@prisma/orm-toolchain 8.0.0-rc.1-dev.38 → 8.0.0-rc.1-dev.39

package/dist/{init-Bco4QkKJ-DqUZVrBU.mjs → redact-secrets-kQ0KKV1u-MnVSKe-u.mjs}

@@ -1,91 +1,17 @@
 import { t as CliStructuredError$1 } from "./cli-errors-BG6bItjG-DwdKIeGz.mjs";
-import { a as formatErrorJson, o as formatErrorOutput, r as createTerminalUI } from "./terminal-ui-Cqz4LVL7-B0mcVdLy.mjs";
-import { i as renderInitOutro, n as buildNextSteps, r as formatInitJson, t as InitOutputSchema } from "./output-DWNYqZGc-D2sRgLAm.mjs";
-import { a as schemaSample, c as targetLabel, i as scaffoldSpecifierResolverFor, l as targetPackageName, n as dbFile, o as starterSchema, r as defaultSchemaPath, s as targetEntrypoint, t as configFile, u as version } from "./bin__prisma-next.mjs";
+import { a as schemaSample, l as targetPackageName, s as targetEntrypoint, u as version } from "./code-templates-CSLH8721-CWRA4Lru.mjs";
 import { createRequire } from "node:module";
 import { CliStructuredError } from "@prisma/orm-framework/errors/control";
-import { basename, dirname, extname, isAbsolute, join, normalize } from "pathe";
-import { existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { ifDefined } from "@prisma/orm-framework/utils/defined";
+import { dirname, extname, join, normalize } from "pathe";
+import { existsSync, readFileSync } from "node:fs";
 import { docsUrlFor } from "@prisma/orm-framework/utils/structured-error";
 import { keepInternalSpecifiers } from "@prisma/orm-framework/components/emission";
 import { blindCast } from "@prisma/orm-framework/utils/casts";
 import { InternalError } from "@prisma/orm-framework/utils/internal-error";
-import * as clack from "@clack/prompts";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import { detect, getUserAgent } from "package-manager-detector/detect";
 import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
-//#region ../../../1-framework/3-tooling/cli/dist/init-Bco4QkKJ.mjs
-const KNOWN = /* @__PURE__ */ new Set([
-	"pnpm",
-	"npm",
-	"yarn",
-	"bun",
-	"deno"
-]);
-function isPackageManager(name) {
-	return KNOWN.has(name);
-}
-/**
-* Resolves the package manager `init` should drive for `add` / `install`
-* commands. Tries, in order:
-*
-*  1. **`detect()`** — walks up from `cwd` looking for a lockfile, the
-*     `packageManager` field, the `devEngines.packageManager` field, or
-*     install metadata. This is the right answer whenever the user is
-*     anywhere inside an existing project, including a deep workspace
-*     subdirectory.
-*
-*  2. **`getUserAgent()`** — parses `npm_config_user_agent`, the env var
-*     every PM sets when it spawns a script. This catches the
-*     bare-directory case where there's no project to walk up to but the
-*     user invoked us via `pnpm dlx prisma-next init` / `bunx
-*     prisma-next init` / `yarn dlx …`. Same signal used by every
-*     `create-*` tool in the ecosystem (`create-vite`, `create-next-app`,
-*     `create-astro`, `@antfu/ni`, …).
-*
-*  3. **`npm`** — final fallback. Always present alongside Node.
-*/
-async function detectPackageManager(cwd) {
-	const detected = await detect({ cwd });
-	if (detected && isPackageManager(detected.name)) return detected.name;
-	const userAgent = getUserAgent();
-	if (userAgent !== null && isPackageManager(userAgent)) return userAgent;
-	return "npm";
-}
-function hasProjectManifest(cwd) {
-	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
-}
-function formatRunCommand(pm, bin, args) {
-	if (pm === "npm") return `npx ${bin} ${args}`;
-	if (pm === "deno") return `deno run npm:${bin} ${args}`;
-	return `${pm} ${bin} ${args}`;
-}
-function formatRunScriptCommand(pm, scriptName) {
-	switch (pm) {
-		case "deno": return `deno task ${scriptName}`;
-		case "bun": return `bun run ${scriptName}`;
-		case "pnpm": return `pnpm run ${scriptName}`;
-		case "yarn": return `yarn run ${scriptName}`;
-		default: return `npm run ${scriptName}`;
-	}
-}
-function formatAddArgs(pm, packages) {
-	if (pm === "deno") return ["add", ...packages.map((p) => `npm:${p}`)];
-	return ["add", ...packages];
-}
-function formatAddDevArgs(pm, packages) {
-	if (pm === "deno") return [
-		"add",
-		"--dev",
-		...packages.map((p) => `npm:${p}`)
-	];
-	return [
-		"add",
-		"-D",
-		...packages
-	];
-}
+//#region ../../../1-framework/3-tooling/cli/dist/redact-secrets-kQ0KKV1u.mjs
 /**
 * Walks up from `baseDir` looking for `pnpm-workspace.yaml`, then scans
 * its top-level `catalog:` block for entries that match any of `packages`.
@@ -177,6 +103,25 @@ function stripQuotes(value) {
 	}
 	return value;
 }
+function formatCatalogWarning(workspaceFile, entries) {
+	return [
+		"pnpm workspace catalog overrides detected — pnpm will install these versions instead of `latest`:",
+		entries.map((entry) => `  • ${entry.name}: ${entry.version}`).join("\n"),
+		`Catalog source: ${workspaceFile}`,
+		"To use the published `latest` instead, remove or update the catalog entry, then re-run `pnpm install`."
+	].join("\n");
+}
+/**
+* Honour-and-warn: when the surrounding pnpm workspace pins one of the
+* packages `init` installs through its catalog, say so — the catalog version,
+* not the published `latest`, is what ends up in the project. Empty when there
+* is no workspace above the project or its catalog names none of them.
+*/
+function buildCatalogWarnings(baseDir, packages) {
+	const result = detectPnpmCatalogOverrides(baseDir, packages);
+	if (result === null || result.entries.length === 0) return [];
+	return [formatCatalogWarning(result.workspaceFile, result.entries)];
+}
 /**
 * Re-init in non-interactive mode without `--force`. Distinct from the
 * decline-the-prompt path (which is `errorInitUserAborted`) because here
@@ -388,6 +333,26 @@ function errorInitEmitFailed(options) {
 	});
 }
 /**
+* A scaffold file could not be written after earlier writes had already
+* landed. The directory is half-scaffolded, so this carries the list of what
+* did get written, the way every other post-write failure in `init` does.
+*
+* Maps to exit code `2 = PRECONDITION`: what stopped the write is something
+* about the directory the user can fix.
+*/
+function errorInitWriteFailed(options) {
+	return new CliStructuredError$1("CLI.INIT_WRITE_FAILED", `Failed to write ${options.path}`, {
+		why: `\`${options.path}\` could not be written: ${options.cause}`,
+		fix: "Fix what stopped the write — a directory sitting where the file goes, permissions, a full disk — then run `prisma-next init` again. It will ask you to confirm replacing the files this run already wrote (listed in `meta.filesWritten`).",
+		docsUrl: docsUrlFor("CLI.INIT_WRITE_FAILED"),
+		meta: {
+			path: options.path,
+			cause: options.cause,
+			filesWritten: options.filesWritten
+		}
+	});
+}
+/**
 * The project-level skills install (`npx skills add
 * prisma/prisma#v<version>`) failed after a successful dependency
 * install + emit. The project's scaffold remains on disk; the user
@@ -412,365 +377,416 @@ function errorInitSkillInstallFailed(options) {
 	});
 }
 /**
-* The `.gitattributes` entries written for a freshly initialised project
-* (FR3.4). Mirrors the relevant subset of the repo-root
-* [`.gitattributes`](../../../../../../../../.gitattributes):
-*
-* - **Today**: `contract.json`, `contract.d.ts` are emitted on every
-*   `prisma-next contract emit`. Marking them `linguist-generated`
-*   keeps GitHub's diff stats honest and collapses the file in code
-*   review by default.
-* - **Forward-looking**: `ops.json`, `migration.json` are not yet emitted
-*   by `init` flows but will be produced by adjacent commands (lower /
-*   migration tooling). Adding them now matches Decision 5
-*   (forward-looking subset) so the file does not need to be amended
-*   every time a new artifact lands.
+* Connects (when configured) to the user's database and returns a
+* structured outcome describing whether the server meets the declared
+* minimum (FR8.1). Pure with respect to its inputs: no I/O happens
+* unless `databaseUrl` is set.
 *
-* `ARTIFACT_FILENAMES` entries are written relative to the schema
-* directory so a user who runs `init --schema-path db/contract.prisma`
-* gets `db/contract.json linguist-generated` — not the workspace-glob
-* form `<glob>/contract.json` (which would over-match any unrelated
-* `contract.json` the user has elsewhere) and not the absolute
-* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json` (which would silently
-* break for a non-default schema path).
+* The outcome is shaped so that `--strict-probe` can branch on the
+* `kind`/`meetsMinimum` pair without re-stringifying the message:
 *
-* The migration contract snapshot store (`migrations/snapshots/<hex>/`)
-* is anchored to the migrations root instead, not the schema directory:
-* migration package depth under `migrations/` varies (`app/<pkg>`,
-* `<space>/<pkg>`, or a bare `<pkg>` in extension source repos), so no
-* single schema-dir-relative pattern can reach every snapshot. See
-* `STORE_GITATTRIBUTES_LINES` below.
-*/
-const ARTIFACT_FILENAMES$1 = [
-	"contract.json",
-	"contract.d.ts",
-	"ops.json",
-	"migration.json"
-];
-const ATTRIBUTE = "linguist-generated";
-/**
-* Full `.gitattributes` lines for the migration contract snapshot store,
-* already anchored to the migrations root — unlike `ARTIFACT_FILENAMES`,
-* these are not combined with the schema-relative prefix.
-*/
-const STORE_GITATTRIBUTES_LINES = [`migrations/snapshots/**/contract.json ${ATTRIBUTE}`, `migrations/snapshots/**/contract.d.ts ${ATTRIBUTE}`];
-/**
-* Computes the `.gitattributes` lines this scaffold expects to own. Each
-* line has the shape `<path> linguist-generated`. The `target` parameter
-* is currently unused but accepted for symmetry with the other hygiene
-* helpers and to leave room for target-specific entries (e.g. a future
-* family-specific artifact) without a signature break.
+* - `ok` — informational; `init` continues.
+* - `below-minimum` — warning; `init` continues regardless of
+*   `--strict-probe` (the spec scopes strict-probe to "probe
+*   *failures*", and a successful probe that finds an old server is
+*   not a failure).
+* - `no-database-url` / `connection-failed` / `driver-missing` —
+*   warning by default, fatal under `--strict-probe`.
 */
-function requiredGitattributesLines(schemaDir, _target) {
-	const dir = schemaDir === "." ? "" : schemaDir.replace(/\/+$/, "");
-	const prefix = dir === "" ? "" : `${dir}/`;
-	return [...ARTIFACT_FILENAMES$1.map((file) => `${prefix}${file} ${ATTRIBUTE}`), ...STORE_GITATTRIBUTES_LINES];
+async function probeServerVersion(ctx, overrides = {}) {
+	const { databaseUrl, minVersion, target } = ctx;
+	if (databaseUrl === void 0 || databaseUrl.trim().length === 0) return {
+		kind: "no-database-url",
+		minVersion,
+		meetsMinimum: null,
+		message: "Skipped --probe-db: DATABASE_URL is not set in the current shell environment. (init does not read .env for the probe; export the variable or drop --probe-db.)"
+	};
+	let driverResult;
+	try {
+		if (target === "postgres") driverResult = overrides.probePostgres !== void 0 ? await overrides.probePostgres(databaseUrl) : await defaultProbePostgres(databaseUrl, ctx.baseDir, overrides);
+		else driverResult = overrides.probeMongo !== void 0 ? await overrides.probeMongo(databaseUrl) : await defaultProbeMongo(databaseUrl, ctx.baseDir, overrides);
+	} catch (err) {
+		if (err instanceof DriverMissingError) return {
+			kind: "driver-missing",
+			minVersion,
+			meetsMinimum: null,
+			cause: err.message,
+			message: `Skipped --probe-db: ${err.message}. (Run with install enabled, or install the driver yourself, then re-run \`prisma-next init --probe-db\`.)`
+		};
+		const cause = redactDatabaseUrlSecrets(causeMessage(err));
+		return {
+			kind: "connection-failed",
+			minVersion,
+			meetsMinimum: null,
+			cause,
+			message: `--probe-db could not connect: ${cause}.`
+		};
+	}
+	if (compareVersionPrefix(driverResult.serverVersion, minVersion) < 0) return {
+		kind: "below-minimum",
+		serverVersion: driverResult.serverVersion,
+		minVersion,
+		meetsMinimum: false,
+		message: `--probe-db: server reports version ${driverResult.serverVersion}, below the declared minimum (${minVersion}). Some queries may fail until the server is upgraded.`
+	};
+	return {
+		kind: "ok",
+		serverVersion: driverResult.serverVersion,
+		minVersion,
+		meetsMinimum: true,
+		message: `--probe-db: server reports version ${driverResult.serverVersion} (>= ${minVersion}).`
+	};
 }
 /**
-* Idempotent `.gitattributes` merge (FR3.4 / FR9.3). Returns the new file
-* content given the existing content (or `undefined` if the file does
-* not yet exist).
+* Compares two semver-prefix strings ("14", "14.2", "6.0", …) by
+* numeric components left-to-right. Returns a negative number when `a`
+* is older than `b`, zero when both versions agree on every numeric
+* component (treating missing trailing components as `0`), and a
+* positive number when `a` is newer.
 *
-* Equivalence is exact-line: a user-customised line like
-* `prisma/*.json linguist-generated` is *not* recognised as covering
-* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json linguist-generated`. We accept that
-* over-specification — preserving the user's broad pattern *and*
-* appending the narrow one — because the narrow lines are what the
-* acceptance criteria pin (FR3.4 AC).
+* The loop runs over the **longer** of the two prefixes so that
+* `'14'` compares less than `'14.1'` — without that, the shorter
+* prefix would be silently accepted whenever the configured minimum
+* has a non-zero minor or patch.
 *
-* Returns `null` when no changes are required (file already contains
-* every required entry).
+* Exported for unit tests.
 */
-function mergeGitattributes(existing, required) {
-	if (existing === void 0) return `${required.join("\n")}\n`;
-	const presentLines = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
-	const missing = required.filter((line) => !presentLines.has(line));
-	if (missing.length === 0) return null;
-	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
+function compareVersionPrefix(a, b) {
+	const aParts = parseNumericParts(a);
+	const bParts = parseNumericParts(b);
+	const len = Math.max(aParts.length, bParts.length);
+	for (let i = 0; i < len; i += 1) {
+		const aPart = aParts[i] ?? 0;
+		const bPart = bParts[i] ?? 0;
+		if (aPart !== bPart) return aPart - bPart;
+	}
+	return 0;
+}
+function parseNumericParts(version) {
+	const match = version.match(/^[^\d]*(\d+(?:\.\d+){0,3})/);
+	if (match === null) return [];
+	return (match[1] ?? "").split(".").map((part) => Number.parseInt(part, 10));
+}
+var DriverMissingError = class extends Error {};
+function causeMessage(err) {
+	if (err instanceof Error) return err.message;
+	return String(err);
 }
 /**
-* The minimal `.gitignore` lines a Prisma Next scaffold needs (FR3.3).
-* Order matches what Node tooling typically writes today.
+* Strips `user:password@` userinfo from any URL-shaped substring before
+* we surface the cause to the user. Mirrors `redactSecrets` in
+* `init.ts` — the probe path has its own redactor because the inputs
+* here include the raw connection string by construction (driver
+* errors echo the URL back).
 *
-* `node_modules/` first because it's the byte-largest miss; `dist/`
-* because the scaffolded `tsconfig.json` writes there; `.env` last so
-* the secret-bearing file is the one most-recently visible in any diff
-* (a paranoid-correct ordering — humans skim from the top).
+* Exported for unit tests.
 */
-const REQUIRED_GITIGNORE_ENTRIES = [
-	"node_modules/",
-	"dist/",
-	".env"
-];
+function redactDatabaseUrlSecrets(text) {
+	if (!text) return text;
+	return text.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
+}
+async function defaultProbePostgres(databaseUrl, baseDir, overrides) {
+	const client = new (requirePeer("pg", baseDir, overrides)).Client({ connectionString: databaseUrl });
+	await client.connect();
+	try {
+		const result = await client.query("SELECT version() as version");
+		return { serverVersion: parsePostgresVersion(String(result?.rows?.[0]?.version ?? "")) };
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
 /**
-* Idempotent `.gitignore` merge (FR3.3 / FR9.3). Returns the new file
-* content given the existing content (or `undefined` if the file does
-* not yet exist). Adds only entries that are not already present and
-* never duplicates a line. Existing comments and blank lines are
-* preserved verbatim — `.gitignore` is parsed by `git` without a tree,
-* so any line modification risks changing semantics.
+* Extracts the numeric prefix from a Postgres `version()` row, e.g.
 *
-* Pattern equivalence is line-literal: `node_modules/` and `node_modules`
-* are treated as different entries. This is intentional — `git` treats
-* them differently (the trailing slash restricts the match to
-* directories), and the AC pins the trailing-slash form.
+*   `PostgreSQL 14.10 on x86_64-pc-linux-gnu, ...`  → `"14.10"`
+*   `PostgreSQL 16beta1 on …`                       → `"16"` (we
+*      conservatively drop the suffix; minimum-version comparisons
+*      treat 16beta1 as 16, which is what every reasonable user
+*      expects).
 *
-* Returns `null` when no changes are required (file already contains
-* every required entry). The caller can use this to decide whether to
-* include `.gitignore` in `filesWritten`.
+* Exported for unit tests.
 */
-function mergeGitignore(existing) {
-	if (existing === void 0) return `${REQUIRED_GITIGNORE_ENTRIES.join("\n")}\n`;
-	const present = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
-	const missing = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !present.has(entry));
-	if (missing.length === 0) return null;
-	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
+function parsePostgresVersion(versionString) {
+	const match = versionString.match(/PostgreSQL\s+(\d+(?:\.\d+)?)/i);
+	if (match === null || match[1] === void 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", `Could not parse PostgreSQL version from \`${versionString}\``);
+	return match[1];
+}
+async function defaultProbeMongo(databaseUrl, baseDir, overrides) {
+	const client = new (requirePeer("mongodb", baseDir, overrides)).MongoClient(databaseUrl);
+	await client.connect();
+	try {
+		const buildInfo = await client.db().admin().command({ buildInfo: 1 });
+		const versionString = String(buildInfo.version ?? "");
+		if (versionString.length === 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", "buildInfo did not include a `version` field");
+		return { serverVersion: versionString };
+	} finally {
+		await client.close().catch(() => void 0);
+	}
 }
-const REQUIRED_SCRIPTS = [{
-	name: "contract:emit",
-	command: "prisma-next contract emit"
-}];
 /**
-* Idempotent `package.json#scripts` merge with collision detection
-* (FR3.5 / FR9.3):
-*
-* - If a required script is **missing**, append it.
-* - If a required script is **already present and identical**, leave
-*   the file alone (idempotency).
-* - If a required script is **present but maps to a different command**,
-*   skip the write for that script and surface a structured warning.
-*   The user's override is sacred — `init` should never silently
-*   overwrite a custom build pipeline.
-*
-* Preserves the existing key order (so a user who has alphabetised
-* their scripts does not see them reshuffled) and appends new entries
-* at the end.
-*
-* The `package.json` is parsed and re-stringified through `JSON` —
-* comments are not preserved (package.json does not support them per
-* spec). Trailing newline matches the original input's trailing
-* newline behaviour.
+* Loads a peer driver (`pg` / `mongodb`) from the user's project
+* `node_modules`. We deliberately resolve from `baseDir` rather than
+* from the CLI bundle — the CLI does not depend on `pg` or `mongodb`
+* directly, but the user's `init`-generated `package.json` does (via
+* the target facade). Failure to resolve is folded into a typed
+* `DriverMissingError` so `probeServerVersion` can map it to a
+* `driver-missing` outcome rather than letting a `MODULE_NOT_FOUND`
+* leak as a generic connection failure.
 */
-function mergePackageScripts(existing, required = REQUIRED_SCRIPTS) {
-	const parsed = blindCast(JSON.parse(existing));
-	const scripts = typeof parsed["scripts"] === "object" && parsed["scripts"] !== null ? { ...blindCast(parsed["scripts"]) } : {};
-	const warnings = [];
-	let mutated = false;
-	for (const { name, command } of required) {
-		const existingValue = scripts[name];
-		if (existingValue === void 0) {
-			scripts[name] = command;
-			mutated = true;
-			continue;
-		}
-		if (existingValue !== command) warnings.push(`package.json already has a "${name}" script with a different command — keeping yours.\n  existing: ${existingValue}\n  expected: ${command}\nIf you want the default, remove your "${name}" script and re-run \`init\`.`);
+function requirePeer(moduleId, baseDir, overrides) {
+	try {
+		if (overrides.requireFromBaseDir !== void 0) return overrides.requireFromBaseDir(baseDir, moduleId);
+		return createRequire(join(baseDir, "package.json"))(moduleId);
+	} catch (err) {
+		throw new DriverMissingError(`\`${moduleId}\` is not installed in this project (resolved from ${baseDir}; cause: ${causeMessage(err)})`);
 	}
-	if (!mutated) return {
-		content: null,
-		warnings
-	};
-	parsed["scripts"] = scripts;
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return {
-		content: `${JSON.stringify(parsed, null, 2)}${trailingNewline}`,
-		warnings
-	};
 }
 /**
-* Idempotently sets `"type": "module"` on a `package.json` so the
-* scaffolded `prisma/db.ts` — which uses the ESM-only `with { type: 'json' }`
-* import attribute — loads as ES module under Node's loader (TML-2494).
-*
-* Without this field Node either:
-*
-* - emits `MODULE_TYPELESS_PACKAGE_JSON` and reparses the file as ESM
-*   with a perf penalty (Node 22+ with `--experimental-strip-types`), or
-* - hard-fails with `ERR_*` because the CJS loader cannot parse the
-*   import-attribute syntax (older Node, or any tool that doesn't
-*   reparse).
-*
-* Behaviour:
-*
-* - **Field missing** → set to `"module"`. New entry is inserted right
-*   after `"name"` (when present) so the diff lands in a conventional
-*   spot for human review; falls through to the natural append position
-*   otherwise.
-* - **Field already `"module"`** → no-op (idempotent).
-* - **Field set to anything else** (e.g. `"commonjs"`) → leave it alone
-*   and surface a structured warning. The user explicitly opted out of
-*   ESM and we don't silently overwrite that.
+* Default base for the GitHub-URL form `<owner>/<repo>` consumed by
+* upstream `skills add`. Each `SkillSource` joins this base with its
+* own subpath (and optional `#ref` for version-pinned clusters).
 */
-function ensureEsmModuleType(existing) {
-	const parsed = blindCast(JSON.parse(existing));
-	const currentType = parsed["type"];
-	if (currentType === "module") return {
-		content: null,
-		warning: null
-	};
-	if (typeof currentType === "string" && currentType !== "module") return {
-		content: null,
-		warning: `package.json declares "type": "${currentType}" — keeping yours, but the scaffolded prisma/db.ts uses an ESM-only import attribute (\`with { type: 'json' }\`) and will not load under that module type.\nIf you want the default, set "type": "module" in package.json.`
-	};
-	const next = {};
-	let inserted = false;
-	for (const [key, value] of Object.entries(parsed)) {
-		if (key === "type") continue;
-		next[key] = value;
-		if (!inserted && key === "name") {
-			next["type"] = "module";
-			inserted = true;
-		}
+const DEFAULT_SKILL_BASE = "prisma/prisma";
+const DEFAULT_SKILL_SOURCES = [
+	{
+		subpath: "skills",
+		skill: "prisma-8",
+		ref: "cli",
+		description: "usage skill (version-locked to installed Prisma Next)"
+	},
+	{
+		subpath: "skills",
+		skill: "prisma-next-upgrade",
+		ref: null,
+		description: "upgrade skill (always tracks `main`)"
+	},
+	{
+		subpath: "skills",
+		skill: "prisma-8-extension-upgrade",
+		ref: null,
+		description: "extension-author upgrade skill (always tracks `main`)"
 	}
-	if (!inserted) next["type"] = "module";
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return {
-		content: `${JSON.stringify(next, null, 2)}${trailingNewline}`,
-		warning: null
-	};
-}
-const TARGET_ALIASES = /* @__PURE__ */ new Map([
-	["postgres", "postgres"],
-	["postgresql", "postgres"],
-	["mongo", "mongo"],
-	["mongodb", "mongo"]
-]);
-const AUTHORING_VALUES = /* @__PURE__ */ new Map([
-	["psl", "psl"],
-	["typescript", "typescript"],
-	["ts", "typescript"]
-]);
+];
 /**
-* Resolves every required input for `runInit`. In interactive mode, missing
-* inputs are prompted via clack; in non-interactive mode, missing required
-* inputs throw a structured error listing exactly which flags are missing
-* (FR1.4). Throws `CliStructuredError` on any unrecoverable input issue.
+* Test-only escape hatch for pinning the install base to a local
+* checkout. Production runs leave this unset, so installs always use
+* `DEFAULT_SKILL_BASE`.
 *
-* `canPrompt` is decoupled from `flags.interactive` so the action handler
-* (`./index.ts`) owns the merge of stdout-TTY (decoration) and stdin-TTY
-* (prompts). `flags.interactive` continues to gate `TerminalUI` decoration
-* — see [Style Guide § Interactivity](../../../../../../../docs/CLI%20Style%20Guide.md#interactivity).
+* When set to an absolute filesystem path (typical for tests), the
+* `#ref` fragment is dropped — local-path mode in upstream's CLI does
+* not accept refs, and the local clone has whatever content the test
+* checked into it anyway. When set to anything else (e.g. a fork name
+* `myuser/prisma-next`), the ref policy is preserved.
 */
-async function resolveInitInputs(ctx) {
-	const { baseDir, options, flags, canPrompt } = ctx;
-	const force = Boolean(options.force);
-	const autoAcceptPrompts = Boolean(flags.yes);
-	if (options.strictProbe && !options.probeDb) throw errorInitStrictProbeWithoutProbe();
-	const reinit = await resolveReinit({
-		baseDir,
-		force,
-		canPrompt,
-		autoAcceptPrompts
-	});
-	const target = resolveTarget(options.target);
-	const authoring = resolveAuthoring(options.authoring);
-	const missing = [];
-	if (target === void 0) missing.push("target");
-	if (authoring === void 0) missing.push("authoring");
-	if (!canPrompt && missing.length > 0) throw errorInitMissingFlags({
-		missing,
-		why: process.stdin.isTTY ? "Non-interactive mode is active (`--no-interactive` or stdout is piped)." : "stdin is not a TTY, so `init` cannot prompt interactively."
-	});
-	const finalTarget = target ?? await promptTarget();
-	const finalAuthoring = authoring ?? await promptAuthoring();
-	const finalSchemaPath = options.schemaPath !== void 0 ? validateSchemaPath(options.schemaPath, finalAuthoring) : canPrompt ? await promptSchemaPath(finalAuthoring) : defaultSchemaPath(finalAuthoring);
-	const writeEnv = await resolveWriteEnv({
-		flag: options.writeEnv,
-		canPrompt,
-		autoAcceptPrompts
-	});
-	const removePreviousFacade = await resolveRemovePreviousFacade({
-		baseDir,
-		target: finalTarget,
-		reinit,
-		force,
-		canPrompt,
-		autoAcceptPrompts
-	});
-	const installProjectSkill = options.skill !== false;
-	return {
-		target: finalTarget,
-		authoring: finalAuthoring,
-		schemaPath: finalSchemaPath,
-		install: options.install !== false,
-		writeEnv,
-		probeDb: Boolean(options.probeDb),
-		strictProbe: Boolean(options.strictProbe),
-		reinit,
-		removePreviousFacade,
-		installProjectSkill
-	};
+function resolveAgentSkillBase(env) {
+	const override = env["PRISMA_NEXT_SKILLS_BASE"]?.trim();
+	return override && override.length > 0 ? override : DEFAULT_SKILL_BASE;
 }
-async function resolveWriteEnv(opts) {
-	if (opts.flag !== void 0) return Boolean(opts.flag);
-	if (!opts.canPrompt || opts.autoAcceptPrompts) return false;
-	const result = await clack.confirm({
-		message: "Also write a .env file from .env.example? (gitignored)",
-		initialValue: false,
-		output: process.stderr
-	});
-	if (clack.isCancel(result)) throw errorInitUserAborted();
-	return Boolean(result);
+function isLocalPath(base) {
+	return base.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(base);
+}
+/**
+* Agents passed to every project-level init install. Upstream `skills add`
+* is the source of truth for per-agent install behaviour; the CLI lists
+* every supported runtime on one invocation and delegates the rest.
+*/
+const DEFAULT_SKILL_AGENTS = [
+	"cursor",
+	"claude-code",
+	"codex",
+	"windsurf"
+];
+/**
+* Build the `<base>/<subpath>[#ref]` URL the `skills` CLI will
+* resolve. Exported for unit tests so the per-source format can be
+* asserted without going through the full install loop.
+*/
+function formatSkillSourceUrl(source, env = process.env) {
+	const base = resolveAgentSkillBase(env);
+	const url = `${base}/${source.subpath}`;
+	if (source.ref === null) return url;
+	if (isLocalPath(base)) return url;
+	if (source.ref === "cli") return `${url}#v${version}`;
+	return url;
 }
 /**
-* FR9.2 — detects whether re-init is switching targets (the previous
-* facade differs from the chosen target's facade) and resolves the
-* remove-or-keep question.
+* The skill-install command for one source, formatted for the
+* project's detected package manager. `npx`/`pnpm dlx`/`bunx` are
+* interchangeable to the user; we pick the variant that matches the
+* rest of the install step so a single project consistently uses one
+* runner.
 *
-* The non-interactive contract is the same as the `--force` re-init
-* gate above: a non-interactive run that reaches this helper always
-* has `--force` (otherwise `resolveReinit` would have thrown 5002), so
-* the removal proceeds without further prompting. Interactive runs see
-* a `clack.confirm` with `initialValue: true` — the destructive default
-* is correct because keeping both facades produces a project that
-* imports from one but pays for both in the lockfile, which is a
-* silent foot-gun the user almost never wants.
+* `--agent` takes space-separated slugs on one flag; the explicit
+* `--skill <name>` and `-y` skip the multi-select prompts a
+* non-interactive scaffold step cannot show.
 *
-* Returns the previous facade package name when the user consented (or
-* was force-ed) to remove it, otherwise `null`. Parse failures on
-* `package.json` resolve to `null` here — `runInit`'s precondition
-* gate surfaces a structured 5010 error for the same file shortly
-* after, so we avoid double-reporting and keep this helper side-effect
-* free under hostile inputs.
+* Exported for unit tests so the per-PM dispatch can be asserted
+* without a live subprocess.
 */
-async function resolveRemovePreviousFacade(opts) {
-	if (!opts.reinit) return null;
-	const packageJsonPath = join(opts.baseDir, "package.json");
-	if (!existsSync(packageJsonPath)) return null;
-	const otherTarget = opts.target === "postgres" ? "mongo" : "postgres";
-	const otherFacadeNames = [targetPackageName(otherTarget, scaffoldSpecifierResolverFor(otherTarget)), targetPackageName(otherTarget)];
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
-	} catch {
-		return null;
-	}
-	const deps = parsed["dependencies"];
-	if (deps === null || typeof deps !== "object" || Array.isArray(deps)) return null;
-	const otherFacade = otherFacadeNames.find((name) => Object.hasOwn(deps, name));
-	if (otherFacade === void 0) return null;
-	if (opts.force || opts.canPrompt && opts.autoAcceptPrompts) return otherFacade;
-	if (!opts.canPrompt) return otherFacade;
-	const result = await clack.confirm({
-		message: `Switching from ${targetLabel(otherTarget)} to ${targetLabel(opts.target)} — remove ${otherFacade} from package.json dependencies?`,
-		initialValue: true,
-		output: process.stderr
-	});
-	if (clack.isCancel(result)) throw errorInitUserAborted();
-	return result === true ? otherFacade : null;
-}
-async function resolveReinit(opts) {
-	if (!existsSync(join(opts.baseDir, "prisma-next.config.ts"))) return false;
-	if (opts.force) return true;
-	if (!opts.canPrompt) throw errorInitReinitNeedsForce();
-	if (opts.autoAcceptPrompts) return true;
-	const result = await clack.confirm({
-		message: "This project is already initialized. Re-initialize? This will overwrite all generated files.",
-		initialValue: false,
-		output: process.stderr
-	});
-	if (clack.isCancel(result) || result !== true) throw errorInitUserAborted();
-	return true;
+function formatSkillInstallCommand(args) {
+	const agents = args.agents ?? DEFAULT_SKILL_AGENTS;
+	const cliArgs = [
+		"skills@latest",
+		"add",
+		formatSkillSourceUrl(args.source, args.env),
+		"--agent",
+		...agents,
+		"--skill",
+		args.source.skill,
+		"-y"
+	];
+	return formatPackageManagerCommand(args.pm, cliArgs);
 }
+/**
+* Ordered skill-install commands for one init run. This is both what the
+* commander shell runs and what either shell tells the user to run when the
+* install is skipped or fails — the commands need no scaffold and no `init`.
+*/
+function resolveProjectSkillInstallCommands(pm, env) {
+	return DEFAULT_SKILL_SOURCES.map((source) => formatSkillInstallCommand({
+		pm,
+		source,
+		...ifDefined("env", env)
+	}));
+}
+function formatPackageManagerCommand(pm, args) {
+	switch (pm) {
+		case "pnpm": return `pnpm dlx ${args.join(" ")}`;
+		case "yarn": return `yarn dlx ${args.join(" ")}`;
+		case "bun": return `bunx ${args.join(" ")}`;
+		case "deno": return `deno run -A npm:${args.join(" ")}`;
+		case "npm": return `npx ${args.join(" ")}`;
+	}
+}
+/**
+* Skill directories that predate the consolidated `prisma-8` skill:
+* the per-workflow usage cluster (including the renamed
+* `prisma-8-migration-review` spelling it briefly shipped under), the
+* pre-rename spellings of the consolidated skill and the
+* extension-author upgrade skill, and any hand-rolled `prisma-next`
+* stub. Projects initialised before the consolidation carry these as
+* sibling directories in each agent's install root; left in place
+* they compete with the current skills for activation, so init
+* removes them on every run.
+*/
+const RETIRED_SKILL_NAMES = [
+	"prisma-next",
+	"prisma-next-quickstart",
+	"prisma-next-contract",
+	"prisma-next-migrations",
+	"prisma-next-migration-review",
+	"prisma-8-migration-review",
+	"prisma-next-queries",
+	"prisma-next-runtime",
+	"prisma-next-build",
+	"prisma-next-supabase",
+	"prisma-next-debug",
+	"prisma-next-feedback",
+	"prisma-next-extension-upgrade"
+];
+/**
+* Project-level install roots the upstream `skills` CLI uses for the
+* agents in `DEFAULT_SKILL_AGENTS`: cursor and codex install into
+* `.agents/skills`, claude-code into `.claude/skills`, windsurf into
+* `.windsurf/skills`.
+*/
+const AGENT_SKILL_ROOTS = [
+	".agents/skills",
+	".claude/skills",
+	".windsurf/skills"
+];
+/**
+* Every directory a retired per-workflow skill may occupy in a
+* consumer project. Init deletes each (recursively) before running the
+* skill install.
+*/
+function legacySkillDirs() {
+	return AGENT_SKILL_ROOTS.flatMap((root) => RETIRED_SKILL_NAMES.map((name) => `${root}/${name}`));
+}
+/**
+* The minimum supported server version for each target. The
+* authoritative source of truth is each target package's
+* `package.json#prismaNext.minServerVersion` field — this module
+* mirrors those values and a workspace-level test asserts the two
+* never drift (`templates/tsconfig-env.test.ts`).
+*
+* Bumping a value here in isolation is **not** safe: edit the
+* corresponding target package's `package.json` first, then mirror
+* here. The scaffold's `.env.example` and the "Requirements" section
+* of `prisma-next.md` both read from this constant, so a stale value
+* lies to every freshly initialised user.
+*/
+const MIN_SERVER_VERSION = {
+	postgres: "17",
+	mongo: "8.0"
+};
+const TARGET_LABEL = {
+	postgres: "PostgreSQL",
+	mongo: "MongoDB"
+};
+/**
+* Renders the placeholder body shared by `.env` and `.env.example`:
+* the target-specific connection-string requirement comments and the
+* commented-shape `DATABASE_URL` line. The output is identical for both
+* authoring styles — the env file is orthogonal to PSL vs TS schema
+* authoring.
+*/
+function envPlaceholderBody(target) {
+	const label = TARGET_LABEL[target];
+	const minVersion = MIN_SERVER_VERSION[target];
+	const lines = [];
+	lines.push(`# Connection string for ${label}.`);
+	lines.push(`# Requires ${label} >= ${minVersion}.`);
+	lines.push("");
+	if (target === "postgres") lines.push("DATABASE_URL=\"postgresql://user:password@localhost:5432/mydb\"");
+	else {
+		lines.push("# Standalone local mongod / `docker run mongo:8` — no replica set required for first-run queries.");
+		lines.push("# Transactions and change streams need a replica set; add ?replicaSet=... only after initiating one.");
+		lines.push("");
+		lines.push("DATABASE_URL=\"mongodb://user:password@localhost:27017/mydb\"");
+	}
+	lines.push("");
+	return lines.join("\n");
+}
+/**
+* Renders the `.env.example` content for a given target:
+*
+* - Carries a "Copy this file to `.env`…" intro that only makes sense
+*   for the example file (the real `.env` is the destination of that
+*   copy and so does not get the same intro).
+* - Documents the `DATABASE_URL` placeholder in the target's native URL
+*   shape (Postgres: standard `postgresql://`, Mongo: `mongodb://` plus
+*   a `mydb` database segment so the lazy facade has a `dbName`).
+* - Carries a `# Requires <db> >= <version>` comment so a fresh user
+*   knows the minimum supported server before they first try to connect.
+*/
+function envExampleContent(target) {
+	const lines = [];
+	lines.push("# Copy this file to `.env` and replace the placeholder with your real connection string.");
+	lines.push(envPlaceholderBody(target));
+	return lines.join("\n");
+}
+/**
+* Renders the initial `.env` content for `--write-env` / interactive
+* opt-in. Same placeholder body as `.env.example`, **without** the
+* example file's "Copy this file to `.env`…" intro: the real `.env` is
+* the destination of that copy, so the line would lie. Writing this
+* file is gitignored (`.env` lands in `.gitignore` during init).
+*/
+function envFileContent(target) {
+	return envPlaceholderBody(target);
+}
+const TARGET_ALIASES = /* @__PURE__ */ new Map([
+	["postgres", "postgres"],
+	["postgresql", "postgres"],
+	["mongo", "mongo"],
+	["mongodb", "mongo"]
+]);
+const AUTHORING_VALUES = /* @__PURE__ */ new Map([
+	["psl", "psl"],
+	["typescript", "typescript"],
+	["ts", "typescript"]
+]);
 function resolveTarget(value) {
 	if (value === void 0) return void 0;
 	const mapped = TARGET_ALIASES.get(value.toLowerCase());
@@ -820,587 +836,363 @@ function validateSchemaPath(value, authoring) {
 	});
 	return normalize(trimmed);
 }
-async function promptTarget() {
-	const result = await clack.select({
-		message: "What database are you using?",
-		options: [{
-			value: "postgres",
-			label: "PostgreSQL"
-		}, {
-			value: "mongo",
-			label: "MongoDB"
-		}],
-		output: process.stderr
-	});
-	if (clack.isCancel(result)) throw errorInitUserAborted();
-	return result;
-}
-async function promptAuthoring() {
-	const result = await clack.select({
-		message: "How do you want to write your schema?",
-		options: [{
-			value: "psl",
-			label: "Prisma Schema Language (.prisma)"
-		}, {
-			value: "typescript",
-			label: "TypeScript (.ts)"
-		}],
-		output: process.stderr
-	});
-	if (clack.isCancel(result)) throw errorInitUserAborted();
-	return result;
-}
-async function promptSchemaPath(authoring) {
-	const expectedExt = authoring === "typescript" ? ".ts" : ".prisma";
-	const result = await clack.text({
-		message: "Where should the schema file go?",
-		initialValue: defaultSchemaPath(authoring),
-		validate(value = "") {
-			const trimmed = value.trim();
-			if (trimmed.length === 0) return "Path cannot be empty";
-			if (trimmed.endsWith("/") || trimmed.endsWith("\\")) return "Path must be a file, not a directory";
-			const ext = extname(trimmed).toLowerCase();
-			if (ext === "") return "Path must include a file extension (e.g. .prisma or .ts)";
-			if (ext !== expectedExt) return `Schema path must end in ${expectedExt} for --authoring ${authoring} (got ${ext}).`;
-		},
-		output: process.stderr
-	});
-	if (clack.isCancel(result)) throw errorInitUserAborted();
-	return validateSchemaPath(result, authoring);
-}
-/**
-* Connects (when configured) to the user's database and returns a
-* structured outcome describing whether the server meets the declared
-* minimum (FR8.1). Pure with respect to its inputs: no I/O happens
-* unless `databaseUrl` is set.
-*
-* The outcome is shaped so that `--strict-probe` can branch on the
-* `kind`/`meetsMinimum` pair without re-stringifying the message:
-*
-* - `ok` — informational; `init` continues.
-* - `below-minimum` — warning; `init` continues regardless of
-*   `--strict-probe` (the spec scopes strict-probe to "probe
-*   *failures*", and a successful probe that finds an old server is
-*   not a failure).
-* - `no-database-url` / `connection-failed` / `driver-missing` —
-*   warning by default, fatal under `--strict-probe`.
-*/
-async function probeServerVersion(ctx, overrides = {}) {
-	const { databaseUrl, minVersion, target } = ctx;
-	if (databaseUrl === void 0 || databaseUrl.trim().length === 0) return {
-		kind: "no-database-url",
-		minVersion,
-		meetsMinimum: null,
-		message: "Skipped --probe-db: DATABASE_URL is not set in the current shell environment. (init does not read .env for the probe; export the variable or drop --probe-db.)"
-	};
-	let driverResult;
-	try {
-		if (target === "postgres") driverResult = overrides.probePostgres !== void 0 ? await overrides.probePostgres(databaseUrl) : await defaultProbePostgres(databaseUrl, ctx.baseDir, overrides);
-		else driverResult = overrides.probeMongo !== void 0 ? await overrides.probeMongo(databaseUrl) : await defaultProbeMongo(databaseUrl, ctx.baseDir, overrides);
-	} catch (err) {
-		if (err instanceof DriverMissingError) return {
-			kind: "driver-missing",
-			minVersion,
-			meetsMinimum: null,
-			cause: err.message,
-			message: `Skipped --probe-db: ${err.message}. (Run with install enabled, or install the driver yourself, then re-run \`prisma-next init --probe-db\`.)`
-		};
-		const cause = redactDatabaseUrlSecrets(causeMessage$1(err));
-		return {
-			kind: "connection-failed",
-			minVersion,
-			meetsMinimum: null,
-			cause,
-			message: `--probe-db could not connect: ${cause}.`
-		};
-	}
-	if (compareVersionPrefix(driverResult.serverVersion, minVersion) < 0) return {
-		kind: "below-minimum",
-		serverVersion: driverResult.serverVersion,
-		minVersion,
-		meetsMinimum: false,
-		message: `--probe-db: server reports version ${driverResult.serverVersion}, below the declared minimum (${minVersion}). Some queries may fail until the server is upgraded.`
-	};
-	return {
-		kind: "ok",
-		serverVersion: driverResult.serverVersion,
-		minVersion,
-		meetsMinimum: true,
-		message: `--probe-db: server reports version ${driverResult.serverVersion} (>= ${minVersion}).`
-	};
+const KNOWN = /* @__PURE__ */ new Set([
+	"pnpm",
+	"npm",
+	"yarn",
+	"bun",
+	"deno"
+]);
+function isPackageManager(name) {
+	return KNOWN.has(name);
 }
 /**
-* Compares two semver-prefix strings ("14", "14.2", "6.0", …) by
-* numeric components left-to-right. Returns a negative number when `a`
-* is older than `b`, zero when both versions agree on every numeric
-* component (treating missing trailing components as `0`), and a
-* positive number when `a` is newer.
+* Resolves the package manager `init` should drive for `add` / `install`
+* commands. Tries, in order:
 *
-* The loop runs over the **longer** of the two prefixes so that
-* `'14'` compares less than `'14.1'` — without that, the shorter
-* prefix would be silently accepted whenever the configured minimum
-* has a non-zero minor or patch.
+*  1. **`detect()`** — walks up from `cwd` looking for a lockfile, the
+*     `packageManager` field, the `devEngines.packageManager` field, or
+*     install metadata. This is the right answer whenever the user is
+*     anywhere inside an existing project, including a deep workspace
+*     subdirectory.
 *
-* Exported for unit tests.
-*/
-function compareVersionPrefix(a, b) {
-	const aParts = parseNumericParts(a);
-	const bParts = parseNumericParts(b);
-	const len = Math.max(aParts.length, bParts.length);
-	for (let i = 0; i < len; i += 1) {
-		const aPart = aParts[i] ?? 0;
-		const bPart = bParts[i] ?? 0;
-		if (aPart !== bPart) return aPart - bPart;
-	}
-	return 0;
-}
-function parseNumericParts(version) {
-	const match = version.match(/^[^\d]*(\d+(?:\.\d+){0,3})/);
-	if (match === null) return [];
-	return (match[1] ?? "").split(".").map((part) => Number.parseInt(part, 10));
-}
-var DriverMissingError = class extends Error {};
-function causeMessage$1(err) {
-	if (err instanceof Error) return err.message;
-	return String(err);
-}
-/**
-* Strips `user:password@` userinfo from any URL-shaped substring before
-* we surface the cause to the user. Mirrors `redactSecrets` in
-* `init.ts` — the probe path has its own redactor because the inputs
-* here include the raw connection string by construction (driver
-* errors echo the URL back).
+*  2. **`getUserAgent()`** — parses `npm_config_user_agent`, the env var
+*     every PM sets when it spawns a script. This catches the
+*     bare-directory case where there's no project to walk up to but the
+*     user invoked us via `pnpm dlx prisma-next init` / `bunx
+*     prisma-next init` / `yarn dlx …`. Same signal used by every
+*     `create-*` tool in the ecosystem (`create-vite`, `create-next-app`,
+*     `create-astro`, `@antfu/ni`, …).
 *
-* Exported for unit tests.
+*  3. **`npm`** — final fallback. Always present alongside Node.
 */
-function redactDatabaseUrlSecrets(text) {
-	if (!text) return text;
-	return text.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
+async function detectPackageManager(cwd) {
+	const detected = await detect({ cwd });
+	if (detected && isPackageManager(detected.name)) return detected.name;
+	const userAgent = getUserAgent();
+	if (userAgent !== null && isPackageManager(userAgent)) return userAgent;
+	return "npm";
 }
-async function defaultProbePostgres(databaseUrl, baseDir, overrides) {
-	const client = new (requirePeer("pg", baseDir, overrides)).Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		const result = await client.query("SELECT version() as version");
-		return { serverVersion: parsePostgresVersion(String(result?.rows?.[0]?.version ?? "")) };
-	} finally {
-		await client.end().catch(() => void 0);
-	}
+function hasProjectManifest(cwd) {
+	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
 }
-/**
-* Extracts the numeric prefix from a Postgres `version()` row, e.g.
-*
-*   `PostgreSQL 14.10 on x86_64-pc-linux-gnu, ...`  → `"14.10"`
-*   `PostgreSQL 16beta1 on …`                       → `"16"` (we
-*      conservatively drop the suffix; minimum-version comparisons
-*      treat 16beta1 as 16, which is what every reasonable user
-*      expects).
-*
-* Exported for unit tests.
-*/
-function parsePostgresVersion(versionString) {
-	const match = versionString.match(/PostgreSQL\s+(\d+(?:\.\d+)?)/i);
-	if (match === null || match[1] === void 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", `Could not parse PostgreSQL version from \`${versionString}\``);
-	return match[1];
+function formatRunCommand(pm, bin, args) {
+	if (pm === "npm") return `npx ${bin} ${args}`;
+	if (pm === "deno") return `deno run npm:${bin} ${args}`;
+	return `${pm} ${bin} ${args}`;
 }
-async function defaultProbeMongo(databaseUrl, baseDir, overrides) {
-	const client = new (requirePeer("mongodb", baseDir, overrides)).MongoClient(databaseUrl);
-	await client.connect();
-	try {
-		const buildInfo = await client.db().admin().command({ buildInfo: 1 });
-		const versionString = String(buildInfo.version ?? "");
-		if (versionString.length === 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", "buildInfo did not include a `version` field");
-		return { serverVersion: versionString };
-	} finally {
-		await client.close().catch(() => void 0);
+function formatRunScriptCommand(pm, scriptName) {
+	switch (pm) {
+		case "deno": return `deno task ${scriptName}`;
+		case "bun": return `bun run ${scriptName}`;
+		case "pnpm": return `pnpm run ${scriptName}`;
+		case "yarn": return `yarn run ${scriptName}`;
+		default: return `npm run ${scriptName}`;
 	}
 }
-/**
-* Loads a peer driver (`pg` / `mongodb`) from the user's project
-* `node_modules`. We deliberately resolve from `baseDir` rather than
-* from the CLI bundle — the CLI does not depend on `pg` or `mongodb`
-* directly, but the user's `init`-generated `package.json` does (via
-* the target facade). Failure to resolve is folded into a typed
-* `DriverMissingError` so `probeServerVersion` can map it to a
-* `driver-missing` outcome rather than letting a `MODULE_NOT_FOUND`
-* leak as a generic connection failure.
-*/
-function requirePeer(moduleId, baseDir, overrides) {
-	try {
-		if (overrides.requireFromBaseDir !== void 0) return overrides.requireFromBaseDir(baseDir, moduleId);
-		return createRequire(join(baseDir, "package.json"))(moduleId);
-	} catch (err) {
-		throw new DriverMissingError(`\`${moduleId}\` is not installed in this project (resolved from ${baseDir}; cause: ${causeMessage$1(err)})`);
-	}
+function formatAddArgs(pm, packages) {
+	if (pm === "deno") return ["add", ...packages.map((p) => `npm:${p}`)];
+	return ["add", ...packages];
 }
-/**
-* Filenames the contract pipeline emits next to the user's schema source
-* (`<schemaDir>/contract.json`, `<schemaDir>/contract.d.ts`, …). Mirrors
-* the schema-dir-relative `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
-* (not that file's migrations-root-anchored store lines, which are outside
-* this command's scope — reinit only ever touches `schemaDir`); kept as a
-* separate constant here because the cleanup contract is target-agnostic
-* and we deliberately do not want a stale artifact from a previous target
-* lingering after a re-init.
-*
-* If a future emit pipeline produces an additional schema-dir artifact,
-* add it here **and** to `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
-* — the two stay in lockstep so the file `init` advertises as
-* `linguist-generated` is exactly the file `init` is willing to delete on
-* re-init.
-*/
-const ARTIFACT_FILENAMES = [
-	"contract.json",
-	"contract.d.ts",
-	"ops.json",
-	"migration.json"
-];
-/**
-* Returns the schema-relative paths of stale contract artifacts the
-* previous `init` run (or a `contract emit`) left behind in `schemaDir`.
-* Paths are returned relative to `baseDir` so the caller can plumb them
-* into `filesWritten`-style logging without re-deriving the path.
-*
-* Pure function: no filesystem mutation. Used by `runInit`'s precondition
-* phase (FR6.2 / NFR3 atomicity) so a downstream parse failure leaves
-* the artifacts on disk and the project byte-identical to its pre-init
-* state.
-*/
-function findStaleArtifacts(baseDir, schemaDir) {
-	const result = [];
-	for (const filename of ARTIFACT_FILENAMES) {
-		const rel = join(schemaDir, filename);
-		if (existsSync(join(baseDir, rel))) result.push(rel);
-	}
-	return result;
+function formatAddDevArgs(pm, packages) {
+	if (pm === "deno") return [
+		"add",
+		"--dev",
+		...packages.map((p) => `npm:${p}`)
+	];
+	return [
+		"add",
+		"-D",
+		...packages
+	];
 }
 /**
-* Drops a single key from `package.json#dependencies`, returning the new
-* file content. Returns `null` when the dependency was already absent —
-* the caller can skip the write to keep re-init idempotent (FR9.3).
-*
-* Used by `runInit` for the FR9.2 target-switch path: when the user
-* re-inits a project from `--target postgres` to `--target mongodb` (or
-* vice versa), the previous facade is removed from `dependencies` so the
-* resulting project depends only on the chosen target's facade.
-*
-* Devs/peers/optional dep groups are intentionally *not* touched — the
-* facades are only ever in `dependencies` (FR4 / FR7), and broadening
-* the search would risk clobbering an unrelated dep with the same name
-* in `peerDependencies`.
+* The `.gitattributes` entries written for a freshly initialised project
+* (FR3.4). Mirrors the relevant subset of the repo-root
+* [`.gitattributes`](../../../../../../../../.gitattributes):
 *
-* Throws `SyntaxError` if `existing` is not parseable as JSON; the
-* caller (`runInit`) already guards on that with a structured 5010
-* error before this helper is reached.
-*/
-function removeDependency(existing, depName) {
-	const parsed = JSON.parse(existing);
-	const deps = parsed["dependencies"];
-	if (deps === null || typeof deps !== "object" || Array.isArray(deps)) return null;
-	if (!Object.hasOwn(deps, depName)) return null;
-	const next = { ...deps };
-	delete next[depName];
-	parsed["dependencies"] = next;
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return `${JSON.stringify(parsed, null, 2)}${trailingNewline}`;
-}
-const exec = promisify(execFile);
-/**
-* Default base for the GitHub-URL form `<owner>/<repo>` consumed by
-* upstream `skills add`. Each `SkillSource` joins this base with its
-* own subpath (and optional `#ref` for version-pinned clusters).
-*/
-const DEFAULT_SKILL_BASE = "prisma/prisma";
-const DEFAULT_SKILL_SOURCES = [
-	{
-		subpath: "skills",
-		skill: "prisma-8",
-		ref: "cli",
-		description: "usage skill (version-locked to installed Prisma Next)"
-	},
-	{
-		subpath: "skills",
-		skill: "prisma-next-upgrade",
-		ref: null,
-		description: "upgrade skill (always tracks `main`)"
-	},
-	{
-		subpath: "skills",
-		skill: "prisma-8-extension-upgrade",
-		ref: null,
-		description: "extension-author upgrade skill (always tracks `main`)"
-	}
-];
-/**
-* Test-only escape hatch for pinning the install base to a local
-* checkout. Production runs leave this unset, so installs always use
-* `DEFAULT_SKILL_BASE`.
+* - **Today**: `contract.json`, `contract.d.ts` are emitted on every
+*   `prisma-next contract emit`. Marking them `linguist-generated`
+*   keeps GitHub's diff stats honest and collapses the file in code
+*   review by default.
+* - **Forward-looking**: `ops.json`, `migration.json` are not yet emitted
+*   by `init` flows but will be produced by adjacent commands (lower /
+*   migration tooling). Adding them now matches Decision 5
+*   (forward-looking subset) so the file does not need to be amended
+*   every time a new artifact lands.
 *
-* When set to an absolute filesystem path (typical for tests), the
-* `#ref` fragment is dropped — local-path mode in upstream's CLI does
-* not accept refs, and the local clone has whatever content the test
-* checked into it anyway. When set to anything else (e.g. a fork name
-* `myuser/prisma-next`), the ref policy is preserved.
+* `ARTIFACT_FILENAMES` entries are written relative to the schema
+* directory so a user who runs `init --schema-path db/contract.prisma`
+* gets `db/contract.json linguist-generated` — not the workspace-glob
+* form `<glob>/contract.json` (which would over-match any unrelated
+* `contract.json` the user has elsewhere) and not the absolute
+* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json` (which would silently
+* break for a non-default schema path).
+*
+* The migration contract snapshot store (`migrations/snapshots/<hex>/`)
+* is anchored to the migrations root instead, not the schema directory:
+* migration package depth under `migrations/` varies (`app/<pkg>`,
+* `<space>/<pkg>`, or a bare `<pkg>` in extension source repos), so no
+* single schema-dir-relative pattern can reach every snapshot. See
+* `STORE_GITATTRIBUTES_LINES` below.
 */
-function resolveAgentSkillBase() {
-	const override = process.env["PRISMA_NEXT_SKILLS_BASE"]?.trim();
-	return override && override.length > 0 ? override : DEFAULT_SKILL_BASE;
-}
-function isLocalPath(base) {
-	return base.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(base);
-}
+const ARTIFACT_FILENAMES$1 = [
+	"contract.json",
+	"contract.d.ts",
+	"ops.json",
+	"migration.json"
+];
+const ATTRIBUTE = "linguist-generated";
 /**
-* Agents passed to every project-level init install. Upstream `skills add`
-* is the source of truth for per-agent install behaviour; the CLI lists
-* every supported runtime on one invocation and delegates the rest.
+* Full `.gitattributes` lines for the migration contract snapshot store,
+* already anchored to the migrations root — unlike `ARTIFACT_FILENAMES`,
+* these are not combined with the schema-relative prefix.
 */
-const DEFAULT_SKILL_AGENTS = [
-	"cursor",
-	"claude-code",
-	"codex",
-	"windsurf"
-];
+const STORE_GITATTRIBUTES_LINES = [`migrations/snapshots/**/contract.json ${ATTRIBUTE}`, `migrations/snapshots/**/contract.d.ts ${ATTRIBUTE}`];
 /**
-* Build the `<base>/<subpath>[#ref]` URL the `skills` CLI will
-* resolve. Exported for unit tests so the per-source format can be
-* asserted without going through the full install loop.
+* Computes the `.gitattributes` lines this scaffold expects to own. Each
+* line has the shape `<path> linguist-generated`. The `target` parameter
+* is currently unused but accepted for symmetry with the other hygiene
+* helpers and to leave room for target-specific entries (e.g. a future
+* family-specific artifact) without a signature break.
 */
-function formatSkillSourceUrl(source) {
-	const base = resolveAgentSkillBase();
-	const url = `${base}/${source.subpath}`;
-	if (source.ref === null) return url;
-	if (isLocalPath(base)) return url;
-	if (source.ref === "cli") return `${url}#v${version}`;
-	return url;
+function requiredGitattributesLines(schemaDir, _target) {
+	const dir = schemaDir === "." ? "" : schemaDir.replace(/\/+$/, "");
+	const prefix = dir === "" ? "" : `${dir}/`;
+	return [...ARTIFACT_FILENAMES$1.map((file) => `${prefix}${file} ${ATTRIBUTE}`), ...STORE_GITATTRIBUTES_LINES];
 }
 /**
-* The skill-install command for one source, formatted for the
-* project's detected package manager. `npx`/`pnpm dlx`/`bunx` are
-* interchangeable to the user; we pick the variant that matches the
-* rest of the install step so a single project consistently uses one
-* runner.
+* Idempotent `.gitattributes` merge (FR3.4 / FR9.3). Returns the new file
+* content given the existing content (or `undefined` if the file does
+* not yet exist).
 *
-* `--agent` takes space-separated slugs on one flag; the explicit
-* `--skill <name>` and `-y` skip the multi-select prompts a
-* non-interactive scaffold step cannot show.
+* Equivalence is exact-line: a user-customised line like
+* `prisma/*.json linguist-generated` is *not* recognised as covering
+* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json linguist-generated`. We accept that
+* over-specification — preserving the user's broad pattern *and*
+* appending the narrow one — because the narrow lines are what the
+* acceptance criteria pin (FR3.4 AC).
 *
-* Exported for unit tests so the per-PM dispatch can be asserted
-* without a live subprocess.
+* Returns `null` when no changes are required (file already contains
+* every required entry).
 */
-function formatSkillInstallCommand(args) {
-	const agents = args.agents ?? DEFAULT_SKILL_AGENTS;
-	const cliArgs = [
-		"skills@latest",
-		"add",
-		formatSkillSourceUrl(args.source),
-		"--agent",
-		...agents,
-		"--skill",
-		args.source.skill,
-		"-y"
-	];
-	return formatPackageManagerCommand(args.pm, cliArgs);
+function mergeGitattributes(existing, required) {
+	if (existing === void 0) return `${required.join("\n")}\n`;
+	const presentLines = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
+	const missing = required.filter((line) => !presentLines.has(line));
+	if (missing.length === 0) return null;
+	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
 }
 /**
-* Ordered skill-install commands for one init run. Exported for unit tests.
+* The minimal `.gitignore` lines a Prisma Next scaffold needs (FR3.3).
+* Order matches what Node tooling typically writes today.
+*
+* `node_modules/` first because it's the byte-largest miss; `dist/`
+* because the scaffolded `tsconfig.json` writes there; `.env` last so
+* the secret-bearing file is the one most-recently visible in any diff
+* (a paranoid-correct ordering — humans skim from the top).
 */
-function resolveProjectSkillInstallCommands(pm) {
-	return DEFAULT_SKILL_SOURCES.map((source) => formatSkillInstallCommand({
-		pm,
-		source
-	}));
-}
-function formatPackageManagerCommand(pm, args) {
-	switch (pm) {
-		case "pnpm": return `pnpm dlx ${args.join(" ")}`;
-		case "yarn": return `yarn dlx ${args.join(" ")}`;
-		case "bun": return `bunx ${args.join(" ")}`;
-		case "deno": return `deno run -A npm:${args.join(" ")}`;
-		case "npm": return `npx ${args.join(" ")}`;
-	}
-}
+const REQUIRED_GITIGNORE_ENTRIES = [
+	"node_modules/",
+	"dist/",
+	".env"
+];
 /**
-* Parse the project-pm-formatted command into an exec call. The
-* format-then-parse split keeps the user-facing command string the same
-* as the surface the structured error advertises, so a user who copies
-* the error's `fix` line gets the same invocation that init just
-* attempted. Single-quoted tokens are preserved in the display form so
-* shell-sensitive characters stay copy-safe, then stripped before
-* `execFile`.
+* Idempotent `.gitignore` merge (FR3.3 / FR9.3). Returns the new file
+* content given the existing content (or `undefined` if the file does
+* not yet exist). Adds only entries that are not already present and
+* never duplicates a line. Existing comments and blank lines are
+* preserved verbatim — `.gitignore` is parsed by `git` without a tree,
+* so any line modification risks changing semantics.
+*
+* Pattern equivalence is line-literal: `node_modules/` and `node_modules`
+* are treated as different entries. This is intentional — `git` treats
+* them differently (the trailing slash restricts the match to
+* directories), and the AC pins the trailing-slash form.
+*
+* Returns `null` when no changes are required (file already contains
+* every required entry). The caller can use this to decide whether to
+* include `.gitignore` in `filesWritten`.
 */
-function commandToExec(command) {
-	const tokens = (command.match(/'[^']*'|\S+/g) ?? []).map((token) => token.startsWith("'") && token.endsWith("'") ? token.slice(1, -1) : token);
-	return {
-		file: tokens[0] ?? "npx",
-		args: tokens.slice(1)
-	};
+function mergeGitignore(existing) {
+	if (existing === void 0) return `${REQUIRED_GITIGNORE_ENTRIES.join("\n")}\n`;
+	const present = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
+	const missing = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !present.has(entry));
+	if (missing.length === 0) return null;
+	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
 }
+const REQUIRED_SCRIPTS = [{
+	name: "contract:emit",
+	command: "prisma-next contract emit"
+}];
 /**
-* Runs the project-level skill install for every source in
-* `DEFAULT_SKILL_SOURCES`, in order. Returns
-* `{ ok: true, commands }` on success; throws a structured
-* `errorInitSkillInstallFailed` on the first failure (subsequent
-* sources are not attempted — the user opted into Prisma Next by
-* running `init` and a partial install would leave the project in an
-* ambiguous state). The throw is intentionally fatal — project-level
-* skill install is unconditional (modulo `--no-skill`).
+* Idempotent `package.json#scripts` merge with collision detection
+* (FR3.5 / FR9.3):
+*
+* - If a required script is **missing**, append it.
+* - If a required script is **already present and identical**, leave
+*   the file alone (idempotency).
+* - If a required script is **present but maps to a different command**,
+*   skip the write for that script and surface a structured warning.
+*   The user's override is sacred — `init` should never silently
+*   overwrite a custom build pipeline.
+*
+* Preserves the existing key order (so a user who has alphabetised
+* their scripts does not see them reshuffled) and appends new entries
+* at the end.
+*
+* The `package.json` is parsed and re-stringified through `JSON` —
+* comments are not preserved (package.json does not support them per
+* spec). Trailing newline matches the original input's trailing
+* newline behaviour.
 */
-async function runProjectLevelSkillInstall(ctx) {
-	const commands = [];
-	const installCommands = resolveProjectSkillInstallCommands(ctx.pm);
-	for (const command of installCommands) {
-		const { file, args } = commandToExec(command);
-		try {
-			await exec(file, args, { cwd: ctx.baseDir });
-			commands.push(command);
-		} catch (err) {
-			throw errorInitSkillInstallFailed({
-				skillInstallCommand: command,
-				filesWritten: ctx.filesWritten,
-				cause: redactSecrets$1(readChildStderr$1(err)) || (err instanceof Error ? err.message : String(err))
-			});
+function mergePackageScripts(existing, required = REQUIRED_SCRIPTS) {
+	const parsed = blindCast(JSON.parse(existing));
+	const scripts = typeof parsed["scripts"] === "object" && parsed["scripts"] !== null ? { ...blindCast(parsed["scripts"]) } : {};
+	const warnings = [];
+	let mutated = false;
+	for (const { name, command } of required) {
+		const existingValue = scripts[name];
+		if (existingValue === void 0) {
+			scripts[name] = command;
+			mutated = true;
+			continue;
 		}
+		if (existingValue !== command) warnings.push(`package.json already has a "${name}" script with a different command — keeping yours.\n  existing: ${existingValue}\n  expected: ${command}\nIf you want the default, remove your "${name}" script and re-run \`init\`.`);
 	}
+	if (!mutated) return {
+		content: null,
+		warnings
+	};
+	parsed["scripts"] = scripts;
+	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
 	return {
-		ok: true,
-		commands
+		content: `${JSON.stringify(parsed, null, 2)}${trailingNewline}`,
+		warnings
 	};
 }
-function readChildStderr$1(err) {
-	if (err instanceof Error && "stderr" in err) return String(err.stderr ?? "");
-	return "";
-}
 /**
-* Strips credentials from a `scheme://user:pass@host/...` URL anywhere
-* in `stderr`. Package-manager stderr regularly contains credentialed
-* registry URLs (private npm registries, GitHub Packages tokens), and
-* those bubble into the structured `errorInitSkillInstallFailed`
-* envelope, which ends up in logs and CI output. Redact at the
-* boundary so we never re-emit a secret.
+* Idempotently sets `"type": "module"` on a `package.json` so the
+* scaffolded `prisma/db.ts` — which uses the ESM-only `with { type: 'json' }`
+* import attribute — loads as ES module under Node's loader (TML-2494).
 *
-* Exported for unit tests.
-*/
-function redactSecrets$1(stderr) {
-	if (!stderr) return stderr;
-	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
-}
-/**
-* Skill directories that predate the consolidated `prisma-8` skill:
-* the per-workflow usage cluster (including the renamed
-* `prisma-8-migration-review` spelling it briefly shipped under), the
-* pre-rename spellings of the consolidated skill and the
-* extension-author upgrade skill, and any hand-rolled `prisma-next`
-* stub. Projects initialised before the consolidation carry these as
-* sibling directories in each agent's install root; left in place
-* they compete with the current skills for activation, so init
-* removes them on every run.
-*/
-const RETIRED_SKILL_NAMES = [
-	"prisma-next",
-	"prisma-next-quickstart",
-	"prisma-next-contract",
-	"prisma-next-migrations",
-	"prisma-next-migration-review",
-	"prisma-8-migration-review",
-	"prisma-next-queries",
-	"prisma-next-runtime",
-	"prisma-next-build",
-	"prisma-next-supabase",
-	"prisma-next-debug",
-	"prisma-next-feedback",
-	"prisma-next-extension-upgrade"
-];
-/**
-* Project-level install roots the upstream `skills` CLI uses for the
-* agents in `DEFAULT_SKILL_AGENTS`: cursor and codex install into
-* `.agents/skills`, claude-code into `.claude/skills`, windsurf into
-* `.windsurf/skills`.
-*/
-const AGENT_SKILL_ROOTS = [
-	".agents/skills",
-	".claude/skills",
-	".windsurf/skills"
-];
-/**
-* Every directory a retired per-workflow skill may occupy in a
-* consumer project. Init deletes each (recursively) before running the
-* skill install.
+* Without this field Node either:
+*
+* - emits `MODULE_TYPELESS_PACKAGE_JSON` and reparses the file as ESM
+*   with a perf penalty (Node 22+ with `--experimental-strip-types`), or
+* - hard-fails with `ERR_*` because the CJS loader cannot parse the
+*   import-attribute syntax (older Node, or any tool that doesn't
+*   reparse).
+*
+* Behaviour:
+*
+* - **Field missing** → set to `"module"`. New entry is inserted right
+*   after `"name"` (when present) so the diff lands in a conventional
+*   spot for human review; falls through to the natural append position
+*   otherwise.
+* - **Field already `"module"`** → no-op (idempotent).
+* - **Field set to anything else** (e.g. `"commonjs"`) → leave it alone
+*   and surface a structured warning. The user explicitly opted out of
+*   ESM and we don't silently overwrite that.
 */
-function legacySkillDirs() {
-	return AGENT_SKILL_ROOTS.flatMap((root) => RETIRED_SKILL_NAMES.map((name) => `${root}/${name}`));
+function ensureEsmModuleType(existing) {
+	const parsed = blindCast(JSON.parse(existing));
+	const currentType = parsed["type"];
+	if (currentType === "module") return {
+		content: null,
+		warning: null
+	};
+	if (typeof currentType === "string" && currentType !== "module") return {
+		content: null,
+		warning: `package.json declares "type": "${currentType}" — keeping yours, but the scaffolded prisma/db.ts uses an ESM-only import attribute (\`with { type: 'json' }\`) and will not load under that module type.\nIf you want the default, set "type": "module" in package.json.`
+	};
+	const next = {};
+	let inserted = false;
+	for (const [key, value] of Object.entries(parsed)) {
+		if (key === "type") continue;
+		next[key] = value;
+		if (!inserted && key === "name") {
+			next["type"] = "module";
+			inserted = true;
+		}
+	}
+	if (!inserted) next["type"] = "module";
+	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
+	return {
+		content: `${JSON.stringify(next, null, 2)}${trailingNewline}`,
+		warning: null
+	};
 }
 /**
-* The minimum supported server version for each target. The
-* authoritative source of truth is each target package's
-* `package.json#prismaNext.minServerVersion` field — this module
-* mirrors those values and a workspace-level test asserts the two
-* never drift (`templates/tsconfig-env.test.ts`).
+* Filenames the contract pipeline emits next to the user's schema source
+* (`<schemaDir>/contract.json`, `<schemaDir>/contract.d.ts`, …). Mirrors
+* the schema-dir-relative `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
+* (not that file's migrations-root-anchored store lines, which are outside
+* this command's scope — reinit only ever touches `schemaDir`); kept as a
+* separate constant here because the cleanup contract is target-agnostic
+* and we deliberately do not want a stale artifact from a previous target
+* lingering after a re-init.
 *
-* Bumping a value here in isolation is **not** safe: edit the
-* corresponding target package's `package.json` first, then mirror
-* here. The scaffold's `.env.example` and the "Requirements" section
-* of `prisma-next.md` both read from this constant, so a stale value
-* lies to every freshly initialised user.
+* If a future emit pipeline produces an additional schema-dir artifact,
+* add it here **and** to `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
+* — the two stay in lockstep so the file `init` advertises as
+* `linguist-generated` is exactly the file `init` is willing to delete on
+* re-init.
 */
-const MIN_SERVER_VERSION = {
-	postgres: "17",
-	mongo: "8.0"
-};
-const TARGET_LABEL = {
-	postgres: "PostgreSQL",
-	mongo: "MongoDB"
-};
+const ARTIFACT_FILENAMES = [
+	"contract.json",
+	"contract.d.ts",
+	"ops.json",
+	"migration.json"
+];
 /**
-* Renders the placeholder body shared by `.env` and `.env.example`:
-* the target-specific connection-string requirement comments and the
-* commented-shape `DATABASE_URL` line. The output is identical for both
-* authoring styles — the env file is orthogonal to PSL vs TS schema
-* authoring.
+* Returns the schema-relative paths of stale contract artifacts the
+* previous `init` run (or a `contract emit`) left behind in `schemaDir`.
+* Paths are returned relative to `baseDir` so the caller can plumb them
+* into `filesWritten`-style logging without re-deriving the path.
+*
+* Pure function: no filesystem mutation. Used by `runInit`'s precondition
+* phase (FR6.2 / NFR3 atomicity) so a downstream parse failure leaves
+* the artifacts on disk and the project byte-identical to its pre-init
+* state.
 */
-function envPlaceholderBody(target) {
-	const label = TARGET_LABEL[target];
-	const minVersion = MIN_SERVER_VERSION[target];
-	const lines = [];
-	lines.push(`# Connection string for ${label}.`);
-	lines.push(`# Requires ${label} >= ${minVersion}.`);
-	lines.push("");
-	if (target === "postgres") lines.push("DATABASE_URL=\"postgresql://user:password@localhost:5432/mydb\"");
-	else {
-		lines.push("# Standalone local mongod / `docker run mongo:8` — no replica set required for first-run queries.");
-		lines.push("# Transactions and change streams need a replica set; add ?replicaSet=... only after initiating one.");
-		lines.push("");
-		lines.push("DATABASE_URL=\"mongodb://user:password@localhost:27017/mydb\"");
+function findStaleArtifacts(baseDir, schemaDir) {
+	const result = [];
+	for (const filename of ARTIFACT_FILENAMES) {
+		const rel = join(schemaDir, filename);
+		if (existsSync(join(baseDir, rel))) result.push(rel);
 	}
-	lines.push("");
-	return lines.join("\n");
+	return result;
 }
 /**
-* Renders the `.env.example` content for a given target:
+* Drops a single key from `package.json#dependencies`, returning the new
+* file content. Returns `null` when the dependency was already absent —
+* the caller can skip the write to keep re-init idempotent (FR9.3).
 *
-* - Carries a "Copy this file to `.env`…" intro that only makes sense
-*   for the example file (the real `.env` is the destination of that
-*   copy and so does not get the same intro).
-* - Documents the `DATABASE_URL` placeholder in the target's native URL
-*   shape (Postgres: standard `postgresql://`, Mongo: `mongodb://` plus
-*   a `mydb` database segment so the lazy facade has a `dbName`).
-* - Carries a `# Requires <db> >= <version>` comment so a fresh user
-*   knows the minimum supported server before they first try to connect.
-*/
-function envExampleContent(target) {
-	const lines = [];
-	lines.push("# Copy this file to `.env` and replace the placeholder with your real connection string.");
-	lines.push(envPlaceholderBody(target));
-	return lines.join("\n");
-}
-/**
-* Renders the initial `.env` content for `--write-env` / interactive
-* opt-in. Same placeholder body as `.env.example`, **without** the
-* example file's "Copy this file to `.env`…" intro: the real `.env` is
-* the destination of that copy, so the line would lie. Writing this
-* file is gitignored (`.env` lands in `.gitignore` during init).
+* Used by `runInit` for the FR9.2 target-switch path: when the user
+* re-inits a project from `--target postgres` to `--target mongodb` (or
+* vice versa), the previous facade is removed from `dependencies` so the
+* resulting project depends only on the chosen target's facade.
+*
+* Devs/peers/optional dep groups are intentionally *not* touched — the
+* facades are only ever in `dependencies` (FR4 / FR7), and broadening
+* the search would risk clobbering an unrelated dep with the same name
+* in `peerDependencies`.
+*
+* Throws `SyntaxError` if `existing` is not parseable as JSON; the
+* caller (`runInit`) already guards on that with a structured 5010
+* error before this helper is reached.
 */
-function envFileContent(target) {
-	return envPlaceholderBody(target);
+function removeDependency(existing, depName) {
+	const parsed = JSON.parse(existing);
+	const deps = parsed["dependencies"];
+	if (deps === null || typeof deps !== "object" || Array.isArray(deps)) return null;
+	if (!Object.hasOwn(deps, depName)) return null;
+	const next = { ...deps };
+	delete next[depName];
+	parsed["dependencies"] = next;
+	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
+	return `${JSON.stringify(parsed, null, 2)}${trailingNewline}`;
 }
 function renderTemplate(templateFile, variableNames, vars) {
 	let result = readFileSync(join(import.meta.dirname, templateFile), "utf-8");
@@ -1646,481 +1438,6 @@ function mergeTypesArray(existing) {
 	return result;
 }
 /**
-* Runs the `init` command end-to-end and returns the exit code. Catches
-* structured CLI errors raised at every phase (input resolution, install,
-* emit) and renders them via the same UI surface as success output
-* (`--json` to stdout, human to stderr). Exit codes follow the documented
-* stable set in `./exit-codes.ts` and the
-* [Style Guide § Exit Codes](../../../../../../../docs/CLI%20Style%20Guide.md#exit-codes).
-*
-* Layered for testability: the action handler in `./index.ts` is
-* responsible for parsing flags and constructing `runOptions`; this
-* function does no flag parsing of its own.
-*/
-async function runInit(baseDir, runOptions) {
-	const { options, flags, canPrompt, probeOverrides } = runOptions;
-	const ui = createTerminalUI(flags);
-	const warnings = [];
-	const filesWritten = [];
-	const filesDeleted = [];
-	if (!flags.json && !flags.quiet) clack.intro("prisma-next init", { output: process.stderr });
-	let inputs;
-	try {
-		inputs = await resolveInitInputs({
-			baseDir,
-			options,
-			flags,
-			canPrompt
-		});
-	} catch (error) {
-		if (CliStructuredError$1.is(error)) return emitError(ui, flags, error);
-		throw error;
-	}
-	const pm = await detectPackageManager(baseDir);
-	const pkgRun = formatRunCommand(pm, "prisma-next", "").trimEnd();
-	const schemaDir = dirname(inputs.schemaPath);
-	const configContractPath = isAbsolute(inputs.schemaPath) ? inputs.schemaPath : `./${inputs.schemaPath}`;
-	const resolveImportSpecifier = scaffoldSpecifierResolverFor(inputs.target);
-	const filesToWrite = [
-		{
-			path: inputs.schemaPath,
-			content: starterSchema(inputs.target, inputs.authoring, resolveImportSpecifier)
-		},
-		{
-			path: "prisma-next.config.ts",
-			content: configFile(inputs.target, configContractPath, resolveImportSpecifier)
-		},
-		{
-			path: join(schemaDir, "db.ts"),
-			content: dbFile(inputs.target, resolveImportSpecifier)
-		},
-		{
-			path: "prisma-next.md",
-			content: quickReferenceMd(inputs.target, inputs.authoring, inputs.schemaPath, pkgRun, resolveImportSpecifier)
-		},
-		{
-			path: ".env.example",
-			content: envExampleContent(inputs.target)
-		}
-	];
-	const filesToDelete = inputs.reinit ? [...findStaleArtifacts(baseDir, schemaDir)] : [];
-	const legacyDirsToDelete = legacySkillDirs().filter((rel) => existsSync(join(baseDir, rel)));
-	if (inputs.writeEnv) if (!existsSync(join(baseDir, ".env"))) filesToWrite.push({
-		path: ".env",
-		content: envFileContent(inputs.target)
-	});
-	else warnings.push(".env already exists; leaving it untouched. Compare with .env.example for any new keys.");
-	const tsconfigPath = join(baseDir, "tsconfig.json");
-	if (existsSync(tsconfigPath)) {
-		const existing = readFileSync(tsconfigPath, "utf-8");
-		let merged;
-		try {
-			merged = mergeTsConfig(existing);
-		} catch (err) {
-			if (err instanceof TsConfigParseError) return emitError(ui, flags, errorInitInvalidTsconfig({
-				path: "tsconfig.json",
-				cause: err.message
-			}));
-			throw err;
-		}
-		filesToWrite.push({
-			path: "tsconfig.json",
-			content: merged,
-			logMessage: "Updated tsconfig.json with required compiler options."
-		});
-	} else filesToWrite.push({
-		path: "tsconfig.json",
-		content: defaultTsConfig()
-	});
-	const gitignorePath = join(baseDir, ".gitignore");
-	const newGitignore = mergeGitignore(existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : void 0);
-	if (newGitignore !== null) filesToWrite.push({
-		path: ".gitignore",
-		content: newGitignore
-	});
-	const gitattributesPath = join(baseDir, ".gitattributes");
-	const newGitattributes = mergeGitattributes(existsSync(gitattributesPath) ? readFileSync(gitattributesPath, "utf-8") : void 0, requiredGitattributesLines(schemaDir, inputs.target));
-	if (newGitattributes !== null) filesToWrite.push({
-		path: ".gitattributes",
-		content: newGitattributes
-	});
-	const packageJsonPath = join(baseDir, "package.json");
-	const packageJsonExisted = existsSync(packageJsonPath);
-	const synthesisePackageJson = !packageJsonExisted && !hasProjectManifest(baseDir);
-	let parsedPackageJson = null;
-	if (packageJsonExisted || synthesisePackageJson) {
-		const pkgRaw = packageJsonExisted ? readFileSync(packageJsonPath, "utf-8") : defaultPackageJsonContent(basename(baseDir));
-		try {
-			parsedPackageJson = JSON.parse(pkgRaw);
-		} catch (err) {
-			if (err instanceof SyntaxError) return emitError(ui, flags, errorInitInvalidManifest({
-				path: "package.json",
-				cause: err.message
-			}));
-			throw err;
-		}
-		let workingPkg = pkgRaw;
-		let pkgChanged = synthesisePackageJson;
-		if (inputs.removePreviousFacade !== null) {
-			const next = removeDependency(workingPkg, inputs.removePreviousFacade);
-			if (next !== null) {
-				workingPkg = next;
-				pkgChanged = true;
-			}
-		}
-		const { content: nextPkg, warnings: scriptWarnings } = mergePackageScripts(workingPkg, REQUIRED_SCRIPTS);
-		if (nextPkg !== null) {
-			workingPkg = nextPkg;
-			pkgChanged = true;
-		}
-		const { content: typedPkg, warning: typeWarning } = ensureEsmModuleType(workingPkg);
-		if (typedPkg !== null) {
-			workingPkg = typedPkg;
-			pkgChanged = true;
-		}
-		if (pkgChanged) filesToWrite.push({
-			path: "package.json",
-			content: workingPkg
-		});
-		warnings.push(...scriptWarnings);
-		if (typeWarning !== null) warnings.push(typeWarning);
-		if (synthesisePackageJson) warnings.push("No package.json found in the target directory; created a minimal one. Edit `name` / `version` to taste.");
-	}
-	if (existsSync(join(baseDir, "src/index.ts"))) if (!existsSync(join(baseDir, "README.md"))) {
-		const rawName = parsedPackageJson !== null && typeof parsedPackageJson["name"] === "string" ? parsedPackageJson["name"] : basename(baseDir);
-		filesToWrite.push({
-			path: "README.md",
-			content: minimalProjectReadmeMd(inputs.target, inputs.schemaPath, sanitisePackageName(rawName), pm)
-		});
-	} else warnings.push("README.md already exists; leaving it untouched.");
-	for (const file of filesToWrite) {
-		const fullPath = join(baseDir, file.path);
-		mkdirSync(dirname(fullPath), { recursive: true });
-		writeFileSync(fullPath, file.content, "utf-8");
-		filesWritten.push(file.path);
-		if (file.logMessage !== void 0 && !flags.json && !flags.quiet) ui.log(file.logMessage);
-	}
-	for (const rel of filesToDelete) {
-		const fullPath = join(baseDir, rel);
-		if (!existsSync(fullPath)) continue;
-		try {
-			unlinkSync(fullPath);
-			filesDeleted.push(rel);
-		} catch (err) {
-			if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) throw err;
-		}
-	}
-	for (const rel of legacyDirsToDelete) {
-		rmSync(join(baseDir, rel), {
-			recursive: true,
-			force: true
-		});
-		filesDeleted.push(rel);
-	}
-	const emitCommand = formatRunCommand(pm, "prisma-next", "contract emit");
-	let install;
-	try {
-		install = await runInstall({
-			baseDir,
-			pm,
-			target: inputs.target,
-			install: inputs.install,
-			flags,
-			ui,
-			filesWritten,
-			resolveImportSpecifier,
-			hasTypesNode: parsedPackageJson !== null ? hasDirectDep(parsedPackageJson, "@types/node") : false
-		});
-	} catch (error) {
-		if (CliStructuredError$1.is(error)) return emitError(ui, flags, error);
-		throw error;
-	}
-	warnings.push(...install.warnings);
-	let contractEmitted = false;
-	if (!install.skipped) try {
-		await runEmit({
-			baseDir,
-			ui,
-			filesWritten,
-			emitCommand
-		});
-		contractEmitted = true;
-	} catch (error) {
-		if (CliStructuredError$1.is(error)) return emitError(ui, flags, error);
-		throw error;
-	}
-	if (inputs.probeDb) {
-		const escalated = applyProbeOutcome(await probeServerVersion({
-			baseDir,
-			target: inputs.target,
-			databaseUrl: process.env["DATABASE_URL"],
-			minVersion: MIN_SERVER_VERSION[inputs.target]
-		}, probeOverrides ?? {}), {
-			strictProbe: inputs.strictProbe,
-			warnings
-		});
-		if (escalated !== null) return emitError(ui, flags, errorInitProbeFailed({
-			cause: escalated,
-			filesWritten
-		}));
-	}
-	const manualProjectSkillSummary = DEFAULT_SKILL_SOURCES.map((source) => formatSkillInstallCommand({
-		pm: install.effectivePm,
-		source
-	})).map((c) => `\`${c}\``).join(" && ");
-	let skillRegistered = false;
-	if (!inputs.installProjectSkill) warnings.push(`Skipped Prisma Next skills install (--no-skill). To install the skills later, run: ${manualProjectSkillSummary}`);
-	else {
-		const spinner = ui.spinner();
-		spinner.start("Registering Prisma Next skills with the agent runtime...");
-		try {
-			const project = await runProjectLevelSkillInstall({
-				baseDir,
-				pm: install.effectivePm,
-				filesWritten
-			});
-			spinner.stop(`Registered Prisma Next skills (project level) — ran ${project.commands.map((c) => `\`${c}\``).join(", ")}`);
-			skillRegistered = true;
-		} catch (error) {
-			spinner.stop("Agent-skill install failed");
-			if (CliStructuredError$1.is(error)) return emitError(ui, flags, error);
-			throw error;
-		}
-	}
-	const output = {
-		ok: true,
-		target: inputs.target === "mongo" ? "mongodb" : "postgres",
-		authoring: inputs.authoring,
-		schemaPath: inputs.schemaPath,
-		filesWritten,
-		filesDeleted,
-		packagesInstalled: {
-			skipped: install.skipped,
-			deps: [...install.deps],
-			devDeps: [...install.devDeps]
-		},
-		contractEmitted,
-		nextSteps: buildNextSteps({
-			target: inputs.target === "mongo" ? "mongodb" : "postgres",
-			contractEmitted,
-			emitCommand,
-			schemaPath: inputs.schemaPath,
-			skillRegistered
-		}),
-		warnings
-	};
-	const validated = InitOutputSchema(output);
-	if (validated instanceof Error || validated.problems !== void 0) return emitError(ui, flags, new CliStructuredError$1("CLI.INIT_INVALID_OUTPUT_DOCUMENT", "Init produced an invalid output document", {
-		why: `The success document failed schema validation: ${String(validated)}`,
-		fix: "This is a bug in prisma-next. Please report it with the full `-v` output.",
-		docsUrl: docsUrlFor("CLI.INIT_INVALID_OUTPUT_DOCUMENT")
-	}));
-	if (flags.json) ui.output(formatInitJson(output));
-	else {
-		renderInitOutro(ui, output, flags);
-		if (!flags.quiet) clack.outro("Done. Open prisma-next.md to get started.", { output: process.stderr });
-	}
-	return 0;
-}
-/**
-* Renders a structured CLI error to the right channel and returns the exit
-* code derived from the error's PN code. JSON-mode errors go to stdout
-* (so consumers always parse from one place); human-mode errors go to
-* stderr. Mirrors `handleResult` but returns init-specific exit codes
-* rather than the CLI/RUN binary.
-*/
-function emitError(ui, flags, error) {
-	const envelope = error.toEnvelope();
-	if (flags.json) ui.output(formatErrorJson(envelope));
-	else ui.error(formatErrorOutput(envelope, flags));
-	return exitCodeForError(error);
-}
-/**
-* Maps a structured init error to its documented exit code. Centralised so
-* the error → exit-code contract lives next to the codes themselves.
-*
-* `CLI.INIT_INVALID_OUTPUT_DOCUMENT` (and the unknown-code default branch)
-* routes to `INIT_EXIT_INTERNAL_ERROR` because those represent prisma-next
-* bugs the user did not cause — surfacing them as `PRECONDITION` would
-* mislead automation into thinking the caller mis-invoked the CLI.
-*
-* See [exit-codes.ts](./exit-codes.ts) for the canonical list and
-* [Style Guide § Exit Codes](../../../../../../../docs/CLI%20Style%20Guide.md#exit-codes)
-* for the reservation policy.
-*
-* Exported for unit tests so the mapping can be asserted without
-* round-tripping a full `runInit` invocation.
-*/
-function exitCodeForError(error) {
-	switch (error.code) {
-		case "CLI.INIT_REINIT_NEEDS_FORCE":
-		case "CLI.INIT_MISSING_FLAGS":
-		case "CLI.INIT_INVALID_FLAG_VALUE":
-		case "CLI.INIT_STRICT_PROBE_WITHOUT_PROBE":
-		case "CLI.INIT_INVALID_MANIFEST":
-		case "CLI.INIT_INVALID_TSCONFIG":
-		case "CLI.INIT_PROBE_FAILED":
-		case "CLI.INIT_AUTHORING_SCHEMA_PATH_MISMATCH": return 2;
-		case "CLI.INIT_USER_ABORTED": return 3;
-		case "CLI.INIT_INSTALL_FAILED": return 4;
-		case "CLI.INIT_EMIT_FAILED": return 5;
-		case "CLI.INIT_INVALID_OUTPUT_DOCUMENT": return 1;
-		case "CLI.INIT_SKILL_INSTALL_FAILED": return 6;
-		default: return 1;
-	}
-}
-/**
-* Folds a `ProbeOutcome` into init's warning channel and returns the
-* fatal cause string when `--strict-probe` should escalate. Mirrors
-* the FR8.3 contract:
-*
-* - `ok` — informational; nothing surfaced unless verbose. (We could
-*   plumb a `note` here, but the spec only requires the warning side
-*   of the contract; an "all good" line would just be noise on the
-*   common path.)
-* - `below-minimum` — warning regardless of `--strict-probe`. The
-*   probe ran successfully and found an old server; that is not a
-*   probe *failure* (which is what `--strict-probe` escalates), it
-*   is the probe doing its job.
-* - `no-database-url` / `connection-failed` / `driver-missing` —
-*   warning by default, fatal under `--strict-probe`.
-*
-* Exported for unit tests so the branching contract can be asserted
-* without spinning up a full `runInit` round trip.
-*/
-function applyProbeOutcome(outcome, ctx) {
-	switch (outcome.kind) {
-		case "ok": return null;
-		case "below-minimum":
-			ctx.warnings.push(outcome.message);
-			return null;
-		case "no-database-url":
-		case "connection-failed":
-		case "driver-missing":
-			if (ctx.strictProbe) return outcome.message;
-			ctx.warnings.push(outcome.message);
-			return null;
-	}
-}
-/**
-* Drives the `pnpm add` / `npm install` step. Failures are escalated to
-* a structured `errorInitInstallFailed` (exit code 4) — the spec treats
-* an unrecoverable install as a hard outcome rather than a warning so
-* CI/agents can branch on the exit code (FR1.6).
-*
-* For pnpm specifically, we additionally implement the FR7.2 fallback:
-* if pnpm fails with a recognised workspace/catalog resolution error
-* class (typically caused by a registry version that leaked
-* `workspace:*` or `catalog:` specifiers), we retry the install using
-* `npm` and surface a non-fatal warning explaining the swap.
-*/
-async function runInstall(ctx) {
-	const { baseDir, pm, target, install, flags, ui, filesWritten, hasTypesNode } = ctx;
-	const deps = [targetPackageName(target, ctx.resolveImportSpecifier), "dotenv"];
-	const devDeps = hasTypesNode ? ["prisma-next"] : ["prisma-next", "@types/node"];
-	const addCommand = `${pm} ${formatAddArgs(pm, deps).join(" ")}`;
-	const addDevCommand = `${pm} ${formatAddDevArgs(pm, devDeps).join(" ")}`;
-	const emitCommand = formatRunCommand(pm, "prisma-next", "contract emit");
-	const catalogWarnings = pm === "pnpm" ? buildCatalogWarnings(baseDir, [...deps, ...devDeps]) : [];
-	if (!install) {
-		if (!flags.json && !flags.quiet) ui.note([
-			"Run the following commands to complete setup:",
-			"",
-			"  1. Install dependencies:",
-			`     ${addCommand}`,
-			`     ${addDevCommand}`,
-			"",
-			"  2. Emit the contract:",
-			`     ${emitCommand}`
-		].join("\n"), "Manual steps");
-		return {
-			skipped: true,
-			deps: [],
-			devDeps: [],
-			warnings: catalogWarnings,
-			effectivePm: pm
-		};
-	}
-	const exec = promisify(execFile);
-	const runPair = async (manager) => {
-		await exec(manager, formatAddArgs(manager, deps), { cwd: baseDir });
-		await exec(manager, formatAddDevArgs(manager, devDeps), { cwd: baseDir });
-	};
-	const allPackages = [...deps, ...devDeps].join(", ");
-	const spinner = ui.spinner();
-	spinner.start(`Installing ${allPackages}...`);
-	try {
-		await runPair(pm);
-		spinner.stop(`Installed ${allPackages}`);
-		return {
-			skipped: false,
-			deps,
-			devDeps,
-			warnings: catalogWarnings,
-			effectivePm: pm
-		};
-	} catch (err) {
-		const stderrText = redactSecrets(readChildStderr(err));
-		if (pm === "pnpm" && isRecognisedPnpmResolutionError(stderrText)) {
-			spinner.message("pnpm could not resolve a workspace/catalog dependency, retrying with npm...");
-			try {
-				await runPair("npm");
-				spinner.stop(`Installed ${allPackages} via npm (pnpm fallback)`);
-				return {
-					skipped: false,
-					deps,
-					devDeps,
-					warnings: [[
-						"pnpm could not install: a published Prisma Next dependency leaked a `workspace:*` or `catalog:` specifier.",
-						"Falling back to `npm install` so init can complete.",
-						stderrText ? `  pnpm error: ${stderrText.trim().split("\n")[0]}` : "",
-						"Once the offending package republishes a clean version, re-run `pnpm install` to switch back."
-					].filter(Boolean).join("\n")],
-					effectivePm: "npm"
-				};
-			} catch (npmErr) {
-				spinner.stop("Installation failed");
-				throw errorInitInstallFailed({
-					addCommand,
-					addDevCommand,
-					emitCommand,
-					filesWritten,
-					stderrLines: [stderrText, redactSecrets(readChildStderr(npmErr))]
-				});
-			}
-		}
-		spinner.stop("Installation failed");
-		throw errorInitInstallFailed({
-			addCommand,
-			addDevCommand,
-			emitCommand,
-			filesWritten,
-			stderrLines: [stderrText]
-		});
-	}
-}
-/**
-* Builds the FR7.3 catalog-honoured warning(s) for the surrounding pnpm
-* workspace, if any. Returns an empty array when no `pnpm-workspace.yaml`
-* exists in any ancestor or when the workspace's catalog has no entry
-* for any of the packages `init` is about to install.
-*
-* Exported for unit tests.
-*/
-function buildCatalogWarnings(baseDir, packages) {
-	const result = detectPnpmCatalogOverrides(baseDir, packages);
-	if (result === null || result.entries.length === 0) return [];
-	return [formatCatalogWarning(result.workspaceFile, result.entries)];
-}
-function formatCatalogWarning(workspaceFile, entries) {
-	return [
-		"pnpm workspace catalog overrides detected — pnpm will install these versions instead of `latest`:",
-		entries.map((entry) => `  • ${entry.name}: ${entry.version}`).join("\n"),
-		`Catalog source: ${workspaceFile}`,
-		"To use the published `latest` instead, remove or update the catalog entry, then re-run `pnpm install`."
-	].join("\n");
-}
-/**
 * Recognised pnpm error signatures that justify a fallback to npm.
 *
 * These patterns indicate the published artifact itself is at fault
@@ -2129,124 +1446,31 @@ function formatCatalogWarning(workspaceFile, entries) {
 * registry version", and npm is willing to install it because npm
 * doesn't care about the protocol prefix when there's a fallback range.
 *
-* Exported for unit tests; do not depend on this from outside the init
-* command.
+* The predicate lives on its own so both shells' `init` share one list:
+* the commander command matches it against captured child stderr, the
+* engine command against the stderr the package-manager capability
+* returns on a failed install.
 */
 function isRecognisedPnpmResolutionError(stderr) {
 	if (!stderr) return false;
 	return stderr.includes("ERR_PNPM_WORKSPACE_PKG_NOT_FOUND") || stderr.includes("ERR_PNPM_NO_MATCHING_VERSION") || /No matching version found for .* in the catalog/i.test(stderr) || /workspace:[^\s]+ is not a valid (version|spec)/i.test(stderr) || /catalog:[^\s]* is not a valid (version|spec)/i.test(stderr);
 }
 /**
-* FR2.1 — true when the parsed `package.json` declares `name` directly
-* in either `dependencies` or `devDependencies`. We deliberately don't
-* inspect `peerDependencies` (irrelevant for a leaf project) or the
-* lockfile (transitive presence is brittle to detect and not the
-* realistic clobber-risk path).
-*
-* Exported for unit tests.
-*/
-function hasDirectDep(parsed, name) {
-	for (const field of ["dependencies", "devDependencies"]) {
-		const value = parsed[field];
-		if (value !== null && typeof value === "object" && name in value) return true;
-	}
-	return false;
-}
-function readChildStderr(err) {
-	if (err instanceof Error && "stderr" in err) return String(err.stderr ?? "");
-	return "";
-}
-/**
-* Redacts userinfo (`user:password@`) from any URL-shaped substring inside
-* package-manager stderr before we surface it in a warning or error
-* meta. pnpm and npm both include the offending registry URL in resolve
-* errors, and that URL can carry an auth token (e.g. corporate registry
-* mirrors that bake `_authToken` into the URL). The Style Guide
-* (Testing & Accessibility — "Security: never print secrets") requires
-* we never surface those.
+* Strips credentials out of package-manager stderr before it reaches a warning,
+* an error's meta, or a log. Two shapes carry them: userinfo inside a registry
+* URL (`https://user:token@registry…`), and the npmrc settings npm and pnpm
+* echo back when authentication fails (`//registry.npmjs.org/:_authToken=…`,
+* or the top-level `_authToken=…` with no registry scope), which are not
+* URL-shaped and survive a userinfo-only pass.
 *
-* Exported for unit tests.
+* Both shells' `init` call this, and both call it on stderr they already
+* received from somewhere else: redaction is cheap and doubling it is harmless,
+* while trusting another layer to have done it is not.
 */
 function redactSecrets(stderr) {
-	if (!stderr) return stderr;
-	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
-}
-/**
-* Drives `prisma-next contract emit` against the freshly scaffolded
-* project. On failure, throws `errorInitEmitFailed` with the underlying
-* cause embedded in `meta.cause` so the user can re-run with `-v` to see
-* the full envelope and follow the fix steps. Maps to exit code
-* `5 = EMIT_FAILED` (FR1.6).
-*/
-async function runEmit(ctx) {
-	const spinner = ctx.ui.spinner();
-	spinner.start("Emitting contract...");
-	try {
-		const { executeContractEmit } = await import("./contract-emit-Bzt11N4v-BQ2Pr8KG.mjs");
-		const { loadConfigForSections } = await import("./exports-BZLNbtkY.mjs").then((n) => n.t);
-		const configFilePath = join(ctx.baseDir, "prisma-next.config.ts");
-		const configResult = await loadConfigForSections(configFilePath, [
-			"contract",
-			"family",
-			"target",
-			"adapter",
-			"extensions"
-		]);
-		if (!configResult.ok) throw configResult.failure;
-		await executeContractEmit({
-			config: configResult.value,
-			cwd: process.cwd(),
-			configPath: configFilePath
-		});
-		spinner.stop("Contract emitted");
-	} catch (err) {
-		spinner.stop("Contract emission failed");
-		throw errorInitEmitFailed({
-			emitCommand: ctx.emitCommand,
-			filesWritten: ctx.filesWritten,
-			cause: causeMessage(err)
-		});
-	}
-}
-function causeMessage(err) {
-	if (err instanceof Error) return err.message;
-	return String(err);
-}
-/**
-* Minimal `package.json` content used when init runs in a directory
-* that has no project manifest (TML-2496). Mirrors the npm 11 `init -y`
-* defaults, with two deliberate deviations:
-*
-* - `"private": true` so a stray `npm publish` cannot leak the
-*   placeholder. Users who want to publish have to opt in by removing
-*   the field.
-* - `"type": "module"` so the scaffolded ESM imports in
-*   `prisma-next.config.ts` and `db.ts` typecheck and run without
-*   additional tsconfig coercion.
-*
-* Exported for unit tests so the canonical shape is asserted in one
-* place rather than re-derived at every call site.
-*/
-function defaultPackageJsonContent(rawName) {
-	return `${JSON.stringify({
-		name: sanitisePackageName(rawName),
-		version: "0.0.0",
-		private: true,
-		type: "module"
-	}, null, 2)}\n`;
-}
-/**
-* npm package names are restricted to lowercase, no leading dot/underscore,
-* and a small URL-safe character set. `basename(cwd)` happily returns
-* "My Project" or ".hidden" — both rejected by `npm install` validation.
-* Coerce to a safe fallback rather than emit a manifest npm refuses to
-* read.
-*/
-function sanitisePackageName(raw) {
-	const trimmed = raw.toLowerCase().replace(/[^a-z0-9._~-]/g, "-").replace(/^[._-]+/, "").replace(/-+/g, "-");
-	return trimmed.length > 0 ? trimmed : "my-app";
+	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@").replace(/(\b_(?:authToken|auth|password)=)\S+/gi, "$1***");
 }
 //#endregion
-export { runInit };
+export { isRecognisedPnpmResolutionError as A, removeDependency as B, findStaleArtifacts as C, formatSkillInstallCommand as D, formatRunCommand as E, mergeTsConfig as F, validateSchemaPath as G, resolveAuthoring as H, minimalProjectReadmeMd as I, probeServerVersion as L, mergeGitattributes as M, mergeGitignore as N, formatSkillSourceUrl as O, mergePackageScripts as P, quickReferenceMd as R, errorInitWriteFailed as S, formatAddDevArgs as T, resolveProjectSkillInstallCommands as U, requiredGitattributesLines as V, resolveTarget as W, errorInitProbeFailed as _, TsConfigParseError as a, errorInitStrictProbeWithoutProbe as b, detectPackageManager as c, envFileContent as d, errorInitEmitFailed as f, errorInitMissingFlags as g, errorInitInvalidTsconfig as h, REQUIRED_SCRIPTS as i, legacySkillDirs as j, hasProjectManifest as k, ensureEsmModuleType as l, errorInitInvalidManifest as m, DEFAULT_SKILL_SOURCES as n, buildCatalogWarnings as o, errorInitInstallFailed as p, MIN_SERVER_VERSION as r, defaultTsConfig as s, DEFAULT_SKILL_AGENTS as t, envExampleContent as u, errorInitReinitNeedsForce as v, formatAddArgs as w, errorInitUserAborted as x, errorInitSkillInstallFailed as y, redactSecrets as z };
 
-//# sourceMappingURL=init-Bco4QkKJ-DqUZVrBU.mjs.map
+//# sourceMappingURL=redact-secrets-kQ0KKV1u-MnVSKe-u.mjs.map