@supacloud/compiler 0.53.1 → 0.55.0

package/README.md

@@ -3,22 +3,25 @@
 ## Enforced Database Governance
 
 Existing compiler callers retain `off` as a compatibility migration exception.
-Newly generated `command` starters set
-`databaseGovernance: { mode: "enforce", moduleFile: "db/modules.ts" }`:
-compile/check/build run the existing `@supacloud/db` source-boundary and
-contract-freshness gate, SQL lint and live Catalog reconciliation, including
+Newly generated `command` starters keep `databaseGovernance: { mode: "check",
+moduleFile: "db/modules.ts" }` for ordinary compile/check/build. `check` runs
+the existing `@supacloud/db` source-boundary and contract-freshness gate plus SQL
+lint, without importing project modules or opening a database connection. The
+generated integration dev profile switches the same configuration to `enforce`
+and supplies a loopback database URL explicitly.
+
+`enforce` adds live Catalog reconciliation on top of `check`, including on
 incremental cache hits. Missing adoption files, stale contracts, SQL findings or
 Catalog drift block generation even with `writeOnError`; checks never generate
-contracts or migrations.
-The minimal/http/edge starters remain database-free.
+contracts or migrations. The minimal/http/edge starters remain database-free.
 
 For an existing database project, adopt the governed path by declaring the real
-database modules and explicitly setting the following in `supacloud.config.ts`:
+database modules and setting the following in `supacloud.config.ts`:
 
 ```ts
 export default {
   databaseGovernance: {
-    mode: "enforce",
+    mode: "check",
     projectRoot: ".",
     moduleFile: "db/modules.ts",
     databaseUrlEnv: "SUPACLOUD_CHECK_DATABASE_URL",
@@ -27,11 +30,17 @@ export default {
 };
 ```
 
+Keep `check` in committed project configuration so local builds and CI remain
+hermetic. Run `enforce` only in an explicit release/deployment gate where the
+platform injects a read-only PostgreSQL connection, or run the separate
+`supacloud db module_check` command through the same controlled environment.
+Application code and committed configuration must not contain a production
+connection URL.
+
 `projectRoot` is relative to the configuration directory (or `rootDir` when
-calling `compileProject` / `checkProject` directly). Use a read-only PostgreSQL
-credential in the named environment variable, targeting an explicitly selected
-local or test database. The compiler does not load `.env` files for this worker,
-generate migrations, repair contracts, or apply SQL. Setting `mode: "off"` is
+calling `compileProject` / `checkProject` directly). The compiler does not load
+`.env` files for this worker, generate migrations, repair contracts, or apply
+SQL. Never use a migration/owner role for this check. Setting `mode: "off"` is
 reserved for an explicit migration exception and should not be used in a new
 database starter.
 
@@ -76,6 +85,11 @@ attempts. The default policy requires `requireRouteEffects`,
 
 ## Unified Database Contracts
 
+Database contracts are protocol-aware: configure only the database sources the
+application uses (`postgrestTypes`, `drizzleSchema`, or `graphql`). The generated
+`database.manifest.json` is a TypeBox-validated, fingerprinted build boundary;
+consumers must reject it when its schema or migration fingerprint is stale.
+
 `supacloud-compiler database-contracts database-contracts.json` generates a shared
 type entry point while preserving PostgREST, Drizzle and GraphQL native types:
 

package/dist/cli.js

@@ -1475,6 +1475,9 @@ var init_validate = __esm(() => {
     "effect-direct-runtime-execution": { code: "SC3045", docsUrl: "https://supacloud.dev/errors/SC3045" },
     "effect-direct-throw": { code: "SC3046", docsUrl: "https://supacloud.dev/errors/SC3046" },
     "effect-promise-return": { code: "SC3047", docsUrl: "https://supacloud.dev/errors/SC3047" },
+    "effect-retry-target-required": { code: "SC3048", docsUrl: "https://supacloud.dev/errors/SC3048" },
+    "effect-retryable-invalid": { code: "SC3049", docsUrl: "https://supacloud.dev/errors/SC3049" },
+    "effect-retry-required": { code: "SC3050", docsUrl: "https://supacloud.dev/errors/SC3050" },
     "invalid-route-response-map": { code: "SC3024", docsUrl: "https://supacloud.dev/errors/SC3024" },
     "invalid-route-response-selector": { code: "SC3025", docsUrl: "https://supacloud.dev/errors/SC3025" },
     "conflicting-route-response-schema": { code: "SC3026", docsUrl: "https://supacloud.dev/errors/SC3026" },
@@ -18184,6 +18187,27 @@ var init_release_evidence_cli = __esm(() => {
   init_release_evidence();
 });
 
+// src/database-contract-manifest.ts
+function parseDatabaseContractManifest(value) {
+  if (!Check2(databaseContractManifestSchema, value)) {
+    throw new TypeError("Invalid database contract manifest");
+  }
+  return value;
+}
+var databaseContractManifestSchema;
+var init_database_contract_manifest = __esm(() => {
+  init_build();
+  init_value2();
+  databaseContractManifestSchema = _Object_({
+    version: Literal(1),
+    role: String2({ minLength: 1 }),
+    fingerprint: String2({ pattern: "^[a-f0-9]{64}$" }),
+    inputs: Record(String2({ minLength: 1 }), String2({ pattern: "^[a-f0-9]{64}$" })),
+    migrationOrder: _Array_(String2({ minLength: 1 })),
+    outputs: Record(String2({ minLength: 1 }), String2({ pattern: "^[a-f0-9]{64}$" }))
+  });
+});
+
 // src/database-contracts.ts
 import { createHash as createHash13 } from "node:crypto";
 import { mkdir as mkdir5, readFile as readFile14 } from "node:fs/promises";
@@ -18208,8 +18232,23 @@ function parseDatabaseContractsOptions(value, directory) {
       throw new TypeError(`Missing database contracts ${name}`);
     return result;
   };
-  const graphql = Reflect.get(value, "graphql");
-  assertGraphqlOptions(graphql);
+  const optionalPath = (name) => {
+    if (!Object.hasOwn(value, name))
+      return;
+    return field(name);
+  };
+  const postgrestTypes = optionalPath("postgrestTypes");
+  const drizzleSchema = optionalPath("drizzleSchema");
+  const graphqlPresent = Object.hasOwn(value, "graphql");
+  if (!postgrestTypes && !drizzleSchema && !graphqlPresent) {
+    throw new TypeError("Database contracts require postgrestTypes, drizzleSchema, or graphql");
+  }
+  let graphql;
+  if (graphqlPresent) {
+    const candidate = Reflect.get(value, "graphql");
+    assertGraphqlOptions(candidate);
+    graphql = { ...candidate, schema: resolve25(directory, candidate.schema) };
+  }
   const migrations = Reflect.get(value, "migrations");
   if (!Array.isArray(migrations) || !migrations.every((entry) => typeof entry === "string" && entry.endsWith(".sql"))) {
     throw new TypeError("migrations must be an ordered list of SQL files");
@@ -18217,22 +18256,20 @@ function parseDatabaseContractsOptions(value, directory) {
   return {
     rootDir: resolve25(directory, field("rootDir")),
     outDir: resolve25(directory, field("outDir")),
-    postgrestTypes: resolve25(directory, field("postgrestTypes")),
-    drizzleSchema: resolve25(directory, field("drizzleSchema")),
+    ...postgrestTypes ? { postgrestTypes: resolve25(directory, postgrestTypes) } : {},
+    ...drizzleSchema ? { drizzleSchema: resolve25(directory, drizzleSchema) } : {},
     role: field("role"),
-    graphql: { ...graphql, schema: resolve25(directory, graphql.schema) },
+    ...graphql ? { graphql } : {},
     migrations: migrations.map((file) => resolve25(directory, file))
   };
 }
-async function generateDatabaseContracts(options, check = false) {
-  const rootDir = resolve25(options.rootDir), outDir = resolve25(options.outDir);
-  const postgrestTypes = resolve25(rootDir, options.postgrestTypes), drizzleSchema = resolve25(rootDir, options.drizzleSchema);
-  const snapshot = await readFile14(postgrestTypes, "utf8");
-  const syntax = ts18.createSourceFile(postgrestTypes, snapshot, ts18.ScriptTarget.Latest, true);
+async function assertPostgrestSnapshot(path) {
+  const snapshot = await readFile14(path, "utf8");
+  const syntax = ts18.createSourceFile(path, snapshot, ts18.ScriptTarget.Latest, true);
   const database = syntax.statements.find((node) => (ts18.isTypeAliasDeclaration(node) || ts18.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts18.SyntaxKind.ExportKeyword));
   if (!database)
     throw new Error("PostgREST snapshot must export Database from the official type generator");
-  const program = ts18.createProgram([postgrestTypes], {
+  const program = ts18.createProgram([path], {
     strict: true,
     noEmit: true,
     skipLibCheck: true,
@@ -18243,11 +18280,17 @@ async function generateDatabaseContracts(options, check = false) {
   });
   if (ts18.getPreEmitDiagnostics(program).length)
     throw new Error("PostgREST snapshot has TypeScript errors");
-  const artifacts = await renderGraphql({
-    rootDir,
-    outDir,
-    graphql: options.graphql
-  });
+}
+async function generateDatabaseContracts(options, check = false) {
+  const rootDir = resolve25(options.rootDir), outDir = resolve25(options.outDir);
+  const postgrestTypes = options.postgrestTypes ? resolve25(rootDir, options.postgrestTypes) : undefined;
+  const drizzleSchema = options.drizzleSchema ? resolve25(rootDir, options.drizzleSchema) : undefined;
+  if (!postgrestTypes && !drizzleSchema && !options.graphql) {
+    throw new TypeError("Database contracts require postgrestTypes, drizzleSchema, or graphql");
+  }
+  if (postgrestTypes)
+    await assertPostgrestSnapshot(postgrestTypes);
+  const artifacts = options.graphql ? await renderGraphql({ rootDir, outDir, graphql: options.graphql }) : { diagnostics: [], files: {} };
   if (artifacts.diagnostics.some((item) => item.severity === "error")) {
     throw new Error(artifacts.diagnostics.map((item) => item.message).join(`
 `));
@@ -18257,38 +18300,42 @@ async function generateDatabaseContracts(options, check = false) {
     const absolute = resolve25(rootDir, path);
     inputs[relative13(rootDir, absolute).replaceAll("\\", "/")] = hash4(await readFile14(absolute, "utf8"));
   };
-  await addInput(postgrestTypes);
-  await addInput(drizzleSchema);
-  const drizzleProgram = ts18.createProgram([drizzleSchema], {
-    noEmit: true,
-    moduleResolution: ts18.ModuleResolutionKind.Bundler,
-    module: ts18.ModuleKind.ESNext,
-    target: ts18.ScriptTarget.ES2022,
-    types: [],
-    skipLibCheck: true
-  });
-  for (const source of drizzleProgram.getSourceFiles()) {
-    if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
-      await addInput(source.fileName);
+  if (postgrestTypes)
+    await addInput(postgrestTypes);
+  if (drizzleSchema) {
+    await addInput(drizzleSchema);
+    const drizzleProgram = ts18.createProgram([drizzleSchema], {
+      noEmit: true,
+      moduleResolution: ts18.ModuleResolutionKind.Bundler,
+      module: ts18.ModuleKind.ESNext,
+      target: ts18.ScriptTarget.ES2022,
+      types: [],
+      skipLibCheck: true
+    });
+    for (const source of drizzleProgram.getSourceFiles()) {
+      if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
+        await addInput(source.fileName);
+    }
   }
-  await addInput(resolve25(rootDir, options.graphql.schema));
+  if (options.graphql)
+    await addInput(resolve25(rootDir, options.graphql.schema));
   if (new Set(options.migrations.map((path) => resolve25(rootDir, path))).size !== options.migrations.length) {
     throw new Error("Duplicate migration in database contracts configuration");
   }
   for (const path of options.migrations)
     await addInput(path);
-  const files = {
-    ...artifacts.files,
-    "database.ts": [
-      "// GENERATED BY @supacloud/compiler database-contracts. Do not edit.",
-      `export type { Database } from ${JSON.stringify(importPath(outDir, postgrestTypes))};`,
-      'export type { QueryData, QueryResult, QueryError } from "@supabase/supabase-js";',
-      `export type DrizzleSchema = typeof import(${JSON.stringify(importPath(outDir, drizzleSchema))});`,
-      'export * from "./graphql";',
-      ""
-    ].join(`
-`)
-  };
+  const barrel = ["// GENERATED BY @supacloud/compiler database-contracts. Do not edit."];
+  if (postgrestTypes) {
+    barrel.push(`export type { Database } from ${JSON.stringify(importPath(outDir, postgrestTypes))};`);
+    barrel.push('export type { QueryData, QueryResult, QueryError } from "@supabase/supabase-js";');
+  }
+  if (drizzleSchema)
+    barrel.push(`export type DrizzleSchema = typeof import(${JSON.stringify(importPath(outDir, drizzleSchema))});`);
+  if (options.graphql)
+    barrel.push('export * from "./graphql";');
+  barrel.push("");
+  const files = { ...artifacts.files, "database.ts": barrel.join(`
+`) };
   const manifest = {
     version: 1,
     role: options.role,
@@ -18296,7 +18343,12 @@ async function generateDatabaseContracts(options, check = false) {
     migrationOrder: options.migrations.map((path) => relative13(rootDir, resolve25(rootDir, path)).replaceAll("\\", "/")),
     outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash4(text)]))
   };
-  files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
+  const fingerprint = hash4(JSON.stringify({
+    inputs: manifest.inputs,
+    migrationOrder: manifest.migrationOrder
+  }));
+  const typedManifest = parseDatabaseContractManifest({ ...manifest, fingerprint });
+  files["database.manifest.json"] = JSON.stringify(typedManifest, null, 2) + `
 `;
   const mismatches = [];
   for (const [file, content] of Object.entries(files)) {
@@ -18316,7 +18368,7 @@ async function generateDatabaseContracts(options, check = false) {
     for (const [file, content] of Object.entries(files))
       await writeFileIfChanged(resolve25(outDir, file), content);
   }
-  return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
+  return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest: typedManifest };
 }
 async function runDatabaseContractsFile(path, check = false) {
   const absolute = resolve25(path);
@@ -18327,6 +18379,7 @@ var init_database_contracts = __esm(() => {
   init_graphql();
   init_generate();
   init_graphql_options();
+  init_database_contract_manifest();
 });
 
 // src/graphql-schema.ts
@@ -19105,7 +19158,8 @@ var DEFAULT_EFFECT_ANALYSIS_OPTIONS = {
   requireExactDependencyTypes: true,
   requireTimeoutForDependencies: true,
   forbidDirectRuntimeExecution: true,
-  forbidDirectThrows: true
+  forbidDirectThrows: true,
+  requireRetryPolicy: true
 };
 function nodeText(node) {
   return node.getText(node.getSourceFile());
@@ -19178,7 +19232,8 @@ async function analyzeProject(rootDir, include, cache, changedPaths, effectOptio
       requireExactDependencyTypes: effectOptions.requireExactDependencyTypes ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireExactDependencyTypes,
       requireTimeoutForDependencies: effectOptions.requireTimeoutForDependencies ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireTimeoutForDependencies,
       forbidDirectRuntimeExecution: effectOptions.forbidDirectRuntimeExecution ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectRuntimeExecution,
-      forbidDirectThrows: effectOptions.forbidDirectThrows ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectThrows
+      forbidDirectThrows: effectOptions.forbidDirectThrows ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectThrows,
+      requireRetryPolicy: effectOptions.requireRetryPolicy ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireRetryPolicy
     }
   };
   if (ctx.effectOptions.forbidDirectRuntimeExecution) {
@@ -20001,6 +20056,21 @@ function resolveStaticObjectLiteral(input, ctx, seen = new Set) {
   }
   return ts7.isObjectLiteralExpression(input) ? input : undefined;
 }
+function resolveStaticArrayLiteral(input, ctx, seen = new Set) {
+  if (!input || seen.has(input))
+    return;
+  seen.add(input);
+  if (ts7.isAsExpression(input) || ts7.isSatisfiesExpression(input) || ts7.isParenthesizedExpression(input)) {
+    return resolveStaticArrayLiteral(input.expression, ctx, seen);
+  }
+  if (ts7.isIdentifier(input)) {
+    const declaration = resolveDeclaration(input, ctx).find(ts7.isVariableDeclaration);
+    const list = declaration?.parent;
+    const isConst = Boolean(list && ts7.isVariableDeclarationList(list) && (list.flags & ts7.NodeFlags.Const) !== 0);
+    return isConst && declaration?.initializer ? resolveStaticArrayLiteral(declaration.initializer, ctx, seen) : undefined;
+  }
+  return ts7.isArrayLiteralExpression(input) ? input : undefined;
+}
 function routePolicyProperty(object, name, ctx, seen = new Set) {
   if (seen.has(object))
     return { unresolved: true };
@@ -20961,7 +21031,7 @@ function parseController(input, ctx) {
               file,
               line: lineOf(effectExpr),
               message: `Route ${route.handler} effect must be a statically resolvable object literal.`,
-              suggestion: "Use effect: { required: true, errors: [...], dependencies: [...] }."
+              suggestion: 'Use effect: { required: true, errors: [...], dependencies: [...], retry: "none" }.'
             });
           } else {
             const effect = { required: true };
@@ -20992,6 +21062,8 @@ function parseController(input, ctx) {
               } else {
                 effect.retry = retry;
               }
+            } else if (ctx.effectOptions.requireRetryPolicy === false) {
+              effect.retry = "none";
             }
             const maxAttemptsExpr = getProp(effectObject, "maxAttempts");
             if (maxAttemptsExpr !== undefined) {
@@ -21040,7 +21112,8 @@ function parseController(input, ctx) {
             }
             const dependenciesExpr = getProp(effectObject, "dependencies");
             if (dependenciesExpr !== undefined) {
-              if (!ts7.isArrayLiteralExpression(dependenciesExpr) || dependenciesExpr.elements.some((element) => !ts7.isStringLiteral(element) || element.text.trim().length === 0)) {
+              const dependenciesArray = resolveStaticArrayLiteral(dependenciesExpr, ctx);
+              if (!dependenciesArray || dependenciesArray.elements.some((element) => !ts7.isStringLiteral(element) || element.text.trim().length === 0)) {
                 ctx.diagnostics.push({
                   severity: "error",
                   code: "invalid-effect-dependencies",
@@ -21048,10 +21121,10 @@ function parseController(input, ctx) {
                   docsUrl: "https://supacloud.dev/errors/SC3033",
                   file,
                   line: lineOf(dependenciesExpr),
-                  message: `Route ${route.handler} effect.dependencies must be an explicit string array.`
+                  message: `Route ${route.handler} effect.dependencies must be a string array or a const initialized with one.`
                 });
               } else {
-                effect.dependencies = dependenciesExpr.elements.map((element) => element.text);
+                effect.dependencies = dependenciesArray.elements.map((element) => element.text);
                 if (new Set(effect.dependencies).size !== effect.dependencies.length) {
                   ctx.diagnostics.push({
                     severity: "error",
@@ -21068,7 +21141,8 @@ function parseController(input, ctx) {
             }
             const errorsExpr = getProp(effectObject, "errors");
             if (errorsExpr !== undefined) {
-              if (!ts7.isArrayLiteralExpression(errorsExpr)) {
+              const errorsArray = resolveStaticArrayLiteral(errorsExpr, ctx);
+              if (!errorsArray) {
                 ctx.diagnostics.push({
                   severity: "error",
                   code: "invalid-effect-errors",
@@ -21076,11 +21150,11 @@ function parseController(input, ctx) {
                   docsUrl: "https://supacloud.dev/errors/SC3034",
                   file,
                   line: lineOf(errorsExpr),
-                  message: `Route ${route.handler} effect.errors must be an explicit object array.`
+                  message: `Route ${route.handler} effect.errors must be an object array or a const initialized with one.`
                 });
               } else {
                 const errors = [];
-                for (const errorExpr of errorsExpr.elements) {
+                for (const errorExpr of errorsArray.elements) {
                   if (!ts7.isObjectLiteralExpression(errorExpr)) {
                     ctx.diagnostics.push({
                       severity: "error",
@@ -21097,6 +21171,23 @@ function parseController(input, ctx) {
                   const code = stringLiteralProp(errorExpr, "code");
                   const status = numberLiteralProp(errorExpr, "status");
                   const message = stringLiteralProp(errorExpr, "message");
+                  const codeFromError = booleanLiteralProp(errorExpr, "codeFromError");
+                  const messageFromError = booleanLiteralProp(errorExpr, "messageFromError");
+                  const statusFromError = booleanLiteralProp(errorExpr, "statusFromError");
+                  const retryable = booleanLiteralProp(errorExpr, "retryable");
+                  const outcomeUnknown = booleanLiteralProp(errorExpr, "outcomeUnknown");
+                  if (invalidBooleanProp(errorExpr, "codeFromError") || invalidBooleanProp(errorExpr, "messageFromError") || invalidBooleanProp(errorExpr, "statusFromError") || invalidBooleanProp(errorExpr, "retryable") || invalidBooleanProp(errorExpr, "outcomeUnknown")) {
+                    ctx.diagnostics.push({
+                      severity: "error",
+                      code: "invalid-effect-errors",
+                      errorCode: "SC3034",
+                      docsUrl: "https://supacloud.dev/errors/SC3034",
+                      file,
+                      line: lineOf(errorExpr),
+                      message: `Route ${route.handler} effect.errors instance flags must be boolean literals.`
+                    });
+                    continue;
+                  }
                   if (!tag || !code || status === undefined || !Number.isInteger(status) || status < 400 || status > 599) {
                     ctx.diagnostics.push({
                       severity: "error",
@@ -21109,7 +21200,17 @@ function parseController(input, ctx) {
                     });
                     continue;
                   }
-                  errors.push({ tag, code, status, ...message === undefined ? {} : { message } });
+                  errors.push({
+                    tag,
+                    code,
+                    status,
+                    ...message === undefined ? {} : { message },
+                    ...codeFromError === undefined ? {} : { codeFromError },
+                    ...messageFromError === undefined ? {} : { messageFromError },
+                    ...statusFromError === undefined ? {} : { statusFromError },
+                    ...retryable === undefined ? {} : { retryable },
+                    ...outcomeUnknown === undefined ? {} : { outcomeUnknown }
+                  });
                 }
                 effect.errors = errors;
                 if (new Set(errors.map((entry) => entry.tag)).size !== errors.length) {
@@ -21837,6 +21938,19 @@ function numberLiteralProp(obj, name) {
   const value = Number(expr.text);
   return Number.isFinite(value) ? value : undefined;
 }
+function booleanLiteralProp(obj, name) {
+  const expr = getProp(obj, name);
+  if (!expr || !isBooleanLiteral(expr))
+    return;
+  return expr.kind === ts7.SyntaxKind.TrueKeyword;
+}
+function isBooleanLiteral(expr) {
+  return expr.kind === ts7.SyntaxKind.TrueKeyword || expr.kind === ts7.SyntaxKind.FalseKeyword;
+}
+function invalidBooleanProp(obj, name) {
+  const expr = getProp(obj, name);
+  return expr !== undefined && !isBooleanLiteral(expr);
+}
 function arrayProp(obj, name) {
   const expr = getProp(obj, name);
   return expr && ts7.isArrayLiteralExpression(expr) ? [...expr.elements] : [];
@@ -22777,6 +22891,9 @@ function validateEffectPolicies(graph, options = {}) {
         if (options.requireDependencies && effect.dependencies === undefined) {
           diagnostics.push(diagnostic("effect-dependencies-required", `Route ${label} declares an Effect contract without dependencies.`, controller.file, "Declare the logical services required by the Effect environment."));
         }
+        if (effect.retry === undefined && options.requireRetryPolicy !== false) {
+          diagnostics.push(diagnostic("effect-retry-required", `Route ${label} declares an Effect contract but does not declare retry.`, controller.file, 'Set effect.retry to "none". That is the required default; use "explicit" only with maxAttempts and a retryable 5xx allow-list.'));
+        }
         if (effect.retry === "explicit" && effect.maxAttempts === undefined) {
           diagnostics.push(diagnostic("invalid-effect-retry", `Route ${label} enables explicit Effect retry without maxAttempts.`, controller.file, "Declare a positive maxAttempts value including the initial attempt."));
         }
@@ -22787,6 +22904,18 @@ function validateEffectPolicies(graph, options = {}) {
           if (command && command.idempotency !== "required") {
             diagnostics.push(diagnostic("effect-command-retry-forbidden", `Route ${label} enables explicit Effect retry for non-idempotent command "${command.name}".`, controller.file, 'Set command idempotency to "required" or use effect.retry: "none".'));
           }
+          const retryable = (effect.errors ?? []).filter((entry) => entry.retryable === true);
+          if (retryable.length === 0) {
+            diagnostics.push(diagnostic("effect-retry-target-required", `Route ${label} enables explicit Effect retry without a transient failure allow-list.`, controller.file, 'Mark only 5xx failures that did not commit with retryable: true, or use effect.retry: "none".'));
+          }
+        }
+        for (const entry of effect.errors ?? []) {
+          if (entry.retryable !== true)
+            continue;
+          const transient = effect.retry === "explicit" && entry.outcomeUnknown !== true && entry.statusFromError !== true && entry.status >= 500 && entry.status <= 599;
+          if (!transient) {
+            diagnostics.push(diagnostic("effect-retryable-invalid", `Route ${label} marks "${entry.tag}" retryable, but in-process retry is only for declared 5xx failures that are not outcome-unknown.`, controller.file, 'Remove retryable, or keep it on a 5xx mapping with retry: "explicit" and without outcomeUnknown or statusFromError.'));
+          }
         }
       }
     }
@@ -23787,7 +23916,9 @@ var DEFAULT_SUPACLOUD_CONFIG = {
     requireExactDependencyTypes: true,
     requireTimeoutForDependencies: true,
     forbidDirectRuntimeExecution: true,
-    forbidDirectThrows: true
+    forbidDirectThrows: true,
+    requireRetryPolicy: true,
+    defaultRetry: "none"
   }
 };
 function defineSupacloudConfig(config = {}) {
@@ -23869,7 +24000,9 @@ function validateGovernanceConfig(config) {
       "requireExactDependencyTypes",
       "requireTimeoutForDependencies",
       "forbidDirectRuntimeExecution",
-      "forbidDirectThrows"
+      "forbidDirectThrows",
+      "requireRetryPolicy",
+      "defaultRetry"
     ].includes(key))) {
       throw new Error("effect contains an unsupported governance option.");
     }
@@ -23881,12 +24014,16 @@ function validateGovernanceConfig(config) {
       "requireExactDependencyTypes",
       "requireTimeoutForDependencies",
       "forbidDirectRuntimeExecution",
-      "forbidDirectThrows"
+      "forbidDirectThrows",
+      "requireRetryPolicy"
     ]) {
       if (config.effect[key] !== undefined && typeof config.effect[key] !== "boolean") {
         throw new Error(`effect.${key} must be boolean.`);
       }
     }
+    if (config.effect["defaultRetry"] !== undefined && config.effect["defaultRetry"] !== "none") {
+      throw new Error('effect.defaultRetry must be "none". explicit can only be written on a route, with maxAttempts and a retryable 5xx allow-list.');
+    }
   }
 }
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
@@ -25731,10 +25868,10 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve19 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.35.0";
+var MIGRATION_APP_VERSION = "0.36.0";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.37.0";
+var MIGRATION_ELYSIA_VERSION = "0.38.1";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;
@@ -25753,7 +25890,7 @@ function migrationDependencies() {
     "@supacloud/app": MIGRATION_APP_VERSION,
     "@supacloud/compiler": compilerVersion(),
     "@supacloud/elysia": MIGRATION_ELYSIA_VERSION,
-    elysia: "2.0.0-rc.0",
+    elysia: "2.0.0-rc.1",
     typescript: "7.0.2"
   };
 }

package/dist/database-contract-manifest.d.ts

@@ -0,0 +1,9 @@
+export interface DatabaseContractManifest {
+    readonly version: 1;
+    readonly role: string;
+    readonly fingerprint: string;
+    readonly inputs: Readonly<Record<string, string>>;
+    readonly migrationOrder: readonly string[];
+    readonly outputs: Readonly<Record<string, string>>;
+}
+export declare function parseDatabaseContractManifest(value: unknown): DatabaseContractManifest;

package/dist/database-contracts.d.ts

@@ -1,14 +1,16 @@
+import { type DatabaseContractManifest } from "./database-contract-manifest";
 import type { GraphqlOptions } from "./types";
 export interface DatabaseContractsOptions {
     rootDir: string;
     outDir: string;
-    /** Generated by the official Supabase/Postgres Meta exporter, not a handwritten table map. */
-    postgrestTypes: string;
-    /** Source module defining Drizzle tables; imported as types, never executed by this generator. */
-    drizzleSchema: string;
+    /** Official PostgREST snapshot. Omit when the project does not use PostgREST. */
+    postgrestTypes?: string;
+    /** Drizzle query-builder module. Omit when the project does not use Drizzle. */
+    drizzleSchema?: string;
     /** Explicit identity/role label for reviewing snapshot provenance. Not an authorization proof. */
     role: string;
-    graphql: GraphqlOptions;
+    /** Role-scoped pg_graphql snapshot exported by graphql-schema. Omit when GraphQL is unused. */
+    graphql?: GraphqlOptions;
     /** Ordered complete migration history. */
     migrations: readonly string[];
 }
@@ -18,31 +20,11 @@ export declare function generateDatabaseContracts(options: DatabaseContractsOpti
     upToDate: boolean;
     mismatches: string[];
     written: string[];
-    manifest: {
-        version: number;
-        role: string;
-        inputs: {
-            [k: string]: string;
-        };
-        migrationOrder: string[];
-        outputs: {
-            [k: string]: string;
-        };
-    };
+    manifest: DatabaseContractManifest;
 }>;
 export declare function runDatabaseContractsFile(path: string, check?: boolean): Promise<{
     upToDate: boolean;
     mismatches: string[];
     written: string[];
-    manifest: {
-        version: number;
-        role: string;
-        inputs: {
-            [k: string]: string;
-        };
-        migrationOrder: string[];
-        outputs: {
-            [k: string]: string;
-        };
-    };
+    manifest: DatabaseContractManifest;
 }>;

package/dist/index.d.ts

@@ -60,3 +60,5 @@ export type { PullGraphqlSchemaOptions } from "./graphql-schema";
 export { checkGraphqlCompatibility, createRoleSnapshotReport, diffGraphqlSchemas, graphqlFeatureMatrix, introspectionQuery, readGraphqlSchema, schemaFromSource, } from "./graphql-governance";
 export type { GraphqlCompatibilityReport, GraphqlFeatureMatrix, GraphqlGovernanceDiagnostic, GraphqlGovernancePolicy, GraphqlOperationReport, GraphqlRoleSnapshot, GraphqlRoleSnapshotReport, GraphqlSchemaChange, GraphqlSchemaDiff, } from "./graphql-governance";
 export { generateDatabaseContracts, parseDatabaseContractsOptions, runDatabaseContractsFile, type DatabaseContractsOptions } from "./database-contracts";
+export { parseDatabaseContractManifest } from "./database-contract-manifest";
+export type { DatabaseContractManifest } from "./database-contract-manifest";

package/dist/index.js

@@ -1474,6 +1474,9 @@ var init_validate = __esm(() => {
     "effect-direct-runtime-execution": { code: "SC3045", docsUrl: "https://supacloud.dev/errors/SC3045" },
     "effect-direct-throw": { code: "SC3046", docsUrl: "https://supacloud.dev/errors/SC3046" },
     "effect-promise-return": { code: "SC3047", docsUrl: "https://supacloud.dev/errors/SC3047" },
+    "effect-retry-target-required": { code: "SC3048", docsUrl: "https://supacloud.dev/errors/SC3048" },
+    "effect-retryable-invalid": { code: "SC3049", docsUrl: "https://supacloud.dev/errors/SC3049" },
+    "effect-retry-required": { code: "SC3050", docsUrl: "https://supacloud.dev/errors/SC3050" },
     "invalid-route-response-map": { code: "SC3024", docsUrl: "https://supacloud.dev/errors/SC3024" },
     "invalid-route-response-selector": { code: "SC3025", docsUrl: "https://supacloud.dev/errors/SC3025" },
     "conflicting-route-response-schema": { code: "SC3026", docsUrl: "https://supacloud.dev/errors/SC3026" },
@@ -18216,6 +18219,27 @@ var init_graphql_schema = __esm(() => {
   init_graphql_schema_hashes();
 });
 
+// src/database-contract-manifest.ts
+function parseDatabaseContractManifest(value) {
+  if (!Check2(databaseContractManifestSchema, value)) {
+    throw new TypeError("Invalid database contract manifest");
+  }
+  return value;
+}
+var databaseContractManifestSchema;
+var init_database_contract_manifest = __esm(() => {
+  init_build();
+  init_value2();
+  databaseContractManifestSchema = _Object_({
+    version: Literal(1),
+    role: String2({ minLength: 1 }),
+    fingerprint: String2({ pattern: "^[a-f0-9]{64}$" }),
+    inputs: Record(String2({ minLength: 1 }), String2({ pattern: "^[a-f0-9]{64}$" })),
+    migrationOrder: _Array_(String2({ minLength: 1 })),
+    outputs: Record(String2({ minLength: 1 }), String2({ pattern: "^[a-f0-9]{64}$" }))
+  });
+});
+
 // src/database-contracts.ts
 import { createHash as createHash12 } from "node:crypto";
 import { mkdir as mkdir6, readFile as readFile14 } from "node:fs/promises";
@@ -18240,8 +18264,23 @@ function parseDatabaseContractsOptions(value, directory) {
       throw new TypeError(`Missing database contracts ${name}`);
     return result;
   };
-  const graphql = Reflect.get(value, "graphql");
-  assertGraphqlOptions(graphql);
+  const optionalPath = (name) => {
+    if (!Object.hasOwn(value, name))
+      return;
+    return field(name);
+  };
+  const postgrestTypes = optionalPath("postgrestTypes");
+  const drizzleSchema = optionalPath("drizzleSchema");
+  const graphqlPresent = Object.hasOwn(value, "graphql");
+  if (!postgrestTypes && !drizzleSchema && !graphqlPresent) {
+    throw new TypeError("Database contracts require postgrestTypes, drizzleSchema, or graphql");
+  }
+  let graphql;
+  if (graphqlPresent) {
+    const candidate = Reflect.get(value, "graphql");
+    assertGraphqlOptions(candidate);
+    graphql = { ...candidate, schema: resolve24(directory, candidate.schema) };
+  }
   const migrations = Reflect.get(value, "migrations");
   if (!Array.isArray(migrations) || !migrations.every((entry) => typeof entry === "string" && entry.endsWith(".sql"))) {
     throw new TypeError("migrations must be an ordered list of SQL files");
@@ -18249,22 +18288,20 @@ function parseDatabaseContractsOptions(value, directory) {
   return {
     rootDir: resolve24(directory, field("rootDir")),
     outDir: resolve24(directory, field("outDir")),
-    postgrestTypes: resolve24(directory, field("postgrestTypes")),
-    drizzleSchema: resolve24(directory, field("drizzleSchema")),
+    ...postgrestTypes ? { postgrestTypes: resolve24(directory, postgrestTypes) } : {},
+    ...drizzleSchema ? { drizzleSchema: resolve24(directory, drizzleSchema) } : {},
     role: field("role"),
-    graphql: { ...graphql, schema: resolve24(directory, graphql.schema) },
+    ...graphql ? { graphql } : {},
     migrations: migrations.map((file) => resolve24(directory, file))
   };
 }
-async function generateDatabaseContracts(options, check = false) {
-  const rootDir = resolve24(options.rootDir), outDir = resolve24(options.outDir);
-  const postgrestTypes = resolve24(rootDir, options.postgrestTypes), drizzleSchema = resolve24(rootDir, options.drizzleSchema);
-  const snapshot = await readFile14(postgrestTypes, "utf8");
-  const syntax = ts18.createSourceFile(postgrestTypes, snapshot, ts18.ScriptTarget.Latest, true);
+async function assertPostgrestSnapshot(path) {
+  const snapshot = await readFile14(path, "utf8");
+  const syntax = ts18.createSourceFile(path, snapshot, ts18.ScriptTarget.Latest, true);
   const database = syntax.statements.find((node) => (ts18.isTypeAliasDeclaration(node) || ts18.isInterfaceDeclaration(node)) && node.name.text === "Database" && node.modifiers?.some((modifier) => modifier.kind === ts18.SyntaxKind.ExportKeyword));
   if (!database)
     throw new Error("PostgREST snapshot must export Database from the official type generator");
-  const program = ts18.createProgram([postgrestTypes], {
+  const program = ts18.createProgram([path], {
     strict: true,
     noEmit: true,
     skipLibCheck: true,
@@ -18275,11 +18312,17 @@ async function generateDatabaseContracts(options, check = false) {
   });
   if (ts18.getPreEmitDiagnostics(program).length)
     throw new Error("PostgREST snapshot has TypeScript errors");
-  const artifacts = await renderGraphql({
-    rootDir,
-    outDir,
-    graphql: options.graphql
-  });
+}
+async function generateDatabaseContracts(options, check = false) {
+  const rootDir = resolve24(options.rootDir), outDir = resolve24(options.outDir);
+  const postgrestTypes = options.postgrestTypes ? resolve24(rootDir, options.postgrestTypes) : undefined;
+  const drizzleSchema = options.drizzleSchema ? resolve24(rootDir, options.drizzleSchema) : undefined;
+  if (!postgrestTypes && !drizzleSchema && !options.graphql) {
+    throw new TypeError("Database contracts require postgrestTypes, drizzleSchema, or graphql");
+  }
+  if (postgrestTypes)
+    await assertPostgrestSnapshot(postgrestTypes);
+  const artifacts = options.graphql ? await renderGraphql({ rootDir, outDir, graphql: options.graphql }) : { diagnostics: [], files: {} };
   if (artifacts.diagnostics.some((item) => item.severity === "error")) {
     throw new Error(artifacts.diagnostics.map((item) => item.message).join(`
 `));
@@ -18289,38 +18332,42 @@ async function generateDatabaseContracts(options, check = false) {
     const absolute = resolve24(rootDir, path);
     inputs[relative12(rootDir, absolute).replaceAll("\\", "/")] = hash4(await readFile14(absolute, "utf8"));
   };
-  await addInput(postgrestTypes);
-  await addInput(drizzleSchema);
-  const drizzleProgram = ts18.createProgram([drizzleSchema], {
-    noEmit: true,
-    moduleResolution: ts18.ModuleResolutionKind.Bundler,
-    module: ts18.ModuleKind.ESNext,
-    target: ts18.ScriptTarget.ES2022,
-    types: [],
-    skipLibCheck: true
-  });
-  for (const source of drizzleProgram.getSourceFiles()) {
-    if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
-      await addInput(source.fileName);
+  if (postgrestTypes)
+    await addInput(postgrestTypes);
+  if (drizzleSchema) {
+    await addInput(drizzleSchema);
+    const drizzleProgram = ts18.createProgram([drizzleSchema], {
+      noEmit: true,
+      moduleResolution: ts18.ModuleResolutionKind.Bundler,
+      module: ts18.ModuleKind.ESNext,
+      target: ts18.ScriptTarget.ES2022,
+      types: [],
+      skipLibCheck: true
+    });
+    for (const source of drizzleProgram.getSourceFiles()) {
+      if (!source.isDeclarationFile && !source.fileName.includes("/node_modules/"))
+        await addInput(source.fileName);
+    }
   }
-  await addInput(resolve24(rootDir, options.graphql.schema));
+  if (options.graphql)
+    await addInput(resolve24(rootDir, options.graphql.schema));
   if (new Set(options.migrations.map((path) => resolve24(rootDir, path))).size !== options.migrations.length) {
     throw new Error("Duplicate migration in database contracts configuration");
   }
   for (const path of options.migrations)
     await addInput(path);
-  const files = {
-    ...artifacts.files,
-    "database.ts": [
-      "// GENERATED BY @supacloud/compiler database-contracts. Do not edit.",
-      `export type { Database } from ${JSON.stringify(importPath(outDir, postgrestTypes))};`,
-      'export type { QueryData, QueryResult, QueryError } from "@supabase/supabase-js";',
-      `export type DrizzleSchema = typeof import(${JSON.stringify(importPath(outDir, drizzleSchema))});`,
-      'export * from "./graphql";',
-      ""
-    ].join(`
-`)
-  };
+  const barrel = ["// GENERATED BY @supacloud/compiler database-contracts. Do not edit."];
+  if (postgrestTypes) {
+    barrel.push(`export type { Database } from ${JSON.stringify(importPath(outDir, postgrestTypes))};`);
+    barrel.push('export type { QueryData, QueryResult, QueryError } from "@supabase/supabase-js";');
+  }
+  if (drizzleSchema)
+    barrel.push(`export type DrizzleSchema = typeof import(${JSON.stringify(importPath(outDir, drizzleSchema))});`);
+  if (options.graphql)
+    barrel.push('export * from "./graphql";');
+  barrel.push("");
+  const files = { ...artifacts.files, "database.ts": barrel.join(`
+`) };
   const manifest = {
     version: 1,
     role: options.role,
@@ -18328,7 +18375,12 @@ async function generateDatabaseContracts(options, check = false) {
     migrationOrder: options.migrations.map((path) => relative12(rootDir, resolve24(rootDir, path)).replaceAll("\\", "/")),
     outputs: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([file, text]) => [file, hash4(text)]))
   };
-  files["database.manifest.json"] = JSON.stringify(manifest, null, 2) + `
+  const fingerprint = hash4(JSON.stringify({
+    inputs: manifest.inputs,
+    migrationOrder: manifest.migrationOrder
+  }));
+  const typedManifest = parseDatabaseContractManifest({ ...manifest, fingerprint });
+  files["database.manifest.json"] = JSON.stringify(typedManifest, null, 2) + `
 `;
   const mismatches = [];
   for (const [file, content] of Object.entries(files)) {
@@ -18348,7 +18400,7 @@ async function generateDatabaseContracts(options, check = false) {
     for (const [file, content] of Object.entries(files))
       await writeFileIfChanged(resolve24(outDir, file), content);
   }
-  return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest };
+  return { upToDate: mismatches.length === 0, mismatches, written: check ? [] : mismatches, manifest: typedManifest };
 }
 async function runDatabaseContractsFile(path, check = false) {
   const absolute = resolve24(path);
@@ -18359,6 +18411,7 @@ var init_database_contracts = __esm(() => {
   init_graphql();
   init_generate();
   init_graphql_options();
+  init_database_contract_manifest();
 });
 
 // src/analyze.ts
@@ -19064,7 +19117,8 @@ var DEFAULT_EFFECT_ANALYSIS_OPTIONS = {
   requireExactDependencyTypes: true,
   requireTimeoutForDependencies: true,
   forbidDirectRuntimeExecution: true,
-  forbidDirectThrows: true
+  forbidDirectThrows: true,
+  requireRetryPolicy: true
 };
 function nodeText(node) {
   return node.getText(node.getSourceFile());
@@ -19137,7 +19191,8 @@ async function analyzeProject(rootDir, include, cache, changedPaths, effectOptio
       requireExactDependencyTypes: effectOptions.requireExactDependencyTypes ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireExactDependencyTypes,
       requireTimeoutForDependencies: effectOptions.requireTimeoutForDependencies ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireTimeoutForDependencies,
       forbidDirectRuntimeExecution: effectOptions.forbidDirectRuntimeExecution ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectRuntimeExecution,
-      forbidDirectThrows: effectOptions.forbidDirectThrows ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectThrows
+      forbidDirectThrows: effectOptions.forbidDirectThrows ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.forbidDirectThrows,
+      requireRetryPolicy: effectOptions.requireRetryPolicy ?? DEFAULT_EFFECT_ANALYSIS_OPTIONS.requireRetryPolicy
     }
   };
   if (ctx.effectOptions.forbidDirectRuntimeExecution) {
@@ -19960,6 +20015,21 @@ function resolveStaticObjectLiteral(input, ctx, seen = new Set) {
   }
   return ts7.isObjectLiteralExpression(input) ? input : undefined;
 }
+function resolveStaticArrayLiteral(input, ctx, seen = new Set) {
+  if (!input || seen.has(input))
+    return;
+  seen.add(input);
+  if (ts7.isAsExpression(input) || ts7.isSatisfiesExpression(input) || ts7.isParenthesizedExpression(input)) {
+    return resolveStaticArrayLiteral(input.expression, ctx, seen);
+  }
+  if (ts7.isIdentifier(input)) {
+    const declaration = resolveDeclaration(input, ctx).find(ts7.isVariableDeclaration);
+    const list = declaration?.parent;
+    const isConst = Boolean(list && ts7.isVariableDeclarationList(list) && (list.flags & ts7.NodeFlags.Const) !== 0);
+    return isConst && declaration?.initializer ? resolveStaticArrayLiteral(declaration.initializer, ctx, seen) : undefined;
+  }
+  return ts7.isArrayLiteralExpression(input) ? input : undefined;
+}
 function routePolicyProperty(object, name, ctx, seen = new Set) {
   if (seen.has(object))
     return { unresolved: true };
@@ -20920,7 +20990,7 @@ function parseController(input, ctx) {
               file,
               line: lineOf(effectExpr),
               message: `Route ${route.handler} effect must be a statically resolvable object literal.`,
-              suggestion: "Use effect: { required: true, errors: [...], dependencies: [...] }."
+              suggestion: 'Use effect: { required: true, errors: [...], dependencies: [...], retry: "none" }.'
             });
           } else {
             const effect = { required: true };
@@ -20951,6 +21021,8 @@ function parseController(input, ctx) {
               } else {
                 effect.retry = retry;
               }
+            } else if (ctx.effectOptions.requireRetryPolicy === false) {
+              effect.retry = "none";
             }
             const maxAttemptsExpr = getProp(effectObject, "maxAttempts");
             if (maxAttemptsExpr !== undefined) {
@@ -20999,7 +21071,8 @@ function parseController(input, ctx) {
             }
             const dependenciesExpr = getProp(effectObject, "dependencies");
             if (dependenciesExpr !== undefined) {
-              if (!ts7.isArrayLiteralExpression(dependenciesExpr) || dependenciesExpr.elements.some((element) => !ts7.isStringLiteral(element) || element.text.trim().length === 0)) {
+              const dependenciesArray = resolveStaticArrayLiteral(dependenciesExpr, ctx);
+              if (!dependenciesArray || dependenciesArray.elements.some((element) => !ts7.isStringLiteral(element) || element.text.trim().length === 0)) {
                 ctx.diagnostics.push({
                   severity: "error",
                   code: "invalid-effect-dependencies",
@@ -21007,10 +21080,10 @@ function parseController(input, ctx) {
                   docsUrl: "https://supacloud.dev/errors/SC3033",
                   file,
                   line: lineOf(dependenciesExpr),
-                  message: `Route ${route.handler} effect.dependencies must be an explicit string array.`
+                  message: `Route ${route.handler} effect.dependencies must be a string array or a const initialized with one.`
                 });
               } else {
-                effect.dependencies = dependenciesExpr.elements.map((element) => element.text);
+                effect.dependencies = dependenciesArray.elements.map((element) => element.text);
                 if (new Set(effect.dependencies).size !== effect.dependencies.length) {
                   ctx.diagnostics.push({
                     severity: "error",
@@ -21027,7 +21100,8 @@ function parseController(input, ctx) {
             }
             const errorsExpr = getProp(effectObject, "errors");
             if (errorsExpr !== undefined) {
-              if (!ts7.isArrayLiteralExpression(errorsExpr)) {
+              const errorsArray = resolveStaticArrayLiteral(errorsExpr, ctx);
+              if (!errorsArray) {
                 ctx.diagnostics.push({
                   severity: "error",
                   code: "invalid-effect-errors",
@@ -21035,11 +21109,11 @@ function parseController(input, ctx) {
                   docsUrl: "https://supacloud.dev/errors/SC3034",
                   file,
                   line: lineOf(errorsExpr),
-                  message: `Route ${route.handler} effect.errors must be an explicit object array.`
+                  message: `Route ${route.handler} effect.errors must be an object array or a const initialized with one.`
                 });
               } else {
                 const errors = [];
-                for (const errorExpr of errorsExpr.elements) {
+                for (const errorExpr of errorsArray.elements) {
                   if (!ts7.isObjectLiteralExpression(errorExpr)) {
                     ctx.diagnostics.push({
                       severity: "error",
@@ -21056,6 +21130,23 @@ function parseController(input, ctx) {
                   const code = stringLiteralProp(errorExpr, "code");
                   const status = numberLiteralProp(errorExpr, "status");
                   const message = stringLiteralProp(errorExpr, "message");
+                  const codeFromError = booleanLiteralProp(errorExpr, "codeFromError");
+                  const messageFromError = booleanLiteralProp(errorExpr, "messageFromError");
+                  const statusFromError = booleanLiteralProp(errorExpr, "statusFromError");
+                  const retryable = booleanLiteralProp(errorExpr, "retryable");
+                  const outcomeUnknown = booleanLiteralProp(errorExpr, "outcomeUnknown");
+                  if (invalidBooleanProp(errorExpr, "codeFromError") || invalidBooleanProp(errorExpr, "messageFromError") || invalidBooleanProp(errorExpr, "statusFromError") || invalidBooleanProp(errorExpr, "retryable") || invalidBooleanProp(errorExpr, "outcomeUnknown")) {
+                    ctx.diagnostics.push({
+                      severity: "error",
+                      code: "invalid-effect-errors",
+                      errorCode: "SC3034",
+                      docsUrl: "https://supacloud.dev/errors/SC3034",
+                      file,
+                      line: lineOf(errorExpr),
+                      message: `Route ${route.handler} effect.errors instance flags must be boolean literals.`
+                    });
+                    continue;
+                  }
                   if (!tag || !code || status === undefined || !Number.isInteger(status) || status < 400 || status > 599) {
                     ctx.diagnostics.push({
                       severity: "error",
@@ -21068,7 +21159,17 @@ function parseController(input, ctx) {
                     });
                     continue;
                   }
-                  errors.push({ tag, code, status, ...message === undefined ? {} : { message } });
+                  errors.push({
+                    tag,
+                    code,
+                    status,
+                    ...message === undefined ? {} : { message },
+                    ...codeFromError === undefined ? {} : { codeFromError },
+                    ...messageFromError === undefined ? {} : { messageFromError },
+                    ...statusFromError === undefined ? {} : { statusFromError },
+                    ...retryable === undefined ? {} : { retryable },
+                    ...outcomeUnknown === undefined ? {} : { outcomeUnknown }
+                  });
                 }
                 effect.errors = errors;
                 if (new Set(errors.map((entry) => entry.tag)).size !== errors.length) {
@@ -21796,6 +21897,19 @@ function numberLiteralProp(obj, name) {
   const value = Number(expr.text);
   return Number.isFinite(value) ? value : undefined;
 }
+function booleanLiteralProp(obj, name) {
+  const expr = getProp(obj, name);
+  if (!expr || !isBooleanLiteral(expr))
+    return;
+  return expr.kind === ts7.SyntaxKind.TrueKeyword;
+}
+function isBooleanLiteral(expr) {
+  return expr.kind === ts7.SyntaxKind.TrueKeyword || expr.kind === ts7.SyntaxKind.FalseKeyword;
+}
+function invalidBooleanProp(obj, name) {
+  const expr = getProp(obj, name);
+  return expr !== undefined && !isBooleanLiteral(expr);
+}
 function arrayProp(obj, name) {
   const expr = getProp(obj, name);
   return expr && ts7.isArrayLiteralExpression(expr) ? [...expr.elements] : [];
@@ -22738,6 +22852,9 @@ function validateEffectPolicies(graph, options = {}) {
         if (options.requireDependencies && effect.dependencies === undefined) {
           diagnostics.push(diagnostic("effect-dependencies-required", `Route ${label} declares an Effect contract without dependencies.`, controller.file, "Declare the logical services required by the Effect environment."));
         }
+        if (effect.retry === undefined && options.requireRetryPolicy !== false) {
+          diagnostics.push(diagnostic("effect-retry-required", `Route ${label} declares an Effect contract but does not declare retry.`, controller.file, 'Set effect.retry to "none". That is the required default; use "explicit" only with maxAttempts and a retryable 5xx allow-list.'));
+        }
         if (effect.retry === "explicit" && effect.maxAttempts === undefined) {
           diagnostics.push(diagnostic("invalid-effect-retry", `Route ${label} enables explicit Effect retry without maxAttempts.`, controller.file, "Declare a positive maxAttempts value including the initial attempt."));
         }
@@ -22748,6 +22865,18 @@ function validateEffectPolicies(graph, options = {}) {
           if (command && command.idempotency !== "required") {
             diagnostics.push(diagnostic("effect-command-retry-forbidden", `Route ${label} enables explicit Effect retry for non-idempotent command "${command.name}".`, controller.file, 'Set command idempotency to "required" or use effect.retry: "none".'));
           }
+          const retryable = (effect.errors ?? []).filter((entry) => entry.retryable === true);
+          if (retryable.length === 0) {
+            diagnostics.push(diagnostic("effect-retry-target-required", `Route ${label} enables explicit Effect retry without a transient failure allow-list.`, controller.file, 'Mark only 5xx failures that did not commit with retryable: true, or use effect.retry: "none".'));
+          }
+        }
+        for (const entry of effect.errors ?? []) {
+          if (entry.retryable !== true)
+            continue;
+          const transient = effect.retry === "explicit" && entry.outcomeUnknown !== true && entry.statusFromError !== true && entry.status >= 500 && entry.status <= 599;
+          if (!transient) {
+            diagnostics.push(diagnostic("effect-retryable-invalid", `Route ${label} marks "${entry.tag}" retryable, but in-process retry is only for declared 5xx failures that are not outcome-unknown.`, controller.file, 'Remove retryable, or keep it on a 5xx mapping with retry: "explicit" and without outcomeUnknown or statusFromError.'));
+          }
         }
       }
     }
@@ -24991,10 +25120,10 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve17 } from "node:path";
 
 // src/migration-app-version.ts
-var MIGRATION_APP_VERSION = "0.35.0";
+var MIGRATION_APP_VERSION = "0.36.0";
 
 // src/migration-elysia-version.ts
-var MIGRATION_ELYSIA_VERSION = "0.37.0";
+var MIGRATION_ELYSIA_VERSION = "0.38.1";
 
 // src/migration-policy.ts
 var cachedCompilerVersion;
@@ -25013,7 +25142,7 @@ function migrationDependencies() {
     "@supacloud/app": MIGRATION_APP_VERSION,
     "@supacloud/compiler": compilerVersion(),
     "@supacloud/elysia": MIGRATION_ELYSIA_VERSION,
-    elysia: "2.0.0-rc.0",
+    elysia: "2.0.0-rc.1",
     typescript: "7.0.2"
   };
 }
@@ -26357,7 +26486,9 @@ var DEFAULT_SUPACLOUD_CONFIG = {
     requireExactDependencyTypes: true,
     requireTimeoutForDependencies: true,
     forbidDirectRuntimeExecution: true,
-    forbidDirectThrows: true
+    forbidDirectThrows: true,
+    requireRetryPolicy: true,
+    defaultRetry: "none"
   }
 };
 function defineSupacloudConfig(config = {}) {
@@ -26439,7 +26570,9 @@ function validateGovernanceConfig(config) {
       "requireExactDependencyTypes",
       "requireTimeoutForDependencies",
       "forbidDirectRuntimeExecution",
-      "forbidDirectThrows"
+      "forbidDirectThrows",
+      "requireRetryPolicy",
+      "defaultRetry"
     ].includes(key))) {
       throw new Error("effect contains an unsupported governance option.");
     }
@@ -26451,12 +26584,16 @@ function validateGovernanceConfig(config) {
       "requireExactDependencyTypes",
       "requireTimeoutForDependencies",
       "forbidDirectRuntimeExecution",
-      "forbidDirectThrows"
+      "forbidDirectThrows",
+      "requireRetryPolicy"
     ]) {
       if (config.effect[key] !== undefined && typeof config.effect[key] !== "boolean") {
         throw new Error(`effect.${key} must be boolean.`);
       }
     }
+    if (config.effect["defaultRetry"] !== undefined && config.effect["defaultRetry"] !== "none") {
+      throw new Error('effect.defaultRetry must be "none". explicit can only be written on a route, with maxAttempts and a retryable 5xx allow-list.');
+    }
   }
 }
 function resolveSupacloudConfig(config = {}, cwd = process.cwd()) {
@@ -26782,6 +26919,7 @@ function introspectionQuery() {
 
 // src/index.ts
 init_database_contracts();
+init_database_contract_manifest();
 export {
   ANGULAR_ENTERPRISE_RULES,
   APPLICATION_DEVELOPMENT_ARCHIVE_MAX_BYTES2 as APPLICATION_DEVELOPMENT_ARCHIVE_MAX_BYTES,
@@ -26868,6 +27006,7 @@ export {
   migrateProject,
   migrateRouteResponse,
   parseApplicationDevelopmentContext,
+  parseDatabaseContractManifest,
   parseDatabaseContractsOptions,
   parseDeliveryBuildManifest,
   parseDeliveryBuildResult,

package/dist/migration-app-version.d.ts

@@ -1 +1 @@
-export declare const MIGRATION_APP_VERSION = "0.35.0";
+export declare const MIGRATION_APP_VERSION = "0.36.0";

package/dist/migration-elysia-version.d.ts

@@ -1 +1 @@
-export declare const MIGRATION_ELYSIA_VERSION = "0.37.0";
+export declare const MIGRATION_ELYSIA_VERSION = "0.38.1";

package/dist/types.d.ts

@@ -191,6 +191,19 @@ export interface EffectErrorMappingNode {
     status: number;
     code: string;
     message?: string;
+    /** Use the failure value's own `code` string when it is non-empty and bounded. */
+    codeFromError?: boolean;
+    /** Use the failure value's own `message` string when it is non-empty and bounded. */
+    messageFromError?: boolean;
+    /** Use the failure value's own HTTP status when it is an integer from 400 to 599. */
+    statusFromError?: boolean;
+    /**
+     * In-process retry allow-list. Only a declared 5xx failure that did not
+     * commit may be retried by the framework adapter.
+     */
+    retryable?: boolean;
+    /** The write may already have happened. The framework adapter must not retry it. */
+    outcomeUnknown?: boolean;
 }
 export interface EffectRouteNode {
     required: true;
@@ -511,6 +524,13 @@ export interface EffectCompilerOptions {
     forbidDirectRuntimeExecution?: boolean;
     /** Reject direct throw statements inside governed route handlers. */
     forbidDirectThrows?: boolean;
+    /** Require every route that declares an Effect contract to write an explicit retry policy. */
+    requireRetryPolicy?: boolean;
+    /**
+     * Materialize an omitted retry policy when requireRetryPolicy is disabled.
+     * The only project-level default is "none"; "explicit" stays route-local.
+     */
+    defaultRetry?: "none";
 }
 export interface GraphqlOptions {
     /** Additionally emit standard TypedDocumentNode artifacts for GraphQL ecosystem clients. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/compiler",
-  "version": "0.53.1",
+  "version": "0.55.0",
   "description": "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,7 +57,7 @@
     "directory": "packages/compiler"
   },
   "dependencies": {
-    "@supacloud/db": "0.20.3",
+    "@supacloud/db": "0.20.5",
     "@supacloud/delivery": "0.24.0",
     "typebox": "1.4.3",
     "@graphql-codegen/core": "^6.2.2",