@supacloud/elysia 0.16.0 → 0.18.0

package/README.md

@@ -125,9 +125,9 @@ Runtime adapter that turns `@supacloud/compiler` output into a production-ready
   controllers and services.
 - **Request-scope teardown**: invokes the compiler-generated
   `destroyRequestScope` after the response, including when the handler fails.
-- **Angular-backed async DI**: when `createApplication({ injector })` receives
-  an `@supacloud/app` root injector, each request gets an isolated child
-  injector with `REQUEST_CONTEXT`, including across `await` boundaries.
+- **Compile-time DI**: constructor dependencies are directly connected by generated
+  factories. Request/job context is passed explicitly without runtime injector
+  discovery, registration or token lookup.
 - **TypeBox schema binding**: attaches compiled parameter, query, body, headers,
   cookie, single-response and status-map TypeBox schemas directly to Elysia
   route definitions; Elysia performs request validation and normalization.
@@ -205,10 +205,11 @@ GraphQL endpoint serves a local, role-scoped snapshot only; it does not enable
 server introspection or create a GraphQL resolver layer. Protect or omit these
 routes in production when the schema is not public.
 
-The root injector is normally created and owned by `bootstrapBun`. The Elysia
-adapter does not take ownership of an injected root injector; stop it from the
-same Bun bootstrap that created it. Existing applications may omit `injector`
-and continue using compiler-generated request scopes unchanged.
+Use constructor injection and the generated `createServices`,
+`createRequestScope` and `createJobScope` factories. Compiled applications reject
+property `inject()` and runtime injection contexts with `SC2012`. The host provides
+platform dependencies through `deps` and owns their lifecycle; generated factories
+own application scope construction and teardown.
 
 For deterministic local verification, use the in-memory sandbox. It supplies
 stable request identity, an isolated key-value database with optimistic

package/dist/fixtures/webhook-generated/application.d.ts

@@ -33,6 +33,7 @@ export interface CompiledRoute {
     title?: string;
     data?: Record<string, unknown>;
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
     invoker?: (controller: unknown, request: {
         params?: Record<string, unknown>;
         query?: Record<string, unknown>;
@@ -52,6 +53,7 @@ export interface CompiledCommand {
     idempotency: "required" | "none";
     standalone?: boolean;
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
 export interface CompiledJob {
     className: string;
@@ -65,6 +67,7 @@ export interface CompiledJob {
     maxAttempts?: number;
     idempotency?: "required" | "none";
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
 export interface CompiledAspectContext {
     kind: "route" | "command" | "job";
@@ -94,7 +97,11 @@ export interface CompiledModule {
     commands: CompiledCommand[];
     jobs: CompiledJob[];
     aspects?: CompiledAspect[];
+    aspectPipeline?: CompiledAspectPipeline;
 }
+type CompiledAspectObserver = (stage: string, run: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
+type CompiledAspectPipeline = (context: CompiledAspectContext, next: () => unknown | Promise<unknown>, observe?: CompiledAspectObserver) => unknown | Promise<unknown>;
 export declare function createCompiledModules(): CompiledModule[];
 export declare function initializeApplication(services: Record<string, unknown>): Promise<void>;
 export declare function destroyApplication(services: Record<string, unknown>): Promise<void>;
+export {};

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from "elysia";
+import type { CommandRuntimeAudit, CommandRuntimeAuthorizer, CommandRuntimeGovernance, CommandRuntimeInvocation, CommandRuntimeMiddleware } from "@supacloud/app";
 import { type CommandPreview } from "@supacloud/contracts";
-import { type EnvironmentInjector } from "@supacloud/app";
 import { type ExecutionObserver } from "./execution";
 import { type ApplicationDocumentationOptions } from "./documentation";
 export type { ExecutionEvent, ExecutionObserver } from "./execution";
@@ -46,6 +46,7 @@ export interface CompiledRoute {
     command?: string;
     /** Statically generated route aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledCommand {
     rpc?: string;
@@ -57,6 +58,7 @@ export interface CompiledCommand {
     idempotency?: "required" | "none" | string;
     /** Statically generated command aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledJob {
     className: string;
@@ -72,6 +74,7 @@ export interface CompiledJob {
     maxAttempts?: number;
     idempotency?: "required" | "none";
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export interface CompiledController {
     /** Controller path prefix, e.g. "/cases". */
@@ -93,6 +96,7 @@ export interface CompiledModule {
     jobs?: CompiledJob[];
     /** Statically generated module aspects. */
     aspects?: ApplicationAspect[];
+    aspectPipeline?: ApplicationAspectPipeline;
 }
 export type RequestContextFactory = (request: Request) => unknown | Promise<unknown>;
 export { createSupAuthRequestContext } from "./identity";
@@ -113,19 +117,8 @@ export interface SupaCloudRequestContext {
     identity: TrustedRequestIdentity;
     idempotencyKey?: string;
 }
-export interface CommandInvocation {
-    command: CompiledCommand;
-    input: {
-        body: unknown;
-        params: Record<string, unknown>;
-        query: Record<string, unknown>;
-    };
-    request: Request;
-    requestContext: unknown;
-    scope?: Record<string, unknown>;
-    services: Record<string, unknown>;
-}
-export type CommandExecutor = (invocation: CommandInvocation, next: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
+export type CommandInvocation = CommandRuntimeInvocation<CompiledCommand>;
+export type CommandExecutor = CommandRuntimeMiddleware<CommandInvocation>;
 export { assertFeatureTransition } from "./feature";
 export type { FeatureTransitionSpec } from "./feature";
 export interface ApplicationAspectContext {
@@ -145,28 +138,49 @@ export type ApplicationAspect = (context: ApplicationAspectContext, next: () =>
  * registers aspects.
  */
 export declare function composeAspects(...aspects: (ApplicationAspect | undefined | null)[]): ApplicationAspect;
-export type CommandAuthorizer = (invocation: CommandInvocation) => void | Promise<void>;
-export type CommandMiddleware = (invocation: CommandInvocation, next: () => unknown | Promise<unknown>) => unknown | Promise<unknown>;
-export interface CommandAudit {
-    succeeded(invocation: CommandInvocation, result: unknown): void | Promise<void>;
-    failed(invocation: CommandInvocation, error: unknown): void | Promise<void>;
+export type ApplicationAspectPipeline = (context: ApplicationAspectContext, next: () => unknown | Promise<unknown>, observe?: (stage: string, run: () => unknown | Promise<unknown>) => unknown | Promise<unknown>) => unknown | Promise<unknown>;
+export type CommandAuthorizer = CommandRuntimeAuthorizer<CommandInvocation>;
+export type CommandMiddleware = CommandRuntimeMiddleware<CommandInvocation>;
+export type CommandAudit = CommandRuntimeAudit<CommandInvocation>;
+export type CommandGovernance = CommandRuntimeGovernance<CommandInvocation>;
+export interface CommandAuthorizationRequest {
+    readonly principal: {
+        readonly kind: "user" | "service";
+        readonly issuer: string;
+        readonly subject: string;
+    };
+    readonly applicationId: string;
+    readonly domain: {
+        readonly type: string;
+        readonly id: string;
+    };
+}
+export interface CommandAuthorizationContext {
+    readonly applicationId: string;
+    readonly permissions: readonly string[];
+    readonly permissionCatalogVersion?: string;
+    readonly permissionCatalogDigest?: string;
+}
+export interface CommandAuthorizationCatalog {
+    readonly version: string;
+    readonly digest?: string;
 }
-export interface CommandGovernance {
-    /** Application-owned adapters: a single RPC owns all declared persistence. */
-    rpc?: Record<string, {
-        capabilities: {
-            audit?: boolean;
-            transaction?: boolean;
-            idempotency?: boolean;
-            boundary?: "database" | "external";
-        };
-        execute: CommandMiddleware;
-    }>;
-    authorize: CommandAuthorizer;
-    idempotency?: CommandMiddleware;
-    transaction?: CommandMiddleware;
-    audit?: CommandAudit;
+export interface CommandAuthorizationAdapterOptions {
+    readonly applicationId: string;
+    readonly issuer: string;
+    readonly domain: (invocation: CommandInvocation) => {
+        readonly type: string;
+        readonly id: string;
+    };
+    readonly resolve: (request: CommandAuthorizationRequest) => Promise<CommandAuthorizationContext>;
+    readonly catalog?: CommandAuthorizationCatalog;
 }
+/**
+ * Adapt a SupAuth-style resolver to the standard command governance port.
+ * The resolver remains the authorization source of truth; this adapter only
+ * maps trusted request identity and normalizes public failure statuses.
+ */
+export declare function createCommandAuthorizationAdapter(options: CommandAuthorizationAdapterOptions): CommandAuthorizer;
 /**
  * Compose multiple CommandExecutors into a single onion-style pipeline.
  * Outer executors run first before calling `next()`, and complete last.
@@ -211,8 +225,6 @@ export interface ApplicationOptions {
     modules?: CompiledModule[];
     /** Platform-level dependencies (db client etc.), passed to createServices. */
     deps?: Record<string, unknown>;
-    /** Optional Angular-backed root injector used for async request contexts. */
-    injector?: EnvironmentInjector;
     /** Builds the per-request context object. Defaults to { requestId, request }. */
     requestContext?: RequestContextFactory;
     /** Enforces permission/audit/idempotency policy for command-bound routes. */
@@ -248,7 +260,7 @@ export declare const createSupaCloudRequestContext: (request: Request) => SupaCl
 export declare function createCommandExecutor(governance: CommandGovernance, observer?: ExecutionObserver): CommandExecutor;
 /** Execute at the business-selected boundary without binding or re-entering an HTTP route. */
 export declare function executeCompiledCommand<Input, Result>(options: {
-    module: Pick<CompiledModule, "name" | "commands" | "aspects">;
+    module: Pick<CompiledModule, "name" | "commands" | "aspects" | "aspectPipeline">;
     command: string;
     input: Input;
     request: Request;
@@ -282,7 +294,7 @@ export declare function requireIdempotencyKey(invocation: CommandInvocation): st
  * exposed on the `scope` context key. Request-scoped controller instances are
  * looked up on `scope`, everything else on `services`.
  */
-export declare function createModulePlugin(compiled: CompiledModule, services: Record<string, unknown>, ctxFactory?: RequestContextFactory, options?: Pick<ApplicationOptions, "commandGovernance" | "commandExecutor" | "errorMapper" | "onExecution" | "normalize" | "injector">, imported?: Record<string, Record<string, unknown>>): Elysia;
+export declare function createModulePlugin(compiled: CompiledModule, services: Record<string, unknown>, ctxFactory?: RequestContextFactory, options?: Pick<ApplicationOptions, "commandGovernance" | "commandExecutor" | "errorMapper" | "onExecution" | "normalize">, imported?: Record<string, Record<string, unknown>>): Elysia;
 /**
  * Execute one compiler-emitted Job descriptor.
  *

package/dist/index.js

@@ -1,11 +1,6 @@
 // src/index.ts
 import { Elysia as Elysia2 } from "elysia";
 import { decodeCommandPreview } from "@supacloud/contracts";
-import {
-  provideToken,
-  runInRequestContext
-} from "@supacloud/app";
-import { REQUEST_CONTEXT } from "@supacloud/app";
 
 // src/command-errors.ts
 function commandErrorCode(error) {
@@ -429,7 +424,7 @@ function createPersistentCommandAdapter(command, options) {
     async execute(invocation) {
       try {
         const identity = decodeCommandIdentity(await options.identity(invocation));
-        return await command.execute(identity, requireIdempotencyKey(invocation), options.input(invocation));
+        return await command.execute(identity, requireIdempotencyKey(invocation), options.input(invocation), invocation.request.signal);
       } catch (error) {
         if (!(error instanceof CommandError))
           throw error;
@@ -1285,6 +1280,53 @@ function observedAspects(aspects, boundary, observer) {
     ...executionTrace(context.requestContext)
   }, () => aspect(context, next))));
 }
+function descriptorPipeline(descriptor, boundary, observer) {
+  const pipeline = descriptor.aspectPipeline;
+  if (!pipeline)
+    return observedAspects(descriptor.aspects ?? [], boundary, observer);
+  return (context, next) => pipeline(context, next, observer ? (stage, run) => observeExecution(observer, {
+    kind: context.kind,
+    operation: context.name,
+    stage: `${boundary}.${stage}`,
+    ...executionTrace(context.requestContext)
+  }, run) : undefined);
+}
+function createCommandAuthorizationAdapter(options) {
+  return async (invocation) => {
+    const permission = invocation.command.permission;
+    if (!permission || !/^[a-z][a-z0-9._-]*:[a-z][a-z0-9._-]*$/.test(permission)) {
+      throw new ApplicationError("Command permission must use resource:action syntax", {
+        status: 500,
+        code: "COMMAND_PERMISSION_INVALID"
+      });
+    }
+    const context = invocation.requestContext;
+    const identity = isRecord(context) && isTrustedIdentity(context.identity) ? context.identity : undefined;
+    if (!isAuthenticatedTrustedIdentity(identity)) {
+      throw new ApplicationError("Authentication required", { status: 401, code: "AUTHENTICATION_REQUIRED" });
+    }
+    const request = {
+      principal: { kind: "user", issuer: options.issuer, subject: identity.subject },
+      applicationId: options.applicationId,
+      domain: options.domain(invocation)
+    };
+    let resolved;
+    try {
+      resolved = await options.resolve(request);
+    } catch {
+      throw new ApplicationError("Authorization is unavailable", { status: 503, code: "AUTHORIZATION_UNAVAILABLE" });
+    }
+    if (!isRecord(resolved) || !Array.isArray(resolved.permissions) || !resolved.permissions.every((value) => typeof value === "string") || resolved.permissionCatalogVersion !== undefined && typeof resolved.permissionCatalogVersion !== "string" || resolved.permissionCatalogDigest !== undefined && typeof resolved.permissionCatalogDigest !== "string" || resolved.applicationId !== options.applicationId || options.catalog !== undefined && (resolved.permissionCatalogVersion !== options.catalog.version || options.catalog.digest !== undefined && resolved.permissionCatalogDigest !== options.catalog.digest)) {
+      throw new ApplicationError("Authorization context is not bound to this application", {
+        status: 503,
+        code: "AUTHORIZATION_CONTEXT_INVALID"
+      });
+    }
+    if (!resolved.permissions.includes(permission)) {
+      throw new ApplicationError("Permission denied", { status: 403, code: "PERMISSION_DENIED" });
+    }
+  };
+}
 function composeCommandExecutors(...executors) {
   const active = executors.filter((e) => typeof e === "function");
   if (active.length === 0)
@@ -1499,7 +1541,7 @@ async function executeCompiledCommand(options) {
     services: options.services ?? {},
     ...options.scope ? { scope: options.scope } : {}
   };
-  const aspects = composeAspects(observedAspects(options.module.aspects ?? [], `module:${options.module.name}`, options.observer), observedAspects(command.aspects ?? [], "command", options.observer));
+  const aspects = composeAspects(descriptorPipeline(options.module, `module:${options.module.name}`, options.observer), descriptorPipeline(command, "command", options.observer));
   const value = await createCommandExecutor(options.governance, options.observer)(invocation, once(() => aspects({
     kind: "command",
     name: command.name,
@@ -1579,6 +1621,67 @@ function requireIdempotencyKey(invocation) {
   }
   return key;
 }
+function assertCommandGovernanceReady(compiled, governance, executor) {
+  if ((compiled.commands ?? []).length === 0)
+    return;
+  if (executor !== undefined && typeof executor !== "function") {
+    throw new ApplicationError(`Module "${compiled.name}" has no callable command executor`, {
+      code: "COMMAND_EXECUTOR_UNCONFIGURED"
+    });
+  }
+  if (!governance && !executor) {
+    throw new ApplicationError(`Module "${compiled.name}" has commands but no command governance`, {
+      code: "COMMAND_GOVERNANCE_UNCONFIGURED"
+    });
+  }
+  if (!governance)
+    return;
+  if (typeof governance.authorize !== "function") {
+    throw new ApplicationError(`Module "${compiled.name}" has no authorization adapter`, {
+      code: "COMMAND_AUTHORIZATION_UNCONFIGURED"
+    });
+  }
+  for (const command of compiled.commands ?? []) {
+    if (command.audit && command.rpc === undefined && (typeof governance.audit?.succeeded !== "function" || typeof governance.audit?.failed !== "function")) {
+      throw new ApplicationError(`Command "${command.name}" has no audit adapter`, {
+        code: "COMMAND_AUDIT_UNCONFIGURED"
+      });
+    }
+    if (command.idempotency === "required" && typeof governance.idempotency !== "function" && command.rpc === undefined) {
+      throw new ApplicationError(`Command "${command.name}" has no idempotency adapter`, {
+        code: "COMMAND_IDEMPOTENCY_UNCONFIGURED"
+      });
+    }
+    if (command.transaction === "required" && typeof governance.transaction !== "function" && command.rpc === undefined) {
+      throw new ApplicationError(`Command "${command.name}" has no transaction adapter`, {
+        code: "COMMAND_TRANSACTION_UNCONFIGURED"
+      });
+    }
+    if (command.rpc !== undefined) {
+      const adapter = Object.hasOwn(governance.rpc ?? {}, command.rpc) ? governance.rpc?.[command.rpc] : undefined;
+      if (!adapter || typeof adapter.execute !== "function" || !isRecord(adapter.capabilities)) {
+        throw new ApplicationError(`Command "${command.name}" has no RPC governance adapter`, {
+          code: "COMMAND_RPC_UNCONFIGURED"
+        });
+      }
+      if (command.audit && adapter.capabilities.audit !== true) {
+        throw new ApplicationError(`Command "${command.name}" RPC adapter has no audit capability`, {
+          code: "COMMAND_AUDIT_UNCONFIGURED"
+        });
+      }
+      if (command.idempotency === "required" && adapter.capabilities.idempotency !== true) {
+        throw new ApplicationError(`Command "${command.name}" RPC adapter has no idempotency capability`, {
+          code: "COMMAND_IDEMPOTENCY_UNCONFIGURED"
+        });
+      }
+      if (command.transaction === "required" && adapter.capabilities.transaction !== true) {
+        throw new ApplicationError(`Command "${command.name}" RPC adapter has no transaction capability`, {
+          code: "COMMAND_TRANSACTION_UNCONFIGURED"
+        });
+      }
+    }
+  }
+}
 function joinPaths(prefix, path) {
   const joined = `${prefix}/${path}`.replace(/\/{2,}/g, "/");
   return joined.length > 1 ? joined.replace(/\/+$/, "") : joined;
@@ -1625,6 +1728,7 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
     "invoker",
     "command",
     "aspects",
+    "aspectPipeline",
     "paramTransforms",
     "paramDefaults",
     "queryTransforms",
@@ -1647,6 +1751,7 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
   if (hasCommandRoutes && !options.commandGovernance && !options.commandExecutor) {
     throw new ApplicationError(`Module "${compiled.name}" has command routes but no commandGovernance`, { code: "COMMAND_GOVERNANCE_UNCONFIGURED" });
   }
+  assertCommandGovernanceReady(compiled, options.commandGovernance, options.commandExecutor);
   const commandsByClassName = new Map((compiled.commands ?? []).map((command) => [command.className, command]));
   for (const controller of compiled.controllers) {
     for (const route of controller.routes) {
@@ -1747,14 +1852,13 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
             services,
             metadata: command ?? route
           };
-          const commandAspects = route.command ? commandsByClassName.get(route.command)?.aspects ?? [] : [];
-          const routePipeline = observedAspects(route.aspects ?? [], "route", options.onExecution);
-          const commandPipeline = observedAspects(commandAspects, "command", options.onExecution);
-          const modulePipeline = observedAspects(compiled.aspects ?? [], `module:${compiled.name}`, options.onExecution);
-          const invokeRoute = () => routePipeline(routeContext, () => route.command ? commandPipeline(commandContext, () => invokeCommand()) : invoke());
+          const routePipeline = descriptorPipeline(route, "route", options.onExecution);
+          const commandPipeline = descriptorPipeline(command ?? {}, "command", options.onExecution);
+          const modulePipeline = descriptorPipeline(compiled, `module:${compiled.name}`, options.onExecution);
+          const invokeRoute = () => modulePipeline(route.command ? commandContext : routeContext, once(() => routePipeline(routeContext, once(() => route.command ? commandPipeline(commandContext, once(invoke)) : invoke()))));
           const invokeCommand = () => {
             if (!route.command)
-              return invoke();
+              return invokeRoute();
             if (!command) {
               throw new ApplicationError(`Command "${route.command}" is not registered`, {
                 code: "COMMAND_NOT_REGISTERED"
@@ -1779,11 +1883,11 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
               operation: command.name,
               stage: "commandExecutor",
               ...executionTrace(requestContext)
-            }, () => commandExecutor(invocation, invoke));
+            }, () => commandExecutor(invocation, once(invokeRoute)));
           };
-          return modulePipeline(route.command ? commandContext : routeContext, invokeRoute);
+          return invokeCommand();
         };
-        const result = options.injector ? await runInRequestContext(options.injector, [provideToken(REQUEST_CONTEXT, requestContext)], execute) : await execute();
+        const result = await execute();
         assertDeclaredResponseStatus(route, result, ctx.set.status);
         return result;
       };
@@ -1846,8 +1950,8 @@ async function executeJob(compiled, services, job, input, requestContext, import
       stage: "handler",
       ...executionTrace(requestContext)
     }, () => Reflect.apply(method, instance, [decodedInput])));
-    const pipeline = observedAspects(compiled.aspects ?? [], `module:${compiled.name}`, observer);
-    const jobPipeline = observedAspects(job.aspects ?? [], "job", observer);
+    const pipeline = descriptorPipeline(compiled, `module:${compiled.name}`, observer);
+    const jobPipeline = descriptorPipeline(job, "job", observer);
     const result = await pipeline(context, () => jobPipeline(context, () => observeExecution(observer, {
       kind: "job",
       operation: job.name,
@@ -1947,6 +2051,7 @@ export {
   composeAspects,
   composeCommandExecutors,
   createApplication,
+  createCommandAuthorizationAdapter,
   createCommandExecutor,
   createDocumentationPlugin,
   createMemoryPolicy,

package/dist/persistent-command.d.ts

@@ -2,7 +2,7 @@ import { type CommandIdentity, type DurableCommandReceipt } from "@supacloud/con
 import { type CommandInvocation } from "./index";
 export interface PersistentCommandHandler<Result> {
     readonly kind: "transactional" | "external";
-    execute(identity: CommandIdentity, key: string, value: unknown): Promise<DurableCommandReceipt<Result>>;
+    execute(identity: CommandIdentity, key: string, value: unknown, signal?: AbortSignal): Promise<DurableCommandReceipt<Result>>;
 }
 /** Registered persistence owns the operation; a second route handler is never invoked. */
 export declare function createPersistentCommandAdapter<Result>(command: PersistentCommandHandler<Result>, options: {

package/dist/webhook-migration-example.d.ts

@@ -1,7 +1,16 @@
-import type { CommandAuthorization, CommandIdentity } from "@supacloud/contracts";
+import { type CommandAuthorization, type CommandIdentity } from "@supacloud/contracts";
 import { type CommandDatabase, type CommandTransaction } from "@supacloud/db";
+import { type CommandExecutor } from "./index";
 export { decodeWebhookInput } from "./fixtures/webhook/contracts";
 export declare const WEBHOOK_EXAMPLE_SQL = "CREATE TABLE IF NOT EXISTS public.webhook_module_example (\n  tenant_id text NOT NULL, id text NOT NULL, enabled boolean NOT NULL,\n  writes integer NOT NULL DEFAULT 0, PRIMARY KEY (tenant_id,id)\n);";
+/**
+ * Register the existing native command boundary, not a pass-through executor.
+ * Controllers still call their generated UpdateWebhook service directly. Any
+ * explicit command invocation delegates to that same service, which owns
+ * authorization, durable receipts, transactions and audit. Never run a second
+ * route continuation or construct another command runtime here.
+ */
+export declare const executeWebhookCommand: CommandExecutor;
 /** Composition only; the compiler generates factories and routes from the real module. */
 export declare function createWebhookMigrationExample(options: {
     database: CommandDatabase;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/elysia",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Elysia runtime adapter for SupaCloud compiled modules: application/request scopes, route registration and validation",
   "type": "module",
   "main": "./dist/index.js",
@@ -46,21 +46,21 @@
     "directory": "packages/elysia"
   },
   "dependencies": {
-    "@supacloud/app": "0.14.0",
+    "@supacloud/app": "0.15.0",
     "@supacloud/contracts": "0.4.0",
     "jose": "^6.2.11"
   },
   "overrides": {
     "@supacloud/contracts": "0.4.0",
-    "@supacloud/commands": "0.4.0"
+    "@supacloud/commands": "0.5.0"
   },
   "peerDependencies": {
     "elysia": "^1.4.30"
   },
   "devDependencies": {
-    "@supacloud/compiler": "0.21.0",
-    "@supacloud/commands": "0.4.0",
-    "@supacloud/db": "0.7.1",
+    "@supacloud/compiler": "0.23.0",
+    "@supacloud/commands": "0.5.0",
+    "@supacloud/db": "0.8.0",
     "@types/bun": "^1.4.2",
     "elysia": "^1.4.30",
     "typescript": "^7.0.2"