@prisma/orm-toolchain 0.16.0

package/dist/aggregate-B4mhR4Sk.mjs

@@ -0,0 +1,1012 @@
+import { M as errorRefNotResolvable, N as errorSpaceHeadRefMissing, i as errorContractDeserializationFailed, p as errorHashNotInGraph, r as errorBundleNotFoundForGraphNode, t as MigrationToolsError } from "./errors-IpZm1Skp-BH495dRd.mjs";
+import { n as readContractSnapshotDts, r as readContractSnapshotJson, t as contractSnapshotDir } from "./contract-snapshot-store-sf5nP4mb-MLpG-ihh.mjs";
+import { s as readMigrationsDir } from "./io-C8TdyBKt-DloEBi70.mjs";
+import { t as EMPTY_CONTRACT_HASH } from "./constants-CM-w38DQ-Cz_EXbOc.mjs";
+import { l as reconstructGraph, o as findPathWithDecision } from "./migration-graph-CBf9ORe7-B4xAF8GN.mjs";
+import { a as isValidSpaceId, c as spaceMigrationDirectory, l as spaceRefsDirectory, o as listContractSpaceDirectories, s as readContractSpaceHeadRef, t as APP_SPACE_ID$1 } from "./verify-contract-spaces-BZDcJsuA-De8v4Z4T.mjs";
+import { n as isGraphNode } from "./graph-membership-DW6nnbyQ-Bp2KcVwR.mjs";
+import { a as readRefsTolerant, r as readRef, t as HEAD_REF_NAME } from "./refs-BDbB9BRB-D6Za3Q49.mjs";
+import { notOk, ok } from "@prisma/orm-framework/utils/result";
+import { join } from "pathe";
+import { issueOutcome } from "@prisma/orm-framework/components/control";
+import { blindCast } from "@prisma/orm-framework/utils/casts";
+import { InternalError } from "@prisma/orm-framework/utils/internal-error";
+import { UNBOUND_NAMESPACE_ID, coordinateKey, elementCoordinates, entityAt } from "@prisma/orm-framework/components/ir";
+import { effectiveControlPolicy } from "@prisma/orm-framework/contract/types";
+//#region ../../../1-framework/3-tooling/migration/dist/exports/aggregate.mjs
+function contractAtMemoKey(hash, refName) {
+	return `${hash}\0${refName ?? ""}`;
+}
+function deserializeContractAtPath(filePath, contractJson, deserializeContract) {
+	try {
+		return deserializeContract(contractJson);
+	} catch (error) {
+		if (MigrationToolsError.is(error)) throw error;
+		throw errorContractDeserializationFailed(filePath, error instanceof Error ? error.message : String(error));
+	}
+}
+async function readContractSnapshotEntry(migrationsDir, hash, deserializeContract) {
+	const contractJson = await readContractSnapshotJson(migrationsDir, hash);
+	return {
+		contractJson,
+		contractDts: await readContractSnapshotDts(migrationsDir, hash),
+		contract: deserializeContractAtPath(join(contractSnapshotDir(migrationsDir, hash), "contract.json"), contractJson, deserializeContract)
+	};
+}
+async function resolveContractAt(args) {
+	const { hash, opts, refsDir, migrationsDir, packages, graph, deserializeContract } = args;
+	const refName = opts?.refName;
+	if (refName !== void 0) {
+		let refEntry;
+		try {
+			refEntry = await readRef(refsDir, refName);
+		} catch (error) {
+			if (MigrationToolsError.is(error) && error.code === "MIGRATION.UNKNOWN_REF") refEntry = void 0;
+			else throw error;
+		}
+		if (refEntry) {
+			const { contractJson, contractDts, contract } = await readContractSnapshotEntry(migrationsDir, refEntry.hash, deserializeContract);
+			return {
+				hash: refEntry.hash,
+				contractJson,
+				contractDts,
+				contract,
+				provenance: "ref"
+			};
+		}
+		if (isGraphNode(hash, graph)) return resolveGraphNodeContractAt({
+			hash,
+			migrationsDir,
+			packages,
+			deserializeContract,
+			explicitLabel: refName
+		});
+		throw errorRefNotResolvable(refName);
+	}
+	if (isGraphNode(hash, graph)) return resolveGraphNodeContractAt({
+		hash,
+		migrationsDir,
+		packages,
+		deserializeContract
+	});
+	throw errorHashNotInGraph(hash, graph);
+}
+async function resolveGraphNodeContractAt(args) {
+	const { hash, migrationsDir, packages, deserializeContract, explicitLabel } = args;
+	if (!packages.find((pkg) => pkg.metadata.to === hash)) throw errorBundleNotFoundForGraphNode(hash, explicitLabel);
+	const { contractJson, contractDts, contract } = await readContractSnapshotEntry(migrationsDir, hash, deserializeContract);
+	return {
+		hash,
+		contractJson,
+		contractDts,
+		contract,
+		provenance: "graph-node"
+	};
+}
+/**
+* Resolve a contract space's head ref, asserting it is present. The apply/verify
+* engine only runs after `checkIntegrity` has refused on `headRefMissing`,
+* so a space reaching the planner / verifier without a head ref is a
+* programming error (the integrity gate was skipped), not a user-facing
+* state. The app space's head ref is always synthesised, so this only
+* ever guards an ungated extension space.
+*/
+function requireHeadRef(space) {
+	if (space.headRef === null) throw new InternalError(`Contract space "${space.spaceId}" has no head ref; the integrity gate must refuse a missing head ref before planning or verifying.`);
+	return space.headRef;
+}
+/**
+* Build a {@link AggregateContractSpace} with lazily-memoised `graph()`,
+* `contract()`, and `contractAt()` facets.
+*
+* `graph()` reconstructs the migration graph from `packages` on first
+* call and caches it. `contract()` calls `resolveContract` on first call
+* and caches the result; a throwing `resolveContract` (e.g. a missing or
+* undeserializable on-disk contract) re-throws on each call rather than
+* caching a value — `checkIntegrity` surfaces that as `contractUnreadable`.
+* `contractAt()` materializes the contract at an arbitrary graph node with
+* the same resolution order as plan-time ref resolution: the ref's pointer
+* plus the store entry keyed by the pointer's hash first (when
+* `opts.refName` is set), else the contract snapshot store entry keyed by
+* the matching package's `to` hash.
+*/
+function createAggregateContractSpace(args) {
+	const { spaceId, packages, refs, headRef, refsDir, migrationsDir, resolveContract, deserializeContract } = args;
+	let graphMemo;
+	let contractMemo;
+	const contractAtMemo = /* @__PURE__ */ new Map();
+	function spaceGraph() {
+		graphMemo ??= reconstructGraph(packages);
+		return graphMemo;
+	}
+	return {
+		spaceId,
+		packages,
+		refs,
+		headRef,
+		graph: spaceGraph,
+		contract() {
+			contractMemo ??= resolveContract();
+			return contractMemo;
+		},
+		async contractAt(hash, opts) {
+			const key = contractAtMemoKey(hash, opts?.refName);
+			const cached = contractAtMemo.get(key);
+			if (cached) return cached;
+			const result = await resolveContractAt({
+				hash,
+				opts,
+				refsDir,
+				migrationsDir,
+				packages,
+				graph: spaceGraph(),
+				deserializeContract
+			});
+			contractAtMemo.set(key, result);
+			return result;
+		}
+	};
+}
+/**
+* Collect the union of every namespace declared across all contract spaces of an
+* aggregate (app + extensions) and return a minimal object with the shape
+* `{ storage: { namespaces } }` suitable for passing to
+* `familyInstance.introspect`.
+*
+* Callers invoke this after the integrity gate (`buildContractSpaceAggregate`
+* with `checkContracts: true`), so every `space.contract()` call is safe —
+* no try/catch is needed here.
+*/
+function collectAggregateNamespaces(aggregate) {
+	const merged = {};
+	for (const space of aggregate.spaces()) for (const [key, ns] of Object.entries(space.contract().storage.namespaces)) {
+		const existing = merged[key];
+		merged[key] = existing === void 0 ? ns : mergeNamespaceEntries(existing, ns);
+	}
+	return { storage: { namespaces: merged } };
+}
+/**
+* Union two contract spaces' declarations for the same namespace id, per
+* entity kind. Two spaces may legitimately share a namespace (e.g. both
+* declaring tables in `public`); element-level disjointness is enforced by
+* `checkIntegrity`, so the kind maps never collide on a name — replacing the
+* whole namespace would silently drop the earlier space's entities.
+*/
+function mergeNamespaceEntries(a, b) {
+	const entries = { ...a.entries };
+	for (const [entityKind, kindMap] of Object.entries(b.entries)) entries[entityKind] = {
+		...entries[entityKind],
+		...kindMap
+	};
+	return {
+		...a,
+		entries
+	};
+}
+/**
+* Assemble a {@link ContractSpaceAggregate} value from its contract spaces and a
+* `checkIntegrity` implementation. The query methods (`listSpaces` /
+* `hasSpace` / `space` / `spaces`) are derived here so every aggregate —
+* loader-built or test-built — shares one query surface: `app` first,
+* then `extensions` in the order supplied (the loader sorts them
+* lex-ascending by `spaceId`).
+*/
+function createContractSpaceAggregate(args) {
+	const { targetId, app, extensions, checkIntegrity } = args;
+	const ordered = [app, ...extensions];
+	const byId = new Map(ordered.map((m) => [m.spaceId, m]));
+	const spaceDeclares = (space, coordinate) => {
+		const key = coordinateKey(coordinate);
+		for (const coord of elementCoordinates(space.contract().storage)) if (coordinateKey(coord) === key) return true;
+		return false;
+	};
+	return {
+		targetId,
+		app,
+		extensions,
+		listSpaces: () => ordered.map((m) => m.spaceId),
+		hasSpace: (id) => byId.has(id),
+		space: (id) => byId.get(id),
+		spaces: () => ordered,
+		declaresEntity: (coordinate) => ordered.some((space) => spaceDeclares(space, coordinate)),
+		declaringSpaces: (coordinate) => ordered.filter((space) => spaceDeclares(space, coordinate)).map((s) => s.spaceId),
+		checkIntegrity
+	};
+}
+function isControlPolicy(value) {
+	return value === "managed" || value === "tolerated" || value === "external" || value === "observed";
+}
+/**
+* True when every storage element the contract declares resolves to the
+* `external` control policy (ADR 224) — element-level `control` first, the
+* contract's `defaultControlPolicy` otherwise. A contract with no storage
+* elements is vacuously all-external.
+*
+* This is the precondition for advancing a contract space's marker without
+* any migrations (the declared-state resolution the db-init aggregate
+* planner and `migrate` share): only when nothing in the space is
+* Prisma-Next-managed can the storage structure be correct without a
+* migration having produced it. Any space that declares a managed element
+* but ships no migration graph is an authoring bug and must fail loudly.
+*/
+function allStorageElementsExternal(contract) {
+	for (const coordinate of elementCoordinates(contract.storage)) {
+		const entity = entityAt(contract.storage, coordinate);
+		const declared = entity !== null && typeof entity === "object" ? blindCast(entity).control : void 0;
+		if (effectiveControlPolicy(isControlPolicy(declared) ? declared : void 0, contract.defaultControlPolicy) !== "external") return false;
+	}
+	return true;
+}
+/**
+* Walk the loaded model and return **every** integrity violation — never
+* bailing at the first. Structurally-derivable violations (load-time
+* problems, self-edges, missing / unreachable head refs) are always
+* produced; layout-drift checks require `declaredExtensions`, and
+* contract / target / disjointness checks require `checkContracts`.
+*/
+function computeIntegrityViolations(input, opts) {
+	const violations = [];
+	for (const { space, problems, refProblems, headRefProblem, isApp } of input.spaces) {
+		const { spaceId } = space;
+		for (const problem of problems) violations.push(loadProblemToViolation(spaceId, problem));
+		for (const refProblem of refProblems) violations.push({
+			kind: "refUnreadable",
+			spaceId,
+			refName: refProblem.refName,
+			detail: refProblem.detail
+		});
+		if (headRefProblem !== null) violations.push({
+			kind: "refUnreadable",
+			spaceId,
+			refName: headRefProblem.refName,
+			detail: headRefProblem.detail
+		});
+		for (const pkg of space.packages) {
+			const from = pkg.metadata.from ?? "empty";
+			const isSelfEdge = from === pkg.metadata.to;
+			const hasDataOp = pkg.ops.some((op) => op.operationClass === "data");
+			if (isSelfEdge && !hasDataOp) violations.push({
+				kind: "sameSourceAndTarget",
+				spaceId,
+				dirName: pkg.dirName,
+				hash: from
+			});
+		}
+		violations.push(...duplicateMigrationHashViolations(spaceId, space.packages));
+		if (!isApp && headRefProblem === null) {
+			if (space.headRef === null) violations.push({
+				kind: "headRefMissing",
+				spaceId
+			});
+			else if (space.packages.length > 0 && !headRefPresentInGraph(space, space.headRef.hash)) violations.push({
+				kind: "headRefNotInGraph",
+				spaceId,
+				hash: space.headRef.hash
+			});
+		}
+	}
+	if (opts?.declaredExtensions !== void 0) violations.push(...layoutViolations(input.spaces, opts.declaredExtensions));
+	if (opts?.checkContracts === true) violations.push(...contractViolations(input));
+	return violations;
+}
+function loadProblemToViolation(spaceId, problem) {
+	switch (problem.kind) {
+		case "hashMismatch": return {
+			kind: "hashMismatch",
+			spaceId,
+			dirName: problem.dirName,
+			stored: problem.stored,
+			computed: problem.computed
+		};
+		case "providedInvariantsMismatch": return {
+			kind: "providedInvariantsMismatch",
+			spaceId,
+			dirName: problem.dirName
+		};
+		case "packageUnloadable": return {
+			kind: "packageUnloadable",
+			spaceId,
+			dirName: problem.dirName,
+			detail: problem.detail
+		};
+	}
+}
+function duplicateMigrationHashViolations(spaceId, packages) {
+	const dirNamesByHash = /* @__PURE__ */ new Map();
+	for (const pkg of packages) {
+		const hash = pkg.metadata.migrationHash;
+		const dirNames = dirNamesByHash.get(hash);
+		if (dirNames) dirNames.push(pkg.dirName);
+		else dirNamesByHash.set(hash, [pkg.dirName]);
+	}
+	const out = [];
+	for (const [migrationHash, dirNames] of dirNamesByHash) if (dirNames.length > 1) out.push({
+		kind: "duplicateMigrationHash",
+		spaceId,
+		migrationHash,
+		dirNames: [...dirNames].sort()
+	});
+	return out;
+}
+/**
+* Whether a space's head-ref hash is present in its reconstructed graph.
+* An empty graph is reachable only by the empty-contract sentinel.
+*/
+function headRefPresentInGraph(space, headHash) {
+	const graph = space.graph();
+	if (graph.nodes.size === 0) return headHash === EMPTY_CONTRACT_HASH;
+	return graph.nodes.has(headHash);
+}
+function layoutViolations(spaces, declaredExtensions) {
+	const out = [];
+	const extensionSpaceIds = new Set(spaces.filter((s) => !s.isApp).map((s) => s.space.spaceId));
+	const declaredIds = new Set(declaredExtensions.map((d) => d.id));
+	for (const id of [...extensionSpaceIds].sort()) if (!declaredIds.has(id)) out.push({
+		kind: "orphanSpaceDir",
+		spaceId: id
+	});
+	for (const id of [...declaredIds].sort()) if (!extensionSpaceIds.has(id)) out.push({
+		kind: "declaredButUnmigrated",
+		spaceId: id
+	});
+	return out;
+}
+function contractViolations(input) {
+	const out = [];
+	const elementClaimedBy = /* @__PURE__ */ new Map();
+	const elementLabel = /* @__PURE__ */ new Map();
+	for (const { space } of input.spaces) {
+		let contract;
+		try {
+			contract = space.contract();
+		} catch (error) {
+			out.push({
+				kind: "contractUnreadable",
+				spaceId: space.spaceId,
+				detail: detailOf$1(error)
+			});
+			continue;
+		}
+		if (contract.target !== input.targetId) out.push({
+			kind: "targetMismatch",
+			spaceId: space.spaceId,
+			expected: input.targetId,
+			actual: contract.target
+		});
+		for (const coordinate of elementCoordinates(contract.storage)) {
+			const key = coordinateKey(coordinate);
+			const claimers = elementClaimedBy.get(key);
+			if (claimers) claimers.push(space.spaceId);
+			else {
+				elementClaimedBy.set(key, [space.spaceId]);
+				elementLabel.set(key, `${coordinate.namespaceId}.${coordinate.entityName}`);
+			}
+		}
+	}
+	const disjointness = [];
+	for (const [key, claimedBy] of elementClaimedBy) if (claimedBy.length > 1) {
+		const element = elementLabel.get(key) ?? key;
+		disjointness.push({
+			kind: "disjointness",
+			element,
+			claimedBy: [...claimedBy].sort()
+		});
+	}
+	disjointness.sort((a, b) => a.kind === "disjointness" && b.kind === "disjointness" ? a.element.localeCompare(b.element) : 0);
+	out.push(...disjointness);
+	return out;
+}
+function detailOf$1(error) {
+	if (MigrationToolsError.is(error)) return error.why;
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function buildFabricatedMigrationEdge(args) {
+	return {
+		dirName: "",
+		migrationHash: args.destinationStorageHash,
+		from: args.currentMarkerStorageHash ?? "",
+		to: args.destinationStorageHash,
+		operationCount: args.operationCount,
+		...args.destinationContractJson !== void 0 ? { destinationContractJson: args.destinationContractJson } : {}
+	};
+}
+/**
+* Build a tolerant, queryable {@link ContractSpaceAggregate} from on-disk
+* migration state plus the caller's live app contract.
+*
+* Building **never throws on disk content**: a hash- or
+* invariants-mismatched package is retained, an unparseable package is
+* omitted, a missing extension head ref leaves `headRef: null`, and an
+* unreadable on-disk contract defers its failure to `space.contract()`.
+* Every such problem is judged by {@link ContractSpaceAggregate.checkIntegrity}
+* rather than aborting the load. The only rejections are catastrophic I/O
+* (a `migrations/` that exists but is unreadable for reasons other than
+* absence).
+*
+* The app space's head ref is synthesised from the live contract's
+* storage hash (the app contract is authored independently of the
+* migration graph), and `app.contract()` returns the supplied contract.
+* Extension spaces read their contract, refs, and head ref from disk.
+*/
+async function loadContractSpaceAggregate(input) {
+	const { migrationsDir, deserializeContract, appContract } = input;
+	const targetId = appContract.target;
+	const appState = await loadAppSpace(migrationsDir, appContract, deserializeContract);
+	const extensionStates = await loadExtensionSpaces(migrationsDir, deserializeContract);
+	const spaces = [appState, ...extensionStates];
+	return createContractSpaceAggregate({
+		targetId,
+		app: appState.space,
+		extensions: extensionStates.map((state) => state.space),
+		checkIntegrity: (opts) => computeIntegrityViolations({
+			targetId,
+			spaces
+		}, opts)
+	});
+}
+async function loadAppSpace(migrationsDir, appContract, deserializeContract) {
+	const spaceDir = spaceMigrationDirectory(migrationsDir, APP_SPACE_ID$1);
+	const { packages, problems } = await readMigrationsDir(spaceDir, { migrationsDir });
+	const { refs, problems: refProblems } = await readRefsTolerant(spaceRefsDirectory(spaceDir));
+	return {
+		space: createAggregateContractSpace({
+			spaceId: APP_SPACE_ID$1,
+			packages,
+			refs,
+			headRef: {
+				hash: appContract.storage.storageHash,
+				invariants: []
+			},
+			refsDir: spaceRefsDirectory(spaceDir),
+			migrationsDir,
+			resolveContract: () => appContract,
+			deserializeContract
+		}),
+		problems,
+		refProblems,
+		headRefProblem: null,
+		isApp: true
+	};
+}
+async function loadExtensionSpaces(migrationsDir, deserializeContract) {
+	const extensionIds = (await listContractSpaceDirectories(migrationsDir)).filter((name) => name !== APP_SPACE_ID$1).filter(isValidSpaceId).sort();
+	const states = [];
+	for (const spaceId of extensionIds) states.push(await loadExtensionSpace(migrationsDir, spaceId, deserializeContract));
+	return states;
+}
+async function loadExtensionSpace(migrationsDir, spaceId, deserializeContract) {
+	const spaceDir = spaceMigrationDirectory(migrationsDir, spaceId);
+	const { packages, problems } = await readMigrationsDir(spaceDir, { migrationsDir });
+	const { refs, problems: refProblems } = await readRefsTolerant(spaceRefsDirectory(spaceDir));
+	const { headRef, problem: headRefProblem } = await readHeadRefTolerant(migrationsDir, spaceId);
+	const rawContract = await readRawContractDeferred(migrationsDir, spaceId, headRef);
+	return {
+		space: createAggregateContractSpace({
+			spaceId,
+			packages,
+			refs,
+			headRef,
+			refsDir: spaceRefsDirectory(spaceDir),
+			migrationsDir,
+			resolveContract: () => deserializeContract(rawContract()),
+			deserializeContract
+		}),
+		problems,
+		refProblems,
+		headRefProblem,
+		isApp: false
+	};
+}
+/**
+* Read an extension's head ref, distinguishing a *genuinely absent*
+* `head.json` (`headRef: null`, no problem — judged `headRefMissing`)
+* from one that *exists but cannot be parsed* (`headRef: null` plus a
+* problem — judged `refUnreadable`, not `headRefMissing`).
+* `readContractSpaceHeadRef` already returns `null` only for ENOENT and
+* throws for unparseable / schema-invalid content, so the throw is the
+* corruption signal. Construction never throws on disk content.
+*/
+function isToleratedRefHeadReadError(error) {
+	if (MigrationToolsError.is(error)) return true;
+	if (!(error instanceof Error)) return false;
+	const code = error.code;
+	return code === "ENOENT" || code === "EISDIR";
+}
+async function readHeadRefTolerant(migrationsDir, spaceId) {
+	try {
+		return {
+			headRef: await readContractSpaceHeadRef(migrationsDir, spaceId),
+			problem: null
+		};
+	} catch (error) {
+		if (!isToleratedRefHeadReadError(error)) throw error;
+		return {
+			headRef: null,
+			problem: {
+				refName: HEAD_REF_NAME,
+				detail: detailOf(error)
+			}
+		};
+	}
+}
+function detailOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Read the raw contract snapshot-store entry eagerly (cheap I/O) but defer
+* its (throwing) failure to call time, so a missing or unparseable store
+* entry becomes a `contract()` throw — surfaced as `contractUnreadable` —
+* rather than a construction failure. When `headRef` is absent there is no
+* hash to resolve against the store, so the deferred call always throws;
+* `checkIntegrity` already reports that case as `headRefMissing`, and a
+* `checkContracts` pass surfaces the same space as `contractUnreadable`.
+*/
+async function readRawContractDeferred(migrationsDir, spaceId, headRef) {
+	if (headRef === null) return () => {
+		throw errorSpaceHeadRefMissing(spaceId);
+	};
+	try {
+		const raw = await readContractSnapshotJson(migrationsDir, headRef.hash);
+		return () => raw;
+	} catch (error) {
+		return () => {
+			throw error;
+		};
+	}
+}
+/**
+* Plan a migration for a single contract space from a diff against the full
+* live schema, delegating to the family's `createPlanner(...).plan(...)`.
+*
+* The planner diffs the whole introspected schema, so it sees other contract
+* spaces' tables as "extras"; the orchestration hands the planner the
+* aggregate as an ownership oracle so it can ask, per extra, whether any
+* space owns it — a sibling-owned table is left untouched, so the planner
+* never emits a destructive drop for it, and this strategy holds no ownership
+* logic of its own. The schema is never pruned before planning: cross-space
+* foreign keys need every sibling table visible to the diff.
+*
+* The produced plan's `targetId` is set from `aggregateTargetId`
+* (the aggregate's ambient target). The family's planner does not
+* stamp `targetId` on the produced plan; the aggregate planner is
+* the single point that knows the target.
+*
+* Used by:
+*
+* - The app space by default (CLI policy
+*   `ignoreGraphFor: { app.spaceId }`).
+* - Any extension space whose `headRef.invariants` is empty and whose
+*   graph is non-empty (the all-external, zero-migration-package case is
+*   handled directly by the aggregate planner without calling this).
+*/
+async function planFromDiff(input) {
+	const plannerResult = await input.migrations.createPlanner(input.adapter).plan({
+		contract: input.space.contract(),
+		schema: input.schemaIntrospection,
+		policy: input.operationPolicy,
+		fromContract: null,
+		frameworkComponents: input.frameworkComponents,
+		spaceId: input.space.spaceId,
+		ownership: input.ownership,
+		snapshotsImportPath: ""
+	});
+	if (plannerResult.kind === "failure") return {
+		kind: "failure",
+		conflicts: plannerResult.conflicts
+	};
+	const producedPlan = plannerResult.plan;
+	const plan = new Proxy(producedPlan, {
+		get(target, prop) {
+			if (prop === "targetId") return input.aggregateTargetId;
+			return Reflect.get(target, prop, target);
+		},
+		has(target, prop) {
+			if (prop === "targetId") return true;
+			return Reflect.has(target, prop);
+		}
+	});
+	const destinationStorageHash = producedPlan.destination.storageHash;
+	const producedOps = await Promise.all(producedPlan.operations);
+	const destinationContract = input.space.contract();
+	return {
+		kind: "ok",
+		result: {
+			plan,
+			displayOps: producedOps,
+			destinationContract,
+			strategy: "plan-from-diff",
+			...plannerResult.warnings && plannerResult.warnings.length > 0 ? { warnings: plannerResult.warnings } : {},
+			migrationEdges: [buildFabricatedMigrationEdge({
+				currentMarkerStorageHash: input.currentMarker?.storageHash,
+				destinationStorageHash,
+				operationCount: producedOps.length,
+				destinationContractJson: destinationContract
+			})]
+		}
+	};
+}
+/**
+* Resolve a contract space's hydrated migration graph to the path from the
+* live marker to `space.headRef.hash`, covering every required invariant.
+*
+* Pure synchronous function — no I/O. The aggregate's loader has
+* already integrity-checked every package and reconstructed the graph;
+* this resolves the path by looking up ops by `migrationHash` and
+* assembles a `MigrationPlan` with `targetId` set from the aggregate (no
+* placeholder cast).
+*
+* Required invariants are computed as `headRef.invariants \ marker.invariants`
+* — the marker already declares some invariants satisfied; the path
+* only needs to provide the remainder. Mirrors today's
+* `computeExtensionSpaceApplyPath` semantics.
+*/
+function resolveRecordedPath(input) {
+	const { aggregateTargetId, space, currentMarker, refName } = input;
+	const headRef = requireHeadRef(space);
+	const graph = space.graph();
+	const packagesByMigrationHash = new Map(space.packages.map((pkg) => [pkg.metadata.migrationHash, pkg]));
+	const fromHash = currentMarker?.storageHash ?? "empty";
+	const markerInvariants = new Set(currentMarker?.invariants ?? []);
+	const required = new Set(headRef.invariants.filter((id) => !markerInvariants.has(id)));
+	const outcome = findPathWithDecision(graph, fromHash, headRef.hash, {
+		required,
+		...refName !== void 0 ? { refName } : {}
+	});
+	if (outcome.kind === "unreachable") return { kind: "unreachable" };
+	if (outcome.kind === "unsatisfiable") return {
+		kind: "unsatisfiable",
+		missing: outcome.missing
+	};
+	const pathOps = [];
+	const providedInvariantsSet = /* @__PURE__ */ new Set();
+	const edgeRefs = [];
+	for (const edge of outcome.decision.selectedPath) {
+		const pkg = packagesByMigrationHash.get(edge.migrationHash);
+		if (!pkg) throw new InternalError(`Migration package missing for edge ${edge.migrationHash} in space "${space.spaceId}". The hydrated migration graph and packagesByMigrationHash map are out of sync — this should be unreachable; report.`);
+		for (const op of pkg.ops) pathOps.push(op);
+		for (const invariant of pkg.metadata.providedInvariants) providedInvariantsSet.add(invariant);
+		edgeRefs.push({
+			migrationHash: edge.migrationHash,
+			dirName: edge.dirName,
+			from: edge.from,
+			to: edge.to,
+			operationCount: pkg.ops.length,
+			...pkg.endContractJson !== void 0 ? { destinationContractJson: pkg.endContractJson } : {}
+		});
+	}
+	return {
+		kind: "ok",
+		result: {
+			plan: {
+				targetId: aggregateTargetId,
+				spaceId: space.spaceId,
+				origin: currentMarker === null ? null : { storageHash: currentMarker.storageHash },
+				destination: { storageHash: headRef.hash },
+				operations: pathOps,
+				providedInvariants: [...providedInvariantsSet].sort()
+			},
+			displayOps: pathOps,
+			destinationContract: space.contract(),
+			strategy: "resolve-recorded-path",
+			migrationEdges: edgeRefs,
+			pathDecision: outcome.decision
+		}
+	};
+}
+/**
+* Plan a migration across every contract space of a {@link ContractSpaceAggregate}.
+*
+* Per-space operation selection, in order; first match wins:
+*
+* 1. If `callerPolicy.ignoreGraphFor.has(space.spaceId)`:
+*    - If `space.headRef.invariants` is empty → `planFromDiff`.
+*    - Else → `policyConflict` (a diff-fabricated plan cannot satisfy
+*      authored invariants).
+* 2. Else if `space.graph()` is non-empty AND `resolveRecordedPath`
+*    succeeds → its result.
+* 3. Else if `space.graph()` is non-empty but unresolvable →
+*    `extensionPathUnreachable` / `extensionPathUnsatisfiable`.
+* 4. Else (empty graph — the space ships no migration packages at all,
+*    e.g. an all-external extension space like Supabase's `auth`/`storage`)
+*    if `space.headRef.invariants` is empty → declare the no-op state
+*    directly (zero ops, destination = head ref) without invoking the
+*    family planner.
+* 5. Else → `extensionPathUnsatisfiable` (an empty graph cannot satisfy
+*    non-empty invariants).
+*
+* Output `applyOrder` is `[...aggregate.extensions.map(spaceId), aggregate.app.spaceId]`
+* — extensions alphabetical, then app — matching today's
+* `concatenateSpaceApplyInputs` ordering. This preserves
+* `MigrationRunnerFailure.failingSpace` attribution byte-for-byte.
+*
+* Every emitted `MigrationPlan` has `targetId = aggregate.targetId`.
+* No placeholder cast; no patch step.
+*/
+async function planMigration(input) {
+	const { aggregate, currentDBState, callerPolicy } = input;
+	const perSpace = /* @__PURE__ */ new Map();
+	const orderedSpaces = [...aggregate.extensions, aggregate.app];
+	for (const space of orderedSpaces) {
+		const currentMarker = currentDBState.markersBySpaceId.get(space.spaceId) ?? null;
+		const headRef = requireHeadRef(space);
+		const ignoreGraph = callerPolicy.ignoreGraphFor.has(space.spaceId);
+		const invariantsRequired = headRef.invariants.length > 0;
+		if (ignoreGraph && invariantsRequired) return notOk({
+			kind: "policyConflict",
+			spaceId: space.spaceId,
+			detail: `\`callerPolicy.ignoreGraphFor\` requested for space "${space.spaceId}", but the contract space declares non-empty head-ref invariants (${headRef.invariants.join(", ")}). A plan built directly from the contract IR cannot satisfy authored invariants — the graph must be walked. Either remove "${space.spaceId}" from \`ignoreGraphFor\` or amend the on-disk head ref to declare zero invariants.`
+		});
+		if (ignoreGraph) {
+			const diffOutcome = await planFromDiff({
+				aggregateTargetId: aggregate.targetId,
+				currentMarker,
+				space,
+				ownership: aggregate,
+				schemaIntrospection: currentDBState.schemaIntrospection,
+				adapter: input.adapter,
+				migrations: input.migrations,
+				frameworkComponents: input.frameworkComponents,
+				operationPolicy: input.operationPolicy
+			});
+			if (diffOutcome.kind === "failure") return notOk({
+				kind: "planFromDiffFailed",
+				spaceId: space.spaceId,
+				conflicts: diffOutcome.conflicts
+			});
+			perSpace.set(space.spaceId, diffOutcome.result);
+			continue;
+		}
+		if (space.graph().nodes.size > 0) {
+			const resolved = resolveRecordedPath({
+				aggregateTargetId: aggregate.targetId,
+				space,
+				currentMarker
+			});
+			if (resolved.kind === "ok") {
+				perSpace.set(space.spaceId, resolved.result);
+				continue;
+			}
+			if (resolved.kind === "unreachable") return notOk({
+				kind: "extensionPathUnreachable",
+				spaceId: space.spaceId,
+				target: headRef.hash
+			});
+			return notOk({
+				kind: "extensionPathUnsatisfiable",
+				spaceId: space.spaceId,
+				missingInvariants: resolved.missing
+			});
+		}
+		if (invariantsRequired) return notOk({
+			kind: "extensionPathUnsatisfiable",
+			spaceId: space.spaceId,
+			missingInvariants: [...headRef.invariants].sort()
+		});
+		if (!allStorageElementsExternal(space.contract())) return notOk({
+			kind: "extensionPathUnreachable",
+			spaceId: space.spaceId,
+			target: headRef.hash
+		});
+		perSpace.set(space.spaceId, {
+			plan: {
+				targetId: aggregate.targetId,
+				spaceId: space.spaceId,
+				origin: currentMarker === null ? null : { storageHash: currentMarker.storageHash },
+				destination: { storageHash: headRef.hash },
+				operations: []
+			},
+			displayOps: [],
+			destinationContract: space.contract(),
+			strategy: "declared-state",
+			migrationEdges: [buildFabricatedMigrationEdge({
+				currentMarkerStorageHash: currentMarker?.storageHash,
+				destinationStorageHash: headRef.hash,
+				operationCount: 0
+			})]
+		});
+	}
+	return ok({
+		perSpace,
+		applyOrder: [...aggregate.extensions.map((m) => m.spaceId), aggregate.app.spaceId]
+	});
+}
+function pathIsUnder(path, prefix) {
+	if (path.length < prefix.length) return false;
+	return prefix.every((segment, i) => path[i] === segment);
+}
+/**
+* Whether an issue's subject is a WHOLE top-level entity — as opposed to
+* something nested under one (e.g. a field, an index, or a policy). Calls
+* the injected `classify` capability, which resolves this from the issue's
+* node `nodeKind` (this aggregate never reaches into the node itself).
+* Absent `classify` (or a `classify` that returns nothing for this issue —
+* a family that doesn't classify) falls back to path shape: a
+* top-level entity's path is exactly its own name (one segment), so
+* anything deeper is nested.
+*/
+function isWholeEntityIssue(issue, classify) {
+	const granularity = classify?.(issue);
+	if (granularity !== void 0) return granularity === "entity";
+	return issue.path.length === 1;
+}
+/**
+* A contract space's contract-satisfaction view. Strips the top-level entity
+* extras — the `not-expected` findings on whole-entity nodes (plus the
+* findings the differ's total descent reported under those entities). Those
+* belong to the standalone unclaimed-elements list
+* ({@link collectExtraElementCoordinates}), never a space's own verdict.
+*
+* Nested `not-expected` findings (an extra field on the space's own
+* declared entity…) and structural findings (an undeclared policy) are
+* the space's **own drift** and stay.
+*
+* The verdict recomputes from the surviving list: the per-space result is
+* issue-based (`ok` ⇔ the list is empty), so a space whose only failures
+* were top-level extras passes after the strip.
+*/
+function stripExtraFindings(result, classify) {
+	const droppedTablePaths = result.schema.issues.filter((issue) => issueOutcome(issue) === "not-expected" && isWholeEntityIssue(issue, classify)).map((issue) => issue.path);
+	const issues = result.schema.issues.filter((issue) => {
+		if (issueOutcome(issue) !== "not-expected") return true;
+		if (classify?.(issue) === "structural") return true;
+		return !droppedTablePaths.some((prefix) => pathIsUnder(issue.path, prefix));
+	});
+	if (issues.length === result.schema.issues.length) return result;
+	const ok = issues.length === 0;
+	const { code: staleCode, ...envelope } = result;
+	return {
+		...envelope,
+		ok,
+		...ok ? {} : { code: result.code ?? "CONTRACT.MARKER_REQUIRED" },
+		summary: ok ? "Database schema satisfies contract" : result.summary,
+		schema: {
+			issues,
+			...result.schema.warnings !== void 0 ? { warnings: result.schema.warnings } : {}
+		}
+	};
+}
+/**
+* The schema-IR entity coordinate a `not-expected` `SchemaDiffIssue`
+* addresses, when its subject is a whole top-level entity. A nested leaf
+* (a field, an index, a policy on an undeclared entity) has no entity of
+* its own to report here.
+*
+* The whole-entity's name is the last path segment: the differ builds each
+* path from its nodes' ids, so at a whole-entity finding the last segment is
+* exactly the entity name — for every family, whether or not it stamps a
+* granularity. The namespace segment only exists for namespace-qualified
+* paths (`['database', namespaceId, entityName]`); single-namespace families
+* (a flat `['database', entityName]`, or a bare `[entityName]`) have no
+* separate segment, so every entity they declare implicitly shares one
+* namespace — the same sentinel the aggregate's own coordinate walk uses
+* for those families.
+*
+* `entityKind` is asked from the injected `classifyEntityKind` capability —
+* this module never names a family entity kind itself. Absent a classifier
+* (the classifier-absent path-shape fallback, e.g. a document family) the
+* coordinate carries {@link UNCLASSIFIED_ENTITY_KIND}: no ownership
+* consumer queries `declaresEntity` for a family in that state today, so
+* nothing reads the value as true.
+*/
+function schemaDiffIssueCoordinate(issue, classify, classifyEntityKind) {
+	if (!isWholeEntityIssue(issue, classify)) return void 0;
+	const entityName = issue.path[issue.path.length - 1];
+	if (entityName === void 0) return void 0;
+	return {
+		namespaceId: issue.path.length === 3 ? issue.path[1] ?? UNBOUND_NAMESPACE_ID : UNBOUND_NAMESPACE_ID,
+		entityKind: classifyEntityKind?.(issue) ?? "unclassified-entity",
+		entityName
+	};
+}
+/**
+* The schema-IR entity coordinates of every live element this contract
+* space's diff reports as `not-expected`, deduplicated. The verifier gathers
+* these across all spaces and keeps only the coordinates no contract space
+* declares — the standalone unclaimed-elements list, reported once for the
+* whole database.
+*/
+function collectExtraElementCoordinates(result, classify, classifyEntityKind) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const issue of result.schema.issues) {
+		if (issueOutcome(issue) !== "not-expected") continue;
+		const coordinate = schemaDiffIssueCoordinate(issue, classify, classifyEntityKind);
+		if (coordinate === void 0) continue;
+		seen.set(coordinateKey(coordinate), coordinate);
+	}
+	return [...seen.values()];
+}
+/**
+* Verify a {@link ContractSpaceAggregate} against the live database
+* state. Bundles two checks:
+*
+* - `markerCheck` per contract space: compare the live marker row against the
+*   space's `headRef.hash` + `headRef.invariants`. Absence is a
+*   distinct kind, not an error (callers — `db verify` strict vs
+*   `db init` precondition — choose how to interpret it).
+* - `schemaCheck`: two distinct outputs from the per-space diffs.
+*   `perSpace` — each space verified against the **full**
+*   introspected schema, then its extras stripped, leaving the space's
+*   declared nodes (its contract-satisfaction view; verdict is
+*   missing/mismatch only). `unclaimed` — the extras gathered
+*   across every space, deduplicated, and filtered to the names no contract
+*   space declares (via the passive aggregate's ownership query); reported
+*   once for the database. No schema is pruned before verifying.
+*
+* `markerCheck.orphanMarkers` lists every marker row whose `space` is
+* not a contract space of the aggregate. `db verify` callers reject orphans;
+* future tooling may not.
+*
+* Pure synchronous function; no I/O. The caller (CLI) gathers
+* `markersBySpaceId` and `schemaIntrospection` ahead of the call.
+*/
+function verifyMigration(input) {
+	try {
+		return runVerifyMigration(input);
+	} catch (error) {
+		return notOk({
+			kind: "introspectionFailure",
+			detail: error instanceof Error ? error.message : String(error)
+		});
+	}
+}
+function runVerifyMigration(input) {
+	const { aggregate, markersBySpaceId, schemaIntrospection, mode, verifySchemaForSpace, classifySubjectGranularity, classifyEntityKind } = input;
+	const allSpaces = [aggregate.app, ...aggregate.extensions];
+	const aggregateSpaceIds = new Set(allSpaces.map((m) => m.spaceId));
+	const markerPerSpace = /* @__PURE__ */ new Map();
+	for (const space of allSpaces) {
+		const marker = markersBySpaceId.get(space.spaceId) ?? null;
+		if (marker === null) {
+			markerPerSpace.set(space.spaceId, { kind: "absent" });
+			continue;
+		}
+		const headRef = requireHeadRef(space);
+		if (marker.storageHash !== headRef.hash) {
+			markerPerSpace.set(space.spaceId, {
+				kind: "hashMismatch",
+				markerHash: marker.storageHash,
+				expected: headRef.hash
+			});
+			continue;
+		}
+		const markerInvariants = new Set(marker.invariants);
+		const missing = headRef.invariants.filter((id) => !markerInvariants.has(id));
+		if (missing.length > 0) {
+			markerPerSpace.set(space.spaceId, {
+				kind: "missingInvariants",
+				missing: [...missing].sort()
+			});
+			continue;
+		}
+		markerPerSpace.set(space.spaceId, { kind: "ok" });
+	}
+	const orphanMarkers = [];
+	for (const [spaceId, row] of markersBySpaceId) if (row !== null && !aggregateSpaceIds.has(spaceId)) orphanMarkers.push({
+		spaceId,
+		row
+	});
+	orphanMarkers.sort((a, b) => a.spaceId.localeCompare(b.spaceId));
+	const schemaPerSpace = /* @__PURE__ */ new Map();
+	const extraCoordinates = /* @__PURE__ */ new Map();
+	for (const space of allSpaces) {
+		const result = verifySchemaForSpace(schemaIntrospection, space, mode);
+		schemaPerSpace.set(space.spaceId, stripExtraFindings(result, classifySubjectGranularity));
+		for (const coordinate of collectExtraElementCoordinates(result, classifySubjectGranularity, classifyEntityKind)) extraCoordinates.set(coordinateKey(coordinate), coordinate);
+	}
+	const unclaimed = [...new Set([...extraCoordinates.values()].filter((coordinate) => !aggregate.declaresEntity(coordinate)).map((coordinate) => coordinate.entityName))].sort((a, b) => a.localeCompare(b));
+	return ok({
+		markerCheck: {
+			perSpace: markerPerSpace,
+			orphanMarkers
+		},
+		schemaCheck: {
+			perSpace: schemaPerSpace,
+			unclaimed
+		}
+	});
+}
+//#endregion
+export { createAggregateContractSpace as a, loadProblemToViolation as c, resolveRecordedPath as d, verifyMigration as f, computeIntegrityViolations as i, planMigration as l, buildFabricatedMigrationEdge as n, createContractSpaceAggregate as o, collectAggregateNamespaces as r, loadContractSpaceAggregate as s, allStorageElementsExternal as t, requireHeadRef as u };
+
+//# sourceMappingURL=aggregate-B4mhR4Sk.mjs.map