@prisma-next/cli 0.5.0-dev.66 → 0.5.0-dev.68

package/src/utils/command-helpers.ts

@@ -7,6 +7,7 @@ import { readMigrationsDir } from '@prisma-next/migration-tools/io';
 import type { PathDecision } from '@prisma-next/migration-tools/migration-graph';
 import { reconstructGraph } from '@prisma-next/migration-tools/migration-graph';
 import type { OnDiskMigrationPackage } from '@prisma-next/migration-tools/package';
+import { APP_SPACE_ID, spaceMigrationDirectory } from '@prisma-next/migration-tools/spaces';
 import { ifDefined } from '@prisma-next/utils/defined';
 import type { Command } from 'commander';
 import { relative, resolve } from 'pathe';
@@ -79,6 +80,16 @@ export function resolveContractPath(config: { contract?: { output?: string } }):
 /**
  * Resolves the migrations directory and config path from CLI options.
  * Shared by migration-apply, migration-plan, and migration-status.
+ *
+ * - `migrationsDir` is the project's top-level `migrations/` directory
+ *   (the root that the aggregate loader walks for every contract space).
+ * - `appMigrationsDir` is the app subspace directory under it
+ *   (`<migrationsDir>/<APP_SPACE_ID>/`). Every per-app reader / writer
+ *   (`migration new`, `migration plan`, `migration apply`,
+ *   `migration status`, `migration show`, `migration ref`) operates on
+ *   this directory. Extensions own their own `migrations/<spaceId>/`.
+ * - `refsDir` is the app's refs directory (`<appMigrationsDir>/refs/`).
+ *   The framework does not maintain refs at the migrations root.
  */
 export function resolveMigrationPaths(
   configOption: string | undefined,
@@ -87,6 +98,8 @@ export function resolveMigrationPaths(
   configPath: string;
   migrationsDir: string;
   migrationsRelative: string;
+  appMigrationsDir: string;
+  appMigrationsRelative: string;
   refsDir: string;
 } {
   const configPath = configOption
@@ -97,8 +110,17 @@ export function resolveMigrationPaths(
     config.migrations?.dir ?? 'migrations',
   );
   const migrationsRelative = relative(process.cwd(), migrationsDir);
-  const refsDir = resolve(migrationsDir, 'refs');
-  return { configPath, migrationsDir, migrationsRelative, refsDir };
+  const appMigrationsDir = spaceMigrationDirectory(migrationsDir, APP_SPACE_ID);
+  const appMigrationsRelative = relative(process.cwd(), appMigrationsDir);
+  const refsDir = resolve(appMigrationsDir, 'refs');
+  return {
+    configPath,
+    migrationsDir,
+    migrationsRelative,
+    appMigrationsDir,
+    appMigrationsRelative,
+    refsDir,
+  };
 }
 
 /**

package/src/utils/contract-space-aggregate-loader.ts

@@ -0,0 +1,236 @@
+import type { Contract } from '@prisma-next/contract/types';
+import type { ControlExtensionDescriptor } from '@prisma-next/framework-components/control';
+import type {
+  ContractSpaceAggregate,
+  DeclaredExtensionEntry,
+  LoadAggregateError,
+  LoadAggregateInput,
+  LoadAggregateOutput,
+} from '@prisma-next/migration-tools/aggregate';
+import { loadContractSpaceAggregate } from '@prisma-next/migration-tools/aggregate';
+import { notOk, ok, type Result } from '@prisma-next/utils/result';
+import { CliStructuredError } from './cli-errors';
+
+/**
+ * Structural shape the aggregate loader needs from each declared
+ * `Config.extensionPacks` entry. Mirrors the SQL family's
+ * `SqlControlExtensionDescriptor.contractSpace` shape but kept
+ * structural so the loader doesn't depend on the SQL family.
+ */
+type ExtensionPackForAggregate = {
+  readonly id: string;
+  readonly targetId: string;
+  readonly contractSpace?: {
+    readonly contractJson: unknown;
+    readonly headRef: { readonly hash: string; readonly invariants: readonly string[] };
+  };
+};
+
+/**
+ * Convert the CLI's `Config.extensionPacks` array into the loader's
+ * `DeclaredExtensionEntry[]` shape.
+ *
+ * The loader hashes `contractSpace.contractJson` to compare against the
+ * on-disk `refs/head.json.hash` (drift detection). Rather than re-running
+ * the canonical-JSON + SHA-256 pipeline at the CLI surface, we look up
+ * the descriptor's pre-computed `headRef.hash` via reference identity
+ * on the contract JSON value — the loader passes the same
+ * `entry.contractSpace.contractJson` reference through to the hasher,
+ * so identity-keyed lookup is safe.
+ */
+function toDeclaredExtensions(extensionPacks: ReadonlyArray<ExtensionPackForAggregate>): {
+  readonly entries: ReadonlyArray<DeclaredExtensionEntry>;
+  readonly hashByContractJson: Map<unknown, string>;
+} {
+  const entries: DeclaredExtensionEntry[] = [];
+  const hashByContractJson = new Map<unknown, string>();
+  for (const pack of extensionPacks) {
+    const entry: DeclaredExtensionEntry = pack.contractSpace
+      ? {
+          id: pack.id,
+          targetId: pack.targetId,
+          contractSpace: { contractJson: pack.contractSpace.contractJson },
+        }
+      : { id: pack.id, targetId: pack.targetId };
+    entries.push(entry);
+    if (pack.contractSpace) {
+      hashByContractJson.set(pack.contractSpace.contractJson, pack.contractSpace.headRef.hash);
+    }
+  }
+  return { entries, hashByContractJson };
+}
+
+/**
+ * Render a {@link LoadAggregateError} into a CLI structured-error
+ * envelope. Preserves error codes `5001` (layout) and `5002` (marker /
+ * drift / disjointness / etc.) so existing integration tests and
+ * downstream tooling continue to assert on the same `meta.violations[]`
+ * shape they did under the old precheck/marker-check helpers.
+ */
+export function mapLoadAggregateError(error: LoadAggregateError): CliStructuredError {
+  if (error.kind === 'layoutViolation') {
+    const lines = error.violations.map((v) => `- [${v.kind}] ${v.spaceId}`);
+    const summary =
+      error.violations.length === 1
+        ? 'Contract-space layout violation detected'
+        : `Contract-space layout violations detected (${error.violations.length})`;
+    return new CliStructuredError('5001', summary, {
+      domain: 'MIG',
+      why: `The on-disk \`migrations/\` directory and your \`extensionPacks\` declaration are not in agreement.\n${lines.join('\n')}`,
+      fix: 'Run `prisma-next migrate` to materialise on-disk artefacts for declared extensions, or remove the orphan directory.',
+      docsUrl: 'https://pris.ly/contract-spaces',
+      meta: {
+        violations: error.violations.map((v) => ({
+          kind: v.kind,
+          spaceId: v.spaceId,
+        })),
+      },
+    });
+  }
+  if (error.kind === 'driftViolation') {
+    return new CliStructuredError('5002', `Contract-space drift detected for "${error.spaceId}"`, {
+      domain: 'MIG',
+      why: `The on-disk contract for space "${error.spaceId}" (hash ${error.priorHeadHash}) does not match the live extension descriptor (hash ${error.liveHash}).`,
+      fix: 'Run `prisma-next migrate` to refresh the on-disk artefacts to match the live descriptor.',
+      docsUrl: 'https://pris.ly/contract-spaces',
+      meta: {
+        violations: [
+          {
+            kind: 'drift',
+            spaceId: error.spaceId,
+            priorHeadHash: error.priorHeadHash,
+            liveHash: error.liveHash,
+          },
+        ],
+      },
+    });
+  }
+  if (error.kind === 'disjointnessViolation') {
+    return new CliStructuredError(
+      '5002',
+      `Contract-space disjointness violation: storage element "${error.element}" claimed by multiple spaces`,
+      {
+        domain: 'MIG',
+        why: `Spaces ${error.claimedBy.map((s) => `"${s}"`).join(', ')} all claim the storage element "${error.element}". Each storage element must be owned by exactly one contract space.`,
+        fix: 'Update the conflicting contracts so each storage element is claimed by exactly one space.',
+        docsUrl: 'https://pris.ly/contract-spaces',
+        meta: {
+          violations: [
+            {
+              kind: 'disjointness',
+              spaceId: error.claimedBy.join(','),
+              element: error.element,
+              claimedBy: error.claimedBy,
+            },
+          ],
+        },
+      },
+    );
+  }
+  if (error.kind === 'integrityFailure') {
+    return new CliStructuredError(
+      '5002',
+      `Contract-space integrity failure for "${error.spaceId}"`,
+      {
+        domain: 'MIG',
+        why: error.detail,
+        fix: 'Run `prisma-next migrate` to refresh on-disk artefacts, or restore the on-disk `migrations/` directory from version control.',
+        docsUrl: 'https://pris.ly/contract-spaces',
+        meta: {
+          violations: [{ kind: 'integrity', spaceId: error.spaceId, detail: error.detail }],
+        },
+      },
+    );
+  }
+  if (error.kind === 'validationFailure') {
+    return new CliStructuredError(
+      '5002',
+      `Contract-space contract validation failed for "${error.spaceId}"`,
+      {
+        domain: 'MIG',
+        why: error.detail,
+        fix: 'Run `prisma-next migrate` to refresh on-disk artefacts, or fix the extension descriptor producing the invalid contract.',
+        meta: {
+          violations: [{ kind: 'validation', spaceId: error.spaceId, detail: error.detail }],
+        },
+      },
+    );
+  }
+  // targetMismatch
+  return new CliStructuredError('5002', `Contract-space target mismatch for "${error.spaceId}"`, {
+    domain: 'MIG',
+    why: `Space "${error.spaceId}" targets "${error.actual}" but the project's adapter targets "${error.expected}".`,
+    fix: 'Update the extension descriptor to target the configured database, or change the project adapter.',
+    meta: {
+      violations: [
+        {
+          kind: 'targetMismatch',
+          spaceId: error.spaceId,
+          expected: error.expected,
+          actual: error.actual,
+        },
+      ],
+    },
+  });
+}
+
+/**
+ * Inputs needed to compose the aggregate loader at the CLI surface.
+ *
+ * Keeps the loader framework-neutral (no `Config` import) by accepting
+ * already-resolved structural inputs: validated app contract, target
+ * id, migrations root directory, and the set of extension descriptors.
+ */
+export interface BuildAggregateInputs<TFamilyId extends string, TTargetId extends string> {
+  readonly targetId: TTargetId;
+  readonly migrationsDir: string;
+  readonly appContract: Contract;
+  readonly extensionPacks: ReadonlyArray<ControlExtensionDescriptor<TFamilyId, TTargetId>>;
+  readonly validateContract: (contractJson: unknown) => Contract;
+}
+
+/**
+ * Run the aggregate loader at the CLI surface, mapping any
+ * {@link LoadAggregateError} into a {@link CliStructuredError} envelope.
+ *
+ * App-side migration packages are intentionally not threaded through:
+ * `db init` / `db update` go through the planner's `synth` strategy for
+ * the app member (driven by `callerPolicy.ignoreGraphFor`), so the
+ * app's authored `migrations/` graph is not walked.
+ *
+ * @see specs/contract-space-aggregate-spec.md § Loader.
+ */
+export async function buildContractSpaceAggregate<
+  TFamilyId extends string,
+  TTargetId extends string,
+>(
+  inputs: BuildAggregateInputs<TFamilyId, TTargetId>,
+): Promise<Result<ContractSpaceAggregate, CliStructuredError>> {
+  const { entries, hashByContractJson } = toDeclaredExtensions(
+    inputs.extensionPacks as ReadonlyArray<ExtensionPackForAggregate>,
+  );
+
+  const loadInput: LoadAggregateInput = {
+    targetId: inputs.targetId,
+    migrationsDir: inputs.migrationsDir,
+    appContract: inputs.appContract,
+    declaredExtensions: entries,
+    validateContract: inputs.validateContract,
+    hashContract: (contractJson: unknown) => {
+      const precomputed = hashByContractJson.get(contractJson);
+      if (precomputed === undefined) {
+        throw new Error(
+          'CLI aggregate loader: encountered an extension contract without a pre-computed descriptor hash. This is a wiring bug.',
+        );
+      }
+      return precomputed;
+    },
+    appMigrationPackages: [],
+  };
+
+  const result: LoadAggregateOutput = await loadContractSpaceAggregate(loadInput);
+  if (!result.ok) {
+    return notOk(mapLoadAggregateError(result.failure));
+  }
+  return ok(result.value.aggregate);
+}

package/src/utils/contract-space-extension-migrations-pass.ts

@@ -0,0 +1,120 @@
+import { materialiseExtensionMigrationPackageIfMissing } from '@prisma-next/migration-tools/io';
+import type { MigrationMetadata } from '@prisma-next/migration-tools/metadata';
+import type { MigrationOps } from '@prisma-next/migration-tools/package';
+import {
+  planAllSpaces,
+  type SpacePlanOutput,
+  spaceMigrationDirectory,
+} from '@prisma-next/migration-tools/spaces';
+
+/**
+ * In-memory authored migration package shipped by an extension descriptor.
+ * Mirrors `MigrationPackage` from `@prisma-next/migration-tools/io`
+ * (the on-disk shape minus `dirPath`); redeclared structurally here so
+ * the CLI helper does not couple to the SQL family's `ExtensionMigrationPackage`
+ * type — any family that ships pre-built migration packages can pass them
+ * through unchanged.
+ */
+export interface DescriptorMigrationPackage {
+  readonly dirName: string;
+  readonly metadata: MigrationMetadata;
+  readonly ops: MigrationOps;
+}
+
+/**
+ * Minimal descriptor view consumed by the migration-materialisation pass.
+ * Mirrors {@link import('./contract-space-migrate-pass').MigrateExtensionInput}
+ * but adds the `migrations` field — the canonical set of pre-built
+ * migration packages the extension ships.
+ */
+export interface ExtensionMigrationsExtensionInput {
+  readonly id: string;
+  readonly contractSpace?: {
+    readonly contractJson: unknown;
+    readonly migrations: readonly DescriptorMigrationPackage[];
+    readonly headRef: { readonly hash: string; readonly invariants: readonly string[] };
+  };
+}
+
+export interface ContractSpaceExtensionMigrationsPassInputs {
+  readonly migrationsDir: string;
+  readonly extensionPacks: ReadonlyArray<ExtensionMigrationsExtensionInput>;
+}
+
+export interface ContractSpaceExtensionMigrationsPassResult {
+  readonly emitted: readonly { readonly spaceId: string; readonly dirName: string }[];
+  readonly skipped: readonly { readonly spaceId: string; readonly dirName: string }[];
+}
+
+/**
+ * Materialise an extension's pre-built migration packages onto disk
+ * under `migrations/<spaceId>/<dirName>/` for every package that does
+ * not yet exist there.
+ *
+ * Helper-location pattern — the per-space "planner" for extension
+ * spaces is a no-op that just returns the descriptor's `migrations`
+ * verbatim; the value `planAllSpaces` brings to this consumer site is
+ * **deterministic ordering** (alphabetical by spaceId) and
+ * **duplicate-spaceId detection**. The actual write is performed via
+ * `materialiseMigrationPackage` per package.
+ *
+ * Idempotent: an existing `migrations/<spaceId>/<dirName>/` is left
+ * untouched and reported in `result.skipped` — the helper never
+ * overwrites authored migration content, ensuring re-running
+ * `migrate` does not corrupt or churn extension migration packages.
+ *
+ * Per-space artefacts (`contract.json`, `contract.d.ts`,
+ * `refs/head.json`) are emitted by
+ * {@link import('./contract-space-migrate-pass').runContractSpaceMigratePass}
+ * separately — they cover the head-pointer side of the ledger. This
+ * helper covers the migration-graph side.
+ */
+export async function runContractSpaceExtensionMigrationsPass(
+  inputs: ContractSpaceExtensionMigrationsPassInputs,
+): Promise<ContractSpaceExtensionMigrationsPassResult> {
+  const planInputs = inputs.extensionPacks
+    .filter(
+      (
+        pack,
+      ): pack is ExtensionMigrationsExtensionInput & {
+        contractSpace: NonNullable<ExtensionMigrationsExtensionInput['contractSpace']>;
+      } => pack.contractSpace !== undefined,
+    )
+    .map((pack) => ({
+      spaceId: pack.id,
+      priorContract: null,
+      newContract: pack.contractSpace.contractJson,
+      __migrations: pack.contractSpace.migrations,
+    }));
+
+  // Threading the descriptor's pre-built migrations into the
+  // `planAllSpaces` callback by piggybacking on the input shape.
+  // The framework helper is generic over the per-space planner output;
+  // here the "planner" is a no-op that returns the descriptor's
+  // `migrations` array. The benefit of routing through `planAllSpaces`
+  // is duplicate-spaceId detection + alphabetical ordering — failures
+  // there throw `MIGRATION.DUPLICATE_SPACE_ID` before any write.
+  const planned: readonly SpacePlanOutput<DescriptorMigrationPackage>[] = planAllSpaces(
+    planInputs,
+    (input) =>
+      (input as typeof input & { readonly __migrations: readonly DescriptorMigrationPackage[] })
+        .__migrations,
+  );
+
+  const emitted: { spaceId: string; dirName: string }[] = [];
+  const skipped: { spaceId: string; dirName: string }[] = [];
+
+  for (const space of planned) {
+    const spaceDir = spaceMigrationDirectory(inputs.migrationsDir, space.spaceId);
+    for (const pkg of space.migrationPackages) {
+      const { written } = await materialiseExtensionMigrationPackageIfMissing(spaceDir, pkg);
+      if (written) {
+        emitted.push({ spaceId: space.spaceId, dirName: pkg.dirName });
+      } else {
+        skipped.push({ spaceId: space.spaceId, dirName: pkg.dirName });
+      }
+    }
+  }
+
+  return { emitted, skipped };
+}

package/src/utils/contract-space-migrate-pass.ts

@@ -0,0 +1,156 @@
+import {
+  detectSpaceContractDrift,
+  emitContractSpaceArtefacts,
+  readContractSpaceHeadRef,
+  type SpaceContractDriftResult,
+} from '@prisma-next/migration-tools/spaces';
+
+/**
+ * Minimal descriptor view consumed by the migrate-time per-space pass.
+ *
+ * The CLI receives descriptors typed against the SQL family (or any other
+ * family in the future); this helper only needs the structural shape of
+ * `contractSpace`, so it accepts an `unknown`-typed `contractJson` and
+ * a structurally-typed `headRef`. SQL-family callers pass the same
+ * `Contract<SqlStorage>` value through unchanged — `emitContractSpaceArtefacts`
+ * already serialises through `canonicalizeJson` and is framework-neutral.
+ *
+ * @see specs/framework-mechanism.spec.md § 3 — Per-space helper location.
+ */
+export interface MigrateExtensionInput {
+  readonly id: string;
+  readonly contractSpace?: {
+    readonly contractJson: unknown;
+    readonly headRef: { readonly hash: string; readonly invariants: readonly string[] };
+  };
+}
+
+/**
+ * Inputs needed to compose the migrate-time per-space pass at the CLI
+ * surface — typically called once after the app-space migration package
+ * has been written, regardless of whether the app-space had structural
+ * changes (an extension bump alone should still re-pin its artefacts).
+ */
+export interface ContractSpaceMigratePassInputs {
+  readonly migrationsDir: string;
+  readonly extensionPacks: ReadonlyArray<MigrateExtensionInput>;
+}
+
+export interface ContractSpaceMigratePassResult {
+  readonly drifts: readonly SpaceContractDriftResult[];
+  readonly emittedSpaceIds: readonly string[];
+}
+
+/**
+ * Run drift detection + on-disk artefact emission for every loaded
+ * extension space at `migrate` time.
+ *
+ * Per sub-spec § 3:
+ *
+ * - For each declared extension that exposes a `contractSpace`:
+ *   - Read the on-disk head hash from `migrations/<spaceId>/refs/head.json`
+ *     (returns `null` on first emit).
+ *   - Compare against the descriptor's `headRef.hash` via
+ *     `detectSpaceContractDrift`. The `kind` discriminant decides whether
+ *     the user sees a warning (`drift`), a no-op silent emit (`firstEmit`,
+ *     `noDrift`), or nothing at all.
+ *   - Always re-emit the on-disk artefacts (`contract.json`, `contract.d.ts`,
+ *     `refs/head.json`). The framework owns these files and the helper is
+ *     idempotent.
+ *
+ * Drift warnings are returned to the caller for formatting (TerminalUI,
+ * structured-output envelope, etc.) — the helper does not print directly,
+ * keeping it framework-neutral and unit-testable.
+ *
+ * Extension migration packages (the descriptor's pre-canned `migrations`
+ * array → `migrations/<spaceId>/<dirName>/`) are intentionally not
+ * materialised here — that interaction will be wired in a follow-on round
+ * once the runner-side single-tx slice (sub-spec § 6) is in place.
+ * On-disk artefacts are sufficient to lock the drift-warning behaviour
+ * and the always-on re-emit AC for R2.
+ *
+ * @see specs/framework-mechanism.spec.md § 3 — Drift detection (T1.9).
+ */
+export async function runContractSpaceMigratePass(
+  inputs: ContractSpaceMigratePassInputs,
+): Promise<ContractSpaceMigratePassResult> {
+  const drifts: SpaceContractDriftResult[] = [];
+  const emittedSpaceIds: string[] = [];
+
+  for (const pack of inputs.extensionPacks) {
+    if (pack.contractSpace === undefined) continue;
+    const { contractJson, headRef } = pack.contractSpace;
+
+    const onDiskHeadRef = await readContractSpaceHeadRef(inputs.migrationsDir, pack.id);
+    const drift = detectSpaceContractDrift(pack.id, {
+      descriptorHash: headRef.hash,
+      priorHeadHash: onDiskHeadRef?.hash ?? null,
+    });
+    drifts.push(drift);
+
+    await emitContractSpaceArtefacts(inputs.migrationsDir, pack.id, {
+      contract: contractJson,
+      contractDts: buildPlaceholderContractDts(pack.id),
+      headRef: { hash: headRef.hash, invariants: headRef.invariants },
+    });
+    emittedSpaceIds.push(pack.id);
+  }
+
+  return { drifts, emittedSpaceIds };
+}
+
+/**
+ * Format the user-facing drift warning for a single space. Callers
+ * funnel this through their preferred output channel (TerminalUI line,
+ * structured-output envelope `warnings[]`, etc.).
+ *
+ * Locks AM7 — drift warning surfaces the extension name and the diff
+ * direction (descriptor → on-disk head).
+ */
+export function formatContractSpaceDriftWarning(drift: SpaceContractDriftResult): string {
+  if (drift.kind !== 'drift') {
+    throw new Error(`formatContractSpaceDriftWarning called with non-drift result: ${drift.kind}`);
+  }
+  return (
+    `Contract-space drift detected for "${drift.spaceId}": descriptor hash ` +
+    `${drift.descriptorHash} differs from on-disk head hash ${drift.priorHeadHash ?? '<none>'}. ` +
+    `The on-disk artefacts under migrations/${drift.spaceId}/ will be refreshed to match the descriptor.`
+  );
+}
+
+/**
+ * Placeholder `.d.ts` content for an extension space's on-disk mirror.
+ *
+ * Rendering a fully-typed `.d.ts` for an extension contract requires the
+ * SQL-family renderer with the codec / typemap registry threaded
+ * through; that integration is tracked under sub-spec Open Question 3
+ * (see `projects/extension-contract-spaces/specs/framework-mechanism.spec.md`).
+ *
+ * Until that ships, the on-disk `.d.ts` is a `@ts-nocheck` stub. The
+ * spec gap closing alongside the typed renderer is **AC2 / AC14**
+ * (byte-equivalence of per-space artefacts under `migrate`):
+ * a placeholder cannot be byte-equal to a fully-rendered `.d.ts` from
+ * the same descriptor, so AC2 / AC14 are PARTIAL today and become
+ * fully-PASS once OQ3 closes.
+ *
+ * Scheduled to close in **M3** (cipherstash editor tooling) — that's
+ * the milestone where the typed renderer gets its first real
+ * extension-space consumer and the byte-equivalence guarantee is
+ * practically required.
+ */
+function buildPlaceholderContractDts(spaceId: string): string {
+  return [
+    '// @ts-nocheck',
+    '/**',
+    ` * Placeholder \`.d.ts\` for extension space "${spaceId}".`,
+    ' *',
+    ' * The framework re-emits this file on every `migrate` run alongside',
+    ' * `contract.json` and `refs/head.json`. A typed `.d.ts` rendering',
+    " * pass for extension contracts is tracked under the project's open",
+    ' * questions; until that ships, consumers should import',
+    ' * `contract.json` directly with `validateContract<…>(…)`.',
+    ' */',
+    'export {};',
+    '',
+  ].join('\n');
+}