@prisma/cli 8.0.0-rc.8 → 8.0.0-rc.8-dev.72

package/dist/cli.js

@@ -1,841 +1,148 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineConfigSection, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
 import { createComposerFamily } from "@prisma/composer-cli/family";
 import { ormCommandFamily } from "@prisma/orm-toolchain/cli";
 import { CliStructuredError, notOk, ok } from "@prisma/cli-engine/protocol";
-import { fstatSync, readFileSync, statSync } from "node:fs";
-import path from "node:path";
-import { execa } from "execa";
-import fs, { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
 import { AuthError, createManagementApiClient, createManagementApiSdk } from "@prisma/management-api-sdk";
 import os from "node:os";
+import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
+import fs, { mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { CredentialsStore } from "@prisma/credentials-store";
 import events from "node:events";
 import http from "node:http";
 import readline from "node:readline/promises";
 import open from "open";
+import { existsSync, fstatSync, readFileSync, statSync } from "node:fs";
+import { PnpmTool, YarnTool } from "@manypkg/tools";
 import { Result, TaggedError, UnhandledException, matchError } from "better-result";
 import { execFile, fork, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { ApiError, CancelledError, ComputeClient, streamLogs } from "@prisma/compute-sdk";
 import { parse } from "dotenv";
 import { fileURLToPath } from "node:url";
+import { execa } from "execa";
 import { Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 //#region src/cli-name.ts
 /**
-* The CLI's user-facing identity, in one place. The npm package is
-* "@prisma/cli" but the binary on PATH is "prisma-cli" (the S1
-* convention) — every user-facing command string and notice consumes
-* this constant rather than restating the name.
+* The CLI's user-facing identity, in one place: the binary on PATH is
+* `prisma`, published by the `prisma` package, and every user-facing
+* command string and notice consumes this constant rather than
+* restating the name. The `@prisma/cli` package installs the same shell
+* under the name `prisma-cli`; what a user is told to type is the
+* unified binary's name.
 */
-const CLI_NAME = "prisma-cli";
+const CLI_NAME = "prisma";
 /** The CLI docs page (also the update-check fallback instruction URL).
 *  The old /docs/orm/tools/prisma-cli path 308-redirects to the ORM CLI
 *  reference — the wrong docs for the unified CLI — so this points at
 *  the docs root until the unified CLI has its own page. */
 const CLI_DOCS_URL = "https://www.prisma.io/docs";
-const PRISMA_CLI_PACKAGE_SPEC = `@prisma/cli@next`;
-const DEFAULT_PRISMA_CLI_PACKAGE_RUNNER = ["npx", "-y"];
-const PRISMA_CLI_BINARY = "prisma-cli";
-function formatPrismaCliCommand(args, options = {}) {
-	return [...getPrismaCliCommandPrefix(options), ...args].join(" ");
-}
-function getPrismaCliCommandPrefix({ invocation = "package", packageRunner = DEFAULT_PRISMA_CLI_PACKAGE_RUNNER }) {
-	if (invocation === "binary") return [PRISMA_CLI_BINARY];
-	return [...packageRunner, PRISMA_CLI_PACKAGE_SPEC];
-}
 //#endregion
-//#region src/lib/agent/package-manager.ts
-const LOCKFILE_PACKAGE_MANAGERS = [
-	{
-		packageManager: "bun",
-		fileNames: ["bun.lock", "bun.lockb"]
-	},
-	{
-		packageManager: "pnpm",
-		fileNames: ["pnpm-lock.yaml", "pnpm-workspace.yaml"]
-	},
-	{
-		packageManager: "yarn",
-		fileNames: ["yarn.lock"]
-	},
-	{
-		packageManager: "npm",
-		fileNames: ["package-lock.json", "npm-shrinkwrap.json"]
-	}
-];
-async function resolveSkillsPackageRunner(options) {
-	return resolvePackageRunner(options);
-}
-async function resolvePackageRunner(options) {
-	options.signal.throwIfAborted();
-	const packageManager = detectPackageManagerSync(options.cwd, options.signal) ?? "npm";
-	options.signal.throwIfAborted();
-	return packageRunnerForPackageManager(packageManager);
-}
-function detectPackageManagerSync(cwd, signal) {
-	let directory = path.resolve(cwd);
-	while (true) {
-		signal?.throwIfAborted();
-		const packageJsonManager = readPackageJsonPackageManager(directory);
-		if (packageJsonManager) return packageJsonManager;
-		const lockfileManager = readLockfilePackageManager(directory, signal);
-		if (lockfileManager) return lockfileManager;
-		const parent = path.dirname(directory);
-		if (parent === directory) return null;
-		directory = parent;
-	}
-}
-function readPackageJsonPackageManager(directory) {
-	const packageJsonPath = path.join(directory, "package.json");
-	let content;
-	try {
-		content = readFileSync(packageJsonPath, "utf8");
-	} catch (error) {
-		if (isMissingFileError(error)) return null;
-		throw error;
-	}
-	try {
-		return parsePackageManager(JSON.parse(content).packageManager);
-	} catch {
-		return null;
-	}
-}
-function readLockfilePackageManager(directory, signal) {
-	for (const candidate of LOCKFILE_PACKAGE_MANAGERS) for (const fileName of candidate.fileNames) {
-		signal?.throwIfAborted();
-		if (fileExists(path.join(directory, fileName))) return candidate.packageManager;
-	}
-	return null;
+//#region src/auth/client.ts
+const CLIENT_ID = "cmm3lndn701oo0uefvxzo0ivw";
+const AUTH_FILE_ENV_VAR = "PRISMA_COMPUTE_AUTH_FILE";
+/**
+* The redirect the OAuth client is registered with. `performLogin`
+* replaces it with its own ephemeral callback server's port; the
+* refreshing client never reads it.
+*/
+const DEFAULT_REDIRECT_URI = "http://localhost/auth/callback";
+function getApiBaseUrl(env = process.env) {
+	return env.PRISMA_MANAGEMENT_API_URL?.trim() || "https://api.prisma.io";
 }
-function fileExists(filePath) {
-	try {
-		return statSync(filePath).isFile();
-	} catch (error) {
-		if (isMissingFileError(error)) return false;
-		throw error;
-	}
+function getAuthBaseUrl(env = process.env) {
+	return env.PRISMA_AUTH_BASE_URL?.trim() || "https://auth.prisma.io";
 }
-function parsePackageManager(value) {
-	if (typeof value !== "string") return null;
-	const normalized = value.trim().toLowerCase();
-	if (normalized === "bun" || normalized.startsWith("bun@")) return "bun";
-	if (normalized === "pnpm" || normalized.startsWith("pnpm@")) return "pnpm";
-	if (normalized === "yarn" || normalized.startsWith("yarn@")) return "yarn";
-	if (normalized === "npm" || normalized.startsWith("npm@")) return "npm";
-	return null;
+function getAuthFilePath(env = process.env) {
+	const configured = env[AUTH_FILE_ENV_VAR];
+	if (configured?.trim()) return path.resolve(configured);
+	return defaultAuthFilePath(env);
 }
-function packageRunnerForPackageManager(packageManager) {
-	switch (packageManager) {
-		case "bun": return ["bunx"];
-		case "pnpm": return ["pnpm", "dlx"];
-		case "yarn": return ["yarn", "dlx"];
-		case "npm": return ["npx", "-y"];
+function defaultAuthFilePath(env = process.env) {
+	if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", "prisma", "auth.json");
+	if (process.platform === "win32") {
+		const appData = env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
+		return path.join(appData, "prisma", "auth.json");
 	}
-}
-function isMissingFileError(error) {
-	const code = error.code;
-	return code === "ENOENT" || code === "ENOTDIR";
+	const xdgConfigHome = env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config");
+	return path.join(xdgConfigHome, "prisma", "auth.json");
 }
 //#endregion
-//#region src/lib/agent/cli-command.ts
-async function resolvePrismaCliPackageCommandFormatter(options) {
-	return createPrismaCliPackageCommandFormatter(await resolvePackageRunner(options));
-}
-async function resolvePrismaCliPackageCommand(options) {
-	return (await resolvePrismaCliPackageCommandFormatter(options))(options.args);
+//#region src/lib/workspace-id.ts
+/**
+* A workspace reaches the CLI under two ids for the same workspace: a
+* credential's `workspace_id` claim carries the bare id, while the
+* management API and anything derived from it carry the same id behind
+* a `wksp_` prefix. Comparing the two forms directly silently matches
+* nothing, so every comparison between workspace ids of different
+* origin goes through here.
+*/
+const WORKSPACE_ID_PREFIX = "wksp_";
+function stripWorkspacePrefix(value) {
+	return value.startsWith(WORKSPACE_ID_PREFIX) ? value.slice(5) : value;
 }
-function createPrismaCliPackageCommandFormatter(packageRunner) {
-	return (args) => formatPrismaCliCommand(args, { packageRunner });
+function sameWorkspaceId(left, right) {
+	return stripWorkspacePrefix(left) === stripWorkspacePrefix(right);
 }
 //#endregion
-//#region src/lib/agent/constants.ts
-const PRISMA_SKILLS_SOURCE = "prisma/skills";
-const PRISMA_SKILLS_LOCK_FILENAME = "skills-lock.json";
-const SKILLS_CLI_PACKAGE = "skills@latest";
-const DEFAULT_PRISMA_AGENT_SKILLS = ["*"];
-const DEFAULT_PRISMA_AGENT_TARGETS = ["codex", "claude-code"];
-const PRISMA_AGENT_INSTALL_ARGS = ["agent", "install"];
-const PRISMA_AGENT_STATUS_ARGS = ["agent", "status"];
-//#endregion
-//#region src/shell-command.ts
-/** A word a shell needs no quoting for. */
-const SHELL_SAFE_WORD = /^[A-Za-z0-9_./:@=-]+$/;
-const SINGLE_QUOTE = /'/g;
-/** Renders a command as a line a user can paste into a shell, quoting
-*  any word that needs it. */
-function formatShellCommand(command) {
-	return command.map(formatShellCommandWord).join(" ");
-}
-function formatShellCommandWord(value) {
-	return SHELL_SAFE_WORD.test(value) ? value : `'${value.replace(SINGLE_QUOTE, "'\\''")}'`;
+//#region src/auth/token-storage.ts
+const REFRESH_LOCK_RETRY_MS$1 = 100;
+const REFRESH_LOCK_STALE_MS$1 = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS$1 = 25e3;
+const EMPTY_AUTH_CONTEXT = {
+	activeWorkspaceId: null,
+	workspaces: {}
+};
+const UNKNOWN_WORKSPACE_NAME = "Unknown workspace";
+function getAuthContextFilePath(authFilePath) {
+	const extension = path.extname(authFilePath);
+	if (!extension) return `${authFilePath}.context.json`;
+	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
 }
-//#endregion
-//#region src/commands/agent/presentation.ts
-function fields$1(rows) {
-	return {
-		kind: "fields",
-		rows
-	};
+function findLatestValidTokens(allCredentials) {
+	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
+		const credential = allCredentials[i];
+		if (!credential) continue;
+		if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) continue;
+		return {
+			workspaceId: credential.workspaceId,
+			accessToken: credential.token,
+			refreshToken: credential.refreshToken
+		};
+	}
+	return null;
 }
-function title$1(text) {
+function storedCredentialToTokens(credential) {
+	if (!credential) return null;
+	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
 	return {
-		kind: "summary",
-		status: "info",
-		text
+		workspaceId: credential.workspaceId,
+		accessToken: credential.token,
+		refreshToken: credential.refreshToken
 	};
 }
-function operationSummary(result) {
-	if (result.skills.status === "would-install") return "Would install";
-	return result.operation === "update" ? "Updated" : "Installed";
-}
-function statusSourceValue(result) {
-	if (result.statusSource === "skills-cli") return result.statusScope === "global" ? "skills list -g --json" : "skills list --json";
-	if (result.statusSource === "skills-lock") return result.skillsLockPath;
-	return "unavailable";
-}
-function setupPromptValue(result) {
-	if (result.skillsInstalled) return "not needed";
-	if (result.promptDismissedAt) return `dismissed ${result.promptDismissedAt}`;
-	return "active";
-}
-function projectStatusRows(result) {
-	if (result.statusScope !== "project") return [];
-	return [
-		{
-			label: "skills lock",
-			value: result.skillsLockInstalled ? "installed" : "not found"
-		},
-		{
-			label: "skills lock path",
-			value: result.skillsLockPath
-		},
-		{
-			label: "setup prompt",
-			value: setupPromptValue(result)
-		}
-	];
-}
-function installPresentations(result, statusCommand) {
-	return {
-		stdout: () => [],
-		json: () => result,
-		human: () => [{
-			kind: "summary",
-			status: result.skills.status === "installed" ? "ok" : "info",
-			text: `${operationSummary(result)} Prisma skills.`
-		}, fields$1([{
-			label: "skills",
-			value: result.skills.status.replace("-", " ")
-		}, {
-			label: "command",
-			value: formatShellCommand(result.skills.command)
-		}])],
-		next: () => statusCommand === null ? [] : [{
-			kind: "run-command",
-			label: "Verify the installed Prisma skills",
-			command: statusCommand
-		}]
-	};
+function findTokensForWorkspace(allCredentials, workspaceId) {
+	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
 }
-function statusPresentations(result, installCommand) {
-	return {
-		stdout: () => [],
-		json: () => result,
-		human: () => [
-			title$1(`Checking ${result.statusScope} Prisma skills.`),
-			fields$1([
-				{
-					label: "skills",
-					value: result.skillsInstalled ? "installed" : "not found"
-				},
-				{
-					label: "source",
-					value: statusSourceValue(result)
-				},
-				{
-					label: "command",
-					value: formatShellCommand(result.skillsListCommand)
-				},
-				...projectStatusRows(result)
-			]),
-			result.skills.length === 0 ? {
-				kind: "summary",
-				status: "info",
-				text: "No Prisma skills reported."
-			} : {
-				kind: "table",
-				columns: [
-					"skill",
-					"scope",
-					"agents"
-				],
-				rows: result.skills.map((skill) => [
-					skill.name,
-					skill.scope,
-					skill.agents.length > 0 ? skill.agents.join(", ") : "no agents reported"
-				])
-			}
-		],
-		next: () => installCommand === null ? [] : [{
-			kind: "run-command",
-			label: "Install or refresh Prisma skills",
-			command: installCommand
-		}]
-	};
+function tokensEqual(a, b) {
+	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
-//#endregion
-//#region src/commands/agent/errors.ts
-/**
-* The installer's own command line is the next action: legacy carried it
-* as the error's single nextStep with the fix "Run the command below to
-* retry the installer directly."
-*/
-function skillsInstallFailedError(options) {
-	return new CliStructuredError("AGENT.SKILLS_INSTALL_FAILED", "Prisma skills install failed", {
-		why: `The skills installer exited with code ${options.exitCode ?? "unknown"}.`,
-		nextActions: [{
-			kind: "run-command",
-			label: "Retry the installer directly",
-			command: formatShellCommand(options.command)
-		}],
-		cause: options.cause
-	});
-}
-//#endregion
-//#region src/commands/agent/skills-cli.ts
-async function buildSkillsInstallCommand(ctx, inputs, cwd) {
-	const command = [
-		...await resolveSkillsPackageRunner({
-			cwd,
-			signal: ctx.signal
-		}),
-		SKILLS_CLI_PACKAGE,
-		"add",
-		PRISMA_SKILLS_SOURCE
-	];
-	const skills = inputs.skill && inputs.skill.length > 0 ? inputs.skill : DEFAULT_PRISMA_AGENT_SKILLS;
-	for (const skill of skills) command.push("--skill", skill);
-	for (const agent of resolveTargetAgents(inputs)) command.push("--agent", agent);
-	if (inputs.global) command.push("--global");
-	if (inputs.copy || ctx.host.platform === "win32") command.push("--copy");
-	command.push("--yes");
-	return command;
-}
-function resolveTargetAgents(inputs) {
-	if (inputs.allAgents) return ["*"];
-	if (inputs.agent && inputs.agent.length > 0) return inputs.agent;
-	return DEFAULT_PRISMA_AGENT_TARGETS;
-}
-async function runSkillsInstall(ctx, command, cwd) {
-	const [executable, args] = splitCommand(command);
-	try {
-		await execa(executable, args, {
-			cwd,
-			env: ctx.env,
-			cancelSignal: ctx.signal,
-			stdin: "ignore"
-		});
-	} catch (error) {
-		if (isAbortError$1(error)) throw error;
-		throw skillsInstallFailedError({
-			command,
-			exitCode: exitCodeFromError(error),
-			cause: error
-		});
-	}
-}
-async function listInstalledPrismaSkills(ctx, cwd, scope) {
-	const command = [
-		...await resolveSkillsPackageRunner({
-			cwd,
-			signal: ctx.signal
-		}),
-		SKILLS_CLI_PACKAGE,
-		"list",
-		...scope === "global" ? ["-g"] : [],
-		"--json"
-	];
-	const [executable, args] = splitCommand(command);
-	try {
-		const { stdout } = await execa(executable, args, {
-			cwd,
-			env: ctx.env,
-			cancelSignal: ctx.signal,
-			stdin: "ignore"
-		});
-		return {
-			status: "ok",
-			command,
-			skills: parseSkillsListOutput(stdout ?? "").filter((skill) => isPrismaSkillName(skill.name))
-		};
-	} catch (error) {
-		if (isAbortError$1(error) || ctx.signal.aborted) throw error;
-		return {
-			status: "failed",
-			command,
-			message: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-function splitCommand(command) {
-	const [executable, ...args] = command;
-	if (!executable) throw new Error("Cannot run an empty command.");
-	return [executable, args];
-}
-function isAbortError$1(error) {
-	return error instanceof Error && error.name === "AbortError" || isObject(error) && error.isCanceled === true;
-}
-function exitCodeFromError(error) {
-	if (!isObject(error) || typeof error.exitCode !== "number") return null;
-	return error.exitCode;
-}
-function isObject(value) {
-	return typeof value === "object" && value !== null;
-}
-function parseSkillsListOutput(output) {
-	const parsed = JSON.parse(output);
-	if (!Array.isArray(parsed)) throw new Error("skills list did not return a JSON array");
-	return parsed.flatMap((item) => {
-		const skill = parseInstalledSkill(item);
-		return skill ? [skill] : [];
-	});
-}
-function parseInstalledSkill(value) {
-	if (!isObject(value)) return null;
-	if (typeof value.name !== "string" || typeof value.path !== "string" || typeof value.scope !== "string" || !Array.isArray(value.agents)) return null;
-	return {
-		name: value.name,
-		path: value.path,
-		scope: value.scope,
-		agents: value.agents.filter((agent) => typeof agent === "string")
-	};
-}
-function isPrismaSkillName(name) {
-	return name === "prisma" || name.startsWith("prisma-");
-}
-//#endregion
-//#region src/commands/agent/install.ts
-/** `agent install` and `agent update` are one operation with two names,
-*  as in the legacy shell: same flags, same flow, different reported
-*  operation. */
-const agentInstallFlags = {
-	agent: flag.repeated({
-		brief: "Agent target for Prisma skills; repeat for multiple agents",
-		placeholder: "agent"
-	}),
-	allAgents: flag.boolean({ brief: "Install Prisma skills for every agent supported by the skills CLI" }),
-	skill: flag.repeated({
-		brief: "Prisma skill to install; repeat for multiple skills",
-		placeholder: "skill"
-	}),
-	global: flag.boolean({ brief: "Install skills into the user directory instead of the project" }),
-	copy: flag.boolean({ brief: "Ask the skills CLI to copy files instead of symlinking them (always on Windows)" }),
-	dryRun: flag.boolean({ brief: "Show the installer command without running it" })
-};
-async function runAgentSkillsInstall(flags, ctx, operation) {
-	const command = await buildSkillsInstallCommand(ctx, {
-		agent: flags.agent ?? [],
-		skill: flags.skill ?? [],
-		allAgents: flags.allAgents,
-		copy: flags.copy,
-		global: flags.global
-	}, ctx.cwd);
-	if (!flags.dryRun) await runSkillsInstall(ctx, command, ctx.cwd);
-	const result = {
-		operation,
-		skills: {
-			status: flags.dryRun ? "would-install" : "installed",
-			command
-		}
-	};
-	const statusCommand = flags.dryRun ? null : await resolvePrismaCliPackageCommand({
-		cwd: ctx.cwd,
-		signal: ctx.signal,
-		args: flags.global ? [...PRISMA_AGENT_STATUS_ARGS, "--global"] : PRISMA_AGENT_STATUS_ARGS
-	});
-	return ok(ctx.present({ data: result }, installPresentations(result, statusCommand)));
-}
-const agentInstallCommand = defineCommand({
-	help: {
-		summary: "Install Prisma skills for AI coding agents",
-		examples: [
-			"agent install",
-			"agent install --agent codex",
-			"agent install --all-agents",
-			"agent install --skill prisma-compute"
-		]
-	},
-	args: { flags: agentInstallFlags },
-	handler: async (args, ctx) => runAgentSkillsInstall(args.flags, ctx, "install")
-});
-//#endregion
-//#region src/adapters/local-state.ts
-const DEFAULT_STATE = {
-	auth: null,
-	project: {
-		rememberedByWorkspace: {},
-		lastResolved: null,
-		repositoryConnectionsByProject: {}
-	},
-	branch: { active: "preview" },
-	agent: { setupPromptDismissedAt: null }
-};
-const DEFAULT_STATE_FILE_NAME = "state.json";
-function resolveLocalStateFilePath(stateDir) {
-	return path.join(stateDir, DEFAULT_STATE_FILE_NAME);
-}
-var LocalStateStore = class {
-	stateFilePath;
-	constructor(stateDir, signal) {
-		this.signal = signal;
-		this.stateFilePath = resolveLocalStateFilePath(stateDir);
-	}
-	async read() {
-		this.signal?.throwIfAborted();
-		try {
-			const raw = await readFile(this.stateFilePath, {
-				encoding: "utf8",
-				signal: this.signal
-			});
-			const parsed = JSON.parse(raw);
-			return {
-				auth: parsed.auth ?? structuredClone(DEFAULT_STATE.auth),
-				project: {
-					rememberedByWorkspace: parsed.project?.rememberedByWorkspace ?? {},
-					lastResolved: parsed.project?.lastResolved ?? null,
-					repositoryConnectionsByProject: parsed.project?.repositoryConnectionsByProject ?? {}
-				},
-				branch: { active: parsed.branch?.active ?? DEFAULT_STATE.branch.active },
-				agent: { setupPromptDismissedAt: parsed.agent?.setupPromptDismissedAt ?? null }
-			};
-		} catch (error) {
-			if (error.code === "ENOENT") return structuredClone(DEFAULT_STATE);
-			throw error;
-		}
-	}
-	async write(state) {
-		this.signal?.throwIfAborted();
-		await mkdir(path.dirname(this.stateFilePath), { recursive: true });
-		this.signal?.throwIfAborted();
-		await writeFile(this.stateFilePath, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8" });
-		this.signal?.throwIfAborted();
-	}
-	async setAuthSession(session) {
-		const state = await this.read();
-		state.auth = session;
-		await this.write(state);
-		return state;
-	}
-	async clearAuthSession() {
-		const state = await this.read();
-		state.auth = null;
-		await this.write(state);
-		return state;
-	}
-	async setActiveBranch(active) {
-		const state = await this.read();
-		state.branch.active = active;
-		await this.write(state);
-		return state;
-	}
-	async readRememberedProject(workspaceId) {
-		return (await this.read()).project.rememberedByWorkspace[workspaceId] ?? null;
-	}
-	async readLastResolvedProject() {
-		return (await this.read()).project.lastResolved;
-	}
-	async setRememberedProject(project) {
-		const state = await this.read();
-		state.project.rememberedByWorkspace[project.workspaceId] = project;
-		state.project.lastResolved = project;
-		await this.write(state);
-		return state;
-	}
-	async readRepositoryConnection(projectId) {
-		return (await this.read()).project.repositoryConnectionsByProject[projectId] ?? null;
-	}
-	async setRepositoryConnection(projectId, connection) {
-		const state = await this.read();
-		state.project.repositoryConnectionsByProject[projectId] = connection;
-		await this.write(state);
-		return state;
-	}
-	async clearRepositoryConnection(projectId) {
-		const state = await this.read();
-		delete state.project.repositoryConnectionsByProject[projectId];
-		await this.write(state);
-		return state;
-	}
-	async readAgentSetupPromptDismissedAt() {
-		return (await this.read()).agent.setupPromptDismissedAt;
-	}
-	async setAgentSetupPromptDismissedAt(dismissedAt) {
-		const state = await this.read();
-		state.agent.setupPromptDismissedAt = dismissedAt;
-		await this.write(state);
-		return state;
-	}
-};
-//#endregion
-//#region src/lib/agent/setup-status.ts
-async function readPrismaAgentSetupStatus(options) {
-	const skillsLockPath = path.join(options.cwd, PRISMA_SKILLS_LOCK_FILENAME);
-	const [skillsInstalled, promptDismissedAt] = await Promise.all([hasPrismaSkillsLock(skillsLockPath, options.signal, options.requiredSkill), options.stateStore?.readAgentSetupPromptDismissedAt() ?? null]);
-	return {
-		skillsLockPath: path.basename(skillsLockPath),
-		skillsInstalled,
-		promptDismissedAt
-	};
-}
-function isPrismaAgentSetupComplete(status) {
-	return status.skillsInstalled;
-}
-function shouldOfferPrismaAgentSetup(status) {
-	return !isPrismaAgentSetupComplete(status) && !status.promptDismissedAt;
-}
-async function isLikelyProjectDirectory(options) {
-	return (await Promise.all([
-		"package.json",
-		"prisma.config.ts",
-		".git"
-	].map((fileName) => pathExists(path.join(options.cwd, fileName), options.signal)))).some(Boolean);
-}
-async function hasPrismaSkillsLock(filePath, signal, requiredSkill) {
-	try {
-		const raw = await readFile(filePath, {
-			encoding: "utf8",
-			signal
-		});
-		return hasPrismaSkillsLockEntry(JSON.parse(raw), requiredSkill);
-	} catch (error) {
-		if (isNotFoundError(error) || error instanceof SyntaxError) return false;
-		throw error;
-	}
-}
-function hasPrismaSkillsLockEntry(value, requiredSkill) {
-	if (!isRecord(value)) return false;
-	if (requiredSkill) return skillLockEntryUsesPrismaSource(readSkillLockEntries(value)[requiredSkill]);
-	if (readLegacySources(value).includes("prisma/skills")) return true;
-	return Object.values(readSkillLockEntries(value)).some(skillLockEntryUsesPrismaSource);
-}
-function readLegacySources(value) {
-	return Array.isArray(value.sources) ? value.sources.filter((source) => typeof source === "string") : [];
-}
-function readSkillLockEntries(value) {
-	return isRecord(value.skills) ? value.skills : {};
-}
-function skillLockEntryUsesPrismaSource(value) {
-	return isRecord(value) && value.source === "prisma/skills";
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-async function pathExists(filePath, signal) {
-	signal.throwIfAborted();
-	try {
-		await stat(filePath);
-		signal.throwIfAborted();
-		return true;
-	} catch (error) {
-		if (signal.aborted) throw error;
-		if (isNotFoundError(error)) return false;
-		throw error;
-	}
-}
-function isNotFoundError(error) {
-	const code = error.code;
-	return code === "ENOENT" || code === "ENOTDIR";
-}
-//#endregion
-//#region src/state-dir.ts
-const DEFAULT_STATE_DIR_NAME = path.join(".prisma", "cli");
-function resolveStateDir(inputs) {
-	const explicitStateDir = inputs.stateDir ?? inputs.env.PRISMA_CLI_STATE_DIR;
-	if (explicitStateDir) return explicitStateDir;
-	return path.join(inputs.cwd, DEFAULT_STATE_DIR_NAME);
-}
-//#endregion
-//#region src/commands/agent/status.ts
-function resolveStatusSource(skillsList, statusScope) {
-	if (skillsList.status === "ok") return "skills-cli";
-	return statusScope === "project" ? "skills-lock" : "unavailable";
-}
-function openStateStore(ctx) {
-	return new LocalStateStore(resolveStateDir({
-		env: ctx.env,
-		cwd: ctx.cwd
-	}), ctx.signal);
-}
-function skillsListUnavailable(failure, scope, skillsLockPath) {
-	const commandText = formatShellCommand(failure.command);
-	return {
-		code: "AGENT.SKILLS_LIST_UNAVAILABLE",
-		severity: "warn",
-		summary: scope === "project" ? `Could not read installed skills with ${commandText}: ${failure.message}. Falling back to ${skillsLockPath}.` : `Could not read globally installed skills with ${commandText}: ${failure.message}.`,
-		nextActions: []
-	};
-}
-const agentStatusCommand = defineCommand({
-	help: {
-		summary: "Show installed Prisma skills",
-		examples: [
-			"agent status",
-			"agent status --json",
-			"agent status --global"
-		]
-	},
-	args: { flags: { global: flag.boolean({ brief: "Check globally installed Prisma skills instead of project skills" }) } },
-	handler: async (args, ctx) => {
-		const statusScope = args.flags.global ? "global" : "project";
-		const setupStatus = await readPrismaAgentSetupStatus({
-			cwd: ctx.cwd,
-			stateStore: openStateStore(ctx),
-			signal: ctx.signal
-		});
-		const skillsList = await listInstalledPrismaSkills(ctx, ctx.cwd, statusScope);
-		const skillsInstalled = skillsList.status === "ok" ? skillsList.skills.length > 0 : statusScope === "project" && setupStatus.skillsInstalled;
-		const result = {
-			skills: skillsList.status === "ok" ? skillsList.skills : [],
-			skillsListCommand: skillsList.command,
-			statusScope,
-			skillsLockPath: setupStatus.skillsLockPath,
-			skillsLockInstalled: setupStatus.skillsInstalled,
-			skillsInstalled,
-			statusSource: resolveStatusSource(skillsList, statusScope),
-			promptDismissedAt: setupStatus.promptDismissedAt
-		};
-		const installCommand = skillsInstalled ? null : await resolvePrismaCliPackageCommand({
-			cwd: ctx.cwd,
-			signal: ctx.signal,
-			args: args.flags.global ? [...PRISMA_AGENT_INSTALL_ARGS, "--global"] : PRISMA_AGENT_INSTALL_ARGS
-		});
-		return ok(ctx.present({
-			data: result,
-			diagnostics: skillsList.status === "ok" ? [] : [skillsListUnavailable(skillsList, statusScope, setupStatus.skillsLockPath)]
-		}, statusPresentations(result, installCommand)));
-	}
-});
-//#endregion
-//#region src/commands/agent/update.ts
-const agentUpdateCommand = defineCommand({
-	help: {
-		summary: "Refresh Prisma skills for AI coding agents",
-		examples: [
-			"agent update",
-			"agent update --agent codex",
-			"agent update --all-agents"
-		]
-	},
-	args: { flags: agentInstallFlags },
-	handler: async (args, ctx) => runAgentSkillsInstall(args.flags, ctx, "update")
-});
-//#endregion
-//#region src/auth/client.ts
-const CLIENT_ID = "cmm3lndn701oo0uefvxzo0ivw";
-const AUTH_FILE_ENV_VAR = "PRISMA_COMPUTE_AUTH_FILE";
-/**
-* The redirect the OAuth client is registered with. `performLogin`
-* replaces it with its own ephemeral callback server's port; the
-* refreshing client never reads it.
-*/
-const DEFAULT_REDIRECT_URI = "http://localhost/auth/callback";
-function getApiBaseUrl(env = process.env) {
-	return env.PRISMA_MANAGEMENT_API_URL?.trim() || "https://api.prisma.io";
-}
-function getAuthBaseUrl(env = process.env) {
-	return env.PRISMA_AUTH_BASE_URL?.trim() || "https://auth.prisma.io";
-}
-function getAuthFilePath(env = process.env) {
-	const configured = env[AUTH_FILE_ENV_VAR];
-	if (configured?.trim()) return path.resolve(configured);
-	return defaultAuthFilePath(env);
-}
-function defaultAuthFilePath(env = process.env) {
-	if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", "prisma", "auth.json");
-	if (process.platform === "win32") {
-		const appData = env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
-		return path.join(appData, "prisma", "auth.json");
-	}
-	const xdgConfigHome = env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config");
-	return path.join(xdgConfigHome, "prisma", "auth.json");
-}
-//#endregion
-//#region src/lib/workspace-id.ts
-/**
-* A workspace reaches the CLI under two ids for the same workspace: a
-* credential's `workspace_id` claim carries the bare id, while the
-* management API and anything derived from it carry the same id behind
-* a `wksp_` prefix. Comparing the two forms directly silently matches
-* nothing, so every comparison between workspace ids of different
-* origin goes through here.
-*/
-const WORKSPACE_ID_PREFIX = "wksp_";
-function stripWorkspacePrefix(value) {
-	return value.startsWith(WORKSPACE_ID_PREFIX) ? value.slice(5) : value;
-}
-function sameWorkspaceId(left, right) {
-	return stripWorkspacePrefix(left) === stripWorkspacePrefix(right);
-}
-//#endregion
-//#region src/auth/token-storage.ts
-const REFRESH_LOCK_RETRY_MS$1 = 100;
-const REFRESH_LOCK_STALE_MS$1 = 3e4;
-const REFRESH_LOCK_WAIT_TIMEOUT_MS$1 = 25e3;
-const EMPTY_AUTH_CONTEXT = {
-	activeWorkspaceId: null,
-	workspaces: {}
-};
-const UNKNOWN_WORKSPACE_NAME = "Unknown workspace";
-function getAuthContextFilePath(authFilePath) {
-	const extension = path.extname(authFilePath);
-	if (!extension) return `${authFilePath}.context.json`;
-	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
-}
-function findLatestValidTokens(allCredentials) {
-	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
-		const credential = allCredentials[i];
-		if (!credential) continue;
-		if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) continue;
-		return {
-			workspaceId: credential.workspaceId,
-			accessToken: credential.token,
-			refreshToken: credential.refreshToken
-		};
-	}
-	return null;
-}
-function storedCredentialToTokens(credential) {
-	if (!credential) return null;
-	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
-	return {
-		workspaceId: credential.workspaceId,
-		accessToken: credential.token,
-		refreshToken: credential.refreshToken
-	};
-}
-function findTokensForWorkspace(allCredentials, workspaceId) {
-	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
-}
-function tokensEqual(a, b) {
-	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
-}
-function sleep$2(ms, signal) {
-	signal?.throwIfAborted();
-	return new Promise((resolve, reject) => {
-		const onAbort = () => {
-			clearTimeout(timeout);
-			reject(signal?.reason);
-		};
-		const timeout = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
+function sleep$2(ms, signal) {
+	signal?.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(signal?.reason);
+		};
+		const timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
 	});
 }
 var FileTokenStorage = class {
@@ -1731,41 +1038,737 @@ function environmentServiceToken(env) {
 function environmentCredentialInForce(env) {
 	return environmentServiceToken(env) !== void 0;
 }
-//#endregion
-//#region src/commands/auth/agent-setup-tip.ts
-/**
-* Port of the legacy shell's post-login agent-setup tip (the real-mode
-* path of `resolveAgentSetupTipCommand` in controllers/auth.ts). The
-* legacy --json / --quiet / stderr-TTY suppressions do not translate:
-* the engine's format selection already keeps the tip line out of json
-* output, and handlers cannot read TTY-ness or the interactive flag —
-* both recorded in the S2 parity divergence list. CI suppression is
-* kept via ctx.env.
-*/
-async function resolveAgentSetupTipCommand(ctx) {
-	if (ctx.env.CI) return null;
-	if (!await isLikelyProjectDirectory({
-		cwd: ctx.cwd,
-		signal: ctx.signal
-	})) return null;
-	const stateStore = new LocalStateStore(resolveStateDir({
-		env: ctx.env,
-		cwd: ctx.cwd
-	}), ctx.signal);
-	if (!shouldOfferPrismaAgentSetup(await readPrismaAgentSetupStatus({
-		cwd: ctx.cwd,
-		stateStore,
-		signal: ctx.signal
-	}))) return null;
-	return await resolvePrismaCliPackageCommand({
-		cwd: ctx.cwd,
-		signal: ctx.signal,
-		args: PRISMA_AGENT_INSTALL_ARGS
-	});
+const PRISMA_CLI_PACKAGE_SPEC = `@prisma/cli@next`;
+const DEFAULT_PRISMA_CLI_PACKAGE_RUNNER = ["npx", "-y"];
+const PRISMA_CLI_BINARY = CLI_NAME;
+function formatPrismaCliCommand(args, options = {}) {
+	return [...getPrismaCliCommandPrefix(options), ...args].join(" ");
+}
+function getPrismaCliCommandPrefix({ invocation = "package", packageRunner = DEFAULT_PRISMA_CLI_PACKAGE_RUNNER }) {
+	if (invocation === "binary") return [PRISMA_CLI_BINARY];
+	return [...packageRunner, PRISMA_CLI_PACKAGE_SPEC];
 }
 //#endregion
-//#region src/commands/auth/credential-card.ts
-const ENVIRONMENT_CREDENTIAL_NOTICE = `${SERVICE_TOKEN_ENV_VAR} supplies the credential in force; unset it to use your stored workspace sessions.`;
+//#region src/lib/agent/package-manager.ts
+const LOCKFILE_PACKAGE_MANAGERS = [
+	{
+		packageManager: "bun",
+		fileNames: ["bun.lock", "bun.lockb"]
+	},
+	{
+		packageManager: "pnpm",
+		fileNames: ["pnpm-lock.yaml", "pnpm-workspace.yaml"]
+	},
+	{
+		packageManager: "yarn",
+		fileNames: ["yarn.lock"]
+	},
+	{
+		packageManager: "npm",
+		fileNames: ["package-lock.json", "npm-shrinkwrap.json"]
+	}
+];
+async function resolvePackageRunner(options) {
+	options.signal.throwIfAborted();
+	const packageManager = detectPackageManagerSync(options.cwd, options.signal) ?? "npm";
+	options.signal.throwIfAborted();
+	return packageRunnerForPackageManager(packageManager);
+}
+function detectPackageManagerSync(cwd, signal) {
+	let directory = path.resolve(cwd);
+	while (true) {
+		signal?.throwIfAborted();
+		const packageJsonManager = readPackageJsonPackageManager(directory);
+		if (packageJsonManager) return packageJsonManager;
+		const lockfileManager = readLockfilePackageManager(directory, signal);
+		if (lockfileManager) return lockfileManager;
+		const parent = path.dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function readPackageJsonPackageManager(directory) {
+	const packageJsonPath = path.join(directory, "package.json");
+	let content;
+	try {
+		content = readFileSync(packageJsonPath, "utf8");
+	} catch (error) {
+		if (isMissingFileError(error)) return null;
+		throw error;
+	}
+	try {
+		return parsePackageManager(JSON.parse(content).packageManager);
+	} catch {
+		return null;
+	}
+}
+function readLockfilePackageManager(directory, signal) {
+	for (const candidate of LOCKFILE_PACKAGE_MANAGERS) for (const fileName of candidate.fileNames) {
+		signal?.throwIfAborted();
+		if (fileExists(path.join(directory, fileName))) return candidate.packageManager;
+	}
+	return null;
+}
+function fileExists(filePath) {
+	try {
+		return statSync(filePath).isFile();
+	} catch (error) {
+		if (isMissingFileError(error)) return false;
+		throw error;
+	}
+}
+function parsePackageManager(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "bun" || normalized.startsWith("bun@")) return "bun";
+	if (normalized === "pnpm" || normalized.startsWith("pnpm@")) return "pnpm";
+	if (normalized === "yarn" || normalized.startsWith("yarn@")) return "yarn";
+	if (normalized === "npm" || normalized.startsWith("npm@")) return "npm";
+	return null;
+}
+function packageRunnerForPackageManager(packageManager) {
+	switch (packageManager) {
+		case "bun": return ["bunx"];
+		case "pnpm": return ["pnpm", "dlx"];
+		case "yarn": return ["yarn", "dlx"];
+		case "npm": return ["npx", "-y"];
+	}
+}
+function isMissingFileError(error) {
+	const code = error.code;
+	return code === "ENOENT" || code === "ENOTDIR";
+}
+//#endregion
+//#region src/lib/agent/cli-command.ts
+async function resolvePrismaCliPackageCommandFormatter(options) {
+	return createPrismaCliPackageCommandFormatter(await resolvePackageRunner(options));
+}
+async function resolvePrismaCliPackageCommand(options) {
+	return (await resolvePrismaCliPackageCommandFormatter(options))(options.args);
+}
+function createPrismaCliPackageCommandFormatter(packageRunner) {
+	return (args) => formatPrismaCliCommand(args, { packageRunner });
+}
+//#endregion
+//#region src/lib/semver-order.ts
+function parseVersion(version) {
+	const match = VERSION_PATTERN.exec(version);
+	if (!match) return null;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3]),
+		prerelease: match[4]?.split(".") ?? []
+	};
+}
+const VERSION_PATTERN = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+const NUMERIC_PART = /^\d+$/;
+/** Negative when left is older, positive when newer, 0 when equal, and
+*  null when either side is not a version this understands. */
+function compareVersionStrings(left, right) {
+	const parsedLeft = parseVersion(left);
+	const parsedRight = parseVersion(right);
+	if (!parsedLeft || !parsedRight) return null;
+	return compareVersions(parsedLeft, parsedRight);
+}
+function compareVersions(left, right) {
+	for (const key of [
+		"major",
+		"minor",
+		"patch"
+	]) {
+		const diff = left[key] - right[key];
+		if (diff !== 0) return diff;
+	}
+	return comparePrerelease(left.prerelease, right.prerelease);
+}
+function comparePrerelease(left, right) {
+	if (left.length === 0 && right.length === 0) return 0;
+	if (left.length === 0) return 1;
+	if (right.length === 0) return -1;
+	const count = Math.max(left.length, right.length);
+	for (let index = 0; index < count; index += 1) {
+		const leftPart = left[index];
+		const rightPart = right[index];
+		if (leftPart === void 0) return -1;
+		if (rightPart === void 0) return 1;
+		const diff = comparePrereleasePart(leftPart, rightPart);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+}
+function comparePrereleasePart(left, right) {
+	const leftNumber = NUMERIC_PART.test(left) ? Number(left) : null;
+	const rightNumber = NUMERIC_PART.test(right) ? Number(right) : null;
+	if (leftNumber !== null && rightNumber !== null) return leftNumber - rightNumber;
+	if (leftNumber !== null) return -1;
+	if (rightNumber !== null) return 1;
+	return left.localeCompare(right);
+}
+//#endregion
+//#region src/lib/skills/allowlist.ts
+/**
+* SECURITY INVARIANT — read before changing this list.
+*
+* Skill content only ever comes from the packages named here. The sync
+* command never scans node_modules, or any other directory, looking for
+* skills to install, and no discovery mode may be added: a skill is
+* instructions an agent will follow, so installing one from an
+* arbitrary transitive dependency hands that dependency's author
+* influence over the user's agent. Resolving these names keeps the
+* trust boundary identical to the code's — if you run
+* `@prisma/orm-postgres`, you already trust its author.
+*
+* Adding a package here is a deliberate decision about a package Prisma
+* publishes. This is permanent.
+*/
+const SKILL_SOURCE_PACKAGES = [
+	"@prisma/orm-postgres",
+	"@prisma/orm-sqlite",
+	"@prisma/orm-mongo",
+	"@prisma/composer"
+];
+/** The directory inside a source package's tarball that holds its skill
+*  trees, one directory per skill. */
+const PACKAGE_SKILLS_DIR = "skills";
+/**
+* The agent harnesses this CLI can install skills for, each mapped to
+* the project-relative directory that harness reads its skills from.
+* There is no harness detection anywhere: which of these a project uses
+* comes from `skills: { agents: [...] }` in prisma.config.ts, and every
+* one of them when the config says nothing.
+*/
+const AGENT_SKILL_DIRS = {
+	claude: ".claude/skills",
+	cursor: ".cursor/skills",
+	agents: ".agents/skills",
+	devin: ".devin/skills"
+};
+const KNOWN_AGENTS = Object.keys(AGENT_SKILL_DIRS);
+/** Without a config, sync writes every known agent's directory, so a
+*  harness adopted later finds the skills already there. */
+const DEFAULT_AGENTS = KNOWN_AGENTS;
+function isKnownAgent(name) {
+	return name in AGENT_SKILL_DIRS;
+}
+function agentSkillDirs(agents) {
+	return agents.map((agent) => AGENT_SKILL_DIRS[agent]);
+}
+function isSkillSourcePackage(name) {
+	return SKILL_SOURCE_PACKAGES.includes(name);
+}
+//#endregion
+//#region src/lib/skills/unquote.ts
+const QUOTED = /^(["'])(.*)\1$/;
+/** Strips one layer of matching single or double quotes. */
+function unquote(value) {
+	return QUOTED.exec(value)?.[2] ?? value;
+}
+//#endregion
+//#region src/lib/skills/frontmatter.ts
+const LINE_BREAK = /\r?\n/;
+const INDENTED = /^[ \t]/;
+const EMPTY_STAMP = {
+	library: null,
+	libraryVersion: null
+};
+const METADATA_KEY = "metadata";
+const STAMP_KEYS = new Map([["library", "library"], ["library_version", "libraryVersion"]]);
+/**
+* The `library` and `library_version` entries of a SKILL.md's
+* `metadata` map. The Agent Skills spec defines no custom top-level
+* frontmatter keys — extensions live under `metadata`, a map of strings
+* — so the stamp is read there and nowhere else. A file without
+* frontmatter, without a `metadata` map, or without those entries
+* reports nulls rather than failing.
+*
+* Contract: this reads only the stamp this CLI writes. A file it
+* cannot read classifies as unmanaged, which sync refuses to touch, so
+* a parse bug can never delete user files.
+*/
+function parseSkillStamp(source) {
+	const lines = source.split(LINE_BREAK);
+	if (lines[0]?.trim() !== "---") return EMPTY_STAMP;
+	const stamp = {
+		library: null,
+		libraryVersion: null
+	};
+	let inMetadata = false;
+	for (const line of lines.slice(1)) {
+		if (line.trim() === "---") break;
+		if (line.trim() === "") continue;
+		if (!INDENTED.test(line)) {
+			inMetadata = keyOf(line) === METADATA_KEY;
+			continue;
+		}
+		if (!inMetadata) continue;
+		const field = STAMP_KEYS.get(keyOf(line) ?? "");
+		if (field) stamp[field] = valueAfterKey(line);
+	}
+	return stamp;
+}
+async function readSkillStamp(path) {
+	try {
+		return parseSkillStamp(await readFile(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function keyOf(line) {
+	const separator = line.indexOf(":");
+	return separator === -1 ? null : line.slice(0, separator).trim();
+}
+function valueAfterKey(line) {
+	const separator = line.indexOf(":");
+	return unquote(line.slice(separator + 1).trim());
+}
+//#endregion
+//#region src/lib/skills/opt-out.ts
+/**
+* The project's persisted answer to the staleness check, written by
+* `skills sync --disable` and read by the check on every command. It
+* sits at the project root beside the CLI's other local state, so the
+* opt-out follows the project rather than one machine's environment.
+*/
+const SKILLS_STATE_FILE = path.join(".prisma", "skills.json");
+function skillsStatePath(projectRoot) {
+	return path.join(projectRoot, SKILLS_STATE_FILE);
+}
+async function readSkillsCheckDisabled(projectRoot) {
+	try {
+		return JSON.parse(await readFile(skillsStatePath(projectRoot), "utf8")).check === false;
+	} catch {
+		return false;
+	}
+}
+async function writeSkillsCheckDisabled(projectRoot, disabled) {
+	const target = skillsStatePath(projectRoot);
+	await mkdir(path.dirname(target), { recursive: true });
+	await writeFile(target, `${JSON.stringify({ check: !disabled }, null, 2)}\n`, "utf8");
+}
+//#endregion
+//#region src/lib/skills/resolve.ts
+/**
+* Standard module resolution of one named package from one directory.
+* Under Yarn PnP this goes through the PnP resolver and answers a path
+* inside a zip, which the patched filesystem reads like any other.
+*/
+async function resolvePackage(fromDir, packageName) {
+	const dir = resolvePackageDir(fromDir, packageName);
+	if (dir === null) return null;
+	const version = await readPackageVersion(path.join(dir, "package.json"));
+	return version === null ? null : {
+		name: packageName,
+		version,
+		dir,
+		resolvedFrom: fromDir
+	};
+}
+function resolvePackageDir(fromDir, packageName) {
+	const requireFrom = createRequire(path.join(fromDir, "package.json"));
+	try {
+		return path.dirname(requireFrom.resolve(`${packageName}/package.json`));
+	} catch {}
+	try {
+		return packageRootOf(requireFrom.resolve(packageName), packageName);
+	} catch {
+		return null;
+	}
+}
+/** Walks up from a resolved entry point to the directory named by the
+*  package specifier — the last `node_modules/<name>` segment on the
+*  path, or the first ancestor holding a package.json with that name. */
+function packageRootOf(entry, packageName) {
+	const marker = `${path.sep}node_modules${path.sep}${packageName.split("/").join(path.sep)}`;
+	const at = entry.lastIndexOf(marker);
+	if (at !== -1) return entry.slice(0, at + marker.length);
+	let dir = path.dirname(entry);
+	for (;;) {
+		if (path.basename(dir) === path.basename(packageName)) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+async function readPackageVersion(manifestPath) {
+	try {
+		const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+		return typeof manifest.version === "string" ? manifest.version : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/skills/workspace-members.ts
+/**
+* The workspace member directories declared by the root's workspace
+* config, expanded from its globs by @manypkg/tools. Enumeration reads
+* the declared globs from plain files (pnpm-workspace.yaml or
+* package.json) and its glob expansion ignores node_modules, so a
+* package is resolvable from a member directory only because the user
+* declared that member — never because something was found by scanning.
+*
+* PnpmTool covers pnpm; YarnTool reads the package.json `workspaces`
+* field in both its array and `{ packages }` forms, which is how npm,
+* Yarn (Plug'n'Play included — the globs live in plain files), and bun
+* all declare their members. Only directories holding a package.json
+* come back.
+*/
+async function workspaceMemberDirs(root) {
+	const dirs = /* @__PURE__ */ new Set();
+	if (await hasPnpmWorkspace(root)) for (const dir of await memberDirsVia(PnpmTool, root)) dirs.add(dir);
+	if (await hasPackageJsonWorkspaces(root)) for (const dir of await memberDirsVia(YarnTool, root)) dirs.add(dir);
+	dirs.delete(path.resolve(root));
+	return [...dirs].sort();
+}
+async function memberDirsVia(tool, root) {
+	try {
+		const { packages } = await tool.getPackages(root);
+		return packages.map((pkg) => path.resolve(pkg.dir));
+	} catch {
+		return [];
+	}
+}
+async function hasPnpmWorkspace(root) {
+	try {
+		await readFile(path.join(root, "pnpm-workspace.yaml"), "utf8");
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function hasPackageJsonWorkspaces(root) {
+	try {
+		return JSON.parse(await readFile(path.join(root, "package.json"), "utf8")).workspaces !== void 0;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/lib/skills/status.ts
+async function readSkillsStatus(cwd, options) {
+	const projectRoot = path.resolve(cwd);
+	const dirs = agentSkillDirs(options?.agents ?? DEFAULT_AGENTS);
+	const checkDisabled = options?.checkDisabled ?? await readSkillsCheckDisabled(projectRoot);
+	const packages = await findInstalledSourcePackages(projectRoot);
+	const sources = await collectSkillSources(packages);
+	const skills = [];
+	for (const source of sources.values()) skills.push(await readSkillStatus(projectRoot, dirs, source));
+	skills.sort((left, right) => left.skill.localeCompare(right.skill));
+	return {
+		projectRoot,
+		checkDisabled,
+		packages,
+		skills,
+		orphans: options?.orphans === false ? [] : await findOrphanedSkills(projectRoot, dirs, new Set(sources.keys())),
+		upToDate: skills.every((skill) => skill.upToDate)
+	};
+}
+/**
+* The allowlisted packages installed in this project, resolved by name
+* from the project root and from each declared workspace member. Never
+* a directory scan.
+*/
+async function findInstalledSourcePackages(projectRoot) {
+	const searchDirs = [projectRoot, ...await workspaceMemberDirs(projectRoot)];
+	const found = [];
+	for (const name of SKILL_SOURCE_PACKAGES) {
+		const resolutions = [];
+		for (const dir of searchDirs) {
+			const resolved = await resolvePackage(dir, name);
+			if (resolved !== null) resolutions.push(resolved);
+		}
+		if (resolutions.length === 0) continue;
+		const highest = resolutions.reduce((best, candidate) => (compareVersionStrings(candidate.version, best.version) ?? 0) > 0 ? candidate : best);
+		const versions = [...new Set(resolutions.map((one) => one.version))].sort();
+		found.push({
+			name,
+			version: highest.version,
+			dir: highest.dir,
+			conflictingVersions: versions.length > 1 ? versions : []
+		});
+	}
+	return found;
+}
+/** Every skill tree the installed source packages ship, keyed by skill
+*  name. When two packages ship the same skill, the higher version
+*  wins — the public packages version in lockstep, so this only
+*  arbitrates a half-finished upgrade. */
+async function collectSkillSources(packages) {
+	const sources = /* @__PURE__ */ new Map();
+	for (const installed of packages) {
+		const skillsDir = path.join(installed.dir, PACKAGE_SKILLS_DIR);
+		for (const skill of await skillDirectories(skillsDir)) {
+			const existing = sources.get(skill);
+			if (existing !== void 0 && (compareVersionStrings(installed.version, existing.version) ?? 0) <= 0) continue;
+			sources.set(skill, {
+				skill,
+				library: installed.name,
+				version: installed.version,
+				dir: path.join(skillsDir, skill)
+			});
+		}
+	}
+	return sources;
+}
+async function readSkillStatus(projectRoot, dirs, source) {
+	const targets = [];
+	for (const dir of dirs) {
+		const skillFile = path.join(projectRoot, dir, source.skill, "SKILL.md");
+		const stamp = await readSkillStamp(skillFile);
+		targets.push({
+			dir,
+			syncedVersion: stamp?.libraryVersion ?? null,
+			state: await targetState(skillFile, stamp, source.version)
+		});
+	}
+	return {
+		skill: source.skill,
+		library: source.library,
+		version: source.version,
+		sourceDir: source.dir,
+		targets,
+		upToDate: targets.every((target) => target.state === "synced" || target.state === "unmanaged")
+	};
+}
+async function targetState(skillFile, stamp, sourceVersion) {
+	if (stamp === null) return await missingFromDisk(skillFile) ? "absent" : "unmanaged";
+	if (stamp.library === null || !isSkillSourcePackage(stamp.library)) return "unmanaged";
+	return stamp.libraryVersion === sourceVersion ? "synced" : "stale";
+}
+async function missingFromDisk(target) {
+	try {
+		await stat(target);
+		return false;
+	} catch (error) {
+		return error.code === "ENOENT";
+	}
+}
+/**
+* Copies in the harness directories that this CLI installed — their
+* SKILL.md names an allowlisted package as its `library` — and that no
+* installed package still provides. A skill from anywhere else is
+* someone else's file and is never touched.
+*/
+async function findOrphanedSkills(projectRoot, dirs, provided) {
+	const orphans = /* @__PURE__ */ new Map();
+	for (const dir of dirs) {
+		const harnessDir = path.join(projectRoot, dir);
+		for (const skill of await skillDirectories(harnessDir)) {
+			if (provided.has(skill)) continue;
+			const stamp = await readSkillStamp(path.join(harnessDir, skill, "SKILL.md"));
+			if (stamp?.library === null || stamp === null) continue;
+			if (!isSkillSourcePackage(stamp.library)) continue;
+			const entry = orphans.get(skill) ?? {
+				library: stamp.library,
+				dirs: []
+			};
+			entry.dirs.push(dir);
+			orphans.set(skill, entry);
+		}
+	}
+	return [...orphans.entries()].map(([skill, entry]) => ({
+		skill,
+		library: entry.library,
+		dirs: entry.dirs
+	}));
+}
+/** The subdirectories of `dir` that hold a SKILL.md. */
+async function skillDirectories(dir) {
+	let entries;
+	try {
+		entries = (await readdir(dir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	} catch {
+		return [];
+	}
+	const skills = [];
+	for (const name of entries.sort()) if (await isFile(path.join(dir, name, "SKILL.md"))) skills.push(name);
+	return skills;
+}
+async function isFile(target) {
+	try {
+		return (await stat(target)).isFile();
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/commands/skills/config.ts
+const DEFAULT = {
+	check: true,
+	agents: DEFAULT_AGENTS,
+	agentsConfigured: false
+};
+const SKILLS_CONFIG_SECTION_NAME = "skills";
+function invalidSection(value) {
+	return {
+		code: "SKILLS.CONFIG_INVALID",
+		severity: "error",
+		summary: `The 'skills' config section must be an object, and is ${describe(value)}.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Write skills: { check: false } to silence the skills check."
+		}]
+	};
+}
+function invalidCheck(value) {
+	return {
+		code: "SKILLS.CONFIG_INVALID",
+		severity: "error",
+		summary: `skills.check must be true or false, and is ${describe(value)}.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Set skills.check to true or false, or remove it."
+		}]
+	};
+}
+function invalidAgents(value) {
+	return {
+		code: "SKILLS.CONFIG_INVALID",
+		severity: "error",
+		summary: `skills.agents must be an array of agent names, and is ${describe(value)}.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: `List the agents to install skills for (${KNOWN_AGENTS.join(", ")}), or remove skills.agents to install for all of them.`
+		}]
+	};
+}
+function unknownAgent(name) {
+	return {
+		code: "SKILLS.CONFIG_INVALID",
+		severity: "error",
+		summary: `skills.agents names '${name}', which this CLI does not know. The known agents are ${KNOWN_AGENTS.join(", ")}.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: `Remove '${name}' from skills.agents, or update the CLI if a newer version knows it.`
+		}]
+	};
+}
+function describe(value) {
+	return value === null ? "null" : typeof value;
+}
+function validateAgents(raw) {
+	if (raw === void 0) return {
+		ok: true,
+		agents: DEFAULT_AGENTS
+	};
+	if (!Array.isArray(raw)) return {
+		ok: false,
+		diagnostic: invalidAgents(raw)
+	};
+	const agents = [];
+	for (const entry of raw) {
+		if (typeof entry !== "string" || !isKnownAgent(entry)) return {
+			ok: false,
+			diagnostic: typeof entry === "string" ? unknownAgent(entry) : invalidAgents(entry)
+		};
+		if (!agents.includes(entry)) agents.push(entry);
+	}
+	return {
+		ok: true,
+		agents
+	};
+}
+/**
+* The validated skills section of an already-loaded config, or null
+* when the section does not validate. Used by code that runs outside a
+* command handler (the staleness check, the post-login tip), which has
+* no ctx.config.
+*
+* Null deliberately collapses "no config" and "config invalid": both
+* callers fall back to the default agent set, so a broken config never
+* silences the check. The commands that consume the config surface the
+* validation error themselves.
+*/
+function readSkillsConfig(loaded) {
+	const section = skillsConfigSection.validate(loaded.sections[SKILLS_CONFIG_SECTION_NAME]);
+	return section.ok ? section.value : null;
+}
+/**
+* The project's skills settings from prisma.config.ts, or null when no
+* config file exists — decided with one stat, so a project without a
+* config never pays the file's TypeScript transpile — or the section
+* does not validate.
+*/
+async function readProjectSkillsConfig(cwd, configPath) {
+	if (!existsSync(configPath === void 0 ? path.join(cwd, "prisma.config.ts") : path.resolve(cwd, configPath))) return null;
+	return readSkillsConfig(await loadConfig(cwd, configPath));
+}
+const skillsConfigSection = defineConfigSection({
+	name: SKILLS_CONFIG_SECTION_NAME,
+	validate: (raw) => {
+		if (raw === void 0) return {
+			ok: true,
+			value: DEFAULT,
+			diagnostics: []
+		};
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+			ok: false,
+			diagnostics: [invalidSection(raw)]
+		};
+		let check;
+		let rawAgents;
+		try {
+			check = raw.check;
+			rawAgents = raw.agents;
+		} catch {
+			return {
+				ok: false,
+				diagnostics: [invalidSection(raw)]
+			};
+		}
+		if (check !== void 0 && typeof check !== "boolean") return {
+			ok: false,
+			diagnostics: [invalidCheck(check)]
+		};
+		const agents = validateAgents(rawAgents);
+		if (!agents.ok) return {
+			ok: false,
+			diagnostics: [agents.diagnostic]
+		};
+		return {
+			ok: true,
+			value: {
+				check: check ?? true,
+				agents: agents.agents,
+				agentsConfigured: rawAgents !== void 0
+			},
+			diagnostics: []
+		};
+	}
+});
+//#endregion
+//#region src/commands/auth/agent-setup-tip.ts
+/**
+* The post-login skills tip. Login is the moment a developer sets a
+* project up, so it points at `skills sync` when the project's synced
+* agent skills do not match its installed Prisma packages. Silent in
+* CI, in a directory with no skill-bearing Prisma packages, when the
+* copies are current, and when the check is opted out.
+*/
+const SKILLS_SYNC_ARGS = ["skills", "sync"];
+async function resolveAgentSetupTipCommand(ctx) {
+	if (ctx.env.CI) return null;
+	try {
+		const config = await readProjectSkillsConfig(ctx.cwd);
+		if (config !== null && !config.check) return null;
+		const status = await readSkillsStatus(ctx.cwd, {
+			orphans: false,
+			agents: config?.agents
+		});
+		if (status.packages.length === 0 || status.upToDate || status.checkDisabled) return null;
+		return await resolvePrismaCliPackageCommand({
+			cwd: ctx.cwd,
+			signal: ctx.signal,
+			args: SKILLS_SYNC_ARGS
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/commands/auth/credential-card.ts
+const ENVIRONMENT_CREDENTIAL_NOTICE = `${SERVICE_TOKEN_ENV_VAR} supplies the credential in force; unset it to use your stored workspace sessions.`;
 /** The card rows for the active credential, or the signed-out row when
 *  there is none. A credential nothing names — an environment token
 *  whose claims carry no workspace — has no workspace row at all. */
@@ -2150,7 +2153,7 @@ function serializeWorkspaceList(result) {
 		count: result.sessions.length
 	};
 }
-function listPresentations$8(result) {
+function listPresentations$9(result) {
 	const columns = [
 		"name",
 		"id",
@@ -2201,7 +2204,7 @@ const authWorkspaceListCommand = defineCommand({
 			selectedWorkspaceId: stored.selectedWorkspaceId,
 			environmentCredentialInForce: environmentCredentialInForce(ctx.env)
 		};
-		return ok(ctx.present({ data: result }, listPresentations$8(result)));
+		return ok(ctx.present({ data: result }, listPresentations$9(result)));
 	}
 });
 //#endregion
@@ -2416,13 +2419,13 @@ function usageError(summary, why, fix, nextSteps = [], domain = "cli") {
 		nextSteps
 	});
 }
-function authRequiredError(nextSteps = ["prisma-cli auth login"], options = {}) {
+function authRequiredError(nextSteps = ["prisma auth login"], options = {}) {
 	return new CliError({
 		code: "AUTH_REQUIRED",
 		domain: "auth",
 		summary: "Authentication required",
 		why: "This command needs an authenticated session.",
-		fix: "Run prisma-cli auth login, or rerun the command in a TTY to sign in interactively.",
+		fix: "Run prisma auth login, or rerun the command in a TTY to sign in interactively.",
 		debug: options.debug,
 		exitCode: 1,
 		nextSteps
@@ -2482,6 +2485,31 @@ function branchApiError(summary, response, error) {
 	});
 }
 //#endregion
+//#region src/lib/project/prisma-dir.ts
+/**
+* Walks up from cwd to the nearest directory containing a `.prisma/`
+* directory and returns that directory, or null when no ancestor has
+* one. Pure filesystem check — no config file is read or evaluated.
+* Nearest wins by design: a nested directory deliberately linked to a
+* different project beats the repo root.
+*/
+async function findNearestPrismaDir(cwd) {
+	let dir = path.resolve(cwd);
+	for (;;) {
+		if (await isDirectory(path.join(dir, ".prisma"))) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+async function isDirectory(candidate) {
+	try {
+		return (await stat(candidate)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/lib/project/local-pin.ts
 const LOCAL_RESOLUTION_PIN_RELATIVE_PATH = ".prisma/local.json";
 var LocalResolutionPinInvalidJsonError = class extends TaggedError("LocalResolutionPinInvalidJsonError")() {
@@ -2557,16 +2585,21 @@ var LocalResolutionPinGitignoreUpdateFailedError = class extends TaggedError("Lo
 		});
 	}
 };
+/** Reads the pin at the nearest ancestor with a `.prisma/` directory;
+*  without one anywhere up the tree, reads at cwd and finds nothing.
+*  Writes never walk — only discovery does. */
 async function readLocalResolutionPin(cwd, signal) {
 	return Result.gen(async function* () {
 		yield* ensureLocalResolutionPinReadNotAborted(signal);
-		const file = yield* Result.await(readLocalResolutionPinFile(cwd, signal));
+		const directory = await findNearestPrismaDir(cwd) ?? cwd;
+		const file = yield* Result.await(readLocalResolutionPinFile(directory, signal));
 		if (file.kind === "missing") return Result.ok({ kind: "missing" });
 		const parsed = yield* parseLocalResolutionPin(file.raw);
 		if (!isLocalResolutionPin(parsed)) return Result.err(new LocalResolutionPinInvalidShapeError());
 		return Result.ok({
 			kind: "present",
-			pin: parsed
+			pin: parsed,
+			directory
 		});
 	});
 }
@@ -2811,7 +2844,7 @@ var LocalProjectWorkspaceMismatchError = class extends TaggedError("LocalProject
 };
 var ProjectSetupRequiredError = class extends TaggedError("ProjectSetupRequiredError")() {
 	constructor(options) {
-		const commandLabel = options.commandName ? `prisma-cli ${options.commandName}` : "this command";
+		const commandLabel = options.commandName ? `prisma ${options.commandName}` : "this command";
 		super({
 			message: `This directory is not linked to a Prisma Project, and ${commandLabel} will not choose one from package or directory names.`,
 			commandName: options.commandName,
@@ -2862,9 +2895,9 @@ function projectNotFoundCliError(projectRef, workspace) {
 		domain: "project",
 		summary: "Project not found",
 		why: `The project "${projectRef}" does not exist in workspace "${workspace.name}" or is not accessible.`,
-		fix: "Pass a project id or name from prisma-cli project list.",
+		fix: "Pass a project id or name from prisma project list.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli project list"]
+		nextSteps: ["prisma project list"]
 	});
 }
 function projectAmbiguousError(projectRef, matches) {
@@ -2872,8 +2905,8 @@ function projectAmbiguousError(projectRef, matches) {
 }
 function projectAmbiguousCliError(projectRef, matches) {
 	const firstMatch = matches[0];
-	const nextSteps = ["prisma-cli project list"];
-	if (firstMatch) nextSteps.push(`prisma-cli project link ${firstMatch.id}`);
+	const nextSteps = ["prisma project list"];
+	if (firstMatch) nextSteps.push(`prisma project link ${firstMatch.id}`);
 	return new CliError({
 		code: "PROJECT_AMBIGUOUS",
 		domain: "project",
@@ -2897,7 +2930,7 @@ function localStateStaleCliError() {
 		fix: `Delete ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH}, then choose a Project explicitly.`,
 		meta: { pinPath: LOCAL_RESOLUTION_PIN_RELATIVE_PATH },
 		exitCode: 1,
-		nextSteps: ["prisma-cli project list", "prisma-cli project link <id-or-name>"]
+		nextSteps: ["prisma project list", "prisma project link <id-or-name>"]
 	});
 }
 function localProjectWorkspaceMismatchCliError(options) {
@@ -2916,9 +2949,9 @@ function localProjectWorkspaceMismatchCliError(options) {
 		},
 		exitCode: 1,
 		nextSteps: [
-			`prisma-cli auth workspace use ${options.pinnedWorkspaceId}`,
-			"prisma-cli project list",
-			"prisma-cli project link <id-or-name>"
+			`prisma auth workspace use ${options.pinnedWorkspaceId}`,
+			"prisma project list",
+			"prisma project link <id-or-name>"
 		]
 	});
 }
@@ -2974,7 +3007,7 @@ function projectSetupRequiredCliError(error) {
 		fix: "Link the directory to an existing Project, or pass --project <id-or-name> for this command.",
 		meta: { ...suggestion },
 		exitCode: 1,
-		nextSteps: ["prisma-cli project list", ...suggestion.recoveryCommands],
+		nextSteps: ["prisma project list", ...suggestion.recoveryCommands],
 		nextActions: buildProjectSetupNextActions({
 			commandName: error.commandName,
 			suggestedProjectName: suggestion.suggestedProjectName
@@ -2983,14 +3016,14 @@ function projectSetupRequiredCliError(error) {
 }
 function buildProjectSetupNextActions(options = {}) {
 	const recoveryCommands = buildProjectRecoveryCommands(options.commandName);
-	const linkCommand = recoveryCommands[0] ?? "prisma-cli project link <id-or-name>";
+	const linkCommand = recoveryCommands[0] ?? "prisma project link <id-or-name>";
 	const retryCommand = options.retryCommand ?? recoveryCommands[1];
 	const actions = [{
 		kind: "user-choice",
 		journey: "project-setup",
 		label: "Ask the user whether to link an existing Project or create a new one",
 		commands: [
-			"prisma-cli project list",
+			"prisma project list",
 			linkCommand,
 			...retryCommand ? [retryCommand] : []
 		],
@@ -3002,7 +3035,7 @@ function buildProjectSetupNextActions(options = {}) {
 		command: linkCommand,
 		reason: "Linking writes the durable local Project binding for this directory."
 	}];
-	const createCommand = options.createCommand ?? (options.suggestedProjectName ? `prisma-cli project create ${formatCommandArgument(options.suggestedProjectName)}` : void 0);
+	const createCommand = options.createCommand ?? (options.suggestedProjectName ? `prisma project create ${formatCommandArgument(options.suggestedProjectName)}` : void 0);
 	if (createCommand) actions.push({
 		kind: "run-command",
 		journey: "project-setup",
@@ -3014,7 +3047,7 @@ function buildProjectSetupNextActions(options = {}) {
 		kind: "run-command",
 		journey: "recover",
 		label: "Retry with an explicit Project",
-		command: retryCommand ?? `prisma-cli ${options.commandName} --project <id-or-name>`
+		command: retryCommand ?? `prisma ${options.commandName} --project <id-or-name>`
 	});
 	return actions;
 }
@@ -3128,8 +3161,8 @@ function resolvedTarget(workspace, project, projectSource, resolutionDetails) {
 	};
 }
 function buildProjectRecoveryCommands(commandName) {
-	const commands = ["prisma-cli project link <id-or-name>"];
-	if (commandName) commands.push(`prisma-cli ${commandName} --project <id-or-name>`);
+	const commands = ["prisma project link <id-or-name>"];
+	if (commandName) commands.push(`prisma ${commandName} --project <id-or-name>`);
 	return commands;
 }
 function toProjectSummary$1(project) {
@@ -3211,7 +3244,7 @@ async function cleanupLocalPinForProject(context, projectId, hooks) {
 	const pin = pinResult.value;
 	if (pin.kind !== "present" || pin.pin.projectId !== projectId) return false;
 	try {
-		await unlink(path.join(context.runtime.cwd, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
+		await unlink(path.join(pin.directory, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
 		return true;
 	} catch {
 		hooks.onError(`The local pin ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} points at the deleted project but could not be deleted.`);
@@ -3224,7 +3257,7 @@ async function rewriteOrClearLocalPinForProject(context, projectId, recipientWor
 	const pin = pinResult.value;
 	if (pin.kind !== "present" || pin.pin.projectId !== projectId) return "none";
 	if (recipientWorkspaceId) {
-		if ((await writeLocalResolutionPin(context.runtime.cwd, {
+		if ((await writeLocalResolutionPin(pin.directory, {
 			workspaceId: recipientWorkspaceId,
 			projectId
 		}, context.runtime.signal)).isOk()) return "rewritten";
@@ -3232,7 +3265,7 @@ async function rewriteOrClearLocalPinForProject(context, projectId, recipientWor
 		return "none";
 	}
 	try {
-		await unlink(path.join(context.runtime.cwd, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
+		await unlink(path.join(pin.directory, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
 		return "cleared";
 	} catch {
 		hooks.onError(`The local pin ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} points at the transferred project but could not be cleared.`);
@@ -3401,7 +3434,7 @@ function unsupportedRepositoryProviderError() {
 		why: "Repository connection supports GitHub repository URLs only.",
 		fix: "Pass a GitHub repository URL such as git@github.com:prisma/prisma-cli.git.",
 		exitCode: 2,
-		nextSteps: ["prisma-cli git connect git@github.com:owner/repo.git"]
+		nextSteps: ["prisma git connect git@github.com:owner/repo.git"]
 	});
 }
 function repoNotConnectedError() {
@@ -3410,9 +3443,9 @@ function repoNotConnectedError() {
 		domain: "project",
 		summary: "No GitHub repository connected",
 		why: "The resolved project does not have an active GitHub repository connection.",
-		fix: "Run prisma-cli git connect before disconnecting.",
+		fix: "Run prisma git connect before disconnecting.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli git connect"]
+		nextSteps: ["prisma git connect"]
 	});
 }
 function repoInstallationRequiredError(repository, installUrl, opened) {
@@ -3421,14 +3454,14 @@ function repoInstallationRequiredError(repository, installUrl, opened) {
 		domain: "project",
 		summary: "GitHub App installation required",
 		why: `The selected workspace does not have a GitHub App installation that can be used to link ${repository.fullName}.`,
-		fix: opened ? "Finish installing the GitHub App in the browser, then rerun prisma-cli git connect." : "Open the GitHub App installation URL, approve access, then rerun prisma-cli git connect.",
+		fix: opened ? "Finish installing the GitHub App in the browser, then rerun prisma git connect." : "Open the GitHub App installation URL, approve access, then rerun prisma git connect.",
 		meta: {
 			repository: repository.fullName,
 			installUrl,
 			opened
 		},
 		exitCode: 1,
-		nextSteps: [installUrl, `prisma-cli git connect ${repository.url}`]
+		nextSteps: [installUrl, `prisma git connect ${repository.url}`]
 	});
 }
 function repoNotAccessibleError(repository, installUrl, opened) {
@@ -3437,14 +3470,14 @@ function repoNotAccessibleError(repository, installUrl, opened) {
 		domain: "project",
 		summary: "GitHub repository is not accessible",
 		why: `The GitHub App installations connected to this workspace do not expose ${repository.fullName}.`,
-		fix: "Open the GitHub App installation URL, grant access to this repository, then rerun prisma-cli git connect.",
+		fix: "Open the GitHub App installation URL, grant access to this repository, then rerun prisma git connect.",
 		meta: {
 			repository: repository.fullName,
 			installUrl,
 			opened
 		},
 		exitCode: 1,
-		nextSteps: [installUrl, `prisma-cli git connect ${repository.url}`]
+		nextSteps: [installUrl, `prisma git connect ${repository.url}`]
 	});
 }
 function repoAlreadyConnectedError(repositoryFullName) {
@@ -3456,7 +3489,7 @@ function repoAlreadyConnectedError(repositoryFullName) {
 		fix: "Disconnect the existing repository before connecting a different one.",
 		meta: { repository: repositoryFullName },
 		exitCode: 1,
-		nextSteps: ["prisma-cli git disconnect"]
+		nextSteps: ["prisma git disconnect"]
 	});
 }
 function repositoryFullNamesMatch(left, right) {
@@ -3467,7 +3500,7 @@ function repoConnectionApiError(summary, response, error) {
 	const apiCode = error?.error?.code;
 	const apiMessage = error?.error?.message;
 	const apiHint = error?.error?.hint;
-	if (status === 401 || status === 403) return authRequiredError(["prisma-cli auth login"]);
+	if (status === 401 || status === 403) return authRequiredError(["prisma auth login"]);
 	return new CliError({
 		code: "REPO_CONNECTION_FAILED",
 		domain: "project",
@@ -3479,11 +3512,11 @@ function repoConnectionApiError(summary, response, error) {
 			...apiCode ? { apiCode } : {}
 		},
 		exitCode: 1,
-		nextSteps: ["prisma-cli project show"]
+		nextSteps: ["prisma project show"]
 	});
 }
 function repoConnectionFixForStatus(status) {
-	if (status === 404) return "Install the GitHub App for this workspace, then rerun prisma-cli git connect.";
+	if (status === 404) return "Install the GitHub App for this workspace, then rerun prisma git connect.";
 	if (status === 409) return "This project or repository is already linked. Disconnect the old link first, then try again.";
 	if (status === 422) return "Make sure the GitHub App installation has access to this repository.";
 	return "Re-run with --trace for the underlying API response details.";
@@ -3537,7 +3570,7 @@ function localStateWriteFailedError(error, options) {
 		debug: formatDebugDetails(error.cause),
 		meta: options.meta,
 		exitCode: 1,
-		nextSteps: ["prisma-cli project link <id-or-name>"]
+		nextSteps: ["prisma project link <id-or-name>"]
 	});
 }
 function toProjectSummary(project) {
@@ -3549,7 +3582,7 @@ function toProjectSummary(project) {
 	};
 }
 function projectSetupNameRequiredError(command) {
-	return usageError("Project create requires a name", "The project name must be a non-empty value.", "Pass a Project name explicitly.", [`prisma-cli ${command} my-app`], "project");
+	return usageError("Project create requires a name", "The project name must be a non-empty value.", "Pass a Project name explicitly.", [`prisma ${command} my-app`], "project");
 }
 function projectCreateFailedError(error, projectName, workspace, options) {
 	const status = extractHttpStatus(error);
@@ -3715,11 +3748,12 @@ const PROJECT_CODE_MAP = {
 };
 const PACKAGE_RUNNER_PREFIX = /^\S+(?: -y)? @prisma\/cli@\S+ /;
 const COMMENT_PREFIX$1 = /^#\s*/;
-/** Legacy command strings are `prisma-cli …`, except one `prisma auth
-*  login` copy bug and the package-runner formatter's output. */
+/** Ported command strings already name this binary; what still needs
+*  porting is the package-runner spelling the legacy formatter emitted
+*  (`npx -y @prisma/cli@next auth login`), which becomes a plain
+*  invocation. Anything else is passed through untouched. */
 function portCommandString(command) {
-	if (command.startsWith(`prisma-cli `)) return command;
-	if (command.startsWith("prisma ")) return `${CLI_NAME} ${command.slice(7)}`;
+	if (command.startsWith(`prisma `)) return command;
 	return command.replace(PACKAGE_RUNNER_PREFIX, `${CLI_NAME} `);
 }
 const STALE_INTERACTIVE_SIGN_IN$4 = /, or rerun the command in a TTY to sign in interactively\./g;
@@ -3812,7 +3846,7 @@ function mapBranchOperationError(error) {
 //#region src/commands/branch/list.ts
 /** The `branch list` command. */
 const TITLE$12 = "Listing branches for the resolved project.";
-function listPresentations$7(result) {
+function listPresentations$8(result) {
 	const rows = result.branches.map((branch) => [
 		branch.name,
 		branch.role,
@@ -3870,7 +3904,7 @@ const branchListCommand = defineCommand({
 				projectName: target.project.name,
 				branches: sortBranches(branches.map(toBranchSummary))
 			};
-			return ok(ctx.present({ data: result }, listPresentations$7(result)));
+			return ok(ctx.present({ data: result }, listPresentations$8(result)));
 		} catch (error) {
 			const mapped = mapBranchOperationError(error);
 			if (mapped) return notOk(mapped);
@@ -3963,7 +3997,7 @@ function createManagementBucketProvider(client) {
 				why: "Bucket key credentials are one-time-view secrets, but the Management API did not include them in this create response.",
 				fix: "Create another bucket key and store the returned credentials immediately.",
 				exitCode: 1,
-				nextSteps: [`prisma-cli bucket key create ${options.bucketId}`]
+				nextSteps: [`prisma bucket key create ${options.bucketId}`]
 			});
 			return {
 				key: normalizeKey(raw),
@@ -4311,17 +4345,184 @@ const bucketKeyCreateCommand = defineCommand({
 	handler: async (args, ctx) => {
 		try {
 			const bucketId = args.positionals.bucketId.trim();
-			if (!bucketId) throw usageError("Bucket id required", "Bucket key creation needs a bucket id.", "Pass the bucket id.", ["prisma-cli bucket list"], "bucket");
+			if (!bucketId) throw usageError("Bucket id required", "Bucket key creation needs a bucket id.", "Pass the bucket id.", ["prisma bucket list"], "bucket");
+			const result = {
+				bucketId,
+				...await resolveBucketProviderOnly(ctx).createKey({
+					bucketId,
+					name: args.flags.name?.trim() || void 0,
+					role: resolveKeyRole(args.flags.role),
+					signal: ctx.signal
+				})
+			};
+			return ok(ctx.present({ data: result }, createPresentations$1(result)));
+		} catch (error) {
+			const mapped = mapBucketOperationError(error);
+			if (mapped) return notOk(mapped);
+			throw error;
+		}
+	}
+});
+//#endregion
+//#region src/commands/bucket/key-delete.ts
+/** The `bucket key delete` command. */
+function deletePresentations$4(result) {
+	return {
+		stdout: () => [],
+		json: () => result,
+		next: () => [],
+		human: () => [
+			{
+				kind: "summary",
+				status: "ok",
+				text: "Deleting bucket access key."
+			},
+			{
+				kind: "fields",
+				rows: [{
+					label: "key",
+					value: result.key.id
+				}]
+			},
+			{
+				kind: "list",
+				items: ["The access key was revoked and removed."]
+			}
+		]
+	};
+}
+const bucketKeyDeleteCommand = defineCommand({
+	args: { positionals: {
+		bucketId: bucketPositional,
+		keyId: positional.string({
+			brief: "Key id",
+			placeholder: "key-id"
+		})
+	} },
+	help: {
+		summary: "Revoke and delete a bucket access key",
+		examples: ["bucket key delete bkt_123 bkey_456"]
+	},
+	needs: { credentials: true },
+	handler: async (args, ctx) => {
+		try {
+			const bucketId = args.positionals.bucketId.trim();
+			const keyId = args.positionals.keyId.trim();
+			if (!bucketId || !keyId) throw usageError("Bucket id and key id required", "Bucket key deletion needs both a bucket id and a key id.", "Pass the bucket id and key id.", ["prisma bucket key list <bucketId>"], "bucket");
+			await resolveBucketProviderOnly(ctx).deleteKey(bucketId, keyId, { signal: ctx.signal });
+			const result = { key: { id: keyId } };
+			return ok(ctx.present({ data: result }, deletePresentations$4(result)));
+		} catch (error) {
+			const mapped = mapBucketOperationError(error);
+			if (mapped) return notOk(mapped);
+			throw error;
+		}
+	}
+});
+//#endregion
+//#region src/output/patterns.ts
+function serializeList(input) {
+	return {
+		context: input.context,
+		items: input.items.map((item) => ({
+			name: item.label,
+			id: item.id,
+			status: item.status
+		})),
+		count: input.items.length
+	};
+}
+//#endregion
+//#region src/presenters/bucket.ts
+function serializeBucketList(result) {
+	return {
+		context: {
+			project: result.projectName,
+			...result.branchName ? { branch: result.branchName } : {}
+		},
+		items: result.buckets.map((bucket) => ({
+			name: bucket.name,
+			id: bucket.id,
+			status: bucket.status
+		})),
+		count: result.buckets.length,
+		projectId: result.projectId,
+		branchName: result.branchName,
+		buckets: result.buckets
+	};
+}
+function serializeBucketKeyList(result) {
+	return {
+		...serializeList({
+			context: { bucket: result.bucketId },
+			items: result.keys.map((key) => ({
+				noun: "key",
+				label: key.name,
+				id: key.id,
+				status: null
+			}))
+		}),
+		bucketId: result.bucketId,
+		keys: result.keys
+	};
+}
+//#endregion
+//#region src/commands/bucket/key-list.ts
+/** The `bucket key list` command. */
+const TITLE$11 = "Listing access keys for bucket.";
+function listPresentations$7(result) {
+	const rows = bucketKeyRows(result.keys);
+	return {
+		next: () => [],
+		human: () => [
+			{
+				kind: "summary",
+				status: "info",
+				text: TITLE$11
+			},
+			{
+				kind: "fields",
+				rows: [{
+					label: "bucket",
+					value: result.bucketId
+				}]
+			},
+			...rows.length === 0 ? [{
+				kind: "summary",
+				status: "info",
+				text: "No keys found."
+			}] : [{
+				kind: "table",
+				columns: [
+					"Name",
+					"Id",
+					"Role",
+					"Hint",
+					"Created"
+				],
+				rows
+			}]
+		],
+		stdout: () => rows.map((row) => row.join("	")),
+		json: () => serializeBucketKeyList(result)
+	};
+}
+const bucketKeyListCommand = defineCommand({
+	args: { positionals: { bucketId: bucketPositional } },
+	help: {
+		summary: "List access keys for a bucket",
+		examples: ["bucket key list bkt_123", "bucket key list bkt_123 --json"]
+	},
+	needs: { credentials: true },
+	handler: async (args, ctx) => {
+		try {
+			const bucketId = args.positionals.bucketId.trim();
+			if (!bucketId) throw usageError("Bucket id required", "Bucket key listing needs a bucket id.", "Pass the bucket id.", ["prisma bucket list"], "bucket");
 			const result = {
 				bucketId,
-				...await resolveBucketProviderOnly(ctx).createKey({
-					bucketId,
-					name: args.flags.name?.trim() || void 0,
-					role: resolveKeyRole(args.flags.role),
-					signal: ctx.signal
-				})
+				keys: await resolveBucketProviderOnly(ctx).listKeys(bucketId, { signal: ctx.signal })
 			};
-			return ok(ctx.present({ data: result }, createPresentations$1(result)));
+			return ok(ctx.present({ data: result }, listPresentations$7(result)));
 		} catch (error) {
 			const mapped = mapBucketOperationError(error);
 			if (mapped) return notOk(mapped);
@@ -4330,824 +4531,1329 @@ const bucketKeyCreateCommand = defineCommand({
 	}
 });
 //#endregion
-//#region src/commands/bucket/key-delete.ts
-/** The `bucket key delete` command. */
-function deletePresentations$4(result) {
+//#region src/commands/bucket/list.ts
+/** The `bucket list` command. */
+const TITLE$10 = "Listing object-store buckets for the resolved project.";
+function listPresentations$6(result) {
+	const rows = bucketRows(result.buckets);
+	const stdoutRows = bucketStdoutRows(result.buckets);
 	return {
-		stdout: () => [],
-		json: () => result,
 		next: () => [],
 		human: () => [
 			{
 				kind: "summary",
-				status: "ok",
-				text: "Deleting bucket access key."
+				status: "info",
+				text: TITLE$10
 			},
 			{
 				kind: "fields",
 				rows: [{
-					label: "key",
-					value: result.key.id
-				}]
+					label: "project",
+					value: result.projectName
+				}, ...result.branchName ? [{
+					label: "branch",
+					value: result.branchName
+				}] : []]
 			},
-			{
-				kind: "list",
-				items: ["The access key was revoked and removed."]
-			}
-		]
+			...rows.length === 0 ? [{
+				kind: "summary",
+				status: "info",
+				text: "No buckets found."
+			}] : [{
+				kind: "table",
+				columns: [
+					"Name",
+					"Id",
+					"Status",
+					"Branch",
+					"Created"
+				],
+				rows
+			}]
+		],
+		stdout: () => stdoutRows.map((row) => row.join("	")),
+		json: () => serializeBucketList(result)
 	};
 }
-const bucketKeyDeleteCommand = defineCommand({
-	args: { positionals: {
-		bucketId: bucketPositional,
-		keyId: positional.string({
-			brief: "Key id",
-			placeholder: "key-id"
-		})
+const bucketListCommand = defineCommand({
+	args: { flags: {
+		project: projectFlag$3,
+		branch: branchFlag$2
 	} },
 	help: {
-		summary: "Revoke and delete a bucket access key",
-		examples: ["bucket key delete bkt_123 bkey_456"]
+		summary: "List object-store buckets for the resolved project",
+		examples: [
+			"bucket list",
+			"bucket list --branch preview",
+			"bucket list --json"
+		]
+	},
+	needs: { credentials: true },
+	handler: async (args, ctx) => {
+		try {
+			const { provider, projectId, projectName } = await resolveBucketContext(ctx, args.flags, "bucket list");
+			const buckets = await provider.listBuckets({
+				projectId,
+				branchName: args.flags.branch,
+				signal: ctx.signal
+			});
+			const result = {
+				projectId,
+				projectName,
+				branchName: args.flags.branch ?? null,
+				buckets
+			};
+			return ok(ctx.present({ data: result }, listPresentations$6(result)));
+		} catch (error) {
+			const mapped = mapBucketOperationError(error);
+			if (mapped) return notOk(mapped);
+			throw error;
+		}
+	}
+});
+//#endregion
+//#region src/lib/feedback.ts
+const FEEDBACK_TIMEOUT_MS = 3e3;
+const TIMEOUT_DETAIL = `The feedback service did not answer within ${FEEDBACK_TIMEOUT_MS / 1e3} seconds.`;
+function isTimeout(error) {
+	return error instanceof Error && error.name === "TimeoutError";
+}
+function unreachableDetail(error) {
+	if (isTimeout(error)) return TIMEOUT_DETAIL;
+	return `The feedback service could not be reached${error instanceof Error && error.cause instanceof Error ? ` (${error.cause.message})` : ""}.`;
+}
+function unreadableBodyDetail(error) {
+	return isTimeout(error) ? TIMEOUT_DETAIL : "The feedback service response could not be read.";
+}
+//#endregion
+//#region src/lib/version.ts
+const requireFromHere = createRequire(import.meta.url);
+/** The bundled entry sits one directory below the package root
+*  (`dist/cli.js`); this source file sits two below (`src/lib/`). Both
+*  are tried, nearest first, so the same code serves either. */
+const PACKAGE_JSON_CANDIDATES = ["../package.json", "../../package.json"];
+function readPackageMetadata() {
+	for (const candidate of PACKAGE_JSON_CANDIDATES) try {
+		const metadata = requireFromHere(candidate);
+		if (metadata.version) return metadata;
+	} catch {}
+	return {};
+}
+function getCliVersion() {
+	const pkg = readPackageMetadata();
+	if (!pkg.version) throw new Error("CLI version metadata is missing from the installed package: the bundled package.json could not be read or did not contain a version field. Reinstall the CLI from the npm registry, or check your install path is intact.");
+	return pkg.version;
+}
+function getCliName() {
+	return CLI_NAME;
+}
+//#endregion
+//#region src/commands/feedback.ts
+const DEFAULT_FEEDBACK_ENDPOINT = "https://hiieirp2pwqnjvq9axzyg6d0.fra.prisma.build/feedback";
+const MAX_MESSAGE_LENGTH = 4e3;
+const MAX_EMAIL_LENGTH = 320;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function sendFailedError(detail) {
+	return new CliStructuredError("FEEDBACK.SEND_FAILED", "Feedback could not be delivered", {
+		why: detail,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Check your network and rerun."
+		}]
+	});
+}
+function messageRequiredError() {
+	return new CliStructuredError("FEEDBACK.MESSAGE_REQUIRED", "Feedback message required", {
+		why: "The message argument is empty.",
+		nextActions: [{
+			kind: "user-choice",
+			label: "Pass a non-empty message."
+		}, {
+			kind: "run-command",
+			label: "Send feedback",
+			command: `${CLI_NAME} feedback "the deploy flow is great"`
+		}]
+	});
+}
+function messageTooLongError(length) {
+	return new CliStructuredError("FEEDBACK.MESSAGE_TOO_LONG", "Feedback message too long", {
+		why: `The message is ${length} characters; the limit is ${MAX_MESSAGE_LENGTH}.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Shorten the message."
+		}]
+	});
+}
+function emailInvalidError(value) {
+	return new CliStructuredError("FEEDBACK.EMAIL_INVALID", "Invalid email", {
+		why: `"${value}" is not a valid email address of at most ${MAX_EMAIL_LENGTH} characters.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Pass a valid address with --email, or drop the flag to stay anonymous."
+		}, {
+			kind: "run-command",
+			label: "Send feedback with a contact address",
+			command: `${CLI_NAME} feedback "please add X" --email you@example.com`
+		}]
+	});
+}
+function feedbackPresentations(result) {
+	return {
+		stdout: () => [],
+		json: () => result,
+		next: () => [],
+		human: () => [{
+			kind: "summary",
+			status: "ok",
+			text: "Feedback sent. Thank you!"
+		}, {
+			kind: "fields",
+			rows: [
+				...result.id ? [{
+					label: "id",
+					value: result.id
+				}] : [],
+				{
+					label: "sent as",
+					value: result.email ?? "anonymous"
+				},
+				{
+					label: "included",
+					value: `CLI ${result.context.cliVersion}, ${result.context.runtime.name} ${result.context.runtime.version}, ${result.context.platform} ${result.context.arch}`
+				}
+			]
+		}]
+	};
+}
+async function readServiceError(response, signal) {
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		if (signal.aborted) throw error;
+		return "";
+	}
+	return typeof payload?.error?.message === "string" ? ` (${payload.error.message})` : "";
+}
+async function sendFeedback(endpoint, body, signal) {
+	try {
+		return await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"user-agent": `${CLI_NAME}/${getCliVersion()}`
+			},
+			body: JSON.stringify(body),
+			signal: AbortSignal.any([signal, AbortSignal.timeout(FEEDBACK_TIMEOUT_MS)])
+		});
+	} catch (error) {
+		if (signal.aborted) throw error;
+		throw sendFailedError(unreachableDetail(error));
+	}
+}
+async function readSubmissionId(response, signal) {
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		if (signal.aborted) throw error;
+		if (!(error instanceof SyntaxError)) throw sendFailedError(unreadableBodyDetail(error));
+		payload = null;
+	}
+	return typeof payload?.id === "string" ? payload.id : null;
+}
+async function postFeedback(endpoint, body, signal) {
+	const response = await sendFeedback(endpoint, body, signal);
+	if (!response.ok) throw sendFailedError(`The feedback service responded with HTTP ${response.status}${await readServiceError(response, signal)}.`);
+	return readSubmissionId(response, signal);
+}
+const feedbackCommand = defineCommand({
+	help: {
+		summary: "Send feedback to the Prisma CLI team",
+		description: "Anonymous unless --email is passed. Every submission includes the CLI\nversion, node version, and OS platform/arch, and nothing else.",
+		examples: ["feedback \"the deploy flow is great\"", "feedback \"please add X\" --email you@example.com"]
+	},
+	args: {
+		flags: { email: flag.string({
+			brief: "Contact email if you want a reply; feedback is anonymous without it",
+			placeholder: "address"
+		}) },
+		positionals: { message: positional.string({
+			brief: "Feedback text (up to 4000 characters)",
+			placeholder: "message"
+		}) }
 	},
-	needs: { credentials: true },
 	handler: async (args, ctx) => {
-		try {
-			const bucketId = args.positionals.bucketId.trim();
-			const keyId = args.positionals.keyId.trim();
-			if (!bucketId || !keyId) throw usageError("Bucket id and key id required", "Bucket key deletion needs both a bucket id and a key id.", "Pass the bucket id and key id.", ["prisma-cli bucket key list <bucketId>"], "bucket");
-			await resolveBucketProviderOnly(ctx).deleteKey(bucketId, keyId, { signal: ctx.signal });
-			const result = { key: { id: keyId } };
-			return ok(ctx.present({ data: result }, deletePresentations$4(result)));
-		} catch (error) {
-			const mapped = mapBucketOperationError(error);
-			if (mapped) return notOk(mapped);
-			throw error;
-		}
+		const message = args.positionals.message.trim();
+		if (!message) throw messageRequiredError();
+		if (message.length > MAX_MESSAGE_LENGTH) throw messageTooLongError(message.length);
+		const email = args.flags.email?.trim();
+		if (email !== void 0 && (email.length > MAX_EMAIL_LENGTH || !EMAIL_PATTERN.test(email))) throw emailInvalidError(args.flags.email ?? "");
+		const context = {
+			cliVersion: getCliVersion(),
+			runtime: { ...ctx.host.runtime },
+			platform: ctx.host.platform,
+			arch: ctx.host.arch
+		};
+		const result = {
+			id: await postFeedback(ctx.env.PRISMA_CLI_FEEDBACK_URL || DEFAULT_FEEDBACK_ENDPOINT, {
+				message,
+				...email ? { email } : {},
+				meta: { ...context }
+			}, ctx.signal),
+			email: email ?? null,
+			context
+		};
+		return ok(ctx.present({ data: result }, feedbackPresentations(result)));
 	}
 });
 //#endregion
-//#region src/output/patterns.ts
-function serializeList(input) {
-	return {
-		context: input.context,
-		items: input.items.map((item) => ({
-			name: item.label,
-			id: item.id,
-			status: item.status
-		})),
-		count: input.items.length
-	};
+//#region src/adapters/git.ts
+const execFileAsync = promisify(execFile);
+async function readGitOriginRemote(cwd, signal) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"config",
+			"--get",
+			"remote.origin.url"
+		], {
+			cwd,
+			timeout: 5e3,
+			signal
+		});
+		const remote = stdout.trim();
+		return remote.length > 0 ? remote : null;
+	} catch (error) {
+		if (signal?.aborted || isAbortError(error)) throw error;
+		return null;
+	}
 }
-//#endregion
-//#region src/presenters/bucket.ts
-function serializeBucketList(result) {
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+function parseGitHubRepositoryUrl(value) {
+	const input = value.trim();
+	const shorthand = input.match(/^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?$/);
+	if (shorthand) return toGitHubRepositoryReference(shorthand[1], shorthand[2]);
+	let parsed;
+	try {
+		parsed = new URL(input);
+	} catch {
+		return null;
+	}
+	if (parsed.hostname !== "github.com") return null;
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:" && parsed.protocol !== "ssh:") return null;
+	const parts = parsed.pathname.split("/").filter(Boolean);
+	if (parts.length !== 2) return null;
+	const [owner, rawName] = parts;
+	return toGitHubRepositoryReference(owner, rawName.endsWith(".git") ? rawName.slice(0, -4) : rawName);
+}
+function toGitHubRepositoryReference(owner, name) {
+	if (!owner || !name || owner.includes("/") || name.includes("/")) return null;
 	return {
-		context: {
-			project: result.projectName,
-			...result.branchName ? { branch: result.branchName } : {}
-		},
-		items: result.buckets.map((bucket) => ({
-			name: bucket.name,
-			id: bucket.id,
-			status: bucket.status
-		})),
-		count: result.buckets.length,
-		projectId: result.projectId,
-		branchName: result.branchName,
-		buckets: result.buckets
+		provider: "github",
+		owner,
+		name,
+		fullName: `${owner}/${name}`,
+		url: `https://github.com/${owner}/${name}`
 	};
 }
-function serializeBucketKeyList(result) {
+//#endregion
+//#region src/presenters/project.ts
+function serializeProjectList(result) {
 	return {
 		...serializeList({
-			context: { bucket: result.bucketId },
-			items: result.keys.map((key) => ({
-				noun: "key",
-				label: key.name,
-				id: key.id,
+			context: { workspace: result.workspace.name },
+			items: result.projects.map((project) => ({
+				noun: "project",
+				label: project.name,
+				id: project.id,
 				status: null
 			}))
 		}),
-		bucketId: result.bucketId,
-		keys: result.keys
+		localBinding: result.localBinding ?? null
+	};
+}
+function serializeProjectSetup(result) {
+	return result;
+}
+function formatGitConnectionDetail(status) {
+	switch (status) {
+		case "active": return "GitHub branch automation is active for this project.";
+		case "pending": return "GitHub branch automation is pending GitHub App installation.";
+		case "archived": return "GitHub branch automation has been archived for this project.";
+		default: return "GitHub repository is connected, but branch automation is not active.";
+	}
+}
+//#endregion
+//#region src/commands/git/context.ts
+/** Workspace, project and the source-repository client for the
+*  `git *` commands. */
+const projectFlag$2 = flag.string({
+	brief: "Project id or name",
+	placeholder: "id-or-name"
+});
+async function resolveGitContext(ctx, explicitProject, commandName) {
+	const target = await resolvePinnedProject(ctx, await resolveActiveWorkspace(ctx), explicitProject, commandName);
+	return {
+		api: ctx.api,
+		target
+	};
+}
+//#endregion
+//#region src/commands/git/errors.ts
+const GIT_CODE_MAP = {
+	USAGE_ERROR: "GIT.USAGE_ERROR",
+	REPO_PROVIDER_UNSUPPORTED: "GIT.REPO_PROVIDER_UNSUPPORTED",
+	REPO_ALREADY_CONNECTED: "GIT.REPO_ALREADY_CONNECTED",
+	REPO_INSTALLATION_REQUIRED: "GIT.REPO_INSTALLATION_REQUIRED",
+	REPO_NOT_ACCESSIBLE: "GIT.REPO_NOT_ACCESSIBLE",
+	REPO_NOT_CONNECTED: "GIT.REPO_NOT_CONNECTED",
+	REPO_CONNECTION_FAILED: "GIT.REPO_CONNECTION_FAILED"
+};
+/** The project-resolution codes the git commands can raise; they keep
+*  the project group's dotted codes and copy. */
+const PROJECT_CODES$1 = new Set([
+	"PROJECT_NOT_FOUND",
+	"PROJECT_AMBIGUOUS",
+	"PROJECT_SETUP_REQUIRED",
+	"LOCAL_STATE_STALE",
+	"LOCAL_PROJECT_WORKSPACE_MISMATCH"
+]);
+const STALE_INTERACTIVE_SIGN_IN$1 = /, or rerun the command in a TTY to sign in interactively\./g;
+const TRACE_FLAG$1 = /--trace/g;
+/** `--trace` is gone in this CLI; the log level replaces it. Interactive
+*  sign-in is gone too (R-S2b-2), so the legacy offer to rerun in a TTY
+*  describes something this CLI cannot do; `auth login` is the whole remedy. */
+function portFixText$1(fix) {
+	return fix.replace(TRACE_FLAG$1, "--log-level verbose").replace(STALE_INTERACTIVE_SIGN_IN$1, ".");
+}
+/** The install-required and not-accessible errors put the raw install
+*  URL in their nextSteps beside real commands. A URL is not a command,
+*  so it becomes an `open-url` action. */
+function nextStepAction(step) {
+	if (step.startsWith("https://") || step.startsWith("http://")) return {
+		kind: "open-url",
+		label: step,
+		url: step
+	};
+	const command = portCommandString(step);
+	return {
+		kind: "run-command",
+		label: command,
+		command
 	};
 }
-//#endregion
-//#region src/commands/bucket/key-list.ts
-/** The `bucket key list` command. */
-const TITLE$11 = "Listing access keys for bucket.";
-function listPresentations$6(result) {
-	const rows = bucketKeyRows(result.keys);
+function nextActionsFor$1(error) {
+	return [...error.fix ? [{
+		kind: "user-choice",
+		label: portFixText$1(error.fix)
+	}] : [], ...error.nextSteps.map(nextStepAction)];
+}
+/** The legacy errors branch their fix text on whether a browser was
+*  opened. The engine's browser wait always shows the URL, so the
+*  opened branch is the one that describes what this CLI does. */
+const BROWSER_OPENED = true;
+/**
+* The install wait's two terminal outcomes. The legacy constructors own
+* every copy string; the design drops `opened` from the meta they build
+* (`browserWait` does not report it and the URL is always shown), so
+* the structured error is assembled from their fields with the meta
+* d3 §3.8 pins.
+*/
+function installWaitFailedError(repository, installUrl, inspectableInstallationCount) {
+	const legacy = inspectableInstallationCount > 0 ? repoNotAccessibleError(repository, installUrl, BROWSER_OPENED) : repoInstallationRequiredError(repository, installUrl, BROWSER_OPENED);
+	return new CliStructuredError(GIT_CODE_MAP[legacy.code], legacy.summary, {
+		why: legacy.why ?? void 0,
+		meta: {
+			repository: repository.fullName,
+			installUrl
+		},
+		nextActions: nextActionsFor$1(legacy)
+	});
+}
+function mapGitOperationError(error) {
+	if (!(error instanceof CliError)) return null;
+	if (PROJECT_CODES$1.has(error.code)) return mapProjectOperationError(error);
+	return new CliStructuredError(GIT_CODE_MAP[error.code] ?? `GIT.${error.code}`, error.summary, {
+		why: error.why ?? void 0,
+		meta: Object.keys(error.meta).length > 0 ? error.meta : void 0,
+		nextActions: nextActionsFor$1(error)
+	});
+}
+//#endregion
+//#region src/commands/git/connect.ts
+/** The `git connect` command. */
+/** The legacy wait line, printed once before the poll loop. */
+const WAIT_MESSAGE = "Waiting for GitHub App installation or repository access approval...";
+/**
+* The legacy `resolveInstalledRepository`: find the repository in the
+* workspace's GitHub App installations, and when it is not there yet,
+* send the user to an install intent and wait for them to finish. The
+* engine owns the announcement, the browser and the polling clock; this
+* only supplies the address, the cadence and the question being polled.
+*/
+async function resolveInstalledRepository(ctx, api, workspaceId, repository) {
+	const inspect = async (signal) => findRepositoryInInstallations(api, await listScmInstallations(api, workspaceId, signal), repository, signal);
+	const first = await inspect(ctx.signal);
+	if (first.match) return first.match;
+	const installUrl = await createGitHubInstallIntent(api, workspaceId, ctx.signal);
+	let match = null;
+	let inspectableInstallationCount = 0;
+	try {
+		await ctx.prompt.browserWait({
+			url: installUrl,
+			message: WAIT_MESSAGE,
+			timeout: readPositiveIntegerEnv(ctx.env.PRISMA_CLI_GITHUB_INSTALL_TIMEOUT_MS, GITHUB_INSTALL_POLL_TIMEOUT_MS),
+			interval: readPositiveIntegerEnv(ctx.env.PRISMA_CLI_GITHUB_INSTALL_POLL_INTERVAL_MS, GITHUB_INSTALL_POLL_INTERVAL_MS),
+			poll: async (signal) => {
+				const lookup = await inspect(signal);
+				match = lookup.match;
+				inspectableInstallationCount = lookup.inspectableInstallationCount;
+				return lookup.match !== null;
+			}
+		});
+	} catch (error) {
+		if (CliStructuredError.is(error) && error.code === "CLI.BROWSER_WAIT_TIMEOUT") throw installWaitFailedError(repository, installUrl, inspectableInstallationCount);
+		throw error;
+	}
+	if (match === null) throw installWaitFailedError(repository, installUrl, inspectableInstallationCount);
+	return match;
+}
+function connectPresentations(result) {
+	const connection = result.repositoryConnection;
 	return {
+		stdout: () => [],
+		json: () => result,
 		next: () => [],
 		human: () => [
 			{
 				kind: "summary",
-				status: "info",
-				text: TITLE$11
+				status: "ok",
+				text: "Connecting Git to the resolved project."
 			},
 			{
 				kind: "fields",
-				rows: [{
-					label: "bucket",
-					value: result.bucketId
-				}]
+				rows: [
+					{
+						label: "project",
+						value: result.project.name
+					},
+					{
+						label: "workspace",
+						value: result.workspace.name
+					},
+					{
+						label: "repository",
+						value: connection.repository.fullName
+					},
+					{
+						label: "status",
+						value: connection.status
+					}
+				]
 			},
-			...rows.length === 0 ? [{
-				kind: "summary",
-				status: "info",
-				text: "No keys found."
-			}] : [{
-				kind: "table",
-				columns: [
-					"Name",
-					"Id",
-					"Role",
-					"Hint",
-					"Created"
-				],
-				rows
-			}]
-		],
-		stdout: () => rows.map((row) => row.join("	")),
-		json: () => serializeBucketKeyList(result)
+			{
+				kind: "list",
+				items: [formatGitConnectionDetail(connection.status)]
+			}
+		]
 	};
 }
-const bucketKeyListCommand = defineCommand({
-	args: { positionals: { bucketId: bucketPositional } },
+const gitConnectCommand = defineCommand({
+	args: {
+		positionals: { gitUrl: positional.optionalString({
+			brief: "GitHub repository URL",
+			placeholder: "git-url"
+		}) },
+		flags: { project: projectFlag$2 }
+	},
 	help: {
-		summary: "List access keys for a bucket",
-		examples: ["bucket key list bkt_123", "bucket key list bkt_123 --json"]
+		summary: "Connect the resolved project to a GitHub repository",
+		examples: [
+			"git connect",
+			"git connect git@github.com:prisma/prisma-cli.git",
+			"git connect --project proj_123"
+		]
 	},
 	needs: { credentials: true },
 	handler: async (args, ctx) => {
 		try {
-			const bucketId = args.positionals.bucketId.trim();
-			if (!bucketId) throw usageError("Bucket id required", "Bucket key listing needs a bucket id.", "Pass the bucket id.", ["prisma-cli bucket list"], "bucket");
+			const { api, target } = await resolveGitContext(ctx, args.flags.project, "git connect");
+			const remoteUrl = args.positionals.gitUrl ?? await readGitOriginRemote(ctx.cwd, ctx.signal);
+			if (!remoteUrl) throw usageError("Repository connection requires a GitHub repository URL", "No git-url was provided and the local repo does not have an origin remote.", `Pass a GitHub repository URL, or add a GitHub origin remote and rerun ${CLI_NAME} git connect.`, [`${CLI_NAME} git connect git@github.com:prisma/prisma-cli.git`], "project");
+			const repository = parseGitHubRepositoryUrl(remoteUrl);
+			if (!repository) throw unsupportedRepositoryProviderError();
+			const existing = await readFirstSourceRepository(api, target.project.id, ctx.signal);
+			if (existing) {
+				const existingConnection = toRepositoryConnection(existing);
+				if (!repositoryFullNamesMatch(existingConnection.repository.fullName, repository.fullName)) throw repoAlreadyConnectedError(existingConnection.repository.fullName);
+				const idempotent = {
+					...target,
+					repositoryConnection: existingConnection
+				};
+				return ok(ctx.present({ data: idempotent }, connectPresentations(idempotent)));
+			}
+			const installed = await resolveInstalledRepository(ctx, api, target.workspace.id, repository);
+			const { data, error, response } = await api.POST("/v1/source-repositories", {
+				body: {
+					projectId: target.project.id,
+					provider: "github",
+					providerRepositoryId: installed.repository.id,
+					installationId: installed.installation.id
+				},
+				signal: ctx.signal
+			});
+			if (error || !data) throw repoConnectionApiError("Failed to connect GitHub repository", response, error);
 			const result = {
-				bucketId,
-				keys: await resolveBucketProviderOnly(ctx).listKeys(bucketId, { signal: ctx.signal })
+				...target,
+				repositoryConnection: toRepositoryConnection(data.data)
 			};
-			return ok(ctx.present({ data: result }, listPresentations$6(result)));
+			return ok(ctx.present({ data: result }, connectPresentations(result)));
 		} catch (error) {
-			const mapped = mapBucketOperationError(error);
+			const mapped = mapGitOperationError(error);
 			if (mapped) return notOk(mapped);
 			throw error;
 		}
 	}
 });
 //#endregion
-//#region src/commands/bucket/list.ts
-/** The `bucket list` command. */
-const TITLE$10 = "Listing object-store buckets for the resolved project.";
-function listPresentations$5(result) {
-	const rows = bucketRows(result.buckets);
-	const stdoutRows = bucketStdoutRows(result.buckets);
+//#region src/commands/git/disconnect.ts
+/** The `git disconnect` command. */
+function disconnectPresentations(result) {
 	return {
+		stdout: () => [],
+		json: () => result,
 		next: () => [],
 		human: () => [
 			{
 				kind: "summary",
-				status: "info",
-				text: TITLE$10
+				status: "ok",
+				text: "Disconnecting Git from the resolved project."
 			},
 			{
 				kind: "fields",
-				rows: [{
-					label: "project",
-					value: result.projectName
-				}, ...result.branchName ? [{
-					label: "branch",
-					value: result.branchName
-				}] : []]
+				rows: [
+					{
+						label: "project",
+						value: result.project.name
+					},
+					{
+						label: "workspace",
+						value: result.workspace.name
+					},
+					{
+						label: "repository",
+						value: result.repositoryConnection.repository.fullName
+					}
+				]
 			},
-			...rows.length === 0 ? [{
-				kind: "summary",
-				status: "info",
-				text: "No buckets found."
-			}] : [{
-				kind: "table",
-				columns: [
-					"Name",
-					"Id",
-					"Status",
-					"Branch",
-					"Created"
-				],
-				rows
-			}]
-		],
-		stdout: () => stdoutRows.map((row) => row.join("	")),
-		json: () => serializeBucketList(result)
+			{
+				kind: "list",
+				items: ["GitHub branch automation is no longer active for this project."]
+			}
+		]
 	};
 }
-const bucketListCommand = defineCommand({
-	args: { flags: {
-		project: projectFlag$3,
-		branch: branchFlag$2
-	} },
+const gitDisconnectCommand = defineCommand({
+	args: { flags: { project: projectFlag$2 } },
 	help: {
-		summary: "List object-store buckets for the resolved project",
-		examples: [
-			"bucket list",
-			"bucket list --branch preview",
-			"bucket list --json"
-		]
+		summary: "Disconnect the GitHub repository from the resolved project",
+		examples: ["git disconnect", "git disconnect --project proj_123"]
 	},
 	needs: { credentials: true },
 	handler: async (args, ctx) => {
 		try {
-			const { provider, projectId, projectName } = await resolveBucketContext(ctx, args.flags, "bucket list");
-			const buckets = await provider.listBuckets({
-				projectId,
-				branchName: args.flags.branch,
+			const { api, target } = await resolveGitContext(ctx, args.flags.project, "git disconnect");
+			const existing = await readFirstSourceRepository(api, target.project.id, ctx.signal);
+			if (!existing) throw repoNotConnectedError();
+			const { error, response } = await api.DELETE("/v1/source-repositories/{id}", {
+				params: { path: { id: existing.id } },
 				signal: ctx.signal
 			});
+			if (error) throw repoConnectionApiError("Failed to disconnect GitHub repository", response, error);
 			const result = {
-				projectId,
-				projectName,
-				branchName: args.flags.branch ?? null,
-				buckets
+				...target,
+				repositoryConnection: toRepositoryConnection(existing)
 			};
-			return ok(ctx.present({ data: result }, listPresentations$5(result)));
-		} catch (error) {
-			const mapped = mapBucketOperationError(error);
-			if (mapped) return notOk(mapped);
-			throw error;
-		}
-	}
-});
-//#endregion
-//#region src/lib/feedback.ts
-const FEEDBACK_TIMEOUT_MS = 3e3;
-const TIMEOUT_DETAIL = `The feedback service did not answer within ${FEEDBACK_TIMEOUT_MS / 1e3} seconds.`;
-function isTimeout(error) {
-	return error instanceof Error && error.name === "TimeoutError";
-}
-function unreachableDetail(error) {
-	if (isTimeout(error)) return TIMEOUT_DETAIL;
-	return `The feedback service could not be reached${error instanceof Error && error.cause instanceof Error ? ` (${error.cause.message})` : ""}.`;
-}
-function unreadableBodyDetail(error) {
-	return isTimeout(error) ? TIMEOUT_DETAIL : "The feedback service response could not be read.";
-}
+			return ok(ctx.present({ data: result }, disconnectPresentations(result)));
+		} catch (error) {
+			const mapped = mapGitOperationError(error);
+			if (mapped) return notOk(mapped);
+			throw error;
+		}
+	}
+});
 //#endregion
-//#region src/lib/version.ts
-const requireFromHere = createRequire(import.meta.url);
-/** The bundled entry sits one directory below the package root
-*  (`dist/cli.js`); this source file sits two below (`src/lib/`). Both
-*  are tried, nearest first, so the same code serves either. */
-const PACKAGE_JSON_CANDIDATES = ["../package.json", "../../package.json"];
-function readPackageMetadata() {
-	for (const candidate of PACKAGE_JSON_CANDIDATES) try {
-		const metadata = requireFromHere(candidate);
-		if (metadata.version) return metadata;
-	} catch {}
-	return {};
+//#region src/lib/skills/sync.ts
+/**
+* Brings the harness skill directories in line with the installed
+* source packages: copies each skill tree whose stamp does not match
+* the package it came from, and removes copies whose source package is
+* gone. A target directory that exists but is not this CLI's copy is
+* refused, never replaced. Doing nothing is the normal outcome and is
+* not an error.
+*/
+async function syncSkills(status) {
+	const synced = [];
+	const refused = [];
+	for (const skill of status.skills) {
+		const dirs = skill.targets.filter((target) => target.state === "stale" || target.state === "absent").map((target) => target.dir);
+		const refusedDirs = skill.targets.filter((target) => target.state === "unmanaged").map((target) => target.dir);
+		if (refusedDirs.length > 0) refused.push({
+			skill: skill.skill,
+			dirs: refusedDirs
+		});
+		for (const target of skill.targets) if (target.state === "synced") await removeOldCliGitignore(path.join(status.projectRoot, target.dir, skill.skill, ".gitignore"));
+		if (dirs.length === 0) continue;
+		for (const dir of dirs) await replaceTree(skill.sourceDir, path.join(status.projectRoot, dir, skill.skill));
+		synced.push({
+			skill: skill.skill,
+			library: skill.library,
+			version: skill.version,
+			dirs
+		});
+	}
+	const pruned = [];
+	for (const orphan of status.orphans) {
+		for (const dir of orphan.dirs) await rm(path.join(status.projectRoot, dir, orphan.skill), {
+			recursive: true,
+			force: true
+		});
+		pruned.push({
+			skill: orphan.skill,
+			library: orphan.library,
+			dirs: orphan.dirs
+		});
+	}
+	return {
+		projectRoot: status.projectRoot,
+		packages: status.packages,
+		synced,
+		pruned,
+		refused,
+		checkDisabled: status.checkDisabled
+	};
 }
-function getCliVersion() {
-	const pkg = readPackageMetadata();
-	if (!pkg.version) throw new Error("CLI version metadata is missing from the installed package: the bundled package.json could not be read or did not contain a version field. Reinstall the CLI from the npm registry, or check your install path is intact.");
-	return pkg.version;
+const OLD_CLI_GITIGNORE = /^\*\r?\n?$/;
+async function removeOldCliGitignore(file) {
+	let content;
+	try {
+		content = await readFile(file, "utf8");
+	} catch {
+		return;
+	}
+	if (OLD_CLI_GITIGNORE.test(content)) await rm(file, { force: true });
 }
-function getCliName() {
-	return CLI_NAME;
+/**
+* Copies a skill tree over whatever is at the destination, so a skill
+* that lost a reference file between versions does not keep the stale
+* one. Files are read and written rather than handed to `fs.cp`,
+* because under Yarn PnP the source lives inside a zip and only the
+* patched read path can see it.
+*/
+async function replaceTree(source, destination) {
+	await rm(destination, {
+		recursive: true,
+		force: true
+	});
+	await copyTree(source, destination);
+}
+async function copyTree(source, destination) {
+	await mkdir(destination, { recursive: true });
+	for (const entry of await readdir(source, { withFileTypes: true })) {
+		const from = path.join(source, entry.name);
+		const to = path.join(destination, entry.name);
+		if (entry.isDirectory()) {
+			await copyTree(from, to);
+			continue;
+		}
+		if (entry.isFile() || entry.isSymbolicLink()) await writeFile(to, await readFile(from));
+	}
 }
 //#endregion
-//#region src/commands/feedback.ts
-const DEFAULT_FEEDBACK_ENDPOINT = "https://hiieirp2pwqnjvq9axzyg6d0.fra.prisma.build/feedback";
-const MAX_MESSAGE_LENGTH = 4e3;
-const MAX_EMAIL_LENGTH = 320;
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function sendFailedError(detail) {
-	return new CliStructuredError("FEEDBACK.SEND_FAILED", "Feedback could not be delivered", {
-		why: detail,
-		nextActions: [{
-			kind: "user-choice",
-			label: "Check your network and rerun."
-		}]
-	});
-}
-function messageRequiredError() {
-	return new CliStructuredError("FEEDBACK.MESSAGE_REQUIRED", "Feedback message required", {
-		why: "The message argument is empty.",
-		nextActions: [{
-			kind: "user-choice",
-			label: "Pass a non-empty message."
-		}, {
-			kind: "run-command",
-			label: "Send feedback",
-			command: `${CLI_NAME} feedback "the deploy flow is great"`
-		}]
-	});
-}
-function messageTooLongError(length) {
-	return new CliStructuredError("FEEDBACK.MESSAGE_TOO_LONG", "Feedback message too long", {
-		why: `The message is ${length} characters; the limit is ${MAX_MESSAGE_LENGTH}.`,
-		nextActions: [{
-			kind: "user-choice",
-			label: "Shorten the message."
-		}]
-	});
-}
-function emailInvalidError(value) {
-	return new CliStructuredError("FEEDBACK.EMAIL_INVALID", "Invalid email", {
-		why: `"${value}" is not a valid email address of at most ${MAX_EMAIL_LENGTH} characters.`,
-		nextActions: [{
-			kind: "user-choice",
-			label: "Pass a valid address with --email, or drop the flag to stay anonymous."
+//#region src/commands/skills/presentation.ts
+function projectFields(projectRoot, checkDisabled) {
+	return {
+		kind: "fields",
+		rows: [{
+			label: "project",
+			value: projectRoot
 		}, {
-			kind: "run-command",
-			label: "Send feedback with a contact address",
-			command: `${CLI_NAME} feedback "please add X" --email you@example.com`
+			label: "check",
+			value: checkDisabled ? "disabled" : "enabled"
 		}]
-	});
+	};
 }
-function feedbackPresentations(result) {
+/** Decision B: "up to date" may not over-claim — when directories were
+*  refused, the summary says so in the same line, for sync and list
+*  alike. */
+function unmanagedClause(count) {
+	if (count === 0) return "";
+	return count === 1 ? "; 1 directory is not managed by this CLI" : `; ${count} directories are not managed by this CLI`;
+}
+function syncSummary(result) {
+	if (result.agents.length === 0) return "No agents are configured for skills.";
+	if (result.packages.length === 0) return "No Prisma packages with agent skills are installed.";
+	const refusedDirs = result.refused.reduce((count, skill) => count + skill.dirs.length, 0);
+	if (result.synced.length === 0 && result.pruned.length === 0) return `Agent skills are up to date${unmanagedClause(refusedDirs)}.`;
+	const synced = `${result.synced.length} skill${result.synced.length === 1 ? "" : "s"}`;
+	return `${result.pruned.length === 0 ? `Synced ${synced}` : `Synced ${synced} and removed ${result.pruned.length}`}${unmanagedClause(refusedDirs)}.`;
+}
+function syncPresentations(result) {
+	const syncedRows = result.synced.map((skill) => [
+		skill.skill,
+		skill.library,
+		skill.version,
+		skill.dirs.join(", ")
+	]);
+	const prunedRows = result.pruned.map((skill) => [skill.skill, skill.dirs.join(", ")]);
+	const refusedRows = result.refused.map((skill) => [skill.skill, skill.dirs.join(", ")]);
 	return {
-		stdout: () => [],
 		json: () => result,
 		next: () => [],
-		human: () => [{
-			kind: "summary",
-			status: "ok",
-			text: "Feedback sent. Thank you!"
-		}, {
-			kind: "fields",
-			rows: [
-				...result.id ? [{
-					label: "id",
-					value: result.id
-				}] : [],
-				{
-					label: "sent as",
-					value: result.email ?? "anonymous"
-				},
-				{
-					label: "included",
-					value: `CLI ${result.context.cliVersion}, ${result.context.runtime.name} ${result.context.runtime.version}, ${result.context.platform} ${result.context.arch}`
-				}
-			]
-		}]
+		human: () => [
+			{
+				kind: "summary",
+				status: result.synced.length > 0 ? "ok" : "info",
+				text: syncSummary(result)
+			},
+			projectFields(result.projectRoot, result.checkDisabled),
+			...syncedRows.length === 0 ? [] : [{
+				kind: "table",
+				columns: [
+					"Skill",
+					"Package",
+					"Version",
+					"Installed into"
+				],
+				rows: syncedRows
+			}],
+			...prunedRows.length === 0 ? [] : [{
+				kind: "table",
+				columns: ["Removed skill", "Removed from"],
+				rows: prunedRows
+			}],
+			...refusedRows.length === 0 ? [] : [{
+				kind: "table",
+				columns: ["Unmanaged skill", "Left untouched in"],
+				rows: refusedRows
+			}]
+		],
+		stdout: () => syncedRows.map((row) => row.join("	"))
 	};
 }
-async function readServiceError(response, signal) {
-	let payload;
-	try {
-		payload = await response.json();
-	} catch (error) {
-		if (signal.aborted) throw error;
-		return "";
-	}
-	return typeof payload?.error?.message === "string" ? ` (${payload.error.message})` : "";
+function listSummary(result) {
+	if (result.agents.length === 0) return "No agents are configured for skills.";
+	if (result.skills.length === 0) return "No Prisma agent skills are available to sync.";
+	if (!result.upToDate) return "Agent skills are out of date.";
+	const unmanaged = result.skills.flatMap((skill) => skill.targets).filter((target) => target.state === "unmanaged").length;
+	return `Agent skills are up to date${unmanagedClause(unmanaged)}.`;
 }
-async function sendFeedback(endpoint, body, signal) {
-	try {
-		return await fetch(endpoint, {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				"user-agent": `${CLI_NAME}/${getCliVersion()}`
+function listPresentations$5(result) {
+	const rows = result.skills.flatMap((skill) => skill.targets.map((target) => [
+		skill.skill,
+		skill.library,
+		skill.version,
+		target.dir,
+		target.syncedVersion ?? "-",
+		target.state
+	]));
+	return {
+		json: () => result,
+		next: () => [],
+		human: () => [
+			{
+				kind: "summary",
+				status: "info",
+				text: listSummary(result)
 			},
-			body: JSON.stringify(body),
-			signal: AbortSignal.any([signal, AbortSignal.timeout(FEEDBACK_TIMEOUT_MS)])
-		});
-	} catch (error) {
-		if (signal.aborted) throw error;
-		throw sendFailedError(unreachableDetail(error));
-	}
+			projectFields(result.projectRoot, result.checkDisabled),
+			...rows.length === 0 ? [] : [{
+				kind: "table",
+				columns: [
+					"Skill",
+					"Package",
+					"Installed",
+					"Directory",
+					"Synced",
+					"State"
+				],
+				rows
+			}]
+		],
+		stdout: () => rows.map((row) => row.join("	"))
+	};
 }
-async function readSubmissionId(response, signal) {
-	let payload;
-	try {
-		payload = await response.json();
-	} catch (error) {
-		if (signal.aborted) throw error;
-		if (!(error instanceof SyntaxError)) throw sendFailedError(unreadableBodyDetail(error));
-		payload = null;
-	}
-	return typeof payload?.id === "string" ? payload.id : null;
+//#endregion
+//#region src/commands/skills/sync.ts
+function packageReports(packages) {
+	return packages.map((installed) => ({
+		package: installed.name,
+		version: installed.version,
+		conflictingVersions: installed.conflictingVersions
+	}));
 }
-async function postFeedback(endpoint, body, signal) {
-	const response = await sendFeedback(endpoint, body, signal);
-	if (!response.ok) throw sendFailedError(`The feedback service responded with HTTP ${response.status}${await readServiceError(response, signal)}.`);
-	return readSubmissionId(response, signal);
+/** Workspace members that pin different versions of the same
+*  skill-bearing package: the highest wins, and the user hears about
+*  it, because the losing members get a skill describing a version
+*  they did not install. */
+function versionConflictDiagnostics(packages) {
+	return packages.filter((installed) => installed.conflictingVersions.length > 1).map((installed) => ({
+		code: "SKILLS.VERSION_CONFLICT",
+		severity: "warn",
+		summary: `Workspace members install different versions of ${installed.name} (${installed.conflictingVersions.join(", ")}); the skills for ${installed.version} were installed.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: `Pin one version of ${installed.name} across the workspace.`
+		}]
+	}));
 }
-const feedbackCommand = defineCommand({
-	help: {
-		summary: "Send feedback to the Prisma CLI team",
-		description: "Anonymous unless --email is passed. Every submission includes the CLI\nversion, node version, and OS platform/arch, and nothing else.",
-		examples: ["feedback \"the deploy flow is great\"", "feedback \"please add X\" --email you@example.com"]
-	},
-	args: {
-		flags: { email: flag.string({
-			brief: "Contact email if you want a reply; feedback is anonymous without it",
-			placeholder: "address"
-		}) },
-		positionals: { message: positional.string({
-			brief: "Feedback text (up to 4000 characters)",
-			placeholder: "message"
-		}) }
-	},
-	handler: async (args, ctx) => {
-		const message = args.positionals.message.trim();
-		if (!message) throw messageRequiredError();
-		if (message.length > MAX_MESSAGE_LENGTH) throw messageTooLongError(message.length);
-		const email = args.flags.email?.trim();
-		if (email !== void 0 && (email.length > MAX_EMAIL_LENGTH || !EMAIL_PATTERN.test(email))) throw emailInvalidError(args.flags.email ?? "");
-		const context = {
-			cliVersion: getCliVersion(),
-			runtime: { ...ctx.host.runtime },
-			platform: ctx.host.platform,
-			arch: ctx.host.arch
-		};
-		const result = {
-			id: await postFeedback(ctx.env.PRISMA_CLI_FEEDBACK_URL || DEFAULT_FEEDBACK_ENDPOINT, {
-				message,
-				...email ? { email } : {},
-				meta: { ...context }
-			}, ctx.signal),
-			email: email ?? null,
-			context
-		};
-		return ok(ctx.present({ data: result }, feedbackPresentations(result)));
-	}
-});
-//#endregion
-//#region src/adapters/git.ts
-const execFileAsync = promisify(execFile);
-async function readGitOriginRemote(cwd, signal) {
-	try {
-		const { stdout } = await execFileAsync("git", [
-			"config",
-			"--get",
-			"remote.origin.url"
-		], {
-			cwd,
-			timeout: 5e3,
-			signal
-		});
-		const remote = stdout.trim();
-		return remote.length > 0 ? remote : null;
-	} catch (error) {
-		if (signal?.aborted || isAbortError(error)) throw error;
-		return null;
-	}
+/** Target directories that already hold a skill this CLI does not
+*  manage: sync leaves them alone, and the user hears why the packaged
+*  skill was not installed there. */
+function unmanagedDirectoryDiagnostics(refused) {
+	return refused.flatMap((entry) => entry.dirs.map((dir) => ({
+		code: "SKILLS.UNMANAGED_DIRECTORY",
+		severity: "warn",
+		summary: `${dir}/${entry.skill} is not managed by this CLI, so it was left untouched.`,
+		nextActions: [{
+			kind: "user-choice",
+			label: `Move or remove ${dir}/${entry.skill}, then rerun skills sync to install the packaged skill.`
+		}]
+	})));
 }
-function isAbortError(error) {
-	return error instanceof Error && error.name === "AbortError";
+function bothSwitchesError() {
+	return new CliStructuredError("CLI.INVALID_ARGUMENTS", "--disable and --enable ask for opposite things, so only one may be given.", { nextActions: [{
+		kind: "user-choice",
+		label: "Run with --disable to silence the skills check, or --enable to restore it."
+	}] });
 }
-function parseGitHubRepositoryUrl(value) {
-	const input = value.trim();
-	const shorthand = input.match(/^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?$/);
-	if (shorthand) return toGitHubRepositoryReference(shorthand[1], shorthand[2]);
-	let parsed;
-	try {
-		parsed = new URL(input);
-	} catch {
-		return null;
+const skillsSyncCommand = defineCommand({
+	help: {
+		summary: "Copy the agent skills from installed Prisma packages into this project",
+		description: "Skills come from the Prisma packages the project installs, so they always describe the version in use. Sync copies them into the skill directories the agent harnesses read, and removes copies whose package is gone. It does nothing, and exits 0, when everything is already current.",
+		examples: ["skills sync", "skills sync --disable"]
+	},
+	needs: { config: skillsConfigSection },
+	args: { flags: {
+		disable: flag.boolean({ brief: "Stop other commands reporting out-of-date skills in this project" }),
+		enable: flag.boolean({ brief: "Undo --disable for this project" })
+	} },
+	handler: async (args, ctx) => {
+		if (args.flags.disable && args.flags.enable) return notOk(bothSwitchesError());
+		const outcome = await syncSkills(await readSkillsStatus(ctx.cwd, { agents: ctx.config.agents }));
+		let optedOut = outcome.checkDisabled;
+		if (args.flags.disable || args.flags.enable) {
+			optedOut = args.flags.disable;
+			await writeSkillsCheckDisabled(outcome.projectRoot, optedOut);
+		}
+		const checkDisabled = optedOut || !ctx.config.check;
+		const result = {
+			projectRoot: outcome.projectRoot,
+			agents: ctx.config.agents,
+			packages: packageReports(outcome.packages),
+			synced: outcome.synced,
+			pruned: outcome.pruned,
+			refused: outcome.refused,
+			checkDisabled
+		};
+		return ok(ctx.present({
+			data: result,
+			diagnostics: [...versionConflictDiagnostics(outcome.packages), ...unmanagedDirectoryDiagnostics(outcome.refused)]
+		}, syncPresentations(result)));
 	}
-	if (parsed.hostname !== "github.com") return null;
-	if (parsed.protocol !== "https:" && parsed.protocol !== "http:" && parsed.protocol !== "ssh:") return null;
-	const parts = parsed.pathname.split("/").filter(Boolean);
-	if (parts.length !== 2) return null;
-	const [owner, rawName] = parts;
-	return toGitHubRepositoryReference(owner, rawName.endsWith(".git") ? rawName.slice(0, -4) : rawName);
+});
+//#endregion
+//#region src/commands/init.ts
+const POSTINSTALL_SCRIPT = "prisma skills sync || exit 0";
+function summary(status, text) {
+	return {
+		kind: "summary",
+		status,
+		text
+	};
 }
-function toGitHubRepositoryReference(owner, name) {
-	if (!owner || !name || owner.includes("/") || name.includes("/")) return null;
+const APPEND_ADVICE = {
+	kind: "user-choice",
+	label: `Append "${POSTINSTALL_SCRIPT}" to your postinstall script yourself to resync the skills on every install.`
+};
+function noPackageJsonDiagnostic() {
 	return {
-		provider: "github",
-		owner,
-		name,
-		fullName: `${owner}/${name}`,
-		url: `https://github.com/${owner}/${name}`
+		code: "INIT.NO_PACKAGE_JSON",
+		severity: "warn",
+		summary: "There is no package.json in this directory, so the postinstall hook was not added.",
+		nextActions: [{
+			kind: "user-choice",
+			label: `Run ${CLI_NAME} init from the directory that holds your package.json.`
+		}]
 	};
 }
-//#endregion
-//#region src/presenters/project.ts
-function serializeProjectList(result) {
+function unreadablePackageJsonDiagnostic() {
 	return {
-		...serializeList({
-			context: { workspace: result.workspace.name },
-			items: result.projects.map((project) => ({
-				noun: "project",
-				label: project.name,
-				id: project.id,
-				status: null
-			}))
-		}),
-		localBinding: result.localBinding ?? null
+		code: "INIT.PACKAGE_JSON_UNREADABLE",
+		severity: "warn",
+		summary: "package.json could not be parsed, so the postinstall hook was not added.",
+		nextActions: [APPEND_ADVICE]
 	};
 }
-function serializeProjectSetup(result) {
-	return result;
+function unwritablePackageJsonDiagnostic() {
+	return {
+		code: "INIT.PACKAGE_JSON_UNWRITABLE",
+		severity: "warn",
+		summary: "package.json could not be written, so the postinstall hook was not added.",
+		nextActions: [APPEND_ADVICE]
+	};
 }
-function formatGitConnectionDetail(status) {
-	switch (status) {
-		case "active": return "GitHub branch automation is active for this project.";
-		case "pending": return "GitHub branch automation is pending GitHub App installation.";
-		case "archived": return "GitHub branch automation has been archived for this project.";
-		default: return "GitHub repository is connected, but branch automation is not active.";
-	}
+function scriptsNotAnObjectDiagnostic() {
+	return {
+		code: "INIT.SCRIPTS_NOT_AN_OBJECT",
+		severity: "warn",
+		summary: "The scripts field in package.json is not an object, so init left it alone.",
+		nextActions: [APPEND_ADVICE]
+	};
 }
-//#endregion
-//#region src/commands/git/context.ts
-/** Workspace, project and the source-repository client for the
-*  `git *` commands. */
-const projectFlag$2 = flag.string({
-	brief: "Project id or name",
-	placeholder: "id-or-name"
-});
-async function resolveGitContext(ctx, explicitProject, commandName) {
-	const target = await resolvePinnedProject(ctx, await resolveActiveWorkspace(ctx), explicitProject, commandName);
+function foreignPostinstallDiagnostic() {
 	return {
-		api: ctx.api,
-		target
+		code: "INIT.POSTINSTALL_KEPT",
+		severity: "warn",
+		summary: "package.json already has a postinstall script, so init left it alone.",
+		nextActions: [APPEND_ADVICE]
 	};
 }
-//#endregion
-//#region src/commands/git/errors.ts
-const GIT_CODE_MAP = {
-	USAGE_ERROR: "GIT.USAGE_ERROR",
-	REPO_PROVIDER_UNSUPPORTED: "GIT.REPO_PROVIDER_UNSUPPORTED",
-	REPO_ALREADY_CONNECTED: "GIT.REPO_ALREADY_CONNECTED",
-	REPO_INSTALLATION_REQUIRED: "GIT.REPO_INSTALLATION_REQUIRED",
-	REPO_NOT_ACCESSIBLE: "GIT.REPO_NOT_ACCESSIBLE",
-	REPO_NOT_CONNECTED: "GIT.REPO_NOT_CONNECTED",
-	REPO_CONNECTION_FAILED: "GIT.REPO_CONNECTION_FAILED"
-};
-/** The project-resolution codes the git commands can raise; they keep
-*  the project group's dotted codes and copy. */
-const PROJECT_CODES$1 = new Set([
-	"PROJECT_NOT_FOUND",
-	"PROJECT_AMBIGUOUS",
-	"PROJECT_SETUP_REQUIRED",
-	"LOCAL_STATE_STALE",
-	"LOCAL_PROJECT_WORKSPACE_MISMATCH"
-]);
-const STALE_INTERACTIVE_SIGN_IN$1 = /, or rerun the command in a TTY to sign in interactively\./g;
-const TRACE_FLAG$1 = /--trace/g;
-/** `--trace` is gone in this CLI; the log level replaces it. Interactive
-*  sign-in is gone too (R-S2b-2), so the legacy offer to rerun in a TTY
-*  describes something this CLI cannot do; `auth login` is the whole remedy. */
-function portFixText$1(fix) {
-	return fix.replace(TRACE_FLAG$1, "--log-level verbose").replace(STALE_INTERACTIVE_SIGN_IN$1, ".");
+function configSnippet(agents) {
+	return `skills: { agents: [${agents.map((agent) => `"${agent}"`).join(", ")}] }`;
 }
-/** The install-required and not-accessible errors put the raw install
-*  URL in their nextSteps beside real commands. A URL is not a command,
-*  so it becomes an `open-url` action. */
-function nextStepAction(step) {
-	if (step.startsWith("https://") || step.startsWith("http://")) return {
-		kind: "open-url",
-		label: step,
-		url: step
+/** The same never-touch discipline as the postinstall step's
+*  foreign-script rule: a prisma.config.ts the user already has is
+*  theirs, and init only says what to add. */
+function configKeptDiagnostic(agents) {
+	return {
+		code: "INIT.CONFIG_KEPT",
+		severity: "warn",
+		summary: "prisma.config.ts already exists, so init left it alone instead of writing the skills section.",
+		nextActions: [{
+			kind: "user-choice",
+			label: `Add ${configSnippet(agents)} to the object passed to definePrismaConfig in prisma.config.ts.`
+		}]
 	};
-	const command = portCommandString(step);
+}
+function configUnwritableDiagnostic(agents) {
 	return {
-		kind: "run-command",
-		label: command,
-		command
+		code: "INIT.CONFIG_UNWRITABLE",
+		severity: "warn",
+		summary: "prisma.config.ts could not be written, so init skipped it.",
+		nextActions: [{
+			kind: "user-choice",
+			label: `Create a prisma.config.ts whose definePrismaConfig call carries ${configSnippet(agents)}.`
+		}]
 	};
 }
-function nextActionsFor$1(error) {
-	return [...error.fix ? [{
-		kind: "user-choice",
-		label: portFixText$1(error.fix)
-	}] : [], ...error.nextSteps.map(nextStepAction)];
+function skillsSyncFailedDiagnostic(cause) {
+	return {
+		code: "INIT.SKILLS_SYNC_FAILED",
+		severity: "warn",
+		summary: `The agent skills could not be synced: ${cause instanceof Error ? cause.message : String(cause)}`,
+		nextActions: [{
+			kind: "run-command",
+			label: "Retry the sync on its own",
+			command: `${CLI_NAME} skills sync`
+		}]
+	};
 }
-/** The legacy errors branch their fix text on whether a browser was
-*  opened. The engine's browser wait always shows the URL, so the
-*  opened branch is the one that describes what this CLI does. */
-const BROWSER_OPENED = true;
-/**
-* The install wait's two terminal outcomes. The legacy constructors own
-* every copy string; the design drops `opened` from the meta they build
-* (`browserWait` does not report it and the URL is always shown), so
-* the structured error is assembled from their fields with the meta
-* d3 §3.8 pins.
-*/
-function installWaitFailedError(repository, installUrl, inspectableInstallationCount) {
-	const legacy = inspectableInstallationCount > 0 ? repoNotAccessibleError(repository, installUrl, BROWSER_OPENED) : repoInstallationRequiredError(repository, installUrl, BROWSER_OPENED);
-	return new CliStructuredError(GIT_CODE_MAP[legacy.code], legacy.summary, {
-		why: legacy.why ?? void 0,
-		meta: {
-			repository: repository.fullName,
-			installUrl
+const FIRST_INDENT = /\n([ \t]+)"/;
+/** The indentation the file already uses, so the rewrite matches it. */
+function detectIndent(source) {
+	return FIRST_INDENT.exec(source)?.[1] ?? "  ";
+}
+const BOM = "";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseManifestObject(source) {
+	try {
+		const parsed = JSON.parse(source);
+		return isPlainObject(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function renderManifest(manifest, source, bom, crlf) {
+	let rewritten = JSON.stringify(manifest, null, detectIndent(source));
+	if (crlf) rewritten = rewritten.replaceAll("\n", "\r\n");
+	const eol = crlf ? "\r\n" : "\n";
+	return `${bom}${rewritten}${source.endsWith("\n") ? eol : ""}`;
+}
+async function addPostinstallHook(cwd) {
+	const manifestPath = path.join(cwd, "package.json");
+	let raw;
+	try {
+		raw = await readFile(manifestPath, "utf8");
+	} catch {
+		return {
+			report: {
+				outcome: "skipped",
+				script: null
+			},
+			line: summary("warn", "No package.json here; postinstall hook skipped."),
+			diagnostics: [noPackageJsonDiagnostic()]
+		};
+	}
+	const bom = raw.startsWith(BOM) ? BOM : "";
+	const source = bom === "" ? raw : raw.slice(1);
+	const crlf = source.includes("\r\n");
+	const manifest = parseManifestObject(source);
+	if (manifest === null) return {
+		report: {
+			outcome: "skipped",
+			script: null
 		},
-		nextActions: nextActionsFor$1(legacy)
-	});
+		line: summary("warn", "package.json could not be parsed; postinstall hook skipped."),
+		diagnostics: [unreadablePackageJsonDiagnostic()]
+	};
+	if (manifest.scripts !== void 0 && !isPlainObject(manifest.scripts)) return {
+		report: {
+			outcome: "kept",
+			script: null
+		},
+		line: summary("warn", "The scripts field in package.json is not an object; left untouched."),
+		diagnostics: [scriptsNotAnObjectDiagnostic()]
+	};
+	const scripts = manifest.scripts ?? {};
+	const existing = scripts.postinstall;
+	if (existing === "prisma skills sync || exit 0") return {
+		report: {
+			outcome: "exists",
+			script: POSTINSTALL_SCRIPT
+		},
+		line: summary("info", "The postinstall hook is already in package.json."),
+		diagnostics: []
+	};
+	if (existing !== void 0) return {
+		report: {
+			outcome: "kept",
+			script: typeof existing === "string" ? existing : null
+		},
+		line: summary("warn", "package.json has its own postinstall script; left untouched."),
+		diagnostics: [foreignPostinstallDiagnostic()]
+	};
+	manifest.scripts = {
+		...scripts,
+		postinstall: POSTINSTALL_SCRIPT
+	};
+	try {
+		await writeFile(manifestPath, renderManifest(manifest, source, bom, crlf), "utf8");
+	} catch {
+		return {
+			report: {
+				outcome: "skipped",
+				script: null
+			},
+			line: summary("warn", "package.json could not be written; postinstall hook skipped."),
+			diagnostics: [unwritablePackageJsonDiagnostic()]
+		};
+	}
+	return {
+		report: {
+			outcome: "added",
+			script: POSTINSTALL_SCRIPT
+		},
+		line: summary("ok", `Added "postinstall": "${POSTINSTALL_SCRIPT}" to package.json.`),
+		diagnostics: []
+	};
 }
-function mapGitOperationError(error) {
-	if (!(error instanceof CliError)) return null;
-	if (PROJECT_CODES$1.has(error.code)) return mapProjectOperationError(error);
-	return new CliStructuredError(GIT_CODE_MAP[error.code] ?? `GIT.${error.code}`, error.summary, {
-		why: error.why ?? void 0,
-		meta: Object.keys(error.meta).length > 0 ? error.meta : void 0,
-		nextActions: nextActionsFor$1(error)
-	});
+/** What the scaffold contains: the effective agents list, spelled the
+*  way a user would write it by hand. */
+function renderConfigScaffold(agents) {
+	return [
+		"import { definePrismaConfig } from \"prisma/config\";",
+		"",
+		"export default definePrismaConfig({",
+		"  skills: {",
+		`    agents: [${agents.map((agent) => `"${agent}"`).join(", ")}],`,
+		"  },",
+		"});",
+		""
+	].join("\n");
 }
-//#endregion
-//#region src/commands/git/connect.ts
-/** The `git connect` command. */
-/** The legacy wait line, printed once before the poll loop. */
-const WAIT_MESSAGE = "Waiting for GitHub App installation or repository access approval...";
-/**
-* The legacy `resolveInstalledRepository`: find the repository in the
-* workspace's GitHub App installations, and when it is not there yet,
-* send the user to an install intent and wait for them to finish. The
-* engine owns the announcement, the browser and the polling clock; this
-* only supplies the address, the cadence and the question being polled.
-*/
-async function resolveInstalledRepository(ctx, api, workspaceId, repository) {
-	const inspect = async (signal) => findRepositoryInInstallations(api, await listScmInstallations(api, workspaceId, signal), repository, signal);
-	const first = await inspect(ctx.signal);
-	if (first.match) return first.match;
-	const installUrl = await createGitHubInstallIntent(api, workspaceId, ctx.signal);
-	let match = null;
-	let inspectableInstallationCount = 0;
+async function scaffoldConfigStep(cwd, agents, agentsConfigured) {
+	const configPath = path.join(cwd, "prisma.config.ts");
+	let existing = null;
 	try {
-		await ctx.prompt.browserWait({
-			url: installUrl,
-			message: WAIT_MESSAGE,
-			timeout: readPositiveIntegerEnv(ctx.env.PRISMA_CLI_GITHUB_INSTALL_TIMEOUT_MS, GITHUB_INSTALL_POLL_TIMEOUT_MS),
-			interval: readPositiveIntegerEnv(ctx.env.PRISMA_CLI_GITHUB_INSTALL_POLL_INTERVAL_MS, GITHUB_INSTALL_POLL_INTERVAL_MS),
-			poll: async (signal) => {
-				const lookup = await inspect(signal);
-				match = lookup.match;
-				inspectableInstallationCount = lookup.inspectableInstallationCount;
-				return lookup.match !== null;
-			}
+		existing = await readFile(configPath, "utf8");
+	} catch {
+		existing = null;
+	}
+	if (existing !== null) return {
+		report: {
+			outcome: "exists",
+			agents: null
+		},
+		line: agentsConfigured ? summary("info", "prisma.config.ts already configures skills.agents.") : summary("warn", "prisma.config.ts already exists; left untouched."),
+		diagnostics: agentsConfigured ? [] : [configKeptDiagnostic(agents)]
+	};
+	try {
+		await writeFile(configPath, renderConfigScaffold(agents), {
+			encoding: "utf8",
+			flag: "wx"
 		});
-	} catch (error) {
-		if (CliStructuredError.is(error) && error.code === "CLI.BROWSER_WAIT_TIMEOUT") throw installWaitFailedError(repository, installUrl, inspectableInstallationCount);
-		throw error;
+	} catch {
+		return {
+			report: {
+				outcome: "skipped",
+				agents: null
+			},
+			line: summary("warn", "prisma.config.ts could not be written; skipped."),
+			diagnostics: [configUnwritableDiagnostic(agents)]
+		};
 	}
-	if (match === null) throw installWaitFailedError(repository, installUrl, inspectableInstallationCount);
-	return match;
-}
-function connectPresentations(result) {
-	const connection = result.repositoryConnection;
 	return {
-		stdout: () => [],
-		json: () => result,
-		next: () => [],
-		human: () => [
-			{
-				kind: "summary",
-				status: "ok",
-				text: "Connecting Git to the resolved project."
+		report: {
+			outcome: "created",
+			agents
+		},
+		line: summary("ok", `Created prisma.config.ts with ${configSnippet(agents)}.`),
+		diagnostics: []
+	};
+}
+async function syncSkillsStep(cwd, agents, checkEnabledByConfig) {
+	try {
+		const outcome = await syncSkills(await readSkillsStatus(cwd, { agents }));
+		const result = {
+			projectRoot: outcome.projectRoot,
+			agents,
+			packages: packageReports(outcome.packages),
+			synced: outcome.synced,
+			pruned: outcome.pruned,
+			refused: outcome.refused,
+			checkDisabled: outcome.checkDisabled || !checkEnabledByConfig
+		};
+		return {
+			report: {
+				outcome: result.synced.length > 0 || result.pruned.length > 0 ? "synced" : "up-to-date",
+				sync: result
 			},
-			{
-				kind: "fields",
-				rows: [
-					{
-						label: "project",
-						value: result.project.name
-					},
-					{
-						label: "workspace",
-						value: result.workspace.name
-					},
-					{
-						label: "repository",
-						value: connection.repository.fullName
-					},
-					{
-						label: "status",
-						value: connection.status
-					}
-				]
+			line: null,
+			diagnostics: [...versionConflictDiagnostics(outcome.packages), ...unmanagedDirectoryDiagnostics(outcome.refused)]
+		};
+	} catch (cause) {
+		return {
+			report: {
+				outcome: "failed",
+				sync: null
 			},
-			{
-				kind: "list",
-				items: [formatGitConnectionDetail(connection.status)]
-			}
-		]
-	};
+			line: summary("warn", "The agent skills could not be synced."),
+			diagnostics: [skillsSyncFailedDiagnostic(cause)]
+		};
+	}
 }
-const gitConnectCommand = defineCommand({
-	args: {
-		positionals: { gitUrl: positional.optionalString({
-			brief: "GitHub repository URL",
-			placeholder: "git-url"
-		}) },
-		flags: { project: projectFlag$2 }
+const SKIPPED_POSTINSTALL = {
+	report: {
+		outcome: "skipped",
+		script: null
 	},
-	help: {
-		summary: "Connect the resolved project to a GitHub repository",
-		examples: [
-			"git connect",
-			"git connect git@github.com:prisma/prisma-cli.git",
-			"git connect --project proj_123"
-		]
+	line: summary("info", "Skipped the postinstall hook (--no-postinstall)."),
+	diagnostics: []
+};
+const SKIPPED_SKILLS = {
+	report: {
+		outcome: "skipped",
+		sync: null
 	},
-	needs: { credentials: true },
-	handler: async (args, ctx) => {
-		try {
-			const { api, target } = await resolveGitContext(ctx, args.flags.project, "git connect");
-			const remoteUrl = args.positionals.gitUrl ?? await readGitOriginRemote(ctx.cwd, ctx.signal);
-			if (!remoteUrl) throw usageError("Repository connection requires a GitHub repository URL", "No git-url was provided and the local repo does not have an origin remote.", `Pass a GitHub repository URL, or add a GitHub origin remote and rerun ${CLI_NAME} git connect.`, [`${CLI_NAME} git connect git@github.com:prisma/prisma-cli.git`], "project");
-			const repository = parseGitHubRepositoryUrl(remoteUrl);
-			if (!repository) throw unsupportedRepositoryProviderError();
-			const existing = await readFirstSourceRepository(api, target.project.id, ctx.signal);
-			if (existing) {
-				const existingConnection = toRepositoryConnection(existing);
-				if (!repositoryFullNamesMatch(existingConnection.repository.fullName, repository.fullName)) throw repoAlreadyConnectedError(existingConnection.repository.fullName);
-				const idempotent = {
-					...target,
-					repositoryConnection: existingConnection
-				};
-				return ok(ctx.present({ data: idempotent }, connectPresentations(idempotent)));
-			}
-			const installed = await resolveInstalledRepository(ctx, api, target.workspace.id, repository);
-			const { data, error, response } = await api.POST("/v1/source-repositories", {
-				body: {
-					projectId: target.project.id,
-					provider: "github",
-					providerRepositoryId: installed.repository.id,
-					installationId: installed.installation.id
-				},
-				signal: ctx.signal
-			});
-			if (error || !data) throw repoConnectionApiError("Failed to connect GitHub repository", response, error);
-			const result = {
-				...target,
-				repositoryConnection: toRepositoryConnection(data.data)
-			};
-			return ok(ctx.present({ data: result }, connectPresentations(result)));
-		} catch (error) {
-			const mapped = mapGitOperationError(error);
-			if (mapped) return notOk(mapped);
-			throw error;
-		}
+	line: summary("info", "Skipped the skills sync (--skills=none)."),
+	diagnostics: []
+};
+const SKIP_SENTINEL = "none";
+function invalidSkillsFlagError(problem) {
+	return new CliStructuredError("CLI.INVALID_ARGUMENTS", problem, { nextActions: [{
+		kind: "user-choice",
+		label: `Pass --skills a comma-separated list of agents (${KNOWN_AGENTS.join(", ")}), or --skills=${SKIP_SENTINEL} to record that no agent skills are wanted.`
+	}] });
+}
+/** `--skills`: absent defers to the config's agents (every known agent
+*  when there is no config); `none` records the choice — the scaffold
+*  gets `agents: []` and the sync is skipped; otherwise a
+*  comma-separated list of agent names. */
+function parseSkillsFlag(raw, configured) {
+	if (raw === void 0) return {
+		kind: "agents",
+		agents: configured
+	};
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.includes(SKIP_SENTINEL)) return names.length === 1 ? { kind: "skip" } : {
+		kind: "invalid",
+		error: invalidSkillsFlagError(`--skills=${SKIP_SENTINEL} records that no agent skills are wanted, so it cannot be combined with agent names.`)
+	};
+	const agents = [];
+	for (const name of names) {
+		if (!isKnownAgent(name)) return {
+			kind: "invalid",
+			error: invalidSkillsFlagError(`--skills names '${name}', which this CLI does not know. The known agents are ${KNOWN_AGENTS.join(", ")}.`)
+		};
+		if (!agents.includes(name)) agents.push(name);
 	}
-});
-//#endregion
-//#region src/commands/git/disconnect.ts
-/** The `git disconnect` command. */
-function disconnectPresentations(result) {
+	if (agents.length === 0) return {
+		kind: "invalid",
+		error: invalidSkillsFlagError("--skills was given no agent names.")
+	};
+	return {
+		kind: "agents",
+		agents
+	};
+}
+function initPresentations(result, postinstall, config, skills) {
 	return {
-		stdout: () => [],
 		json: () => result,
 		next: () => [],
-		human: () => [
-			{
-				kind: "summary",
-				status: "ok",
-				text: "Disconnecting Git from the resolved project."
-			},
-			{
-				kind: "fields",
-				rows: [
-					{
-						label: "project",
-						value: result.project.name
-					},
-					{
-						label: "workspace",
-						value: result.workspace.name
-					},
-					{
-						label: "repository",
-						value: result.repositoryConnection.repository.fullName
-					}
-				]
-			},
-			{
-				kind: "list",
-				items: ["GitHub branch automation is no longer active for this project."]
-			}
-		]
+		stdout: () => [],
+		human: (ui) => {
+			const skillsBlocks = result.skills.sync === null ? [] : syncPresentations(result.skills.sync).human(ui);
+			return [
+				...postinstall.line === null ? [] : [postinstall.line],
+				...config.line === null ? [] : [config.line],
+				...skills.line === null ? skillsBlocks : [skills.line]
+			];
+		}
 	};
 }
-const gitDisconnectCommand = defineCommand({
-	args: { flags: { project: projectFlag$2 } },
+const initCommand = defineCommand({
 	help: {
-		summary: "Disconnect the GitHub repository from the resolved project",
-		examples: ["git disconnect", "git disconnect --project proj_123"]
+		summary: "Prepare this repository for Prisma development",
+		description: "Runs locally and calls no platform API. Adds a postinstall script to package.json that keeps the Prisma agent skills in sync on every install, scaffolds a prisma.config.ts recording which agents to install skills for, then syncs the skills once now. Everything lands in the current directory; a prisma.config.ts or postinstall script that already exists is never edited. Rerunning is safe: each step reports what is already done.",
+		examples: [
+			"init",
+			"init --skills=claude,cursor",
+			"init --skills=none",
+			"init --no-postinstall"
+		]
 	},
-	needs: { credentials: true },
+	needs: { config: skillsConfigSection },
+	args: { flags: {
+		postinstall: flag.optionalBoolean({ brief: "Add the skills-sync postinstall hook (--no-postinstall skips)" }),
+		skills: flag.string({
+			brief: `Agents to install skills for (comma-separated: ${KNOWN_AGENTS.join(", ")}); '${SKIP_SENTINEL}' records that no agent skills are wanted`,
+			placeholder: "agents"
+		})
+	} },
 	handler: async (args, ctx) => {
-		try {
-			const { api, target } = await resolveGitContext(ctx, args.flags.project, "git disconnect");
-			const existing = await readFirstSourceRepository(api, target.project.id, ctx.signal);
-			if (!existing) throw repoNotConnectedError();
-			const { error, response } = await api.DELETE("/v1/source-repositories/{id}", {
-				params: { path: { id: existing.id } },
-				signal: ctx.signal
-			});
-			if (error) throw repoConnectionApiError("Failed to disconnect GitHub repository", response, error);
-			const result = {
-				...target,
-				repositoryConnection: toRepositoryConnection(existing)
-			};
-			return ok(ctx.present({ data: result }, disconnectPresentations(result)));
-		} catch (error) {
-			const mapped = mapGitOperationError(error);
-			if (mapped) return notOk(mapped);
-			throw error;
-		}
+		const skillsFlag = parseSkillsFlag(args.flags.skills, ctx.config.agents);
+		if (skillsFlag.kind === "invalid") return notOk(skillsFlag.error);
+		const postinstall = args.flags.postinstall === false ? SKIPPED_POSTINSTALL : await addPostinstallHook(ctx.cwd);
+		const config = await scaffoldConfigStep(ctx.cwd, skillsFlag.kind === "skip" ? [] : skillsFlag.agents, ctx.config.agentsConfigured);
+		const skills = skillsFlag.kind === "skip" ? SKIPPED_SKILLS : await syncSkillsStep(ctx.cwd, skillsFlag.agents, ctx.config.check);
+		const result = {
+			postinstall: postinstall.report,
+			config: config.report,
+			skills: skills.report
+		};
+		return ok(ctx.present({
+			data: result,
+			diagnostics: [
+				...postinstall.diagnostics,
+				...config.diagnostics,
+				...skills.diagnostics
+			]
+		}, initPresentations(result, postinstall, config, skills)));
 	}
 });
 //#endregion
@@ -5188,7 +5894,7 @@ function parseBackupLimit(value, formatCommand) {
 }
 async function resolveDatabase(provider, target, databaseRef, branchName, signal) {
 	const ref = databaseRef.trim();
-	if (!ref) throw usageError("Database id or name required", "This command needs a database id or name.", "Pass a database id or name.", ["prisma-cli database list"], "database");
+	if (!ref) throw usageError("Database id or name required", "This command needs a database id or name.", "Pass a database id or name.", ["prisma database list"], "database");
 	const databases = await provider.listDatabases({
 		projectId: target.project.id,
 		branchName,
@@ -5214,7 +5920,7 @@ function databaseRemovedDuringResolutionError(database, projectName) {
 		why: `"${database.name}" (${database.id}) was listed for project "${projectName}", but reading it returned 404. It was most likely removed while this command was running.`,
 		fix: "Re-run the command, or list the project's databases to see what is there now.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli database list"]
+		nextSteps: ["prisma database list"]
 	});
 }
 function ensureProjectId(database, projectId) {
@@ -5240,9 +5946,9 @@ function databaseNotFoundError(databaseRef, projectName, branchName) {
 		domain: "database",
 		summary: "Database not found",
 		why: `No database matched "${databaseRef}"${projectName ? ` in project "${projectName}"${branchName ? ` on branch "${branchName}"` : ""}` : ""}.`,
-		fix: "Pass a database id or name from prisma-cli database list.",
+		fix: "Pass a database id or name from prisma database list.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli database list"]
+		nextSteps: ["prisma database list"]
 	});
 }
 function databaseAmbiguousError(databaseRef, matches, branchName) {
@@ -5253,7 +5959,7 @@ function databaseAmbiguousError(databaseRef, matches, branchName) {
 		why: branchName ? `Multiple databases matched "${databaseRef}" on branch "${branchName}".` : `Multiple databases matched "${databaseRef}".`,
 		fix: "Pass the database id, or pass --branch <git-name> to narrow the match.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli database list"],
+		nextSteps: ["prisma database list"],
 		meta: { matches: matches.map((database) => ({
 			id: database.id,
 			name: database.name,
@@ -5489,9 +6195,9 @@ function normalizeCreatedDatabase(database, fallbackProjectId) {
 		domain: "database",
 		summary: "Created database did not return a connection string",
 		why: "The Management API created the database but did not include the one-time connection payload.",
-		fix: "Create a connection explicitly with prisma-cli database connection create <database>.",
+		fix: "Create a connection explicitly with prisma database connection create <database>.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli database connection create ${database.id}`]
+		nextSteps: [`prisma database connection create ${database.id}`]
 	});
 	return {
 		database: normalizeDatabase(database, fallbackProjectId),
@@ -5507,7 +6213,7 @@ function normalizeCreatedConnection(connection, fallbackDatabaseId) {
 		why: "Database connection strings are one-time-view secrets, but the Management API did not include one in this create response.",
 		fix: "Create another database connection and store the returned URL immediately.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli database connection create ${fallbackDatabaseId}`]
+		nextSteps: [`prisma database connection create ${fallbackDatabaseId}`]
 	});
 	return {
 		connection: normalizeConnection(connection, fallbackDatabaseId),
@@ -5773,7 +6479,7 @@ function portCommandReferences(text) {
 }
 function portPostgresCommand(command) {
 	const named = portCommandReferences(command);
-	return named.startsWith(`prisma-cli `) ? named : `${CLI_NAME} ${named}`;
+	return named.startsWith(`prisma `) ? named : `${CLI_NAME} ${named}`;
 }
 const STALE_INTERACTIVE_SIGN_IN = /, or rerun the command in a TTY to sign in interactively\./g;
 const TRACE_FLAG = /--trace/g;
@@ -7597,9 +8303,9 @@ const projectCreateCommand = defineCommand({
 				*  cancelled. */
 				if (ctx.signal.aborted) throw ctx.signal.reason;
 				throw projectCreateFailedError(error, name, workspace, {
-					nextSteps: ["prisma-cli project list", "prisma-cli project link <id-or-name>"],
+					nextSteps: ["prisma project list", "prisma project link <id-or-name>"],
 					permissionFix: "Grant the token permission to create Projects in this workspace, or link an existing Project.",
-					fallbackFix: "Retry the command, or choose an existing Project with prisma-cli project link <id-or-name>."
+					fallbackFix: "Retry the command, or choose an existing Project with prisma project link <id-or-name>."
 				});
 			});
 			const result = await bindDirectoryToProject(ctx, workspace, {
@@ -7701,9 +8407,9 @@ function positionalHint(command) {
 	return "";
 }
 function resolveEnvScope(flags, options) {
-	if (flags.roleName && flags.branchName) throw usageError(`prisma-cli project env ${options.command} accepts either --role or --branch`, "--role targets a project-level config map; --branch targets a preview branch override.", "Pass exactly one scope flag.", [`prisma-cli project env ${options.command} ${positionalHint(options.command)}--role preview`, `prisma-cli project env ${options.command} ${positionalHint(options.command)}--branch feature/foo`], "app");
+	if (flags.roleName && flags.branchName) throw usageError(`prisma project env ${options.command} accepts either --role or --branch`, "--role targets a project-level config map; --branch targets a preview branch override.", "Pass exactly one scope flag.", [`prisma project env ${options.command} ${positionalHint(options.command)}--role preview`, `prisma project env ${options.command} ${positionalHint(options.command)}--branch feature/foo`], "app");
 	if (flags.roleName) {
-		if (!VALID_ROLES.has(flags.roleName)) throw usageError(`Unknown role "${flags.roleName}"`, "--role accepts production or preview.", "Pass --role production or --role preview.", [`prisma-cli project env ${options.command} --role production`, `prisma-cli project env ${options.command} --role preview`], "app");
+		if (!VALID_ROLES.has(flags.roleName)) throw usageError(`Unknown role "${flags.roleName}"`, "--role accepts production or preview.", "Pass --role production or --role preview.", [`prisma project env ${options.command} --role production`, `prisma project env ${options.command} --role preview`], "app");
 		return {
 			kind: "role",
 			role: flags.roleName
@@ -7715,16 +8421,16 @@ function resolveEnvScope(flags, options) {
 	};
 	if (options.requireExplicit) {
 		const positional = positionalHint(options.command);
-		throw usageError(`prisma-cli project env ${options.command} requires --role or --branch`, "Writing without an explicit scope is rejected so the command never silently targets production.", "Pass --role production, --role preview, or --branch <git-name>.", [
-			`prisma-cli project env ${options.command} ${positional}--role production`,
-			`prisma-cli project env ${options.command} ${positional}--role preview`,
-			`prisma-cli project env ${options.command} ${positional}--branch feature/foo`
+		throw usageError(`prisma project env ${options.command} requires --role or --branch`, "Writing without an explicit scope is rejected so the command never silently targets production.", "Pass --role production, --role preview, or --branch <git-name>.", [
+			`prisma project env ${options.command} ${positional}--role production`,
+			`prisma project env ${options.command} ${positional}--role preview`,
+			`prisma project env ${options.command} ${positional}--branch feature/foo`
 		], "app");
 	}
 	return null;
 }
 function parseKeyValuePositional(raw, command, env = process.env) {
-	if (!raw) throw usageError(`prisma-cli project env ${command} requires KEY=VALUE`, "No KEY=VALUE positional argument was supplied.", "Pass the variable as KEY=VALUE, e.g. STRIPE_KEY=sk_test_xxx.", [`prisma-cli project env ${command} STRIPE_KEY=sk_test_xxx --role production`], "app");
+	if (!raw) throw usageError(`prisma project env ${command} requires KEY=VALUE`, "No KEY=VALUE positional argument was supplied.", "Pass the variable as KEY=VALUE, e.g. STRIPE_KEY=sk_test_xxx.", [`prisma project env ${command} STRIPE_KEY=sk_test_xxx --role production`], "app");
 	const separatorIndex = raw.indexOf("=");
 	if (separatorIndex === -1) {
 		if (KEY_SHAPE.test(raw)) {
@@ -7734,14 +8440,14 @@ function parseKeyValuePositional(raw, command, env = process.env) {
 				key: raw,
 				value
 			};
-			throw usageError(`Value for "${raw}" was not provided`, `No KEY=VALUE assignment was supplied, and ${raw} is not set in the current environment.`, "Pass KEY=VALUE or export the variable before running the command.", [`prisma-cli project env ${command} ${raw}=value --role production`, `${raw}=value prisma-cli project env ${command} ${raw} --role production`], "app");
+			throw usageError(`Value for "${raw}" was not provided`, `No KEY=VALUE assignment was supplied, and ${raw} is not set in the current environment.`, "Pass KEY=VALUE or export the variable before running the command.", [`prisma project env ${command} ${raw}=value --role production`, `${raw}=value prisma project env ${command} ${raw} --role production`], "app");
 		}
-		throw usageError(`KEY=VALUE argument is missing the = separator`, `"${raw}" does not contain an = character.`, "Pass the variable as KEY=VALUE, e.g. STRIPE_KEY=sk_test_xxx.", [`prisma-cli project env ${command} STRIPE_KEY=sk_test_xxx --role production`], "app");
+		throw usageError(`KEY=VALUE argument is missing the = separator`, `"${raw}" does not contain an = character.`, "Pass the variable as KEY=VALUE, e.g. STRIPE_KEY=sk_test_xxx.", [`prisma project env ${command} STRIPE_KEY=sk_test_xxx --role production`], "app");
 	}
 	const key = raw.slice(0, separatorIndex);
 	const value = raw.slice(separatorIndex + 1);
 	validateKey(key, command);
-	if (value.length === 0) throw usageError(`KEY=VALUE argument has an empty value`, `"${raw}" has an empty value after the = separator.`, `Pass a non-empty value, or use prisma-cli project env delete to delete a variable.`, [`prisma-cli project env ${command} ${key}=value --role production`], "app");
+	if (value.length === 0) throw usageError(`KEY=VALUE argument has an empty value`, `"${raw}" has an empty value after the = separator.`, `Pass a non-empty value, or use prisma project env delete to delete a variable.`, [`prisma project env ${command} ${key}=value --role production`], "app");
 	return {
 		key,
 		value
@@ -7749,9 +8455,9 @@ function parseKeyValuePositional(raw, command, env = process.env) {
 }
 const KEY_SHAPE = /^[A-Z_][A-Z0-9_]*$/;
 function validateKey(key, command) {
-	if (key.length === 0) throw usageError(`Variable key cannot be empty`, "An empty key was passed.", "Pass an env-var key, e.g. STRIPE_KEY.", [`prisma-cli project env ${command} STRIPE_KEY=value --role production`], "app");
+	if (key.length === 0) throw usageError(`Variable key cannot be empty`, "An empty key was passed.", "Pass an env-var key, e.g. STRIPE_KEY.", [`prisma project env ${command} STRIPE_KEY=value --role production`], "app");
 	if (key.length > 256) throw usageError(`Variable key "${key}" exceeds the 256-character limit`, "Env-var keys are capped at 256 characters by the platform.", "Use a shorter key.", [], "app");
-	if (!KEY_SHAPE.test(key)) throw usageError(`Variable key "${key}" must match the POSIX env-var shape`, "Keys must start with an uppercase letter or underscore and contain only uppercase letters, digits, and underscores.", "Rename the key to match [A-Z_][A-Z0-9_]*.", [`prisma-cli project env ${command} STRIPE_KEY=value --role production`], "app");
+	if (!KEY_SHAPE.test(key)) throw usageError(`Variable key "${key}" must match the POSIX env-var shape`, "Keys must start with an uppercase letter or underscore and contain only uppercase letters, digits, and underscores.", "Rename the key to match [A-Z_][A-Z0-9_]*.", [`prisma project env ${command} STRIPE_KEY=value --role production`], "app");
 }
 function formatScopeLabel(scope) {
 	if (scope.kind === "role") return scope.role;
@@ -7766,7 +8472,7 @@ async function readEnvFileAssignments(cwd, filePath, command) {
 	try {
 		contents = await readFile(resolvedPath, "utf8");
 	} catch (error) {
-		throw usageError(`Failed to read env file "${filePath}"`, error instanceof Error ? error.message : "The file could not be read.", "Pass a readable dotenv file path.", [`prisma-cli project env ${command} --file .env --role preview`], "app");
+		throw usageError(`Failed to read env file "${filePath}"`, error instanceof Error ? error.message : "The file could not be read.", "Pass a readable dotenv file path.", [`prisma project env ${command} --file .env --role preview`], "app");
 	}
 	return parseEnvFileContents(contents, filePath, command);
 }
@@ -7889,15 +8595,15 @@ function formatDescriptorLabel(scope) {
 //#endregion
 //#region src/controllers/app-env.ts
 function resolveEnvWriteSource(rawAssignment, filePath, command) {
-	if (filePath !== void 0 && rawAssignment !== void 0) throw usageError(`prisma-cli project env ${command} accepts either KEY=VALUE or --file`, "The command received both a positional assignment and a dotenv file path.", "Pass one input source.", [`prisma-cli project env ${command} KEY=value --role preview`, `prisma-cli project env ${command} --file .env --role preview`], "app");
+	if (filePath !== void 0 && rawAssignment !== void 0) throw usageError(`prisma project env ${command} accepts either KEY=VALUE or --file`, "The command received both a positional assignment and a dotenv file path.", "Pass one input source.", [`prisma project env ${command} KEY=value --role preview`, `prisma project env ${command} --file .env --role preview`], "app");
 	if (filePath !== void 0) {
-		if (filePath.length === 0) throw usageError(`prisma-cli project env ${command} --file requires a path`, "The --file flag was passed without a file path.", "Pass a readable dotenv file path.", [`prisma-cli project env ${command} --file .env --role preview`], "app");
+		if (filePath.length === 0) throw usageError(`prisma project env ${command} --file requires a path`, "The --file flag was passed without a file path.", "Pass a readable dotenv file path.", [`prisma project env ${command} --file .env --role preview`], "app");
 		return {
 			kind: "file",
 			filePath
 		};
 	}
-	if (rawAssignment === void 0) throw usageError(`prisma-cli project env ${command} requires KEY=VALUE or --file`, "No environment variable input was supplied.", "Pass a single KEY=VALUE assignment or a dotenv file path.", [`prisma-cli project env ${command} KEY=value --role preview`, `prisma-cli project env ${command} --file .env --role preview`], "app");
+	if (rawAssignment === void 0) throw usageError(`prisma project env ${command} requires KEY=VALUE or --file`, "No environment variable input was supplied.", "Pass a single KEY=VALUE assignment or a dotenv file path.", [`prisma project env ${command} KEY=value --role preview`, `prisma project env ${command} --file .env --role preview`], "app");
 	return {
 		kind: "single",
 		rawAssignment
@@ -7934,7 +8640,7 @@ async function resolveScopeToApi(client, projectId, scope, options) {
 		why: "Production variables are project-level only; branch overrides apply to preview branches.",
 		fix: "Use --role production for the production branch.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli project env list --role production"]
+		nextSteps: ["prisma project env list --role production"]
 	});
 	return {
 		scope,
@@ -8020,7 +8726,7 @@ async function resolveExistingBranch(client, projectId, branchName, signal) {
 		why: "Branch update, list, and delete commands only target existing preview branches.",
 		fix: "Create the branch by deploying it, or use `project env add --branch` to create its first override.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli project env add KEY=value --branch ${branchName}`]
+		nextSteps: [`prisma project env add KEY=value --branch ${branchName}`]
 	});
 	return branch;
 }
@@ -8034,7 +8740,7 @@ async function resolveOrCreateBranch(client, projectId, branchName, signal) {
 		why: "Creating the first branch would make it the project default, but branch overrides are preview-only.",
 		fix: "Create or deploy the default branch first, then add the branch override.",
 		exitCode: 1,
-		nextSteps: ["prisma-cli git connect <repository-url>"]
+		nextSteps: ["prisma git connect <repository-url>"]
 	});
 	const { data, error, response } = await client.POST("/v1/projects/{projectId}/branches", {
 		params: { path: { projectId } },
@@ -8257,7 +8963,7 @@ function envFileApplyFailedError(command, filePath, scope, failedKey, writtenVar
 		why: writtenKeys.length === 0 ? `No variables were written before ${failedKey} failed. Cause: ${cause}` : `Written keys before failure: ${formatKeyList(writtenKeys)}. Cause: ${cause}`,
 		fix: "Inspect the target scope, then retry the remaining keys once the API issue is resolved.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli project env list ${formatScopeFlag(scope)}`, retryStepForApplyFailure(command, filePath, scope, writtenKeys)],
+		nextSteps: [`prisma project env list ${formatScopeFlag(scope)}`, retryStepForApplyFailure(command, filePath, scope, writtenKeys)],
 		meta: {
 			file: filePath,
 			failedKey,
@@ -8266,9 +8972,9 @@ function envFileApplyFailedError(command, filePath, scope, failedKey, writtenVar
 	});
 }
 function retryStepForApplyFailure(command, filePath, scope, writtenKeys) {
-	if (command === "update") return `prisma-cli project env update --file ${filePath} ${formatScopeFlag(scope)}`;
-	if (writtenKeys.length === 0) return `prisma-cli project env add --file ${filePath} ${formatScopeFlag(scope)}`;
-	return `prisma-cli project env add --file <remaining.env> ${formatScopeFlag(scope)}`;
+	if (command === "update") return `prisma project env update --file ${filePath} ${formatScopeFlag(scope)}`;
+	if (writtenKeys.length === 0) return `prisma project env add --file ${filePath} ${formatScopeFlag(scope)}`;
+	return `prisma project env add --file <remaining.env> ${formatScopeFlag(scope)}`;
 }
 function splitFileNextSteps(filePath, scope, options) {
 	const scopeFlag = formatScopeFlag(scope);
@@ -8276,15 +8982,15 @@ function splitFileNextSteps(filePath, scope, options) {
 	const newFile = `${filePath}.new`;
 	if (options.first === "update-existing") return [
 		`# existing keys: ${formatKeyList(options.existingKeys)}`,
-		`prisma-cli project env update --file ${existingFile} ${scopeFlag}`,
+		`prisma project env update --file ${existingFile} ${scopeFlag}`,
 		"# new keys only",
-		`prisma-cli project env add --file ${newFile} ${scopeFlag}`
+		`prisma project env add --file ${newFile} ${scopeFlag}`
 	];
 	return [
 		`# missing keys: ${formatKeyList(options.missingKeys)}`,
-		`prisma-cli project env add --file ${newFile} ${scopeFlag}`,
+		`prisma project env add --file ${newFile} ${scopeFlag}`,
 		"# existing keys only",
-		`prisma-cli project env update --file ${existingFile} ${scopeFlag}`
+		`prisma project env update --file ${existingFile} ${scopeFlag}`
 	];
 }
 function formatKeyList(keys) {
@@ -8362,7 +9068,7 @@ function requireEnvScope(flags, command) {
 		requireExplicit: true,
 		command
 	});
-	if (!scope) throw usageError(`prisma-cli project env ${command} requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", [`prisma-cli project env ${command} KEY=value --role production`], "app");
+	if (!scope) throw usageError(`prisma project env ${command} requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", [`prisma project env ${command} KEY=value --role production`], "app");
 	return scope;
 }
 /** Workspace, pinned project and the API scope every env write needs. */
@@ -8511,7 +9217,7 @@ const projectEnvAddCommand = defineCommand({
 			"project env add --file .env --role preview",
 			"project env add DATABASE_URL=postgresql://branch --branch feature/foo",
 			"project env add --file .env.local --branch feature/foo",
-			"API_URL=https://api.example prisma-cli project env add API_URL --project proj_123 --role preview"
+			"API_URL=https://api.example prisma project env add API_URL --project proj_123 --role preview"
 		]
 	},
 	needs: { credentials: true },
@@ -8545,9 +9251,9 @@ const projectEnvAddCommand = defineCommand({
 				domain: "app",
 				summary: `Variable "${input.key}" already exists in ${formatScopeLabel(scope)}`,
 				why: "A variable with this key already exists in the targeted scope.",
-				fix: "Use `prisma-cli project env update` to change an existing variable's value.",
+				fix: "Use `prisma project env update` to change an existing variable's value.",
 				exitCode: 1,
-				nextSteps: [`prisma-cli project env update ${input.key}=<new-value> ${formatScopeFlag$1(scope)}`]
+				nextSteps: [`prisma project env update ${input.key}=<new-value> ${formatScopeFlag$1(scope)}`]
 			});
 			const warnings = scope.kind === "branch" && !await findVariableByNaturalKey(ctx.api, projectId, input.key, {
 				descriptor: {
@@ -8650,9 +9356,9 @@ const projectEnvDeleteCommand = defineCommand({
 				domain: "app",
 				summary: `Variable "${key}" not found in ${formatScopeLabel(scope)}`,
 				why: "No variable with this key exists in the targeted scope, so there is nothing to delete.",
-				fix: "Run prisma-cli project env list with the same scope to see the available variables.",
+				fix: "Run prisma project env list with the same scope to see the available variables.",
 				exitCode: 1,
-				nextSteps: [`prisma-cli project env list ${formatScopeFlag$1(scope)}`]
+				nextSteps: [`prisma project env list ${formatScopeFlag$1(scope)}`]
 			});
 			const { error, response } = await ctx.api.DELETE("/v1/environment-variables/{envVarId}", {
 				params: { path: { envVarId: existing.id } },
@@ -8835,9 +9541,9 @@ const projectEnvUpdateCommand = defineCommand({
 				domain: "app",
 				summary: `Variable "${input.key}" not found in ${formatScopeLabel(scope)}`,
 				why: "No variable with this key exists in the targeted scope.",
-				fix: "Use `prisma-cli project env add` to create a new variable.",
+				fix: "Use `prisma project env add` to create a new variable.",
 				exitCode: 1,
-				nextSteps: [`prisma-cli project env add ${input.key}=<value> ${formatScopeFlag$1(scope)}`]
+				nextSteps: [`prisma project env add ${input.key}=<value> ${formatScopeFlag$1(scope)}`]
 			});
 			const { data, error, response } = await ctx.api.PATCH("/v1/environment-variables/{envVarId}", {
 				params: { path: { envVarId: existing.id } },
@@ -8864,7 +9570,7 @@ const projectEnvUpdateCommand = defineCommand({
 const CREATE_CHOICE = "__create__";
 const CANCEL_CHOICE = "__cancel__";
 function setupCanceledError() {
-	return usageError("Project setup canceled", "Project link needs a Project before it can continue.", "Choose an existing Project or create a new one, then rerun project link.", ["prisma-cli project link <id-or-name>", "prisma-cli project create <name>"], "project");
+	return usageError("Project setup canceled", "Project link needs a Project before it can continue.", "Choose an existing Project or create a new one, then rerun project link.", ["prisma project link <id-or-name>", "prisma project create <name>"], "project");
 }
 function choiceOptions(projects) {
 	const sorted = sortProjects(projects);
@@ -8897,12 +9603,12 @@ async function createProjectForLink(ctx, workspace, projectName) {
 		if (ctx.signal.aborted) throw ctx.signal.reason;
 		throw projectCreateFailedError(error, projectName, workspace, {
 			nextSteps: [
-				"prisma-cli project list",
-				"prisma-cli project link <id-or-name>",
-				`prisma-cli project create ${formatCommandArgument(projectName)}`
+				"prisma project list",
+				"prisma project link <id-or-name>",
+				`prisma project create ${formatCommandArgument(projectName)}`
 			],
 			permissionFix: "Grant the token permission to create Projects in this workspace, or link an existing Project.",
-			fallbackFix: "Retry the command, or choose an existing Project with prisma-cli project link <id-or-name>."
+			fallbackFix: "Retry the command, or choose an existing Project with prisma project link <id-or-name>."
 		});
 	});
 	return {
@@ -9226,7 +9932,7 @@ function showPresentations$1(result, cwd, env) {
 		stdout: () => stdoutFieldRows(result, cwd).map((row) => `${row.label}: ${row.value}`),
 		next: () => result.project === null ? toNextActions(buildProjectSetupNextActions({
 			commandName: "project show",
-			retryCommand: "prisma-cli project show <id-or-name>",
+			retryCommand: "prisma project show <id-or-name>",
 			suggestedProjectName: result.suggestedProjectName,
 			reason: "This directory is not linked to a Prisma Project. Package and directory names can suggest setup defaults, but they do not select a Project."
 		})) : []
@@ -9499,12 +10205,12 @@ function formatDomainFailureFix(domain) {
 	if (domain.status !== "failed") return null;
 	const dnsRecord = domain.dnsRecords[0];
 	if (domain.failureCategory === "dns") {
-		if (dnsRecord) return `Add ${dnsRecord.type} ${dnsRecord.name} -> ${dnsRecord.value}, then run prisma-cli app domain retry ${domain.hostname}.`;
-		return `DNS verification failed, but the platform did not return a DNS record. Run prisma-cli app domain show ${domain.hostname} later, then retry when the DNS target is available.`;
+		if (dnsRecord) return `Add ${dnsRecord.type} ${dnsRecord.name} -> ${dnsRecord.value}, then run prisma service domain retry ${domain.hostname}.`;
+		return `DNS verification failed, but the platform did not return a DNS record. Run prisma service domain show ${domain.hostname} later, then retry when the DNS target is available.`;
 	}
-	if (domain.failureCategory === "acme") return `Retry TLS issuance with prisma-cli app domain retry ${domain.hostname}. Contact support if it fails again.`;
-	if (domain.failureCategory === "storage") return `Retry provisioning with prisma-cli app domain retry ${domain.hostname}. Contact support if it fails again.`;
-	return `Run prisma-cli app domain retry ${domain.hostname}. Contact support if it fails again.`;
+	if (domain.failureCategory === "acme") return `Retry TLS issuance with prisma service domain retry ${domain.hostname}. Contact support if it fails again.`;
+	if (domain.failureCategory === "storage") return `Retry provisioning with prisma service domain retry ${domain.hostname}. Contact support if it fails again.`;
+	return `Run prisma service domain retry ${domain.hostname}. Contact support if it fails again.`;
 }
 //#endregion
 //#region src/commands/service/errors.ts
@@ -9530,42 +10236,24 @@ function toEngineNextAction(action) {
 		...action.reason !== void 0 ? { reason: action.reason } : {}
 	};
 }
-/**
-* The binary name legacy error copy is written in. It is fixed, not
-* `CLI_NAME`: these strings are inputs to the rewriting below, and a
-* renamed binary must still recognise them.
-*/
-const LEGACY_CLI_NAME = "prisma-cli";
 const CNAME_HINT = /\bcname(?:s)?\s+to\b/;
 const PRISMA_BUILD_HOST = /\b((?:[a-z0-9-]+\.)+prisma\.build)\b/i;
 /**
-* The rename surface for copy that flows through legacy error builders:
-* command lines and the "app target" noun in prose.
-*/
-function renameAppCopy(text) {
-	return text.replaceAll(`${LEGACY_CLI_NAME} app `, `${CLI_NAME} service `).replaceAll("App target", "Service target").replaceAll("app target", "service target");
-}
-/** A legacy `nextSteps` command line as this binary spells it. */
-function toCurrentCommandLine(legacyStep) {
-	const renamed = renameAppCopy(legacyStep);
-	return renamed.startsWith(`${LEGACY_CLI_NAME} `) ? `${CLI_NAME} ${renamed.slice(11)}` : renamed;
-}
-/**
 * Maps a legacy CliError onto the engine error protocol: the flat code
 * becomes `SERVICE.<code>`, the free-text fix becomes a user-choice
-* action carried alongside any typed legacy actions, and nextSteps that
-* are command lines become run-command actions. Copy passes through the
-* rename surface.
+* action carried alongside any typed legacy actions, and each nextSteps
+* command line becomes a run-command action. Copy passes through
+* unchanged: the producers write the commands a user types today.
 */
 function fromLegacyCliError(error) {
-	const fixAction = error.fix ? [adviceAction(renameAppCopy(error.fix))] : [];
-	const nextActions = error.nextActions.length > 0 ? [...error.nextActions.map(toEngineNextAction), ...fixAction] : [...fixAction, ...error.nextSteps.filter((step) => step.startsWith(`${LEGACY_CLI_NAME} `)).map((step) => ({
+	const fixAction = error.fix ? [adviceAction(error.fix)] : [];
+	const nextActions = error.nextActions.length > 0 ? [...error.nextActions.map(toEngineNextAction), ...fixAction] : [...fixAction, ...error.nextSteps.map((step) => ({
 		kind: "run-command",
 		label: "Run",
-		command: toCurrentCommandLine(step)
+		command: step
 	}))];
-	return new CliStructuredError(`SERVICE.${error.code}`, renameAppCopy(error.summary), {
-		...error.why ? { why: renameAppCopy(error.why) } : {},
+	return new CliStructuredError(`SERVICE.${error.code}`, error.summary, {
+		...error.why ? { why: error.why } : {},
 		nextActions,
 		...error.where ? { where: { path: error.where } } : {},
 		...Object.keys(error.meta).length > 0 ? { meta: error.meta } : {},
@@ -9716,7 +10404,7 @@ function domainVerificationFailedError(hostname, domain) {
 	return new CliStructuredError("SERVICE.DOMAIN_VERIFICATION_FAILED", `Custom domain "${hostname}" failed verification`, {
 		why,
 		nextActions: [
-			...guidance ? [adviceAction(renameAppCopy(guidance))] : [],
+			...guidance ? [adviceAction(guidance)] : [],
 			runCommandAction("Show the domain", `service domain show ${hostname} --service <name>`),
 			runCommandAction("Retry verification", `service domain retry ${hostname} --service <name>`)
 		]
@@ -11979,6 +12667,54 @@ const serviceVersionStopCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/skills/family.ts
+/** Skill delivery is product-agnostic — the same two commands serve the
+*  ORM's skills and Composer's — so it is its own family rather than
+*  part of either product's. */
+const skillsCommandFamily = defineCommandFamily({
+	configSection: skillsConfigSection,
+	commands: {
+		sync: skillsSyncCommand,
+		list: defineCommand({
+			help: {
+				summary: "Show which Prisma agent skills are installed in this project",
+				examples: ["skills list", "skills list --json"]
+			},
+			needs: { config: skillsConfigSection },
+			handler: async (_args, ctx) => {
+				const status = await readSkillsStatus(ctx.cwd, { agents: ctx.config.agents });
+				const result = {
+					projectRoot: status.projectRoot,
+					agents: ctx.config.agents,
+					packages: packageReports(status.packages),
+					skills: status.skills.map((skill) => ({
+						skill: skill.skill,
+						library: skill.library,
+						version: skill.version,
+						upToDate: skill.upToDate,
+						targets: skill.targets.map((target) => ({
+							dir: target.dir,
+							syncedVersion: target.syncedVersion,
+							state: target.state
+						}))
+					})),
+					orphaned: status.orphans.map((orphan) => ({
+						skill: orphan.skill,
+						library: orphan.library,
+						dirs: orphan.dirs
+					})),
+					checkDisabled: status.checkDisabled || !ctx.config.check,
+					upToDate: status.upToDate
+				};
+				return ok(ctx.present({
+					data: result,
+					diagnostics: versionConflictDiagnostics(status.packages)
+				}, listPresentations$5(result)));
+			}
+		})
+	}
+});
+//#endregion
 //#region src/cli.ts
 const platformCommandFamily = defineCommandFamily({ commands: {
 	login: authLoginCommand,
@@ -12071,13 +12807,13 @@ const cliGroups = {
 	service: { brief: "Manage services and their versions for a project" },
 	"service domain": { brief: "Manage custom domains for a service" },
 	"service version": { brief: "Manage the versions of a service" },
-	agent: { brief: "Manage Prisma skills for AI coding agents" },
 	"auth workspace": { brief: "Manage local workspace sessions" },
 	contract: { brief: "Define and emit your application data contract" },
 	db: { brief: "Verify, sign and update your database against the contract" },
 	migration: { brief: "Plan, inspect and scaffold on-disk migrations" },
 	"migration ref": { brief: "Manage named refs that point at contracts" },
 	orm: { brief: "Initialize a Prisma ORM project" },
+	skills: { brief: "Keep this project's Prisma agent skills current" },
 	...telemetry.groups
 };
 const mountedCommands = {
@@ -12160,9 +12896,9 @@ const mountedCommands = {
 	"migration ref delete": ormCommandFamily$1.commands["migration ref delete"],
 	"migration ref list": ormCommandFamily$1.commands["migration ref list"],
 	"migration ref set": ormCommandFamily$1.commands["migration ref set"],
-	"agent install": agentInstallCommand,
-	"agent update": agentUpdateCommand,
-	"agent status": agentStatusCommand,
+	init: initCommand,
+	"skills sync": skillsCommandFamily.commands.sync,
+	"skills list": skillsCommandFamily.commands.list,
 	feedback: feedbackCommand,
 	...telemetry.commands
 };
@@ -12173,7 +12909,8 @@ function buildCli() {
 		commandFamilies: [
 			platformCommandFamily,
 			composerCommandFamily,
-			ormCommandFamily$1
+			ormCommandFamily$1,
+			skillsCommandFamily
 		],
 		groups: cliGroups,
 		commands: mountedCommands,
@@ -13370,6 +14107,81 @@ async function assembleRuntime(proc) {
 		host: describeHost(proc)
 	};
 }
+async function maybeWriteSkillsStaleNotice(runtime) {
+	if (isSuppressedByInvocation(runtime)) return;
+	try {
+		if (await readSkillsCheckDisabled(runtime.cwd)) return;
+		const status = await readSkillsStatus(runtime.cwd, {
+			orphans: false,
+			checkDisabled: false
+		});
+		if (status.upToDate) return;
+		const config = await readProjectSkillsConfig(runtime.cwd, configPathFromArgv(runtime.argv));
+		if (config !== null && !config.check) return;
+		const agents = config?.agents ?? DEFAULT_AGENTS;
+		if (agents.length === 0) return;
+		const notice = renderStaleNotice(status, agentSkillDirs(agents));
+		if (notice !== null) runtime.stderr.write(notice);
+	} catch {
+		return;
+	}
+}
+/** The first skill with a stale or never-synced copy in one of the
+*  configured directories — what the check names in its one line. */
+function firstOutdatedSkillIn(status, dirs) {
+	return status.skills.find((skill) => skill.targets.some((target) => dirs.includes(target.dir) && (target.state === "stale" || target.state === "absent"))) ?? null;
+}
+function renderStaleNotice(status, dirs) {
+	const outdated = firstOutdatedSkillIn(status, dirs);
+	if (outdated === null) return null;
+	const synced = outdated.targets.find((target) => dirs.includes(target.dir) && target.state === "stale")?.syncedVersion;
+	return `Prisma agent skills are out of date (installed ${outdated.library} ${outdated.version}, synced ${synced ?? "none"}). Run: ${getCliName()} skills sync\n`;
+}
+/** The shared flags that take a separate value, so the word after them
+*  is that value rather than the command being invoked. */
+const FLAGS_TAKING_A_VALUE = new Set([
+	"--format",
+	"--log-level",
+	"--config",
+	"--confirm"
+]);
+/** The first word of the invocation — the group, or the command when it
+*  is mounted top-level — skipping the shared flags that may precede it. */
+function invokedGroup(argv) {
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (!token.startsWith("-")) return token;
+		if (FLAGS_TAKING_A_VALUE.has(token)) index += 1;
+	}
+}
+/** Tokens before a bare `--`; everything after it is positional data,
+*  never a flag. */
+function flagTokens(argv) {
+	const end = argv.indexOf("--");
+	return end === -1 ? argv : argv.slice(0, end);
+}
+/** The off switches that cost nothing to read. */
+function isSuppressedByInvocation(runtime) {
+	const env = runtime.env;
+	if (env["PRISMA_SKILLS_CHECK"] === "0") return true;
+	if (env.CI || env.GITHUB_ACTIONS) return true;
+	const argv = flagTokens(runtime.argv);
+	const group = invokedGroup(argv);
+	if (group === "skills" || group === "init") return true;
+	if (argv.includes("--json") || argv.includes("--quiet") || argv.includes("-q")) return true;
+	if (argv.includes("--version")) return true;
+	return argv.some((token, index) => token === "--format=json" || token === "--format" && argv[index + 1] === "json");
+}
+/** The file an explicit --config names, so the check reads the same
+*  config the command did. Discovery is otherwise cwd-only. */
+function configPathFromArgv(argv) {
+	const tokens = flagTokens(argv);
+	for (let index = 0; index < tokens.length; index += 1) {
+		const token = tokens[index];
+		if (token === "--config") return tokens[index + 1];
+		if (token.startsWith("--config=")) return token.slice(9);
+	}
+}
 //#endregion
 //#region src/update-check.ts
 const UPDATE_CHECK_FILE_NAME = "update-check.json";
@@ -13546,54 +14358,8 @@ function isAtLeastIntervalAgo(value) {
 	return Number.isNaN(timestamp) || Date.now() - timestamp >= NOTIFICATION_INTERVAL_MS;
 }
 function isInstalledVersionStale(installedVersion, latestVersion) {
-	const installed = parseVersion(installedVersion);
-	const latest = parseVersion(latestVersion);
-	if (!installed || !latest) return false;
-	return compareVersions(installed, latest) < 0;
-}
-function parseVersion(version) {
-	const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(version);
-	if (!match) return null;
-	return {
-		major: Number(match[1]),
-		minor: Number(match[2]),
-		patch: Number(match[3]),
-		prerelease: match[4]?.split(".") ?? []
-	};
-}
-function compareVersions(left, right) {
-	for (const key of [
-		"major",
-		"minor",
-		"patch"
-	]) {
-		const diff = left[key] - right[key];
-		if (diff !== 0) return diff;
-	}
-	return comparePrerelease(left.prerelease, right.prerelease);
-}
-function comparePrerelease(left, right) {
-	if (left.length === 0 && right.length === 0) return 0;
-	if (left.length === 0) return 1;
-	if (right.length === 0) return -1;
-	const count = Math.max(left.length, right.length);
-	for (let index = 0; index < count; index += 1) {
-		const leftPart = left[index];
-		const rightPart = right[index];
-		if (leftPart === void 0) return -1;
-		if (rightPart === void 0) return 1;
-		const diff = comparePrereleasePart(leftPart, rightPart);
-		if (diff !== 0) return diff;
-	}
-	return 0;
-}
-function comparePrereleasePart(left, right) {
-	const leftNumber = /^\d+$/.test(left) ? Number(left) : null;
-	const rightNumber = /^\d+$/.test(right) ? Number(right) : null;
-	if (leftNumber !== null && rightNumber !== null) return leftNumber - rightNumber;
-	if (leftNumber !== null) return -1;
-	if (rightNumber !== null) return 1;
-	return left.localeCompare(right);
+	const order = compareVersionStrings(installedVersion, latestVersion);
+	return order !== null && order < 0;
 }
 async function fetchLatestVersion(registryUrl, fetchImpl) {
 	const controller = new AbortController();
@@ -13632,7 +14398,14 @@ async function main(proc, buildCliForRun = buildCli) {
 		stderr: proc.stderr
 	});
 	const runtime = await assembleRuntime(proc);
-	return cli.run(proc.argv.slice(2), runtime);
+	const exitCode = await cli.run(proc.argv.slice(2), runtime);
+	await maybeWriteSkillsStaleNotice({
+		env: proc.env,
+		argv: proc.argv.slice(2),
+		cwd: proc.cwd(),
+		stderr: proc.stderr
+	});
+	return exitCode;
 }
 //#endregion
 //#region src/bin.ts