@prisma-next/migration-tools 0.5.0-dev.9 → 0.5.1

package/dist/exports/aggregate.d.mts

@@ -0,0 +1,599 @@
+import { n as OnDiskMigrationPackage } from "../package-BjiZ7KDy.mjs";
+import { n as MigrationGraph } from "../graph-HMWAldoR.mjs";
+import { t as PathDecision } from "../migration-graph-DulOITvG.mjs";
+import { ControlFamilyInstance, MigrationOperationPolicy, MigrationPlan, MigrationPlanOperation, MigrationPlannerConflict, TargetMigrationsCapability } from "@prisma-next/framework-components/control";
+import { Result } from "@prisma-next/utils/result";
+import { Contract } from "@prisma-next/contract/types";
+import { TargetBoundComponentDescriptor } from "@prisma-next/framework-components/components";
+
+//#region src/aggregate/types.d.ts
+/**
+ * Hydrated migration graph for a single contract space.
+ *
+ * `graph` is the structural shortest-path graph (forward / reverse chain,
+ * deterministic tie-break order) reconstructed from a set of on-disk
+ * migration packages. `packagesByMigrationHash` is the lookup table the
+ * graph-walk strategy uses to resolve a path's edge sequence back to the
+ * concrete `OnDiskMigrationPackage` (and therefore the operation list) for
+ * apply.
+ *
+ * Eagerly hydrated by the loader. Once a `ContractSpaceAggregate` exists,
+ * downstream consumers do **not** touch the filesystem to walk graphs or
+ * resolve packages — the aggregate is the boundary.
+ */
+interface HydratedMigrationGraph {
+  readonly graph: MigrationGraph;
+  readonly packagesByMigrationHash: ReadonlyMap<string, OnDiskMigrationPackage>;
+}
+/**
+ * One contract space — app or extension — as a member of a
+ * {@link ContractSpaceAggregate}. Every member has the same shape.
+ *
+ * - `spaceId`: `'app'` for the application, otherwise the extension's
+ *   id (validated against `[a-z][a-z0-9_-]{0,63}`).
+ * - `contract`: the validated contract value for this member. For the
+ *   app, the user's authored contract; for an extension, the on-disk
+ *   `migrations/<spaceId>/contract.json`. Both have already passed the
+ *   family's `validateContract` at the loader boundary.
+ * - `headRef.hash`: the storage hash this member is targeting. For the
+ *   app, equals `contract.storage.storageHash`. For extensions, the
+ *   on-disk `refs/head.json.hash`.
+ * - `headRef.invariants`: alphabetically sorted, deduplicated invariant
+ *   ids declared on the head ref. Empty for the app member (the app's
+ *   plan is synthesised from the contract IR, no invariants required).
+ * - `migrations`: the hydrated migration graph for this space. Possibly
+ *   empty (an extension whose on-disk head ref points at the
+ *   empty-contract sentinel and ships no migrations yet, or the app
+ *   when the user hasn't authored any).
+ */
+interface ContractSpaceMember {
+  readonly spaceId: string;
+  readonly contract: Contract;
+  readonly headRef: {
+    readonly hash: string;
+    readonly invariants: readonly string[];
+  };
+  readonly migrations: HydratedMigrationGraph;
+}
+/**
+ * Typed value carrying the user's app contract plus every loaded
+ * extension contract space, fully hydrated and internally consistent.
+ *
+ * Produced once per CLI invocation by `loadContractSpaceAggregate`.
+ * Every downstream component (planner, verifier, runner adapter)
+ * consumes this value rather than rebuilding state from disk.
+ *
+ * Invariants the loader enforces at construction:
+ *
+ * 1. `targetId` is consistent across every member (`contract.target`
+ *    matches `aggregate.targetId`). The aggregate's `targetId` is the
+ *    `Config.adapter.targetId` value the loader was told to use.
+ * 2. `aggregate.extensions` is sorted alphabetically by `spaceId`.
+ *    Mirrors {@link import('../concatenate-space-apply-inputs').concatenateSpaceApplyInputs}'s
+ *    extension ordering convention so downstream apply order matches
+ *    today's behaviour byte-for-byte.
+ * 3. No two members claim the same storage element (table / type / etc.).
+ * 4. For each extension member: `member.headRef.hash` is reachable from
+ *    the empty-contract sentinel in `member.migrations.graph` (or the
+ *    graph is empty and `member.headRef.hash === EMPTY_CONTRACT_HASH`).
+ * 5. For the app member: `member.headRef.hash` equals
+ *    `member.contract.storage.storageHash`. The app's `migrations`
+ *    is hydrated from the user's authored `migrations/` (or empty if
+ *    none).
+ *
+ * The aggregate is **type-uniform** post-construction: app/extension
+ * distinguishability survives only at the caller-policy layer
+ * (`ignoreGraphFor: new Set([appSpaceId])`), not on member shape.
+ */
+interface ContractSpaceAggregate {
+  readonly targetId: string;
+  readonly app: ContractSpaceMember;
+  readonly extensions: readonly ContractSpaceMember[];
+}
+//#endregion
+//#region src/aggregate/loader.d.ts
+/**
+ * Single declared extension entry the loader needs from `Config.extensionPacks`.
+ *
+ * Only the subset of fields the loader operates on:
+ *
+ * - `id` — the space id (also the directory name under `migrations/`).
+ * - `targetId` — the configured `Config.adapter.targetId` value the
+ *   declaring extension declared. The loader rejects mismatches against
+ *   the aggregate's `targetId` with `targetMismatch`.
+ *
+ * Whether the descriptor declares a contract space is decided by whether
+ * its corresponding `migrations/<id>/` directory exists on disk
+ * (materialised by the seed phase before the loader runs); the loader
+ * never reads the descriptor's `contractJson` itself. That makes the
+ * aggregate's apply / verify paths byte-for-byte independent of the
+ * descriptor module — `db verify` succeeds even if the descriptor's
+ * `contractJson` is a throwing getter.
+ *
+ * Typed structurally so the migration-tools layer stays framework-neutral.
+ */
+interface DeclaredExtensionEntry {
+  readonly id: string;
+  readonly targetId: string;
+}
+/**
+ * Inputs for {@link loadContractSpaceAggregate}.
+ *
+ * The loader is the **sole** descriptor-import boundary in the M2.5
+ * pipeline: callers gather the descriptor data (already-validated app
+ * contract, declared extension entries) and pass it through. Once the
+ * loader returns, no descriptor module is imported again for this
+ * aggregate's lifetime.
+ */
+interface LoadAggregateInput {
+  readonly targetId: string;
+  readonly migrationsDir: string;
+  readonly appContract: Contract;
+  readonly declaredExtensions: ReadonlyArray<DeclaredExtensionEntry>;
+  readonly validateContract: (contractJson: unknown) => Contract;
+  /**
+   * Hydrated migration graph for the **app member**.
+   *
+   * The framework-neutral migration-tools layer doesn't know how to read
+   * the user's authored `migrations/` directory (the app member's
+   * migration-package layout is family-aware: ops.json shape, manifest
+   * keys, etc.). Callers — the SQL family today — read the user's
+   * `migrations/` and hand the resulting `OnDiskMigrationPackage[]` through.
+   *
+   * Passing `[]` is valid (greenfield project, no authored migrations).
+   * Equivalent to `migrations/` not existing or being empty.
+   */
+  readonly appMigrationPackages: ReadonlyArray<OnDiskMigrationPackage>;
+}
+/**
+ * Discriminated failure variants the loader emits.
+ *
+ * Every variant short-circuits at first hit; the loader does not keep
+ * collecting after the first violation in any phase except for layout
+ * (where every layout offence is bundled into one `layoutViolation`).
+ */
+type LoadAggregateError = {
+  readonly kind: 'layoutViolation';
+  readonly violations: readonly LayoutViolation[];
+} | {
+  readonly kind: 'integrityFailure';
+  readonly spaceId: string;
+  readonly detail: string;
+} | {
+  readonly kind: 'validationFailure';
+  readonly spaceId: string;
+  readonly detail: string;
+} | {
+  readonly kind: 'disjointnessViolation';
+  readonly element: string;
+  readonly claimedBy: readonly string[];
+} | {
+  readonly kind: 'targetMismatch';
+  readonly spaceId: string;
+  readonly expected: string;
+  readonly actual: string;
+};
+/**
+ * Single layout violation; bundled into a `layoutViolation` error so
+ * users see every layout offence at once rather than fixing them one
+ * at a time across re-runs.
+ *
+ * - `declaredButUnmigrated`: extension declared in `extensionPacks` with
+ *   a `contractSpace` but no contract-space dir on disk. Remediation:
+ *   `prisma-next migrate`.
+ * - `orphanSpaceDir`: contract-space dir under `migrations/` for an extension
+ *   not in `extensionPacks`. Remediation: remove the directory, or
+ *   re-add the extension to `extensionPacks`.
+ */
+type LayoutViolation = {
+  readonly kind: 'declaredButUnmigrated';
+  readonly spaceId: string;
+} | {
+  readonly kind: 'orphanSpaceDir';
+  readonly spaceId: string;
+};
+type LoadAggregateOutput = Result<{
+  readonly aggregate: ContractSpaceAggregate;
+}, LoadAggregateError>;
+/**
+ * Hydrate a {@link ContractSpaceAggregate} from on-disk state and
+ * the app contract value the caller supplies.
+ *
+ * The loader is the **only** descriptor-import boundary at apply /
+ * verify time, but it intentionally does **not** read the extension
+ * descriptor's `contractJson` value. Each extension space's contract
+ * is read from its on-disk `migrations/<id>/contract.json` mirror; the
+ * descriptor's role is exhausted by the seed phase that wrote that
+ * mirror in the first place. The loader composes existing
+ * migration-tools primitives — layout precheck (via
+ * {@link listContractSpaceDirectories}), integrity checks (via
+ * {@link readMigrationsDir} / {@link readContractSpaceHeadRef} /
+ * {@link readContractSpaceContract} / `validateContract`), and
+ * disjointness — into a single typed value.
+ *
+ * Failure semantics: every failure variant in {@link LoadAggregateError}
+ * short-circuits the load.
+ */
+declare function loadContractSpaceAggregate(input: LoadAggregateInput): Promise<LoadAggregateOutput>;
+//#endregion
+//#region src/aggregate/marker-types.d.ts
+/**
+ * Structural shape the aggregate planner / verifier accept for marker
+ * rows. Mirrors `family.readAllMarkers(...)` outputs across SQL and
+ * Mongo families: a `(storageHash, invariants)` pair plus an optional
+ * `profileHash` the verifier uses to align the marker with the
+ * destination contract's profile envelope.
+ *
+ * Typed structurally so `migration-tools` stays framework-neutral; SQL
+ * and Mongo families pass their typed `ContractMarkerRecord` through
+ * unchanged.
+ */
+interface ContractMarkerRecordLike {
+  readonly storageHash: string;
+  readonly invariants: readonly string[];
+  readonly profileHash?: string;
+}
+//#endregion
+//#region src/aggregate/planner-types.d.ts
+/**
+ * Caller-provided policy for {@link planAggregate}. Today this carries
+ * just one knob:
+ *
+ * - `ignoreGraphFor`: `Set<spaceId>`. For listed members, the planner
+ *   forces the **synth** strategy (synthesise a plan from the contract
+ *   IR via `familyInstance.createPlanner(...).plan(...)`) regardless of
+ *   whether a graph is available. The CLI's daily-driver `db init` /
+ *   `db update` pipelines pass `new Set([aggregate.app.spaceId])` to
+ *   keep today's app-space behaviour: the user's authored
+ *   `migrations/` directory is **not** walked for the app member, the
+ *   plan is synthesised on the fly. Extension members are walked.
+ *
+ *   Listing a member here whose `headRef.invariants` is non-empty is
+ *   a `policyConflict` — synth cannot satisfy authored invariants.
+ */
+interface CallerPolicy {
+  readonly ignoreGraphFor: ReadonlySet<string>;
+}
+/**
+ * Snapshot of the live database state the planner needs to drive
+ * strategy selection.
+ *
+ * - `markersBySpaceId`: per-space marker rows. Absent entry = no
+ *   marker yet (greenfield space). The planner treats the marker's
+ *   `storageHash` as the graph-walk's `from` node, falling back to
+ *   {@link import('../constants').EMPTY_CONTRACT_HASH} when absent.
+ * - `schemaIntrospection`: the family's full live schema IR. Fed into
+ *   the synth strategy after per-space pre-projection via
+ *   {@link import('./project-schema-to-space').projectSchemaToSpace}.
+ *
+ * Callers (CLI commands) gather this via the family's
+ * `readAllMarkers` + `introspect` calls before invoking the planner.
+ * The planner itself does not touch the database.
+ */
+interface AggregateCurrentDBState {
+  readonly markersBySpaceId: ReadonlyMap<string, ContractMarkerRecordLike | null>;
+  readonly schemaIntrospection: unknown;
+}
+/**
+ * Inputs to {@link planAggregate}.
+ *
+ * The planner is target-agnostic but family-aware: per-member synth
+ * delegates to the family's `createPlanner(familyInstance).plan(...)`,
+ * which is why `familyInstance`, `migrations` (the
+ * `TargetMigrationsCapability`), and `frameworkComponents` are all
+ * threaded through. (`frameworkComponents` is passed verbatim into
+ * `planner.plan(...)` per ADR 212; the planner does not interpret it.)
+ *
+ * The aggregate planner does **not** receive a `targetId` separately —
+ * it reads `aggregate.targetId` and stamps it onto every emitted
+ * `MigrationPlan` from construction. No placeholder, no patch step.
+ */
+interface AggregatePlannerInput<TFamilyId extends string, TTargetId extends string> {
+  readonly aggregate: ContractSpaceAggregate;
+  readonly currentDBState: AggregateCurrentDBState;
+  readonly familyInstance: ControlFamilyInstance<TFamilyId, unknown>;
+  readonly migrations: TargetMigrationsCapability<TFamilyId, TTargetId, ControlFamilyInstance<TFamilyId, unknown>>;
+  readonly frameworkComponents: ReadonlyArray<TargetBoundComponentDescriptor<TFamilyId, TTargetId>>;
+  readonly callerPolicy: CallerPolicy;
+  readonly operationPolicy: MigrationOperationPolicy;
+}
+/**
+ * Per-member output of the aggregate planner. The runner ingests this
+ * shape directly via a thin `toRunnerInput` adapter at the CLI.
+ *
+ * - `plan`: ready-to-execute `MigrationPlan` with `targetId` already
+ *   set from `aggregate.targetId`.
+ * - `displayOps`: same operation list, surfaced separately so plan-mode
+ *   output can render without touching the runner-bound `plan`.
+ * - `destinationContract`: the typed contract value the runner uses
+ *   for post-apply verification. For the app member, the user's
+ *   contract; for extension members, the on-disk `contract.json`.
+ * - `strategy`: which strategy produced this plan (`'graph-walk'` or
+ *   `'synth'`). Surfaced for diagnostics; not consumed by the runner.
+ */
+/**
+ * Per-edge metadata for the chain assembled by the graph-walk
+ * strategy. Lets `migration apply` surface a per-migration `applied[]`
+ * entry (preserving the single-space `migrationsApplied` count
+ * semantics) without re-walking the graph.
+ *
+ * `synth`-produced plans leave this absent — synthesised plans don't
+ * have authored edges to surface.
+ */
+interface AggregateMigrationEdgeRef {
+  readonly migrationHash: string;
+  readonly dirName: string;
+  readonly from: string;
+  readonly to: string;
+  readonly operationCount: number;
+}
+interface AggregatePerSpacePlan {
+  readonly plan: MigrationPlan;
+  readonly displayOps: readonly MigrationPlanOperation[];
+  readonly destinationContract: Contract;
+  readonly strategy: 'graph-walk' | 'synth';
+  /**
+   * Per-edge breakdown of the chain. Populated by the graph-walk
+   * strategy; absent for synth-produced plans.
+   */
+  readonly migrationEdges?: readonly AggregateMigrationEdgeRef[];
+  /**
+   * Path decision data the strategy used to select the chain
+   * (alternative count, tie-break reasons, required/satisfied
+   * invariants, per-edge invariants). Populated by the graph-walk
+   * strategy; absent for synth-produced plans.
+   *
+   * `migration apply` surfaces this for the app member as
+   * `MigrationApplySuccess.pathDecision` (back-compat with single-
+   * space callers).
+   */
+  readonly pathDecision?: PathDecision;
+}
+interface AggregatePlannerSuccess {
+  readonly perSpace: ReadonlyMap<string, AggregatePerSpacePlan>;
+  /**
+   * `applyOrder` is the order the runner must walk per-space inputs.
+   * Mirrors the existing `concatenateSpaceApplyInputs` convention:
+   * extensions alphabetically by `spaceId`, then the app. Tests assert
+   * on `MultiSpaceRunnerFailure.failingSpace`, which is positional in
+   * the runner's input array — preserving the literal ordering keeps
+   * `failingSpace` attribution byte-for-byte.
+   */
+  readonly applyOrder: readonly string[];
+}
+/**
+ * Discriminated failure variants for {@link planAggregate}. Each
+ * variant short-circuits the plan; per-member errors carry the
+ * `spaceId` so the CLI can surface a precise envelope.
+ */
+type AggregatePlannerError = {
+  readonly kind: 'extensionPathUnreachable';
+  readonly spaceId: string;
+  readonly target: string;
+} | {
+  readonly kind: 'extensionPathUnsatisfiable';
+  readonly spaceId: string;
+  readonly missingInvariants: readonly string[];
+} | {
+  readonly kind: 'appSynthFailure';
+  readonly spaceId: string;
+  readonly conflicts: readonly MigrationPlannerConflict[];
+} | {
+  readonly kind: 'policyConflict';
+  readonly spaceId: string;
+  readonly detail: string;
+};
+type AggregatePlannerOutput = Result<AggregatePlannerSuccess, AggregatePlannerError>;
+//#endregion
+//#region src/aggregate/planner.d.ts
+/**
+ * Plan a migration across every member of a {@link ContractSpaceAggregate}.
+ *
+ * Strategy selection per member, in order; first match wins:
+ *
+ * 1. If `callerPolicy.ignoreGraphFor.has(member.spaceId)`:
+ *    - If `member.headRef.invariants` is empty → synth.
+ *    - Else → `policyConflict` (synth cannot satisfy authored invariants).
+ * 2. Else if `member.migrations.graph` is non-empty AND graph-walk
+ *    succeeds → graph-walk.
+ * 3. Else if `member.headRef.invariants` is empty → synth.
+ * 4. Else → graph-walk failure → `extensionPathUnreachable` /
+ *    `extensionPathUnsatisfiable`.
+ *
+ * Output `applyOrder` is `[...aggregate.extensions.map(spaceId), aggregate.app.spaceId]`
+ * — extensions alphabetical, then app — matching today's
+ * `concatenateSpaceApplyInputs` ordering. This preserves
+ * `MultiSpaceRunnerFailure.failingSpace` attribution byte-for-byte.
+ *
+ * Every emitted `MigrationPlan` has `targetId = aggregate.targetId`.
+ * No placeholder cast; no patch step.
+ */
+declare function planAggregate<TFamilyId extends string, TTargetId extends string>(input: AggregatePlannerInput<TFamilyId, TTargetId>): Promise<AggregatePlannerOutput>;
+//#endregion
+//#region src/aggregate/project-schema-to-space.d.ts
+/**
+ * Project the introspected live schema to the slice claimed by a single
+ * contract-space member.
+ *
+ * Returns the same `schema` value with every top-level table claimed by
+ * **other** members of the aggregate removed. Tables not claimed by any
+ * member flow through unchanged — the planner / verifier sees them as
+ * orphans (extras in strict mode).
+ *
+ * Used by:
+ *
+ * - The aggregate planner's **synth strategy**: when synthesising a
+ *   plan against a member's contract, the live schema must be projected
+ *   to that member's slice so the planner doesn't treat tables claimed
+ *   by other members as "extras" and emit destructive ops to drop
+ *   them.
+ * - The aggregate verifier's **schemaCheck**: projects per member so the
+ *   single-contract `verifySqlSchema` only sees the slice claimed by
+ *   the member it is checking. Closes the F23 architectural concern
+ *   (multi-member deployments where each member's tables look like
+ *   extras to every other member's verify pass).
+ *
+ * **Duck-typing semantics**: the helper operates on `unknown` for the
+ * schema and falls through structurally if the shape doesn't match.
+ * Every family today exposes `storage.tables: Record<string, ...>` and
+ * the introspected schema mirrors the same shape; a future family with
+ * a different storage shape gets the schema returned unchanged rather
+ * than blowing up the aggregate planner.
+ */
+declare function projectSchemaToSpace(schema: unknown, member: ContractSpaceMember, otherMembers: ReadonlyArray<ContractSpaceMember>): unknown;
+//#endregion
+//#region src/aggregate/strategies/graph-walk.d.ts
+/**
+ * Outcome variants for the graph-walk strategy. Mirrors
+ * {@link import('../../compute-extension-space-apply-path').ExtensionSpaceApplyPathOutcome}
+ * but operates against the **already-hydrated** `member.migrations.graph`
+ * instead of re-reading from disk. The aggregate planner converts
+ * these into {@link import('../planner-types').AggregatePlannerError}
+ * variants.
+ */
+type GraphWalkOutcome = {
+  readonly kind: 'ok';
+  readonly result: AggregatePerSpacePlan;
+} | {
+  readonly kind: 'unreachable';
+} | {
+  readonly kind: 'unsatisfiable';
+  readonly missing: readonly string[];
+};
+interface GraphWalkStrategyInputs {
+  readonly aggregateTargetId: string;
+  readonly member: ContractSpaceMember;
+  readonly currentMarker: ContractMarkerRecordLike | null;
+  /**
+   * Optional ref name to decorate the resulting `PathDecision`. Used by
+   * `migration apply` to surface the user-supplied `--ref <name>` in
+   * structured-progress events and invariant-path error envelopes. The
+   * strategy itself does not interpret it.
+   */
+  readonly refName?: string;
+}
+/**
+ * Walk a member's hydrated migration graph from the live marker to
+ * `member.headRef.hash`, covering every required invariant.
+ *
+ * Pure synchronous function — no I/O. The aggregate's loader has
+ * already integrity-checked every package and reconstructed the graph;
+ * this strategy just looks up ops by `migrationHash` and assembles a
+ * `MigrationPlan` with `targetId` set from the aggregate (no
+ * placeholder cast).
+ *
+ * Required invariants are computed as `headRef.invariants \ marker.invariants`
+ * — the marker already declares some invariants satisfied; the path
+ * only needs to provide the remainder. Mirrors today's
+ * `computeExtensionSpaceApplyPath` semantics.
+ */
+declare function graphWalkStrategy(input: GraphWalkStrategyInputs): GraphWalkOutcome;
+//#endregion
+//#region src/aggregate/verifier.d.ts
+/**
+ * Caller policy for the aggregate verifier. Today's only knob is
+ * `mode`: `strict` treats orphan elements (live tables not claimed by
+ * any aggregate member) as errors; `lenient` treats them as
+ * informational. Maps directly to `db verify --strict`.
+ */
+interface AggregateVerifierInput<TSchemaResult> {
+  readonly aggregate: ContractSpaceAggregate;
+  readonly markersBySpaceId: ReadonlyMap<string, ContractMarkerRecordLike | null>;
+  readonly schemaIntrospection: unknown;
+  readonly mode: 'strict' | 'lenient';
+  /**
+   * Caller-supplied per-space schema verifier. The CLI wires this to
+   * the family's `verifySqlSchema` (SQL) / equivalent (other
+   * families). The aggregate verifier projects the schema to the
+   * member's slice via {@link projectSchemaToSpace} before invoking
+   * the callback, so single-contract semantics are preserved.
+   *
+   * Typed structurally with a generic `TSchemaResult` so the
+   * migration-tools layer doesn't depend on the SQL family's
+   * `VerifySqlSchemaResult`. CLI callers pass the family's type
+   * through unchanged.
+   */
+  readonly verifySchemaForMember: (projectedSchema: unknown, member: ContractSpaceMember, mode: 'strict' | 'lenient') => TSchemaResult;
+}
+/**
+ * Marker-check result per member. Mirrors the four cases the
+ * `verifyContractSpaces` primitive surfaces today, plus an `'absent'`
+ * case for greenfield spaces (no marker row written yet — `db init`
+ * not run).
+ */
+type MarkerCheckResult = {
+  readonly kind: 'ok';
+} | {
+  readonly kind: 'absent';
+} | {
+  readonly kind: 'hashMismatch';
+  readonly markerHash: string;
+  readonly expected: string;
+} | {
+  readonly kind: 'missingInvariants';
+  readonly missing: readonly string[];
+};
+interface MarkerCheckSection {
+  readonly perSpace: ReadonlyMap<string, MarkerCheckResult>;
+  readonly orphanMarkers: readonly {
+    readonly spaceId: string;
+    readonly row: ContractMarkerRecordLike;
+  }[];
+}
+/**
+ * A live storage element (today: a top-level table) not claimed by any
+ * member of the aggregate. The aggregate verifier always reports these;
+ * the caller decides what to do — `db verify --strict` treats them as
+ * errors, the lenient default treats them as informational.
+ *
+ * Today only `kind: 'table'` exists. The discriminated shape leaves
+ * room for orphan columns / indexes / sequences in the future without
+ * breaking the type contract.
+ */
+type OrphanElement = {
+  readonly kind: 'table';
+  readonly name: string;
+};
+interface SchemaCheckSection<TSchemaResult> {
+  readonly perSpace: ReadonlyMap<string, TSchemaResult>;
+  /**
+   * Live elements present in the introspected schema that are not
+   * claimed by **any** aggregate member. Sorted alphabetically by name.
+   */
+  readonly orphanElements: readonly OrphanElement[];
+}
+interface AggregateVerifierSuccess<TSchemaResult> {
+  readonly markerCheck: MarkerCheckSection;
+  readonly schemaCheck: SchemaCheckSection<TSchemaResult>;
+}
+type AggregateVerifierError = {
+  readonly kind: 'introspectionFailure';
+  readonly detail: string;
+};
+type AggregateVerifierOutput<TSchemaResult> = Result<AggregateVerifierSuccess<TSchemaResult>, AggregateVerifierError>;
+/**
+ * Verify a {@link ContractSpaceAggregate} against the live database
+ * state. Bundles two checks:
+ *
+ * - `markerCheck` per member: compare the live marker row against the
+ *   member's `headRef.hash` + `headRef.invariants`. Absence is a
+ *   distinct kind, not an error (callers — `db verify` strict vs
+ *   `db init` precondition — choose how to interpret it).
+ * - `schemaCheck` per member: project the live schema to the slice
+ *   the member claims via {@link projectSchemaToSpace}, then delegate
+ *   to the caller-supplied `verifySchemaForMember`. The pre-projection
+ *   means the family's single-contract verifier no longer sees other
+ *   members' tables as `extras`, so a multi-member deployment never
+ *   surfaces cross-member tables as orphaned schema elements.
+ *
+ * `markerCheck.orphanMarkers` lists every marker row whose `space` is
+ * not a member of the aggregate. `db verify` callers reject orphans;
+ * future tooling may not.
+ *
+ * Pure synchronous function; no I/O. The caller (CLI) gathers
+ * `markersBySpaceId` and `schemaIntrospection` ahead of the call.
+ */
+declare function verifyAggregate<TSchemaResult>(input: AggregateVerifierInput<TSchemaResult>): AggregateVerifierOutput<TSchemaResult>;
+//#endregion
+export { type AggregateCurrentDBState, type AggregateMigrationEdgeRef, type AggregatePerSpacePlan, type AggregatePlannerError, type AggregatePlannerInput, type AggregatePlannerOutput, type AggregatePlannerSuccess, type AggregateVerifierError, type AggregateVerifierInput, type AggregateVerifierOutput, type AggregateVerifierSuccess, type CallerPolicy, type ContractMarkerRecordLike, type ContractSpaceAggregate, type ContractSpaceMember, type DeclaredExtensionEntry, type GraphWalkOutcome, type GraphWalkStrategyInputs, type HydratedMigrationGraph, type LayoutViolation, type LoadAggregateError, type LoadAggregateInput, type LoadAggregateOutput, type MarkerCheckResult, type MarkerCheckSection, type OrphanElement, type SchemaCheckSection, graphWalkStrategy, loadContractSpaceAggregate, planAggregate, projectSchemaToSpace, verifyAggregate };
+//# sourceMappingURL=aggregate.d.mts.map

package/dist/exports/aggregate.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregate.d.mts","names":[],"sources":["../../src/aggregate/types.ts","../../src/aggregate/loader.ts","../../src/aggregate/marker-types.ts","../../src/aggregate/planner-types.ts","../../src/aggregate/planner.ts","../../src/aggregate/project-schema-to-space.ts","../../src/aggregate/strategies/graph-walk.ts","../../src/aggregate/verifier.ts"],"mappings":";;;;;;;;;;;;;;;AAkBA;;;;;;;;UAAiB,sBAAA;EAAA,SACN,KAAA,EAAO,cAAA;EAAA,SACP,uBAAA,EAAyB,WAAA,SAAoB,sBAAA;AAAA;;;;AAwBxD;;;;;;;;;;;;;;AAwCA;;;;UAxCiB,mBAAA;EAAA,SACN,OAAA;EAAA,SACA,QAAA,EAAU,QAAA;EAAA,SACV,OAAA;IAAA,SACE,IAAA;IAAA,SACA,UAAA;EAAA;EAAA,SAEF,UAAA,EAAY,sBAAA;AAAA;;ACnBvB;;;;;AAcA;;;;;;;;;;;;;;;;;;;;;;;;UDsCiB,sBAAA;EAAA,SACN,QAAA;EAAA,SACA,GAAA,EAAK,mBAAA;EAAA,SACL,UAAA,WAAqB,mBAAA;AAAA;;;;;;;;AArEhC;;;;;;;;;;;;;;;UCciB,sBAAA;EAAA,SACN,EAAA;EAAA,SACA,QAAA;AAAA;;;;;;;;;;UAYM,kBAAA;EAAA,SACN,QAAA;EAAA,SACA,aAAA;EAAA,SACA,WAAA,EAAa,QAAA;EAAA,SACb,kBAAA,EAAoB,aAAA,CAAc,sBAAA;EAAA,SAClC,gBAAA,GAAmB,YAAA,cAA0B,QAAA;EDmC7C;;;;;;;;;ACtDX;;;EDsDW,SCtBA,oBAAA,EAAsB,aAAA,CAAc,sBAAA;AAAA;AAlB/C;;;;;;;AAAA,KA4BY,kBAAA;EAAA,SACG,IAAA;EAAA,SAAkC,UAAA,WAAqB,eAAA;AAAA;EAAA,SACvD,IAAA;EAAA,SAAmC,OAAA;EAAA,SAA0B,MAAA;AAAA;EAAA,SAC7D,IAAA;EAAA,SAAoC,OAAA;EAAA,SAA0B,MAAA;AAAA;EAAA,SAE9D,IAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,QAAA;EAAA,SACA,MAAA;AAAA;;;;;;;;;;;;;KAeH,eAAA;EAAA,SACG,IAAA;EAAA,SAAwC,OAAA;AAAA;EAAA,SACxC,IAAA;EAAA,SAAiC,OAAA;AAAA;AAAA,KAEpC,mBAAA,GAAsB,MAAA;EAAA,SACrB,SAAA,EAAW,sBAAA;AAAA,GACtB,kBAAA;;;;;;;;;AAFF;;;;;;;;;;;iBAgCsB,0BAAA,CACpB,KAAA,EAAO,kBAAA,GACN,OAAA,CAAQ,mBAAA;;;;;;;;;;;;AD1HX;;UEPiB,wBAAA;EAAA,SACN,WAAA;EAAA,SACA,UAAA;EAAA,SACA,WAAA;AAAA;;;;;AFIX;;;;;;;;;;;;;;UGaiB,YAAA;EAAA,SACN,cAAA,EAAgB,WAAA;AAAA;;;;;;;;;;;;;AHoD3B;;;;UGjCiB,uBAAA;EAAA,SACN,gBAAA,EAAkB,WAAA,SAAoB,wBAAA;EAAA,SACtC,mBAAA;AAAA;;;;;;;AFrBX;;;;;AAcA;;;UEwBiB,qBAAA;EAAA,SACN,SAAA,EAAW,sBAAA;EAAA,SACX,cAAA,EAAgB,uBAAA;EAAA,SAChB,cAAA,EAAgB,qBAAA,CAAsB,SAAA;EAAA,SACtC,UAAA,EAAY,0BAAA,CACnB,SAAA,EACA,SAAA,EACA,qBAAA,CAAsB,SAAA;EAAA,SAEf,mBAAA,EAAqB,aAAA,CAAc,8BAAA,CAA+B,SAAA,EAAW,SAAA;EAAA,SAC7E,YAAA,EAAc,YAAA;EAAA,SACd,eAAA,EAAiB,wBAAA;AAAA;;;;;;;;;;;;;;;AFP5B;;;;;;;;;AAAA,UEiCiB,yBAAA;EAAA,SACN,aAAA;EAAA,SACA,OAAA;EAAA,SACA,IAAA;EAAA,SACA,EAAA;EAAA,SACA,cAAA;AAAA;AAAA,UAGM,qBAAA;EAAA,SACN,IAAA,EAAM,aAAA;EAAA,SACN,UAAA,WAAqB,sBAAA;EAAA,SACrB,mBAAA,EAAqB,QAAA;EAAA,SACrB,QAAA;EFhCU;AAerB;;;EAfqB,SEqCV,cAAA,YAA0B,yBAAA;EFrBtB;;;;;;AAGf;;;;EAHe,SEgCJ,YAAA,GAAe,YAAA;AAAA;AAAA,UAGT,uBAAA;EAAA,SACN,QAAA,EAAU,WAAA,SAAoB,qBAAA;EFjCP;;;;;;AAgClC;;EAhCkC,SE0CvB,UAAA;AAAA;;;;;;KAQC,qBAAA;EAAA,SACG,IAAA;EAAA,SAA2C,OAAA;EAAA,SAA0B,MAAA;AAAA;EAAA,SAErE,IAAA;EAAA,SACA,OAAA;EAAA,SACA,iBAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA,WAAoB,wBAAA;AAAA;EAAA,SAEpB,IAAA;EAAA,SAAiC,OAAA;EAAA,SAA0B,MAAA;AAAA;AAAA,KAE9D,sBAAA,GAAyB,MAAA,CAAO,uBAAA,EAAyB,qBAAA;;;;;;;;;;AHxJrE;;;;;;;;;;;;;;;iBI0BsB,aAAA,oDAAA,CACpB,KAAA,EAAO,qBAAA,CAAsB,SAAA,EAAW,SAAA,IACvC,OAAA,CAAQ,sBAAA;;;;;;;;;;;AJ5BX;;;;;;;;;;;;;;;AA0BA;;;;;;iBKbgB,oBAAA,CACd,MAAA,WACA,MAAA,EAAQ,mBAAA,EACR,YAAA,EAAc,aAAA,CAAc,mBAAA;;;;;;;;;ALhB9B;;KMDY,gBAAA;EAAA,SACG,IAAA;EAAA,SAAqB,MAAA,EAAQ,qBAAA;AAAA;EAAA,SAC7B,IAAA;AAAA;EAAA,SACA,IAAA;EAAA,SAAgC,OAAA;AAAA;AAAA,UAE9B,uBAAA;EAAA,SACN,iBAAA;EAAA,SACA,MAAA,EAAQ,mBAAA;EAAA,SACR,aAAA,EAAe,wBAAA;ENmBT;;;;;;EAAA,SMZN,OAAA;AAAA;;;;;;;ANoDX;;;;;;;;;iBMlCgB,iBAAA,CAAkB,KAAA,EAAO,uBAAA,GAA0B,gBAAA;;;;;;;;;UCtClD,sBAAA;EAAA,SACN,SAAA,EAAW,sBAAA;EAAA,SACX,gBAAA,EAAkB,WAAA,SAAoB,wBAAA;EAAA,SACtC,mBAAA;EAAA,SACA,IAAA;EPIyB;;;;;;;;;;AAwBpC;;EAxBoC,SOSzB,qBAAA,GACP,eAAA,WACA,MAAA,EAAQ,mBAAA,EACR,IAAA,2BACG,aAAA;AAAA;;;;;;;KASK,iBAAA;EAAA,SACG,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;EAAA,SAEA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,QAAA;AAAA;EAAA,SAEA,IAAA;EAAA,SAAoC,OAAA;AAAA;AAAA,UAElC,kBAAA;EAAA,SACN,QAAA,EAAU,WAAA,SAAoB,iBAAA;EAAA,SAC9B,aAAA;IAAA,SACE,OAAA;IAAA,SACA,GAAA,EAAK,wBAAA;EAAA;AAAA;;;;;ANVlB;;;;;;KMwBY,aAAA;EAAA,SAA2B,IAAA;EAAA,SAAwB,IAAA;AAAA;AAAA,UAE9C,kBAAA;EAAA,SACN,QAAA,EAAU,WAAA,SAAoB,aAAA;ENzB9B;;;;EAAA,SM8BA,cAAA,WAAyB,aAAA;AAAA;AAAA,UAGnB,wBAAA;EAAA,SACN,WAAA,EAAa,kBAAA;EAAA,SACb,WAAA,EAAa,kBAAA,CAAmB,aAAA;AAAA;AAAA,KAG/B,sBAAA;EAAA,SACD,IAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGC,uBAAA,kBAAyC,MAAA,CACnD,wBAAA,CAAyB,aAAA,GACzB,sBAAA;;;;;;;;;;;;;;;;;;;;;;ANSF;iBMgBgB,eAAA,eAAA,CACd,KAAA,EAAO,sBAAA,CAAuB,aAAA,IAC7B,uBAAA,CAAwB,aAAA"}