@prisma/orm-toolchain 8.0.0-rc.1-dev.45 → 8.0.0-rc.1-dev.46

package/dist/redact-secrets-DuKoiMax-Cfe2XVhc.mjs

@@ -1,1476 +0,0 @@
-import { t as CliStructuredError$1 } from "./cli-errors-B4zTLaqQ-CXgjO9t4.mjs";
-import { a as schemaSample, l as targetPackageName, s as targetEntrypoint, u as version } from "./code-templates-C-jirr19-DDQB0WGo.mjs";
-import { createRequire } from "node:module";
-import { CliStructuredError } from "@prisma/orm-framework/errors/control";
-import { ifDefined } from "@prisma/orm-framework/utils/defined";
-import { dirname, extname, join, normalize } from "pathe";
-import { existsSync, readFileSync } from "node:fs";
-import { docsUrlFor } from "@prisma/orm-framework/utils/structured-error";
-import { keepInternalSpecifiers } from "@prisma/orm-framework/components/emission";
-import { blindCast } from "@prisma/orm-framework/utils/casts";
-import { InternalError } from "@prisma/orm-framework/utils/internal-error";
-import { detect, getUserAgent } from "package-manager-detector/detect";
-import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
-//#region ../../../1-framework/3-tooling/cli/dist/redact-secrets-DuKoiMax.mjs
-/**
-* Walks up from `baseDir` looking for `pnpm-workspace.yaml`, then scans
-* its top-level `catalog:` block for entries that match any of `packages`.
-*
-* Implements FR7.3 / Spec Decision 8 (honour-and-warn): when `init` runs
-* inside a pnpm workspace whose catalog overrides one of the packages it
-* installs, surface a structured warning so the user knows the catalog
-* version (not the published `latest`) is what ended up in their
-* `node_modules`. pnpm itself does this silently; the warning closes the
-* "looks fine, must be wrong version six months later" gap.
-*
-* Notes / scope:
-*
-* - We only inspect the unnamed top-level `catalog:` block. pnpm also
-*   supports `catalogs:` (plural — *named* catalogs referenced via
-*   `catalog:foo` specifiers); those don't apply to a vanilla
-*   `pnpm add prisma-next` invocation, so we skip them.
-* - We don't validate YAML syntax exhaustively. The file format pnpm
-*   ships is line-oriented and well-known; a minimal regex is more
-*   robust than depending on a YAML parser for one warning.
-* - We don't compare against the registry's `latest` — pnpm uses the
-*   catalog version regardless, so the warning fires whenever a match
-*   exists. The user-facing copy explains how to opt out.
-*/
-function detectPnpmCatalogOverrides(baseDir, packages) {
-	const workspaceFile = findNearestPnpmWorkspaceFile(baseDir);
-	if (workspaceFile === null) return null;
-	const catalog = extractCatalogBlock(readFileSync(workspaceFile, "utf-8"));
-	if (catalog === null) return {
-		workspaceFile,
-		entries: []
-	};
-	const wanted = new Set(packages);
-	const entries = [];
-	for (const [name, version] of catalog) if (wanted.has(name)) entries.push({
-		name,
-		version
-	});
-	return {
-		workspaceFile,
-		entries
-	};
-}
-function findNearestPnpmWorkspaceFile(baseDir) {
-	let dir = baseDir;
-	let prev = "";
-	while (dir !== prev) {
-		const candidate = join(dir, "pnpm-workspace.yaml");
-		if (existsSync(candidate)) return candidate;
-		prev = dir;
-		dir = dirname(dir);
-	}
-	return null;
-}
-/**
-* Returns the entries inside the top-level `catalog:` block as `[name, version]`
-* pairs in document order, or `null` when no `catalog:` block exists.
-*
-* The parser is intentionally minimal: it reads line-by-line, locates the
-* top-level `catalog:` line (no leading whitespace), then collects every
-* subsequent indented line of the form `<key>: <value>` until the next
-* top-level key (or end of file). Quotes around `<key>` and `<value>`
-* are stripped; comments (`#…`) are ignored.
-*/
-function extractCatalogBlock(contents) {
-	const lines = contents.split(/\r?\n/);
-	const startIdx = lines.findIndex((line) => /^catalog\s*:\s*$/.test(line));
-	if (startIdx === -1) return null;
-	const entries = [];
-	for (let i = startIdx + 1; i < lines.length; i++) {
-		const raw = lines[i] ?? "";
-		if (raw.trim() === "" || /^\s*#/.test(raw)) continue;
-		if (!/^\s/.test(raw)) break;
-		const match = raw.match(/^\s+(?:'([^']+)'|"([^"]+)"|([^:\s'"]+))\s*:\s*(.*?)\s*(?:#.*)?$/);
-		if (!match) continue;
-		const name = match[1] ?? match[2] ?? match[3];
-		if (name === void 0) continue;
-		const version = stripQuotes((match[4] ?? "").trim());
-		if (version === "") continue;
-		entries.push([name, version]);
-	}
-	return entries;
-}
-function stripQuotes(value) {
-	if (value.length >= 2) {
-		const first = value[0];
-		const last = value[value.length - 1];
-		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
-	}
-	return value;
-}
-function formatCatalogWarning(workspaceFile, entries) {
-	return [
-		"pnpm workspace catalog overrides detected — pnpm will install these versions instead of `latest`:",
-		entries.map((entry) => `  • ${entry.name}: ${entry.version}`).join("\n"),
-		`Catalog source: ${workspaceFile}`,
-		"To use the published `latest` instead, remove or update the catalog entry, then re-run `pnpm install`."
-	].join("\n");
-}
-/**
-* Honour-and-warn: when the surrounding pnpm workspace pins one of the
-* packages `init` installs through its catalog, say so — the catalog version,
-* not the published `latest`, is what ends up in the project. Empty when there
-* is no workspace above the project or its catalog names none of them.
-*/
-function buildCatalogWarnings(baseDir, packages) {
-	const result = detectPnpmCatalogOverrides(baseDir, packages);
-	if (result === null || result.entries.length === 0) return [];
-	return [formatCatalogWarning(result.workspaceFile, result.entries)];
-}
-/**
-* Re-init in non-interactive mode without `--force`. Distinct from the
-* decline-the-prompt path (which is `errorInitUserAborted`) because here
-* the user was never given the choice — `--force` is the contract.
-*/
-function errorInitReinitNeedsForce() {
-	return new CliStructuredError$1("CLI.INIT_REINIT_NEEDS_FORCE", "Project is already initialized", {
-		why: "A `prisma-next.config.ts` already exists in this directory. Re-running `init` would overwrite the scaffolded files; in non-interactive mode `init` will not do that without `--force`.",
-		fix: "Pass `--force` to overwrite the existing scaffold, or run `init` interactively to confirm.",
-		docsUrl: docsUrlFor("CLI.INIT_REINIT_NEEDS_FORCE")
-	});
-}
-/**
-* Non-interactive mode is missing one or more required inputs. Lists every
-* missing flag in the error so an agent / CI script can react without
-* needing to parse English.
-*
-* @param missing — kebab-case flag names without leading dashes
-* @param why — additional context (e.g. "stdin is not a TTY") that helps
-*              the user understand why interactive fallback was skipped.
-*/
-function errorInitMissingFlags(options) {
-	const flagList = options.missing.map((flag) => `--${flag}`).join(", ");
-	const fixList = options.missing.map((flag) => {
-		switch (flag) {
-			case "target": return "--target postgres|mongodb";
-			case "authoring": return "--authoring psl|typescript";
-			case "schema-path": return "--schema-path <path>";
-			default: return `--${flag} <value>`;
-		}
-	}).join(" ");
-	return new CliStructuredError$1("CLI.INIT_MISSING_FLAGS", "Missing required flags", {
-		why: `${options.why} Missing required flag(s): ${flagList}.`,
-		fix: `Re-run with the missing flag(s) supplied, e.g. \`prisma-next init --yes ${fixList}\`. Use \`prisma-next init --help\` to see every flag.`,
-		docsUrl: docsUrlFor("CLI.INIT_MISSING_FLAGS"),
-		meta: { missingFlags: options.missing }
-	});
-}
-/**
-* A flag value was supplied but is not in the allowed set. Lists the
-* allowed values in `meta` for machine-readable consumption.
-*/
-function errorInitInvalidFlagValue(options) {
-	return new CliStructuredError$1("CLI.INIT_INVALID_FLAG_VALUE", `Invalid value for --${options.flag}`, {
-		why: `\`--${options.flag} ${options.value}\` is not one of: ${options.allowed.join(", ")}.`,
-		fix: `Use one of: ${options.allowed.map((v) => `--${options.flag} ${v}`).join(", ")}.`,
-		docsUrl: docsUrlFor("CLI.INIT_INVALID_FLAG_VALUE"),
-		meta: {
-			flag: options.flag,
-			value: options.value,
-			allowed: options.allowed
-		}
-	});
-}
-/**
-* `--authoring` and `--schema-path` disagree on file extension (e.g. PSL
-* authoring with a `.ts` path). Surfaces before any scaffold files are
-* written so the project tree stays untouched.
-*/
-function errorInitAuthoringSchemaPathMismatch(options) {
-	const expectedAuthoring = options.expectedExtension === ".ts" ? "typescript" : "psl";
-	return new CliStructuredError$1("CLI.INIT_AUTHORING_SCHEMA_PATH_MISMATCH", "Authoring and schema path do not match", {
-		why: `\`--authoring ${options.authoring}\` requires a schema file ending in ${options.expectedExtension}, but \`--schema-path ${options.schemaPath}\` ends in ${options.actualExtension}.`,
-		fix: `Use a matching pair, for example \`--authoring ${expectedAuthoring} --schema-path <path>${options.expectedExtension}\`, or change \`--authoring\` to match the path you supplied. You can also omit \`--schema-path\` to use the default for the chosen authoring.`,
-		docsUrl: docsUrlFor("CLI.INIT_AUTHORING_SCHEMA_PATH_MISMATCH"),
-		meta: {
-			authoring: options.authoring,
-			schemaPath: options.schemaPath,
-			actualExtension: options.actualExtension,
-			expectedExtension: options.expectedExtension
-		}
-	});
-}
-/**
-* The user cancelled an interactive prompt (Ctrl-C, escape, declined a
-* selection). Distinct from `errorInitReinitNeedsForce` because that path
-* applies to non-interactive mode where the user was never given the
-* choice; this one is the generic "user said no" path. Maps to exit code
-* 3 (USER_ABORTED).
-*/
-function errorInitUserAborted() {
-	return new CliStructuredError$1("CLI.INIT_USER_ABORTED", "Init cancelled", {
-		why: "The interactive prompt was cancelled before all required inputs were supplied. No files were modified.",
-		fix: "Re-run `prisma-next init` and complete the prompts, or pass the required inputs as flags (see `--help`) for a non-interactive run.",
-		severity: "info"
-	});
-}
-/**
-* `--strict-probe` was supplied without `--probe-db`. Per FR8.3 / NFR9
-* (offline-by-default), `--strict-probe` is a no-op without `--probe-db` —
-* but rather than silently ignoring it we tell the user what they probably
-* meant. Without this guard, the flag combination silently does nothing,
-* which is exactly the kind of "looks like it worked" trap that a strict
-* mode is supposed to prevent.
-*/
-function errorInitStrictProbeWithoutProbe() {
-	return new CliStructuredError$1("CLI.INIT_STRICT_PROBE_WITHOUT_PROBE", "`--strict-probe` requires `--probe-db`", {
-		why: "`--strict-probe` only changes how a *failed* probe is reported; without `--probe-db` no probe is attempted in the first place. (`init` is offline-by-default — it never opens a connection to your database without explicit consent.)",
-		fix: "Add `--probe-db` to opt in to the probe, or drop `--strict-probe` if you do not need the version check.",
-		docsUrl: docsUrlFor("CLI.INIT_STRICT_PROBE_WITHOUT_PROBE")
-	});
-}
-/**
-* Dependency installation failed and the pnpm → npm fallback (FR7.2)
-* either did not apply (pm ≠ pnpm or stderr did not match a recognised
-* leak) or also failed. Files scaffolded before the install step are
-* already on disk; `meta.filesWritten` carries the list so a follow-up
-* agent can resume manually. Maps to exit code `4 = INSTALL_FAILED`.
-*/
-function errorInitInstallFailed(options) {
-	const trimmed = options.stderrLines.map((s) => s.trim()).filter(Boolean);
-	return new CliStructuredError$1("CLI.INIT_INSTALL_FAILED", "Failed to install dependencies", {
-		why: trimmed.length === 0 ? "The package manager exited with an error and no recoverable fallback applied." : `The package manager exited with: ${trimmed[0]}`,
-		fix: `Install manually:\n  ${options.addCommand}\n  ${options.addDevCommand}\nThen run \`${options.emitCommand}\` to emit the contract.`,
-		docsUrl: docsUrlFor("CLI.INIT_INSTALL_FAILED"),
-		meta: {
-			filesWritten: options.filesWritten,
-			stderr: trimmed
-		}
-	});
-}
-/**
-* The user's project manifest (typically `package.json`) failed to parse
-* as JSON. Init reads the manifest to merge `scripts` (FR3.5) and to
-* skip `@types/node` when it is already declared (FR2.1); a malformed
-* file would otherwise surface as an `INTERNAL_ERROR` with a raw
-* `SyntaxError` stack, which violates the FR1.6 contract that every
-* documented failure mode maps to a stable exit code.
-*
-* Maps to exit code `2 = PRECONDITION` — the user can fix the manifest
-* and re-run.
-*/
-function errorInitInvalidManifest(options) {
-	return new CliStructuredError$1("CLI.INIT_INVALID_MANIFEST", `Failed to parse ${options.path}`, {
-		why: `\`${options.path}\` is not valid JSON: ${options.cause}`,
-		fix: `Fix the JSON syntax in \`${options.path}\` (a missing comma or unbalanced brace is the most common cause), then re-run \`prisma-next init\`.`,
-		docsUrl: docsUrlFor("CLI.INIT_INVALID_MANIFEST"),
-		meta: {
-			path: options.path,
-			cause: options.cause
-		}
-	});
-}
-/**
-* The user's existing `tsconfig.json` could not be parsed even with JSONC
-* tolerance (comments + trailing commas) enabled. Init merges the
-* minimum compiler options the scaffolded files need (FR2.2), so an
-* unparseable tsconfig is a hard precondition failure: we cannot
-* faithfully edit a file we cannot read.
-*
-* Init must surface this **before** writing any scaffold file so the
-* user's working tree stays byte-identical (FR6.2 / NFR3) — see
-* `runInit` for the precondition gate.
-*
-* Maps to exit code `2 = PRECONDITION` — the user can fix the file and
-* re-run.
-*/
-function errorInitInvalidTsconfig(options) {
-	return new CliStructuredError$1("CLI.INIT_INVALID_TSCONFIG", `Failed to parse ${options.path}`, {
-		why: `\`${options.path}\` is not valid JSON or JSONC: ${options.cause}`,
-		fix: `Fix the syntax in \`${options.path}\` and re-run \`prisma-next init\`. \`init\` accepts JSONC (comments and trailing commas) but cannot recover from unbalanced braces or missing commas.`,
-		docsUrl: docsUrlFor("CLI.INIT_INVALID_TSCONFIG"),
-		meta: {
-			path: options.path,
-			cause: options.cause
-		}
-	});
-}
-/**
-* `--probe-db` was supplied along with `--strict-probe` and the probe
-* could not complete (no `DATABASE_URL`, network/auth error, the target
-* driver was not installed, …). Without `--strict-probe` the probe
-* surfaces these as warnings; `--strict-probe` escalates them to
-* fatal so a CI gate can rely on "init exit code 2 means something
-* about the runtime environment is wrong" (FR8.3).
-*
-* Maps to exit code `2 = PRECONDITION`. The caller's project files
-* are already on disk by this point — the probe runs after the write
-* phase — but the install/emit steps may or may not have completed
-* depending on `--no-install` and the exact failure mode; `meta`
-* carries `filesWritten` so a follow-up agent can resume manually.
-*/
-function errorInitProbeFailed(options) {
-	return new CliStructuredError$1("CLI.INIT_PROBE_FAILED", "Database probe failed", {
-		why: `\`--probe-db\` could not complete and \`--strict-probe\` was set: ${options.cause}`,
-		fix: "Confirm `DATABASE_URL` points at a reachable server, or drop `--strict-probe` to treat probe failures as warnings.",
-		docsUrl: docsUrlFor("CLI.INIT_PROBE_FAILED"),
-		meta: {
-			filesWritten: options.filesWritten,
-			cause: options.cause
-		}
-	});
-}
-/**
-* `prisma-next contract emit` failed after a successful install. Surface
-* the underlying error so the user can fix it and re-run; files and
-* dependencies remain on disk untouched. Maps to exit code
-* `5 = EMIT_FAILED`.
-*/
-function errorInitEmitFailed(options) {
-	return new CliStructuredError$1("CLI.INIT_EMIT_FAILED", "Failed to emit contract", {
-		why: `\`prisma-next contract emit\` failed: ${options.cause}`,
-		fix: `Inspect your contract file, fix the underlying issue, then re-run \`${options.emitCommand}\`. Pass \`-v\` for the full error envelope.`,
-		docsUrl: docsUrlFor("CLI.INIT_EMIT_FAILED"),
-		meta: {
-			filesWritten: options.filesWritten,
-			cause: options.cause
-		}
-	});
-}
-/**
-* A scaffold file could not be written after earlier writes had already
-* landed. The directory is half-scaffolded, so this carries the list of what
-* did get written, the way every other post-write failure in `init` does.
-*
-* Maps to exit code `2 = PRECONDITION`: what stopped the write is something
-* about the directory the user can fix.
-*/
-function errorInitWriteFailed(options) {
-	return new CliStructuredError$1("CLI.INIT_WRITE_FAILED", `Failed to write ${options.path}`, {
-		why: `\`${options.path}\` could not be written: ${options.cause}`,
-		fix: "Fix what stopped the write — a directory sitting where the file goes, permissions, a full disk — then run `prisma-next init` again. It will ask you to confirm replacing the files this run already wrote (listed in `meta.filesWritten`).",
-		docsUrl: docsUrlFor("CLI.INIT_WRITE_FAILED"),
-		meta: {
-			path: options.path,
-			cause: options.cause,
-			filesWritten: options.filesWritten
-		}
-	});
-}
-/**
-* The project-level skills install (`npx skills add
-* prisma/prisma#v<version>`) failed after a successful dependency
-* install + emit. The project's scaffold remains on disk; the user
-* can either fix the underlying issue (network, registry, PATH) and
-* run the install command manually, or re-run `init --no-skill` to
-* proceed without the skill.
-*
-* Non-rolling-back, matching the existing install/emit failure
-* semantics. Maps to exit code `6 = SKILL_INSTALL_FAILED`.
-*/
-function errorInitSkillInstallFailed(options) {
-	return new CliStructuredError$1("CLI.INIT_SKILL_INSTALL_FAILED", "Failed to install Prisma Next skills", {
-		why: `\`${options.skillInstallCommand}\` exited with an error: ${options.cause}`,
-		fix: `Either:
-  - Re-run \`prisma-next init --no-skill${options.filesWritten.length > 0 ? " --force" : ""}\` to skip the skill install for this run, or\n  - Fix the underlying issue (network, npm registry, \`npx skills\` on PATH) and install manually:\n      ${options.skillInstallCommand}`,
-		docsUrl: docsUrlFor("CLI.INIT_SKILL_INSTALL_FAILED"),
-		meta: {
-			filesWritten: options.filesWritten,
-			skillInstallCommand: options.skillInstallCommand,
-			cause: options.cause
-		}
-	});
-}
-/**
-* Connects (when configured) to the user's database and returns a
-* structured outcome describing whether the server meets the declared
-* minimum (FR8.1). Pure with respect to its inputs: no I/O happens
-* unless `databaseUrl` is set.
-*
-* The outcome is shaped so that `--strict-probe` can branch on the
-* `kind`/`meetsMinimum` pair without re-stringifying the message:
-*
-* - `ok` — informational; `init` continues.
-* - `below-minimum` — warning; `init` continues regardless of
-*   `--strict-probe` (the spec scopes strict-probe to "probe
-*   *failures*", and a successful probe that finds an old server is
-*   not a failure).
-* - `no-database-url` / `connection-failed` / `driver-missing` —
-*   warning by default, fatal under `--strict-probe`.
-*/
-async function probeServerVersion(ctx, overrides = {}) {
-	const { databaseUrl, minVersion, target } = ctx;
-	if (databaseUrl === void 0 || databaseUrl.trim().length === 0) return {
-		kind: "no-database-url",
-		minVersion,
-		meetsMinimum: null,
-		message: "Skipped --probe-db: DATABASE_URL is not set in the current shell environment. (init does not read .env for the probe; export the variable or drop --probe-db.)"
-	};
-	let driverResult;
-	try {
-		if (target === "postgres") driverResult = overrides.probePostgres !== void 0 ? await overrides.probePostgres(databaseUrl) : await defaultProbePostgres(databaseUrl, ctx.baseDir, overrides);
-		else driverResult = overrides.probeMongo !== void 0 ? await overrides.probeMongo(databaseUrl) : await defaultProbeMongo(databaseUrl, ctx.baseDir, overrides);
-	} catch (err) {
-		if (err instanceof DriverMissingError) return {
-			kind: "driver-missing",
-			minVersion,
-			meetsMinimum: null,
-			cause: err.message,
-			message: `Skipped --probe-db: ${err.message}. (Run with install enabled, or install the driver yourself, then re-run \`prisma-next init --probe-db\`.)`
-		};
-		const cause = redactDatabaseUrlSecrets(causeMessage(err));
-		return {
-			kind: "connection-failed",
-			minVersion,
-			meetsMinimum: null,
-			cause,
-			message: `--probe-db could not connect: ${cause}.`
-		};
-	}
-	if (compareVersionPrefix(driverResult.serverVersion, minVersion) < 0) return {
-		kind: "below-minimum",
-		serverVersion: driverResult.serverVersion,
-		minVersion,
-		meetsMinimum: false,
-		message: `--probe-db: server reports version ${driverResult.serverVersion}, below the declared minimum (${minVersion}). Some queries may fail until the server is upgraded.`
-	};
-	return {
-		kind: "ok",
-		serverVersion: driverResult.serverVersion,
-		minVersion,
-		meetsMinimum: true,
-		message: `--probe-db: server reports version ${driverResult.serverVersion} (>= ${minVersion}).`
-	};
-}
-/**
-* Compares two semver-prefix strings ("14", "14.2", "6.0", …) by
-* numeric components left-to-right. Returns a negative number when `a`
-* is older than `b`, zero when both versions agree on every numeric
-* component (treating missing trailing components as `0`), and a
-* positive number when `a` is newer.
-*
-* The loop runs over the **longer** of the two prefixes so that
-* `'14'` compares less than `'14.1'` — without that, the shorter
-* prefix would be silently accepted whenever the configured minimum
-* has a non-zero minor or patch.
-*
-* Exported for unit tests.
-*/
-function compareVersionPrefix(a, b) {
-	const aParts = parseNumericParts(a);
-	const bParts = parseNumericParts(b);
-	const len = Math.max(aParts.length, bParts.length);
-	for (let i = 0; i < len; i += 1) {
-		const aPart = aParts[i] ?? 0;
-		const bPart = bParts[i] ?? 0;
-		if (aPart !== bPart) return aPart - bPart;
-	}
-	return 0;
-}
-function parseNumericParts(version) {
-	const match = version.match(/^[^\d]*(\d+(?:\.\d+){0,3})/);
-	if (match === null) return [];
-	return (match[1] ?? "").split(".").map((part) => Number.parseInt(part, 10));
-}
-var DriverMissingError = class extends Error {};
-function causeMessage(err) {
-	if (err instanceof Error) return err.message;
-	return String(err);
-}
-/**
-* Strips `user:password@` userinfo from any URL-shaped substring before
-* we surface the cause to the user. Mirrors `redactSecrets` in
-* `init.ts` — the probe path has its own redactor because the inputs
-* here include the raw connection string by construction (driver
-* errors echo the URL back).
-*
-* Exported for unit tests.
-*/
-function redactDatabaseUrlSecrets(text) {
-	if (!text) return text;
-	return text.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@");
-}
-async function defaultProbePostgres(databaseUrl, baseDir, overrides) {
-	const client = new (requirePeer("pg", baseDir, overrides)).Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		const result = await client.query("SELECT version() as version");
-		return { serverVersion: parsePostgresVersion(String(result?.rows?.[0]?.version ?? "")) };
-	} finally {
-		await client.end().catch(() => void 0);
-	}
-}
-/**
-* Extracts the numeric prefix from a Postgres `version()` row, e.g.
-*
-*   `PostgreSQL 14.10 on x86_64-pc-linux-gnu, ...`  → `"14.10"`
-*   `PostgreSQL 16beta1 on …`                       → `"16"` (we
-*      conservatively drop the suffix; minimum-version comparisons
-*      treat 16beta1 as 16, which is what every reasonable user
-*      expects).
-*
-* Exported for unit tests.
-*/
-function parsePostgresVersion(versionString) {
-	const match = versionString.match(/PostgreSQL\s+(\d+(?:\.\d+)?)/i);
-	if (match === null || match[1] === void 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", `Could not parse PostgreSQL version from \`${versionString}\``);
-	return match[1];
-}
-async function defaultProbeMongo(databaseUrl, baseDir, overrides) {
-	const client = new (requirePeer("mongodb", baseDir, overrides)).MongoClient(databaseUrl);
-	await client.connect();
-	try {
-		const buildInfo = await client.db().admin().command({ buildInfo: 1 });
-		const versionString = String(buildInfo.version ?? "");
-		if (versionString.length === 0) throw new CliStructuredError("CLI.INIT_PROBE_FAILED", "buildInfo did not include a `version` field");
-		return { serverVersion: versionString };
-	} finally {
-		await client.close().catch(() => void 0);
-	}
-}
-/**
-* Loads a peer driver (`pg` / `mongodb`) from the user's project
-* `node_modules`. We deliberately resolve from `baseDir` rather than
-* from the CLI bundle — the CLI does not depend on `pg` or `mongodb`
-* directly, but the user's `init`-generated `package.json` does (via
-* the target facade). Failure to resolve is folded into a typed
-* `DriverMissingError` so `probeServerVersion` can map it to a
-* `driver-missing` outcome rather than letting a `MODULE_NOT_FOUND`
-* leak as a generic connection failure.
-*/
-function requirePeer(moduleId, baseDir, overrides) {
-	try {
-		if (overrides.requireFromBaseDir !== void 0) return overrides.requireFromBaseDir(baseDir, moduleId);
-		return createRequire(join(baseDir, "package.json"))(moduleId);
-	} catch (err) {
-		throw new DriverMissingError(`\`${moduleId}\` is not installed in this project (resolved from ${baseDir}; cause: ${causeMessage(err)})`);
-	}
-}
-/**
-* Default base for the GitHub-URL form `<owner>/<repo>` consumed by
-* upstream `skills add`. Each `SkillSource` joins this base with its
-* own subpath (and optional `#ref` for version-pinned clusters).
-*/
-const DEFAULT_SKILL_BASE = "prisma/prisma";
-const DEFAULT_SKILL_SOURCES = [
-	{
-		subpath: "skills",
-		skill: "prisma-8",
-		ref: "cli",
-		description: "usage skill (version-locked to installed Prisma Next)"
-	},
-	{
-		subpath: "skills",
-		skill: "prisma-next-upgrade",
-		ref: null,
-		description: "upgrade skill (always tracks `main`)"
-	},
-	{
-		subpath: "skills",
-		skill: "prisma-8-extension-upgrade",
-		ref: null,
-		description: "extension-author upgrade skill (always tracks `main`)"
-	}
-];
-/**
-* Test-only escape hatch for pinning the install base to a local
-* checkout. Production runs leave this unset, so installs always use
-* `DEFAULT_SKILL_BASE`.
-*
-* When set to an absolute filesystem path (typical for tests), the
-* `#ref` fragment is dropped — local-path mode in upstream's CLI does
-* not accept refs, and the local clone has whatever content the test
-* checked into it anyway. When set to anything else (e.g. a fork name
-* `myuser/prisma-next`), the ref policy is preserved.
-*/
-function resolveAgentSkillBase(env) {
-	const override = env["PRISMA_NEXT_SKILLS_BASE"]?.trim();
-	return override && override.length > 0 ? override : DEFAULT_SKILL_BASE;
-}
-function isLocalPath(base) {
-	return base.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(base);
-}
-/**
-* Agents passed to every project-level init install. Upstream `skills add`
-* is the source of truth for per-agent install behaviour; the CLI lists
-* every supported runtime on one invocation and delegates the rest.
-*/
-const DEFAULT_SKILL_AGENTS = [
-	"cursor",
-	"claude-code",
-	"codex",
-	"windsurf"
-];
-/**
-* Build the `<base>/<subpath>[#ref]` URL the `skills` CLI will
-* resolve. Exported for unit tests so the per-source format can be
-* asserted without going through the full install loop.
-*/
-function formatSkillSourceUrl(source, env = process.env) {
-	const base = resolveAgentSkillBase(env);
-	const url = `${base}/${source.subpath}`;
-	if (source.ref === null) return url;
-	if (isLocalPath(base)) return url;
-	if (source.ref === "cli") return `${url}#v${version}`;
-	return url;
-}
-/**
-* The skill-install command for one source, formatted for the
-* project's detected package manager. `npx`/`pnpm dlx`/`bunx` are
-* interchangeable to the user; we pick the variant that matches the
-* rest of the install step so a single project consistently uses one
-* runner.
-*
-* `--agent` takes space-separated slugs on one flag; the explicit
-* `--skill <name>` and `-y` skip the multi-select prompts a
-* non-interactive scaffold step cannot show.
-*
-* Exported for unit tests so the per-PM dispatch can be asserted
-* without a live subprocess.
-*/
-function formatSkillInstallCommand(args) {
-	const agents = args.agents ?? DEFAULT_SKILL_AGENTS;
-	const cliArgs = [
-		"skills@latest",
-		"add",
-		formatSkillSourceUrl(args.source, args.env),
-		"--agent",
-		...agents,
-		"--skill",
-		args.source.skill,
-		"-y"
-	];
-	return formatPackageManagerCommand(args.pm, cliArgs);
-}
-/**
-* Ordered skill-install commands for one init run. This is both what the
-* commander shell runs and what either shell tells the user to run when the
-* install is skipped or fails — the commands need no scaffold and no `init`.
-*/
-function resolveProjectSkillInstallCommands(pm, env) {
-	return DEFAULT_SKILL_SOURCES.map((source) => formatSkillInstallCommand({
-		pm,
-		source,
-		...ifDefined("env", env)
-	}));
-}
-function formatPackageManagerCommand(pm, args) {
-	switch (pm) {
-		case "pnpm": return `pnpm dlx ${args.join(" ")}`;
-		case "yarn": return `yarn dlx ${args.join(" ")}`;
-		case "bun": return `bunx ${args.join(" ")}`;
-		case "deno": return `deno run -A npm:${args.join(" ")}`;
-		case "npm": return `npx ${args.join(" ")}`;
-	}
-}
-/**
-* Skill directories that predate the consolidated `prisma-8` skill:
-* the per-workflow usage cluster (including the renamed
-* `prisma-8-migration-review` spelling it briefly shipped under), the
-* pre-rename spellings of the consolidated skill and the
-* extension-author upgrade skill, and any hand-rolled `prisma-next`
-* stub. Projects initialised before the consolidation carry these as
-* sibling directories in each agent's install root; left in place
-* they compete with the current skills for activation, so init
-* removes them on every run.
-*/
-const RETIRED_SKILL_NAMES = [
-	"prisma-next",
-	"prisma-next-quickstart",
-	"prisma-next-contract",
-	"prisma-next-migrations",
-	"prisma-next-migration-review",
-	"prisma-8-migration-review",
-	"prisma-next-queries",
-	"prisma-next-runtime",
-	"prisma-next-build",
-	"prisma-next-supabase",
-	"prisma-next-debug",
-	"prisma-next-feedback",
-	"prisma-next-extension-upgrade"
-];
-/**
-* Project-level install roots the upstream `skills` CLI uses for the
-* agents in `DEFAULT_SKILL_AGENTS`: cursor and codex install into
-* `.agents/skills`, claude-code into `.claude/skills`, windsurf into
-* `.windsurf/skills`.
-*/
-const AGENT_SKILL_ROOTS = [
-	".agents/skills",
-	".claude/skills",
-	".windsurf/skills"
-];
-/**
-* Every directory a retired per-workflow skill may occupy in a
-* consumer project. Init deletes each (recursively) before running the
-* skill install.
-*/
-function legacySkillDirs() {
-	return AGENT_SKILL_ROOTS.flatMap((root) => RETIRED_SKILL_NAMES.map((name) => `${root}/${name}`));
-}
-/**
-* The minimum supported server version for each target. The
-* authoritative source of truth is each target package's
-* `package.json#prismaNext.minServerVersion` field — this module
-* mirrors those values and a workspace-level test asserts the two
-* never drift (`templates/tsconfig-env.test.ts`).
-*
-* Bumping a value here in isolation is **not** safe: edit the
-* corresponding target package's `package.json` first, then mirror
-* here. The scaffold's `.env.example` and the "Requirements" section
-* of `prisma-next.md` both read from this constant, so a stale value
-* lies to every freshly initialised user.
-*/
-const MIN_SERVER_VERSION = {
-	postgres: "15",
-	mongo: "8.0"
-};
-const TARGET_LABEL = {
-	postgres: "PostgreSQL",
-	mongo: "MongoDB"
-};
-/**
-* Renders the placeholder body shared by `.env` and `.env.example`:
-* the target-specific connection-string requirement comments and the
-* commented-shape `DATABASE_URL` line. The output is identical for both
-* authoring styles — the env file is orthogonal to PSL vs TS schema
-* authoring.
-*/
-function envPlaceholderBody(target) {
-	const label = TARGET_LABEL[target];
-	const minVersion = MIN_SERVER_VERSION[target];
-	const lines = [];
-	lines.push(`# Connection string for ${label}.`);
-	lines.push(`# Requires ${label} >= ${minVersion}.`);
-	lines.push("");
-	if (target === "postgres") lines.push("DATABASE_URL=\"postgresql://user:password@localhost:5432/mydb\"");
-	else {
-		lines.push("# Standalone local mongod / `docker run mongo:8` — no replica set required for first-run queries.");
-		lines.push("# Transactions and change streams need a replica set; add ?replicaSet=... only after initiating one.");
-		lines.push("");
-		lines.push("DATABASE_URL=\"mongodb://user:password@localhost:27017/mydb\"");
-	}
-	lines.push("");
-	return lines.join("\n");
-}
-/**
-* Renders the `.env.example` content for a given target:
-*
-* - Carries a "Copy this file to `.env`…" intro that only makes sense
-*   for the example file (the real `.env` is the destination of that
-*   copy and so does not get the same intro).
-* - Documents the `DATABASE_URL` placeholder in the target's native URL
-*   shape (Postgres: standard `postgresql://`, Mongo: `mongodb://` plus
-*   a `mydb` database segment so the lazy facade has a `dbName`).
-* - Carries a `# Requires <db> >= <version>` comment so a fresh user
-*   knows the minimum supported server before they first try to connect.
-*/
-function envExampleContent(target) {
-	const lines = [];
-	lines.push("# Copy this file to `.env` and replace the placeholder with your real connection string.");
-	lines.push(envPlaceholderBody(target));
-	return lines.join("\n");
-}
-/**
-* Renders the initial `.env` content for `--write-env` / interactive
-* opt-in. Same placeholder body as `.env.example`, **without** the
-* example file's "Copy this file to `.env`…" intro: the real `.env` is
-* the destination of that copy, so the line would lie. Writing this
-* file is gitignored (`.env` lands in `.gitignore` during init).
-*/
-function envFileContent(target) {
-	return envPlaceholderBody(target);
-}
-const TARGET_ALIASES = /* @__PURE__ */ new Map([
-	["postgres", "postgres"],
-	["postgresql", "postgres"],
-	["mongo", "mongo"],
-	["mongodb", "mongo"]
-]);
-const AUTHORING_VALUES = /* @__PURE__ */ new Map([
-	["psl", "psl"],
-	["typescript", "typescript"],
-	["ts", "typescript"]
-]);
-function resolveTarget(value) {
-	if (value === void 0) return void 0;
-	const mapped = TARGET_ALIASES.get(value.toLowerCase());
-	if (mapped === void 0) throw errorInitInvalidFlagValue({
-		flag: "target",
-		value,
-		allowed: ["postgres", "mongodb"]
-	});
-	return mapped;
-}
-function resolveAuthoring(value) {
-	if (value === void 0) return void 0;
-	const mapped = AUTHORING_VALUES.get(value.toLowerCase());
-	if (mapped === void 0) throw errorInitInvalidFlagValue({
-		flag: "authoring",
-		value,
-		allowed: ["psl", "typescript"]
-	});
-	return mapped;
-}
-/**
-* Validates `--schema-path` against the chosen `--authoring` style: PSL
-* authoring requires a `.prisma` file and TypeScript authoring requires a
-* `.ts` file. Mismatched combinations would silently scaffold PSL content
-* into a `.ts` file (or vice versa); this validator surfaces the mistake
-* as a precondition error naming both flags.
-*/
-function validateSchemaPath(value, authoring) {
-	const trimmed = value.trim();
-	if (trimmed.length === 0) throw errorInitInvalidFlagValue({
-		flag: "schema-path",
-		value,
-		allowed: ["<non-empty file path with .prisma or .ts extension>"]
-	});
-	if (trimmed.endsWith("/") || trimmed.endsWith("\\")) throw errorInitInvalidFlagValue({
-		flag: "schema-path",
-		value,
-		allowed: ["<file path, not a directory>"]
-	});
-	const ext = extname(trimmed).toLowerCase();
-	const expected = authoring === "typescript" ? ".ts" : ".prisma";
-	if (ext !== expected) throw errorInitAuthoringSchemaPathMismatch({
-		authoring,
-		schemaPath: trimmed,
-		actualExtension: ext.length > 0 ? ext : "(none)",
-		expectedExtension: expected
-	});
-	return normalize(trimmed);
-}
-const KNOWN = /* @__PURE__ */ new Set([
-	"pnpm",
-	"npm",
-	"yarn",
-	"bun",
-	"deno"
-]);
-function isPackageManager(name) {
-	return KNOWN.has(name);
-}
-/**
-* Resolves the package manager `init` should drive for `add` / `install`
-* commands. Tries, in order:
-*
-*  1. **`detect()`** — walks up from `cwd` looking for a lockfile, the
-*     `packageManager` field, the `devEngines.packageManager` field, or
-*     install metadata. This is the right answer whenever the user is
-*     anywhere inside an existing project, including a deep workspace
-*     subdirectory.
-*
-*  2. **`getUserAgent()`** — parses `npm_config_user_agent`, the env var
-*     every PM sets when it spawns a script. This catches the
-*     bare-directory case where there's no project to walk up to but the
-*     user invoked us via `pnpm dlx prisma-next init` / `bunx
-*     prisma-next init` / `yarn dlx …`. Same signal used by every
-*     `create-*` tool in the ecosystem (`create-vite`, `create-next-app`,
-*     `create-astro`, `@antfu/ni`, …).
-*
-*  3. **`npm`** — final fallback. Always present alongside Node.
-*/
-async function detectPackageManager(cwd) {
-	const detected = await detect({ cwd });
-	if (detected && isPackageManager(detected.name)) return detected.name;
-	const userAgent = getUserAgent();
-	if (userAgent !== null && isPackageManager(userAgent)) return userAgent;
-	return "npm";
-}
-function hasProjectManifest(cwd) {
-	return existsSync(join(cwd, "package.json")) || existsSync(join(cwd, "deno.json")) || existsSync(join(cwd, "deno.jsonc"));
-}
-function formatRunCommand(pm, bin, args) {
-	if (pm === "npm") return `npx ${bin} ${args}`;
-	if (pm === "deno") return `deno run npm:${bin} ${args}`;
-	return `${pm} ${bin} ${args}`;
-}
-function formatRunScriptCommand(pm, scriptName) {
-	switch (pm) {
-		case "deno": return `deno task ${scriptName}`;
-		case "bun": return `bun run ${scriptName}`;
-		case "pnpm": return `pnpm run ${scriptName}`;
-		case "yarn": return `yarn run ${scriptName}`;
-		default: return `npm run ${scriptName}`;
-	}
-}
-function formatAddArgs(pm, packages) {
-	if (pm === "deno") return ["add", ...packages.map((p) => `npm:${p}`)];
-	return ["add", ...packages];
-}
-function formatAddDevArgs(pm, packages) {
-	if (pm === "deno") return [
-		"add",
-		"--dev",
-		...packages.map((p) => `npm:${p}`)
-	];
-	return [
-		"add",
-		"-D",
-		...packages
-	];
-}
-/**
-* The `.gitattributes` entries written for a freshly initialised project
-* (FR3.4). Mirrors the relevant subset of the repo-root
-* [`.gitattributes`](../../../../../../../../.gitattributes):
-*
-* - **Today**: `contract.json`, `contract.d.ts` are emitted on every
-*   `prisma-next contract emit`. Marking them `linguist-generated`
-*   keeps GitHub's diff stats honest and collapses the file in code
-*   review by default.
-* - **Forward-looking**: `ops.json`, `migration.json` are not yet emitted
-*   by `init` flows but will be produced by adjacent commands (lower /
-*   migration tooling). Adding them now matches Decision 5
-*   (forward-looking subset) so the file does not need to be amended
-*   every time a new artifact lands.
-*
-* `ARTIFACT_FILENAMES` entries are written relative to the schema
-* directory so a user who runs `init --schema-path db/contract.prisma`
-* gets `db/contract.json linguist-generated` — not the workspace-glob
-* form `<glob>/contract.json` (which would over-match any unrelated
-* `contract.json` the user has elsewhere) and not the absolute
-* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json` (which would silently
-* break for a non-default schema path).
-*
-* The migration contract snapshot store (`migrations/snapshots/<hex>/`)
-* is anchored to the migrations root instead, not the schema directory:
-* migration package depth under `migrations/` varies (`app/<pkg>`,
-* `<space>/<pkg>`, or a bare `<pkg>` in extension source repos), so no
-* single schema-dir-relative pattern can reach every snapshot. See
-* `STORE_GITATTRIBUTES_LINES` below.
-*/
-const ARTIFACT_FILENAMES$1 = [
-	"contract.json",
-	"contract.d.ts",
-	"ops.json",
-	"migration.json"
-];
-const ATTRIBUTE = "linguist-generated";
-/**
-* Full `.gitattributes` lines for the migration contract snapshot store,
-* already anchored to the migrations root — unlike `ARTIFACT_FILENAMES`,
-* these are not combined with the schema-relative prefix.
-*/
-const STORE_GITATTRIBUTES_LINES = [`migrations/snapshots/**/contract.json ${ATTRIBUTE}`, `migrations/snapshots/**/contract.d.ts ${ATTRIBUTE}`];
-/**
-* Computes the `.gitattributes` lines this scaffold expects to own. Each
-* line has the shape `<path> linguist-generated`. The `target` parameter
-* is currently unused but accepted for symmetry with the other hygiene
-* helpers and to leave room for target-specific entries (e.g. a future
-* family-specific artifact) without a signature break.
-*/
-function requiredGitattributesLines(schemaDir, _target) {
-	const dir = schemaDir === "." ? "" : schemaDir.replace(/\/+$/, "");
-	const prefix = dir === "" ? "" : `${dir}/`;
-	return [...ARTIFACT_FILENAMES$1.map((file) => `${prefix}${file} ${ATTRIBUTE}`), ...STORE_GITATTRIBUTES_LINES];
-}
-/**
-* Idempotent `.gitattributes` merge (FR3.4 / FR9.3). Returns the new file
-* content given the existing content (or `undefined` if the file does
-* not yet exist).
-*
-* Equivalence is exact-line: a user-customised line like
-* `prisma/*.json linguist-generated` is *not* recognised as covering
-* `DEFAULT_CONTRACT_SOURCE_DIR/contract.json linguist-generated`. We accept that
-* over-specification — preserving the user's broad pattern *and*
-* appending the narrow one — because the narrow lines are what the
-* acceptance criteria pin (FR3.4 AC).
-*
-* Returns `null` when no changes are required (file already contains
-* every required entry).
-*/
-function mergeGitattributes(existing, required) {
-	if (existing === void 0) return `${required.join("\n")}\n`;
-	const presentLines = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
-	const missing = required.filter((line) => !presentLines.has(line));
-	if (missing.length === 0) return null;
-	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
-}
-/**
-* The minimal `.gitignore` lines a Prisma Next scaffold needs (FR3.3).
-* Order matches what Node tooling typically writes today.
-*
-* `node_modules/` first because it's the byte-largest miss; `dist/`
-* because the scaffolded `tsconfig.json` writes there; `.env` last so
-* the secret-bearing file is the one most-recently visible in any diff
-* (a paranoid-correct ordering — humans skim from the top).
-*/
-const REQUIRED_GITIGNORE_ENTRIES = [
-	"node_modules/",
-	"dist/",
-	".env"
-];
-/**
-* Idempotent `.gitignore` merge (FR3.3 / FR9.3). Returns the new file
-* content given the existing content (or `undefined` if the file does
-* not yet exist). Adds only entries that are not already present and
-* never duplicates a line. Existing comments and blank lines are
-* preserved verbatim — `.gitignore` is parsed by `git` without a tree,
-* so any line modification risks changing semantics.
-*
-* Pattern equivalence is line-literal: `node_modules/` and `node_modules`
-* are treated as different entries. This is intentional — `git` treats
-* them differently (the trailing slash restricts the match to
-* directories), and the AC pins the trailing-slash form.
-*
-* Returns `null` when no changes are required (file already contains
-* every required entry). The caller can use this to decide whether to
-* include `.gitignore` in `filesWritten`.
-*/
-function mergeGitignore(existing) {
-	if (existing === void 0) return `${REQUIRED_GITIGNORE_ENTRIES.join("\n")}\n`;
-	const present = new Set(existing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")));
-	const missing = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !present.has(entry));
-	if (missing.length === 0) return null;
-	return `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${missing.join("\n")}\n`;
-}
-const REQUIRED_SCRIPTS = [{
-	name: "contract:emit",
-	command: "prisma-next contract emit"
-}];
-/**
-* Idempotent `package.json#scripts` merge with collision detection
-* (FR3.5 / FR9.3):
-*
-* - If a required script is **missing**, append it.
-* - If a required script is **already present and identical**, leave
-*   the file alone (idempotency).
-* - If a required script is **present but maps to a different command**,
-*   skip the write for that script and surface a structured warning.
-*   The user's override is sacred — `init` should never silently
-*   overwrite a custom build pipeline.
-*
-* Preserves the existing key order (so a user who has alphabetised
-* their scripts does not see them reshuffled) and appends new entries
-* at the end.
-*
-* The `package.json` is parsed and re-stringified through `JSON` —
-* comments are not preserved (package.json does not support them per
-* spec). Trailing newline matches the original input's trailing
-* newline behaviour.
-*/
-function mergePackageScripts(existing, required = REQUIRED_SCRIPTS) {
-	const parsed = blindCast(JSON.parse(existing));
-	const scripts = typeof parsed["scripts"] === "object" && parsed["scripts"] !== null ? { ...blindCast(parsed["scripts"]) } : {};
-	const warnings = [];
-	let mutated = false;
-	for (const { name, command } of required) {
-		const existingValue = scripts[name];
-		if (existingValue === void 0) {
-			scripts[name] = command;
-			mutated = true;
-			continue;
-		}
-		if (existingValue !== command) warnings.push(`package.json already has a "${name}" script with a different command — keeping yours.\n  existing: ${existingValue}\n  expected: ${command}\nIf you want the default, remove your "${name}" script and re-run \`init\`.`);
-	}
-	if (!mutated) return {
-		content: null,
-		warnings
-	};
-	parsed["scripts"] = scripts;
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return {
-		content: `${JSON.stringify(parsed, null, 2)}${trailingNewline}`,
-		warnings
-	};
-}
-/**
-* Idempotently sets `"type": "module"` on a `package.json` so the
-* scaffolded `prisma/db.ts` — which uses the ESM-only `with { type: 'json' }`
-* import attribute — loads as ES module under Node's loader (TML-2494).
-*
-* Without this field Node either:
-*
-* - emits `MODULE_TYPELESS_PACKAGE_JSON` and reparses the file as ESM
-*   with a perf penalty (Node 22+ with `--experimental-strip-types`), or
-* - hard-fails with `ERR_*` because the CJS loader cannot parse the
-*   import-attribute syntax (older Node, or any tool that doesn't
-*   reparse).
-*
-* Behaviour:
-*
-* - **Field missing** → set to `"module"`. New entry is inserted right
-*   after `"name"` (when present) so the diff lands in a conventional
-*   spot for human review; falls through to the natural append position
-*   otherwise.
-* - **Field already `"module"`** → no-op (idempotent).
-* - **Field set to anything else** (e.g. `"commonjs"`) → leave it alone
-*   and surface a structured warning. The user explicitly opted out of
-*   ESM and we don't silently overwrite that.
-*/
-function ensureEsmModuleType(existing) {
-	const parsed = blindCast(JSON.parse(existing));
-	const currentType = parsed["type"];
-	if (currentType === "module") return {
-		content: null,
-		warning: null
-	};
-	if (typeof currentType === "string" && currentType !== "module") return {
-		content: null,
-		warning: `package.json declares "type": "${currentType}" — keeping yours, but the scaffolded prisma/db.ts uses an ESM-only import attribute (\`with { type: 'json' }\`) and will not load under that module type.\nIf you want the default, set "type": "module" in package.json.`
-	};
-	const next = {};
-	let inserted = false;
-	for (const [key, value] of Object.entries(parsed)) {
-		if (key === "type") continue;
-		next[key] = value;
-		if (!inserted && key === "name") {
-			next["type"] = "module";
-			inserted = true;
-		}
-	}
-	if (!inserted) next["type"] = "module";
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return {
-		content: `${JSON.stringify(next, null, 2)}${trailingNewline}`,
-		warning: null
-	};
-}
-/**
-* Filenames the contract pipeline emits next to the user's schema source
-* (`<schemaDir>/contract.json`, `<schemaDir>/contract.d.ts`, …). Mirrors
-* the schema-dir-relative `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
-* (not that file's migrations-root-anchored store lines, which are outside
-* this command's scope — reinit only ever touches `schemaDir`); kept as a
-* separate constant here because the cleanup contract is target-agnostic
-* and we deliberately do not want a stale artifact from a previous target
-* lingering after a re-init.
-*
-* If a future emit pipeline produces an additional schema-dir artifact,
-* add it here **and** to `ARTIFACT_FILENAMES` in `hygiene-gitattributes.ts`
-* — the two stay in lockstep so the file `init` advertises as
-* `linguist-generated` is exactly the file `init` is willing to delete on
-* re-init.
-*/
-const ARTIFACT_FILENAMES = [
-	"contract.json",
-	"contract.d.ts",
-	"ops.json",
-	"migration.json"
-];
-/**
-* Returns the schema-relative paths of stale contract artifacts the
-* previous `init` run (or a `contract emit`) left behind in `schemaDir`.
-* Paths are returned relative to `baseDir` so the caller can plumb them
-* into `filesWritten`-style logging without re-deriving the path.
-*
-* Pure function: no filesystem mutation. Used by `runInit`'s precondition
-* phase (FR6.2 / NFR3 atomicity) so a downstream parse failure leaves
-* the artifacts on disk and the project byte-identical to its pre-init
-* state.
-*/
-function findStaleArtifacts(baseDir, schemaDir) {
-	const result = [];
-	for (const filename of ARTIFACT_FILENAMES) {
-		const rel = join(schemaDir, filename);
-		if (existsSync(join(baseDir, rel))) result.push(rel);
-	}
-	return result;
-}
-/**
-* Drops a single key from `package.json#dependencies`, returning the new
-* file content. Returns `null` when the dependency was already absent —
-* the caller can skip the write to keep re-init idempotent (FR9.3).
-*
-* Used by `runInit` for the FR9.2 target-switch path: when the user
-* re-inits a project from `--target postgres` to `--target mongodb` (or
-* vice versa), the previous facade is removed from `dependencies` so the
-* resulting project depends only on the chosen target's facade.
-*
-* Devs/peers/optional dep groups are intentionally *not* touched — the
-* facades are only ever in `dependencies` (FR4 / FR7), and broadening
-* the search would risk clobbering an unrelated dep with the same name
-* in `peerDependencies`.
-*
-* Throws `SyntaxError` if `existing` is not parseable as JSON; the
-* caller (`runInit`) already guards on that with a structured 5010
-* error before this helper is reached.
-*/
-function removeDependency(existing, depName) {
-	const parsed = JSON.parse(existing);
-	const deps = parsed["dependencies"];
-	if (deps === null || typeof deps !== "object" || Array.isArray(deps)) return null;
-	if (!Object.hasOwn(deps, depName)) return null;
-	const next = { ...deps };
-	delete next[depName];
-	parsed["dependencies"] = next;
-	const trailingNewline = existing.endsWith("\n") ? "\n" : "";
-	return `${JSON.stringify(parsed, null, 2)}${trailingNewline}`;
-}
-function renderTemplate(templateFile, variableNames, vars) {
-	let result = readFileSync(join(import.meta.dirname, templateFile), "utf-8");
-	for (const key of variableNames) {
-		const value = vars[key];
-		if (value === void 0) throw new InternalError(`Template variable '${key}' is not defined`);
-		result = result.replaceAll(`{{${key}}}`, value);
-	}
-	return result;
-}
-const variables = [
-	"schemaPath",
-	"schemaDir",
-	"dbImportPath",
-	"pkgRun",
-	"pkg",
-	"configEntrypoint",
-	"schemaSample",
-	"requirements"
-];
-function quickReferenceMd(target, authoring, schemaPath, pkgRun, resolveImportSpecifier = keepInternalSpecifiers) {
-	const schemaDir = dirname(schemaPath);
-	const pkg = targetPackageName(target, resolveImportSpecifier);
-	const vars = {
-		schemaPath,
-		schemaDir,
-		dbImportPath: `./${schemaDir}/db`,
-		pkgRun,
-		pkg,
-		configEntrypoint: targetEntrypoint(target, "config", resolveImportSpecifier),
-		schemaSample: schemaSample(target, authoring, resolveImportSpecifier),
-		requirements: requirementsBlock(target)
-	};
-	return renderTemplate(`quick-reference-${target}.md`, variables, vars);
-}
-/**
-* Renders the FR8.2 "Requirements" block injected into `prisma-next.md`
-* (the user-facing quick reference). Sources the minimum server
-* version from `MIN_SERVER_VERSION` — itself mirrored from each
-* target package's `package.json#prismaNext.minServerVersion`
-* (FR8.1).
-*
-* The verification command is target-specific — Postgres scaffolds
-* shouldn't ship Mongo's `db.runCommand` (and vice versa) just because
-* we couldn't be bothered to branch.
-*/
-function requirementsBlock(target) {
-	return [
-		"## Requirements",
-		"",
-		`- **${TARGET_LABEL[target]} ${MIN_SERVER_VERSION[target]} or newer.** Older servers are not supported. Run ${target === "postgres" ? "`SELECT version()`" : "`db.runCommand({ buildInfo: 1 })`"} against your server to verify.`,
-		"- The CLI never connects to your database without explicit consent. Pass `--probe-db` to `prisma-next init` if you want `init` to verify the server version itself."
-	].join("\n");
-}
-const sharedVariables = [
-	"projectName",
-	"contractPath",
-	"runDev",
-	"runContractEmit"
-];
-const postgresVariables = [
-	...sharedVariables,
-	"runDbInit",
-	"runDbUpdate",
-	"runMigrationPlan",
-	"runMigrate",
-	"runDbSeed"
-];
-const mongoVariables = [
-	...sharedVariables,
-	"runDbUp",
-	"runDbDown",
-	"runDbReset",
-	"runMigrationPlan",
-	"runMigrate",
-	"runDbSeed"
-];
-function minimalProjectReadmeMd(target, schemaPath, projectName, pm) {
-	const run = (script) => formatRunScriptCommand(pm, script);
-	const shared = {
-		projectName,
-		contractPath: schemaPath,
-		runDev: run("dev"),
-		runContractEmit: run("contract:emit"),
-		runMigrationPlan: run("migration:plan"),
-		runMigrate: run("migrate"),
-		runDbSeed: run("db:seed")
-	};
-	if (target === "mongo") {
-		const vars = {
-			...shared,
-			runDbUp: run("db:up"),
-			runDbDown: run("db:down"),
-			runDbReset: run("db:reset")
-		};
-		return renderTemplate("readme-mongo.md", mongoVariables, vars);
-	}
-	const vars = {
-		...shared,
-		runDbInit: run("db:init"),
-		runDbUpdate: run("db:update")
-	};
-	return renderTemplate("readme-postgres.md", postgresVariables, vars);
-}
-/**
-* Compiler options the scaffolded `prisma-next.config.ts` and `db.ts` need
-* to typecheck:
-*
-* - `module: 'preserve'` + `moduleResolution: 'bundler'` align with how
-*   modern bundlers (and `tsdown`) consume our facade packages.
-* - `resolveJsonModule` lets `db.ts` import `contract.json with { type:
-*   'json' }` — the runtime path the facades document (FR4).
-*
-* `types: ['node']` is FR2.2 territory and lives in
-* `REQUIRED_COMPILER_OPTIONS_TYPES` because TS only honours an _array_
-* here, and a string-keyed merge would clobber any user-specified entries.
-* Merge handling preserves any extra `types` the user added.
-*/
-const REQUIRED_COMPILER_OPTIONS = {
-	module: "preserve",
-	moduleResolution: "bundler",
-	resolveJsonModule: true
-};
-/**
-* Types that must be present in `compilerOptions.types` for the scaffold
-* to typecheck. With `moduleResolution: 'bundler'`, TypeScript does not
-* implicitly include all `@types/*` packages — `process.env` only resolves
-* when `node` is in this array (or `types` is omitted, but then any other
-* type listed here would force the same behaviour). Listing `node`
-* explicitly is the documented escape hatch (FR2.2).
-*/
-const REQUIRED_COMPILER_OPTIONS_TYPES = ["node"];
-function defaultTsConfig() {
-	return JSON.stringify({
-		compilerOptions: {
-			target: "ES2022",
-			...REQUIRED_COMPILER_OPTIONS,
-			types: [...REQUIRED_COMPILER_OPTIONS_TYPES],
-			strict: true,
-			skipLibCheck: true,
-			esModuleInterop: true,
-			outDir: "dist"
-		},
-		include: ["**/*.ts"]
-	}, null, 2);
-}
-/**
-* Thrown by `mergeTsConfig` when the user's existing `tsconfig.json` is
-* not parseable as JSONC (TypeScript's actual configured dialect — see
-* FR6.1). Carries the raw parse errors so the caller can render an
-* actionable, location-aware message.
-*
-* `runInit` catches this exception during the precondition phase and
-* maps it to a `CliStructuredError(5011)` so the user's working tree
-* stays byte-identical when init bails (FR6.2 / NFR3).
-*/
-var TsConfigParseError = class extends Error {
-	errors;
-	constructor(errors) {
-		super(formatTsConfigParseErrors(errors));
-		this.errors = errors;
-		this.name = "TsConfigParseError";
-	}
-};
-function formatTsConfigParseErrors(errors) {
-	if (errors.length === 0) return "tsconfig.json is empty or not an object";
-	return errors.map((e) => `${printParseErrorCode(e.error)} at offset ${e.offset}`).join("; ");
-}
-/**
-* Merges the required compiler options into an existing `tsconfig.json`.
-*
-* Parsing is delegated to `jsonc-parser` so JSONC inputs (comments,
-* trailing commas) — TypeScript's real configuration dialect — survive
-* unchanged: edits are applied as text patches via `modify` /
-* `applyEdits`, preserving the user's formatting, key ordering, and
-* comments wherever the touched paths permit (FR6.1, AC "Hostile
-* inputs").
-*
-* Throws `TsConfigParseError` when the input is not parseable as JSONC.
-* The caller must catch this and surface a structured error before
-* writing any scaffold files (FR6.2 atomicity).
-*/
-function mergeTsConfig(existing) {
-	const { config } = parseTsConfigText(existing);
-	const formattingOptions = {
-		tabSize: detectIndent(existing),
-		insertSpaces: true,
-		eol: existing.includes("\r\n") ? "\r\n" : "\n"
-	};
-	let result = existing;
-	for (const [key, value] of Object.entries(REQUIRED_COMPILER_OPTIONS)) {
-		const edits = modify(result, ["compilerOptions", key], value, { formattingOptions });
-		result = applyEdits(result, edits);
-	}
-	const existingTypes = config["compilerOptions"]?.["types"];
-	const mergedTypes = mergeTypesArray(existingTypes);
-	const typesEdits = modify(result, ["compilerOptions", "types"], mergedTypes, { formattingOptions });
-	result = applyEdits(result, typesEdits);
-	return result;
-}
-/**
-* Parses an existing `tsconfig.json` (JSONC) and returns the structured
-* config alongside any non-fatal parse warnings. Throws
-* `TsConfigParseError` if the input cannot be parsed at all or does
-* not resolve to a JSON object — both cases mean we cannot safely
-* apply edits.
-*
-* Exposed independently so callers (notably `runInit`'s precondition
-* gate) can validate the file *before* any scaffold file is written.
-*/
-function parseTsConfigText(text) {
-	const errors = [];
-	const value = parse(text, errors, {
-		allowTrailingComma: true,
-		disallowComments: false,
-		allowEmptyContent: false
-	});
-	if (value === void 0 || value === null || typeof value !== "object" || Array.isArray(value)) throw new TsConfigParseError(errors);
-	if (errors.length > 0) throw new TsConfigParseError(errors);
-	return { config: value };
-}
-function detectIndent(text) {
-	const match = text.match(/^([ \t]+)\S/m);
-	if (match === null) return 2;
-	const indent = match[1] ?? "";
-	if (indent.startsWith("	")) return 1;
-	return indent.length || 2;
-}
-/**
-* Merges `REQUIRED_COMPILER_OPTIONS_TYPES` into the user's existing
-* `compilerOptions.types` array. Preserves order and dedupes. If the
-* user has no `types` array (or has set it to a non-array), we replace
-* with the required minimum — overwriting a non-array `types` is the
-* correct fix because anything other than a string array is invalid TS
-* config.
-*/
-function mergeTypesArray(existing) {
-	const result = [];
-	if (Array.isArray(existing)) {
-		for (const item of existing) if (typeof item === "string" && !result.includes(item)) result.push(item);
-	}
-	for (const required of REQUIRED_COMPILER_OPTIONS_TYPES) if (!result.includes(required)) result.push(required);
-	return result;
-}
-/**
-* Recognised pnpm error signatures that justify a fallback to npm.
-*
-* These patterns indicate the published artifact itself is at fault
-* (a leaked `workspace:*` or `catalog:` specifier), not the user's
-* environment — pnpm is faithfully reporting "I cannot resolve this
-* registry version", and npm is willing to install it because npm
-* doesn't care about the protocol prefix when there's a fallback range.
-*
-* The predicate lives on its own so both shells' `init` share one list:
-* the commander command matches it against captured child stderr, the
-* engine command against the stderr the package-manager capability
-* returns on a failed install.
-*/
-function isRecognisedPnpmResolutionError(stderr) {
-	if (!stderr) return false;
-	return stderr.includes("ERR_PNPM_WORKSPACE_PKG_NOT_FOUND") || stderr.includes("ERR_PNPM_NO_MATCHING_VERSION") || /No matching version found for .* in the catalog/i.test(stderr) || /workspace:[^\s]+ is not a valid (version|spec)/i.test(stderr) || /catalog:[^\s]* is not a valid (version|spec)/i.test(stderr);
-}
-/**
-* Strips credentials out of package-manager stderr before it reaches a warning,
-* an error's meta, or a log. Two shapes carry them: userinfo inside a registry
-* URL (`https://user:token@registry…`), and the npmrc settings npm and pnpm
-* echo back when authentication fails (`//registry.npmjs.org/:_authToken=…`,
-* or the top-level `_authToken=…` with no registry scope), which are not
-* URL-shaped and survive a userinfo-only pass.
-*
-* Both shells' `init` call this, and both call it on stderr they already
-* received from somewhere else: redaction is cheap and doubling it is harmless,
-* while trusting another layer to have done it is not.
-*/
-function redactSecrets(stderr) {
-	return stderr.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+)@/g, "$1***@").replace(/(\b_(?:authToken|auth|password)=)\S+/gi, "$1***");
-}
-//#endregion
-export { isRecognisedPnpmResolutionError as A, removeDependency as B, findStaleArtifacts as C, formatSkillInstallCommand as D, formatRunCommand as E, mergeTsConfig as F, validateSchemaPath as G, resolveAuthoring as H, minimalProjectReadmeMd as I, probeServerVersion as L, mergeGitattributes as M, mergeGitignore as N, formatSkillSourceUrl as O, mergePackageScripts as P, quickReferenceMd as R, errorInitWriteFailed as S, formatAddDevArgs as T, resolveProjectSkillInstallCommands as U, requiredGitattributesLines as V, resolveTarget as W, errorInitProbeFailed as _, TsConfigParseError as a, errorInitStrictProbeWithoutProbe as b, detectPackageManager as c, envFileContent as d, errorInitEmitFailed as f, errorInitMissingFlags as g, errorInitInvalidTsconfig as h, REQUIRED_SCRIPTS as i, legacySkillDirs as j, hasProjectManifest as k, ensureEsmModuleType as l, errorInitInvalidManifest as m, DEFAULT_SKILL_SOURCES as n, buildCatalogWarnings as o, errorInitInstallFailed as p, MIN_SERVER_VERSION as r, defaultTsConfig as s, DEFAULT_SKILL_AGENTS as t, envExampleContent as u, errorInitReinitNeedsForce as v, formatAddArgs as w, errorInitUserAborted as x, errorInitSkillInstallFailed as y, redactSecrets as z };
-
-//# sourceMappingURL=redact-secrets-DuKoiMax-Cfe2XVhc.mjs.map