@prisma/cli 8.0.0-rc.2-dev.49 → 8.0.0-rc.2-dev.51

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, telemetryCommandGroup } from "@prisma/cli-engine";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
 import { createComposerFamily } from "@prisma/composer/family";
 import { ormCommandFamily } from "@prisma/orm-toolchain/cli";
 import { CliStructuredError, notOk, ok } from "@prisma/cli-engine/protocol";
@@ -24,6 +24,8 @@ import { promisify } from "node:util";
 import { ApiError, CancelledError, ComputeClient, normalizeArtifactSymlinks, resolveBuildStrategy, streamLogs } from "@prisma/compute-sdk";
 import { parse } from "dotenv";
 import { fileURLToPath } from "node:url";
+import { Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 //#region src/cli-name.ts
 /**
 * The CLI's user-facing identity, in one place. The npm package is
@@ -848,9 +850,9 @@ function sameWorkspaceId(left, right) {
 }
 //#endregion
 //#region src/auth/token-storage.ts
-const REFRESH_LOCK_RETRY_MS = 100;
-const REFRESH_LOCK_STALE_MS = 3e4;
-const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const REFRESH_LOCK_RETRY_MS$1 = 100;
+const REFRESH_LOCK_STALE_MS$1 = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS$1 = 25e3;
 const EMPTY_AUTH_CONTEXT = {
 	activeWorkspaceId: null,
 	workspaces: {}
@@ -1097,8 +1099,8 @@ var FileTokenStorage = class {
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
 		const startedAt = Date.now();
-		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
-		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS$1;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS$1;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
@@ -1152,7 +1154,7 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS$1;
 		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
@@ -14315,6 +14317,19 @@ const FILE_MODE = 384;
 const LOCK_STALE_MS = 5e3;
 const LOCK_RETRY_MS = 10;
 const LOCK_WAIT_TIMEOUT_MS = 1e4;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 3e4;
+const STATE_LOCK_TIMINGS = {
+	staleMs: LOCK_STALE_MS,
+	retryMs: LOCK_RETRY_MS,
+	waitTimeoutMs: LOCK_WAIT_TIMEOUT_MS
+};
+const REFRESH_LOCK_TIMINGS = {
+	staleMs: REFRESH_LOCK_STALE_MS,
+	retryMs: REFRESH_LOCK_RETRY_MS,
+	waitTimeoutMs: REFRESH_LOCK_WAIT_TIMEOUT_MS
+};
 const EMPTY_STATE = {
 	version: 1,
 	sessions: [],
@@ -14417,9 +14432,9 @@ async function writeCredentialState(filePath, state) {
 	await fs.chmod(filePath, FILE_MODE).catch(() => {});
 }
 var StateLockTimeoutError = class extends CliStructuredError {
-	constructor(lockPath) {
+	constructor(lockPath, waitTimeoutMs) {
 		super("CLI.CREDENTIALS_LOCKED", "Another prisma process is still updating your credentials.", {
-			why: `The credentials lock at ${lockPath} was held for longer than ${LOCK_WAIT_TIMEOUT_MS}ms.`,
+			why: `The credentials lock at ${lockPath} was held for longer than ${waitTimeoutMs}ms.`,
 			nextActions: [{
 				kind: "user-choice",
 				label: "Wait for the other command to finish, then try again."
@@ -14435,8 +14450,20 @@ var StateLockTimeoutError = class extends CliStructuredError {
 * small fixed staleness threshold.
 */
 async function withStateLock(filePath, debug, run) {
-	const lockPath = `${filePath}.lock`;
-	const lockId = await acquireStateLock(lockPath, debug);
+	return withFileLock(`${filePath}.lock`, debug, STATE_LOCK_TIMINGS, run);
+}
+/**
+* The cross-process lock the delegated refresh holds for its whole
+* read → exchange → write sequence, so two processes never spend the
+* same refresh token. Distinct from the state lock: it IS held across
+* network I/O, so its staleness and wait budgets are larger, and it
+* uses its own lock path so short mutations are not queued behind it.
+*/
+async function withRefreshFileLock(filePath, debug, run) {
+	return withFileLock(`${filePath}.refresh-lock`, debug, REFRESH_LOCK_TIMINGS, run);
+}
+async function withFileLock(lockPath, debug, timings, run) {
+	const lockId = await acquireStateLock(lockPath, debug, timings);
 	debug(`lock acquired ${lockPath}`);
 	try {
 		return await run();
@@ -14445,15 +14472,15 @@ async function withStateLock(filePath, debug, run) {
 		debug(`lock released ${lockPath}`);
 	}
 }
-async function acquireStateLock(lockPath, debug) {
+async function acquireStateLock(lockPath, debug, timings) {
 	const lockId = randomUUID();
 	const startedAt = Date.now();
 	await fs.mkdir(path.dirname(lockPath), { recursive: true });
 	while (true) {
 		if (await tryCreateStateLock(lockPath, lockId)) return lockId;
-		const tookOver = await takeOverStaleStateLock(lockPath, debug);
-		if (Date.now() - startedAt >= LOCK_WAIT_TIMEOUT_MS) throw new StateLockTimeoutError(lockPath);
-		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+		const tookOver = await takeOverStaleStateLock(lockPath, debug, timings);
+		if (Date.now() - startedAt >= timings.waitTimeoutMs) throw new StateLockTimeoutError(lockPath, timings.waitTimeoutMs);
+		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, timings.retryMs));
 	}
 }
 async function tryCreateStateLock(lockPath, lockId) {
@@ -14479,10 +14506,10 @@ async function tryCreateStateLock(lockPath, lockId) {
 * then run their read-modify-write at once and one update is lost,
 * which is the very thing the lock exists to prevent.
 */
-async function takeOverStaleStateLock(lockPath, debug) {
+async function takeOverStaleStateLock(lockPath, debug, timings) {
 	const stale = await fs.stat(lockPath).catch(() => null);
 	if (stale === null) return true;
-	if (Date.now() - stale.mtimeMs <= LOCK_STALE_MS) return false;
+	if (Date.now() - stale.mtimeMs <= timings.staleMs) return false;
 	const takenPath = `${lockPath}.${randomUUID()}.stale`;
 	try {
 		await fs.rename(lockPath, takenPath);
@@ -14520,12 +14547,16 @@ function memoryBackedStorage(credential, withRefreshLock) {
 	let tokens = {
 		workspaceId: credentialWorkspaceId(credential.token) ?? NO_WORKSPACE_CLAIMED,
 		accessToken: credential.token,
-		refreshToken: credential.refreshToken
+		refreshToken: credential.refreshToken,
+		expiresAt: claimedExpiresAt(credential.token) ?? credential.expiresAt
 	};
 	return {
 		getTokens: async () => tokens,
-		setTokens: async (rotated) => {
-			tokens = rotated;
+		setTokens: async (rotated, expiresAt) => {
+			tokens = {
+				...rotated,
+				expiresAt: claimedExpiresAt(rotated.accessToken) ?? expiresAt ?? tokens?.expiresAt
+			};
 		},
 		clearTokens: async () => {
 			tokens = null;
@@ -14544,6 +14575,7 @@ var FileCredentialManager = class {
 	#filePath;
 	#debug;
 	#fetchWorkspaceName;
+	#refreshCredential;
 	#pin = { kind: "unresolved" };
 	/** Built for one pinned credential. Every mutation that moves the
 	*  pin discards it, so a command that mutates and then reaches for
@@ -14556,6 +14588,7 @@ var FileCredentialManager = class {
 		this.#filePath = resolveStateFilePath(options.env).filePath;
 		this.#debug = makeDebugLog(options.env, options.debugWrite);
 		this.#fetchWorkspaceName = options.fetchWorkspaceName;
+		this.#refreshCredential = options.refreshCredential;
 		this.#debug(`state file ${this.#filePath}`);
 	}
 	get stateFilePath() {
@@ -14666,14 +14699,13 @@ var FileCredentialManager = class {
 		this.#activeStorage ??= this.#buildActiveStorage();
 		return this.#activeStorage;
 	}
-	/** The spawn path's read: the active credential's access token,
+	/** The delegated path's read: the active credential's access token,
 	*  fresh on every call, never the refresh token. Null when there is
 	*  no active credential to read — storage exists only once
 	*  activeCredential() has returned non-null. */
-	async activeAccessToken() {
+	async activeAccessToken(options) {
 		if (await this.activeCredential() === null) return null;
-		const tokens = await (await this.activeCredentialStorage()).getTokens();
-		return tokens === null ? null : tokens.accessToken;
+		return readActiveAccessToken(await this.activeCredentialStorage(), this.#refreshCredential, options);
 	}
 	/** §11.2: which storage is chosen once, when the pin resolves. Each
 	*  has exactly one source of truth — the file, or process memory. */
@@ -14701,10 +14733,11 @@ var FileCredentialManager = class {
 				return {
 					workspaceId,
 					accessToken: record.token,
-					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken }
+					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken },
+					...record.expiresAt === void 0 ? {} : { expiresAt: new Date(record.expiresAt) }
 				};
 			},
-			setTokens: async (tokens) => {
+			setTokens: async (tokens, expiresAt) => {
 				this.#debug(`rotation write for session ${workspaceId}`);
 				const claimed = credentialWorkspaceId(tokens.accessToken);
 				if (claimed !== void 0 && claimed !== workspaceId) throw credentialWorkspaceMismatchError(workspaceId);
@@ -14716,7 +14749,7 @@ var FileCredentialManager = class {
 						...record.name === void 0 ? {} : { name: record.name },
 						token: tokens.accessToken,
 						...tokens.refreshToken === void 0 ? {} : { refreshToken: tokens.refreshToken },
-						...expiresAtSlice(tokens.accessToken, void 0)
+						...expiresAtSlice(tokens.accessToken, expiresAt ?? (record.expiresAt === void 0 ? void 0 : new Date(record.expiresAt)))
 					};
 					return {
 						state: {
@@ -14745,7 +14778,7 @@ var FileCredentialManager = class {
 					};
 				});
 			},
-			withRefreshLock: (fn) => this.#withRefreshLock(fn)
+			withRefreshLock: (fn) => this.#withRefreshLock(() => withRefreshFileLock(this.#filePath, this.#debug, fn))
 		};
 	}
 	#withRefreshLock(fn) {
@@ -14881,6 +14914,45 @@ function environmentCredential(token) {
 	};
 }
 //#endregion
+//#region src/auth/refresh.ts
+const TRAILING_SLASH = /\/$/;
+const CREDENTIAL_REFRESH_TIMEOUT_MS = 1e4;
+/** The dumb HTTP adapter behind the engine's delegated-credential policy. */
+function makeCredentialRefresher(authBaseUrl) {
+	const endpoint = `${authBaseUrl.replace(TRAILING_SLASH, "")}/token`;
+	return async ({ refreshToken, signal }) => {
+		signal.throwIfAborted();
+		const refreshSignal = AbortSignal.any([signal, AbortSignal.timeout(CREDENTIAL_REFRESH_TIMEOUT_MS)]);
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			}),
+			signal: refreshSignal
+		});
+		const body = await readBody(response);
+		if (response.status >= 400 && response.status < 500 && body?.error === "invalid_grant") return { kind: "invalid" };
+		if (!response.ok || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string" || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in < 0) throw new Error(`OAuth token refresh failed (status ${String(response.status)})`);
+		return {
+			kind: "success",
+			accessToken: body.access_token,
+			refreshToken: body.refresh_token,
+			expiresAt: new Date(Date.now() + body.expires_in * 1e3)
+		};
+	};
+}
+async function readBody(response) {
+	try {
+		const body = await response.json();
+		return typeof body === "object" && body !== null ? body : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/auth/workspace-name.ts
 /** The manager's injected name lookup: a static-token client over the
 *  credential just minted. The manager constructs no API client and
@@ -14994,33 +15066,127 @@ const runPackageManager = async ({ file, args, cwd, signal, onOutput }) => {
 };
 //#endregion
 //#region src/spawn.ts
+/** How long after the child exits the relay keeps reading its pipes. A
+*  grandchild that inherited them can hold EOF back forever; settlement
+*  must not wait on it, so the pipes are destroyed after this grace. */
+const POST_EXIT_DRAIN_GRACE_MS = 5e3;
 /**
-* The engine's spawn seam, adapted to node:child_process. Inherited
-* stdio, no `detached`, no new console: the child stays in this
-* process's group (POSIX) or console (Windows), so the terminal
-* delivers Ctrl-C to it natively.
+* The engine's spawn seam, adapted to node:child_process. Human mode
+* inherits stdio; structured mode pipes both child output streams to
+* diagnostics. Neither mode detaches or opens a new console, so the child
+* stays in this process's group (POSIX) or console (Windows).
+*
+* The child's own status settles the run: `ended` resolves from the
+* process `exit` event, waits for the diagnostic relay only up to the
+* drain grace, and never rejects for a relay failure — rejection is
+* reserved for a child that could not be launched at all.
 */
-const spawnChild = (request) => {
-	const child = spawn(request.command, [...request.args], {
-		cwd: request.cwd,
-		env: request.env,
-		stdio: "inherit"
-	});
-	return {
-		ended: new Promise((resolve, reject) => {
+function makeSpawnChild(diagnostics, options) {
+	const drainGraceMs = options?.drainGraceMs ?? POST_EXIT_DRAIN_GRACE_MS;
+	return (request) => {
+		const structured = request.output === "diagnostic";
+		const child = spawn(request.command, [...request.args], {
+			cwd: request.cwd,
+			env: request.env,
+			stdio: structured ? [
+				"inherit",
+				"pipe",
+				"pipe"
+			] : "inherit"
+		});
+		const processEnded = new Promise((resolve, reject) => {
 			child.on("error", reject);
-			child.on("close", (exitCode, signal) => {
+			child.on("exit", (exitCode, signal) => {
 				resolve({
 					exitCode,
 					signal
 				});
 			});
-		}),
-		kill: (signal) => {
-			child.kill(signal);
-		}
+		});
+		if (!structured) return {
+			ended: processEnded,
+			kill: (signal) => {
+				child.kill(signal);
+			}
+		};
+		const forwarding = forwardStructuredOutput(child.stdout, child.stderr, diagnostics);
+		return {
+			ended: processEnded.then(async (result) => {
+				const drainDeadline = setTimeout(() => {
+					child.stdout?.destroy();
+					child.stderr?.destroy();
+				}, drainGraceMs);
+				await forwarding;
+				clearTimeout(drainDeadline);
+				return result;
+			}),
+			kill: (signal) => {
+				child.kill(signal);
+			}
+		};
 	};
-};
+}
+/** Best-effort relay: a forwarding failure never rejects, so the child's
+*  real status still settles the run when the diagnostic sink dies. */
+function forwardStructuredOutput(stdout, stderr, diagnostics) {
+	const sources = [stdout, stderr].filter((source) => source !== null);
+	return Promise.all(sources.map((source) => forwardOutput(source, diagnostics))).then(() => void 0, () => void 0);
+}
+/** Decode each child stream continuously and stop reading while the
+*  diagnostic destination applies backpressure. A destination that
+*  errors or closes instead of draining fails the relay rather than
+*  stalling it. */
+function forwardOutput(source, diagnostics) {
+	let pendingDone;
+	let pendingDrain;
+	let failure;
+	const fail = (cause) => {
+		failure ??= cause;
+		const done = pendingDone;
+		pendingDone = void 0;
+		done?.(cause);
+	};
+	const onSinkError = (cause) => {
+		fail(toError(cause));
+	};
+	const onSinkClose = () => {
+		fail(/* @__PURE__ */ new Error("the diagnostic stream closed during child output"));
+	};
+	diagnostics.once?.("error", onSinkError);
+	diagnostics.once?.("close", onSinkClose);
+	const destination = new Writable({
+		decodeStrings: false,
+		write: (text, _encoding, done) => {
+			if (failure !== void 0) {
+				done(failure);
+				return;
+			}
+			try {
+				if (diagnostics.write(text) === false && diagnostics.once !== void 0) {
+					pendingDone = done;
+					const onDrain = () => {
+						pendingDrain = void 0;
+						if (pendingDone !== done) return;
+						pendingDone = void 0;
+						done();
+					};
+					pendingDrain = onDrain;
+					diagnostics.once("drain", onDrain);
+				} else done();
+			} catch (cause) {
+				done(toError(cause));
+			}
+		}
+	});
+	return pipeline(source.setEncoding("utf8"), destination).finally(() => {
+		diagnostics.off?.("error", onSinkError);
+		diagnostics.off?.("close", onSinkClose);
+		if (pendingDrain !== void 0) diagnostics.off?.("drain", pendingDrain);
+	});
+}
+function toError(cause) {
+	return cause instanceof Error ? cause : new Error(String(cause));
+}
 //#endregion
 //#region src/runtime.ts
 /** Dumb wiring: forwards process signals to the engine's subscribers.
@@ -15092,6 +15258,7 @@ async function assembleRuntime(proc) {
 	};
 	warnOnDeprecatedStateFileEnvVar(proc);
 	const apiBaseUrl = getApiBaseUrl(proc.env);
+	const authBaseUrl = getAuthBaseUrl(proc.env);
 	return {
 		stdout: { write: (text) => {
 			proc.stdout.write(text);
@@ -15118,15 +15285,16 @@ async function assembleRuntime(proc) {
 		loadConfig: (configPath) => loadConfig(proc.cwd(), configPath),
 		credentialManager: new FileCredentialManager({
 			env: proc.env,
-			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl)
+			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl),
+			refreshCredential: makeCredentialRefresher(authBaseUrl)
 		}),
 		managementApiClientConfig: {
 			clientId: CLIENT_ID,
 			redirectUri: DEFAULT_REDIRECT_URI,
 			apiBaseUrl,
-			authBaseUrl: getAuthBaseUrl(proc.env)
+			authBaseUrl
 		},
-		spawn: spawnChild,
+		spawn: makeSpawnChild(proc.stderr),
 		/** The engine has already decided and composed; the bin only forks
 		*  the detached sender and hands the payload over. Every failure is
 		*  swallowed inside runTelemetry. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "8.0.0-rc.2-dev.49",
+  "version": "8.0.0-rc.2-dev.51",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -51,9 +51,9 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@repo/cli-conformance": "8.0.0-rc.2-dev.49",
-    "@repo/cli-telemetry": "8.0.0-rc.2-dev.49",
-    "@repo/tsconfig": "8.0.0-rc.2-dev.49",
+    "@repo/cli-conformance": "8.0.0-rc.2-dev.51",
+    "@repo/cli-telemetry": "8.0.0-rc.2-dev.51",
+    "@repo/tsconfig": "8.0.0-rc.2-dev.51",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "tsx": "^4.22.4",