chore(deps): align Composer with CLI engine 0.6.3

[AmanVarshney01]

Use the published CLI engine 0.6.3, which fixes the ArkType mismatch behind failed orm init / contract emit in fresh installs.

Updates the public family's peer/build pins and the internal CLI and target test dependency together. The private workspace host uses the documented engine override during the release transition; published libraries and generated apps receive no override.

Required for prisma/prisma-cli#332. Engine release: https://github.com/prisma/prisma-cli/actions/runs/37510386018.

Verified:

• Public package and target builds.
• CLI and public family typechecks.
• Engine pin/externality check: one engine shared by the workspace host and family; the library stays engine-free.
• CLI and target unit suites pass; database-backed integration cases without local Postgres remain for CI.
• Lint and frozen offline installation.

This is the dependency update, not the Composer version bump. A subsequent Composer release must publish the new exact peer before the unified CLI can use it.

[prisma-gizmo]

✅ Gizmo reviewed 1ed4591 — posted 0 inline comment(s) this pass.

Open findings: none

Change walkthrough

This PR pins @prisma/cli-engine to the published 0.6.3 across the workspace — the engine release that fixes the ArkType mismatch breaking orm init / contract emit in fresh installs — and adds the temporary root pnpm override that keeps the private workspace host and the Composer family on that single engine copy during the tandem release.

Engine alignment across manifests. All three internal declarations move 0.6.2 → 0.6.3 together: the @internal/cli dependency in packages/0-framework/3-tooling/cli/package.json:23, and the peer plus dev pins in packages/9-public/composer-cli/package.json:28. They stay exact and identical, which is what scripts/check-cli-engine-pin.mjs enforces — the code that imports the engine, the engine the workspace builds against, and the peer consumers must satisfy all name the same release. The target extension's dev pin in packages/1-prisma-cloud/1-extensions/target/package.json:43 follows suit; there the engine is only used by test fixtures that import definePrismaConfig, so it ships no engine relationship.

Workspace-host override. The root package.json:52 adds @prisma/cli-engine: "0.6.3" to pnpm.overrides alongside the existing @prisma/composer-cli: "workspace:*" override. This is the documented transition mechanism: scripts/check-cli-engine-pin-host.mjs states that during a tandem release the root override points the published prisma host (catalog-pinned in pnpm-workspace.yaml) at the workspace engine pin, because the release order is engine → Composer → host and the published host otherwise declares an older engine. The lockfile resolves the host, the family, and @internal/cli to one @prisma/cli-engine@0.6.3 copy, preserving the single-engine invariant the pin check verifies by resolving real paths. The override lives only in the private root manifest, so published tarballs and generated apps see only the declared pins.

Scope. This is the dependency update only — the Composer version bump and the publishing of the new exact peer happen in a follow-up release, after which the unified CLI can consume it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: f89039eb-82cb-494b-b9a0-f1c9190a95cc

📥 Commits

Reviewing files that changed from the base of the PR and between ce98092 and 1ed4591.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• package.json
• packages/0-framework/3-tooling/cli/package.json
• packages/1-prisma-cloud/1-extensions/target/package.json
• packages/9-public/composer-cli/package.json

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Summary by CodeRabbit

• Chores
  • Updated the command-line tooling and related integrations to version 0.6.3, keeping their versions aligned. This maintenance update does not add or remove any user-facing features, and no changes to the app’s visible behavior are noted.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 1ed45

The dependency pins and lockfile are consistent; no identified issue prevents merging after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update to CLI engine 0.6.3, which is the main change.
Description check	✅ Passed	The description explains the CLI engine update, its purpose, the affected dependencies, and reported verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[prisma-gizmo]

New findings: none · trace

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@339

npm i https://pkg.pr.new/@prisma/composer-cli@339

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@339

commit: 1ed4591

[prisma-gizmo]

No critical or major Gizmo finding is open and the head commit has been reviewed. Approving.