@prisma-next/family-sql 0.12.0-dev.5 → 0.12.0-dev.51

package/dist/{verify-sql-schema-CYLsGCFO.mjs → verify-sql-schema-CYlKme0a.mjs}

@@ -1,7 +1,9 @@
-import { assertUniqueCodecOwner } from "@prisma-next/framework-components/control";
+import { assertUniqueCodecOwner, dispositionForCategory } from "@prisma-next/framework-components/control";
 import { ifDefined } from "@prisma-next/utils/defined";
 import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
 import { StorageTable, isPostgresEnumStorageEntry, isStorageTypeInstance } from "@prisma-next/sql-contract/types";
+import { blindCast } from "@prisma-next/utils/casts";
+import { effectiveControlPolicy } from "@prisma-next/contract/types";
 import { canonicalStringify } from "@prisma-next/utils/canonical-stringify";
 //#region src/core/assembly.ts
 function hasCodecControlHooks(descriptor) {
@@ -31,6 +33,71 @@ function extractCodecControlHooks(descriptors) {
 	return hooks;
 }
 //#endregion
+//#region src/core/schema-verify/verifier-disposition.ts
+/**
+* Classifies the relational verifier issue kinds the SQL family emits (tables,
+* columns, constraints, indexes, defaults, enum types) into the target-neutral
+* categories the framework grades. The relational vocabulary lives here, in the
+* SQL domain — the framework never switches over `extra_foreign_key` and friends.
+*/
+function classifySqlVerifierIssueKind(kind) {
+	switch (kind) {
+		case "extra_column": return "extraNestedElement";
+		case "extra_primary_key":
+		case "extra_foreign_key":
+		case "extra_unique_constraint":
+		case "extra_index":
+		case "extra_validator":
+		case "extra_default": return "extraAuxiliary";
+		case "extra_table": return "extraTopLevelObject";
+		case "missing_schema":
+		case "missing_table":
+		case "missing_column":
+		case "type_missing":
+		case "default_missing": return "declaredMissing";
+		case "type_values_mismatch":
+		case "enum_values_changed": return "valueDrift";
+		case "type_mismatch":
+		case "nullability_mismatch":
+		case "primary_key_mismatch":
+		case "foreign_key_mismatch":
+		case "unique_constraint_mismatch":
+		case "index_mismatch":
+		case "default_mismatch": return "declaredIncompatible";
+	}
+}
+function verifierDisposition(controlPolicy, issueKind) {
+	return dispositionForCategory(controlPolicy, classifySqlVerifierIssueKind(issueKind));
+}
+//#endregion
+//#region src/core/schema-verify/control-verify-emit.ts
+/**
+* Grades `issue` under `controlPolicy` and, unless suppressed, pushes both the
+* issue and a status-stamped verification node. Returns the resolved outcome so
+* the caller never re-grades the same issue.
+*/
+function emitIssueAndNodeUnderControlPolicy(controlPolicy, issue, node, issues, nodes) {
+	const disposition = verifierDisposition(controlPolicy, issue.kind);
+	if (disposition === "suppress") return disposition;
+	issues.push(issue);
+	nodes.push({
+		...node,
+		status: disposition
+	});
+	return disposition;
+}
+/**
+* Grades `issue` under `controlPolicy` and, unless suppressed, pushes the issue
+* (no verification node). Returns the resolved outcome so the caller maps it to
+* a node status itself without re-grading.
+*/
+function emitIssueUnderControlPolicy(controlPolicy, issue, issues) {
+	const disposition = verifierDisposition(controlPolicy, issue.kind);
+	if (disposition === "suppress") return disposition;
+	issues.push(issue);
+	return disposition;
+}
+//#endregion
 //#region src/core/schema-verify/verify-helpers.ts
 function indexOptionsLooselyEqual(a, b) {
 	const aKeys = a ? Object.keys(a).sort() : [];
@@ -92,27 +159,27 @@ function isIndexSatisfied(indexes, uniques, columns) {
 * Uses semantic satisfaction: identity is based on (table + kind + columns).
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, issues) {
+function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, tableControlPolicy, issues) {
 	if (!schemaPK) {
-		issues.push({
+		const outcome = emitIssueUnderControlPolicy(tableControlPolicy, {
 			kind: "primary_key_mismatch",
 			table: tableName,
 			namespaceId,
 			expected: contractPK.columns.join(", "),
 			message: `Table "${tableName}" is missing primary key`
-		});
-		return "fail";
+		}, issues);
+		return outcome === "suppress" ? "pass" : outcome;
 	}
 	if (!arraysEqual(contractPK.columns, schemaPK.columns)) {
-		issues.push({
+		const outcome = emitIssueUnderControlPolicy(tableControlPolicy, {
 			kind: "primary_key_mismatch",
 			table: tableName,
 			namespaceId,
 			expected: contractPK.columns.join(", "),
 			actual: schemaPK.columns.join(", "),
 			message: `Table "${tableName}" has primary key mismatch: expected columns [${contractPK.columns.join(", ")}], got [${schemaPK.columns.join(", ")}]`
-		});
-		return "fail";
+		}, issues);
+		return outcome === "suppress" ? "pass" : outcome;
 	}
 	return "pass";
 }
@@ -123,7 +190,7 @@ function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, issues)
 * Uses semantic satisfaction: identity is based on (table + columns + referenced table + referenced columns).
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, tablePath, issues, strict) {
+function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractFK of contractFKs) {
 		const fkPath = `${tablePath}.foreignKeys[${contractFK.source.columns.join(",")}]`;
@@ -131,32 +198,30 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 			const tablesMatch = fk.referencedSchema !== void 0 && contractFK.target.namespaceId !== UNBOUND_NAMESPACE_ID ? fk.referencedSchema === contractFK.target.namespaceId && fk.referencedTable === contractFK.target.tableName : fk.referencedTable === contractFK.target.tableName;
 			return arraysEqual(fk.columns, contractFK.source.columns) && tablesMatch && arraysEqual(fk.referencedColumns, contractFK.target.columns);
 		});
-		if (!matchingFK) {
-			issues.push({
-				kind: "foreign_key_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: `${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`,
-				message: `Table "${tableName}" is missing foreign key: ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "foreignKey",
-				name: `foreignKey(${contractFK.source.columns.join(", ")})`,
-				contractPath: fkPath,
-				code: "foreign_key_mismatch",
-				message: "Foreign key missing",
-				expected: contractFK,
-				actual: void 0,
-				children: []
-			});
-		} else {
+		if (!matchingFK) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "foreign_key_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: `${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`,
+			message: `Table "${tableName}" is missing foreign key: ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`
+		}, {
+			status: "fail",
+			kind: "foreignKey",
+			name: `foreignKey(${contractFK.source.columns.join(", ")})`,
+			contractPath: fkPath,
+			code: "foreign_key_mismatch",
+			message: "Foreign key missing",
+			expected: contractFK,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else {
 			const actionMismatches = getReferentialActionMismatches(contractFK, matchingFK);
 			if (actionMismatches.length > 0) {
 				const combinedMessage = actionMismatches.map((m) => m.message).join("; ");
 				const combinedExpected = actionMismatches.map((m) => m.expected).join(", ");
 				const combinedActual = actionMismatches.map((m) => m.actual).join(", ");
-				issues.push({
+				emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 					kind: "foreign_key_mismatch",
 					table: tableName,
 					namespaceId,
@@ -164,8 +229,7 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 					expected: combinedExpected,
 					actual: combinedActual,
 					message: `Table "${tableName}" foreign key ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}: ${combinedMessage}`
-				});
-				nodes.push({
+				}, {
 					status: "fail",
 					kind: "foreignKey",
 					name: `foreignKey(${contractFK.source.columns.join(", ")})`,
@@ -175,7 +239,7 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 					expected: contractFK,
 					actual: matchingFK,
 					children: []
-				});
+				}, issues, nodes);
 			} else nodes.push({
 				status: "pass",
 				kind: "foreignKey",
@@ -193,26 +257,23 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 		for (const schemaFK of schemaFKs) if (!contractFKs.find((fk) => {
 			const tablesMatch = schemaFK.referencedSchema !== void 0 && fk.target.namespaceId !== UNBOUND_NAMESPACE_ID ? schemaFK.referencedSchema === fk.target.namespaceId && schemaFK.referencedTable === fk.target.tableName : schemaFK.referencedTable === fk.target.tableName;
 			return arraysEqual(fk.source.columns, schemaFK.columns) && tablesMatch && arraysEqual(fk.target.columns, schemaFK.referencedColumns);
-		})) {
-			issues.push({
-				kind: "extra_foreign_key",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaFK.name ?? `fk(${schemaFK.columns.join(",")})`,
-				message: `Extra foreign key found in database (not in contract): ${schemaFK.columns.join(", ")} -> ${schemaFK.referencedTable}(${schemaFK.referencedColumns.join(", ")})`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "foreignKey",
-				name: `foreignKey(${schemaFK.columns.join(", ")})`,
-				contractPath: `${tablePath}.foreignKeys[${schemaFK.columns.join(",")}]`,
-				code: "extra_foreign_key",
-				message: "Extra foreign key found",
-				expected: void 0,
-				actual: schemaFK,
-				children: []
-			});
-		}
+		})) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_foreign_key",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaFK.name ?? `fk(${schemaFK.columns.join(",")})`,
+			message: `Extra foreign key found in database (not in contract): ${schemaFK.columns.join(", ")} -> ${schemaFK.referencedTable}(${schemaFK.referencedColumns.join(", ")})`
+		}, {
+			status: "fail",
+			kind: "foreignKey",
+			name: `foreignKey(${schemaFK.columns.join(", ")})`,
+			contractPath: `${tablePath}.foreignKeys[${schemaFK.columns.join(",")}]`,
+			code: "extra_foreign_key",
+			message: "Extra foreign key found",
+			expected: void 0,
+			actual: schemaFK,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -227,32 +288,30 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 *
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes, tableName, namespaceId, tablePath, issues, strict) {
+function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractUnique of contractUniques) {
 		const uniquePath = `${tablePath}.uniques[${contractUnique.columns.join(",")}]`;
 		const matchingUnique = schemaUniques.find((u) => arraysEqual(u.columns, contractUnique.columns));
 		const matchingUniqueIndex = !matchingUnique && schemaIndexes.find((idx) => idx.unique && arraysEqual(idx.columns, contractUnique.columns));
-		if (!matchingUnique && !matchingUniqueIndex) {
-			issues.push({
-				kind: "unique_constraint_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: contractUnique.columns.join(", "),
-				message: `Table "${tableName}" is missing unique constraint: ${contractUnique.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "unique",
-				name: `unique(${contractUnique.columns.join(", ")})`,
-				contractPath: uniquePath,
-				code: "unique_constraint_mismatch",
-				message: "Unique constraint missing",
-				expected: contractUnique,
-				actual: void 0,
-				children: []
-			});
-		} else nodes.push({
+		if (!matchingUnique && !matchingUniqueIndex) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "unique_constraint_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: contractUnique.columns.join(", "),
+			message: `Table "${tableName}" is missing unique constraint: ${contractUnique.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "unique",
+			name: `unique(${contractUnique.columns.join(", ")})`,
+			contractPath: uniquePath,
+			code: "unique_constraint_mismatch",
+			message: "Unique constraint missing",
+			expected: contractUnique,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else nodes.push({
 			status: "pass",
 			kind: "unique",
 			name: `unique(${contractUnique.columns.join(", ")})`,
@@ -265,26 +324,23 @@ function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes,
 		});
 	}
 	if (strict) {
-		for (const schemaUnique of schemaUniques) if (!contractUniques.find((u) => arraysEqual(u.columns, schemaUnique.columns))) {
-			issues.push({
-				kind: "extra_unique_constraint",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaUnique.name ?? `unique(${schemaUnique.columns.join(",")})`,
-				message: `Extra unique constraint found in database (not in contract): ${schemaUnique.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "unique",
-				name: `unique(${schemaUnique.columns.join(", ")})`,
-				contractPath: `${tablePath}.uniques[${schemaUnique.columns.join(",")}]`,
-				code: "extra_unique_constraint",
-				message: "Extra unique constraint found",
-				expected: void 0,
-				actual: schemaUnique,
-				children: []
-			});
-		}
+		for (const schemaUnique of schemaUniques) if (!contractUniques.find((u) => arraysEqual(u.columns, schemaUnique.columns))) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_unique_constraint",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaUnique.name ?? `unique(${schemaUnique.columns.join(",")})`,
+			message: `Extra unique constraint found in database (not in contract): ${schemaUnique.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "unique",
+			name: `unique(${schemaUnique.columns.join(", ")})`,
+			contractPath: `${tablePath}.uniques[${schemaUnique.columns.join(",")}]`,
+			code: "extra_unique_constraint",
+			message: "Extra unique constraint found",
+			expected: void 0,
+			actual: schemaUnique,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -299,32 +355,30 @@ function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes,
 *
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName, namespaceId, tablePath, issues, strict) {
+function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractIndex of contractIndexes) {
 		const indexPath = `${tablePath}.indexes[${contractIndex.columns.join(",")}]`;
 		const matchingIndex = schemaIndexes.find((idx) => arraysEqual(idx.columns, contractIndex.columns) && indexExtrasMatch(contractIndex, idx));
 		const matchingUniqueConstraint = !matchingIndex && contractIndex.type === void 0 && contractIndex.options === void 0 && schemaUniques.find((u) => arraysEqual(u.columns, contractIndex.columns));
-		if (!matchingIndex && !matchingUniqueConstraint) {
-			issues.push({
-				kind: "index_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: contractIndex.columns.join(", "),
-				message: `Table "${tableName}" is missing index: ${contractIndex.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "index",
-				name: `index(${contractIndex.columns.join(", ")})`,
-				contractPath: indexPath,
-				code: "index_mismatch",
-				message: "Index missing",
-				expected: contractIndex,
-				actual: void 0,
-				children: []
-			});
-		} else nodes.push({
+		if (!matchingIndex && !matchingUniqueConstraint) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "index_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: contractIndex.columns.join(", "),
+			message: `Table "${tableName}" is missing index: ${contractIndex.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "index",
+			name: `index(${contractIndex.columns.join(", ")})`,
+			contractPath: indexPath,
+			code: "index_mismatch",
+			message: "Index missing",
+			expected: contractIndex,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else nodes.push({
 			status: "pass",
 			kind: "index",
 			name: `index(${contractIndex.columns.join(", ")})`,
@@ -338,26 +392,23 @@ function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName,
 	}
 	if (strict) for (const schemaIndex of schemaIndexes) {
 		if (schemaIndex.unique) continue;
-		if (!contractIndexes.find((idx) => arraysEqual(idx.columns, schemaIndex.columns) && indexExtrasMatch(idx, schemaIndex))) {
-			issues.push({
-				kind: "extra_index",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaIndex.name ?? `idx(${schemaIndex.columns.join(",")})`,
-				message: `Extra index found in database (not in contract): ${schemaIndex.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "index",
-				name: `index(${schemaIndex.columns.join(", ")})`,
-				contractPath: `${tablePath}.indexes[${schemaIndex.columns.join(",")}]`,
-				code: "extra_index",
-				message: "Extra index found",
-				expected: void 0,
-				actual: schemaIndex,
-				children: []
-			});
-		}
+		if (!contractIndexes.find((idx) => arraysEqual(idx.columns, schemaIndex.columns) && indexExtrasMatch(idx, schemaIndex))) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_index",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaIndex.name ?? `idx(${schemaIndex.columns.join(",")})`,
+			message: `Extra index found in database (not in contract): ${schemaIndex.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "index",
+			name: `index(${schemaIndex.columns.join(", ")})`,
+			contractPath: `${tablePath}.indexes[${schemaIndex.columns.join(",")}]`,
+			code: "extra_index",
+			message: "Extra index found",
+			expected: void 0,
+			actual: schemaIndex,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -435,7 +486,7 @@ function verifySqlSchema(options) {
 	const { contractStorageHash, contractProfileHash, contractTarget } = extractContractMetadata(contract);
 	const allStorageTypesMap = { ...contract.storage.types ?? {} };
 	for (const ns of Object.values(contract.storage.namespaces)) {
-		const nsEnums = ns.enum;
+		const nsEnums = blindCast(ns.entries).type;
 		if (nsEnums) for (const [k, v] of Object.entries(nsEnums)) allStorageTypesMap[k] = v;
 	}
 	const { issues, rootChildren } = verifySchemaTables({
@@ -450,53 +501,57 @@ function verifySqlSchema(options) {
 	});
 	validateFrameworkComponentsForExtensions(contract, options.frameworkComponents);
 	const typeNodes = [];
-	const pushTypeNode = (typeName, contractPath, typeIssues) => {
-		if (typeIssues.length > 0) issues.push(...typeIssues);
+	const pushTypeNode = (typeName, contractPath, typeIssues, controlPolicy) => {
+		let status = "pass";
+		let code = "";
+		let emitted = 0;
+		for (const issue of typeIssues) {
+			const disposition = verifierDisposition(controlPolicy, issue.kind);
+			if (disposition === "suppress") continue;
+			issues.push(issue);
+			emitted += 1;
+			if (code === "") code = issue.kind;
+			if (disposition === "fail") status = "fail";
+			else if (disposition === "warn" && status !== "fail") status = "warn";
+		}
 		typeNodes.push({
-			status: typeIssues.length > 0 ? "fail" : "pass",
+			status,
 			kind: "storageType",
 			name: `type ${typeName}`,
 			contractPath,
-			code: typeIssues.length > 0 ? typeIssues[0]?.kind ?? "" : "",
-			message: typeIssues.length > 0 ? `${typeIssues.length} issue${typeIssues.length === 1 ? "" : "s"}` : "",
+			code: status === "pass" ? "" : code,
+			message: emitted > 0 ? `${emitted} issue${emitted === 1 ? "" : "s"}` : "",
 			expected: void 0,
 			actual: void 0,
 			children: []
 		});
 	};
-	for (const [typeName, typeInstance] of Object.entries(contract.storage.types ?? {})) if (isPostgresEnumStorageEntry(typeInstance)) pushTypeNode(typeName, `storage.types.${typeName}`, verifyEnumType({
-		typeName,
-		typeInstance,
-		schema,
-		resolveExistingEnumValues,
-		namespaceId: UNBOUND_NAMESPACE_ID
-	}));
-	else if (isStorageTypeInstance(typeInstance)) {
+	for (const [typeName, typeInstance] of Object.entries(contract.storage.types ?? {})) if (isStorageTypeInstance(typeInstance)) {
 		const hook = codecHooks.get(typeInstance.codecId);
 		pushTypeNode(typeName, `storage.types.${typeName}`, hook?.verifyType ? hook.verifyType({
 			typeName,
 			typeInstance,
 			schema
-		}) : []);
+		}) : [], effectiveControlPolicy(void 0, contract.defaultControlPolicy));
 	}
 	for (const nsId of Object.keys(contract.storage.namespaces)) {
 		const ns = contract.storage.namespaces[nsId];
 		if (!ns) continue;
-		const nsEnums = ns.enum;
+		const nsEnums = ns.entries["type"];
 		if (!nsEnums) continue;
 		for (const [typeName, entry] of Object.entries(nsEnums)) {
 			if (!isPostgresEnumStorageEntry(entry)) continue;
-			pushTypeNode(typeName, `storage.namespaces.${nsId}.enum.${typeName}`, verifyEnumType({
+			pushTypeNode(typeName, `storage.namespaces.${nsId}.entries.type.${typeName}`, verifyEnumType({
 				typeName,
 				typeInstance: entry,
 				schema,
 				resolveExistingEnumValues,
 				namespaceId: nsId
-			}));
+			}), effectiveControlPolicy(entry.control, contract.defaultControlPolicy));
 		}
 	}
 	if (typeNodes.length > 0) {
-		const typesStatus = typeNodes.some((n) => n.status === "fail") ? "fail" : "pass";
+		const typesStatus = typeNodes.some((n) => n.status === "fail") ? "fail" : typeNodes.some((n) => n.status === "warn") ? "warn" : "pass";
 		rootChildren.push({
 			status: typesStatus,
 			kind: "storageTypes",
@@ -581,6 +636,7 @@ function extractContractMetadata(contract) {
 }
 function verifySchemaTables(options) {
 	const { contract, schema, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const contractDefaultControl = contract.defaultControlPolicy;
 	const issues = [];
 	const rootChildren = [];
 	const schemaTables = schema.tables;
@@ -588,19 +644,19 @@ function verifySchemaTables(options) {
 	for (const namespaceId of namespaceIds) {
 		const ns = contract.storage.namespaces[namespaceId];
 		if (!ns) continue;
-		for (const [tableName, contractTableRaw] of Object.entries(ns.tables)) {
-			if (!(contractTableRaw instanceof StorageTable)) throw new Error(`verifySqlSchema: expected StorageTable at storage.namespaces.${namespaceId}.tables.${tableName}`);
+		for (const [tableName, contractTableRaw] of Object.entries(ns.entries.table)) {
+			if (!(contractTableRaw instanceof StorageTable)) throw new Error(`verifySqlSchema: expected StorageTable at storage.namespaces.${namespaceId}.entries.table.${tableName}`);
 			const contractTable = contractTableRaw;
+			const tableControlPolicy = effectiveControlPolicy(contractTable.control, contractDefaultControl);
 			const schemaTable = schemaTables[tableName];
-			const tablePath = `storage.namespaces.${namespaceId}.tables.${tableName}`;
+			const tablePath = `storage.namespaces.${namespaceId}.entries.table.${tableName}`;
 			if (!schemaTable) {
-				issues.push({
+				emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 					kind: "missing_table",
 					table: tableName,
 					namespaceId,
 					message: `Table "${tableName}" is missing from database`
-				});
-				rootChildren.push({
+				}, {
 					status: "fail",
 					kind: "table",
 					name: `table ${tableName}`,
@@ -610,7 +666,7 @@ function verifySchemaTables(options) {
 					expected: void 0,
 					actual: void 0,
 					children: []
-				});
+				}, issues, rootChildren);
 				continue;
 			}
 			const tableChildren = verifyTableChildren({
@@ -619,6 +675,7 @@ function verifySchemaTables(options) {
 				tableName,
 				namespaceId,
 				tablePath,
+				tableControlPolicy,
 				issues,
 				strict,
 				typeMetadataRegistry,
@@ -631,24 +688,21 @@ function verifySchemaTables(options) {
 		}
 	}
 	if (strict) {
-		for (const tableName of Object.keys(schemaTables)) if (!namespaceIds.some((namespaceId) => contract.storage.namespaces[namespaceId]?.tables[tableName] !== void 0)) {
-			issues.push({
-				kind: "extra_table",
-				table: tableName,
-				message: `Extra table "${tableName}" found in database (not in contract)`
-			});
-			rootChildren.push({
-				status: "fail",
-				kind: "table",
-				name: `table ${tableName}`,
-				contractPath: `storage.namespaces.*.tables.${tableName}`,
-				code: "extra_table",
-				message: `Extra table "${tableName}" found`,
-				expected: void 0,
-				actual: void 0,
-				children: []
-			});
-		}
+		for (const tableName of Object.keys(schemaTables)) if (!namespaceIds.some((namespaceId) => contract.storage.namespaces[namespaceId]?.entries.table[tableName] !== void 0)) emitIssueAndNodeUnderControlPolicy(effectiveControlPolicy(void 0, contractDefaultControl), {
+			kind: "extra_table",
+			table: tableName,
+			message: `Extra table "${tableName}" found in database (not in contract)`
+		}, {
+			status: "fail",
+			kind: "table",
+			name: `table ${tableName}`,
+			contractPath: `storage.namespaces.*.entries.table.${tableName}`,
+			code: "extra_table",
+			message: `Extra table "${tableName}" found`,
+			expected: void 0,
+			actual: void 0,
+			children: []
+		}, issues, rootChildren);
 	}
 	return {
 		issues,
@@ -656,7 +710,7 @@ function verifySchemaTables(options) {
 	};
 }
 function verifyTableChildren(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
 	const tableChildren = [];
 	const columnNodes = collectContractColumnNodes({
 		contractTable,
@@ -664,6 +718,7 @@ function verifyTableChildren(options) {
 		tableName,
 		namespaceId,
 		tablePath,
+		tableControlPolicy,
 		issues,
 		strict,
 		typeMetadataRegistry,
@@ -679,77 +734,87 @@ function verifyTableChildren(options) {
 		tableName,
 		namespaceId,
 		tablePath,
+		tableControlPolicy,
 		issues,
 		columnNodes
 	});
-	if (contractTable.primaryKey) if (verifyPrimaryKey(contractTable.primaryKey, schemaTable.primaryKey, tableName, namespaceId, issues) === "fail") tableChildren.push({
-		status: "fail",
-		kind: "primaryKey",
-		name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
-		contractPath: `${tablePath}.primaryKey`,
-		code: "primary_key_mismatch",
-		message: "Primary key mismatch",
-		expected: contractTable.primaryKey,
-		actual: schemaTable.primaryKey,
-		children: []
-	});
-	else tableChildren.push({
-		status: "pass",
-		kind: "primaryKey",
-		name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
-		contractPath: `${tablePath}.primaryKey`,
-		code: "",
-		message: "",
-		expected: void 0,
-		actual: void 0,
-		children: []
-	});
-	else if (schemaTable.primaryKey && strict) {
-		issues.push({
-			kind: "extra_primary_key",
-			table: tableName,
-			namespaceId,
-			message: "Extra primary key found in database (not in contract)"
-		});
-		tableChildren.push({
+	if (contractTable.primaryKey) {
+		const pkStatus = verifyPrimaryKey(contractTable.primaryKey, schemaTable.primaryKey, tableName, namespaceId, tableControlPolicy, issues);
+		if (pkStatus === "fail") tableChildren.push({
 			status: "fail",
 			kind: "primaryKey",
-			name: `primary key: ${schemaTable.primaryKey.columns.join(", ")}`,
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
 			contractPath: `${tablePath}.primaryKey`,
-			code: "extra_primary_key",
-			message: "Extra primary key found",
-			expected: void 0,
+			code: "primary_key_mismatch",
+			message: "Primary key mismatch",
+			expected: contractTable.primaryKey,
 			actual: schemaTable.primaryKey,
 			children: []
 		});
-	}
+		else if (pkStatus === "warn") tableChildren.push({
+			status: "warn",
+			kind: "primaryKey",
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
+			contractPath: `${tablePath}.primaryKey`,
+			code: "primary_key_mismatch",
+			message: "Primary key mismatch",
+			expected: contractTable.primaryKey,
+			actual: schemaTable.primaryKey,
+			children: []
+		});
+		else tableChildren.push({
+			status: "pass",
+			kind: "primaryKey",
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
+			contractPath: `${tablePath}.primaryKey`,
+			code: "",
+			message: "",
+			expected: void 0,
+			actual: void 0,
+			children: []
+		});
+	} else if (schemaTable.primaryKey && strict) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+		kind: "extra_primary_key",
+		table: tableName,
+		namespaceId,
+		message: "Extra primary key found in database (not in contract)"
+	}, {
+		status: "fail",
+		kind: "primaryKey",
+		name: `primary key: ${schemaTable.primaryKey.columns.join(", ")}`,
+		contractPath: `${tablePath}.primaryKey`,
+		code: "extra_primary_key",
+		message: "Extra primary key found",
+		expected: void 0,
+		actual: schemaTable.primaryKey,
+		children: []
+	}, issues, tableChildren);
 	const constraintFks = contractTable.foreignKeys.filter((fk) => fk.constraint === true);
 	if (constraintFks.length > 0 || strict) {
-		const fkStatuses = verifyForeignKeys(constraintFks, schemaTable.foreignKeys, tableName, namespaceId, tablePath, issues, strict);
+		const fkStatuses = verifyForeignKeys(constraintFks, schemaTable.foreignKeys, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 		tableChildren.push(...fkStatuses);
 	}
-	const uniqueStatuses = verifyUniqueConstraints(contractTable.uniques, schemaTable.uniques, schemaTable.indexes, tableName, namespaceId, tablePath, issues, strict);
+	const uniqueStatuses = verifyUniqueConstraints(contractTable.uniques, schemaTable.uniques, schemaTable.indexes, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 	tableChildren.push(...uniqueStatuses);
 	const fkBackingIndexes = contractTable.foreignKeys.filter((fk) => fk.index === true && !contractTable.indexes.some((idx) => arraysEqual(idx.columns, fk.source.columns))).map((fk) => ({ columns: fk.source.columns }));
-	const indexStatuses = verifyIndexes([...contractTable.indexes, ...fkBackingIndexes], schemaTable.indexes, schemaTable.uniques, tableName, namespaceId, tablePath, issues, strict);
+	const indexStatuses = verifyIndexes([...contractTable.indexes, ...fkBackingIndexes], schemaTable.indexes, schemaTable.uniques, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 	tableChildren.push(...indexStatuses);
 	return tableChildren;
 }
 function collectContractColumnNodes(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
 	const columnNodes = [];
 	for (const [columnName, contractColumn] of Object.entries(contractTable.columns)) {
 		const schemaColumn = schemaTable.columns[columnName];
 		const columnPath = `${tablePath}.columns.${columnName}`;
 		if (!schemaColumn) {
-			issues.push({
+			emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 				kind: "missing_column",
 				table: tableName,
 				namespaceId,
 				column: columnName,
 				message: `Column "${tableName}"."${columnName}" is missing from database`
-			});
-			columnNodes.push({
+			}, {
 				status: "fail",
 				kind: "column",
 				name: `${columnName}: missing`,
@@ -759,7 +824,7 @@ function collectContractColumnNodes(options) {
 				expected: void 0,
 				actual: void 0,
 				children: []
-			});
+			}, issues, columnNodes);
 			continue;
 		}
 		columnNodes.push(verifyColumn({
@@ -769,6 +834,7 @@ function collectContractColumnNodes(options) {
 			contractColumn,
 			schemaColumn,
 			columnPath,
+			tableControlPolicy,
 			issues,
 			strict,
 			typeMetadataRegistry,
@@ -781,30 +847,27 @@ function collectContractColumnNodes(options) {
 	return columnNodes;
 }
 function appendExtraColumnNodes(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, columnNodes } = options;
-	for (const [columnName, { nativeType }] of Object.entries(schemaTable.columns)) if (!contractTable.columns[columnName]) {
-		issues.push({
-			kind: "extra_column",
-			table: tableName,
-			namespaceId,
-			column: columnName,
-			message: `Extra column "${tableName}"."${columnName}" found in database (not in contract)`
-		});
-		columnNodes.push({
-			status: "fail",
-			kind: "column",
-			name: `${columnName}: extra`,
-			contractPath: `${tablePath}.columns.${columnName}`,
-			code: "extra_column",
-			message: `Extra column "${columnName}" found`,
-			expected: void 0,
-			actual: nativeType,
-			children: []
-		});
-	}
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, columnNodes } = options;
+	for (const [columnName, { nativeType }] of Object.entries(schemaTable.columns)) if (!contractTable.columns[columnName]) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+		kind: "extra_column",
+		table: tableName,
+		namespaceId,
+		column: columnName,
+		message: `Extra column "${tableName}"."${columnName}" found in database (not in contract)`
+	}, {
+		status: "fail",
+		kind: "column",
+		name: `${columnName}: extra`,
+		contractPath: `${tablePath}.columns.${columnName}`,
+		code: "extra_column",
+		message: `Extra column "${columnName}" found`,
+		expected: void 0,
+		actual: nativeType,
+		children: []
+	}, issues, columnNodes);
 }
 function verifyColumn(options) {
-	const { tableName, namespaceId, columnName, contractColumn, schemaColumn, columnPath, issues, strict, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { tableName, namespaceId, columnName, contractColumn, schemaColumn, columnPath, tableControlPolicy, issues, strict, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
 	const columnChildren = [];
 	let columnStatus = "pass";
 	const resolvedContractColumn = resolveContractColumnTypeMetadata(contractColumn, storageTypes, {
@@ -816,8 +879,8 @@ function verifyColumn(options) {
 		columnName
 	});
 	const schemaNativeType = normalizeNativeType?.(schemaColumn.nativeType) ?? schemaColumn.nativeType;
-	if (contractNativeType !== schemaNativeType) {
-		issues.push({
+	if (!(contractNativeType === schemaNativeType)) {
+		const issue = {
 			kind: "type_mismatch",
 			table: tableName,
 			namespaceId,
@@ -825,19 +888,23 @@ function verifyColumn(options) {
 			expected: contractNativeType,
 			actual: schemaNativeType,
 			message: `Column "${tableName}"."${columnName}" has type mismatch: expected "${contractNativeType}", got "${schemaNativeType}"`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "type",
-			name: "type",
-			contractPath: `${columnPath}.nativeType`,
-			code: "type_mismatch",
-			message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
-			expected: contractNativeType,
-			actual: schemaNativeType,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "type",
+				name: "type",
+				contractPath: `${columnPath}.nativeType`,
+				code: "type_mismatch",
+				message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
+				expected: contractNativeType,
+				actual: schemaNativeType,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	if (resolvedContractColumn.codecId) {
 		const typeMetadata = options.typeMetadataRegistry.get(resolvedContractColumn.codecId);
@@ -865,7 +932,7 @@ function verifyColumn(options) {
 		});
 	}
 	if (contractColumn.nullable !== schemaColumn.nullable) {
-		issues.push({
+		const issue = {
 			kind: "nullability_mismatch",
 			table: tableName,
 			namespaceId,
@@ -873,47 +940,55 @@ function verifyColumn(options) {
 			expected: String(contractColumn.nullable),
 			actual: String(schemaColumn.nullable),
 			message: `Column "${tableName}"."${columnName}" has nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "nullability",
-			name: "nullability",
-			contractPath: `${columnPath}.nullable`,
-			code: "nullability_mismatch",
-			message: `Nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`,
-			expected: contractColumn.nullable,
-			actual: schemaColumn.nullable,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "nullability",
+				name: "nullability",
+				contractPath: `${columnPath}.nullable`,
+				code: "nullability_mismatch",
+				message: `Nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`,
+				expected: contractColumn.nullable,
+				actual: schemaColumn.nullable,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	if (contractColumn.default) {
 		if (!schemaColumn.default) {
 			const defaultDescription = describeColumnDefault(contractColumn.default);
-			issues.push({
+			const issue = {
 				kind: "default_missing",
 				table: tableName,
 				namespaceId,
 				column: columnName,
 				expected: defaultDescription,
 				message: `Column "${tableName}"."${columnName}" should have default ${defaultDescription} but database has no default`
-			});
-			columnChildren.push({
-				status: "fail",
-				kind: "default",
-				name: "default",
-				contractPath: `${columnPath}.default`,
-				code: "default_missing",
-				message: `Default missing: expected ${defaultDescription}`,
-				expected: defaultDescription,
-				actual: void 0,
-				children: []
-			});
-			columnStatus = "fail";
+			};
+			const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+			if (disposition !== "suppress") {
+				issues.push(issue);
+				columnChildren.push({
+					status: disposition,
+					kind: "default",
+					name: "default",
+					contractPath: `${columnPath}.default`,
+					code: "default_missing",
+					message: `Default missing: expected ${defaultDescription}`,
+					expected: defaultDescription,
+					actual: void 0,
+					children: []
+				});
+				columnStatus = disposition;
+			}
 		} else if (!columnDefaultsEqual(contractColumn.default, schemaColumn.default, normalizeDefault, schemaNativeType)) {
 			const expectedDescription = describeColumnDefault(contractColumn.default);
 			const actualDescription = schemaColumn.default;
-			issues.push({
+			const issue = {
 				kind: "default_mismatch",
 				table: tableName,
 				namespaceId,
@@ -921,41 +996,49 @@ function verifyColumn(options) {
 				expected: expectedDescription,
 				actual: actualDescription,
 				message: `Column "${tableName}"."${columnName}" has default mismatch: expected ${expectedDescription}, got ${actualDescription}`
-			});
-			columnChildren.push({
-				status: "fail",
-				kind: "default",
-				name: "default",
-				contractPath: `${columnPath}.default`,
-				code: "default_mismatch",
-				message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
-				expected: expectedDescription,
-				actual: actualDescription,
-				children: []
-			});
-			columnStatus = "fail";
+			};
+			const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+			if (disposition !== "suppress") {
+				issues.push(issue);
+				columnChildren.push({
+					status: disposition,
+					kind: "default",
+					name: "default",
+					contractPath: `${columnPath}.default`,
+					code: "default_mismatch",
+					message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
+					expected: expectedDescription,
+					actual: actualDescription,
+					children: []
+				});
+				columnStatus = disposition;
+			}
 		}
 	} else if (strict && schemaColumn.default) {
-		issues.push({
+		const issue = {
 			kind: "extra_default",
 			table: tableName,
 			namespaceId,
 			column: columnName,
 			actual: schemaColumn.default,
 			message: `Column "${tableName}"."${columnName}" has default ${schemaColumn.default} in database but contract specifies no default`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "default",
-			name: "default",
-			contractPath: `${columnPath}.default`,
-			code: "extra_default",
-			message: `Extra default: ${schemaColumn.default}`,
-			expected: void 0,
-			actual: schemaColumn.default,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "default",
+				name: "default",
+				contractPath: `${columnPath}.default`,
+				code: "extra_default",
+				message: `Extra default: ${schemaColumn.default}`,
+				expected: void 0,
+				actual: schemaColumn.default,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	const aggregated = aggregateChildState(columnChildren, columnStatus);
 	const nullableText = contractColumn.nullable ? "nullable" : "not nullable";
@@ -1154,4 +1237,4 @@ function formatLiteralValue(value) {
 //#endregion
 export { extractCodecControlHooks as a, isUniqueConstraintSatisfied as i, arraysEqual as n, isIndexSatisfied as r, verifySqlSchema as t };
 
-//# sourceMappingURL=verify-sql-schema-CYLsGCFO.mjs.map
+//# sourceMappingURL=verify-sql-schema-CYlKme0a.mjs.map