@prisma/orm-toolchain 0.16.0-dev.36

package/dist/aggregate-BflrjWPO.d.mts

@@ -0,0 +1,803 @@
+import { i as Refs, r as RefLoadProblem } from "./refs-BNCUu58Y-BIso5Jfg.mjs";
+import { n as MigrationGraph } from "./graph-bDjJ4GL9-BhFevsJS.mjs";
+import { n as OnDiskMigrationPackage } from "./package-CfWiDNrr-ZR4HM_Iz.mjs";
+import { t as ContractSpaceHeadRecord } from "./verify-contract-spaces-Cc1u_wJo-BilPJS2S.mjs";
+import { t as PackageLoadProblem } from "./io-sr4CO9_t-C3eV_kn-.mjs";
+import { t as PathDecision } from "./migration-graph-tarTxJ99-BrGBANeE.mjs";
+import { Result } from "@prisma/orm-framework/utils/result";
+import { ControlAdapterInstance, ControlFamilyInstance, DiffSubjectGranularity, MigrationOperationPolicy, MigrationPlan, MigrationPlanOperation, MigrationPlannerConflict, SchemaDiffIssue, SchemaEntityCoordinate, SchemaOwnership, TargetMigrationsCapability, VerifyDatabaseSchemaResult } from "@prisma/orm-framework/components/control";
+import { TargetBoundComponentDescriptor } from "@prisma/orm-framework/components/components";
+import { Contract, StorageNamespace } from "@prisma/orm-framework/contract/types";
+//#region ../../../1-framework/3-tooling/migration/dist/exports/aggregate.d.mts
+//#region src/integrity-violation.d.ts
+/**
+ * Every structural problem the migration model can carry.
+ *
+ * Violations come in three groups:
+ *
+ * - **Recoverable**: the package or space is retained in the model;
+ *   the violation is surfaced for policy (report, refuse, or ignore
+ *   depending on the command).
+ * - **Config/contract-dependent**: produced only when the matching
+ *   `IntegrityQueryOptions` opt is set (declaredExtensions /
+ *   checkContracts). The model is built without them; they surface
+ *   when the caller explicitly asks for the broader integrity view.
+ * - **Unloadable**: the package is omitted from the model entirely
+ *   (its on-disk content cannot be parsed into an `OnDiskMigrationPackage`).
+ *
+ * `checkIntegrity()` on `ContractSpaceAggregate` returns the full set —
+ * all violations across all spaces — never bailing at the first hit.
+ */
+type IntegrityViolation = {
+  readonly kind: 'sameSourceAndTarget';
+  readonly spaceId: string;
+  readonly dirName: string;
+  readonly hash: string;
+} | {
+  readonly kind: 'hashMismatch';
+  readonly spaceId: string;
+  readonly dirName: string;
+  readonly stored: string;
+  readonly computed: string;
+} | {
+  readonly kind: 'providedInvariantsMismatch';
+  readonly spaceId: string;
+  readonly dirName: string;
+} | {
+  readonly kind: 'headRefMissing';
+  readonly spaceId: string;
+} | {
+  readonly kind: 'headRefNotInGraph';
+  readonly spaceId: string;
+  readonly hash: string;
+} | {
+  readonly kind: 'duplicateMigrationHash';
+  readonly spaceId: string;
+  readonly migrationHash: string;
+  readonly dirNames: readonly string[];
+} | {
+  readonly kind: 'refUnreadable';
+  readonly spaceId: string;
+  readonly refName: string;
+  readonly detail: string;
+} | {
+  readonly kind: 'orphanSpaceDir';
+  readonly spaceId: string;
+} | {
+  readonly kind: 'declaredButUnmigrated';
+  readonly spaceId: string;
+} | {
+  readonly kind: 'targetMismatch';
+  readonly spaceId: string;
+  readonly expected: string;
+  readonly actual: string;
+} | {
+  readonly kind: 'disjointness';
+  readonly element: string;
+  readonly claimedBy: readonly string[];
+} | {
+  readonly kind: 'contractUnreadable';
+  readonly spaceId: string;
+  readonly detail: string;
+} | {
+  readonly kind: 'packageUnloadable';
+  readonly spaceId: string;
+  readonly dirName: string;
+  readonly detail: string;
+};
+/**
+ * One declared extension entry, drawn from `Config.extensions`.
+ *
+ * The integrity layer needs only:
+ *
+ * - `id` — the space id (also the directory name under `migrations/`),
+ *   used for the layout-drift checks (`orphanSpaceDir` /
+ *   `declaredButUnmigrated`).
+ * - `targetId` — the target the declaring extension was configured for.
+ *
+ * Typed structurally so the migration-tools layer stays framework-neutral.
+ */
+interface DeclaredExtensionEntry {
+  readonly id: string;
+  readonly targetId: string;
+}
+/**
+ * Options controlling which config/contract-dependent violation checks
+ * `checkIntegrity()` runs.
+ *
+ * Both opts default to disabled: a caller without the app contract or
+ * declared extensions still gets the structurally-derivable violations
+ * (hashMismatch, providedInvariantsMismatch, headRefMissing,
+ * headRefNotInGraph, refUnreadable, sameSourceAndTarget, packageUnloadable).
+ */
+interface IntegrityQueryOptions {
+  /**
+   * When provided, enables layout-drift checks: `orphanSpaceDir`
+   * (a directory exists on disk for an extension not in the list) and
+   * `declaredButUnmigrated` (an extension in the list has no on-disk dir).
+   */
+  readonly declaredExtensions?: readonly DeclaredExtensionEntry[];
+  /**
+   * When true, enables contract/disjointness/target checks:
+   * `contractUnreadable`, `targetMismatch`, `disjointness`.
+   */
+  readonly checkContracts?: boolean;
+}
+//#endregion
+//#region src/aggregate/types.d.ts
+interface ContractAtOptions {
+  readonly refName?: string;
+}
+type ContractAtResult = {
+  readonly provenance: 'ref';
+  readonly hash: string;
+  readonly contractJson: unknown;
+  readonly contractDts: string;
+  readonly contract: Contract;
+} | {
+  readonly provenance: 'graph-node';
+  readonly hash: string;
+  readonly contractJson: unknown;
+  readonly contractDts: string;
+  readonly contract: Contract;
+};
+/**
+ * One contract space — app or extension — as the aggregate holds it.
+ * Every space in a {@link ContractSpaceAggregate} has the same shape.
+ *
+ * A value of this type is a tolerant snapshot of one space's on-disk state, not a
+ * validated value: `packages` is the raw migration-package list as read
+ * from disk (a hash- or invariants-mismatched package is retained here;
+ * a genuinely unparseable one is omitted), and integrity is judged
+ * separately by {@link ContractSpaceAggregate.checkIntegrity}.
+ *
+ * - `spaceId`: `'app'` for the application, otherwise the extension's
+ *   id (validated against `[a-z][a-z0-9_-]{0,63}`).
+ * - `packages`: raw on-disk migration packages, as read; never
+ *   integrity-validated at load.
+ * - `refs`: the user-authored refs under `migrations/<spaceId>/refs/*.json`.
+ * - `headRef`: the system head ref read from
+ *   `migrations/<spaceId>/refs/head.json`, or `null` when absent
+ *   (represented as a `headRefMissing` violation, never fatal). The app
+ *   space's head ref is always synthesised from its live contract's
+ *   storage hash, so it is never `null`.
+ * - `graph()`: the migration graph this space's packages induce —
+ *   lazily reconstructed on first call and memoised. Pure structure: a
+ *   `from === to` self-edge is represented, not rejected.
+ * - `contract()`: the deserialized contract for this space — lazily
+ *   produced on first call and memoised. For the app it is the live
+ *   contract the caller supplied; for an extension it is the contract
+ *   snapshot store entry keyed by the space's head ref hash, run through
+ *   the family's `deserializeContract`. Throws if the store entry is
+ *   missing or undeserializable (surfaced as `contractUnreadable` by
+ *   `checkIntegrity` under `checkContracts`); callers gate before
+ *   querying it.
+ * - `contractAt(hash, opts?)`: materializes the contract at an arbitrary
+ *   graph node — when `opts.refName` is set, resolve the ref's pointer
+ *   and read the contract snapshot store entry keyed by the pointer's
+ *   hash; else find the package whose `metadata.to === hash` and read
+ *   the contract snapshot store entry keyed by that hash. Lazy per
+ *   `(hash, refName?)` memoisation; throws typed {@link MigrationToolsError}
+ *   values compatible with CLI mappers.
+ */
+interface AggregateContractSpace {
+  readonly spaceId: string;
+  readonly packages: readonly OnDiskMigrationPackage[];
+  readonly refs: Refs;
+  readonly headRef: ContractSpaceHeadRecord | null;
+  graph(): MigrationGraph;
+  contract(): Contract;
+  contractAt(hash: string, opts?: ContractAtOptions): Promise<ContractAtResult>;
+}
+/**
+ * Tolerant, queryable snapshot of a project's on-disk migration state:
+ * the app contract space plus every extension contract space, each a
+ * {@link AggregateContractSpace}.
+ *
+ * Produced once per CLI invocation by `loadContractSpaceAggregate`.
+ * Building the aggregate never throws on disk content; every consumer
+ * obtains spaces / packages / refs / graphs from this one value rather
+ * than re-deriving them from disk.
+ *
+ * - `targetId`: the app contract's target; every space is expected to
+ *   share it (a mismatch surfaces as a `targetMismatch` violation under
+ *   `checkContracts`).
+ * - `app` / `extensions`: retained as fields for the existing planner /
+ *   verifier / runner consumers. `extensions` is sorted alphabetically
+ *   by `spaceId` (the apply-ordering convention).
+ * - `listSpaces()` / `hasSpace()` / `space()` / `spaces()`: the query
+ *   surface the read commands consume — `app` first, then extension ids
+ *   lex-ascending.
+ * - `declaresEntity(coordinate)` / `declaringSpaces(coordinate)`: ownership
+ *   queries — does any contract space declare a storage entity at this
+ *   coordinate (namespace, entity kind, and name), and which spaces do? The verifier's
+ *   unclaimed-elements pass asks these of the diff's extra findings; the
+ *   migration planner asks `declaresEntity` per live extra node to decide
+ *   whether some space owns it (the aggregate satisfies the framework
+ *   {@link SchemaOwnership} oracle). The passive aggregate answers both; it
+ *   runs no diff.
+ * - `checkIntegrity()`: judges the loaded model and returns every
+ *   violation (never bailing at the first). Config/contract-dependent
+ *   checks run only when the matching {@link IntegrityQueryOptions} opt
+ *   is set.
+ */
+interface ContractSpaceAggregate extends SchemaOwnership {
+  readonly targetId: string;
+  readonly app: AggregateContractSpace;
+  readonly extensions: readonly AggregateContractSpace[];
+  listSpaces(): readonly string[];
+  hasSpace(id: string): boolean;
+  space(id: string): AggregateContractSpace | undefined;
+  spaces(): readonly AggregateContractSpace[];
+  declaresEntity(coordinate: SchemaEntityCoordinate): boolean;
+  declaringSpaces(coordinate: SchemaEntityCoordinate): readonly string[];
+  checkIntegrity(opts?: IntegrityQueryOptions): readonly IntegrityViolation[];
+}
+//#endregion
+//#region src/aggregate/aggregate.d.ts
+/**
+ * Resolve a contract space's head ref, asserting it is present. The apply/verify
+ * engine only runs after `checkIntegrity` has refused on `headRefMissing`,
+ * so a space reaching the planner / verifier without a head ref is a
+ * programming error (the integrity gate was skipped), not a user-facing
+ * state. The app space's head ref is always synthesised, so this only
+ * ever guards an ungated extension space.
+ */
+declare function requireHeadRef(space: AggregateContractSpace): ContractSpaceHeadRecord;
+/**
+ * Build a {@link AggregateContractSpace} with lazily-memoised `graph()`,
+ * `contract()`, and `contractAt()` facets.
+ *
+ * `graph()` reconstructs the migration graph from `packages` on first
+ * call and caches it. `contract()` calls `resolveContract` on first call
+ * and caches the result; a throwing `resolveContract` (e.g. a missing or
+ * undeserializable on-disk contract) re-throws on each call rather than
+ * caching a value — `checkIntegrity` surfaces that as `contractUnreadable`.
+ * `contractAt()` materializes the contract at an arbitrary graph node with
+ * the same resolution order as plan-time ref resolution: the ref's pointer
+ * plus the store entry keyed by the pointer's hash first (when
+ * `opts.refName` is set), else the contract snapshot store entry keyed by
+ * the matching package's `to` hash.
+ */
+declare function createAggregateContractSpace(args: {
+  readonly spaceId: string;
+  readonly packages: readonly OnDiskMigrationPackage[];
+  readonly refs: Refs;
+  readonly headRef: ContractSpaceHeadRecord | null;
+  readonly refsDir: string;
+  readonly migrationsDir: string;
+  readonly resolveContract: () => Contract;
+  readonly deserializeContract: (raw: unknown) => Contract;
+}): AggregateContractSpace;
+/**
+ * Collect the union of every namespace declared across all contract spaces of an
+ * aggregate (app + extensions) and return a minimal object with the shape
+ * `{ storage: { namespaces } }` suitable for passing to
+ * `familyInstance.introspect`.
+ *
+ * Callers invoke this after the integrity gate (`buildContractSpaceAggregate`
+ * with `checkContracts: true`), so every `space.contract()` call is safe —
+ * no try/catch is needed here.
+ */
+declare function collectAggregateNamespaces(aggregate: ContractSpaceAggregate): {
+  readonly storage: {
+    readonly namespaces: Readonly<Record<string, StorageNamespace>>;
+  };
+};
+/**
+ * Assemble a {@link ContractSpaceAggregate} value from its contract spaces and a
+ * `checkIntegrity` implementation. The query methods (`listSpaces` /
+ * `hasSpace` / `space` / `spaces`) are derived here so every aggregate —
+ * loader-built or test-built — shares one query surface: `app` first,
+ * then `extensions` in the order supplied (the loader sorts them
+ * lex-ascending by `spaceId`).
+ */
+declare function createContractSpaceAggregate(args: {
+  readonly targetId: string;
+  readonly app: AggregateContractSpace;
+  readonly extensions: readonly AggregateContractSpace[];
+  readonly checkIntegrity: (opts?: IntegrityQueryOptions) => readonly IntegrityViolation[];
+}): ContractSpaceAggregate;
+//#endregion
+//#region src/aggregate/all-external.d.ts
+/**
+ * True when every storage element the contract declares resolves to the
+ * `external` control policy (ADR 224) — element-level `control` first, the
+ * contract's `defaultControlPolicy` otherwise. A contract with no storage
+ * elements is vacuously all-external.
+ *
+ * This is the precondition for advancing a contract space's marker without
+ * any migrations (the declared-state resolution the db-init aggregate
+ * planner and `migrate` share): only when nothing in the space is
+ * Prisma-Next-managed can the storage structure be correct without a
+ * migration having produced it. Any space that declares a managed element
+ * but ships no migration graph is an authoring bug and must fail loudly.
+ */
+declare function allStorageElementsExternal(contract: Contract): boolean;
+//#endregion
+//#region src/aggregate/check-integrity.d.ts
+/**
+ * One space's load-time facts that `checkIntegrity` judges: the loaded
+ * contract space, the load-time problems `readMigrationsDir` surfaced for it, and
+ * whether it is the app space (the app head ref is synthesised, so the
+ * head-ref checks are skipped for it).
+ */
+interface IntegritySpaceState {
+  readonly space: AggregateContractSpace;
+  readonly problems: readonly PackageLoadProblem[];
+  /** Per-ref problems: a user ref `*.json` that exists but is unparseable. */
+  readonly refProblems: readonly RefLoadProblem[];
+  /**
+   * The space's `refs/head.json` problem when it exists but is unparseable.
+   * `null` means the head ref was read cleanly or is genuinely absent —
+   * the absent case is judged `headRefMissing`, the corrupt case here is
+   * judged `refUnreadable` (and suppresses `headRefMissing`).
+   *
+   * Always `null` for the app space — the app head ref is synthesised from
+   * the live contract, so there is no on-disk `head.json` to read or fail on.
+   */
+  readonly headRefProblem: RefLoadProblem | null;
+  readonly isApp: boolean;
+}
+interface IntegrityComputationInput {
+  readonly targetId: string;
+  readonly spaces: readonly IntegritySpaceState[];
+}
+/**
+ * Walk the loaded model and return **every** integrity violation — never
+ * bailing at the first. Structurally-derivable violations (load-time
+ * problems, self-edges, missing / unreachable head refs) are always
+ * produced; layout-drift checks require `declaredExtensions`, and
+ * contract / target / disjointness checks require `checkContracts`.
+ */
+declare function computeIntegrityViolations(input: IntegrityComputationInput, opts?: IntegrityQueryOptions): readonly IntegrityViolation[];
+declare function loadProblemToViolation(spaceId: string, problem: PackageLoadProblem): IntegrityViolation;
+//#endregion
+//#region src/aggregate/marker-types.d.ts
+/**
+ * Structural shape the aggregate planner / verifier accept for marker
+ * rows. Mirrors `family.readAllMarkers(...)` outputs across SQL and
+ * Mongo families: a `(storageHash, invariants)` pair plus an optional
+ * `profileHash` the verifier uses to align the marker with the
+ * destination contract's profile envelope.
+ *
+ * Typed structurally so `migration-tools` stays framework-neutral; SQL
+ * and Mongo families pass their typed `ContractMarkerRecord` through
+ * unchanged.
+ */
+interface ContractMarkerRecordLike {
+  readonly storageHash: string;
+  readonly invariants: readonly string[];
+  readonly profileHash?: string;
+}
+//#endregion
+//#region src/aggregate/planner-types.d.ts
+/**
+ * Caller-provided policy for {@link planMigration}. Today this carries
+ * just one knob:
+ *
+ * - `ignoreGraphFor`: `Set<spaceId>`. For listed contract spaces, the planner
+ *   forces **`planFromDiff`** (fabricate a plan from a diff against the
+ *   contract IR via `familyInstance.createPlanner(...).plan(...)`)
+ *   regardless of whether a graph is available. The CLI's daily-driver
+ *   `db init` / `db update` pipelines pass `new Set([aggregate.app.spaceId])`
+ *   to keep today's app-space behaviour: the user's authored
+ *   `migrations/` directory is **not** walked for the app space, the
+ *   plan is fabricated on the fly. Extension spaces are walked.
+ *
+ *   Listing a contract space here whose `headRef.invariants` is non-empty is
+ *   a `policyConflict` — a diff-fabricated plan cannot satisfy authored
+ *   invariants.
+ */
+interface CallerPolicy {
+  readonly ignoreGraphFor: ReadonlySet<string>;
+}
+/**
+ * Snapshot of the live database state the planner needs to drive
+ * strategy selection.
+ *
+ * - `markersBySpaceId`: per-space marker rows. Absent entry = no
+ *   marker yet (greenfield space). The planner treats the marker's
+ *   `storageHash` as the recorded-path resolution's `from` node, falling
+ *   back to {@link import('../constants').EMPTY_CONTRACT_HASH} when absent.
+ * - `schemaIntrospection`: the family's full live schema IR. Fed into
+ *   `planFromDiff` in full; the aggregate itself is handed to the planner as
+ *   an ownership oracle, which the planner asks per live extra node whether
+ *   any space owns it — no schema is pruned up front, and the planner never
+ *   drops a node a sibling space owns.
+ *
+ * Callers (CLI commands) gather this via the family's
+ * `readAllMarkers` + `introspect` calls before invoking the planner.
+ * The planner itself does not touch the database.
+ */
+interface AggregateCurrentDBState {
+  readonly markersBySpaceId: ReadonlyMap<string, ContractMarkerRecordLike | null>;
+  readonly schemaIntrospection: unknown;
+}
+/**
+ * Inputs to {@link planMigration}.
+ *
+ * The planner is target-agnostic but family-aware: per-space
+ * `planFromDiff` delegates to the family's `createPlanner(adapter).plan(...)`,
+ * which is why `adapter`, `migrations` (the
+ * `TargetMigrationsCapability`), and `frameworkComponents` are all
+ * threaded through. (`frameworkComponents` is passed verbatim into
+ * `planner.plan(...)` per ADR 212; the planner does not interpret it.)
+ *
+ * The planner does **not** receive a `targetId` separately —
+ * it reads `aggregate.targetId` and stamps it onto every emitted
+ * `MigrationPlan` from construction. No placeholder, no patch step.
+ */
+interface PlannerInput<TFamilyId extends string, TTargetId extends string> {
+  readonly aggregate: ContractSpaceAggregate;
+  readonly currentDBState: AggregateCurrentDBState;
+  readonly adapter: ControlAdapterInstance<TFamilyId, TTargetId>;
+  readonly migrations: TargetMigrationsCapability<TFamilyId, TTargetId, ControlFamilyInstance<TFamilyId, unknown>>;
+  readonly frameworkComponents: ReadonlyArray<TargetBoundComponentDescriptor<TFamilyId, TTargetId>>;
+  readonly callerPolicy: CallerPolicy;
+  readonly operationPolicy: MigrationOperationPolicy;
+}
+/**
+ * Per-space output of the planner. The runner ingests this
+ * shape directly via a thin `toRunnerInput` adapter at the CLI.
+ *
+ * - `plan`: ready-to-execute `MigrationPlan` with `targetId` already
+ *   set from `aggregate.targetId`.
+ * - `displayOps`: same operation list, surfaced separately so plan-mode
+ *   output can render without touching the runner-bound `plan`.
+ * - `destinationContract`: the typed contract value the runner uses
+ *   for post-apply verification. For the app space, the user's
+ *   contract; for extension spaces, the on-disk `contract.json`.
+ * - `strategy`: which operation produced this plan — `'resolve-recorded-path'`
+ *   (walked a recorded migration path), `'plan-from-diff'` (fabricated a
+ *   plan from a state diff), or `'declared-state'` (the space ships no
+ *   migration packages at all; the aggregate declares the no-op directly
+ *   without invoking either). Surfaced for diagnostics; not consumed by
+ *   the runner.
+ */
+/**
+ * Per-edge metadata for the chain assembled by resolving a contract
+ * space's recorded migration path. Lets `migrate` surface a per-migration
+ * `applied[]` entry (preserving the `migrationsApplied` count semantics)
+ * without re-walking the graph.
+ *
+ * `plan-from-diff`/`declared-state` plans leave this absent — they don't
+ * have authored edges to surface (a single fabricated edge is used
+ * instead, see {@link import('./fabricated-migration-edge').buildFabricatedMigrationEdge}).
+ */
+interface AggregateMigrationEdgeRef {
+  readonly migrationHash: string;
+  readonly dirName: string;
+  readonly from: string;
+  readonly to: string;
+  readonly operationCount: number;
+  /**
+   * Contract IR JSON of the edge's destination state, threaded from the
+   * bundle's snapshot store entry (`resolveRecordedPath`) or the space's
+   * destination contract (`planFromDiff`). Runners persist it as the
+   * edge's ledger-linked contract row so database tooling can render
+   * model-level diffs per applied migration; an edge's *before* state is
+   * the previous row's snapshot by chain construction. Absent when the
+   * source bundle's snapshot store entry cannot be resolved.
+   */
+  readonly destinationContractJson?: unknown;
+}
+interface PerSpacePlan {
+  readonly plan: MigrationPlan;
+  readonly displayOps: readonly MigrationPlanOperation[];
+  readonly destinationContract: Contract;
+  readonly strategy: 'resolve-recorded-path' | 'plan-from-diff' | 'declared-state';
+  readonly warnings?: readonly MigrationPlannerConflict[];
+  /**
+   * Per-edge breakdown of the chain. `resolve-recorded-path` plans carry
+   * one entry per authored edge; `plan-from-diff` and `declared-state`
+   * plans carry a single fabricated edge.
+   */
+  readonly migrationEdges: readonly AggregateMigrationEdgeRef[];
+  /**
+   * Path decision data used to select the chain (alternative count,
+   * tie-break reasons, required/satisfied invariants, per-edge
+   * invariants). Populated by `resolveRecordedPath`; absent for
+   * `plan-from-diff`/`declared-state` plans.
+   *
+   * `migrate` surfaces this for the app space as
+   * `MigrateSuccess.pathDecision` (back-compat with single-
+   * space callers).
+   */
+  readonly pathDecision?: PathDecision;
+}
+interface PlannerSuccess {
+  readonly perSpace: ReadonlyMap<string, PerSpacePlan>;
+  /**
+   * `applyOrder` is the order the runner must walk per-space inputs.
+   * Mirrors the existing `concatenateSpaceApplyInputs` convention:
+   * extensions alphabetically by `spaceId`, then the app. Tests assert
+   * on `MigrationRunnerFailure.failingSpace`, which is positional in
+   * the runner's input array — preserving the literal ordering keeps
+   * `failingSpace` attribution byte-for-byte.
+   */
+  readonly applyOrder: readonly string[];
+}
+/**
+ * Discriminated failure variants for {@link planMigration}. Each
+ * variant short-circuits the plan; per-space errors carry the
+ * `spaceId` so the CLI can surface a precise envelope.
+ */
+type PlannerError = {
+  readonly kind: 'extensionPathUnreachable';
+  readonly spaceId: string;
+  readonly target: string;
+} | {
+  readonly kind: 'extensionPathUnsatisfiable';
+  readonly spaceId: string;
+  readonly missingInvariants: readonly string[];
+} | {
+  readonly kind: 'planFromDiffFailed';
+  readonly spaceId: string;
+  readonly conflicts: readonly MigrationPlannerConflict[];
+} | {
+  readonly kind: 'policyConflict';
+  readonly spaceId: string;
+  readonly detail: string;
+};
+type PlannerOutput = Result<PlannerSuccess, PlannerError>;
+//#endregion
+//#region src/aggregate/fabricated-migration-edge.d.ts
+declare function buildFabricatedMigrationEdge(args: {
+  readonly currentMarkerStorageHash: string | null | undefined;
+  readonly destinationStorageHash: string;
+  readonly operationCount: number;
+  readonly destinationContractJson?: unknown;
+}): AggregateMigrationEdgeRef;
+//#endregion
+//#region src/aggregate/loader.d.ts
+/**
+ * Inputs for {@link loadContractSpaceAggregate}.
+ *
+ * Construction reads migration **state** from disk (`migrations/<space>/`
+ * packages + refs + head refs). The app's *live* contract is not a disk
+ * artifact — in Prisma Next it is always compiled from the project's
+ * central contract, so the caller always has it and threads it in as
+ * `appContract`. `deserializeContract` is held and called lazily only for
+ * the extension contracts resolved from the contract snapshot store,
+ * keyed by each extension space's head ref hash.
+ */
+interface LoadAggregateInput {
+  readonly migrationsDir: string;
+  readonly deserializeContract: (raw: unknown) => Contract;
+  readonly appContract: Contract;
+}
+/**
+ * Build a tolerant, queryable {@link ContractSpaceAggregate} from on-disk
+ * migration state plus the caller's live app contract.
+ *
+ * Building **never throws on disk content**: a hash- or
+ * invariants-mismatched package is retained, an unparseable package is
+ * omitted, a missing extension head ref leaves `headRef: null`, and an
+ * unreadable on-disk contract defers its failure to `space.contract()`.
+ * Every such problem is judged by {@link ContractSpaceAggregate.checkIntegrity}
+ * rather than aborting the load. The only rejections are catastrophic I/O
+ * (a `migrations/` that exists but is unreadable for reasons other than
+ * absence).
+ *
+ * The app space's head ref is synthesised from the live contract's
+ * storage hash (the app contract is authored independently of the
+ * migration graph), and `app.contract()` returns the supplied contract.
+ * Extension spaces read their contract, refs, and head ref from disk.
+ */
+declare function loadContractSpaceAggregate(input: LoadAggregateInput): Promise<ContractSpaceAggregate>;
+//#endregion
+//#region src/aggregate/planner.d.ts
+/**
+ * Plan a migration across every contract space of a {@link ContractSpaceAggregate}.
+ *
+ * Per-space operation selection, in order; first match wins:
+ *
+ * 1. If `callerPolicy.ignoreGraphFor.has(space.spaceId)`:
+ *    - If `space.headRef.invariants` is empty → `planFromDiff`.
+ *    - Else → `policyConflict` (a diff-fabricated plan cannot satisfy
+ *      authored invariants).
+ * 2. Else if `space.graph()` is non-empty AND `resolveRecordedPath`
+ *    succeeds → its result.
+ * 3. Else if `space.graph()` is non-empty but unresolvable →
+ *    `extensionPathUnreachable` / `extensionPathUnsatisfiable`.
+ * 4. Else (empty graph — the space ships no migration packages at all,
+ *    e.g. an all-external extension space like Supabase's `auth`/`storage`)
+ *    if `space.headRef.invariants` is empty → declare the no-op state
+ *    directly (zero ops, destination = head ref) without invoking the
+ *    family planner.
+ * 5. Else → `extensionPathUnsatisfiable` (an empty graph cannot satisfy
+ *    non-empty invariants).
+ *
+ * Output `applyOrder` is `[...aggregate.extensions.map(spaceId), aggregate.app.spaceId]`
+ * — extensions alphabetical, then app — matching today's
+ * `concatenateSpaceApplyInputs` ordering. This preserves
+ * `MigrationRunnerFailure.failingSpace` attribution byte-for-byte.
+ *
+ * Every emitted `MigrationPlan` has `targetId = aggregate.targetId`.
+ * No placeholder cast; no patch step.
+ */
+declare function planMigration<TFamilyId extends string, TTargetId extends string>(input: PlannerInput<TFamilyId, TTargetId>): Promise<PlannerOutput>;
+//#endregion
+//#region src/aggregate/strategies/resolve-recorded-path.d.ts
+/**
+ * Outcome variants for resolving a contract space's recorded migration
+ * path. Mirrors
+ * {@link import('../../compute-extension-space-apply-path').ExtensionSpaceApplyPathOutcome}
+ * but operates against the contract space's lazily-reconstructed `graph()`
+ * instead of re-reading from disk. The aggregate planner converts
+ * these into {@link import('../planner-types').PlannerError}
+ * variants.
+ */
+type ResolveRecordedPathOutcome = {
+  readonly kind: 'ok';
+  readonly result: PerSpacePlan;
+} | {
+  readonly kind: 'unreachable';
+} | {
+  readonly kind: 'unsatisfiable';
+  readonly missing: readonly string[];
+};
+interface ResolveRecordedPathInputs {
+  readonly aggregateTargetId: string;
+  readonly space: AggregateContractSpace;
+  readonly currentMarker: ContractMarkerRecordLike | null;
+  /**
+   * Optional ref name to decorate the resulting `PathDecision`. Used by
+   * `migrate` to surface the user-supplied `--to <name>` in
+   * structured-progress events and invariant-path error envelopes. The
+   * strategy itself does not interpret it.
+   */
+  readonly refName?: string;
+}
+/**
+ * Resolve a contract space's hydrated migration graph to the path from the
+ * live marker to `space.headRef.hash`, covering every required invariant.
+ *
+ * Pure synchronous function — no I/O. The aggregate's loader has
+ * already integrity-checked every package and reconstructed the graph;
+ * this resolves the path by looking up ops by `migrationHash` and
+ * assembles a `MigrationPlan` with `targetId` set from the aggregate (no
+ * placeholder cast).
+ *
+ * Required invariants are computed as `headRef.invariants \ marker.invariants`
+ * — the marker already declares some invariants satisfied; the path
+ * only needs to provide the remainder. Mirrors today's
+ * `computeExtensionSpaceApplyPath` semantics.
+ */
+declare function resolveRecordedPath(input: ResolveRecordedPathInputs): ResolveRecordedPathOutcome;
+//#endregion
+//#region src/aggregate/unclaimed-elements.d.ts
+/**
+ * Classifies a diff issue's subject granularity on demand — the injected
+ * capability a contract space's family/target instance provides (via
+ * `hasSchemaSubjectClassifier`). This module never imports family node
+ * classes and never reads a classification off the node or the issue;
+ * absent entirely for families that classify nothing.
+ */
+type SchemaSubjectClassifier = (issue: SchemaDiffIssue) => DiffSubjectGranularity | undefined;
+/**
+ * Classifies a diff issue's subject storage `entityKind` on demand — the
+ * sibling injected capability (`hasSchemaSubjectClassifier`'s
+ * `classifyEntityKind`) that resolves the same per-family vocabulary the
+ * contract storage's `entries` dictionary uses. This module never hardcodes
+ * a family entity kind; absent for families that classify nothing.
+ */
+type SchemaEntityKindClassifier = (issue: SchemaDiffIssue) => string | undefined;
+//#endregion
+//#region src/aggregate/verifier.d.ts
+/**
+ * Caller policy for the verifier. Today's only knob is
+ * `mode`: `strict` treats unclaimed elements (live tables declared by
+ * no contract space) as errors; `lenient` treats them as
+ * informational. Maps directly to `db verify --strict`.
+ */
+interface VerifierInput {
+  readonly aggregate: ContractSpaceAggregate;
+  readonly markersBySpaceId: ReadonlyMap<string, ContractMarkerRecordLike | null>;
+  readonly schemaIntrospection: unknown;
+  readonly mode: 'strict' | 'lenient';
+  /**
+   * Caller-supplied per-space schema verifier. The CLI wires this to the
+   * family's `verifySchema`, run against the **full** introspected schema. The
+   * verifier then produces two outputs from the per-space results: each space's
+   * contract-satisfaction view (extras stripped) and one deduplicated list of
+   * live elements no contract space declares. It touches no storage shape.
+   */
+  readonly verifySchemaForSpace: (schema: unknown, space: AggregateContractSpace, mode: 'strict' | 'lenient') => VerifyDatabaseSchemaResult;
+  /**
+   * Classifies a diff issue's subject granularity on demand — the injected
+   * capability the caller reads off the family instance (via
+   * `hasSchemaSubjectClassifier`) when it has one. Absent for families that
+   * classify nothing; the unclaimed-elements sweep falls back to path shape
+   * in that case. Never stamped onto the issue or the node.
+   */
+  readonly classifySubjectGranularity?: SchemaSubjectClassifier;
+  /**
+   * Classifies a diff issue's subject storage `entityKind` on demand — the
+   * sibling injected capability read off the family instance alongside
+   * `classifySubjectGranularity`. Absent for families that classify
+   * nothing; the unclaimed-elements sweep falls back to a placeholder in
+   * that case. Never stamped onto the issue or the node.
+   */
+  readonly classifyEntityKind?: SchemaEntityKindClassifier;
+}
+/**
+ * Marker-check result per contract space. Mirrors the four cases the
+ * `verifyContractSpaces` primitive surfaces today, plus an `'absent'`
+ * case for greenfield spaces (no marker row written yet — `db init`
+ * not run).
+ */
+type MarkerCheckResult = {
+  readonly kind: 'ok';
+} | {
+  readonly kind: 'absent';
+} | {
+  readonly kind: 'hashMismatch';
+  readonly markerHash: string;
+  readonly expected: string;
+} | {
+  readonly kind: 'missingInvariants';
+  readonly missing: readonly string[];
+};
+interface MarkerCheckSection {
+  readonly perSpace: ReadonlyMap<string, MarkerCheckResult>;
+  readonly orphanMarkers: readonly {
+    readonly spaceId: string;
+    readonly row: ContractMarkerRecordLike;
+  }[];
+}
+interface SchemaCheckSection {
+  /**
+   * Per contract space, its contract-satisfaction view: the space's
+   * declared nodes only, each pass/fail by whether a missing/mismatch issue
+   * concerns it. Extras are stripped; the space's verdict is missing/mismatch
+   * only.
+   */
+  readonly perSpace: ReadonlyMap<string, VerifyDatabaseSchemaResult>;
+  /**
+   * One deduplicated, sorted list of live element names no contract
+   * space declares (built from the diffs' extra findings, filtered by the
+   * passive aggregate's ownership query). Reported once for the whole database,
+   * not per space. Strict callers fail on a non-empty list; lenient callers show
+   * it informationally.
+   */
+  readonly unclaimed: readonly string[];
+}
+interface VerifierSuccess {
+  readonly markerCheck: MarkerCheckSection;
+  readonly schemaCheck: SchemaCheckSection;
+}
+type VerifierError = {
+  readonly kind: 'introspectionFailure';
+  readonly detail: string;
+};
+type VerifierOutput = Result<VerifierSuccess, VerifierError>;
+/**
+ * Verify a {@link ContractSpaceAggregate} against the live database
+ * state. Bundles two checks:
+ *
+ * - `markerCheck` per contract space: compare the live marker row against the
+ *   space's `headRef.hash` + `headRef.invariants`. Absence is a
+ *   distinct kind, not an error (callers — `db verify` strict vs
+ *   `db init` precondition — choose how to interpret it).
+ * - `schemaCheck`: two distinct outputs from the per-space diffs.
+ *   `perSpace` — each space verified against the **full**
+ *   introspected schema, then its extras stripped, leaving the space's
+ *   declared nodes (its contract-satisfaction view; verdict is
+ *   missing/mismatch only). `unclaimed` — the extras gathered
+ *   across every space, deduplicated, and filtered to the names no contract
+ *   space declares (via the passive aggregate's ownership query); reported
+ *   once for the database. No schema is pruned before verifying.
+ *
+ * `markerCheck.orphanMarkers` lists every marker row whose `space` is
+ * not a contract space of the aggregate. `db verify` callers reject orphans;
+ * future tooling may not.
+ *
+ * Pure synchronous function; no I/O. The caller (CLI) gathers
+ * `markersBySpaceId` and `schemaIntrospection` ahead of the call.
+ */
+declare function verifyMigration(input: VerifierInput): VerifierOutput;
+//#endregion
+export { buildFabricatedMigrationEdge as A, verifyMigration as B, ResolveRecordedPathOutcome as C, VerifierOutput as D, VerifierInput as E, loadContractSpaceAggregate as F, loadProblemToViolation as I, planMigration as L, computeIntegrityViolations as M, createAggregateContractSpace as N, VerifierSuccess as O, createContractSpaceAggregate as P, requireHeadRef as R, ResolveRecordedPathInputs as S, VerifierError as T, PerSpacePlan as _, ContractAtOptions as a, PlannerOutput as b, ContractSpaceAggregate as c, IntegrityQueryOptions as d, IntegritySpaceState as f, MarkerCheckSection as g, MarkerCheckResult as h, CallerPolicy as i, collectAggregateNamespaces as j, allStorageElementsExternal as k, DeclaredExtensionEntry as l, LoadAggregateInput as m, AggregateCurrentDBState as n, ContractAtResult as o, IntegrityViolation as p, AggregateMigrationEdgeRef as r, ContractMarkerRecordLike as s, AggregateContractSpace as t, IntegrityComputationInput as u, PlannerError as v, SchemaCheckSection as w, PlannerSuccess as x, PlannerInput as y, resolveRecordedPath as z };
+//# sourceMappingURL=aggregate-BflrjWPO.d.mts.map