@prisma/orm-toolchain 8.0.0-rc.1-dev.38 → 8.0.0-rc.1-dev.40

package/dist/cli.mjs

@@ -1,47 +1,58 @@
 import { i as loadConfig } from "./exports-BZLNbtkY.mjs";
-import { I as requireLiveDatabase, L as runCommandAction, M as errorTargetMigrationNotSupported, O as errorRunnerFailed, P as errorUnexpected, a as errorConfigValidation$1, b as errorMigrationPlanningFailed, c as errorContractValidationFailed, d as errorDriverRequired, f as errorFileNotFound, g as errorLegendHumanOnly, k as errorRuntime$1, l as errorDatabaseConnectionRequired, o as errorConsentPlanMismatch, t as CliStructuredError$1$1, u as errorDestructiveChanges, x as errorNoMigrations, y as errorMigrationPackageNotFound } from "./cli-errors-BG6bItjG-DwdKIeGz.mjs";
+import { A as errorRuntime$1, F as errorUnexpected, L as requireLiveDatabase, N as errorTargetMigrationNotSupported, P as errorTargetMismatch, R as runCommandAction, S as errorNoMigrations, _ as errorLegendHumanOnly, a as errorConfigValidation$1, b as errorMigrationPackageNotFound, d as errorDestructiveChanges, f as errorDriverRequired, k as errorRunnerFailed, l as errorContractValidationFailed, m as errorHashMismatch, o as errorConsentPlanMismatch, p as errorFileNotFound, r as chooseAction, s as errorContractArgConflict, t as CliStructuredError$1$1, u as errorDatabaseConnectionRequired, x as errorMigrationPlanningFailed, y as errorMarkerMissing } from "./cli-errors-B4zTLaqQ-CXgjO9t4.mjs";
 import { r as getEmittedArtifactPaths } from "./exports-BCLg4CiV-05kuwcb0.mjs";
-import { n as executeContractEmit } from "./contract-emit-CZQZ1i4z-p9LSGmmQ.mjs";
+import { n as executeContractEmit } from "./contract-emit-DFScp9D6-6H-UJMFv.mjs";
 import { h as renderPreviewStatement, m as previewBlockHeader } from "./terminal-ui-Cqz4LVL7-B0mcVdLy.mjs";
 import { c as spaceMigrationDirectory } from "./verify-contract-spaces-DhJTb0zM-_oh6W6lp.mjs";
-import { S as targetSupportsMigrations, f as maskConnectionUrl, n as closeQuietly, v as sanitizeErrorMessage } from "./command-helpers-CwLvFwMB-BWwUQhlT.mjs";
-import { t as createContractEmitCommand } from "./contract-emit-BQFpcb2A-BwT9iVdb.mjs";
-import { n as executeFormat, t as createFormatCommand } from "./format-cbJY7l6v-CjMUDTAs.mjs";
-import { a as loadContractSpaceAggregateForCli, r as buildReadAggregate, s as refuseContractSpaceIntegrity, u as toDeclaredExtensionsFromRaw } from "./contract-space-aggregate-loader-CoLTf3Ce-pQDru2w0.mjs";
-import { t as createControlClient } from "./client-DU9qtBxW-BjVHiKzE.mjs";
+import { S as targetSupportsMigrations, f as maskConnectionUrl, h as readContractEnvelope, n as closeQuietly, v as sanitizeErrorMessage } from "./command-helpers-BCgwcqTe-lNCtppzM.mjs";
+import { t as createContractEmitCommand } from "./contract-emit-DsvAx-dY-DQzoDO34.mjs";
+import { n as executeFormat, t as createFormatCommand } from "./format-Ca7dUE6B-BMFqrc6D.mjs";
+import { c as targetLabel, i as scaffoldSpecifierResolverFor, l as targetPackageName, n as dbFile, o as starterSchema, r as defaultSchemaPath, t as configFile } from "./code-templates-D73q329L-CSx0Jg-6.mjs";
+import { a as loadContractSpaceAggregateForCli, i as loadContractRawSafely, l as refusePackageCorruptionOnAggregate, r as buildReadAggregate, s as refuseContractSpaceIntegrity, u as toDeclaredExtensionsFromRaw } from "./contract-space-aggregate-loader-fa04OIaL-B7LXHle3.mjs";
+import { t as createControlClient } from "./client-C6Qp5ujC-Dxb7r79B.mjs";
 import { a as readContractIR, o as resolveRefAdvancementFields, t as advanceRefSafely } from "./ref-advancement-DaZBzm7m-WoqnFAyr.mjs";
-import { t as mapDbInitFailure } from "./db-init-failure-BmCcHUfc-BqDxyrJE.mjs";
-import { t as resolveContractRefToSnapshot } from "./contract-snapshot-resolution-DvZvbNcZ-DHFCWe_k.mjs";
-import { t as mapCaughtMigrationError } from "./caught-errors-DLPzfzIW-CQ9BoXD-.mjs";
-import { t as mapContractAtError } from "./contract-at-errors-Dptf8RE_-B5gr04Sc.mjs";
-import { i as refuseUnknownInvariants, n as refuseMarkerOutsideGraph } from "./invariants-1zL5-9Mc-BCeOLxd_.mjs";
-import { t as executeMigrateShowPlan } from "./migrate-show-kVUG1xdo-bVTW8tu4.mjs";
-import { n as resolveMigrationRef, t as resolveContractRef } from "./ref-resolution-DAK4OK3x-B-8ZZc0f.mjs";
-import { n as migrationSpaceListEntriesFromAggregate, r as runMigrationList } from "./migration-list-BQTfSGbT-DoNqbNsu.mjs";
-import { S as toneSpans, b as renderMigrationListWithStyle, d as createToneMigrationListStyler, n as TONE_MIGRATION_GRAPH_PALETTE, v as renderMigrationGraphLegend, x as toneDrawing } from "./migration-graph-command-render-BeuEyf2B-BNH9oUB_.mjs";
-import { n as migrateShowRunListRows, r as renderMigrateShowGraph, t as mapMigrateFailure } from "./migrate-failure-CnoUcDms-taa9pfd7.mjs";
-import { n as looksLikePath, r as resolveAppTargetPath, t as findPackageByDirPath } from "./migration-path-target-BNTSTPAc-D7dQ4K7x.mjs";
-import { t as buildMigrationSpaceGraphEntries } from "./migration-graph-B30X5398-BH3zB9Mn.mjs";
-import { n as renderMigrationGraphDot, r as renderMigrationGraphSections, t as buildMigrationGraphTreeSections } from "./migration-graph-sections-0lKA5l1b-CTHQquu7.mjs";
-import { a as sortLedgerEntries, i as serializeLedgerEntriesForJson, n as formatLedgerAppliedAt, o as styleHashTransition, t as MIGRATION_LOG_EMPTY_MESSAGE } from "./migration-log-table-DRiOnvzf-zTQBThqe.mjs";
-import { n as executeRefListCommand, r as executeRefSetCommand, t as executeRefDeleteCommand } from "./ref-C8oaaeky-ColNkWpr.mjs";
+import { t as mapDbInitFailure } from "./db-init-failure-B5cQML4A-5zr-99Ek.mjs";
+import { t as resolveContractRefToSnapshot } from "./contract-snapshot-resolution-De2VvOJn-DqIAV9cr.mjs";
+import { t as combineVerifyResults } from "./combine-verify-results-B87B_pMc-D4l22OqY.mjs";
+import { t as mapCaughtMigrationError } from "./caught-errors-BZo7zcRc-C-pIEasG.mjs";
+import { t as mapContractAtError } from "./contract-at-errors-BSoDI0Hw-BXeUNE3s.mjs";
+import { i as refuseUnknownInvariants, n as refuseMarkerOutsideGraph, r as refuseMissingInvariantPath, t as hasMigrationPath } from "./invariants-Bltd8DyA-Cg_1Lu0q.mjs";
+import { t as executeMigrateShowPlan } from "./migrate-show-C_9xR4Qt-B-Y0PGKw.mjs";
+import { n as resolveMigrationRef, t as resolveContractRef } from "./ref-resolution-BSN1amKm-C6-TTM2N.mjs";
+import { n as migrationSpaceListEntriesFromAggregate, r as runMigrationList, t as listRefsByContractHash } from "./migration-list-CY08bD8I-PoXuv94c.mjs";
+import { C as toneSpans, S as toneDrawing, b as renderMigrationGraphSpaceTrees, d as createToneMigrationListStyler, m as indentMigrationGraphTreeBlock, n as TONE_MIGRATION_GRAPH_PALETTE, v as renderMigrationGraphLegend, x as renderMigrationListWithStyle } from "./migration-graph-command-render-h0VdTkSM-C3rPZEw1.mjs";
+import { n as migrateShowRunListRows, r as renderMigrateShowGraph, t as mapMigrateFailure } from "./migrate-failure-D4NvkoCk-0bttmQs2.mjs";
+import { n as looksLikePath, r as resolveAppTargetPath, t as findPackageByDirPath } from "./migration-path-target-JDWqF9kj-B7zoMq6X.mjs";
+import { i as runMigrationCheck, n as enumerateCheckSpaces, r as loadAggregateIntegrityViolations, t as checkSingleTarget } from "./migration-check-Bbdw7t-r-C2VTMK61.mjs";
+import { t as integrityViolationToCheckFailure } from "./integrity-violation-to-check-failure-BmWMLAae-DqiC4_3p.mjs";
+import { t as buildMigrationSpaceGraphEntries } from "./migration-graph-B8WxW_tm-qGNf7jQh.mjs";
+import { n as renderMigrationGraphDot, r as renderMigrationGraphSections, t as buildMigrationGraphTreeSections } from "./migration-graph-sections-BBHPOFN--COKyUKQ4.mjs";
+import { a as sortLedgerEntries, i as serializeLedgerEntriesForJson, n as formatLedgerAppliedAt, o as styleHashTransition, t as MIGRATION_LOG_EMPTY_MESSAGE } from "./migration-log-table-eES9lPjv-BCFm8qJr.mjs";
+import { t as executeMigrationNewCommand } from "./migration-new-DXMvJdbB-BkrpDfcr.mjs";
+import { t as executeMigrationPlanCommand } from "./migration-plan-Cfz0efEL-DMNFq5b2.mjs";
+import { a as statusForMigrationHash, i as readMigrationRefs, n as deriveStatusEdgeAnnotations, r as originHashForStatus, t as appliedHashesFromLedger } from "./refs-fQLFcMoq-aTBeUU9H.mjs";
+import { n as executeRefListCommand, r as executeRefSetCommand, t as executeRefDeleteCommand } from "./ref-WXLIR9Xm-12IUtoBU.mjs";
+import { A as isRecognisedPnpmResolutionError, B as removeDependency, C as findStaleArtifacts, E as formatRunCommand, F as mergeTsConfig, G as validateSchemaPath, H as resolveAuthoring, I as minimalProjectReadmeMd, L as probeServerVersion, M as mergeGitattributes, N as mergeGitignore, O as formatSkillSourceUrl, P as mergePackageScripts, R as quickReferenceMd, S as errorInitWriteFailed, U as resolveProjectSkillInstallCommands, V as requiredGitattributesLines, W as resolveTarget, _ as errorInitProbeFailed, a as TsConfigParseError, b as errorInitStrictProbeWithoutProbe, d as envFileContent, g as errorInitMissingFlags, h as errorInitInvalidTsconfig, i as REQUIRED_SCRIPTS, j as legacySkillDirs, l as ensureEsmModuleType, m as errorInitInvalidManifest, n as DEFAULT_SKILL_SOURCES, o as buildCatalogWarnings, r as MIN_SERVER_VERSION, s as defaultTsConfig, t as DEFAULT_SKILL_AGENTS, u as envExampleContent, x as errorInitUserAborted, z as redactSecrets } from "./redact-secrets-Cvia6eTB-BE_Pg3k9.mjs";
+import { n as buildNextSteps, t as InitOutputSchema } from "./output-DP3woAjV-BxCr9nHA.mjs";
 import { CliStructuredError } from "@prisma/orm-framework/errors/control";
 import { ifDefined } from "@prisma/orm-framework/utils/defined";
-import { basename, dirname, join, normalize, relative, resolve } from "pathe";
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
-import { DOCS_BASE, isStructuredError } from "@prisma/orm-framework/utils/structured-error";
+import { basename, dirname, isAbsolute, join, normalize, relative, resolve } from "pathe";
+import { existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { DOCS_BASE, docsUrlFor, isStructuredError, isStructuredErrorCode } from "@prisma/orm-framework/utils/structured-error";
 import { blindCast, castAs } from "@prisma/orm-framework/utils/casts";
-import { InternalError, assertNever } from "@prisma/orm-framework/utils/internal-error";
+import { InternalError, assertNever, isInternalError } from "@prisma/orm-framework/utils/internal-error";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { APP_SPACE_ID, createControlStack } from "@prisma/orm-framework/components/control";
+import { APP_SPACE_ID, VERIFY_CODE_HASH_MISMATCH, VERIFY_CODE_MARKER_MISSING, VERIFY_CODE_TARGET_MISMATCH, createControlStack, issueOutcome } from "@prisma/orm-framework/components/control";
+import { type } from "arktype";
 import { collectConfigIssues } from "@prisma/orm-framework/config/config-validation";
 import { tmpdir } from "node:os";
+import { detect } from "package-manager-detector/detect";
 import { printPsl } from "@prisma/orm-framework/psl-printer";
-import { defineCommand, defineCommandFamily, defineConfigSection, flag, positional } from "@prisma/cli-engine";
+import { defineCommand, defineCommandFamily, defineConfigSection, defineServerCommand, flag, positional } from "@prisma/cli-engine";
 import { CliStructuredError as CliStructuredError$1, notOk, ok } from "@prisma/cli-engine/protocol";
 import { pathToFileURL } from "node:url";
 import { build } from "esbuild";
-//#region ../../../1-framework/3-tooling/cli/dist/load-config-pL46nF5F.mjs
+//#region ../../../1-framework/3-tooling/cli/dist/load-config-CVli79Ro.mjs
 const MISSING_CONFIG_ACTION = {
 	kind: "run-command",
 	label: "Create a config file",
@@ -251,6 +262,11 @@ function normalizeError(error) {
 * prisma/prisma's `CliStructuredError` — both classes carry that name — and then settles it
 * through fields the engine's own class has and this one does not. The envelope that results is
 * off-protocol. Catching here means every handler settles through the single conversion instead.
+*
+* An `InternalError` is the one thing this boundary does not convert. Its own contract says never
+* to catch it outside the outermost boundary: it means an invariant broke, which is a bug in
+* Prisma Next rather than something the user did. Re-throwing lets the engine settle it as a bug
+* at exit 1, where converting it would report the same number as a bad connection string.
 */
 function defineOrmCommand(def) {
 	return defineCommand({
@@ -259,6 +275,7 @@ function defineOrmCommand(def) {
 			try {
 				return await def.handler(args, ctx);
 			} catch (error) {
+				if (isInternalError(error)) throw error;
 				return notOk(normalizeError(error));
 			}
 		}
@@ -608,7 +625,7 @@ function perSpaceBlocks(perSpace, mode) {
 		roots: spaceNodes(perSpace, mode)
 	}, ...destructiveWarningBlocks(hasDestructive)];
 }
-function operationBlocks$1(result) {
+function operationBlocks$2(result) {
 	const perSpace = result.perSpace;
 	if (perSpace !== void 0 && perSpace.length > 0) return perSpaceBlocks(perSpace, result.mode);
 	if (result.plan.operations.length === 0) return [];
@@ -619,7 +636,7 @@ function operationBlocks$1(result) {
 	}, ...destructiveWarningBlocks(hasDestructive)];
 }
 /** The statements a database would run, printed verbatim rather than laid out. */
-function previewBlocks$1(preview) {
+function previewBlocks$2(preview) {
 	if (preview === void 0) return [];
 	const header = {
 		kind: "summary",
@@ -666,7 +683,7 @@ function applySummaryText(result) {
 	if (executed === 0) return `Database already matches contract${across}`;
 	return `Applied ${executed} operation(s)${across}`;
 }
-function planBlocks(result) {
+function planBlocks$1(result) {
 	const planned = result.plannedAdvanceRef;
 	return [
 		{
@@ -675,7 +692,7 @@ function planBlocks(result) {
 			text: planSummaryText(result)
 		},
 		...plannerWarningBlocks(result),
-		...operationBlocks$1(result),
+		...operationBlocks$2(result),
 		{
 			kind: "fields",
 			rows: [{
@@ -694,7 +711,7 @@ function planBlocks(result) {
 				tone: "identifier"
 			}]
 		}],
-		...previewBlocks$1(result.plan.preview),
+		...previewBlocks$2(result.plan.preview),
 		{
 			kind: "summary",
 			status: "info",
@@ -736,7 +753,7 @@ function applyBlocks(result) {
 			text: applySummaryText(result)
 		},
 		...plannerWarningBlocks(result),
-		...operationBlocks$1(result),
+		...operationBlocks$2(result),
 		...fallbackMarkerBlocks(result),
 		...advanced === null || advanced === void 0 ? [] : [{
 			kind: "summary",
@@ -750,7 +767,7 @@ function applyBlocks(result) {
 }
 /** What a `db init` / `db update` result looks like in human mode. */
 function migrationResultBlocks(result) {
-	return result.mode === "plan" ? planBlocks(result) : applyBlocks(result);
+	return result.mode === "plan" ? planBlocks$1(result) : applyBlocks(result);
 }
 /** Where the user goes next, as typed actions rather than trailing prose. */
 function migrationResultNextActions(result, applyCommand) {
@@ -769,6 +786,16 @@ function appMigrationsDirFor(config, cwd) {
 	return spaceMigrationDirectory(migrationsDirFor(config, cwd), APP_SPACE_ID);
 }
 /**
+* The config file an operation should anchor its project paths on. The engine
+* loads the config and hands a handler the value but not the path, and
+* `--config` is an engine flag the handler never sees, so a handler names the
+* invocation directory's file. That equals the loaded file for every
+* invocation whose config sits in the invocation directory.
+*/
+function projectConfigPathFor(cwd) {
+	return resolve(cwd, "prisma-next.config.ts");
+}
+/**
 * Where refs live. The framework keeps them under the app subspace rather than
 * at the migrations root.
 */
@@ -842,7 +869,7 @@ async function prepareMigrationRun(inputs) {
 		refsDir: appRefsDirFor(config, cwd)
 	});
 }
-function initPresentations(inputs) {
+function initPresentations$1(inputs) {
 	const { document, database, dryRun } = inputs;
 	return {
 		human: () => [{
@@ -974,7 +1001,7 @@ function createDbInitCommand(createClient) {
 				severity: "verbose",
 				text: `Total time: ${document.timings.total}ms`
 			});
-			return ok(ctx.present({ data: document }, initPresentations({
+			return ok(ctx.present({ data: document }, initPresentations$1({
 				document,
 				contractPath: prepared.value.contractDisplayPath,
 				database: prepared.value.database,
@@ -1090,7 +1117,7 @@ function treeNode(node) {
 		...ifDefined("children", node.children === void 0 || node.children.length === 0 ? void 0 : node.children.map(treeNode))
 	};
 }
-function schemaPresentations(inputs) {
+function schemaPresentations$1(inputs) {
 	const { document, schemaView, database } = inputs;
 	return {
 		human: () => [...database === void 0 ? [] : [{
@@ -1167,7 +1194,7 @@ function createDbSchemaCommand(createClient) {
 				meta: { ...ifDefined("dbUrl", database) },
 				timings: { total: Date.now() - startedAt }
 			};
-			return ok(ctx.present({ data: document }, schemaPresentations({
+			return ok(ctx.present({ data: document }, schemaPresentations$1({
 				document,
 				schemaView,
 				database
@@ -1177,6 +1204,372 @@ function createDbSchemaCommand(createClient) {
 }
 const dbSchemaCommand = createDbSchemaCommand(createControlClient);
 /**
+* Reads the emitted contract and hydrates it through the family's
+* `deserializeContract` seam, which is where every other on-disk contract read
+* in this CLI crosses into family types.
+*/
+async function readEmittedContract(inputs) {
+	const path = contractPathFor(inputs.config, inputs.cwd);
+	if (path === void 0) return notOk(normalizeError(errorConfigValidation$1("contract.output", {
+		why: `${inputs.commandName} reads the emitted contract from config.contract.output; the config has no value to read.`,
+		section: "contract"
+	})));
+	const relativePath = displayPath(path, inputs.cwd);
+	let content;
+	try {
+		content = await readFile(path, "utf-8");
+	} catch (error) {
+		return notOk(normalizeError(Reflect.get(Object(error), "code") === "ENOENT" ? errorFileNotFound(path, {
+			why: `Contract file not found at ${path}`,
+			fix: `Run \`prisma-next contract emit\` to generate ${relativePath}, or update \`contract.output\` in prisma-next.config.ts`
+		}) : errorUnexpected(error instanceof Error ? error.message : String(error), { why: `Failed to read contract file: ${error instanceof Error ? error.message : String(error)}` })));
+	}
+	const familyInstance = inputs.config.family.create(createControlStack(inputs.config));
+	try {
+		return ok({
+			contract: familyInstance.deserializeContract(castAs(JSON.parse(content))),
+			path,
+			displayPath: relativePath
+		});
+	} catch (error) {
+		return notOk(normalizeError(errorContractValidationFailed(`Contract JSON is invalid: ${error instanceof Error ? error.message : String(error)}`, { where: { path } })));
+	}
+}
+/**
+* The connection and driver both verification commands need. Returns the
+* resolved connection or the precondition failure that stopped the run.
+*/
+function requireVerifyConnection(inputs) {
+	const dbConnection = inputs.db ?? inputs.config.db?.connection;
+	if (typeof dbConnection !== "string" || dbConnection.length === 0) return notOk(normalizeError(errorDatabaseConnectionRequired({
+		why: `Database connection is required for ${inputs.invocation} (set db.connection in prisma-next.config.ts, or pass --db <url>)`,
+		missingFlags: ["--db"],
+		retryCommand: `prisma-next ${inputs.invocation} --db <url>`
+	})));
+	if (inputs.config.driver === void 0) return notOk(normalizeError(errorDriverRequired({ why: `Config.driver is required for ${inputs.invocation}` })));
+	return ok(dbConnection);
+}
+/**
+* A failure the verification could not recover from — a dropped connection, a
+* driver throw — as a settlement the user can act on. Connection strings are
+* stripped from the prose whichever path the value took. A driver error
+* carrying `ECONNREFUSED`, `ENOTFOUND` or a SQLSTATE has a `code` and takes
+* the first path, and its message is exactly the one likely to quote the URL.
+*/
+function verificationThrow(inputs) {
+	const { error } = inputs;
+	const message = error instanceof Error ? error.message : String(error);
+	return withoutConnectionString(typeof error === "object" && error !== null && "code" in error ? normalizeError(error) : normalizeError(errorUnexpected(message, { why: `Unexpected error during ${inputs.invocation}: ${message}` })), inputs.connection);
+}
+/**
+* The same envelope with the connection string stripped from every field the
+* settlement serializes: the prose, each next action's strings, and every
+* string reachable through `meta`. A driver error quotes the URL wherever it
+* pleases, so nothing user-facing passes through unstripped.
+*/
+function withoutConnectionString(error, connection) {
+	const clean = (text) => sanitizeErrorMessage(text, connection);
+	return new CliStructuredError$1(error.code, clean(error.message), {
+		severity: error.severity,
+		nextActions: error.nextActions.map((action) => cleanNextAction(action, clean)),
+		...ifDefined("why", error.why === void 0 ? void 0 : clean(error.why)),
+		...ifDefined("where", error.where),
+		...ifDefined("meta", error.meta === void 0 ? void 0 : cleanMetaRecord(error.meta, clean)),
+		...ifDefined("docsUrl", error.docsUrl),
+		cause: error.cause
+	});
+}
+function cleanNextAction(action, clean) {
+	return {
+		kind: action.kind,
+		label: clean(action.label),
+		...ifDefined("command", action.command === void 0 ? void 0 : clean(action.command)),
+		...ifDefined("commands", action.commands?.map(clean)),
+		...ifDefined("url", action.url === void 0 ? void 0 : clean(action.url)),
+		...ifDefined("reason", action.reason === void 0 ? void 0 : clean(action.reason))
+	};
+}
+function cleanMetaValue(value, clean) {
+	if (typeof value === "string") return clean(value);
+	if (Array.isArray(value)) return value.map((entry) => cleanMetaValue(entry, clean));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, cleanMetaValue(entry, clean)]));
+	return value;
+}
+function cleanMetaRecord(meta, clean) {
+	return Object.fromEntries(Object.entries(meta).map(([key, value]) => [key, cleanMetaValue(value, clean)]));
+}
+const OUTCOME_LABEL = {
+	"not-found": "missing",
+	"not-expected": "extra",
+	"not-equal": "mismatch"
+};
+/** What a diff issue says, in the words the commander shell used. */
+function issueLabel(issue) {
+	return `${OUTCOME_LABEL[issueOutcome(issue)]}: ${issue.path.join("/")}`;
+}
+function issueNodes(issues, status) {
+	return issues.map((issue) => ({
+		label: issueLabel(issue),
+		status
+	}));
+}
+/**
+* The drift, laid out as a tree the engine draws: one root per finding family,
+* one child per element. The engine owns the connectors and the status glyphs,
+* so nothing here carries an escape sequence.
+*/
+function schemaFindingBlocks(inputs) {
+	const roots = [];
+	const issues = inputs.result.schema.issues;
+	if (issues.length > 0) roots.push({
+		label: "Schema issues",
+		status: "error",
+		children: issueNodes(issues, "error")
+	});
+	const warnings = inputs.result.schema.warnings?.issues ?? [];
+	if (warnings.length > 0) roots.push({
+		label: "Schema warnings",
+		status: "warn",
+		children: issueNodes(warnings, "warn")
+	});
+	if (inputs.unclaimed.length > 0) {
+		const status = inputs.strict ? "error" : "warn";
+		roots.push({
+			label: "Unclaimed elements (declared by no contract)",
+			status,
+			children: inputs.unclaimed.map((name) => ({
+				label: name,
+				status
+			}))
+		});
+	}
+	return roots.length === 0 ? [] : [{
+		kind: "tree",
+		roots
+	}];
+}
+/**
+* A failed schema-verification verdict as one envelope diagnostic. `error` is
+* the honest severity: the database does not satisfy the contract. It is legal
+* because both commands settle at exit 4 — the engine refuses a
+* severity-`error` diagnostic only on a run that exits 0.
+*/
+function schemaVerdictDiagnostic(inputs) {
+	const code = inputs.result.code;
+	const dotted = code !== void 0 && isStructuredErrorCode(code);
+	const issues = inputs.result.schema.issues.map(issueLabel);
+	return {
+		code: dotted ? code : "CONTRACT.VERIFY_FAILED",
+		severity: "error",
+		summary: inputs.result.summary,
+		...issues.length === 0 ? {} : { why: `The live schema differs: ${issues.join("; ")}.` },
+		nextActions: inputs.nextActions,
+		meta: {
+			...inputs.space === void 0 ? {} : { space: inputs.space },
+			issues,
+			...dotted || code === void 0 ? {} : { code }
+		}
+	};
+}
+/**
+* Verification ran and refused the signature. The command completed — it
+* answered the question "may this database be signed?" — so the refusal is a
+* diagnostic on a completed envelope rather than an error.
+*/
+const FINDINGS_EXIT_CODE$2 = 4;
+/** The config file this bin reads; the handler is not told which one was loaded. */
+const CONFIG_DISPLAY_PATH = "prisma-next.config.ts";
+function headerBlock$1(inputs) {
+	return {
+		kind: "fields",
+		rail: true,
+		rows: [{
+			label: "contract",
+			value: inputs.contract
+		}, {
+			label: "database",
+			value: inputs.database
+		}]
+	};
+}
+function signPresentations(inputs) {
+	const marker = inputs.document.marker;
+	return {
+		human: () => [
+			inputs.header,
+			{
+				kind: "summary",
+				status: "ok",
+				text: "Database signed"
+			},
+			{
+				kind: "fields",
+				rows: [{
+					label: "from",
+					value: marker.previous?.storageHash === void 0 ? [{
+						text: "none",
+						tone: "muted"
+					}] : [{
+						text: marker.previous.storageHash,
+						tone: "identifier"
+					}]
+				}, {
+					label: "to",
+					value: [{
+						text: inputs.document.contract.storageHash,
+						tone: "identifier"
+					}]
+				}]
+			}
+		],
+		json: () => inputs.document
+	};
+}
+function refusedPresentations(inputs) {
+	return {
+		human: () => [
+			inputs.header,
+			...schemaFindingBlocks({
+				result: inputs.document,
+				unclaimed: [],
+				strict: false
+			}),
+			{
+				kind: "summary",
+				status: "error",
+				text: inputs.document.summary
+			}
+		],
+		json: () => inputs.document
+	};
+}
+/**
+* Builds the command with its control-client factory injected, so tests mount
+* the same tree over a fake client instead of mocking the client module.
+*/
+function createDbSignCommand(createClient = createControlClient) {
+	return defineOrmCommand({
+		help: {
+			summary: "Sign the database with your contract so you can safely run queries",
+			description: "Verifies that your database schema satisfies the emitted contract, and if\nso, writes or updates the database signature. Idempotent and safe to run\nin CI or a deployment pipeline. The signature records that this database\ninstance is aligned with a specific contract version.\nExit codes: 0 = signed, 2 = the command could not run (unresolvable\ncontract reference, no emitted contract, unreachable database),\n4 = schema verification failed and no signature was written.",
+			examples: [
+				"db sign",
+				"db sign --db $DATABASE_URL",
+				"db sign production --db $DATABASE_URL",
+				"db sign --contract production --db $DATABASE_URL"
+			]
+		},
+		args: {
+			positionals: { contract: positional.optionalString({
+				brief: "Contract reference (hash, prefix, ref name, or migration dir name)",
+				placeholder: "contract"
+			}) },
+			flags: {
+				db: dbFlag,
+				contract: flag.string({
+					brief: "Contract reference (hash, prefix, ref name, migration dir name, <dir>^, or ./path)",
+					placeholder: "contract"
+				})
+			}
+		},
+		needs: { config: ormConfigSection },
+		exitCodes: { 4: "schema verification failed; no signature was written" },
+		handler: async (args, ctx) => {
+			const positionalContract = args.positionals.contract;
+			const flagContract = args.flags.contract;
+			if (positionalContract !== void 0 && flagContract !== void 0) return notOk(normalizeError(errorContractArgConflict({
+				positional: positionalContract,
+				flag: flagContract
+			})));
+			const contractRef = positionalContract ?? flagContract;
+			const emitted = await readEmittedContract({
+				config: ctx.config,
+				cwd: ctx.cwd,
+				commandName: "db sign"
+			});
+			if (!emitted.ok) return notOk(emitted.failure);
+			let contractInput = emitted.value.contract;
+			if (contractRef !== void 0) {
+				const resolvedRef = await resolveContractRefToSnapshot({
+					config: ctx.config,
+					migrationsDir: migrationsDirFor(ctx.config, ctx.cwd),
+					refInput: contractRef,
+					contractPathAbsolute: emitted.value.path,
+					fallbackToEmitted: true
+				});
+				if (!resolvedRef.ok) return notOk(normalizeError(resolvedRef.failure));
+				contractInput = resolvedRef.value.contractJson;
+			}
+			const connection = requireVerifyConnection({
+				config: ctx.config,
+				db: args.flags.db,
+				invocation: "db sign"
+			});
+			if (!connection.ok) return notOk(connection.failure);
+			const dbConnection = connection.value;
+			const header = headerBlock$1({
+				contract: contractRef ?? emitted.value.displayPath,
+				database: maskConnectionUrl(dbConnection)
+			});
+			const client = createClient({
+				family: ctx.config.family,
+				target: ctx.config.target,
+				adapter: ctx.config.adapter,
+				...ifDefined("driver", ctx.config.driver),
+				extensions: ctx.config.extensions ?? []
+			});
+			const onProgress = controlProgressReporter(ctx.report);
+			try {
+				const verified = await client.schemaVerify({
+					contract: contractInput,
+					strict: false,
+					connection: dbConnection,
+					onProgress
+				});
+				if (!verified.ok) {
+					const document = verified;
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$2,
+						diagnostics: [schemaVerdictDiagnostic({
+							result: verified,
+							space: void 0,
+							nextActions: [runCommandAction("Bring the database up to the contract, then sign again", "prisma-next db update")]
+						})]
+					}, refusedPresentations({
+						document,
+						header
+					})));
+				}
+				const signed = await client.sign({
+					contract: contractInput,
+					contractPath: displayPath(emitted.value.path, ctx.cwd),
+					configPath: CONFIG_DISPLAY_PATH,
+					onProgress
+				});
+				if (!signed.ok) throw new InternalError(`The family returned a sign result that did not sign: ${signed.summary}`);
+				return ok(ctx.present({
+					data: signed,
+					exitCode: 0
+				}, signPresentations({
+					document: signed,
+					header
+				})));
+			} catch (error) {
+				if (isInternalError(error)) throw error;
+				return notOk(verificationThrow({
+					error,
+					invocation: "db sign",
+					connection: dbConnection
+				}));
+			} finally {
+				await closeQuietly(client);
+			}
+		}
+	});
+}
+const dbSignCommand = createDbSignCommand();
+/**
 * A `db update` failure as the CLI's structured error.
 *
 * `DESTRUCTIVE_CHANGES` is handled by the command, which asks for consent and
@@ -1440,85 +1833,1503 @@ function createDbUpdateCommand(createClient) {
 	});
 }
 const dbUpdateCommand = createDbUpdateCommand(createControlClient);
-const NOTHING_TO_FORMAT = "Nothing to format (contract source is not PSL).";
-function formatPresentations(document, cwd) {
-	const path = document.path;
-	return {
-		human: () => document.formatted && path !== void 0 ? [{
-			kind: "summary",
-			status: "ok",
-			text: [{ text: "Formatted " }, {
-				text: relative(cwd, path),
-				tone: "identifier"
-			}]
-		}] : [{
-			kind: "summary",
-			status: "info",
-			text: NOTHING_TO_FORMAT
+/**
+* Verification ran and the database does not match the contract. The run did
+* the job it was asked to do, so this is a completed settlement carrying
+* diagnostics rather than an error.
+*/
+const FINDINGS_EXIT_CODE$1 = 4;
+const PUSH_THE_CONTRACT = runCommandAction("Push the contract to the database", "prisma-next db update");
+const RECONCILE_BY_HAND = {
+	kind: "user-choice",
+	label: "Or reconcile the differences by hand and verify again"
+};
+function errorInvalidVerifyMode(options) {
+	return new CliStructuredError$1("CLI.INVALID_VERIFY_MODE", "Invalid verify mode", {
+		why: options.why,
+		nextActions: [{
+			kind: "user-choice",
+			label: options.choose
 		}],
-		json: () => document
-	};
-}
-function createFormatCommand$1(execute = executeFormat) {
-	return defineOrmCommand({
-		help: {
-			summary: "Format your PSL contract source",
-			description: "Formats the Prisma schema (PSL) contract source declared in your config\n(contract.source.inputs[0]) in place. Only runs when contract.source.format\nis 'psl'; a TypeScript or unset source is left untouched. Indent and newline\nare read from the optional formatter config section, defaulting to two\nspaces and the system newline.",
-			examples: ["format", "format --json"]
-		},
-		needs: { config: ormConfigSection },
-		handler: async (_args, ctx) => {
-			const result = await execute({
-				config: ctx.config,
-				cwd: ctx.cwd
-			});
-			if (!result.ok) return notOk(normalizeError(result.failure));
-			return ok(ctx.present({ data: result.value }, formatPresentations(result.value, ctx.cwd)));
-		}
+		docsUrl: "https://pris.ly/db-verify"
 	});
 }
-const formatCommand = createFormatCommand$1();
-const STATUS_ACTION = runCommandAction("Check every space against the database", "prisma-next migration status");
+function resolveMode(flags) {
+	if (flags.markerOnly && flags.schemaOnly) return notOk(errorInvalidVerifyMode({
+		why: "`--marker-only` and `--schema-only` cannot be used together",
+		choose: "Choose one mode: omit both to check the marker and schema, use `--marker-only` to check only the marker, or use `--schema-only` to check only the live schema."
+	}));
+	if (flags.markerOnly && flags.strict) return notOk(errorInvalidVerifyMode({
+		why: "`--strict` requires schema verification, but `--marker-only` skips it",
+		choose: "Remove `--strict`, or use `db verify` / `db verify --schema-only` when you want to check the live schema in strict mode."
+	}));
+	if (flags.schemaOnly) return ok("schema-only");
+	return ok(flags.markerOnly ? "marker-only" : "full");
+}
+function modeLabel(mode, strict) {
+	if (mode === "marker-only") return "marker only";
+	const strictness = strict ? "strict" : "tolerant";
+	return mode === "schema-only" ? `schema only (${strictness})` : `full (marker + schema, ${strictness})`;
+}
+function invocation(mode, strict) {
+	return [
+		"db verify",
+		...mode === "marker-only" ? ["--marker-only"] : [],
+		...mode === "schema-only" ? ["--schema-only"] : [],
+		...strict ? ["--strict"] : []
+	].join(" ");
+}
+/** The marker verdict as a finding, keeping the code the commander raised. */
+function markerFindingDiagnostic(result) {
+	const { ok: _ok, ...diagnostic } = normalizeError(markerFindingError(result)).toEnvelope();
+	return diagnostic;
+}
 /**
-* The route the migration will take. The graph is a drawing — the engine cannot
-* derive a lane gutter — and the ordered list under it is drawn with the same
-* widths so every arrow lands in one column.
+* The aggregate verifier's per-space marker drift as a finding on a completed
+* run, keeping the `MIGRATION.CONTRACT_SPACE_VIOLATION` envelope it was
+* raised with.
 */
-function showPresentations$1(inputs) {
-	const { document, graph, runList } = inputs;
-	const count = document.migrations.length;
+function markerDriftDiagnostic(drift) {
+	const { ok: _ok, ...diagnostic } = normalizeError(drift).toEnvelope();
+	return diagnostic;
+}
+function markerFindingError(result) {
+	if (result.code === VERIFY_CODE_MARKER_MISSING) return errorMarkerMissing();
+	if (result.code === VERIFY_CODE_HASH_MISMATCH) {
+		if (!(result.marker?.storageHash === result.contract.storageHash)) return errorHashMismatch({
+			why: "Contract storageHash does not match database marker",
+			expected: result.contract.storageHash,
+			...ifDefined("actual", result.marker?.storageHash)
+		});
+		return errorHashMismatch({
+			why: !result.contract.profileHash || result.marker?.profileHash === result.contract.profileHash ? "Contract hash does not match database marker" : "Contract profileHash does not match database marker",
+			...ifDefined("expected", result.contract.profileHash),
+			...ifDefined("actual", result.marker?.profileHash)
+		});
+	}
+	if (result.code === VERIFY_CODE_TARGET_MISMATCH) return errorTargetMismatch(result.target.expected, result.target.actual ?? "unknown");
+	return errorRuntime$1("CONTRACT.VERIFY_FAILED", result.summary, {
+		why: "Verification failed",
+		fix: "Check contract and database state"
+	});
+}
+function verifyDocument(inputs) {
+	return {
+		ok: inputs.ok,
+		summary: inputs.summary,
+		mode: inputs.mode,
+		contract: inputs.verified.contract,
+		...ifDefined("marker", inputs.verified.marker),
+		target: inputs.verified.target,
+		...ifDefined("missingCodecs", inputs.verified.missingCodecs),
+		...ifDefined("codecCoverageSkipped", inputs.verified.codecCoverageSkipped),
+		...ifDefined("schema", inputs.schema),
+		...ifDefined("unclaimed", inputs.unclaimed),
+		...ifDefined("warning", inputs.warning),
+		meta: {
+			...inputs.verified.meta ?? {},
+			schemaVerification: inputs.schemaVerification
+		},
+		timings: { total: inputs.elapsed }
+	};
+}
+function schemaSummary(combined) {
+	return {
+		summary: combined.result.summary,
+		strict: combined.result.meta?.strict ?? false,
+		warnings: (combined.result.schema.warnings?.issues ?? []).map((issue) => issue.path.join("/"))
+	};
+}
+function headerBlock(inputs) {
+	return {
+		kind: "fields",
+		rail: true,
+		rows: [
+			{
+				label: "contract",
+				value: inputs.contractPath
+			},
+			{
+				label: "mode",
+				value: modeLabel(inputs.mode, inputs.strict)
+			},
+			{
+				label: "database",
+				value: inputs.database
+			}
+		]
+	};
+}
+function verifyPresentations(inputs) {
+	const document = inputs.document;
+	const warnings = document.schema?.warnings ?? [];
+	const unclaimed = document.unclaimed ?? [];
 	return {
 		human: () => [
+			inputs.header,
 			{
-				kind: "fields",
-				rail: true,
-				rows: [
-					{
-						label: "migrations",
-						value: inputs.migrationsDir
-					},
-					...inputs.database === void 0 ? [] : [{
-						label: "database",
-						value: inputs.database
-					}],
-					...inputs.from === void 0 ? [] : [{
-						label: "from",
-						value: inputs.from
-					}],
-					...inputs.to === void 0 ? [] : [{
-						label: "to",
-						value: inputs.to
-					}]
-				]
+				kind: "summary",
+				status: document.ok ? "ok" : "error",
+				text: document.summary
 			},
-			...graph.length === 0 ? [] : [{
-				kind: "drawing",
-				lines: toneDrawing(graph)
+			...document.ok ? [{
+				kind: "fields",
+				rows: [{
+					label: "storageHash",
+					value: document.contract.storageHash
+				}, ...document.contract.profileHash === void 0 ? [] : [{
+					label: "profileHash",
+					value: document.contract.profileHash
+				}]]
+			}] : [],
+			...warnings.length === 0 && unclaimed.length === 0 ? [] : [{
+				kind: "tree",
+				roots: [...warnings.length === 0 ? [] : [{
+					label: "Schema warnings",
+					status: "warn",
+					children: warnings.map((message) => ({
+						label: message,
+						status: "warn"
+					}))
+				}], ...unclaimed.length === 0 ? [] : [{
+					label: "Unclaimed elements (declared by no contract)",
+					status: "warn",
+					children: unclaimed.map((name) => ({
+						label: name,
+						status: "warn"
+					}))
+				}]]
 			}],
-			...count === 0 ? [{
+			...document.warning === void 0 ? [] : [{
 				kind: "summary",
-				status: "info",
-				text: document.summary
+				status: "warn",
+				text: document.warning
+			}]
+		],
+		json: () => document
+	};
+}
+function schemaPresentations(inputs) {
+	return {
+		human: () => [
+			inputs.header,
+			...schemaFindingBlocks({
+				result: inputs.document,
+				unclaimed: inputs.document.unclaimed,
+				strict: inputs.strict
+			}),
+			{
+				kind: "summary",
+				status: inputs.document.ok ? "ok" : "error",
+				text: inputs.document.summary
+			}
+		],
+		json: () => inputs.document
+	};
+}
+/**
+* One diagnostic per contract space whose live schema does not satisfy its
+* contract, plus the combined verdict when only the unclaimed list failed it.
+*/
+function driftDiagnostics(inputs) {
+	const perSpace = [...inputs.perSpace].filter(([, result]) => !result.ok).map(([space, result]) => schemaVerdictDiagnostic({
+		result,
+		space,
+		nextActions: [PUSH_THE_CONTRACT, RECONCILE_BY_HAND]
+	}));
+	if (perSpace.length > 0) return perSpace;
+	return [schemaVerdictDiagnostic({
+		result: inputs.combined.result,
+		space: void 0,
+		nextActions: [{
+			kind: "user-choice",
+			label: "Declare the unclaimed elements in a contract, or drop them from the database"
+		}]
+	})];
+}
+/**
+* Builds the command with its control-client factory injected, so tests mount
+* the same tree over a fake client instead of mocking the client module.
+*/
+function createDbVerifyCommand(createClient = createControlClient) {
+	return defineOrmCommand({
+		help: {
+			summary: "Check whether the database marker and live schema match your contract",
+			description: "Verifies the database marker first, then checks the database schema\nmatches your contract. Use `--marker-only` for marker-only verification,\n`--schema-only` to skip marker checks and inspect only the live schema,\nand `--strict` to fail if the database includes elements not present in\nthe contract.\nExit codes: 0 = the database matches the contract, 2 = the check could\nnot run (conflicting mode flags, no emitted contract, unreachable\ndatabase), 4 = drift or a marker finding.",
+			examples: [
+				"db verify",
+				"db verify --db $DATABASE_URL",
+				"db verify --strict",
+				"db verify --schema-only",
+				"db verify --marker-only",
+				"db verify --json"
+			]
+		},
+		args: { flags: {
+			db: dbFlag,
+			markerOnly: flag.boolean({ brief: "Skip schema verification and only check the database marker" }),
+			schemaOnly: flag.boolean({ brief: "Skip marker verification and only check whether the live schema satisfies the contract" }),
+			strict: flag.boolean({ brief: "Treat schema elements not present in the contract as an error" })
+		} },
+		needs: { config: ormConfigSection },
+		exitCodes: { 4: "verification found drift or marker findings" },
+		handler: async (args, ctx) => {
+			const strict = args.flags.strict;
+			const resolved = resolveMode({
+				markerOnly: args.flags.markerOnly,
+				schemaOnly: args.flags.schemaOnly,
+				strict
+			});
+			if (!resolved.ok) return notOk(resolved.failure);
+			const mode = resolved.value;
+			const commandInvocation = invocation(mode, strict);
+			const emitted = await readEmittedContract({
+				config: ctx.config,
+				cwd: ctx.cwd,
+				commandName: commandInvocation
+			});
+			if (!emitted.ok) return notOk(emitted.failure);
+			const connection = requireVerifyConnection({
+				config: ctx.config,
+				db: args.flags.db,
+				invocation: commandInvocation
+			});
+			if (!connection.ok) return notOk(connection.failure);
+			const dbConnection = connection.value;
+			const header = headerBlock({
+				contractPath: emitted.value.displayPath,
+				mode,
+				strict,
+				database: maskConnectionUrl(dbConnection)
+			});
+			const migrationsDir = migrationsDirFor(ctx.config, ctx.cwd);
+			const client = createClient({
+				family: ctx.config.family,
+				target: ctx.config.target,
+				adapter: ctx.config.adapter,
+				...ifDefined("driver", ctx.config.driver),
+				extensions: ctx.config.extensions ?? []
+			});
+			const onProgress = controlProgressReporter(ctx.report);
+			const startedAt = Date.now();
+			try {
+				if (mode === "schema-only") {
+					await client.connect(dbConnection);
+					const aggregate = await client.dbVerify({
+						contract: emitted.value.contract,
+						migrationsDir,
+						strict,
+						skipSchema: false,
+						skipMarker: true,
+						onProgress
+					});
+					if (!aggregate.ok) return notOk(normalizeError(aggregate.failure));
+					const combined = combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+					const document = {
+						...combined.result,
+						unclaimed: combined.unclaimed
+					};
+					return ok(ctx.present({
+						data: document,
+						exitCode: combined.result.ok ? 0 : FINDINGS_EXIT_CODE$1,
+						diagnostics: combined.result.ok ? [] : driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined
+						})
+					}, schemaPresentations({
+						document,
+						header,
+						strict
+					})));
+				}
+				const verified = await client.verify({
+					contract: emitted.value.contract,
+					connection: dbConnection,
+					onProgress
+				});
+				if (!verified.ok) {
+					const document = verifyDocument({
+						ok: false,
+						mode,
+						summary: verified.summary,
+						verified,
+						schema: void 0,
+						schemaVerification: "skipped",
+						unclaimed: void 0,
+						warning: void 0,
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: [markerFindingDiagnostic(verified)]
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				const aggregate = await client.dbVerify({
+					contract: emitted.value.contract,
+					migrationsDir,
+					strict,
+					skipSchema: mode === "marker-only",
+					skipMarker: false,
+					onProgress
+				});
+				if (!aggregate.ok) return notOk(normalizeError(aggregate.failure));
+				const drift = aggregate.value.markerDrift;
+				if (drift !== null) {
+					const driftCombined = mode === "marker-only" ? void 0 : combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+					const document = verifyDocument({
+						ok: false,
+						mode,
+						summary: normalizeError(drift).message,
+						verified,
+						schema: driftCombined === void 0 ? void 0 : schemaSummary(driftCombined),
+						schemaVerification: driftCombined === void 0 ? "skipped" : "performed",
+						unclaimed: driftCombined?.unclaimed,
+						warning: void 0,
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: [markerDriftDiagnostic(drift), ...driftCombined !== void 0 && !driftCombined.result.ok ? driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined: driftCombined
+						}) : []]
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				if (mode === "marker-only") {
+					const document = verifyDocument({
+						ok: true,
+						mode,
+						summary: "Database marker matches contract",
+						verified,
+						schema: void 0,
+						schemaVerification: "skipped",
+						unclaimed: void 0,
+						warning: "Schema verification skipped because --marker-only was provided",
+						elapsed: Date.now() - startedAt
+					});
+					return ok(ctx.present({
+						data: document,
+						exitCode: 0
+					}, verifyPresentations({
+						document,
+						header
+					})));
+				}
+				const combined = combineVerifyResults(aggregate.value.schemaResults, aggregate.value.appSpaceId, strict, aggregate.value.unclaimed);
+				if (!combined.result.ok) {
+					const document = {
+						...combined.result,
+						unclaimed: combined.unclaimed
+					};
+					return ok(ctx.present({
+						data: document,
+						exitCode: FINDINGS_EXIT_CODE$1,
+						diagnostics: driftDiagnostics({
+							perSpace: aggregate.value.schemaResults,
+							combined
+						})
+					}, schemaPresentations({
+						document,
+						header,
+						strict
+					})));
+				}
+				const document = verifyDocument({
+					ok: true,
+					mode,
+					summary: "Database marker and schema match contract",
+					verified,
+					schema: schemaSummary(combined),
+					schemaVerification: "performed",
+					unclaimed: combined.unclaimed,
+					warning: void 0,
+					elapsed: Date.now() - startedAt
+				});
+				return ok(ctx.present({
+					data: document,
+					exitCode: 0
+				}, verifyPresentations({
+					document,
+					header
+				})));
+			} catch (error) {
+				if (isInternalError(error)) throw error;
+				return notOk(verificationThrow({
+					error,
+					invocation: commandInvocation,
+					connection: dbConnection
+				}));
+			} finally {
+				await closeQuietly(client);
+			}
+		}
+	});
+}
+const dbVerifyCommand = createDbVerifyCommand();
+const NOTHING_TO_FORMAT = "Nothing to format (contract source is not PSL).";
+function formatPresentations(document, cwd) {
+	const path = document.path;
+	return {
+		human: () => document.formatted && path !== void 0 ? [{
+			kind: "summary",
+			status: "ok",
+			text: [{ text: "Formatted " }, {
+				text: relative(cwd, path),
+				tone: "identifier"
+			}]
+		}] : [{
+			kind: "summary",
+			status: "info",
+			text: NOTHING_TO_FORMAT
+		}],
+		json: () => document
+	};
+}
+function createFormatCommand$1(execute = executeFormat) {
+	return defineOrmCommand({
+		help: {
+			summary: "Format your PSL contract source",
+			description: "Formats the Prisma schema (PSL) contract source declared in your config\n(contract.source.inputs[0]) in place. Only runs when contract.source.format\nis 'psl'; a TypeScript or unset source is left untouched. Indent and newline\nare read from the optional formatter config section, defaulting to two\nspaces and the system newline.",
+			examples: ["format", "format --json"]
+		},
+		needs: { config: ormConfigSection },
+		handler: async (_args, ctx) => {
+			const result = await execute({
+				config: ctx.config,
+				cwd: ctx.cwd
+			});
+			if (!result.ok) return notOk(normalizeError(result.failure));
+			return ok(ctx.present({ data: result.value }, formatPresentations(result.value, ctx.cwd)));
+		}
+	});
+}
+const formatCommand = createFormatCommand$1();
+/** The invocation that finishes what a failed `init` phase started. */
+const EMIT_COMMAND = "prisma-next contract emit";
+/**
+* The command's own record of a phase that failed after the scaffold was
+* written. The scaffold is on disk and the run has a result to report, so each
+* of these rides a completed envelope as a finding rather than replacing it.
+*/
+function initFinding(code, summary, parts) {
+	return {
+		code,
+		severity: "error",
+		summary,
+		why: parts.why,
+		nextActions: parts.nextActions,
+		meta: parts.meta,
+		docsUrl: docsUrlFor(code)
+	};
+}
+/**
+* The dependency install failed. The engine composed and announced the command
+* line, so its own next action — which carries the redacted spelling — is the
+* one that tells the user what to run; `init` adds the emit that was waiting
+* on it.
+*/
+function installFailedFinding(failure, filesWritten) {
+	return initFinding("CLI.INIT_INSTALL_FAILED", "Failed to install dependencies", {
+		why: failure.why ?? failure.message,
+		nextActions: [...failure.nextActions, runCommandAction("Emit the contract once the dependencies are installed", EMIT_COMMAND)],
+		meta: {
+			filesWritten,
+			install: failure.meta ?? {}
+		}
+	});
+}
+/** The first emit failed against the freshly written scaffold. */
+function emitFailedFinding(cause, filesWritten) {
+	return initFinding("CLI.INIT_EMIT_FAILED", "Failed to emit contract", {
+		why: `\`${EMIT_COMMAND}\` failed: ${cause}`,
+		nextActions: [chooseAction("Fix the problem the contract source reports, then emit again"), runCommandAction("Emit the contract", EMIT_COMMAND)],
+		meta: {
+			filesWritten,
+			cause
+		}
+	});
+}
+/**
+* An agent-skill install failed; the project itself is complete without it.
+* The remedy is the skill-install commands themselves, which run against any
+* directory — advising a re-run of `init` would put the user's schema at risk
+* to fix something `init` no longer needs to be involved in.
+*/
+function skillInstallFailedFinding(failure, filesWritten, skillCommands) {
+	return initFinding("CLI.INIT_SKILL_INSTALL_FAILED", "Failed to install Prisma Next skills", {
+		why: failure.why ?? failure.message,
+		nextActions: [...failure.nextActions, ...skillCommands.map((command) => runCommandAction("Install the Prisma Next skills", command))],
+		meta: {
+			filesWritten,
+			skillInstall: failure.meta ?? {}
+		}
+	});
+}
+function fileNodes(paths) {
+	return paths.map((path) => ({
+		label: path,
+		tone: "identifier"
+	}));
+}
+function scaffoldTree(document) {
+	const roots = [{
+		label: "written",
+		tone: "heading",
+		children: fileNodes(document.filesWritten)
+	}];
+	if (document.filesDeleted.length > 0) roots.push({
+		label: "removed (stale artifacts and retired skill directories)",
+		tone: "heading",
+		children: fileNodes(document.filesDeleted)
+	});
+	const installed = document.packagesInstalled;
+	if (installed.status === "installed") roots.push({
+		label: "installed",
+		tone: "heading",
+		children: [...fileNodes(installed.deps), ...installed.devDeps.map((dep) => ({
+			label: `${dep} (dev)`,
+			tone: "identifier"
+		}))]
+	});
+	return {
+		kind: "tree",
+		roots
+	};
+}
+/**
+* The scaffold's follow-up steps, typed. `nextSteps` in the result document
+* keeps its numbered prose for consumers that already read it; these are the
+* same advice in the shape an agent can act on.
+*/
+function buildInitNextActions(inputs) {
+	const actions = [chooseAction("Set DATABASE_URL in your environment (export it or add it to .env)")];
+	if (!inputs.contractEmitted) actions.push(runCommandAction("Emit the contract", EMIT_COMMAND));
+	actions.push({
+		kind: "edit-file",
+		label: `Edit your schema at ${inputs.schemaPath}, then emit again`
+	});
+	actions.push(chooseAction("Open prisma-next.md for a quick reference on writing your first typed query"));
+	if (inputs.skillRegistered) actions.push(chooseAction("Prisma Next skills are registered with your agent runtime — ask it to add a model, run a query, or plan a migration"));
+	return actions;
+}
+const DONE_TEXT = "Done. Open prisma-next.md to get started.";
+const INCOMPLETE_TEXT = "Scaffold written. Finish the steps above to complete setup.";
+/**
+* `init` writes files rather than data another program reads, so it supplies
+* no `stdout` payload: human mode writes nothing to stdout.
+*/
+function initPresentations(inputs) {
+	const { document } = inputs;
+	return {
+		human: () => [
+			{
+				kind: "fields",
+				rail: true,
+				rows: [
+					{
+						label: "target",
+						value: document.target
+					},
+					{
+						label: "authoring",
+						value: document.authoring
+					},
+					{
+						label: "schema",
+						value: document.schemaPath
+					}
+				]
+			},
+			scaffoldTree(document),
+			inputs.complete ? {
+				kind: "summary",
+				status: "ok",
+				text: DONE_TEXT
+			} : {
+				kind: "summary",
+				status: "warn",
+				text: INCOMPLETE_TEXT
+			}
+		],
+		json: () => document,
+		next: () => inputs.nextActions
+	};
+}
+/**
+* Emits the contract for the project `init` has just scaffolded.
+*
+* The config file is the one this run wrote, so it is read here rather than
+* through `needs.config`: `init` runs where no config exists yet, and the
+* engine loads a section before the handler starts. The emitter and the config
+* loader are imported at execution time so a run that skips the install — and
+* therefore skips the emit — never pays for either.
+*/
+async function emitScaffoldedContract(ctx) {
+	const { executeContractEmit } = await import("./contract-emit-DDWBBvF1-BeGZCRrb.mjs");
+	const { loadConfigForSections } = await import("./exports-BZLNbtkY.mjs").then((n) => n.t);
+	const configPath = join(ctx.cwd, "prisma-next.config.ts");
+	const loaded = await loadConfigForSections(configPath, [
+		"contract",
+		"family",
+		"target",
+		"adapter",
+		"extensions"
+	]);
+	if (!loaded.ok) throw loaded.failure;
+	await executeContractEmit({
+		config: loaded.value,
+		cwd: ctx.cwd,
+		configPath
+	});
+}
+const CONFIG_FILE = "prisma-next.config.ts";
+const QUICK_REFERENCE_FILE = "prisma-next.md";
+const ENV_EXAMPLE_FILE = ".env.example";
+/**
+* The generated files a run replaces outright, in the order it writes them.
+* Everything else the scaffold touches it merges (`tsconfig.json`,
+* `package.json`, the git files) or keeps (`.env`, `README.md`), so replacing
+* one of these is the destructive act consent is asked for.
+*
+* `.env.example` is written the same way but deliberately left out: it is a
+* conventional filename in projects that have never seen Prisma Next, and a
+* consent token demanded for it would fire on first runs. The scaffold warns
+* when it replaces one instead.
+*/
+function generatedFilesInitReplaces(schemaPath) {
+	return [
+		schemaPath,
+		CONFIG_FILE,
+		join(dirname(schemaPath), "db.ts"),
+		QUICK_REFERENCE_FILE
+	];
+}
+const MANAGERS = /* @__PURE__ */ new Set([
+	"pnpm",
+	"npm",
+	"yarn",
+	"bun",
+	"deno"
+]);
+function isPackageManager(name) {
+	return MANAGERS.has(name);
+}
+/**
+* The manager the scaffolded quick reference and README name in their example
+* commands. It resolves the way the engine's package operations resolve theirs
+* — the project at `cwd` first, then the manager that invoked this process —
+* so the documentation `init` writes names the manager `init` drove. The
+* capability itself reports no manager back on success, which is why this is
+* worked out a second time here.
+*/
+async function resolveScaffoldPackageManager(ctx) {
+	const detected = await detect({ cwd: ctx.cwd });
+	if (detected !== null && isPackageManager(detected.name)) return detected.name;
+	const invoking = ctx.env["npm_config_user_agent"]?.split("/")[0];
+	return invoking !== void 0 && isPackageManager(invoking) ? invoking : "npm";
+}
+/**
+* True when the parsed manifest declares `name` directly in `dependencies` or
+* `devDependencies`. Transitive presence is deliberately ignored: detecting it
+* needs the lockfile, and the realistic risk is a direct pin being clobbered.
+*/
+function hasDirectDep(parsed, name) {
+	for (const field of ["dependencies", "devDependencies"]) {
+		const value = parsed[field];
+		if (value !== null && typeof value === "object" && name in value) return true;
+	}
+	return false;
+}
+/**
+* npm package names are lowercase and URL-safe; `basename(cwd)` happily
+* returns "My Project" or ".hidden", both of which npm refuses to read.
+*/
+function sanitisePackageName(raw) {
+	const trimmed = raw.toLowerCase().replace(/[^a-z0-9._~-]/g, "-").replace(/^[._-]+/, "").replace(/-+/g, "-");
+	return trimmed.length > 0 ? trimmed : "my-app";
+}
+/**
+* The manifest `init` writes for a directory that has none. Private, so a
+* stray publish cannot leak the placeholder, and ESM so the scaffolded import
+* attributes load under Node's loader.
+*/
+function defaultPackageJsonContent(rawName) {
+	return `${JSON.stringify({
+		name: sanitisePackageName(rawName),
+		version: "0.0.0",
+		private: true,
+		type: "module"
+	}, null, 2)}\n`;
+}
+function hasProjectManifest(cwd) {
+	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
+}
+/**
+* Computes every write before touching disk: reads and parses each file the
+* scaffold merges with, so a malformed manifest or tsconfig fails with the
+* user's project byte-identical to how it started.
+*/
+function planScaffold(ctx) {
+	const { cwd, inputs, packageManager, resolveImportSpecifier } = ctx;
+	const warnings = [];
+	const schemaDir = dirname(inputs.schemaPath);
+	const configContractPath = isAbsolute(inputs.schemaPath) ? inputs.schemaPath : `./${inputs.schemaPath}`;
+	const runPrefix = formatRunCommand(packageManager, "prisma-next", "").trimEnd();
+	const files = [
+		{
+			path: inputs.schemaPath,
+			content: starterSchema(inputs.target, inputs.authoring, resolveImportSpecifier)
+		},
+		{
+			path: CONFIG_FILE,
+			content: configFile(inputs.target, configContractPath, resolveImportSpecifier)
+		},
+		{
+			path: join(schemaDir, "db.ts"),
+			content: dbFile(inputs.target, resolveImportSpecifier)
+		},
+		{
+			path: QUICK_REFERENCE_FILE,
+			content: quickReferenceMd(inputs.target, inputs.authoring, inputs.schemaPath, runPrefix, resolveImportSpecifier)
+		},
+		{
+			path: ENV_EXAMPLE_FILE,
+			content: envExampleContent(inputs.target)
+		}
+	];
+	if (existsSync(join(cwd, ENV_EXAMPLE_FILE))) warnings.push(`${ENV_EXAMPLE_FILE} already existed and was replaced with the Prisma Next template.`);
+	const filesToDelete = inputs.reinit ? [...findStaleArtifacts(cwd, schemaDir)] : [];
+	const dirsToDelete = legacySkillDirs().filter((rel) => existsSync(join(cwd, rel)));
+	if (inputs.writeEnv) if (existsSync(join(cwd, ".env"))) warnings.push(".env already exists; leaving it untouched. Compare with .env.example for any new keys.");
+	else files.push({
+		path: ".env",
+		content: envFileContent(inputs.target)
+	});
+	const tsconfigPath = join(cwd, "tsconfig.json");
+	if (existsSync(tsconfigPath)) {
+		const existing = readFileSync(tsconfigPath, "utf-8");
+		let merged;
+		try {
+			merged = mergeTsConfig(existing);
+		} catch (error) {
+			if (error instanceof TsConfigParseError) throw errorInitInvalidTsconfig({
+				path: "tsconfig.json",
+				cause: error.message
+			});
+			throw error;
+		}
+		files.push({
+			path: "tsconfig.json",
+			content: merged,
+			note: "Updated tsconfig.json with required compiler options."
+		});
+	} else files.push({
+		path: "tsconfig.json",
+		content: defaultTsConfig()
+	});
+	const gitignorePath = join(cwd, ".gitignore");
+	const nextGitignore = mergeGitignore(existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : void 0);
+	if (nextGitignore !== null) files.push({
+		path: ".gitignore",
+		content: nextGitignore
+	});
+	const gitattributesPath = join(cwd, ".gitattributes");
+	const nextGitattributes = mergeGitattributes(existsSync(gitattributesPath) ? readFileSync(gitattributesPath, "utf-8") : void 0, requiredGitattributesLines(schemaDir, inputs.target));
+	if (nextGitattributes !== null) files.push({
+		path: ".gitattributes",
+		content: nextGitattributes
+	});
+	const manifestPath = join(cwd, "package.json");
+	const manifestExisted = existsSync(manifestPath);
+	const synthesiseManifest = !manifestExisted && !hasProjectManifest(cwd);
+	let parsedManifest = null;
+	if (manifestExisted || synthesiseManifest) {
+		const raw = manifestExisted ? readFileSync(manifestPath, "utf-8") : defaultPackageJsonContent(basename(cwd));
+		try {
+			parsedManifest = JSON.parse(raw);
+		} catch (error) {
+			if (error instanceof SyntaxError) throw errorInitInvalidManifest({
+				path: "package.json",
+				cause: error.message
+			});
+			throw error;
+		}
+		let working = raw;
+		let changed = synthesiseManifest;
+		if (inputs.removePreviousFacade !== null) {
+			const next = removeDependency(working, inputs.removePreviousFacade);
+			if (next !== null) {
+				working = next;
+				changed = true;
+			}
+		}
+		const { content: withScripts, warnings: scriptWarnings } = mergePackageScripts(working, REQUIRED_SCRIPTS);
+		if (withScripts !== null) {
+			working = withScripts;
+			changed = true;
+		}
+		const { content: withType, warning: typeWarning } = ensureEsmModuleType(working);
+		if (withType !== null) {
+			working = withType;
+			changed = true;
+		}
+		if (changed) files.push({
+			path: "package.json",
+			content: working
+		});
+		warnings.push(...scriptWarnings);
+		if (typeWarning !== null) warnings.push(typeWarning);
+		if (synthesiseManifest) warnings.push("No package.json found in the target directory; created a minimal one. Edit `name` / `version` to taste.");
+	}
+	if (existsSync(join(cwd, "src/index.ts"))) if (existsSync(join(cwd, "README.md"))) warnings.push("README.md already exists; leaving it untouched.");
+	else {
+		const declaredName = parsedManifest !== null && typeof parsedManifest["name"] === "string" ? parsedManifest["name"] : basename(cwd);
+		files.push({
+			path: "README.md",
+			content: minimalProjectReadmeMd(inputs.target, inputs.schemaPath, sanitisePackageName(declaredName), packageManager)
+		});
+	}
+	return {
+		files,
+		filesToDelete,
+		dirsToDelete,
+		warnings,
+		hasTypesNode: parsedManifest !== null && hasDirectDep(parsedManifest, "@types/node")
+	};
+}
+/**
+* Plans every write, then performs them. Everything that can fail on the
+* user's existing files fails during planning, so a failure leaves the project
+* as it was; after the first write, the scaffold is on disk to keep, and a
+* write that fails partway names the files that already landed.
+*/
+function scaffoldProject(ctx) {
+	const resolveImportSpecifier = scaffoldSpecifierResolverFor(ctx.inputs.target);
+	const plan = planScaffold({
+		...ctx,
+		resolveImportSpecifier
+	});
+	const filesWritten = [];
+	const filesDeleted = [];
+	const notes = [];
+	for (const file of plan.files) {
+		const target = join(ctx.cwd, file.path);
+		try {
+			mkdirSync(dirname(target), { recursive: true });
+			writeFileSync(target, file.content, "utf-8");
+		} catch (error) {
+			throw errorInitWriteFailed({
+				path: file.path,
+				cause: error instanceof Error ? error.message : String(error),
+				filesWritten
+			});
+		}
+		filesWritten.push(file.path);
+		if (file.note !== void 0) notes.push(file.note);
+	}
+	for (const rel of plan.filesToDelete) {
+		const target = join(ctx.cwd, rel);
+		if (!existsSync(target)) continue;
+		try {
+			unlinkSync(target);
+			filesDeleted.push(rel);
+		} catch (error) {
+			if (!(error instanceof Error && Reflect.get(error, "code") === "ENOENT")) throw error;
+		}
+	}
+	for (const rel of plan.dirsToDelete) {
+		rmSync(join(ctx.cwd, rel), {
+			recursive: true,
+			force: true
+		});
+		filesDeleted.push(rel);
+	}
+	return {
+		filesWritten,
+		filesDeleted,
+		warnings: plan.warnings,
+		notes,
+		hasTypesNode: plan.hasTypesNode,
+		resolveImportSpecifier
+	};
+}
+const REQUIRED_FLAG_PROMPTS = /* @__PURE__ */ new Set(["target", "authoring"]);
+function formatFileList(files) {
+	const last = files.at(-1) ?? "";
+	return files.length <= 1 ? last : `${files.slice(0, -1).join(", ")} and ${last}`;
+}
+/**
+* Names the files at stake rather than the category they belong to: the user
+* knows `contract.prisma`, not "every generated file".
+*/
+function consentQuestion(replaced) {
+	const written = replaced.length === 1 ? "it" : "them";
+	return `Re-initializing replaces ${formatFileList(replaced)} with a fresh scaffold, losing anything you wrote in ${written}.`;
+}
+/**
+* The engine raises this when a prompt has no default and the session cannot
+* show it. For the two prompts that stand in for a required flag, that is the
+* same condition `init` has always reported as a missing flag.
+*/
+function isPromptRequired(error) {
+	return error instanceof Error && Reflect.get(error, "code") === "CLI.PROMPT_REQUIRED";
+}
+/**
+* `--confirm` matches a token, so the token has to be something the user can
+* see and type. The working directory's name is it; a directory with no name
+* of its own (the filesystem root) falls back to its path.
+*
+* Trimmed, because the engine compares the typed answer trimmed: an untrimmed
+* token from a directory named `my app ` is one no keystroke sequence matches.
+*/
+function consentToken(cwd) {
+	const name = basename(cwd).trim();
+	return name.length > 0 ? name : cwd.trim();
+}
+async function askTarget(prompt) {
+	return prompt.select("What database are you using?", [{
+		value: "postgres",
+		label: "PostgreSQL"
+	}, {
+		value: "mongo",
+		label: "MongoDB"
+	}]);
+}
+async function askAuthoring(prompt) {
+	return prompt.select("How do you want to write your schema?", [{
+		value: "psl",
+		label: "Prisma Schema Language (.prisma)"
+	}, {
+		value: "typescript",
+		label: "TypeScript (.ts)"
+	}]);
+}
+/**
+* The schema path the user typed goes through the same validator the flag
+* does, so an answer the engine accepted still has to agree with the authoring
+* style.
+*/
+async function askSchemaPath(prompt, authoring) {
+	return validateSchemaPath(await prompt.text("Where should the schema file go?", { default: defaultSchemaPath(authoring) }), authoring);
+}
+/**
+* The facade a previous `init` installed for the other target, when this run
+* switches targets and one is still declared. Reads every name a previous run
+* could have written, because older versions scaffolded the workspace name.
+*/
+function previousFacade(cwd, target) {
+	const manifestPath = join(cwd, "package.json");
+	if (!existsSync(manifestPath)) return;
+	const otherTarget = target === "postgres" ? "mongo" : "postgres";
+	const candidates = [targetPackageName(otherTarget, scaffoldSpecifierResolverFor(otherTarget)), targetPackageName(otherTarget)];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf-8"));
+	} catch {
+		return;
+	}
+	const deps = parsed["dependencies"];
+	if (deps === null || typeof deps !== "object" || Array.isArray(deps)) return;
+	const declared = deps;
+	return candidates.find((name) => Object.hasOwn(declared, name));
+}
+async function resolveRemovePreviousFacade(ctx) {
+	if (!ctx.reinit || ctx.keepPreviousFacade) return null;
+	const facade = previousFacade(ctx.cwd, ctx.target);
+	if (facade === void 0) return null;
+	const otherTarget = ctx.target === "postgres" ? "mongo" : "postgres";
+	return await ctx.prompt.confirm(`Switching from ${targetLabel(otherTarget)} to ${targetLabel(ctx.target)} — remove ${facade} from package.json dependencies?`, { default: true }) ? facade : null;
+}
+/**
+* Resolves every input from the flags and, where a flag is absent, from the
+* engine's prompt surface.
+*
+* Order matters twice. Every flag value is validated before anything is asked,
+* so a typo costs a typo rather than a typed consent token. And consent comes
+* as soon as the schema path is known, because that is the point at which the
+* question can name the files it is about — and before any question whose
+* answer only matters if the run proceeds.
+*/
+async function resolveInitInputs(ctx) {
+	const { cwd, flags, prompt } = ctx;
+	if (flags.strictProbe && !flags.probeDb) throw errorInitStrictProbeWithoutProbe();
+	const flagTarget = resolveTarget(flags.target);
+	const flagAuthoring = resolveAuthoring(flags.authoring);
+	let target;
+	let authoring;
+	try {
+		target = flagTarget ?? await askTarget(prompt);
+		authoring = flagAuthoring ?? await askAuthoring(prompt);
+	} catch (error) {
+		if (!isPromptRequired(error)) throw error;
+		throw errorInitMissingFlags({
+			missing: [...flagTarget === void 0 ? ["target"] : [], ...flagAuthoring === void 0 ? ["authoring"] : []].filter((flag) => REQUIRED_FLAG_PROMPTS.has(flag)),
+			why: "This session cannot prompt, so the answers have to arrive as flags."
+		});
+	}
+	const schemaPath = flags.schemaPath !== void 0 ? validateSchemaPath(flags.schemaPath, authoring) : await askSchemaPath(prompt, authoring);
+	const replaced = generatedFilesInitReplaces(schemaPath).filter((relative) => existsSync(join(cwd, relative)));
+	const reinit = replaced.length > 0;
+	if (reinit) {
+		if (!await prompt.consent(consentQuestion(replaced), { token: consentToken(cwd) })) throw errorInitUserAborted();
+	}
+	const writeEnv = flags.writeEnv || await prompt.confirm("Also write a .env file from .env.example? (gitignored)", { default: false });
+	const removePreviousFacade = await resolveRemovePreviousFacade({
+		cwd,
+		target,
+		reinit,
+		keepPreviousFacade: flags.keepPreviousFacade,
+		prompt
+	});
+	return {
+		target,
+		authoring,
+		schemaPath,
+		install: !flags.skipInstall,
+		writeEnv,
+		probeDb: flags.probeDb,
+		strictProbe: flags.strictProbe,
+		reinit,
+		removePreviousFacade,
+		installProjectSkill: !flags.skipSkills
+	};
+}
+function metaString(failure, key) {
+	const value = failure.meta?.[key];
+	return typeof value === "string" ? value : "";
+}
+/**
+* pnpm reported a specifier the published artifact leaked, which npm installs
+* happily. The engine redacts credentials out of the stderr it returns but
+* leaves error codes alone, which is what this reads.
+*/
+function pnpmLeakedASpecifier(failure) {
+	return metaString(failure, "manager") === "pnpm" && isRecognisedPnpmResolutionError(metaString(failure, "stderrTail"));
+}
+/**
+* The engine redacts the stderr it hands back, and this redacts it again
+* before quoting it: what the engine strips is its own business, and registry
+* auth material is not all URL-shaped.
+*/
+function fallbackWarning(failure) {
+	const firstLine = redactSecrets(metaString(failure, "stderrTail")).trim().split("\n")[0] ?? "";
+	return [
+		"pnpm could not install: a published Prisma Next dependency leaked a `workspace:*` or `catalog:` specifier.",
+		"Falling back to npm so init can complete.",
+		firstLine === "" ? "" : `  pnpm error: ${firstLine}`,
+		"Both installs ran under npm, which writes a package-lock.json beside the pnpm lockfile — delete whichever of the two you do not want to keep.",
+		"Once the offending package republishes a clean version, re-run `pnpm install` to switch back."
+	].filter((line) => line !== "").join("\n");
+}
+/** The pnpm failure the npm retry was meant to recover from, kept alongside the npm one. */
+function retriedWarning(failure) {
+	const firstLine = redactSecrets(metaString(failure, "stderrTail")).trim().split("\n")[0] ?? "";
+	return ["pnpm failed first with a leaked `workspace:*` or `catalog:` specifier, so init retried with npm.", firstLine === "" ? "" : `  pnpm error: ${firstLine}`].filter((line) => line !== "").join("\n");
+}
+/**
+* Adds the runtime and development dependencies through the engine's package
+* manager. The retry is `init`'s alone: the engine spells and runs the
+* command, and this decides — from the stderr it returned — that another
+* manager is worth a try.
+*/
+async function installProjectDependencies(ctx) {
+	const pair = async (manager) => {
+		const runtimeDeps = await ctx.packages.install({
+			packages: ctx.deps,
+			cwd: ctx.cwd,
+			...ifDefined("manager", manager)
+		});
+		if (!runtimeDeps.ok) return runtimeDeps.failure;
+		const developmentDeps = await ctx.packages.install({
+			packages: ctx.devDeps,
+			dev: true,
+			cwd: ctx.cwd,
+			...ifDefined("manager", manager)
+		});
+		return developmentDeps.ok ? void 0 : developmentDeps.failure;
+	};
+	const failure = await pair();
+	if (failure === void 0) return {
+		failure: void 0,
+		manager: void 0,
+		warnings: ctx.catalogWarnings
+	};
+	if (!pnpmLeakedASpecifier(failure)) return {
+		failure,
+		manager: void 0,
+		warnings: []
+	};
+	const retryFailure = await pair("npm");
+	if (retryFailure !== void 0) return {
+		failure: retryFailure,
+		manager: void 0,
+		warnings: [retriedWarning(failure)]
+	};
+	return {
+		failure: void 0,
+		manager: "npm",
+		warnings: [fallbackWarning(failure)]
+	};
+}
+function skillArgs(url, skill) {
+	return [
+		"add",
+		url,
+		"--agent",
+		...DEFAULT_SKILL_AGENTS,
+		"--skill",
+		skill,
+		"-y"
+	];
+}
+/**
+* Registers every Prisma Next skill with the agent runtimes, in order. The
+* first failure stops the loop: the user opted into Prisma Next by running
+* `init`, and a half-installed skill set leaves the project ambiguous.
+*/
+async function installAgentSkills(ctx) {
+	for (const source of DEFAULT_SKILL_SOURCES) {
+		const result = await ctx.packages.run({
+			package: "skills@latest",
+			args: skillArgs(formatSkillSourceUrl(source, ctx.env), source.skill),
+			cwd: ctx.cwd,
+			...ifDefined("manager", ctx.manager)
+		});
+		if (!result.ok) return result.failure;
+	}
+}
+/** The scaffold is on disk from here on, so each of these is a finding. */
+const INIT_EXIT_CODES = {
+	4: "scaffold written; dependency install failed",
+	5: "scaffold written and installed; contract emit failed",
+	6: "scaffold complete; agent-skill install failed"
+};
+function probeWarning(outcome, strictProbe) {
+	switch (outcome.kind) {
+		case "ok": return {
+			warning: void 0,
+			fatal: void 0
+		};
+		case "below-minimum": return {
+			warning: outcome.message,
+			fatal: void 0
+		};
+		case "no-database-url":
+		case "connection-failed":
+		case "driver-missing": return strictProbe ? {
+			warning: void 0,
+			fatal: outcome.message
+		} : {
+			warning: outcome.message,
+			fatal: void 0
+		};
+	}
+}
+function causeMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+const createInitCommand = (injected) => defineOrmCommand({
+	help: {
+		summary: "Initialize a new Prisma Next project",
+		description: "Scaffolds config, schema, and runtime files, installs dependencies,\nand emits the contract. Gets you from zero to typed queries in one step.\n\nRun it interactively for a guided setup, or supply --target and --authoring\nfor a fully scriptable run (CI, AI coding agents, automation).",
+		examples: [
+			"init",
+			"init --target postgres --authoring psl",
+			"init --target mongodb --authoring typescript --json",
+			"init --skip-install",
+			"init --skip-skills",
+			"init --target postgres --keep-previous-facade"
+		]
+	},
+	args: { flags: {
+		target: flag.string({
+			brief: "Database target: postgres or mongodb",
+			placeholder: "db"
+		}),
+		authoring: flag.string({
+			brief: "Schema authoring style: psl or typescript",
+			placeholder: "style"
+		}),
+		schemaPath: flag.string({
+			brief: "Where to write the starter schema",
+			placeholder: "path"
+		}),
+		writeEnv: flag.boolean({ brief: "Write a .env file from .env.example (gitignored)" }),
+		probeDb: flag.boolean({ brief: "Connect to DATABASE_URL once and check the server version" }),
+		strictProbe: flag.boolean({ brief: "Treat a failed --probe-db as fatal" }),
+		skipInstall: flag.boolean({ brief: "Skip dependency installation and contract emission" }),
+		skipSkills: flag.boolean({ brief: "Skip the Prisma Next agent-skill install" }),
+		keepPreviousFacade: flag.boolean({ brief: "Keep the previous target package in package.json when switching targets" })
+	} },
+	exitCodes: INIT_EXIT_CODES,
+	installsPackages: true,
+	handler: async (args, ctx) => {
+		const warnings = [];
+		const warn = (text) => {
+			warnings.push(text);
+			ctx.report({
+				kind: "message",
+				severity: "warn",
+				text
+			});
+		};
+		const inputs = await resolveInitInputs({
+			cwd: ctx.cwd,
+			flags: args.flags,
+			prompt: ctx.prompt
+		});
+		const packageManager = await resolveScaffoldPackageManager({
+			cwd: ctx.cwd,
+			env: ctx.env
+		});
+		const scaffold = scaffoldProject({
+			cwd: ctx.cwd,
+			inputs,
+			packageManager
+		});
+		for (const warning of scaffold.warnings) warn(warning);
+		for (const note of scaffold.notes) ctx.report({
+			kind: "message",
+			severity: "info",
+			text: note
+		});
+		const deps = [targetPackageName(inputs.target, scaffold.resolveImportSpecifier), "dotenv"];
+		const devDeps = scaffold.hasTypesNode ? ["prisma-next"] : ["prisma-next", "@types/node"];
+		const findings = [];
+		const extraActions = [];
+		let installedManager;
+		let packagesInstalled = "skipped";
+		let contractEmitted = false;
+		let skillRegistered = false;
+		const settle = (exitCode) => {
+			const installed = packagesInstalled === "installed";
+			const document = {
+				ok: true,
+				target: inputs.target === "mongo" ? "mongodb" : "postgres",
+				authoring: inputs.authoring,
+				schemaPath: inputs.schemaPath,
+				filesWritten: scaffold.filesWritten,
+				filesDeleted: scaffold.filesDeleted,
+				packagesInstalled: {
+					status: packagesInstalled,
+					deps: installed ? deps : [],
+					devDeps: installed ? devDeps : []
+				},
+				contractEmitted,
+				nextSteps: buildNextSteps({
+					target: inputs.target === "mongo" ? "mongodb" : "postgres",
+					packagesInstalled,
+					contractEmitted,
+					emitCommand: EMIT_COMMAND,
+					schemaPath: inputs.schemaPath,
+					skillRegistered
+				}),
+				warnings
+			};
+			const validated = InitOutputSchema(document);
+			if (validated instanceof type.errors) return notOk(new CliStructuredError$1("CLI.INIT_INVALID_OUTPUT_DOCUMENT", "Init produced an invalid output document", {
+				why: `The success document failed schema validation: ${String(validated)}`,
+				nextActions: [chooseAction("This is a bug in prisma-next. Please report it with `-v` output.")],
+				docsUrl: docsUrlFor("CLI.INIT_INVALID_OUTPUT_DOCUMENT")
+			}));
+			return ok(ctx.present({
+				data: document,
+				exitCode,
+				diagnostics: findings
+			}, initPresentations({
+				document,
+				complete: exitCode === 0,
+				nextActions: [...extraActions, ...buildInitNextActions({
+					contractEmitted,
+					schemaPath: inputs.schemaPath,
+					skillRegistered
+				})]
+			})));
+		};
+		if (inputs.install) {
+			const outcome = await installProjectDependencies({
+				packages: ctx.packages,
+				cwd: ctx.cwd,
+				deps,
+				devDeps,
+				catalogWarnings: packageManager === "pnpm" ? buildCatalogWarnings(ctx.cwd, [...deps, ...devDeps]) : []
+			});
+			for (const warning of outcome.warnings) warn(warning);
+			if (outcome.failure !== void 0) {
+				packagesInstalled = "failed";
+				findings.push(installFailedFinding(outcome.failure, scaffold.filesWritten));
+				return settle(4);
+			}
+			packagesInstalled = "installed";
+			installedManager = outcome.manager;
+			const emitStep = "Emit the contract";
+			ctx.report({
+				kind: "step-started",
+				step: emitStep
+			});
+			try {
+				await injected.emitScaffoldedContract({ cwd: ctx.cwd });
+				contractEmitted = true;
+				ctx.report({
+					kind: "step-finished",
+					step: emitStep,
+					outcome: "ok"
+				});
+			} catch (error) {
+				ctx.report({
+					kind: "step-finished",
+					step: emitStep,
+					outcome: "failed"
+				});
+				findings.push(emitFailedFinding(causeMessage(error), scaffold.filesWritten));
+				return settle(5);
+			}
+		} else extraActions.push(chooseAction(`Install the project dependencies with your package manager: ${deps.join(", ")} (and ${devDeps.join(", ")} as development dependencies)`));
+		if (inputs.probeDb) {
+			const probe = probeWarning(await probeServerVersion({
+				baseDir: ctx.cwd,
+				target: inputs.target,
+				databaseUrl: ctx.env["DATABASE_URL"],
+				minVersion: MIN_SERVER_VERSION[inputs.target]
+			}, {}), inputs.strictProbe);
+			if (probe.warning !== void 0) warn(probe.warning);
+			if (probe.fatal !== void 0) return notOk(normalizeError(errorInitProbeFailed({
+				cause: probe.fatal,
+				filesWritten: scaffold.filesWritten
+			})));
+		}
+		const skillCommands = resolveProjectSkillInstallCommands(installedManager ?? packageManager, ctx.env);
+		if (inputs.installProjectSkill) {
+			const failure = await installAgentSkills({
+				packages: ctx.packages,
+				cwd: ctx.cwd,
+				env: ctx.env,
+				manager: installedManager
+			});
+			if (failure !== void 0) {
+				findings.push(skillInstallFailedFinding(failure, scaffold.filesWritten, skillCommands));
+				return settle(6);
+			}
+			skillRegistered = true;
+		} else warn(`Skipped the Prisma Next agent-skill install (--skip-skills). To install them later, run: ${skillCommands.map((command) => `\`${command}\``).join(" && ")}`);
+		return settle(0);
+	}
+});
+const initCommand = createInitCommand({ emitScaffoldedContract });
+/**
+* R-S5-12 asks every command to end at 143 for SIGTERM and 130 otherwise, and
+* a server command is the one kind the engine leaves to do it: it settles the
+* handler's code verbatim, on the reasoning that a protocol conclusion was
+* never the CLI's to author. The two readings are in tension — this one wins
+* here, and the tension is recorded for the engine's owners, because it means
+* a SIGTERM landing after a clean `shutdown` reports 143 for a conversation
+* that ended correctly at 0.
+*/
+function signalExitCode(reason) {
+	return reason === "SIGTERM" ? 143 : 130;
+}
+const lspCommand = defineServerCommand({
+	help: {
+		summary: "Start the Prisma Next language server",
+		description: "Launches a Language Server Protocol server that publishes PSL parse diagnostics\nand handles whole-document PSL formatting for the schema inputs declared in\nyour config (contract.source.inputs). Formatting uses the Prisma Next PSL\nformatter and the formatter block from the project config.\nCommunicates over stdio; intended to be spawned by an\neditor, not run interactively. The server keeps running until the editor client\ndisconnects.",
+		examples: ["lsp"]
+	},
+	args: { flags: {
+		stdio: flag.boolean({ brief: "Communicate with the editor over stdio (the default and only transport)" }),
+		clientProcessId: flag.number({
+			brief: "Process id of the editor that spawned the server; the server ends when it dies",
+			placeholder: "pid"
+		})
+	} },
+	handler: async (args, io) => {
+		const exitCode = await withoutClientProcessIdInArgv(async () => {
+			const { startServer } = await import("./exports-B3xY_FHp.mjs");
+			return startServer({
+				stdin: io.stdin,
+				stdout: io.stdout,
+				stderr: io.stderr,
+				signal: io.signal,
+				...ifDefined("clientProcessId", args.flags.clientProcessId)
+			});
+		});
+		return io.signal.aborted ? signalExitCode(io.signal.reason) : exitCode;
+	}
+});
+/**
+* Importing `vscode-languageserver/node` reads `--clientProcessId` off
+* `process.argv` and arms a parent-watch interval that is never unref'd, so a
+* settled run would leave the process hanging. The server watches the client
+* process itself (from the parsed flag), so the argument is hidden for the
+* import and restored after.
+*/
+async function withoutClientProcessIdInArgv(run) {
+	const original = process.argv;
+	const scrubbed = [];
+	for (let index = 0; index < original.length; index += 1) {
+		const token = original[index];
+		if (token === "--clientProcessId") {
+			index += 1;
+			continue;
+		}
+		if (token === void 0 || token.startsWith("--clientProcessId=")) continue;
+		scrubbed.push(token);
+	}
+	process.argv = scrubbed;
+	try {
+		return await run();
+	} finally {
+		process.argv = original;
+	}
+}
+const STATUS_ACTION = runCommandAction("Check every space against the database", "prisma-next migration status");
+/**
+* The route the migration will take. The graph is a drawing — the engine cannot
+* derive a lane gutter — and the ordered list under it is drawn with the same
+* widths so every arrow lands in one column.
+*/
+function showPresentations$1(inputs) {
+	const { document, graph, runList } = inputs;
+	const count = document.migrations.length;
+	return {
+		human: () => [
+			{
+				kind: "fields",
+				rail: true,
+				rows: [
+					{
+						label: "migrations",
+						value: inputs.migrationsDir
+					},
+					...inputs.database === void 0 ? [] : [{
+						label: "database",
+						value: inputs.database
+					}],
+					...inputs.from === void 0 ? [] : [{
+						label: "from",
+						value: inputs.from
+					}],
+					...inputs.to === void 0 ? [] : [{
+						label: "to",
+						value: inputs.to
+					}]
+				]
+			},
+			...graph.length === 0 ? [] : [{
+				kind: "drawing",
+				lines: toneDrawing(graph)
+			}],
+			...count === 0 ? [{
+				kind: "summary",
+				status: "info",
+				text: document.summary
 			}] : [{
 				kind: "summary",
 				status: "info",
@@ -1799,6 +3610,146 @@ function createMigrateCommand(createClient) {
 }
 const migrateCommand = createMigrateCommand(createControlClient);
 /**
+* The check completed and the artifacts it read are not internally consistent.
+* The findings ride the envelope as diagnostics; the run itself did its job,
+* which is why this is not an errored settlement.
+*/
+const FINDINGS_EXIT_CODE = 4;
+/**
+* One integrity failure as an envelope diagnostic. `error` is the honest
+* severity: nothing about the artifacts is merely worth a look, and exit 4
+* makes it legal — the engine refuses a severity-`error` diagnostic only on a
+* run that exits 0.
+*
+* The summary leads with the path because the engine's diagnostic renderer
+* prints `code`, `summary`, `why` and the next actions and never prints
+* `where`. Several failure texts name no package on their own — a hash
+* mismatch reads "Stored hash X does not match recomputed hash Y" — so
+* without the path a project with fifty migrations cannot be told which one
+* is broken. `where` still carries the path on its own for a `--json`
+* consumer.
+*/
+function failureDiagnostic(failure) {
+	if (!isStructuredErrorCode(failure.code)) throw new InternalError(`migration check produced the failure code "${failure.code}", which is not a dotted NAMESPACE.SUBCODE.`);
+	return {
+		code: failure.code,
+		severity: "error",
+		summary: `${failure.where}: ${failure.why}`,
+		nextActions: failure.nextActions,
+		where: { path: failure.where },
+		meta: { space: failure.space }
+	};
+}
+function checkPresentations(inputs) {
+	const summary = inputs.resolvedSpaceId === void 0 ? inputs.document.summary : `${inputs.document.summary}  (space: ${inputs.resolvedSpaceId})`;
+	return {
+		human: () => [{
+			kind: "fields",
+			rail: true,
+			rows: [
+				{
+					label: "migrations",
+					value: inputs.migrationsRelative
+				},
+				...inputs.target === void 0 ? [] : [{
+					label: "target",
+					value: inputs.target
+				}],
+				...inputs.space === void 0 ? [] : [{
+					label: "space",
+					value: inputs.space
+				}]
+			]
+		}, {
+			kind: "summary",
+			status: inputs.document.ok ? "ok" : "error",
+			text: summary
+		}],
+		json: () => inputs.document
+	};
+}
+const migrationCheckCommand = defineOrmCommand({
+	help: {
+		summary: "Verify artifact and graph integrity",
+		description: "Validates that on-disk migration packages are internally consistent\n(hashes match, manifests are complete) and that the graph is well-formed\n(edges connect, refs point at valid nodes). The whole-graph check spans\nevery contract space by default; pass --space <id> to narrow to one. A\nmigration reference checks a single package, resolved across all contract\nspaces (narrow with --space; an ambiguous reference cannot be checked).\nOffline — does not consult the database.\nExit codes: 0 = all checks passed, 2 = precondition failed (unresolved\ntarget or unknown --space), 4 = integrity failure(s) found.",
+		examples: [
+			"migration check",
+			"migration check --space app",
+			"migration check 20260101-add-users",
+			"migration check 20260101-add-users --space app",
+			"migration check --json"
+		]
+	},
+	args: {
+		positionals: { target: positional.optionalString({
+			brief: "Migration reference: directory name, hash/prefix, ref, or path",
+			placeholder: "target"
+		}) },
+		flags: { space: flag.string({
+			brief: "Narrow output to a single contract space",
+			placeholder: "id"
+		}) }
+	},
+	needs: { config: ormConfigSection },
+	exitCodes: { 4: "integrity check found failures" },
+	handler: async (args, ctx) => {
+		const { target } = args.positionals;
+		const spaceFilter = args.flags.space;
+		const migrationsDir = migrationsDirFor(ctx.config, ctx.cwd);
+		const appMigrationsDir = appMigrationsDirFor(ctx.config, ctx.cwd);
+		const appMigrationsRelative = displayPath(appMigrationsDir, ctx.cwd);
+		const loaded = await buildReadAggregate(ctx.config, { migrationsDir });
+		if (!loaded.ok) return notOk(normalizeError(loaded.failure));
+		const spaces = await enumerateCheckSpaces(loaded.value.aggregate, migrationsDir, ctx.cwd);
+		let document;
+		let resolvedSpaceId;
+		if (target !== void 0) {
+			const outcome = await checkSingleTarget(target, {
+				spaces,
+				...ifDefined("spaceFilter", spaceFilter),
+				appMigrationsDir,
+				appMigrationsRelative,
+				cwd: ctx.cwd
+			});
+			if (outcome.error !== void 0) return notOk(normalizeError(outcome.error));
+			const result = outcome.result;
+			if (result === void 0 || outcome.exitCode === 2) return notOk(normalizeError(errorMigrationPackageNotFound(result?.summary ?? `Migration package for "${target}" not found on disk`)));
+			document = result;
+			resolvedSpaceId = outcome.resolvedSpaceId;
+		} else {
+			const checked = await runMigrationCheck({
+				spaces,
+				...ifDefined("spaceFilter", spaceFilter)
+			});
+			if (!checked.ok) return notOk(normalizeError(checked.failure));
+			const violations = await loadAggregateIntegrityViolations(ctx.config, migrationsDir);
+			const scoped = spaceFilter === void 0 ? violations : violations.filter((violation) => violation.kind !== "disjointness" && violation.spaceId === spaceFilter);
+			const failures = [...checked.value.failures, ...scoped.map((violation) => integrityViolationToCheckFailure(violation, migrationsDir))];
+			document = failures.length === 0 ? {
+				ok: true,
+				failures: [],
+				summary: "All checks passed"
+			} : {
+				ok: false,
+				failures: [...failures],
+				summary: `${failures.length} integrity failure(s)`
+			};
+		}
+		const diagnostics = document.failures.map(failureDiagnostic);
+		return ok(ctx.present({
+			data: document,
+			exitCode: diagnostics.length === 0 ? 0 : FINDINGS_EXIT_CODE,
+			diagnostics
+		}, checkPresentations({
+			document,
+			migrationsRelative: appMigrationsRelative,
+			target,
+			space: spaceFilter,
+			resolvedSpaceId
+		})));
+	}
+});
+/**
 * The tree is a drawing for a reader; the DOT document is a graph description
 * for another program, so it is the one thing here that belongs on stdout.
 */
@@ -2020,85 +3971,392 @@ function ledgerGrid(entries, options) {
 		})
 	};
 }
-function logPresentations(inputs) {
-	const grid = inputs.grid;
+function logPresentations(inputs) {
+	const grid = inputs.grid;
+	return {
+		human: () => [...inputs.database === void 0 ? [] : [{
+			kind: "fields",
+			rail: true,
+			rows: [{
+				label: "database",
+				value: inputs.database
+			}]
+		}], ...grid === void 0 ? [{
+			kind: "summary",
+			status: "info",
+			text: MIGRATION_LOG_EMPTY_MESSAGE
+		}] : [{
+			kind: "table",
+			columns: grid.headings,
+			rows: grid.rows
+		}]],
+		json: () => inputs.document
+	};
+}
+const migrationLogCommand = defineOrmCommand({
+	help: {
+		summary: "Show executed migration history",
+		description: "Reads the database ledger and displays every applied migration edge in\nchronological order, including rollbacks and re-applies, merged across\nall contract spaces. Requires a database connection.",
+		examples: [
+			"migration log",
+			"migration log --db $DATABASE_URL",
+			"migration log --utc",
+			"migration log --json"
+		]
+	},
+	args: { flags: {
+		db: dbFlag,
+		utc: flag.boolean({ brief: "Render human timestamps in UTC instead of local time" }),
+		ascii: flag.boolean({ brief: "Use ASCII glyphs (pipe-friendly)" })
+	} },
+	needs: { config: ormConfigSection },
+	handler: async (args, ctx) => {
+		const dbConnection = args.flags.db ?? ctx.config.db?.connection;
+		const missingDb = requireLiveDatabase({
+			dbConnection,
+			hasDriver: ctx.config.driver !== void 0,
+			why: "migration log needs a database connection and driver to read the ledger (set db.connection in prisma-next.config.ts, or pass --db <url>)",
+			commandName: "migration log"
+		});
+		if (missingDb !== null) return notOk(normalizeError(missingDb));
+		if (!targetSupportsMigrations(ctx.config.target)) return notOk(normalizeError(errorTargetMigrationNotSupported({ why: "migration log reads the ledger a migration runner writes, and the configured target provides no runner." })));
+		const client = createControlClient({
+			family: ctx.config.family,
+			target: ctx.config.target,
+			adapter: ctx.config.adapter,
+			...ifDefined("driver", ctx.config.driver),
+			extensions: ctx.config.extensions ?? []
+		});
+		let entries;
+		try {
+			await client.connect(dbConnection);
+			entries = await client.readLedger();
+		} catch (error) {
+			return notOk(normalizeError(mapCaughtMigrationError(error) ?? errorUnexpected(error instanceof Error ? error.message : String(error), { why: `Failed to read migration log: ${error instanceof Error ? error.message : String(error)}` })));
+		} finally {
+			await closeQuietly(client);
+		}
+		const records = serializeLedgerEntriesForJson(entries);
+		const document = {
+			ok: true,
+			records,
+			summary: `${records.length} migration(s) applied`
+		};
+		const glyphMode = args.flags.ascii ? "ascii" : "unicode";
+		return ok(ctx.present({ data: document }, logPresentations({
+			document,
+			grid: entries.length === 0 ? void 0 : ledgerGrid(entries, {
+				utc: args.flags.utc,
+				glyphMode
+			}),
+			database: typeof dbConnection === "string" ? maskConnectionUrl(dbConnection) : void 0
+		})));
+	}
+});
+function newPresentations(inputs) {
+	const { document } = inputs;
+	const migrationTs = join(document.dir, "migration.ts");
+	return {
+		human: () => [
+			{
+				kind: "fields",
+				rail: true,
+				rows: [{
+					label: "contract",
+					value: inputs.contractPath
+				}, {
+					label: "migrations",
+					value: inputs.appMigrationsRelative
+				}]
+			},
+			{
+				kind: "summary",
+				status: "ok",
+				text: document.summary
+			},
+			{
+				kind: "fields",
+				rows: [{
+					label: "from",
+					value: document.from === null ? [{
+						text: "(baseline)",
+						tone: "muted"
+					}] : [{
+						text: document.from,
+						tone: "identifier"
+					}]
+				}, {
+					label: "to",
+					value: [{
+						text: document.to,
+						tone: "identifier"
+					}]
+				}]
+			}
+		],
+		json: () => document,
+		next: () => [{
+			kind: "edit-file",
+			label: `Write the migration body in ${migrationTs}`
+		}, runCommandAction("Run it to self-emit ops.json and attest the package", `node "${migrationTs}"`)]
+	};
+}
+const migrationNewCommand = defineOrmCommand({
+	help: {
+		summary: "Scaffold a new migration for manual authoring",
+		description: "Creates a migration package with a migration.ts file for manual authoring.\nWrite the migration body in migration.ts, then run the file with Node\n(`node migration.ts`) to self-emit ops.json and attest the package.\nOffline — does not consult the database.",
+		examples: [
+			"migration new --name split-name",
+			"migration new --name custom-fk --from abc123",
+			"migration new --json"
+		]
+	},
+	args: { flags: {
+		name: flag.string({
+			brief: "Migration name (used in directory name)",
+			placeholder: "slug"
+		}),
+		from: flag.string({
+			brief: "Starting contract hash (default: latest migration target)",
+			placeholder: "hash"
+		})
+	} },
+	needs: { config: ormConfigSection },
+	handler: async (args, ctx) => {
+		const scaffolded = await executeMigrationNewCommand({
+			config: ctx.config,
+			cwd: ctx.cwd,
+			configPath: projectConfigPathFor(ctx.cwd),
+			...ifDefined("name", args.flags.name),
+			...ifDefined("from", args.flags.from)
+		});
+		if (!scaffolded.ok) return notOk(normalizeError(scaffolded.failure));
+		const contractPath = contractPathFor(ctx.config, ctx.cwd);
+		return ok(ctx.present({ data: scaffolded.value }, newPresentations({
+			document: scaffolded.value,
+			contractPath: contractPath === void 0 ? "(unset)" : displayPath(contractPath, ctx.cwd),
+			appMigrationsRelative: displayPath(appMigrationsDirFor(ctx.config, ctx.cwd), ctx.cwd)
+		})));
+	}
+});
+function hashRow(label, hash) {
+	return {
+		label,
+		value: hash === null ? [{
+			text: "(baseline)",
+			tone: "muted"
+		}] : [{
+			text: hash,
+			tone: "identifier"
+		}]
+	};
+}
+/**
+* Where the run put things: the contract edge it planned, then every directory
+* it wrote — the app-space package, the auto-baseline package that precedes it,
+* and any extension-space package the seed phase materialised.
+*/
+function outcomeFields(result, migrationsRelative) {
+	return {
+		kind: "fields",
+		rows: [
+			hashRow("from", result.from),
+			hashRow("to", result.to),
+			...result.baselineDir === void 0 ? [] : [{
+				label: "baseline",
+				value: result.baselineDir
+			}],
+			...result.dir === void 0 ? [] : [{
+				label: "app space",
+				value: result.dir
+			}],
+			...result.emittedExtensionDirs.map((entry) => ({
+				label: `space ${entry.spaceId}`,
+				value: join(migrationsRelative, entry.spaceId, entry.dirName)
+			}))
+		]
+	};
+}
+function operationNodes$1(result) {
+	return result.operations.map((operation) => operation.operationClass === "destructive" ? {
+		label: operation.label,
+		status: "warn"
+	} : { label: operation.label });
+}
+function operationBlocks$1(result) {
+	if (result.operations.length === 0) return [];
+	const destructive = result.operations.some((operation) => operation.operationClass === "destructive");
+	return [{
+		kind: "tree",
+		roots: [{
+			label: result.dir ?? "operations",
+			children: operationNodes$1(result)
+		}]
+	}, ...destructive ? [{
+		kind: "summary",
+		status: "warn",
+		text: "This migration contains destructive operations that may cause data loss."
+	}] : []];
+}
+/** Statements a database would run, printed verbatim rather than laid out. */
+function previewBlocks$1(result) {
+	const preview = result.preview;
+	if (preview === void 0) return [];
+	const statements = preview.statements.map((statement) => statement.text.trim()).filter((text) => text.length > 0).map((text) => text.endsWith(";") ? text : `${text};`);
+	if (statements.length === 0) return [];
+	return [{
+		kind: "summary",
+		status: "info",
+		tone: "muted",
+		text: previewBlockHeader(preview)
+	}, {
+		kind: "drawing",
+		lines: statements
+	}];
+}
+function planBlocks(result, migrationsRelative) {
+	const outcome = outcomeFields(result, migrationsRelative);
+	if (result.noOp) return [{
+		kind: "summary",
+		status: "ok",
+		text: "No changes detected"
+	}, outcome];
+	if (result.pendingPlaceholders === true) return [{
+		kind: "summary",
+		status: "warn",
+		text: result.summary
+	}, outcome];
+	return [
+		{
+			kind: "summary",
+			status: "ok",
+			text: result.summary
+		},
+		...operationBlocks$1(result),
+		outcome,
+		...previewBlocks$1(result)
+	];
+}
+function planNextActions(result, migrationsRelative) {
+	if (result.pendingPlaceholders === true) {
+		const migrationTs = join(result.dir ?? "<dir>", "migration.ts");
+		return [{
+			kind: "edit-file",
+			label: `Replace each placeholder(...) call in ${migrationTs} with your query`
+		}, runCommandAction("Run it to self-emit ops.json and attest the package", `node "${migrationTs}"`)];
+	}
+	const written = [
+		...result.baselineDir === void 0 ? [] : [result.baselineDir],
+		...result.dir === void 0 ? [] : [result.dir],
+		...result.emittedExtensionDirs.map((entry) => join(migrationsRelative, entry.spaceId, entry.dirName))
+	];
+	if (written.length === 0) return [];
+	return [{
+		kind: "edit-file",
+		label: `Review ${written.join(" and ")}`
+	}, runCommandAction("Apply the migration", "prisma-next migrate")];
+}
+function planPresentations(inputs) {
 	return {
-		human: () => [...inputs.database === void 0 ? [] : [{
+		human: () => [{
 			kind: "fields",
 			rail: true,
-			rows: [{
-				label: "database",
-				value: inputs.database
-			}]
-		}], ...grid === void 0 ? [{
-			kind: "summary",
-			status: "info",
-			text: MIGRATION_LOG_EMPTY_MESSAGE
-		}] : [{
-			kind: "table",
-			columns: grid.headings,
-			rows: grid.rows
-		}]],
-		json: () => inputs.document
+			rows: [
+				{
+					label: "contract",
+					value: inputs.contractPath
+				},
+				{
+					label: "migrations",
+					value: inputs.appMigrationsRelative
+				},
+				...inputs.from === void 0 ? [] : [{
+					label: "from",
+					value: inputs.from
+				}],
+				...inputs.to === void 0 ? [] : [{
+					label: "to",
+					value: inputs.to
+				}],
+				...inputs.name === void 0 ? [] : [{
+					label: "name",
+					value: inputs.name
+				}]
+			]
+		}, ...planBlocks(inputs.document, inputs.migrationsRelative)],
+		json: () => inputs.document,
+		next: () => planNextActions(inputs.document, inputs.migrationsRelative)
 	};
 }
-const migrationLogCommand = defineOrmCommand({
+const migrationPlanCommand = defineOrmCommand({
 	help: {
-		summary: "Show executed migration history",
-		description: "Reads the database ledger and displays every applied migration edge in\nchronological order, including rollbacks and re-applies, merged across\nall contract spaces. Requires a database connection.",
+		summary: "Plan a migration from contract changes",
+		description: "Compares the emitted contract against the latest on-disk migration state\nand produces a new migration package with the required operations.\nOffline — does not consult the database.",
 		examples: [
-			"migration log",
-			"migration log --db $DATABASE_URL",
-			"migration log --utc",
-			"migration log --json"
+			"migration plan",
+			"migration plan --name add-users-table",
+			"migration plan --to <migration-dir>^ --name rollback",
+			"migration plan --json"
 		]
 	},
 	args: { flags: {
-		db: dbFlag,
-		utc: flag.boolean({ brief: "Render human timestamps in UTC instead of local time" }),
-		ascii: flag.boolean({ brief: "Use ASCII glyphs (pipe-friendly)" })
+		name: flag.string({
+			brief: "Name slug for the migration directory",
+			placeholder: "slug"
+		}),
+		from: flag.string({
+			brief: "Starting contract reference (hash, prefix, ref name, migration dir name, <dir>^, or ./path)",
+			placeholder: "contract"
+		}),
+		to: flag.string({
+			brief: "Destination contract reference; defaults to the emitted contract. Same grammar as --from",
+			placeholder: "contract"
+		})
 	} },
 	needs: { config: ormConfigSection },
 	handler: async (args, ctx) => {
-		const dbConnection = args.flags.db ?? ctx.config.db?.connection;
-		const missingDb = requireLiveDatabase({
-			dbConnection,
-			hasDriver: ctx.config.driver !== void 0,
-			why: "migration log needs a database connection and driver to read the ledger (set db.connection in prisma-next.config.ts, or pass --db <url>)",
-			commandName: "migration log"
-		});
-		if (missingDb !== null) return notOk(normalizeError(missingDb));
-		if (!targetSupportsMigrations(ctx.config.target)) return notOk(normalizeError(errorTargetMigrationNotSupported({ why: "migration log reads the ledger a migration runner writes, and the configured target provides no runner." })));
-		const client = createControlClient({
-			family: ctx.config.family,
-			target: ctx.config.target,
-			adapter: ctx.config.adapter,
-			...ifDefined("driver", ctx.config.driver),
-			extensions: ctx.config.extensions ?? []
-		});
-		let entries;
-		try {
-			await client.connect(dbConnection);
-			entries = await client.readLedger();
-		} catch (error) {
-			return notOk(normalizeError(mapCaughtMigrationError(error) ?? errorUnexpected(error instanceof Error ? error.message : String(error), { why: `Failed to read migration log: ${error instanceof Error ? error.message : String(error)}` })));
-		} finally {
-			await closeQuietly(client);
-		}
-		const records = serializeLedgerEntriesForJson(entries);
-		const document = {
-			ok: true,
-			records,
-			summary: `${records.length} migration(s) applied`
+		const seeded = (record) => {
+			if (record.action !== "updated") return;
+			const step = `Seed contract space ${record.spaceId}`;
+			ctx.report({
+				kind: "step-started",
+				step,
+				id: record.spaceId
+			});
+			ctx.report({
+				kind: "step-finished",
+				step,
+				id: record.spaceId,
+				outcome: "ok",
+				data: {
+					newHash: record.newHash,
+					newMigrationDirs: record.newMigrationDirs
+				}
+			});
 		};
-		const glyphMode = args.flags.ascii ? "ascii" : "unicode";
-		return ok(ctx.present({ data: document }, logPresentations({
-			document,
-			grid: entries.length === 0 ? void 0 : ledgerGrid(entries, {
-				utc: args.flags.utc,
-				glyphMode
-			}),
-			database: typeof dbConnection === "string" ? maskConnectionUrl(dbConnection) : void 0
+		const planned = await executeMigrationPlanCommand({
+			config: ctx.config,
+			cwd: ctx.cwd,
+			configPath: projectConfigPathFor(ctx.cwd),
+			...ifDefined("name", args.flags.name),
+			...ifDefined("from", args.flags.from),
+			...ifDefined("to", args.flags.to)
+		}, Date.now(), { onSeeded: seeded });
+		if (!planned.ok) return notOk(normalizeError(planned.failure));
+		ctx.report({
+			kind: "message",
+			severity: "verbose",
+			text: `Total time: ${planned.value.timings.total}ms`
+		});
+		const contractPath = contractPathFor(ctx.config, ctx.cwd);
+		return ok(ctx.present({ data: planned.value }, planPresentations({
+			document: planned.value,
+			contractPath: contractPath === void 0 ? "(unset)" : displayPath(contractPath, ctx.cwd),
+			appMigrationsRelative: displayPath(appMigrationsDirFor(ctx.config, ctx.cwd), ctx.cwd),
+			migrationsRelative: displayPath(migrationsDirFor(ctx.config, ctx.cwd), ctx.cwd),
+			from: args.flags.from,
+			to: args.flags.to,
+			name: args.flags.name
 		})));
 	}
 });
@@ -2336,6 +4594,426 @@ const migrationShowCommand = defineOrmCommand({
 		})));
 	}
 });
+const EMIT_CONTRACT = runCommandAction("Regenerate the contract", "prisma-next contract emit");
+function contractUnreadableFinding(reason) {
+	const message = `Could not read contract: ${reason}`;
+	return {
+		document: {
+			code: "CONTRACT.UNREADABLE",
+			severity: "warn",
+			message,
+			hints: ["Run 'prisma-next contract emit' to generate a valid contract"]
+		},
+		diagnostic: {
+			code: "CONTRACT.UNREADABLE",
+			severity: "warn",
+			summary: message,
+			why: "The status tree falls back to the on-disk migration graph when the emitted contract cannot be read.",
+			nextActions: [EMIT_CONTRACT]
+		}
+	};
+}
+function markerNotInHistoryFinding(space) {
+	const message = `Database was updated outside the migration system (marker for space "${space}" does not match any migration)`;
+	return {
+		document: {
+			code: "MIGRATION.MARKER_NOT_IN_HISTORY",
+			severity: "warn",
+			message,
+			hints: ["Run 'prisma-next db sign' to overwrite the marker if the database already matches the contract", "Run 'prisma-next db update' to push the current contract to the database"]
+		},
+		diagnostic: {
+			code: "MIGRATION.MARKER_NOT_IN_HISTORY",
+			severity: "warn",
+			summary: message,
+			why: "The marker the database carries names no contract in the on-disk migration graph.",
+			meta: { space },
+			nextActions: [runCommandAction("Overwrite the marker if the database already matches the contract", "prisma-next db sign"), runCommandAction("Or push the current contract to the database", "prisma-next db update")]
+		}
+	};
+}
+function missingInvariantsFinding(inputs) {
+	const message = `missing invariant(s): ${inputs.missing.join(", ")}`;
+	return {
+		document: {
+			code: "MIGRATION.MISSING_INVARIANTS",
+			severity: "warn",
+			...ifDefined("ref", inputs.refName),
+			invariants: [...inputs.missing],
+			message
+		},
+		diagnostic: {
+			code: "MIGRATION.MISSING_INVARIANTS",
+			severity: "warn",
+			summary: message,
+			why: inputs.refName === void 0 ? "The database marker does not carry every invariant the target requires." : `The database marker does not carry every invariant \`${inputs.refName}\` requires.`,
+			nextActions: [runCommandAction("Apply the migrations that provide them", "prisma-next migrate")],
+			meta: {
+				invariants: [...inputs.missing],
+				...ifDefined("ref", inputs.refName)
+			}
+		}
+	};
+}
+const SHORT_HASH_LENGTH = 12;
+function shortDisplayHash(hash) {
+	return hash.slice(0, SHORT_HASH_LENGTH);
+}
+const NO_DATABASE_STATE = {
+	markersBySpace: /* @__PURE__ */ new Map(),
+	ledgersBySpace: /* @__PURE__ */ new Map()
+};
+async function readDatabaseState(inputs) {
+	const { client } = inputs;
+	try {
+		await client.connect(inputs.connection);
+		const markersBySpace = new Map(await client.readAllMarkers());
+		const ledgersBySpace = /* @__PURE__ */ new Map();
+		for (const spaceId of inputs.spaceIds) ledgersBySpace.set(spaceId, await client.readLedger(spaceId));
+		return ok({
+			markersBySpace,
+			ledgersBySpace
+		});
+	} catch (error) {
+		return notOk(normalizeError(CliStructuredError$1.is(error) ? error : errorUnexpected(error instanceof Error ? error.message : String(error), { why: `Failed to read database state: ${error instanceof Error ? error.message : String(error)}` })));
+	} finally {
+		await closeQuietly(client);
+	}
+}
+function buildNoPathSummary(args) {
+	const markerPart = args.markerHash !== void 0 ? `the database state (${shortDisplayHash(args.markerHash)})` : "the database state";
+	const targetShort = shortDisplayHash(args.targetHash);
+	if (!args.explicitTarget) return `No migration path from ${markerPart} to the application's contract (${targetShort}). Run \`prisma-next migration plan --name <name>\` to author one.`;
+	return `No migration path from ${markerPart} to ${args.refName !== void 0 ? `the target (${targetShort} via \`${args.refName}\`)` : `the target (${targetShort})`}. Run \`prisma-next migration plan --name <name>\` to author one, or pass \`--to <contract>\` to pick a reachable target.`;
+}
+function buildStatusHeadline(args) {
+	if (args.markerDiverged && args.markerHash !== void 0) return `Database marker ${shortDisplayHash(args.markerHash)} is not in the on-disk migration graph`;
+	if (args.pendingCount === 0) return "Up to date";
+	return `${args.pendingCount} pending — run \`prisma-next migrate --to ${shortDisplayHash(args.targetHash)}\``;
+}
+/**
+* One space's section: its heading, where more than one space is in scope, on
+* top of its tree. Heading and tree are one drawing so the heading stays a
+* bare label — a `summary` would put a status glyph in front of it.
+*/
+function sectionBlock(section) {
+	const heading = section.showHeading ? [[{
+		text: `${section.space}:`,
+		tone: "heading"
+	}]] : [];
+	const body = section.tree.length === 0 ? [[{
+		text: "(no migrations)",
+		tone: "muted"
+	}]] : toneDrawing(section.tree);
+	return {
+		kind: "drawing",
+		lines: [...heading, ...body]
+	};
+}
+function statusPresentations(inputs) {
+	const legend = inputs.legend;
+	return {
+		human: () => [
+			{
+				kind: "fields",
+				rail: true,
+				rows: [
+					{
+						label: "migrations",
+						value: inputs.migrationsDir
+					},
+					...inputs.database === void 0 ? [] : [{
+						label: "database",
+						value: inputs.database
+					}],
+					...inputs.ref === void 0 ? [] : [{
+						label: "ref",
+						value: inputs.ref
+					}],
+					...inputs.from === void 0 ? [] : [{
+						label: "from",
+						value: inputs.from
+					}],
+					...inputs.space === void 0 ? [] : [{
+						label: "space",
+						value: inputs.space
+					}]
+				]
+			},
+			...legend === void 0 ? [] : [{
+				kind: "drawing",
+				lines: toneDrawing(legend)
+			}],
+			...inputs.sections.map(sectionBlock),
+			inputs.headline
+		],
+		json: () => inputs.document
+	};
+}
+const migrationStatusCommand = defineOrmCommand({
+	help: {
+		summary: "Show migration path and pending status",
+		description: "Shows which migrations are pending between the database marker and the\ntarget contract. Requires a database connection. Pass --from for an\noffline path preview without a database. Use `migration graph` for\ntopology, `migration log` for history, and `migration list` for on-disk\nenumeration.",
+		examples: [
+			"migration status",
+			"migration status --db $DATABASE_URL",
+			"migration status --to production",
+			"migration status --from abc123 --to production",
+			"migration status --ascii",
+			"migration status --legend"
+		]
+	},
+	args: { flags: {
+		db: dbFlag,
+		space: flag.string({
+			brief: "Narrow output to a single contract space",
+			placeholder: "id"
+		}),
+		to: flag.string({
+			brief: "Target contract reference (hash, prefix, ref name, migration dir name, <dir>^, or ./path)",
+			placeholder: "contract"
+		}),
+		from: flag.string({
+			brief: "Origin contract reference; same grammar as --to. Supplying it switches to offline path computation",
+			placeholder: "contract"
+		}),
+		legend: flag.boolean({ brief: "Print a key for the tree glyphs and lane colors" }),
+		ascii: flag.boolean({ brief: "Use ASCII glyphs (pipe-friendly)" })
+	} },
+	needs: { config: ormConfigSection },
+	handler: async (args, ctx) => {
+		const migrationsDir = migrationsDirFor(ctx.config, ctx.cwd);
+		const dbConnection = args.flags.db ?? ctx.config.db?.connection;
+		const hasDriver = ctx.config.driver !== void 0;
+		const usingFromOverride = args.flags.from !== void 0;
+		if (!usingFromOverride) {
+			const missingDb = requireLiveDatabase({
+				dbConnection,
+				hasDriver,
+				why: "migration status needs a database connection to read the marker and ledger (or pass --from for an offline path preview)",
+				retryCommand: "prisma-next migration status --from <contract>"
+			});
+			if (missingDb !== null) return notOk(normalizeError(missingDb));
+		}
+		const refsResult = await readMigrationRefs(appRefsDirFor(ctx.config, ctx.cwd));
+		if (!refsResult.ok) return notOk(normalizeError(refsResult.failure));
+		const refs = refsResult.value;
+		const findings = [];
+		const loaded = await buildReadAggregate(ctx.config, { migrationsDir });
+		if (!loaded.ok) return notOk(normalizeError(loaded.failure));
+		const { aggregate, contractHash } = loaded.value;
+		const contractConfig = { contract: ifDefined("output", contractPathFor(ctx.config, ctx.cwd)) };
+		try {
+			await readContractEnvelope(contractConfig);
+		} catch (error) {
+			findings.push(contractUnreadableFinding(error instanceof Error ? error.message : "unknown error"));
+		}
+		if (await loadContractRawSafely(contractConfig) !== null) {
+			const corruption = refusePackageCorruptionOnAggregate(aggregate);
+			if (corruption) return notOk(normalizeError(corruption));
+		}
+		const appGraph = aggregate.app.graph();
+		let activeRefHash;
+		let activeRefName;
+		let activeRefEntry;
+		if (args.flags.to !== void 0) {
+			const resolved = resolveContractRef(args.flags.to, {
+				graph: appGraph,
+				refs
+			});
+			if (!resolved.ok) return notOk(normalizeError(resolved.failure));
+			activeRefHash = resolved.value.hash;
+			if (resolved.value.provenance.kind === "ref") {
+				activeRefName = resolved.value.provenance.refName;
+				activeRefEntry = refs[activeRefName];
+			}
+		}
+		let fromOverrideHash;
+		if (args.flags.from !== void 0) {
+			const resolved = resolveContractRef(args.flags.from, {
+				graph: appGraph,
+				refs
+			});
+			if (!resolved.ok) return notOk(normalizeError(resolved.failure));
+			fromOverrideHash = resolved.value.hash;
+		}
+		const listed = runMigrationList({
+			spaces: await migrationSpaceListEntriesFromAggregate(aggregate, migrationsDir),
+			...ifDefined("spaceFilter", args.flags.space)
+		});
+		if (!listed.ok) return notOk(normalizeError(listed.failure));
+		const scopedSpaces = listed.value.spaces;
+		const connects = dbConnection !== void 0 && hasDriver && !usingFromOverride;
+		let database = NO_DATABASE_STATE;
+		if (connects) {
+			const read = await readDatabaseState({
+				client: createControlClient({
+					family: ctx.config.family,
+					target: ctx.config.target,
+					adapter: ctx.config.adapter,
+					...ifDefined("driver", ctx.config.driver),
+					extensions: ctx.config.extensions ?? []
+				}),
+				connection: dbConnection,
+				spaceIds: scopedSpaces.map((entry) => entry.space)
+			});
+			if (!read.ok) return notOk(read.failure);
+			database = read.value;
+		}
+		const appMarker = database.markersBySpace.get(aggregate.app.spaceId);
+		if (activeRefEntry !== void 0 && activeRefEntry.invariants.length > 0 && connects) {
+			const unknown = refuseUnknownInvariants({
+				graph: appGraph,
+				markerInvariants: appMarker?.invariants ?? [],
+				refInvariants: activeRefEntry.invariants,
+				...ifDefined("refName", activeRefName)
+			});
+			if (unknown) return notOk(normalizeError(unknown));
+		}
+		const glyphMode = args.flags.ascii ? "ascii" : "unicode";
+		const styler = createToneMigrationListStyler();
+		const showSpaceHeadings = scopedSpaces.length > 1;
+		const statusSpaces = [];
+		const renderInputs = [];
+		const emptySpaces = [];
+		let divergedMarker;
+		let noPath;
+		let headlineTargetHash = activeRefHash ?? contractHash;
+		let totalPending = 0;
+		for (const entry of scopedSpaces) {
+			const space = aggregate.space(entry.space);
+			if (space === void 0) continue;
+			const graph = space.graph();
+			const spaceContractHash = space.contract().storage.storageHash;
+			const targetHash = activeRefHash ?? spaceContractHash;
+			if (entry.space === aggregate.app.spaceId) headlineTargetHash = targetHash;
+			const markerHash = usingFromOverride ? fromOverrideHash : database.markersBySpace.get(entry.space)?.storageHash;
+			const originHash = originHashForStatus(markerHash);
+			const markerInGraph = markerHash === void 0 || graph.nodes.has(markerHash) || markerHash === spaceContractHash;
+			if (connects && markerInGraph && originHash !== targetHash && noPath === void 0 && !hasMigrationPath(graph, originHash, targetHash)) noPath = {
+				markerHash,
+				targetHash
+			};
+			if (connects && markerHash !== void 0 && !markerInGraph) {
+				divergedMarker ??= {
+					space: entry.space,
+					markerHash
+				};
+				findings.push(markerNotInHistoryFinding(entry.space));
+			}
+			const ledger = database.ledgersBySpace.get(entry.space) ?? [];
+			const annotations = deriveStatusEdgeAnnotations({
+				graph,
+				targetHash,
+				originHash,
+				appliedMigrationHashes: connects ? appliedHashesFromLedger(ledger) : /* @__PURE__ */ new Set(),
+				showAppliedOverlay: connects
+			});
+			const migrations = entry.migrations.map((migration) => ({
+				...migration,
+				status: statusForMigrationHash(migration.hash, annotations)
+			}));
+			totalPending += migrations.filter((migration) => migration.status === "pending").length;
+			statusSpaces.push({
+				space: entry.space,
+				currentContract: markerHash ?? null,
+				targetContract: targetHash,
+				migrations
+			});
+			if (graph.nodes.size === 0) {
+				emptySpaces.push(entry.space);
+				continue;
+			}
+			renderInputs.push({
+				spaceId: entry.space,
+				graph,
+				migrations: entry.migrations,
+				liveContractHash: contractHash,
+				refsByHash: listRefsByContractHash(space),
+				statusOverlayByHash: annotations,
+				colorize: true,
+				glyphMode,
+				styler,
+				palette: TONE_MIGRATION_GRAPH_PALETTE,
+				isAppSpace: entry.space === aggregate.app.spaceId,
+				...connects && markerHash !== void 0 ? { dbHash: markerHash } : {}
+			});
+		}
+		const requiredInvariants = [...activeRefEntry?.invariants ?? []].sort();
+		if (connects && requiredInvariants.length > 0) {
+			const held = new Set(appMarker?.invariants ?? []);
+			const missing = requiredInvariants.filter((id) => !held.has(id));
+			if (missing.length > 0) {
+				findings.push(missingInvariantsFinding({
+					missing,
+					refName: activeRefName
+				}));
+				if (activeRefHash !== void 0) {
+					const unreachable = refuseMissingInvariantPath({
+						graph: appGraph,
+						originHash: originHashForStatus(appMarker?.storageHash),
+						targetHash: activeRefHash,
+						missing,
+						...ifDefined("refName", activeRefName)
+					});
+					if (unreachable) return notOk(normalizeError(unreachable));
+				}
+			}
+		}
+		const rendered = renderMigrationGraphSpaceTrees(renderInputs);
+		const treesBySpace = new Map(renderInputs.map((input, index) => [input.spaceId, rendered[index] ?? ""]));
+		const sections = scopedSpaces.map((entry) => {
+			const tree = treesBySpace.get(entry.space) ?? "";
+			return {
+				space: entry.space,
+				tree: showSpaceHeadings && tree.length > 0 ? indentMigrationGraphTreeBlock(tree, "  ") : tree,
+				showHeading: showSpaceHeadings
+			};
+		});
+		const summary = scopedSpaces.every((entry) => entry.migrations.length === 0) ? "No migrations found" : noPath !== void 0 ? buildNoPathSummary({
+			markerHash: noPath.markerHash,
+			targetHash: noPath.targetHash,
+			explicitTarget: args.flags.to !== void 0,
+			refName: activeRefName
+		}) : buildStatusHeadline({
+			pendingCount: totalPending,
+			targetHash: headlineTargetHash,
+			markerDiverged: divergedMarker !== void 0,
+			markerHash: divergedMarker?.markerHash
+		});
+		const diagnostics = findings.map((finding) => finding.diagnostic);
+		const document = {
+			ok: true,
+			spaces: statusSpaces,
+			summary,
+			diagnostics: findings.map((finding) => finding.document)
+		};
+		const alarming = divergedMarker !== void 0 || totalPending > 0 || noPath !== void 0;
+		return ok(ctx.present({
+			data: document,
+			diagnostics
+		}, statusPresentations({
+			document,
+			sections,
+			headline: {
+				kind: "summary",
+				status: alarming ? "warn" : "ok",
+				text: summary
+			},
+			migrationsDir: displayPath(migrationsDir, ctx.cwd),
+			database: connects && typeof dbConnection === "string" ? maskConnectionUrl(dbConnection) : void 0,
+			ref: activeRefName,
+			from: args.flags.from,
+			space: args.flags.space,
+			legend: args.flags.legend ? renderMigrationGraphLegend({
+				colorize: true,
+				glyphMode,
+				styler,
+				palette: TONE_MIGRATION_GRAPH_PALETTE
+			}) : void 0
+		})));
+	}
+});
 function deletePresentations(document) {
 	return {
 		human: () => [{
@@ -2507,27 +5185,62 @@ const ormCommandFamily = defineCommandFamily({
 		"contract infer": contractInferCommand,
 		"db init": dbInitCommand,
 		"db schema": dbSchemaCommand,
+		"db sign": dbSignCommand,
 		"db update": dbUpdateCommand,
+		"db verify": dbVerifyCommand,
 		format: formatCommand,
+		init: initCommand,
+		lsp: lspCommand,
 		migrate: migrateCommand,
+		"migration check": migrationCheckCommand,
 		"migration graph": migrationGraphCommand,
 		"migration list": migrationListCommand,
 		"migration log": migrationLogCommand,
+		"migration new": migrationNewCommand,
+		"migration plan": migrationPlanCommand,
 		"migration show": migrationShowCommand,
+		"migration status": migrationStatusCommand,
 		"ref delete": refDeleteCommand,
 		"ref list": refListCommand,
 		"ref set": refSetCommand
 	},
 	docsBaseUrl: DOCS_BASE_URL,
-	redirects: [{
-		from: "migration apply",
-		replacement: "{bin} migrate --to <contract>",
-		reason: "Applying a migration is a move to a target contract, not a verb of its own."
-	}, {
-		from: "migration ref",
-		replacement: "{bin} ref set|list|delete",
-		reason: "Refs are managed by their own command, for every space rather than migrations alone."
-	}]
+	redirects: [
+		{
+			from: "migration apply",
+			replacement: "{bin} migrate --to <contract>",
+			reason: "Applying a migration is a move to a target contract, not a verb of its own."
+		},
+		{
+			from: "migration ref",
+			replacement: "{bin} ref set|list|delete",
+			reason: "Refs are managed by their own command, for every space rather than migrations alone."
+		},
+		{
+			from: "migration status",
+			flag: "graph",
+			replacement: "{bin} migration graph",
+			reason: "Topology is its own command rather than a mode of the status report."
+		},
+		{
+			from: "migration status",
+			flag: "all",
+			replacement: "{bin} migration log --db <url>",
+			reason: "Execution history is read from the database ledger, which is what migration log does."
+		},
+		{
+			from: "migration status",
+			flag: "limit",
+			replacement: "{bin} migration log --db <url>",
+			reason: "Execution history is read from the database ledger, which is what migration log does."
+		},
+		{
+			from: "migration status",
+			flag: "ref",
+			replacement: "{bin} migration status --to <contract>",
+			reason: "One flag names the target contract, whether it is a ref, a hash or a migration."
+		}
+	]
 });
 /** The file the ORM's loader reads when `--config` names none. */
 const ORM_CONFIG_FILENAME = "prisma-next.config.ts";