Compatibility and Roadmap

Compatibility and Roadmap

Source of truth: docs/compatibility.md and docs/roadmap.md

Verified matrix

• Runtime: Bun 1.4.x (pinned oracle: 1.4.0) on Linux x86-64, macOS arm64, Windows x64 — per-OS CI runs the full suite on 1.4.0 and 1.4.x.
• TypeScript: 7.0.2 verified; declarations ship as direct .ts sources (no .d.ts fork).
• Validators: Zod 4.4.3 and Valibot 1.4.2 in CI; any Standard Schema v1 validator works. JSON Schema documentation in OpenAPI and Scalar is feature-detected per validator.
• Browsers: the prebuilt lugas/client/browser artifact is verified in a same-origin real-browser lane (Chrome via CDP); real browsers are not part of the per-OS CI matrix.

Known beta limitations: server core and CLI are Bun-only (the client is runtime-neutral); in-flight handler work is not cancelled on client disconnect (except SSE streams, whose cancellation is pinned — see Server-Sent Events).

Feature status

The four M8 batteries below are part of the attested v0.1.0-beta.1 candidate (regenerated through M8-GATE on source commit 3edaae9). See Home for the full table.

Battery	ADR	Evidence
CORS	ADR-0022	docs/reports/issues/M8-001.md
Server-Sent Events	ADR-0023	docs/reports/issues/M8-002.md
Structured logging	ADR-0024	docs/reports/issues/M8-003.md
OpenAPI 3.1 + Scalar	ADR-0025	docs/reports/issues/M8-004.md
Drizzle adapter (lugas/drizzle)	ADR-0026	docs/reports/issues/M9-001.md

Planned (owner-directed post-beta.2 sequence, 2026-09-09)

1. Cookie primitives + auth interoperability — explicit cookie helpers; Better Auth as an integration recipe, never a first-party auth system.
2. WebSockets — typed upgrade guards and shutdown semantics on Bun's native WebSockets.
3. Production hardening — secure headers (no invented strict CSP) and health/readiness helpers over the service lifecycle.
4. Observability and HTTP primitives — multipart with bounded consumption, OpenTelemetry hooks (no SDK dependency), compression/ETag, rate-limit contract (storage app-owned).

First-party non-goals (standing): JWT, password/OAuth/passkey authentication, email, queues, Redis/cron/S3/cache backends, GraphQL, payments, migrations tooling, ORM repository pattern, dependency-injection container. Each battery requires its own issue, ADR, and ODR before implementation.

Integration defaults (as shipped)

Capability	Default
CORS	Disabled unless configured
SSE	Available per route
Access logging	Off unless configured (explicit production policy)
OpenAPI document	Explicitly enabled when configured
Scalar UI	Opt-in; production exposure is an explicit choice
Drizzle	Never initialized implicitly

Release status

v0.1.0-beta.1 is attested but publication is an owner-controlled action and has not happened. The candidate was regenerated through the M8-GATE release integration on source commit 3edaae9: package rehearsal 21/21 (79-entry tarball, sha256 4ffadc34…, reproducible across runs), release gate 0 blocking failures / 0 alerts (117k static / 97k JSON / 62k validated rps), SHA256SUMS re-verified from a separate clean clone, and the 6-cell compatibility matrix green on the artifact commit. Evidence: docs/reports/gates/M8.md and docs/releases/beta/.