@prisma/cli 8.0.0-rc.15-dev.109 → 8.0.0-rc.15-dev.111

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineConfigSection, defineSessionCommand, detectCI, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineConfigSection, defineSessionCommand, detectCI, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, realpathOr, resolveSectionOverChain, telemetryCommandGroup } from "@prisma/cli-engine";
 import { createComposerFamily } from "@prisma/composer-cli/family";
 import { ormCommandFamily } from "@prisma/orm-toolchain/cli";
 import { CliStructuredError, notOk, ok } from "@prisma/cli-engine/protocol";
@@ -16,7 +16,7 @@ import events from "node:events";
 import http from "node:http";
 import readline from "node:readline/promises";
 import open from "open";
-import { existsSync, fstatSync, readFileSync, statSync } from "node:fs";
+import { fstatSync, readFileSync, statSync } from "node:fs";
 import { PnpmTool, YarnTool } from "@manypkg/tools";
 import { Result, TaggedError, UnhandledException, matchError } from "better-result";
 import { execFile, fork, spawn } from "node:child_process";
@@ -2212,6 +2212,28 @@ async function isFile(target) {
 	}
 }
 //#endregion
+//#region src/lib/version.ts
+const requireFromHere = createRequire(import.meta.url);
+/** The bundled entry sits one directory below the package root
+*  (`dist/cli.js`); this source file sits two below (`src/lib/`). Both
+*  are tried, nearest first, so the same code serves either. */
+const PACKAGE_JSON_CANDIDATES = ["../package.json", "../../package.json"];
+function readPackageMetadata() {
+	for (const candidate of PACKAGE_JSON_CANDIDATES) try {
+		const metadata = requireFromHere(candidate);
+		if (metadata.version) return metadata;
+	} catch {}
+	return {};
+}
+function getCliVersion() {
+	const pkg = readPackageMetadata();
+	if (!pkg.version) throw new Error("CLI version metadata is missing from the installed package: the bundled package.json could not be read or did not contain a version field. Reinstall the CLI from the npm registry, or check your install path is intact.");
+	return pkg.version;
+}
+function getCliName() {
+	return CLI_NAME;
+}
+//#endregion
 //#region src/commands/skills/config.ts
 const DEFAULT = {
 	check: true,
@@ -2288,31 +2310,34 @@ function validateAgents(raw) {
 		agents
 	};
 }
+/** The disk loader bound the way the bin's Runtime binds it, for
+*  callers with no Runtime in scope (the post-login tip). */
+function projectConfigLoader(cwd) {
+	return (configPath) => loadConfig(cwd, configPath, getCliVersion());
+}
 /**
-* The validated skills section of an already-loaded config, or null
-* when the section does not validate. Used by code that runs outside a
-* command handler (the staleness check, the post-login tip), which has
-* no ctx.config.
+* The project's skills settings, resolved per key over the discovered
+* config chain exactly as the skills commands resolve them, so callers
+* that run outside a command handler (the staleness check, the
+* post-login tip) agree with the commands on the governing config from
+* any directory. `load` is Runtime.loadConfig wherever a Runtime is in
+* scope, so a host-supplied loader governs these reads too. Chain
+* discovery is stat-only until a file exists, so a project without a
+* config never pays a TypeScript transpile.
 *
-* Null deliberately collapses "no config" and "config invalid": both
-* callers fall back to the default agent set, so a broken config never
-* silences the check. The commands that consume the config surface the
-* validation error themselves.
+* Null deliberately collapses "no config" and "config broken or
+* invalid": both callers fall back to the default agent set, so a
+* broken config never silences the check. The commands that consume
+* the config surface the error themselves.
 */
-function readSkillsConfig(loaded) {
-	const section = skillsConfigSection.validate(loaded.sections[SKILLS_CONFIG_SECTION_NAME]);
+async function readProjectSkillsConfig(load, configPath) {
+	const loaded = await load(configPath);
+	if (loaded.diagnostics.some((entry) => entry.diagnostic.severity === "error") || loaded.files.length === 0) return null;
+	const resolved = resolveSectionOverChain(skillsConfigSection, loaded.files);
+	if (!resolved.ok) return null;
+	const section = skillsConfigSection.validate(resolved.value, resolved.provenance);
 	return section.ok ? section.value : null;
 }
-/**
-* The project's skills settings from prisma.config.ts, or null when no
-* config file exists — decided with one stat, so a project without a
-* config never pays the file's TypeScript transpile — or the section
-* does not validate.
-*/
-async function readProjectSkillsConfig(cwd, configPath) {
-	if (!existsSync(configPath === void 0 ? path.join(cwd, "prisma.config.ts") : path.resolve(cwd, configPath))) return null;
-	return readSkillsConfig(await loadConfig(cwd, configPath));
-}
 const skillsConfigSection = defineConfigSection({
 	name: SKILLS_CONFIG_SECTION_NAME,
 	validate: (raw) => {
@@ -2369,7 +2394,7 @@ const SKILLS_SYNC_ARGS = ["skills", "sync"];
 async function resolveAgentSetupTipCommand(ctx) {
 	if (ctx.env.CI) return null;
 	try {
-		const config = await readProjectSkillsConfig(ctx.cwd);
+		const config = await readProjectSkillsConfig(projectConfigLoader(ctx.cwd), ctx.configPath);
 		if (config !== null && !config.check) return null;
 		const status = await readSkillsStatus(ctx.cwd, {
 			orphans: false,
@@ -2388,6 +2413,7 @@ async function resolveAgentSetupTipCommand(ctx) {
 //#endregion
 //#region src/commands/auth/credential-card.ts
 const ENVIRONMENT_CREDENTIAL_NOTICE = `${SERVICE_TOKEN_ENV_VAR} supplies the credential in force; unset it to use your stored workspace sessions.`;
+const UNVERIFIED_CREDENTIAL_NOTICE = "Could not reach Prisma to confirm this sign-in. Showing what the local credential says.";
 /** The card rows for the active credential, or the signed-out row when
 *  there is none. A credential nothing names — an environment token
 *  whose claims carry no workspace — has no workspace row at all. */
@@ -2661,22 +2687,31 @@ const SIGN_IN = {
 *  nothing else bounds a request: a host that accepts the connection
 *  and never answers would otherwise hold the command for minutes. */
 const ENRICHMENT_TIMEOUT_MS = 3e3;
-/** Best-effort online enrichment: whoami works offline, so any failure
-*  leaves the identity as whatever the credential's own claims said. */
+/** Best-effort online enrichment: whoami works offline, so a transient
+*  failure leaves the identity as the credential's own claims said.
+*  CLI.CREDENTIALS_REQUIRED means signed out; AUTH.SERVICE_TOKEN_REJECTED
+*  is rethrown because signing in cannot fix an environment token. */
 async function fetchedIdentity(api, signal) {
 	const bounded = AbortSignal.any([signal, AbortSignal.timeout(ENRICHMENT_TIMEOUT_MS)]);
 	try {
 		const { data } = await api.GET("/v1/me", { signal: bounded });
-		const user = data?.data?.user;
-		if (!user) return;
+		if (data === void 0) return { kind: "inconclusive" };
+		const user = data.data?.user;
 		return {
-			userId: user.id ?? void 0,
-			email: user.email ?? void 0,
-			name: user.name ?? void 0
+			kind: "confirmed",
+			identity: user ? {
+				userId: user.id ?? void 0,
+				email: user.email ?? void 0,
+				name: user.name ?? void 0
+			} : void 0
 		};
-	} catch {
+	} catch (cause) {
 		signal.throwIfAborted();
-		return;
+		if (CliStructuredError.is(cause)) {
+			if (cause.code === "CLI.CREDENTIALS_REQUIRED") return { kind: "signed-out" };
+			if (cause.code === "AUTH.SERVICE_TOKEN_REJECTED") throw cause;
+		}
+		return { kind: "inconclusive" };
 	}
 }
 /**
@@ -2717,6 +2752,11 @@ function presentationsFor(spec, result) {
 				kind: "summary",
 				status: "info",
 				text: ENVIRONMENT_CREDENTIAL_NOTICE
+			}] : [],
+			...result.authenticated && !result.verified ? [{
+				kind: "summary",
+				status: "info",
+				text: UNVERIFIED_CREDENTIAL_NOTICE
 			}] : []
 		],
 		stdout: () => rows.map((row) => `${row.label}: ${row.value}`),
@@ -2730,10 +2770,13 @@ const authWhoamiCommand = defineCommand({
 		examples: ["auth whoami", "auth whoami --json"]
 	},
 	handler: async (_args, ctx) => {
-		const credential = await ctx.activeCredential();
-		const identity = credential === null ? null : mergedIdentity(credential.identity, await fetchedIdentity(ctx.api, ctx.signal));
+		const active = await ctx.activeCredential();
+		const lookup = active === null ? void 0 : await fetchedIdentity(ctx.api, ctx.signal);
+		const credential = lookup?.kind === "signed-out" ? null : active;
+		const identity = credential === null ? null : mergedIdentity(credential.identity, lookup?.kind === "confirmed" ? lookup.identity : void 0);
 		const result = {
 			authenticated: credential !== null,
+			verified: credential !== null && lookup?.kind === "confirmed",
 			workspace: credential === null || credential.workspaceId === void 0 ? null : {
 				id: credential.workspaceId,
 				name: credential.workspaceName ?? null
@@ -5053,28 +5096,6 @@ function unreadableBodyDetail(error) {
 	return isTimeout(error) ? TIMEOUT_DETAIL : "The feedback service response could not be read.";
 }
 //#endregion
-//#region src/lib/version.ts
-const requireFromHere = createRequire(import.meta.url);
-/** The bundled entry sits one directory below the package root
-*  (`dist/cli.js`); this source file sits two below (`src/lib/`). Both
-*  are tried, nearest first, so the same code serves either. */
-const PACKAGE_JSON_CANDIDATES = ["../package.json", "../../package.json"];
-function readPackageMetadata() {
-	for (const candidate of PACKAGE_JSON_CANDIDATES) try {
-		const metadata = requireFromHere(candidate);
-		if (metadata.version) return metadata;
-	} catch {}
-	return {};
-}
-function getCliVersion() {
-	const pkg = readPackageMetadata();
-	if (!pkg.version) throw new Error("CLI version metadata is missing from the installed package: the bundled package.json could not be read or did not contain a version field. Reinstall the CLI from the npm registry, or check your install path is intact.");
-	return pkg.version;
-}
-function getCliName() {
-	return CLI_NAME;
-}
-//#endregion
 //#region src/commands/feedback.ts
 const DEFAULT_FEEDBACK_ENDPOINT = "https://hiieirp2pwqnjvq9axzyg6d0.fra.prisma.build/feedback";
 const MAX_MESSAGE_LENGTH = 4e3;
@@ -6272,6 +6293,39 @@ async function syncSkillsStep(cwd, agents, checkEnabledByConfig) {
 		};
 	}
 }
+/** Whether some file on the resolved chain sits in a strict ancestor
+*  directory of cwd. A config in cwd itself does not count, and neither
+*  does one reached sideways (--config to a file elsewhere) — the spec
+*  defers only to an ancestor config. The chain is the one the needs
+*  check loaded before the handler ran, so init's own scaffold never
+*  counts either. Realpath'd on both sides so symlinked layouts compare
+*  like with like. */
+function governedByAncestorConfig(files, cwd) {
+	const here = realpathOr(cwd);
+	return files.some((file) => {
+		const relative = path.relative(realpathOr(path.dirname(file.path)), here);
+		return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+	});
+}
+const ANCESTOR_SKIPPED_POSTINSTALL = {
+	report: {
+		outcome: "skipped",
+		reason: "governing-config",
+		script: null,
+		dependency: "skipped"
+	},
+	lines: [summary("info", "Skipped the postinstall hook and the prisma dev dependency: another prisma.config.ts already governs this directory, so both belong at the repository root. Pass --postinstall to add them here anyway.")],
+	diagnostics: []
+};
+const ANCESTOR_SKIPPED_SKILLS = {
+	report: {
+		outcome: "skipped",
+		reason: "governing-config",
+		sync: null
+	},
+	lines: [summary("info", "Skipped the skills sync: another prisma.config.ts already governs this directory, so the skills belong at the repository root. Pass --skills with your agents to sync them here anyway.")],
+	diagnostics: []
+};
 const SKIPPED_POSTINSTALL = {
 	report: {
 		outcome: "skipped",
@@ -6327,6 +6381,11 @@ function parseSkillsFlag(raw, configured) {
 		agents
 	};
 }
+async function postinstallStep(flag, deferToAncestor, cwd) {
+	if (flag === false) return SKIPPED_POSTINSTALL;
+	if (deferToAncestor && flag === void 0) return ANCESTOR_SKIPPED_POSTINSTALL;
+	return addPostinstallHook(cwd);
+}
 function initPresentations(result, postinstall, config, skills) {
 	return {
 		json: () => result,
@@ -6345,7 +6404,7 @@ function initPresentations(result, postinstall, config, skills) {
 const initCommand = defineCommand({
 	help: {
 		summary: "Prepare this repository for Prisma: config file, dev dependency, AI-agent skills",
-		description: "Runs locally and calls no platform API. Adds a postinstall script to package.json that keeps the Prisma agent skills in sync on every install, adds prisma to devDependencies at this CLI's exact version when no dependency field declares it, scaffolds a prisma.config.ts recording which agents to install skills for, then syncs the skills once now. Everything lands in the current directory; a prisma.config.ts or postinstall script that already exists is never edited. Rerunning is safe: each step reports what is already done.",
+		description: "Runs locally and calls no platform API. Adds a postinstall script to package.json that keeps the Prisma agent skills in sync on every install, adds prisma to devDependencies at this CLI's exact version when no dependency field declares it, scaffolds a prisma.config.ts recording which agents to install skills for, then syncs the skills once now. Everything lands in the current directory; a prisma.config.ts or postinstall script that already exists is never edited. Rerunning is safe: each step reports what is already done. In a directory another prisma.config.ts already governs, init writes only the prisma.config.ts scaffold — the postinstall hook, the prisma dev dependency, and the skills sync belong at the repository root and are skipped unless --postinstall or --skills asks for them here.",
 		examples: [
 			"init",
 			"init --skills=claude,cursor",
@@ -6364,9 +6423,13 @@ const initCommand = defineCommand({
 	handler: async (args, ctx) => {
 		const skillsFlag = parseSkillsFlag(args.flags.skills, ctx.config.agents);
 		if (skillsFlag.kind === "invalid") return notOk(skillsFlag.error);
-		const postinstall = args.flags.postinstall === false ? SKIPPED_POSTINSTALL : await addPostinstallHook(ctx.cwd);
+		const deferToAncestor = governedByAncestorConfig(ctx.configFiles, ctx.cwd);
+		const postinstall = await postinstallStep(args.flags.postinstall, deferToAncestor, ctx.cwd);
 		const config = await scaffoldConfigStep(ctx.cwd, skillsFlag.kind === "skip" ? [] : skillsFlag.agents, ctx.config.agentsConfigured);
-		const skills = skillsFlag.kind === "skip" ? SKIPPED_SKILLS : await syncSkillsStep(ctx.cwd, skillsFlag.agents, ctx.config.check);
+		let skills;
+		if (skillsFlag.kind === "skip") skills = SKIPPED_SKILLS;
+		else if (deferToAncestor && args.flags.skills === void 0) skills = ANCESTOR_SKIPPED_SKILLS;
+		else skills = await syncSkillsStep(ctx.cwd, skillsFlag.agents, ctx.config.check);
 		const result = {
 			postinstall: postinstall.report,
 			config: config.report,
@@ -14482,6 +14545,21 @@ function outputStreamsShareDevice() {
 		return;
 	}
 }
+/** One chain discovery and transpile per config path per process: a
+*  command's needs check and the skills staleness check both load the
+*  config, and the process is single-shot, so nothing invalidates. The
+*  promise is cached, not the value, so concurrent calls coalesce. */
+function memoizedConfigLoader(proc) {
+	const loads = /* @__PURE__ */ new Map();
+	return (configPath) => {
+		let load = loads.get(configPath);
+		if (load === void 0) {
+			load = loadConfig(proc.cwd(), configPath, getCliVersion());
+			loads.set(configPath, load);
+		}
+		return load;
+	};
+}
 async function assembleRuntime(proc) {
 	const stdin = {
 		setRawMode: proc.stdin.isTTY === true && proc.stdin.setRawMode !== void 0 ? (enabled) => {
@@ -14515,7 +14593,7 @@ async function assembleRuntime(proc) {
 		outputStreamsShareDevice: outputStreamsShareDevice(),
 		exit: (code) => proc.exit(code),
 		onSignal: makeOnSignal(proc),
-		loadConfig: (configPath) => loadConfig(proc.cwd(), configPath, getCliVersion()),
+		loadConfig: memoizedConfigLoader(proc),
 		credentialManager: new FileCredentialManager({
 			env: proc.env,
 			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl),
@@ -14554,7 +14632,7 @@ async function maybeWriteSkillsStaleNotice(runtime) {
 			checkDisabled: false
 		});
 		if (status.upToDate) return;
-		const config = await readProjectSkillsConfig(runtime.cwd, configPathFromArgv(runtime.argv));
+		const config = await readProjectSkillsConfig(runtime.loadConfig, configPathFromArgv(runtime.argv));
 		if (config !== null && !config.check) return;
 		const agents = config?.agents ?? DEFAULT_AGENTS;
 		if (agents.length === 0) return;
@@ -14631,8 +14709,8 @@ function isSuppressedByInvocation(runtime) {
 function isFormat(tokens, format) {
 	return tokens.some((token, index) => token === `--format=${format}` || token === "--format" && tokens[index + 1] === format);
 }
-/** The file an explicit --config names, so the check reads the same
-*  config the command did. Discovery is otherwise cwd-only. */
+/** The file an explicit --config names, so the check anchors the same
+*  chain the command did. Discovery otherwise anchors at cwd. */
 function configPathFromArgv(argv) {
 	const tokens = flagTokens(argv);
 	for (let index = 0; index < tokens.length; index += 1) {
@@ -14863,7 +14941,8 @@ async function main(proc, buildCliForRun = buildCli) {
 		argv: proc.argv.slice(2),
 		cwd: proc.cwd(),
 		stdout: proc.stdout,
-		stderr: proc.stderr
+		stderr: proc.stderr,
+		loadConfig: runtime.loadConfig
 	});
 	return exitCode;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "8.0.0-rc.15-dev.109",
+  "version": "8.0.0-rc.15-dev.111",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -40,11 +40,11 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@manypkg/tools": "^2.1.2",
-    "@prisma/cli-engine": "0.4.0",
-    "@prisma/composer-cli": "0.20.0-dev.6",
+    "@prisma/cli-engine": "0.5.0",
+    "@prisma/composer-cli": "0.21.0-dev.2",
     "@prisma/compute-sdk": "0.42.0",
     "@prisma/management-api-sdk": "1.69.0",
-    "@prisma/orm-toolchain": "8.0.0-rc.11-dev.22",
+    "@prisma/orm-toolchain": "8.0.0-rc.11-dev.37",
     "@vercel/detect-agent": "^1.2.3",
     "better-result": "^2.9.2",
     "cross-spawn": "^7.0.6",
@@ -53,11 +53,11 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@prisma/composer": "0.20.0-dev.6",
+    "@prisma/composer": "0.21.0-dev.2",
     "@prisma/credentials-store": "^7.8.0",
-    "@repo/cli-conformance": "8.0.0-rc.15-dev.109",
-    "@repo/cli-telemetry": "8.0.0-rc.15-dev.109",
-    "@repo/tsconfig": "8.0.0-rc.15-dev.109",
+    "@repo/cli-conformance": "8.0.0-rc.15-dev.111",
+    "@repo/cli-telemetry": "8.0.0-rc.15-dev.111",
+    "@repo/tsconfig": "8.0.0-rc.15-dev.111",
     "@types/node": "^22.19.19",
     "@types/cross-spawn": "^6.0.6",
     "tsdown": "^0.21.10",