@prisma/cli 8.0.0-rc.2 → 8.0.0-rc.2-dev.50

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, telemetryCommandGroup } from "@prisma/cli-engine";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, claimedIdentity, createCli, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineSessionCommand, emptyServiceTokenError, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup } from "@prisma/cli-engine";
 import { createComposerFamily } from "@prisma/composer/family";
 import { ormCommandFamily } from "@prisma/orm-toolchain/cli";
 import { CliStructuredError, notOk, ok } from "@prisma/cli-engine/protocol";
@@ -848,9 +848,9 @@ function sameWorkspaceId(left, right) {
 }
 //#endregion
 //#region src/auth/token-storage.ts
-const REFRESH_LOCK_RETRY_MS = 100;
-const REFRESH_LOCK_STALE_MS = 3e4;
-const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const REFRESH_LOCK_RETRY_MS$1 = 100;
+const REFRESH_LOCK_STALE_MS$1 = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS$1 = 25e3;
 const EMPTY_AUTH_CONTEXT = {
 	activeWorkspaceId: null,
 	workspaces: {}
@@ -889,7 +889,7 @@ function findTokensForWorkspace(allCredentials, workspaceId) {
 function tokensEqual(a, b) {
 	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
-function sleep$1(ms, signal) {
+function sleep$2(ms, signal) {
 	signal?.throwIfAborted();
 	return new Promise((resolve, reject) => {
 		const onAbort = () => {
@@ -1097,8 +1097,8 @@ var FileTokenStorage = class {
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
 		const startedAt = Date.now();
-		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
-		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS$1;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS$1;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
@@ -1106,7 +1106,7 @@ var FileTokenStorage = class {
 			if (await this.tryCreateRefreshLock(lockId)) return lockId;
 			if (await this.releaseStaleRefreshLock()) continue;
 			this.throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs);
-			await sleep$1(retryMs, this.signal);
+			await sleep$2(retryMs, this.signal);
 		}
 	}
 	async tryCreateRefreshLock(lockId) {
@@ -1152,7 +1152,7 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS$1;
 		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
@@ -4657,8 +4657,45 @@ const bucketListCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/lib/ndjson.ts
+/**
+* Reads a newline-delimited JSON body line by line.
+*
+* Shared by every command that reads an NDJSON log page, so the stream
+* handling below is written and tested once. The two subtleties are the
+* reason: a chunk boundary can fall inside a line, and a body can end
+* without a trailing newline, so the last record arrives only if the
+* leftover buffer is flushed at `done`.
+*/
+async function forEachNdjsonRecord(body, onRecord) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (value) buffer += decoder.decode(value, { stream: true });
+			let newlineIndex = buffer.indexOf("\n");
+			while (newlineIndex !== -1) {
+				const line = buffer.slice(0, newlineIndex).trim();
+				buffer = buffer.slice(newlineIndex + 1);
+				if (line) onRecord(JSON.parse(line));
+				newlineIndex = buffer.indexOf("\n");
+			}
+			if (done) {
+				const tail = buffer.trim();
+				if (tail) onRecord(JSON.parse(tail));
+				return;
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+}
+//#endregion
 //#region src/commands/build/logs.ts
-const TRAILING_NEWLINE = /\n$/;
+const TRAILING_NEWLINE$1 = /\n$/;
 function buildNotFoundError(buildId) {
 	return new CliStructuredError("BUILD.NOT_FOUND", `Build ${buildId} was not found`, {
 		why: "The build does not exist, or your workspace does not have access to it.",
@@ -4706,40 +4743,13 @@ function buildFailedError(buildId, record) {
 		}] : []]
 	});
 }
-/** Reads a newline-delimited JSON body line by line. */
-async function forEachNdjsonRecord(body, onRecord) {
-	const reader = body.getReader();
-	const decoder = new TextDecoder();
-	let buffer = "";
-	try {
-		for (;;) {
-			const { done, value } = await reader.read();
-			if (value) buffer += decoder.decode(value, { stream: true });
-			let newlineIndex = buffer.indexOf("\n");
-			while (newlineIndex !== -1) {
-				const line = buffer.slice(0, newlineIndex).trim();
-				buffer = buffer.slice(newlineIndex + 1);
-				if (line) onRecord(JSON.parse(line));
-				newlineIndex = buffer.indexOf("\n");
-			}
-			if (done) {
-				const tail = buffer.trim();
-				if (tail) onRecord(JSON.parse(tail));
-				return;
-			}
-		}
-	} finally {
-		await reader.cancel().catch(() => void 0);
-		reader.releaseLock();
-	}
-}
 function reportRecord(ctx, record) {
 	if (record.type === "log") {
 		ctx.report({
 			kind: "output",
 			source: "build",
 			channel: record.source === "stderr" || record.level === "error" ? "diagnostic" : "data",
-			line: record.text.replace(TRAILING_NEWLINE, ""),
+			line: record.text.replace(TRAILING_NEWLINE$1, ""),
 			data: {
 				cursor: record.cursor,
 				level: record.level,
@@ -11257,6 +11267,30 @@ function deploymentNotFoundError(deploymentId) {
 		nextActions: [runCommandAction("Choose an available deployment id", "service deployment list")]
 	});
 }
+/** `--tail` and `--from-start` ask for opposite ends of the log, so a
+*  run naming both has no answer to give. Refused before any work. */
+function logsRangeConflictError() {
+	return new CliStructuredError("SERVICE.LOGS_RANGE_CONFLICT", "Choose one end of the log to read from", {
+		why: "--tail and --from-start are mutually exclusive: one reads the last lines, the other reads from the beginning.",
+		nextActions: [adviceAction("Pass --tail <n> for the last n lines, or --from-start for the whole log.")]
+	});
+}
+/** A deployment id resolves globally, so one that exists but belongs to
+*  another project is its own failure — not "not found". */
+function deploymentOutsideProjectError(deploymentId) {
+	return new CliStructuredError("SERVICE.DEPLOYMENT_OUTSIDE_PROJECT", `Deployment "${deploymentId}" belongs to another project`, {
+		why: "The deployment exists, but the service that owns it is not in the resolved project.",
+		nextActions: [adviceAction("Pass --project for the project that owns it."), runCommandAction("List services", "service list")]
+	});
+}
+/** The deployment exists but names no owning service, so there is no
+*  project to check it against and nothing to scope logs by. */
+function deploymentDetachedError(deploymentId) {
+	return new CliStructuredError("SERVICE.DEPLOYMENT_DETACHED", `Deployment "${deploymentId}" has no owning service`, {
+		why: "The Management API returned the deployment without a service, so it cannot be scoped to a project.",
+		nextActions: [runCommandAction("Show the deployment", `service deployment show ${deploymentId}`)]
+	});
+}
 function deploymentNotFoundForServiceError(deploymentId, serviceName) {
 	return new CliStructuredError("SERVICE.DEPLOYMENT_NOT_FOUND", `Deployment "${deploymentId}" not found for service "${serviceName}"`, {
 		why: "The requested deployment does not belong to the resolved service or is no longer available.",
@@ -12414,12 +12448,13 @@ async function resolveServiceReadState(ctx, options) {
 	});
 	const projectId = target.project.id;
 	const stateStore = await openServiceStateStore(ctx);
+	const services = await listServices(ctx, provider, projectId, target.branch.name);
 	return {
 		provider,
 		stateStore,
 		target,
 		projectId,
-		selected: await resolveExistingServiceSelection(ctx, stateStore, projectId, await listServices(ctx, provider, projectId, target.branch.name), options.serviceName ?? compute.configServiceName)
+		selected: options.skipSelection ? null : await resolveExistingServiceSelection(ctx, stateStore, projectId, services, options.serviceName ?? compute.configServiceName)
 	};
 }
 async function resolveServiceDomainTarget(ctx, options) {
@@ -13325,7 +13360,7 @@ const serviceDomainShowCommand = defineCommand({
 //#endregion
 //#region src/commands/service/domain-wait.ts
 const DEFAULT_TIMEOUT_MS = 900 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS = 5e3;
+const DEFAULT_POLL_INTERVAL_MS$1 = 5e3;
 const UNIT_MULTIPLIER_MS = {
 	ms: 1,
 	s: 1e3,
@@ -13340,13 +13375,13 @@ function parseWaitTimeout(value) {
 	if (!match) throw timeoutInvalidError(value);
 	return Number.parseInt(match[1], 10) * (UNIT_MULTIPLIER_MS[match[2]] ?? 1);
 }
-function pollIntervalMs(ctx) {
+function pollIntervalMs$1(ctx) {
 	const raw = ctx.env.PRISMA_CLI_DOMAIN_WAIT_POLL_MS;
-	if (!raw) return DEFAULT_POLL_INTERVAL_MS;
+	if (!raw) return DEFAULT_POLL_INTERVAL_MS$1;
 	const parsed = Number.parseInt(raw, 10);
-	return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_POLL_INTERVAL_MS;
+	return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_POLL_INTERVAL_MS$1;
 }
-async function sleep(milliseconds, signal) {
+async function sleep$1(milliseconds, signal) {
 	if (milliseconds <= 0) return;
 	signal.throwIfAborted();
 	await new Promise((resolve, reject) => {
@@ -13392,7 +13427,7 @@ const serviceDomainWaitCommand = defineCommand({
 		const domain = await resolveDomainByHostname(target.provider, target.service.id, hostname, "wait", ctx.signal);
 		const start = Date.now();
 		const deadline = start + timeoutMs;
-		const interval = pollIntervalMs(ctx);
+		const interval = pollIntervalMs$1(ctx);
 		let previousStatus = null;
 		let current = domain;
 		for (;;) {
@@ -13418,7 +13453,7 @@ const serviceDomainWaitCommand = defineCommand({
 			}
 			if (current.status === "failed") throw domainVerificationFailedError(hostname, current);
 			if (timeoutMs === 0 || Date.now() >= deadline) throw domainVerificationTimeoutError(hostname, current.status);
-			await sleep(Math.min(interval, Math.max(deadline - Date.now(), 0)), ctx.signal);
+			await sleep$1(Math.min(interval, Math.max(deadline - Date.now(), 0)), ctx.signal);
 			current = await target.provider.showDomain(current.id, { signal: ctx.signal }).catch((error) => {
 				throw domainCommandError("wait", error, hostname);
 			});
@@ -13461,6 +13496,264 @@ const serviceListCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/service/logs.ts
+const TRAILING_NEWLINE = /\n$/;
+/** The endpoint's own default page size, restated so `--tail` and the
+*  unflagged run send the same shape of request. */
+const DEFAULT_TAIL = 100;
+/** Contract: poll every 2s in --follow. Overridable so a test drives the
+*  loop without waiting, the way `service domain wait` does. */
+const DEFAULT_POLL_INTERVAL_MS = 2e3;
+function pollIntervalMs(ctx) {
+	const raw = ctx.env.PRISMA_CLI_SERVICE_LOGS_POLL_MS;
+	if (!raw) return DEFAULT_POLL_INTERVAL_MS;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isInteger(parsed) && parsed >= 0 ? parsed : DEFAULT_POLL_INTERVAL_MS;
+}
+async function sleep(milliseconds, signal) {
+	if (milliseconds <= 0) {
+		signal.throwIfAborted();
+		return;
+	}
+	signal.throwIfAborted();
+	await new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(signal.reason);
+		};
+		const timeout = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, milliseconds);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function logsFailedError(deploymentId, status) {
+	return new CliStructuredError("SERVICE.LOGS_FAILED", `Failed to read logs for deployment ${deploymentId}`, {
+		why: `The Management API returned HTTP ${status}.`,
+		meta: { status },
+		nextActions: [adviceAction("Retry the command, or rerun with --log-level verbose for more detail."), runCommandAction("Show the deployment", `service deployment show ${deploymentId}`)]
+	});
+}
+/**
+* The body ended mid-page, without the terminal record that closes one.
+* Distinct from SERVICE.LOGS_NO_CURSOR, which is a page that closed
+* properly and said there is nothing to resume from: this one is an
+* incomplete read, and the lines already printed are not the whole page.
+*/
+function logsIncompleteError(deploymentId) {
+	return new CliStructuredError("SERVICE.LOGS_INCOMPLETE", `Incomplete log page for deployment ${deploymentId}`, {
+		why: "The response ended without the record that closes a page, so the lines shown may be only part of it.",
+		nextActions: [adviceAction("Rerun the command to read the page again.")]
+	});
+}
+/** An error terminal record is the platform reporting that the log read
+*  itself failed, so it settles the run rather than printing. */
+function logStreamFailedError(deploymentId, record) {
+	return new CliStructuredError("SERVICE.LOGS_FAILED", `Log stream failed for deployment ${deploymentId}`, {
+		why: record.message,
+		meta: {
+			code: record.code,
+			retryable: record.retryable,
+			...record.cursor === null ? {} : { cursor: record.cursor }
+		},
+		nextActions: [runCommandAction("Show the deployment", `service deployment show ${deploymentId}`)]
+	});
+}
+function listDeployments(ctx, provider, serviceId) {
+	return provider.listDeployments(serviceId, { signal: ctx.signal }).catch((error) => {
+		throw deployFailedError("Failed to list service deployments", error, [runCommandAction("List deployments", "service deployment list")]);
+	});
+}
+/** `--deployment <id>`: the id is global, so it is resolved directly and
+*  then checked against the resolved project — a deployment that exists
+*  but belongs elsewhere is reported as its own failure. */
+async function resolveExplicitDeployment(ctx, state, serviceName, deploymentId) {
+	if (serviceName) {
+		if (!state.selected) throw noDeploymentsError("No deployments available to read logs from", "The resolved project does not have any deployed service yet.");
+		const deploymentsResult = await listDeployments(ctx, state.provider, state.selected.id);
+		const deployment = requireDeploymentForService(deploymentsResult.deployments, deploymentId, state.selected.name);
+		await rememberSelectedService(state.stateStore, state.projectId, deploymentsResult.app);
+		return {
+			service: deploymentsResult.app,
+			deployment
+		};
+	}
+	const shown = await state.provider.showDeployment(deploymentId, { signal: ctx.signal }).catch((error) => {
+		throw deployFailedError("Failed to show deployment", error, [runCommandAction("List deployments", "service deployment list")]);
+	});
+	if (!shown) throw deploymentNotFoundError(deploymentId);
+	if (!shown.app) throw deploymentDetachedError(deploymentId);
+	const owning = (await listServices(ctx, state.provider, state.projectId, state.target.branch.name)).find((service) => service.id === shown.app?.id);
+	if (!owning) throw deploymentOutsideProjectError(deploymentId);
+	await rememberSelectedService(state.stateStore, state.projectId, owning);
+	return {
+		service: owning,
+		deployment: shown.deployment
+	};
+}
+/** No `--deployment`: read whatever is live for the selected service. */
+async function resolveLiveDeployment(ctx, state) {
+	if (!state.selected) throw noDeploymentsError("No deployments available to read logs from", "The resolved project does not have any deployed service yet.");
+	const deploymentsResult = await listDeployments(ctx, state.provider, state.selected.id);
+	const currentLiveDeploymentId = resolveCurrentLiveDeploymentId(deploymentsResult.app, deploymentsResult.deployments);
+	const deployments = applyLiveDeploymentHint(deploymentsResult.deployments, currentLiveDeploymentId);
+	const deployment = currentLiveDeploymentId ? deployments.find((candidate) => candidate.id === currentLiveDeploymentId) ?? null : null;
+	await rememberSelectedService(state.stateStore, state.projectId, deploymentsResult.app);
+	if (!deployment) throw noDeploymentsError("No deployments available to read logs from", `The selected service "${deploymentsResult.app.name}" does not have a live deployment.`);
+	return {
+		service: deploymentsResult.app,
+		deployment
+	};
+}
+/**
+* Reads one page and reports its log records. Returns the terminal
+* record that closed it — the caller decides whether that ends the run
+* or starts the next page.
+*
+* Every page ends with a terminal record, so a body that stops without
+* one was truncated. The lines that did arrive have already been
+* reported, but the run must not settle as though it had read the whole
+* page: the user would have a partial log and no way to tell.
+*/
+async function readPage(ctx, deploymentId, query) {
+	const { data, response } = await ctx.api.GET("/v1/deployments/{deploymentId}/logs", {
+		params: {
+			path: { deploymentId },
+			query
+		},
+		parseAs: "stream",
+		signal: ctx.signal
+	});
+	const body = data;
+	if (!response.ok || !body) {
+		await body?.cancel().catch(() => void 0);
+		throw response.status === 404 ? deploymentNotFoundError(deploymentId) : logsFailedError(deploymentId, response.status);
+	}
+	let terminal = null;
+	await forEachNdjsonRecord(body, (record) => {
+		if (record.type === "terminal") {
+			terminal = record;
+			return;
+		}
+		ctx.report({
+			kind: "output",
+			source: "logs",
+			channel: "data",
+			line: record.text.replace(TRAILING_NEWLINE, ""),
+			data: {
+				byteStart: record.byteStart,
+				byteEnd: record.byteEnd
+			}
+		});
+	});
+	if (terminal === null) throw logsIncompleteError(deploymentId);
+	return terminal;
+}
+/**
+* Following needs somewhere to resume from. Without a cursor the next
+* request would carry no range at all, the endpoint would apply its
+* default tail, and the same lines would print again every interval —
+* silent duplication the user cannot act on. So the run stops and says
+* why. It settles as an error rather than a clean end because `--follow`
+* has no successful ending: it runs until interrupted (130) or fails,
+* and an exit 0 here would be a novel outcome meaning "gave up".
+*/
+function requireResumeCursor(deploymentId, cursor) {
+	if (cursor === null) throw new CliStructuredError("SERVICE.LOGS_NO_CURSOR", `Cannot follow logs for deployment ${deploymentId}`, {
+		why: "The log page ended without a resume cursor, so there is no point to continue reading from.",
+		nextActions: [adviceAction("Rerun without --follow to read the page, or retry if the deployment is still starting.")]
+	});
+	return cursor;
+}
+/**
+* `--follow`: wait the poll interval, read the next page from the cursor
+* the last one ended on, repeat until the user interrupts. Never
+* returns — the run ends by abort (the engine settles 130) or by throw.
+*/
+async function followPages(ctx, deploymentId, startCursor) {
+	const interval = pollIntervalMs(ctx);
+	let cursor = requireResumeCursor(deploymentId, startCursor);
+	let retriedAfterError = false;
+	for (;;) {
+		await sleep(interval, ctx.signal);
+		const next = await readPage(ctx, deploymentId, { cursor });
+		if (next.kind === "error") {
+			if (!next.retryable || retriedAfterError) throw logStreamFailedError(deploymentId, next);
+			retriedAfterError = true;
+			continue;
+		}
+		retriedAfterError = false;
+		cursor = requireResumeCursor(deploymentId, next.cursor);
+	}
+}
+const serviceLogsCommand = defineSessionCommand({
+	help: {
+		summary: "Read logs for a deployment of the service",
+		examples: [
+			"service logs",
+			"service logs --tail 500",
+			"service logs --follow",
+			"service logs --deployment dep_123 --from-start"
+		]
+	},
+	args: {
+		flags: {
+			service: flag.string({
+				brief: "Service name",
+				placeholder: "name"
+			}),
+			project: flag.string({
+				brief: "Project id or name",
+				placeholder: "id-or-name"
+			}),
+			deployment: flag.string({
+				brief: "Deployment id to read (default: the live deployment)",
+				placeholder: "id"
+			}),
+			tail: flag.number({
+				brief: `Read the last N lines (default ${DEFAULT_TAIL})`,
+				placeholder: "n"
+			}),
+			fromStart: flag.boolean({ brief: "Read from the beginning instead of the last lines" }),
+			follow: flag.boolean({ brief: "Keep polling for new lines until interrupted" })
+		},
+		positionals: { service: positional.optionalString({
+			brief: "Service target from prisma.compute.ts when the config defines multiple services",
+			placeholder: "service"
+		}) }
+	},
+	needs: { credentials: true },
+	handler: async (args, ctx) => {
+		if (args.flags.fromStart && args.flags.tail !== void 0) throw logsRangeConflictError();
+		const serviceNamed = args.flags.service ?? args.positionals.service;
+		const resolveGlobally = Boolean(args.flags.deployment) && !serviceNamed;
+		const state = await resolveServiceReadState(ctx, {
+			...args.flags.service !== void 0 ? { serviceName: args.flags.service } : {},
+			...args.flags.project !== void 0 ? { projectRef: args.flags.project } : {},
+			...args.positionals.service !== void 0 ? { configTarget: args.positionals.service } : {},
+			commandName: "service logs",
+			skipSelection: resolveGlobally
+		});
+		const target = args.flags.deployment ? await resolveExplicitDeployment(ctx, state, serviceNamed, args.flags.deployment) : await resolveLiveDeployment(ctx, state);
+		const deploymentId = target.deployment.id;
+		for (const line of [
+			`project: ${state.projectId}`,
+			`service: ${target.service.name}`,
+			`deployment: ${deploymentId}`
+		]) ctx.report({
+			kind: "output",
+			source: "logs",
+			channel: "diagnostic",
+			line
+		});
+		const terminal = await readPage(ctx, deploymentId, args.flags.fromStart ? { from_start: "true" } : { tail: args.flags.tail ?? DEFAULT_TAIL });
+		if (terminal.kind === "error") throw logStreamFailedError(deploymentId, terminal);
+		if (!args.flags.follow) return ok(void 0);
+		return followPages(ctx, deploymentId, terminal.cursor);
+	}
+});
+//#endregion
 //#region src/commands/service/open.ts
 const serviceOpenCommand = defineCommand({
 	help: {
@@ -13714,6 +14007,7 @@ const platformCommandFamily = defineCommandFamily({ commands: {
 	gitConnect: gitConnectCommand,
 	gitDisconnect: gitDisconnectCommand,
 	serviceList: serviceListCommand,
+	serviceLogs: serviceLogsCommand,
 	serviceCreate: serviceCreateCommand,
 	serviceShow: serviceShowCommand,
 	serviceOpen: serviceOpenCommand,
@@ -13816,6 +14110,7 @@ const mountedCommands = {
 	"git connect": gitConnectCommand,
 	"git disconnect": gitDisconnectCommand,
 	"service list": serviceListCommand,
+	"service logs": serviceLogsCommand,
 	"service create": serviceCreateCommand,
 	"service show": serviceShowCommand,
 	"service open": serviceOpenCommand,
@@ -14020,6 +14315,19 @@ const FILE_MODE = 384;
 const LOCK_STALE_MS = 5e3;
 const LOCK_RETRY_MS = 10;
 const LOCK_WAIT_TIMEOUT_MS = 1e4;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 3e4;
+const STATE_LOCK_TIMINGS = {
+	staleMs: LOCK_STALE_MS,
+	retryMs: LOCK_RETRY_MS,
+	waitTimeoutMs: LOCK_WAIT_TIMEOUT_MS
+};
+const REFRESH_LOCK_TIMINGS = {
+	staleMs: REFRESH_LOCK_STALE_MS,
+	retryMs: REFRESH_LOCK_RETRY_MS,
+	waitTimeoutMs: REFRESH_LOCK_WAIT_TIMEOUT_MS
+};
 const EMPTY_STATE = {
 	version: 1,
 	sessions: [],
@@ -14122,9 +14430,9 @@ async function writeCredentialState(filePath, state) {
 	await fs.chmod(filePath, FILE_MODE).catch(() => {});
 }
 var StateLockTimeoutError = class extends CliStructuredError {
-	constructor(lockPath) {
+	constructor(lockPath, waitTimeoutMs) {
 		super("CLI.CREDENTIALS_LOCKED", "Another prisma process is still updating your credentials.", {
-			why: `The credentials lock at ${lockPath} was held for longer than ${LOCK_WAIT_TIMEOUT_MS}ms.`,
+			why: `The credentials lock at ${lockPath} was held for longer than ${waitTimeoutMs}ms.`,
 			nextActions: [{
 				kind: "user-choice",
 				label: "Wait for the other command to finish, then try again."
@@ -14140,8 +14448,20 @@ var StateLockTimeoutError = class extends CliStructuredError {
 * small fixed staleness threshold.
 */
 async function withStateLock(filePath, debug, run) {
-	const lockPath = `${filePath}.lock`;
-	const lockId = await acquireStateLock(lockPath, debug);
+	return withFileLock(`${filePath}.lock`, debug, STATE_LOCK_TIMINGS, run);
+}
+/**
+* The cross-process lock the delegated refresh holds for its whole
+* read → exchange → write sequence, so two processes never spend the
+* same refresh token. Distinct from the state lock: it IS held across
+* network I/O, so its staleness and wait budgets are larger, and it
+* uses its own lock path so short mutations are not queued behind it.
+*/
+async function withRefreshFileLock(filePath, debug, run) {
+	return withFileLock(`${filePath}.refresh-lock`, debug, REFRESH_LOCK_TIMINGS, run);
+}
+async function withFileLock(lockPath, debug, timings, run) {
+	const lockId = await acquireStateLock(lockPath, debug, timings);
 	debug(`lock acquired ${lockPath}`);
 	try {
 		return await run();
@@ -14150,15 +14470,15 @@ async function withStateLock(filePath, debug, run) {
 		debug(`lock released ${lockPath}`);
 	}
 }
-async function acquireStateLock(lockPath, debug) {
+async function acquireStateLock(lockPath, debug, timings) {
 	const lockId = randomUUID();
 	const startedAt = Date.now();
 	await fs.mkdir(path.dirname(lockPath), { recursive: true });
 	while (true) {
 		if (await tryCreateStateLock(lockPath, lockId)) return lockId;
-		const tookOver = await takeOverStaleStateLock(lockPath, debug);
-		if (Date.now() - startedAt >= LOCK_WAIT_TIMEOUT_MS) throw new StateLockTimeoutError(lockPath);
-		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+		const tookOver = await takeOverStaleStateLock(lockPath, debug, timings);
+		if (Date.now() - startedAt >= timings.waitTimeoutMs) throw new StateLockTimeoutError(lockPath, timings.waitTimeoutMs);
+		if (!tookOver) await new Promise((resolve) => setTimeout(resolve, timings.retryMs));
 	}
 }
 async function tryCreateStateLock(lockPath, lockId) {
@@ -14184,10 +14504,10 @@ async function tryCreateStateLock(lockPath, lockId) {
 * then run their read-modify-write at once and one update is lost,
 * which is the very thing the lock exists to prevent.
 */
-async function takeOverStaleStateLock(lockPath, debug) {
+async function takeOverStaleStateLock(lockPath, debug, timings) {
 	const stale = await fs.stat(lockPath).catch(() => null);
 	if (stale === null) return true;
-	if (Date.now() - stale.mtimeMs <= LOCK_STALE_MS) return false;
+	if (Date.now() - stale.mtimeMs <= timings.staleMs) return false;
 	const takenPath = `${lockPath}.${randomUUID()}.stale`;
 	try {
 		await fs.rename(lockPath, takenPath);
@@ -14225,12 +14545,16 @@ function memoryBackedStorage(credential, withRefreshLock) {
 	let tokens = {
 		workspaceId: credentialWorkspaceId(credential.token) ?? NO_WORKSPACE_CLAIMED,
 		accessToken: credential.token,
-		refreshToken: credential.refreshToken
+		refreshToken: credential.refreshToken,
+		expiresAt: claimedExpiresAt(credential.token) ?? credential.expiresAt
 	};
 	return {
 		getTokens: async () => tokens,
-		setTokens: async (rotated) => {
-			tokens = rotated;
+		setTokens: async (rotated, expiresAt) => {
+			tokens = {
+				...rotated,
+				expiresAt: claimedExpiresAt(rotated.accessToken) ?? expiresAt ?? tokens?.expiresAt
+			};
 		},
 		clearTokens: async () => {
 			tokens = null;
@@ -14249,6 +14573,7 @@ var FileCredentialManager = class {
 	#filePath;
 	#debug;
 	#fetchWorkspaceName;
+	#refreshCredential;
 	#pin = { kind: "unresolved" };
 	/** Built for one pinned credential. Every mutation that moves the
 	*  pin discards it, so a command that mutates and then reaches for
@@ -14261,6 +14586,7 @@ var FileCredentialManager = class {
 		this.#filePath = resolveStateFilePath(options.env).filePath;
 		this.#debug = makeDebugLog(options.env, options.debugWrite);
 		this.#fetchWorkspaceName = options.fetchWorkspaceName;
+		this.#refreshCredential = options.refreshCredential;
 		this.#debug(`state file ${this.#filePath}`);
 	}
 	get stateFilePath() {
@@ -14371,14 +14697,13 @@ var FileCredentialManager = class {
 		this.#activeStorage ??= this.#buildActiveStorage();
 		return this.#activeStorage;
 	}
-	/** The spawn path's read: the active credential's access token,
+	/** The delegated path's read: the active credential's access token,
 	*  fresh on every call, never the refresh token. Null when there is
 	*  no active credential to read — storage exists only once
 	*  activeCredential() has returned non-null. */
-	async activeAccessToken() {
+	async activeAccessToken(options) {
 		if (await this.activeCredential() === null) return null;
-		const tokens = await (await this.activeCredentialStorage()).getTokens();
-		return tokens === null ? null : tokens.accessToken;
+		return readActiveAccessToken(await this.activeCredentialStorage(), this.#refreshCredential, options);
 	}
 	/** §11.2: which storage is chosen once, when the pin resolves. Each
 	*  has exactly one source of truth — the file, or process memory. */
@@ -14406,10 +14731,11 @@ var FileCredentialManager = class {
 				return {
 					workspaceId,
 					accessToken: record.token,
-					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken }
+					...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken },
+					...record.expiresAt === void 0 ? {} : { expiresAt: new Date(record.expiresAt) }
 				};
 			},
-			setTokens: async (tokens) => {
+			setTokens: async (tokens, expiresAt) => {
 				this.#debug(`rotation write for session ${workspaceId}`);
 				const claimed = credentialWorkspaceId(tokens.accessToken);
 				if (claimed !== void 0 && claimed !== workspaceId) throw credentialWorkspaceMismatchError(workspaceId);
@@ -14421,7 +14747,7 @@ var FileCredentialManager = class {
 						...record.name === void 0 ? {} : { name: record.name },
 						token: tokens.accessToken,
 						...tokens.refreshToken === void 0 ? {} : { refreshToken: tokens.refreshToken },
-						...expiresAtSlice(tokens.accessToken, void 0)
+						...expiresAtSlice(tokens.accessToken, expiresAt ?? (record.expiresAt === void 0 ? void 0 : new Date(record.expiresAt)))
 					};
 					return {
 						state: {
@@ -14450,7 +14776,7 @@ var FileCredentialManager = class {
 					};
 				});
 			},
-			withRefreshLock: (fn) => this.#withRefreshLock(fn)
+			withRefreshLock: (fn) => this.#withRefreshLock(() => withRefreshFileLock(this.#filePath, this.#debug, fn))
 		};
 	}
 	#withRefreshLock(fn) {
@@ -14586,6 +14912,45 @@ function environmentCredential(token) {
 	};
 }
 //#endregion
+//#region src/auth/refresh.ts
+const TRAILING_SLASH = /\/$/;
+const CREDENTIAL_REFRESH_TIMEOUT_MS = 1e4;
+/** The dumb HTTP adapter behind the engine's delegated-credential policy. */
+function makeCredentialRefresher(authBaseUrl) {
+	const endpoint = `${authBaseUrl.replace(TRAILING_SLASH, "")}/token`;
+	return async ({ refreshToken, signal }) => {
+		signal.throwIfAborted();
+		const refreshSignal = AbortSignal.any([signal, AbortSignal.timeout(CREDENTIAL_REFRESH_TIMEOUT_MS)]);
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			}),
+			signal: refreshSignal
+		});
+		const body = await readBody(response);
+		if (response.status >= 400 && response.status < 500 && body?.error === "invalid_grant") return { kind: "invalid" };
+		if (!response.ok || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string" || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in < 0) throw new Error(`OAuth token refresh failed (status ${String(response.status)})`);
+		return {
+			kind: "success",
+			accessToken: body.access_token,
+			refreshToken: body.refresh_token,
+			expiresAt: new Date(Date.now() + body.expires_in * 1e3)
+		};
+	};
+}
+async function readBody(response) {
+	try {
+		const body = await response.json();
+		return typeof body === "object" && body !== null ? body : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/auth/workspace-name.ts
 /** The manager's injected name lookup: a static-token client over the
 *  credential just minted. The manager constructs no API client and
@@ -14797,6 +15162,7 @@ async function assembleRuntime(proc) {
 	};
 	warnOnDeprecatedStateFileEnvVar(proc);
 	const apiBaseUrl = getApiBaseUrl(proc.env);
+	const authBaseUrl = getAuthBaseUrl(proc.env);
 	return {
 		stdout: { write: (text) => {
 			proc.stdout.write(text);
@@ -14823,13 +15189,14 @@ async function assembleRuntime(proc) {
 		loadConfig: (configPath) => loadConfig(proc.cwd(), configPath),
 		credentialManager: new FileCredentialManager({
 			env: proc.env,
-			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl)
+			fetchWorkspaceName: fetchWorkspaceName(apiBaseUrl),
+			refreshCredential: makeCredentialRefresher(authBaseUrl)
 		}),
 		managementApiClientConfig: {
 			clientId: CLIENT_ID,
 			redirectUri: DEFAULT_REDIRECT_URI,
 			apiBaseUrl,
-			authBaseUrl: getAuthBaseUrl(proc.env)
+			authBaseUrl
 		},
 		spawn: spawnChild,
 		/** The engine has already decided and composed; the bin only forks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "8.0.0-rc.2",
+  "version": "8.0.0-rc.2-dev.50",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@prisma/cli-engine": "8.0.0-rc.2",
+    "@prisma/cli-engine": "0.1.1",
     "@prisma/composer": "0.6.0-dev.16",
     "@prisma/compute-sdk": "0.39.0",
     "@prisma/credentials-store": "^7.8.0",
@@ -51,9 +51,9 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@repo/cli-conformance": "8.0.0-rc.2",
-    "@repo/cli-telemetry": "8.0.0-rc.2",
-    "@repo/tsconfig": "8.0.0-rc.2",
+    "@repo/cli-conformance": "8.0.0-rc.2-dev.50",
+    "@repo/cli-telemetry": "8.0.0-rc.2-dev.50",
+    "@repo/tsconfig": "8.0.0-rc.2-dev.50",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "tsx": "^4.22.4",