@prisma-next/cli 0.10.0-dev.2 → 0.10.0-dev.4

package/dist/{init-DBRWZlFU.mjs → init-BHbEOgNr.mjs}

@@ -11,6 +11,159 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { detect, getUserAgent } from "package-manager-detector/detect";
 import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
+//#region src/commands/init/detect-package-manager.ts
+const KNOWN = new Set([
+	"pnpm",
+	"npm",
+	"yarn",
+	"bun",
+	"deno"
+]);
+/**
+* Resolves the package manager `init` should drive for `add` / `install`
+* commands. Tries, in order:
+*
+*  1. **`detect()`** — walks up from `cwd` looking for a lockfile, the
+*     `packageManager` field, the `devEngines.packageManager` field, or
+*     install metadata. This is the right answer whenever the user is
+*     anywhere inside an existing project, including a deep workspace
+*     subdirectory.
+*
+*  2. **`getUserAgent()`** — parses `npm_config_user_agent`, the env var
+*     every PM sets when it spawns a script. This catches the
+*     bare-directory case where there's no project to walk up to but the
+*     user invoked us via `pnpm dlx prisma-next init` / `bunx
+*     prisma-next init` / `yarn dlx …`. Same signal used by every
+*     `create-*` tool in the ecosystem (`create-vite`, `create-next-app`,
+*     `create-astro`, `@antfu/ni`, …).
+*
+*  3. **`npm`** — final fallback. Always present alongside Node.
+*/
+async function detectPackageManager(cwd) {
+	const detected = await detect({ cwd });
+	if (detected && KNOWN.has(detected.name)) return detected.name;
+	const userAgent = getUserAgent();
+	if (userAgent !== null && KNOWN.has(userAgent)) return userAgent;
+	return "npm";
+}
+function hasProjectManifest(cwd) {
+	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
+}
+function formatRunCommand(pm, bin, args) {
+	if (pm === "npm") return `npx ${bin} ${args}`;
+	if (pm === "deno") return `deno run npm:${bin} ${args}`;
+	return `${pm} ${bin} ${args}`;
+}
+function formatAddArgs(pm, packages) {
+	if (pm === "deno") return ["add", ...packages.map((p) => `npm:${p}`)];
+	return ["add", ...packages];
+}
+function formatAddDevArgs(pm, packages) {
+	if (pm === "deno") return [
+		"add",
+		"--dev",
+		...packages.map((p) => `npm:${p}`)
+	];
+	return [
+		"add",
+		"-D",
+		...packages
+	];
+}
+//#endregion
+//#region src/commands/init/detect-pnpm-catalog.ts
+/**
+* Walks up from `baseDir` looking for `pnpm-workspace.yaml`, then scans
+* its top-level `catalog:` block for entries that match any of `packages`.
+*
+* Implements FR7.3 / Spec Decision 8 (honour-and-warn): when `init` runs
+* inside a pnpm workspace whose catalog overrides one of the packages it
+* installs, surface a structured warning so the user knows the catalog
+* version (not the published `latest`) is what ended up in their
+* `node_modules`. pnpm itself does this silently; the warning closes the
+* "looks fine, must be wrong version six months later" gap.
+*
+* Notes / scope:
+*
+* - We only inspect the unnamed top-level `catalog:` block. pnpm also
+*   supports `catalogs:` (plural — *named* catalogs referenced via
+*   `catalog:foo` specifiers); those don't apply to a vanilla
+*   `pnpm add prisma-next` invocation, so we skip them.
+* - We don't validate YAML syntax exhaustively. The file format pnpm
+*   ships is line-oriented and well-known; a minimal regex is more
+*   robust than depending on a YAML parser for one warning.
+* - We don't compare against the registry's `latest` — pnpm uses the
+*   catalog version regardless, so the warning fires whenever a match
+*   exists. The user-facing copy explains how to opt out.
+*/
+function detectPnpmCatalogOverrides(baseDir, packages) {
+	const workspaceFile = findNearestPnpmWorkspaceFile(baseDir);
+	if (workspaceFile === null) return null;
+	const catalog = extractCatalogBlock(readFileSync(workspaceFile, "utf-8"));
+	if (catalog === null) return {
+		workspaceFile,
+		entries: []
+	};
+	const wanted = new Set(packages);
+	const entries = [];
+	for (const [name, version] of catalog) if (wanted.has(name)) entries.push({
+		name,
+		version
+	});
+	return {
+		workspaceFile,
+		entries
+	};
+}
+function findNearestPnpmWorkspaceFile(baseDir) {
+	let dir = baseDir;
+	let prev = "";
+	while (dir !== prev) {
+		const candidate = join(dir, "pnpm-workspace.yaml");
+		if (existsSync(candidate)) return candidate;
+		prev = dir;
+		dir = dirname(dir);
+	}
+	return null;
+}
+/**
+* Returns the entries inside the top-level `catalog:` block as `[name, version]`
+* pairs in document order, or `null` when no `catalog:` block exists.
+*
+* The parser is intentionally minimal: it reads line-by-line, locates the
+* top-level `catalog:` line (no leading whitespace), then collects every
+* subsequent indented line of the form `<key>: <value>` until the next
+* top-level key (or end of file). Quotes around `<key>` and `<value>`
+* are stripped; comments (`#…`) are ignored.
+*/
+function extractCatalogBlock(contents) {
+	const lines = contents.split(/\r?\n/);
+	const startIdx = lines.findIndex((line) => /^catalog\s*:\s*$/.test(line));
+	if (startIdx === -1) return null;
+	const entries = [];
+	for (let i = startIdx + 1; i < lines.length; i++) {
+		const raw = lines[i] ?? "";
+		if (raw.trim() === "" || /^\s*#/.test(raw)) continue;
+		if (!/^\s/.test(raw)) break;
+		const match = raw.match(/^\s+(?:'([^']+)'|"([^"]+)"|([^:\s'"]+))\s*:\s*(.*?)\s*(?:#.*)?$/);
+		if (!match) continue;
+		const name = match[1] ?? match[2] ?? match[3];
+		if (name === void 0) continue;
+		const version = stripQuotes((match[4] ?? "").trim());
+		if (version === "") continue;
+		entries.push([name, version]);
+	}
+	return entries;
+}
+function stripQuotes(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+//#endregion
 //#region src/commands/init/errors.ts
 /**
 * Re-init in non-interactive mode without `--force`. Distinct from the
@@ -190,383 +343,53 @@ function errorInitProbeFailed(options) {
 		fix: "Confirm `DATABASE_URL` points at a reachable server, or drop `--strict-probe` to treat probe failures as warnings.",
 		docsUrl: "https://prisma-next.dev/docs/cli/init",
 		meta: {
-			filesWritten: options.filesWritten,
-			cause: options.cause
-		}
-	});
-}
-/**
-* `prisma-next contract emit` failed after a successful install. Surface
-* the underlying error so the user can fix it and re-run; files and
-* dependencies remain on disk untouched. Maps to exit code
-* `5 = EMIT_FAILED`.
-*/
-function errorInitEmitFailed(options) {
-	return new CliStructuredError("5008", "Failed to emit contract", {
-		domain: "CLI",
-		why: `\`prisma-next contract emit\` failed: ${options.cause}`,
-		fix: `Inspect your contract file, fix the underlying issue, then re-run \`${options.emitCommand}\`. Pass \`-v\` for the full error envelope.`,
-		docsUrl: "https://prisma-next.dev/docs/cli/contract-emit",
-		meta: {
-			filesWritten: options.filesWritten,
-			cause: options.cause
-		}
-	});
-}
-/**
-* The project-level agent-skill install (`npx skills add
-* prisma/prisma-next#v<version>`) failed after a successful dependency
-* install + emit. The project's scaffold remains on disk; the user
-* can either fix the underlying issue (network, registry, PATH) and
-* run the install command manually, or re-run `init --no-skill` to
-* proceed without the skill.
-*
-* Non-rolling-back, matching the existing install/emit failure
-* semantics. Maps to exit code `6 = SKILL_INSTALL_FAILED`.
-*/
-function errorInitSkillInstallFailed(options) {
-	return new CliStructuredError("5013", "Failed to install Prisma Next skills", {
-		domain: "CLI",
-		why: `\`${options.skillInstallCommand}\` exited with an error: ${options.cause}`,
-		fix: `Either:
-  - Re-run \`prisma-next init --no-skill${options.filesWritten.length > 0 ? " --force" : ""}\` to skip the skill install for this run, or\n  - Fix the underlying issue (network, npm registry, \`npx skills\` on PATH) and install manually:\n      ${options.skillInstallCommand}`,
-		docsUrl: "https://prisma-next.dev/docs/cli/init#agent-skill",
-		meta: {
-			filesWritten: options.filesWritten,
-			skillInstallCommand: options.skillInstallCommand,
-			cause: options.cause
-		}
-	});
-}
-//#endregion
-//#region src/commands/init/agent-skill-install.ts
-const exec = promisify(execFile);
-/**
-* Default base for the GitHub-URL form `<owner>/<repo>` consumed by
-* upstream `skills add`. Each `SkillSource` joins this base with its
-* own subpath (and optional `#ref` for version-pinned clusters).
-*/
-const DEFAULT_AGENT_SKILL_BASE = "prisma/prisma-next";
-const DEFAULT_AGENT_SKILL_SOURCES = [
-	{
-		subpath: "skills",
-		ref: "cli",
-		description: "usage skills (version-locked to installed Prisma Next)"
-	},
-	{
-		subpath: "skills/upgrade",
-		ref: null,
-		description: "upgrade skill (always tracks `main`)"
-	},
-	{
-		subpath: "skills/extension-author",
-		ref: null,
-		description: "extension-author skill (always tracks `main`)"
-	}
-];
-/**
-* Test-only escape hatch for pinning the install base to a local
-* checkout. Production runs leave this unset, so installs always use
-* `DEFAULT_AGENT_SKILL_BASE`.
-*
-* When set to an absolute filesystem path (typical for tests), the
-* `#ref` fragment is dropped — local-path mode in upstream's CLI does
-* not accept refs, and the local clone has whatever content the test
-* checked into it anyway. When set to anything else (e.g. a fork name
-* `myuser/prisma-next`), the ref policy is preserved.
-*/
-function resolveAgentSkillBase() {
-	const override = process.env["PRISMA_NEXT_SKILLS_BASE"]?.trim();
-	return override && override.length > 0 ? override : DEFAULT_AGENT_SKILL_BASE;
-}
-function isLocalPath(base) {
-	return base.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(base);
-}
-/**
-* Build the `<base>/<subpath>[#ref]` URL the `skills` CLI will
-* resolve. Exported for unit tests so the per-source format can be
-* asserted without going through the full install loop.
-*/
-function formatSkillSourceUrl(source) {
-	const base = resolveAgentSkillBase();
-	const url = `${base}/${source.subpath}`;
-	if (source.ref === null) return url;
-	if (isLocalPath(base)) return url;
-	if (source.ref === "cli") return `${url}#v${version}`;
-	return url;
-}
-/**
-* The skill-install command for one source, formatted for the
-* project's detected package manager. `npx`/`pnpm dlx`/`bunx` are
-* interchangeable to the user; we pick the variant that matches the
-* rest of the install step so a single project consistently uses one
-* runner.
-*
-* `--all` auto-selects every skill in the cluster and every detected
-* agent runtime, skipping the multi-select prompts the `skills` CLI
-* shows by default. A non-interactive scaffold step cannot present
-* prompts.
-*
-* Exported for unit tests so the per-PM dispatch can be asserted
-* without a live subprocess.
-*/
-function formatSkillInstallCommand(pm, source) {
-	return formatPackageManagerCommand(pm, [
-		"skills@latest",
-		"add",
-		formatSkillSourceUrl(source),
-		"--all"
-	]);
-}
-/**
-* `skills add --all` should cover Claude Code, but upstream currently skips
-* project-local Claude symlinks when `.claude/` does not already exist. Run
-* the explicit Claude Code install as well so fresh projects get
-* `.claude/skills` without asking users to create that folder first.
-*/
-function formatClaudeSkillInstallCommand(pm, source) {
-	return formatPackageManagerCommand(pm, [
-		"skills@latest",
-		"add",
-		formatSkillSourceUrl(source),
-		"--agent",
-		"claude-code",
-		"--skill",
-		"'*'",
-		"-y"
-	]);
-}
-function formatPackageManagerCommand(pm, args) {
-	switch (pm) {
-		case "pnpm": return `pnpm dlx ${args.join(" ")}`;
-		case "yarn": return `yarn dlx ${args.join(" ")}`;
-		case "bun": return `bunx ${args.join(" ")}`;
-		case "deno": return `deno run -A npm:${args.join(" ")}`;
-		case "npm": return `npx ${args.join(" ")}`;
-	}
-}
-/**
-* Parse the project-pm-formatted command into an exec call. The
-* format-then-parse split keeps the user-facing command string the same
-* as the surface the structured error advertises, so a user who copies
-* the error's `fix` line gets the same invocation that init just
-* attempted. Single quotes are preserved in the display form so `*` is
-* safe to copy into a shell, then stripped before `execFile`.
-*/
-function commandToExec(command) {
-	const tokens = (command.match(/'[^']*'|\S+/g) ?? []).map((token) => token.startsWith("'") && token.endsWith("'") ? token.slice(1, -1) : token);
-	return {
-		file: tokens[0] ?? "npx",
-		args: tokens.slice(1)
-	};
-}
-/**
-* Runs the project-level skill install for every source in
-* `DEFAULT_AGENT_SKILL_SOURCES`, in order. Returns
-* `{ ok: true, commands }` on success; throws a structured
-* `errorInitSkillInstallFailed` on the first failure (subsequent
-* sources are not attempted — the user opted into Prisma Next by
-* running `init` and a partial install would leave the project in an
-* ambiguous state). The throw is intentionally fatal — project-level
-* skill install is unconditional (modulo `--no-skill`).
-*/
-async function runProjectLevelSkillInstall(ctx) {
-	const commands = [];
-	const installCommands = DEFAULT_AGENT_SKILL_SOURCES.flatMap((source) => [formatSkillInstallCommand(ctx.pm, source), formatClaudeSkillInstallCommand(ctx.pm, source)]);
-	for (const command of installCommands) {
-		const { file, args } = commandToExec(command);
-		try {
-			await exec(file, args, { cwd: ctx.baseDir });
-			commands.push(command);
-		} catch (err) {
-			throw errorInitSkillInstallFailed({
-				skillInstallCommand: command,
-				filesWritten: ctx.filesWritten,
-				cause: redactSecrets$1(readChildStderr$1(err)) || (err instanceof Error ? err.message : String(err))
-			});
-		}
-	}
-	return {
-		ok: true,
-		commands
-	};
-}
-function readChildStderr$1(err) {
-	if (err instanceof Error && "stderr" in err) return String(err.stderr ?? "");
-	return "";
-}
-/**
-* Strips credentials from a `scheme://user:pass@host/...` URL anywhere
-* in `stderr`. Package-manager stderr regularly contains credentialed
-* registry URLs (private npm registries, GitHub Packages tokens), and
-* those bubble into the structured `errorInitSkillInstallFailed`
-* envelope, which ends up in logs and CI output. Redact at the
-* boundary so we never re-emit a secret.
-*
-* Exported for unit tests.
-*/
-function redactSecrets$1(stderr) {
-	if (!stderr) return stderr;
-	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
-}
-/**
-* Hand-rolled skill stub path that init must not leave behind. Removed
-* on every init run so a project's `.agents/skills/prisma-next/` does
-* not shadow the installed Prisma Next skill cluster.
-*/
-const LEGACY_SKILL_FILE = ".agents/skills/prisma-next/SKILL.md";
-//#endregion
-//#region src/commands/init/detect-package-manager.ts
-const KNOWN = new Set([
-	"pnpm",
-	"npm",
-	"yarn",
-	"bun",
-	"deno"
-]);
-/**
-* Resolves the package manager `init` should drive for `add` / `install`
-* commands. Tries, in order:
-*
-*  1. **`detect()`** — walks up from `cwd` looking for a lockfile, the
-*     `packageManager` field, the `devEngines.packageManager` field, or
-*     install metadata. This is the right answer whenever the user is
-*     anywhere inside an existing project, including a deep workspace
-*     subdirectory.
-*
-*  2. **`getUserAgent()`** — parses `npm_config_user_agent`, the env var
-*     every PM sets when it spawns a script. This catches the
-*     bare-directory case where there's no project to walk up to but the
-*     user invoked us via `pnpm dlx prisma-next init` / `bunx
-*     prisma-next init` / `yarn dlx …`. Same signal used by every
-*     `create-*` tool in the ecosystem (`create-vite`, `create-next-app`,
-*     `create-astro`, `@antfu/ni`, …).
-*
-*  3. **`npm`** — final fallback. Always present alongside Node.
-*/
-async function detectPackageManager(cwd) {
-	const detected = await detect({ cwd });
-	if (detected && KNOWN.has(detected.name)) return detected.name;
-	const userAgent = getUserAgent();
-	if (userAgent !== null && KNOWN.has(userAgent)) return userAgent;
-	return "npm";
-}
-function hasProjectManifest(cwd) {
-	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
-}
-function formatRunCommand(pm, bin, args) {
-	if (pm === "npm") return `npx ${bin} ${args}`;
-	if (pm === "deno") return `deno run npm:${bin} ${args}`;
-	return `${pm} ${bin} ${args}`;
-}
-function formatAddArgs(pm, packages) {
-	if (pm === "deno") return ["add", ...packages.map((p) => `npm:${p}`)];
-	return ["add", ...packages];
-}
-function formatAddDevArgs(pm, packages) {
-	if (pm === "deno") return [
-		"add",
-		"--dev",
-		...packages.map((p) => `npm:${p}`)
-	];
-	return [
-		"add",
-		"-D",
-		...packages
-	];
-}
-//#endregion
-//#region src/commands/init/detect-pnpm-catalog.ts
-/**
-* Walks up from `baseDir` looking for `pnpm-workspace.yaml`, then scans
-* its top-level `catalog:` block for entries that match any of `packages`.
-*
-* Implements FR7.3 / Spec Decision 8 (honour-and-warn): when `init` runs
-* inside a pnpm workspace whose catalog overrides one of the packages it
-* installs, surface a structured warning so the user knows the catalog
-* version (not the published `latest`) is what ended up in their
-* `node_modules`. pnpm itself does this silently; the warning closes the
-* "looks fine, must be wrong version six months later" gap.
-*
-* Notes / scope:
-*
-* - We only inspect the unnamed top-level `catalog:` block. pnpm also
-*   supports `catalogs:` (plural — *named* catalogs referenced via
-*   `catalog:foo` specifiers); those don't apply to a vanilla
-*   `pnpm add prisma-next` invocation, so we skip them.
-* - We don't validate YAML syntax exhaustively. The file format pnpm
-*   ships is line-oriented and well-known; a minimal regex is more
-*   robust than depending on a YAML parser for one warning.
-* - We don't compare against the registry's `latest` — pnpm uses the
-*   catalog version regardless, so the warning fires whenever a match
-*   exists. The user-facing copy explains how to opt out.
-*/
-function detectPnpmCatalogOverrides(baseDir, packages) {
-	const workspaceFile = findNearestPnpmWorkspaceFile(baseDir);
-	if (workspaceFile === null) return null;
-	const catalog = extractCatalogBlock(readFileSync(workspaceFile, "utf-8"));
-	if (catalog === null) return {
-		workspaceFile,
-		entries: []
-	};
-	const wanted = new Set(packages);
-	const entries = [];
-	for (const [name, version] of catalog) if (wanted.has(name)) entries.push({
-		name,
-		version
+			filesWritten: options.filesWritten,
+			cause: options.cause
+		}
 	});
-	return {
-		workspaceFile,
-		entries
-	};
 }
-function findNearestPnpmWorkspaceFile(baseDir) {
-	let dir = baseDir;
-	let prev = "";
-	while (dir !== prev) {
-		const candidate = join(dir, "pnpm-workspace.yaml");
-		if (existsSync(candidate)) return candidate;
-		prev = dir;
-		dir = dirname(dir);
-	}
-	return null;
+/**
+* `prisma-next contract emit` failed after a successful install. Surface
+* the underlying error so the user can fix it and re-run; files and
+* dependencies remain on disk untouched. Maps to exit code
+* `5 = EMIT_FAILED`.
+*/
+function errorInitEmitFailed(options) {
+	return new CliStructuredError("5008", "Failed to emit contract", {
+		domain: "CLI",
+		why: `\`prisma-next contract emit\` failed: ${options.cause}`,
+		fix: `Inspect your contract file, fix the underlying issue, then re-run \`${options.emitCommand}\`. Pass \`-v\` for the full error envelope.`,
+		docsUrl: "https://prisma-next.dev/docs/cli/contract-emit",
+		meta: {
+			filesWritten: options.filesWritten,
+			cause: options.cause
+		}
+	});
 }
 /**
-* Returns the entries inside the top-level `catalog:` block as `[name, version]`
-* pairs in document order, or `null` when no `catalog:` block exists.
+* The project-level skills install (`npx skills add
+* prisma/prisma-next#v<version>`) failed after a successful dependency
+* install + emit. The project's scaffold remains on disk; the user
+* can either fix the underlying issue (network, registry, PATH) and
+* run the install command manually, or re-run `init --no-skill` to
+* proceed without the skill.
 *
-* The parser is intentionally minimal: it reads line-by-line, locates the
-* top-level `catalog:` line (no leading whitespace), then collects every
-* subsequent indented line of the form `<key>: <value>` until the next
-* top-level key (or end of file). Quotes around `<key>` and `<value>`
-* are stripped; comments (`#…`) are ignored.
+* Non-rolling-back, matching the existing install/emit failure
+* semantics. Maps to exit code `6 = SKILL_INSTALL_FAILED`.
 */
-function extractCatalogBlock(contents) {
-	const lines = contents.split(/\r?\n/);
-	const startIdx = lines.findIndex((line) => /^catalog\s*:\s*$/.test(line));
-	if (startIdx === -1) return null;
-	const entries = [];
-	for (let i = startIdx + 1; i < lines.length; i++) {
-		const raw = lines[i] ?? "";
-		if (raw.trim() === "" || /^\s*#/.test(raw)) continue;
-		if (!/^\s/.test(raw)) break;
-		const match = raw.match(/^\s+(?:'([^']+)'|"([^"]+)"|([^:\s'"]+))\s*:\s*(.*?)\s*(?:#.*)?$/);
-		if (!match) continue;
-		const name = match[1] ?? match[2] ?? match[3];
-		if (name === void 0) continue;
-		const version = stripQuotes((match[4] ?? "").trim());
-		if (version === "") continue;
-		entries.push([name, version]);
-	}
-	return entries;
-}
-function stripQuotes(value) {
-	if (value.length >= 2) {
-		const first = value[0];
-		const last = value[value.length - 1];
-		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
-	}
-	return value;
+function errorInitSkillInstallFailed(options) {
+	return new CliStructuredError("5013", "Failed to install Prisma Next skills", {
+		domain: "CLI",
+		why: `\`${options.skillInstallCommand}\` exited with an error: ${options.cause}`,
+		fix: `Either:
+  - Re-run \`prisma-next init --no-skill${options.filesWritten.length > 0 ? " --force" : ""}\` to skip the skill install for this run, or\n  - Fix the underlying issue (network, npm registry, \`npx skills\` on PATH) and install manually:\n      ${options.skillInstallCommand}`,
+		docsUrl: "https://prisma-next.dev/docs/cli/init#skills",
+		meta: {
+			filesWritten: options.filesWritten,
+			skillInstallCommand: options.skillInstallCommand,
+			cause: options.cause
+		}
+	});
 }
 //#endregion
 //#region src/commands/init/hygiene-gitattributes.ts
@@ -1519,6 +1342,183 @@ function removeDependency(existing, depName) {
 	return `${JSON.stringify(parsed, null, 2)}${trailingNewline}`;
 }
 //#endregion
+//#region src/commands/init/skill-install.ts
+const exec = promisify(execFile);
+/**
+* Default base for the GitHub-URL form `<owner>/<repo>` consumed by
+* upstream `skills add`. Each `SkillSource` joins this base with its
+* own subpath (and optional `#ref` for version-pinned clusters).
+*/
+const DEFAULT_SKILL_BASE = "prisma/prisma-next";
+const DEFAULT_SKILL_SOURCES = [
+	{
+		subpath: "skills",
+		ref: "cli",
+		description: "usage skills (version-locked to installed Prisma Next)"
+	},
+	{
+		subpath: "skills/upgrade",
+		ref: null,
+		description: "upgrade skill (always tracks `main`)"
+	},
+	{
+		subpath: "skills/extension-author",
+		ref: null,
+		description: "extension-author skill (always tracks `main`)"
+	}
+];
+/**
+* Test-only escape hatch for pinning the install base to a local
+* checkout. Production runs leave this unset, so installs always use
+* `DEFAULT_SKILL_BASE`.
+*
+* When set to an absolute filesystem path (typical for tests), the
+* `#ref` fragment is dropped — local-path mode in upstream's CLI does
+* not accept refs, and the local clone has whatever content the test
+* checked into it anyway. When set to anything else (e.g. a fork name
+* `myuser/prisma-next`), the ref policy is preserved.
+*/
+function resolveAgentSkillBase() {
+	const override = process.env["PRISMA_NEXT_SKILLS_BASE"]?.trim();
+	return override && override.length > 0 ? override : DEFAULT_SKILL_BASE;
+}
+function isLocalPath(base) {
+	return base.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(base);
+}
+/**
+* Build the `<base>/<subpath>[#ref]` URL the `skills` CLI will
+* resolve. Exported for unit tests so the per-source format can be
+* asserted without going through the full install loop.
+*/
+function formatSkillSourceUrl(source) {
+	const base = resolveAgentSkillBase();
+	const url = `${base}/${source.subpath}`;
+	if (source.ref === null) return url;
+	if (isLocalPath(base)) return url;
+	if (source.ref === "cli") return `${url}#v${version}`;
+	return url;
+}
+/**
+* The skill-install command for one source, formatted for the
+* project's detected package manager. `npx`/`pnpm dlx`/`bunx` are
+* interchangeable to the user; we pick the variant that matches the
+* rest of the install step so a single project consistently uses one
+* runner.
+*
+* `--all` auto-selects every skill in the cluster and every detected
+* agent runtime, skipping the multi-select prompts the `skills` CLI
+* shows by default. A non-interactive scaffold step cannot present
+* prompts.
+*
+* Exported for unit tests so the per-PM dispatch can be asserted
+* without a live subprocess.
+*/
+function formatSkillInstallCommand(pm, source) {
+	return formatPackageManagerCommand(pm, [
+		"skills@latest",
+		"add",
+		formatSkillSourceUrl(source),
+		"--all"
+	]);
+}
+/**
+* `skills add --all` should cover Claude Code, but upstream currently skips
+* project-local Claude symlinks when `.claude/` does not already exist. Run
+* the explicit Claude Code install as well so fresh projects get
+* `.claude/skills` without asking users to create that folder first.
+*/
+function formatClaudeSkillInstallCommand(pm, source) {
+	return formatPackageManagerCommand(pm, [
+		"skills@latest",
+		"add",
+		formatSkillSourceUrl(source),
+		"--agent",
+		"claude-code",
+		"--skill",
+		"'*'",
+		"-y"
+	]);
+}
+function formatPackageManagerCommand(pm, args) {
+	switch (pm) {
+		case "pnpm": return `pnpm dlx ${args.join(" ")}`;
+		case "yarn": return `yarn dlx ${args.join(" ")}`;
+		case "bun": return `bunx ${args.join(" ")}`;
+		case "deno": return `deno run -A npm:${args.join(" ")}`;
+		case "npm": return `npx ${args.join(" ")}`;
+	}
+}
+/**
+* Parse the project-pm-formatted command into an exec call. The
+* format-then-parse split keeps the user-facing command string the same
+* as the surface the structured error advertises, so a user who copies
+* the error's `fix` line gets the same invocation that init just
+* attempted. Single quotes are preserved in the display form so `*` is
+* safe to copy into a shell, then stripped before `execFile`.
+*/
+function commandToExec(command) {
+	const tokens = (command.match(/'[^']*'|\S+/g) ?? []).map((token) => token.startsWith("'") && token.endsWith("'") ? token.slice(1, -1) : token);
+	return {
+		file: tokens[0] ?? "npx",
+		args: tokens.slice(1)
+	};
+}
+/**
+* Runs the project-level skill install for every source in
+* `DEFAULT_SKILL_SOURCES`, in order. Returns
+* `{ ok: true, commands }` on success; throws a structured
+* `errorInitSkillInstallFailed` on the first failure (subsequent
+* sources are not attempted — the user opted into Prisma Next by
+* running `init` and a partial install would leave the project in an
+* ambiguous state). The throw is intentionally fatal — project-level
+* skill install is unconditional (modulo `--no-skill`).
+*/
+async function runProjectLevelSkillInstall(ctx) {
+	const commands = [];
+	const installCommands = DEFAULT_SKILL_SOURCES.flatMap((source) => [formatSkillInstallCommand(ctx.pm, source), formatClaudeSkillInstallCommand(ctx.pm, source)]);
+	for (const command of installCommands) {
+		const { file, args } = commandToExec(command);
+		try {
+			await exec(file, args, { cwd: ctx.baseDir });
+			commands.push(command);
+		} catch (err) {
+			throw errorInitSkillInstallFailed({
+				skillInstallCommand: command,
+				filesWritten: ctx.filesWritten,
+				cause: redactSecrets$1(readChildStderr$1(err)) || (err instanceof Error ? err.message : String(err))
+			});
+		}
+	}
+	return {
+		ok: true,
+		commands
+	};
+}
+function readChildStderr$1(err) {
+	if (err instanceof Error && "stderr" in err) return String(err.stderr ?? "");
+	return "";
+}
+/**
+* Strips credentials from a `scheme://user:pass@host/...` URL anywhere
+* in `stderr`. Package-manager stderr regularly contains credentialed
+* registry URLs (private npm registries, GitHub Packages tokens), and
+* those bubble into the structured `errorInitSkillInstallFailed`
+* envelope, which ends up in logs and CI output. Redact at the
+* boundary so we never re-emit a secret.
+*
+* Exported for unit tests.
+*/
+function redactSecrets$1(stderr) {
+	if (!stderr) return stderr;
+	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
+}
+/**
+* Hand-rolled skill stub path that init must not leave behind. Removed
+* on every init run so a project's `.agents/skills/prisma-next/` does
+* not shadow the installed Prisma Next skill cluster.
+*/
+const LEGACY_SKILL_FILE = ".agents/skills/prisma-next/SKILL.md";
+//#endregion
 //#region src/commands/init/templates/env.ts
 /**
 * The minimum supported server version for each target (FR8.1). The
@@ -1790,7 +1790,7 @@ function mergeTypesArray(existing) {
 * structured CLI errors raised at every phase (input resolution, install,
 * emit) and renders them via the same UI surface as success output
 * (`--json` to stdout, human to stderr). Exit codes follow the documented
-* stable set in `./exit-codes.ts` (FR1.6) and the
+* stable set in `./exit-codes.ts` and the
 * [Style Guide § Exit Codes](../../../../../../../docs/CLI%20Style%20Guide.md#exit-codes).
 *
 * Layered for testability: the action handler in `./index.ts` is
@@ -1991,10 +1991,10 @@ async function runInit(baseDir, runOptions) {
 			filesWritten
 		}));
 	}
-	const manualProjectSkillSummary = DEFAULT_AGENT_SKILL_SOURCES.flatMap((source) => [formatSkillInstallCommand(install.effectivePm, source), formatClaudeSkillInstallCommand(install.effectivePm, source)]).map((c) => `\`${c}\``).join(" && ");
+	const manualProjectSkillSummary = DEFAULT_SKILL_SOURCES.flatMap((source) => [formatSkillInstallCommand(install.effectivePm, source), formatClaudeSkillInstallCommand(install.effectivePm, source)]).map((c) => `\`${c}\``).join(" && ");
 	let skillRegistered = false;
-	if (!inputs.installProjectSkill) warnings.push(`Skipped Prisma Next agent-skill install (--no-skill). To install the skills later, run: ${manualProjectSkillSummary}`);
-	else if (install.skipped) warnings.push(`Skipped Prisma Next agent-skill install because --no-install was passed. After you run install manually, install the skills with: ${manualProjectSkillSummary}`);
+	if (!inputs.installProjectSkill) warnings.push(`Skipped Prisma Next skills install (--no-skill). To install the skills later, run: ${manualProjectSkillSummary}`);
+	else if (install.skipped) warnings.push(`Skipped Prisma Next skills install because --no-install was passed. After you run install manually, install the skills with: ${manualProjectSkillSummary}`);
 	else {
 		const spinner = ui.spinner();
 		spinner.start("Registering Prisma Next skills with the agent runtime...");
@@ -2360,4 +2360,4 @@ function sanitisePackageName(raw) {
 //#endregion
 export { runInit };
 
-//# sourceMappingURL=init-DBRWZlFU.mjs.map
+//# sourceMappingURL=init-BHbEOgNr.mjs.map