 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve25 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile15 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve26 } from "node:path";
 async function pullGraphqlSchema(options) {
   assertGraphqlOptions({ schema: options.output });
   const endpoint = new URL(options.url);
@@ -18362,7 +18371,7 @@ async function pullGraphqlSchema(options) {
     throw new Error("GraphQL schema export failed. Verify caller grants and enable introspection only in the intended development environment.");
   }
   const schema = lexicographicSortSchema(buildClientSchema(data));
-  const path = resolve25(options.output);
+  const path = resolve26(options.output);
   const content = path.endsWith(".json") ? JSON.stringify(introspectionFromSchema(schema), null, 2) + `
 ` : `# GENERATED BY supacloud-compiler graphql-schema. DO NOT EDIT.
 # Database First: change database declarations, apply migrations, then re-export for the intended role.
@@ -18370,7 +18379,7 @@ async function pullGraphqlSchema(options) {
 `;
   let previous;
   try {
-    previous = await readFile14(path, "utf8");
+    previous = await readFile15(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT"))
       throw error;
@@ -18390,8 +18399,8 @@ var init_graphql_schema = __esm(() => {
 });
 
 // src/cli.ts
-import { resolve as resolve26 } from "node:path";
-import { readFile as readFile15 } from "node:fs/promises";
+import { resolve as resolve27 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
 
 // src/analyze.ts
 import { createHash as createHash3 } from "node:crypto";
@@ -23933,6 +23942,431 @@ function compileOptionsFromConfig(config, cwd = process.cwd()) {
 // src/cli.ts
 init_fixes();
 
+// src/preview-fix-loop.ts
+init_src();
+import { createHash as createHash10 } from "node:crypto";
+import { lstat as lstat3, readdir as readdir4, readFile as readFile6, realpath as realpath4, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename2, isAbsolute as isAbsolute5, join as join9, relative as relative10, resolve as resolve15, sep as sep10 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+init_execution_context();
+init_fixes();
+var PREVIEW_DEPLOY_RECEIPT_SCHEMA = "supacloud.preview-deploy-receipt.v1";
+var PREVIEW_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var PROJECT_REF = /^[a-z0-9-]{1,20}$/;
+var RESOURCE_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var RELATIVE_FILE = /^(?!\/)(?!\.\.(?:\/|$))(?!.*\/\.\.(?:\/|$))[A-Za-z0-9_./-]{1,240}$/;
+var MAX_FILES = 200;
+var MAX_FILE_BYTES = 1048576;
+var EVENTS_FILE = "preview-execution-events.json";
+var RECEIPT_FILE = "preview-deploy-receipt.json";
+
+class PreviewFixError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "PreviewFixError";
+  }
+}
+function fail(code) {
+  throw new PreviewFixError(code);
+}
+function inside2(parent, child) {
+  const fromParent = relative10(parent, child);
+  return fromParent === "" || !isAbsolute5(fromParent) && fromParent !== ".." && !fromParent.startsWith(`..${sep10}`);
+}
+async function realDirectory(path) {
+  const resolved = resolve15(path);
+  let stat;
+  try {
+    stat = await lstat3(resolved);
+  } catch {
+    return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+  const real = await realpath4(resolved);
+  if (real !== resolved)
+    return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+  return real;
+}
+async function treeDigest(root) {
+  const files = [];
+  async function walk(directory) {
+    if (files.length > MAX_FILES)
+      return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink() || entry.name === "." || entry.name === ".." || entry.name.includes("..")) {
+        return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+      }
+      const path = join9(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules")
+          continue;
+        await walk(path);
+      } else if (entry.isFile()) {
+        const stat = await lstat3(path);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_FILE_BYTES)
+          return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+        files.push(path);
+      } else {
+        return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+      }
+    }
+  }
+  await walk(root);
+  if (files.length > MAX_FILES)
+    return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+  const hash = createHash10("sha256");
+  for (const file of files.sort()) {
+    hash.update(relative10(root, file));
+    hash.update("\x00");
+    hash.update(await readFile6(file));
+    hash.update("\x00");
+  }
+  return hash.digest("hex");
+}
+function identity2(input, branchRef) {
+  if (!PREVIEW_ID.test(input.previewId) || !PROJECT_REF.test(input.projectRef) || !RESOURCE_ID.test(input.applicationId) || !RESOURCE_ID.test(input.environmentId) || input.property !== "transaction" && input.property !== "idempotency" || input.value !== "required" && input.value !== "none") {
+    fail("PREVIEW_FIX_POLICY_REQUIRED");
+  }
+  if (applicationPreviewBranchRef(input.previewId) !== branchRef)
+    fail("PREVIEW_FIX_IDENTITY_MISMATCH");
+}
+function matchingFix(diagnostics, property) {
+  const errors = diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+  const matches = errors.filter((diagnostic) => diagnostic.code === "invalid-command-mode" && diagnostic.fix?.type === "set_command_mode" && diagnostic.fix.property === property && typeof diagnostic.file === "string" && RELATIVE_FILE.test(diagnostic.file) && diagnostic.errorCode === "SC4012");
+  const [match] = matches;
+  if (errors.length !== 1 || matches.length !== 1 || !match?.fix || match.fix.type !== "set_command_mode") {
+    return fail("PREVIEW_FIX_DIAGNOSIS_REQUIRED");
+  }
+  return match.fix;
+}
+function record5(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  const entry = value;
+  const present = Object.keys(entry);
+  if (present.length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(entry, key))) {
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  }
+  return entry;
+}
+function text3(value, pattern) {
+  if (typeof value !== "string" || !pattern.test(value))
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  return value;
+}
+function stringList(value) {
+  if (!Array.isArray(value) || value.length > 32 || value.some((item) => typeof item !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(item))) {
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  }
+  return [...value];
+}
+function parsePreviewDeployReceipt(value) {
+  const root = record5(value, [
+    "schema",
+    "deployed",
+    "published",
+    "live",
+    "target",
+    "preview_id",
+    "project_ref",
+    "application_id",
+    "environment_id",
+    "branch_ref",
+    "artifact_sha256",
+    "status",
+    "graph",
+    "change",
+    "diagnosis",
+    "test",
+    "timeline",
+    "production"
+  ]);
+  if (root.schema !== PREVIEW_DEPLOY_RECEIPT_SCHEMA || root.deployed !== false || root.published !== false || root.live !== false || root.target !== "preview" || root.status !== "recorded") {
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  }
+  const graph = record5(root.graph, ["modules", "command", "transaction"]);
+  const change = record5(root.change, ["file", "written"]);
+  const diagnosis = record5(root.diagnosis, ["code", "errorCode", "file"]);
+  const test = record5(root.test, ["operation", "ok"]);
+  const timeline = record5(root.timeline, ["requestId", "operation", "handler", "failed", "complete", "missingStages"]);
+  const production = record5(root.production, ["written", "approval", "graphRead"]);
+  if (change.written !== true || test.ok !== true || timeline.handler !== "succeeded" || timeline.failed !== false || typeof timeline.complete !== "boolean" || production.written !== false || production.approval !== "required" || production.graphRead !== true || graph.transaction !== "required" && graph.transaction !== "none") {
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  }
+  const previewId = text3(root.preview_id, PREVIEW_ID);
+  const branchRef = text3(root.branch_ref, /^pv[a-f0-9]{18}$/);
+  if (applicationPreviewBranchRef(previewId) !== branchRef)
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  return {
+    schema: PREVIEW_DEPLOY_RECEIPT_SCHEMA,
+    deployed: false,
+    published: false,
+    live: false,
+    target: "preview",
+    preview_id: previewId,
+    project_ref: text3(root.project_ref, PROJECT_REF),
+    application_id: text3(root.application_id, RESOURCE_ID),
+    environment_id: text3(root.environment_id, RESOURCE_ID),
+    branch_ref: branchRef,
+    artifact_sha256: text3(root.artifact_sha256, /^[a-f0-9]{64}$/),
+    status: "recorded",
+    graph: {
+      modules: stringList(graph.modules),
+      command: text3(graph.command, /^[A-Za-z0-9_.:-]{1,128}$/),
+      transaction: graph.transaction
+    },
+    change: { file: text3(change.file, RELATIVE_FILE), written: true },
+    diagnosis: {
+      code: text3(diagnosis.code, /^[a-z0-9-]{1,64}$/),
+      errorCode: text3(diagnosis.errorCode, /^SC[0-9]{4}$/),
+      file: text3(diagnosis.file, RELATIVE_FILE)
+    },
+    test: { operation: text3(test.operation, /^[A-Za-z0-9_.:-]{1,128}$/), ok: true },
+    timeline: {
+      requestId: text3(timeline.requestId, /^[A-Za-z0-9._:-]{1,256}$/),
+      operation: text3(timeline.operation, /^[A-Za-z0-9_.:-]{1,128}$/),
+      handler: "succeeded",
+      failed: false,
+      complete: timeline.complete,
+      missingStages: stringList(timeline.missingStages)
+    },
+    production: { written: false, approval: "required", graphRead: true }
+  };
+}
+async function writeInside(root, name, contents) {
+  if (name !== EVENTS_FILE && name !== RECEIPT_FILE)
+    return fail("PREVIEW_FIX_ROOT_UNSUPPORTED");
+  const path = join9(root, name);
+  if (!inside2(root, path))
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  await writeFile4(path, contents, { encoding: "utf8", flag: "wx", mode: 420 });
+}
+async function runPreviewFixLoop(input) {
+  const branchRef = basename2(resolve15(input.previewRoot));
+  identity2(input, branchRef);
+  const productionRoot = await realDirectory(input.productionRoot);
+  const previewRoot = await realDirectory(input.previewRoot);
+  if (basename2(previewRoot) !== branchRef || productionRoot === previewRoot || inside2(productionRoot, previewRoot) || inside2(previewRoot, productionRoot)) {
+    return fail("PREVIEW_FIX_IDENTITY_MISMATCH");
+  }
+  const productionBefore = await treeDigest(productionRoot);
+  let previewGraph;
+  let productionGraph;
+  try {
+    previewGraph = await analyzeProject(previewRoot);
+    productionGraph = await analyzeProject(productionRoot);
+  } catch (error) {
+    if (error instanceof PreviewFixError)
+      throw error;
+    return fail("PREVIEW_FIX_DIAGNOSIS_REQUIRED");
+  }
+  if (!productionGraph.modules)
+    return fail("PREVIEW_FIX_DIAGNOSIS_REQUIRED");
+  const fix = matchingFix(previewGraph.diagnostics ?? [], input.property);
+  const chosen = { ...fix, value: input.value };
+  const previewed = await applyDiagnosticFix(chosen, { rootDir: previewRoot });
+  if (!previewed.changed || !inside2(previewRoot, previewed.file))
+    return fail("PREVIEW_FIX_DIAGNOSIS_REQUIRED");
+  const applied = await applyDiagnosticFix(chosen, { rootDir: previewRoot, dryRun: false });
+  if (!applied.changed || !inside2(previewRoot, applied.file))
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  if (await treeDigest(productionRoot) !== productionBefore)
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  const compiled = await compileProject({ rootDir: previewRoot, outDir: join9(previewRoot, "generated") });
+  const command = compiled.graph.modules.flatMap((module) => module.commands).find((item) => item.className === fix.command);
+  const policyApplied = input.property === "transaction" ? command?.transaction === input.value : command?.idempotency === input.value;
+  if (compiled.diagnostics.some((diagnostic) => diagnostic.severity === "error") || !command || !policyApplied) {
+    return fail("PREVIEW_FIX_COMPILE_FAILED");
+  }
+  const sourceFile = join9(previewRoot, fix.targetFile);
+  const sourceReal = await realpath4(sourceFile).catch(() => fail("PREVIEW_FIX_INVOKE_FAILED"));
+  if (!inside2(previewRoot, sourceReal))
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  const started = performance.now();
+  try {
+    const child = Bun.spawn([
+      process.versions.bun ? process.execPath : "bun",
+      "--no-env-file",
+      "-e",
+      [
+        "const imported = await import(process.argv[1]);",
+        "const ctor = imported[process.argv[2]];",
+        'if (typeof ctor !== "function") process.exit(2);',
+        "const instance = new ctor();",
+        'if (typeof instance.execute !== "function") process.exit(3);',
+        "const output = await instance.execute();",
+        'process.exit(output && typeof output === "object" && output.ok === true ? 0 : 4);'
+      ].join(`
+`),
+      "--",
+      pathToFileURL2(sourceReal).href,
+      fix.command
+    ], {
+      cwd: previewRoot,
+      env: { PATH: process.env.PATH ?? "" },
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    const timer = setTimeout(() => child.kill(), 1e4);
+    const status = await child.exited.finally(() => clearTimeout(timer));
+    if (status !== 0)
+      return fail("PREVIEW_FIX_INVOKE_FAILED");
+  } catch (error) {
+    if (error instanceof PreviewFixError)
+      throw error;
+    return fail("PREVIEW_FIX_INVOKE_FAILED");
+  }
+  const durationMs = Math.max(0, performance.now() - started);
+  const requestId = `preview-${input.previewId}`;
+  const events = {
+    version: 1,
+    events: [
+      { kind: "command", operation: command.name, stage: "handler", phase: "started", requestId, attempt: 1 },
+      { kind: "command", operation: command.name, stage: "handler", phase: "succeeded", requestId, attempt: 1, durationMs }
+    ]
+  };
+  await writeInside(previewRoot, EVENTS_FILE, `${JSON.stringify(events)}
+`);
+  const eventsPath = join9(previewRoot, EVENTS_FILE);
+  let pack;
+  try {
+    pack = createExecutionContextPack(compiled.graph, command.name, await readExecutionMetadata(eventsPath), requestId);
+  } catch {
+    return fail("PREVIEW_FIX_TIMELINE_UNAVAILABLE");
+  }
+  const entry = pack.timeline.find((item) => item.kind === "command" && item.operation === command.name);
+  const attempt = entry?.attempts[0];
+  const handler = attempt?.stages.find((stage) => stage.stage === "handler" && stage.phase === "succeeded");
+  if (!entry || !attempt || !handler || attempt.failed || pack.requestId !== requestId) {
+    return fail("PREVIEW_FIX_TIMELINE_UNAVAILABLE");
+  }
+  const artifactPath = join9(previewRoot, "generated", "application.ts");
+  const artifactReal = await realpath4(artifactPath).catch(() => fail("PREVIEW_FIX_COMPILE_FAILED"));
+  if (!inside2(previewRoot, artifactReal))
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  const artifact = await readFile6(artifactReal);
+  const receipt = parsePreviewDeployReceipt({
+    schema: PREVIEW_DEPLOY_RECEIPT_SCHEMA,
+    deployed: false,
+    published: false,
+    live: false,
+    target: "preview",
+    preview_id: input.previewId,
+    project_ref: input.projectRef,
+    application_id: input.applicationId,
+    environment_id: input.environmentId,
+    branch_ref: branchRef,
+    artifact_sha256: createHash10("sha256").update(artifact).digest("hex"),
+    status: "recorded",
+    graph: {
+      modules: compiled.graph.modules.map((module) => module.name),
+      command: command.name,
+      transaction: command.transaction
+    },
+    change: { file: relative10(previewRoot, applied.file), written: true },
+    diagnosis: { code: "invalid-command-mode", errorCode: "SC4012", file: fix.targetFile },
+    test: { operation: command.name, ok: true },
+    timeline: {
+      requestId,
+      operation: command.name,
+      handler: "succeeded",
+      failed: false,
+      complete: attempt.complete,
+      missingStages: attempt.missingStages
+    },
+    production: { written: false, approval: "required", graphRead: true }
+  });
+  await writeInside(previewRoot, RECEIPT_FILE, `${JSON.stringify(receipt, null, 2)}
+`);
+  if (await treeDigest(productionRoot) !== productionBefore)
+    return fail("PRODUCTION_APPROVAL_REQUIRED");
+  const written = parsePreviewDeployReceipt(JSON.parse(await readFile6(join9(previewRoot, RECEIPT_FILE), "utf8")));
+  if (written.deployed !== false || written.production.written !== false)
+    return fail("PREVIEW_FIX_RECEIPT_INVALID");
+  return written;
+}
+
+// src/preview-fix-cli.ts
+var FLAGS = [
+  "--production",
+  "--preview",
+  "--preview-id",
+  "--project-ref",
+  "--application-id",
+  "--environment-id",
+  "--property",
+  "--value"
+];
+function fail2(code) {
+  console.error(`Error: ${code}`);
+  process.exitCode = 1;
+  throw new Error(code);
+}
+async function runPreviewFixCommand(args) {
+  try {
+    const values = new Map;
+    let json = false;
+    for (let index = 0;index < args.length; index++) {
+      const option = args[index];
+      if (option === "--json") {
+        if (json)
+          fail2("PREVIEW_FIX_POLICY_REQUIRED");
+        json = true;
+        continue;
+      }
+      if (!FLAGS.includes(option))
+        fail2("PREVIEW_FIX_POLICY_REQUIRED");
+      const value = args[++index];
+      if (!value || value.startsWith("-") || values.has(option) || /[\u0000-\u001f\u007f]/.test(value) || value.length > 4096) {
+        fail2("PREVIEW_FIX_POLICY_REQUIRED");
+      }
+      values.set(option, value);
+    }
+    const required = FLAGS.map((flag) => values.get(flag));
+    if (required.some((value) => value === undefined))
+      fail2("PREVIEW_FIX_POLICY_REQUIRED");
+    const [productionRoot, previewRoot, previewId, projectRef, applicationId, environmentId, property, value] = required;
+    if (property !== "transaction" && property !== "idempotency" || value !== "required" && value !== "none") {
+      fail2("PREVIEW_FIX_POLICY_REQUIRED");
+    }
+    const input = {
+      productionRoot,
+      previewRoot,
+      previewId,
+      projectRef,
+      applicationId,
+      environmentId,
+      property,
+      value
+    };
+    const receipt = await runPreviewFixLoop(input);
+    if (json) {
+      console.log(JSON.stringify(receipt, null, 2));
+      return;
+    }
+    console.log([
+      "preview-fix recorded",
+      `  preview: ${receipt.preview_id}`,
+      `  branch: ${receipt.branch_ref}`,
+      `  diagnosis: ${receipt.diagnosis.errorCode}`,
+      `  test: ${receipt.test.operation} ok`,
+      "  deployed: false",
+      "  published: false",
+      "  production written: false",
+      "  production approval: required"
+    ].join(`
+`));
+  } catch (error) {
+    if (process.exitCode === 1)
+      return;
+    console.error(`Error: ${error instanceof PreviewFixError ? error.code : "PREVIEW_FIX_FAILED"}`);
+    process.exitCode = 1;
+  }
+}
+
 // src/diagnostics.ts
 function createDiagnosticReport(diagnostics) {
   return { format: 1, entries: diagnostics.map((diagnostic) => {
@@ -23990,7 +24424,7 @@ async function createEditorCodeActions(diagnostics, options = {}) {
 init_graphql_options();
 
 // src/delivery-plan.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 init_feature();
 init_validate();
 var compare2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -24223,7 +24657,7 @@ function createDeliveryPlan(graph, input, validation) {
     deploymentReady: false,
     targets: [...targets.values()].sort((a, b) => compare2(a.name, b.name))
   };
-  const topologyDigest = createHash10("sha256").update(JSON.stringify(topology)).digest("hex");
+  const topologyDigest = createHash11("sha256").update(JSON.stringify(topology)).digest("hex");
   return parseDeliveryPlanResult({
     ok: true,
     plan: { ...topology, topologyDigest },
@@ -24258,9 +24692,9 @@ function formatDeliveryPlan(result) {
 }
 
 // src/delivery-build.ts
-import { mkdir as mkdir3, mkdtemp, readFile as readFile7, realpath as realpath4, rename as rename4, rm as rm2 } from "node:fs/promises";
+import { mkdir as mkdir3, mkdtemp, readFile as readFile8, realpath as realpath5, rename as rename4, rm as rm2 } from "node:fs/promises";
 import { readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname9, join as join10, relative as relative10, resolve as resolve17, sep as sep10 } from "node:path";
+import { dirname as dirname9, join as join11, relative as relative11, resolve as resolve18, sep as sep11 } from "node:path";
 import * as ts16 from "@typescript/typescript6";
 
 // src/delivery-build-schema.ts
@@ -24301,8 +24735,8 @@ function renderDeliveryTarget(graph, target, options) {
 // src/delivery-bundle.ts
 init_delivery_files2();
 import { isBuiltin } from "node:module";
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join9, resolve as resolve15 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join10, resolve as resolve16 } from "node:path";
 import * as ts15 from "@typescript/typescript6";
 
 // src/delivery-imports.ts
@@ -24391,7 +24825,7 @@ function staticDeliveryImports(path, contents) {
 // src/delivery-bundle-protocol.ts
 init_build();
 init_value2();
-var closed5 = { additionalProperties: false };
+var closed11 = { additionalProperties: false };
 var requestSchema = _Object_({
   parentPid: Integer({ minimum: 1 }),
   name: String2(),
@@ -24399,15 +24833,15 @@ var requestSchema = _Object_({
   project: String2(),
   generatedDirectory: String2(),
   options: DeliveryOptionsSchema
-}, closed5);
+}, closed11);
 var responseSchema = Union([
   _Object_({
     ok: Literal(true),
     files: _Array_(Tuple([DeliveryFilePathSchema, String2({ pattern: "^[A-Za-z0-9+/]*={0,2}$" })])),
     inputs: _Array_(Tuple([String2(), String2({ pattern: "^[a-f0-9]{64}$" })])),
     runtimeImports: _Array_(String2())
-  }, closed5),
-  _Object_({ ok: Literal(false) }, closed5)
+  }, closed11),
+  _Object_({ ok: Literal(false) }, closed11)
 ]);
 function parseDeliveryBundleRequest(input) {
   if (!Check2(requestSchema, input))
@@ -24422,7 +24856,7 @@ function parseDeliveryBundleResponse(input) {
 
 // src/delivery-bundle.ts
 async function bundleDeliveryTarget(name, code, project, generatedDirectory, options) {
-  const worker = join9(import.meta.dir, `delivery-bundle-worker.${import.meta.path.endsWith(".ts") ? "ts" : "js"}`);
+  const worker = join10(import.meta.dir, `delivery-bundle-worker.${import.meta.path.endsWith(".ts") ? "ts" : "js"}`);
   const environment = {};
   for (const name of ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SystemRoot"]) {
     const value = process.env[name];
@@ -24479,7 +24913,7 @@ async function bundleDeliveryTarget(name, code, project, generatedDirectory, opt
 async function bundleDeliveryTargetInProcess(name, code, project, generatedDirectory, options) {
   const inputs = new Map;
   const workingDirectory = process.cwd();
-  const entry = resolve15(generatedDirectory, `delivery-${name}.ts`);
+  const entry = resolve16(generatedDirectory, `delivery-${name}.ts`);
   const entryPattern = new RegExp(`^${entry.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`);
   const result = await Bun.build({
     entrypoints: [entry],
@@ -24501,8 +24935,8 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
         build.onLoad({ filter: /.*/, namespace: "file" }, async (args) => {
           if (args.path === entry)
             return { contents: code, loader: "ts" };
-          const bytes = await readFile6(args.path);
-          inputs.set(resolve15(args.path), digest(bytes));
+          const bytes = await readFile7(args.path);
+          inputs.set(resolve16(args.path), digest(bytes));
           return { contents: staticDeliveryImports(args.path, bytes), loader: args.loader };
         });
       }
@@ -24512,7 +24946,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
     throw new Error("Independent bundle failed or has no dependency metadata.");
   const runtimeImports = new Set;
   for (const [path, metadata] of Object.entries(result.metafile.inputs)) {
-    if (resolve15(workingDirectory, path) !== entry && !inputs.has(resolve15(workingDirectory, path))) {
+    if (resolve16(workingDirectory, path) !== entry && !inputs.has(resolve16(workingDirectory, path))) {
       throw new Error("Bundler reported an input that was not captured by the delivery snapshot.");
     }
     for (const imported of metadata.imports) {
@@ -24547,7 +24981,7 @@ async function bundleDeliveryTargetInProcess(name, code, project, generatedDirec
   if (!files.has("bundle/index.js"))
     throw new Error("Independent bundle has no index.js entrypoint.");
   for (const [path, hash] of inputs) {
-    if (digest(await readFile6(path)) !== hash)
+    if (digest(await readFile7(path)) !== hash)
       throw new Error("Source changed during bundling; retry the build.");
   }
   return { files, inputs, runtimeImports: [...runtimeImports].sort() };
@@ -24898,14 +25332,14 @@ export default deliveryFunctionDefault;
 
 // src/delivery-migrations.ts
 init_delivery_files2();
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 async function prepareDeliveryMigrations(project, generatedRoot, declarations = []) {
   const entries = [];
   const files = new Map;
   const inputs = new Map;
   let totalBytes = 0;
   for (const declaration of [...declarations].sort((a, b) => BigInt(a.version) < BigInt(b.version) ? -1 : BigInt(a.version) > BigInt(b.version) ? 1 : 0)) {
-    const source = resolve16(project, declaration.source);
+    const source = resolve17(project, declaration.source);
     if (!inside(project, source) || inside(generatedRoot, source))
       throw new Error("Invalid migration source.");
     const bytes = await readBoundedOwned(project, source, 1048576);
@@ -24956,27 +25390,27 @@ async function buildDeliveryProject(options, delivery) {
     const settings = parseDeliveryOptions(delivery);
     if (typeof Bun === "undefined")
       throw new Error("Independent delivery builds require Bun.");
-    const configPath = ts16.findConfigFile(resolve17(options.rootDir), ts16.sys.fileExists);
+    const configPath = ts16.findConfigFile(resolve18(options.rootDir), ts16.sys.fileExists);
     if (!configPath)
       throw new Error("Independent delivery builds require a project tsconfig.json.");
     const lexicalProject = dirname9(configPath);
-    const project = await realpath4(lexicalProject);
-    const sourceRoot = await realpath4(options.rootDir);
+    const project = await realpath5(lexicalProject);
+    const sourceRoot = await realpath5(options.rootDir);
     if (!inside(project, sourceRoot))
       throw new Error("Application sources must be inside the project.");
-    const requested = resolve17(options.outDir, "delivery");
+    const requested = resolve18(options.outDir, "delivery");
     if (!inside(lexicalProject, requested))
       throw new Error("Output must be inside the application project.");
-    const buildRoot = resolve17(project, relative10(lexicalProject, requested));
-    const generatedRoot = resolve17(project, relative10(lexicalProject, options.outDir));
+    const buildRoot = resolve18(project, relative11(lexicalProject, requested));
+    const generatedRoot = resolve18(project, relative11(lexicalProject, options.outDir));
     if (inside(generatedRoot, sourceRoot))
       throw new Error("Output must not contain the application source root.");
     const configInputs = new Map;
-    const parsedConfig = ts16.getParsedCommandLineOfConfigFile(await realpath4(configPath), {}, {
+    const parsedConfig = ts16.getParsedCommandLineOfConfigFile(await realpath5(configPath), {}, {
       ...ts16.sys,
       readFile(path) {
         const contents = readFileSync3(path, "utf8");
-        configInputs.set(resolve17(path), digest(contents));
+        configInputs.set(resolve18(path), digest(contents));
         return contents;
       },
       onUnRecoverableConfigFileDiagnostic() {
@@ -25014,7 +25448,7 @@ async function buildDeliveryProject(options, delivery) {
         if (!target || (kind === "worker" ? target.kind !== "jobs" : target.kind === "jobs")) {
           throw new Error("Delivery host kind does not match its target.");
         }
-        const path = resolve17(sourceRoot, app.source);
+        const path = resolve18(sourceRoot, app.source);
         if (inside(generatedRoot, path) || !/\.[cm]?ts$/.test(path))
           throw new Error("Hosts require application TypeScript source.");
         hosts.set(app.target, { path, kind, hash: digest(await readOwned(sourceRoot, path)) });
@@ -25025,7 +25459,7 @@ async function buildDeliveryProject(options, delivery) {
         continue;
       if (hosts.has(target.name))
         throw new Error("Duplicate delivery application host.");
-      const path = resolve17(sourceRoot, target.function.entrypoint);
+      const path = resolve18(sourceRoot, target.function.entrypoint);
       if (inside(generatedRoot, path) || !/\.[cm]?ts$/.test(path)) {
         throw new Error("Function hosts require application TypeScript source.");
       }
@@ -25035,10 +25469,10 @@ async function buildDeliveryProject(options, delivery) {
     const migrations = await prepareDeliveryMigrations(project, generatedRoot, settings.build?.migrations);
     phase = "output-ownership";
     output = await reserveOutput(project, buildRoot);
-    const objectRoot = join10(output.path, "objects");
+    const objectRoot = join11(output.path, "objects");
     await noLinks(output.path, objectRoot);
     await mkdir3(objectRoot, { recursive: true });
-    const pointer = join10(output.path, "delivery.manifest.json");
+    const pointer = join11(output.path, "delivery.manifest.json");
     const previous = await exists(pointer) ? parseDeliveryBuildManifest(JSON.parse(new TextDecoder().decode(await readOwned(output.path, pointer)))) : undefined;
     const objects = [];
     const candidates = [];
@@ -25059,14 +25493,14 @@ async function buildDeliveryProject(options, delivery) {
     let directory = project;
     while (true) {
       for (const name of ["package.json", "bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bunfig.toml", "tsconfig.json"]) {
-        const path = join10(directory, name);
+        const path = join11(directory, name);
         if (await exists(path)) {
-          const bytes = await readFile7(path);
+          const bytes = await readFile8(path);
           const before = snapshots.get(path);
           if (before !== undefined && before !== digest(bytes))
             throw new Error("Configuration changed during analysis; retry.");
           snapshots.set(path, digest(bytes));
-          configuration[relative10(project, path).split(sep10).join("/")] = digest(bytes);
+          configuration[relative11(project, path).split(sep11).join("/")] = digest(bytes);
         }
       }
       const parent = dirname9(directory);
@@ -25078,13 +25512,13 @@ async function buildDeliveryProject(options, delivery) {
       producer,
       bun: Bun.version,
       revision: Bun.revision,
-      compiler: digest(canonical2(Object.fromEntries([...await sourceInventory(import.meta.dir, join10(import.meta.dir, "node_modules"))].map(([path, hash]) => [relative10(import.meta.dir, path), hash]))))
+      compiler: digest(canonical2(Object.fromEntries([...await sourceInventory(import.meta.dir, join11(import.meta.dir, "node_modules"))].map(([path, hash]) => [relative11(import.meta.dir, path), hash]))))
     };
     for (const target of planned.plan.targets) {
       phase = `target:${target.name}`;
-      const stage = await mkdtemp(join10(objectRoot, ".build-"));
+      const stage = await mkdtemp(join11(objectRoot, ".build-"));
       temporary.push(stage);
-      const generatedDirectory = join10(objectRoot, "0".repeat(64), "generated");
+      const generatedDirectory = join11(objectRoot, "0".repeat(64), "generated");
       const host = hosts.get(target.name);
       const standaloneFunction = target.kind === "function" && target.modules.length === 0;
       const rendered = standaloneFunction ? undefined : renderDeliveryTarget(checked.graph, target, {
@@ -25098,7 +25532,7 @@ async function buildDeliveryProject(options, delivery) {
       if (standaloneFunction) {
         if (target.function === undefined)
           throw new Error("Function target requires an entrypoint descriptor.");
-        const entrypointPath = resolve17(sourceRoot, target.function.entrypoint);
+        const entrypointPath = resolve18(sourceRoot, target.function.entrypoint);
         if (inside(generatedRoot, entrypointPath) || !/\.[cm]?ts$/.test(entrypointPath)) {
           throw new Error("Standalone Function entrypoints require application TypeScript source.");
         }
@@ -25126,7 +25560,7 @@ async function buildDeliveryProject(options, delivery) {
         const program = ts16.createProgram({
           rootNames: [
             ...parsedConfig.fileNames.filter((path) => !inside(generatedRoot, path)),
-            ...Object.keys(generated).map((name) => join10(stage, "generated", name))
+            ...Object.keys(generated).map((name) => join11(stage, "generated", name))
           ],
           options: { ...parsedConfig.options, rootDir: project },
           ...parsedConfig.projectReferences ? { projectReferences: parsedConfig.projectReferences } : {}
@@ -25176,7 +25610,7 @@ async function buildDeliveryProject(options, delivery) {
       }));
       const assetInputs = {};
       for (const asset of assets.filter((asset) => asset.target === target.name)) {
-        const path = resolve17(sourceRoot, asset.source);
+        const path = resolve18(sourceRoot, asset.source);
         const bytes = await readOwned(sourceRoot, path);
         const hash = digest(bytes);
         const previousHash = snapshots.get(path);
@@ -25199,7 +25633,7 @@ async function buildDeliveryProject(options, delivery) {
           workerApplication: workerApplications.find((app) => app.target === target.name),
           assets: assets.filter((asset) => asset.target === target.name)
         },
-        inputs: Object.fromEntries([...bundled.inputs].map(([path, hash]) => [relative10(project, path).split(sep10).join("/"), hash])),
+        inputs: Object.fromEntries([...bundled.inputs].map(([path, hash]) => [relative11(project, path).split(sep11).join("/"), hash])),
         assets: assetInputs,
         ...migrations.entries.length ? { migrations: migrations.entries } : {}
       }));
@@ -25220,7 +25654,7 @@ async function buildDeliveryProject(options, delivery) {
     if (canonical2(Object.fromEntries(sources)) !== canonical2(Object.fromEntries(await sourceInventory(sourceRoot, generatedRoot))))
       throw new Error("Application sources changed during analysis; retry.");
     for (const [path, hash] of snapshots) {
-      if (digest(await readFile7(path)) !== hash)
+      if (digest(await readFile8(path)) !== hash)
         throw new Error("Build inputs changed before publication; retry.");
     }
     const manifest = parseDeliveryBuildManifest({
@@ -25239,7 +25673,7 @@ async function buildDeliveryProject(options, delivery) {
     });
     phase = "artifact-integrity";
     for (const candidate of candidates) {
-      const destination = join10(objectRoot, candidate.object.objectId);
+      const destination = join11(objectRoot, candidate.object.objectId);
       await noLinks(output.path, destination);
       if (await exists(destination) && canonical2(await artifactInventory(destination)) !== canonical2(candidate.object.files)) {
         throw new Error("An immutable artifact was modified. Refusing to overwrite it.");
@@ -25247,10 +25681,10 @@ async function buildDeliveryProject(options, delivery) {
     }
     const written = [];
     for (const candidate of candidates) {
-      const destination = join10(objectRoot, candidate.object.objectId);
+      const destination = join11(objectRoot, candidate.object.objectId);
       if (!await exists(destination)) {
         await rename4(candidate.path, destination);
-        written.push(...candidate.object.files.map((file) => join10(destination, file.path)));
+        written.push(...candidate.object.files.map((file) => join11(destination, file.path)));
       }
     }
     phase = "manifest-publication";
@@ -25290,14 +25724,14 @@ async function buildDeliveryProject(options, delivery) {
 }
 
 // src/migrations.ts
-import { rename as rename5, readFile as readFile9, writeFile as writeFile4, rm as rm3 } from "node:fs/promises";
-import { relative as relative11, resolve as resolve19 } from "node:path";
+import { rename as rename5, readFile as readFile10, writeFile as writeFile5, rm as rm3 } from "node:fs/promises";
+import { relative as relative12, resolve as resolve20 } from "node:path";
 import * as ts17 from "@typescript/typescript6";
 
 // src/migration-policy.ts
-import { readFile as readFile8 } from "node:fs/promises";
+import { readFile as readFile9 } from "node:fs/promises";
 import { readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve18 } from "node:path";
+import { resolve as resolve19 } from "node:path";
 
 // src/migration-app-version.ts
 var MIGRATION_APP_VERSION = "0.35.0";
@@ -25330,7 +25764,7 @@ async function checkMigrationDependencies(rootDir) {
   const problems = [];
   for (const [name, expected] of Object.entries(migrationDependencies())) {
     try {
-      const manifest = JSON.parse(await readFile8(resolve18(rootDir, "node_modules", name, "package.json"), "utf8"));
+      const manifest = JSON.parse(await readFile9(resolve19(rootDir, "node_modules", name, "package.json"), "utf8"));
       if (!manifest || typeof manifest !== "object" || !("name" in manifest) || manifest.name !== name || !("version" in manifest) || manifest.version !== expected) {
         problems.push(`${name}: requires tested installed version ${expected}`);
       }
@@ -25435,7 +25869,7 @@ function resolveStaticObjectLiteral2(input, checker, seen = new Set) {
   return;
 }
 function displayFile(rootDir, fileName) {
-  const path = relative11(rootDir, fileName);
+  const path = relative12(rootDir, fileName);
   return path && !path.startsWith("..") ? path : fileName;
 }
 function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
@@ -25445,10 +25879,10 @@ function createMigrationProgram(fileNames, sourceOverrides, rootDir) {
   const fileExists = host.fileExists.bind(host);
   const readFile = host.readFile.bind(host);
   const currentDirectory = host.getCurrentDirectory.bind(host);
-  host.fileExists = (fileName) => sourceOverrides.has(resolve19(fileName)) || fileExists(fileName);
-  host.readFile = (fileName) => sourceOverrides.get(resolve19(fileName)) ?? readFile(fileName);
+  host.fileExists = (fileName) => sourceOverrides.has(resolve20(fileName)) || fileExists(fileName);
+  host.readFile = (fileName) => sourceOverrides.get(resolve20(fileName)) ?? readFile(fileName);
   host.getSourceFile = (fileName, languageVersion, onError, shouldCreateNewSourceFile) => {
-    const source = sourceOverrides.get(resolve19(fileName));
+    const source = sourceOverrides.get(resolve20(fileName));
     return source === undefined ? getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile) : ts17.createSourceFile(fileName, source, languageVersion, true);
   };
   host.getCurrentDirectory = () => rootDir ?? currentDirectory();
@@ -25474,7 +25908,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
     issues.push(issue);
   };
   for (const sourceFile of sourceFiles) {
-    const sourcePath = resolve19(sourceFile.fileName);
+    const sourcePath = resolve20(sourceFile.fileName);
     if (!includedFiles.has(sourcePath))
       continue;
     const visit = (node) => {
@@ -25482,7 +25916,7 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         const options = node.arguments[1];
         const object = options && resolveStaticObjectLiteral2(options, checker);
         if (object) {
-          const objectPath = resolve19(object.getSourceFile().fileName);
+          const objectPath = resolve20(object.getSourceFile().fileName);
           const properties = routeResponseProperties(object);
           if (properties.response) {
             if (!includedFiles.has(objectPath)) {
@@ -25525,13 +25959,13 @@ function planRouteResponseMigration(sourceFiles, checker, rootDir, includedFiles
         line: lineOf2(sourceFile, response)
       });
     } else {
-      const replacements = replacementsByFile.get(resolve19(sourceFile.fileName)) ?? [];
+      const replacements = replacementsByFile.get(resolve20(sourceFile.fileName)) ?? [];
       replacements.push({
         start: response.getStart(sourceFile),
         end: response.getEnd(),
         text: `responses: { 200: ${response.initializer.getText(sourceFile)} }`
       });
-      replacementsByFile.set(resolve19(sourceFile.fileName), replacements);
+      replacementsByFile.set(resolve20(sourceFile.fileName), replacements);
     }
   }
   return { replacementsByFile, issues };
@@ -25544,7 +25978,7 @@ function applyReplacements(source, replacements) {
   return content;
 }
 function migrateRouteResponse(source, fileName) {
-  const absoluteFile = resolve19(fileName);
+  const absoluteFile = resolve20(fileName);
   const sourceOverrides = new Map([[absoluteFile, source]]);
   const program = createMigrationProgram([absoluteFile], sourceOverrides);
   const sourceFile = program.getSourceFile(absoluteFile);
@@ -25560,7 +25994,7 @@ function migrateRouteResponse(source, fileName) {
       }]
     };
   }
-  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve19("."), new Set([absoluteFile]));
+  const plan = planRouteResponseMigration([sourceFile], program.getTypeChecker(), resolve20("."), new Set([absoluteFile]));
   const replacements = plan.replacementsByFile.get(absoluteFile) ?? [];
   return {
     changed: replacements.length > 0,
@@ -25570,7 +26004,7 @@ function migrateRouteResponse(source, fileName) {
   };
 }
 function migrateRouteResponseProject(files, rootDir, sourceByPath) {
-  const absoluteFiles = files.map((file) => resolve19(file));
+  const absoluteFiles = files.map((file) => resolve20(file));
   const program = createMigrationProgram(absoluteFiles, sourceByPath, rootDir);
   const sourceFiles = absoluteFiles.map((file) => program.getSourceFile(file)).filter((file) => file !== undefined);
   const plan = planRouteResponseMigration(sourceFiles, program.getTypeChecker(), rootDir, new Set(absoluteFiles));
@@ -25583,11 +26017,11 @@ function migrateRouteResponseProject(files, rootDir, sourceByPath) {
       changed: replacements.length > 0,
       content: applyReplacements(source, replacements),
       replacements: replacements.length,
-      issues: plan.issues.filter((issue) => resolve19(rootDir, issue.file) === file)
+      issues: plan.issues.filter((issue) => resolve20(rootDir, issue.file) === file)
     });
   }
   for (const issue of plan.issues) {
-    const path = resolve19(rootDir, issue.file);
+    const path = resolve20(rootDir, issue.file);
     if (!results.has(path) && sourceByPath.has(path)) {
       results.set(path, {
         changed: false,
@@ -25618,14 +26052,14 @@ var SUPACLOUD_MIGRATIONS = [
 async function writeAtomically(path, content) {
   const temporary = `${path}.supacloud-migrate-${process.pid}-${crypto.randomUUID()}`;
   try {
-    await writeFile4(temporary, content, "utf8");
+    await writeFile5(temporary, content, "utf8");
     await rename5(temporary, path);
   } finally {
     await rm3(temporary, { force: true });
   }
 }
 async function migrateProject(options) {
-  const rootDir = resolve19(options.rootDir);
+  const rootDir = resolve20(options.rootDir);
   let migrations = SUPACLOUD_MIGRATIONS;
   const preflightIssues = [];
   if (options.fromVersion !== undefined || options.toVersion !== undefined) {
@@ -25681,7 +26115,7 @@ async function migrateProject(options) {
     }
   };
   for (const filePath of files) {
-    sourceByPath.set(resolve19(filePath), await readFile9(filePath, "utf8"));
+    sourceByPath.set(resolve20(filePath), await readFile10(filePath, "utf8"));
   }
   const originalSources = new Map(sourceByPath);
   const writtenFiles = new Set;
@@ -25690,8 +26124,8 @@ async function migrateProject(options) {
     if (projectResults)
       appendIssues(projectResults.issues);
     for (const filePath of files) {
-      const absoluteFile = resolve19(filePath);
-      const file = relative11(rootDir, absoluteFile) || absoluteFile;
+      const absoluteFile = resolve20(filePath);
+      const file = relative12(rootDir, absoluteFile) || absoluteFile;
       const before = sourceByPath.get(absoluteFile);
       if (before === undefined)
         continue;
@@ -25716,7 +26150,7 @@ async function migrateProject(options) {
     const written = [];
     try {
       for (const [path, content] of pendingWrites) {
-        if (await readFile9(path, "utf8") !== originalSources.get(path)) {
+        if (await readFile10(path, "utf8") !== originalSources.get(path)) {
           throw new Error(`Source changed during migration: ${path}`);
         }
         await writeAtomically(path, content);
@@ -25728,7 +26162,7 @@ async function migrateProject(options) {
       for (const path of written.reverse()) {
         try {
           const original = originalSources.get(path);
-          if (original === undefined || await readFile9(path, "utf8") !== pendingWrites.get(path)) {
+          if (original === undefined || await readFile10(path, "utf8") !== pendingWrites.get(path)) {
             throw new Error("File changed after migration; refusing to overwrite concurrent edits");
           }
           await writeAtomically(path, original);
@@ -25739,7 +26173,7 @@ async function migrateProject(options) {
       }
     }
   }
-  const changedFiles = options.write && issues.length > 0 ? [...writtenFiles].map((file) => relative11(rootDir, file)) : [...new Set(results.filter((result) => result.changed && result.issues.length === 0).map((result) => result.file))];
+  const changedFiles = options.write && issues.length > 0 ? [...writtenFiles].map((file) => relative12(rootDir, file)) : [...new Set(results.filter((result) => result.changed && result.issues.length === 0).map((result) => result.file))];
   return {
     write: options.write === true,
     migrations: migrations.map(({ id, from, to, description }) => ({ id, from, to, description })),
@@ -25750,14 +26184,14 @@ async function migrateProject(options) {
 }
 
 // src/migration-assess.ts
-import { createHash as createHash11 } from "node:crypto";
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join11, resolve as resolve21 } from "node:path";
+import { createHash as createHash12 } from "node:crypto";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join12, resolve as resolve22 } from "node:path";
 
 // src/openapi-tools.ts
-import { mkdir as mkdir4, readFile as readFile10, rename as rename6, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve20 } from "node:path";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
+import { mkdir as mkdir4, readFile as readFile11, rename as rename6, unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname10, resolve as resolve21 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
 
 class OpenApiDocumentError extends Error {
   code = "OPENAPI_DOCUMENT_INVALID";
@@ -26147,7 +26581,7 @@ function serializeOpenApiJson(document, space = 2) {
 }
 async function readOpenApiJson(path) {
   try {
-    const value = JSON.parse(await readFile10(resolve20(path), "utf8"));
+    const value = JSON.parse(await readFile11(resolve21(path), "utf8"));
     return parseOpenApiDocument(value);
   } catch (error) {
     if (error instanceof OpenApiDocumentError)
@@ -26156,16 +26590,16 @@ async function readOpenApiJson(path) {
   }
 }
 async function writeOpenApiJson(document, outputPath, space = 2) {
-  const path = resolve20(outputPath);
+  const path = resolve21(outputPath);
   const content = serializeOpenApiJson(document, space);
   await mkdir4(dirname10(path), { recursive: true });
   try {
-    if (await readFile10(path, "utf8") === content)
+    if (await readFile11(path, "utf8") === content)
       return { path, written: false };
   } catch {}
   const temporaryPath = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
   try {
-    await writeFile5(temporaryPath, content, "utf8");
+    await writeFile6(temporaryPath, content, "utf8");
     await rename6(temporaryPath, path);
   } catch (error) {
     await unlink3(temporaryPath).catch(() => {
@@ -26177,7 +26611,7 @@ async function writeOpenApiJson(document, outputPath, space = 2) {
 }
 async function loadGeneratedOpenApiDocument(modulePath) {
   try {
-    const moduleUrl = pathToFileURL2(resolve20(modulePath));
+    const moduleUrl = pathToFileURL3(resolve21(modulePath));
     moduleUrl.searchParams.set("supacloud-openapi-export", "1");
     const loaded = await import(moduleUrl.href);
     if (!isRecord(loaded))
@@ -26447,17 +26881,17 @@ function validRpcInventory(value, commandInventory) {
   });
 }
 async function sha2566(path) {
-  return createHash11("sha256").update(await readFile11(path)).digest("hex");
+  return createHash12("sha256").update(await readFile12(path)).digest("hex");
 }
 function overallStatus(findings) {
   return findings.reduce((current, finding) => STATUS_PRIORITY[finding.status] > STATUS_PRIORITY[current] ? finding.status : current, "compatible");
 }
 async function assessMigration(options) {
-  const projectDir = resolve21(options.projectDir);
+  const projectDir = resolve22(options.projectDir);
   const compile = {
     ...options.compile,
-    rootDir: resolve21(options.compile.rootDir),
-    outDir: resolve21(options.compile.outDir)
+    rootDir: resolve22(options.compile.rootDir),
+    outDir: resolve22(options.compile.outDir)
   };
   const findings = [];
   const dependencyProblems = await checkMigrationDependencies(projectDir);
@@ -26508,13 +26942,13 @@ async function assessMigration(options) {
       remediation: "Verify the project source, configuration and installed dependencies, then reassess."
     });
   }
-  const contractsManifestPath = join11(compile.outDir, "contracts.manifest.json");
+  const contractsManifestPath = join12(compile.outDir, "contracts.manifest.json");
   let contractsManifest = {
     path: contractsManifestPath,
     present: false
   };
   try {
-    const parsed = JSON.parse(await readFile11(contractsManifestPath, "utf8"));
+    const parsed = JSON.parse(await readFile12(contractsManifestPath, "utf8"));
     if (!isRecord2(parsed) || parsed["version"] !== 1 || !validJobInventory(parsed["jobs"]) || !validCommandInventory(parsed["commands"]) || !Array.isArray(parsed["routes"]) || !validRpcInventory(parsed["rpc"], parsed["commands"]) || !validFeatureInventory(parsed["features"], parsed["jobs"], parsed["commands"], parsed["routes"], parsed["rpc"])) {
       throw new Error("invalid manifest");
     }
@@ -26545,8 +26979,8 @@ async function assessMigration(options) {
   }
   let openApi;
   if (options.baselineOpenApiPath && options.currentOpenApiPath) {
-    const baselinePath = resolve21(projectDir, options.baselineOpenApiPath);
-    const currentPath = resolve21(projectDir, options.currentOpenApiPath);
+    const baselinePath = resolve22(projectDir, options.baselineOpenApiPath);
+    const currentPath = resolve22(projectDir, options.currentOpenApiPath);
     try {
       const diff = diffOpenApiDocuments(await readOpenApiJson(baselinePath), await readOpenApiJson(currentPath));
       openApi = {
@@ -26628,8 +27062,8 @@ function formatMigrationAssessment(result) {
 
 // src/graphql-governance.ts
 init_graphql_schema_hashes();
-import { readFile as readFile12 } from "node:fs/promises";
-import { resolve as resolve22 } from "node:path";
+import { readFile as readFile13 } from "node:fs/promises";
+import { resolve as resolve23 } from "node:path";
 import {
   buildClientSchema as buildClientSchema2,
   buildSchema as buildSchema2,
@@ -26649,8 +27083,8 @@ function schemaFromSource(source, path = "schema.graphql") {
   return buildSchema2(source);
 }
 async function readGraphqlSchema(path) {
-  const absolute = resolve22(path);
-  const source = await readFile12(absolute, "utf8");
+  const absolute = resolve23(path);
+  const source = await readFile13(absolute, "utf8");
   const hashes = graphqlSchemaHashes(source);
   return { path: absolute, source, schema: schemaFromSource(source, absolute), ...hashes };
 }
@@ -26911,6 +27345,7 @@ Usage:
   supacloud-compiler graph   [rootDir] [options]
   supacloud-compiler explain <name> [rootDir] [options]
   supacloud-compiler context <name> [rootDir] [options]
+  supacloud-compiler preview-fix --production <dir> --preview <dir> --preview-id <uuid> --project-ref <ref> --application-id <id> --environment-id <id> --property transaction|idempotency --value required|none [--json]
   supacloud-compiler dev-context [rootDir] [options]
   supacloud-compiler environment-bindings [rootDir] [options]
   supacloud-compiler release-evidence --delivery-manifest <file> --delivery-target <name> [--json]
@@ -26936,6 +27371,7 @@ Commands:
   graph               Print the discovered application graph
   explain             Explain a module, provider, or external token
   context             Extract an AI-sized module context pack
+  preview-fix         Edit, compile, invoke, and record a timeline inside one isolated preview. Does not deploy or write production.
   dev-context         Print the read-only application development context for tooling/console/MCP consumers
   environment-bindings Resolve static per-environment resource bindings without credentials
   release-evidence    Summarize one immutable target without loading project configuration
@@ -27009,11 +27445,11 @@ async function runGraphqlGovernanceCommand(args) {
     if (!schemaPath || documentPaths.length === 0)
       throw new Error("graphql compatibility requires --schema and at least one --documents");
     const schema = await readGraphqlSchema(schemaPath);
-    const documents = await Promise.all(documentPaths.map(async (path) => ({ path, source: await readFile15(resolve26(path), "utf8") })));
+    const documents = await Promise.all(documentPaths.map(async (path) => ({ path, source: await readFile16(resolve27(path), "utf8") })));
     let policy = {};
     const policyPath = one("--policy");
     if (policyPath)
-      policy = JSON.parse(await readFile15(resolve26(policyPath), "utf8"));
+      policy = JSON.parse(await readFile16(resolve27(policyPath), "utf8"));
     const report = checkGraphqlCompatibility(schema.schema, documents, policy);
     const result = {
       ok: report.ok,
@@ -27049,7 +27485,7 @@ async function runGraphqlGovernanceCommand(args) {
         throw new Error("--role must use name=schema");
       const role = value.slice(0, separator);
       const path = value.slice(separator + 1);
-      return { role, path, source: await readFile15(resolve26(path), "utf8") };
+      return { role, path, source: await readFile16(resolve27(path), "utf8") };
     }));
     const result = createRoleSnapshotReport(roles);
     console.log(JSON.stringify(result, null, 2));
@@ -27068,6 +27504,10 @@ async function run() {
   const command = args[0];
   if (await runGraphqlGovernanceCommand(args))
     return;
+  if (command === "preview-fix") {
+    await runPreviewFixCommand(args.slice(1));
+    return;
+  }
   if (command === "release-evidence") {
     await Promise.resolve().then(() => init_release_evidence_cli());
     await runReleaseEvidenceCommand(args.slice(1));
@@ -27319,7 +27759,7 @@ async function run() {
       throw new Error("Build context requires a manifest, target, subject, events, request ID and --json");
     }
     try {
-      const pack = await createDeliveryExecutionContextPack(contextManifest, contextTarget, query, await readExecutionMetadata(resolve26(executionEventsPath)), executionRequestId);
+      const pack = await createDeliveryExecutionContextPack(contextManifest, contextTarget, query, await readExecutionMetadata(resolve27(executionEventsPath)), executionRequestId);
       console.log(JSON.stringify(pack, null, 2));
     } catch (error) {
       console.log(JSON.stringify({
@@ -27338,7 +27778,7 @@ async function run() {
     const currentPath = openApiDiffPaths[1];
     if (!basePath || !currentPath)
       throw new Error("openapi-diff requires two JSON file paths");
-    const result = diffOpenApiDocuments(await readOpenApiJson(resolve26(process.cwd(), basePath)), await readOpenApiJson(resolve26(process.cwd(), currentPath)));
+    const result = diffOpenApiDocuments(await readOpenApiJson(resolve27(process.cwd(), basePath)), await readOpenApiJson(resolve27(process.cwd(), currentPath)));
     console.log(json ? JSON.stringify(result, null, 2) : formatOpenApiDiff(result));
     if (!result.ok)
       process.exitCode = 1;
@@ -27353,8 +27793,8 @@ async function run() {
     if (!modulePath || !outputPath)
       throw new Error("openapi-export requires an OpenAPI module and output path");
     const result = await exportGeneratedOpenApiJson({
-      modulePath: resolve26(process.cwd(), modulePath),
-      outputPath: resolve26(process.cwd(), outputPath),
+      modulePath: resolve27(process.cwd(), modulePath),
+      outputPath: resolve27(process.cwd(), outputPath),
       ...openApiExportSpace === undefined ? {} : { space: openApiExportSpace }
     });
     console.log(json ? JSON.stringify({ ok: true, ...result }, null, 2) : result.written ? `OpenAPI JSON written: ${result.path}` : `OpenAPI JSON matches: ${result.path}`);
@@ -27362,7 +27802,7 @@ async function run() {
   }
   if (command === "migrate") {
     const result = await migrateProject({
-      rootDir: rootDir ? resolve26(process.cwd(), rootDir) : process.cwd(),
+      rootDir: rootDir ? resolve27(process.cwd(), rootDir) : process.cwd(),
       write: !dryRun,
       ...fromVersion === undefined ? {} : { fromVersion },
       ...toVersion === undefined ? {} : { toVersion }
@@ -27400,8 +27840,8 @@ async function run() {
   if (checkSchema && command !== "graphql-schema")
     throw new Error("--check is only supported by graphql-schema");
   const defaults = resolveSupacloudConfig(loadedConfig, process.cwd());
-  const resolvedRoot = rootDir ? resolve26(process.cwd(), rootDir) : defaults.rootDir;
-  const resolvedOut = outDir ? resolve26(process.cwd(), outDir) : defaults.outDir;
+  const resolvedRoot = rootDir ? resolve27(process.cwd(), rootDir) : defaults.rootDir;
+  const resolvedOut = outDir ? resolve27(process.cwd(), outDir) : defaults.outDir;
   const configured = compileOptionsFromConfig({
     ...loadedConfig,
     root: resolvedRoot,
@@ -27420,7 +27860,7 @@ async function run() {
     let delivery = loadedConfig.delivery;
     if (deliveryPath !== undefined) {
       try {
-        delivery = JSON.parse(await readFile15(resolve26(process.cwd(), deliveryPath), "utf8"));
+        delivery = JSON.parse(await readFile16(resolve27(process.cwd(), deliveryPath), "utf8"));
       } catch {
         throw new DeliveryConfigurationError;
       }
@@ -27478,7 +27918,7 @@ ${item.suggestion ?? ""}`).join(`
   } else if (command === "fix") {
     if (!query)
       throw new Error("fix requires a JSON file containing one DiagnosticFix");
-    const input = JSON.parse(await readFile15(resolve26(process.cwd(), query), "utf8"));
+    const input = JSON.parse(await readFile16(resolve27(process.cwd(), query), "utf8"));
     const envelope = input && typeof input === "object" && "fix" in input;
     if (envelope && (typeof input.expectedSourceHash !== "string" || !/^[a-f0-9]{64}$/.test(input.expectedSourceHash))) {
       throw new Error("Editor fix requires the source hash from its validated preview");
@@ -27619,7 +28059,7 @@ Source change detected; compiling...`);
       process.exitCode = 1;
       return;
     }
-    const file = resolve26(rootDir ? resolve26(process.cwd(), rootDir) : process.cwd(), bindingsFile ?? "supacloud.environments.json");
+    const file = resolve27(rootDir ? resolve27(process.cwd(), rootDir) : process.cwd(), bindingsFile ?? "supacloud.environments.json");
     try {
       const document = await readEnvironmentBindingsFile(file);
       const graph = await analyzeProject(resolvedRoot);
@@ -27654,7 +28094,7 @@ Source change detected; compiling...`);
     try {
       const result = await checkProject(compileDefaults);
       if (executionEventsPath && executionRequestId) {
-        const pack = createExecutionContextPack({ ...result.graph, diagnostics: result.diagnostics }, query, await readExecutionMetadata(resolve26(process.cwd(), executionEventsPath)), executionRequestId);
+        const pack = createExecutionContextPack({ ...result.graph, diagnostics: result.diagnostics }, query, await readExecutionMetadata(resolve27(process.cwd(), executionEventsPath)), executionRequestId);
         console.log(JSON.stringify(pack, null, 2));
         return;
       }