@prisma-next/migration-tools 0.5.0-dev.7 → 0.5.0-dev.70

package/dist/read-contract-space-contract-C3-1eyaI.mjs

@@ -0,0 +1,298 @@
+import { _ as errorInvalidSpaceId, p as errorInvalidRefFile, u as errorInvalidJson, y as errorMissingFile } from "./errors-EPL_9p9f.mjs";
+import { t as MANIFEST_FILE } from "./io-D13dLvUh.mjs";
+import { join } from "pathe";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { APP_SPACE_ID } from "@prisma-next/framework-components/control";
+//#region src/space-layout.ts
+/**
+* Pattern a contract-space identifier must match. The constraint is
+* filesystem-friendly: lowercase letters / digits / hyphen / underscore,
+* starts with a letter, max 64 characters.
+*/
+const SPACE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+function isValidSpaceId(spaceId) {
+	return SPACE_ID_PATTERN.test(spaceId);
+}
+function assertValidSpaceId(spaceId) {
+	if (!isValidSpaceId(spaceId)) throw errorInvalidSpaceId(spaceId);
+}
+/**
+* Resolve the migrations subdirectory for a given contract space.
+*
+* Every contract space — including the app space (default `'app'`) —
+* lands under `<projectMigrationsDir>/<spaceId>/`. The space id is
+* validated against {@link SPACE_ID_PATTERN} because it becomes a
+* filesystem directory name verbatim.
+*
+* `projectMigrationsDir` is the project's top-level `migrations/`
+* directory; the helper does not assume anything about its absolute /
+* relative shape and is symmetric with `pathe.join`.
+*/
+function spaceMigrationDirectory(projectMigrationsDir, spaceId) {
+	assertValidSpaceId(spaceId);
+	return join(projectMigrationsDir, spaceId);
+}
+//#endregion
+//#region src/read-contract-space-head-ref.ts
+function hasErrnoCode$2(error, code) {
+	return error instanceof Error && error.code === code;
+}
+/**
+* Read the head ref (`hash` + `invariants`) for a contract space from
+* `<projectMigrationsDir>/<spaceId>/refs/head.json`.
+*
+* Returns `null` when the file does not exist (first emit). Surfaces
+* `MIGRATION.INVALID_JSON` / `MIGRATION.INVALID_REF_FILE` on a corrupt
+* `refs/head.json` so callers can distinguish "no head ref on disk"
+* (returns `null`) from "head ref present but unreadable" (throws).
+*
+* Validates the space id against `[a-z][a-z0-9_-]{0,63}` for the same
+* filesystem-safety reasons as the rest of the per-space helpers. The
+* helper is uniform across the app and extension spaces.
+*/
+async function readContractSpaceHeadRef(projectMigrationsDir, spaceId) {
+	assertValidSpaceId(spaceId);
+	const filePath = join(projectMigrationsDir, spaceId, "refs", "head.json");
+	let raw;
+	try {
+		raw = await readFile(filePath, "utf-8");
+	} catch (error) {
+		if (hasErrnoCode$2(error, "ENOENT")) return null;
+		throw error;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (e) {
+		throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));
+	}
+	if (typeof parsed !== "object" || parsed === null) throw errorInvalidRefFile(filePath, "expected an object");
+	const obj = parsed;
+	if (typeof obj.hash !== "string") throw errorInvalidRefFile(filePath, "expected an object with a string `hash` field");
+	if (!Array.isArray(obj.invariants) || obj.invariants.some((value) => typeof value !== "string")) throw errorInvalidRefFile(filePath, "expected an object with an `invariants` array of strings");
+	return {
+		hash: obj.hash,
+		invariants: obj.invariants
+	};
+}
+//#endregion
+//#region src/detect-space-contract-drift.ts
+/**
+* Pure drift-detection primitive for a single contract space.
+*
+* Runs once per loaded extension space, just before computing the
+* `priorContract` that feeds {@link import('./plan-all-spaces').planAllSpaces}.
+* Hash equality is byte-for-byte (no normalisation) — both sides are
+* already canonical hashes produced by the same pipeline, so any
+* difference is meaningful drift.
+*
+* Synchronous, pure, no I/O. The caller (SQL family) reads the on-disk
+* `contract.json` and computes its hash, then invokes this helper
+* alongside the descriptor's `headRef.hash`. Composes naturally with
+* {@link import('./read-contract-space-head-ref').readContractSpaceHeadRef}
+* which provides the read-side primitive.
+*
+* The drift warning surfaces the extension name and the diff direction.
+*/
+function detectSpaceContractDrift(spaceId, inputs) {
+	if (inputs.priorHeadHash === null) return {
+		kind: "firstEmit",
+		spaceId,
+		descriptorHash: inputs.descriptorHash,
+		priorHeadHash: null
+	};
+	if (inputs.descriptorHash === inputs.priorHeadHash) return {
+		kind: "noDrift",
+		spaceId,
+		descriptorHash: inputs.descriptorHash,
+		priorHeadHash: inputs.priorHeadHash
+	};
+	return {
+		kind: "drift",
+		spaceId,
+		descriptorHash: inputs.descriptorHash,
+		priorHeadHash: inputs.priorHeadHash
+	};
+}
+//#endregion
+//#region src/verify-contract-spaces.ts
+function hasErrnoCode$1(error, code) {
+	return error instanceof Error && error.code === code;
+}
+/**
+* List the per-space subdirectories under
+* `<projectRoot>/migrations/`. Returns space-id directory names (sorted
+* alphabetically) — i.e. any non-dot-prefixed subdirectory whose root
+* does **not** contain a `migration.json` manifest. The manifest is the
+* structural marker of a user-authored migration directory (see
+* `readMigrationsDir` in `./io`); directory names themselves belong to
+* the user and are not part of the contract.
+*
+* Returns `[]` if the migrations directory does not exist (greenfield
+* project).
+*
+* Reads only the user's repo. **No descriptor import.** The caller
+* (verifier) feeds the result into {@link verifyContractSpaces} alongside
+* the loaded-space set and the marker rows.
+*/
+async function listContractSpaceDirectories(projectMigrationsDir) {
+	let entries;
+	try {
+		entries = (await readdir(projectMigrationsDir, { withFileTypes: true })).map((d) => ({
+			name: d.name,
+			isDirectory: d.isDirectory()
+		}));
+	} catch (error) {
+		if (hasErrnoCode$1(error, "ENOENT")) return [];
+		throw error;
+	}
+	const namedCandidates = entries.filter((e) => e.isDirectory).map((e) => e.name).filter((name) => !name.startsWith(".")).sort();
+	return (await Promise.all(namedCandidates.map(async (name) => {
+		try {
+			await stat(join(projectMigrationsDir, name, MANIFEST_FILE));
+			return {
+				name,
+				isMigrationDir: true
+			};
+		} catch (error) {
+			if (hasErrnoCode$1(error, "ENOENT")) return {
+				name,
+				isMigrationDir: false
+			};
+			throw error;
+		}
+	}))).filter((c) => !c.isMigrationDir).map((c) => c.name);
+}
+/**
+* Pure structural verifier for the per-space mechanism. Aggregates the
+* three orphan / missing checks plus per-space hash and invariant
+* comparison.
+*
+* Algorithm:
+*
+* - For every extension space declared in `loadedSpaces` (`'app'`
+*   excluded — the per-space verifier is scoped to extension members;
+*   the app is verified through the aggregate path):
+*   - If no contract-space dir on disk → `declaredButUnmigrated`.
+*   - Else if `markerRowsBySpace` lacks an entry → no violation here;
+*     the live-DB compare done outside this helper is where the
+*     absence shows up.
+*   - Else compare marker hash / invariants vs. on-disk head hash /
+*     invariants → `hashMismatch` / `invariantsMismatch` on drift.
+* - For every contract-space dir on disk that is not in `loadedSpaces` →
+*   `orphanSpaceDir`.
+* - For every marker row whose `space` is not in `loadedSpaces` →
+*   `orphanMarker`. The app-space marker is always loaded (`'app'` is
+*   in `loadedSpaces` by definition).
+*
+* Output is deterministic: violations are sorted first by `kind`
+* (`declaredButUnmigrated` → `orphanMarker` → `orphanSpaceDir` →
+* `hashMismatch` → `invariantsMismatch`) then by `spaceId`. Two callers
+* passing equivalent inputs see byte-identical violation lists.
+*
+* Synchronous, pure, no I/O. **Does not import the extension descriptor**
+* (the inputs are pre-resolved by the caller); the verifier reads only
+* the user repo, not `node_modules`.
+*/
+function verifyContractSpaces(inputs) {
+	const violations = [];
+	for (const spaceId of [...inputs.loadedSpaces].sort()) {
+		if (spaceId === APP_SPACE_ID) continue;
+		if (!inputs.spaceDirsOnDisk.includes(spaceId)) {
+			violations.push({
+				kind: "declaredButUnmigrated",
+				spaceId,
+				remediation: `Extension '${spaceId}' is declared in extensionPacks but has not been emitted; run \`prisma-next migrate\`.`
+			});
+			continue;
+		}
+		const head = inputs.headRefsBySpace.get(spaceId);
+		const marker = inputs.markerRowsBySpace.get(spaceId);
+		if (!head || !marker) continue;
+		if (head.hash !== marker.hash) {
+			violations.push({
+				kind: "hashMismatch",
+				spaceId,
+				priorHeadHash: head.hash,
+				markerHash: marker.hash,
+				remediation: `Marker row for space '${spaceId}' is keyed at ${marker.hash}, but the on-disk ${join("migrations", spaceId, "contract.json")} resolves to ${head.hash}. Run \`prisma-next db update\` to advance the database, or \`prisma-next migrate\` if the descriptor was bumped without re-emitting.`
+			});
+			continue;
+		}
+		const onDiskInvariants = [...head.invariants].sort();
+		const markerInvariants = new Set(marker.invariants);
+		const missing = onDiskInvariants.filter((id) => !markerInvariants.has(id));
+		if (missing.length > 0) violations.push({
+			kind: "invariantsMismatch",
+			spaceId,
+			onDiskInvariants,
+			markerInvariants: [...marker.invariants].sort(),
+			remediation: `Marker row for space '${spaceId}' is missing invariants [${missing.map((s) => JSON.stringify(s)).join(", ")}]. Run \`prisma-next db update\` to apply the corresponding data-transform migrations.`
+		});
+	}
+	for (const dir of [...inputs.spaceDirsOnDisk].sort()) if (!inputs.loadedSpaces.has(dir)) violations.push({
+		kind: "orphanSpaceDir",
+		spaceId: dir,
+		remediation: `Orphan contract-space directory \`${join("migrations", dir)}/\` for an extension not in extensionPacks; remove the directory or re-add the extension.`
+	});
+	for (const space of [...inputs.markerRowsBySpace.keys()].sort()) if (!inputs.loadedSpaces.has(space)) violations.push({
+		kind: "orphanMarker",
+		spaceId: space,
+		remediation: `Orphan marker row for space '${space}' (no longer in extensionPacks); remediation: manually delete the row from \`prisma_contract.marker\`.`
+	});
+	if (violations.length === 0) return { ok: true };
+	const kindOrder = {
+		declaredButUnmigrated: 0,
+		orphanMarker: 1,
+		orphanSpaceDir: 2,
+		hashMismatch: 3,
+		invariantsMismatch: 4
+	};
+	violations.sort((a, b) => {
+		const k = kindOrder[a.kind] - kindOrder[b.kind];
+		if (k !== 0) return k;
+		if (a.spaceId < b.spaceId) return -1;
+		if (a.spaceId > b.spaceId) return 1;
+		return 0;
+	});
+	return {
+		ok: false,
+		violations
+	};
+}
+//#endregion
+//#region src/read-contract-space-contract.ts
+function hasErrnoCode(error, code) {
+	return error instanceof Error && error.code === code;
+}
+/**
+* Read the on-disk contract value for a contract space
+* (`<projectMigrationsDir>/<spaceId>/contract.json`). Returns the parsed
+* JSON value as `unknown` — callers that need a typed contract validate
+* via their family's `validateContract` to surface schema issues.
+*
+* Companion to {@link import('./read-contract-space-head-ref').readContractSpaceHeadRef}
+* — same ENOENT-throws / corrupt-file-error semantics. Returns the
+* canonical-JSON value the framework wrote during emit, so re-running
+* this helper across machines / runs yields a byte-identical value.
+*/
+async function readContractSpaceContract(projectMigrationsDir, spaceId) {
+	assertValidSpaceId(spaceId);
+	const filePath = join(projectMigrationsDir, spaceId, "contract.json");
+	let raw;
+	try {
+		raw = await readFile(filePath, "utf-8");
+	} catch (error) {
+		if (hasErrnoCode(error, "ENOENT")) throw errorMissingFile("contract.json", join(projectMigrationsDir, spaceId));
+		throw error;
+	}
+	try {
+		return JSON.parse(raw);
+	} catch (e) {
+		throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));
+	}
+}
+//#endregion
+export { readContractSpaceHeadRef as a, isValidSpaceId as c, detectSpaceContractDrift as i, spaceMigrationDirectory as l, listContractSpaceDirectories as n, APP_SPACE_ID as o, verifyContractSpaces as r, assertValidSpaceId as s, readContractSpaceContract as t };
+
+//# sourceMappingURL=read-contract-space-contract-C3-1eyaI.mjs.map

package/dist/read-contract-space-contract-C3-1eyaI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-contract-space-contract-C3-1eyaI.mjs","names":["hasErrnoCode","hasErrnoCode"],"sources":["../src/space-layout.ts","../src/read-contract-space-head-ref.ts","../src/detect-space-contract-drift.ts","../src/verify-contract-spaces.ts","../src/read-contract-space-contract.ts"],"sourcesContent":["import { APP_SPACE_ID } from '@prisma-next/framework-components/control';\nimport { join } from 'pathe';\nimport { errorInvalidSpaceId } from './errors';\n\nexport { APP_SPACE_ID };\n\n/**\n * Branded string carrying a compile-time guarantee that the value has\n * been validated by {@link assertValidSpaceId}. Downstream filesystem\n * helpers (e.g. {@link spaceMigrationDirectory}) accept this type to\n * make \"validated\" tracking visible at the type level rather than\n * relying purely on a runtime check.\n */\nexport type ValidSpaceId = string & { readonly __brand: 'ValidSpaceId' };\n\n/**\n * Pattern a contract-space identifier must match. The constraint is\n * filesystem-friendly: lowercase letters / digits / hyphen / underscore,\n * starts with a letter, max 64 characters.\n */\nconst SPACE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\n\nexport function isValidSpaceId(spaceId: string): spaceId is ValidSpaceId {\n  return SPACE_ID_PATTERN.test(spaceId);\n}\n\nexport function assertValidSpaceId(spaceId: string): asserts spaceId is ValidSpaceId {\n  if (!isValidSpaceId(spaceId)) {\n    throw errorInvalidSpaceId(spaceId);\n  }\n}\n\n/**\n * Resolve the migrations subdirectory for a given contract space.\n *\n * Every contract space — including the app space (default `'app'`) —\n * lands under `<projectMigrationsDir>/<spaceId>/`. The space id is\n * validated against {@link SPACE_ID_PATTERN} because it becomes a\n * filesystem directory name verbatim.\n *\n * `projectMigrationsDir` is the project's top-level `migrations/`\n * directory; the helper does not assume anything about its absolute /\n * relative shape and is symmetric with `pathe.join`.\n */\nexport function spaceMigrationDirectory(projectMigrationsDir: string, spaceId: string): string {\n  assertValidSpaceId(spaceId);\n  return join(projectMigrationsDir, spaceId);\n}\n","import { readFile } from 'node:fs/promises';\nimport type { ContractSpaceHeadRef } from '@prisma-next/framework-components/control';\nimport { join } from 'pathe';\nimport { errorInvalidJson, errorInvalidRefFile } from './errors';\nimport { assertValidSpaceId } from './space-layout';\n\nexport type { ContractSpaceHeadRef };\n\nfunction hasErrnoCode(error: unknown, code: string): boolean {\n  return error instanceof Error && (error as { code?: string }).code === code;\n}\n\n/**\n * Read the head ref (`hash` + `invariants`) for a contract space from\n * `<projectMigrationsDir>/<spaceId>/refs/head.json`.\n *\n * Returns `null` when the file does not exist (first emit). Surfaces\n * `MIGRATION.INVALID_JSON` / `MIGRATION.INVALID_REF_FILE` on a corrupt\n * `refs/head.json` so callers can distinguish \"no head ref on disk\"\n * (returns `null`) from \"head ref present but unreadable\" (throws).\n *\n * Validates the space id against `[a-z][a-z0-9_-]{0,63}` for the same\n * filesystem-safety reasons as the rest of the per-space helpers. The\n * helper is uniform across the app and extension spaces.\n */\nexport async function readContractSpaceHeadRef(\n  projectMigrationsDir: string,\n  spaceId: string,\n): Promise<ContractSpaceHeadRef | null> {\n  assertValidSpaceId(spaceId);\n\n  const filePath = join(projectMigrationsDir, spaceId, 'refs', 'head.json');\n\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (error) {\n    if (hasErrnoCode(error, 'ENOENT')) {\n      return null;\n    }\n    throw error;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (e) {\n    throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw errorInvalidRefFile(filePath, 'expected an object');\n  }\n  const obj = parsed as { hash?: unknown; invariants?: unknown };\n  if (typeof obj.hash !== 'string') {\n    throw errorInvalidRefFile(filePath, 'expected an object with a string `hash` field');\n  }\n  if (!Array.isArray(obj.invariants) || obj.invariants.some((value) => typeof value !== 'string')) {\n    throw errorInvalidRefFile(filePath, 'expected an object with an `invariants` array of strings');\n  }\n\n  return { hash: obj.hash, invariants: obj.invariants as readonly string[] };\n}\n","/**\n * Inputs for {@link detectSpaceContractDrift}.\n *\n * Both hashes are produced by the caller (the SQL-family wiring at the\n * consumption site) using the canonical contract hashing pipeline.\n * Keeping the helper pure lets `migration-tools` stay framework-neutral\n * — the SQL family already speaks `Contract<SqlStorage>`, the Mongo\n * family speaks its own contract type, and both reduce to a hash string\n * before drift detection runs.\n *\n * `priorHeadHash` is `null` when no `contract.json` exists yet on disk for\n * the space (the descriptor declares an extension that has never been\n * emitted into the user's repo). That's the \"first emit\" case — no\n * drift to surface; the migrate emit will create the on-disk artefacts.\n */\nexport interface DetectSpaceContractDriftInputs {\n  readonly descriptorHash: string;\n  readonly priorHeadHash: string | null;\n}\n\n/**\n * Result discriminant for {@link detectSpaceContractDrift}.\n *\n * - `noDrift`: descriptor hash and on-disk head hash agree byte-for-byte.\n *   The migrate emit can proceed with no warning.\n * - `firstEmit`: no on-disk `contract.json` on disk yet. The extension\n *   was just added to `extensionPacks`; this run will create the\n *   on-disk artefacts. No warning either — the user's intent is to install\n *   the extension, not to \"drift\" from a state they haven't recorded.\n * - `drift`: descriptor hash differs from on-disk head hash. The caller\n *   surfaces a non-fatal warning naming the extension and the\n *   diff direction (descriptor → on-disk head). The migrate emit proceeds\n *   normally so the bump is materialised this run; the warning just\n *   confirms the bump is being captured.\n *\n * `spaceId`, `descriptorHash`, and `priorHeadHash` are threaded through\n * verbatim so the caller (logger / TerminalUI / strict-mode envelope)\n * has everything it needs to format the warning message without\n * re-reading the descriptor or the on-disk artefact.\n */\nexport type SpaceContractDriftResult = {\n  readonly kind: 'noDrift' | 'firstEmit' | 'drift';\n  readonly spaceId: string;\n  readonly descriptorHash: string;\n  readonly priorHeadHash: string | null;\n};\n\n/**\n * Pure drift-detection primitive for a single contract space.\n *\n * Runs once per loaded extension space, just before computing the\n * `priorContract` that feeds {@link import('./plan-all-spaces').planAllSpaces}.\n * Hash equality is byte-for-byte (no normalisation) — both sides are\n * already canonical hashes produced by the same pipeline, so any\n * difference is meaningful drift.\n *\n * Synchronous, pure, no I/O. The caller (SQL family) reads the on-disk\n * `contract.json` and computes its hash, then invokes this helper\n * alongside the descriptor's `headRef.hash`. Composes naturally with\n * {@link import('./read-contract-space-head-ref').readContractSpaceHeadRef}\n * which provides the read-side primitive.\n *\n * The drift warning surfaces the extension name and the diff direction.\n */\nexport function detectSpaceContractDrift(\n  spaceId: string,\n  inputs: DetectSpaceContractDriftInputs,\n): SpaceContractDriftResult {\n  if (inputs.priorHeadHash === null) {\n    return {\n      kind: 'firstEmit',\n      spaceId,\n      descriptorHash: inputs.descriptorHash,\n      priorHeadHash: null,\n    };\n  }\n  if (inputs.descriptorHash === inputs.priorHeadHash) {\n    return {\n      kind: 'noDrift',\n      spaceId,\n      descriptorHash: inputs.descriptorHash,\n      priorHeadHash: inputs.priorHeadHash,\n    };\n  }\n  return {\n    kind: 'drift',\n    spaceId,\n    descriptorHash: inputs.descriptorHash,\n    priorHeadHash: inputs.priorHeadHash,\n  };\n}\n","import { readdir, stat } from 'node:fs/promises';\nimport { join } from 'pathe';\nimport { MANIFEST_FILE } from './io';\nimport { APP_SPACE_ID } from './space-layout';\n\nfunction hasErrnoCode(error: unknown, code: string): boolean {\n  return error instanceof Error && (error as { code?: string }).code === code;\n}\n\n/**\n * List the per-space subdirectories under\n * `<projectRoot>/migrations/`. Returns space-id directory names (sorted\n * alphabetically) — i.e. any non-dot-prefixed subdirectory whose root\n * does **not** contain a `migration.json` manifest. The manifest is the\n * structural marker of a user-authored migration directory (see\n * `readMigrationsDir` in `./io`); directory names themselves belong to\n * the user and are not part of the contract.\n *\n * Returns `[]` if the migrations directory does not exist (greenfield\n * project).\n *\n * Reads only the user's repo. **No descriptor import.** The caller\n * (verifier) feeds the result into {@link verifyContractSpaces} alongside\n * the loaded-space set and the marker rows.\n */\nexport async function listContractSpaceDirectories(\n  projectMigrationsDir: string,\n): Promise<readonly string[]> {\n  let entries: { readonly name: string; readonly isDirectory: boolean }[];\n  try {\n    const dirents = await readdir(projectMigrationsDir, { withFileTypes: true });\n    entries = dirents.map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));\n  } catch (error) {\n    if (hasErrnoCode(error, 'ENOENT')) {\n      return [];\n    }\n    throw error;\n  }\n\n  const namedCandidates = entries\n    .filter((e) => e.isDirectory)\n    .map((e) => e.name)\n    .filter((name) => !name.startsWith('.'))\n    .sort();\n\n  const manifestChecks = await Promise.all(\n    namedCandidates.map(async (name) => {\n      try {\n        await stat(join(projectMigrationsDir, name, MANIFEST_FILE));\n        return { name, isMigrationDir: true };\n      } catch (error) {\n        if (hasErrnoCode(error, 'ENOENT')) {\n          return { name, isMigrationDir: false };\n        }\n        throw error;\n      }\n    }),\n  );\n\n  return manifestChecks.filter((c) => !c.isMigrationDir).map((c) => c.name);\n}\n\n/**\n * On-disk head value (`(hash, invariants)`) for one contract space.\n * The verifier compares this against the marker row for the same space\n * to detect drift between the user-emitted artefacts and the live DB\n * marker.\n */\nexport interface ContractSpaceHeadRecord {\n  readonly hash: string;\n  readonly invariants: readonly string[];\n}\n\n/**\n * Marker row read from `prisma_contract.marker` (one per `space`).\n * Caller resolves these via the family runtime's marker reader before\n * invoking {@link verifyContractSpaces}.\n */\nexport interface SpaceMarkerRecord {\n  readonly hash: string;\n  readonly invariants: readonly string[];\n}\n\nexport interface VerifyContractSpacesInputs {\n  /**\n   * Set of contract spaces the project declares: `'app'` plus each\n   * extension space in `extensionPacks`. The caller's discovery path\n   * never reads the extension descriptor module — it walks the\n   * `extensionPacks` configuration in `prisma-next.config.ts` for the\n   * space ids.\n   */\n  readonly loadedSpaces: ReadonlySet<string>;\n\n  /**\n   * Per-space subdirectories observed under\n   * `<projectRoot>/migrations/`. Resolved via\n   * {@link listContractSpaceDirectories}.\n   */\n  readonly spaceDirsOnDisk: readonly string[];\n\n  /**\n   * Head ref per space, keyed by space id. Caller reads\n   * `<projectRoot>/migrations/<space-id>/contract.json` and\n   * `<projectRoot>/migrations/<space-id>/refs/head.json` to construct\n   * this map. Spaces with no contract-space dir on disk simply omit a\n   * map entry.\n   */\n  readonly headRefsBySpace: ReadonlyMap<string, ContractSpaceHeadRecord>;\n\n  /**\n   * Marker rows keyed by `space`. Caller reads them from the\n   * `prisma_contract.marker` table.\n   */\n  readonly markerRowsBySpace: ReadonlyMap<string, SpaceMarkerRecord>;\n}\n\nexport type SpaceVerifierViolation =\n  | {\n      readonly kind: 'declaredButUnmigrated';\n      readonly spaceId: string;\n      readonly remediation: string;\n    }\n  | {\n      readonly kind: 'orphanMarker';\n      readonly spaceId: string;\n      readonly remediation: string;\n    }\n  | {\n      readonly kind: 'orphanSpaceDir';\n      readonly spaceId: string;\n      readonly remediation: string;\n    }\n  | {\n      readonly kind: 'hashMismatch';\n      readonly spaceId: string;\n      readonly priorHeadHash: string;\n      readonly markerHash: string;\n      readonly remediation: string;\n    }\n  | {\n      readonly kind: 'invariantsMismatch';\n      readonly spaceId: string;\n      readonly onDiskInvariants: readonly string[];\n      readonly markerInvariants: readonly string[];\n      readonly remediation: string;\n    };\n\nexport type VerifyContractSpacesResult =\n  | { readonly ok: true }\n  | { readonly ok: false; readonly violations: readonly SpaceVerifierViolation[] };\n\n/**\n * Pure structural verifier for the per-space mechanism. Aggregates the\n * three orphan / missing checks plus per-space hash and invariant\n * comparison.\n *\n * Algorithm:\n *\n * - For every extension space declared in `loadedSpaces` (`'app'`\n *   excluded — the per-space verifier is scoped to extension members;\n *   the app is verified through the aggregate path):\n *   - If no contract-space dir on disk → `declaredButUnmigrated`.\n *   - Else if `markerRowsBySpace` lacks an entry → no violation here;\n *     the live-DB compare done outside this helper is where the\n *     absence shows up.\n *   - Else compare marker hash / invariants vs. on-disk head hash /\n *     invariants → `hashMismatch` / `invariantsMismatch` on drift.\n * - For every contract-space dir on disk that is not in `loadedSpaces` →\n *   `orphanSpaceDir`.\n * - For every marker row whose `space` is not in `loadedSpaces` →\n *   `orphanMarker`. The app-space marker is always loaded (`'app'` is\n *   in `loadedSpaces` by definition).\n *\n * Output is deterministic: violations are sorted first by `kind`\n * (`declaredButUnmigrated` → `orphanMarker` → `orphanSpaceDir` →\n * `hashMismatch` → `invariantsMismatch`) then by `spaceId`. Two callers\n * passing equivalent inputs see byte-identical violation lists.\n *\n * Synchronous, pure, no I/O. **Does not import the extension descriptor**\n * (the inputs are pre-resolved by the caller); the verifier reads only\n * the user repo, not `node_modules`.\n */\nexport function verifyContractSpaces(\n  inputs: VerifyContractSpacesInputs,\n): VerifyContractSpacesResult {\n  const violations: SpaceVerifierViolation[] = [];\n\n  for (const spaceId of [...inputs.loadedSpaces].sort()) {\n    if (spaceId === APP_SPACE_ID) continue;\n\n    if (!inputs.spaceDirsOnDisk.includes(spaceId)) {\n      violations.push({\n        kind: 'declaredButUnmigrated',\n        spaceId,\n        remediation: `Extension '${spaceId}' is declared in extensionPacks but has not been emitted; run \\`prisma-next migrate\\`.`,\n      });\n      continue;\n    }\n\n    const head = inputs.headRefsBySpace.get(spaceId);\n    const marker = inputs.markerRowsBySpace.get(spaceId);\n    if (!head || !marker) {\n      continue;\n    }\n\n    if (head.hash !== marker.hash) {\n      violations.push({\n        kind: 'hashMismatch',\n        spaceId,\n        priorHeadHash: head.hash,\n        markerHash: marker.hash,\n        remediation: `Marker row for space '${spaceId}' is keyed at ${marker.hash}, but the on-disk ${join('migrations', spaceId, 'contract.json')} resolves to ${head.hash}. Run \\`prisma-next db update\\` to advance the database, or \\`prisma-next migrate\\` if the descriptor was bumped without re-emitting.`,\n      });\n      continue;\n    }\n\n    const onDiskInvariants = [...head.invariants].sort();\n    const markerInvariants = new Set(marker.invariants);\n    const missing = onDiskInvariants.filter((id) => !markerInvariants.has(id));\n    if (missing.length > 0) {\n      violations.push({\n        kind: 'invariantsMismatch',\n        spaceId,\n        onDiskInvariants,\n        markerInvariants: [...marker.invariants].sort(),\n        remediation: `Marker row for space '${spaceId}' is missing invariants [${missing.map((s) => JSON.stringify(s)).join(', ')}]. Run \\`prisma-next db update\\` to apply the corresponding data-transform migrations.`,\n      });\n    }\n  }\n\n  for (const dir of [...inputs.spaceDirsOnDisk].sort()) {\n    if (!inputs.loadedSpaces.has(dir)) {\n      violations.push({\n        kind: 'orphanSpaceDir',\n        spaceId: dir,\n        remediation: `Orphan contract-space directory \\`${join('migrations', dir)}/\\` for an extension not in extensionPacks; remove the directory or re-add the extension.`,\n      });\n    }\n  }\n\n  for (const space of [...inputs.markerRowsBySpace.keys()].sort()) {\n    if (!inputs.loadedSpaces.has(space)) {\n      violations.push({\n        kind: 'orphanMarker',\n        spaceId: space,\n        remediation: `Orphan marker row for space '${space}' (no longer in extensionPacks); remediation: manually delete the row from \\`prisma_contract.marker\\`.`,\n      });\n    }\n  }\n\n  if (violations.length === 0) {\n    return { ok: true };\n  }\n\n  const kindOrder: Record<SpaceVerifierViolation['kind'], number> = {\n    declaredButUnmigrated: 0,\n    orphanMarker: 1,\n    orphanSpaceDir: 2,\n    hashMismatch: 3,\n    invariantsMismatch: 4,\n  };\n\n  violations.sort((a, b) => {\n    const k = kindOrder[a.kind] - kindOrder[b.kind];\n    if (k !== 0) return k;\n    if (a.spaceId < b.spaceId) return -1;\n    if (a.spaceId > b.spaceId) return 1;\n    return 0;\n  });\n\n  return { ok: false, violations };\n}\n","import { readFile } from 'node:fs/promises';\nimport { join } from 'pathe';\nimport { errorInvalidJson, errorMissingFile } from './errors';\nimport { assertValidSpaceId } from './space-layout';\n\nfunction hasErrnoCode(error: unknown, code: string): boolean {\n  return error instanceof Error && (error as { code?: string }).code === code;\n}\n\n/**\n * Read the on-disk contract value for a contract space\n * (`<projectMigrationsDir>/<spaceId>/contract.json`). Returns the parsed\n * JSON value as `unknown` — callers that need a typed contract validate\n * via their family's `validateContract` to surface schema issues.\n *\n * Companion to {@link import('./read-contract-space-head-ref').readContractSpaceHeadRef}\n * — same ENOENT-throws / corrupt-file-error semantics. Returns the\n * canonical-JSON value the framework wrote during emit, so re-running\n * this helper across machines / runs yields a byte-identical value.\n */\nexport async function readContractSpaceContract(\n  projectMigrationsDir: string,\n  spaceId: string,\n): Promise<unknown> {\n  assertValidSpaceId(spaceId);\n\n  const filePath = join(projectMigrationsDir, spaceId, 'contract.json');\n\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (error) {\n    if (hasErrnoCode(error, 'ENOENT')) {\n      throw errorMissingFile('contract.json', join(projectMigrationsDir, spaceId));\n    }\n    throw error;\n  }\n\n  try {\n    return JSON.parse(raw);\n  } catch (e) {\n    throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));\n  }\n}\n"],"mappings":";;;;;;;;;;;AAoBA,MAAM,mBAAmB;AAEzB,SAAgB,eAAe,SAA0C;CACvE,OAAO,iBAAiB,KAAK,QAAQ;;AAGvC,SAAgB,mBAAmB,SAAkD;CACnF,IAAI,CAAC,eAAe,QAAQ,EAC1B,MAAM,oBAAoB,QAAQ;;;;;;;;;;;;;;AAgBtC,SAAgB,wBAAwB,sBAA8B,SAAyB;CAC7F,mBAAmB,QAAQ;CAC3B,OAAO,KAAK,sBAAsB,QAAQ;;;;ACtC5C,SAASA,eAAa,OAAgB,MAAuB;CAC3D,OAAO,iBAAiB,SAAU,MAA4B,SAAS;;;;;;;;;;;;;;;AAgBzE,eAAsB,yBACpB,sBACA,SACsC;CACtC,mBAAmB,QAAQ;CAE3B,MAAM,WAAW,KAAK,sBAAsB,SAAS,QAAQ,YAAY;CAEzE,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,SAAS,UAAU,QAAQ;UAChC,OAAO;EACd,IAAIA,eAAa,OAAO,SAAS,EAC/B,OAAO;EAET,MAAM;;CAGR,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;UACjB,GAAG;EACV,MAAM,iBAAiB,UAAU,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,CAAC;;CAG9E,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAM,oBAAoB,UAAU,qBAAqB;CAE3D,MAAM,MAAM;CACZ,IAAI,OAAO,IAAI,SAAS,UACtB,MAAM,oBAAoB,UAAU,gDAAgD;CAEtF,IAAI,CAAC,MAAM,QAAQ,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,UAAU,OAAO,UAAU,SAAS,EAC7F,MAAM,oBAAoB,UAAU,2DAA2D;CAGjG,OAAO;EAAE,MAAM,IAAI;EAAM,YAAY,IAAI;EAAiC;;;;;;;;;;;;;;;;;;;;;ACG5E,SAAgB,yBACd,SACA,QAC0B;CAC1B,IAAI,OAAO,kBAAkB,MAC3B,OAAO;EACL,MAAM;EACN;EACA,gBAAgB,OAAO;EACvB,eAAe;EAChB;CAEH,IAAI,OAAO,mBAAmB,OAAO,eACnC,OAAO;EACL,MAAM;EACN;EACA,gBAAgB,OAAO;EACvB,eAAe,OAAO;EACvB;CAEH,OAAO;EACL,MAAM;EACN;EACA,gBAAgB,OAAO;EACvB,eAAe,OAAO;EACvB;;;;ACpFH,SAASC,eAAa,OAAgB,MAAuB;CAC3D,OAAO,iBAAiB,SAAU,MAA4B,SAAS;;;;;;;;;;;;;;;;;;AAmBzE,eAAsB,6BACpB,sBAC4B;CAC5B,IAAI;CACJ,IAAI;EAEF,WAAU,MADY,QAAQ,sBAAsB,EAAE,eAAe,MAAM,CAAC,EAC1D,KAAK,OAAO;GAAE,MAAM,EAAE;GAAM,aAAa,EAAE,aAAa;GAAE,EAAE;UACvE,OAAO;EACd,IAAIA,eAAa,OAAO,SAAS,EAC/B,OAAO,EAAE;EAEX,MAAM;;CAGR,MAAM,kBAAkB,QACrB,QAAQ,MAAM,EAAE,YAAY,CAC5B,KAAK,MAAM,EAAE,KAAK,CAClB,QAAQ,SAAS,CAAC,KAAK,WAAW,IAAI,CAAC,CACvC,MAAM;CAgBT,QAAO,MAdsB,QAAQ,IACnC,gBAAgB,IAAI,OAAO,SAAS;EAClC,IAAI;GACF,MAAM,KAAK,KAAK,sBAAsB,MAAM,cAAc,CAAC;GAC3D,OAAO;IAAE;IAAM,gBAAgB;IAAM;WAC9B,OAAO;GACd,IAAIA,eAAa,OAAO,SAAS,EAC/B,OAAO;IAAE;IAAM,gBAAgB;IAAO;GAExC,MAAM;;GAER,CACH,EAEqB,QAAQ,MAAM,CAAC,EAAE,eAAe,CAAC,KAAK,MAAM,EAAE,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2H3E,SAAgB,qBACd,QAC4B;CAC5B,MAAM,aAAuC,EAAE;CAE/C,KAAK,MAAM,WAAW,CAAC,GAAG,OAAO,aAAa,CAAC,MAAM,EAAE;EACrD,IAAI,YAAY,cAAc;EAE9B,IAAI,CAAC,OAAO,gBAAgB,SAAS,QAAQ,EAAE;GAC7C,WAAW,KAAK;IACd,MAAM;IACN;IACA,aAAa,cAAc,QAAQ;IACpC,CAAC;GACF;;EAGF,MAAM,OAAO,OAAO,gBAAgB,IAAI,QAAQ;EAChD,MAAM,SAAS,OAAO,kBAAkB,IAAI,QAAQ;EACpD,IAAI,CAAC,QAAQ,CAAC,QACZ;EAGF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,WAAW,KAAK;IACd,MAAM;IACN;IACA,eAAe,KAAK;IACpB,YAAY,OAAO;IACnB,aAAa,yBAAyB,QAAQ,gBAAgB,OAAO,KAAK,oBAAoB,KAAK,cAAc,SAAS,gBAAgB,CAAC,eAAe,KAAK,KAAK;IACrK,CAAC;GACF;;EAGF,MAAM,mBAAmB,CAAC,GAAG,KAAK,WAAW,CAAC,MAAM;EACpD,MAAM,mBAAmB,IAAI,IAAI,OAAO,WAAW;EACnD,MAAM,UAAU,iBAAiB,QAAQ,OAAO,CAAC,iBAAiB,IAAI,GAAG,CAAC;EAC1E,IAAI,QAAQ,SAAS,GACnB,WAAW,KAAK;GACd,MAAM;GACN;GACA;GACA,kBAAkB,CAAC,GAAG,OAAO,WAAW,CAAC,MAAM;GAC/C,aAAa,yBAAyB,QAAQ,2BAA2B,QAAQ,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;GAC3H,CAAC;;CAIN,KAAK,MAAM,OAAO,CAAC,GAAG,OAAO,gBAAgB,CAAC,MAAM,EAClD,IAAI,CAAC,OAAO,aAAa,IAAI,IAAI,EAC/B,WAAW,KAAK;EACd,MAAM;EACN,SAAS;EACT,aAAa,qCAAqC,KAAK,cAAc,IAAI,CAAC;EAC3E,CAAC;CAIN,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,kBAAkB,MAAM,CAAC,CAAC,MAAM,EAC7D,IAAI,CAAC,OAAO,aAAa,IAAI,MAAM,EACjC,WAAW,KAAK;EACd,MAAM;EACN,SAAS;EACT,aAAa,gCAAgC,MAAM;EACpD,CAAC;CAIN,IAAI,WAAW,WAAW,GACxB,OAAO,EAAE,IAAI,MAAM;CAGrB,MAAM,YAA4D;EAChE,uBAAuB;EACvB,cAAc;EACd,gBAAgB;EAChB,cAAc;EACd,oBAAoB;EACrB;CAED,WAAW,MAAM,GAAG,MAAM;EACxB,MAAM,IAAI,UAAU,EAAE,QAAQ,UAAU,EAAE;EAC1C,IAAI,MAAM,GAAG,OAAO;EACpB,IAAI,EAAE,UAAU,EAAE,SAAS,OAAO;EAClC,IAAI,EAAE,UAAU,EAAE,SAAS,OAAO;EAClC,OAAO;GACP;CAEF,OAAO;EAAE,IAAI;EAAO;EAAY;;;;ACzQlC,SAAS,aAAa,OAAgB,MAAuB;CAC3D,OAAO,iBAAiB,SAAU,MAA4B,SAAS;;;;;;;;;;;;;AAczE,eAAsB,0BACpB,sBACA,SACkB;CAClB,mBAAmB,QAAQ;CAE3B,MAAM,WAAW,KAAK,sBAAsB,SAAS,gBAAgB;CAErE,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,SAAS,UAAU,QAAQ;UAChC,OAAO;EACd,IAAI,aAAa,OAAO,SAAS,EAC/B,MAAM,iBAAiB,iBAAiB,KAAK,sBAAsB,QAAQ,CAAC;EAE9E,MAAM;;CAGR,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;UACf,GAAG;EACV,MAAM,iBAAiB,UAAU,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,CAAC"}

package/package.json

@@ -1,23 +1,24 @@
 {
   "name": "@prisma-next/migration-tools",
-  "version": "0.5.0-dev.7",
+  "version": "0.5.0-dev.70",
+  "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
-  "description": "On-disk migration persistence, attestation, and chain reconstruction for Prisma Next",
+  "description": "On-disk migration persistence, hash verification, and chain reconstruction for Prisma Next",
   "dependencies": {
     "arktype": "^2.1.29",
     "pathe": "^2.0.3",
-    "prettier": "^3.6.2",
-    "@prisma-next/contract": "0.5.0-dev.7",
-    "@prisma-next/framework-components": "0.5.0-dev.7",
-    "@prisma-next/utils": "0.5.0-dev.7"
+    "prettier": "^3.8.3",
+    "@prisma-next/contract": "0.5.0-dev.70",
+    "@prisma-next/utils": "0.5.0-dev.70",
+    "@prisma-next/framework-components": "0.5.0-dev.70"
   },
   "devDependencies": {
-    "tsdown": "0.18.4",
+    "tsdown": "0.22.0",
     "typescript": "5.9.3",
-    "vitest": "4.0.17",
-    "@prisma-next/tsdown": "0.0.0",
-    "@prisma-next/tsconfig": "0.0.0"
+    "vitest": "4.1.5",
+    "@prisma-next/tsconfig": "0.0.0",
+    "@prisma-next/tsdown": "0.0.0"
   },
   "files": [
     "dist",
@@ -27,21 +28,37 @@
     "node": ">=20"
   },
   "exports": {
-    "./types": {
-      "types": "./dist/exports/types.d.mts",
-      "import": "./dist/exports/types.mjs"
+    "./metadata": {
+      "types": "./dist/exports/metadata.d.mts",
+      "import": "./dist/exports/metadata.mjs"
+    },
+    "./package": {
+      "types": "./dist/exports/package.d.mts",
+      "import": "./dist/exports/package.mjs"
+    },
+    "./graph": {
+      "types": "./dist/exports/graph.d.mts",
+      "import": "./dist/exports/graph.mjs"
+    },
+    "./errors": {
+      "types": "./dist/exports/errors.d.mts",
+      "import": "./dist/exports/errors.mjs"
     },
     "./io": {
       "types": "./dist/exports/io.d.mts",
       "import": "./dist/exports/io.mjs"
     },
-    "./attestation": {
-      "types": "./dist/exports/attestation.d.mts",
-      "import": "./dist/exports/attestation.mjs"
+    "./hash": {
+      "types": "./dist/exports/hash.d.mts",
+      "import": "./dist/exports/hash.mjs"
     },
-    "./dag": {
-      "types": "./dist/exports/dag.d.mts",
-      "import": "./dist/exports/dag.mjs"
+    "./invariants": {
+      "types": "./dist/exports/invariants.d.mts",
+      "import": "./dist/exports/invariants.mjs"
+    },
+    "./migration-graph": {
+      "types": "./dist/exports/migration-graph.d.mts",
+      "import": "./dist/exports/migration-graph.mjs"
     },
     "./refs": {
       "types": "./dist/exports/refs.d.mts",
@@ -59,6 +76,14 @@
       "types": "./dist/exports/migration.d.mts",
       "import": "./dist/exports/migration.mjs"
     },
+    "./spaces": {
+      "types": "./dist/exports/spaces.d.mts",
+      "import": "./dist/exports/spaces.mjs"
+    },
+    "./aggregate": {
+      "types": "./dist/exports/aggregate.d.mts",
+      "import": "./dist/exports/aggregate.mjs"
+    },
     "./package.json": "./package.json"
   },
   "repository": {