@prisma/orm-toolchain 8.0.0-rc.1-dev.39 → 8.0.0-rc.1-dev.40

package/dist/cli.mjs

@@ -1,55 +1,58 @@
 import { i as loadConfig } from "./exports-BZLNbtkY.mjs";
-import { I as requireLiveDatabase, L as runCommandAction, M as errorTargetMigrationNotSupported, O as errorRunnerFailed, P as errorUnexpected, a as errorConfigValidation$1, b as errorMigrationPlanningFailed, c as errorContractValidationFailed, d as errorDriverRequired, f as errorFileNotFound, g as errorLegendHumanOnly, k as errorRuntime$1, l as errorDatabaseConnectionRequired, o as errorConsentPlanMismatch, r as chooseAction, t as CliStructuredError$1$1, u as errorDestructiveChanges, x as errorNoMigrations, y as errorMigrationPackageNotFound } from "./cli-errors-BG6bItjG-DwdKIeGz.mjs";
+import { A as errorRuntime$1, F as errorUnexpected, L as requireLiveDatabase, N as errorTargetMigrationNotSupported, P as errorTargetMismatch, R as runCommandAction, S as errorNoMigrations, _ as errorLegendHumanOnly, a as errorConfigValidation$1, b as errorMigrationPackageNotFound, d as errorDestructiveChanges, f as errorDriverRequired, k as errorRunnerFailed, l as errorContractValidationFailed, m as errorHashMismatch, o as errorConsentPlanMismatch, p as errorFileNotFound, r as chooseAction, s as errorContractArgConflict, t as CliStructuredError$1$1, u as errorDatabaseConnectionRequired, x as errorMigrationPlanningFailed, y as errorMarkerMissing } from "./cli-errors-B4zTLaqQ-CXgjO9t4.mjs";
 import { r as getEmittedArtifactPaths } from "./exports-BCLg4CiV-05kuwcb0.mjs";
-import { n as executeContractEmit } from "./contract-emit-CZQZ1i4z-p9LSGmmQ.mjs";
+import { n as executeContractEmit } from "./contract-emit-DFScp9D6-6H-UJMFv.mjs";
 import { h as renderPreviewStatement, m as previewBlockHeader } from "./terminal-ui-Cqz4LVL7-B0mcVdLy.mjs";
 import { c as spaceMigrationDirectory } from "./verify-contract-spaces-DhJTb0zM-_oh6W6lp.mjs";
-import { S as targetSupportsMigrations, f as maskConnectionUrl, h as readContractEnvelope, n as closeQuietly, v as sanitizeErrorMessage } from "./command-helpers-CwLvFwMB-BWwUQhlT.mjs";
-import { t as createContractEmitCommand } from "./contract-emit-BQFpcb2A-BwT9iVdb.mjs";
-import { n as executeFormat, t as createFormatCommand } from "./format-cbJY7l6v-CjMUDTAs.mjs";
-import { c as targetLabel, i as scaffoldSpecifierResolverFor, l as targetPackageName, n as dbFile, o as starterSchema, r as defaultSchemaPath, t as configFile } from "./code-templates-CSLH8721-CWRA4Lru.mjs";
-import { a as loadContractSpaceAggregateForCli, i as loadContractRawSafely, l as refusePackageCorruptionOnAggregate, r as buildReadAggregate, s as refuseContractSpaceIntegrity, u as toDeclaredExtensionsFromRaw } from "./contract-space-aggregate-loader-CoLTf3Ce-pQDru2w0.mjs";
-import { t as createControlClient } from "./client-DU9qtBxW-BjVHiKzE.mjs";
+import { S as targetSupportsMigrations, f as maskConnectionUrl, h as readContractEnvelope, n as closeQuietly, v as sanitizeErrorMessage } from "./command-helpers-BCgwcqTe-lNCtppzM.mjs";
+import { t as createContractEmitCommand } from "./contract-emit-DsvAx-dY-DQzoDO34.mjs";
+import { n as executeFormat, t as createFormatCommand } from "./format-Ca7dUE6B-BMFqrc6D.mjs";
+import { c as targetLabel, i as scaffoldSpecifierResolverFor, l as targetPackageName, n as dbFile, o as starterSchema, r as defaultSchemaPath, t as configFile } from "./code-templates-D73q329L-CSx0Jg-6.mjs";
+import { a as loadContractSpaceAggregateForCli, i as loadContractRawSafely, l as refusePackageCorruptionOnAggregate, r as buildReadAggregate, s as refuseContractSpaceIntegrity, u as toDeclaredExtensionsFromRaw } from "./contract-space-aggregate-loader-fa04OIaL-B7LXHle3.mjs";
+import { t as createControlClient } from "./client-C6Qp5ujC-Dxb7r79B.mjs";
 import { a as readContractIR, o as resolveRefAdvancementFields, t as advanceRefSafely } from "./ref-advancement-DaZBzm7m-WoqnFAyr.mjs";
-import { t as mapDbInitFailure } from "./db-init-failure-BmCcHUfc-BqDxyrJE.mjs";
-import { t as resolveContractRefToSnapshot } from "./contract-snapshot-resolution-DvZvbNcZ-DHFCWe_k.mjs";
-import { t as mapCaughtMigrationError } from "./caught-errors-DLPzfzIW-CQ9BoXD-.mjs";
-import { t as mapContractAtError } from "./contract-at-errors-Dptf8RE_-B5gr04Sc.mjs";
-import { i as refuseUnknownInvariants, n as refuseMarkerOutsideGraph, r as refuseMissingInvariantPath, t as hasMigrationPath } from "./invariants-1zL5-9Mc-BCeOLxd_.mjs";
-import { t as executeMigrateShowPlan } from "./migrate-show-kVUG1xdo-bVTW8tu4.mjs";
-import { n as resolveMigrationRef, t as resolveContractRef } from "./ref-resolution-DAK4OK3x-B-8ZZc0f.mjs";
-import { n as migrationSpaceListEntriesFromAggregate, r as runMigrationList, t as listRefsByContractHash } from "./migration-list-BQTfSGbT-DoNqbNsu.mjs";
+import { t as mapDbInitFailure } from "./db-init-failure-B5cQML4A-5zr-99Ek.mjs";
+import { t as resolveContractRefToSnapshot } from "./contract-snapshot-resolution-De2VvOJn-DqIAV9cr.mjs";
+import { t as combineVerifyResults } from "./combine-verify-results-B87B_pMc-D4l22OqY.mjs";
+import { t as mapCaughtMigrationError } from "./caught-errors-BZo7zcRc-C-pIEasG.mjs";
+import { t as mapContractAtError } from "./contract-at-errors-BSoDI0Hw-BXeUNE3s.mjs";
+import { i as refuseUnknownInvariants, n as refuseMarkerOutsideGraph, r as refuseMissingInvariantPath, t as hasMigrationPath } from "./invariants-Bltd8DyA-Cg_1Lu0q.mjs";
+import { t as executeMigrateShowPlan } from "./migrate-show-C_9xR4Qt-B-Y0PGKw.mjs";
+import { n as resolveMigrationRef, t as resolveContractRef } from "./ref-resolution-BSN1amKm-C6-TTM2N.mjs";
+import { n as migrationSpaceListEntriesFromAggregate, r as runMigrationList, t as listRefsByContractHash } from "./migration-list-CY08bD8I-PoXuv94c.mjs";
 import { C as toneSpans, S as toneDrawing, b as renderMigrationGraphSpaceTrees, d as createToneMigrationListStyler, m as indentMigrationGraphTreeBlock, n as TONE_MIGRATION_GRAPH_PALETTE, v as renderMigrationGraphLegend, x as renderMigrationListWithStyle } from "./migration-graph-command-render-h0VdTkSM-C3rPZEw1.mjs";
-import { n as migrateShowRunListRows, r as renderMigrateShowGraph, t as mapMigrateFailure } from "./migrate-failure-CKMEnA_x-ByHkYjn5.mjs";
-import { n as looksLikePath, r as resolveAppTargetPath, t as findPackageByDirPath } from "./migration-path-target-BNTSTPAc-D7dQ4K7x.mjs";
-import { t as buildMigrationSpaceGraphEntries } from "./migration-graph-B30X5398-BH3zB9Mn.mjs";
-import { n as renderMigrationGraphDot, r as renderMigrationGraphSections, t as buildMigrationGraphTreeSections } from "./migration-graph-sections-B8WSWSkJ-CyaRo0T6.mjs";
+import { n as migrateShowRunListRows, r as renderMigrateShowGraph, t as mapMigrateFailure } from "./migrate-failure-D4NvkoCk-0bttmQs2.mjs";
+import { n as looksLikePath, r as resolveAppTargetPath, t as findPackageByDirPath } from "./migration-path-target-JDWqF9kj-B7zoMq6X.mjs";
+import { i as runMigrationCheck, n as enumerateCheckSpaces, r as loadAggregateIntegrityViolations, t as checkSingleTarget } from "./migration-check-Bbdw7t-r-C2VTMK61.mjs";
+import { t as integrityViolationToCheckFailure } from "./integrity-violation-to-check-failure-BmWMLAae-DqiC4_3p.mjs";
+import { t as buildMigrationSpaceGraphEntries } from "./migration-graph-B8WxW_tm-qGNf7jQh.mjs";
+import { n as renderMigrationGraphDot, r as renderMigrationGraphSections, t as buildMigrationGraphTreeSections } from "./migration-graph-sections-BBHPOFN--COKyUKQ4.mjs";
 import { a as sortLedgerEntries, i as serializeLedgerEntriesForJson, n as formatLedgerAppliedAt, o as styleHashTransition, t as MIGRATION_LOG_EMPTY_MESSAGE } from "./migration-log-table-eES9lPjv-BCFm8qJr.mjs";
-import { t as executeMigrationNewCommand } from "./migration-new-Bp5dPKnF-D-Fb6vEp.mjs";
-import { t as executeMigrationPlanCommand } from "./migration-plan-C6KrFHJT-CRkTsE7L.mjs";
+import { t as executeMigrationNewCommand } from "./migration-new-DXMvJdbB-BkrpDfcr.mjs";
+import { t as executeMigrationPlanCommand } from "./migration-plan-Cfz0efEL-DMNFq5b2.mjs";
 import { a as statusForMigrationHash, i as readMigrationRefs, n as deriveStatusEdgeAnnotations, r as originHashForStatus, t as appliedHashesFromLedger } from "./refs-fQLFcMoq-aTBeUU9H.mjs";
-import { n as executeRefListCommand, r as executeRefSetCommand, t as executeRefDeleteCommand } from "./ref-C8oaaeky-ColNkWpr.mjs";
-import { A as isRecognisedPnpmResolutionError, B as removeDependency, C as findStaleArtifacts, E as formatRunCommand, F as mergeTsConfig, G as validateSchemaPath, H as resolveAuthoring, I as minimalProjectReadmeMd, L as probeServerVersion, M as mergeGitattributes, N as mergeGitignore, O as formatSkillSourceUrl, P as mergePackageScripts, R as quickReferenceMd, S as errorInitWriteFailed, U as resolveProjectSkillInstallCommands, V as requiredGitattributesLines, W as resolveTarget, _ as errorInitProbeFailed, a as TsConfigParseError, b as errorInitStrictProbeWithoutProbe, d as envFileContent, g as errorInitMissingFlags, h as errorInitInvalidTsconfig, i as REQUIRED_SCRIPTS, j as legacySkillDirs, l as ensureEsmModuleType, m as errorInitInvalidManifest, n as DEFAULT_SKILL_SOURCES, o as buildCatalogWarnings, r as MIN_SERVER_VERSION, s as defaultTsConfig, t as DEFAULT_SKILL_AGENTS, u as envExampleContent, x as errorInitUserAborted, z as redactSecrets } from "./redact-secrets-kQ0KKV1u-MnVSKe-u.mjs";
+import { n as executeRefListCommand, r as executeRefSetCommand, t as executeRefDeleteCommand } from "./ref-WXLIR9Xm-12IUtoBU.mjs";
+import { A as isRecognisedPnpmResolutionError, B as removeDependency, C as findStaleArtifacts, E as formatRunCommand, F as mergeTsConfig, G as validateSchemaPath, H as resolveAuthoring, I as minimalProjectReadmeMd, L as probeServerVersion, M as mergeGitattributes, N as mergeGitignore, O as formatSkillSourceUrl, P as mergePackageScripts, R as quickReferenceMd, S as errorInitWriteFailed, U as resolveProjectSkillInstallCommands, V as requiredGitattributesLines, W as resolveTarget, _ as errorInitProbeFailed, a as TsConfigParseError, b as errorInitStrictProbeWithoutProbe, d as envFileContent, g as errorInitMissingFlags, h as errorInitInvalidTsconfig, i as REQUIRED_SCRIPTS, j as legacySkillDirs, l as ensureEsmModuleType, m as errorInitInvalidManifest, n as DEFAULT_SKILL_SOURCES, o as buildCatalogWarnings, r as MIN_SERVER_VERSION, s as defaultTsConfig, t as DEFAULT_SKILL_AGENTS, u as envExampleContent, x as errorInitUserAborted, z as redactSecrets } from "./redact-secrets-Cvia6eTB-BE_Pg3k9.mjs";
 import { n as buildNextSteps, t as InitOutputSchema } from "./output-DP3woAjV-BxCr9nHA.mjs";
 import { CliStructuredError } from "@prisma/orm-framework/errors/control";
 import { ifDefined } from "@prisma/orm-framework/utils/defined";
 import { basename, dirname, isAbsolute, join, normalize, relative, resolve } from "pathe";
 import { existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { DOCS_BASE, docsUrlFor, isStructuredError } from "@prisma/orm-framework/utils/structured-error";
+import { DOCS_BASE, docsUrlFor, isStructuredError, isStructuredErrorCode } from "@prisma/orm-framework/utils/structured-error";
 import { blindCast, castAs } from "@prisma/orm-framework/utils/casts";
-import { InternalError, assertNever } from "@prisma/orm-framework/utils/internal-error";
+import { InternalError, assertNever, isInternalError } from "@prisma/orm-framework/utils/internal-error";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { APP_SPACE_ID, createControlStack } from "@prisma/orm-framework/components/control";
+import { APP_SPACE_ID, VERIFY_CODE_HASH_MISMATCH, VERIFY_CODE_MARKER_MISSING, VERIFY_CODE_TARGET_MISMATCH, createControlStack, issueOutcome } from "@prisma/orm-framework/components/control";
 import { type } from "arktype";
 import { collectConfigIssues } from "@prisma/orm-framework/config/config-validation";
 import { tmpdir } from "node:os";
 import { detect } from "package-manager-detector/detect";
 import { printPsl } from "@prisma/orm-framework/psl-printer";
-import { defineCommand, defineCommandFamily, defineConfigSection, flag, positional } from "@prisma/cli-engine";
+import { defineCommand, defineCommandFamily, defineConfigSection, defineServerCommand, flag, positional } from "@prisma/cli-engine";
 import { CliStructuredError as CliStructuredError$1, notOk, ok } from "@prisma/cli-engine/protocol";
 import { pathToFileURL } from "node:url";
 import { build } from "esbuild";
-//#region ../../../1-framework/3-tooling/cli/dist/load-config-DWFCZvpn.mjs
+//#region ../../../1-framework/3-tooling/cli/dist/load-config-CVli79Ro.mjs
 const MISSING_CONFIG_ACTION = {
 	kind: "run-command",
 	label: "Create a config file",
@@ -259,6 +262,11 @@ function normalizeError(error) {
 * prisma/prisma's `CliStructuredError` — both classes carry that name — and then settles it
 * through fields the engine's own class has and this one does not. The envelope that results is
 * off-protocol. Catching here means every handler settles through the single conversion instead.
+*
+* An `InternalError` is the one thing this boundary does not convert. Its own contract says never
+* to catch it outside the outermost boundary: it means an invariant broke, which is a bug in
+* Prisma Next rather than something the user did. Re-throwing lets the engine settle it as a bug
+* at exit 1, where converting it would report the same number as a bad connection string.
 */
 function defineOrmCommand(def) {
 	return defineCommand({
@@ -267,6 +275,7 @@ function defineOrmCommand(def) {
 			try {
 				return await def.handler(args, ctx);
 			} catch (error) {
+				if (isInternalError(error)) throw error;
 				return notOk(normalizeError(error));
 			}
 		}
@@ -1108,7 +1117,7 @@ function treeNode(node) {
 		...ifDefined("children", node.children === void 0 || node.children.length === 0 ? void 0 : node.children.map(treeNode))
 	};
 }
-function schemaPresentations(inputs) {
+function schemaPresentations$1(inputs) {
 	const { document, schemaView, database } = inputs;
 	return {
 		human: () => [...database === void 0 ? [] : [{
@@ -1185,7 +1194,7 @@ function createDbSchemaCommand(createClient) {
 				meta: { ...ifDefined("dbUrl", database) },
 				timings: { total: Date.now() - startedAt }
 			};
-			return ok(ctx.present({ data: document }, schemaPresentations({
+			return ok(ctx.present({ data: document }, schemaPresentations$1({
 				document,
 				schemaView,
 				database
@@ -1195,6 +1204,372 @@ function createDbSchemaCommand(createClient) {
 }
 const dbSchemaCommand = createDbSchemaCommand(createControlClient);
 /**
+* Reads the emitted contract and hydrates it through the family's
+* `deserializeContract` seam, which is where every other on-disk contract read
+* in this CLI crosses into family types.
+*/
+async function readEmittedContract(inputs) {
+	const path = contractPathFor(inputs.config, inputs.cwd);
+	if (path === void 0) return notOk(normalizeError(errorConfigValidation$1("contract.output", {
+		why: `${inputs.commandName} reads the emitted contract from config.contract.output; the config has no value to read.`,
+		section: "contract"
+	})));
+	const relativePath = displayPath(path, inputs.cwd);
+	let content;
+	try {
+		content = await readFile(path, "utf-8");
+	} catch (error) {
+		return notOk(normalizeError(Reflect.get(Object(error), "code") === "ENOENT" ? errorFileNotFound(path, {
+			why: `Contract file not found at ${path}`,
+			fix: `Run \`prisma-next contract emit\` to generate ${relativePath}, or update \`contract.output\` in prisma-next.config.ts`
+		}) : errorUnexpected(error instanceof Error ? error.message : String(error), { why: `Failed to read contract file: ${error instanceof Error ? error.message : String(error)}` })));
+	}
+	const familyInstance = inputs.config.family.create(createControlStack(inputs.config));
+	try {
+		return ok({
+			contract: familyInstance.deserializeContract(castAs(JSON.parse(content))),
+			path,
+			displayPath: relativePath
+		});
+	} catch (error) {
+		return notOk(normalizeError(errorContractValidationFailed(`Contract JSON is invalid: ${error instanceof Error ? error.message : String(error)}`, { where: { path } })));
+	}
+}
+/**
+* The connection and driver both verification commands need. Returns the
+* resolved connection or the precondition failure that stopped the run.
+*/
+function requireVerifyConnection(inputs) {
+	const dbConnection = inputs.db ?? inputs.config.db?.connection;
+	if (typeof dbConnection !== "string" || dbConnection.length === 0) return notOk(normalizeError(errorDatabaseConnectionRequired({
+		why: `Database connection is required for ${inputs.invocation} (set db.connection in prisma-next.config.ts, or pass --db <url>)`,
+		missingFlags: ["--db"],
+		retryCommand: `prisma-next ${inputs.invocation} --db <url>`
+	})));
+	if (inputs.config.driver === void 0) return notOk(normalizeError(errorDriverRequired({ why: `Config.driver is required for ${inputs.invocation}` })));
+	return ok(dbConnection);
+}
+/**
+* A failure the verification could not recover from — a dropped connection, a
+* driver throw — as a settlement the user can act on. Connection strings are
+* stripped from the prose whichever path the value took. A driver error
+* carrying `ECONNREFUSED`, `ENOTFOUND` or a SQLSTATE has a `code` and takes
+* the first path, and its message is exactly the one likely to quote the URL.
+*/
+function verificationThrow(inputs) {
+	const { error } = inputs;
+	const message = error instanceof Error ? error.message : String(error);
+	return withoutConnectionString(typeof error === "object" && error !== null && "code" in error ? normalizeError(error) : normalizeError(errorUnexpected(message, { why: `Unexpected error during ${inputs.invocation}: ${message}` })), inputs.connection);
+}
+/**
+* The same envelope with the connection string stripped from every field the
+* settlement serializes: the prose, each next action's strings, and every
+* string reachable through `meta`. A driver error quotes the URL wherever it
+* pleases, so nothing user-facing passes through unstripped.
+*/
+function withoutConnectionString(error, connection) {
+	const clean = (text) => sanitizeErrorMessage(text, connection);
+	return new CliStructuredError$1(error.code, clean(error.message), {
+		severity: error.severity,
+		nextActions: error.nextActions.map((action) => cleanNextAction(action, clean)),
+		...ifDefined("why", error.why === void 0 ? void 0 : clean(error.why)),
+		...ifDefined("where", error.where),
+		...ifDefined("meta", error.meta === void 0 ? void 0 : cleanMetaRecord(error.meta, clean)),
+		...ifDefined("docsUrl", error.docsUrl),
+		cause: error.cause
+	});
+}
+function cleanNextAction(action, clean) {
+	return {
+		kind: action.kind,
+		label: clean(action.label),
+		...ifDefined("command", action.command === void 0 ? void 0 : clean(action.command)),
+		...ifDefined("commands", action.commands?.map(clean)),
+		...ifDefined("url", action.url === void 0 ? void 0 : clean(action.url)),
+		...ifDefined("reason", action.reason === void 0 ? void 0 : clean(action.reason))
+	};
+}
+function cleanMetaValue(value, clean) {
+	if (typeof value === "string") return clean(value);
+	if (Array.isArray(value)) return value.map((entry) => cleanMetaValue(entry, clean));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, cleanMetaValue(entry, clean)]));
+	return value;
+}
+function cleanMetaRecord(meta, clean) {
+	return Object.fromEntries(Object.entries(meta).map(([key, value]) => [key, cleanMetaValue(value, clean)]));
+}
+const OUTCOME_LABEL = {
+	"not-found": "missing",
+	"not-expected": "extra",
+	"not-equal": "mismatch"
+};
+/** What a diff issue says, in the words the commander shell used. */
+function issueLabel(issue) {
+	return `${OUTCOME_LABEL[issueOutcome(issue)]}: ${issue.path.join("/")}`;
+}
+function issueNodes(issues, status) {
+	return issues.map((issue) => ({
+		label: issueLabel(issue),
+		status
+	}));
+}
+/**
+* The drift, laid out as a tree the engine draws: one root per finding family,
+* one child per element. The engine owns the connectors and the status glyphs,
+* so nothing here carries an escape sequence.
+*/
+function schemaFindingBlocks(inputs) {
+	const roots = [];
+	const issues = inputs.result.schema.issues;
+	if (issues.length > 0) roots.push({
+		label: "Schema issues",
+		status: "error",
+		children: issueNodes(issues, "error")
+	});
+	const warnings = inputs.result.schema.warnings?.issues ?? [];
+	if (warnings.length > 0) roots.push({
+		label: "Schema warnings",
+		status: "warn",
+		children: issueNodes(warnings, "warn")
+	});
+	if (inputs.unclaimed.length > 0) {
+		const status = inputs.strict ? "error" : "warn";
+		roots.push({
+			label: "Unclaimed elements (declared by no contract)",
+			status,
+			children: inputs.unclaimed.map((name) => ({
+				label: name,
+				status
+			}))
+		});
+	}
+	return roots.length === 0 ? [] : [{
+		kind: "tree",
+		roots
+	}];
+}
+/**
+* A failed schema-verification verdict as one envelope diagnostic. `error` is
+* the honest severity: the database does not satisfy the contract. It is legal
+* because both commands settle at exit 4 — the engine refuses a
+* severity-`error` diagnostic only on a run that exits 0.
+*/
+function schemaVerdictDiagnostic(inputs) {
+	const code = inputs.result.code;
+	const dotted = code !== void 0 && isStructuredErrorCode(code);
+	const issues = inputs.result.schema.issues.map(issueLabel);
+	return {
+		code: dotted ? code : "CONTRACT.VERIFY_FAILED",
+		severity: "error",
+		summary: inputs.result.summary,
+		...issues.length === 0 ? {} : { why: `The live schema differs: ${issues.join("; ")}.` },
+		nextActions: inputs.nextActions,
+		meta: {
+			...inputs.space === void 0 ? {} : { space: inputs.space },
+			issues,
+			...dotted || code === void 0 ? {} : { code }
+		}
+	};
+}
+/**
+* Verification ran and refused the signature. The command completed — it
+* answered the question "may this database be signed?" — so the refusal is a
+* diagnostic on a completed envelope rather than an error.
+*/
+const FINDINGS_EXIT_CODE$2 = 4;
+/** The config file this bin reads; the handler is not told which one was loaded. */
+const CONFIG_DISPLAY_PATH = "prisma-next.config.ts";
+function headerBlock$1(inputs) {
+	return {
+		kind: "fields",
+		rail: true,
+		rows: [{
+			label: "contract",
+			value: inputs.contract
+		}, {
+			label: "database",
+			value: inputs.database
+		}]
+	};
+}
+function signPresentations(inputs) {
+	const marker = inputs.document.marker;
+	return {
+		human: () => [
+			inputs.header,
+			{
+				kind: "summary",
+				status: "ok",
+				text: "Database signed"
+			},
+			{
+				kind: "fields",
+				rows: [{
+					label: "from",
+					value: marker.previous?.storageHash === void 0 ? [{
+						text: "none",
+						tone: "muted"
+					}] : [{
+						text: marker.previous.storageHash,
+						tone: "identifier"
+					}]
+				}, {
+					label: "to",
+					value: [{
+						text: inputs.document.contract.storageHash,
+						tone: "identifier"
+					}]
+				}]
+			}
+		],
+		json: () => inputs.document
+	};
+}
+function refusedPresentations(inputs) {
+	return {
+		human: () => [
+			inputs.header,
+			...schemaFindingBlocks({
+				result: inputs.document,
+				unclaimed: [],
+				strict: false
+			}),
+			{
+				kind: "summary",
+				status: "error",
+				text: inputs.document.summary
+			}
+		],
+		json: () => inputs.document
+	};
+}
+/**
+* Builds the command with its control-client factory injected, so tests mount
+* the same tree over a fake client instead of mocking the client module.
+*/
+function createDbSignCommand(createClient = createControlClient) {
+	return defineOrmCommand({
+		help: {
+			summary: "Sign the database with your contract so you can safely run queries",
+			description: "Verifies that your database schema satisfies the emitted contract, and if\nso, writes or updates the database signature. Idempotent and safe to run\nin CI or a deployment pipeline. The signature records that this database\ninstance is aligned with a specific contract version.\nExit codes: 0 = signed, 2 = the command could not run (unresolvable\ncontract reference, no emitted contract, unreachable database),\n4 = schema verification failed and no signature was written.",
+			examples: [
+				"db sign",
+				"db sign --db $DATABASE_URL",
+				"db sign production --db $DATABASE_URL",
+				"db sign --contract production --db $DATABASE_URL"
+			]
+		},
+		args: {
+			positionals: { contract: positional.optionalString({
+				brief: "Contract reference (hash, prefix, ref name, or migration dir name)",
+				placeholder: "contract"
+			}) },
+			flags: {
+				db: dbFlag,
+				contract: flag.string({
+					brief: "Contract reference (hash, prefix, ref name, migration dir name, <dir>^, or ./path)",
+					placeholder: "contract"
+				})
+			}
+		},
+		needs: { config: ormConfigSection },
+		exitCodes: { 4: "schema verification failed; no signature was written" },
+		handler: async (args, ctx) => {
+			const positionalContract = args.positionals.contract;
+			const flagContract = args.flags.contract;
+			if (positionalContract !== void 0 && flagContract !== void 0) return notOk(normalizeError(errorContractArgConflict({
+				positional: positionalContract,
+				flag: flagContract
+			})));
+			const contractRef = positionalContract ?? flagContract;
+			const emitted = await readEmittedContract({
+				config: ctx.config,
+				cwd: ctx.cwd,
+				commandName: "db sign"
+			});
+			if (!emitted.ok) return notOk(emitted.failure);
+			let contractInput = emitted.value.contract;
+			if (contractRef !== void 0) {
+				const resolvedRef = await resolveContractRefToSnapshot({
+					config: ctx.config,
+					migrationsDir: migrationsDirFor(ctx.config, ctx.cwd),
+					refInput: contractRef,
+					contractPathAbsolute: emitted.value.path,
+					fallbackToEmitted: true
+				});
+				if (!resolvedRef.ok) return notOk(normalizeError(resolvedRef.failure));
+				contractInput = resolvedRef.value.contractJson;
+			}
+			const connection = requireVerifyConnection({
+				config: ctx.config,
+				db: args.flags.db,
+				invocation: "db sign"
+			});
+			if (!connection.ok) return notOk(connection.failure);
+			const dbConnection = connection.value;
+			const header = headerBlock$1({
+				contract: contractRef ?? emitted.value.displayPath,
+				database: maskConnectionUrl(dbConnection)
+			});
+			const client = createClient({
+				family: ctx.config.family,
+				target: ctx.config.target,
+				adapter: ctx.config.adapter,
+				...ifDefined("driver", ctx.config.driver),
+				extensions: ctx.config.extensions ?? []
+			});
+			const onProgress = controlProgressReporter(ctx.report);
+			try {
+				const verified = await client.schemaVerify({
+					contract: contractInput,
+					strict: false,
+					connection: dbConnection,
+					onProgress
+				});
+				if (!verified.ok) {
+					const document = verified;
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$2,
+						diagnostics: [schemaVerdictDiagnostic({
+							result: verified,
+							space: void 0,
+							nextActions: [runCommandAction("Bring the database up to the contract, then sign again", "prisma-next db update")]
+						})]
+					}, refusedPresentations({
+						document,
+						header
+					})));
+				}
+				const signed = await client.sign({
+					contract: contractInput,
+					contractPath: displayPath(emitted.value.path, ctx.cwd),
+					configPath: CONFIG_DISPLAY_PATH,
+					onProgress
+				});
+				if (!signed.ok) throw new InternalError(`The family returned a sign result that did not sign: ${signed.summary}`);
+				return ok(ctx.present({
+					data: signed,
+					exitCode: 0
+				}, signPresentations({
+					document: signed,
+					header
+				})));
+			} catch (error) {
+				if (isInternalError(error)) throw error;
+				return notOk(verificationThrow({
+					error,
+					invocation: "db sign",
+					connection: dbConnection
+				}));
+			} finally {
+				await closeQuietly(client);
+			}
+		}
+	});
+}
+const dbSignCommand = createDbSignCommand();
+/**
 * A `db update` failure as the CLI's structured error.
 *
 * `DESTRUCTIVE_CHANGES` is handled by the command, which asks for consent and
@@ -1458,6 +1833,447 @@ function createDbUpdateCommand(createClient) {
 	});
 }
 const dbUpdateCommand = createDbUpdateCommand(createControlClient);
+/**
+* Verification ran and the database does not match the contract. The run did
+* the job it was asked to do, so this is a completed settlement carrying
+* diagnostics rather than an error.
+*/
+const FINDINGS_EXIT_CODE$1 = 4;
+const PUSH_THE_CONTRACT = runCommandAction("Push the contract to the database", "prisma-next db update");
+const RECONCILE_BY_HAND = {
+	kind: "user-choice",
+	label: "Or reconcile the differences by hand and verify again"
+};
+function errorInvalidVerifyMode(options) {
+	return new CliStructuredError$1("CLI.INVALID_VERIFY_MODE", "Invalid verify mode", {
+		why: options.why,
+		nextActions: [{
+			kind: "user-choice",
+			label: options.choose
+		}],
+		docsUrl: "https://pris.ly/db-verify"
+	});
+}
+function resolveMode(flags) {
+	if (flags.markerOnly && flags.schemaOnly) return notOk(errorInvalidVerifyMode({
+		why: "`--marker-only` and `--schema-only` cannot be used together",
+		choose: "Choose one mode: omit both to check the marker and schema, use `--marker-only` to check only the marker, or use `--schema-only` to check only the live schema."
+	}));
+	if (flags.markerOnly && flags.strict) return notOk(errorInvalidVerifyMode({
+		why: "`--strict` requires schema verification, but `--marker-only` skips it",
+		choose: "Remove `--strict`, or use `db verify` / `db verify --schema-only` when you want to check the live schema in strict mode."
+	}));
+	if (flags.schemaOnly) return ok("schema-only");
+	return ok(flags.markerOnly ? "marker-only" : "full");
+}
+function modeLabel(mode, strict) {
+	if (mode === "marker-only") return "marker only";
+	const strictness = strict ? "strict" : "tolerant";
+	return mode === "schema-only" ? `schema only (${strictness})` : `full (marker + schema, ${strictness})`;
+}
+function invocation(mode, strict) {
+	return [
+		"db verify",
+		...mode === "marker-only" ? ["--marker-only"] : [],
+		...mode === "schema-only" ? ["--schema-only"] : [],
+		...strict ? ["--strict"] : []
+	].join(" ");
+}
+/** The marker verdict as a finding, keeping the code the commander raised. */
+function markerFindingDiagnostic(result) {
+	const { ok: _ok, ...diagnostic } = normalizeError(markerFindingError(result)).toEnvelope();
+	return diagnostic;
+}
+/**
+* The aggregate verifier's per-space marker drift as a finding on a completed
+* run, keeping the `MIGRATION.CONTRACT_SPACE_VIOLATION` envelope it was
+* raised with.
+*/
+function markerDriftDiagnostic(drift) {
+	const { ok: _ok, ...diagnostic } = normalizeError(drift).toEnvelope();
+	return diagnostic;
+}
+function markerFindingError(result) {
+	if (result.code === VERIFY_CODE_MARKER_MISSING) return errorMarkerMissing();
+	if (result.code === VERIFY_CODE_HASH_MISMATCH) {
+		if (!(result.marker?.storageHash === result.contract.storageHash)) return errorHashMismatch({
+			why: "Contract storageHash does not match database marker",
+			expected: result.contract.storageHash,
+			...ifDefined("actual", result.marker?.storageHash)
+		});
+		return errorHashMismatch({
+			why: !result.contract.profileHash || result.marker?.profileHash === result.contract.profileHash ? "Contract hash does not match database marker" : "Contract profileHash does not match database marker",
+			...ifDefined("expected", result.contract.profileHash),
+			...ifDefined("actual", result.marker?.profileHash)
+		});
+	}
+	if (result.code === VERIFY_CODE_TARGET_MISMATCH) return errorTargetMismatch(result.target.expected, result.target.actual ?? "unknown");
+	return errorRuntime$1("CONTRACT.VERIFY_FAILED", result.summary, {
+		why: "Verification failed",
+		fix: "Check contract and database state"
+	});
+}
+function verifyDocument(inputs) {
+	return {
+		ok: inputs.ok,
+		summary: inputs.summary,
+		mode: inputs.mode,
+		contract: inputs.verified.contract,
+		...ifDefined("marker", inputs.verified.marker),
+		target: inputs.verified.target,
+		...ifDefined("missingCodecs", inputs.verified.missingCodecs),
+		...ifDefined("codecCoverageSkipped", inputs.verified.codecCoverageSkipped),
+		...ifDefined("schema", inputs.schema),
+		...ifDefined("unclaimed", inputs.unclaimed),
+		...ifDefined("warning", inputs.warning),
+		meta: {
+			...inputs.verified.meta ?? {},
+			schemaVerification: inputs.schemaVerification
+		},
+		timings: { total: inputs.elapsed }
+	};
+}
+function schemaSummary(combined) {
+	return {
+		summary: combined.result.summary,
+		strict: combined.result.meta?.strict ?? false,
+		warnings: (combined.result.schema.warnings?.issues ?? []).map((issue) => issue.path.join("/"))
+	};
+}
+function headerBlock(inputs) {
+	return {
+		kind: "fields",
+		rail: true,
+		rows: [
+			{
+				label: "contract",
+				value: inputs.contractPath
+			},
+			{
+				label: "mode",
+				value: modeLabel(inputs.mode, inputs.strict)
+			},
+			{
+				label: "database",
+				value: inputs.database
+			}
+		]
+	};
+}
+function verifyPresentations(inputs) {
+	const document = inputs.document;
+	const warnings = document.schema?.warnings ?? [];
+	const unclaimed = document.unclaimed ?? [];
+	return {
+		human: () => [
+			inputs.header,
+			{
+				kind: "summary",
+				status: document.ok ? "ok" : "error",
+				text: document.summary
+			},
+			...document.ok ? [{
+				kind: "fields",
+				rows: [{
+					label: "storageHash",
+					value: document.contract.storageHash
+				}, ...document.contract.profileHash === void 0 ? [] : [{
+					label: "profileHash",
+					value: document.contract.profileHash
+				}]]
+			}] : [],
+			...warnings.length === 0 && unclaimed.length === 0 ? [] : [{
+				kind: "tree",
+				roots: [...warnings.length === 0 ? [] : [{
+					label: "Schema warnings",
+					status: "warn",
+					children: warnings.map((message) => ({
+						label: message,
+						status: "warn"
+					}))
+				}], ...unclaimed.length === 0 ? [] : [{
+					label: "Unclaimed elements (declared by no contract)",
+					status: "warn",
+					children: unclaimed.map((name) => ({
+						label: name,
+						status: "warn"
+					}))
+				}]]
+			}],
+			...document.warning === void 0 ? [] : [{
+				kind: "summary",
+				status: "warn",
+				text: document.warning
+			}]
+		],
+		json: () => document
+	};
+}
+function schemaPresentations(inputs) {
+	return {
+		human: () => [
+			inputs.header,
+			...schemaFindingBlocks({
+				result: inputs.document,
+				unclaimed: inputs.document.unclaimed,
+				strict: inputs.strict
+			}),
+			{
+				kind: "summary",
+				status: inputs.document.ok ? "ok" : "error",
+				text: inputs.document.summary
+			}
+		],
+		json: () => inputs.document
+	};
+}
+/**
+* One diagnostic per contract space whose live schema does not satisfy its
+* contract, plus the combined verdict when only the unclaimed list failed it.
+*/
+function driftDiagnostics(inputs) {
+	const perSpace = [...inputs.perSpace].filter(([, result]) => !result.ok).map(([space, result]) => schemaVerdictDiagnostic({
+		result,
+		space,
+		nextActions: [PUSH_THE_CONTRACT, RECONCILE_BY_HAND]
+	}));
+	if (perSpace.length > 0) return perSpace;
+	return [schemaVerdictDiagnostic({
+		result: inputs.combined.result,
+		space: void 0,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Declare the unclaimed elements in a contract, or drop them from the database"
+		}]
+	})];
+}
+/**
+* Builds the command with its control-client factory injected, so tests mount
+* the same tree over a fake client instead of mocking the client module.
+*/
+function createDbVerifyCommand(createClient = createControlClient) {
+	return defineOrmCommand({
+		help: {
+			summary: "Check whether the database marker and live schema match your contract",
+			description: "Verifies the database marker first, then checks the database schema\nmatches your contract. Use `--marker-only` for marker-only verification,\n`--schema-only` to skip marker checks and inspect only the live schema,\nand `--strict` to fail if the database includes elements not present in\nthe contract.\nExit codes: 0 = the database matches the contract, 2 = the check could\nnot run (conflicting mode flags, no emitted contract, unreachable\ndatabase), 4 = drift or a marker finding.",
+			examples: [
+				"db verify",
+				"db verify --db $DATABASE_URL",
+				"db verify --strict",
+				"db verify --schema-only",
+				"db verify --marker-only",
+				"db verify --json"
+			]
+		},
+		args: { flags: {
+			db: dbFlag,
+			markerOnly: flag.boolean({ brief: "Skip schema verification and only check the database marker" }),
+			schemaOnly: flag.boolean({ brief: "Skip marker verification and only check whether the live schema satisfies the contract" }),
+			strict: flag.boolean({ brief: "Treat schema elements not present in the contract as an error" })
+		} },
+		needs: { config: ormConfigSection },
+		exitCodes: { 4: "verification found drift or marker findings" },
+		handler: async (args, ctx) => {
+			const strict = args.flags.strict;
+			const resolved = resolveMode({
+				markerOnly: args.flags.markerOnly,
+				schemaOnly: args.flags.schemaOnly,
+				strict
+			});
+			if (!resolved.ok) return notOk(resolved.failure);
+			const mode = resolved.value;
+			const commandInvocation = invocation(mode, strict);
+			const emitted = await readEmittedContract({
+				config: ctx.config,
+				cwd: ctx.cwd,
+				commandName: commandInvocation
+			});
+			if (!emitted.ok) return notOk(emitted.failure);
+			const connection = requireVerifyConnection({
+				config: ctx.config,
+				db: args.flags.db,
+				invocation: commandInvocation
+			});
+			if (!connection.ok) return notOk(connection.failure);
+			const dbConnection = connection.value;
+			const header = headerBlock({
+				contractPath: emitted.value.displayPath,
+				mode,
+				strict,
+				database: maskConnectionUrl(dbConnection)
+			});
+			const migrationsDir = migrationsDirFor(ctx.config, ctx.cwd);
+			const client = createClient({
+				family: ctx.config.family,
+				target: ctx.config.target,
+				adapter: ctx.config.adapter,
+				...ifDefined("driver", ctx.config.driver),
+				extensions: ctx.config.extensions ?? []
+			});
+			const onProgress = controlProgressReporter(ctx.report);
+			const startedAt = Date.now();
+			try {
+				if (mode === "schema-only") {
+					await client.connect(dbConnection);
+					const aggregate = await client.dbVerify({
+						contract: emitted.value.contract,
+						migrationsDir,
+						strict,
+						skipSchema: false,
+						skipMarker: true,
+						onProgress
+					});
+					if (!aggregate.ok) return notOk(normalizeError(aggregate.failure));
+					const combined = combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+					const document = {
+						...combined.result,
+						unclaimed: combined.unclaimed
+					};
+					return ok(ctx.present({
+						data: document,
+						exitCode: combined.result.ok ? 0 : FINDINGS_EXIT_CODE$1,
+						diagnostics: combined.result.ok ? [] : driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined
+						})
+					}, schemaPresentations({
+						document,
+						header,
+						strict
+					})));
+				}
+				const verified = await client.verify({
+					contract: emitted.value.contract,
+					connection: dbConnection,
+					onProgress
+				});
+				if (!verified.ok) {
+					const document = verifyDocument({
+						ok: false,
+						mode,
+						summary: verified.summary,
+						verified,
+						schema: void 0,
+						schemaVerification: "skipped",
+						unclaimed: void 0,
+						warning: void 0,
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: [markerFindingDiagnostic(verified)]
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				const aggregate = await client.dbVerify({
+					contract: emitted.value.contract,
+					migrationsDir,
+					strict,
+					skipSchema: mode === "marker-only",
+					skipMarker: false,
+					onProgress
+				});
+				if (!aggregate.ok) return notOk(normalizeError(aggregate.failure));
+				const drift = aggregate.value.markerDrift;
+				if (drift !== null) {
+					const driftCombined = mode === "marker-only" ? void 0 : combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+					const document = verifyDocument({
+						ok: false,
+						mode,
+						summary: normalizeError(drift).message,
+						verified,
+						schema: driftCombined === void 0 ? void 0 : schemaSummary(driftCombined),
+						schemaVerification: driftCombined === void 0 ? "skipped" : "performed",
+						unclaimed: driftCombined?.unclaimed,
+						warning: void 0,
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: [markerDriftDiagnostic(drift), ...driftCombined !== void 0 && !driftCombined.result.ok ? driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined: driftCombined
+						}) : []]
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				if (mode === "marker-only") {
+					const document = verifyDocument({
+						ok: true,
+						mode,
+						summary: "Database marker matches contract",
+						verified,
+						schema: void 0,
+						schemaVerification: "skipped",
+						unclaimed: void 0,
+						warning: "Schema verification skipped because --marker-only was provided",
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: 0
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				const combined = combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+				if (!combined.result.ok) {
+					const document = {
+						...combined.result,
+						unclaimed: combined.unclaimed
+					};
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined
+						})
+					}, schemaPresentations({
+						document,
+						header,
+						strict
+					})));
+				}
+				const document = verifyDocument({
+					ok: true,
+					mode,
+					summary: "Database marker and schema match contract",
+					verified,
+					schema: schemaSummary(combined),
+					schemaVerification: "performed",
+					unclaimed: combined.unclaimed,
+					warning: void 0,
+					elapsed: Date.now() - startedAt
+				});
+				return ok(ctx.present({
+					data: document,
+					exitCode: 0
+				}, verifyPresentations({
+					document,
+					header
+				})));
+			} catch (error) {
+				if (isInternalError(error)) throw error;
+				return notOk(verificationThrow({
+					error,
+					invocation: commandInvocation,
+					connection: dbConnection
+				}));
+			} finally {
+				await closeQuietly(client);
+			}
+		}
+	});
+}
+const dbVerifyCommand = createDbVerifyCommand();
 const NOTHING_TO_FORMAT = "Nothing to format (contract source is not PSL).";
 function formatPresentations(document, cwd) {
 	const path = document.path;
@@ -1657,7 +2473,7 @@ function initPresentations(inputs) {
 * therefore skips the emit — never pays for either.
 */
 async function emitScaffoldedContract(ctx) {
-	const { executeContractEmit } = await import("./contract-emit-Bzt11N4v-BQ2Pr8KG.mjs");
+	const { executeContractEmit } = await import("./contract-emit-DDWBBvF1-BeGZCRrb.mjs");
 	const { loadConfigForSections } = await import("./exports-BZLNbtkY.mjs").then((n) => n.t);
 	const configPath = join(ctx.cwd, "prisma-next.config.ts");
 	const loaded = await loadConfigForSections(configPath, [
@@ -2408,6 +3224,71 @@ const createInitCommand = (injected) => defineOrmCommand({
 	}
 });
 const initCommand = createInitCommand({ emitScaffoldedContract });
+/**
+* R-S5-12 asks every command to end at 143 for SIGTERM and 130 otherwise, and
+* a server command is the one kind the engine leaves to do it: it settles the
+* handler's code verbatim, on the reasoning that a protocol conclusion was
+* never the CLI's to author. The two readings are in tension — this one wins
+* here, and the tension is recorded for the engine's owners, because it means
+* a SIGTERM landing after a clean `shutdown` reports 143 for a conversation
+* that ended correctly at 0.
+*/
+function signalExitCode(reason) {
+	return reason === "SIGTERM" ? 143 : 130;
+}
+const lspCommand = defineServerCommand({
+	help: {
+		summary: "Start the Prisma Next language server",
+		description: "Launches a Language Server Protocol server that publishes PSL parse diagnostics\nand handles whole-document PSL formatting for the schema inputs declared in\nyour config (contract.source.inputs). Formatting uses the Prisma Next PSL\nformatter and the formatter block from the project config.\nCommunicates over stdio; intended to be spawned by an\neditor, not run interactively. The server keeps running until the editor client\ndisconnects.",
+		examples: ["lsp"]
+	},
+	args: { flags: {
+		stdio: flag.boolean({ brief: "Communicate with the editor over stdio (the default and only transport)" }),
+		clientProcessId: flag.number({
+			brief: "Process id of the editor that spawned the server; the server ends when it dies",
+			placeholder: "pid"
+		})
+	} },
+	handler: async (args, io) => {
+		const exitCode = await withoutClientProcessIdInArgv(async () => {
+			const { startServer } = await import("./exports-B3xY_FHp.mjs");
+			return startServer({
+				stdin: io.stdin,
+				stdout: io.stdout,
+				stderr: io.stderr,
+				signal: io.signal,
+				...ifDefined("clientProcessId", args.flags.clientProcessId)
+			});
+		});
+		return io.signal.aborted ? signalExitCode(io.signal.reason) : exitCode;
+	}
+});
+/**
+* Importing `vscode-languageserver/node` reads `--clientProcessId` off
+* `process.argv` and arms a parent-watch interval that is never unref'd, so a
+* settled run would leave the process hanging. The server watches the client
+* process itself (from the parsed flag), so the argument is hidden for the
+* import and restored after.
+*/
+async function withoutClientProcessIdInArgv(run) {
+	const original = process.argv;
+	const scrubbed = [];
+	for (let index = 0; index < original.length; index += 1) {
+		const token = original[index];
+		if (token === "--clientProcessId") {
+			index += 1;
+			continue;
+		}
+		if (token === void 0 || token.startsWith("--clientProcessId=")) continue;
+		scrubbed.push(token);
+	}
+	process.argv = scrubbed;
+	try {
+		return await run();
+	} finally {
+		process.argv = original;
+	}
+}
 const STATUS_ACTION = runCommandAction("Check every space against the database", "prisma-next migration status");
 /**
 * The route the migration will take. The graph is a drawing — the engine cannot
@@ -2729,6 +3610,146 @@ function createMigrateCommand(createClient) {
 }
 const migrateCommand = createMigrateCommand(createControlClient);
 /**
+* The check completed and the artifacts it read are not internally consistent.
+* The findings ride the envelope as diagnostics; the run itself did its job,
+* which is why this is not an errored settlement.
+*/
+const FINDINGS_EXIT_CODE = 4;
+/**
+* One integrity failure as an envelope diagnostic. `error` is the honest
+* severity: nothing about the artifacts is merely worth a look, and exit 4
+* makes it legal — the engine refuses a severity-`error` diagnostic only on a
+* run that exits 0.
+*
+* The summary leads with the path because the engine's diagnostic renderer
+* prints `code`, `summary`, `why` and the next actions and never prints
+* `where`. Several failure texts name no package on their own — a hash
+* mismatch reads "Stored hash X does not match recomputed hash Y" — so
+* without the path a project with fifty migrations cannot be told which one
+* is broken. `where` still carries the path on its own for a `--json`
+* consumer.
+*/
+function failureDiagnostic(failure) {
+	if (!isStructuredErrorCode(failure.code)) throw new InternalError(`migration check produced the failure code "${failure.code}", which is not a dotted NAMESPACE.SUBCODE.`);
+	return {
+		code: failure.code,
+		severity: "error",
+		summary: `${failure.where}: ${failure.why}`,
+		nextActions: failure.nextActions,
+		where: { path: failure.where },
+		meta: { space: failure.space }
+	};
+}
+function checkPresentations(inputs) {
+	const summary = inputs.resolvedSpaceId === void 0 ? inputs.document.summary : `${inputs.document.summary}  (space: ${inputs.resolvedSpaceId})`;
+	return {
+		human: () => [{
+			kind: "fields",
+			rail: true,
+			rows: [
+				{
+					label: "migrations",
+					value: inputs.migrationsRelative
+				},
+				...inputs.target === void 0 ? [] : [{
+					label: "target",
+					value: inputs.target
+				}],
+				...inputs.space === void 0 ? [] : [{
+					label: "space",
+					value: inputs.space
+				}]
+			]
+		}, {
+			kind: "summary",
+			status: inputs.document.ok ? "ok" : "error",
+			text: summary
+		}],
+		json: () => inputs.document
+	};
+}
+const migrationCheckCommand = defineOrmCommand({
+	help: {
+		summary: "Verify artifact and graph integrity",
+		description: "Validates that on-disk migration packages are internally consistent\n(hashes match, manifests are complete) and that the graph is well-formed\n(edges connect, refs point at valid nodes). The whole-graph check spans\nevery contract space by default; pass --space <id> to narrow to one. A\nmigration reference checks a single package, resolved across all contract\nspaces (narrow with --space; an ambiguous reference cannot be checked).\nOffline — does not consult the database.\nExit codes: 0 = all checks passed, 2 = precondition failed (unresolved\ntarget or unknown --space), 4 = integrity failure(s) found.",
+		examples: [
+			"migration check",
+			"migration check --space app",
+			"migration check 20260101-add-users",
+			"migration check 20260101-add-users --space app",
+			"migration check --json"
+		]
+	},
+	args: {
+		positionals: { target: positional.optionalString({
+			brief: "Migration reference: directory name, hash/prefix, ref, or path",
+			placeholder: "target"
+		}) },
+		flags: { space: flag.string({
+			brief: "Narrow output to a single contract space",
+			placeholder: "id"
+		}) }
+	},
+	needs: { config: ormConfigSection },
+	exitCodes: { 4: "integrity check found failures" },
+	handler: async (args, ctx) => {
+		const { target } = args.positionals;
+		const spaceFilter = args.flags.space;
+		const migrationsDir = migrationsDirFor(ctx.config, ctx.cwd);
+		const appMigrationsDir = appMigrationsDirFor(ctx.config, ctx.cwd);
+		const appMigrationsRelative = displayPath(appMigrationsDir, ctx.cwd);
+		const loaded = await buildReadAggregate(ctx.config, { migrationsDir });
+		if (!loaded.ok) return notOk(normalizeError(loaded.failure));
+		const spaces = await enumerateCheckSpaces(loaded.value.aggregate, migrationsDir, ctx.cwd);
+		let document;
+		let resolvedSpaceId;
+		if (target !== void 0) {
+			const outcome = await checkSingleTarget(target, {
+				spaces,
+				...ifDefined("spaceFilter", spaceFilter),
+				appMigrationsDir,
+				appMigrationsRelative,
+				cwd: ctx.cwd
+			});
+			if (outcome.error !== void 0) return notOk(normalizeError(outcome.error));
+			const result = outcome.result;
+			if (result === void 0 || outcome.exitCode === 2) return notOk(normalizeError(errorMigrationPackageNotFound(result?.summary ?? `Migration package for "${target}" not found on disk`)));
+			document = result;
+			resolvedSpaceId = outcome.resolvedSpaceId;
+		} else {
+			const checked = await runMigrationCheck({
+				spaces,
+				...ifDefined("spaceFilter", spaceFilter)
+			});
+			if (!checked.ok) return notOk(normalizeError(checked.failure));
+			const violations = await loadAggregateIntegrityViolations(ctx.config, migrationsDir);
+			const scoped = spaceFilter === void 0 ? violations : violations.filter((violation) => violation.kind !== "disjointness" && violation.spaceId === spaceFilter);
+			const failures = [...checked.value.failures, ...scoped.map((violation) => integrityViolationToCheckFailure(violation, migrationsDir))];
+			document = failures.length === 0 ? {
+				ok: true,
+				failures: [],
+				summary: "All checks passed"
+			} : {
+				ok: false,
+				failures: [...failures],
+				summary: `${failures.length} integrity failure(s)`
+			};
+		}
+		const diagnostics = document.failures.map(failureDiagnostic);
+		return ok(ctx.present({
+			data: document,
+			exitCode: diagnostics.length === 0 ? 0 : FINDINGS_EXIT_CODE,
+			diagnostics
+		}, checkPresentations({
+			document,
+			migrationsRelative: appMigrationsRelative,
+			target,
+			space: spaceFilter,
+			resolvedSpaceId
+		})));
+	}
+});
+/**
 * The tree is a drawing for a reader; the DOT document is a graph description
 * for another program, so it is the one thing here that belongs on stdout.
 */
@@ -4164,10 +5185,14 @@ const ormCommandFamily = defineCommandFamily({
 		"contract infer": contractInferCommand,
 		"db init": dbInitCommand,
 		"db schema": dbSchemaCommand,
+		"db sign": dbSignCommand,
 		"db update": dbUpdateCommand,
+		"db verify": dbVerifyCommand,
 		format: formatCommand,
 		init: initCommand,
+		lsp: lspCommand,
 		migrate: migrateCommand,
+		"migration check": migrationCheckCommand,
 		"migration graph": migrationGraphCommand,
 		"migration list": migrationListCommand,
 		"migration log": migrationLogCommand,