@prisma/cli 3.0.0-beta.3 → 3.0.0-beta.30

package/dist/lib/app/production-deploy-gate.js

@@ -0,0 +1,162 @@
+import { CliError } from "../../shell/errors.js";
+import { canPrompt } from "../../shell/runtime.js";
+import { confirmPrompt } from "../../shell/prompt.js";
+//#region src/lib/app/production-deploy-gate.ts
+async function enforceProductionDeployGate(context, provider, options) {
+	if (options.branchKind !== "production") return { firstProductionDeploy: false };
+	if (!options.appId) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return { firstProductionDeploy: true };
+	}
+	const currentLiveDeployment = resolveCurrentProductionDeployment(await provider.listDeployments(options.appId).catch((error) => {
+		throw productionDeployInspectionFailedError(error);
+	}));
+	if (!currentLiveDeployment) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return { firstProductionDeploy: true };
+	}
+	if (!options.prod) throw productionDeployRequiresFlagError();
+	if (context.flags.yes) {
+		renderProductionDeployYesLine(context);
+		return { firstProductionDeploy: false };
+	}
+	if (!canPrompt(context)) throw productionDeployConfirmationRequiredError(options.appName);
+	renderProductionDeployConfirmation(context, currentLiveDeployment);
+	if (!await confirmPrompt({
+		input: context.runtime.stdin,
+		output: context.output.stderr,
+		signal: context.runtime.signal,
+		message: "Deploy to production?",
+		initialValue: false
+	})) throw productionDeployCancelledError();
+	return { firstProductionDeploy: false };
+}
+function resolveCurrentProductionDeployment(result) {
+	if (result.deployments.length === 0) return null;
+	if (result.app.liveDeploymentId) {
+		const live = result.deployments.find((deployment) => deployment.id === result.app.liveDeploymentId);
+		if (live) return live;
+	}
+	return result.deployments.find((deployment) => deployment.live === true) ?? result.deployments[0] ?? null;
+}
+function renderFirstProductionDeployLine(context, appName) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write(`First deploy of "${appName}" -- promoting to production.\n\n`);
+}
+function renderProductionDeployYesLine(context) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write("Deploying to production (--prod --yes).\n\n");
+}
+function renderProductionDeployConfirmation(context, currentLiveDeployment) {
+	if (context.flags.json || context.flags.quiet) return;
+	const lines = [
+		"This will deploy to production and replace the live deployment.",
+		"",
+		`  Current live:  ${currentLiveDeployment.id} deployed ${formatDeploymentAge(currentLiveDeployment.createdAt)}`,
+		"  New deploy:    will be built from your local code",
+		""
+	];
+	context.output.stderr.write(`${lines.join("\n")}\n`);
+}
+function formatDeploymentAge(createdAt) {
+	const createdAtMs = Date.parse(createdAt);
+	if (!Number.isFinite(createdAtMs)) return createdAt;
+	const elapsedMs = Math.max(0, Date.now() - createdAtMs);
+	for (const unit of [
+		{
+			label: "day",
+			ms: 1440 * 60 * 1e3
+		},
+		{
+			label: "hour",
+			ms: 3600 * 1e3
+		},
+		{
+			label: "minute",
+			ms: 60 * 1e3
+		}
+	]) if (elapsedMs >= unit.ms) {
+		const value = Math.floor(elapsedMs / unit.ms);
+		return `${value} ${unit.label}${value === 1 ? "" : "s"} ago`;
+	}
+	return "less than a minute ago";
+}
+function productionDeployRequiresFlagError() {
+	return new CliError({
+		code: "PROD_DEPLOY_REQUIRES_FLAG",
+		domain: "app",
+		summary: "Production deploy requires --prod",
+		why: "The resolved Branch is production and this App already has a production deployment.",
+		fix: "Re-run with --prod, or deploy from a preview Branch.",
+		exitCode: 2,
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production",
+			command: "prisma-cli app deploy --prod"
+		}, {
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Create a preview branch",
+			commands: ["git checkout -b <branch-name>", "prisma-cli app deploy"]
+		}],
+		humanLines: [
+			"This would deploy to production.",
+			"",
+			"Production deploys require explicit intent. Re-run with:",
+			"",
+			"  prisma-cli app deploy --prod",
+			"",
+			"Or deploy a preview from a feature branch:",
+			"",
+			"  git checkout -b <branch-name>",
+			"  prisma-cli app deploy"
+		]
+	});
+}
+function productionDeployConfirmationRequiredError(appName) {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy requires confirmation in the current mode",
+		why: "This command cannot prompt for production deploy confirmation in the current mode.",
+		fix: `Pass --prod --yes to confirm deployment of "${appName}" to production.`,
+		exitCode: 1,
+		nextSteps: ["prisma-cli app deploy --prod --yes"],
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production non-interactively",
+			command: "prisma-cli app deploy --prod --yes"
+		}]
+	});
+}
+function productionDeployCancelledError() {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy cancelled",
+		why: null,
+		fix: null,
+		exitCode: 0,
+		humanLines: ["Cancelled."]
+	});
+}
+function productionDeployInspectionFailedError(error) {
+	return new CliError({
+		code: "DEPLOY_FAILED",
+		domain: "app",
+		summary: "Failed to inspect production deployments",
+		why: error instanceof Error ? error.message : String(error),
+		fix: "Retry the command, or rerun with --trace for more detailed diagnostics.",
+		debug: formatDebugDetails(error),
+		exitCode: 1,
+		nextSteps: ["prisma-cli app list-deploys"]
+	});
+}
+function formatDebugDetails(error) {
+	if (error instanceof Error) return error.stack ?? error.message;
+	return typeof error === "string" ? error : null;
+}
+//#endregion
+export { enforceProductionDeployGate };

package/dist/lib/app/read-branch.js

@@ -0,0 +1,30 @@
+//#region src/lib/app/read-branch.ts
+/**
+* Resolves the branch an app management command should read from, without ever
+* creating one. Returns the branch whose `gitName` matches `branchName`, else
+* the project's default branch, else null when the project has no branches.
+*/
+async function resolveReadBranch(client, options) {
+	const branches = [];
+	let cursor;
+	do {
+		const result = await client.GET("/v1/projects/{projectId}/branches", {
+			params: {
+				path: { projectId: options.projectId },
+				query: { cursor }
+			},
+			signal: options.signal
+		});
+		if (result.error || !result.data) throw new Error(`Failed to list branches for project ${options.projectId}: ${JSON.stringify(result.error)}`);
+		branches.push(...result.data.data);
+		cursor = result.data.pagination.hasMore ? result.data.pagination.nextCursor ?? void 0 : void 0;
+	} while (cursor);
+	const chosen = branches.find((branch) => branch.gitName === options.branchName) ?? branches.find((branch) => branch.isDefault) ?? null;
+	return chosen ? {
+		id: chosen.id,
+		name: chosen.gitName,
+		kind: chosen.role
+	} : null;
+}
+//#endregion
+export { resolveReadBranch };

package/dist/lib/auth/auth-ops.js

@@ -26,7 +26,7 @@ function workspaceIdFromClaims(claims) {
 }
 async function performLogin(env, signal) {
 	await login({
-		tokenStorage: new FileTokenStorage(env, signal),
+		tokenStorage: new FileTokenStorage(env, signal, { activateOnSetTokens: true }),
 		env,
 		signal
 	});
@@ -38,7 +38,8 @@ async function readAuthState(env, signal) {
 		if (serviceToken.length === 0) throw new Error(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
 		return readServiceTokenAuthState(serviceToken, env, signal);
 	}
-	const tokens = await new FileTokenStorage(env, signal).getTokens();
+	const tokenStorage = new FileTokenStorage(env, signal);
+	const tokens = await tokenStorage.getTokens();
 	if (!tokens) return {
 		authenticated: false,
 		provider: null,
@@ -48,15 +49,20 @@ async function readAuthState(env, signal) {
 	};
 	const client = await requireComputeAuth(env, signal);
 	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
-	if (currentPrincipal) return currentPrincipal;
+	if (currentPrincipal) {
+		if (currentPrincipal.authenticated && currentPrincipal.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, currentPrincipal.workspace);
+		return currentPrincipal;
+	}
 	const claims = decodeJwtPayload(tokens.accessToken);
-	return buildAuthState({
+	const authState = await buildAuthState({
 		workspaceIdFromCredential: tokens.workspaceId,
 		claims,
 		env,
 		client,
 		signal
 	});
+	if (authState.authenticated && authState.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, authState.workspace);
+	return authState;
 }
 async function readServiceTokenAuthState(token, env, signal) {
 	const client = await requireComputeAuth(env, signal);

package/dist/lib/auth/guard.js

@@ -22,7 +22,10 @@ async function requireComputeAuth(env = process.env, signal) {
 			token
 		});
 	}
-	const tokenStorage = new FileTokenStorage(env, signal);
+	const tokenStorage = new FileTokenStorage(env, signal, {
+		activateOnSetTokens: false,
+		lockSetTokens: false
+	});
 	if (!await tokenStorage.getTokens()) return null;
 	return createManagementApiSdk({
 		clientId: CLIENT_ID,

package/dist/lib/auth/login.js

@@ -1,7 +1,7 @@
 import { getApiBaseUrl } from "./client.js";
 import { FileTokenStorage } from "../../adapters/token-storage.js";
-import open from "open";
 import { AuthError, createManagementApiSdk } from "@prisma/management-api-sdk";
+import open from "open";
 import events from "node:events";
 import http from "node:http";
 import readline from "node:readline/promises";
@@ -106,35 +106,42 @@ async function consumePastedCallback(options) {
 	});
 	try {
 		for (;;) {
-			let answer;
-			try {
-				answer = await rl.question("Paste the callback URL here: ", { signal: options.signal });
-			} catch (error) {
-				if (error?.name === "AbortError") return;
-				throw error;
-			}
-			const trimmed = answer.trim().replace(/^["']|["']$/g, "");
-			let url;
-			try {
-				if (!trimmed) throw new Error("empty input");
-				url = new URL(trimmed);
-			} catch {
-				options.output.write("That didn't look like a URL. Paste the full localhost callback URL and try again.\n");
-				continue;
-			}
-			try {
-				await options.complete(url);
-				return;
-			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				options.output.write(`Sign-in didn't complete (${message}). Paste the callback URL to try again.\n`);
-				continue;
-			}
+			const url = await readPastedCallbackUrl(rl, options);
+			if (url === null) return;
+			if (url === void 0) continue;
+			if (await tryCompletePastedCallback(url, options)) return;
 		}
 	} finally {
 		rl.close();
 	}
 }
+async function readPastedCallbackUrl(rl, options) {
+	let answer;
+	try {
+		answer = await rl.question("Paste the callback URL here: ", { signal: options.signal });
+	} catch (error) {
+		if (error?.name === "AbortError") return null;
+		throw error;
+	}
+	const trimmed = answer.trim().replace(/^["']|["']$/g, "");
+	try {
+		if (!trimmed) throw new Error("empty input");
+		return new URL(trimmed);
+	} catch {
+		options.output.write("That didn't look like a URL. Paste the full localhost callback URL and try again.\n");
+		return;
+	}
+}
+async function tryCompletePastedCallback(url, options) {
+	try {
+		await options.complete(url);
+		return true;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		options.output.write(`Sign-in didn't complete (${message}). Paste the callback URL to try again.\n`);
+		return false;
+	}
+}
 var LoginState = class {
 	latestVerifier;
 	latestState;
@@ -144,7 +151,7 @@ var LoginState = class {
 	output;
 	constructor(options) {
 		this.options = options;
-		this.tokenStorage = options.tokenStorage ?? new FileTokenStorage(options.env, options.signal);
+		this.tokenStorage = options.tokenStorage ?? new FileTokenStorage(options.env, options.signal, { activateOnSetTokens: true });
 		this.sdk = createManagementApiSdk({
 			clientId: options.clientId ?? "cmm3lndn701oo0uefvxzo0ivw",
 			redirectUri: `http://${options.hostname}:${options.port}/auth/callback`,

package/dist/lib/auth/recipient.js

@@ -0,0 +1,42 @@
+import { getApiBaseUrl } from "./client.js";
+import { FileTokenStorage } from "../../adapters/token-storage.js";
+import { createManagementApiSdk } from "@prisma/management-api-sdk";
+//#region src/lib/auth/recipient.ts
+var RecipientSessionInvalidError = class extends Error {
+	constructor(workspaceRef) {
+		super(`The stored session for workspace "${workspaceRef}" could not be validated.`);
+		this.workspaceRef = workspaceRef;
+		this.name = "RecipientSessionInvalidError";
+	}
+};
+/**
+* Resolve a locally stored OAuth workspace session and return a validated
+* access token for it, refreshing through the SDK when the stored token has
+* expired. The active workspace pointer is never touched.
+*
+* Throws WorkspaceSelectionError when the ref does not match exactly one
+* stored session, and RecipientSessionInvalidError when the session cannot
+* be validated or refreshed.
+*/
+async function resolveRecipientWorkspaceSession(workspaceRef, env = process.env, signal) {
+	const workspace = await new FileTokenStorage(env, signal).resolveWorkspace(workspaceRef);
+	const pinnedStorage = new FileTokenStorage(env, signal, {
+		activateOnSetTokens: false,
+		lockSetTokens: false,
+		pinnedWorkspaceId: workspace.credentialWorkspaceId
+	});
+	if ((await createManagementApiSdk({
+		clientId: "cmm3lndn701oo0uefvxzo0ivw",
+		redirectUri: "http://localhost:0/auth/callback",
+		tokenStorage: pinnedStorage,
+		apiBaseUrl: getApiBaseUrl(env)
+	}).client.GET("/v1/workspaces", { signal })).error) throw new RecipientSessionInvalidError(workspaceRef);
+	const tokens = await pinnedStorage.getTokens();
+	if (!tokens) throw new RecipientSessionInvalidError(workspaceRef);
+	return {
+		workspace,
+		accessToken: tokens.accessToken
+	};
+}
+//#endregion
+export { RecipientSessionInvalidError, resolveRecipientWorkspaceSession };

package/dist/lib/bucket/provider.js

@@ -0,0 +1,139 @@
+import { CliError } from "../../shell/errors.js";
+//#region src/lib/bucket/provider.ts
+function createManagementBucketProvider(client) {
+	return {
+		async listBuckets(options) {
+			const buckets = [];
+			let cursor;
+			while (true) {
+				const result = await client.GET("/v1/buckets", {
+					params: { query: {
+						projectId: options.projectId,
+						branchGitName: options.branchName,
+						cursor
+					} },
+					signal: options.signal
+				});
+				if (result.error || !result.data) throw bucketApiError("Failed to list buckets", result.response, result.error);
+				const data = result.data;
+				buckets.push(...data.data);
+				if (!data.pagination.hasMore || !data.pagination.nextCursor) break;
+				cursor = data.pagination.nextCursor;
+			}
+			return buckets.map(normalizeBucket);
+		},
+		async createBucket(options) {
+			const result = await client.POST("/v1/buckets", {
+				body: {
+					projectId: options.projectId,
+					...options.name ? { name: options.name } : {},
+					...options.branchGitName ? { branchGitName: options.branchGitName } : {}
+				},
+				signal: options.signal
+			});
+			if (result.error || !result.data) throw bucketApiError("Failed to create bucket", result.response, result.error);
+			const data = result.data;
+			return normalizeBucket(data.data);
+		},
+		async deleteBucket(bucketId, options) {
+			const result = await client.DELETE("/v1/buckets/{bucketId}", {
+				params: { path: { bucketId } },
+				signal: options?.signal
+			});
+			if (result.error) throw bucketApiError("Failed to delete bucket", result.response, result.error);
+		},
+		async listKeys(bucketId, options) {
+			const keys = [];
+			let cursor;
+			while (true) {
+				const result = await client.GET("/v1/buckets/{bucketId}/keys", {
+					params: {
+						path: { bucketId },
+						query: { cursor }
+					},
+					signal: options?.signal
+				});
+				if (result.error || !result.data) throw bucketApiError("Failed to list bucket keys", result.response, result.error);
+				const data = result.data;
+				keys.push(...data.data);
+				if (!data.pagination.hasMore || !data.pagination.nextCursor) break;
+				cursor = data.pagination.nextCursor;
+			}
+			return keys.map(normalizeKey);
+		},
+		async createKey(options) {
+			const result = await client.POST("/v1/buckets/{bucketId}/keys", {
+				params: { path: { bucketId: options.bucketId } },
+				body: {
+					role: options.role,
+					...options.name ? { name: options.name } : {}
+				},
+				signal: options.signal
+			});
+			if (result.error || !result.data) throw bucketApiError("Failed to create bucket key", result.response, result.error);
+			const raw = result.data.data;
+			const secretAccessKey = raw.secretAccessKey;
+			const accessKeyId = raw.accessKeyId;
+			const endpoint = raw.endpoint;
+			const bucketName = raw.bucketName;
+			if (!secretAccessKey || !accessKeyId || !endpoint || !bucketName) throw new CliError({
+				code: "BUCKET_KEY_SECRET_MISSING",
+				domain: "bucket",
+				summary: "Created bucket key did not return credentials",
+				why: "Bucket key credentials are one-time-view secrets, but the Management API did not include them in this create response.",
+				fix: "Create another bucket key and store the returned credentials immediately.",
+				exitCode: 1,
+				nextSteps: [`prisma-cli bucket key create ${options.bucketId}`]
+			});
+			return {
+				key: normalizeKey(raw),
+				secretAccessKey,
+				accessKeyId,
+				endpoint,
+				bucketName
+			};
+		},
+		async deleteKey(bucketId, keyId, options) {
+			const result = await client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", {
+				params: { path: {
+					bucketId,
+					keyId
+				} },
+				signal: options?.signal
+			});
+			if (result.error) throw bucketApiError("Failed to delete bucket key", result.response, result.error);
+		}
+	};
+}
+function normalizeBucket(raw) {
+	return {
+		id: raw.id,
+		name: raw.name,
+		status: raw.status,
+		branchId: raw.branchId,
+		createdAt: raw.createdAt
+	};
+}
+function normalizeKey(raw) {
+	return {
+		id: raw.id,
+		name: raw.name,
+		role: raw.role,
+		valueHint: raw.valueHint,
+		createdAt: raw.createdAt
+	};
+}
+function bucketApiError(summary, response, error) {
+	const status = response?.status ?? 0;
+	return new CliError({
+		code: error?.error?.code ?? "BUCKET_API_ERROR",
+		domain: "bucket",
+		summary,
+		why: error?.error?.message ?? `The Management API returned status ${status || "unknown"}.`,
+		fix: error?.error?.hint ?? "Re-run with --trace for the underlying API response details.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+//#endregion
+export { createManagementBucketProvider, normalizeBucket, normalizeKey };