@supacloud/elysia 0.14.1 → 0.17.0

package/README.md

@@ -1,5 +1,94 @@
 # @supacloud/elysia
 
+## Compatibility and Acceptance Boundary
+
+The dependency range is not a claim that every allowed version has been tested.
+The focused conformance suite was verified with Bun 1.4.2 and Elysia 1.4.30.
+The package declares Elysia `^1.4.30` as a peer and TypeScript `^7.0.2` as a
+development dependency. `compatibility.json` records the exact exercised tuple,
+including the compiler's separate TypeScript 6 semantic API. The contract-upgrade
+gate checks both that semantic API and the TypeScript 7 CLI. These tests do not
+establish a wider version matrix or Node.js runtime compatibility.
+
+Run `bun run test:conformance` in this package after building the local
+`@supacloud/contracts` and `@supacloud/app` dependencies and installing this
+package's dependencies. The suite runs through `app.handle(Request)` without a
+network listener. It is included in the normal `bun test` discovery.
+
+| Boundary | Acceptance evidence in `src/conformance.test.ts` |
+| --- | --- |
+| Decoded body, params, query, headers and cookies | Native/adapter response comparison, with explicit decoded-value assertions |
+| Response normalization and declared status maps | Native/adapter comparison, including a 409 response |
+| Native `Response` transport | Status, body, content type, custom header and outgoing cookie preserved |
+| Parent lifecycle hooks | Request, before-handler, handler and after-handler order compared |
+| Parent early return | 403 response compared; controller must not run |
+| Local sibling hooks | Local hook cannot intercept compiled routes |
+| Request schema failure | Native 422 status retained; controller must not run |
+| Malformed JSON | Native 400 status retained for multiple malformed bodies; controller must not run |
+| Error mapper precedence | Custom mapper handles parse failure before request context resolution |
+| Module error isolation | Internal exception redacted; sibling native error handling remains unchanged |
+| Invalid handler output | Intentional 500 response with `RESPONSE_VALIDATION_ERROR` |
+| Unsupported route descriptors | Unsupported methods/native hooks rejected before registration |
+| Duplicate protocol package copies | Known command errors retain their status; unknown codes remain internal |
+
+### Intentional Adapter Semantics
+
+- Default parse failures return HTTP 400 with `PARSE_ERROR`; request schema
+  failures return HTTP 422 with `VALIDATION_ERROR`. Their public messages do not
+  include parser details, submitted values or schema internals.
+- Invalid handler output returns HTTP 500, not a client-input error. It may occur
+  after business work has completed and must not be interpreted as a rollback.
+- Unknown handler exceptions are redacted. Known `CommandError` instances are
+  recognized by their Error identity, name and allowlisted code across separate
+  protocol package copies, never by exposing their message. A configured `errorMapper` can
+  override these defaults and owns the safety of its response.
+- Cookie input passed to a compiled controller contains decoded values, not
+  Elysia's mutable cookie wrappers. Native `Response` headers can carry outgoing
+  cookies.
+- Errors before context resolution have no request context. Error mappers must
+  not assume identity or request-scoped services are available.
+
+### Not Yet Proven by This Suite
+
+WebSockets, streaming and disconnect behavior, multipart uploads, signed-cookie
+mutation, arbitrary third-party plugins, alternate runtime/version combinations,
+concurrent tenant isolation, database transaction/idempotency guarantees and
+published-package installation are not covered by the conformance suite alone.
+Runtime safety is covered separately below. This list records
+an evidence gap, not a declaration that all these features are unsupported.
+Do not claim complete Elysia compatibility from this gate.
+
+Compiled routes accept only the HTTP methods and schema fields declared by
+`CompiledRoute`, plus compiler-emitted parameter transformation/default and
+descriptive metadata. This metadata does not install native Elysia hooks.
+Other descriptor fields (including browser guards/resolvers and native
+`beforeHandle`) or unsupported methods throw `ROUTE_DESCRIPTOR_UNSUPPORTED`
+at registration. It is not an arbitrary Elysia route-options passthrough.
+TypeScript/decorator inference, compiler migrations and generated client parity
+require their own acceptance gates.
+
+### Runtime and Upgrade Gates
+
+`bun run test:runtime-safety` requires `SUPACLOUD_COMMAND_TEST_URL` and fails
+instead of skipping when it is missing. Use a dedicated loopback database named
+`supacloud_commands_test`, with PostgreSQL 18 and PGMQ 1.10.0; initialize it using
+`scripts/prepare-command-test-database.ts`. The gate opens real loopback HTTP
+listeners and exercises compiler-generated request-scoped controllers. It proves
+overlapping tenant/actor requests, duplicate-key concurrency, authorization
+revocation, audit rollback, same-key retry and per-request provider teardown.
+Its authentication uses a fixed test token map, not a production JWT provider.
+
+`bun run test:contract-upgrade` copies a fixed legacy source fixture, previews and
+applies its versioned migration, compiles factories/client/OpenAPI, checks positive
+and negative types with both TypeScript engines, and calls the generated client
+over real HTTP. It restores the old source checkpoint, regenerates artifacts and
+executes the restored application. Build local contracts, app and compiler
+(including declarations) before installing this package's copied file dependencies.
+
+These gates prove the stated scenarios, not a full historical npm upgrade matrix
+or all business-domain isolation. See [framework acceptance](../../docs/framework-acceptance.md)
+for the evidence boundaries and upgrade policy.
+
 ## Persistent Command Adapters
 
 `createPersistentCommandAdapter(command, { identity, input })` binds a
@@ -36,9 +125,9 @@ Runtime adapter that turns `@supacloud/compiler` output into a production-ready
   controllers and services.
 - **Request-scope teardown**: invokes the compiler-generated
   `destroyRequestScope` after the response, including when the handler fails.
-- **Angular-backed async DI**: when `createApplication({ injector })` receives
-  an `@supacloud/app` root injector, each request gets an isolated child
-  injector with `REQUEST_CONTEXT`, including across `await` boundaries.
+- **Compile-time DI**: constructor dependencies are directly connected by generated
+  factories. Request/job context is passed explicitly without runtime injector
+  discovery, registration or token lookup.
 - **TypeBox schema binding**: attaches compiled parameter, query, body, headers,
   cookie, single-response and status-map TypeBox schemas directly to Elysia
   route definitions; Elysia performs request validation and normalization.
@@ -116,10 +205,11 @@ GraphQL endpoint serves a local, role-scoped snapshot only; it does not enable
 server introspection or create a GraphQL resolver layer. Protect or omit these
 routes in production when the schema is not public.
 
-The root injector is normally created and owned by `bootstrapBun`. The Elysia
-adapter does not take ownership of an injected root injector; stop it from the
-same Bun bootstrap that created it. Existing applications may omit `injector`
-and continue using compiler-generated request scopes unchanged.
+Use constructor injection and the generated `createServices`,
+`createRequestScope` and `createJobScope` factories. Compiled applications reject
+property `inject()` and runtime injection contexts with `SC2012`. The host provides
+platform dependencies through `deps` and owns their lifecycle; generated factories
+own application scope construction and teardown.
 
 For deterministic local verification, use the in-memory sandbox. It supplies
 stable request identity, an isolated key-value database with optimistic

package/compatibility.json

@@ -0,0 +1,9 @@
+{
+  "bun": "1.4.2",
+  "packages": {
+    "elysia": "1.4.30",
+    "typescript": "7.0.2",
+    "@sinclair/typebox": "0.34.52",
+    "@typescript/typescript6": "6.0.2"
+  }
+}

package/dist/command-errors.d.ts

@@ -1,2 +1,3 @@
 import type { CommandErrorCode } from "@supacloud/contracts";
+export declare function commandErrorCode(error: unknown): CommandErrorCode | undefined;
 export declare function commandErrorStatus(code: CommandErrorCode): number;

package/dist/fixtures/webhook-generated/application.d.ts

@@ -33,6 +33,7 @@ export interface CompiledRoute {
     title?: string;
     data?: Record<string, unknown>;
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
     invoker?: (controller: unknown, request: {
         params?: Record<string, unknown>;
         query?: Record<string, unknown>;
@@ -52,6 +53,7 @@ export interface CompiledCommand {
     idempotency: "required" | "none";
     standalone?: boolean;
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
 export interface CompiledJob {
     className: string;
@@ -65,6 +67,7 @@ export interface CompiledJob {
     maxAttempts?: number;
     idempotency?: "required" | "none";
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
 export interface CompiledAspectContext {
     kind: "route" | "command" | "job";
@@ -94,7 +97,11 @@ export interface CompiledModule {
     commands: CompiledCommand[];
     jobs: CompiledJob[];
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
+type CompiledAspectObserver = (stage: string, run: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
+type CompiledAspectPipeline = (context: CompiledAspectContext, next: () => unknown | Promise<unknown>, observe?: CompiledAspectObserver) => unknown | Promise<unknown>;
 export declare function createCompiledModules(): CompiledModule[];
 export declare function initializeApplication(services: Record<string, unknown>): Promise<void>;
 export declare function destroyApplication(services: Record<string, unknown>): Promise<void>;
+export {};

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 import { Elysia } from "elysia";
 import { type CommandPreview } from "@supacloud/contracts";
-import { type EnvironmentInjector } from "@supacloud/app";
 import { type ExecutionObserver } from "./execution";
 import { type ApplicationDocumentationOptions } from "./documentation";
 export type { ExecutionEvent, ExecutionObserver } from "./execution";
@@ -46,6 +45,7 @@ export interface CompiledRoute {
     command?: string;
     /** Statically generated route aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledCommand {
     rpc?: string;
@@ -57,6 +57,7 @@ export interface CompiledCommand {
     idempotency?: "required" | "none" | string;
     /** Statically generated command aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledJob {
     className: string;
@@ -72,6 +73,7 @@ export interface CompiledJob {
     maxAttempts?: number;
     idempotency?: "required" | "none";
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledController {
     /** Controller path prefix, e.g. "/cases". */
@@ -93,6 +95,7 @@ export interface CompiledModule {
     jobs?: CompiledJob[];
     /** Statically generated module aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export type RequestContextFactory = (request: Request) => unknown | Promise<unknown>;
 export { createSupAuthRequestContext } from "./identity";
@@ -145,6 +148,7 @@ export type ApplicationAspect = (context: ApplicationAspectContext, next: () =>
  * registers aspects.
  */
 export declare function composeAspects(...aspects: (ApplicationAspect | undefined | null)[]): ApplicationAspect;
+export type ApplicationAspectPipeline = (context: ApplicationAspectContext, next: () => unknown | Promise<unknown>, observe?: (stage: string, run: () => unknown | Promise<unknown>) => unknown | Promise<unknown>) => unknown | Promise<unknown>;
 export type CommandAuthorizer = (invocation: CommandInvocation) => void | Promise<void>;
 export type CommandMiddleware = (invocation: CommandInvocation, next: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
 export interface CommandAudit {
@@ -211,8 +215,6 @@ export interface ApplicationOptions {
     modules?: CompiledModule[];
     /** Platform-level dependencies (db client etc.), passed to createServices. */
     deps?: Record<string, unknown>;
-    /** Optional Angular-backed root injector used for async request contexts. */
-    injector?: EnvironmentInjector;
     /** Builds the per-request context object. Defaults to { requestId, request }. */
     requestContext?: RequestContextFactory;
     /** Enforces permission/audit/idempotency policy for command-bound routes. */
@@ -248,7 +250,7 @@ export declare const createSupaCloudRequestContext: (request: Request) => SupaCl
 export declare function createCommandExecutor(governance: CommandGovernance, observer?: ExecutionObserver): CommandExecutor;
 /** Execute at the business-selected boundary without binding or re-entering an HTTP route. */
 export declare function executeCompiledCommand<Input, Result>(options: {
-    module: Pick<CompiledModule, "name" | "commands" | "aspects">;
+    module: Pick<CompiledModule, "name" | "commands" | "aspects" | "aspectPipeline">;
     command: string;
     input: Input;
     request: Request;
@@ -282,7 +284,7 @@ export declare function requireIdempotencyKey(invocation: CommandInvocation): st
  * exposed on the `scope` context key. Request-scoped controller instances are
  * looked up on `scope`, everything else on `services`.
  */
-export declare function createModulePlugin(compiled: CompiledModule, services: Record<string, unknown>, ctxFactory?: RequestContextFactory, options?: Pick<ApplicationOptions, "commandGovernance" | "commandExecutor" | "errorMapper" | "onExecution" | "normalize" | "injector">, imported?: Record<string, Record<string, unknown>>): Elysia;
+export declare function createModulePlugin(compiled: CompiledModule, services: Record<string, unknown>, ctxFactory?: RequestContextFactory, options?: Pick<ApplicationOptions, "commandGovernance" | "commandExecutor" | "errorMapper" | "onExecution" | "normalize">, imported?: Record<string, Record<string, unknown>>): Elysia;
 /**
  * Execute one compiler-emitted Job descriptor.
  *

package/dist/index.js

@@ -1,13 +1,24 @@
 // src/index.ts
 import { Elysia as Elysia2 } from "elysia";
-import { CommandError as CommandError2, decodeCommandPreview } from "@supacloud/contracts";
-import {
-  provideToken,
-  runInRequestContext
-} from "@supacloud/app";
-import { REQUEST_CONTEXT } from "@supacloud/app";
+import { decodeCommandPreview } from "@supacloud/contracts";
 
 // src/command-errors.ts
+function commandErrorCode(error) {
+  if (!(error instanceof Error) || error.name !== "CommandError" || !("code" in error))
+    return;
+  switch (error.code) {
+    case "COMMAND_INPUT_INVALID":
+    case "COMMAND_REJECTED":
+    case "COMMAND_IDEMPOTENCY_CONFLICT":
+    case "COMMAND_INPUT_EXPIRED":
+    case "COMMAND_UNAVAILABLE":
+    case "COMMAND_RECEIPT_INVALID":
+    case "COMMAND_OUTCOME_UNKNOWN":
+      return error.code;
+    default:
+      return;
+  }
+}
 function commandErrorStatus(code) {
   switch (code) {
     case "COMMAND_INPUT_INVALID":
@@ -413,7 +424,7 @@ function createPersistentCommandAdapter(command, options) {
     async execute(invocation) {
       try {
         const identity = decodeCommandIdentity(await options.identity(invocation));
-        return await command.execute(identity, requireIdempotencyKey(invocation), options.input(invocation));
+        return await command.execute(identity, requireIdempotencyKey(invocation), options.input(invocation), invocation.request.signal);
       } catch (error) {
         if (!(error instanceof CommandError))
           throw error;
@@ -1269,6 +1280,17 @@ function observedAspects(aspects, boundary, observer) {
     ...executionTrace(context.requestContext)
   }, () => aspect(context, next))));
 }
+function descriptorPipeline(descriptor, boundary, observer) {
+  const pipeline = descriptor.aspectPipeline;
+  if (!pipeline)
+    return observedAspects(descriptor.aspects ?? [], boundary, observer);
+  return (context, next) => pipeline(context, next, observer ? (stage, run) => observeExecution(observer, {
+    kind: context.kind,
+    operation: context.name,
+    stage: `${boundary}.${stage}`,
+    ...executionTrace(context.requestContext)
+  }, run) : undefined);
+}
 function composeCommandExecutors(...executors) {
   const active = executors.filter((e) => typeof e === "function");
   if (active.length === 0)
@@ -1483,7 +1505,7 @@ async function executeCompiledCommand(options) {
     services: options.services ?? {},
     ...options.scope ? { scope: options.scope } : {}
   };
-  const aspects = composeAspects(observedAspects(options.module.aspects ?? [], `module:${options.module.name}`, options.observer), observedAspects(command.aspects ?? [], "command", options.observer));
+  const aspects = composeAspects(descriptorPipeline(options.module, `module:${options.module.name}`, options.observer), descriptorPipeline(command, "command", options.observer));
   const value = await createCommandExecutor(options.governance, options.observer)(invocation, once(() => aspects({
     kind: "command",
     name: command.name,
@@ -1591,6 +1613,43 @@ function assertDeclaredResponseStatus(route, value, configuredStatus) {
   throw new ApplicationError("Response validation failed", { status: 500, code: "RESPONSE_CONTRACT_UNDECLARED" });
 }
 function createModulePlugin(compiled, services, ctxFactory = defaultRequestContext, options = {}, imported = {}) {
+  const supportedMethods = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+  const supportedFields = new Set([
+    "method",
+    "path",
+    "handler",
+    "body",
+    "params",
+    "query",
+    "headers",
+    "cookie",
+    "response",
+    "responses",
+    "contract",
+    "schemaKinds",
+    "nativeResponse",
+    "invoker",
+    "command",
+    "aspects",
+    "aspectPipeline",
+    "paramTransforms",
+    "paramDefaults",
+    "queryTransforms",
+    "queryDefaults",
+    "title",
+    "data",
+    "input",
+    "result",
+    "request"
+  ]);
+  for (const controller of compiled.controllers) {
+    for (const route of controller.routes) {
+      const unsupported = Object.keys(route).filter((field) => !supportedFields.has(field));
+      if (!supportedMethods.has(route.method) || unsupported.length > 0) {
+        throw new ApplicationError(`Unsupported compiled route ${route.method} ${controller.path}${route.path}` + (unsupported.length > 0 ? `: ${unsupported.join(", ")}` : ""), { code: "ROUTE_DESCRIPTOR_UNSUPPORTED" });
+      }
+    }
+  }
   const hasCommandRoutes = compiled.controllers.some((controller) => controller.routes.some((route) => route.command !== undefined));
   if (hasCommandRoutes && !options.commandGovernance && !options.commandExecutor) {
     throw new ApplicationError(`Module "${compiled.name}" has command routes but no commandGovernance`, { code: "COMMAND_GOVERNANCE_UNCONFIGURED" });
@@ -1695,14 +1754,13 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
             services,
             metadata: command ?? route
           };
-          const commandAspects = route.command ? commandsByClassName.get(route.command)?.aspects ?? [] : [];
-          const routePipeline = observedAspects(route.aspects ?? [], "route", options.onExecution);
-          const commandPipeline = observedAspects(commandAspects, "command", options.onExecution);
-          const modulePipeline = observedAspects(compiled.aspects ?? [], `module:${compiled.name}`, options.onExecution);
-          const invokeRoute = () => routePipeline(routeContext, () => route.command ? commandPipeline(commandContext, () => invokeCommand()) : invoke());
+          const routePipeline = descriptorPipeline(route, "route", options.onExecution);
+          const commandPipeline = descriptorPipeline(command ?? {}, "command", options.onExecution);
+          const modulePipeline = descriptorPipeline(compiled, `module:${compiled.name}`, options.onExecution);
+          const invokeRoute = () => modulePipeline(route.command ? commandContext : routeContext, once(() => routePipeline(routeContext, once(() => route.command ? commandPipeline(commandContext, once(invoke)) : invoke()))));
           const invokeCommand = () => {
             if (!route.command)
-              return invoke();
+              return invokeRoute();
             if (!command) {
               throw new ApplicationError(`Command "${route.command}" is not registered`, {
                 code: "COMMAND_NOT_REGISTERED"
@@ -1727,11 +1785,11 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
               operation: command.name,
               stage: "commandExecutor",
               ...executionTrace(requestContext)
-            }, () => commandExecutor(invocation, invoke));
+            }, () => commandExecutor(invocation, once(invokeRoute)));
           };
-          return modulePipeline(route.command ? commandContext : routeContext, invokeRoute);
+          return invokeCommand();
         };
-        const result = options.injector ? await runInRequestContext(options.injector, [provideToken(REQUEST_CONTEXT, requestContext)], execute) : await execute();
+        const result = await execute();
         assertDeclaredResponseStatus(route, result, ctx.set.status);
         return result;
       };
@@ -1794,8 +1852,8 @@ async function executeJob(compiled, services, job, input, requestContext, import
       stage: "handler",
       ...executionTrace(requestContext)
     }, () => Reflect.apply(method, instance, [decodedInput])));
-    const pipeline = observedAspects(compiled.aspects ?? [], `module:${compiled.name}`, observer);
-    const jobPipeline = observedAspects(job.aspects ?? [], "job", observer);
+    const pipeline = descriptorPipeline(compiled, `module:${compiled.name}`, observer);
+    const jobPipeline = descriptorPipeline(job, "job", observer);
     const result = await pipeline(context, () => jobPipeline(context, () => observeExecution(observer, {
       kind: "job",
       operation: job.name,
@@ -1810,9 +1868,10 @@ async function executeJob(compiled, services, job, input, requestContext, import
   }
 }
 function defaultErrorResponse(error, frameworkCode) {
-  if (error instanceof CommandError2) {
-    return Response.json({ ok: false, code: error.code, message: error.code }, {
-      status: commandErrorStatus(error.code)
+  const protocolCode = commandErrorCode(error);
+  if (protocolCode) {
+    return Response.json({ ok: false, code: protocolCode, message: protocolCode }, {
+      status: commandErrorStatus(protocolCode)
     });
   }
   if (isPublicApplicationError(error)) {
@@ -1823,6 +1882,13 @@ function defaultErrorResponse(error, frameworkCode) {
       ...error.details === undefined ? {} : { details: error.details }
     }, { status: error.status });
   }
+  if (frameworkCode === "PARSE") {
+    return Response.json({
+      ok: false,
+      code: "PARSE_ERROR",
+      message: "Request body could not be parsed"
+    }, { status: 400 });
+  }
   if (frameworkCode === "VALIDATION") {
     if (isRecord(error) && error.type === "response") {
       return Response.json({

package/dist/persistent-command.d.ts

@@ -2,7 +2,7 @@ import { type CommandIdentity, type DurableCommandReceipt } from "@supacloud/con
 import { type CommandInvocation } from "./index";
 export interface PersistentCommandHandler<Result> {
     readonly kind: "transactional" | "external";
-    execute(identity: CommandIdentity, key: string, value: unknown): Promise<DurableCommandReceipt<Result>>;
+    execute(identity: CommandIdentity, key: string, value: unknown, signal?: AbortSignal): Promise<DurableCommandReceipt<Result>>;
 }
 /** Registered persistence owns the operation; a second route handler is never invoked. */
 export declare function createPersistentCommandAdapter<Result>(command: PersistentCommandHandler<Result>, options: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/elysia",
-  "version": "0.14.1",
+  "version": "0.17.0",
   "description": "Elysia runtime adapter for SupaCloud compiled modules: application/request scopes, route registration and validation",
   "type": "module",
   "main": "./dist/index.js",
@@ -15,7 +15,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "compatibility.json"
   ],
   "scripts": {
     "generate:example": "bun src/generate-webhook-example.ts",
@@ -25,6 +26,9 @@
     "clean": "rm -rf dist",
     "prepublishOnly": "bun run build",
     "test": "bun test",
+    "test:conformance": "bun test src/conformance.test.ts",
+    "test:runtime-safety": "SUPACLOUD_REQUIRE_RUNTIME_SAFETY=1 bun test src/runtime-safety.test.ts",
+    "test:contract-upgrade": "bun test src/contract-upgrade.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
   },
@@ -48,15 +52,15 @@
   },
   "overrides": {
     "@supacloud/contracts": "0.4.0",
-    "@supacloud/commands": "0.4.0"
+    "@supacloud/commands": "0.5.0"
   },
   "peerDependencies": {
     "elysia": "^1.4.30"
   },
   "devDependencies": {
-    "@supacloud/compiler": "0.19.1",
-    "@supacloud/commands": "0.4.0",
-    "@supacloud/db": "0.7.1",
+    "@supacloud/compiler": "0.22.0",
+    "@supacloud/commands": "0.5.0",
+    "@supacloud/db": "0.8.0",
     "@types/bun": "^1.4.2",
     "elysia": "^1.4.30",
     "typescript": "^7.0.2"