@xemahq/biome-database-nest 0.6.4 → 0.7.0

package/README.md

@@ -6,7 +6,7 @@
     <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#8B5CF6"/>
   </g>
   <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="22" fill="#F8FAFC" font-weight="700">@xemahq/biome-database-nest</text>
-  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">Centralized database wiring for Xema biome services.</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">Explicit database ownership and runtime wiring for Xema biomes</text>
   <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
 </svg>
 </p>
@@ -24,106 +24,20 @@
 
 # @xemahq/biome-database-nest
 
-> Centralized database wiring for Xema biome services.
-
-This package belongs to Layer 1 — it depends only on Layer 0 contracts and
-other Layer 1 SDKs plus npm libraries, and carries zero domain knowledge.
+> Explicit database ownership and runtime wiring for Xema biomes
 
 ## Overview
 
-Xema biome services share one Postgres database and isolate their tables per
-biome by schema (`biome_<id>`). This package makes the correct database
-construction the only construction a biome can perform, so biome services carry
-no DB boilerplate. It provides:
-
-- **The schema-qualified driver-adapter.** `createBiomePrismaAdapter` (and its
-  `…FromEnv` sibling) build a `PrismaPg` pool that passes the schema as the
-  second constructor argument — the one thing that makes Prisma qualify
-  `biome_<id>.<table>` instead of `public.<table>`. Raw queries are covered
-  separately via the libpq `search_path` option.
-- **The schema-naming convention.** `deriveBiomeSchemaName(biomeId, dbKey?)`
-  produces a deterministic, collision-resistant, 63-byte-safe schema name so
-  two biomes never collide.
-- **Config resolution.** `resolveBiomeDatabaseConfigFromEnv` reads the standard
-  `DB_*` contract (with per-key suffixes); `fetchSystemDatabaseConfig` pulls a
-  fully-resolved config from the control plane.
-- **Boot-time bootstrap.** `bootstrapBiomeDatabases` resolves config, writes an
-  inline CA cert if supplied, creates the schema under an advisory lock, runs
-  `prisma migrate deploy`, and exports the resolved connection into the env.
-- **Systematic org-tenant isolation.** `createBiomePrismaService` detects
-  org-scoped models (any model with an `orgId` column) from the client's
-  runtime data model and scopes every query on them to the request's org via a
-  Prisma client extension — no hand-written `where: { orgId }` per service.
-
-## Tenant isolation
-
-Org-scoped access is pushed down into the client so it is systematic instead of
-hand-written. Any model declaring the org column (default `orgId`; configurable
-via `tenantIsolation.orgField`, opt-outs via `tenantIsolation.exemptModels`) is
-detected at client construction and covered by the isolation extension.
-
-### Modes
-
-Resolution: `tenantIsolation.mode` option > `XEMA_TENANT_ISOLATION_MODE` env
-var > default `observe`. An invalid env value fails the boot — it never
-silently weakens the mode.
-
-| Mode | Behavior of the default injected client |
-| --- | --- |
-| `observe` (default) | NO query is rewritten. Every violation `enforce` would reject (org mismatch in a write payload, org-model access with no org context) is logged as a structured warning. |
-| `enforce` | `where` clauses are AND-ed with `{ orgId }` (unique wheres included — a cross-org `findUnique` returns `null`, a cross-org `update`/`delete` raises P2025); create payloads are stamped with the org; violations throw a typed `TenantIsolationError`. |
-| `off` | Passthrough kill switch. `forOrg()` still enforces — explicit scoping is never silently degraded. |
-
-The **rollout story** is deliberate: everything ships in `observe` (zero
-behavior change across ~60 services), each service burns down its warnings,
-then flips itself to `enforce` via `XEMA_TENANT_ISOLATION_MODE=enforce` (or the
-module option). `enforce` is the target state; `off` exists only as an
-emergency kill switch.
-
-### Where the org comes from
-
-Inside a request, the org is the `RequestContext.orgId` that
-`RequestContextMiddleware` resolved. `AmbientOrgContextMiddleware`
-(`@xemahq/platform-common`) runs right after it and lifts the org into the
-ambient async scope the extension reads. Services wired through
-`configureAuthMiddleware` / `applyXemaServiceMiddleware` get BOTH middlewares
-automatically — no per-service wiring is needed.
-
-### The boot-path rule
-
-Outside a request (boot, migrations, seeding, contribution sync, Temporal
-activities, background workers) there is NO ambient org. In `enforce` mode,
-touching an org-scoped model there throws. Scope explicitly:
-
-```ts
-// Jobs/workers acting for one org — hard-bound, always enforced:
-const scoped = prisma.forOrg(orgId);
-await scoped.artifact.findMany();           // implicitly WHERE orgId = <orgId>
-
-// Legitimate cross-org system paths (boot backfills, platform admin):
-const system = prisma.asSystem();           // unscoped; debug-logged per call site
-
-// Non-HTTP entrypoints that DO have an org (queue consumers, activities):
-// runWithAmbientOrg comes from @xemahq/platform-common.
-await runWithAmbientOrg(orgId, () => handler());
-```
-
-`forOrg(orgId)` always enforces, in every mode. `asSystem()` returns the raw
-client and logs each distinct call site once at debug level.
-
-### Conformance testing
-
-`@xemahq/biome-test-utils` exports `assertTenantIsolation(client, { orgA,
-orgB, models })` — given the wrapped client and a list of org-scoped model
-probes, it verifies cross-org reads return empty/null, cross-org writes throw,
-and `asSystem()` sees both orgs, cleaning up after itself.
+This package centralizes schema-qualified Prisma construction and database
+bootstrap for Xema biome services. Every consumer explicitly selects whether
+the application or an external process owns migrations. Externally managed
+services receive only a verified runtime connection and must prove target
+identity, least privilege, required DML access, and migration compatibility.
 
 ## When to use it
 
-- Use it inside a biome service so the service never hand-wires Prisma, the
-  schema name, or the migrate-time connection string.
-- Reach for `createBiomePrismaAdapterFromEnv` in a `PrismaService` constructor,
-  and `bootstrapBiomeDatabases` at service boot before Nest starts.
+- Use it when a NestJS biome service needs a schema-qualified Prisma connection.
+- Select externally managed migrations when deployment operations own all DDL.
 
 ## Installation
 
@@ -135,26 +49,21 @@ pnpm add @xemahq/biome-database-nest
 
 ```ts
 import {
-  bootstrapBiomeDatabases,
-  createBiomePrismaAdapterFromEnv,
+  BiomeDatabaseMigrationMode,
+  BiomeDatabaseModule,
 } from '@xemahq/biome-database-nest';
 
-// At boot (main.ts), before NestFactory.create:
-await bootstrapBiomeDatabases({
-  biomeId: 'mailops',
-  databases: [{ workspaceDir: process.cwd() }],
-  registry,
-  serviceToken: () => identity.getAccessToken(),
+BiomeDatabaseModule.forRoot({
+  biomeId: 'example',
+  migrationMode: BiomeDatabaseMigrationMode.ExternallyManaged,
+  databases: [externallyManagedDatabase],
 });
-
-// In PrismaService:
-const adapter = createBiomePrismaAdapterFromEnv(process.env);
 ```
 
 ## Peer requirements
 
-- `@prisma/client`, `@prisma/adapter-pg` — the consumer owns the Prisma
-  version; the adapter is constructed against the consumer's copy.
+- NestJS 10 or 11 and Prisma 7.
+- Compatible Xema identity, kernel-contract, service-registry, and decorator packages.
 
 ## License
 

package/dist/index.d.ts

@@ -6,8 +6,9 @@ export { resolveBiomeDatabaseConfigFromEnv, type BiomeDatabaseConfig, } from './
 export { createBiomePrismaAdapter, createBiomePrismaAdapterFromEnv, } from './lib/adapter';
 export { fetchSystemDatabaseConfig, type SystemDatabaseConfigRequest, } from './lib/control-plane-client';
 export { resolveControlPlaneBaseUrl, ORG_DATABASE_POOL_SERVICE_NAME, type ControlPlaneDiscoveryOptions, } from './lib/control-plane-discovery';
-export { bootstrapBiomeDatabases, type BiomeDatabaseDeclaration, type BootstrapBiomeDatabasesOptions, } from './lib/bootstrap';
-export { BiomeDatabaseModule, BIOME_DATABASE_READY, type BiomeDatabaseModuleOptions, } from './lib/nest/biome-database.module';
+export { bootstrapBiomeDatabases, type BiomeDatabaseDeclaration, type ExternallyManagedBiomeDatabaseDeclaration, type ApplicationManagedBootstrapOptions, type ExternallyManagedBootstrapOptions, type BootstrapBiomeDatabasesOptions, } from './lib/bootstrap';
+export { BiomeDatabaseMigrationMode, RuntimeDatabaseCredentialSource, RuntimeSequencePrivilege, RuntimeTablePrivilege, type AppliedPrismaMigration, type MigrationCompatibilityContext, type MigrationCompatibilityExpectation, type MigrationCompatibilityProof, type RuntimeDatabaseAccessExpectation, type RuntimeDatabaseTarget, } from './lib/migration-mode';
+export { BiomeDatabaseModule, BIOME_DATABASE_READY, type ApplicationManagedBiomeDatabaseModuleOptions, type ExternallyManagedBiomeDatabaseModuleOptions, type BiomeDatabaseModuleOptions, } from './lib/nest/biome-database.module';
 export { createBiomePrismaService, type BiomePrismaClient, type BiomePrismaClientCtor, type BiomePrismaServiceInstance, type CreateBiomePrismaServiceOptions, type TenantIsolationServiceOptions, type TenantScopedApi, } from './lib/nest/prisma-service-factory';
 export { TenantIsolationMode, TENANT_ISOLATION_MODE_ENV_VAR, resolveTenantIsolationMode, } from './lib/tenant-isolation/tenant-isolation-mode';
 export { TenantIsolationError, TenantIsolationViolationKind, formatTenantIsolationViolation, type TenantIsolationViolation, } from './lib/tenant-isolation/tenant-isolation-error';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,yCAAyC,EAC9C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,4CAA4C,EACjD,KAAK,2CAA2C,EAChD,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ORG_ERASURE_ROUTE_PATH = exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = exports.OrgErasureController = exports.OrgErasureModule = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.UndeclaredUnscopedModelsError = exports.normalizeUnscopedModelDeclarations = exports.formatUnscopedModelReport = exports.collectUnscopableModels = exports.assertUnscopedModelsDeclared = exports.readRuntimeModels = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.unwrapPlatformResponseEnvelope = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
+exports.OrgErasureController = exports.OrgErasureModule = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.UndeclaredUnscopedModelsError = exports.normalizeUnscopedModelDeclarations = exports.formatUnscopedModelReport = exports.collectUnscopableModels = exports.assertUnscopedModelsDeclared = exports.readRuntimeModels = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.RuntimeTablePrivilege = exports.RuntimeSequencePrivilege = exports.RuntimeDatabaseCredentialSource = exports.BiomeDatabaseMigrationMode = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.unwrapPlatformResponseEnvelope = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
+exports.ORG_ERASURE_ROUTE_PATH = exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = void 0;
 var schema_name_1 = require("./lib/schema-name");
 Object.defineProperty(exports, "DEFAULT_BIOME_DB_KEY", { enumerable: true, get: function () { return schema_name_1.DEFAULT_BIOME_DB_KEY; } });
 Object.defineProperty(exports, "deriveBiomeSchemaName", { enumerable: true, get: function () { return schema_name_1.deriveBiomeSchemaName; } });
@@ -32,6 +33,11 @@ Object.defineProperty(exports, "resolveControlPlaneBaseUrl", { enumerable: true,
 Object.defineProperty(exports, "ORG_DATABASE_POOL_SERVICE_NAME", { enumerable: true, get: function () { return control_plane_discovery_1.ORG_DATABASE_POOL_SERVICE_NAME; } });
 var bootstrap_1 = require("./lib/bootstrap");
 Object.defineProperty(exports, "bootstrapBiomeDatabases", { enumerable: true, get: function () { return bootstrap_1.bootstrapBiomeDatabases; } });
+var migration_mode_1 = require("./lib/migration-mode");
+Object.defineProperty(exports, "BiomeDatabaseMigrationMode", { enumerable: true, get: function () { return migration_mode_1.BiomeDatabaseMigrationMode; } });
+Object.defineProperty(exports, "RuntimeDatabaseCredentialSource", { enumerable: true, get: function () { return migration_mode_1.RuntimeDatabaseCredentialSource; } });
+Object.defineProperty(exports, "RuntimeSequencePrivilege", { enumerable: true, get: function () { return migration_mode_1.RuntimeSequencePrivilege; } });
+Object.defineProperty(exports, "RuntimeTablePrivilege", { enumerable: true, get: function () { return migration_mode_1.RuntimeTablePrivilege; } });
 var biome_database_module_1 = require("./lib/nest/biome-database.module");
 Object.defineProperty(exports, "BiomeDatabaseModule", { enumerable: true, get: function () { return biome_database_module_1.BiomeDatabaseModule; } });
 Object.defineProperty(exports, "BIOME_DATABASE_READY", { enumerable: true, get: function () { return biome_database_module_1.BIOME_DATABASE_READY; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,6DAAyE;AAAhE,mIAAA,8BAA8B,OAAA;AACvC,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,0EAI0C;AAHxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAGtB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAW2D;AAVzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAC9B,+HAAA,iBAAiB,OAAA;AAQnB,0EAUgD;AAT9C,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,4HAAA,yBAAyB,OAAA;AACzB,qIAAA,kCAAkC,OAAA;AAClC,gIAAA,6BAA6B,OAAA;AAM/B,kEAK4C;AAJ1C,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AAIxB,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,6DAAyE;AAAhE,mIAAA,8BAA8B,OAAA;AACvC,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAOyB;AANvB,oHAAA,uBAAuB,OAAA;AAOzB,uDAW8B;AAV5B,4HAAA,0BAA0B,OAAA;AAC1B,iIAAA,+BAA+B,OAAA;AAC/B,0HAAA,wBAAwB,OAAA;AACxB,uHAAA,qBAAqB,OAAA;AAQvB,0EAM0C;AALxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAKtB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAW2D;AAVzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAC9B,+HAAA,iBAAiB,OAAA;AAQnB,0EAUgD;AAT9C,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,4HAAA,yBAAyB,OAAA;AACzB,qIAAA,kCAAkC,OAAA;AAClC,gIAAA,6BAA6B,OAAA;AAM/B,kEAK4C;AAJ1C,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AAIxB,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}

package/dist/lib/bootstrap.d.ts

@@ -1,16 +1,34 @@
 import type { KernelState } from '@xemahq/kernel-contracts/kernel-state';
 import { type ControlPlaneDiscoveryOptions } from './control-plane-discovery';
+import { BiomeDatabaseMigrationMode, RuntimeDatabaseCredentialSource, type MigrationCompatibilityExpectation, type RuntimeDatabaseAccessExpectation, type RuntimeDatabaseTarget } from './migration-mode';
 export interface BiomeDatabaseDeclaration {
     readonly key?: string;
     readonly workspaceDir: string;
 }
-export interface BootstrapBiomeDatabasesOptions {
+export interface ExternallyManagedBiomeDatabaseDeclaration {
+    readonly key?: string;
+    readonly credentialSource: RuntimeDatabaseCredentialSource;
+    readonly expectedTarget: RuntimeDatabaseTarget;
+    readonly runtimeAccess: RuntimeDatabaseAccessExpectation;
+    readonly migrationCompatibility: MigrationCompatibilityExpectation;
+}
+interface BootstrapBiomeDatabasesCommonOptions {
     readonly biomeId: string;
-    readonly databases: readonly BiomeDatabaseDeclaration[];
     readonly serviceToken?: string | (() => Promise<string>);
     readonly kernelState: KernelState;
     readonly controlPlaneDiscovery?: ControlPlaneDiscoveryOptions;
+}
+export interface ApplicationManagedBootstrapOptions extends BootstrapBiomeDatabasesCommonOptions {
+    readonly migrationMode: BiomeDatabaseMigrationMode.ApplicationManaged;
+    readonly databases: readonly BiomeDatabaseDeclaration[];
     readonly requiredExtensions?: readonly string[];
 }
+export interface ExternallyManagedBootstrapOptions extends BootstrapBiomeDatabasesCommonOptions {
+    readonly migrationMode: BiomeDatabaseMigrationMode.ExternallyManaged;
+    readonly databases: readonly ExternallyManagedBiomeDatabaseDeclaration[];
+    readonly requiredExtensions?: never;
+}
+export type BootstrapBiomeDatabasesOptions = ApplicationManagedBootstrapOptions | ExternallyManagedBootstrapOptions;
 export declare function bootstrapBiomeDatabases(opts: BootstrapBiomeDatabasesOptions): Promise<void>;
+export {};
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/lib/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAWzE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAInC,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAQxD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAQzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAW9D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAgSD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,IAAI,CAAC,CAmDf"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAWzE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,yCAAyC;IAExD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;IAE3D,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAE/C,QAAQ,CAAC,aAAa,EAAE,gCAAgC,CAAC;IAEzD,QAAQ,CAAC,sBAAsB,EAAE,iCAAiC,CAAC;CACpE;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAMzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAOzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;CAC/D;AAED,MAAM,WAAW,kCACf,SAAQ,oCAAoC;IAC5C,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;IACtE,QAAQ,CAAC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAWxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,iCACf,SAAQ,oCAAoC;IAC5C,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,iBAAiB,CAAC;IACrE,QAAQ,CAAC,SAAS,EAAE,SAAS,yCAAyC,EAAE,CAAC;IAEzE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC;CACrC;AAED,MAAM,MAAM,8BAA8B,GACtC,kCAAkC,GAClC,iCAAiC,CAAC;AA6VtC,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,IAAI,CAAC,CAiFf"}

package/dist/lib/bootstrap.js

@@ -12,6 +12,8 @@ const pg_1 = require("pg");
 const config_1 = require("./config");
 const control_plane_client_1 = require("./control-plane-client");
 const control_plane_discovery_1 = require("./control-plane-discovery");
+const external_runtime_verifier_1 = require("./external-runtime-verifier");
+const migration_mode_1 = require("./migration-mode");
 const schema_name_1 = require("./schema-name");
 const LOG_PREFIX = '[biome-database]';
 function upperKeySuffix(key) {
@@ -38,6 +40,26 @@ async function resolveDatabaseConfig(opts, key, getControlPlaneBaseUrl) {
         ...(key !== schema_name_1.DEFAULT_BIOME_DB_KEY ? { dbKey: key } : {}),
     });
 }
+async function resolveExternalRuntimeConfig(opts, key, credentialSource, getControlPlaneBaseUrl) {
+    switch (credentialSource) {
+        case migration_mode_1.RuntimeDatabaseCredentialSource.Environment: {
+            const local = (0, config_1.resolveBiomeDatabaseConfigFromEnv)(process.env, key);
+            if (local === null) {
+                throw new Error(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: external runtime ` +
+                    'credential source is environment, but no complete DB_* config exists.');
+            }
+            return local;
+        }
+        case migration_mode_1.RuntimeDatabaseCredentialSource.ControlPlane: {
+            const baseUrl = await getControlPlaneBaseUrl();
+            const token = await resolveServiceToken(opts.serviceToken);
+            return (0, control_plane_client_1.fetchSystemDatabaseConfig)(baseUrl, token, {
+                biomeId: opts.biomeId,
+                ...(key !== schema_name_1.DEFAULT_BIOME_DB_KEY ? { dbKey: key } : {}),
+            });
+        }
+    }
+}
 async function materializeInlineCaCert(biomeId, key, config) {
     if (config.caCertPem === undefined || config.caCertPem === '') {
         return config;
@@ -98,7 +120,9 @@ async function ensureSchemaExists(biomeId, key, config, requiredExtensions) {
         }
         if (hasSchema) {
             await client.query('BEGIN');
-            await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [schema]);
+            await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                schema,
+            ]);
             await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
             await client.query('COMMIT');
             console.log(`${LOG_PREFIX} biome=${biomeId} key=${key}: ensured schema "${schema}" exists`);
@@ -112,8 +136,8 @@ async function ensureSchemaExists(biomeId, key, config, requiredExtensions) {
         await client.end();
     }
 }
-async function runMigrations(biomeId, key, workspaceDir, config) {
-    const migrateUrl = (0, platform_common_1.composeBiomeDatabaseUrl)({
+function buildDirectConnectionUrl(biomeId, key, config) {
+    const directUrl = (0, platform_common_1.composeBiomeDatabaseUrl)({
         user: config.username,
         password: config.password,
         host: config.host,
@@ -122,23 +146,25 @@ async function runMigrations(biomeId, key, workspaceDir, config) {
         ...(config.schema !== undefined ? { schema: config.schema } : {}),
         ...(config.sslParams !== undefined ? { sslParams: config.sslParams } : {}),
     });
-    if (migrateUrl === null) {
-        throw new Error(`${LOG_PREFIX} biome=${biomeId} key=${key}: incomplete config — cannot form a migrate URL.`);
+    if (directUrl === null) {
+        throw new Error(`${LOG_PREFIX} biome=${biomeId} key=${key}: incomplete config — cannot form a database URL.`);
     }
+    return (0, platform_common_1.ensureBiomeDbSearchPath)(directUrl);
+}
+async function runMigrations(biomeId, key, workspaceDir, migrateUrl) {
     console.log(`${LOG_PREFIX} biome=${biomeId} key=${key}: running prisma migrate deploy (cwd=${workspaceDir})`);
     const result = await new migration_runner_prisma_1.PrismaMigrationRunner().run({
         workspaceDir,
-        connectionUrl: (0, platform_common_1.ensureBiomeDbSearchPath)(migrateUrl),
+        connectionUrl: migrateUrl,
         env: {},
     });
     if (result.exitCode !== 0) {
         throw new Error(`${LOG_PREFIX} biome=${biomeId} key=${key}: migrations failed (exit ${result.exitCode}):\n${result.output}`);
     }
-    return migrateUrl;
 }
-function buildRuntimeUrl(biomeId, key, config, directMigrateUrl) {
+function buildRuntimeUrl(biomeId, key, config, directUrl) {
     if (config.poolerHost === undefined || config.poolerHost === '') {
-        return (0, platform_common_1.ensureBiomeDbSearchPath)(directMigrateUrl);
+        return (0, platform_common_1.ensureBiomeDbSearchPath)(directUrl);
     }
     const pooledUrl = (0, platform_common_1.composeBiomeDatabaseUrl)({
         user: config.username,
@@ -152,9 +178,23 @@ function buildRuntimeUrl(biomeId, key, config, directMigrateUrl) {
     if (pooledUrl === null) {
         throw new Error(`${LOG_PREFIX} biome=${biomeId} key=${key}: incomplete config — cannot form a pooled runtime URL.`);
     }
-    console.log(`${LOG_PREFIX} biome=${biomeId} key=${key}: runtime routed through pooler ${config.poolerHost}:${config.poolerPort ?? config.port} (migrations stay direct)`);
+    console.log(`${LOG_PREFIX} biome=${biomeId} key=${key}: runtime routed through pooler ${config.poolerHost}:${config.poolerPort ?? config.port}`);
     return (0, platform_common_1.ensureBiomeDbSearchPath)(pooledUrl);
 }
+function withApplicationName(url, applicationName) {
+    const parsed = new URL(url);
+    parsed.searchParams.set('application_name', applicationName);
+    return parsed.toString();
+}
+function assertExternalTargetMatchesConfig(biomeId, key, config, target) {
+    const configuredSchema = config.schema ?? 'public';
+    if (config.database !== target.database ||
+        configuredSchema !== target.schema) {
+        throw new Error(`${LOG_PREFIX} biome=${biomeId} key=${key}: resolved runtime target ` +
+            `${config.database}/${configuredSchema} does not match expected ` +
+            `${target.database}/${target.schema}.`);
+    }
+}
 function exportResolvedEnv(key, config, runtimeUrl) {
     const suffix = upperKeySuffix(key);
     process.env[`DATABASE_URL${suffix}`] = runtimeUrl;
@@ -170,14 +210,30 @@ async function bootstrapBiomeDatabases(opts) {
         }
         return cachedBaseUrl;
     };
+    if (opts.migrationMode === migration_mode_1.BiomeDatabaseMigrationMode.ApplicationManaged) {
+        for (const decl of opts.databases) {
+            const key = decl.key ?? schema_name_1.DEFAULT_BIOME_DB_KEY;
+            console.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config for mode=${opts.migrationMode}`);
+            const rawConfig = await resolveDatabaseConfig(opts, key, getControlPlaneBaseUrl);
+            const config = await materializeInlineCaCert(opts.biomeId, key, rawConfig);
+            const directUrl = buildDirectConnectionUrl(opts.biomeId, key, config);
+            await ensureSchemaExists(opts.biomeId, key, config, opts.requiredExtensions ?? []);
+            await runMigrations(opts.biomeId, key, decl.workspaceDir, directUrl);
+            const runtimeUrl = buildRuntimeUrl(opts.biomeId, key, config, directUrl);
+            exportResolvedEnv(key, config, runtimeUrl);
+            console.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`);
+        }
+        return;
+    }
     for (const decl of opts.databases) {
         const key = decl.key ?? schema_name_1.DEFAULT_BIOME_DB_KEY;
-        console.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config`);
-        const rawConfig = await resolveDatabaseConfig(opts, key, getControlPlaneBaseUrl);
+        console.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config for mode=${opts.migrationMode}`);
+        const rawConfig = await resolveExternalRuntimeConfig(opts, key, decl.credentialSource, getControlPlaneBaseUrl);
         const config = await materializeInlineCaCert(opts.biomeId, key, rawConfig);
-        await ensureSchemaExists(opts.biomeId, key, config, opts.requiredExtensions ?? []);
-        const migrateUrl = await runMigrations(opts.biomeId, key, decl.workspaceDir, config);
-        const runtimeUrl = buildRuntimeUrl(opts.biomeId, key, config, migrateUrl);
+        const directUrl = buildDirectConnectionUrl(opts.biomeId, key, config);
+        assertExternalTargetMatchesConfig(opts.biomeId, key, config, decl.expectedTarget);
+        const runtimeUrl = withApplicationName(buildRuntimeUrl(opts.biomeId, key, config, directUrl), decl.expectedTarget.applicationName);
+        await (0, external_runtime_verifier_1.verifyExternallyManagedRuntime)(runtimeUrl, decl.expectedTarget, decl.runtimeAccess, decl.migrationCompatibility);
         exportResolvedEnv(key, config, runtimeUrl);
         console.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`);
     }

package/dist/lib/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":";;AA+VA,0DAqDC;AApZD,6CAAyC;AACzC,qCAAuC;AACvC,+CAA6C;AAC7C,qCAAiC;AACjC,yCAAiC;AAGjC,6DAGiC;AACjC,6EAAwE;AACxE,2BAA4B;AAG5B,qCAA6D;AAC7D,iEAAmE;AACnE,uEAGmC;AACnC,+CAAqD;AA4CrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,KAAK,kCAAoB;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,YAA0D;IAE1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,yDAAyD;YACpE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,qBAAqB,CAClC,IAAoC,EACpC,GAAW,EACX,sBAA6C;IAE7C,MAAM,KAAK,GAAG,IAAA,0CAAiC,EAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,IAAA,gDAAyB,EAAC,OAAO,EAAE,KAAK,EAAE;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,GAAG,KAAK,kCAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAQD,KAAK,UAAU,uBAAuB,CACpC,OAAe,EACf,GAAW,EACX,MAA2B;IAE3B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,IAAI,MAAM,CAAC,CAAC;IAChE,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,QAAQ,EAAE,CACjF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACrD,CAAC;AAiBD,SAAS,UAAU,CACjB,MAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,aAAa,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,EAAE,GACN,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,WAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QAKH,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,6BAA6B,GAAG,IAAI,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,iBAAiB,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wBAAwB,GAAG,aAAa,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3E,MAAM,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,GAAG,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,qBAAqB,MAAM,UAAU,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,GAAW,EACX,YAAoB,EACpB,MAA2B;IAE3B,MAAM,UAAU,GAAG,IAAA,yCAAuB,EAAC;QACzC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,kDAAkD,CAC5F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wCAAwC,YAAY,GAAG,CACjG,CAAC;IAUF,MAAM,MAAM,GAAG,MAAM,IAAI,+CAAqB,EAAE,CAAC,GAAG,CAAC;QACnD,YAAY;QACZ,aAAa,EAAE,IAAA,yCAAuB,EAAC,UAAU,CAAC;QAClD,GAAG,EAAE,EAAE;KACR,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,MAAM,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAiBD,SAAS,eAAe,CACtB,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,gBAAwB;IAExB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,IAAA,yCAAuB,EAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC;QACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,eAAe,IAAI,iBAAiB;KACvD,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,yDAAyD,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,mCAAmC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,2BAA2B,CAC7J,CAAC;IACF,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAOD,SAAS,iBAAiB,CACxB,GAAW,EACX,MAA2B,EAC3B,UAAkB;IAElB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,CAAC;AACH,CAAC;AAWM,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAIpC,IAAI,aAAiC,CAAC;IACtC,MAAM,sBAAsB,GAAG,KAAK,IAAqB,EAAE;QACzD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,MAAM,IAAA,oDAA0B,EAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kCAAoB,CAAC;QAE7C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,oBAAoB,CACnE,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,EACJ,GAAG,EACH,sBAAsB,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3E,MAAM,kBAAkB,CACtB,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,MAAM,EACN,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAC9B,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,IAAI,CAAC,YAAY,EACjB,MAAM,CACP,CAAC;QAMF,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1E,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAE3C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,sBAAsB,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":";;AAgcA,0DAmFC;AAnhBD,6CAAyC;AACzC,qCAAuC;AACvC,+CAA6C;AAC7C,qCAAiC;AACjC,yCAAiC;AAGjC,6DAGiC;AACjC,6EAAwE;AACxE,2BAA4B;AAG5B,qCAA6D;AAC7D,iEAAmE;AACnE,uEAGmC;AACnC,2EAA6E;AAC7E,qDAM0B;AAC1B,+CAAqD;AAwErD,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,KAAK,kCAAoB;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,YAA0D;IAE1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,yDAAyD;YACpE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,qBAAqB,CAClC,IAA0C,EAC1C,GAAW,EACX,sBAA6C;IAE7C,MAAM,KAAK,GAAG,IAAA,0CAAiC,EAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,IAAA,gDAAyB,EAAC,OAAO,EAAE,KAAK,EAAE;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,GAAG,KAAK,kCAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,IAA0C,EAC1C,GAAW,EACX,gBAAiD,EACjD,sBAA6C;IAE7C,QAAQ,gBAAgB,EAAE,CAAC;QACzB,KAAK,gDAA+B,CAAC,WAAW,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,IAAA,0CAAiC,EAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,qBAAqB;oBACjE,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,gDAA+B,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3D,OAAO,IAAA,gDAAyB,EAAC,OAAO,EAAE,KAAK,EAAE;gBAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,GAAG,KAAK,kCAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,uBAAuB,CACpC,OAAe,EACf,GAAW,EACX,MAA2B;IAE3B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,IAAI,MAAM,CAAC,CAAC;IAChE,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,QAAQ,EAAE,CACjF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACrD,CAAC;AAiBD,SAAS,UAAU,CACjB,MAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,aAAa,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,EAAE,GACN,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,WAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QAKH,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,6BAA6B,GAAG,IAAI,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAChB,mCAAmC,GAAG,iBAAiB,CACxD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wBAAwB,GAAG,aAAa,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC/D,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,GAAG,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,qBAAqB,MAAM,UAAU,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAGD,SAAS,wBAAwB,CAC/B,OAAe,EACf,GAAW,EACX,MAA2B;IAE3B,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC;QACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,mDAAmD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,GAAW,EACX,YAAoB,EACpB,UAAkB;IAElB,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wCAAwC,YAAY,GAAG,CACjG,CAAC;IAUF,MAAM,MAAM,GAAG,MAAM,IAAI,+CAAqB,EAAE,CAAC,GAAG,CAAC;QACnD,YAAY;QACZ,aAAa,EAAE,UAAU;QACzB,GAAG,EAAE,EAAE;KACR,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,MAAM,EAAE,CAC5G,CAAC;IACJ,CAAC;AACH,CAAC;AAiBD,SAAS,eAAe,CACtB,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,SAAiB;IAEjB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC;QACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,eAAe,IAAI,iBAAiB;KACvD,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,yDAAyD,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,mCAAmC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CACpI,CAAC;IACF,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,eAAuB;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,MAA6B;IAE7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;IACnD,IACE,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACnC,gBAAgB,KAAK,MAAM,CAAC,MAAM,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,4BAA4B;YACnE,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,2BAA2B;YACjE,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,iBAAiB,CACxB,GAAW,EACX,MAA2B,EAC3B,UAAkB;IAElB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,CAAC;AACH,CAAC;AAYM,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAIpC,IAAI,aAAiC,CAAC;IACtC,MAAM,sBAAsB,GAAG,KAAK,IAAqB,EAAE;QACzD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,MAAM,IAAA,oDAA0B,EAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,kBAAkB,EAAE,CAAC;QACzE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kCAAoB,CAAC;YAC7C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,+BAA+B,IAAI,CAAC,aAAa,EAAE,CAClG,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,EACJ,GAAG,EACH,sBAAsB,CACvB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,SAAS,CACV,CAAC;YACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,kBAAkB,CACtB,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,MAAM,EACN,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAC9B,CAAC;YACF,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACzE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,sBAAsB,CACrE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kCAAoB,CAAC;QAC7C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,+BAA+B,IAAI,CAAC,aAAa,EAAE,CAClG,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAClD,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,gBAAgB,EACrB,sBAAsB,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACtE,iCAAiC,CAC/B,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,MAAM,EACN,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,MAAM,UAAU,GAAG,mBAAmB,CACpC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EACrD,IAAI,CAAC,cAAc,CAAC,eAAe,CACpC,CAAC;QACF,MAAM,IAAA,0DAA8B,EAClC,UAAU,EACV,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,sBAAsB,CAC5B,CAAC;QACF,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,sBAAsB,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/external-runtime-verifier.d.ts

@@ -0,0 +1,3 @@
+import type { MigrationCompatibilityContext, MigrationCompatibilityExpectation, RuntimeDatabaseAccessExpectation, RuntimeDatabaseTarget } from './migration-mode';
+export declare function verifyExternallyManagedRuntime(runtimeUrl: string, target: RuntimeDatabaseTarget, access: RuntimeDatabaseAccessExpectation, compatibility: MigrationCompatibilityExpectation): Promise<MigrationCompatibilityContext>;
+//# sourceMappingURL=external-runtime-verifier.d.ts.map

package/dist/lib/external-runtime-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-runtime-verifier.d.ts","sourceRoot":"","sources":["../../src/lib/external-runtime-verifier.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AA4K1B,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,gCAAgC,EACxC,aAAa,EAAE,iCAAiC,GAC/C,OAAO,CAAC,6BAA6B,CAAC,CA6NxC"}

package/dist/lib/external-runtime-verifier.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyExternallyManagedRuntime = verifyExternallyManagedRuntime;
+const node_crypto_1 = require("node:crypto");
+const pg_1 = require("pg");
+const LOG_PREFIX = '[biome-database]';
+function quoteIdentifier(identifier) {
+    return `"${identifier.replaceAll('"', '""')}"`;
+}
+function requireSingleRow(rows, description) {
+    if (rows.length !== 1) {
+        throw new Error(`${LOG_PREFIX} expected exactly one ${description} row, received ${rows.length}.`);
+    }
+    return rows[0];
+}
+function assertNonEmpty(value, field) {
+    if (value.trim() === '') {
+        throw new Error(`${LOG_PREFIX} ${field} must be a non-empty string.`);
+    }
+}
+function assertExpectation(expectation) {
+    if (expectation.tablePrivileges.length === 0) {
+        throw new Error(`${LOG_PREFIX} externally-managed runtime access must require at least one table privilege.`);
+    }
+}
+function buildMissingTablePrivilegeQuery(privileges) {
+    const projections = privileges
+        .map((privilege) => `CASE WHEN NOT has_table_privilege(current_user, ` +
+        `format('%I.%I', table_schema, table_name), '${privilege}') ` +
+        `THEN '${privilege}' END`)
+        .join(', ');
+    return `
+    SELECT table_name AS object_name,
+           array_remove(ARRAY[${projections}], NULL) AS missing_privileges
+      FROM information_schema.tables
+     WHERE table_schema = $1
+       AND table_type = 'BASE TABLE'
+       AND table_name <> '_prisma_migrations'
+       AND NOT (
+         ${privileges
+        .map((privilege) => `has_table_privilege(current_user, ` +
+        `format('%I.%I', table_schema, table_name), '${privilege}')`)
+        .join(' AND ')}
+       )
+     ORDER BY table_name
+  `;
+}
+function buildMissingSequencePrivilegeQuery(privileges) {
+    if (privileges.length === 0) {
+        return null;
+    }
+    const projections = privileges
+        .map((privilege) => `CASE WHEN NOT has_sequence_privilege(current_user, ` +
+        `format('%I.%I', sequence_schema, sequence_name), '${privilege}') ` +
+        `THEN '${privilege}' END`)
+        .join(', ');
+    return `
+    SELECT sequence_name AS object_name,
+           array_remove(ARRAY[${projections}], NULL) AS missing_privileges
+      FROM information_schema.sequences
+     WHERE sequence_schema = $1
+       AND NOT (
+         ${privileges
+        .map((privilege) => `has_sequence_privilege(current_user, ` +
+        `format('%I.%I', sequence_schema, sequence_name), '${privilege}')`)
+        .join(' AND ')}
+       )
+     ORDER BY sequence_name
+  `;
+}
+function formatMissingPrivileges(kind, rows) {
+    return rows
+        .map((row) => `${kind} ${row.object_name} missing ${row.missing_privileges.join('/')}`)
+        .join(', ');
+}
+function digestLedger(appliedMigrations) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(appliedMigrations))
+        .digest('hex');
+}
+function assertTarget(target) {
+    assertNonEmpty(target.database, 'expected target database');
+    assertNonEmpty(target.schema, 'expected target schema');
+    assertNonEmpty(target.applicationName, 'expected application_name');
+}
+async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compatibility) {
+    assertTarget(target);
+    assertExpectation(access);
+    if (compatibility === undefined ||
+        typeof compatibility.verify !== 'function') {
+        throw new Error(`${LOG_PREFIX} externally-managed mode requires a migration compatibility verifier.`);
+    }
+    assertNonEmpty(compatibility.verifierId, 'migration verifierId');
+    const client = new pg_1.Client({ connectionString: runtimeUrl });
+    await client.connect();
+    try {
+        const identity = requireSingleRow((await client.query(`
+          SELECT current_database() AS database_name,
+                 current_schema() AS schema_name,
+                 current_setting('application_name') AS application_name,
+                 current_user AS role_name
+        `)).rows, 'connection identity');
+        if (identity.database_name !== target.database ||
+            identity.schema_name !== target.schema ||
+            identity.application_name !== target.applicationName) {
+            throw new Error(`${LOG_PREFIX} runtime target mismatch: expected ` +
+                `${target.database}/${target.schema}/${target.applicationName}, observed ` +
+                `${identity.database_name}/${identity.schema_name ?? '<none>'}/${identity.application_name}.`);
+        }
+        const role = requireSingleRow((await client.query(`
+          SELECT rolsuper, rolcreatedb, rolcreaterole, rolbypassrls
+            FROM pg_roles
+           WHERE rolname = current_user
+        `)).rows, 'runtime role');
+        const forbiddenRoleAttributes = [
+            role.rolsuper ? 'SUPERUSER' : null,
+            role.rolcreatedb ? 'CREATEDB' : null,
+            role.rolcreaterole ? 'CREATEROLE' : null,
+            role.rolbypassrls ? 'BYPASSRLS' : null,
+        ].filter((value) => value !== null);
+        if (forbiddenRoleAttributes.length > 0) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden attribute(s): ` +
+                forbiddenRoleAttributes.join(', '));
+        }
+        const databasePrivileges = requireSingleRow((await client.query(`
+          SELECT has_database_privilege(current_user, current_database(), 'CONNECT') AS can_connect,
+                 has_database_privilege(current_user, current_database(), 'CREATE') AS can_create,
+                 pg_has_role(current_user, datdba, 'USAGE') AS owns_database
+            FROM pg_database
+           WHERE datname = current_database()
+        `)).rows, 'database privilege');
+        if (!databasePrivileges.can_connect) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} lacks database CONNECT.`);
+        }
+        if (databasePrivileges.can_create || databasePrivileges.owns_database) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden database ` +
+                `${databasePrivileges.owns_database ? 'ownership' : 'CREATE privilege'}.`);
+        }
+        const schemaPrivileges = requireSingleRow((await client.query(`
+            SELECT has_schema_privilege(current_user, oid, 'USAGE') AS can_use,
+                   has_schema_privilege(current_user, oid, 'CREATE') AS can_create,
+                   pg_has_role(current_user, nspowner, 'USAGE') AS owns_schema
+              FROM pg_namespace
+             WHERE nspname = $1
+          `, [target.schema])).rows, 'target schema privilege');
+        if (!schemaPrivileges.can_use) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} lacks USAGE on schema ${target.schema}.`);
+        }
+        if (schemaPrivileges.can_create || schemaPrivileges.owns_schema) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden CREATE/ownership ` +
+                `on schema ${target.schema}.`);
+        }
+        const persistentDdlSchemas = (await client.query(`
+        SELECT nspname AS schema_name
+          FROM pg_namespace
+         WHERE nspname NOT IN ('pg_catalog', 'information_schema')
+           AND nspname NOT LIKE 'pg_toast%'
+           AND nspname NOT LIKE 'pg_temp_%'
+           AND (
+             has_schema_privilege(current_user, oid, 'CREATE')
+             OR pg_has_role(current_user, nspowner, 'USAGE')
+           )
+         ORDER BY nspname
+      `)).rows;
+        if (persistentDdlSchemas.length > 0) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden persistent ` +
+                `schema CREATE/ownership on: ${persistentDdlSchemas
+                    .map((row) => row.schema_name)
+                    .join(', ')}.`);
+        }
+        const missingTablePrivileges = (await client.query(buildMissingTablePrivilegeQuery(access.tablePrivileges), [target.schema])).rows;
+        if (missingTablePrivileges.length > 0) {
+            throw new Error(`${LOG_PREFIX} runtime DML contract failed: ${formatMissingPrivileges('table', missingTablePrivileges)}.`);
+        }
+        const sequenceQuery = buildMissingSequencePrivilegeQuery(access.sequencePrivileges);
+        if (sequenceQuery !== null) {
+            const missingSequencePrivileges = (await client.query(sequenceQuery, [target.schema])).rows;
+            if (missingSequencePrivileges.length > 0) {
+                throw new Error(`${LOG_PREFIX} runtime DML contract failed: ${formatMissingPrivileges('sequence', missingSequencePrivileges)}.`);
+            }
+        }
+        const migrationRows = (await client.query(`
+        SELECT id::text,
+               migration_name,
+               checksum,
+               started_at::text,
+               finished_at::text,
+               applied_steps_count
+          FROM ${quoteIdentifier(target.schema)}."_prisma_migrations"
+         WHERE finished_at IS NOT NULL
+           AND rolled_back_at IS NULL
+         ORDER BY finished_at, id
+      `)).rows;
+        const appliedMigrations = migrationRows.map((row) => ({
+            id: row.id,
+            name: row.migration_name,
+            checksum: row.checksum,
+            startedAt: row.started_at,
+            finishedAt: row.finished_at,
+            appliedStepsCount: row.applied_steps_count,
+        }));
+        const observedLedgerDigest = digestLedger(appliedMigrations);
+        const context = Object.freeze({
+            target: Object.freeze({ ...target }),
+            currentRole: identity.role_name,
+            appliedMigrations: Object.freeze(appliedMigrations.map((migration) => Object.freeze(migration))),
+            observedLedgerDigest,
+        });
+        const proof = await compatibility.verify(context);
+        if (proof.verifierId !== compatibility.verifierId ||
+            proof.observedLedgerDigest !== observedLedgerDigest) {
+            throw new Error(`${LOG_PREFIX} migration compatibility proof does not match verifier ` +
+                `${compatibility.verifierId} and observed ledger ${observedLedgerDigest}.`);
+        }
+        if (!proof.compatible) {
+            throw new Error(`${LOG_PREFIX} migration compatibility rejected by ${proof.verifierId}: ${proof.reason}`);
+        }
+        assertNonEmpty(proof.expectedState, 'migration proof expectedState');
+        return context;
+    }
+    finally {
+        await client.end();
+    }
+}
+//# sourceMappingURL=external-runtime-verifier.js.map

package/dist/lib/external-runtime-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-runtime-verifier.js","sourceRoot":"","sources":["../../src/lib/external-runtime-verifier.ts"],"names":[],"mappings":";;AAsLA,wEAkOC;AAxZD,6CAAyC;AAEzC,2BAA4B;AAU5B,MAAM,UAAU,GAAG,kBAAkB,CAAC;AA8CtC,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAI,IAAkB,EAAE,WAAmB;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,yBAAyB,WAAW,kBAAkB,IAAI,CAAC,MAAM,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAM,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,IAAI,KAAK,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,WAA6C;IAE7C,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,+EAA+E,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,UAA+D;IAE/D,MAAM,WAAW,GAAG,UAAU;SAC3B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,kDAAkD;QAClD,+CAA+C,SAAS,KAAK;QAC7D,SAAS,SAAS,OAAO,CAC5B;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;gCAEuB,WAAW;;;;;;WAMhC,UAAU;SACT,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,oCAAoC;QACpC,+CAA+C,SAAS,IAAI,CAC/D;SACA,IAAI,CAAC,OAAO,CAAC;;;GAGtB,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,UAAkE;IAElE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,UAAU;SAC3B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,qDAAqD;QACrD,qDAAqD,SAAS,KAAK;QACnE,SAAS,SAAS,OAAO,CAC5B;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;gCAEuB,WAAW;;;;WAIhC,UAAU;SACT,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,uCAAuC;QACvC,qDAAqD,SAAS,IAAI,CACrE;SACA,IAAI,CAAC,OAAO,CAAC;;;GAGtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0B,EAC1B,IAAoC;IAEpC,OAAO,IAAI;SACR,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,IAAI,IAAI,GAAG,CAAC,WAAW,YAAY,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,iBAAoD;IAEpD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B;IACjD,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC5D,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,cAAc,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;AACtE,CAAC;AAQM,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,MAA6B,EAC7B,MAAwC,EACxC,aAAgD;IAEhD,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,IACE,aAAa,KAAK,SAAS;QAC3B,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,uEAAuE,CACrF,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,aAAa,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,IAAI,WAAM,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,CACE,MAAM,MAAM,CAAC,KAAK,CAAc;;;;;SAK/B,CAAC,CACH,CAAC,IAAI,EACN,qBAAqB,CACtB,CAAC;QACF,IACE,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,QAAQ;YAC1C,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM;YACtC,QAAQ,CAAC,gBAAgB,KAAK,MAAM,CAAC,eAAe,EACpD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,qCAAqC;gBAChD,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,aAAa;gBAC1E,GAAG,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,GAAG,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAC3B,CACE,MAAM,MAAM,CAAC,KAAK,CAAU;;;;SAI3B,CAAC,CACH,CAAC,IAAI,EACN,cAAc,CACf,CAAC;QACF,MAAM,uBAAuB,GAAG;YAC9B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YAClC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACpC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YACxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;SACvC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QACrD,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,+BAA+B;gBAC7E,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,gBAAgB,CACzC,CACE,MAAM,MAAM,CAAC,KAAK,CAAuB;;;;;;SAMxC,CAAC,CACH,CAAC,IAAI,EACN,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,0BAA0B,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,aAAa,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,0BAA0B;gBACxE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,CACE,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;WAMC,EACD,CAAC,MAAM,CAAC,MAAM,CAAC,CAChB,CACF,CAAC,IAAI,EACN,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,0BAA0B,MAAM,CAAC,MAAM,GAAG,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,CAAC,UAAU,IAAI,gBAAgB,CAAC,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,kCAAkC;gBAChF,aAAa,MAAM,CAAC,MAAM,GAAG,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,CAC3B,MAAM,MAAM,CAAC,KAAK,CAAwB;;;;;;;;;;;OAWzC,CAAC,CACH,CAAC,IAAI,CAAC;QACP,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iBAAiB,QAAQ,CAAC,SAAS,4BAA4B;gBAC1E,+BAA+B,oBAAoB;qBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;qBAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,CAC7B,MAAM,MAAM,CAAC,KAAK,CAChB,+BAA+B,CAAC,MAAM,CAAC,eAAe,CAAC,EACvD,CAAC,MAAM,CAAC,MAAM,CAAC,CAChB,CACF,CAAC,IAAI,CAAC;QACP,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iCAAiC,uBAAuB,CACnE,OAAO,EACP,sBAAsB,CACvB,GAAG,CACL,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,kCAAkC,CACtD,MAAM,CAAC,kBAAkB,CAC1B,CAAC;QACF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,yBAAyB,GAAG,CAChC,MAAM,MAAM,CAAC,KAAK,CAAsB,aAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACxE,CAAC,IAAI,CAAC;YACP,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iCAAiC,uBAAuB,CACnE,UAAU,EACV,yBAAyB,CAC1B,GAAG,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,CACpB,MAAM,MAAM,CAAC,KAAK,CAAe;;;;;;;iBAOtB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;;;;OAIxC,CAAC,CACH,CAAC,IAAI,CAAC;QACP,MAAM,iBAAiB,GACrB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,cAAc;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;SAC3C,CAAC,CAAC,CAAC;QACN,MAAM,oBAAoB,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAkC,MAAM,CAAC,MAAM,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YACpC,WAAW,EAAE,QAAQ,CAAC,SAAS;YAC/B,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAC9B,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAC/D;YACD,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IACE,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU;YAC7C,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,yDAAyD;gBACpE,GAAG,aAAa,CAAC,UAAU,wBAAwB,oBAAoB,GAAG,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,wCAAwC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/lib/migration-mode.d.ts

@@ -0,0 +1,58 @@
+export declare enum BiomeDatabaseMigrationMode {
+    ApplicationManaged = "application-managed",
+    ExternallyManaged = "externally-managed"
+}
+export declare enum RuntimeDatabaseCredentialSource {
+    ControlPlane = "control-plane",
+    Environment = "environment"
+}
+export declare enum RuntimeTablePrivilege {
+    Select = "SELECT",
+    Insert = "INSERT",
+    Update = "UPDATE",
+    Delete = "DELETE"
+}
+export declare enum RuntimeSequencePrivilege {
+    Usage = "USAGE",
+    Select = "SELECT",
+    Update = "UPDATE"
+}
+export interface RuntimeDatabaseAccessExpectation {
+    readonly tablePrivileges: readonly RuntimeTablePrivilege[];
+    readonly sequencePrivileges: readonly RuntimeSequencePrivilege[];
+}
+export interface RuntimeDatabaseTarget {
+    readonly database: string;
+    readonly schema: string;
+    readonly applicationName: string;
+}
+export interface AppliedPrismaMigration {
+    readonly id: string;
+    readonly name: string;
+    readonly checksum: string;
+    readonly startedAt: string;
+    readonly finishedAt: string;
+    readonly appliedStepsCount: number;
+}
+export interface MigrationCompatibilityContext {
+    readonly target: RuntimeDatabaseTarget;
+    readonly currentRole: string;
+    readonly appliedMigrations: readonly AppliedPrismaMigration[];
+    readonly observedLedgerDigest: string;
+}
+export type MigrationCompatibilityProof = {
+    readonly compatible: true;
+    readonly verifierId: string;
+    readonly expectedState: string;
+    readonly observedLedgerDigest: string;
+} | {
+    readonly compatible: false;
+    readonly verifierId: string;
+    readonly reason: string;
+    readonly observedLedgerDigest: string;
+};
+export interface MigrationCompatibilityExpectation {
+    readonly verifierId: string;
+    readonly verify: (context: MigrationCompatibilityContext) => MigrationCompatibilityProof | Promise<MigrationCompatibilityProof>;
+}
+//# sourceMappingURL=migration-mode.d.ts.map

package/dist/lib/migration-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-mode.d.ts","sourceRoot":"","sources":["../../src/lib/migration-mode.ts"],"names":[],"mappings":"AAOA,oBAAY,0BAA0B;IACpC,kBAAkB,wBAAwB;IAC1C,iBAAiB,uBAAuB;CACzC;AAQD,oBAAY,+BAA+B;IACzC,YAAY,kBAAkB;IAC9B,WAAW,gBAAgB;CAC5B;AAGD,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAGD,oBAAY,wBAAwB;IAClC,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAUD,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,eAAe,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAClE;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAGD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAGD,MAAM,MAAM,2BAA2B,GACnC;IACE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC,CAAC;AASN,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,CACf,OAAO,EAAE,6BAA6B,KACnC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACzE"}

package/dist/lib/migration-mode.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeSequencePrivilege = exports.RuntimeTablePrivilege = exports.RuntimeDatabaseCredentialSource = exports.BiomeDatabaseMigrationMode = void 0;
+var BiomeDatabaseMigrationMode;
+(function (BiomeDatabaseMigrationMode) {
+    BiomeDatabaseMigrationMode["ApplicationManaged"] = "application-managed";
+    BiomeDatabaseMigrationMode["ExternallyManaged"] = "externally-managed";
+})(BiomeDatabaseMigrationMode || (exports.BiomeDatabaseMigrationMode = BiomeDatabaseMigrationMode = {}));
+var RuntimeDatabaseCredentialSource;
+(function (RuntimeDatabaseCredentialSource) {
+    RuntimeDatabaseCredentialSource["ControlPlane"] = "control-plane";
+    RuntimeDatabaseCredentialSource["Environment"] = "environment";
+})(RuntimeDatabaseCredentialSource || (exports.RuntimeDatabaseCredentialSource = RuntimeDatabaseCredentialSource = {}));
+var RuntimeTablePrivilege;
+(function (RuntimeTablePrivilege) {
+    RuntimeTablePrivilege["Select"] = "SELECT";
+    RuntimeTablePrivilege["Insert"] = "INSERT";
+    RuntimeTablePrivilege["Update"] = "UPDATE";
+    RuntimeTablePrivilege["Delete"] = "DELETE";
+})(RuntimeTablePrivilege || (exports.RuntimeTablePrivilege = RuntimeTablePrivilege = {}));
+var RuntimeSequencePrivilege;
+(function (RuntimeSequencePrivilege) {
+    RuntimeSequencePrivilege["Usage"] = "USAGE";
+    RuntimeSequencePrivilege["Select"] = "SELECT";
+    RuntimeSequencePrivilege["Update"] = "UPDATE";
+})(RuntimeSequencePrivilege || (exports.RuntimeSequencePrivilege = RuntimeSequencePrivilege = {}));
+//# sourceMappingURL=migration-mode.js.map

package/dist/lib/migration-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-mode.js","sourceRoot":"","sources":["../../src/lib/migration-mode.ts"],"names":[],"mappings":";;;AAOA,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,wEAA0C,CAAA;IAC1C,sEAAwC,CAAA;AAC1C,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAQD,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,iEAA8B,CAAA;IAC9B,8DAA2B,CAAA;AAC7B,CAAC,EAHW,+BAA+B,+CAA/B,+BAA+B,QAG1C;AAGD,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,qCAArB,qBAAqB,QAKhC;AAGD,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,2CAAe,CAAA;IACf,6CAAiB,CAAA;IACjB,6CAAiB,CAAA;AACnB,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC"}

package/dist/lib/nest/biome-database.module.d.ts

@@ -1,12 +1,23 @@
 import type { DynamicModule } from '@nestjs/common';
-import type { BiomeDatabaseDeclaration } from '../bootstrap';
+import type { BiomeDatabaseDeclaration, ExternallyManagedBiomeDatabaseDeclaration } from '../bootstrap';
+import { BiomeDatabaseMigrationMode } from '../migration-mode';
 export declare const BIOME_DATABASE_READY: unique symbol;
-export interface BiomeDatabaseModuleOptions {
+interface BiomeDatabaseModuleCommonOptions {
     readonly biomeId: string;
+}
+export interface ApplicationManagedBiomeDatabaseModuleOptions extends BiomeDatabaseModuleCommonOptions {
+    readonly migrationMode: BiomeDatabaseMigrationMode.ApplicationManaged;
     readonly databases?: readonly BiomeDatabaseDeclaration[];
     readonly requiredExtensions?: readonly string[];
 }
+export interface ExternallyManagedBiomeDatabaseModuleOptions extends BiomeDatabaseModuleCommonOptions {
+    readonly migrationMode: BiomeDatabaseMigrationMode.ExternallyManaged;
+    readonly databases: readonly ExternallyManagedBiomeDatabaseDeclaration[];
+    readonly requiredExtensions?: never;
+}
+export type BiomeDatabaseModuleOptions = ApplicationManagedBiomeDatabaseModuleOptions | ExternallyManagedBiomeDatabaseModuleOptions;
 export declare class BiomeDatabaseModule {
     static forRoot(opts: BiomeDatabaseModuleOptions): DynamicModule;
 }
+export {};
 //# sourceMappingURL=biome-database.module.d.ts.map

package/dist/lib/nest/biome-database.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"biome-database.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAUpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAY7D,eAAO,MAAM,oBAAoB,eAEhC,CAAC;AAGF,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAKzB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAMzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AA6CD,qBACa,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,0BAA0B,GAAG,aAAa;CAgDhE"}
+{"version":3,"file":"biome-database.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAUpD,OAAO,KAAK,EACV,wBAAwB,EACxB,yCAAyC,EAC1C,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAY/D,eAAO,MAAM,oBAAoB,eAEhC,CAAC;AAEF,UAAU,gCAAgC;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4CACf,SAAQ,gCAAgC;IACxC,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;IAKtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAMzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,2CACf,SAAQ,gCAAgC;IACxC,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,iBAAiB,CAAC;IAKrE,QAAQ,CAAC,SAAS,EAAE,SAAS,yCAAyC,EAAE,CAAC;IACzE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC;CACrC;AAGD,MAAM,MAAM,0BAA0B,GAClC,4CAA4C,GAC5C,2CAA2C,CAAC;AA+ChD,qBACa,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,0BAA0B,GAAG,aAAa;CAmFhE"}

package/dist/lib/nest/biome-database.module.js

@@ -12,13 +12,24 @@ const common_1 = require("@nestjs/common");
 const identity_client_1 = require("@xemahq/identity-client");
 const service_registry_nest_1 = require("@xemahq/service-registry-nest");
 const bootstrap_1 = require("../bootstrap");
+const migration_mode_1 = require("../migration-mode");
 const schema_name_1 = require("../schema-name");
 exports.BIOME_DATABASE_READY = Symbol.for('@xemahq/biome-database-nest:ready');
 let BiomeDatabaseModule = BiomeDatabaseModule_1 = class BiomeDatabaseModule {
     static forRoot(opts) {
-        const databases = opts.databases ?? [
-            { key: schema_name_1.DEFAULT_BIOME_DB_KEY, workspaceDir: process.cwd() },
-        ];
+        if (opts.migrationMode !== migration_mode_1.BiomeDatabaseMigrationMode.ApplicationManaged &&
+            opts.migrationMode !== migration_mode_1.BiomeDatabaseMigrationMode.ExternallyManaged) {
+            throw new Error('[biome-database] migrationMode is required and must be a BiomeDatabaseMigrationMode.');
+        }
+        if (opts.migrationMode === migration_mode_1.BiomeDatabaseMigrationMode.ExternallyManaged &&
+            opts.databases.length === 0) {
+            throw new Error('[biome-database] externally-managed mode requires at least one explicit database declaration.');
+        }
+        const databases = opts.migrationMode === migration_mode_1.BiomeDatabaseMigrationMode.ApplicationManaged
+            ? (opts.databases ?? [
+                { key: schema_name_1.DEFAULT_BIOME_DB_KEY, workspaceDir: process.cwd() },
+            ])
+            : opts.databases;
         if ((0, service_registry_nest_1.isOpenApiExtraction)()) {
             return {
                 module: BiomeDatabaseModule_1,
@@ -34,15 +45,28 @@ let BiomeDatabaseModule = BiomeDatabaseModule_1 = class BiomeDatabaseModule {
                 {
                     provide: exports.BIOME_DATABASE_READY,
                     useFactory: async (identityBootstrap, kernelState) => {
-                        await (0, bootstrap_1.bootstrapBiomeDatabases)({
-                            biomeId: opts.biomeId,
-                            databases,
-                            ...(opts.requiredExtensions !== undefined
-                                ? { requiredExtensions: opts.requiredExtensions }
-                                : {}),
-                            serviceToken: () => identityBootstrap.getAccessToken(),
-                            kernelState,
-                        });
+                        if (opts.migrationMode ===
+                            migration_mode_1.BiomeDatabaseMigrationMode.ApplicationManaged) {
+                            await (0, bootstrap_1.bootstrapBiomeDatabases)({
+                                biomeId: opts.biomeId,
+                                migrationMode: opts.migrationMode,
+                                databases: databases,
+                                ...(opts.requiredExtensions !== undefined
+                                    ? { requiredExtensions: opts.requiredExtensions }
+                                    : {}),
+                                serviceToken: () => identityBootstrap.getAccessToken(),
+                                kernelState,
+                            });
+                        }
+                        else {
+                            await (0, bootstrap_1.bootstrapBiomeDatabases)({
+                                biomeId: opts.biomeId,
+                                migrationMode: opts.migrationMode,
+                                databases: databases,
+                                serviceToken: () => identityBootstrap.getAccessToken(),
+                                kernelState,
+                            });
+                        }
                         return true;
                     },
                     inject: [identity_client_1.IdentityBootstrapService, service_registry_nest_1.KERNEL_STATE_TOKEN],

package/dist/lib/nest/biome-database.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"biome-database.module.js","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":";;;;;;;;;;AACA,2CAAwC;AACxC,6DAAmE;AAEnE,yEAGuC;AAEvC,4CAAuD;AAEvD,gDAAsD;AAWzC,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAC5C,mCAAmC,CACpC,CAAC;AA+DK,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAgC;QAC7C,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI;YAChB,EAAE,GAAG,EAAE,kCAAoB,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;SAC3D,CAAC;QAQJ,IAAI,IAAA,2CAAmB,GAAE,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,qBAAmB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,4BAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC9D,OAAO,EAAE,CAAC,4BAAoB,CAAC;aAChC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,qBAAmB;YAC3B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,4BAAoB;oBAC7B,UAAU,EAAE,KAAK,EACf,iBAA2C,EAC3C,WAAwB,EACT,EAAE;wBACjB,MAAM,IAAA,mCAAuB,EAAC;4BAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,SAAS;4BACT,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gCACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;gCACjD,CAAC,CAAC,EAAE,CAAC;4BACP,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE;4BACtD,WAAW;yBACZ,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,MAAM,EAAE,CAAC,0CAAwB,EAAE,0CAAkB,CAAC;iBACvD;aACF;YACD,OAAO,EAAE,CAAC,4BAAoB,CAAC;SAChC,CAAC;IACJ,CAAC;CACF,CAAA;AAjDY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,mBAAmB,CAiD/B"}
+{"version":3,"file":"biome-database.module.js","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":";;;;;;;;;;AACA,2CAAwC;AACxC,6DAAmE;AAEnE,yEAGuC;AAEvC,4CAAuD;AAKvD,sDAA+D;AAC/D,gDAAsD;AAWzC,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAC5C,mCAAmC,CACpC,CAAC;AAqFK,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAgC;QAC7C,IACE,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,kBAAkB;YACpE,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,iBAAiB,EACnE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,iBAAiB;YACnE,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAGb,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,kBAAkB;YAClE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI;gBACjB,EAAE,GAAG,EAAE,kCAAoB,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aAC3D,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAQrB,IAAI,IAAA,2CAAmB,GAAE,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,qBAAmB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,4BAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC9D,OAAO,EAAE,CAAC,4BAAoB,CAAC;aAChC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,qBAAmB;YAC3B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,4BAAoB;oBAC7B,UAAU,EAAE,KAAK,EACf,iBAA2C,EAC3C,WAAwB,EACT,EAAE;wBACjB,IACE,IAAI,CAAC,aAAa;4BAClB,2CAA0B,CAAC,kBAAkB,EAC7C,CAAC;4BACD,MAAM,IAAA,mCAAuB,EAAC;gCAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gCACrB,aAAa,EAAE,IAAI,CAAC,aAAa;gCACjC,SAAS,EAAE,SAAgD;gCAC3D,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;oCACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;oCACjD,CAAC,CAAC,EAAE,CAAC;gCACP,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE;gCACtD,WAAW;6BACZ,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAA,mCAAuB,EAAC;gCAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gCACrB,aAAa,EAAE,IAAI,CAAC,aAAa;gCACjC,SAAS,EACP,SAAiE;gCACnE,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE;gCACtD,WAAW;6BACZ,CAAC,CAAC;wBACL,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,MAAM,EAAE,CAAC,0CAAwB,EAAE,0CAAkB,CAAC;iBACvD;aACF;YACD,OAAO,EAAE,CAAC,4BAAoB,CAAC;SAChC,CAAC;IACJ,CAAC;CACF,CAAA;AApFY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,mBAAmB,CAoF/B"}

package/dist/lib/response-envelope.d.ts

@@ -1,2 +1,2 @@
-export declare function unwrapPlatformResponseEnvelope<T>(payload: unknown, context: string): T;
+export { unwrapPlatformResponseEnvelope } from '@xemahq/platform-common';
 //# sourceMappingURL=response-envelope.d.ts.map

package/dist/lib/response-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-envelope.d.ts","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":"AAwCA,wBAAgB,8BAA8B,CAAC,CAAC,EAC9C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,CAAC,CAaH"}
+{"version":3,"file":"response-envelope.d.ts","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/lib/response-envelope.js

@@ -1,26 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.unwrapPlatformResponseEnvelope = unwrapPlatformResponseEnvelope;
-function describePayload(payload) {
-    if (payload === null) {
-        return 'null';
-    }
-    if (Array.isArray(payload)) {
-        return 'a bare array';
-    }
-    if (typeof payload === 'object') {
-        return `an object with keys [${Object.keys(payload).join(', ')}]`;
-    }
-    return `a bare ${typeof payload}`;
-}
-function unwrapPlatformResponseEnvelope(payload, context) {
-    if (payload === null ||
-        typeof payload !== 'object' ||
-        !('data' in payload)) {
-        throw new Error(`${context}: response is not a platform envelope — expected an object with a 'data' property, ` +
-            `received ${describePayload(payload)}. The peer either is not a Xema platform service or is ` +
-            `missing the global ResponseEnvelopeInterceptor.`);
-    }
-    return payload.data;
-}
+exports.unwrapPlatformResponseEnvelope = void 0;
+var platform_common_1 = require("@xemahq/platform-common");
+Object.defineProperty(exports, "unwrapPlatformResponseEnvelope", { enumerable: true, get: function () { return platform_common_1.unwrapPlatformResponseEnvelope; } });
 //# sourceMappingURL=response-envelope.js.map

package/dist/lib/response-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"response-envelope.js","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":";;AAwCA,wEAgBC;AAvCD,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,wBAAwB,MAAM,CAAC,IAAI,CACxC,OAAkC,CACnC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,OAAO,OAAO,EAAE,CAAC;AACpC,CAAC;AAUD,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,OAAe;IAEf,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM,IAAK,OAAmC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,qFAAqF;YAC7F,YAAY,eAAe,CAAC,OAAO,CAAC,yDAAyD;YAC7F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAQ,OAAuB,CAAC,IAAI,CAAC;AACvC,CAAC"}
+{"version":3,"file":"response-envelope.js","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":";;;AAcA,2DAAyE;AAAhE,iIAAA,8BAA8B,OAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xemahq/biome-database-nest",
-  "version": "0.6.4",
-  "description": "Layer 1 SDK that centralizes ALL database concerns for Xema biome services. Provides the single correct construction of a schema-qualified Prisma driver-adapter (the second-arg `{ schema }` that makes `@prisma/adapter-pg` qualify `biome_<id>.<table>` instead of `public.<table>`), the per-biome schema-naming convention, env/control-plane config resolution, and a boot-time bootstrap that creates the schema and runs migrations. Biomes carry zero DB boilerplate.",
+  "version": "0.7.0",
+  "description": "Explicit database migration ownership, least-privilege runtime verification, and schema-qualified Prisma wiring for Xema biome services.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
@@ -28,7 +28,7 @@
     "@types/node": "25.2.3",
     "@types/pg": "^8.16.0",
     "@xemahq/identity-client": "^0.3.5",
-    "@xemahq/kernel-contracts": "^0.58.0",
+    "@xemahq/kernel-contracts": "^0.60.0",
     "@xemahq/xema-decorators": "^0.5.0",
     "jest": "^30.3.0",
     "prettier": "3.6.2",
@@ -49,7 +49,7 @@
   },
   "dependencies": {
     "@xemahq/migration-runner-prisma": "^0.1.2",
-    "@xemahq/platform-common": "^0.5.1",
+    "@xemahq/platform-common": "^0.5.9",
     "pg": "8.16.3"
   },
   "exports": {