@supacloud/compiler 0.55.1 → 0.57.0

package/DELIVERY.md

@@ -552,3 +552,29 @@ it cannot bypass platform SQL policy or grant database privileges. Platform
 runtime prerequisites are separately managed, not implicitly bundled.
 Building an archive is not evidence of backward compatibility, applied migrations,
 successful activation, application rollback or recovered data.
+
+## Compiled execution contract migration
+
+Delivery builds now validate `app.manifest.json.executionPlan` against explicit
+`commandCapabilities` before emitting a bundle. Applications with commands must
+declare the capabilities of the adapters actually wired by their host; omitted
+capabilities are unavailable at this boundary. For a named database adapter:
+
+```ts
+commandCapabilities: {
+  requirePersistentAdapters: true,
+  permission: true,
+  rpc: {
+    orders: { boundary: "database", audit: true, idempotency: true, transaction: true },
+  },
+}
+```
+
+Declare every RPC branch. External adapters need reconciliation and must not
+claim a database transaction around a remote effect. These declarations are
+checked structurally; deployment still needs runtime adapter verification.
+
+Upgrade compiler and Elysia adapter together, regenerate artifacts, and rebuild
+the bundle. HTTP modules require the generated `registerRoutes` callback; old
+route-array fallback has been removed. See the [adapter migration](../elysia/README.md#static-route-registration-migration)
+and [command boundary migration](../app/EXECUTION.md#command-boundary-migration-sc4029).

package/README.md

@@ -63,7 +63,7 @@ Remote database changes alone do not trigger watch; the next compile checks them
 This gate enforces the adopted database-source contract and declared object
 checks, not complete database coverage, ORM usage, runtime authorization, or SQL
 test behavior. Passing it is not deployment acceptance. Keep one existing
-append-only migration ledger, maintain Drizzle structure and SQL sources
+append-only migration ledger, maintain ZModel structure and SQL sources
 separately, and explicitly generate/review RPC contracts before compiling.
 See `docs/database-governance.md` and `docs/database-source-contracts.md` for
 the database checks and their limitations.
@@ -86,19 +86,19 @@ attempts. The default policy requires `requireRouteEffects`,
 ## Unified Database Contracts
 
 Database contracts are protocol-aware: configure only the database sources the
-application uses (`postgrestTypes`, `drizzleSchema`, or `graphql`). The generated
+application uses (`postgrestTypes`, `modelSchema`, or `graphql`). The generated
 `database.manifest.json` is a TypeBox-validated, fingerprinted build boundary;
 consumers must reject it when its schema or migration fingerprint is stale.
 
 `supacloud-compiler database-contracts database-contracts.json` generates a shared
-type entry point while preserving PostgREST, Drizzle and GraphQL native types:
+type entry point while preserving PostgREST, ZModel and GraphQL native types:
 
 ```json
 {
   "rootDir": ".",
   "outDir": "generated",
   "postgrestTypes": "database.types.ts",
-  "drizzleSchema": "db/schema.ts",
+  "modelSchema": "zenstack/generated/schema.ts",
   "role": "authenticated",
   "graphql": {
     "schema": "graphql/schema.graphql",
@@ -111,18 +111,21 @@ type entry point while preserving PostgREST, Drizzle and GraphQL native types:
 Configuration paths are relative to the configuration directory; GraphQL document
 patterns are resolved under `rootDir`. Supply the official PostgREST `Database`
 snapshot and a role-scoped `pg_graphql` schema snapshot. The generated barrel
-exports `Database`, `QueryData`, Drizzle schema types and GraphQL contracts.
-Consumers need `@supabase/supabase-js` and their Drizzle dependencies.
+exports `Database`, `QueryData`, ZModel schema types and GraphQL contracts.
+Consumers need `@supabase/supabase-js` and their ZenStack dependencies.
 
-`--check` detects drift in supplied snapshots, local Drizzle imports, migration
+`--check` detects drift in supplied snapshots, local ZModel imports, migration
 content/order and generated artifacts without writing. This is an offline check,
 not proof of live database parity or authorization. Refresh snapshots from the
 intended database and role before running it. Keep runtime decoders at untrusted
 boundaries; protocol result shapes are not interchangeable.
 
-Compiled DI requires constructor injection and generated scope factories.
+Architecture references: Micronaut for compile-time AOP, NestJS for feature modules,
+and Angular for DI semantics. Compiled DI requires constructor injection and generated scope factories.
+Validation, generation and manifests share a static resolver; see the supported
+[DI profile and migration](../../docs/architecture/static-aop.md#已实施的静态服务端-di-语义).
 Property `inject()` and runtime injection-context APIs fail with `SC2012`.
-Production SQL scanning reports non-`unknown` Drizzle `sql<T>` as `SC6007` and
+Production SQL scanning reports non-`unknown` Kysely `sql<T>` as `SC6007` and
 dynamic `sql.raw` as `SC6008`. Prefer parameters and explicit result decoders.
 These rules do not replace PostgreSQL constraints, RLS or migration review.
 
@@ -208,7 +211,7 @@ SupaCloud 应用静态编译器：读取 `@supacloud/app` 装饰器元数据的
 
 ## Recommended GraphQL Query Contracts
 
-**Database First is the only server-schema model.** Drizzle and SQL declarations
+**Database First is the only server-schema model.** ZModel and SQL declarations
 are migrated to PostgreSQL; `pg_graphql` reflects the actual database, and
 `graphql-schema` exports the intended role's snapshot. Author queries/fragments,
 not GraphQL resolver classes or a separate server SDL. `graphql.schema` accepts
@@ -562,13 +565,14 @@ IDE 和 AI agent 做状态机漂移检查。
 `<outDir>/application.ts`（头注释 `// GENERATED BY @supacloud/compiler — do not edit`）：
 
 - 文件顶部本地声明 `CompiledRoute` / `CompiledController` / `CompiledModule` 接口，不 import 任何外部包。
-- `createCompiledModules()` 按 imports 拓扑序返回模块描述：`{ name, createServices, createRequestScope?, createJobScope?, controllers, commands }`。平台依赖统一由 `createApplication({ deps })` 传入生成工厂。
+- `createCompiledModules()` 按 imports 与隐式 root 依赖拓扑序返回模块描述：`{ name, createServices, createRequestScope?, createJobScope?, controllers, commands }`。平台依赖统一由 `createApplication({ deps })` 传入生成工厂。
 - `makeEnvironmentProviders`、`provideToken`、`provideAppInitializer`、`provideEnvironmentInitializer`、`provideRouter` 和 `provideHttpClient` 的可静态展开部分会在 AST 分析阶段展开为普通 provider；不支持静态安全展开的动态参数会产生诊断，不会被静默丢弃。
-- 每个模块一个 `create<Name>Services(deps, imported)`：实例化 application 级 provider；dep 解析顺序为本模块 services > imports 模块导出的 services（`imported.<module>.<key>`）> 平台注入（`deps.<camelName>`）。
-- 含 request 级 provider/controller 的模块额外生成 `create<Name>RequestScope(services, ctx)`：依赖 `REQUEST_CONTEXT`（或 token name `supacloud.request-context`）的参数传 `ctx`，其余经 `services` 解析（运行期负责把 imports 模块导出的 application 服务合并进 `services`）；job 级同理生成 `create<Name>JobScope`。
+- 每个模块一个 `create<Name>Services(deps, imported)`：实例化 application 级 provider；dep 解析顺序为本模块 > imports 公开导出/重导出的原始 provider > root 默认 provider > 平台自有属性。歧义与非法生命周期在编译时拒绝。
+- 含 request 级 provider/controller 的模块额外生成 `create<Name>RequestScope(services, ctx)`：依赖 `REQUEST_CONTEXT`（或 token name `supacloud.request-context`）的参数传 `ctx`，其余根据静态计划从本 scope、`services`、`imported` 或私有保留的平台绑定读取；job 级同理生成 `create<Name>JobScope`。
 - 含 request/job 级 provider 或 controller 的模块同时生成异步静态 `create<Name>RequestScope` / `create<Name>JobScope` 与 `destroy<Name>RequestScope(scope)` / `destroy<Name>JobScope(scope)`；factory 在构造中途失败时按编译期确定的逆创建顺序回滚已知 `onDestroy` 方法，不会运行时扫描或解析 Token。
 - `@Host()` 在 EnvironmentInjector 作用域中保留元数据但不改变解析，因为 SupaCloud 没有 Angular 元素注入器树；`@Self()` / `@SkipSelf()` 由静态 factory 按当前 scope 与模块可见性执行。
 - AOP 只支持静态边界：`ModuleOptions.aspects`、`RouteOptions.aspects`、`CommandOptions.aspects` 和 `JobOptions.aspects` 必须是显式数组字面量，元素必须是可解析的函数标识符。生成器会直接 import aspect 并生成固定顺序的 onion chain，不使用 Proxy、Reflect 扫描、动态 pointcut 或运行时注册。
+- typed aspect 可使用真实 `@supacloud/app`、`/core`、`/execution` 的 `defineOperationAspect` 初始化 `const` 命名变量；`kind`、`name` 必须为静态字面量且与绑定操作一致，契约不接受 spread。输入/结果校验器与 capability 选择器提供类型缩窄。生成的 Command 管线要求成功返回来自一次 next，拒绝结果替换及吞掉下游失败，并递归冻结普通数据结果。详见 [静态 AOP 约束](../../docs/architecture/static-aop.md)。
 - 执行顺序为 `commandGovernance -> module -> route -> command -> handler`，授权拒绝不会运行业务切面；Job 使用 `module -> job -> executor -> run/execute`，并在 finally 中销毁 job scope。
 - services 对象的 key 为 token 名的 camelCase：`CaseService → caseService`、`CASE_REPOSITORY → caseRepository`、`LOGGER → logger`。
 - controller 描述静态给出：`{ path, serviceKey, scope, routes: [{ method, path, handler, body?, params?, query?, headers?, cookie?, response?, responses? }] }`，schema 直接引用 import 进来的对象。
@@ -739,7 +743,11 @@ export default defineSupacloudConfig({
 supacloud-compiler check --root ./app --out ./app/generated --strict
 ```
 
-程序化调用可直接使用 `scanGeneratedArtifacts()` 和 `scanProductionSource()` 获取结构化诊断。
+程序化调用需 `await scanGeneratedArtifacts()` 和 `await scanProductionSource()` 获取结构化诊断。
+
+编译工具链固定为官方 TypeScript `7.1.0-beta`，内部使用 `typescript/async`，可直接运行于 Bun 1.4.4。源码解析、类型查询和迁移不再依赖 TypeScript 6 或 Node 同步 API。Svelte 的 `svelte-check` 是唯一例外：暂留 TS 6，并通过 `@typescript/native` 使用同一 TS 7.1 beta。
+
+`IncrementalProgramSession.update()`、`getDiagnostics()`、`emit()`、`reset()` 现在返回 Promise。会话支持 `await using`，更新后不要继续使用上一快照的 checker/type/symbol；自主管理缓存的调用方需 `await session.reset()` 释放原生进程。`IncrementalCompiler.reset()` 同样需要等待，watch 关闭会自动清理。内置源码迁移返回 Promise，自定义迁移仍可同步返回结果。
 
 ## 开发模式
 

package/dist/api-source.d.ts

@@ -1,11 +1,12 @@
-import * as ts from "@typescript/typescript6";
+import * as ts from "@supacloud/db/typescript";
 export interface ApiOrigin {
     module: string;
     name: string;
 }
 /** Bind one source for lexical identity only. Never load dependencies or execute application code. */
-export declare function bindApiSource(source: ts.SourceFile): {
+export declare function bindApiSource(source: ts.SourceFile): Promise<{
     source: ts.SourceFile;
-    checker: ts.TypeChecker;
-};
-export declare function apiOrigin(expression: ts.Expression, checker: ts.TypeChecker, seen?: Set<ts.Node>): ApiOrigin | undefined;
+    checker: ts.Checker;
+    [Symbol.asyncDispose]: () => Promise<void>;
+}>;
+export declare function apiOrigin(expression: ts.Expression, checker: ts.TypeChecker, seen?: Set<ts.Node>): Promise<ApiOrigin | undefined>;