@prisma/cli 8.0.0-rc.2-dev.49 → 8.0.0-rc.2-dev.50

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, telemetryCommandGroup } from "@prisma/cli-engine";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
 import { createComposerFamily } from "@prisma/composer/family";
 import { ormCommandFamily } from "@prisma/orm-toolchain/cli";
 import { CliStructuredError, notOk, ok } from "@prisma/cli-engine/protocol";
@@ -848,9 +848,9 @@ function sameWorkspaceId(left, right) {
 }
 //#endregion
 //#region src/auth/token-storage.ts
-const REFRESH_LOCK_RETRY_MS = 100;
-const REFRESH_LOCK_STALE_MS = 3e4;
-const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const REFRESH_LOCK_RETRY_MS$1 = 100;
+const REFRESH_LOCK_STALE_MS$1 = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS$1 = 25e3;
 const EMPTY_AUTH_CONTEXT = {
 	activeWorkspaceId: null,
 	workspaces: {}
@@ -1097,8 +1097,8 @@ var FileTokenStorage = class {
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
 		const startedAt = Date.now();
-		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
-		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS$1;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS$1;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
@@ -1152,7 +1152,7 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS$1;
 		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
@@ -14315,6 +14315,19 @@ const FILE_MODE = 384;
 const LOCK_STALE_MS = 5e3;
 const LOCK_RETRY_MS = 10;
 const LOCK_WAIT_TIMEOUT_MS = 1e4;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 3e4;
+const STATE_LOCK_TIMINGS = {
+	staleMs: LOCK_STALE_MS,
+	retryMs: LOCK_RETRY_MS,
+	waitTimeoutMs: LOCK_WAIT_TIMEOUT_MS
+};
+const REFRESH_LOCK_TIMINGS = {
+	staleMs: REFRESH_LOCK_STALE_MS,
+	retryMs: REFRESH_LOCK_RETRY_MS,
+	waitTimeoutMs: REFRESH_LOCK_WAIT_TIMEOUT_MS
+};
 const EMPTY_STATE = {
 	version: 1,
 	sessions: [],
@@ -14417,9 +14430,9 @@ async function writeCredentialState(filePath, state) {
 	await fs.chmod(filePath, FILE_MODE).catch(() => {});
 }
 var StateLockTimeoutError = class extends CliStructuredError {
-	constructor(lockPath) {
+	constructor(lockPath, waitTimeoutMs) {
 		super("CLI.CREDENTIALS_LOCKED", "Another prisma process is still updating your credentials.", {
-			why: `The credentials lock at ${lockPath} was held for longer than ${LOCK_WAIT_TIMEOUT_MS}ms.`,
+			why: `The credentials lock at ${lockPath} was held for longer than ${waitTimeoutMs}ms.`,
 			nextActions: [{
 				kind: "user-choice",
 				label: "Wait for the other command to finish, then try again."
@@ -14435,8 +14448,20 @@ var StateLockTimeoutError = class extends CliStructuredError {
 * small fixed staleness threshold.
 */
 async function withStateLock(filePath, debug, run) {
-	const lockPath = `${filePath}.lock`;
-	const lockId = await acquireStateLock(lockPath, debug);
+	return withFileLock(`${filePath}.lock`, debug, STATE_LOCK_TIMINGS, run);
+}
+/**
+* The cross-process lock the delegated refresh holds for its whole
+* read → exchange → write sequence, so two processes never spend the
+* same refresh token. Distinct from the state lock: it IS held across
+* network I/O, so its staleness and wait budgets are larger, and it
+* uses its own lock path so short mutations are not queued behind it.
+*/
+async function withRefreshFileLock(filePath, debug, run) {
+	return withFileLock(`${filePath}.refresh-lock`, debug, REFRESH_LOCK_TIMINGS, run);
+}
+async function withFileLock(lockPath, debug, timings, run) {
+	const lockId = await acquireStateLock(lockPath, debug, timings);
 	debug(`lock acquired ${lockPath}`);
 	try {
 		return await run();
@@ -14445,15 +14470,15 @@ async function withStateLock(filePath, debug, run) {
 		debug(`lock released ${lockPath}`);
 	}
 }
-async function acquireStateLock(lockPath, debug) {
+async function acquireStateLock(lockPath, debug, timings) {
 	const lockId = randomUUID();
 	const startedAt = Date.now();
 	await fs.mkdir(path.dirname(lockPath), { recursive: true });
 	while (true) {
 		if (await tryCreateStateLock(lockPath, lockId)) return lockId;
-		const tookOver = await takeOverStaleStateLock(lockPath, debug);
-		if (Date.now() - startedAt >= LOCK_WAIT_TIMEOUT_MS) throw new StateLockTimeoutError(lockPath);
-		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+		const tookOver = await takeOverStaleStateLock(lockPath, debug, timings);
+		if (Date.now() - startedAt >= timings.waitTimeoutMs) throw new StateLockTimeoutError(lockPath, timings.waitTimeoutMs);
+		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, timings.retryMs));
 	}
 }
 async function tryCreateStateLock(lockPath, lockId) {
@@ -14479,10 +14504,10 @@ async function tryCreateStateLock(lockPath, lockId) {
 * then run their read-modify-write at once and one update is lost,
 * which is the very thing the lock exists to prevent.
 */
-async function takeOverStaleStateLock(lockPath, debug) {
+async function takeOverStaleStateLock(lockPath, debug, timings) {
 	const stale = await fs.stat(lockPath).catch(() => null);
 	if (stale === null) return true;
-	if (Date.now() - stale.mtimeMs <= LOCK_STALE_MS) return false;
+	if (Date.now() - stale.mtimeMs <= timings.staleMs) return false;
 	const takenPath = `${lockPath}.${randomUUID()}.stale`;
 	try {
 		await fs.rename(lockPath, takenPath);
@@ -14520,12 +14545,16 @@ function memoryBackedStorage(credential, withRefreshLock) {
 	let tokens = {
 		workspaceId: credentialWorkspaceId(credential.token) ?? NO_WORKSPACE_CLAIMED,
 		accessToken: credential.token,
-		refreshToken: credential.refreshToken
+		refreshToken: credential.refreshToken,
+		expiresAt: claimedExpiresAt(credential.token) ?? credential.expiresAt
 	};
 	return {
 		getTokens: async () => tokens,
-		setTokens: async (rotated) => {
-			tokens = rotated;
+		setTokens: async (rotated, expiresAt) => {
+			tokens = {
+				...rotated,
+				expiresAt: claimedExpiresAt(rotated.accessToken) ?? expiresAt ?? tokens?.expiresAt
+			};
 		},
 		clearTokens: async () => {
 			tokens = null;
@@ -14544,6 +14573,7 @@ var FileCredentialManager = class {
 	#filePath;
 	#debug;
 	#fetchWorkspaceName;
+	#refreshCredential;
 	#pin = { kind: "unresolved" };
 	/** Built for one pinned credential. Every mutation that moves the
 	*  pin discards it, so a command that mutates and then reaches for
@@ -14556,6 +14586,7 @@ var FileCredentialManager = class {
 		this.#filePath = resolveStateFilePath(options.env).filePath;
 		this.#debug = makeDebugLog(options.env, options.debugWrite);
 		this.#fetchWorkspaceName = options.fetchWorkspaceName;
+		this.#refreshCredential = options.refreshCredential;
 		this.#debug(`state file ${this.#filePath}`);
 	}
 	get stateFilePath() {
@@ -14666,14 +14697,13 @@ var FileCredentialManager = class {
 		this.#activeStorage ??= this.#buildActiveStorage();
 		return this.#activeStorage;
 	}
-	/** The spawn path's read: the active credential's access token,
+	/** The delegated path's read: the active credential's access token,
 	*  fresh on every call, never the refresh token. Null when there is
 	*  no active credential to read — storage exists only once
 	*  activeCredential() has returned non-null. */
-	async activeAccessToken() {
+	async activeAccessToken(options) {
 		if (await this.activeCredential() === null) return null;
-		const tokens = await (await this.activeCredentialStorage()).getTokens();
-		return tokens === null ? null : tokens.accessToken;
+		return readActiveAccessToken(await this.activeCredentialStorage(), this.#refreshCredential, options);
 	}
 	/** §11.2: which storage is chosen once, when the pin resolves. Each
 	*  has exactly one source of truth — the file, or process memory. */
@@ -14701,10 +14731,11 @@ var FileCredentialManager = class {
 				return {
 					workspaceId,
 					accessToken: record.token,
-					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken }
+					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken },
+					...record.expiresAt === void 0 ? {} : { expiresAt: new Date(record.expiresAt) }
 				};
 			},
-			setTokens: async (tokens) => {
+			setTokens: async (tokens, expiresAt) => {
 				this.#debug(`rotation write for session ${workspaceId}`);
 				const claimed = credentialWorkspaceId(tokens.accessToken);
 				if (claimed !== void 0 && claimed !== workspaceId) throw credentialWorkspaceMismatchError(workspaceId);
@@ -14716,7 +14747,7 @@ var FileCredentialManager = class {
 						...record.name === void 0 ? {} : { name: record.name },
 						token: tokens.accessToken,
 						...tokens.refreshToken === void 0 ? {} : { refreshToken: tokens.refreshToken },
-						...expiresAtSlice(tokens.accessToken, void 0)
+						...expiresAtSlice(tokens.accessToken, expiresAt ?? (record.expiresAt === void 0 ? void 0 : new Date(record.expiresAt)))
 					};
 					return {
 						state: {
@@ -14745,7 +14776,7 @@ var FileCredentialManager = class {
 					};
 				});
 			},
-			withRefreshLock: (fn) => this.#withRefreshLock(fn)
+			withRefreshLock: (fn) => this.#withRefreshLock(() => withRefreshFileLock(this.#filePath, this.#debug, fn))
 		};
 	}
 	#withRefreshLock(fn) {
@@ -14881,6 +14912,45 @@ function environmentCredential(token) {
 	};
 }
 //#endregion
+//#region src/auth/refresh.ts
+const TRAILING_SLASH = /\/$/;
+const CREDENTIAL_REFRESH_TIMEOUT_MS = 1e4;
+/** The dumb HTTP adapter behind the engine's delegated-credential policy. */
+function makeCredentialRefresher(authBaseUrl) {
+	const endpoint = `${authBaseUrl.replace(TRAILING_SLASH, "")}/token`;
+	return async ({ refreshToken, signal }) => {
+		signal.throwIfAborted();
+		const refreshSignal = AbortSignal.any([signal, AbortSignal.timeout(CREDENTIAL_REFRESH_TIMEOUT_MS)]);
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			}),
+			signal: refreshSignal
+		});
+		const body = await readBody(response);
+		if (response.status >= 400 && response.status < 500 && body?.error === "invalid_grant") return { kind: "invalid" };
+		if (!response.ok || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string" || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in < 0) throw new Error(`OAuth token refresh failed (status ${String(response.status)})`);
+		return {
+			kind: "success",
+			accessToken: body.access_token,
+			refreshToken: body.refresh_token,
+			expiresAt: new Date(Date.now() + body.expires_in * 1e3)
+		};
+	};
+}
+async function readBody(response) {
+	try {
+		const body = await response.json();
+		return typeof body === "object" && body !== null ? body : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/auth/workspace-name.ts
 /** The manager's injected name lookup: a static-token client over the
 *  credential just minted. The manager constructs no API client and
@@ -15092,6 +15162,7 @@ async function assembleRuntime(proc) {
 	};
 	warnOnDeprecatedStateFileEnvVar(proc);
 	const apiBaseUrl = getApiBaseUrl(proc.env);
+	const authBaseUrl = getAuthBaseUrl(proc.env);
 	return {
 		stdout: { write: (text) => {
 			proc.stdout.write(text);
@@ -15118,13 +15189,14 @@ async function assembleRuntime(proc) {
 		loadConfig: (configPath) => loadConfig(proc.cwd(), configPath),
 		credentialManager: new FileCredentialManager({
 			env: proc.env,
-			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl)
+			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl),
+			refreshCredential: makeCredentialRefresher(authBaseUrl)
 		}),
 		managementApiClientConfig: {
 			clientId: CLIENT_ID,
 			redirectUri: DEFAULT_REDIRECT_URI,
 			apiBaseUrl,
-			authBaseUrl: getAuthBaseUrl(proc.env)
+			authBaseUrl
 		},
 		spawn: spawnChild,
 		/** The engine has already decided and composed; the bin only forks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "8.0.0-rc.2-dev.49",
+  "version": "8.0.0-rc.2-dev.50",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -51,9 +51,9 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@repo/cli-conformance": "8.0.0-rc.2-dev.49",
-    "@repo/cli-telemetry": "8.0.0-rc.2-dev.49",
-    "@repo/tsconfig": "8.0.0-rc.2-dev.49",
+    "@repo/cli-conformance": "8.0.0-rc.2-dev.50",
+    "@repo/cli-telemetry": "8.0.0-rc.2-dev.50",
+    "@repo/tsconfig": "8.0.0-rc.2-dev.50",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "tsx": "^4.22.4",