@prisma/cli 3.0.0-dev.53.1 → 3.0.0-dev.56.1

package/dist/lib/app/preview-provider.js

@@ -19,7 +19,10 @@ function createPreviewAppProvider(client, options) {
 	const sdk = new ComputeClient(client);
 	return {
 		async createProject(options) {
-			const projectResult = await sdk.createProject({ name: options.name });
+			const projectResult = await sdk.createProject({
+				name: options.name,
+				signal: options.signal
+			});
 			if (projectResult.isErr()) throw new Error(projectResult.error.message);
 			return {
 				id: projectResult.value.id,
@@ -29,17 +32,34 @@ function createPreviewAppProvider(client, options) {
 		async listApps(projectId, options) {
 			return listComputeServices(client, {
 				projectId,
-				branchGitName: options?.branchName
+				branchGitName: options?.branchName,
+				signal: options?.signal
 			});
 		},
-		async removeApp(appId) {
-			const appResult = await sdk.showService({ serviceId: appId });
+		async resolveBranch(projectId, options) {
+			const branch = await resolveOrCreateBranch(client, {
+				projectId,
+				gitName: options.branchName,
+				signal: options.signal
+			});
+			return {
+				id: branch.id,
+				name: branch.gitName,
+				role: branch.role
+			};
+		},
+		async removeApp(appId, options) {
+			const appResult = await sdk.showService({
+				serviceId: appId,
+				signal: options?.signal
+			});
 			if (appResult.isErr()) throw new Error(appResult.error.message);
 			const destroyResult = await sdk.destroyService({
 				serviceId: appId,
 				keepService: false,
 				timeoutSeconds: 120,
-				pollIntervalMs: 2e3
+				pollIntervalMs: 2e3,
+				signal: options?.signal
 			});
 			if (destroyResult.isErr()) throw new Error(destroyResult.error.message);
 			return {
@@ -47,17 +67,18 @@ function createPreviewAppProvider(client, options) {
 				name: appResult.value.name
 			};
 		},
-		async listDomains(appId) {
-			return listComputeServiceDomains(client, appId);
+		async listDomains(appId, options) {
+			return listComputeServiceDomains(client, appId, options?.signal);
 		},
 		async addDomain(options) {
 			const result = await client.POST("/v1/compute-services/{computeServiceId}/domains", {
 				params: { path: { computeServiceId: options.appId } },
-				body: { hostname: options.hostname }
+				body: { hostname: options.hostname },
+				signal: options.signal
 			});
 			if (result.error || !result.data) {
 				if (result.response.status === 409) {
-					const existing = (await listComputeServiceDomains(client, options.appId)).find((domain) => sameHostname(domain.hostname, options.hostname));
+					const existing = (await listComputeServiceDomains(client, options.appId, options.signal)).find((domain) => sameHostname(domain.hostname, options.hostname));
 					if (existing) return {
 						domain: existing,
 						existing: true
@@ -70,17 +91,26 @@ function createPreviewAppProvider(client, options) {
 				existing: false
 			};
 		},
-		async showDomain(domainId) {
-			const result = await client.GET("/v1/domains/{domainId}", { params: { path: { domainId } } });
+		async showDomain(domainId, options) {
+			const result = await client.GET("/v1/domains/{domainId}", {
+				params: { path: { domainId } },
+				signal: options?.signal
+			});
 			if (result.error || !result.data) throw domainApiCallError("Failed to show custom domain", result.response, result.error);
 			return normalizeDomainRecord(result.data.data);
 		},
-		async removeDomain(domainId) {
-			const result = await client.DELETE("/v1/domains/{domainId}", { params: { path: { domainId } } });
+		async removeDomain(domainId, options) {
+			const result = await client.DELETE("/v1/domains/{domainId}", {
+				params: { path: { domainId } },
+				signal: options?.signal
+			});
 			if (result.error) throw domainApiCallError("Failed to remove custom domain", result.response, result.error);
 		},
-		async retryDomain(domainId) {
-			const result = await client.POST("/v1/domains/{domainId}/retry", { params: { path: { domainId } } });
+		async retryDomain(domainId, options) {
+			const result = await client.POST("/v1/domains/{domainId}/retry", {
+				params: { path: { domainId } },
+				signal: options?.signal
+			});
 			if (result.error || !result.data) throw domainApiCallError("Failed to retry custom domain", result.response, result.error);
 			return normalizeDomainRecord(result.data.data);
 		},
@@ -90,6 +120,7 @@ function createPreviewAppProvider(client, options) {
 				versionId: options.deploymentId,
 				timeoutSeconds: 120,
 				pollIntervalMs: 2e3,
+				signal: options.signal,
 				progress: options.progress
 			});
 			if (promoteResult.isErr()) throw new Error(promoteResult.error.message);
@@ -103,7 +134,8 @@ function createPreviewAppProvider(client, options) {
 				projectId: options.projectId,
 				branchName: options.branchName,
 				appName: options.appName,
-				region: options.region
+				region: options.region,
+				signal: options.signal
 			}) : {
 				appId: void 0,
 				appName: options.appName,
@@ -113,7 +145,8 @@ function createPreviewAppProvider(client, options) {
 				strategy: new PreviewBuildStrategy({
 					appPath: path.resolve(options.cwd),
 					entrypoint: options.entrypoint,
-					buildType: options.buildType
+					buildType: options.buildType,
+					signal: options.signal
 				}),
 				projectId: options.projectId,
 				serviceId: resolvedApp.appId,
@@ -124,6 +157,7 @@ function createPreviewAppProvider(client, options) {
 				timeoutSeconds: 120,
 				pollIntervalMs: 2e3,
 				interaction: options.interaction,
+				signal: options.signal,
 				progress: options.progress
 			});
 			if (deployResult.isErr()) throw new Error(deployResult.error.message);
@@ -150,6 +184,7 @@ function createPreviewAppProvider(client, options) {
 				envVars: options.envVars,
 				timeoutSeconds: 120,
 				pollIntervalMs: 2e3,
+				signal: options.signal,
 				progress: options.progress
 			});
 			if (updateResult.isErr()) throw new Error(updateResult.error.message);
@@ -158,10 +193,17 @@ function createPreviewAppProvider(client, options) {
 				versionId: updateResult.value.versionId,
 				timeoutSeconds: 120,
 				pollIntervalMs: 2e3,
+				signal: options.signal,
 				progress: options.promoteProgress
 			});
 			if (promoteResult.isErr()) throw new Error(promoteResult.error.message);
-			const [serviceResult, versionResult] = await Promise.all([sdk.showService({ serviceId: options.appId }), sdk.showVersion({ versionId: updateResult.value.versionId })]);
+			const [serviceResult, versionResult] = await Promise.all([sdk.showService({
+				serviceId: options.appId,
+				signal: options.signal
+			}), sdk.showVersion({
+				versionId: updateResult.value.versionId,
+				signal: options.signal
+			})]);
 			if (serviceResult.isErr()) throw new Error(serviceResult.error.message);
 			if (versionResult.isErr()) throw new Error(versionResult.error.message);
 			return {
@@ -184,7 +226,13 @@ function createPreviewAppProvider(client, options) {
 			};
 		},
 		async listAppEnvNames(options) {
-			const [serviceResult, versionResult] = await Promise.all([sdk.showService({ serviceId: options.appId }), sdk.showVersion({ versionId: options.deploymentId })]);
+			const [serviceResult, versionResult] = await Promise.all([sdk.showService({
+				serviceId: options.appId,
+				signal: options.signal
+			}), sdk.showVersion({
+				versionId: options.deploymentId,
+				signal: options.signal
+			})]);
 			if (serviceResult.isErr()) throw new Error(serviceResult.error.message);
 			if (versionResult.isErr()) throw new Error(versionResult.error.message);
 			return {
@@ -206,8 +254,14 @@ function createPreviewAppProvider(client, options) {
 				variables: envVarNames(versionResult.value.envVars)
 			};
 		},
-		async listDeployments(appId) {
-			const [appResult, versionsResult] = await Promise.all([sdk.showService({ serviceId: appId }), sdk.listVersions({ serviceId: appId })]);
+		async listDeployments(appId, options) {
+			const [appResult, versionsResult] = await Promise.all([sdk.showService({
+				serviceId: appId,
+				signal: options?.signal
+			}), sdk.listVersions({
+				serviceId: appId,
+				signal: options?.signal
+			})]);
 			if (appResult.isErr()) throw new Error(appResult.error.message);
 			if (versionsResult.isErr()) throw new Error(versionsResult.error.message);
 			return {
@@ -230,14 +284,17 @@ function createPreviewAppProvider(client, options) {
 				}))
 			};
 		},
-		async showDeployment(deploymentId) {
-			const deploymentResult = await sdk.showVersion({ versionId: deploymentId });
+		async showDeployment(deploymentId, options) {
+			const deploymentResult = await sdk.showVersion({
+				versionId: deploymentId,
+				signal: options?.signal
+			});
 			if (deploymentResult.isErr()) {
 				if (ApiError.is(deploymentResult.error) && deploymentResult.error.statusCode === 404) return null;
 				throw new Error(deploymentResult.error.message);
 			}
 			return {
-				app: await findAppForDeployment(sdk, deploymentId),
+				app: await findAppForDeployment(sdk, deploymentId, options?.signal),
 				deployment: {
 					id: deploymentResult.value.id,
 					status: deploymentResult.value.status,
@@ -263,22 +320,28 @@ function createPreviewAppProvider(client, options) {
 	};
 }
 async function listBranches(client, options) {
-	const result = await client.GET("/v1/projects/{projectId}/branches", { params: {
-		path: { projectId: options.projectId },
-		query: { gitName: options.gitName }
-	} });
+	const result = await client.GET("/v1/projects/{projectId}/branches", {
+		params: {
+			path: { projectId: options.projectId },
+			query: { gitName: options.gitName }
+		},
+		signal: options.signal
+	});
 	if (result.error || !result.data) throw apiCallError("Failed to list branches", result.response, result.error);
-	return result.data.data;
+	return result.data.data.map((branch) => ({
+		id: branch.id,
+		gitName: branch.gitName,
+		isDefault: branch.isDefault,
+		role: branch.role
+	}));
 }
 async function resolveOrCreateBranch(client, options) {
 	const existing = (await listBranches(client, options))[0];
 	if (existing) return existing;
 	const result = await client.POST("/v1/projects/{projectId}/branches", {
 		params: { path: { projectId: options.projectId } },
-		body: {
-			gitName: options.gitName,
-			isDefault: options.gitName === "main"
-		}
+		body: { gitName: options.gitName },
+		signal: options.signal
 	});
 	if (result.error || !result.data) {
 		if (result.response.status === 409) {
@@ -287,17 +350,26 @@ async function resolveOrCreateBranch(client, options) {
 		}
 		throw apiCallError(`Failed to create branch "${options.gitName}"`, result.response, result.error);
 	}
-	return result.data.data;
+	const branch = result.data.data;
+	return {
+		id: branch.id,
+		gitName: branch.gitName,
+		isDefault: branch.isDefault,
+		role: branch.role
+	};
 }
 async function listComputeServices(client, options) {
 	const services = [];
 	let cursor;
 	while (true) {
-		const result = await client.GET("/v1/compute-services", { params: { query: {
-			projectId: options.projectId,
-			branchGitName: options.branchGitName,
-			cursor
-		} } });
+		const result = await client.GET("/v1/compute-services", {
+			params: { query: {
+				projectId: options.projectId,
+				branchGitName: options.branchGitName,
+				cursor
+			} },
+			signal: options.signal
+		});
 		if (result.error || !result.data) throw apiCallError("Failed to list apps", result.response, result.error);
 		services.push(...result.data.data);
 		if (!result.data.pagination.hasMore || !result.data.pagination.nextCursor) break;
@@ -312,8 +384,11 @@ async function listComputeServices(client, options) {
 		liveUrl: toAbsoluteUrl(service.serviceEndpointDomain ?? null)
 	}));
 }
-async function listComputeServiceDomains(client, computeServiceId) {
-	const result = await client.GET("/v1/compute-services/{computeServiceId}/domains", { params: { path: { computeServiceId } } });
+async function listComputeServiceDomains(client, computeServiceId, signal) {
+	const result = await client.GET("/v1/compute-services/{computeServiceId}/domains", {
+		params: { path: { computeServiceId } },
+		signal
+	});
 	if (result.error || !result.data) throw domainApiCallError("Failed to list custom domains", result.response, result.error);
 	return result.data.data.map((domain) => normalizeDomainRecord(domain));
 }
@@ -355,19 +430,24 @@ function normalizeHostnameForComparison(hostname) {
 async function createBranchApp(client, options) {
 	const branch = await resolveOrCreateBranch(client, {
 		projectId: options.projectId,
-		gitName: options.branchName
+		gitName: options.branchName,
+		signal: options.signal
+	});
+	const result = await client.POST("/v1/compute-services", {
+		body: {
+			projectId: options.projectId,
+			branchId: branch.id,
+			displayName: options.appName,
+			...options.region ? { regionId: options.region } : {}
+		},
+		signal: options.signal
 	});
-	const result = await client.POST("/v1/compute-services", { body: {
-		projectId: options.projectId,
-		branchId: branch.id,
-		displayName: options.appName,
-		...options.region ? { regionId: options.region } : {}
-	} });
 	if (result.error || !result.data) {
 		if (result.response.status === 409) {
 			const matched = (await listComputeServices(client, {
 				projectId: options.projectId,
-				branchGitName: options.branchName
+				branchGitName: options.branchName,
+				signal: options.signal
 			})).find((app) => app.name === options.appName);
 			if (matched) return {
 				appId: matched.id,
@@ -399,14 +479,20 @@ function domainApiCallError(summary, response, error) {
 		hint: error.error?.hint ?? null
 	});
 }
-async function findAppForDeployment(sdk, deploymentId) {
-	const projectsResult = await sdk.listProjects();
+async function findAppForDeployment(sdk, deploymentId, signal) {
+	const projectsResult = await sdk.listProjects({ signal });
 	if (projectsResult.isErr()) throw new Error(projectsResult.error.message);
 	for (const project of projectsResult.value) {
-		const servicesResult = await sdk.listServices({ projectId: project.id });
+		const servicesResult = await sdk.listServices({
+			projectId: project.id,
+			signal
+		});
 		if (servicesResult.isErr()) throw new Error(servicesResult.error.message);
 		for (const service of servicesResult.value) {
-			const detailResult = await sdk.showService({ serviceId: service.id });
+			const detailResult = await sdk.showService({
+				serviceId: service.id,
+				signal
+			});
 			if (detailResult.isErr()) throw new Error(detailResult.error.message);
 			const app = {
 				id: detailResult.value.id,
@@ -416,7 +502,10 @@ async function findAppForDeployment(sdk, deploymentId) {
 				liveUrl: toAbsoluteUrl(detailResult.value.serviceEndpointDomain ?? null)
 			};
 			if (app.liveDeploymentId === deploymentId) return app;
-			const versionsResult = await sdk.listVersions({ serviceId: service.id });
+			const versionsResult = await sdk.listVersions({
+				serviceId: service.id,
+				signal
+			});
 			if (versionsResult.isErr()) throw new Error(versionsResult.error.message);
 			if (versionsResult.value.some((version) => version.id === deploymentId)) return app;
 		}

package/dist/lib/app/production-deploy-gate.js

@@ -0,0 +1,160 @@
+import { CliError } from "../../shell/errors.js";
+import { canPrompt } from "../../shell/runtime.js";
+import { confirmPrompt } from "../../shell/prompt.js";
+//#region src/lib/app/production-deploy-gate.ts
+async function enforceProductionDeployGate(context, provider, options) {
+	if (options.branchKind !== "production") return;
+	if (!options.appId) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return;
+	}
+	const currentLiveDeployment = resolveCurrentProductionDeployment(await provider.listDeployments(options.appId).catch((error) => {
+		throw productionDeployInspectionFailedError(error);
+	}));
+	if (!currentLiveDeployment) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return;
+	}
+	if (!options.prod) throw productionDeployRequiresFlagError();
+	if (context.flags.yes) {
+		renderProductionDeployYesLine(context);
+		return;
+	}
+	if (!canPrompt(context)) throw productionDeployConfirmationRequiredError(options.appName);
+	renderProductionDeployConfirmation(context, currentLiveDeployment);
+	if (!await confirmPrompt({
+		input: context.runtime.stdin,
+		output: context.output.stderr,
+		message: "Deploy to production?",
+		initialValue: false
+	})) throw productionDeployCancelledError();
+}
+function resolveCurrentProductionDeployment(result) {
+	if (result.deployments.length === 0) return null;
+	if (result.app.liveDeploymentId) {
+		const live = result.deployments.find((deployment) => deployment.id === result.app.liveDeploymentId);
+		if (live) return live;
+	}
+	return result.deployments.find((deployment) => deployment.live === true) ?? result.deployments[0] ?? null;
+}
+function renderFirstProductionDeployLine(context, appName) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write(`First deploy of "${appName}" -- promoting to production.\n\n`);
+}
+function renderProductionDeployYesLine(context) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write("Deploying to production (--prod --yes).\n\n");
+}
+function renderProductionDeployConfirmation(context, currentLiveDeployment) {
+	if (context.flags.json || context.flags.quiet) return;
+	const lines = [
+		"This will deploy to production and replace the live deployment.",
+		"",
+		`  Current live:  ${currentLiveDeployment.id} deployed ${formatDeploymentAge(currentLiveDeployment.createdAt)}`,
+		"  New deploy:    will be built from your local code",
+		""
+	];
+	context.output.stderr.write(`${lines.join("\n")}\n`);
+}
+function formatDeploymentAge(createdAt) {
+	const createdAtMs = Date.parse(createdAt);
+	if (!Number.isFinite(createdAtMs)) return createdAt;
+	const elapsedMs = Math.max(0, Date.now() - createdAtMs);
+	for (const unit of [
+		{
+			label: "day",
+			ms: 1440 * 60 * 1e3
+		},
+		{
+			label: "hour",
+			ms: 3600 * 1e3
+		},
+		{
+			label: "minute",
+			ms: 60 * 1e3
+		}
+	]) if (elapsedMs >= unit.ms) {
+		const value = Math.floor(elapsedMs / unit.ms);
+		return `${value} ${unit.label}${value === 1 ? "" : "s"} ago`;
+	}
+	return "less than a minute ago";
+}
+function productionDeployRequiresFlagError() {
+	return new CliError({
+		code: "PROD_DEPLOY_REQUIRES_FLAG",
+		domain: "app",
+		summary: "Production deploy requires --prod",
+		why: "The resolved Branch is production and this App already has a production deployment.",
+		fix: "Re-run with --prod, or deploy from a preview Branch.",
+		exitCode: 2,
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production",
+			command: "prisma-cli app deploy --prod"
+		}, {
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Create a preview branch",
+			commands: ["git checkout -b <branch-name>", "prisma-cli app deploy"]
+		}],
+		humanLines: [
+			"This would deploy to production.",
+			"",
+			"Production deploys require explicit intent. Re-run with:",
+			"",
+			"  prisma app deploy --prod",
+			"",
+			"Or deploy a preview from a feature branch:",
+			"",
+			"  git checkout -b <branch-name>",
+			"  prisma app deploy"
+		]
+	});
+}
+function productionDeployConfirmationRequiredError(appName) {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy requires confirmation in the current mode",
+		why: "This command cannot prompt for production deploy confirmation in the current mode.",
+		fix: `Pass --prod --yes to confirm deployment of "${appName}" to production.`,
+		exitCode: 1,
+		nextSteps: ["prisma-cli app deploy --prod --yes"],
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production non-interactively",
+			command: "prisma-cli app deploy --prod --yes"
+		}]
+	});
+}
+function productionDeployCancelledError() {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy cancelled",
+		why: null,
+		fix: null,
+		exitCode: 0,
+		humanLines: ["Cancelled."]
+	});
+}
+function productionDeployInspectionFailedError(error) {
+	return new CliError({
+		code: "DEPLOY_FAILED",
+		domain: "app",
+		summary: "Failed to inspect production deployments",
+		why: error instanceof Error ? error.message : String(error),
+		fix: "Retry the command, or rerun with --trace for more detailed diagnostics.",
+		debug: formatDebugDetails(error),
+		exitCode: 1,
+		nextSteps: ["prisma-cli app list-deploys"]
+	});
+}
+function formatDebugDetails(error) {
+	if (error instanceof Error) return error.stack ?? error.message;
+	return typeof error === "string" ? error : null;
+}
+//#endregion
+export { enforceProductionDeployGate };

package/dist/lib/auth/auth-ops.js

@@ -24,20 +24,21 @@ function workspaceIdFromClaims(claims) {
 	const id = sub.slice(10).trim();
 	return id.length > 0 ? id : null;
 }
-async function performLogin(env) {
+async function performLogin(env, signal) {
 	await login({
-		tokenStorage: new FileTokenStorage(env),
-		env
+		tokenStorage: new FileTokenStorage(env, signal),
+		env,
+		signal
 	});
 }
-async function readAuthState(env) {
+async function readAuthState(env, signal) {
 	const rawServiceToken = env[SERVICE_TOKEN_ENV_VAR];
 	if (rawServiceToken !== void 0) {
 		const serviceToken = rawServiceToken.trim();
 		if (serviceToken.length === 0) throw new Error(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
-		return readServiceTokenAuthState(serviceToken, env);
+		return readServiceTokenAuthState(serviceToken, env, signal);
 	}
-	const tokens = await new FileTokenStorage(env).getTokens();
+	const tokens = await new FileTokenStorage(env, signal).getTokens();
 	if (!tokens) return {
 		authenticated: false,
 		provider: null,
@@ -45,20 +46,21 @@ async function readAuthState(env) {
 		workspace: null,
 		credential: null
 	};
-	const client = await requireComputeAuth(env);
-	const currentPrincipal = await readCurrentPrincipalAuthState(client);
+	const client = await requireComputeAuth(env, signal);
+	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
 	if (currentPrincipal) return currentPrincipal;
 	const claims = decodeJwtPayload(tokens.accessToken);
 	return buildAuthState({
 		workspaceIdFromCredential: tokens.workspaceId,
 		claims,
 		env,
-		client
+		client,
+		signal
 	});
 }
-async function readServiceTokenAuthState(token, env) {
-	const client = await requireComputeAuth(env);
-	const currentPrincipal = await readCurrentPrincipalAuthState(client);
+async function readServiceTokenAuthState(token, env, signal) {
+	const client = await requireComputeAuth(env, signal);
+	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
 	if (currentPrincipal) return currentPrincipal;
 	const claims = decodeJwtPayload(token);
 	const workspaceId = workspaceIdFromClaims(claims);
@@ -73,15 +75,19 @@ async function readServiceTokenAuthState(token, env) {
 		workspaceIdFromCredential: workspaceId,
 		claims,
 		env,
-		client
+		client,
+		signal
 	});
 }
-async function buildAuthState({ workspaceIdFromCredential, claims, env, client }) {
+async function buildAuthState({ workspaceIdFromCredential, claims, env, client, signal }) {
 	let workspaceId = workspaceIdFromCredential;
 	let workspaceName = workspaceIdFromCredential;
-	client ??= await requireComputeAuth(env);
+	client ??= await requireComputeAuth(env, signal);
 	if (client) try {
-		const { data, response } = await client.GET("/v1/workspaces/{id}", { params: { path: { id: workspaceIdFromCredential } } });
+		const { data, response } = await client.GET("/v1/workspaces/{id}", {
+			params: { path: { id: workspaceIdFromCredential } },
+			signal
+		});
 		if (response?.status === 401) return {
 			authenticated: false,
 			provider: null,
@@ -94,7 +100,9 @@ async function buildAuthState({ workspaceIdFromCredential, claims, env, client }
 			workspaceName = data.data.id;
 		}
 		if (data?.data?.name) workspaceName = data.data.name;
-	} catch {}
+	} catch {
+		signal?.throwIfAborted();
+	}
 	const email = emailFromClaims(claims);
 	return {
 		authenticated: true,
@@ -107,10 +115,10 @@ async function buildAuthState({ workspaceIdFromCredential, claims, env, client }
 		credential: null
 	};
 }
-async function readCurrentPrincipalAuthState(client) {
+async function readCurrentPrincipalAuthState(client, signal) {
 	if (!client) return null;
 	try {
-		const { data, response } = await client.GET("/v1/me");
+		const { data, response } = await client.GET("/v1/me", { signal });
 		if (response?.status === 401) return {
 			authenticated: false,
 			provider: null,
@@ -133,11 +141,12 @@ async function readCurrentPrincipalAuthState(client) {
 			credential: principal.credential
 		};
 	} catch {
+		signal?.throwIfAborted();
 		return null;
 	}
 }
-async function performLogout(env) {
-	await new FileTokenStorage(env).clearTokens();
+async function performLogout(env, signal) {
+	await new FileTokenStorage(env, signal).clearTokens();
 }
 //#endregion
 export { performLogin, performLogout, readAuthState };

package/dist/lib/auth/guard.js

@@ -11,7 +11,8 @@ import { createManagementApiClient, createManagementApiSdk } from "@prisma/manag
 *
 * Returns null if not authenticated.
 */
-async function requireComputeAuth(env = process.env) {
+async function requireComputeAuth(env = process.env, signal) {
+	signal?.throwIfAborted();
 	const rawToken = env[SERVICE_TOKEN_ENV_VAR];
 	if (rawToken !== void 0) {
 		const token = rawToken.trim();
@@ -21,7 +22,7 @@ async function requireComputeAuth(env = process.env) {
 			token
 		});
 	}
-	const tokenStorage = new FileTokenStorage(env);
+	const tokenStorage = new FileTokenStorage(env, signal);
 	if (!await tokenStorage.getTokens()) return null;
 	return createManagementApiSdk({
 		clientId: CLIENT_ID,