@prisma/cli 3.0.0-beta.9 → 3.0.0-dev.102.1

package/README.md

@@ -98,19 +98,6 @@ npx prisma-cli app promote <deployment-id>
 - Stable command groups, flags, and error codes for scripts and agents.
 - Environment variable values are not printed back to the terminal.
 
-### Agent skills
-
-For agent-guided Next.js deploys, install the Prisma CLI skill cluster at the
-project level. Match the skill ref to the installed CLI version:
-
-```bash
-npx prisma-cli version
-pnpm dlx skills@latest add prisma/prisma-cli/skills#cli-v<cli-version> --all
-```
-
-The skills teach agents how to prepare a Next.js app, run `app deploy`, verify
-the result, and route CLI / Compute feedback to the right Prisma channel.
-
 ---
 
 ## Beta notes

package/dist/adapters/token-storage.js

@@ -1,9 +1,22 @@
 import { getAuthFilePath } from "../lib/auth/client.js";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { CredentialsStore } from "@prisma/credentials-store";
 import { randomUUID } from "node:crypto";
+import { CredentialsStore } from "@prisma/credentials-store";
 //#region src/adapters/token-storage.ts
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const EMPTY_AUTH_CONTEXT = {
+	activeWorkspaceId: null,
+	workspaces: {}
+};
+const UNKNOWN_WORKSPACE_NAME = "Unknown workspace";
+function getAuthContextFilePath(authFilePath) {
+	const extension = path.extname(authFilePath);
+	if (!extension) return `${authFilePath}.context.json`;
+	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
+}
 function findLatestValidTokens(allCredentials) {
 	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
 		const credential = allCredentials[i];
@@ -17,6 +30,18 @@ function findLatestValidTokens(allCredentials) {
 	}
 	return null;
 }
+function storedCredentialToTokens(credential) {
+	if (!credential) return null;
+	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
+	return {
+		workspaceId: credential.workspaceId,
+		accessToken: credential.token,
+		refreshToken: credential.refreshToken
+	};
+}
+function findTokensForWorkspace(allCredentials, workspaceId) {
+	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
+}
 function tokensEqual(a, b) {
 	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
@@ -36,25 +61,44 @@ function sleep(ms, signal) {
 }
 var FileTokenStorage = class {
 	credentialsStore;
+	authFilePath;
+	contextFilePath;
 	lockFilePath;
-	constructor(env = process.env, signal) {
+	constructor(env = process.env, signal, options = {}) {
 		this.signal = signal;
+		this.options = options;
 		const authFilePath = getAuthFilePath(env);
+		this.authFilePath = authFilePath;
+		this.contextFilePath = getAuthContextFilePath(authFilePath);
 		this.credentialsStore = new CredentialsStore(authFilePath);
 		this.lockFilePath = `${authFilePath}.lock`;
 	}
 	async getTokens() {
 		this.signal?.throwIfAborted();
 		try {
-			const all = await this.credentialsStore.getCredentials();
-			this.signal?.throwIfAborted();
-			return findLatestValidTokens(all);
-		} catch (error) {
+			const credentials = await this.readCredentialsFromDisk();
+			const context = await this.readAuthContext();
+			if (context.state.activeWorkspaceId) return findTokensForWorkspace(credentials, context.state.activeWorkspaceId);
+			const latest = findLatestValidTokens(credentials);
+			if (!latest) return null;
+			if (!context.exists) {
+				await this.setActiveWorkspaceId(latest.workspaceId);
+				return latest;
+			}
+			return null;
+		} catch (_error) {
 			if (this.signal?.aborted) throw this.signal.reason;
 			return null;
 		}
 	}
 	async setTokens(tokens) {
+		if (this.options.lockSetTokens === false) {
+			await this.setTokensUnlocked(tokens);
+			return;
+		}
+		await this.withRefreshLock(() => this.setTokensUnlocked(tokens));
+	}
+	async setTokensUnlocked(tokens) {
 		this.signal?.throwIfAborted();
 		await this.credentialsStore.storeCredentials({
 			workspaceId: tokens.workspaceId,
@@ -62,20 +106,119 @@ var FileTokenStorage = class {
 			refreshToken: tokens.refreshToken
 		});
 		this.signal?.throwIfAborted();
+		await this.rememberWorkspaceUnlocked(tokens.workspaceId, {
+			id: tokens.workspaceId,
+			name: tokens.workspaceId
+		});
+		await this.maybeActivateWorkspaceId(tokens.workspaceId);
 	}
 	async clearTokens() {
+		await this.withRefreshLock(() => this.clearTokensUnlocked());
+	}
+	async clearTokensUnlocked() {
 		this.signal?.throwIfAborted();
-		const all = await this.credentialsStore.getCredentials();
+		await fs.mkdir(path.dirname(this.authFilePath), { recursive: true });
 		this.signal?.throwIfAborted();
-		const tokens = findLatestValidTokens(all);
-		if (!tokens) return;
-		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await fs.writeFile(this.authFilePath, `${JSON.stringify({ tokens: [] }, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		await this.clearAuthContext();
+		await this.credentialsStore.reloadCredentialsFromDisk();
 		this.signal?.throwIfAborted();
 	}
 	async clearTokensIfCurrent(tokens) {
 		this.signal?.throwIfAborted();
 		if (!tokensEqual(await this.getTokens(), tokens)) return;
-		await this.clearTokens();
+		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await this.removeRememberedWorkspace(tokens.workspaceId, { preserveActivePointer: true });
+		this.signal?.throwIfAborted();
+	}
+	async listWorkspaces() {
+		this.signal?.throwIfAborted();
+		const credentials = await this.readCredentialsFromDisk();
+		const context = await this.ensureMigratedAuthContext(credentials);
+		return credentials.map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null).map((tokens) => {
+			const cached = context.state.workspaces[tokens.workspaceId];
+			const id = typeof cached?.id === "string" && cached.id.trim().length > 0 ? cached.id.trim() : tokens.workspaceId;
+			const name = typeof cached?.name === "string" && cached.name.trim().length > 0 ? workspaceDisplayName(cached.name.trim(), tokens.workspaceId) : UNKNOWN_WORKSPACE_NAME;
+			const lastSeenAt = typeof cached?.lastSeenAt === "string" && cached.lastSeenAt.trim().length > 0 ? cached.lastSeenAt.trim() : null;
+			return {
+				id,
+				name,
+				credentialWorkspaceId: tokens.workspaceId,
+				active: context.state.activeWorkspaceId === tokens.workspaceId,
+				lastSeenAt
+			};
+		});
+	}
+	async listWorkspaceTokens() {
+		this.signal?.throwIfAborted();
+		return (await this.readCredentialsFromDisk()).map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null);
+	}
+	async useWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.useWorkspaceUnlocked(workspaceRef));
+	}
+	async useWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const previous = workspaces.find((workspace) => workspace.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null;
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const selected = matches[0];
+		await this.setActiveWorkspaceId(selected.credentialWorkspaceId);
+		return {
+			previous,
+			selected
+		};
+	}
+	async logoutWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.logoutWorkspaceUnlocked(workspaceRef));
+	}
+	async logoutWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const workspace = matches[0];
+		const wasActive = context.state.activeWorkspaceId === workspace.credentialWorkspaceId;
+		await this.credentialsStore.deleteCredentials(workspace.credentialWorkspaceId);
+		this.signal?.throwIfAborted();
+		const remainingWorkspaces = workspaces.filter((candidate) => candidate.credentialWorkspaceId !== workspace.credentialWorkspaceId);
+		if (remainingWorkspaces.length === 0) {
+			await this.clearAuthContext();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace: null
+			};
+		}
+		delete context.state.workspaces[workspace.credentialWorkspaceId];
+		if (wasActive) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+		return {
+			workspace,
+			wasActive,
+			activeWorkspace: context.state.activeWorkspaceId === null ? null : remainingWorkspaces.find((candidate) => candidate.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null
+		};
+	}
+	async rememberWorkspace(credentialWorkspaceId, workspace) {
+		await this.withRefreshLock(() => this.rememberWorkspaceUnlocked(credentialWorkspaceId, workspace));
+	}
+	async rememberWorkspaceUnlocked(credentialWorkspaceId, workspace) {
+		const context = await this.readAuthContext();
+		context.state.workspaces[credentialWorkspaceId] = {
+			id: workspace.id,
+			name: workspace.name,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
 	}
 	async withRefreshLock(fn) {
 		const lockId = await this.acquireRefreshLock();
@@ -87,34 +230,48 @@ var FileTokenStorage = class {
 	}
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
+		const startedAt = Date.now();
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
 			this.signal?.throwIfAborted();
-			let lockFileCreated = false;
+			if (await this.tryCreateRefreshLock(lockId)) return lockId;
+			if (await this.releaseStaleRefreshLock()) continue;
+			this.throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs);
+			await sleep(retryMs, this.signal);
+		}
+	}
+	async tryCreateRefreshLock(lockId) {
+		let lockFileCreated = false;
+		try {
+			const handle = await fs.open(this.lockFilePath, "wx");
+			lockFileCreated = true;
 			try {
-				const handle = await fs.open(this.lockFilePath, "wx");
-				lockFileCreated = true;
-				try {
-					this.signal?.throwIfAborted();
-					await handle.writeFile(lockId, { encoding: "utf8" });
-					this.signal?.throwIfAborted();
-				} finally {
-					await handle.close();
-				}
-				return lockId;
-			} catch (error) {
-				if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
-				if (error.code !== "EEXIST") throw error;
-				const staleLockId = await this.getStaleRefreshLockId();
-				if (staleLockId) {
-					await this.releaseRefreshLock(staleLockId);
-					continue;
-				}
-				await sleep(100, this.signal);
+				this.signal?.throwIfAborted();
+				await handle.writeFile(lockId, { encoding: "utf8" });
+				this.signal?.throwIfAborted();
+			} finally {
+				await handle.close();
 			}
+			return true;
+		} catch (error) {
+			if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
+			if (error.code === "EEXIST") return false;
+			throw error;
 		}
 	}
+	async releaseStaleRefreshLock() {
+		const staleLockId = await this.getStaleRefreshLockId();
+		if (!staleLockId) return false;
+		await this.releaseRefreshLock(staleLockId);
+		return true;
+	}
+	throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs) {
+		if (Date.now() - startedAt < waitTimeoutMs) return;
+		throw new RefreshLockTimeoutError(this.lockFilePath, waitTimeoutMs);
+	}
 	async getStaleRefreshLockId() {
 		this.signal?.throwIfAborted();
 		const lockId = await fs.readFile(this.lockFilePath, {
@@ -129,12 +286,133 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		return Date.now() - stats.mtimeMs > 3e4 ? lockId : null;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
 		if (await fs.readFile(this.lockFilePath, { encoding: "utf8" }).catch(() => null) !== lockId) return;
 		await fs.unlink(this.lockFilePath).catch(() => {});
 	}
+	async readCredentialsFromDisk() {
+		this.signal?.throwIfAborted();
+		await this.credentialsStore.reloadCredentialsFromDisk();
+		this.signal?.throwIfAborted();
+		return await this.credentialsStore.getCredentials();
+	}
+	async ensureMigratedAuthContext(credentials) {
+		const context = await this.readAuthContext();
+		if (context.state.activeWorkspaceId || context.exists) return context;
+		const latest = findLatestValidTokens(credentials);
+		if (!latest) return context;
+		context.state.activeWorkspaceId = latest.workspaceId;
+		context.state.workspaces[latest.workspaceId] ??= {
+			id: latest.workspaceId,
+			name: latest.workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+		return {
+			exists: true,
+			state: context.state
+		};
+	}
+	async setActiveWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async maybeActivateWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		if (this.options.activateOnSetTokens === false && context.exists && context.state.activeWorkspaceId && context.state.activeWorkspaceId !== workspaceId) return;
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async removeRememberedWorkspace(workspaceId, options) {
+		const context = await this.readAuthContext();
+		delete context.state.workspaces[workspaceId];
+		if (!options.preserveActivePointer && context.state.activeWorkspaceId === workspaceId) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+	}
+	async readAuthContext() {
+		this.signal?.throwIfAborted();
+		const raw = await fs.readFile(this.contextFilePath, {
+			encoding: "utf8",
+			signal: this.signal
+		}).catch((error) => {
+			if (this.signal?.aborted) throw error;
+			if (error.code === "ENOENT") return null;
+			throw error;
+		});
+		if (raw === null) return {
+			exists: false,
+			state: structuredClone(EMPTY_AUTH_CONTEXT)
+		};
+		try {
+			const parsed = JSON.parse(raw);
+			return {
+				exists: true,
+				state: {
+					activeWorkspaceId: typeof parsed.activeWorkspaceId === "string" && parsed.activeWorkspaceId.trim().length > 0 ? parsed.activeWorkspaceId.trim() : null,
+					workspaces: parsed.workspaces && typeof parsed.workspaces === "object" && !Array.isArray(parsed.workspaces) ? parsed.workspaces : {}
+				}
+			};
+		} catch {
+			return {
+				exists: false,
+				state: structuredClone(EMPTY_AUTH_CONTEXT)
+			};
+		}
+	}
+	async writeAuthContext(state) {
+		this.signal?.throwIfAborted();
+		await fs.mkdir(path.dirname(this.contextFilePath), { recursive: true });
+		this.signal?.throwIfAborted();
+		await fs.writeFile(this.contextFilePath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		this.signal?.throwIfAborted();
+	}
+	async clearAuthContext() {
+		await fs.unlink(this.contextFilePath).catch((error) => {
+			if (error.code === "ENOENT") return;
+			throw error;
+		});
+	}
+};
+var WorkspaceSelectionError = class extends Error {
+	constructor(reason, workspaceRef, matches = []) {
+		super(reason);
+		this.reason = reason;
+		this.workspaceRef = workspaceRef;
+		this.matches = matches;
+		this.name = "WorkspaceSelectionError";
+	}
 };
+var RefreshLockTimeoutError = class extends Error {
+	constructor(lockFilePath, waitTimeoutMs) {
+		super(`Timed out waiting ${waitTimeoutMs}ms for auth refresh lock at ${lockFilePath}`);
+		this.name = "RefreshLockTimeoutError";
+	}
+};
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.credentialWorkspaceId === ref || workspace.id === ref || stripWorkspacePrefix(workspace.credentialWorkspaceId) === stripWorkspacePrefix(ref) || stripWorkspacePrefix(workspace.id) === stripWorkspacePrefix(ref) || workspace.name.toLowerCase() === ref.toLowerCase();
+}
+function stripWorkspacePrefix(value) {
+	return value.startsWith("wksp_") ? value.slice(5) : value;
+}
+function workspaceDisplayName(name, credentialWorkspaceId) {
+	return name === credentialWorkspaceId ? UNKNOWN_WORKSPACE_NAME : name;
+}
 //#endregion
-export { FileTokenStorage };
+export { FileTokenStorage, WorkspaceSelectionError };

package/dist/cli.js

@@ -3,22 +3,22 @@ import { runUpdateDiscoveryWorker } from "./shell/update-check.js";
 import { runCli } from "./cli2.js";
 import process from "node:process";
 //#region src/bin.ts
-if (process.env.PRISMA_CLI_RUN_UPDATE_CHECK_WORKER === "1") runUpdateDiscoveryWorker().then(() => {
+if (process.env.PRISMA_CLI_RUN_UPDATE_CHECK_WORKER === "1") {
+	await runUpdateDiscoveryWorker();
 	process.exitCode = 0;
-});
-else {
+} else {
 	const controller = new AbortController();
 	const abortCli = () => {
 		if (!controller.signal.aborted) controller.abort(new DOMException("Command canceled", "AbortError"));
 	};
 	process.once("SIGINT", abortCli);
 	process.once("SIGTERM", abortCli);
-	runCli({ signal: controller.signal }).then((exitCode) => {
-		process.exitCode = exitCode;
-	}).finally(() => {
+	try {
+		process.exitCode = await runCli({ signal: controller.signal });
+	} finally {
 		process.off("SIGINT", abortCli);
 		process.off("SIGTERM", abortCli);
-	});
+	}
 }
 //#endregion
 export {};

package/dist/cli2.js

@@ -1,10 +1,10 @@
 import { CliError } from "./shell/errors.js";
-import { createShellUi } from "./shell/ui.js";
-import { formatUnexpectedError, writeHumanError, writeJsonError, writeJsonSuccess } from "./shell/output.js";
+import "./shell/prompt.js";
 import { attachCommandDescriptor } from "./shell/command-meta.js";
 import { addCompactGlobalFlags } from "./shell/global-flags.js";
+import { createShellUi } from "./shell/ui.js";
 import { configureRuntimeCommand, createCommandContext } from "./shell/runtime.js";
-import "./shell/prompt.js";
+import { formatUnexpectedError, writeHumanError, writeJsonError, writeJsonSuccess } from "./shell/output.js";
 import { createAppCommand } from "./commands/app/index.js";
 import { createAuthCommand } from "./commands/auth/index.js";
 import { createBranchCommand } from "./commands/branch/index.js";