@prisma-next/cli 0.11.0-dev.46 → 0.11.0-dev.48

package/src/commands/migration-status.ts

@@ -1,10 +1,14 @@
+import type { Contract } from '@prisma-next/contract/types';
 import {
   createControlStack,
   type MigrationPlanOperation,
 } from '@prisma-next/framework-components/control';
 import {
   type ContractMarkerRecordLike,
+  type ContractSpaceAggregate,
   graphWalkStrategy,
+  loadContractSpaceAggregate,
+  requireHeadRef,
 } from '@prisma-next/migration-tools/aggregate';
 import { EMPTY_CONTRACT_HASH } from '@prisma-next/migration-tools/constants';
 import {
@@ -22,6 +26,7 @@ import type { OnDiskMigrationPackage } from '@prisma-next/migration-tools/packag
 import { parseContractRef } from '@prisma-next/migration-tools/ref-resolution';
 import type { RefEntry, Refs } from '@prisma-next/migration-tools/refs';
 import { readRefs } from '@prisma-next/migration-tools/refs';
+import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { notOk, ok, type Result } from '@prisma-next/utils/result';
 import { cyan, dim, magenta, yellow } from 'colorette';
@@ -39,7 +44,6 @@ import {
 import {
   addGlobalOptions,
   collectDeclaredInvariants,
-  loadMigrationPackages,
   maskConnectionUrl,
   readContractEnvelope,
   resolveMigrationPaths,
@@ -50,9 +54,10 @@ import {
   toStructuralEdge,
 } from '../utils/command-helpers';
 import {
-  type BuildAggregateInputs,
-  buildContractSpaceAggregate,
+  refuseContractSpaceIntegrity,
+  refusePackageCorruptionOnAggregate,
 } from '../utils/contract-space-aggregate-loader';
+import { toDeclaredExtensionsFromRaw } from '../utils/extension-pack-inputs';
 import {
   type EdgeStatus,
   type EdgeStatusKind,
@@ -433,46 +438,43 @@ function resolveDisplayChain(
  * cross-space totals.
  */
 export async function loadAggregateStatusSpaces(args: {
-  readonly targetId: string;
-  readonly migrationsDir: string;
-  readonly appContractRaw: unknown;
-  readonly extensionPacks: BuildAggregateInputs<string, string>['extensionPacks'];
-  readonly deserializeContract: BuildAggregateInputs<string, string>['deserializeContract'];
+  readonly aggregate: ContractSpaceAggregate;
+  readonly extensionPacks: ReadonlyArray<unknown>;
   readonly markersBySpace: ReadonlyMap<string, ContractMarkerRecordLike> | null;
 }): Promise<readonly MigrationStatusSpaceEntry[]> {
-  const loadInputs: BuildAggregateInputs<string, string> = {
-    targetId: args.targetId,
-    migrationsDir: args.migrationsDir,
-    appContract: args.deserializeContract(args.appContractRaw),
-    extensionPacks: args.extensionPacks,
-    deserializeContract: args.deserializeContract,
-  };
-
-  const loaded = await buildContractSpaceAggregate(loadInputs);
-  if (!loaded.ok) {
-    // Loader failure (drift, layout violation, etc.) — surfacing it
-    // as a status diagnostic would duplicate `migration plan`'s job.
+  const declaredExtensions = toDeclaredExtensionsFromRaw(args.extensionPacks);
+  if (
+    refuseContractSpaceIntegrity(args.aggregate, {
+      declaredExtensions,
+      checkContracts: true,
+    })
+  ) {
+    // Full integrity refusal (drift, layout violation, etc.) — surfacing
+    // it as a status diagnostic would duplicate `migration plan`'s job.
     // The single-space app pipeline still runs; extensions are simply
     // not enumerated.
     return [];
   }
-  const aggregate = loaded.value;
+  const aggregate = args.aggregate;
 
   const orderedMembers = [...aggregate.extensions, aggregate.app];
   const rows: MigrationStatusSpaceEntry[] = [];
   for (const member of orderedMembers) {
     const liveMarker = args.markersBySpace?.get(member.spaceId) ?? null;
     const isApp = member.spaceId === aggregate.app.spaceId;
+    // The aggregate passed the integrity gate above, so every member has
+    // a resolved head ref (a missing one would have refused the load).
+    const headRef = requireHeadRef(member);
 
-    if (member.migrations.graph.nodes.size === 0) {
+    if (member.graph().nodes.size === 0) {
       rows.push({
         spaceId: member.spaceId,
         kind: isApp ? 'app' : 'extension',
-        headHash: member.headRef.hash,
+        headHash: headRef.hash,
         ...(args.markersBySpace !== null
           ? {
               markerHash: liveMarker?.storageHash ?? null,
-              status: member.headRef.hash === EMPTY_CONTRACT_HASH ? 'up-to-date' : 'never-planned',
+              status: headRef.hash === EMPTY_CONTRACT_HASH ? 'up-to-date' : 'never-planned',
               pendingCount: 0,
             }
           : {}),
@@ -484,7 +486,7 @@ export async function loadAggregateStatusSpaces(args: {
       rows.push({
         spaceId: member.spaceId,
         kind: isApp ? 'app' : 'extension',
-        headHash: member.headRef.hash,
+        headHash: headRef.hash,
       });
       continue;
     }
@@ -513,7 +515,7 @@ export async function loadAggregateStatusSpaces(args: {
     rows.push({
       spaceId: member.spaceId,
       kind: isApp ? 'app' : 'extension',
-      headHash: member.headRef.hash,
+      headHash: headRef.hash,
       markerHash: liveMarker?.storageHash ?? null,
       pendingCount,
       ...(status ? { status } : {}),
@@ -528,6 +530,22 @@ export async function loadAggregateStatusSpaces(args: {
  * the existing `readContractEnvelope` path will report the same
  * problem via a status diagnostic, no need to double-surface.
  */
+
+function appContractShellForAggregateLoad(args: {
+  readonly contractHash: string;
+  readonly targetId: string;
+  readonly targetFamily: string;
+}): Contract {
+  return blindCast<Contract, 'status aggregate load without contract.json'>({
+    storage: { storageHash: args.contractHash },
+    schemaVersion: '0.0.0',
+    target: args.targetId,
+    targetFamily: args.targetFamily,
+    models: {},
+    profileHash: EMPTY_CONTRACT_HASH,
+  });
+}
+
 async function loadContractRawSafely(config: {
   contract?: { output?: string };
 }): Promise<unknown | null> {
@@ -580,8 +598,10 @@ async function executeMigrationStatusCommand(
   ui: TerminalUI,
 ): Promise<Result<MigrationStatusResult, CliStructuredError>> {
   const config = await loadConfig(options.config);
-  const { configPath, appMigrationsDir, appMigrationsRelative, migrationsDir, refsDir } =
-    resolveMigrationPaths(options.config, config);
+  const { configPath, appMigrationsRelative, migrationsDir, refsDir } = resolveMigrationPaths(
+    options.config,
+    config,
+  );
 
   const dbConnection = options.db ?? config.db?.connection;
   const hasDriver = !!config.driver;
@@ -599,37 +619,92 @@ async function executeMigrationStatusCommand(
     throw error;
   }
 
-  let fromOverrideHash: string | undefined;
+  const diagnostics: StatusDiagnostic[] = [];
+  let contractHash: string = EMPTY_CONTRACT_HASH;
+  try {
+    const envelope = await readContractEnvelope(config);
+    contractHash = envelope.storageHash;
+  } catch (error) {
+    diagnostics.push({
+      code: 'CONTRACT.UNREADABLE',
+      severity: 'warn',
+      message: `Could not read contract: ${error instanceof Error ? error.message : 'unknown error'}`,
+      hints: ["Run 'prisma-next contract emit' to generate a valid contract"],
+    });
+  }
 
-  if (options.to || options.from) {
+  const contractRawForAggregate = await loadContractRawSafely(config);
+  const stack = createControlStack(config);
+  const familyInstance = config.family.create(stack);
+  const deserializeContract = (json: unknown): Contract => familyInstance.deserializeContract(json);
+  const appContractShell = appContractShellForAggregateLoad({
+    contractHash,
+    targetId: config.target.id,
+    targetFamily: config.target.familyId,
+  });
+  let appContractForLoad: Contract = appContractShell;
+  if (contractRawForAggregate !== null) {
     try {
-      const { graph: earlyGraph } = await loadMigrationPackages(appMigrationsDir);
+      appContractForLoad = deserializeContract(contractRawForAggregate);
+    } catch (error) {
+      diagnostics.push({
+        code: 'CONTRACT.UNREADABLE',
+        severity: 'warn',
+        message: `Could not deserialize contract: ${error instanceof Error ? error.message : 'unknown error'}`,
+        hints: ["Run 'prisma-next contract emit' to generate a valid contract"],
+      });
+    }
+  }
 
-      if (options.to) {
-        const refResult = parseContractRef(options.to, { graph: earlyGraph, refs: allRefs });
-        if (!refResult.ok) {
-          return notOk(mapRefResolutionError(refResult.failure));
-        }
-        activeRefHash = refResult.value.hash;
-        if (refResult.value.provenance.kind === 'ref') {
-          const resolvedRefName = refResult.value.provenance.refName;
-          activeRefName = resolvedRefName;
-          activeRefEntry = allRefs[resolvedRefName];
-        }
-      }
+  let aggregate: ContractSpaceAggregate;
+  try {
+    aggregate = await loadContractSpaceAggregate({
+      migrationsDir,
+      deserializeContract,
+      appContract: appContractForLoad,
+    });
+  } catch (error) {
+    if (MigrationToolsError.is(error)) {
+      return notOk(mapMigrationToolsError(error));
+    }
+    return notOk(
+      errorUnexpected(error instanceof Error ? error.message : String(error), {
+        why: `Failed to read migrations directory: ${error instanceof Error ? error.message : String(error)}`,
+      }),
+    );
+  }
 
-      if (options.from) {
-        const fromResult = parseContractRef(options.from, { graph: earlyGraph, refs: allRefs });
-        if (!fromResult.ok) {
-          return notOk(mapRefResolutionError(fromResult.failure));
-        }
-        fromOverrideHash = fromResult.value.hash;
+  if (contractRawForAggregate !== null) {
+    const corruptionFailure = refusePackageCorruptionOnAggregate(aggregate);
+    if (corruptionFailure) {
+      return notOk(corruptionFailure);
+    }
+  }
+
+  const appGraph = aggregate.app.graph();
+
+  let fromOverrideHash: string | undefined;
+
+  if (options.to || options.from) {
+    if (options.to) {
+      const refResult = parseContractRef(options.to, { graph: appGraph, refs: allRefs });
+      if (!refResult.ok) {
+        return notOk(mapRefResolutionError(refResult.failure));
       }
-    } catch (error) {
-      if (MigrationToolsError.is(error)) {
-        return notOk(mapMigrationToolsError(error));
+      activeRefHash = refResult.value.hash;
+      if (refResult.value.provenance.kind === 'ref') {
+        const resolvedRefName = refResult.value.provenance.refName;
+        activeRefName = resolvedRefName;
+        activeRefEntry = allRefs[resolvedRefName];
       }
-      throw error;
+    }
+
+    if (options.from) {
+      const fromResult = parseContractRef(options.from, { graph: appGraph, refs: allRefs });
+      if (!fromResult.ok) {
+        return notOk(mapRefResolutionError(fromResult.failure));
+      }
+      fromOverrideHash = fromResult.value.hash;
     }
   }
 
@@ -670,34 +745,8 @@ async function executeMigrationStatusCommand(
     ui.stderr(header);
   }
 
-  const diagnostics: StatusDiagnostic[] = [];
-  let contractHash: string = EMPTY_CONTRACT_HASH;
-  try {
-    const envelope = await readContractEnvelope(config);
-    contractHash = envelope.storageHash;
-  } catch (error) {
-    diagnostics.push({
-      code: 'CONTRACT.UNREADABLE',
-      severity: 'warn',
-      message: `Could not read contract: ${error instanceof Error ? error.message : 'unknown error'}`,
-      hints: ["Run 'prisma-next contract emit' to generate a valid contract"],
-    });
-  }
-
-  let bundles: readonly OnDiskMigrationPackage[];
-  let graph: MigrationGraph;
-  try {
-    ({ bundles, graph } = await loadMigrationPackages(appMigrationsDir));
-  } catch (error) {
-    if (MigrationToolsError.is(error)) {
-      return notOk(mapMigrationToolsError(error));
-    }
-    return notOk(
-      errorUnexpected(error instanceof Error ? error.message : String(error), {
-        why: `Failed to read migrations directory: ${error instanceof Error ? error.message : String(error)}`,
-      }),
-    );
-  }
+  const bundles = aggregate.app.packages;
+  const graph = appGraph;
 
   if (bundles.length === 0) {
     if (dbConnection && hasDriver) {
@@ -808,32 +857,15 @@ async function executeMigrationStatusCommand(
     allMarkers = null;
   }
 
-  // Build the aggregate enumeration of contract spaces. Lossy on
-  // failure (extensions are simply omitted) so the existing
-  // single-space app pipeline below still runs even if extensions
-  // can't be loaded — a strict failure here would degrade the
-  // load-bearing app-space output for unrelated reasons.
-  const contractRawForAggregate = await loadContractRawSafely(config);
   let aggregateSpaces: readonly MigrationStatusSpaceEntry[] = [];
   if (contractRawForAggregate !== null) {
-    // The aggregate loader needs a typed-Contract producer. Build a
-    // real control stack so `deserializeContract` runs against a fully
-    // composed family instance — descriptors that read stack members
-    // during construction (e.g. codec lookups) get a consistent view.
-    const stack = createControlStack(config);
-    const familyInstance = config.family.create(stack);
     try {
       aggregateSpaces = await loadAggregateStatusSpaces({
-        targetId: config.target.targetId,
-        migrationsDir,
-        appContractRaw: contractRawForAggregate,
+        aggregate,
         extensionPacks: config.extensionPacks ?? [],
-        deserializeContract: (json: unknown) => familyInstance.deserializeContract(json),
         markersBySpace: allMarkers,
       });
     } catch {
-      // Loader failure short-circuits silently — the existing
-      // single-space app pipeline below still runs.
       aggregateSpaces = [];
     }
   }

package/src/control-api/client.ts

@@ -473,7 +473,6 @@ class ControlClientImpl implements ControlClient {
       migrationsDir: options.migrationsDir,
       extensionPacks: this.options.extensionPacks ?? [],
       targetId: this.options.target.targetId,
-      appMigrationPackages: options.appMigrationPackages,
       ...ifDefined('refHash', options.refHash),
       ...ifDefined('refInvariants', options.refInvariants),
       ...ifDefined('refName', options.refName),

package/src/control-api/operations/db-verify.ts

@@ -9,8 +9,10 @@ import type {
 import {
   type AggregateVerifierOutput,
   type ContractSpaceMember,
+  requireHeadRef,
   verifyAggregate,
 } from '@prisma-next/migration-tools/aggregate';
+import { castAs } from '@prisma-next/utils/casts';
 import { notOk, ok, type Result } from '@prisma-next/utils/result';
 import { CliStructuredError } from '../../utils/cli-errors';
 import {
@@ -162,7 +164,7 @@ async function runIntrospection<TFamilyId extends string, TTargetId extends stri
  * `ok` result so the verifier still runs the (cheap) schemaCheck loop
  * without invoking the family's verification path.
  */
-function createPerMemberVerifier<TFamilyId extends string, TTargetId extends string>(
+export function createPerMemberVerifier<TFamilyId extends string, TTargetId extends string>(
   options: ExecuteDbVerifyOptions<TFamilyId, TTargetId>,
 ): (
   projectedSchema: unknown,
@@ -173,7 +175,7 @@ function createPerMemberVerifier<TFamilyId extends string, TTargetId extends str
   return (projectedSchema, member, verifyMode) => {
     if (skipSchema) return buildSkippedSchemaResult(member);
     return familyInstance.verifySchema({
-      contract: member.contract,
+      contract: member.contract(),
       // The family's `TSchemaIR` is opaque to migration-tools; the
       // aggregate verifier passes through whatever we hand it. The
       // family expects its own IR shape on the way back.
@@ -247,15 +249,17 @@ function finaliseVerifyResult(args: {
 }
 
 function buildSkippedSchemaResult(member: ContractSpaceMember): VerifyDatabaseSchemaResult {
-  const profileHash = (member.contract as { profileHash?: string }).profileHash;
+  const contract = member.contract();
+  const headRef = requireHeadRef(member);
+  const profileHash = castAs<{ profileHash?: string }>(contract).profileHash;
   return {
     ok: true,
     summary: 'Schema verification skipped',
     contract: {
-      storageHash: member.headRef.hash,
+      storageHash: headRef.hash,
       ...(profileHash ? { profileHash } : {}),
     },
-    target: { expected: member.contract.target },
+    target: { expected: contract.target },
     schema: {
       issues: [],
       root: {

package/src/control-api/operations/migration-apply.ts

@@ -12,11 +12,11 @@ import {
   type ContractSpaceAggregate,
   type ContractSpaceMember,
   graphWalkStrategy,
+  requireHeadRef,
 } from '@prisma-next/migration-tools/aggregate';
 import { EMPTY_CONTRACT_HASH } from '@prisma-next/migration-tools/constants';
 import { errorNoInvariantPath } from '@prisma-next/migration-tools/errors';
 import { findPathWithDecision } from '@prisma-next/migration-tools/migration-graph';
-import type { OnDiskMigrationPackage } from '@prisma-next/migration-tools/package';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { notOk, ok } from '@prisma-next/utils/result';
 import {
@@ -56,15 +56,6 @@ export interface ExecuteMigrationApplyOptions<TFamilyId extends string, TTargetI
   readonly migrationsDir: string;
   readonly extensionPacks: ReadonlyArray<ControlExtensionDescriptor<TFamilyId, TTargetId>>;
   readonly targetId: TTargetId;
-  /**
-   * Already-loaded app-space migration packages. The CLI command
-   * loads these via `loadMigrationPackages(appMigrationsDir)`; the
-   * operation hydrates the app member's graph with them. Required
-   * because the framework-neutral aggregate loader doesn't know how
-   * to read the user's `migrations/` directory layout (it's family-
-   * aware: ops.json shape, manifest keys, etc.).
-   */
-  readonly appMigrationPackages: ReadonlyArray<OnDiskMigrationPackage>;
   /**
    * Optional app-space ref override. When provided, the app member's
    * graph-walk targets this hash instead of `member.headRef.hash`.
@@ -125,7 +116,6 @@ export async function executeMigrationApply<TFamilyId extends string, TTargetId
     migrationsDir,
     extensionPacks,
     targetId,
-    appMigrationPackages,
     refHash,
     refInvariants,
     refName,
@@ -138,7 +128,6 @@ export async function executeMigrationApply<TFamilyId extends string, TTargetId
     appContract: contract,
     extensionPacks,
     deserializeContract: (json) => familyInstance.deserializeContract(json),
-    appMigrationPackages,
   };
   const loaded = await buildContractSpaceAggregate(loadInputs);
   if (!loaded.ok) {
@@ -161,12 +150,15 @@ export async function executeMigrationApply<TFamilyId extends string, TTargetId
   const atHeadResolutions = new Map<string, AggregatePerSpacePlan>();
   for (const member of allMembers) {
     const isAppMember = member.spaceId === aggregate.app.spaceId;
-    const targetHash = isAppMember && refHash !== undefined ? refHash : member.headRef.hash;
+    // The aggregate passed the integrity gate, so every member's head ref
+    // is resolved (the app's is synthesised from the live contract).
+    const headRef = requireHeadRef(member);
+    const targetHash = isAppMember && refHash !== undefined ? refHash : headRef.hash;
     const liveMarker = markerRows.get(member.spaceId) ?? null;
 
     // Empty-graph members fail loudly: replay needs an on-disk path
     // and an empty graph means the user has never planned this space.
-    if (member.migrations.graph.nodes.size === 0) {
+    if (member.graph().nodes.size === 0) {
       // Edge case: target == EMPTY (greenfield, nothing to do) or
       // the live marker already matches the target. Loader integrity
       // allows this for extensions whose head ref is the empty
@@ -197,9 +189,9 @@ export async function executeMigrationApply<TFamilyId extends string, TTargetId
     const targetInvariants =
       isAppMember && refHash !== undefined && refInvariants !== undefined
         ? refInvariants
-        : member.headRef.invariants;
+        : headRef.invariants;
     const targetMember: ContractSpaceMember =
-      targetHash === member.headRef.hash && targetInvariants === member.headRef.invariants
+      targetHash === headRef.hash && targetInvariants === headRef.invariants
         ? member
         : { ...member, headRef: { hash: targetHash, invariants: targetInvariants } };
 
@@ -224,7 +216,7 @@ export async function executeMigrationApply<TFamilyId extends string, TTargetId
       // is never a graph node, producing an empty `structuralPath` and
       // a less actionable diagnostic.
       const fromHash = liveMarker?.storageHash ?? EMPTY_CONTRACT_HASH;
-      const structural = findPathWithDecision(targetMember.migrations.graph, fromHash, targetHash, {
+      const structural = findPathWithDecision(targetMember.graph(), fromHash, targetHash, {
         required: new Set<string>(),
       });
       const structuralPath =
@@ -369,7 +361,7 @@ function buildAtHeadResolution(args: {
       providedInvariants: [],
     },
     displayOps: [],
-    destinationContract: member.contract,
+    destinationContract: member.contract(),
     strategy: 'graph-walk',
     migrationEdges: [],
   };
@@ -407,7 +399,7 @@ function buildSuccess(args: BuildSuccessArgs): MigrationApplySuccess {
     (r) => r.spaceId === args.aggregate.app.spaceId,
   );
   const appMarkerHash =
-    appResolution?.entry.plan.destination.storageHash ?? args.aggregate.app.headRef.hash;
+    appResolution?.entry.plan.destination.storageHash ?? requireHeadRef(args.aggregate.app).hash;
 
   // Per-migration entries (one per authored edge) preserve the
   // single-space `migrationsApplied` count semantics for back-compat

package/src/control-api/types.ts

@@ -18,7 +18,6 @@ import type {
   VerifyDatabaseSchemaResult,
 } from '@prisma-next/framework-components/control';
 import type { PslDocumentAst } from '@prisma-next/framework-components/psl-ast';
-import type { OnDiskMigrationPackage } from '@prisma-next/migration-tools/package';
 import type { Result } from '@prisma-next/utils/result';
 import type { ExecuteDbVerifyResult } from './operations/db-verify';
 
@@ -548,12 +547,6 @@ export interface MigrationApplyOptions {
   readonly contract: unknown;
   /** Migrations root directory (`migrations/` under the project). */
   readonly migrationsDir: string;
-  /**
-   * Already-loaded app-space migration packages. The CLI loads these
-   * via `loadMigrationPackages(appMigrationsDir)` before invoking
-   * `migrationApply`.
-   */
-  readonly appMigrationPackages: ReadonlyArray<OnDiskMigrationPackage>;
   /**
    * Optional app-space ref override. When provided, the app member's
    * graph-walk targets this hash instead of `contract.storage.storageHash`.

package/src/utils/command-helpers.ts

@@ -242,9 +242,14 @@ export async function loadMigrationPackages(migrationsDir: string): Promise<{
   bundles: readonly OnDiskMigrationPackage[];
   graph: MigrationGraph;
 }> {
-  const bundles = await readMigrationsDir(migrationsDir);
-  const graph = reconstructGraph(bundles);
-  return { bundles, graph };
+  // `readMigrationsDir` is tolerant: it retains hash-/invariant-mismatched
+  // packages and omits unparseable ones, reporting both via `problems`.
+  // This helper preserves its historical `{ bundles, graph }` contract by
+  // exposing the retained packages; callers that need to surface load
+  // problems read them from the tolerant primitive directly.
+  const { packages } = await readMigrationsDir(migrationsDir);
+  const graph = reconstructGraph(packages);
+  return { bundles: packages, graph };
 }
 
 /**