@prisma-next/migration-tools 0.5.0-dev.9 → 0.6.0-dev.1

package/src/plan-all-spaces.ts

@@ -0,0 +1,76 @@
+import { errorDuplicateSpaceId } from './errors';
+
+/**
+ * Per-space input for {@link planAllSpaces}. One entry per loaded
+ * contract space (the application's `'app'` plus each extension that
+ * exposes a `contractSpace`).
+ *
+ * - `priorContract` is `null` for a space that has never been emitted
+ *   (no `migrations/<space-id>/contract.json` on disk yet); otherwise it
+ *   is the canonical contract value emitted for that space.
+ * - `newContract` is the canonical contract value the planner is about
+ *   to emit for that space — for app-space, the just-emitted root
+ *   `contract.json`; for an extension space, the descriptor's
+ *   `contractSpace.contractJson`.
+ */
+export interface SpacePlanInput<TContract> {
+  readonly spaceId: string;
+  readonly priorContract: TContract | null;
+  readonly newContract: TContract;
+}
+
+export interface SpacePlanOutput<TPackage> {
+  readonly spaceId: string;
+  readonly migrationPackages: readonly TPackage[];
+}
+
+/**
+ * Iterate the per-space planner across a set of loaded contract spaces
+ * and return a deterministic shape regardless of declaration order.
+ *
+ * Behaviour:
+ *
+ * - The output is sorted alphabetically by `spaceId`. Two callers
+ *   passing the same set of inputs in different orders observe
+ *   byte-identical outputs.
+ * - The per-space planner (`planSpace`) is called exactly once per
+ *   input, in alphabetical-by-spaceId order. Its return value is
+ *   attached to the corresponding output entry verbatim.
+ * - Duplicate `spaceId`s in the input array throw
+ *   `MIGRATION.DUPLICATE_SPACE_ID` before any `planSpace` call runs,
+ *   keeping the planner pure when the input is malformed.
+ *
+ * The signature is generic over `TContract` and `TPackage` because the
+ * shape is framework-neutral (SQL family today, Mongo family
+ * eventually). Callers wire in whatever contract value and migration
+ * package shape their family already speaks.
+ *
+ * Synchronous: the underlying per-space planner (target's
+ * `MigrationPlanner.plan(...)`) is synchronous; callers that need to
+ * resolve async I/O (e.g. reading on-disk `contract.json` from disk)
+ * resolve it before calling `planAllSpaces` and pass the materialised
+ * inputs through.
+ */
+export function planAllSpaces<TContract, TPackage>(
+  inputs: readonly SpacePlanInput<TContract>[],
+  planSpace: (input: SpacePlanInput<TContract>) => readonly TPackage[],
+): readonly SpacePlanOutput<TPackage>[] {
+  const seen = new Set<string>();
+  for (const input of inputs) {
+    if (seen.has(input.spaceId)) {
+      throw errorDuplicateSpaceId(input.spaceId);
+    }
+    seen.add(input.spaceId);
+  }
+
+  const sorted = [...inputs].sort((a, b) => {
+    if (a.spaceId < b.spaceId) return -1;
+    if (a.spaceId > b.spaceId) return 1;
+    return 0;
+  });
+
+  return sorted.map((input) => ({
+    spaceId: input.spaceId,
+    migrationPackages: planSpace(input),
+  }));
+}

package/src/read-contract-space-contract.ts

@@ -0,0 +1,44 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'pathe';
+import { errorInvalidJson, errorMissingFile } from './errors';
+import { assertValidSpaceId } from './space-layout';
+
+function hasErrnoCode(error: unknown, code: string): boolean {
+  return error instanceof Error && (error as { code?: string }).code === code;
+}
+
+/**
+ * Read the on-disk contract value for a contract space
+ * (`<projectMigrationsDir>/<spaceId>/contract.json`). Returns the parsed
+ * JSON value as `unknown` — callers that need a typed contract validate
+ * via their family's `validateContract` to surface schema issues.
+ *
+ * Companion to {@link import('./read-contract-space-head-ref').readContractSpaceHeadRef}
+ * — same ENOENT-throws / corrupt-file-error semantics. Returns the
+ * canonical-JSON value the framework wrote during emit, so re-running
+ * this helper across machines / runs yields a byte-identical value.
+ */
+export async function readContractSpaceContract(
+  projectMigrationsDir: string,
+  spaceId: string,
+): Promise<unknown> {
+  assertValidSpaceId(spaceId);
+
+  const filePath = join(projectMigrationsDir, spaceId, 'contract.json');
+
+  let raw: string;
+  try {
+    raw = await readFile(filePath, 'utf-8');
+  } catch (error) {
+    if (hasErrnoCode(error, 'ENOENT')) {
+      throw errorMissingFile('contract.json', join(projectMigrationsDir, spaceId));
+    }
+    throw error;
+  }
+
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));
+  }
+}

package/src/read-contract-space-head-ref.ts

@@ -0,0 +1,63 @@
+import { readFile } from 'node:fs/promises';
+import type { ContractSpaceHeadRef } from '@prisma-next/framework-components/control';
+import { join } from 'pathe';
+import { errorInvalidJson, errorInvalidRefFile } from './errors';
+import { assertValidSpaceId } from './space-layout';
+
+export type { ContractSpaceHeadRef };
+
+function hasErrnoCode(error: unknown, code: string): boolean {
+  return error instanceof Error && (error as { code?: string }).code === code;
+}
+
+/**
+ * Read the head ref (`hash` + `invariants`) for a contract space from
+ * `<projectMigrationsDir>/<spaceId>/refs/head.json`.
+ *
+ * Returns `null` when the file does not exist (first emit). Surfaces
+ * `MIGRATION.INVALID_JSON` / `MIGRATION.INVALID_REF_FILE` on a corrupt
+ * `refs/head.json` so callers can distinguish "no head ref on disk"
+ * (returns `null`) from "head ref present but unreadable" (throws).
+ *
+ * Validates the space id against `[a-z][a-z0-9_-]{0,63}` for the same
+ * filesystem-safety reasons as the rest of the per-space helpers. The
+ * helper is uniform across the app and extension spaces.
+ */
+export async function readContractSpaceHeadRef(
+  projectMigrationsDir: string,
+  spaceId: string,
+): Promise<ContractSpaceHeadRef | null> {
+  assertValidSpaceId(spaceId);
+
+  const filePath = join(projectMigrationsDir, spaceId, 'refs', 'head.json');
+
+  let raw: string;
+  try {
+    raw = await readFile(filePath, 'utf-8');
+  } catch (error) {
+    if (hasErrnoCode(error, 'ENOENT')) {
+      return null;
+    }
+    throw error;
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw errorInvalidJson(filePath, e instanceof Error ? e.message : String(e));
+  }
+
+  if (typeof parsed !== 'object' || parsed === null) {
+    throw errorInvalidRefFile(filePath, 'expected an object');
+  }
+  const obj = parsed as { hash?: unknown; invariants?: unknown };
+  if (typeof obj.hash !== 'string') {
+    throw errorInvalidRefFile(filePath, 'expected an object with a string `hash` field');
+  }
+  if (!Array.isArray(obj.invariants) || obj.invariants.some((value) => typeof value !== 'string')) {
+    throw errorInvalidRefFile(filePath, 'expected an object with an `invariants` array of strings');
+  }
+
+  return { hash: obj.hash, invariants: obj.invariants as readonly string[] };
+}

package/src/space-layout.ts

@@ -0,0 +1,48 @@
+import { APP_SPACE_ID } from '@prisma-next/framework-components/control';
+import { join } from 'pathe';
+import { errorInvalidSpaceId } from './errors';
+
+export { APP_SPACE_ID };
+
+/**
+ * Branded string carrying a compile-time guarantee that the value has
+ * been validated by {@link assertValidSpaceId}. Downstream filesystem
+ * helpers (e.g. {@link spaceMigrationDirectory}) accept this type to
+ * make "validated" tracking visible at the type level rather than
+ * relying purely on a runtime check.
+ */
+export type ValidSpaceId = string & { readonly __brand: 'ValidSpaceId' };
+
+/**
+ * Pattern a contract-space identifier must match. The constraint is
+ * filesystem-friendly: lowercase letters / digits / hyphen / underscore,
+ * starts with a letter, max 64 characters.
+ */
+const SPACE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+
+export function isValidSpaceId(spaceId: string): spaceId is ValidSpaceId {
+  return SPACE_ID_PATTERN.test(spaceId);
+}
+
+export function assertValidSpaceId(spaceId: string): asserts spaceId is ValidSpaceId {
+  if (!isValidSpaceId(spaceId)) {
+    throw errorInvalidSpaceId(spaceId);
+  }
+}
+
+/**
+ * Resolve the migrations subdirectory for a given contract space.
+ *
+ * Every contract space — including the app space (default `'app'`) —
+ * lands under `<projectMigrationsDir>/<spaceId>/`. The space id is
+ * validated against {@link SPACE_ID_PATTERN} because it becomes a
+ * filesystem directory name verbatim.
+ *
+ * `projectMigrationsDir` is the project's top-level `migrations/`
+ * directory; the helper does not assume anything about its absolute /
+ * relative shape and is symmetric with `pathe.join`.
+ */
+export function spaceMigrationDirectory(projectMigrationsDir: string, spaceId: string): string {
+  assertValidSpaceId(spaceId);
+  return join(projectMigrationsDir, spaceId);
+}

package/src/verify-contract-spaces.ts

@@ -0,0 +1,272 @@
+import { readdir, stat } from 'node:fs/promises';
+import { join } from 'pathe';
+import { MANIFEST_FILE } from './io';
+import { APP_SPACE_ID } from './space-layout';
+
+function hasErrnoCode(error: unknown, code: string): boolean {
+  return error instanceof Error && (error as { code?: string }).code === code;
+}
+
+/**
+ * List the per-space subdirectories under
+ * `<projectRoot>/migrations/`. Returns space-id directory names (sorted
+ * alphabetically) — i.e. any non-dot-prefixed subdirectory whose root
+ * does **not** contain a `migration.json` manifest. The manifest is the
+ * structural marker of a user-authored migration directory (see
+ * `readMigrationsDir` in `./io`); directory names themselves belong to
+ * the user and are not part of the contract.
+ *
+ * Returns `[]` if the migrations directory does not exist (greenfield
+ * project).
+ *
+ * Reads only the user's repo. **No descriptor import.** The caller
+ * (verifier) feeds the result into {@link verifyContractSpaces} alongside
+ * the loaded-space set and the marker rows.
+ */
+export async function listContractSpaceDirectories(
+  projectMigrationsDir: string,
+): Promise<readonly string[]> {
+  let entries: { readonly name: string; readonly isDirectory: boolean }[];
+  try {
+    const dirents = await readdir(projectMigrationsDir, { withFileTypes: true });
+    entries = dirents.map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  } catch (error) {
+    if (hasErrnoCode(error, 'ENOENT')) {
+      return [];
+    }
+    throw error;
+  }
+
+  const namedCandidates = entries
+    .filter((e) => e.isDirectory)
+    .map((e) => e.name)
+    .filter((name) => !name.startsWith('.'))
+    .sort();
+
+  const manifestChecks = await Promise.all(
+    namedCandidates.map(async (name) => {
+      try {
+        await stat(join(projectMigrationsDir, name, MANIFEST_FILE));
+        return { name, isMigrationDir: true };
+      } catch (error) {
+        if (hasErrnoCode(error, 'ENOENT')) {
+          return { name, isMigrationDir: false };
+        }
+        throw error;
+      }
+    }),
+  );
+
+  return manifestChecks.filter((c) => !c.isMigrationDir).map((c) => c.name);
+}
+
+/**
+ * On-disk head value (`(hash, invariants)`) for one contract space.
+ * The verifier compares this against the marker row for the same space
+ * to detect drift between the user-emitted artefacts and the live DB
+ * marker.
+ */
+export interface ContractSpaceHeadRecord {
+  readonly hash: string;
+  readonly invariants: readonly string[];
+}
+
+/**
+ * Marker row read from `prisma_contract.marker` (one per `space`).
+ * Caller resolves these via the family runtime's marker reader before
+ * invoking {@link verifyContractSpaces}.
+ */
+export interface SpaceMarkerRecord {
+  readonly hash: string;
+  readonly invariants: readonly string[];
+}
+
+export interface VerifyContractSpacesInputs {
+  /**
+   * Set of contract spaces the project declares: `'app'` plus each
+   * extension space in `extensionPacks`. The caller's discovery path
+   * never reads the extension descriptor module — it walks the
+   * `extensionPacks` configuration in `prisma-next.config.ts` for the
+   * space ids.
+   */
+  readonly loadedSpaces: ReadonlySet<string>;
+
+  /**
+   * Per-space subdirectories observed under
+   * `<projectRoot>/migrations/`. Resolved via
+   * {@link listContractSpaceDirectories}.
+   */
+  readonly spaceDirsOnDisk: readonly string[];
+
+  /**
+   * Head ref per space, keyed by space id. Caller reads
+   * `<projectRoot>/migrations/<space-id>/contract.json` and
+   * `<projectRoot>/migrations/<space-id>/refs/head.json` to construct
+   * this map. Spaces with no contract-space dir on disk simply omit a
+   * map entry.
+   */
+  readonly headRefsBySpace: ReadonlyMap<string, ContractSpaceHeadRecord>;
+
+  /**
+   * Marker rows keyed by `space`. Caller reads them from the
+   * `prisma_contract.marker` table.
+   */
+  readonly markerRowsBySpace: ReadonlyMap<string, SpaceMarkerRecord>;
+}
+
+export type SpaceVerifierViolation =
+  | {
+      readonly kind: 'declaredButUnmigrated';
+      readonly spaceId: string;
+      readonly remediation: string;
+    }
+  | {
+      readonly kind: 'orphanMarker';
+      readonly spaceId: string;
+      readonly remediation: string;
+    }
+  | {
+      readonly kind: 'orphanSpaceDir';
+      readonly spaceId: string;
+      readonly remediation: string;
+    }
+  | {
+      readonly kind: 'hashMismatch';
+      readonly spaceId: string;
+      readonly priorHeadHash: string;
+      readonly markerHash: string;
+      readonly remediation: string;
+    }
+  | {
+      readonly kind: 'invariantsMismatch';
+      readonly spaceId: string;
+      readonly onDiskInvariants: readonly string[];
+      readonly markerInvariants: readonly string[];
+      readonly remediation: string;
+    };
+
+export type VerifyContractSpacesResult =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly violations: readonly SpaceVerifierViolation[] };
+
+/**
+ * Pure structural verifier for the per-space mechanism. Aggregates the
+ * three orphan / missing checks plus per-space hash and invariant
+ * comparison.
+ *
+ * Algorithm:
+ *
+ * - For every extension space declared in `loadedSpaces` (`'app'`
+ *   excluded — the per-space verifier is scoped to extension members;
+ *   the app is verified through the aggregate path):
+ *   - If no contract-space dir on disk → `declaredButUnmigrated`.
+ *   - Else if `markerRowsBySpace` lacks an entry → no violation here;
+ *     the live-DB compare done outside this helper is where the
+ *     absence shows up.
+ *   - Else compare marker hash / invariants vs. on-disk head hash /
+ *     invariants → `hashMismatch` / `invariantsMismatch` on drift.
+ * - For every contract-space dir on disk that is not in `loadedSpaces` →
+ *   `orphanSpaceDir`.
+ * - For every marker row whose `space` is not in `loadedSpaces` →
+ *   `orphanMarker`. The app-space marker is always loaded (`'app'` is
+ *   in `loadedSpaces` by definition).
+ *
+ * Output is deterministic: violations are sorted first by `kind`
+ * (`declaredButUnmigrated` → `orphanMarker` → `orphanSpaceDir` →
+ * `hashMismatch` → `invariantsMismatch`) then by `spaceId`. Two callers
+ * passing equivalent inputs see byte-identical violation lists.
+ *
+ * Synchronous, pure, no I/O. **Does not import the extension descriptor**
+ * (the inputs are pre-resolved by the caller); the verifier reads only
+ * the user repo, not `node_modules`.
+ */
+export function verifyContractSpaces(
+  inputs: VerifyContractSpacesInputs,
+): VerifyContractSpacesResult {
+  const violations: SpaceVerifierViolation[] = [];
+
+  for (const spaceId of [...inputs.loadedSpaces].sort()) {
+    if (spaceId === APP_SPACE_ID) continue;
+
+    if (!inputs.spaceDirsOnDisk.includes(spaceId)) {
+      violations.push({
+        kind: 'declaredButUnmigrated',
+        spaceId,
+        remediation: `Extension '${spaceId}' is declared in extensionPacks but has not been emitted; run \`prisma-next migrate\`.`,
+      });
+      continue;
+    }
+
+    const head = inputs.headRefsBySpace.get(spaceId);
+    const marker = inputs.markerRowsBySpace.get(spaceId);
+    if (!head || !marker) {
+      continue;
+    }
+
+    if (head.hash !== marker.hash) {
+      violations.push({
+        kind: 'hashMismatch',
+        spaceId,
+        priorHeadHash: head.hash,
+        markerHash: marker.hash,
+        remediation: `Marker row for space '${spaceId}' is keyed at ${marker.hash}, but the on-disk ${join('migrations', spaceId, 'contract.json')} resolves to ${head.hash}. Run \`prisma-next db update\` to advance the database, or \`prisma-next migrate\` if the descriptor was bumped without re-emitting.`,
+      });
+      continue;
+    }
+
+    const onDiskInvariants = [...head.invariants].sort();
+    const markerInvariants = new Set(marker.invariants);
+    const missing = onDiskInvariants.filter((id) => !markerInvariants.has(id));
+    if (missing.length > 0) {
+      violations.push({
+        kind: 'invariantsMismatch',
+        spaceId,
+        onDiskInvariants,
+        markerInvariants: [...marker.invariants].sort(),
+        remediation: `Marker row for space '${spaceId}' is missing invariants [${missing.map((s) => JSON.stringify(s)).join(', ')}]. Run \`prisma-next db update\` to apply the corresponding data-transform migrations.`,
+      });
+    }
+  }
+
+  for (const dir of [...inputs.spaceDirsOnDisk].sort()) {
+    if (!inputs.loadedSpaces.has(dir)) {
+      violations.push({
+        kind: 'orphanSpaceDir',
+        spaceId: dir,
+        remediation: `Orphan contract-space directory \`${join('migrations', dir)}/\` for an extension not in extensionPacks; remove the directory or re-add the extension.`,
+      });
+    }
+  }
+
+  for (const space of [...inputs.markerRowsBySpace.keys()].sort()) {
+    if (!inputs.loadedSpaces.has(space)) {
+      violations.push({
+        kind: 'orphanMarker',
+        spaceId: space,
+        remediation: `Orphan marker row for space '${space}' (no longer in extensionPacks); remediation: manually delete the row from \`prisma_contract.marker\`.`,
+      });
+    }
+  }
+
+  if (violations.length === 0) {
+    return { ok: true };
+  }
+
+  const kindOrder: Record<SpaceVerifierViolation['kind'], number> = {
+    declaredButUnmigrated: 0,
+    orphanMarker: 1,
+    orphanSpaceDir: 2,
+    hashMismatch: 3,
+    invariantsMismatch: 4,
+  };
+
+  violations.sort((a, b) => {
+    const k = kindOrder[a.kind] - kindOrder[b.kind];
+    if (k !== 0) return k;
+    if (a.spaceId < b.spaceId) return -1;
+    if (a.spaceId > b.spaceId) return 1;
+    return 0;
+  });
+
+  return { ok: false, violations };
+}

package/dist/attestation-BnzTb0Qp.mjs

@@ -1,65 +0,0 @@
-import { r as readMigrationPackage } from "./io-Cd6GLyjK.mjs";
-import { createHash } from "node:crypto";
-
-//#region src/canonicalize-json.ts
-function sortKeys(value) {
-	if (value === null || typeof value !== "object") return value;
-	if (Array.isArray(value)) return value.map(sortKeys);
-	const sorted = {};
-	for (const key of Object.keys(value).sort()) sorted[key] = sortKeys(value[key]);
-	return sorted;
-}
-function canonicalizeJson(value) {
-	return JSON.stringify(sortKeys(value));
-}
-
-//#endregion
-//#region src/attestation.ts
-function sha256Hex(input) {
-	return createHash("sha256").update(input).digest("hex");
-}
-/**
-* Content-addressed migration identity over (manifest envelope sans
-* contracts/hints, ops). See ADR 199 "Storage-only migration identity"
-* for the rationale: contracts are anchored separately by the
-* storage-hash bookends inside the envelope; planner hints are advisory
-* and must not affect identity.
-*
-* The `migrationId` field on the manifest is stripped before hashing so
-* the function can be used both at write time (when no id exists yet)
-* and at verify time (rehashing an already-attested manifest).
-*/
-function computeMigrationId(manifest, ops) {
-	const { migrationId: _migrationId, signature: _signature, fromContract: _fromContract, toContract: _toContract, hints: _hints, ...strippedMeta } = manifest;
-	return `sha256:${sha256Hex(canonicalizeJson([canonicalizeJson(strippedMeta), canonicalizeJson(ops)].map(sha256Hex)))}`;
-}
-/**
-* Re-hash an on-disk migration bundle and compare against the stored
-* `migrationId`. Returns `{ ok: true }` when the package is internally
-* consistent (manifest + ops still produce the recorded id), or
-* `{ ok: false, reason: 'mismatch', stored, computed }` when they do
-* not — typically a sign of FS corruption, partial writes, or a
-* post-emit hand edit.
-*/
-function verifyMigrationBundle(bundle) {
-	const computed = computeMigrationId(bundle.manifest, bundle.ops);
-	if (bundle.manifest.migrationId === computed) return {
-		ok: true,
-		storedMigrationId: bundle.manifest.migrationId,
-		computedMigrationId: computed
-	};
-	return {
-		ok: false,
-		reason: "mismatch",
-		storedMigrationId: bundle.manifest.migrationId,
-		computedMigrationId: computed
-	};
-}
-/** Convenience wrapper: read the package from disk then verify it. */
-async function verifyMigration(dir) {
-	return verifyMigrationBundle(await readMigrationPackage(dir));
-}
-
-//#endregion
-export { verifyMigration as n, verifyMigrationBundle as r, computeMigrationId as t };
-//# sourceMappingURL=attestation-BnzTb0Qp.mjs.map

package/dist/attestation-BnzTb0Qp.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"attestation-BnzTb0Qp.mjs","names":["sorted: Record<string, unknown>"],"sources":["../src/canonicalize-json.ts","../src/attestation.ts"],"sourcesContent":["function sortKeys(value: unknown): unknown {\n  if (value === null || typeof value !== 'object') {\n    return value;\n  }\n  if (Array.isArray(value)) {\n    return value.map(sortKeys);\n  }\n  const sorted: Record<string, unknown> = {};\n  for (const key of Object.keys(value).sort()) {\n    sorted[key] = sortKeys((value as Record<string, unknown>)[key]);\n  }\n  return sorted;\n}\n\nexport function canonicalizeJson(value: unknown): string {\n  return JSON.stringify(sortKeys(value));\n}\n","import { createHash } from 'node:crypto';\nimport { canonicalizeJson } from './canonicalize-json';\nimport { readMigrationPackage } from './io';\nimport type { MigrationBundle, MigrationManifest, MigrationOps } from './types';\n\nexport interface VerifyResult {\n  readonly ok: boolean;\n  readonly reason?: 'mismatch';\n  readonly storedMigrationId?: string;\n  readonly computedMigrationId?: string;\n}\n\nfunction sha256Hex(input: string): string {\n  return createHash('sha256').update(input).digest('hex');\n}\n\n/**\n * Content-addressed migration identity over (manifest envelope sans\n * contracts/hints, ops). See ADR 199 \"Storage-only migration identity\"\n * for the rationale: contracts are anchored separately by the\n * storage-hash bookends inside the envelope; planner hints are advisory\n * and must not affect identity.\n *\n * The `migrationId` field on the manifest is stripped before hashing so\n * the function can be used both at write time (when no id exists yet)\n * and at verify time (rehashing an already-attested manifest).\n */\nexport function computeMigrationId(\n  manifest: Omit<MigrationManifest, 'migrationId'> & { readonly migrationId?: string },\n  ops: MigrationOps,\n): string {\n  const {\n    migrationId: _migrationId,\n    signature: _signature,\n    fromContract: _fromContract,\n    toContract: _toContract,\n    hints: _hints,\n    ...strippedMeta\n  } = manifest;\n\n  const canonicalManifest = canonicalizeJson(strippedMeta);\n  const canonicalOps = canonicalizeJson(ops);\n\n  const partHashes = [canonicalManifest, canonicalOps].map(sha256Hex);\n  const hash = sha256Hex(canonicalizeJson(partHashes));\n\n  return `sha256:${hash}`;\n}\n\n/**\n * Re-hash an on-disk migration bundle and compare against the stored\n * `migrationId`. Returns `{ ok: true }` when the package is internally\n * consistent (manifest + ops still produce the recorded id), or\n * `{ ok: false, reason: 'mismatch', stored, computed }` when they do\n * not — typically a sign of FS corruption, partial writes, or a\n * post-emit hand edit.\n */\nexport function verifyMigrationBundle(bundle: MigrationBundle): VerifyResult {\n  const computed = computeMigrationId(bundle.manifest, bundle.ops);\n\n  if (bundle.manifest.migrationId === computed) {\n    return {\n      ok: true,\n      storedMigrationId: bundle.manifest.migrationId,\n      computedMigrationId: computed,\n    };\n  }\n\n  return {\n    ok: false,\n    reason: 'mismatch',\n    storedMigrationId: bundle.manifest.migrationId,\n    computedMigrationId: computed,\n  };\n}\n\n/** Convenience wrapper: read the package from disk then verify it. */\nexport async function verifyMigration(dir: string): Promise<VerifyResult> {\n  const pkg = await readMigrationPackage(dir);\n  return verifyMigrationBundle(pkg);\n}\n"],"mappings":";;;;AAAA,SAAS,SAAS,OAAyB;AACzC,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO;AAET,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,IAAI,SAAS;CAE5B,MAAMA,SAAkC,EAAE;AAC1C,MAAK,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,MAAM,CACzC,QAAO,OAAO,SAAU,MAAkC,KAAK;AAEjE,QAAO;;AAGT,SAAgB,iBAAiB,OAAwB;AACvD,QAAO,KAAK,UAAU,SAAS,MAAM,CAAC;;;;;ACHxC,SAAS,UAAU,OAAuB;AACxC,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;;;;;AAczD,SAAgB,mBACd,UACA,KACQ;CACR,MAAM,EACJ,aAAa,cACb,WAAW,YACX,cAAc,eACd,YAAY,aACZ,OAAO,QACP,GAAG,iBACD;AAQJ,QAAO,UAFM,UAAU,iBADJ,CAHO,iBAAiB,aAAa,EACnC,iBAAiB,IAAI,CAEU,CAAC,IAAI,UAAU,CAChB,CAAC;;;;;;;;;;AAatD,SAAgB,sBAAsB,QAAuC;CAC3E,MAAM,WAAW,mBAAmB,OAAO,UAAU,OAAO,IAAI;AAEhE,KAAI,OAAO,SAAS,gBAAgB,SAClC,QAAO;EACL,IAAI;EACJ,mBAAmB,OAAO,SAAS;EACnC,qBAAqB;EACtB;AAGH,QAAO;EACL,IAAI;EACJ,QAAQ;EACR,mBAAmB,OAAO,SAAS;EACnC,qBAAqB;EACtB;;;AAIH,eAAsB,gBAAgB,KAAoC;AAExE,QAAO,sBADK,MAAM,qBAAqB,IAAI,CACV"}