@aventara/prisma7-adapter 0.1.0-pilot.0

package/dist/errors/prisma-error.reader.js

@@ -0,0 +1,167 @@
+/**
+ * The total read of one hostile value (T-10's first half).
+ *
+ * Everything on the failure path arrives as `unknown`. `@prisma/client`
+ * 7.10.0 raises `PrismaClientKnownRequestError`, whose `meta` is typed
+ * `Record<string, unknown>` and is **not** a discriminated union, so a
+ * reader that trusts the type would be reading a shape nobody promised.
+ * Worse, the value need not come from Prisma at all: a developer callback,
+ * a driver, or a proxy can hand the adapter anything.
+ *
+ * So this module reads structurally and defensively, under two rules it
+ * never relaxes — the same totality discipline as core's diagnostics
+ * reporter, which also observes values it cannot vouch for:
+ *
+ * 1. **No accessor is ever invoked.** Every read goes through
+ *    `Object.getOwnPropertyDescriptor` and takes `descriptor.value`. An
+ *    accessor descriptor yields `undefined` and its getter is never called,
+ *    so a booby-trapped property cannot run code, mutate state, or throw
+ *    from inside the adapter's failure path.
+ * 2. **Nothing escapes.** Every reflective call is guarded, because a Proxy
+ *    may throw from its `getOwnPropertyDescriptor` or `ownKeys` trap, and a
+ *    reader that throws while classifying a failure would replace a legible
+ *    outcome with an illegible one.
+ *
+ * Reading only *own* properties is deliberate rather than incidental:
+ * 7.10.0 carries `code` and `meta` as own data properties (observed own
+ * keys: `["code","meta","clientVersion","name"]`), so the own read is
+ * sufficient for every real error, and a `code` that exists only as an
+ * inherited accessor is precisely the case rule 1 refuses to touch.
+ *
+ * ## What this module does NOT read
+ *
+ * `message` is never read. At 7.10.0 a `PrismaClientKnownRequestError`
+ * message is not a sentence — it is a rendered call site. Measured
+ * verbatim on this repository's own schema:
+ *
+ * ```text
+ * Invalid `client.author.create()` invocation in
+ * /home/.../packages/prisma7-adapter/src/errors/__probe__.spec.ts:50:18
+ *
+ *   49 await capture("P2002 duplicate email", () =>
+ * → 50 	client.author.create(
+ * Unique constraint failed on the fields: (`email`)
+ * ```
+ *
+ * That single string carries an absolute file path, a source excerpt and
+ * the violated constraint. C-819 forbids all three from reaching `cause`,
+ * and a *deliberate* outcome's top-level `cause.message` is still forwarded
+ * verbatim (register row F-723, open). The cheapest guarantee is not to
+ * read the message at all, so the leak has no source; the raw error still
+ * reaches core's diagnostics sink, which is server-side and may carry it.
+ *
+ * ## Version bound (C-846)
+ *
+ * Everything below is scoped to `@prisma/client` **7.x**. Prisma 8 replaced
+ * P-codes with dotted `NAMESPACE.SUBCODE` codes, which makes a Prisma 8
+ * adapter a re-map of this module rather than a patch to it.
+ */
+/** Only objects and functions can carry own properties. */
+function canCarryProperties(value) {
+    return ((typeof value === "object" && value !== null) || typeof value === "function");
+}
+/**
+ * One own *data* property, or `undefined`.
+ *
+ * `"value" in descriptor` is what separates a data descriptor from an
+ * accessor one: an accessor descriptor has `get`/`set` and no `value`, so
+ * it falls through and the getter is never invoked. The `try` is for a
+ * Proxy whose `getOwnPropertyDescriptor` trap throws.
+ */
+function ownValue(target, key) {
+    if (!canCarryProperties(target)) {
+        return undefined;
+    }
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(target, key);
+        return descriptor !== undefined && "value" in descriptor
+            ? descriptor.value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownString(target, key) {
+    const value = ownValue(target, key);
+    return typeof value === "string" ? value : undefined;
+}
+/** Own enumerable key names, or none. Guarded for a hostile `ownKeys` trap. */
+function ownKeys(target) {
+    if (!canCarryProperties(target)) {
+        return [];
+    }
+    try {
+        return Object.keys(target);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * A string list read element by element: a sparse array, a nested array or
+ * a list of objects yields only the strings it does contain, and anything
+ * that is not an array at all yields `undefined`.
+ */
+function ownStringList(target, key) {
+    const value = ownValue(target, key);
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const strings = [];
+    for (const entry of value) {
+        if (typeof entry === "string") {
+            strings.push(entry);
+        }
+    }
+    return strings;
+}
+/**
+ * `meta.driverAdapterError.cause.constraint`, as the engines shape it.
+ *
+ * The chain is walked one accessor-free step at a time, so a `meta` that is
+ * a string, a `driverAdapterError` that is `null`, or a `cause` with a
+ * throwing trap all end as `undefined` rather than as a throw. A
+ * `constraint` that is present but matches no measured arm reports
+ * `"unreadable"` — a recorded unknown, which is not the same answer as "no
+ * constraint was reported".
+ */
+function readConstraint(meta) {
+    const cause = ownValue(ownValue(meta, "driverAdapterError"), "cause");
+    const constraint = ownValue(cause, "constraint");
+    if (!canCarryProperties(constraint)) {
+        return undefined;
+    }
+    const fields = ownStringList(constraint, "fields");
+    if (fields !== undefined) {
+        return { kind: "fields", fields };
+    }
+    const index = ownString(constraint, "index");
+    if (index !== undefined) {
+        return { kind: "index", index };
+    }
+    if (canCarryProperties(ownValue(constraint, "foreignKey"))) {
+        return { kind: "foreign-key" };
+    }
+    return { kind: "unreadable" };
+}
+/**
+ * Reads one hostile value into the facts a classification may use.
+ *
+ * Total: every input produces a `PrismaErrorFacts`. `readPrismaError(null)`
+ * and `readPrismaError(Object.create(null))` are as valid as a real
+ * `PrismaClientKnownRequestError` — they simply report nothing, which the
+ * table answers as `unclassified`.
+ */
+export function readPrismaError(error) {
+    const meta = ownValue(error, "meta");
+    return {
+        code: ownString(error, "code"),
+        metaKeys: ownKeys(meta),
+        modelName: ownString(meta, "modelName"),
+        relation: ownString(meta, "relation"),
+        relatedModel: ownString(meta, "model"),
+        constraint: readConstraint(meta),
+        legacyTarget: ownStringList(meta, "target"),
+    };
+}

package/dist/execution/first-variant.emulator.d.ts

@@ -0,0 +1,64 @@
+import { FrameworkError } from "@aventara/core";
+import type { PrismaIdentifierAddress } from "../discovery/discovery-artifact.interface.js";
+import type { PrismaCall } from "../translation/operation.translator.js";
+/**
+ * The lost-row conflict: the read selected a row and the re-asserted write
+ * matched none, so **nothing was written** and a retry may succeed.
+ *
+ * `A2014 STALE_SELECTION`, and this is the only place that names it. The cause
+ * carries framework text and no issues: like `A2008` and `A2013` it pairs with
+ * **no** V-code, because a conflict is not a Framework Validation Layer failure
+ * and ADR 0008 decision 1 would give a conflict V-code no legal rollup (C-839).
+ */
+export declare function lostRowConflict(): FrameworkError;
+/**
+ * Issues one of the emulation's two statements.
+ *
+ * `step` is passed because the two are classified **differently** and the
+ * discrimination is by call site: the read's failures go through the closed P-code
+ * table like any other call, while the write's `P2025` is this module's lost row
+ * and must not reach D-811's rule.
+ */
+export type FirstVariantIssuer = (call: PrismaCall, step: "read" | "write") => Promise<unknown>;
+/**
+ * How the emulation's two statements are issued, and against which client.
+ *
+ * **`inUnit` opens the unit AND yields the issuer scoped to it**, in that order,
+ * which is the only shape that cannot get D-807 wrong. An earlier draft of this
+ * module took the two separately — a `unit` that opened a transaction and an
+ * `issue` already bound to a client — and the standalone case then opened a
+ * transaction whose two statements ran on the **root** client, outside it: the
+ * emulation would have looked atomic and been nothing of the kind, and no
+ * assertion about the issued `where` would have noticed. Making the unit the thing
+ * that hands out the issuer removes the gap rather than documenting it.
+ *
+ * This module therefore never sees a Prisma client, a provider name or a
+ * transaction; it sees one issuer, already in the right unit.
+ */
+export type FirstVariantEmulation = {
+    /** The translated plan's two steps: the read, then the write template. */
+    readonly steps: readonly PrismaCall[];
+    /** The Resource's recorded Prisma addressing, for the write's identifier. */
+    readonly identifiers: readonly PrismaIdentifierAddress[];
+    /**
+     * Opens the one adapter-internal unit and runs `work` inside it.
+     *
+     * Standalone this opens an interactive transaction and the issuer it yields is
+     * scoped to it; inside a plan it runs `work` against the outer transaction
+     * client, so the emulated steps roll back **with** the plan rather than
+     * independently (§14.5).
+     */
+    readonly inUnit: <T>(work: (issue: FirstVariantIssuer) => Promise<T>) => Promise<T>;
+};
+/** A plan that is not the two-step shape this module manufactures. */
+export declare class PrismaEmulationError extends Error {
+    readonly name = "PrismaEmulationError";
+}
+/**
+ * Runs one first-style variant.
+ *
+ * @returns the affected row, shaped to the caller's `select`/`include` by the
+ * write's own projection, or `null` when the read matched nothing.
+ * @throws the lost-row conflict when the re-asserted write matches no row.
+ */
+export declare function runFirstVariantEmulation(emulation: FirstVariantEmulation): Promise<unknown>;

package/dist/execution/first-variant.emulator.js

@@ -0,0 +1,205 @@
+import { FrameworkError } from "@aventara/core";
+import { readPrismaError } from "../errors/prisma-error.reader.js";
+import { addressIdentifier } from "../translation/identifier.addressing.js";
+/**
+ * `update.first` and `delete.first` — the two **framework-manufactured**
+ * variants, and the one adapter-internal unit that manufactures them (D-807,
+ * D-828, C-856; closes F-704).
+ *
+ * # What is manufactured, and why that word
+ *
+ * The shape Aventara advertises — *general filter · ordering decides "first" ·
+ * effect limited to one row · the affected row is returned, in one call* — is
+ * essentially absent across ORM design, because SQL splits the ingredients along
+ * a dialect fault line: `UPDATE … ORDER BY … LIMIT` is a MySQL/MariaDB extension
+ * while `RETURNING` is Postgres/SQLite/MSSQL, so whichever dialect grants the
+ * limit denies the returning **[SURVEY]**. Prisma 7.10.0's `Operation` union has
+ * no `updateFirst` and no `deleteFirst` **[PKG]**. So these are not a Prisma-
+ * shaped gap an adapter might omit; they are an operation the framework
+ * manufactures, and the honest framing — the one the plan, C-857 and the package
+ * README all use — is *framework-manufactured, non-atomic, with a defined
+ * conflict outcome*, **not** "dangerous".
+ *
+ * # Two statements, and the firstness lives in the first one
+ *
+ * 1. `findFirst({ where, orderBy, select: <identifier> })`. The `orderBy` the
+ *    caller sent is the **selector for which row**, not a limit: ordering and
+ *    single-row selection are natural on a read. No match → `null`, which core's
+ *    outcome mapper turns into `A1001 NO_MATCH` (200, `data: null`) (C-826).
+ * 2. `update`/`delete` narrowed to the identifier the read returned **with the
+ *    caller's original predicate re-asserted** — `{ <identifier>, AND: <original
+ *    where> }` — carrying the caller's own projection, so the row the contract
+ *    owes comes back from the write itself (§8.2, §8.4). `WhereUniqueInput`'s
+ *    extended form admits exactly this, and `extendedWhereUnique` is GA **[RUN8]**.
+ *
+ * Prisma's `limit` on `updateMany`/`deleteMany` is **not** used. That is not a
+ * principle — D-827 rules the opposite, an argument the ORM offers is not hidden —
+ * it is that the `limit` cannot express this operation: neither `updateMany` nor
+ * `deleteMany` carries an `orderBy` in 7.10.0 **[RUN8]**, so `limit: 1` selects an
+ * **arbitrary** row and two identical calls can hit different rows. The identifier
+ * from the read is what makes the write deterministic.
+ *
+ * # What re-assertion closes, stated precisely
+ *
+ * It closes the **wrong-row race**: without it the write is by identifier alone
+ * and can mutate a row that no longer matches what the caller asked for; with it
+ * the write can only ever touch a row the read selected, and a row that moved out
+ * of the predicate is **detected** rather than mis-mutated.
+ *
+ * It does **not** close **stale firstness**. Between the read and the write
+ * another writer can insert or update a row that sorts *ahead* of the selected one
+ * and still matches the original predicate. Both steps are blind to it — the read
+ * never saw it, and the re-asserted write succeeds against the row it was given —
+ * so `update.first` can mutate a row that is no longer the first ordered match and
+ * report ordinary success. Nothing detects it and no re-assertion can, because the
+ * missing fact is about a row that was never read. Closing it needs either
+ * `Serializable` isolation, which core's `Adapter.transaction(work)` seam cannot
+ * express (RC-3), so it is **accepted as a documented property**: C-830 has Phase 8
+ * escalate no isolation, and `first-variant.emulator.spec.ts` carries a case that
+ * *demonstrates* the residual rather than asserting it away.
+ *
+ * # The lost row is discriminated BY CALL SITE, never by `meta`
+ *
+ * A write that matches nothing after a successful read is the **lost-row race**: a
+ * distinct semantic outcome the caller may retry. Under the chosen Route A it
+ * arrives as a thrown `P2025` — measured at the emulator's own call site, inside
+ * an interactive transaction, on both engines (2026-10-02):
+ *
+ * ```text
+ * tx.author.update({ where: { id: <read>, AND: [{ tenantId: "gone" }] }, data })
+ *   -> P2025, meta = { modelName: "Author", operation: "an update" }
+ * ```
+ *
+ * That meta is **identical** to the one D-811 forgives into a `null` for
+ * `update.unique`/`delete.unique`, so the two rules cannot be told apart by the
+ * error at all. They are told apart by **where the call was made**: a `P2025`
+ * caught by {@link runFirstVariantEmulation}'s write step is the lost row, and
+ * nothing else in this adapter forgives a `P2025` into a `null`. This is why the
+ * emulator does not consult `classifyPrismaError` for its write step and why
+ * D-811's rule is not shared.
+ *
+ * {@link lostRowConflict} is the one seam that names the outcome. It lives here
+ * rather than in `error.normalizer.ts` (ownership corrected 2026-09-23) because
+ * the normalizer owns the closed P-code table and this condition has **no provider
+ * error behind it at all** under Route B, and under Route A the provider error is
+ * only the messenger. It answers **`A2014 STALE_SELECTION`** (409) — its own
+ * discriminated code since the architect's assent of 2026-10-02 (RC-8, D-831),
+ * replacing the coarse `A2008` it shared with the constraint cases and with
+ * `A2013`'s concurrent write. The code is reached from here and from nowhere
+ * else: the closed P-code table has no row that can emit it, because the
+ * discriminant is the call site and not anything in the error.
+ *
+ * # One adapter-internal unit — F-704's answer
+ *
+ * Inside a plan the emulation reuses the **outer transaction client**; standalone
+ * it opens **its own interactive transaction** (D-807, C-830). The nested option
+ * is real — `$transaction` is not in the interactive-client deny list, which is
+ * exactly `["$connect","$disconnect","$on","$use","$extends"]`, and
+ * `Transaction.Options.newTxId` exists for nested interactive transactions
+ * **[PKG]** — and it is rejected on semantics, not on SQL: a nested savepoint
+ * would let an emulated variant roll back *independently* of the plan, which
+ * contradicts §14.5 ("if any operation fails, all transaction writes roll back")
+ * and core's single-sentinel model. The literal `SAVEPOINT` statement is not in
+ * the JS bundle, so the decision deliberately rests on that semantic argument
+ * rather than on an unverifiable claim about the SQL issued.
+ *
+ * No isolation level is escalated: RC-3's readings are unadopted, safety comes
+ * from re-assertion, and the spec asserts the transaction **boundary**, not a
+ * level.
+ */
+/**
+ * The framework-owned text of the lost-row outcome, which is `A2014`'s published
+ * meaning verbatim. It holds for **any** adapter that reaches this state,
+ * including one that reaches it in a single statement with optimistic
+ * concurrency: it names no provider, no emulation, no savepoint, no retry loop
+ * and no statement count. Carries no provider string (C-819).
+ */
+const LOST_ROW_MESSAGE = "The state this operation had selected changed before its effect could be applied, so nothing was written.";
+/**
+ * The lost-row conflict: the read selected a row and the re-asserted write
+ * matched none, so **nothing was written** and a retry may succeed.
+ *
+ * `A2014 STALE_SELECTION`, and this is the only place that names it. The cause
+ * carries framework text and no issues: like `A2008` and `A2013` it pairs with
+ * **no** V-code, because a conflict is not a Framework Validation Layer failure
+ * and ADR 0008 decision 1 would give a conflict V-code no legal rollup (C-839).
+ */
+export function lostRowConflict() {
+    return new FrameworkError("A2014", { message: LOST_ROW_MESSAGE });
+}
+/** Prisma's code for "the records required for this operation were not found". */
+const MISSING_RECORD_CODE = "P2025";
+/** A plan that is not the two-step shape this module manufactures. */
+export class PrismaEmulationError extends Error {
+    name = "PrismaEmulationError";
+}
+/**
+ * Runs one first-style variant.
+ *
+ * @returns the affected row, shaped to the caller's `select`/`include` by the
+ * write's own projection, or `null` when the read matched nothing.
+ * @throws the lost-row conflict when the re-asserted write matches no row.
+ */
+export async function runFirstVariantEmulation(emulation) {
+    const [read, write] = emulation.steps;
+    if (read === undefined || write === undefined) {
+        throw new PrismaEmulationError("a first-style emulation is exactly two steps: the read that selects the row and the write that applies the effect");
+    }
+    return emulation.inUnit(async (issue) => {
+        const selected = await issue(read, "read");
+        if (selected === null || selected === undefined) {
+            // C-826: the adapter returns `null` and core assigns `A1001 NO_MATCH`.
+            return null;
+        }
+        if (!isRecord(selected)) {
+            throw new PrismaEmulationError("the first-style read answered a value that is not a row, so no identifier can be read from it");
+        }
+        const addressed = addressIdentifier({
+            addresses: emulation.identifiers,
+            values: selected,
+            // `"subset"`: the read selects the identifier today, and a future route
+            // may select the caller's projection beside it. Either way the criterion
+            // is complete, which is all the write needs.
+            match: "subset",
+            emit: (_member, value) => value,
+        });
+        if (addressed === undefined) {
+            throw new PrismaEmulationError(`the first-style read returned { ${Object.keys(selected).join(", ")} }, which completes no recorded identifier, so the write has nothing to target`);
+        }
+        try {
+            return await issue({
+                ...write,
+                // The invariant, and the whole point of the step: the issued `where`
+                // carries BOTH the identifier and the caller's original predicate
+                // (C-856, D-829). The predicate arrives already under `AND` from the
+                // translator, so merging the identifier in cannot reshape it — and when
+                // the caller sent no `where` there is no `AND` to carry, because
+                // inventing an empty one would emit a token the request never did.
+                args: {
+                    ...write.args,
+                    where: { ...addressed.where, ...writeWhere(write) },
+                },
+            }, "write");
+        }
+        catch (error) {
+            if (readPrismaError(error).code === MISSING_RECORD_CODE) {
+                throw lostRowConflict();
+            }
+            throw error;
+        }
+    });
+}
+/** The re-asserted predicate the translator placed on the write template. */
+function writeWhere(write) {
+    const where = write.args.where;
+    if (where === undefined) {
+        return {};
+    }
+    if (!isRecord(where)) {
+        throw new PrismaEmulationError("the first-style write template's `where` must be the re-asserted predicate");
+    }
+    return where;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/execution/operation.executor.d.ts

@@ -0,0 +1,87 @@
+import type { AdapterModel, AdapterOperationExecutor } from "@aventara/core";
+import type { PrismaResourceTranslation } from "../discovery/discovery-artifact.interface.js";
+import { type PrismaDelegateHost, type PrismaTransactionOptions } from "../prisma-client.interface.js";
+/**
+ * The execution half of T-7: a translated {@link PrismaCall} → a provider call,
+ * and `Adapter.execute` made real.
+ *
+ * Translation is pure and lives in `translation/operation.translator.ts`; this
+ * module owns the three things that need a client and nothing else:
+ *
+ * 1. **Reaching the delegate.** See {@link delegateKeyOf} — the one derivation in
+ *    this package, and the one place it is made.
+ * 2. **Classifying a failure.** The closed P-code table in
+ *    `errors/error.normalizer.ts` answers `absence` → `null` (D-811),
+ *    `outcome` → a deliberate `FrameworkError`, or `unclassified` → propagate, so
+ *    core's `AdapterBoundary` reports `A3001` with core's own text and sends the
+ *    raw error to diagnostics. The adapter never guesses a code it did not measure.
+ * 3. **Shaping the answer.** `execution/result.shaper.ts` places every `$count`
+ *    envelope, converts every returned value to the runtime form core's output
+ *    validator accepts (C-834's inbound half) and reads the number a count variant
+ *    owes; which of its three entry points runs is the *variant's* `result` row in
+ *    the dispatch table, not a guess from the shape Prisma returned. The shaper is
+ *    handed the model and the Resource as well as the plan, because the scalar a
+ *    returned value belongs to is a fact of the model and not of the value.
+ *
+ * # One executor type, two scopes (D-807, C-804)
+ *
+ * `scope: "root"` is the adapter's own `execute`. `scope: "transaction"` is what
+ * `Adapter.transaction`'s callback hands core: the same code over a transaction
+ * client. The scope decides exactly one thing — whether a first-style emulation
+ * opens its own interactive transaction or reuses the one already open — and a
+ * transaction-scoped executor closes over the transaction client only, so the root
+ * client is unreachable from inside it.
+ *
+ * # C-834 is converted at its own seam, not at this one
+ *
+ * All three value crossings read ONE table, `translation/scalar.conversion.ts`:
+ * a write's data through `mutation.translator.ts`, a filter operand through
+ * `where.translator.ts`, and a returned row through `execution/result.shaper.ts`.
+ * None of them is converted here. Converting at this seam would have put the
+ * scalar table in a fourth place and hidden the gap from the module that owns it.
+ *
+ * **Core's output validation runs after this module, and strips.** For a
+ * projection-carrying variant `planReadOperation` sets `materialize: true` and
+ * `materializeRecord` ends in `Object.fromEntries(plan.requested…)` **[CORE]**, so
+ * a spare key the adapter returned would be removed before the validator saw it.
+ * That is why the emulator's own return value is asserted directly in
+ * `first-variant.emulator.spec.ts` as well as end-to-end here: an end-to-end
+ * assertion about extra keys cannot fail on that path.
+ */
+/** A call the executor cannot issue against the client it was given. */
+export declare class PrismaExecutionError extends Error {
+    readonly name = "PrismaExecutionError";
+}
+export type PrismaExecutionScope = "root" | "transaction";
+export type PrismaOperationExecutorDependencies = {
+    /**
+     * The client in force: the application's own client at `"root"` scope, the
+     * transaction client inside a plan.
+     */
+    readonly client: PrismaDelegateHost;
+    readonly model: AdapterModel;
+    /** The generate-time translation table (Prisma addressing per Resource). */
+    readonly translation: Readonly<Record<string, PrismaResourceTranslation>>;
+    readonly scope: PrismaExecutionScope;
+    /** Adapter-owned, never Aventara public configuration (D-806). */
+    readonly transactionOptions?: PrismaTransactionOptions;
+};
+/**
+ * Prisma's delegate property for a model.
+ *
+ * **Derived, and that is a recorded residual rather than a comfortable choice.**
+ * The authoritative token is readable — `generated/<engine>/models/<M>.ts`, a 🟢
+ * file, writes it as the extension key: `GetSelect<{ … },
+ * ExtArgs["result"]["author"]>` for model `Author` — but `types.reader.ts` reads
+ * the 🟢 files for *capability* facts and does not record it, and the client
+ * property itself is declared only in `internal/class.ts`, which that reader
+ * refuses by design. So the rule applied here is Prisma's own: lower-case the
+ * first character and nothing else. `operation.executor.spec.ts` asserts the
+ * derivation against the real generated client for **every** model in the schema,
+ * so it is observed for this repository's six models; a model name whose Prisma
+ * property does not follow the rule would be caught there and not in production.
+ * The clean owner of the fact is the generate-time translation table, beside
+ * `identifierKeys`, and that is left as a pointer rather than taken here.
+ */
+export declare function delegateKeyOf(model: string): string;
+export declare function createPrismaOperationExecutor<M extends AdapterModel>(dependencies: PrismaOperationExecutorDependencies): AdapterOperationExecutor<M>;