@endora-commerce/platform 0.100.0

package/dist/db/migrate.js

@@ -0,0 +1,48 @@
+export async function runMigrationCommand(orm, command, io) {
+    const migrator = orm.getMigrator();
+    switch (command) {
+        case 'up': {
+            const applied = await migrator.up();
+            io.out(`applied ${applied.length} migration(s)\n`);
+            for (const m of applied)
+                io.out(`  + ${m.name}\n`);
+            return 0;
+        }
+        case 'down': {
+            const reverted = await migrator.down();
+            io.out(`reverted ${reverted.length} migration(s)\n`);
+            for (const m of reverted)
+                io.out(`  - ${m.name}\n`);
+            return 0;
+        }
+        case 'pending': {
+            const pending = await migrator.getPendingMigrations();
+            if (pending.length === 0) {
+                io.out('no pending migrations\n');
+            }
+            else {
+                for (const m of pending)
+                    io.out(`  ~ ${m.name}\n`);
+            }
+            return 0;
+        }
+        case 'fresh': {
+            // Drop the entire schema by name rather than relying on
+            // `dropSchema()`, which only removes tables present in the current
+            // entity metadata. Tables that exist in the DB but are no longer (or
+            // not yet) reflected in metadata — e.g. pivot tables — would survive
+            // that path and make Migration001 fail with "relation already exists".
+            // A raw `DROP SCHEMA ... CASCADE` guarantees a clean slate.
+            const conn = orm.em.getConnection();
+            await conn.execute('drop schema public cascade; create schema public;');
+            const applied = await migrator.up();
+            io.out(`dropped and re-applied ${applied.length} migration(s)\n`);
+            return 0;
+        }
+        default: {
+            io.err(`unknown command: ${command}\n`);
+            return 1;
+        }
+    }
+}
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAa,EACb,OAAe,EACf,EAAsB;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEnC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC;YACpC,EAAE,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvC,EAAE,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wDAAwD;YACxD,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC;YACpC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,CAAC,MAAM,iBAAiB,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/db/migration-order.d.ts

@@ -0,0 +1,159 @@
+import type { MigrationObject } from '@mikro-orm/core';
+/**
+ * Computes the order in which migrations are handed to the migrator.
+ *
+ * Pure by design: no I/O, no clock read, no environment read, and no import
+ * from `src/modules/`. It is importable and testable without booting the ORM.
+ *
+ * The rule is two blocks. A **baseline block** — the migrations named by the
+ * platform's published baseline list — is emitted first, in the order that list
+ * holds them, exactly as history applied them. Everything else is the
+ * **open block**, emitted module by module in a topological order of the
+ * module dependency graph, each module's migrations contiguous and ascending
+ * by timestamp. So a timestamp orders migrations only **within** their own
+ * module, and a manifest's `dependencies` array is the only thing ordering one
+ * module's schema against another's — which is what lets a migration arrive
+ * from an installed package whose author knows nothing of the host's history.
+ *
+ * Specified by specs/081-per-module-migration-order/contracts/ — the ordering
+ * in `ordering-algorithm.md` (which supersedes the feature-065 contract in
+ * whole), the class-name rule it enforces in `migration-identity.md`. The
+ * baseline block's membership rule is amended by
+ * `specs/110-instance-repository/contracts/instance-migration-order.md`: it is
+ * an **identity**, not a stamp and not an origin, so that the same corpus
+ * installed from packages orders identically. That contract's §1 is where every
+ * obvious alternative — squash, re-stamp, declare a dependency, drop the
+ * boundary — is refused with the reason.
+ */
+/** A migration class as MikroORM instantiates it. */
+export type MigrationClass = MigrationObject['class'];
+/** Where a registry entry came from. Absent means `'core'`. */
+export type MigrationOrigin = 'core' | 'external';
+export interface MigrationRegistryEntry {
+    /**
+     * Owning module id — a `manifest.id` from the resolved manifest index, or
+     * the literal 'core' for the cross-cutting migrations in src/db/migrations/.
+     */
+    moduleId: string;
+    /** The migration class. `cls.name` IS the migration name persisted in the DB. */
+    cls: MigrationClass;
+    /**
+     * Absent means `'core'`, so the committed generated registry is untouched. A
+     * producer outside it must set `'external'`.
+     *
+     * **No ordering decision is taken on it** (R1.6). It survives because the
+     * acceptance criterion's per-origin template digest reads it and
+     * `configured-migrations.ts` reports it — but it once decided membership of
+     * the frozen prefix, and that is exactly what made the prefix empty when the
+     * modules became packages: `origin` answers *"did this come out of our
+     * build"*, which is not the question *"is this one of the migrations whose
+     * order is history"*. The second question is answered by
+     * {@link OrderMigrationsInput.baseline}, which names them.
+     */
+    origin?: MigrationOrigin;
+}
+export type MigrationOrderErrorCode = 'unparsable-name' | 'duplicate-name' | 'duplicate-timestamp' | 'unknown-module' | 'unscoped-name';
+export declare class MigrationOrderError extends Error {
+    readonly code: MigrationOrderErrorCode;
+    constructor(code: MigrationOrderErrorCode, message: string);
+}
+/**
+ * The frozen historical prefix boundary. **Closed. Never drained.**
+ *
+ * Every migration the committed core registry contributed at or before this
+ * UTC stamp predates feature 065: it was written, and applied, in the
+ * hand-maintained array order of the pre-065 `migrationsList`, and those
+ * modules' `dependencies` arrays do not describe the order they actually need
+ * — they contradict it in 37 places. Emitting that block in any other order
+ * produces one a fresh database cannot apply: measured, not assumed — with the
+ * boundary removed, `db:fresh` fails at
+ * `Migration20260505T102206AssetsLibraryInit` with `relation "cms_pages" does
+ * not exist`, because the graph pulls `assets_library` ahead of `cms`.
+ *
+ * So it is not "the block we have not corrected yet"; it is "the block whose
+ * order is history", and nothing should try to drain it. It cannot grow
+ * either: `scripts/new-migration.ts` clamps every scaffolded core stamp past
+ * the boundary.
+ *
+ * **It is a generation-time rule, and no longer a runtime membership test**
+ * (`specs/110-instance-repository/contracts/instance-migration-order.md` R1.2).
+ * `scripts/new-migration.ts` clamps a scaffolded stamp past it, and
+ * `composer:generate` renders the published baseline list out of what the
+ * committed core registry contributes at or below it. Nothing asks it at run
+ * time, because a stamp is a claim an arriving package can make and a name is
+ * not: an entry stamped `20250101T000000` reaches this platform from a registry
+ * with the same authority as one of ours, and history is a list of names.
+ */
+export declare const BASELINE_THROUGH = "20260801T000000";
+export interface OrderMigrationsInput {
+    /** Registry entries. Order is irrelevant. */
+    entries: readonly MigrationRegistryEntry[];
+    /**
+     * moduleId → directly declared `dependencies`. Must contain every entry's
+     * moduleId. This is the primary ordering input, and no other manifest array
+     * is read: nothing else orders one module's migrations against another's.
+     */
+    moduleDependencies: ReadonlyMap<string, readonly string[]>;
+    /**
+     * The frozen historical prefix, **by identity**: the migration class names
+     * whose order is history, in the order history applied them.
+     *
+     * Normally `BASELINE_MIGRATIONS`, the list `@endora-commerce/platform`
+     * publishes — data about this platform's history, carried to a client by the
+     * package that carries the history (R1.5), and generated rather than
+     * hand-written (R1.3). A name here that this composition does not supply is
+     * simply not emitted, which is what an instance installing a subset of the
+     * modules is; the two-way reconciliation that would catch a *wrong* list is a
+     * guard over this repository's committed artefacts
+     * (`test/unit/db/instance-migration-order.test.ts`), never a throw here.
+     */
+    baseline: readonly string[];
+}
+/** What the computation observed and did not refuse. */
+export interface MigrationOrderDiagnostic {
+    kind: 'module-cycle';
+    /** Every member of the strongly connected component, sorted. At least two. */
+    modules: readonly string[];
+    /** Operator-readable: names the members and says what the order did instead. */
+    message: string;
+}
+export interface MigrationOrderResult {
+    /** Assigned verbatim to `migrations.migrationsList`. */
+    migrations: MigrationObject[];
+    diagnostics: readonly MigrationOrderDiagnostic[];
+}
+/**
+ * The frozen prefix as history recorded it, over migration **names**.
+ *
+ * This is the one derivation of that order in the repository: `composer:generate`
+ * renders the published baseline list with it, and the fixtures that drive
+ * `orderMigrations` build their own frozen block with it. A second
+ * implementation would be free to disagree with the first, and nothing compares
+ * two orders that are never computed together.
+ *
+ * It is a **generation-time** answer and takes the watermark for that reason
+ * (R1.2). The result is what {@link orderMigrations} then emits verbatim: the
+ * ordering itself asks no question about a stamp.
+ */
+export declare function historicalBaselineOrder(names: readonly string[], baselineThrough?: string): string[];
+/**
+ * Every dependency cycle in a module graph, in the same shape and wording
+ * `orderMigrations` reports — one strongly connected component of more than
+ * one module per diagnostic, members sorted.
+ *
+ * Two of the diagnostic's three readers are here: `test/unit/db/module-graph.test.ts`,
+ * which fails the build on a cycle in the committed manifests, and the ORM
+ * configuration, which warns at boot and keeps serving. The third is the
+ * `_lifecycle` orchestrator, which refuses an install whose arrival closes a
+ * cycle — the one moment where refusing costs nothing (081 FR-012).
+ *
+ * **The walk itself is the platform's** (D-160.11): the orchestrator reads
+ * `moduleDependencyCycles` directly rather than this wrapper, because it lives
+ * in `@endora-commerce/platform` and this file is the host application's. Three
+ * reactions, one graph walk — the split is the point, and what keeps a second
+ * walk from being free to disagree with this one is that there is only one.
+ * What is added here is the *wording*, which is the migration order's own.
+ */
+export declare function findModuleCycles(moduleDependencies: ReadonlyMap<string, readonly string[]>): readonly MigrationOrderDiagnostic[];
+export declare function orderMigrations(input: OrderMigrationsInput): MigrationOrderResult;
+//# sourceMappingURL=migration-order.d.ts.map

package/dist/db/migration-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-order.d.ts","sourceRoot":"","sources":["../../src/db/migration-order.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAUvD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,qDAAqD;AACrD,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;AAEtD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,GAAG,EAAE,cAAc,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,MAAM,uBAAuB,GAC/B,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC3D;;;;;;;;;;;;OAYG;IACH,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,8EAA8E;IAC9E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAClD;AA4ID;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,eAAe,GAAE,MAAyB,GACzC,MAAM,EAAE,CAkBV;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACzD,SAAS,wBAAwB,EAAE,CAErC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAmDjF"}

package/dist/db/migration-order.js

@@ -0,0 +1,273 @@
+// The graph walk is the platform's (D-160.11): the lifecycle orchestrator refuses an
+// install whose arrival closes a cycle, and the member list it names an operator has to
+// be the member list reported here. One implementation is what makes that true.
+import { moduleDependencyCycles, sortComponentsTopologically, stronglyConnectedComponents, } from '../lifecycle/services/dep-graph.js';
+export class MigrationOrderError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'MigrationOrderError';
+        this.code = code;
+    }
+}
+/**
+ * The frozen historical prefix boundary. **Closed. Never drained.**
+ *
+ * Every migration the committed core registry contributed at or before this
+ * UTC stamp predates feature 065: it was written, and applied, in the
+ * hand-maintained array order of the pre-065 `migrationsList`, and those
+ * modules' `dependencies` arrays do not describe the order they actually need
+ * — they contradict it in 37 places. Emitting that block in any other order
+ * produces one a fresh database cannot apply: measured, not assumed — with the
+ * boundary removed, `db:fresh` fails at
+ * `Migration20260505T102206AssetsLibraryInit` with `relation "cms_pages" does
+ * not exist`, because the graph pulls `assets_library` ahead of `cms`.
+ *
+ * So it is not "the block we have not corrected yet"; it is "the block whose
+ * order is history", and nothing should try to drain it. It cannot grow
+ * either: `scripts/new-migration.ts` clamps every scaffolded core stamp past
+ * the boundary.
+ *
+ * **It is a generation-time rule, and no longer a runtime membership test**
+ * (`specs/110-instance-repository/contracts/instance-migration-order.md` R1.2).
+ * `scripts/new-migration.ts` clamps a scaffolded stamp past it, and
+ * `composer:generate` renders the published baseline list out of what the
+ * committed core registry contributes at or below it. Nothing asks it at run
+ * time, because a stamp is a claim an arriving package can make and a name is
+ * not: an entry stamped `20250101T000000` reaches this platform from a registry
+ * with the same authority as one of ours, and history is a list of names.
+ */
+export const BASELINE_THROUGH = '20260801T000000';
+/** The cross-cutting pseudo-module owning src/db/migrations/. */
+const CORE_MODULE_ID = 'core';
+/** Class-name recognizer — see contracts/migration-identity.md §2. */
+const MIGRATION_CLASS_RE = /^Migration(\d{8}T\d{6})[A-Z0-9]/;
+/** `orders` → `Orders`, `customer_accounts` → `CustomerAccounts`, `_i18n` → `I18n`. */
+function expectedNamePrefix(moduleId) {
+    return (moduleId.startsWith('_') ? moduleId.slice(1) : moduleId)
+        .split('_')
+        .filter((part) => part.length > 0)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join('');
+}
+/**
+ * Rejects a well-formed stamp that names no real instant — month 13, hour 25,
+ * 30 February. The round trip is what catches the last one: `Date.UTC` rolls it
+ * forward to 2 March rather than refusing it.
+ */
+function assertRealInstant(name, timestamp) {
+    const at = (from, width) => Number(timestamp.slice(from, from + width));
+    const utc = new Date(Date.UTC(at(0, 4), at(4, 2) - 1, at(6, 2), at(9, 2), at(11, 2), at(13, 2)));
+    // '2026-08-19T07:48:16.000Z' → '20260819T074816'. The regex bounds the year
+    // to four digits, so `toISOString` never takes its extended ±YYYYYY form.
+    if (utc.toISOString().replace(/[-:]/g, '').slice(0, 15) !== timestamp) {
+        throw new MigrationOrderError('unparsable-name', `[migration-order] migration "${name}" carries the timestamp ${timestamp}, ` +
+            `which is not a real UTC instant. Fix the class name and the filename.`);
+    }
+}
+/** Step 1 — parse & validate entries. */
+function parseEntries(entries, moduleDependencies) {
+    const byName = new Map();
+    // Keyed by module, not globally: two authors who cannot talk to each other
+    // must not have to coordinate stamps, and after Step 5 a stamp orders
+    // nothing outside its own module anyway.
+    const byModuleStamp = new Map();
+    const parsed = [];
+    for (const entry of entries) {
+        const name = entry.cls.name;
+        const match = MIGRATION_CLASS_RE.exec(name);
+        if (!match) {
+            throw new MigrationOrderError('unparsable-name', `[migration-order] migration class "${name}" does not match the naming ` +
+                `convention Migration<YYYYMMDDTHHmmss><PascalCaseTail>. See ` +
+                `specs/081-per-module-migration-order/contracts/migration-identity.md.`);
+        }
+        const timestamp = match[1];
+        assertRealInstant(name, timestamp);
+        const duplicateName = byName.get(name);
+        if (duplicateName) {
+            throw new MigrationOrderError('duplicate-name', `[migration-order] migration "${name}" is registered more than once ` +
+                `(modules "${duplicateName.moduleId}" and "${entry.moduleId}"). The class ` +
+                `name is what \`mikro_orm_migrations\` stores, so it must be globally ` +
+                `unique; rename one and regenerate with \`composer:generate\`.`);
+        }
+        const prefix = expectedNamePrefix(entry.moduleId);
+        if (!name.slice(match[0].length - 1).startsWith(prefix)) {
+            throw new MigrationOrderError('unscoped-name', `[migration-order] migration "${name}" is owned by module "${entry.moduleId}", ` +
+                `so it must be named Migration${timestamp}${prefix}…. A class name is ` +
+                `scoped by its module, which is what makes it unique across every module ` +
+                `the platform can compose — contracts/migration-identity.md §2.`);
+        }
+        const stampKey = `${entry.moduleId} ${timestamp}`;
+        const duplicateStamp = byModuleStamp.get(stampKey);
+        if (duplicateStamp) {
+            throw new MigrationOrderError('duplicate-timestamp', `[migration-order] module "${entry.moduleId}" has two migrations stamped ` +
+                `${timestamp}: "${duplicateStamp.name}" and "${name}". Inside one module the ` +
+                `timestamp is the whole order; advance one by a whole second (file and class).`);
+        }
+        if (entry.moduleId !== CORE_MODULE_ID && !moduleDependencies.has(entry.moduleId)) {
+            throw new MigrationOrderError('unknown-module', `[migration-order] migration "${name}" declares the unknown owning ` +
+                `module "${entry.moduleId}". Add the module's manifest and run ` +
+                `\`pnpm --filter backend run manifest-index:generate\`.`);
+        }
+        const migration = {
+            name,
+            timestamp,
+            moduleId: entry.moduleId,
+            origin: entry.origin ?? CORE_MODULE_ID,
+            cls: entry.cls,
+        };
+        byName.set(name, migration);
+        byModuleStamp.set(stampKey, migration);
+        parsed.push(migration);
+    }
+    return parsed;
+}
+/**
+ * Ascending by timestamp, ties broken by class name — the tiebreak is what
+ * keeps the output a pure function of its inputs now that two modules may
+ * legally share a stamp.
+ */
+function chronologically(left, right) {
+    if (left.timestamp !== right.timestamp)
+        return left.timestamp < right.timestamp ? -1 : 1;
+    return left.name < right.name ? -1 : 1;
+}
+/**
+ * The frozen prefix as history recorded it, over migration **names**.
+ *
+ * This is the one derivation of that order in the repository: `composer:generate`
+ * renders the published baseline list with it, and the fixtures that drive
+ * `orderMigrations` build their own frozen block with it. A second
+ * implementation would be free to disagree with the first, and nothing compares
+ * two orders that are never computed together.
+ *
+ * It is a **generation-time** answer and takes the watermark for that reason
+ * (R1.2). The result is what {@link orderMigrations} then emits verbatim: the
+ * ordering itself asks no question about a stamp.
+ */
+export function historicalBaselineOrder(names, baselineThrough = BASELINE_THROUGH) {
+    return names
+        .map((name) => {
+        const match = MIGRATION_CLASS_RE.exec(name);
+        if (!match) {
+            throw new MigrationOrderError('unparsable-name', `[migration-order] migration class "${name}" does not match the naming ` +
+                `convention Migration<YYYYMMDDTHHmmss><PascalCaseTail>, so the frozen ` +
+                `historical prefix cannot be derived from it. See ` +
+                `specs/081-per-module-migration-order/contracts/migration-identity.md.`);
+        }
+        return { name, timestamp: match[1] };
+    })
+        .filter((migration) => migration.timestamp <= baselineThrough)
+        .sort(chronologically)
+        .map((migration) => migration.name);
+}
+/**
+ * Step 4 — a stable topological sort of the condensation.
+ *
+ * **The walk is the platform's** (`sortComponentsTopologically`), for the reason
+ * `stronglyConnectedComponents` is: feature 113's demo runner orders modules by
+ * the same manifest graph, and its contract says it *"MUST NOT maintain an order
+ * of its own"* (§4.1). Two implementations of one order would disagree silently,
+ * because nothing compares a demo run's order to a migration run's.
+ *
+ * What stays here is the `'core'` argument, which is this file's alone: `'core'`
+ * declares nothing and nothing declares it, so it is always ready at the start,
+ * every module's tables sit downstream of the bootstrap tables, and saying so
+ * beats relying on an accident of alphabetical ordering.
+ */
+function sortComponents(components, neighboursOf) {
+    return sortComponentsTopologically(components, neighboursOf, CORE_MODULE_ID);
+}
+/** Step 3 — the ordering graph of a module dependency map, and its components. */
+function orderingGraph(moduleDependencies) {
+    const nodes = [...moduleDependencies.keys()];
+    if (!moduleDependencies.has(CORE_MODULE_ID))
+        nodes.push(CORE_MODULE_ID);
+    // Edges to ids absent from the map are skipped; a *migration* claiming such
+    // a module is rejected by Step 1 instead.
+    const neighboursOf = (id) => (moduleDependencies.get(id) ?? []).filter((dependency) => moduleDependencies.has(dependency));
+    return { components: stronglyConnectedComponents(nodes, neighboursOf), neighboursOf };
+}
+/** A component of more than one module is a cycle, and is reported, never thrown. */
+function cycleDiagnostics(components) {
+    return components
+        .filter((members) => members.length > 1)
+        .map((members) => ({
+        kind: 'module-cycle',
+        modules: members,
+        message: `[migration-order] modules [${members.join(', ')}] declare a dependency cycle. ` +
+            `Their migrations are emitted as one block in timestamp order, because the ` +
+            `declarations contain no order. Fix the \`dependencies\` array in one of them.`,
+    }));
+}
+/**
+ * Every dependency cycle in a module graph, in the same shape and wording
+ * `orderMigrations` reports — one strongly connected component of more than
+ * one module per diagnostic, members sorted.
+ *
+ * Two of the diagnostic's three readers are here: `test/unit/db/module-graph.test.ts`,
+ * which fails the build on a cycle in the committed manifests, and the ORM
+ * configuration, which warns at boot and keeps serving. The third is the
+ * `_lifecycle` orchestrator, which refuses an install whose arrival closes a
+ * cycle — the one moment where refusing costs nothing (081 FR-012).
+ *
+ * **The walk itself is the platform's** (D-160.11): the orchestrator reads
+ * `moduleDependencyCycles` directly rather than this wrapper, because it lives
+ * in `@endora-commerce/platform` and this file is the host application's. Three
+ * reactions, one graph walk — the split is the point, and what keeps a second
+ * walk from being free to disagree with this one is that there is only one.
+ * What is added here is the *wording*, which is the migration order's own.
+ */
+export function findModuleCycles(moduleDependencies) {
+    return cycleDiagnostics(moduleDependencyCycles(moduleDependencies));
+}
+export function orderMigrations(input) {
+    const { entries, moduleDependencies, baseline: baselineNames } = input;
+    const parsed = parseEntries(entries, moduleDependencies);
+    const { components, neighboursOf } = orderingGraph(moduleDependencies);
+    // Reported, never thrown: the graph is the primary ordering now, so a throw
+    // would mean a stranger's manifest can stop a shop's own schema from
+    // migrating. The readers want different reactions — a red unit test
+    // (`test/unit/db/module-graph.test.ts`), a `warn` at boot, and the lifecycle
+    // refusing an install that closes a loop (FR-012) — and none of them belongs
+    // in a pure function.
+    const diagnostics = cycleDiagnostics(components);
+    // Step 2 — baseline membership, by **identity**. The published list is
+    // ordered and that order is history's, so the block is emitted as the list
+    // holds it rather than as a comparator recomputes it: a comparator that ever
+    // disagreed with the list would make the artefact a lie, and this way there
+    // is nothing for it to disagree with. A listed name this composition does not
+    // supply is simply absent — that is an instance installing a subset.
+    const baselinePosition = new Map(baselineNames.map((name, index) => [name, index]));
+    const baseline = [];
+    const openByModule = new Map();
+    for (const migration of parsed) {
+        if (baselinePosition.has(migration.name)) {
+            baseline.push(migration);
+            continue;
+        }
+        const bucket = openByModule.get(migration.moduleId);
+        if (bucket)
+            bucket.push(migration);
+        else
+            openByModule.set(migration.moduleId, [migration]);
+    }
+    baseline.sort((left, right) => baselinePosition.get(left.name) - baselinePosition.get(right.name));
+    // Step 5 — the open block, component by component, contiguous. A
+    // multi-module component has no internal order to respect, so its members'
+    // migrations are merged and emitted chronologically across the whole block:
+    // the baseline block's rule, applied locally.
+    const open = [];
+    for (const members of sortComponents(components, neighboursOf)) {
+        const owned = members.flatMap((member) => openByModule.get(member) ?? []);
+        open.push(...owned.sort(chronologically));
+    }
+    return {
+        migrations: [...baseline, ...open].map((migration) => ({
+            name: migration.name,
+            class: migration.cls,
+        })),
+        diagnostics,
+    };
+}
+//# sourceMappingURL=migration-order.js.map

package/dist/db/migration-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-order.js","sourceRoot":"","sources":["../../src/db/migration-order.ts"],"names":[],"mappings":"AACA,qFAAqF;AACrF,wFAAwF;AACxF,gFAAgF;AAChF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAkE5C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AA0ClD,iEAAiE;AACjE,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAU7D,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC;IAChG,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,gCAAgC,IAAI,2BAA2B,SAAS,IAAI;YAC1E,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,SAAS,YAAY,CACnB,OAA0C,EAC1C,kBAA0D;IAE1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,2EAA2E;IAC3E,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;IACzD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,sCAAsC,IAAI,8BAA8B;gBACtE,6DAA6D;gBAC7D,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEnC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,gCAAgC,IAAI,iCAAiC;gBACnE,aAAa,aAAa,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,gBAAgB;gBAC3E,uEAAuE;gBACvE,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,gCAAgC,IAAI,yBAAyB,KAAK,CAAC,QAAQ,KAAK;gBAC9E,gCAAgC,SAAS,GAAG,MAAM,qBAAqB;gBACvE,0EAA0E;gBAC1E,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAC3B,qBAAqB,EACrB,6BAA6B,KAAK,CAAC,QAAQ,+BAA+B;gBACxE,GAAG,SAAS,MAAM,cAAc,CAAC,IAAI,UAAU,IAAI,2BAA2B;gBAC9E,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,gCAAgC,IAAI,gCAAgC;gBAClE,WAAW,KAAK,CAAC,QAAQ,uCAAuC;gBAChE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAoB;YACjC,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;YACtC,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,IAA2D,EAC3D,KAA4D;IAE5D,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAwB,EACxB,kBAA0B,gBAAgB;IAE1C,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,sCAAsC,IAAI,8BAA8B;gBACtE,uEAAuE;gBACvE,mDAAmD;gBACnD,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IACxC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,IAAI,eAAe,CAAC;SAC7D,IAAI,CAAC,eAAe,CAAC;SACrB,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CACrB,UAA+B,EAC/B,YAA+C;IAE/C,OAAO,2BAA2B,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,kBAA0D;IAI/E,MAAM,KAAK,GAAG,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,YAAY,GAAG,CAAC,EAAU,EAAqB,EAAE,CACrD,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAChG,OAAO,EAAE,UAAU,EAAE,2BAA2B,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;AACxF,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,UAA+B;IACvD,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,IAAI,EAAE,cAAuB;QAC7B,OAAO,EAAE,OAAO;QAChB,OAAO,EACL,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YAChF,4EAA4E;YAC5E,+EAA+E;KAClF,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,kBAA0D;IAE1D,OAAO,gBAAgB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACvE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAEzD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAEvE,4EAA4E;IAC5E,qEAAqE;IACrE,oEAAoE;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,sBAAsB;IACtB,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEjD,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;YAC9B,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC;IAErG,iEAAiE;IACjE,2EAA2E;IAC3E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/db/mikro-orm.config.d.ts

@@ -0,0 +1,51 @@
+import { type Options } from '@mikro-orm/postgresql';
+import type { ConfiguredEntity } from './configured-entities.js';
+import type { ConfiguredMigrations } from './configured-migrations.js';
+/**
+ * MikroORM configuration for an Endora platform.
+ *
+ * - PostgreSQL driver (constitutional stack).
+ * - Plural snake_case table names + snake_case columns (Principle VI) via the
+ *   custom naming strategy in ./pluralizing-naming-strategy.ts (R-04).
+ * - Migration ownership is module-local: each module keeps its migration files
+ *   under its own `migrations/` directory. The few genuinely cross-cutting
+ *   bootstrap migrations (foundation/commerce init, module-lifecycle, tenant
+ *   indexes) are the platform's own and live in `../migrations/`. Adding a
+ *   migration means dropping a file in the owning module's migrations/ dir and
+ *   regenerating — never here.
+ * - Both registries stay explicit static-import lists rather than a filesystem
+ *   glob: glob discovery needs runtime dynamic `import()` of .ts files, which
+ *   Node's ESM loader cannot transform and which breaks under Vitest. Since
+ *   feature 071's F2 the lists are *emitted* from a filesystem walk by
+ *   scripts/generate-composer.ts and committed, so they are static imports
+ *   nobody maintains by hand. The "registered ⇔ on-disk" round-trip is enforced
+ *   by test/unit/db/migrations-registry.test.ts, and `overlay:check` fails on a
+ *   committed artefact that drifted from the tree.
+ * - Execution order is computed by ./migration-order.ts: a frozen historical
+ *   prefix, then module by module in a topological order of the manifest
+ *   dependency graph, each module's migrations contiguous and ascending by
+ *   timestamp. See docs/docs/architecture/migrations.md.
+ *
+ * ## It takes its inputs and reads no artefact (`specs/110-instance-repository/` R7.4)
+ *
+ * Both committed registries are **bare core**, and stay that way: an installed
+ * extension package may ship entities and migrations (D-106.2), but which
+ * packages an instance installed is a fact about the process rather than about
+ * the tree, so the committed artefacts must not claim to know (D-119, confirmed
+ * as D-155). The package half is therefore discovered at runtime by
+ * `configured-entities.ts` and `configured-migrations.ts`, and the host hands
+ * the merged result in here. `backend/src/db/mikro-orm.config.ts` is the
+ * binding: it holds the async factory, the memoisation and the fourteen callers
+ * — all three facts about one process — and this file is the configuration
+ * itself, which is the platform's. `DATABASE_URL`, `NODE_ENV` and `DB_DEBUG`
+ * are the exception and stay a `process.env` read here; see {@link databaseUrl}.
+ */
+/** What {@link mikroOrmConfigFrom} needs from the host. */
+export interface OrmConfigurationInputs {
+    /** The merged entity set — `configuredEntitiesFrom`'s answer. */
+    readonly entities: readonly ConfiguredEntity[];
+    /** The merged execution order — `configuredMigrations`' answer. */
+    readonly migrations: ConfiguredMigrations;
+}
+export declare function mikroOrmConfigFrom(inputs: OrmConfigurationInputs): Options;
+//# sourceMappingURL=mikro-orm.config.d.ts.map

package/dist/db/mikro-orm.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mikro-orm.config.d.ts","sourceRoot":"","sources":["../../src/db/mikro-orm.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAInE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAiBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CA8C1E"}

package/dist/db/mikro-orm.config.js

@@ -0,0 +1,64 @@
+import { defineConfig } from '@mikro-orm/postgresql';
+import { Migrator } from '@mikro-orm/migrations';
+import { PluralizingNamingStrategy } from './pluralizing-naming-strategy.js';
+import { OrgWriteGuardSubscriber } from '../tenancy/org-write-guard.js';
+/**
+ * Read off `process.env` directly, and deliberately not through an injected
+ * environment.
+ *
+ * `check:env-inputs` reconciles the platform's declared inputs against the
+ * `process.env` and `import.meta.env` reads its walk can see, so a value
+ * reached through a parameter is a declared input nothing reads — measured on
+ * this file when T116 moved it: `DATABASE_URL` and `DB_DEBUG` both reported
+ * `unread-input`, which is an operator being asked for a value that changes
+ * nothing. Which database a process talks to is a fact about that process, so
+ * reading it here is also the honest shape.
+ */
+const databaseUrl = () => process.env['DATABASE_URL'] ?? 'postgresql://b2b:b2b@localhost:5432/b2b';
+export function mikroOrmConfigFrom(inputs) {
+    // A dependency cycle is a diagnostic, not a throw: the graph is the primary
+    // ordering now, so refusing here would let one mis-declared manifest stop
+    // the whole platform's schema from migrating — and since a manifest can
+    // arrive from an installed package, that manifest may be a stranger's.
+    // Nothing in this file branches on it — warning is the whole reaction, and
+    // the platform boots and serves. The other two readers refuse instead, each
+    // where refusing costs nothing: test/unit/db/module-graph.test.ts fails the
+    // build on a cycle in the committed manifests, and the _lifecycle
+    // orchestrator refuses an install whose arrival closes one (FR-012).
+    // test/unit/db/migration-order-boot-warning.test.ts is the proof that this
+    // warning fires on a cycle and is silent without one.
+    for (const diagnostic of inputs.migrations.diagnostics) {
+        console.warn(diagnostic.message);
+    }
+    return defineConfig({
+        clientUrl: databaseUrl(),
+        namingStrategy: PluralizingNamingStrategy,
+        // Explicit class list, not a glob — glob discovery requires runtime
+        // dynamic `import()` of .ts files, which Node's ESM loader cannot
+        // transform and which breaks under Vitest. See
+        // backend/src/db/entities-registry.generated.ts for the rationale and for
+        // what emits it, and ./configured-entities.ts for the package half.
+        entities: [...inputs.entities],
+        // The tenant guard on the write side (D-260/A). One subscriber, over the
+        // classification registry the `@OrgScoped()` decorators already write, so
+        // there is nothing per entity and nothing per module to declare here as
+        // classes arrive. It is constructed rather than passed in because it takes
+        // no input: its subscribed set and its predicate are both `tenancy/`'s, and
+        // a host that could substitute it could switch the guard off.
+        // See ../tenancy/org-write-guard.ts for what it does and does not catch.
+        subscribers: [new OrgWriteGuardSubscriber()],
+        debug: process.env['NODE_ENV'] === 'development' && process.env['DB_DEBUG'] === 'true',
+        allowGlobalContext: false,
+        forceUndefined: true,
+        extensions: [Migrator],
+        migrations: {
+            migrationsList: inputs.migrations.migrations,
+            transactional: true,
+            disableForeignKeys: false,
+            allOrNothing: true,
+            emit: 'ts',
+            snapshot: false,
+        },
+    });
+}
+//# sourceMappingURL=mikro-orm.config.js.map

package/dist/db/mikro-orm.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mikro-orm.config.js","sourceRoot":"","sources":["../../src/db/mikro-orm.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAgB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAoDxE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG,GAAW,EAAE,CAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,yCAAyC,CAAC;AAE3E,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,kEAAkE;IAClE,qEAAqE;IACrE,2EAA2E;IAC3E,sDAAsD;IACtD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,WAAW,EAAE;QACxB,cAAc,EAAE,yBAAyB;QACzC,oEAAoE;QACpE,kEAAkE;QAClE,+CAA+C;QAC/C,0EAA0E;QAC1E,oEAAoE;QACpE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,8DAA8D;QAC9D,yEAAyE;QACzE,WAAW,EAAE,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC5C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM;QACtF,kBAAkB,EAAE,KAAK;QACzB,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,UAAU,EAAE;YACV,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU;YAC5C,aAAa,EAAE,IAAI;YACnB,kBAAkB,EAAE,KAAK;YACzB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,KAAK;SAChB;KACF,CAAC,CAAC;AACL,CAAC"}