Jadpo is experimental and not ready for production. These docs follow the compiler's main branch as of 5 Nov 2026. What's built · Install 0.3.0
jadpo

What's built

Jadpo's specification covers the whole language. This page shows how much of it the compiler does today. Each table below comes from the "What is built" section of that part of the specification, from Jadpo's main branch at aee2e8f (5 Nov 2026), version 0.3.0. If you use something that isn't built, the compiler reports toolchain.not_built_yet.

What comes next, in order, is on the roadmap.

Project layout and modulesRead about it

The compiler builds this layout, with each rule's real output under Errors.

State Feature Status
partly Root, domains and their folders Partly built: a file where the layout has no place for it is layout.unknown_location, and a declaration in the wrong folder layout.wrong_folder; a folder or file with no app.jadpo above it is checked as loose files. A domain created needs an acceptance. Not built yet: jadpo domain rename, split and merge; the documents capability, so a file in documents/ is layout.unknown_location until it is.
built Files and names Built: one primary declaration per file, named after it; names unique project-wide; the round-trip and folded-collision rules, with the exception for a type folding to its callable's name.
partly Names per domain Partly built: private functions and types unique only within their domain, each domain's code reading its own; their identity keys carrying the domain, with promotion to shared/ writing a registry line; semantic.duplicate_declaration saying copy or clash and listing the names in use with the same words. jadpo rename is not built yet (Commands for looking into and changing code).
built Order independence Built: declaration and file order never matter.
built Domains, public and calls Built: owner-qualified calls and per-declaration public, with visibility.private_cross_domain, visibility.public_not_allowed and visibility.public_unused.
built Reserved words Built: a reserved word names only a field or an enum variant (Names from reserved words).
built Comments Built: // and /// documentation comments.
partly Similar helpers Partly built: library.similar_exists, a declinable error. Not built yet: jadpo impact.
partly Declinable errors Partly built: no warning severity; the decline <rule>: "<reason>" line with decline.unused, decline.not_declinable and decline.no_reason; the catalogue's security rules, whose decline needs an acceptance; jadpo declines list and clear; the editor's "Decline with a reason" and "Remove decline"; and the date rule for an expired feature flag, flag.expired, judged at today by check and at the commit's date by build. jadpo approval lists them (Review and records).
built Constants Built: constant as a reserved word and a declaration placed and shared as helper functions are, a private one unique within its domain, constant.similar_exists, and a top-level var pointed at constant (Constants).
built Imports Built: use <folder> { Names } and use <domain>, with import.missing, import.unknown, import.unused, import.unneeded and import.duplicate; jadpo fmt adds, removes and sorts imports, jadpo fmt --layout makes promotion moves, and go to definition works from every use of a name, a use line's included.
built A file holds only what its primary declaration uses Built: layout.unused_declaration for a supporting declaration the primary declaration doesn't use, directly or through one another.
built Definition before use Built: jadpo fmt writes each file's declarations before the first one that uses them, and jadpo fmt --check fails on a file out of that order.
not built Referenced assets Not built yet: layout.asset_unreferenced waits for the ways External services and Built-in services refer to files that aren't Jadpo.
built Jadpo version Built: application { jadpo: "X.Y" }, with toolchain.version_newer refusing a project on a later line, toolchain.version_older one on an earlier line, each naming the release to install, and toolchain.version_invalid; the installed jadpo runs the release the line or jadpo.lock's pin names (Which jadpo runs). jadpo new writes the line of the jadpo that ran it.
partly application { }'s sections Partly built: the one list of sections (What application { } holds), semantic.application_section_unknown for any other, with the edit to the section a near miss meant. Not built yet: the seven more it names, each toolchain.not_built_yet where it is written.
built Packages Built: the root packages/ and jadpo.lock, shared/providers/, packages checked as shared/ is, use packages/<name>, and the reachable-from-public rule (visibility.public_reaches_private) in domains and packages; External services records the choices.

Values and typesRead about it

State Feature Status
built Everything else on this page Built.
not built A map literal with entries Not built yet: it is not designed yet.
not built FileUpload, UploadSlot, OAuthGrant, AnyObject and the Document base Not built yet: each comes with the features that use it.
not built jadpo inspect, showing a built type's final fields and where each came from Not built yet. Hover shows them.
partly BatchRun, BatchProgress, RowProblem, ImportSummary, ExportSummary, File and FileContents Partly built: only the runtime builds one. A program reads the batch types' fields, and an entity field keeps a BatchRun or a File as its JSON; a program reads no part of a File or a FileContents, which is type.field_on_non_record.

LogicRead about it

State Feature Status
built Everything on this page, Constants included Built: every example on this page and every error's example is checked against the compiler on each gate run.

FailuresRead about it

State Feature Status
built Declaring failures, kinds and codes Built, with the checks under Errors.
built fails, reject, attempt and handling in match Built.
built Mapping Built: a construction's rule arms and invalid:, proof that a construction cannot break, a query's missing: and writes' conflict: and empty:, each with its kind check.
built Faults from code Built: Int and Decimal overflow and the recursion limit are faults at their site, and a failure keeps the path it travelled and the failure it was mapped from.
built What the client sees Built: the envelope, the validation details and the OpenAPI responses.
built Concealing records Built: a record policy hides reports the code's own not-found failure, and its log says concealed_by: policy.
not built Logging Not built yet.

Standard libraryRead about it

State Feature Status
built Everything on this page not listed below Built
not built What keys held as data allow: crypto.verify_totp and HS256 in crypto.verify_jwt Not built yet
not built A type.standard_exists or type.standard_clash swap of a type already stored or on the wire, and jadpo rename Not built yet: a swap waits on Review and records, jadpo rename on Tools
not built A query comparing or ordering by an amount of money, a one-step update working one out, a backfill of a new required one, and a condition on a JSON-held field Not built yet: toolchain.not_built_yet names each
not built The UK modulus check in BankAccount Not built yet: waits on Vocalink's permission to ship its tables
not built Checking UnLocode, IataAirport, IcaoAirport, IataAirline and Icd10Code against their lists Not built yet: waits on licences that allow shipping the lists
not built Policy's scopes narrowing OAuthScope Not built yet: waits on Policy
not built Legacy encodings in the file readers Not built yet: waits on an application that needs one
not built jadpo replay, and a calendar file's writer Not built yet: jadpo replay waits on Debugging, a calendar file's writer on an application that needs one
not built What Personal data does with each standard type's personal data category Not built yet: waits on Personal data
partly The rest of geospatial and AI Partly built: What is built: Geospatial and What is built: AI say which parts

Entities, stores and migrationsRead about it

Each feature not built yet is toolchain.not_built_yet where it is used.

State Feature Status
built Entities, their fields, references, unique rules, indexes and stores Built.
built Migrations, computed backfills and the test database Built.
partly PostgreSQL over TLS and through Hyperdrive Partly built: both connect. Not built yet: checking a Hyperdrive configuration's caching on a real deploy.
not built D1, and actions on it as reads first and one checked batch of writes Not built yet.
built Lifecycles Built.
partly Structured values stored as JSON, and their migrations Partly built: each is stored whole, read back and migrated. Not built yet: conditions on them, a unique: or index over them, and an update by id that works one out in the database.
built The check of every stored value on read Built.
not built CHECK constraints holding fields' rules in the database Not built yet.
partly Standard types stored in named columns, and the standard collections Partly built: each is stored and read back. Not built yet: comparing or ordering by them in a query.
built Manifest nodes Built: a node for each entity's placement, unique rule, index and reference, with references edges between entities, one for each system table and migration snapshot, and one for each lifecycle and transition (lifecycle Todo, transition Todo.delete, with its when:, whether it can refuse a record and the fields it sets).
built Removing data Built: retiring a field or an entity, moving an entity to another store and --drop, each needing its acceptance (Removing data). Copying an entity's records to its new store is yours to do.
not built Other schema changes in jadpo migrate new Not built yet: a new pattern: on a stored field, and other column type changes. Turning encrypted: on or off is refused for good: it needs a data migration (Encrypted fields).
not built A worked-out backfill for a field that allows less Not built yet.
not built A backfill in Jadpo that fills a value held in several columns, or reads a field held so or as JSON Not built yet.
not built Entities in Redis and record caches (caches:) Not built yet. Clearing only the cached entries a change affects isn't designed yet.
not built Index kinds other than geographic and HNSW Not built yet.
not built A database implied only when something needs one Not built yet: it comes with the first feature that can run without one.
built Seeds and jadpo seed Built.
not built jadpo rename Not built yet: it writes the identity registry (Tools).

Reads and writesRead about it

State Feature Status
built Everything else on this page Built.
not built Reading another store outside an action's transaction Not built yet: it is toolchain.not_built_yet ("One store per action").
not built Caches and entities in Redis Not built yet: there is no Redis driver ("Where a read comes from", "Entities in Redis").
not built Comparing money, ranges and fields kept as JSON in a query Not built yet: a field of money or a range, or one kept whole as its JSON (an object, a list, a set, a map or an enum with data), isn't compared in a query, its operations included (toolchain.not_built_yet), though list.count of a list would otherwise have a form ("Operations in conditions").

Personal dataRead about it

State Feature Status
partly personal: PersonalData.<category> on an entity's, an event's or an email's field, or an object's, input's or output's a package declares Partly built: it is read and checked against the fourteen categories for the AI page's check of what reaches a model and for where personal data goes, and a marked field on an entity erasure never reaches is data.personal_unreachable. On an app's own object, input or output it is type.unknown_setting. Not built yet: the rest of what this page says marking does. A marked field nothing reads compiles without an error, and no log or access record uses the marking.
built person: true Built: an entity marked person: true is a person, and every record that refers to one directly belongs to them. The build's manifest shows each person under its entity as a person node, listing the references its records belong through (through) and the fields erasure keeps of their record (retained).
partly retention: on a field or an entity Partly built. Built: the entity's hourly purge schedule clears a nullable field's value, or deletes the record with what cascades from it and the sign-in state of everyone it deletes who signs in, cascades included, at the first run once since: is longer ago than after:, a Duration setting; a File's bytes go once no record holds it (Files); each problem under Retention is an error where it is written. The graph holds a retention node for each, under its field or entity, with its period and since:. Not built yet: retention: on an event's or an email's field, toolchain.not_built_yet where it is written.
partly erase: on a reference or the person's own field Partly built: each problem under Erasure and "Erasure is complete" is an error where it is written. Not built yet: a reference to a person from another store, which stays data.reference_across_stores until a generated subscriber can apply it.
built include_erased: on a query Built: it finds the people erasure keeps a record of too, and is held to what they keep.
partly User.erase(id) Partly built. Built: for a caller with delete on the person's record, one statement deletes the record, hidden or not, with the sign-in state of anyone it deletes who signs in, and deletes, anonymises or keeps each record of theirs as its reference says, however deep, records with a lifecycle removed outright. A record that belongs to several people keeps its marked fields until the last of them is erased, and another person's own record loses only the reference (Records that belong to several people). The person's own record stays field by field, hidden, where one of their fields says so (The person's own record). The bytes of each File it deletes or clears go once it commits (Files), and an audited record it deletes takes its history with it. Not built yet: one that would keep an audited record, whose history still refers to the person (Audit trail), toolchain.not_built_yet where erase is called, so no erasure is ever partial; and records in another store, PersonErased, the erasure log and providers' erasure, which nothing emits or calls.
not built User.export(id) Not built yet: it is toolchain.not_built_yet where it is called.
not built privacy: in application { } Not built yet: it is toolchain.not_built_yet where it is written. Nor is jadpo privacy requests, which lists the requests it starts.
built Encrypted fields Built: encrypted: true, key-type, TotpSecret and SecretText fields, sealed on write and opened on read, interpreted, compiled and on Workers; each refusal above; rotation through _PREVIOUS, with field_encryption.reseal and jadpo config rotation.
partly The personal-data report Partly built: jadpo check writes build/report/personal-data.md and .json, for a project with no errors, listing where personal data goes, and jadpo package check shows the same for a package. Each connection says whether its copy is erased or kept for an accepted reason, and the approval review shows its difference from the before side's, a connection at a time. Not built yet: the rest of its list, each person entity's fields, category, store and readers, the queries that say include_erased: true, retention, what erasure does, keys in the outbox, step records and OAuth grants.
partly erasure: on a package and on a connection Partly built. Built: each is read and checked, and a connection that receives personal data and can't erase it needs an ErasureNotPossible acceptance (Erasure at providers). Not built yet: calling the package's erasure:, so a connection that declares one is not yet asked to erase anyone.
not built Everything else on this page Not built yet.

GeospatialRead about it

State Feature Status
built Everything on this page but the rows below Built.
not built Geometries in Redis Not built yet: waits for entities in Redis (Reading and writing entities in Redis). Until then nothing stores a geometry there. A Redis entity will keep a geometry as its GeoJSON, and every geometry, with and without altitude, comes back from its GeoJSON unchanged, except that a polygon wound clockwise comes back wound by the right-hand rule, which PostGIS storage doesn't do.
not built A geo. condition in an include or an aggregate query Not built yet (toolchain.not_built_yet): an include's records aren't checked again by the code yet, and an aggregate's totals are the database's (The aggregates).
not built IndexKinds other than geographic and hnsw Not built yet (Special kinds of index).

HTTPRead about it

A feature that isn't built yet is the error toolchain.not_built_yet where an app uses it.

State Feature Status
built Checking routes Built: jadpo check checks route groups, their prefixes and APIs (with idempotency:), methods and typed placeholders, the one input (from the query string for GET and DELETE, the JSON body otherwise, and header: fields), output: and status:, deadline:'s range and what run: calls, every route of the project against the others and the health paths, and each API's record.
built OpenAPI Built: jadpo check writes one OpenAPI document per API to build/openapi/, and the failure wording for client apps beside it. Each API serves its own document at <prefix>/openapi.json (serve_openapi: false turns it off, authentication: [] opens it to anyone), listed in its record, its document and jadpo routes, and the documents carry the x-jadpo fields the OpenAPI importer reads (OpenAPI). OpenAPI derives each route's responses from what it runs and shows ZonedTime, Zone and a mixed enum as they are sent.
built Serving a request Built: the runtime's HTTP component routes a request, decodes and checks its input (each problem as { field, rule }), runs the action or query, and answers with the output or the failure envelope, its request_id and x-request-id, with the status the failure's kind sets; it answers HEAD and OPTIONS itself and counts the default rate limits. It reads a body only as JSON, and refuses a query string or body a route doesn't read, a header it can't read and a body over 1 MB.
built Deadlines and concurrent changes Built: the runtime stops a route at its deadline without committing, even work that never waits, and runs an action again on a concurrent change found as it commits.
built Health endpoints Built: /health/live and /health/ready.
built Idempotent writes Built: the runtime keeps each write's Idempotency-Key with its response.
built Commands Built: jadpo dev serves the routes and reloads on save, jadpo routes lists them and jadpo api update writes the records, each api/<api>.jadpo_record in the record format with no version: line; the OpenAPI version is a hash of it.
built Native connection limits Built: natively, a client has 10 seconds for its headers and 30 for its body, a write waits at most 30 seconds for it to read, and the server holds at most 1,024 connections and 10 database connections per store per worker.
built Sign-in Built: every route needs a signed-in caller unless it says authentication: RouteAuthentication.none; each API lists the sign-in methods it accepts, named in its record; a route passes current_principal to what it runs; a signed-in caller's requests count against its own rate limit, and its idempotency keys are its own; a request with a credential on a route anyone may call counts against its address before it runs (Sign-in and identity).
built Policy Built: policy decides what each route reaches, and OpenAPI lists the 403 not_permitted on every route that runs an action that writes or is listed under actions: (Policy).
built A GET that runs an action Built: the proof over every action it calls, route.run_kind naming what breaks it and where, a READ ONLY transaction and the faults beside it, for a GET's query and action alike.
built Issued tokens and keys Built: a GET runs sessions.tokens and <Service>.keys itself, and the record and OpenAPI describe the IssuedToken and IssuedKey it sends (Service credentials).
built Map layers Built: a route may send a FeatureCollection<G, P> bare, its properties held to what an Output may hold and, where an action returns it, to the fields every caller may read (Field restrictions); OpenAPI describes RFC 7946's object and the record names it with its type arguments. A GET sends one a query gives (Reads and writes, "A query giving a map layer"), held to field policy where the query is declared.
built Sending raw bytes Built: sends: on an Output of one Bytes field, on the native and Workers hosts and in the interpreter, with Content-Length, HEAD, repeats under a key, OpenAPI and the record (Sending raw bytes, and route.sends_invalid).
built Answers that never change Built: cache: immutable writes Cache-Control on a 200 (Answers that never change, and route.cache_invalid).
built settle: Built: a route waits for the work its action set off (Waiting for follow-on work, and route.settle_invalid).
built Streaming Built: a route whose action returns an AiStream sends a model's answer as server-sent events (Streaming a model's answer, and route.stream_invalid).
not built Failure wording from a build Not built yet: jadpo check writes <api>.failures.<locale>.json beside each OpenAPI document, and jadpo build is to write it too.
not built x-jadpo-events Not built yet: it waits for publishing events outward (Where events travel).
built Rate limits Built: a route's own rate_limit: and an API's (Rate limits).
not built The Redis store for rate limits Not built yet (Rate limits).
built Classifying breaking changes and their acceptances Built (Acceptances).
not built The Jadpo-Revision header Not built yet: it comes with caches (Write revisions).

Sign-in and identityRead about it

A feature not built yet is toolchain.not_built_yet where it is written.

State Feature Status
built Everything else on this page Built.
not built Driver.github, Driver.apple and oauth_provider: Not built yet.
not built Scope declarations and policy's scope restrictions Not built yet. As Policy specifies, an external method narrows scopes only when it declares the scopes it reads; undeclared provider scope or profile claims never replace application authority.
not built OAuth grants: OAuthGrant credentials, the connecting and disconnecting routes and on_behalf_of: (OAuth grants) Not built yet.

PolicyRead about it

Everything on this page is built except the features below. Each is toolchain.not_built_yet where you write it.

State Feature Status
built Grants, user fields, membership roles, roles that need a way in (requires:), Access.authenticated, Access.public and Access.system, tenancy, actions: with listed queries and policy.call_ungranted, field restrictions, the permissions report, and the refusals under "When policy says no" Built.
not built scopes:, with the tokens issued to other applications (oauth_token, external_token) Not built yet. Browser sessions and service keys work without them.
built An acceptance for a change that widens access, with access.jadpo_record (Acceptances) Built.
built The approval report that shows the report's changes in plain terms (Reviewing a change) Built.

Background workRead about it

State Feature Status
built Everything else on this page Built.
not built Publishing chosen public events outward Not built yet.
not built jadpo batches list, show and cancel Not built yet: an action can call batches.status and batches.cancel meanwhile (Tooling).
not built batches.each over a provider's list operation, walked by page.next Not built yet: a provider's list operation as from: is toolchain.not_built_yet where it is written; a named query giving a Page is built (Walking records or a provider's list).
not built Each step's state in jadpo watch, and in jadpo trace with the request timelines (Debugging), and a record's entry in the personal-data report Not built yet.
not built Sending the metrics and the alerts' log events to a monitoring tool Not built yet: waits for telemetry.
not built The console's timeline Not built yet (Debugging).
not built Jitter and Retry-After between a delivery's attempts Not built yet: the next attempt waits only its backoff (Retries and giving up).
not built Splitting a page type allowing more than 1,000 items into batches; batches.status and batches.cancel with runs in no store or several; a file's run with several databases and none written Not built yet (How a run is kept, How a file's run is kept).
not built cli.signal_handler_failed Not built yet (Running background work).

Built-in servicesRead about it

The errors this page describes are built with the feature they belong to.

State Feature Status
built Email Built: email's templates, the shared layout, email:, sending after commit through the SMTP driver, attachments and parking (Email rules: templates and sending). The SMTP conversation runs in the driver, over the host's transport and its TLS upgrade.
built Jadpo's own magic-link email Built: at all five levels, worded by Jadpo or reworded by the app, wrapped in the app's layout, the app's own email filled with the link and the code, or the app's own sending given them (Jadpo's own magic-link email, Your own magic-link email).
not built The privacy emails Not built yet. They come with data requests (Data requests).
built Mail packages Built: a mail package as the connection, partials and email.sent (Mail packages, partials and email.sent).
partly The dev inbox and the health score Partly built: the dev inbox, jadpo email, the health score, email.health_problem and jadpo email check-domain (The dev inbox and the health score), with SpamAssassin's rules in the score (SpamAssassin in the health score). Not built yet: the inbox page as part of the developer console, and its link to each mail's trace, which comes with jadpo trace.
partly Rate limits Partly built: default rate limits with routes, a route's and an API's own rate_limit:, and their store on Workers, Cloudflare's rate-limiting binding (Rate limits on Workers). Not built yet: Redis's driver, which comes with caches. Until then a deployable whose store is Redis counts in its own memory, which on Workers is the judgement call rate_limits.counted_in_memory. Not built: turning a limit off, which the design notes say needs an acceptance and which has no syntax yet; requests: and within: can only loosen it. A generated route's own limits don't appear in OpenAPI's x-jadpo-rate-limit or jadpo routes, and a magic-link refusal gives Retry-After without the RateLimit headers. The binding's windows, the Wrangler entries and what its documentation says of locations and accuracy aren't yet checked against the real edge.
built Outside calls Built: the one place in the runtime every capability's calls go through, with a delivery that hands its event to a capability, parked as outcome_unknown when a send without a key may have acted (How every outside call is made safe).
partly Files Partly built. Built: the files capability's first part, its calls made the same way: Driver.disk connections, File fields, store.put, store.read with its whole-read cap and its two errors, the disk driver jadpo dev keeps files with and the in-memory store a test's are in, which the file helpers' reads walk (Data formats; File fields, put, read and the disk driver); every write of a File field holding the file to the field's store:, types: and max_size: (What a write checks); the pieces the file helpers' writes put, joined into one file or dropped by the store (How an export writes its file); and a gzip file unpacked as the file helpers read it, up to max_unpacked_size: (Reading gzip). A native deployable's disk driver keeps each store at its path:, made the app's user's alone as it starts, a root other users can write to not built, and a write below free_space_floor: answering storage_full, in jadpo dev too; jadpo check refuses a path: that is relative or inside the project (connection.disk_path_invalid); and the manifest lists the disk stores that keep a deployable on one server (The disk driver). A file's bytes are deleted once no record holds it, after the change commits, through the generated subscriber files <store>, and a day after a put when no record ever held them, a person's erasure and retention included (Deleting and erasing). The floor is a monitoring threshold (Monitoring). Not built yet: upload slots, multipart ones included, downloads, fields naming one store of files in entities of two databases, the S3 driver, fixture_file and telling the store to fail from a test, and image variants and scanning when an app needs them, the application's scanning: being toolchain.not_built_yet where it is written; and the jadpo files commands (ls, show, get, put and copy).
partly Flags Partly built: flags { } of Bool and enum flags with their default:, owner: and expires:; flags.<name> in actions, tests and a route's run: arguments, worked out for the caller from jadpo_flags in flags: { store: }, held in each server's memory and fixed for the operation; a test's flags:; flag.unknown, flag.read_context and flag.expired (Flag rules: declaring, reading, testing). jadpo flags list, set, reset and remove, each change logged in jadpo_flag_changes; flag.value_untested; and client: true with each API's GET /flags (Flag rules: changing, listing, removing). Not built yet: named tenants, which wait for tenancy to be settled for flags; and a user's erasure reaching their id in jadpo_flags and jadpo_flag_changes, which comes with erasures.
partly Audit Partly built: an entity's audit:, an entry in the same transaction as each change, history with the record's read grant and the fields the caller can read, retention by the purge schedule, entries deleted with their record by erasure, AuditEntryRecorded to subscribers, and the permissions report's line (Audit trail). Not built yet: what What the audit trail doesn't keep yet lists, each toolchain.not_built_yet where it is written, and publishing, which comes with outgoing webhooks.
partly Search Partly built: on PostgreSQL, search: { fields: language: } with its generated column, GIN index and migrations, matches with a SearchText, the best matches first in keyset pages, and policy over every search (Search). Not built yet: an engine's store:, toolchain.not_built_yet where it is written, and jadpo search reindex, which come with the search capability's packages; and searching a field of a sensitive category, toolchain.not_built_yet in fields: until the access records are built.
not built Documents Not built yet: the application's documents: is toolchain.not_built_yet where it is written.
not built Bot protection Not built yet: the application's bot_check: and a route's are toolchain.not_built_yet where they are written.
not built Outgoing webhooks Not built yet.
not built The telemetry: section Not built yet: it is toolchain.not_built_yet where it is written. Nor is telemetry in the developer console, or jadpo traces, jadpo metrics and jadpo logs, which read it in development.
not built Path IDs Not built yet for requests. Each body's ways are numbered, and the gate compares the paths each test's bodies took when it runs them interpreted and compiled, but no request carries a path or a path_key, and jadpo path isn't built.
partly Monitoring thresholds Partly built: thresholds { } in each domain's monitoring.jadpo, each threshold checked to watch a route, action, query, schedule or subscriber of its domain with limits that apply to it; the per-request limits in the runtime's plan, the across-request limits and the disk floors written to build/monitoring/ as Prometheus and OpenSLO rules and carried in the manifest; and a limit raised or removed, or a floor lowered, refused by check until a ThresholdChange acceptance names it (What Jadpo generates from thresholds). Not built yet: acting on the per-request limits, which comes with the telemetry: section, starting values from the query report and production, and an agent's proposals through MCP.

AIRead about it

A feature not built yet is toolchain.not_built_yet where it is written.

State Feature Status
built Everything else on this page Built.
built The prompts' entry in the personal-data report Built: each field and category a prompt or an embedded text sends, under the connection ai: names; in the approval report's difference a sensitive category is flagged, and the ai connection needs its ErasureNotPossible acceptance.
not built Keeping prompts and answers in production (keep_content:) Not built yet: it will keep them in encrypted fields.
not built A package's embed: with a batch: below 100 Not built yet.
not built jadpo call, which answers through the ai fake as jadpo test does Not built yet (Debugging and review).
not built The conformance suite for a capability other than ai, or for a package with fixed hosts:; a passing run pinned to the package's digest and the registry's listing; running it in scheduled CI Not built yet: the listing comes with the hosted registry, scheduled runs with the CI work.

External servicesRead about it

State Feature Status
built The package format, names and the lock Built.
built The surface, jadpo package show and jadpo package check with the publishing bar Built.
built Installing: add from a folder or git, update, remove, link and unlink Built.
built Connections to packages and the network report Built.
built Lazy loading, the package cache and two versions side by side Built.
built The OpenAPI importer, and the scoped review of an import's types Built.
built Provider calls, decoding, wire_parts: and retries Built.
not built Walking a list operation's pages with batches.each (Pages of results) Not built yet: a provider's list operation as batches.each's from: is toolchain.not_built_yet where it is written (Jobs and events).
built No transaction open during a call, and several changing calls in one action Built.
built Fakes, recordings and provider calls faked in development Built.
built The email capability with SMTP and Resend Built.
built Package actions, subscribers, recipes and polls Built.
built Webhooks as events, replies, handshakes, queues through a package and the Cloudflare Queues driver Built.
not built Services (runs:) Not built yet, nor is jadpo services.
not built OAuth grants Not built yet: the application's grants: is toolchain.not_built_yet where it is written, and jadpo dev grants add isn't a command yet.
built A release's facts and change record in jadpo package check and show, the previous release's examples and tests run against the new code, and jadpo package verify with the fingerprints (How they are worked out) Built.
built The verifier: jadpo package verify --serve, its sandbox, the check of a commit's files and size, its container image and Fly.io configuration Built. Not deployed yet: its image is published, and it runs on Fly.io, once a maintainer has switched them on.
built Publisher trust for third-party git packages Built: a package from a git repository under none of packages:'s own_sources: needs an acceptance, as does adding or widening an entry; an entry is package.own_source_invalid unless it is a host and a path ending in /.
built The registry protocol: its requests and answers, the log and its proofs, a local registry and the conformance test Built (jadpo-registry).
built The jadpo tool's side of the public registry: add and update checked against the log, search, audit, publish and preview (How the registry commands work) Built, against the local registry.
built A package's publisher (Names and publishers): publisher: in the index, on its surface and in its facts, the bar's publisher row, jadpo package publish and verify --publisher, the verifier's request and the local registry's check of a release Built, against the local registry.
built Starting a package: jadpo package new, and the bar's licence row refusing Licence.proprietary for verify and publish Built.
not built The registry at jadpo.dev: publishing, search, advisories and compatibility runs Not built yet: jadpo package add <name>, search and publish stop with registry.unreachable.
not built Importers other than OpenAPI Not built yet.
not built Choosing a provider when deploying Not built yet.
partly Erasure at providers Partly built: the package's and the connection's erasure: are read and checked, and a connection that can't erase what it receives needs an ErasureNotPossible acceptance (Erasure at providers). Not built yet: calling the provider.

Mistakes not reported yet

These mistakes are specified but not reported yet:

State Mistake Reported by
no state An operation whose scope the grant does not request; a call to a grant connection without on_behalf_of: jadpo check
no state A service image not yet accepted; an asks: host not granted by outbound: jadpo check, naming the line that grants it
no state A capability's connection whose package does not provide it, or a function call or expression in a provide mapping, for a capability other than receiving and email jadpo check

The rest of the page's mistakes have examples under Errors: the digest and the lock, an emails/ folder, the index's keys, provider.jadpo's keys, hosts: with runs:, reserved and taken names, a resource and an action of one name and a public action that emits (package.action_invalid), and subscribing to a non-public event (package.not_public) under "Package errors"; a surface that differs at install and a link in CI under "Installing errors"; a decoder that fails on a recording and a field's decode: and encode: that don't round-trip under "Recording errors"; a connection's keys under "Connection errors". The rule that nothing public reaches something private is visibility.public_reaches_private (Project layout and modules), and several changing calls in the wrong place are the step. errors of Background work and effect.call_in_loop (Logic).

ConfigurationRead about it

State Feature Status
built Time literals and the built-in Zone, Weekday and Locale enums Built, with clock.now outside an action reported as type.clock_context.
built Settings Built: settings, secrets, signing keys, connection addresses, jadpo config, the check before the app starts, a test's own values, and the trusted proxies a client's address is read through. The check before the app starts covers every setting a deployable reads, its connections' included, among them the mail server's for the sign-in email.
built Time Built: ZonedTime, durations, arithmetic and comparison, the temporal library over the IANA database bundled into every target, time values on the wire, in OpenAPI and in queries, and a test's clock: and clock.advance(...) (Controlling time).
built Formatting Built: TimeFormat, declared and built in, ComponentStyle and PresentationText, with the checks on formatting.
built Locales Built: locales { } with its errors, locale: checked against it, a Locale on the wire or in a setting limited to the supported ones, and the text formatting gives, over CLDR data compiled into every target; locale.from_accept_language(header).
built Translations as messages Built: Message types and the built-in PluralCount, each domain's translations { } language files and their checks, the generated translations.<domain>.<message> calls, enum wording, email subjects and in_progress: locales; failures' client text exported per locale; stale translations and review; locale.direction; the jadpo translations commands; go to definition and the pseudo-locale.
built Jadpo's own messages Built, with the root file's owner groups.
built Library packages' translations Built: a package's translations/, Postcodes.translations.<message>(...), the root file's package groups and their record lines, and a package's messages in its surface and the publishing bar.
built Locale data a deployable carries Built: its supported locales' only, with the text a Locale the app doesn't support is written in (see Locales).
built Unaccepted wording in the approval report Built: jadpo approval lists it, as jadpo translations missing does.
not built Moving a message to shared/translations/ Not built yet as a promotion: layout.promotion_required doesn't cover messages, so move the message by hand.
not built Other members of clock, translations, sessions and oauth Not built yet: a member these pages don't describe is toolchain.not_built_yet until its area is built.

TestingRead about it

State Feature Status
built Pure and action tests Built: jadpo test runs test "…" { } and assert in the interpreter, for tests that call functions and actions. Each test gets its own environment (its seed and clock, its database and fakes), tests run on a thread per core, and the results are reported in the order seed's order. Each action or fixture a test calls commits on its own, through the runtime's action boundary; an action it calls joins its transaction.
built Kind of test Built: the kind comes from what a test calls (an action, query or fixture makes it an action test, a request a route test, a schedule's .run() a schedule test), and the footer and --json count each kind.
built Schedule tests Built: schedule.run() in a test runs the schedule once at the test's clock, its action called as the system with no tenant, with its own database like an action test; --kind schedule runs only these; anywhere but a test it is semantic.not_callable.
built Route tests Built: request { method: path: params: input: } sends a request through the runtime's HTTP component and gives a Response with status, code and the route's typed output; a route test gets its own database like an action test, and a defect behind a 500 ends it as test.fault. as: signs in a user through a real browser session or API token, and a service through a real service key; sign_in: and strength: record how the user signed in, by magic link with one factor when left out; a caller signs in once per test, and its later requests signed in the same way send the same session or key. Every request but a GET sends a fresh Idempotency-Key, or the one idempotency_key: gives (Idempotency keys). An optional field the input: leaves out is left out of the body, so a patch: keeps it. A streaming route's Response has pieces in place of output, its events read to the last. A route with sends: has the body in its Output's field.
partly Assertion messages Partly built: a failed assert reports its file and line, its source with each part's value hung beneath it, expected and actual, a field-by-field diff for records, lists, sets and maps, a stable code and the rerun command with the order seed (see Errors). Not built yet: the trace, fakes, kept database and clock in the report. A statement over several lines shows its first line; --json has all of it.
built Checking a failure Built: assert call(…) fails Failure; when the call returns or fails differently, the report shows the value, or the other failure with its code, kind, fields and where it was raised. A failure under attempt ends the test as test.unexpected_failure, and a fault as test.fault, each with its .jadpo frames.
built Events Built: what each step emits is delivered once it comes back and before the next statement, at the test's clock, until nothing is due, in an order the run's seed shuffles; a retry waits its full backoff until clock.advance reaches it, and a delivery that fails for good, or stops as diverged, ends the test as test.subscriber_failed ("Caches and events").
built Batches Built: a batch run a step starts, or a delivery or an item starts in turn, runs to its end before the test's next statement, drawn among the deliveries a batch at a time, at the test's clock, two items a batch with a fresh runner claiming each, as after a restart. An item that fails is the run's problem, and a finished: that fails leaves the run failed, which batches.status reads; the test goes on. A run whose batch couldn't commit, such as one whose item's call a fake answers unavailable, gives its runner's lease back and waits, as for the tick, until the next clock.advance, of any length ("Batches").
built Clock Built: a test's clock starts at its clock:, or at 2000-01-01T00:00:00Z without one, and clock.advance(...) moves it on for the calls after it; only a test moves it (type.test_clock_context, a fixture and a seed included), and a move backwards is the fault clock_backward.
built Configuration Built: test: values on fields, defaults, generated secrets and a test's own config:; a request sent through a route is not followed for the compile-time check that every setting a test reads has a value, and a read with none then ends the test as a fault naming the setting.
partly Integration fakes Partly built: for provider packages, every provider call a test reaches answers through its package's fake, with the operation's generated default unless the test's fakes: scripts its answers, each checked against the package (semantic.fake_invalid); a script the calls run past is test.fake_exhausted, one with answers left test.fake_unused ("Fakes for integrations"). Package fakes keep keys, and a test that reaches an action with several changing calls runs again with a crash at each step boundary ("Provider calls and capabilities in tests"). email.sent (Email): every email a test sends is caught, rendered whole, a mail package's included, and read as a List<SentEmail>. Not built yet: .requests (built for the ai fake, ai.<prompt>.requests), the capability fakes but ai's, grants, documents and fixture_file.
built Database Built: jadpo test gives each action test in a project with tables its own copy of a template built from the migrations, on the server JADPO_TEST_DATABASE_URL names or a disposable one started from the machine's PostgreSQL tools; copies are prepared in the background, and a test gets its copy the first time it uses a store. --keep-failed keeps a failed test's database and names it in the report. Tests read and write records through actions, queries and fixtures; a concurrent change, which needs a second connection, is shown by the runtime's own tests.
built Caller Built: Principal.user(user) and Principal.service(service) in tests, fixtures and seeds; a call passing a caller runs as that caller, one passing none runs without policy.
built Placement Built: a test sits in <name>.test.jadpo beside its subject, or in root tests/; a test elsewhere is layout.wrong_folder, which names the .test.jadpo file beside it, and a test file with nothing beside it is layout.test_without_subject.
partly Watch mode Partly built: jadpo test --watch runs the tests asked for, then on every save the ones that reach what changed, through the graph's digests and calls and uses edges, on one long-lived database; a save no test reaches says nothing to rerun, a broken build shows its errors, and the next good save runs everything changed since the last run, or says errors fixed when no test reaches it; a removed file is a change like any other. Run from outside the project, its paths start with the project as typed. It ends when nothing reads its output any more, as when piped into head. A save shows its results in about 0.1 s on a 230-file project, and the gate fails above 1.25 s. The keys in the interactive screen (enter, a, f) wait for --interactive, which says toolchain.not_built_yet; ctrl-c quits.
built Fixtures Built: a fixture is checked like an action and called by name from tests, fixtures and seeds; an action calling one is semantic.not_callable. A public fixture is called through its domain from other domains' tests, fixtures and seeds and from root tests/; a private one from there is visibility.private_cross_domain. Seeds are checked like tests and run with jadpo seed (Seeds).
not built Data builders, assert emitted Not built yet.
not built The trace --keep-failed keeps, for jadpo trace Not built yet: it comes with Debugging and review.
not built Interactive mode Not built yet: jadpo test --interactive says toolchain.not_built_yet.
not built Generated tests Not built yet: jadpo test runs only the tests a project declares.
not built Caches in tests Not built yet: caches need the Redis driver.
built Golden application contract Built: the shared black-box harness in benchmarks/contract/ executes all 44 versioned application cases interpreted, on generated native code and on compiled workerd, with real credential verification, raw invalid inputs, physical SQL observation, persisted-state assertions, controlled clocks and provider faults. These checks supplement authored Jadpo tests; they add no application-facing test controls. Full-gate ownership is interpreted and native in compiled, workerd in wasm32, and verifier negative controls in lint.
built test.no_tests Built: raised by jadpo test only (Tools), when the project has no tests or a file, line, name, kind or --failed picks none.

ToolsRead about it

Each row says what is built and what is specified but not built yet.

State Feature Status
built Command help Built: every command has --help with examples, jadpo help [command] explains one, jadpo help <rule> prints a rule's page offline, and jadpo help --json describes them all.
built Project path Built: every command finds the project by walking up to app.jadpo, so a path is optional; run from outside the project, printed paths start with the project as typed.
built Scaffold Built: jadpo new <name> writes the fixed root on this jadpo's release line with its project token, the hello domain (one route, its action, its policy line, its API record and a route test), AGENTS.md, .gitignore and .gitattributes, passing check, fmt --check and test as written, and refuses a folder that holds anything, with --json. The line an app declares is checked: application { jadpo: "X.Y" }, with toolchain.version_newer, toolchain.version_older and toolchain.version_invalid (The root).
built Which jadpo runs Built: every jadpo runs the release a project's line or jadpo.lock pin names, kept in the cache or fetched from GitHub's releases, its archive checked against its published SHA-256 and its GitHub artifact attestation (Sigstore's verifier, with the public-good trusted root carried in the binary) before it runs, and refuses with toolchain.version_newer or toolchain.version_older when it can't; jadpo toolchain lists, removes, pins and unpins, and JADPO_TOOLCHAIN=local runs everything with the jadpo started. The trusted root is the one this release was built with: no TUF refresh.
built Formatter Built: one member per line, one blank line between declarations, and fmt --check counts the files it read; it keeps use lines at the top, sorted, fixes imports inside a project, --layout makes promotion moves, and it writes each file's declarations before their use, the primary declaration last.
built Error messages Built: one error per mistake, in the field order Error messages gives, impact only when it says something, edits on the next step where one exists, and help links to each error's page on the site.
built JSON output Built: every command takes --json and prints one envelope (schemaVersion 3) with durationMs, project-relative paths and data.root, line and column beside byte offsets, and camelCase keys, shortened unless --full is given; jadpo test --json is described in Testing and under testReport in jadpo help --json.
partly build/ Partly built: jadpo check writes build/manifest.json, the catalogues in build/catalogue/, the permissions, network, provider and personal-data reports in build/report/ and the monitoring rules in build/monitoring/; jadpo test keeps its last run in build/test/. Not built yet: the schema and query reports, and diagnostics/, inventory/, audit/ and compatibility/.
partly Commands Partly built: each command The jadpo command and the topics after it describe. Not built yet: those in their "Not built yet" notes, jadpo inspect, impact, rename, domain, services, dev grants, files, batches, search reindex, trace, traces, metrics, logs, watch, call, console, mcp, replay, path, privacy requests, incident and test new --from.
partly Language server Partly built: diagnostics; hover, with a query's SQL and a route's full path; go to definition, from a use line too; find references; completion; formatting as jadpo fmt; quick fixes from each error's edit, promotion among them; and the code actions under Editor support. Not built yet: rename, which waits for jadpo rename.
built VS Code extension Built: starts jadpo lsp, formats on save, highlights, a status item naming the jadpo running, "Open Generated File", and packaging and publishing on each release to the VS Code Marketplace and Open VSX, which publishes through trusted publishing.
partly Agent tools Partly built: the catalogues and the similar-helper check, a declinable error, are built; migrate is built; the agent skill is built, but for the three parts Tools for agents lists; impact, domain and rename are not built yet, nor is generated CI.
partly Suggestions Partly built: jadpo suggest with its six signal kinds and taught signals, the catalogue, accepted findings, ignore, found, share, suggestions { } and the committed taught record, share against a fake of Jadpo HQ. Not built yet: HQ itself, so a real share has nowhere to go.
built Review and sign-off Built: jadpo check judging acceptances against the default branch at its merge base, --before, jadpo acceptance new (Acceptances) and jadpo approval.
built Build-only errors Built: jadpo build for the one deployable an app that declares none has and for declared deployables, with their toolchain.target_* errors; its settings line, and a Worker's secrets: { required: [ ] }, name every setting a deployable reads, its connections' included.

DebuggingRead about it

State Feature Status
built jadpo calls, calls show and calls script Built.
built Each step a request's action reached, as a trace line in jadpo dev Built: each step is a line under its request's line in jadpo dev, and a delivery whose action reached steps gets a line of its own.
built jadpo why <schedule> Built: it answers why a schedule didn't run (Watching schedules).
partly jadpo approval Partly built: the report in build/review/ in this page's order, the before side built from git and its manifest kept in build/before/<commit>/, and the personal-data report's difference, a connection at a time. Not built yet: the rest of that difference, which comes with the rest of that report, and a package's service and a bot check, which come with those features.
not built Mapped .jadpo stacks, jadpo incident, the other forms of why, timelines and jadpo trace, test new --from and call Not built yet.
not built jadpo dev grants add Not built yet.
not built The developer console, MCP (jadpo mcp) and the review web view Not built yet: they come after those, as product work.
not built jadpo traces, metrics, logs and watch; path coverage, production counts in review, jadpo replay and query cost Not built yet.

Review and recordsRead about it

State Feature Status
built Manifest Built: jadpo check writes build/manifest.json at format 2, with nodes for project layout and modules, values and types, logic and failures and their calls, uses and raises edges, policy's grants, field restrictions, tenancies and listed actions with grants and scopes edges, prompts, and the connections, packages, operations, hosts, lock lines, principals, sign-in, generated routes, settings, locale set, rate limits, schedules and subscribers of Sign-in and identity, Configuration, External services and Background work, and the build stamp, a person node for each person entity, listing the references its records belong through and the fields erasure keeps of their record, and a retention node for each retention, under its field or entity, with its period and since: field. The graph's diff classifies their changes as Package upgrades and the acceptances table say (PackageChange, PolicyChange). Each threshold is a threshold node with what it watches and its limits, and each disk store's floor one too (What Jadpo generates from thresholds). Caches, OAuth scopes and personal fields join as their parts of the language are built.
partly Views of it Partly built: the library and failure catalogues are built, one OpenAPI document per API in build/openapi/, and the monitoring rules in build/monitoring/; the other reports come with their parts of the language.
built Migrations Built: jadpo migrate new writes each folder, and jadpo check fails while the entities and the latest snapshot disagree. Each folder is a migration_snapshot node in the manifest.
built Stable identity Built: a key is the kind and the born name, a function or type declared in a domain carries its domain, and a test's key is the file it sits beside and its sentence. jadpo check reads the registry and promotion with jadpo fmt --layout writes it; jadpo rename and the jadpo domain commands, which write it too, have rows of their own (Tools).
built API record Built: jadpo api update writes api/<api>.jadpo_record for each API with routes, jadpo check fails with record.out_of_date while one disagrees with the routes, naming what changed, and a breaking change needs an acceptance.
partly .jadpo_record files Partly built: every record in the record format, the API record without version:, the registry as database/identities.jadpo_record, the header check, record.out_of_date, record.edited and record.format_newer, jadpo records and jadpo records update, and the .gitattributes lines jadpo new writes. Not built yet: telling a careful hand edit of a view from a stale one, which needs jadpo check to build the base as jadpo approval does; the editor grammar and jadpo lsp serving records.
built Event records Built: one view per domain with events, domains/<domain>/events/events.jadpo_record, written by jadpo records update and checked as the API record is; what The event record records, and its breaking changes need an acceptance.
built Access and network records Built: access.jadpo_record and network.jadpo_record at the root, written by jadpo records update and checked as the API record is (Acceptances).
partly Acceptances Partly built: jadpo acceptance new <purpose>, the before side read from git (--before on jadpo check), matching, the /// reason and history, for ApiChange (the API and event records), PolicyChange (widenings, routes made public, security declines, sign-in settings past their limit), DomainChange.created, NetworkChange.host_added, PackageChange.git_source, an upgrade's PackageChanges (Package upgrades), ThresholdChange (each domain's monitoring.jadpo and app.jadpo's disk floors read from git) and DataChange (read from the migrations a change adds, Removing data). And ErasureNotPossible, which says how things stand rather than what changed, read from where personal data goes. Not built yet: PackageChange.service_image, which comes with services; and a domain renamed, which shows as one created until jadpo domain rename writes the registry.
built Lock and package surfaces Built. The lock is a ledger read and checked like the others, and jadpo check holds each installed package to its line and digest (External services gives the digest), and its jadpo version pin to the line app.jadpo names. jadpo toolchain pin and unpin write the pin, and the package commands and jadpo records update keep it. jadpo package add, update, remove, link and unlink write it, each line through the ledger's writer, sorted; git lines record the repository as written, the tag and the tag's commit, path lines a folder relative to the root, and a link line replaces the package's line while the replaced one waits in .jadpo/links (git-ignored, in the lock's own format) for unlink. Two versions of one package are locked side by side, each on its own line, and update names the version while two are held. A package surface is record surface 1, a view written by jadpo package check in a package's own repository, verified at install against its package's code, and read by jadpo package show; installed, a surface is held by its package's digest rather than regenerated, so jadpo records doesn't list it, and an own integration's is written to build/providers/ (External services). jadpo package update prints the surface's changes, each entry the app uses marked used by the app, and this page's review under Needs a person, the same list jadpo check asks an acceptance for; a package installed from git needs PackageChange.git_source.
built Build stamp Built for native and Workers deployables: jadpo build writes the build id (b_ and twelve hex digits of a SHA-256 over the deployable's program digest, the compiler, the target and jadpo.lock), the commit, whether the tree was modified, the compiler, the deployable and the target into the binary or module as a constant, and every event it logs carries them (A native deployable, A Workers deployable). jadpo check writes the manifest's source (commit, left out when git doesn't track the project, and modified) and deployables, each deployable's target, build id and the disk stores that keep it on one server (one_server), which digests a declared deployable's declaration too, so two deployables of one app never share one (Declared deployables); a project with errors has none.
built Approval Built: jadpo approval builds the before side, keeps its manifest and writes the report to build/review/.
not built Package upgrade plans, jadpo incident, jadpo inspect and jadpo test new --from-event Not built yet.