@drzl/cli 4.37.0 → 4.39.0

package/dist/cli.cjs

@@ -28,7 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_analyzer3 = require("@drzl/analyzer");
 var import_chokidar = __toESM(require("chokidar"), 1);
 var import_commander = require("commander");
-var path8 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 
 // src/output.ts
 var import_chalk = require("chalk");
@@ -519,6 +519,7 @@ var GeneratorKindSchema = import_zod.z.enum([
   "forms",
   "seed",
   "fast-check",
+  "pothos",
   "service",
   "zod",
   "valibot",
@@ -1098,6 +1099,9 @@ function seedOutDir(g, cfg) {
 function fastCheckOutDir(g, cfg) {
   return g.path ?? cfg.outDir;
 }
+function pothosOutDir(g, cfg) {
+  return g.path ?? cfg.outDir;
+}
 function sharedSchemaNames(opts) {
   const resolved = (0, import_validation_core.resolveAffix)(opts);
   return import_validation_core.NAME_MODES.map((mode) => (0, import_validation_core.schemaName)(mode, import_validation_core.AFFIX_PROBE_TABLE, resolved));
@@ -1418,6 +1422,7 @@ function computeGeneratorOutputDirs(cfg, cwd = process.cwd()) {
     if (g.kind === "forms") dirs.add(abs(formsOutDir(g, cfg)));
     if (g.kind === "seed") dirs.add(abs(seedOutDir(g, cfg)));
     if (g.kind === "fast-check") dirs.add(abs(fastCheckOutDir(g, cfg)));
+    if (g.kind === "pothos") dirs.add(abs(pothosOutDir(g, cfg)));
     if (g.kind === "service") dirs.add(abs(g.path ?? "src/services"));
     if (g.kind === "zod") dirs.add(abs(g.path ?? "src/validators/zod"));
     if (g.kind === "valibot") dirs.add(abs(g.path ?? "src/validators/valibot"));
@@ -1785,6 +1790,17 @@ function fastCheckOptions(g, cfg) {
   };
 }
 
+// src/pothos-options.ts
+function pothosOptions(g, cfg) {
+  return {
+    outputDir: pothosOutDir(g, cfg),
+    naming: g.naming,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension
+  };
+}
+
 // src/h3-options.ts
 var VALIDATOR_DEFAULT_DIRS6 = {
   zod: "src/validators/zod",
@@ -2147,6 +2163,14 @@ var GENERATORS = [
     outputDir: (g, cfg) => fastCheckOutDir(g, cfg),
     options: (g, cfg) => fastCheckOptions(g, cfg)
   },
+  {
+    kind: "pothos",
+    specifier: "@drzl/generator-pothos",
+    load: () => import("@drzl/generator-pothos"),
+    construct: (m, analysis) => new m.PothosGenerator(analysis),
+    outputDir: (g, cfg) => pothosOutDir(g, cfg),
+    options: (g, cfg) => pothosOptions(g, cfg)
+  },
   {
     kind: "service",
     specifier: "@drzl/generator-service",
@@ -2390,14 +2414,109 @@ var import_validation_core3 = require("@drzl/validation-core");
 
 // src/doctor.ts
 var import_validation_core2 = require("@drzl/validation-core");
+
+// src/auth-tables.ts
+var SIGNATURES = [
+  {
+    model: "account",
+    // `providerId` beside `accountId` is the distinctive pair: it is a link to an external identity
+    // provider, which an application table has no reason to model this way.
+    required: ["accountId", "providerId", "userId"],
+    supporting: ["accessToken", "refreshToken", "idToken", "password", "scope"],
+    conventionalName: "account",
+    secrets: ["accessToken", "refreshToken", "idToken", "password"]
+  },
+  {
+    model: "session",
+    required: ["token", "expiresAt", "userId"],
+    supporting: ["ipAddress", "userAgent"],
+    conventionalName: "session",
+    // A session token is a bearer credential: whoever reads it is that user until it expires.
+    secrets: ["token"]
+  },
+  {
+    model: "verification",
+    // `identifier` and `value` are deliberately generic names, which is why `expiresAt` is required
+    // too: the three together are a short-lived token store and little else.
+    required: ["identifier", "value", "expiresAt"],
+    supporting: [],
+    conventionalName: "verification",
+    secrets: ["value"]
+  },
+  {
+    model: "user",
+    required: ["email", "emailVerified"],
+    supporting: ["name", "image"],
+    conventionalName: "user",
+    secrets: []
+  }
+];
+function columnKeys(table) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of table.columns) out.set(normalise(c.name), c);
+  return out;
+}
+function normalise(name) {
+  return name.replace(/[_-]/g, "").toLowerCase();
+}
+function has(keys, name) {
+  return keys.has(normalise(name));
+}
+function actualName(table, wanted) {
+  return table.columns.find((c) => normalise(c.name) === normalise(wanted))?.name;
+}
+function matchOne(table, sig) {
+  const keys = columnKeys(table);
+  const missing = sig.required.filter((r) => !has(keys, r));
+  if (missing.length) return void 0;
+  const supporting = sig.supporting.filter((s) => has(keys, s));
+  const nameMatches = normalise(table.name) === normalise(sig.conventionalName) || normalise(table.name) === `${normalise(sig.conventionalName)}s`;
+  const confidence = supporting.length > 0 || nameMatches ? "strong" : "likely";
+  const matched = [...sig.required, ...supporting].map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  const secrets = sig.secrets.map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  return { table: table.name, model: sig.model, confidence, matched, secrets };
+}
+function detectAuthTables(analysis) {
+  const found = [];
+  for (const table of analysis.tables) {
+    for (const sig of SIGNATURES) {
+      const m = matchOne(table, sig);
+      if (m) {
+        found.push(m);
+        break;
+      }
+    }
+  }
+  const hasNonUser = found.some((f) => f.model !== "user");
+  return hasNonUser ? found : found.filter((f) => f.model !== "user");
+}
+function authTablesWithSecrets(matches) {
+  return matches.filter((m) => m.secrets.length > 0);
+}
+function excludeSuggestion(matches) {
+  const names = [...new Set(matches.map((m) => m.table))].sort();
+  return `exclude: [${names.map((n) => `'${n}'`).join(", ")}]`;
+}
+function authTableWarnings(analysis) {
+  const risky = authTablesWithSecrets(detectAuthTables(analysis));
+  if (!risky.length) return [];
+  const lines = risky.map(
+    (m) => `"${m.table}" looks like an authentication library's ${m.model} table and holds ${m.secrets.map((c) => `"${c}"`).join(", ")}. Generating for it publishes ${m.secrets.length === 1 ? "that column" : "those columns"}.`
+  );
+  return [
+    `drzl generate: ${lines.join(" ")} Keep ${risky.length === 1 ? "it" : "them"} out with ${excludeSuggestion(risky)}, or leave it if the route is deliberate.`
+  ];
+}
+
+// src/doctor.ts
 var import_chalk2 = require("chalk");
 var PLAIN = new import_chalk2.Chalk({ level: 0 });
 var HANDLED_CODES = /* @__PURE__ */ new Set(["DRZL_ANL_UNKNOWN_COLUMN"]);
-function splitPath(path9) {
-  if (!path9) return {};
-  const dot = path9.lastIndexOf(".");
-  if (dot <= 0) return { table: path9 };
-  return { table: path9.slice(0, dot), column: path9.slice(dot + 1) };
+function splitPath(path10) {
+  if (!path10) return {};
+  const dot = path10.lastIndexOf(".");
+  if (dot <= 0) return { table: path10 };
+  return { table: path10.slice(0, dot), column: path10.slice(dot + 1) };
 }
 function namedColumns(parsed) {
   const out = [];
@@ -2562,6 +2681,18 @@ function buildDoctorReport(analysis, schemaPath) {
       hint: i.hint
     });
   }
+  for (const match of detectAuthTables(analysis)) {
+    const secrets = match.secrets.length ? ` It holds ${match.secrets.map((c) => `\`${c}\``).join(", ")}, which a generated read route would return to whoever calls it.` : "";
+    findings.push({
+      kind: "auth-table",
+      // A warning rather than an error: this is a real leak and it is also a guess about someone
+      // else's schema, and a doctor that failed the build on a guess would be switched off.
+      level: "warn",
+      table: match.table,
+      message: `"${match.table}" matches the shape of an authentication library's ${match.model} table (${match.matched.join(", ")}).${secrets}`,
+      hint: `Keep it out of every generator with ${excludeSuggestion([match])}.`
+    });
+  }
   for (const i of analysis.issues) {
     if (i.code !== "DRZL_ANL_UNKNOWN_COLUMN") continue;
     findings.push({
@@ -2600,6 +2731,11 @@ var SECTIONS = [
     title: "Columns DRZL cannot type",
     why: "These get a validator that accepts any value."
   },
+  {
+    kinds: ["auth-table"],
+    title: "Tables that look like an authentication library's",
+    why: "Every generator loops over every table it finds, so these get routes too."
+  },
   {
     kinds: ["check-declined", "check-unknown-column", "check-not-scalar", "check-uncountable"],
     title: "CHECK constraints DRZL does not enforce",
@@ -2932,11 +3068,11 @@ function issueTouches(issue, table) {
   return dot > 0 && own.includes(issue.path.slice(0, dot));
 }
 function issueColumn(issue, table) {
-  const path9 = issue.path ?? "";
+  const path10 = issue.path ?? "";
   const names = namesOf(table);
   for (const prefix of [names.qualified, names.tsName, names.name, table.name]) {
-    if (path9.startsWith(`${prefix}.`)) {
-      const rest = path9.slice(prefix.length + 1);
+    if (path10.startsWith(`${prefix}.`)) {
+      const rest = path10.slice(prefix.length + 1);
       if (table.columns.some((c) => c.name === rest)) return rest;
     }
   }
@@ -4095,6 +4231,79 @@ function displayPath(file, cwd = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : file;
 }
 
+// src/manifest.ts
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_fs3 = require("fs");
+var MANIFEST_VERSION = 1;
+var MANIFEST_PATH = import_node_path3.default.join(".drzl", "manifest.json");
+function toPosix(p) {
+  return p.split(import_node_path3.default.sep).join("/");
+}
+function manifestEntries(files, root) {
+  const rel = files.map((f) => toPosix(import_node_path3.default.relative(root, f)));
+  return [...new Set(rel)].sort();
+}
+async function readManifest(root) {
+  try {
+    const raw = await import_node_fs3.promises.readFile(import_node_path3.default.join(root, MANIFEST_PATH), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || parsed.version !== MANIFEST_VERSION || !Array.isArray(parsed.files) || !parsed.files.every((f) => typeof f === "string")) {
+      return void 0;
+    }
+    return { version: MANIFEST_VERSION, files: parsed.files };
+  } catch {
+    return void 0;
+  }
+}
+async function writeManifest(root, files) {
+  const manifest = { version: MANIFEST_VERSION, files: manifestEntries(files, root) };
+  const target = import_node_path3.default.join(root, MANIFEST_PATH);
+  await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(target), { recursive: true });
+  await import_node_fs3.promises.writeFile(target, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+}
+async function staleFiles(previous, writtenNow, root) {
+  if (!previous) return [];
+  const current = new Set(manifestEntries(writtenNow, root));
+  const gone = previous.files.filter((f) => !current.has(f));
+  const out = [];
+  for (const file of gone) {
+    let present = true;
+    try {
+      await import_node_fs3.promises.access(import_node_path3.default.join(root, file));
+    } catch {
+      present = false;
+    }
+    out.push({ file, present });
+  }
+  return out;
+}
+async function pruneStale(root, stale) {
+  const deleted = [];
+  for (const entry of stale) {
+    if (!entry.present) continue;
+    const target = import_node_path3.default.resolve(root, entry.file);
+    const inside = target === root || target.startsWith(root + import_node_path3.default.sep);
+    if (!inside) continue;
+    try {
+      await import_node_fs3.promises.rm(target);
+      deleted.push(entry.file);
+    } catch {
+    }
+  }
+  return deleted;
+}
+function staleWarning(stale) {
+  const present = stale.filter((s) => s.present);
+  if (!present.length) return void 0;
+  const list = present.map((s) => s.file).join(", ");
+  return `drzl generate: ${present.length} file(s) written by a previous run were not written by this one, and are still on disk: ${list}. That usually means a table was renamed or removed. Delete them with \`drzl generate --prune\`, which removes only files a previous run recorded writing.`;
+}
+function nextManifestFiles(writtenNow, stale, root) {
+  const kept = stale.filter((s) => s.present).map((s) => import_node_path3.default.resolve(root, s.file));
+  return manifestEntries([...writtenNow, ...kept], root);
+}
+
 // src/unified-diff.ts
 var DEFAULT_DIFF_LIMITS = {
   maxLines: 4e3,
@@ -4337,8 +4546,8 @@ function createRebuildScheduler(options) {
 
 // src/init.ts
 var import_analyzer2 = require("@drzl/analyzer");
-var fs5 = __toESM(require("fs"), 1);
-var path5 = __toESM(require("path"), 1);
+var fs6 = __toESM(require("fs"), 1);
+var path6 = __toESM(require("path"), 1);
 var INIT_GENERATOR_CHOICES = [
   { kind: "zod", packageName: "@drzl/generator-zod", label: "Zod validators" },
   { kind: "valibot", packageName: "@drzl/generator-valibot", label: "Valibot validators" },
@@ -4409,7 +4618,7 @@ async function detectSchema(cwd) {
     kitFiles = null;
   }
   if (kitFiles && kitPath) {
-    const rel = path5.relative(cwd, kitPath) || path5.basename(kitPath);
+    const rel = path6.relative(cwd, kitPath) || path6.basename(kitPath);
     const report = await classifySchemaCandidate(kitFiles);
     if (report.verdict === "confirmed" || report.verdict === "unverified") {
       notes.push(
@@ -4425,10 +4634,10 @@ async function detectSchema(cwd) {
     }
     notes.push(`${rel} names schema files that declare no Drizzle tables; looking elsewhere.`);
   }
-  const present = schemaCandidates().filter((c) => fs5.existsSync(path5.resolve(cwd, c)));
+  const present = schemaCandidates().filter((c) => fs6.existsSync(path6.resolve(cwd, c)));
   const unverified = [];
   for (const file of present) {
-    const report = await classifySchemaCandidate(path5.resolve(cwd, file));
+    const report = await classifySchemaCandidate(path6.resolve(cwd, file));
     if (report.verdict === "confirmed") {
       notes.push(
         `Schema found at ${file} (${report.tables} table${report.tables === 1 ? "" : "s"})`
@@ -4530,7 +4739,7 @@ async function promptForPlan(args) {
       if (answer === null) endedEarly = true;
       else if (answer.trim()) {
         const typed = answer.trim();
-        const report = await classifySchemaCandidate(path5.resolve(cwd, typed));
+        const report = await classifySchemaCandidate(path6.resolve(cwd, typed));
         if (report.verdict === "confirmed") {
           write(`  ${typed}: ${report.tables} table${report.tables === 1 ? "" : "s"}`);
         } else if (report.verdict === "unverified") {
@@ -4592,8 +4801,8 @@ function parseGeneratorsFlag(value) {
   return parts;
 }
 async function runInit(args) {
-  const target = path5.resolve(args.cwd, "drzl.config.ts");
-  const existing = CONFIG_FILE_NAMES.find((name) => fs5.existsSync(path5.resolve(args.cwd, name)));
+  const target = path6.resolve(args.cwd, "drzl.config.ts");
+  const existing = CONFIG_FILE_NAMES.find((name) => fs6.existsSync(path6.resolve(args.cwd, name)));
   if (existing) {
     args.error(
       `drzl init: ${existing} already exists, so nothing was written. Delete it, or edit it by hand; init never overwrites a config, and will not write one that shadows it either.`
@@ -4632,8 +4841,8 @@ async function runInit(args) {
       generators: fromFlag ?? [DEFAULT_GENERATOR_KIND]
     };
     if (args.schemaFlag) {
-      const full = path5.resolve(args.cwd, args.schemaFlag);
-      if (!fs5.existsSync(full)) {
+      const full = path6.resolve(args.cwd, args.schemaFlag);
+      if (!fs6.existsSync(full)) {
         args.log(`--schema ${args.schemaFlag} is not there yet. Writing it anyway.`);
       } else if ((await classifySchemaCandidate(full)).verdict === "rejected") {
         args.log(`--schema ${args.schemaFlag} declares no Drizzle tables. Writing it anyway.`);
@@ -4641,7 +4850,7 @@ async function runInit(args) {
     }
   }
   try {
-    fs5.writeFileSync(target, renderInitConfig(plan), { flag: "wx" });
+    fs6.writeFileSync(target, renderInitConfig(plan), { flag: "wx" });
   } catch (e) {
     if (e?.code === "EEXIST") {
       args.error(
@@ -4664,10 +4873,10 @@ async function runInit(args) {
 }
 
 // src/sponsor.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = __toESM(require("path"), 1);
-var CACHE_DIR = import_node_path3.default.join(process.cwd(), "node_modules", ".cache", "@drzl");
-var CACHE_FILE = import_node_path3.default.join(CACHE_DIR, "sponsor-message.json");
+var import_node_fs4 = require("fs");
+var import_node_path4 = __toESM(require("path"), 1);
+var CACHE_DIR = import_node_path4.default.join(process.cwd(), "node_modules", ".cache", "@drzl");
+var CACHE_FILE = import_node_path4.default.join(CACHE_DIR, "sponsor-message.json");
 var DEFAULT_INTERVAL_MS = 1e3 * 60 * 15;
 var shownThisProcess = false;
 var tips = [
@@ -4691,7 +4900,7 @@ function maybeShowSponsorMessage({
   if (hideRequested || process.env.CI && !force || shownThisProcess && !force) return;
   if (!out.wantsAsides && !force) return;
   try {
-    (0, import_node_fs3.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs4.mkdirSync)(CACHE_DIR, { recursive: true });
     const payload = readCache();
     payload.runs += 1;
     const now = Date.now();
@@ -4719,11 +4928,11 @@ ${green("Pro tip:")} ${tip}
   }
 }
 function readCache() {
-  if (!(0, import_node_fs3.existsSync)(CACHE_FILE)) {
+  if (!(0, import_node_fs4.existsSync)(CACHE_FILE)) {
     return { runs: 0 };
   }
   try {
-    const data = JSON.parse((0, import_node_fs3.readFileSync)(CACHE_FILE, "utf8"));
+    const data = JSON.parse((0, import_node_fs4.readFileSync)(CACHE_FILE, "utf8"));
     if (typeof data.runs !== "number") return { runs: 0 };
     return data;
   } catch {
@@ -4731,21 +4940,21 @@ function readCache() {
   }
 }
 function writeCache(payload) {
-  (0, import_node_fs3.writeFileSync)(CACHE_FILE, JSON.stringify(payload, null, 2), "utf8");
+  (0, import_node_fs4.writeFileSync)(CACHE_FILE, JSON.stringify(payload, null, 2), "utf8");
 }
 
 // src/version.ts
-var import_node_fs4 = require("fs");
-var path7 = __toESM(require("path"), 1);
+var import_node_fs5 = require("fs");
+var path8 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var PACKAGE_NAME = "@drzl/cli";
 function moduleDir() {
-  return path7.dirname((0, import_node_url.fileURLToPath)(__drzlModuleUrl));
+  return path8.dirname((0, import_node_url.fileURLToPath)(__drzlModuleUrl));
 }
 function readVersionFrom(manifestPath) {
   let raw;
   try {
-    raw = (0, import_node_fs4.readFileSync)(manifestPath, "utf8");
+    raw = (0, import_node_fs5.readFileSync)(manifestPath, "utf8");
   } catch (e) {
     throw new Error(
       `${PACKAGE_NAME} cannot read its own version: no manifest at ${manifestPath} (${e?.message ?? String(e)}).`
@@ -4763,7 +4972,7 @@ function readVersionFrom(manifestPath) {
   return manifest.version;
 }
 function readCliVersion() {
-  return readVersionFrom(path7.join(moduleDir(), "..", "package.json"));
+  return readVersionFrom(path8.join(moduleDir(), "..", "package.json"));
 }
 var CLI_VERSION = readCliVersion();
 
@@ -4852,8 +5061,8 @@ withOutputFlags(
     const errors = res.issues.some((i) => i.level === "error");
     const code = unreadable ? EXIT_FAILED : errors ? EXIT_FINDINGS : EXIT_OK;
     if (opts.out && !opts.json) {
-      const fs6 = await import("fs/promises");
-      await fs6.writeFile(opts.out, JSON.stringify(res, null, 2), "utf8");
+      const fs7 = await import("fs/promises");
+      await fs7.writeFile(opts.out, JSON.stringify(res, null, 2), "utf8");
       spinner.succeed(`Analysis written to ${opts.out} in ${ms}ms`);
     } else {
       spinner.succeed(`Analyzed in ${ms}ms`);
@@ -4990,7 +5199,7 @@ async function explainSchemaSource(opts, out) {
       schema: source.schema,
       label: describeSchemaTarget(source.schema),
       config: cfg,
-      ...source.source === "drizzle-kit" && source.drizzleKitConfigPath ? { note: `Schema from ${path8.relative(process.cwd(), source.drizzleKitConfigPath)}` } : {}
+      ...source.source === "drizzle-kit" && source.drizzleKitConfigPath ? { note: `Schema from ${path9.relative(process.cwd(), source.drizzleKitConfigPath)}` } : {}
     };
   }
   const detected = await detectSchema(process.cwd());
@@ -5100,7 +5309,11 @@ withOutputFlags(
   ).option(
     "--check",
     "regenerate and fail if the result differs from what is on disk, without changing it"
-  ).option("--dry-run", "report what would be written, and write nothing", false)
+  ).option("--dry-run", "report what would be written, and write nothing", false).option(
+    "--prune",
+    "delete files a previous run wrote that this one did not, and nothing else",
+    false
+  )
 ).action(async (opts) => {
   const out = outputFor(opts);
   const planning = !!opts.check || !!opts.dryRun;
@@ -5150,7 +5363,7 @@ withOutputFlags(
         const n = source.schema.length;
         out.note(
           out.errStyle.gray(
-            `Schema from ${path8.relative(process.cwd(), source.drizzleKitConfigPath)} (${n} file${n === 1 ? "" : "s"})`
+            `Schema from ${path9.relative(process.cwd(), source.drizzleKitConfigPath)} (${n} file${n === 1 ? "" : "s"})`
           )
         );
       }
@@ -5179,6 +5392,7 @@ withOutputFlags(
       analysis.tables = filterTables(narrowed.tables, cfg);
       for (const w of [...narrowed.warnings, ...filterWarnings]) warn(w);
       for (const w of wideColumnWarning(analysis.issues)) warn(w);
+      for (const w of authTableWarnings(analysis)) warn(w);
       const empty = nothingToGenerate({
         schema: source.schema,
         analyzed: narrowed.tables,
@@ -5248,6 +5462,19 @@ withOutputFlags(
         files: e.files,
         changes: e.changes.map((c) => ({ file: displayPath(c.file), status: c.status }))
       }));
+      const previousManifest = await readManifest(process.cwd());
+      const writtenNow = plan.files.map((f) => f.file);
+      const stale = await staleFiles(previousManifest, writtenNow, process.cwd());
+      let stillStale = stale;
+      if (opts.prune && !planning) {
+        const removed = await pruneStale(process.cwd(), stale);
+        for (const file of removed) out.warn(`drzl generate: removed stale ${file}`);
+        const gone = new Set(removed);
+        stillStale = stale.filter((s) => !gone.has(s.file));
+      } else {
+        const warning = staleWarning(stale);
+        if (warning) warn(warning);
+      }
       if (planning) {
         const wrote = await verifyNothingWasWritten(outputDirs, existing);
         if (wrote.length) {
@@ -5257,6 +5484,14 @@ withOutputFlags(
           process.exit(EXIT_FAILED);
         }
       }
+      if (!planning) {
+        await writeManifest(
+          process.cwd(),
+          nextManifestFiles(writtenNow, stillStale, process.cwd()).map(
+            (f) => path9.resolve(process.cwd(), f)
+          )
+        );
+      }
       if (opts.check) {
         const drift = pendingChanges(plan);
         const upToDate = drift.length === 0;
@@ -5498,10 +5733,10 @@ program.command("watch").description("Watch schema and regenerate on changes").o
     return;
   }
   let cfg = loaded;
-  const abs = (p) => path8.resolve(process.cwd(), p);
+  const abs = (p) => path9.resolve(process.cwd(), p);
   const isInside = (child, parent) => {
-    const rel = path8.relative(parent, child);
-    return !!rel && !rel.startsWith("..") && !path8.isAbsolute(rel);
+    const rel = path9.relative(parent, child);
+    return !!rel && !rel.startsWith("..") && !path9.isAbsolute(rel);
   };
   let source;
   try {
@@ -5537,7 +5772,7 @@ program.command("watch").description("Watch schema and regenerate on changes").o
       if (full === dir || isInside(full, dir)) return true;
     }
     if (stats?.isDirectory()) return false;
-    const ext = path8.extname(full);
+    const ext = path9.extname(full);
     if (!ext) return false;
     return !WATCHED_EXTENSIONS.has(ext);
   };
@@ -5700,7 +5935,7 @@ program.command("watch").description("Watch schema and regenerate on changes").o
   } else {
     out.note(
       out.errStyle.gray(
-        "Watching:\n  " + Array.from(currentTargets).map((p) => path8.relative(process.cwd(), p)).join("\n  ")
+        "Watching:\n  " + Array.from(currentTargets).map((p) => path9.relative(process.cwd(), p)).join("\n  ")
       )
     );
   }