@wardby/cli 0.2.0 → 0.2.1

package/dist/providers/auth/self-hosted.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { AuthProfile, AuthProvider, AuthTokens, VerifiedToken } from "./types.js";
 import { Credentials } from "../../mcp/auth/self-hosted/credentials.js";
 import { Sessions } from "../../mcp/auth/self-hosted/session.js";
@@ -34,7 +34,7 @@ export declare class SelfHostedAuthProvider implements AuthProvider {
     consentPage(sessionToken: string, interactionId: string): Promise<{
         interaction: {
             client: {
-                metadata: import("@prisma/client/runtime/library").JsonValue;
+                metadata: import("@prisma/client/runtime/client").JsonValue;
                 createdAt: Date;
                 clientId: string;
             };

package/dist/providers/coding-proxy/prisma-ledger.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { CreateProxySessionInput, ProxyLedger, ProxyRequest, ProxySession, ProxyUsage, ReserveProxyRequestInput, ReserveProxyRequestResult } from "./types.js";
 export type PrismaProxyLedgerDb = Pick<PrismaClient, "$transaction" | "$queryRaw" | "$executeRaw">;
 export declare class PrismaProxyLedger implements ProxyLedger {

package/dist/providers/coding-proxy/runtime.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import { startDenyPortListener } from "./deny-port.js";
 import { startCodingProxyServer, type CodingProxyServerHandle } from "./server.js";
 import type { ProxyAuditSink } from "./types.js";

package/dist/providers/datastore/postgres.d.ts

@@ -1,7 +1,7 @@
 /**
  * Postgres-backed default Datastore adapter, via the `DatastoreEntry` table.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Datastore, DatastoreSetOptions, DatastoreValue } from "./types.js";
 import type { SecretCipher } from "../secrets/types.js";
 export type DatastoreDb = Pick<PrismaClient, "datastoreEntry" | "datastore" | "$queryRaw">;

package/dist/providers/executor/build.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { ProviderRegistry } from "../index.js";
 import { type ProviderConfig } from "../../config/providers.js";
 import type { Executor } from "./types.js";

package/dist/providers/executor/composition.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import { type ProviderConfig } from "../../config/providers.js";
 import type { KubernetesApi } from "../jobs/kubernetes-api.js";
 import type { Executor } from "./types.js";

package/dist/providers/executor/container.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import { type CodingRunObserver } from "../../coding/observability.js";
 import { type CodingRunResult } from "../../coding/protocol.js";
 import type { ProxyProtocol } from "../coding-proxy/types.js";

package/dist/providers/executor/container.js

@@ -3,6 +3,7 @@ import { mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { join, resolve, sep } from "node:path";
 import { CodingProfileSchema } from "../../coding/profile.js";
 import { logger } from "../../core/logger.js";
+import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { codingRunObserver } from "../../coding/observability.js";
 import { CODING_PROTOCOL_VERSION, CodingRunResultSchema, CodingTaskInputSchema, parseCodingAgentOutputJson, redactAndTruncate, } from "../../coding/protocol.js";
 import { getModelPricing } from "../llm/pricing.js";
@@ -597,7 +598,7 @@ export class ContainerExecutor {
                 const reason = collected?.diagnostic ?? collected?.reason ?? jobState;
                 this.emit({ stage: "collected", runId: run.runId, jobId: handle.id });
                 const status = jobState === "lost" ? "lost" : "failed";
-                const failure = this.failure(`job_${reason}`);
+                const failure = this.failure(`job_${reason}`, { issues: collected?.diagnosticIssues });
                 await this.options.store.terminate(run.runId, status, failure.error, failure.audit);
                 this.terminal(run, status, failure.audit);
                 return;
@@ -755,7 +756,7 @@ export class ContainerExecutor {
         throw new Error("coding_provider_not_configured:claude-code");
     }
     async writeInput(run, deadlineAt) {
-        await mkdir(this.artifactRoot, { recursive: true, mode: 0o700 });
+        await ensurePrivateDirectory(this.artifactRoot);
         const rootReal = await realpath(this.artifactRoot);
         const directory = resolve(rootReal, run.runId);
         if (!directory.startsWith(`${rootReal}${sep}`))
@@ -881,7 +882,13 @@ export class ContainerExecutor {
         // keyed by the same diagnostic id. Token-shaped values are redacted, and a
         // cause chain is kept because the outer message is often just a wrapper.
         // A user asking to stop is not a failure, so it gets the same id at info.
-        const line = { diagnosticId, category, reason: describeFailure(error) };
+        // `issues` names only which output-schema fields failed (see SAFE_CODING_OUTPUT_ISSUE).
+        const line = {
+            diagnosticId,
+            category,
+            reason: describeFailure(error),
+            ...(options.issues ? { issues: options.issues } : {}),
+        };
         if (options.cancelled === true)
             containerLog.info(line, "coding run cancelled; the persisted error is its id only");
         else

package/dist/providers/executor/dbos.d.ts

@@ -12,7 +12,7 @@
  * stale-heartbeat detection is unchanged; the reconciler consults
  * `recover()` (Task 6) before declaring a DBOS run lost.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { ProviderRegistry } from "../index.js";
 import type { DbosConfig } from "../../config/providers.js";
 import { type RunnerDb } from "../../core/runner.js";

package/dist/providers/jobs/docker.d.ts

@@ -1,5 +1,16 @@
 import type { JobHandle, JobResult, JobSpec, JobStatus, WorkspaceJobLauncher } from "./types.js";
 export declare const SAFE_WORKER_DIAGNOSTIC: RegExp;
+export interface WorkerDiagnostic {
+    diagnostic: string;
+    diagnosticIssues?: string[];
+}
+/**
+ * Worker output is untrusted: recognizes only the fixed `{"error": code}` line,
+ * plus an optional `issues` list whose every entry must pass the shared pattern.
+ * A list with any entry that does not is dropped whole rather than filtered, so
+ * a malformed worker cannot smuggle a partial value through.
+ */
+export declare function parseWorkerDiagnosticLine(line: string): WorkerDiagnostic | undefined;
 export interface DockerCommandOptions {
     env?: Record<string, string>;
     maxOutputBytes?: number;

package/dist/providers/jobs/docker.js

@@ -3,7 +3,9 @@ import { spawn } from "node:child_process";
 import { lstat, mkdir, mkdtemp, open, opendir, readdir, readFile, readlink, realpath, rename, rm, unlink, } from "node:fs/promises";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { logger } from "../../core/logger.js";
-import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES } from "../../coding/protocol.js";
+import { ensurePrivateDirectory } from "../../core/private-directory.js";
+import { readBoundedRegularFile } from "../../coding-worker/artifact.js";
+import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
 import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection, assertClaudeToolRunnerContainerInspection, assertIsolationNetworkInspection, assertKeeperContainerInspection, assertProxyContainerInspection, assertStorageVolumeInspection, assertWorkerContainerInspection, buildDockerIsolationPlan, } from "./docker-isolation.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
 const BACKEND = "docker";
@@ -13,6 +15,31 @@ const MAX_DOCKER_SEED_DIAGNOSTIC_BYTES = 4 * 1024;
 const MAX_WORKSPACE_ENTRIES = 100_000;
 const TERMINAL_PHASES = new Set(["succeeded", "failed", "stopped", "lost", "removed"]);
 export const SAFE_WORKER_DIAGNOSTIC = /^(?:worker_[a-z_]+|coding_[a-z_]+|wardby_[a-z_]+)$/;
+/**
+ * Worker output is untrusted: recognizes only the fixed `{"error": code}` line,
+ * plus an optional `issues` list whose every entry must pass the shared pattern.
+ * A list with any entry that does not is dropped whole rather than filtered, so
+ * a malformed worker cannot smuggle a partial value through.
+ */
+export function parseWorkerDiagnosticLine(line) {
+    let value;
+    try {
+        value = JSON.parse(line);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value?.error !== "string" || !SAFE_WORKER_DIAGNOSTIC.test(value.error))
+        return undefined;
+    const issues = value.issues;
+    const safeIssues = Array.isArray(issues) &&
+        issues.length > 0 &&
+        issues.length <= MAX_CODING_OUTPUT_ISSUES &&
+        issues.every((issue) => typeof issue === "string" && SAFE_CODING_OUTPUT_ISSUE.test(issue))
+        ? issues
+        : undefined;
+    return { diagnostic: value.error, ...(safeIssues ? { diagnosticIssues: safeIssues } : {}) };
+}
 const dockerLog = logger.child({ module: "docker-jobs" });
 /**
  * Docker failures never include daemon output in their public message -- that
@@ -440,7 +467,7 @@ export class DockerJobLauncher {
             if (current.phase === "failed" && !current.result.diagnostic) {
                 const diagnostic = await this.readWorkerFailureDiagnostic(current);
                 if (diagnostic) {
-                    current.result = { ...current.result, diagnostic };
+                    current.result = { ...current.result, ...diagnostic };
                     await this.writeRecord(current);
                 }
             }
@@ -500,7 +527,7 @@ export class DockerJobLauncher {
         });
     }
     async initialize() {
-        await mkdir(this.stateRoot, { recursive: true, mode: 0o700 });
+        await ensurePrivateDirectory(this.stateRoot);
         await mkdir(join(this.stateRoot, ".home"), { recursive: true, mode: 0o700 });
         await realpath(this.stateRoot);
         const records = await this.allRecords();
@@ -792,13 +819,7 @@ export class DockerJobLauncher {
         const target = join(staging, "result.json");
         try {
             await this.run(["container", "cp", `${this.keeperName(record)}:/run/wardby/storage/output/result.json`, target]);
-            const metadata = await lstat(target);
-            if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
-                throw new Error("docker_result_artifact_invalid");
-            }
-            const raw = await readFile(target, "utf8");
-            if (Buffer.byteLength(raw, "utf8") > MAX_CODING_ARTIFACT_BYTES)
-                throw new Error("docker_result_artifact_invalid");
+            const raw = await readBoundedRegularFile(target, MAX_CODING_ARTIFACT_BYTES, "docker_result_artifact_invalid");
             const output = parseCodingAgentOutputJson(raw);
             if (output.runId !== record.runId)
                 throw new Error("docker_result_run_mismatch");
@@ -818,14 +839,9 @@ export class DockerJobLauncher {
             const logs = await this.run(["container", "logs", "--tail", "8", record.handle.id]);
             const raw = `${logs.stdout}\n${logs.stderr}`;
             for (const line of raw.split("\n").reverse()) {
-                try {
-                    const value = JSON.parse(line);
-                    if (typeof value.error === "string" && SAFE_WORKER_DIAGNOSTIC.test(value.error))
-                        return value.error;
-                }
-                catch {
-                    // Worker output is untrusted; only parse one fixed JSON shape.
-                }
+                const diagnostic = parseWorkerDiagnosticLine(line);
+                if (diagnostic)
+                    return diagnostic;
             }
         }
         catch {

package/dist/providers/jobs/kubernetes.js

@@ -31,7 +31,7 @@ import { isIP } from "node:net";
 import { logger } from "../../core/logger.js";
 import { MAX_CODING_ARTIFACT_BYTES, parseCodingAgentOutputJson } from "../../coding/protocol.js";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
-import { SAFE_WORKER_DIAGNOSTIC } from "./docker.js";
+import { parseWorkerDiagnosticLine } from "./docker.js";
 import { KubernetesAlreadyExistsError, KubernetesConflictError } from "./kubernetes-api.js";
 import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT_PROBE_DENY_REFUSED, ENFORCEMENT_PROBE_PROXY_UNREACHABLE, KEEPER_CONTAINER, KEEPER_SEEDED_MARKER, KUBERNETES_ISOLATION_ERROR, STORAGE_ROOT, WORKER_CONTAINER, assertRunNetworkPolicyMatches, assertRunPodMatches, buildCapabilitySecret, buildRunNetworkPolicy, buildRunPod, enforcementProbeScript, kubernetesRunNames, kubernetesRunNamesForToken, runLabels, validateKubernetesSpec, } from "./kubernetes-isolation.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
@@ -428,7 +428,7 @@ export class KubernetesJobLauncher {
         if (phase === "failed" && !result.diagnostic) {
             const diagnostic = await this.readWorkerDiagnostic(names);
             if (diagnostic)
-                result = { ...result, diagnostic };
+                result = { ...result, ...diagnostic };
         }
         if (phase === "succeeded" && !result.resultArtifact) {
             result = { ...result, resultArtifact: await this.readResultArtifact(names, record.runId) };
@@ -715,14 +715,9 @@ export class KubernetesJobLauncher {
             return undefined;
         }
         for (const line of raw.split("\n").reverse()) {
-            try {
-                const value = JSON.parse(line);
-                if (typeof value?.error === "string" && SAFE_WORKER_DIAGNOSTIC.test(value.error))
-                    return value.error;
-            }
-            catch {
-                // Worker output is untrusted; only one fixed JSON shape is recognized.
-            }
+            const diagnostic = parseWorkerDiagnosticLine(line);
+            if (diagnostic)
+                return diagnostic;
         }
         return undefined;
     }

package/dist/providers/jobs/types.d.ts

@@ -45,6 +45,8 @@ export interface JobResult {
     resultArtifact?: string;
     /** Fixed worker-owned failure code; never raw container output. */
     diagnostic?: string;
+    /** Output-schema failure locations (`path:code`) that passed SAFE_CODING_OUTPUT_ISSUE; never values. */
+    diagnosticIssues?: string[];
 }
 /**
  * Lifecycle invariants implemented by every launcher:

package/dist/providers/memory/postgres.d.ts

@@ -6,7 +6,7 @@
  * schema.prisma). Every other operation goes through the normal Prisma
  * Client since it never touches `contentTsv`.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { AgentMemorySearchHit, AgentMemoryStore } from "./types.js";
 export type AgentMemoryDb = Pick<PrismaClient, "agentMemory" | "$executeRaw" | "$queryRaw">;
 export declare class PostgresAgentMemory implements AgentMemoryStore {

package/dist/providers/vcs/git.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { lstat, mkdir, opendir, readFile, readlink, realpath, rm } from "node:fs/promises";
 import { isAbsolute, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { MAX_REDACTED_SPAN, redactTokenShapedValues, normalizeGitHubRepository, normalizeGitRef, } from "../../coding/protocol.js";
 import { isSafeGitHubInstallationToken } from "./github.js";
 export const DEFAULT_MAX_CHANGED_FILES = 1_000;
@@ -220,7 +221,7 @@ export class GitVcsProvider {
     }
     async prepareWorkspace(input) {
         const normalized = this.validateInput(input);
-        await mkdir(this.rootDir, { recursive: true, mode: 0o700 });
+        await ensurePrivateDirectory(this.rootDir);
         await mkdir(resolve(this.rootDir, ".home"), { recursive: true, mode: 0o700 });
         const runRoot = resolve(this.rootDir, normalized.runId);
         if (!directChild(this.rootDir, runRoot))

package/dist/quickstart/index.js

@@ -1,5 +1,4 @@
 import { spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
 import { createServer } from "node:net";
 import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -7,12 +6,11 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { createInterface } from "node:readline/promises";
 import { composeProjectName, defaultModel, ensureWardbyIgnored, generatedSecret, providerKeyName, quickstartPaths, readQuickstartEnv, readQuickstartState, resolveProjectDir, writeQuickstartEnv, writeQuickstartState, } from "./config.js";
+import { FETCH_NOTICE, migrateFailureReason, prismaMigrateInvocation, REGISTRY_FAILURE_MESSAGE, runPrismaMigrateInvocation, } from "./migrate.js";
 const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
 const composeFile = join(packageRoot, "deploy/local/docker-compose.yml");
-const schemaFile = join(packageRoot, "prisma/schema.prisma");
 const wardbyBin = join(packageRoot, "bin/wardby.js");
 const packageJson = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
-const require = createRequire(import.meta.url);
 const DEMO_AGENT = "hello-wardby";
 const DEMO_PROMPT = "You are the Wardby quickstart agent. Reply with a short greeting, then explain in one sentence that Wardby admitted this run against an explicit maximum budget. Do not call tools.";
 function runCommand(command, args, options = {}) {
@@ -200,22 +198,21 @@ async function chooseProvider(requested, previous, existing, nonInteractive) {
         return "anthropic";
     throw new Error(`Unknown provider selection "${answer}".`);
 }
-function prismaCliPath() {
-    return require.resolve("prisma/build/index.js");
-}
 function applyMigrations(paths) {
-    const result = runCommand(process.execPath, [prismaCliPath(), "migrate", "deploy", "--schema", schemaFile], {
-        cwd: paths.projectDir,
-        env: runtimeEnv(paths),
-    });
+    const invocation = prismaMigrateInvocation("deploy", runtimeEnv(paths));
+    if (!invocation.local)
+        console.log(FETCH_NOTICE);
+    const result = runPrismaMigrateInvocation(invocation, paths.projectDir);
+    if (result.registryFailure) {
+        const detail = /^npm (?:error|ERR!) code .*$/m.exec(result.stderr)?.[0] ?? result.stderr.trim().split("\n")[0];
+        throw new Error(`${REGISTRY_FAILURE_MESSAGE}${detail ? ` (${detail})` : ""}`);
+    }
     if (result.status !== 0)
         commandFailure("Database migration", result);
 }
 async function seedDemo(paths, state, budget) {
-    const previousDatabaseUrl = process.env.DATABASE_URL;
-    process.env.DATABASE_URL = readQuickstartEnv(paths).DATABASE_URL;
-    const { PrismaClient } = await import("@prisma/client");
-    const db = new PrismaClient();
+    const { createPrismaClient } = await import("../core/db.js");
+    const db = createPrismaClient(readQuickstartEnv(paths).DATABASE_URL);
     try {
         const existing = await db.agent.findUnique({ where: { name: DEMO_AGENT } });
         if (existing && existing.systemPrompt !== DEMO_PROMPT) {
@@ -241,10 +238,6 @@ async function seedDemo(paths, state, budget) {
     }
     finally {
         await db.$disconnect();
-        if (previousDatabaseUrl === undefined)
-            delete process.env.DATABASE_URL;
-        else
-            process.env.DATABASE_URL = previousDatabaseUrl;
     }
 }
 function runDemo(paths) {
@@ -419,10 +412,8 @@ async function databaseHealthy(paths) {
     const env = readQuickstartEnv(paths);
     if (!env.DATABASE_URL)
         return false;
-    const previous = process.env.DATABASE_URL;
-    process.env.DATABASE_URL = env.DATABASE_URL;
-    const { PrismaClient } = await import("@prisma/client");
-    const db = new PrismaClient();
+    const { createPrismaClient } = await import("../core/db.js");
+    const db = createPrismaClient(env.DATABASE_URL);
     try {
         await db.$queryRawUnsafe("SELECT 1");
         return true;
@@ -432,10 +423,6 @@ async function databaseHealthy(paths) {
     }
     finally {
         await db.$disconnect();
-        if (previous === undefined)
-            delete process.env.DATABASE_URL;
-        else
-            process.env.DATABASE_URL = previous;
     }
 }
 export async function doctorCommand(args) {
@@ -468,11 +455,15 @@ export async function doctorCommand(args) {
         const ps = runCompose(paths, state, ["ps", "--status", "running", "--quiet"]);
         checks.push(["PostgreSQL container", ps.status === 0 && ps.stdout.trim().length > 0]);
         checks.push(["Database connection", await databaseHealthy(paths)]);
-        const migrations = runCommand(process.execPath, [prismaCliPath(), "migrate", "status", "--schema", schemaFile], {
-            cwd: paths.projectDir,
-            env: runtimeEnv(paths),
-        });
-        checks.push(["Database migrations", migrations.status === 0]);
+        const invocation = prismaMigrateInvocation("status", runtimeEnv(paths));
+        if (!invocation.local)
+            console.log(FETCH_NOTICE);
+        const migrations = runPrismaMigrateInvocation(invocation, paths.projectDir);
+        checks.push([
+            "Database migrations",
+            migrations.status === 0,
+            migrations.status === 0 ? undefined : migrateFailureReason(migrations),
+        ]);
     }
     let failed = false;
     for (const [name, ok, detail] of checks) {

package/dist/quickstart/migrate.d.ts

@@ -0,0 +1,23 @@
+export declare const PRISMA_CLI_VERSION = "7.10.0";
+export declare const FETCH_NOTICE = "Fetching the Prisma CLI (prisma@7.10.0)\u2026";
+export declare const REGISTRY_FAILURE_MESSAGE: string;
+export declare const migrateConfigFile: string;
+export interface MigrateResult {
+    status: number;
+    stdout: string;
+    stderr: string;
+    registryFailure?: boolean;
+}
+export interface MigrateInvocation {
+    command: string;
+    args: string[];
+    env: NodeJS.ProcessEnv;
+    local: boolean;
+}
+export declare function parseLocalPrismaVersion(stdout: string): string | undefined;
+export declare function probeLocalPrismaVersion(env: NodeJS.ProcessEnv): string | undefined;
+export declare function prismaMigrateInvocation(subcommand: "deploy" | "status", env: NodeJS.ProcessEnv, probe?: (env: NodeJS.ProcessEnv) => string | undefined): MigrateInvocation;
+export declare function classifyMigrateResult(result: MigrateResult, spawnError?: Error, local?: boolean): MigrateResult;
+export declare function migrateFailureReason(result: MigrateResult): string;
+export declare function runPrismaMigrateInvocation(invocation: MigrateInvocation, cwd: string): MigrateResult;
+export declare function runPrismaMigrate(subcommand: "deploy" | "status", env: NodeJS.ProcessEnv, cwd: string, probe?: (env: NodeJS.ProcessEnv) => string | undefined): MigrateResult;

package/dist/quickstart/migrate.js

@@ -0,0 +1,125 @@
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+// The installed npm package does not carry the Prisma CLI (a devDependency:
+// its tree pulled advisories into every consumer install), so quickstart and
+// doctor first look for a `prisma` executable on PATH and use it only if it
+// reports exactly this version; anything else -- wrong version, not on PATH,
+// a spawn error, a non-zero exit, or a timeout -- falls back to running the
+// pinned version through npx, with a config file shipped in the package.
+// Keep this equal to package.json's devDependencies.prisma (migrate.test.ts
+// enforces it).
+//
+// Not supported on Windows: npx is `npx.cmd` there (and a local install would
+// be `prisma.cmd`), which spawnSync can only run through a shell, and
+// quickstart has no win32 handling anywhere else (Docker Compose paths,
+// POSIX file modes) either.
+export const PRISMA_CLI_VERSION = "7.10.0";
+export const FETCH_NOTICE = `Fetching the Prisma CLI (prisma@${PRISMA_CLI_VERSION})…`;
+export const REGISTRY_FAILURE_MESSAGE = `Could not download the Prisma CLI (prisma@${PRISMA_CLI_VERSION}) from the npm registry. ` +
+    "quickstart and doctor fetch it on demand. Check your internet connection or npm registry settings " +
+    "(.npmrc, proxy), then retry. You can also install it yourself " +
+    `(\`npm i -g prisma@${PRISMA_CLI_VERSION}\`) and rerun quickstart -- doctor benefits too.`;
+export const migrateConfigFile = fileURLToPath(new URL("../../prisma/migrate.config.mjs", import.meta.url));
+// A short timeout so a wedged or misbehaving local binary can't stall
+// quickstart/doctor -- any hang past this falls back to npx.
+const LOCAL_PRISMA_PROBE_TIMEOUT_MS = 5000;
+// `prisma --version` prints a fixed-label, padded-column report, e.g.:
+//   prisma               : 7.10.0
+//   @prisma/client       : 7.10.0
+//   Operating System     : darwin
+//   ...
+// Several other lines carry their own version-shaped numbers (Node.js,
+// TypeScript, the schema engine hash), so key off the "prisma" label
+// specifically -- not the first x.y.z token anywhere in the output.
+const LOCAL_VERSION_LINE = /^prisma\s*:\s*(\S+)$/m;
+export function parseLocalPrismaVersion(stdout) {
+    return LOCAL_VERSION_LINE.exec(stdout)?.[1];
+}
+// Runs a local `prisma --version` under the given env's PATH and returns the
+// version it reports, or undefined for anything that isn't a clean match:
+// not on PATH, a spawn error, a non-zero exit, a timeout, or unparseable
+// output. Never throws.
+export function probeLocalPrismaVersion(env) {
+    const result = spawnSync("prisma", ["--version"], {
+        env,
+        encoding: "utf8",
+        stdio: "pipe",
+        timeout: LOCAL_PRISMA_PROBE_TIMEOUT_MS,
+    });
+    if (result.error || result.status !== 0)
+        return undefined;
+    return parseLocalPrismaVersion(result.stdout ?? "");
+}
+// DATABASE_URL travels in the child's environment only -- never argv, where
+// any local user could read it from the process table. `probe` is injectable
+// so tests never depend on the developer's real PATH.
+export function prismaMigrateInvocation(subcommand, env, probe = probeLocalPrismaVersion) {
+    const childEnv = {
+        ...env,
+        PRISMA_HIDE_UPDATE_MESSAGE: "1",
+        npm_config_update_notifier: "false",
+        npm_config_fund: "false",
+    };
+    if (probe(childEnv) === PRISMA_CLI_VERSION) {
+        return {
+            command: "prisma",
+            args: ["migrate", subcommand, "--config", migrateConfigFile],
+            env: childEnv,
+            local: true,
+        };
+    }
+    return {
+        command: "npx",
+        args: ["--yes", `prisma@${PRISMA_CLI_VERSION}`, "migrate", subcommand, "--config", migrateConfigFile],
+        env: childEnv,
+        local: false,
+    };
+}
+// npm's own error lines when it cannot fetch a package (npm 7+ prints
+// "npm error", older "npm ERR!"): network failures and registry HTTP / version
+// errors. A failed migration is printed by Prisma itself and never carries
+// these -- in particular a database ECONNREFUSED is Prisma's P1001, not an
+// "npm error code" line.
+const REGISTRY_ERROR = /^npm (?:error|ERR!) (?:code|errno) (?:ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ETARGET|E[45]\d\d)\b|^npm (?:error|ERR!) network /m;
+// `local` marks that `result`/`spawnError` came from the locally installed
+// binary rather than npx: nothing was fetched, so neither an npm-shaped
+// error line nor a spawn error is a registry failure there -- a spawn error
+// still gets a clear message (below), just not that one.
+export function classifyMigrateResult(result, spawnError, local = false) {
+    if (spawnError) {
+        if (local)
+            return { ...result, status: 1, stderr: spawnError.message };
+        return { ...result, status: 1, stderr: spawnError.message, registryFailure: true };
+    }
+    if (!local && result.status !== 0 && REGISTRY_ERROR.test(result.stderr))
+        return { ...result, registryFailure: true };
+    return result;
+}
+// The one-line reason for a failed run: the registry message, or Prisma's own
+// first error line (URLs masked, though Prisma prints host and database only).
+export function migrateFailureReason(result) {
+    if (result.registryFailure)
+        return REGISTRY_FAILURE_MESSAGE;
+    const lines = `${result.stderr}\n${result.stdout}`
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    // A line that starts with "Error", or that carries a Prisma error code anywhere.
+    const line = lines.find((candidate) => candidate.startsWith("Error") || /\bP\d{4}\b/.test(candidate)) ?? lines[0] ?? "no output";
+    return line.replace(/postgres(ql)?:\/\/[^\s`'"]+/gi, "<database url>");
+}
+// Runs an already-resolved invocation (from `prismaMigrateInvocation`). Split
+// out so callers can decide whether to print `FETCH_NOTICE` -- which only
+// applies to the npx path -- before running it.
+export function runPrismaMigrateInvocation(invocation, cwd) {
+    const result = spawnSync(invocation.command, invocation.args, {
+        cwd,
+        env: invocation.env,
+        encoding: "utf8",
+        stdio: "pipe",
+    });
+    return classifyMigrateResult({ status: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" }, result.error, invocation.local);
+}
+export function runPrismaMigrate(subcommand, env, cwd, probe) {
+    return runPrismaMigrateInvocation(prismaMigrateInvocation(subcommand, env, probe), cwd);
+}