@xemahq/repo-build-tooling 0.27.0 → 0.27.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.27.0",
+  "version": "0.27.2",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -50,6 +50,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:4a2cf6b565691b2837d7562f58925a40e3ad2284eded9395b72a74312788d417"
+    "sourceDigest": "sha256:3a4f2d10146fe209afa48b5f783954e50bd239602444a7a59920cc7196169c6b"
   }
 }

package/src/composed-image-install.mjs

@@ -4,8 +4,12 @@
 // for the members' closures only and checked to pin nothing new, then production dependencies are
 // installed from the runner's pnpm store alone (`--offline`, `--ignore-scripts`), selected for the
 // TARGET platform (`--os/--cpu/--libc`) so no foreign-platform binary is staged.
+//
+// The re-resolve runs in a scratch copy of the tree's manifests, never in the tree: pnpm 10.33 `--lockfile-only`
+// with a filter that leaves workspace projects out still links a full `node_modules` (dev dependencies included),
+// and the `--prod` install after it does not prune it, so dev-only packages would ship and be scanned.
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { copyFileSync, mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -31,21 +35,41 @@ export const productionInstallCommand = (filters, arch) => [
   '--os=linux', `--cpu=${nodeArch(arch)}`, `--libc=${libcOf(arch)}`,
 ];
 
+/** The root files a resolve reads, beside every workspace `package.json` and patch file. */
+const RESOLVE_ROOT_FILES = Object.freeze(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs']);
+
+/** Copy what `pnpm install --lockfile-only` reads from `treeRoot` into `resolveRoot`: no sources, no `node_modules`. */
+export function copyResolveInputs(treeRoot, resolveRoot, directory = '') {
+  for (const entry of readdirSync(join(treeRoot, directory), { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name !== 'node_modules' && entry.name !== '.git') copyResolveInputs(treeRoot, resolveRoot, path);
+    } else if (entry.isFile() && (entry.name === 'package.json' || entry.name.endsWith('.patch') || (directory === '' && RESOLVE_ROOT_FILES.includes(entry.name)))) {
+      mkdirSync(join(resolveRoot, directory), { recursive: true });
+      copyFileSync(join(treeRoot, path), join(resolveRoot, path));
+    }
+  }
+}
+
 const defaultExec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'inherit' });
 
 /**
  * Install the members' production closure into `treeRoot` (which holds the root manifests, the lockfile and the
  * closure's package files). `filters` are the members' literal `--filter <package>...` words. Throws when the
- * re-resolve pinned a registry package the committed lockfile does not.
+ * re-resolve pinned a registry package the committed lockfile does not. Only the re-resolved `pnpm-lock.yaml` comes
+ * back from the scratch copy, so the tree's `node_modules` is the production install's alone.
  */
 export function installClosure({ treeRoot, filters, arch, exec = defaultExec }) {
   const scratch = mkdtempSync(join(tmpdir(), 'xema-composed-lock-'));
   try {
     const committed = join(scratch, 'pnpm-lock.committed.yaml');
     copyFileSync(join(treeRoot, 'pnpm-lock.yaml'), committed);
+    const resolveRoot = join(scratch, 'resolve');
+    copyResolveInputs(treeRoot, resolveRoot);
     const [resolveFile, ...resolveArgs] = lockfileOnlyCommand(filters);
-    exec(resolveFile, resolveArgs, { cwd: treeRoot });
-    assertPinsUnchanged({ root: treeRoot, committedLockfile: committed });
+    exec(resolveFile, resolveArgs, { cwd: resolveRoot });
+    assertPinsUnchanged({ root: resolveRoot, committedLockfile: committed });
+    copyFileSync(join(resolveRoot, 'pnpm-lock.yaml'), join(treeRoot, 'pnpm-lock.yaml'));
     const [installFile, ...installArgs] = productionInstallCommand(filters, arch);
     exec(installFile, installArgs, { cwd: treeRoot });
     // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.

package/src/composed-image-install.test.mjs

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,11 +16,23 @@ function tree(committed) {
   return treeRoot;
 }
 
-test('the re-resolve then the production install run in the tree, offline and frozen, for the target platform, with the literal filters', () => {
+test('the re-resolve runs in a scratch copy of the manifests, then the production install runs in the tree, offline and frozen, for the target platform, with the literal filters', () => {
   const treeRoot = tree(lock('left-pad@1.3.0'));
+  fs.writeFileSync(path.join(treeRoot, 'package.json'), '{"name":"root"}');
+  fs.mkdirSync(path.join(treeRoot, 'apps/a/dist'), { recursive: true });
+  fs.writeFileSync(path.join(treeRoot, 'apps/a/package.json'), '{"name":"@t/a"}');
+  fs.writeFileSync(path.join(treeRoot, 'apps/a/dist/main.js'), '');
   const calls = [];
-  installClosure({ treeRoot, filters: FILTERS, arch: 'arm64', exec: (file, args, options) => calls.push({ line: [file, ...args], cwd: options.cwd }) });
-  assert.deepEqual(calls.map((c) => c.cwd), [treeRoot, treeRoot]);
+  const exec = (file, args, options) => {
+    const seen = fs.readdirSync(options.cwd, { recursive: true }).sort();
+    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(options.cwd, 'pnpm-lock.yaml'), `${lock('left-pad@1.3.0')}# re-resolved\n`);
+    calls.push({ line: [file, ...args], cwd: options.cwd, seen });
+  };
+  installClosure({ treeRoot, filters: FILTERS, arch: 'arm64', exec });
+  assert.notEqual(calls[0].cwd, treeRoot);
+  assert.deepEqual(calls[0].seen, ['apps', 'apps/a', 'apps/a/package.json', 'package.json', 'pnpm-lock.yaml']);
+  assert.equal(calls[1].cwd, treeRoot);
+  assert.match(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /# re-resolved/, 'the re-resolved lockfile came back into the tree');
   assert.deepEqual(calls[0].line, lockfileOnlyCommand(FILTERS));
   assert.deepEqual(calls[1].line, productionInstallCommand(FILTERS, 'arm64'));
   const install = calls[1].line.join(' ');
@@ -32,10 +45,43 @@ test('the re-resolve then the production install run in the tree, offline and fr
 test('a re-resolution that pins a registry package the committed lockfile does not stops before the install', () => {
   const treeRoot = tree(lock('left-pad@1.3.0'));
   const calls = [];
-  const exec = (file, args) => {
+  const exec = (file, args, options) => {
     calls.push(args);
-    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), lock('left-pad@1.3.0', 'evil@9.9.9'));
+    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(options.cwd, 'pnpm-lock.yaml'), lock('left-pad@1.3.0', 'evil@9.9.9'));
   };
   assert.throws(() => installClosure({ treeRoot, filters: FILTERS, arch: 'amd64', exec }), /pinned registry package\(s\) the committed lockfile does not:\n {2}- evil@9\.9\.9/);
   assert.equal(calls.length, 1, 'the production install never ran');
+  assert.doesNotMatch(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /evil/, 'the refused lockfile never reached the tree');
+});
+
+// Real pnpm, no registry: `file:` packages only. pnpm 10.33 `--lockfile-only` with a filter that leaves a workspace
+// project out links a full node_modules, dev dependencies included; the `--prod` install after it never prunes them.
+test('after the install the tree holds the production closure only: no dev-only package, even when the filter leaves a project out', () => {
+  const treeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'xema-install-real-'));
+  const write = (file, json) => {
+    fs.mkdirSync(path.dirname(path.join(treeRoot, file)), { recursive: true });
+    fs.writeFileSync(path.join(treeRoot, file), JSON.stringify(json));
+  };
+  try {
+    write('package.json', { name: 'root', private: true });
+    fs.writeFileSync(path.join(treeRoot, 'pnpm-workspace.yaml'), "packages:\n  - 'apps/*'\n");
+    write('vendor/prod-only/package.json', { name: 'prod-only', version: '1.0.0' });
+    write('vendor/dev-only/package.json', { name: 'dev-only', version: '1.0.0' });
+    const deps = { dependencies: { 'prod-only': 'file:../../vendor/prod-only' }, devDependencies: { 'dev-only': 'file:../../vendor/dev-only' } };
+    write('apps/lib/package.json', { name: '@t/lib', version: '1.0.0', ...deps });
+    write('apps/a/package.json', { name: '@t/a', version: '1.0.0', ...deps, dependencies: { ...deps.dependencies, '@t/lib': 'workspace:*' } });
+    write('apps/other/package.json', { name: '@t/other', version: '1.0.0', devDependencies: deps.devDependencies });
+    execFileSync('pnpm', ['install', '--lockfile-only', '--offline'], { cwd: treeRoot, stdio: 'ignore' });
+
+    // CI=true as on the runner, where pnpm keeps a modules directory it would otherwise refuse to reuse without a TTY.
+    const exec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'pipe', env: { ...process.env, CI: 'true' } });
+    installClosure({ treeRoot, filters: ['--filter', '@t/a...'], arch: 'arm64', exec });
+
+    const entries = fs.readdirSync(path.join(treeRoot, 'node_modules', '.pnpm'));
+    assert.ok(entries.some((entry) => entry.startsWith('prod-only@')), `the prod dependency is installed: ${entries}`);
+    assert.ok(!entries.some((entry) => entry.startsWith('dev-only@')), `no dev-only package is installed: ${entries}`);
+    assert.match(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /injectWorkspacePackages: true/, 'the tree holds the re-resolved lockfile');
+  } finally {
+    fs.rmSync(treeRoot, { recursive: true, force: true });
+  }
 });

package/src/composed-image-prisma-check.mjs

@@ -1,18 +1,19 @@
 // `xema-composed-image prisma-check`, INSIDE the image build, on the TARGET arch.
 // Every member that owns a Prisma schema carries its generated client(s) in
 // `<member>/node_modules/.prisma/<client>/`, generated on the CI runner and staged
-// without running anything. Each client's schema must be the member's own schema as
+// without running anything; non-client generator outputs there (the org-erasure graph)
+// must load and export their names. Each client's schema must be the member's own schema as
 // `prisma format` writes it, or the client is stale. The image carries no native engine: the only supported
 // client is Rust-free (a wasm query compiler plus a driver adapter). This refuses any
 // native engine file, compiles the wasm, checks the client matches the member's
 // `prisma` CLI, and constructs it. It never connects.
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 
 import { COMPOSED_IMAGE_DIR } from './composed-image-paths.mjs';
 import { readMembers } from './composed-image-members.mjs';
-import { clientSchemaProblems, memberPrismaSchema } from './composed-migrate.mjs';
+import { clientSchemaProblems, memberPrismaOutputs, memberPrismaSchema } from './composed-migrate.mjs';
 
 const NATIVE_ENGINE = [/^libquery_engine-.*\.node$/, /^query-engine-/, /\.so\.node$/, /\.dll\.node$/, /\.dylib\.node$/];
 const WASM_COMPILER = /^query_compiler.*_bg\.wasm$/;
@@ -35,16 +36,14 @@ function cliVersion(memberRequire, memberDirectory) {
 async function schemaVerdicts({ root, imageDir, formatSpawn, concurrency }) {
   const jobs = [];
   for (const [, directory] of readMembers({ root, imageDir })) {
+    let schema;
     try {
-      if (memberPrismaSchema(root, directory) === undefined) continue;
+      schema = memberPrismaSchema(root, directory);
     } catch {
       continue; // reported by the main pass
     }
-    const container = join(root, directory, 'node_modules', '.prisma');
-    if (!existsSync(container)) continue;
-    for (const entry of readdirSync(container, { withFileTypes: true }).filter((e) => e.isDirectory())) {
-      jobs.push({ root, memberDir: directory, clientDir: join(container, entry.name) });
-    }
+    if (schema === undefined) continue;
+    for (const clientDir of memberPrismaOutputs(root, directory, schema).clients) jobs.push({ root, memberDir: directory, clientDir });
   }
   const verdicts = await clientSchemaProblems(jobs, { spawn: formatSpawn, concurrency });
   return new Map(jobs.map((job, i) => [job.clientDir, verdicts[i]]));
@@ -75,10 +74,22 @@ export async function prismaCheck({ root = process.cwd(), imageDir = COMPOSED_IM
       continue;
     }
     const memberRequire = createRequire(join(memberDirectory, 'package.json'));
-    for (const name of dirs) {
+    const outputs = memberPrismaOutputs(root, directory, schema);
+    for (const problem of outputs.problems) problems.push(`${key}: ${problem}`);
+    // A non-client artifact (e.g. the org-erasure graph) is imported at boot: it must load and export its names.
+    for (const { dir, kind, exports } of outputs.artifacts) {
+      const label = `${key} (.prisma/${basename(dir)})`;
+      try {
+        const module = memberRequire(dir);
+        const absent = exports.filter((name) => module?.[name] === undefined);
+        if (absent.length > 0) problems.push(`${label}: the ${kind} does not export ${absent.join(', ')}`);
+      } catch (error) {
+        problems.push(`${label}: the ${kind} does not load: ${error?.message ?? String(error)}`);
+      }
+    }
+    for (const clientDirectory of outputs.clients) {
       clients += 1;
-      const label = `${key} (.prisma/${name})`;
-      const clientDirectory = join(container, name);
+      const label = `${key} (.prisma/${basename(clientDirectory)})`;
       const staleProblem = stale.get(clientDirectory);
       if (staleProblem !== undefined) {
         problems.push(`${label}: ${staleProblem}`);

package/src/composed-image-prisma-check.test.mjs

@@ -38,3 +38,21 @@ test('a stale client (the source gained a field after generation) is refused; th
   await assert.rejects(prismaCheck({ root: stale, log() {}, formatSpawn: formatNoop }), /differs from the member's prisma\/schema\.prisma .*stale/);
   await assert.rejects(prismaCheck({ root: workspace(), log() {}, formatSpawn: formatNoop }), (e) => !/stale/.test(e.message));
 });
+
+test('an org-erasure graph is not treated as a client: it must load and export orgErasureGraph', async () => {
+  const schema =
+    'generator client {\n  provider = "prisma-client-js"\n  output   = "../node_modules/.prisma/alpha-db"\n}\n\n' +
+    'generator orgErasureGraph {\n  provider = "xema-org-erasure-graph"\n  output   = "../node_modules/.prisma/alpha-db-org-erasure-graph"\n}\n\ndatasource db {}\n';
+  const graph = (root, js) => {
+    write(root, 'biomes/alpha/api/alpha-db-api/prisma/schema.prisma', schema);
+    write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/schema.prisma', schema);
+    write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.js', js);
+    write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.d.ts', '');
+    return root;
+  };
+  // The fixture client has no wasm compiler, so the check fails, but only on the client, never on the graph.
+  await assert.rejects(prismaCheck({ root: graph(workspace(), 'exports.orgErasureGraph = {};\n'), log() {}, formatSpawn: formatNoop }), (e) =>
+    /\.prisma\/alpha-db\): no query_compiler/.test(e.message) && !/org-erasure-graph/.test(e.message));
+  await assert.rejects(prismaCheck({ root: graph(workspace(), 'exports.other = 1;\n'), log() {}, formatSpawn: formatNoop }),
+    /\.prisma\/alpha-db-org-erasure-graph\): the org-erasure graph does not export orgErasureGraph/);
+});

package/src/composed-image-stage.mjs

@@ -5,7 +5,7 @@
 //
 //   <dir>/out/<package dir>/<output>/               every closure package's outputs (default: dist);
 //                                                   `--also <pkg>` adds that package's closure (no member checks)
-//   <dir>/out/<pkg dir>/node_modules/.prisma/       the generated Prisma clients of every closure root that has
+//   <dir>/out/<pkg dir>/node_modules/.prisma/       the generated Prisma clients (and artifacts such as the org-erasure graph) of every closure root that has
 //                                                   `prisma/schema.prisma` (members and `--also` roots alike)
 //   <dir>/tool/                                     this package (package.json + src, no tests):
 //                                                   bind-mounted into the build, never copied into a layer
@@ -18,7 +18,7 @@ import { fileURLToPath } from 'node:url';
 
 import { COMPOSED_IMAGE_DIR, NODE_MAJOR_LABEL } from './composed-image-paths.mjs';
 import { memberClosure, readMembers } from './composed-image-members.mjs';
-import { clientSchemaProblems, memberPrismaSchema } from './composed-migrate.mjs';
+import { clientSchemaProblems, memberPrismaOutputs, memberPrismaSchema } from './composed-migrate.mjs';
 
 export const DEFAULT_OUTPUTS = Object.freeze(['dist']);
 const TOOL_PACKAGE = join(dirname(fileURLToPath(import.meta.url)), '..');
@@ -114,9 +114,11 @@ export async function planBuildOutputs({
     const hasClient = existsSync(clients) && readdirSync(clients, { withFileTypes: true }).some((e) => e.isDirectory());
     if (schema !== undefined && !hasClient) problems.push(`${key}: ${directory} has prisma/schema.prisma but no node_modules/.prisma/<client>/ — run prisma generate`);
     if (schema !== undefined && hasClient) {
-      for (const entry of readdirSync(clients, { withFileTypes: true }).filter((e) => e.isDirectory())) {
-        schemaJobs.push({ key, root, memberDir: directory, clientDir: join(clients, entry.name) });
-      }
+      // Each folder by what generated it: clients are checked against the schema, other artifacts
+      // (e.g. the org-erasure graph the process imports at boot) must be present and complete.
+      const prismaOutputs = memberPrismaOutputs(root, directory, schema);
+      for (const problem of prismaOutputs.problems) problems.push(`${key}: ${problem}`);
+      for (const clientDir of prismaOutputs.clients) schemaJobs.push({ key, root, memberDir: directory, clientDir });
     }
     if (schema === undefined && hasClient) problems.push(`${key}: ${directory} ships node_modules/.prisma/<client>/ but has no prisma/schema.prisma`);
   }

package/src/composed-image-stage.test.mjs

@@ -173,3 +173,44 @@ test('--also refuses a non-member closure root with prisma/schema.prisma but no
   await assert.rejects(stage(root, { exec: alsoPnpm(root, EXTRA), also: ['@t/extra'] }), /packages\/sdks\/extra has prisma\/schema\.prisma but no generated client: run prisma generate/);
   assert.equal(fs.existsSync(path.join(root, '.xema-stage')), false);
 });
+
+const GRAPH_SCHEMA =
+  'generator client {\n  provider = "prisma-client-js"\n  output   = "../node_modules/.prisma/alpha-db"\n}\n\n' +
+  'generator orgErasureGraph {\n  provider = "xema-org-erasure-graph"\n  output   = "../node_modules/.prisma/alpha-db-org-erasure-graph"\n}\n\ndatasource db {}\n';
+
+function withErasureGraph() {
+  const root = ready();
+  write(root, 'biomes/alpha/api/alpha-db-api/prisma/schema.prisma', GRAPH_SCHEMA);
+  write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/schema.prisma', GRAPH_SCHEMA);
+  write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.js', 'exports.orgErasureGraph = {};\n');
+  write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.d.ts', 'export declare const orgErasureGraph: unknown;\n');
+  return root;
+}
+
+test('stages a member with a Prisma client and an org-erasure graph, carrying the graph', async () => {
+  const root = withErasureGraph();
+  await stage(root);
+  const staged = files(path.join(root, '.xema-stage/out'));
+  assert.ok(staged.includes('biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.js'));
+  assert.ok(staged.includes('biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/index.js'));
+});
+
+test('a client without its schema still fails beside an org-erasure graph; a missing or incomplete graph fails clearly', async () => {
+  const noClientSchema = withErasureGraph();
+  fs.rmSync(path.join(noClientSchema, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/schema.prisma'));
+  await assert.rejects(stage(noClientSchema), (e) => /\.prisma\/alpha-db: carries no schema\.prisma/.test(e.message) && !/org-erasure-graph/.test(e.message));
+  const missing = withErasureGraph();
+  fs.rmSync(path.join(missing, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph'), { recursive: true });
+  await assert.rejects(stage(missing), /generator orgErasureGraph \(provider "xema-org-erasure-graph"\): node_modules\/\.prisma\/alpha-db-org-erasure-graph is missing — run prisma generate/);
+  const incomplete = withErasureGraph();
+  fs.rmSync(path.join(incomplete, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db-org-erasure-graph/index.d.ts'));
+  await assert.rejects(stage(incomplete), /the org-erasure graph node_modules\/\.prisma\/alpha-db-org-erasure-graph lacks index\.d\.ts/);
+});
+
+test('refuses a generator of an unknown provider writing into node_modules/.prisma', async () => {
+  const root = withErasureGraph();
+  const schema = `${GRAPH_SCHEMA}generator other {\n  provider = "some-generator"\n  output   = "../node_modules/.prisma/alpha-db-other"\n}\n`;
+  write(root, 'biomes/alpha/api/alpha-db-api/prisma/schema.prisma', schema);
+  write(root, 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/schema.prisma', schema);
+  await assert.rejects(stage(root), /generator other \(provider "some-generator"\) writes node_modules\/\.prisma\/alpha-db-other, a kind the composed image does not know/);
+});

package/src/composed-migrate.mjs

@@ -11,9 +11,9 @@
 // platform migration runner drops it the same way). Exits with the child's code.
 // This file is also the single home of `memberPrismaSchema`, which the build tool imports.
 import { spawn as spawnAsync, spawnSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync } from 'node:fs';
 import { availableParallelism, tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 /**
@@ -42,6 +42,75 @@ export function memberPrismaSchema(root, memberDir) {
   return existsSync(schema) ? schema : undefined;
 }
 
+/**
+ * Generators that write into `node_modules/.prisma/` something that is NOT a Prisma client,
+ * keyed by provider: what the output is, the files it must carry and the names its module
+ * must export. The process imports these at boot, so a missing one is a stage failure.
+ */
+export const PRISMA_ARTIFACT_GENERATORS = Object.freeze({
+  'xema-org-erasure-graph': Object.freeze({ kind: 'org-erasure graph', files: ['index.js', 'index.d.ts'], exports: ['orgErasureGraph'] }),
+});
+const PRISMA_CLIENT_PROVIDERS = new Set(['prisma-client-js', 'prisma-client']);
+
+/**
+ * The schema's generator blocks: `[{ name, provider, output }]`. `output` is the absolute
+ * directory (resolved against the schema's directory, as Prisma does), or undefined when the
+ * block sets none or not as a string literal (e.g. `env(...)`).
+ */
+export function schemaGenerators(schemaPath) {
+  const text = readFileSync(schemaPath, 'utf8').replace(/^\s*\/\/.*$/gm, '');
+  const generators = [];
+  for (const block of text.matchAll(/^\s*generator\s+(\w+)\s*\{([^}]*)\}/gm)) {
+    const provider = /^\s*provider\s*=\s*"([^"]*)"/m.exec(block[2])?.[1];
+    const output = /^\s*output\s*=\s*"([^"]*)"/m.exec(block[2])?.[1];
+    generators.push({ name: block[1], provider, output: output === undefined ? undefined : resolve(dirname(schemaPath), output) });
+  }
+  return generators;
+}
+
+/**
+ * Sort a member's `node_modules/.prisma/<dir>/` folders by the generator that wrote them, read
+ * from the member's schema: `{ clients, artifacts, problems }`. A folder a client generator
+ * declares, or one no generator declares, is a Prisma client (`clients`: absolute dirs, to be
+ * checked against the schema). A folder a `PRISMA_ARTIFACT_GENERATORS` provider declares is that
+ * artifact (`artifacts`: `{ dir, provider, kind, exports }`) and must carry its files. A declared
+ * output that is absent, or a generator of an unknown provider writing into `.prisma/`, is a problem.
+ */
+export function memberPrismaOutputs(root, memberDir, schemaPath) {
+  const container = join(resolve(root, memberDir), 'node_modules', '.prisma');
+  const present = new Set(
+    existsSync(container) ? readdirSync(container, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => join(container, e.name)) : [],
+  );
+  const declared = new Map(); // dir -> provider
+  const problems = [];
+  for (const { name, provider, output } of schemaGenerators(schemaPath)) {
+    if (output === undefined || dirname(output) !== container) continue;
+    const label = `${memberDir}: generator ${name} (provider "${provider}")`;
+    if (!PRISMA_CLIENT_PROVIDERS.has(provider) && PRISMA_ARTIFACT_GENERATORS[provider] === undefined) {
+      problems.push(`${label} writes node_modules/.prisma/${basename(output)}, a kind the composed image does not know`);
+      continue;
+    }
+    declared.set(output, provider);
+    if (!present.has(output)) problems.push(`${label}: node_modules/.prisma/${basename(output)} is missing — run prisma generate`);
+  }
+  const clients = [];
+  const artifacts = [];
+  for (const dir of [...present].sort()) {
+    const spec = PRISMA_ARTIFACT_GENERATORS[declared.get(dir)];
+    if (spec === undefined) {
+      clients.push(dir);
+      continue;
+    }
+    const missing = spec.files.filter((file) => !existsSync(join(dir, file)));
+    if (missing.length > 0) {
+      problems.push(`${memberDir}: the ${spec.kind} node_modules/.prisma/${basename(dir)} lacks ${missing.join(', ')} — run prisma generate`);
+      continue;
+    }
+    artifacts.push({ dir, provider: declared.get(dir), kind: spec.kind, exports: spec.exports });
+  }
+  return { clients, artifacts, problems };
+}
+
 /** Async process run with collected output: `{ status, stdout, stderr }` or `{ error }`. */
 function runAsync(command, args, options) {
   return new Promise((done) => {