@prisma-next/family-sql 0.12.0 → 0.13.0-dev.1

package/dist/{verify-sql-schema-CYLsGCFO.mjs → verify-sql-schema-DlAgBiT_.mjs}

@@ -1,7 +1,10 @@
-import { assertUniqueCodecOwner } from "@prisma-next/framework-components/control";
+import { assertUniqueCodecOwner, dispositionForCategory } from "@prisma-next/framework-components/control";
+import { defaultIndexName } from "@prisma-next/sql-schema-ir/naming";
 import { ifDefined } from "@prisma-next/utils/defined";
 import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
-import { StorageTable, isPostgresEnumStorageEntry, isStorageTypeInstance } from "@prisma-next/sql-contract/types";
+import { StorageTable, isPostgresEnumStorageEntry, isStorageTypeInstance, toStorageTypeInstance } from "@prisma-next/sql-contract/types";
+import { blindCast } from "@prisma-next/utils/casts";
+import { effectiveControlPolicy } from "@prisma-next/contract/types";
 import { canonicalStringify } from "@prisma-next/utils/canonical-stringify";
 //#region src/core/assembly.ts
 function hasCodecControlHooks(descriptor) {
@@ -31,6 +34,310 @@ function extractCodecControlHooks(descriptors) {
 	return hooks;
 }
 //#endregion
+//#region src/core/migrations/contract-to-schema-ir.ts
+function convertColumn(name, column, storageTypes, expandNativeType, renderDefault) {
+	const resolved = resolveColumnTypeMetadata(column, storageTypes);
+	return {
+		name,
+		nativeType: expandNativeType ? expandNativeType({
+			nativeType: resolved.nativeType,
+			codecId: resolved.codecId,
+			...ifDefined("typeParams", resolved.typeParams)
+		}) : resolved.nativeType,
+		nullable: column.nullable,
+		...ifDefined("default", column.default != null && renderDefault ? renderDefault(column.default, column) : void 0)
+	};
+}
+function resolveColumnTypeMetadata(column, storageTypes) {
+	if (!column.typeRef) return column;
+	const referenced = storageTypes[column.typeRef];
+	if (!referenced) throw new Error(`Column references storage type "${column.typeRef}" but it is not defined in storage.types.`);
+	if (isPostgresEnumStorageEntry(referenced)) return {
+		codecId: referenced.codecId,
+		nativeType: referenced.nativeType,
+		typeParams: { values: referenced.values }
+	};
+	if (isStorageTypeInstance(referenced)) return {
+		codecId: referenced.codecId,
+		nativeType: referenced.nativeType,
+		typeParams: referenced.typeParams
+	};
+	throw new Error(`Storage type "${column.typeRef}" has an unknown polymorphic kind; expected codec-instance or postgres-enum.`);
+}
+/**
+* Resolves a `ValueSetRef` to its permitted values from the contract storage.
+*
+* Throws when the referenced namespace or value-set is absent — this indicates
+* the contract was built incorrectly (the check and the value-set must be
+* co-emitted by the lowering step). Used by `convertCheck` (schema-IR
+* projection), `verifyCheckConstraints` (verification), and
+* `checkConstraintPlanCallStrategy` (migration planning) so all three agree on
+* the resolved values and the error behavior on a missing reference.
+*/
+function resolveValueSetValues(ref, storage, contextLabel) {
+	const ns = storage.namespaces[ref.namespaceId];
+	if (!ns) throw new Error(`resolveValueSetValues: namespace "${ref.namespaceId}" not found in storage (${contextLabel})`);
+	const valueSet = ns.entries.valueSet?.[ref.name];
+	if (!valueSet) throw new Error(`resolveValueSetValues: value-set "${ref.name}" not found in namespace "${ref.namespaceId}" (${contextLabel})`);
+	return valueSet.values;
+}
+/**
+* Projects a `CheckConstraint` IR into an `SqlCheckConstraintIRInput` by
+* resolving the permitted values from the storage value-set it references.
+*
+* The `CheckConstraint.valueSet` ref points to
+* `storage.namespaces[namespaceId].entries.valueSet[name]`. The resolved
+* values are lifted directly from `StorageValueSet.values` so verification
+* compares value sets, not SQL predicate strings.
+*
+* Throws if the referenced namespace or value-set is absent — this
+* indicates the contract was built incorrectly (the check and the
+* value-set must be co-emitted by the lowering step).
+*/
+function convertCheck(check, storage) {
+	const permittedValues = resolveValueSetValues(check.valueSet, storage, `check "${check.name}"`);
+	return {
+		name: check.name,
+		column: check.column,
+		permittedValues
+	};
+}
+function convertUnique(unique) {
+	return {
+		columns: unique.columns,
+		...ifDefined("name", unique.name)
+	};
+}
+function convertIndex(index) {
+	return {
+		columns: index.columns,
+		unique: false,
+		...ifDefined("name", index.name)
+	};
+}
+function convertForeignKey(fk) {
+	return {
+		columns: fk.source.columns,
+		referencedTable: fk.target.tableName,
+		referencedSchema: fk.target.namespaceId,
+		referencedColumns: fk.target.columns,
+		...ifDefined("name", fk.name),
+		...ifDefined("onDelete", fk.onDelete),
+		...ifDefined("onUpdate", fk.onUpdate)
+	};
+}
+function convertTable(name, table, storageTypes, expandNativeType, renderDefault, storage) {
+	const columns = {};
+	for (const [colName, colDef] of Object.entries(table.columns)) columns[colName] = convertColumn(colName, colDef, storageTypes, expandNativeType, renderDefault);
+	const satisfiedIndexColumns = new Set([
+		...table.indexes.map((idx) => idx.columns.join(",")),
+		...table.uniques.map((unique) => unique.columns.join(",")),
+		...table.primaryKey ? [table.primaryKey.columns.join(",")] : []
+	]);
+	const fkBackingIndexes = [];
+	for (const fk of table.foreignKeys) {
+		if (fk.index === false) continue;
+		const key = fk.source.columns.join(",");
+		if (satisfiedIndexColumns.has(key)) continue;
+		fkBackingIndexes.push({
+			columns: fk.source.columns,
+			unique: false,
+			name: defaultIndexName(name, fk.source.columns)
+		});
+		satisfiedIndexColumns.add(key);
+	}
+	const checks = table.checks && table.checks.length > 0 ? table.checks.map((c) => convertCheck(c, storage)) : void 0;
+	return {
+		name,
+		columns,
+		...ifDefined("primaryKey", table.primaryKey),
+		foreignKeys: table.foreignKeys.filter((fk) => fk.constraint !== false).map(convertForeignKey),
+		uniques: table.uniques.map(convertUnique),
+		indexes: [...table.indexes.map(convertIndex), ...fkBackingIndexes],
+		...ifDefined("checks", checks)
+	};
+}
+/**
+* Detects destructive changes between two contract storages.
+*
+* The additive-only planner silently ignores removals (tables, columns).
+* This function detects those removals so callers can report them as conflicts
+* rather than silently producing an empty plan.
+*
+* Returns an empty array if no destructive changes are found.
+*/
+function detectDestructiveChanges(from, to) {
+	if (!from) return [];
+	const hasOwn = (value, key) => Object.hasOwn(value, key);
+	const conflicts = [];
+	const namespaceIds = [...new Set([...Object.keys(from.namespaces), ...Object.keys(to.namespaces)])].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+	for (const namespaceId of namespaceIds) {
+		const fromNs = from.namespaces[namespaceId];
+		const toNs = to.namespaces[namespaceId];
+		const fromTables = fromNs?.entries.table;
+		if (!fromTables) continue;
+		for (const tableName of Object.keys(fromTables)) {
+			const toTableRaw = toNs?.entries.table[tableName];
+			if (!(toTableRaw instanceof StorageTable)) {
+				conflicts.push({
+					kind: "tableRemoved",
+					summary: `Table "${tableName}" was removed`
+				});
+				continue;
+			}
+			const toTable = toTableRaw;
+			const fromTableRaw = fromTables[tableName];
+			if (!(fromTableRaw instanceof StorageTable)) continue;
+			const fromTable = fromTableRaw;
+			for (const columnName of Object.keys(fromTable.columns)) if (!hasOwn(toTable.columns, columnName)) conflicts.push({
+				kind: "columnRemoved",
+				summary: `Column "${tableName}"."${columnName}" was removed`
+			});
+		}
+	}
+	return conflicts;
+}
+/**
+* Converts a `Contract` to `SqlSchemaIR`.
+*
+* Reads `contract.storage` for tables and `contract.storage.types` for type
+* annotations. Storage-type annotations are written under
+* `options.annotationNamespace`.
+*
+* Drops codec metadata (`codecId`, `typeRef`) since the schema IR only represents
+* structural information. When `expandNativeType` is provided, parameterized types
+* are expanded (e.g. `character` + `{ length: 36 }` → `character(36)`) so the
+* resulting IR compares correctly against the "to" contract during planning.
+*
+* Returns an empty schema IR when `contract` is `null` (new project).
+*/
+function contractToSchemaIR(contract, options) {
+	if (options.annotationNamespace.length === 0) throw new Error("annotationNamespace must be a non-empty string");
+	if (!contract) return { tables: {} };
+	const storage = contract.storage;
+	const allTypes = { ...storage.types ?? {} };
+	for (const ns of Object.values(storage.namespaces)) {
+		const nsEnums = ns.entries["type"];
+		if (nsEnums) for (const [k, v] of Object.entries(nsEnums)) allTypes[k] = blindCast(v);
+	}
+	const storageTypes = allTypes;
+	const tables = {};
+	for (const ns of Object.values(storage.namespaces)) for (const [tableName, tableDefRaw] of Object.entries(ns.entries.table)) {
+		if (!(tableDefRaw instanceof StorageTable)) throw new Error(`contractToSchemaIR: expected StorageTable at namespaces.${ns.id}.entries.table.${tableName}`);
+		const tableDef = tableDefRaw;
+		if (tables[tableName] !== void 0) throw new Error(`contractToSchemaIR: duplicate SQL table name "${tableName}" across namespaces (ambiguous for flat SqlSchemaIR.tables).`);
+		tables[tableName] = convertTable(tableName, tableDef, storageTypes, options.expandNativeType, options.renderDefault, storage);
+	}
+	return {
+		tables,
+		...ifDefined("annotations", deriveAnnotations(storage, options.annotationNamespace, options.resolveEnumStorageKey))
+	};
+}
+/**
+* Normalises a native enum storage entry to the codec-typed annotation shape
+* `{codecId, nativeType, typeParams}` the introspector writes and
+* `readExistingEnumValues` reads (`existing.codecId` + `existing.typeParams.values`).
+* Without this the projector would emit the raw `PostgresEnumStorageEntry`
+* shape (top-level `values`, no `typeParams`) and the enum would read as new.
+*/
+function normalizeEnumAnnotation(entry) {
+	return toStorageTypeInstance({
+		codecId: entry.codecId,
+		nativeType: entry.nativeType,
+		typeParams: { values: entry.values }
+	});
+}
+function deriveAnnotations(storage, annotationNamespace, resolveEnumStorageKey) {
+	const storageTypes = {};
+	for (const typeInstance of Object.values(storage.types ?? {})) {
+		if (isPostgresEnumStorageEntry(typeInstance)) {
+			const key = resolveEnumStorageKey ? resolveEnumStorageKey(storage, UNBOUND_NAMESPACE_ID, typeInstance.nativeType) : typeInstance.nativeType;
+			storageTypes[key] = normalizeEnumAnnotation(typeInstance);
+			continue;
+		}
+		if (isStorageTypeInstance(typeInstance)) storageTypes[typeInstance.nativeType] = typeInstance;
+	}
+	for (const [namespaceId, ns] of Object.entries(storage.namespaces)) {
+		const nsEnums = ns.entries["type"];
+		if (!nsEnums) continue;
+		for (const entry of Object.values(nsEnums)) {
+			if (!isPostgresEnumStorageEntry(entry)) continue;
+			const key = resolveEnumStorageKey ? resolveEnumStorageKey(storage, namespaceId, entry.nativeType) : entry.nativeType;
+			storageTypes[key] = normalizeEnumAnnotation(entry);
+		}
+	}
+	if (Object.keys(storageTypes).length === 0) return void 0;
+	return { [annotationNamespace]: { storageTypes } };
+}
+//#endregion
+//#region src/core/schema-verify/verifier-disposition.ts
+/**
+* Classifies the relational verifier issue kinds the SQL family emits (tables,
+* columns, constraints, indexes, defaults, enum types) into the target-neutral
+* categories the framework grades. The relational vocabulary lives here, in the
+* SQL domain — the framework never switches over `extra_foreign_key` and friends.
+*/
+function classifySqlVerifierIssueKind(kind) {
+	switch (kind) {
+		case "extra_column": return "extraNestedElement";
+		case "extra_primary_key":
+		case "extra_foreign_key":
+		case "extra_unique_constraint":
+		case "extra_index":
+		case "extra_validator":
+		case "extra_default": return "extraAuxiliary";
+		case "extra_table": return "extraTopLevelObject";
+		case "missing_schema":
+		case "missing_table":
+		case "missing_column":
+		case "type_missing":
+		case "default_missing": return "declaredMissing";
+		case "type_values_mismatch":
+		case "enum_values_changed":
+		case "check_mismatch": return "valueDrift";
+		case "type_mismatch":
+		case "nullability_mismatch":
+		case "primary_key_mismatch":
+		case "foreign_key_mismatch":
+		case "unique_constraint_mismatch":
+		case "index_mismatch":
+		case "default_mismatch": return "declaredIncompatible";
+		case "check_missing": return "declaredMissing";
+		case "check_removed": return "extraAuxiliary";
+	}
+}
+function verifierDisposition(controlPolicy, issueKind) {
+	return dispositionForCategory(controlPolicy, classifySqlVerifierIssueKind(issueKind));
+}
+//#endregion
+//#region src/core/schema-verify/control-verify-emit.ts
+/**
+* Grades `issue` under `controlPolicy` and, unless suppressed, pushes both the
+* issue and a status-stamped verification node. Returns the resolved outcome so
+* the caller never re-grades the same issue.
+*/
+function emitIssueAndNodeUnderControlPolicy(controlPolicy, issue, node, issues, nodes) {
+	const disposition = verifierDisposition(controlPolicy, issue.kind);
+	if (disposition === "suppress") return disposition;
+	issues.push(issue);
+	nodes.push({
+		...node,
+		status: disposition
+	});
+	return disposition;
+}
+/**
+* Grades `issue` under `controlPolicy` and, unless suppressed, pushes the issue
+* (no verification node). Returns the resolved outcome so the caller maps it to
+* a node status itself without re-grading.
+*/
+function emitIssueUnderControlPolicy(controlPolicy, issue, issues) {
+	const disposition = verifierDisposition(controlPolicy, issue.kind);
+	if (disposition === "suppress") return disposition;
+	issues.push(issue);
+	return disposition;
+}
+//#endregion
 //#region src/core/schema-verify/verify-helpers.ts
 function indexOptionsLooselyEqual(a, b) {
 	const aKeys = a ? Object.keys(a).sort() : [];
@@ -92,27 +399,27 @@ function isIndexSatisfied(indexes, uniques, columns) {
 * Uses semantic satisfaction: identity is based on (table + kind + columns).
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, issues) {
+function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, tableControlPolicy, issues) {
 	if (!schemaPK) {
-		issues.push({
+		const outcome = emitIssueUnderControlPolicy(tableControlPolicy, {
 			kind: "primary_key_mismatch",
 			table: tableName,
 			namespaceId,
 			expected: contractPK.columns.join(", "),
 			message: `Table "${tableName}" is missing primary key`
-		});
-		return "fail";
+		}, issues);
+		return outcome === "suppress" ? "pass" : outcome;
 	}
 	if (!arraysEqual(contractPK.columns, schemaPK.columns)) {
-		issues.push({
+		const outcome = emitIssueUnderControlPolicy(tableControlPolicy, {
 			kind: "primary_key_mismatch",
 			table: tableName,
 			namespaceId,
 			expected: contractPK.columns.join(", "),
 			actual: schemaPK.columns.join(", "),
 			message: `Table "${tableName}" has primary key mismatch: expected columns [${contractPK.columns.join(", ")}], got [${schemaPK.columns.join(", ")}]`
-		});
-		return "fail";
+		}, issues);
+		return outcome === "suppress" ? "pass" : outcome;
 	}
 	return "pass";
 }
@@ -123,7 +430,7 @@ function verifyPrimaryKey(contractPK, schemaPK, tableName, namespaceId, issues)
 * Uses semantic satisfaction: identity is based on (table + columns + referenced table + referenced columns).
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, tablePath, issues, strict) {
+function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractFK of contractFKs) {
 		const fkPath = `${tablePath}.foreignKeys[${contractFK.source.columns.join(",")}]`;
@@ -131,32 +438,30 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 			const tablesMatch = fk.referencedSchema !== void 0 && contractFK.target.namespaceId !== UNBOUND_NAMESPACE_ID ? fk.referencedSchema === contractFK.target.namespaceId && fk.referencedTable === contractFK.target.tableName : fk.referencedTable === contractFK.target.tableName;
 			return arraysEqual(fk.columns, contractFK.source.columns) && tablesMatch && arraysEqual(fk.referencedColumns, contractFK.target.columns);
 		});
-		if (!matchingFK) {
-			issues.push({
-				kind: "foreign_key_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: `${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`,
-				message: `Table "${tableName}" is missing foreign key: ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "foreignKey",
-				name: `foreignKey(${contractFK.source.columns.join(", ")})`,
-				contractPath: fkPath,
-				code: "foreign_key_mismatch",
-				message: "Foreign key missing",
-				expected: contractFK,
-				actual: void 0,
-				children: []
-			});
-		} else {
+		if (!matchingFK) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "foreign_key_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: `${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`,
+			message: `Table "${tableName}" is missing foreign key: ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}(${contractFK.target.columns.join(", ")})`
+		}, {
+			status: "fail",
+			kind: "foreignKey",
+			name: `foreignKey(${contractFK.source.columns.join(", ")})`,
+			contractPath: fkPath,
+			code: "foreign_key_mismatch",
+			message: "Foreign key missing",
+			expected: contractFK,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else {
 			const actionMismatches = getReferentialActionMismatches(contractFK, matchingFK);
 			if (actionMismatches.length > 0) {
 				const combinedMessage = actionMismatches.map((m) => m.message).join("; ");
 				const combinedExpected = actionMismatches.map((m) => m.expected).join(", ");
 				const combinedActual = actionMismatches.map((m) => m.actual).join(", ");
-				issues.push({
+				emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 					kind: "foreign_key_mismatch",
 					table: tableName,
 					namespaceId,
@@ -164,8 +469,7 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 					expected: combinedExpected,
 					actual: combinedActual,
 					message: `Table "${tableName}" foreign key ${contractFK.source.columns.join(", ")} -> ${contractFK.target.tableName}: ${combinedMessage}`
-				});
-				nodes.push({
+				}, {
 					status: "fail",
 					kind: "foreignKey",
 					name: `foreignKey(${contractFK.source.columns.join(", ")})`,
@@ -175,7 +479,7 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 					expected: contractFK,
 					actual: matchingFK,
 					children: []
-				});
+				}, issues, nodes);
 			} else nodes.push({
 				status: "pass",
 				kind: "foreignKey",
@@ -193,26 +497,23 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 		for (const schemaFK of schemaFKs) if (!contractFKs.find((fk) => {
 			const tablesMatch = schemaFK.referencedSchema !== void 0 && fk.target.namespaceId !== UNBOUND_NAMESPACE_ID ? schemaFK.referencedSchema === fk.target.namespaceId && schemaFK.referencedTable === fk.target.tableName : schemaFK.referencedTable === fk.target.tableName;
 			return arraysEqual(fk.source.columns, schemaFK.columns) && tablesMatch && arraysEqual(fk.target.columns, schemaFK.referencedColumns);
-		})) {
-			issues.push({
-				kind: "extra_foreign_key",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaFK.name ?? `fk(${schemaFK.columns.join(",")})`,
-				message: `Extra foreign key found in database (not in contract): ${schemaFK.columns.join(", ")} -> ${schemaFK.referencedTable}(${schemaFK.referencedColumns.join(", ")})`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "foreignKey",
-				name: `foreignKey(${schemaFK.columns.join(", ")})`,
-				contractPath: `${tablePath}.foreignKeys[${schemaFK.columns.join(",")}]`,
-				code: "extra_foreign_key",
-				message: "Extra foreign key found",
-				expected: void 0,
-				actual: schemaFK,
-				children: []
-			});
-		}
+		})) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_foreign_key",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaFK.name ?? `fk(${schemaFK.columns.join(",")})`,
+			message: `Extra foreign key found in database (not in contract): ${schemaFK.columns.join(", ")} -> ${schemaFK.referencedTable}(${schemaFK.referencedColumns.join(", ")})`
+		}, {
+			status: "fail",
+			kind: "foreignKey",
+			name: `foreignKey(${schemaFK.columns.join(", ")})`,
+			contractPath: `${tablePath}.foreignKeys[${schemaFK.columns.join(",")}]`,
+			code: "extra_foreign_key",
+			message: "Extra foreign key found",
+			expected: void 0,
+			actual: schemaFK,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -227,32 +528,30 @@ function verifyForeignKeys(contractFKs, schemaFKs, tableName, namespaceId, table
 *
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes, tableName, namespaceId, tablePath, issues, strict) {
+function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractUnique of contractUniques) {
 		const uniquePath = `${tablePath}.uniques[${contractUnique.columns.join(",")}]`;
 		const matchingUnique = schemaUniques.find((u) => arraysEqual(u.columns, contractUnique.columns));
 		const matchingUniqueIndex = !matchingUnique && schemaIndexes.find((idx) => idx.unique && arraysEqual(idx.columns, contractUnique.columns));
-		if (!matchingUnique && !matchingUniqueIndex) {
-			issues.push({
-				kind: "unique_constraint_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: contractUnique.columns.join(", "),
-				message: `Table "${tableName}" is missing unique constraint: ${contractUnique.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "unique",
-				name: `unique(${contractUnique.columns.join(", ")})`,
-				contractPath: uniquePath,
-				code: "unique_constraint_mismatch",
-				message: "Unique constraint missing",
-				expected: contractUnique,
-				actual: void 0,
-				children: []
-			});
-		} else nodes.push({
+		if (!matchingUnique && !matchingUniqueIndex) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "unique_constraint_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: contractUnique.columns.join(", "),
+			message: `Table "${tableName}" is missing unique constraint: ${contractUnique.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "unique",
+			name: `unique(${contractUnique.columns.join(", ")})`,
+			contractPath: uniquePath,
+			code: "unique_constraint_mismatch",
+			message: "Unique constraint missing",
+			expected: contractUnique,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else nodes.push({
 			status: "pass",
 			kind: "unique",
 			name: `unique(${contractUnique.columns.join(", ")})`,
@@ -265,26 +564,23 @@ function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes,
 		});
 	}
 	if (strict) {
-		for (const schemaUnique of schemaUniques) if (!contractUniques.find((u) => arraysEqual(u.columns, schemaUnique.columns))) {
-			issues.push({
-				kind: "extra_unique_constraint",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaUnique.name ?? `unique(${schemaUnique.columns.join(",")})`,
-				message: `Extra unique constraint found in database (not in contract): ${schemaUnique.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "unique",
-				name: `unique(${schemaUnique.columns.join(", ")})`,
-				contractPath: `${tablePath}.uniques[${schemaUnique.columns.join(",")}]`,
-				code: "extra_unique_constraint",
-				message: "Extra unique constraint found",
-				expected: void 0,
-				actual: schemaUnique,
-				children: []
-			});
-		}
+		for (const schemaUnique of schemaUniques) if (!contractUniques.find((u) => arraysEqual(u.columns, schemaUnique.columns))) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_unique_constraint",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaUnique.name ?? `unique(${schemaUnique.columns.join(",")})`,
+			message: `Extra unique constraint found in database (not in contract): ${schemaUnique.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "unique",
+			name: `unique(${schemaUnique.columns.join(", ")})`,
+			contractPath: `${tablePath}.uniques[${schemaUnique.columns.join(",")}]`,
+			code: "extra_unique_constraint",
+			message: "Extra unique constraint found",
+			expected: void 0,
+			actual: schemaUnique,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -299,32 +595,30 @@ function verifyUniqueConstraints(contractUniques, schemaUniques, schemaIndexes,
 *
 * Name differences are ignored by default (names are for DDL/diagnostics, not identity).
 */
-function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName, namespaceId, tablePath, issues, strict) {
+function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
 	const nodes = [];
 	for (const contractIndex of contractIndexes) {
 		const indexPath = `${tablePath}.indexes[${contractIndex.columns.join(",")}]`;
 		const matchingIndex = schemaIndexes.find((idx) => arraysEqual(idx.columns, contractIndex.columns) && indexExtrasMatch(contractIndex, idx));
 		const matchingUniqueConstraint = !matchingIndex && contractIndex.type === void 0 && contractIndex.options === void 0 && schemaUniques.find((u) => arraysEqual(u.columns, contractIndex.columns));
-		if (!matchingIndex && !matchingUniqueConstraint) {
-			issues.push({
-				kind: "index_mismatch",
-				table: tableName,
-				namespaceId,
-				expected: contractIndex.columns.join(", "),
-				message: `Table "${tableName}" is missing index: ${contractIndex.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "index",
-				name: `index(${contractIndex.columns.join(", ")})`,
-				contractPath: indexPath,
-				code: "index_mismatch",
-				message: "Index missing",
-				expected: contractIndex,
-				actual: void 0,
-				children: []
-			});
-		} else nodes.push({
+		if (!matchingIndex && !matchingUniqueConstraint) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "index_mismatch",
+			table: tableName,
+			namespaceId,
+			expected: contractIndex.columns.join(", "),
+			message: `Table "${tableName}" is missing index: ${contractIndex.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "index",
+			name: `index(${contractIndex.columns.join(", ")})`,
+			contractPath: indexPath,
+			code: "index_mismatch",
+			message: "Index missing",
+			expected: contractIndex,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else nodes.push({
 			status: "pass",
 			kind: "index",
 			name: `index(${contractIndex.columns.join(", ")})`,
@@ -338,26 +632,23 @@ function verifyIndexes(contractIndexes, schemaIndexes, schemaUniques, tableName,
 	}
 	if (strict) for (const schemaIndex of schemaIndexes) {
 		if (schemaIndex.unique) continue;
-		if (!contractIndexes.find((idx) => arraysEqual(idx.columns, schemaIndex.columns) && indexExtrasMatch(idx, schemaIndex))) {
-			issues.push({
-				kind: "extra_index",
-				table: tableName,
-				namespaceId,
-				indexOrConstraint: schemaIndex.name ?? `idx(${schemaIndex.columns.join(",")})`,
-				message: `Extra index found in database (not in contract): ${schemaIndex.columns.join(", ")}`
-			});
-			nodes.push({
-				status: "fail",
-				kind: "index",
-				name: `index(${schemaIndex.columns.join(", ")})`,
-				contractPath: `${tablePath}.indexes[${schemaIndex.columns.join(",")}]`,
-				code: "extra_index",
-				message: "Extra index found",
-				expected: void 0,
-				actual: schemaIndex,
-				children: []
-			});
-		}
+		if (!contractIndexes.find((idx) => arraysEqual(idx.columns, schemaIndex.columns) && indexExtrasMatch(idx, schemaIndex))) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "extra_index",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: schemaIndex.name ?? `idx(${schemaIndex.columns.join(",")})`,
+			message: `Extra index found in database (not in contract): ${schemaIndex.columns.join(", ")}`
+		}, {
+			status: "fail",
+			kind: "index",
+			name: `index(${schemaIndex.columns.join(", ")})`,
+			contractPath: `${tablePath}.indexes[${schemaIndex.columns.join(",")}]`,
+			code: "extra_index",
+			message: "Extra index found",
+			expected: void 0,
+			actual: schemaIndex,
+			children: []
+		}, issues, nodes);
 	}
 	return nodes;
 }
@@ -416,6 +707,110 @@ function getReferentialActionMismatches(contractFK, schemaFK) {
 function normalizeReferentialAction(action) {
 	return action === "noAction" ? void 0 : action;
 }
+/**
+* Compares two value arrays as unordered sets.
+* Returns true when both sides contain exactly the same values.
+*/
+function valueSetsEqual(a, b) {
+	const aSet = new Set(a);
+	const bSet = new Set(b);
+	if (aSet.size !== bSet.size) return false;
+	return [...aSet].every((v) => bSet.has(v));
+}
+/**
+* Verifies check constraints match between contract-projected checks and
+* introspected live checks.
+*
+* Comparison is value-set-based, not SQL-string-based. Postgres rewrites
+* `col IN ('a','b')` as `col = ANY (ARRAY['a','b'])` in
+* `pg_get_constraintdef`, so comparing the extracted value sets (after
+* the introspection adapter parses the predicate) avoids false mismatches
+* from the `IN`-vs-`= ANY (ARRAY…)` rendering difference.
+*
+* Issues emitted:
+* - `check_missing` — check expected by contract but absent from live DB
+* - `check_removed` — check present in live DB but not in contract
+* - `check_mismatch` — check present on both sides but permitted values differ
+*
+* `check_removed` is emitted only when `strict` is true so non-strict
+* verification (the normal path) does not complain about extra constraints.
+*/
+function verifyCheckConstraints(contractChecks, schemaChecks, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict) {
+	const nodes = [];
+	for (const contractCheck of contractChecks) {
+		const checkPath = `${tablePath}.checks[${contractCheck.name}]`;
+		const liveCheck = schemaChecks.find((c) => c.name === contractCheck.name);
+		if (!liveCheck) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "check_missing",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: contractCheck.name,
+			expected: contractCheck.permittedValues.join(", "),
+			message: `Table "${tableName}" is missing check constraint "${contractCheck.name}" (column "${contractCheck.column}" IN (${contractCheck.permittedValues.join(", ")}))`
+		}, {
+			status: "fail",
+			kind: "checkConstraint",
+			name: `check(${contractCheck.name})`,
+			contractPath: checkPath,
+			code: "check_missing",
+			message: `Check constraint "${contractCheck.name}" missing`,
+			expected: contractCheck,
+			actual: void 0,
+			children: []
+		}, issues, nodes);
+		else if (!valueSetsEqual(contractCheck.permittedValues, liveCheck.permittedValues)) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "check_mismatch",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: contractCheck.name,
+			expected: contractCheck.permittedValues.join(", "),
+			actual: liveCheck.permittedValues.join(", "),
+			message: `Table "${tableName}" check constraint "${contractCheck.name}" has different permitted values: expected [${contractCheck.permittedValues.join(", ")}], got [${liveCheck.permittedValues.join(", ")}]`
+		}, {
+			status: "fail",
+			kind: "checkConstraint",
+			name: `check(${contractCheck.name})`,
+			contractPath: checkPath,
+			code: "check_mismatch",
+			message: `Check constraint "${contractCheck.name}" values mismatch`,
+			expected: contractCheck,
+			actual: liveCheck,
+			children: []
+		}, issues, nodes);
+		else nodes.push({
+			status: "pass",
+			kind: "checkConstraint",
+			name: `check(${contractCheck.name})`,
+			contractPath: checkPath,
+			code: "",
+			message: "",
+			expected: void 0,
+			actual: void 0,
+			children: []
+		});
+	}
+	if (strict) {
+		for (const liveCheck of schemaChecks) if (!contractChecks.find((c) => c.name === liveCheck.name)) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+			kind: "check_removed",
+			table: tableName,
+			namespaceId,
+			indexOrConstraint: liveCheck.name,
+			actual: liveCheck.permittedValues.join(", "),
+			message: `Table "${tableName}" has extra check constraint "${liveCheck.name}" in database (not in contract)`
+		}, {
+			status: "fail",
+			kind: "checkConstraint",
+			name: `check(${liveCheck.name})`,
+			contractPath: `${tablePath}.checks[${liveCheck.name}]`,
+			code: "check_removed",
+			message: `Extra check constraint "${liveCheck.name}" found`,
+			expected: void 0,
+			actual: liveCheck,
+			children: []
+		}, issues, nodes);
+	}
+	return nodes;
+}
 //#endregion
 //#region src/core/schema-verify/verify-sql-schema.ts
 /**
@@ -435,7 +830,7 @@ function verifySqlSchema(options) {
 	const { contractStorageHash, contractProfileHash, contractTarget } = extractContractMetadata(contract);
 	const allStorageTypesMap = { ...contract.storage.types ?? {} };
 	for (const ns of Object.values(contract.storage.namespaces)) {
-		const nsEnums = ns.enum;
+		const nsEnums = blindCast(ns.entries).type;
 		if (nsEnums) for (const [k, v] of Object.entries(nsEnums)) allStorageTypesMap[k] = v;
 	}
 	const { issues, rootChildren } = verifySchemaTables({
@@ -450,53 +845,57 @@ function verifySqlSchema(options) {
 	});
 	validateFrameworkComponentsForExtensions(contract, options.frameworkComponents);
 	const typeNodes = [];
-	const pushTypeNode = (typeName, contractPath, typeIssues) => {
-		if (typeIssues.length > 0) issues.push(...typeIssues);
+	const pushTypeNode = (typeName, contractPath, typeIssues, controlPolicy) => {
+		let status = "pass";
+		let code = "";
+		let emitted = 0;
+		for (const issue of typeIssues) {
+			const disposition = verifierDisposition(controlPolicy, issue.kind);
+			if (disposition === "suppress") continue;
+			issues.push(issue);
+			emitted += 1;
+			if (code === "") code = issue.kind;
+			if (disposition === "fail") status = "fail";
+			else if (disposition === "warn" && status !== "fail") status = "warn";
+		}
 		typeNodes.push({
-			status: typeIssues.length > 0 ? "fail" : "pass",
+			status,
 			kind: "storageType",
 			name: `type ${typeName}`,
 			contractPath,
-			code: typeIssues.length > 0 ? typeIssues[0]?.kind ?? "" : "",
-			message: typeIssues.length > 0 ? `${typeIssues.length} issue${typeIssues.length === 1 ? "" : "s"}` : "",
+			code: status === "pass" ? "" : code,
+			message: emitted > 0 ? `${emitted} issue${emitted === 1 ? "" : "s"}` : "",
 			expected: void 0,
 			actual: void 0,
 			children: []
 		});
 	};
-	for (const [typeName, typeInstance] of Object.entries(contract.storage.types ?? {})) if (isPostgresEnumStorageEntry(typeInstance)) pushTypeNode(typeName, `storage.types.${typeName}`, verifyEnumType({
-		typeName,
-		typeInstance,
-		schema,
-		resolveExistingEnumValues,
-		namespaceId: UNBOUND_NAMESPACE_ID
-	}));
-	else if (isStorageTypeInstance(typeInstance)) {
+	for (const [typeName, typeInstance] of Object.entries(contract.storage.types ?? {})) if (isStorageTypeInstance(typeInstance)) {
 		const hook = codecHooks.get(typeInstance.codecId);
 		pushTypeNode(typeName, `storage.types.${typeName}`, hook?.verifyType ? hook.verifyType({
 			typeName,
 			typeInstance,
 			schema
-		}) : []);
+		}) : [], effectiveControlPolicy(void 0, contract.defaultControlPolicy));
 	}
 	for (const nsId of Object.keys(contract.storage.namespaces)) {
 		const ns = contract.storage.namespaces[nsId];
 		if (!ns) continue;
-		const nsEnums = ns.enum;
+		const nsEnums = ns.entries["type"];
 		if (!nsEnums) continue;
 		for (const [typeName, entry] of Object.entries(nsEnums)) {
 			if (!isPostgresEnumStorageEntry(entry)) continue;
-			pushTypeNode(typeName, `storage.namespaces.${nsId}.enum.${typeName}`, verifyEnumType({
+			pushTypeNode(typeName, `storage.namespaces.${nsId}.entries.type.${typeName}`, verifyEnumType({
 				typeName,
 				typeInstance: entry,
 				schema,
 				resolveExistingEnumValues,
 				namespaceId: nsId
-			}));
+			}), effectiveControlPolicy(entry.control, contract.defaultControlPolicy));
 		}
 	}
 	if (typeNodes.length > 0) {
-		const typesStatus = typeNodes.some((n) => n.status === "fail") ? "fail" : "pass";
+		const typesStatus = typeNodes.some((n) => n.status === "fail") ? "fail" : typeNodes.some((n) => n.status === "warn") ? "warn" : "pass";
 		rootChildren.push({
 			status: typesStatus,
 			kind: "storageTypes",
@@ -581,6 +980,7 @@ function extractContractMetadata(contract) {
 }
 function verifySchemaTables(options) {
 	const { contract, schema, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const contractDefaultControl = contract.defaultControlPolicy;
 	const issues = [];
 	const rootChildren = [];
 	const schemaTables = schema.tables;
@@ -588,19 +988,19 @@ function verifySchemaTables(options) {
 	for (const namespaceId of namespaceIds) {
 		const ns = contract.storage.namespaces[namespaceId];
 		if (!ns) continue;
-		for (const [tableName, contractTableRaw] of Object.entries(ns.tables)) {
-			if (!(contractTableRaw instanceof StorageTable)) throw new Error(`verifySqlSchema: expected StorageTable at storage.namespaces.${namespaceId}.tables.${tableName}`);
+		for (const [tableName, contractTableRaw] of Object.entries(ns.entries.table)) {
+			if (!(contractTableRaw instanceof StorageTable)) throw new Error(`verifySqlSchema: expected StorageTable at storage.namespaces.${namespaceId}.entries.table.${tableName}`);
 			const contractTable = contractTableRaw;
+			const tableControlPolicy = effectiveControlPolicy(contractTable.control, contractDefaultControl);
 			const schemaTable = schemaTables[tableName];
-			const tablePath = `storage.namespaces.${namespaceId}.tables.${tableName}`;
+			const tablePath = `storage.namespaces.${namespaceId}.entries.table.${tableName}`;
 			if (!schemaTable) {
-				issues.push({
+				emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 					kind: "missing_table",
 					table: tableName,
 					namespaceId,
 					message: `Table "${tableName}" is missing from database`
-				});
-				rootChildren.push({
+				}, {
 					status: "fail",
 					kind: "table",
 					name: `table ${tableName}`,
@@ -610,7 +1010,7 @@ function verifySchemaTables(options) {
 					expected: void 0,
 					actual: void 0,
 					children: []
-				});
+				}, issues, rootChildren);
 				continue;
 			}
 			const tableChildren = verifyTableChildren({
@@ -619,11 +1019,13 @@ function verifySchemaTables(options) {
 				tableName,
 				namespaceId,
 				tablePath,
+				tableControlPolicy,
 				issues,
 				strict,
 				typeMetadataRegistry,
 				codecHooks,
 				storageTypes,
+				contractStorage: contract.storage,
 				...ifDefined("normalizeDefault", normalizeDefault),
 				...ifDefined("normalizeNativeType", normalizeNativeType)
 			});
@@ -631,24 +1033,21 @@ function verifySchemaTables(options) {
 		}
 	}
 	if (strict) {
-		for (const tableName of Object.keys(schemaTables)) if (!namespaceIds.some((namespaceId) => contract.storage.namespaces[namespaceId]?.tables[tableName] !== void 0)) {
-			issues.push({
-				kind: "extra_table",
-				table: tableName,
-				message: `Extra table "${tableName}" found in database (not in contract)`
-			});
-			rootChildren.push({
-				status: "fail",
-				kind: "table",
-				name: `table ${tableName}`,
-				contractPath: `storage.namespaces.*.tables.${tableName}`,
-				code: "extra_table",
-				message: `Extra table "${tableName}" found`,
-				expected: void 0,
-				actual: void 0,
-				children: []
-			});
-		}
+		for (const tableName of Object.keys(schemaTables)) if (!namespaceIds.some((namespaceId) => contract.storage.namespaces[namespaceId]?.entries.table[tableName] !== void 0)) emitIssueAndNodeUnderControlPolicy(effectiveControlPolicy(void 0, contractDefaultControl), {
+			kind: "extra_table",
+			table: tableName,
+			message: `Extra table "${tableName}" found in database (not in contract)`
+		}, {
+			status: "fail",
+			kind: "table",
+			name: `table ${tableName}`,
+			contractPath: `storage.namespaces.*.entries.table.${tableName}`,
+			code: "extra_table",
+			message: `Extra table "${tableName}" found`,
+			expected: void 0,
+			actual: void 0,
+			children: []
+		}, issues, rootChildren);
 	}
 	return {
 		issues,
@@ -656,7 +1055,7 @@ function verifySchemaTables(options) {
 	};
 }
 function verifyTableChildren(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType, contractStorage } = options;
 	const tableChildren = [];
 	const columnNodes = collectContractColumnNodes({
 		contractTable,
@@ -664,6 +1063,7 @@ function verifyTableChildren(options) {
 		tableName,
 		namespaceId,
 		tablePath,
+		tableControlPolicy,
 		issues,
 		strict,
 		typeMetadataRegistry,
@@ -679,77 +1079,96 @@ function verifyTableChildren(options) {
 		tableName,
 		namespaceId,
 		tablePath,
+		tableControlPolicy,
 		issues,
 		columnNodes
 	});
-	if (contractTable.primaryKey) if (verifyPrimaryKey(contractTable.primaryKey, schemaTable.primaryKey, tableName, namespaceId, issues) === "fail") tableChildren.push({
-		status: "fail",
-		kind: "primaryKey",
-		name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
-		contractPath: `${tablePath}.primaryKey`,
-		code: "primary_key_mismatch",
-		message: "Primary key mismatch",
-		expected: contractTable.primaryKey,
-		actual: schemaTable.primaryKey,
-		children: []
-	});
-	else tableChildren.push({
-		status: "pass",
-		kind: "primaryKey",
-		name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
-		contractPath: `${tablePath}.primaryKey`,
-		code: "",
-		message: "",
-		expected: void 0,
-		actual: void 0,
-		children: []
-	});
-	else if (schemaTable.primaryKey && strict) {
-		issues.push({
-			kind: "extra_primary_key",
-			table: tableName,
-			namespaceId,
-			message: "Extra primary key found in database (not in contract)"
-		});
-		tableChildren.push({
+	if (contractTable.primaryKey) {
+		const pkStatus = verifyPrimaryKey(contractTable.primaryKey, schemaTable.primaryKey, tableName, namespaceId, tableControlPolicy, issues);
+		if (pkStatus === "fail") tableChildren.push({
 			status: "fail",
 			kind: "primaryKey",
-			name: `primary key: ${schemaTable.primaryKey.columns.join(", ")}`,
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
 			contractPath: `${tablePath}.primaryKey`,
-			code: "extra_primary_key",
-			message: "Extra primary key found",
-			expected: void 0,
+			code: "primary_key_mismatch",
+			message: "Primary key mismatch",
+			expected: contractTable.primaryKey,
 			actual: schemaTable.primaryKey,
 			children: []
 		});
-	}
+		else if (pkStatus === "warn") tableChildren.push({
+			status: "warn",
+			kind: "primaryKey",
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
+			contractPath: `${tablePath}.primaryKey`,
+			code: "primary_key_mismatch",
+			message: "Primary key mismatch",
+			expected: contractTable.primaryKey,
+			actual: schemaTable.primaryKey,
+			children: []
+		});
+		else tableChildren.push({
+			status: "pass",
+			kind: "primaryKey",
+			name: `primary key: ${contractTable.primaryKey.columns.join(", ")}`,
+			contractPath: `${tablePath}.primaryKey`,
+			code: "",
+			message: "",
+			expected: void 0,
+			actual: void 0,
+			children: []
+		});
+	} else if (schemaTable.primaryKey && strict) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+		kind: "extra_primary_key",
+		table: tableName,
+		namespaceId,
+		message: "Extra primary key found in database (not in contract)"
+	}, {
+		status: "fail",
+		kind: "primaryKey",
+		name: `primary key: ${schemaTable.primaryKey.columns.join(", ")}`,
+		contractPath: `${tablePath}.primaryKey`,
+		code: "extra_primary_key",
+		message: "Extra primary key found",
+		expected: void 0,
+		actual: schemaTable.primaryKey,
+		children: []
+	}, issues, tableChildren);
 	const constraintFks = contractTable.foreignKeys.filter((fk) => fk.constraint === true);
 	if (constraintFks.length > 0 || strict) {
-		const fkStatuses = verifyForeignKeys(constraintFks, schemaTable.foreignKeys, tableName, namespaceId, tablePath, issues, strict);
+		const fkStatuses = verifyForeignKeys(constraintFks, schemaTable.foreignKeys, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 		tableChildren.push(...fkStatuses);
 	}
-	const uniqueStatuses = verifyUniqueConstraints(contractTable.uniques, schemaTable.uniques, schemaTable.indexes, tableName, namespaceId, tablePath, issues, strict);
+	const uniqueStatuses = verifyUniqueConstraints(contractTable.uniques, schemaTable.uniques, schemaTable.indexes, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 	tableChildren.push(...uniqueStatuses);
 	const fkBackingIndexes = contractTable.foreignKeys.filter((fk) => fk.index === true && !contractTable.indexes.some((idx) => arraysEqual(idx.columns, fk.source.columns))).map((fk) => ({ columns: fk.source.columns }));
-	const indexStatuses = verifyIndexes([...contractTable.indexes, ...fkBackingIndexes], schemaTable.indexes, schemaTable.uniques, tableName, namespaceId, tablePath, issues, strict);
+	const indexStatuses = verifyIndexes([...contractTable.indexes, ...fkBackingIndexes], schemaTable.indexes, schemaTable.uniques, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
 	tableChildren.push(...indexStatuses);
+	const contractCheckIRs = (contractTable.checks ?? []).map((c) => ({
+		name: c.name,
+		column: c.column,
+		permittedValues: resolveValueSetValues(c.valueSet, contractStorage, `check "${c.name}"`)
+	}));
+	if (strict || contractCheckIRs.length > 0) {
+		const checkStatuses = verifyCheckConstraints(contractCheckIRs, schemaTable.checks ?? [], tableName, namespaceId, tablePath, tableControlPolicy, issues, strict);
+		tableChildren.push(...checkStatuses);
+	}
 	return tableChildren;
 }
 function collectContractColumnNodes(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, strict, typeMetadataRegistry, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
 	const columnNodes = [];
 	for (const [columnName, contractColumn] of Object.entries(contractTable.columns)) {
 		const schemaColumn = schemaTable.columns[columnName];
 		const columnPath = `${tablePath}.columns.${columnName}`;
 		if (!schemaColumn) {
-			issues.push({
+			emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
 				kind: "missing_column",
 				table: tableName,
 				namespaceId,
 				column: columnName,
 				message: `Column "${tableName}"."${columnName}" is missing from database`
-			});
-			columnNodes.push({
+			}, {
 				status: "fail",
 				kind: "column",
 				name: `${columnName}: missing`,
@@ -759,7 +1178,7 @@ function collectContractColumnNodes(options) {
 				expected: void 0,
 				actual: void 0,
 				children: []
-			});
+			}, issues, columnNodes);
 			continue;
 		}
 		columnNodes.push(verifyColumn({
@@ -769,6 +1188,7 @@ function collectContractColumnNodes(options) {
 			contractColumn,
 			schemaColumn,
 			columnPath,
+			tableControlPolicy,
 			issues,
 			strict,
 			typeMetadataRegistry,
@@ -781,30 +1201,27 @@ function collectContractColumnNodes(options) {
 	return columnNodes;
 }
 function appendExtraColumnNodes(options) {
-	const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, columnNodes } = options;
-	for (const [columnName, { nativeType }] of Object.entries(schemaTable.columns)) if (!contractTable.columns[columnName]) {
-		issues.push({
-			kind: "extra_column",
-			table: tableName,
-			namespaceId,
-			column: columnName,
-			message: `Extra column "${tableName}"."${columnName}" found in database (not in contract)`
-		});
-		columnNodes.push({
-			status: "fail",
-			kind: "column",
-			name: `${columnName}: extra`,
-			contractPath: `${tablePath}.columns.${columnName}`,
-			code: "extra_column",
-			message: `Extra column "${columnName}" found`,
-			expected: void 0,
-			actual: nativeType,
-			children: []
-		});
-	}
+	const { contractTable, schemaTable, tableName, namespaceId, tablePath, tableControlPolicy, issues, columnNodes } = options;
+	for (const [columnName, { nativeType }] of Object.entries(schemaTable.columns)) if (!contractTable.columns[columnName]) emitIssueAndNodeUnderControlPolicy(tableControlPolicy, {
+		kind: "extra_column",
+		table: tableName,
+		namespaceId,
+		column: columnName,
+		message: `Extra column "${tableName}"."${columnName}" found in database (not in contract)`
+	}, {
+		status: "fail",
+		kind: "column",
+		name: `${columnName}: extra`,
+		contractPath: `${tablePath}.columns.${columnName}`,
+		code: "extra_column",
+		message: `Extra column "${columnName}" found`,
+		expected: void 0,
+		actual: nativeType,
+		children: []
+	}, issues, columnNodes);
 }
 function verifyColumn(options) {
-	const { tableName, namespaceId, columnName, contractColumn, schemaColumn, columnPath, issues, strict, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
+	const { tableName, namespaceId, columnName, contractColumn, schemaColumn, columnPath, tableControlPolicy, issues, strict, codecHooks, storageTypes, normalizeDefault, normalizeNativeType } = options;
 	const columnChildren = [];
 	let columnStatus = "pass";
 	const resolvedContractColumn = resolveContractColumnTypeMetadata(contractColumn, storageTypes, {
@@ -816,8 +1233,8 @@ function verifyColumn(options) {
 		columnName
 	});
 	const schemaNativeType = normalizeNativeType?.(schemaColumn.nativeType) ?? schemaColumn.nativeType;
-	if (contractNativeType !== schemaNativeType) {
-		issues.push({
+	if (!(contractNativeType === schemaNativeType)) {
+		const issue = {
 			kind: "type_mismatch",
 			table: tableName,
 			namespaceId,
@@ -825,19 +1242,23 @@ function verifyColumn(options) {
 			expected: contractNativeType,
 			actual: schemaNativeType,
 			message: `Column "${tableName}"."${columnName}" has type mismatch: expected "${contractNativeType}", got "${schemaNativeType}"`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "type",
-			name: "type",
-			contractPath: `${columnPath}.nativeType`,
-			code: "type_mismatch",
-			message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
-			expected: contractNativeType,
-			actual: schemaNativeType,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "type",
+				name: "type",
+				contractPath: `${columnPath}.nativeType`,
+				code: "type_mismatch",
+				message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
+				expected: contractNativeType,
+				actual: schemaNativeType,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	if (resolvedContractColumn.codecId) {
 		const typeMetadata = options.typeMetadataRegistry.get(resolvedContractColumn.codecId);
@@ -865,7 +1286,7 @@ function verifyColumn(options) {
 		});
 	}
 	if (contractColumn.nullable !== schemaColumn.nullable) {
-		issues.push({
+		const issue = {
 			kind: "nullability_mismatch",
 			table: tableName,
 			namespaceId,
@@ -873,47 +1294,55 @@ function verifyColumn(options) {
 			expected: String(contractColumn.nullable),
 			actual: String(schemaColumn.nullable),
 			message: `Column "${tableName}"."${columnName}" has nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "nullability",
-			name: "nullability",
-			contractPath: `${columnPath}.nullable`,
-			code: "nullability_mismatch",
-			message: `Nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`,
-			expected: contractColumn.nullable,
-			actual: schemaColumn.nullable,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "nullability",
+				name: "nullability",
+				contractPath: `${columnPath}.nullable`,
+				code: "nullability_mismatch",
+				message: `Nullability mismatch: expected ${contractColumn.nullable ? "nullable" : "not null"}, got ${schemaColumn.nullable ? "nullable" : "not null"}`,
+				expected: contractColumn.nullable,
+				actual: schemaColumn.nullable,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	if (contractColumn.default) {
 		if (!schemaColumn.default) {
 			const defaultDescription = describeColumnDefault(contractColumn.default);
-			issues.push({
+			const issue = {
 				kind: "default_missing",
 				table: tableName,
 				namespaceId,
 				column: columnName,
 				expected: defaultDescription,
 				message: `Column "${tableName}"."${columnName}" should have default ${defaultDescription} but database has no default`
-			});
-			columnChildren.push({
-				status: "fail",
-				kind: "default",
-				name: "default",
-				contractPath: `${columnPath}.default`,
-				code: "default_missing",
-				message: `Default missing: expected ${defaultDescription}`,
-				expected: defaultDescription,
-				actual: void 0,
-				children: []
-			});
-			columnStatus = "fail";
+			};
+			const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+			if (disposition !== "suppress") {
+				issues.push(issue);
+				columnChildren.push({
+					status: disposition,
+					kind: "default",
+					name: "default",
+					contractPath: `${columnPath}.default`,
+					code: "default_missing",
+					message: `Default missing: expected ${defaultDescription}`,
+					expected: defaultDescription,
+					actual: void 0,
+					children: []
+				});
+				columnStatus = disposition;
+			}
 		} else if (!columnDefaultsEqual(contractColumn.default, schemaColumn.default, normalizeDefault, schemaNativeType)) {
 			const expectedDescription = describeColumnDefault(contractColumn.default);
 			const actualDescription = schemaColumn.default;
-			issues.push({
+			const issue = {
 				kind: "default_mismatch",
 				table: tableName,
 				namespaceId,
@@ -921,41 +1350,49 @@ function verifyColumn(options) {
 				expected: expectedDescription,
 				actual: actualDescription,
 				message: `Column "${tableName}"."${columnName}" has default mismatch: expected ${expectedDescription}, got ${actualDescription}`
-			});
-			columnChildren.push({
-				status: "fail",
-				kind: "default",
-				name: "default",
-				contractPath: `${columnPath}.default`,
-				code: "default_mismatch",
-				message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
-				expected: expectedDescription,
-				actual: actualDescription,
-				children: []
-			});
-			columnStatus = "fail";
+			};
+			const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+			if (disposition !== "suppress") {
+				issues.push(issue);
+				columnChildren.push({
+					status: disposition,
+					kind: "default",
+					name: "default",
+					contractPath: `${columnPath}.default`,
+					code: "default_mismatch",
+					message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
+					expected: expectedDescription,
+					actual: actualDescription,
+					children: []
+				});
+				columnStatus = disposition;
+			}
 		}
 	} else if (strict && schemaColumn.default) {
-		issues.push({
+		const issue = {
 			kind: "extra_default",
 			table: tableName,
 			namespaceId,
 			column: columnName,
 			actual: schemaColumn.default,
 			message: `Column "${tableName}"."${columnName}" has default ${schemaColumn.default} in database but contract specifies no default`
-		});
-		columnChildren.push({
-			status: "fail",
-			kind: "default",
-			name: "default",
-			contractPath: `${columnPath}.default`,
-			code: "extra_default",
-			message: `Extra default: ${schemaColumn.default}`,
-			expected: void 0,
-			actual: schemaColumn.default,
-			children: []
-		});
-		columnStatus = "fail";
+		};
+		const disposition = verifierDisposition(tableControlPolicy, issue.kind);
+		if (disposition !== "suppress") {
+			issues.push(issue);
+			columnChildren.push({
+				status: disposition,
+				kind: "default",
+				name: "default",
+				contractPath: `${columnPath}.default`,
+				code: "extra_default",
+				message: `Extra default: ${schemaColumn.default}`,
+				expected: void 0,
+				actual: schemaColumn.default,
+				children: []
+			});
+			columnStatus = disposition;
+		}
 	}
 	const aggregated = aggregateChildState(columnChildren, columnStatus);
 	const nullableText = contractColumn.nullable ? "nullable" : "not nullable";
@@ -1152,6 +1589,6 @@ function formatLiteralValue(value) {
 	return JSON.stringify(value);
 }
 //#endregion
-export { extractCodecControlHooks as a, isUniqueConstraintSatisfied as i, arraysEqual as n, isIndexSatisfied as r, verifySqlSchema as t };
+export { contractToSchemaIR as a, extractCodecControlHooks as c, isUniqueConstraintSatisfied as i, arraysEqual as n, detectDestructiveChanges as o, isIndexSatisfied as r, resolveValueSetValues as s, verifySqlSchema as t };
 
-//# sourceMappingURL=verify-sql-schema-CYLsGCFO.mjs.map
+//# sourceMappingURL=verify-sql-schema-DlAgBiT_.mjs.map