From 17f3f782e601ff48387cd6d3309488bf6a235aed Mon Sep 17 00:00:00 2001 From: willbot Date: Thu, 13 Aug 2026 11:26:04 +0200 Subject: [PATCH] Publish the bare prisma package on next: a committed wrapper, verified like everything else The bare prisma npm package gains the Prisma 8 RC line under the next dist-tag, while its latest keeps serving the pre-8 CLI shipped by prisma/prisma until the operator cuts over. The mechanism is a committed workspace package, packages/prisma: name prisma, bin prisma, one dependency pinning @prisma/cli at the lockstep version, and a two-line bin that imports the cli's bundled entry (newly exported as @prisma/cli/cli). Nothing is renamed or rewritten at publish time, keeping the rule that this workflow never rewrites a manifest. The tarball conformance check learns the wrapper shape: the sandbox install is rooted at the wrapper (what a user installs), both the prisma and prisma-cli bins are started on plain node, the wrapper must pin the shell exactly, and exactly one copy of the shell may resolve in the installed tree. startBin now receives the package whose tree holds the bin instead of inferring it from the sandbox root. The publish workflow ships it third (engine, cli, wrapper) in both the dry-run and real paths; pkg.pr.new previews include it; docs/oss/versioning.md records the shared ownership of the bare package's dist-tags. Registry prerequisite, not in this diff: npm Trusted Publishing for the prisma package must be granted to this repo's publish.yml before the next release, or the run fails at the prisma step (rerun-safe: engine and cli publishes are tolerated as already published). Signed-off-by: willbot Signed-off-by: Will Madden --- .github/workflows/preview-cli-package.yml | 2 +- .github/workflows/publish.yml | 16 +- docs/oss/versioning.md | 8 +- .../cli-conformance/src/checks/tarball.ts | 116 ++++++++++--- packages/cli-conformance/src/tarball-io.ts | 10 +- .../cli-conformance/tests/tarball.test.ts | 159 +++++++++++++++++- packages/cli/package.json | 1 + packages/cli/scripts/conformance.ts | 5 +- packages/prisma/LICENSE | 158 +++++++++++++++++ packages/prisma/README.md | 36 ++++ packages/prisma/bin/prisma.js | 2 + packages/prisma/package.json | 40 +++++ pnpm-lock.yaml | 6 + 13 files changed, 516 insertions(+), 43 deletions(-) create mode 100644 packages/prisma/LICENSE create mode 100644 packages/prisma/README.md create mode 100644 packages/prisma/bin/prisma.js create mode 100644 packages/prisma/package.json diff --git a/.github/workflows/preview-cli-package.yml b/.github/workflows/preview-cli-package.yml index 32196aab..009f80ca 100644 --- a/.github/workflows/preview-cli-package.yml +++ b/.github/workflows/preview-cli-package.yml @@ -66,7 +66,7 @@ jobs: - name: Publish installable PR preview id: publish_preview continue-on-error: ${{ vars.CLI_PR_PREVIEW_REQUIRED != 'true' }} - run: pnpm exec pkg-pr-new publish --bin --comment=update packages/cli packages/cli-engine + run: pnpm exec pkg-pr-new publish --bin --comment=update packages/cli packages/cli-engine packages/prisma - name: Summarize PR preview publish if: ${{ always() }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a0770342..8f0c0f14 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,10 +21,13 @@ name: Publish to npm # - workflow_dispatch → publish `` # under the chosen dist-tag (default `latest`); also the dry-run path. # -# Scope: publishes `@prisma/cli-engine` then `@prisma/cli` (the cli -# depends on the engine, so the engine goes first). `@prisma/compute` is -# excluded from the lockstep by operator ruling (2026-08-10) and keeps -# its own workflow (`publish-compute.yml`). +# Scope: publishes `@prisma/cli-engine`, then `@prisma/cli`, then the +# bare `prisma` wrapper (each depends on the one before it, so they go +# in that order). On the RC line all three land under `next`; the bare +# package's `latest` keeps serving the pre-8 CLI shipped by +# prisma/prisma until the operator moves it deliberately. +# `@prisma/compute` is excluded from the lockstep by operator ruling +# (2026-08-10) and keeps its own workflow (`publish-compute.yml`). on: push: @@ -152,7 +155,8 @@ jobs: # manifest. `--no-git-checks` because the packing step touches the # tree; the version itself is whatever the commit says. # - # Publish order: the engine first, then the cli that depends on it. + # Publish order: the engine, then the cli that depends on it, then + # the bare `prisma` wrapper that pins the cli. # Dry-run path: exercises the full publish pipeline (pack, validate # tarball contents, dependency rewriting) without touching the npm @@ -163,6 +167,7 @@ jobs: run: | pnpm --filter @prisma/cli-engine publish --tag "${{ steps.version.outputs.tag }}" --access public --no-git-checks --dry-run pnpm --filter @prisma/cli publish --tag "${{ steps.version.outputs.tag }}" --access public --no-git-checks --dry-run + pnpm --filter prisma publish --tag "${{ steps.version.outputs.tag }}" --access public --no-git-checks --dry-run # A rerun (or a re-publish dispatch) meets versions that are # already on the registry. npm refuses to publish over them — @@ -191,6 +196,7 @@ jobs: } publish_one @prisma/cli-engine publish_one @prisma/cli + publish_one prisma # Emit a GitHub Release for releases only — runs whose dist-tag is # the canonical one for their version (`next` on the RC line, diff --git a/docs/oss/versioning.md b/docs/oss/versioning.md index 7454818e..fe4c8721 100644 --- a/docs/oss/versioning.md +++ b/docs/oss/versioning.md @@ -8,7 +8,7 @@ Prisma 8 ships as a release-candidate line ahead of `8.0.0` final: releases are RC respins may include breaking changes until `8.0.0` final ships. There are no patch releases on the RC line — a fix ships as the next `rc.N`. -For the packages this repository's publish workflow ships (`@prisma/cli`, `@prisma/cli-engine`), **each release publishes under its line's canonical dist-tag**: RC-line versions under `next`, stable versions under `latest` (operator ruling 2026-08-12; supersedes the earlier "`latest` tracks the newest release, RC or stable"). A dist-tag moves only through a deliberately merged version-bump PR (or a manual `workflow_dispatch`); creating and merging the bump PR is the operator's explicit act. `latest` stays on the pre-8 CLI until the operator moves it deliberately. Existing installs are unaffected — lockfiles pin resolved versions, and nobody lands on the RC line without asking for `@next`. +For the packages this repository's publish workflow ships (`@prisma/cli`, `@prisma/cli-engine`, and the bare `prisma` wrapper), **each release publishes under its line's canonical dist-tag**: RC-line versions under `next`, stable versions under `latest` (operator ruling 2026-08-12; supersedes the earlier "`latest` tracks the newest release, RC or stable"). A dist-tag moves only through a deliberately merged version-bump PR (or a manual `workflow_dispatch`); creating and merging the bump PR is the operator's explicit act. `latest` stays on the pre-8 CLI until the operator moves it deliberately. Existing installs are unaffected — lockfiles pin resolved versions, and nobody lands on the RC line without asking for `@next`. The transition onto the RC line is a one-time bump from the pre-8 base to `8.0.0-rc.1`; `pnpm bump-version` encodes it (a pre-8 stable base advances to `8.0.0-rc.1`, an RC base advances its counter). @@ -18,7 +18,7 @@ Every lockstep workspace package — publishable, private, and the workspace roo **Exception:** `@prisma/compute` versions independently, pending extraction to another repository (operator ruling 2026-08-10). It is hard-excluded in [`scripts/set-version.ts`](../../scripts/set-version.ts) and keeps its own publish workflow ([`publish-compute.yml`](../../.github/workflows/publish-compute.yml)). -The lockstep set is: the workspace root, `packages/cli`, `packages/cli-engine`, `packages/cli-telemetry`, and `packages/tsconfig`. Private packages are never published (`pnpm publish` skips them), but they still version in lockstep so a contributor cloning the repo at any commit sees one consistent answer to "what version is this code?". Workspace-internal dependencies are pinned as `workspace:` (e.g. `workspace:8.0.0-rc.1`); pnpm resolves them locally during development and rewrites them to the exact version at publish time, so every published package carries an exact-version pin on its siblings. +The lockstep set is: the workspace root, `packages/cli`, `packages/cli-engine`, `packages/prisma`, `packages/cli-telemetry`, and `packages/tsconfig`. Private packages are never published (`pnpm publish` skips them), but they still version in lockstep so a contributor cloning the repo at any commit sees one consistent answer to "what version is this code?". Workspace-internal dependencies are pinned as `workspace:` (e.g. `workspace:8.0.0-rc.1`); pnpm resolves them locally during development and rewrites them to the exact version at publish time, so every published package carries an exact-version pin on its siblings. ## Dist-tag convention @@ -28,6 +28,8 @@ The npm registry exposes the CLI packages under these dist-tags: - **`next`** — the Prisma 8 RC line (`8.0.0-rc.N`). A merged release PR on the RC line publishes here automatically. - **`beta`** — reserved for hand-cut previews ahead of significant changes, published by dispatching the workflow with that dist-tag. Routine releases do not use this tag. +The bare `prisma` package is shared with the pre-8 CLI: its `latest`, `dev`, and the other historical dist-tags are still published by [prisma/prisma](https://github.com/prisma/prisma)'s release automation. This repository publishes only the RC line to that package, under `next`, via a thin wrapper ([`packages/prisma`](../../packages/prisma)) that pins `@prisma/cli` exactly and exposes the `prisma` binary. Moving the bare package's `latest` onto the 8.x line is the cutover act described above and happens on the operator's schedule, not before. + There is no `dev` channel. A push to `main` that does not change the version publishes nothing, because the version at that commit is already on the registry and there is nothing else this repository could honestly call the build. To hand someone an unreleased build, use the per-PR preview below. PR previews go through [`pkg.pr.new`](https://pkg.pr.new) ([`preview-cli-package.yml`](../../.github/workflows/preview-cli-package.yml)); they carry the committed base version and install via per-commit URLs, not dist-tags. @@ -51,7 +53,7 @@ This is by design. The alternatives cause silent problems: [`scripts/set-version.ts`](../../scripts/set-version.ts) is what enforces lockstep: a single invocation walks every lockstep workspace `package.json` and writes the requested version (rewriting `workspace:` dependency pins to match). It is a maintainer's tool, invoked through `pnpm bump-version`; the publish workflow does not run it. -The publish workflow is **triggered by a change to the root `version`**: a push to `main` whose root `package.json` carries a different `version` than the previous tip is recognised as a release bump and ships that version under its canonical dist-tag — `next` on the RC line (the accompanying GitHub Release is marked pre-release), `latest` for stable. This is what makes "merge the release PR" the publish trigger; there is no separate dispatch step. A push that leaves the version alone publishes nothing. Within a publish, `@prisma/cli-engine` goes first, then `@prisma/cli` (which depends on it). +The publish workflow is **triggered by a change to the root `version`**: a push to `main` whose root `package.json` carries a different `version` than the previous tip is recognised as a release bump and ships that version under its canonical dist-tag — `next` on the RC line (the accompanying GitHub Release is marked pre-release), `latest` for stable. This is what makes "merge the release PR" the publish trigger; there is no separate dispatch step. A push that leaves the version alone publishes nothing. Within a publish, `@prisma/cli-engine` goes first, then `@prisma/cli` (which depends on it), then the bare `prisma` wrapper (which pins `@prisma/cli`). **Nothing rewrites a `version` field outside a commit.** `set-version.ts` is run by `pnpm bump-version`, whose output a maintainer reviews and commits; the publish workflow never invokes it. That is what makes "the version is whatever `package.json` says" true rather than aspirational — CI has no way to ship a version no commit describes. It also keeps `pnpm-lock.yaml` honest: the lockfile records the `workspace:` specifiers that `set-version.ts` rewrites, so `bump-version` refreshes it in the same breath and the bump lands as one internally consistent commit. diff --git a/packages/cli-conformance/src/checks/tarball.ts b/packages/cli-conformance/src/checks/tarball.ts index c5cc29bf..59f4e4af 100644 --- a/packages/cli-conformance/src/checks/tarball.ts +++ b/packages/cli-conformance/src/checks/tarball.ts @@ -54,6 +54,8 @@ export interface TarballIo { ): Promise; startBin(input: { readonly sandboxDir: string; + /** The installed package whose tree contains the bin file. */ + readonly packageName: string; readonly binName: string; readonly relPath: string; readonly argv: readonly string[]; @@ -80,6 +82,13 @@ export interface PinException extends Suppression { export interface TarballInput { readonly packages: readonly { name: string; dir: string }[]; readonly shellPackage: string; + /** + * A published package that re-exposes the shell under another name + * (the bare `prisma` package wrapping `@prisma/cli`). When set, the + * sandbox install is rooted here, its bins are started alongside the + * shell's, and its packed manifest must pin the shell exactly. + */ + readonly wrapperPackage?: string; readonly enginePackage: string; /** Command-family packages the shell mounts; must be shell deps. */ readonly familyPackages: readonly string[]; @@ -130,9 +139,19 @@ export async function checkTarball( const shell = packed.get(input.shellPackage); if (shell === undefined) return findings; + const wrapper = + input.wrapperPackage === undefined + ? undefined + : packed.get(input.wrapperPackage); + if (input.wrapperPackage !== undefined && wrapper === undefined) { + return findings; + } findings.push(...manifestPinFindings(input, shell.manifest)); - findings.push(...(await sandboxFindings(input, shell, packed, io))); + if (wrapper !== undefined) { + findings.push(...wrapperPinFindings(input, wrapper.manifest)); + } + findings.push(...(await sandboxFindings(input, shell, wrapper, packed, io))); return applyExceptions(findings, input.exceptions); } @@ -188,13 +207,48 @@ function manifestPinFindings( return findings; } +/** The wrapper's leg of 3c: it must pin the shell, exactly. */ +function wrapperPinFindings( + input: TarballInput, + wrapperManifest: PackedManifest, +): readonly Finding[] { + const pin = wrapperManifest.dependencies?.[input.shellPackage]; + if (pin === undefined) { + return [ + finding( + "engine-pin-mismatch", + input.wrapperPackage ?? "(wrapper)", + `the wrapper does not declare ${input.shellPackage} as a dependency — it has nothing to delegate to`, + ), + ]; + } + if (!EXACT_VERSION.test(pin)) { + return [ + finding( + "engine-pin-mismatch", + input.wrapperPackage ?? "(wrapper)", + `the wrapper pins ${input.shellPackage} as "${pin}", which is not an exact version — a workspace: or range specifier survived packing`, + ), + ]; + } + return []; +} + /** 3b + 3c's installed legs, all downstream of one sandbox install. */ async function sandboxFindings( input: TarballInput, shell: { tarball: string; manifest: PackedManifest }, + wrapper: { tarball: string; manifest: PackedManifest } | undefined, packed: ReadonlyMap, io: TarballIo, ): Promise { + // The install is rooted at what a user would install: the wrapper + // when one ships, the shell otherwise. + const root = wrapper ?? shell; + const rootName = + wrapper === undefined + ? input.shellPackage + : (input.wrapperPackage ?? input.shellPackage); // Transitive: a sibling reached only through another sibling still // needs its override, or the install falls back to the registry. const overrides: Record = {}; @@ -208,38 +262,48 @@ async function sandboxFindings( visit(entry.manifest); } }; - visit(shell.manifest); + visit(root.manifest); const install = await io.installSandbox({ sandboxDir: input.sandboxDir, - rootTarball: shell.tarball, + rootTarball: root.tarball, overrides, }); if (!install.ok) { return [ finding( "install-failed", - input.shellPackage, + rootName, "the packed tarball did not install into a clean tree", install.output, ), ]; } - return [ - ...(await binFindings(input, shell.manifest, io)), - ...(await installedPinFindings(input, shell.manifest, io)), + const subjects: readonly { name: string; manifest: PackedManifest }[] = [ + { name: rootName, manifest: root.manifest }, + ...(wrapper === undefined + ? [] + : [{ name: input.shellPackage, manifest: shell.manifest }]), ]; + const findings: Finding[] = []; + for (const subject of subjects) { + // biome-ignore lint/performance/noAwaitInLoops: bins start one package at a time so a failure names its package + findings.push(...(await binFindings(input, subject, io))); + } + findings.push(...(await installedPinFindings(input, shell.manifest, io))); + return findings; } async function binFindings( input: TarballInput, - shellManifest: PackedManifest, + subject: { name: string; manifest: PackedManifest }, io: TarballIo, ): Promise { const findings: Finding[] = []; - for (const [binName, relPath] of declaredBins(shellManifest)) { + for (const [binName, relPath] of declaredBins(subject.manifest)) { // biome-ignore lint/performance/noAwaitInLoops: bins start one at a time so a failure names its bin and concurrent processes cannot confound each other's exit const run = await io.startBin({ sandboxDir: input.sandboxDir, + packageName: subject.name, binName, relPath, argv: ["--version"], @@ -249,7 +313,7 @@ async function binFindings( findings.push( finding( "bin-failed", - input.shellPackage, + subject.name, `bin ${binName} timed out instead of exiting`, run.stderr, ), @@ -258,7 +322,7 @@ async function binFindings( findings.push( finding( "bin-failed", - input.shellPackage, + subject.name, `bin ${binName} exited ${run.exitCode} on plain node`, `stdout:\n${run.stdout}\nstderr:\n${run.stderr}`, ), @@ -306,19 +370,23 @@ async function installedPinFindings( } } - const copies = await io.listInstalledCopies( - input.sandboxDir, - input.enginePackage, - ); - if (copies.length > 1) { - findings.push( - finding( - "engine-pin-mismatch", - input.enginePackage, - `${copies.length} copies of ${input.enginePackage} resolve in the installed tree (${copies.map((c) => c.version).join(", ")})`, - copies.map((c) => `${c.version} ${c.path}`).join("\n"), - ), - ); + const singletons = + input.wrapperPackage === undefined + ? [input.enginePackage] + : [input.enginePackage, input.shellPackage]; + for (const name of singletons) { + // biome-ignore lint/performance/noAwaitInLoops: one sweep per singleton package keeps findings ordered + const copies = await io.listInstalledCopies(input.sandboxDir, name); + if (copies.length > 1) { + findings.push( + finding( + "engine-pin-mismatch", + name, + `${copies.length} copies of ${name} resolve in the installed tree (${copies.map((c) => c.version).join(", ")})`, + copies.map((c) => `${c.version} ${c.path}`).join("\n"), + ), + ); + } } return findings; } diff --git a/packages/cli-conformance/src/tarball-io.ts b/packages/cli-conformance/src/tarball-io.ts index fe600d3a..225b16cf 100644 --- a/packages/cli-conformance/src/tarball-io.ts +++ b/packages/cli-conformance/src/tarball-io.ts @@ -171,22 +171,16 @@ export function realTarballIo( async startBin({ sandboxDir, + packageName, binName: _binName, relPath, argv, timeoutMs, }) { - const rootManifestPath = join(sandbox(), "package.json"); - const rootManifest = JSON.parse( - readFileSync(rootManifestPath, "utf8"), - ) as { - dependencies: Record; - }; - const shellName = Object.keys(rootManifest.dependencies)[0] ?? ""; const binPath = join( sandboxDir, "node_modules", - ...shellName.split("/"), + ...packageName.split("/"), relPath, ); try { diff --git a/packages/cli-conformance/tests/tarball.test.ts b/packages/cli-conformance/tests/tarball.test.ts index ef988bc0..1d6bc753 100644 --- a/packages/cli-conformance/tests/tarball.test.ts +++ b/packages/cli-conformance/tests/tarball.test.ts @@ -297,7 +297,8 @@ describe("checkTarball", () => { test("3b: every declared bin is started; a non-zero exit names the bin", async () => { const started: string[] = []; const io = fakeIo({ - startBin: ({ binName }) => { + startBin: ({ binName, packageName }) => { + expect(packageName).toBe("@prisma/cli"); started.push(binName); return Promise.resolve({ exitCode: binName === "prisma-cli" ? 3 : 0, @@ -402,6 +403,162 @@ describe("checkTarball", () => { expect(started).toEqual([{ binName: "cli", relPath: "./dist/cli.js" }]); }); + describe("wrapper package", () => { + const WRAPPER_MANIFEST = { + name: "prisma", + version: "8.0.0-rc.1", + bin: { prisma: "./bin/prisma.js" }, + dependencies: { "@prisma/cli": "8.0.0-rc.1" }, + } as unknown as PackageManifest; + + function packedManifestFor( + tarball: string, + wrapperManifest: PackageManifest, + ): PackageManifest { + if (tarball.includes("cli-engine")) return ENGINE_MANIFEST; + if (tarball.includes("packages/prisma")) return wrapperManifest; + return { + ...SHELL_MANIFEST, + name: "@prisma/cli", + version: "8.0.0-rc.1", + } as PackageManifest; + } + + function packedFilesFor(tarball: string): ReadonlyMap { + if (tarball.includes("cli-engine")) { + return new Map([ + ["dist/index.js", 'import "@stricli/core";\nimport "colorette";\n'], + ]); + } + if (tarball.includes("packages/prisma")) { + return new Map([["bin/prisma.js", 'import "@prisma/cli/cli";\n']]); + } + return new Map([ + [ + "dist/cli.js", + 'import "colorette";\nimport "@prisma/cli-engine";\nimport "@prisma/composer/family";\n', + ], + ]); + } + + function wrapperIo( + wrapperManifest = WRAPPER_MANIFEST, + overrides: Partial = {}, + ): TarballIo { + return fakeIo({ + pack: (pkgDir) => Promise.resolve({ tarball: `/abs/${pkgDir}.tgz` }), + readPackedManifest: (tarball) => + Promise.resolve(packedManifestFor(tarball, wrapperManifest)), + readPackedFiles: (tarball) => Promise.resolve(packedFilesFor(tarball)), + ...overrides, + }); + } + + const wrapperInput = (overrides: Partial = {}) => + input({ + packages: [ + { name: "prisma", dir: "packages/prisma" }, + { name: "@prisma/cli", dir: "packages/cli" }, + { name: "@prisma/cli-engine", dir: "packages/cli-engine" }, + ], + wrapperPackage: "prisma", + ...overrides, + }); + + test("the install is rooted at the wrapper with the shell and engine overridden in", async () => { + let root = ""; + let seen: Readonly> = {}; + const io = wrapperIo(WRAPPER_MANIFEST, { + installSandbox: ({ rootTarball, overrides: o }) => { + root = rootTarball; + seen = o; + return Promise.resolve({ ok: true as const }); + }, + }); + await checkTarball(wrapperInput(), io); + expect(root).toBe("/abs/packages/prisma.tgz"); + expect(seen["@prisma/cli@8.0.0-rc.1"]).toBe("file:/abs/packages/cli.tgz"); + }); + + test("both the wrapper's and the shell's bins are started in their own package trees", async () => { + const started: { packageName: string; binName: string }[] = []; + const io = wrapperIo(WRAPPER_MANIFEST, { + startBin: ({ packageName, binName }) => { + started.push({ packageName, binName }); + return Promise.resolve({ + exitCode: 0, + stdout: "8.0.0-rc.1", + stderr: "", + timedOut: false, + }); + }, + }); + await checkTarball(wrapperInput(), io); + expect(started).toEqual([ + { packageName: "prisma", binName: "prisma" }, + { packageName: "@prisma/cli", binName: "prisma-cli" }, + ]); + }); + + test("a wrapper whose shell pin is not exact is a finding naming the wrapper", async () => { + const io = wrapperIo({ + ...WRAPPER_MANIFEST, + dependencies: { "@prisma/cli": "workspace:8.0.0-rc.1" }, + } as PackageManifest); + const findings = await checkTarball(wrapperInput(), io); + expect( + findings.some( + (f) => + f.kind === "engine-pin-mismatch" && + f.subject === "prisma" && + f.summary.includes("workspace:"), + ), + ).toBe(true); + }); + + test("a wrapper that does not depend on the shell is a finding", async () => { + const io = wrapperIo({ + ...WRAPPER_MANIFEST, + dependencies: {}, + } as PackageManifest); + const findings = await checkTarball(wrapperInput(), io); + expect( + findings.some( + (f) => + f.kind === "engine-pin-mismatch" && + f.subject === "prisma" && + f.summary.includes("nothing to delegate to"), + ), + ).toBe(true); + }); + + test("two installed copies of the shell under a wrapper is a finding", async () => { + const io = wrapperIo(WRAPPER_MANIFEST, { + listInstalledCopies: (_s, name) => + Promise.resolve( + name === "@prisma/cli" + ? [ + { version: "8.0.0-rc.1", path: "node_modules/@prisma/cli" }, + { + version: "8.0.0-rc.0", + path: "node_modules/prisma/node_modules/@prisma/cli", + }, + ] + : [], + ), + }); + const findings = await checkTarball(wrapperInput(), io); + expect( + findings.some( + (f) => + f.kind === "engine-pin-mismatch" && + f.subject === "@prisma/cli" && + f.summary.includes("2 copies"), + ), + ).toBe(true); + }); + }); + test("no packages at all is a finding, not a pass", async () => { const findings = await checkTarball(input({ packages: [] }), fakeIo()); expect(kinds(findings)).toEqual(["no-subjects"]); diff --git a/packages/cli/package.json b/packages/cli/package.json index 07214a98..82136b2d 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -7,6 +7,7 @@ "prisma-cli": "./dist/cli.js" }, "exports": { + "./cli": "./dist/cli.js", "./package.json": "./package.json" }, "files": [ diff --git a/packages/cli/scripts/conformance.ts b/packages/cli/scripts/conformance.ts index f8a370ef..a81c4370 100644 --- a/packages/cli/scripts/conformance.ts +++ b/packages/cli/scripts/conformance.ts @@ -33,6 +33,7 @@ import { const CLI_DIR = fileURLToPath(new URL("..", import.meta.url)); const ENGINE_DIR = join(CLI_DIR, "..", "cli-engine"); +const BARE_DIR = join(CLI_DIR, "..", "prisma"); // At the REPO ROOT, not inside this package: a sandbox node_modules of // ~440 packages inside packages/cli slows vitest's file crawl enough to // time out unrelated tests. @@ -77,10 +78,12 @@ async function tarball(): Promise { return checkTarball( { packages: [ + { name: "prisma", dir: BARE_DIR }, { name: "@prisma/cli", dir: CLI_DIR }, { name: "@prisma/cli-engine", dir: ENGINE_DIR }, ], shellPackage: "@prisma/cli", + wrapperPackage: "prisma", enginePackage: "@prisma/cli-engine", familyPackages: ["@prisma/composer", "@prisma/orm-toolchain"], exceptions: [ @@ -120,6 +123,6 @@ const findings: Finding[] = [ ...validatorNoThrow(), ...(await tarball()), ]; -const report = { findings, subjectsChecked: 2 + 1 + 2 }; +const report = { findings, subjectsChecked: 2 + 1 + 3 }; process.stdout.write(renderHuman(report)); process.exitCode = exitCodeFor(report); diff --git a/packages/prisma/LICENSE b/packages/prisma/LICENSE new file mode 100644 index 00000000..c6732f40 --- /dev/null +++ b/packages/prisma/LICENSE @@ -0,0 +1,158 @@ +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + +"License" shall mean the terms and conditions for use, reproduction, and +distribution as defined by Sections 1 through 9 of this document. + +"Licensor" shall mean the copyright owner or entity authorized by the copyright +owner that is granting the License. + +"Legal Entity" shall mean the union of the acting entity and all other entities +that control, are controlled by, or are under common control with that entity. +For the purposes of this definition, "control" means (i) the power, direct or +indirect, to cause the direction or management of such entity, whether by +contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the +outstanding shares, or (iii) beneficial ownership of such entity. + +"You" (or "Your") shall mean an individual or Legal Entity exercising +permissions granted by this License. + +"Source" form shall mean the preferred form for making modifications, including +but not limited to software source code, documentation source, and configuration +files. + +"Object" form shall mean any form resulting from mechanical transformation or +translation of a Source form, including but not limited to compiled object code, +generated documentation, and conversions to other media types. + +"Work" shall mean the work of authorship, whether in Source or Object form, made +available under the License, as indicated by a copyright notice that is included +in or attached to the work. + +"Derivative Works" shall mean any work, whether in Source or Object form, that +is based on (or derived from) the Work and for which the editorial revisions, +annotations, elaborations, or other modifications represent, as a whole, an +original work of authorship. For the purposes of this License, Derivative Works +shall not include works that remain separable from, or merely link (or bind by +name) to the interfaces of, the Work and Derivative Works thereof. + +"Contribution" shall mean any work of authorship, including the original version +of the Work and any modifications or additions to that Work or Derivative Works +thereof, that is intentionally submitted to Licensor for inclusion in the Work by +the copyright owner or by an individual or Legal Entity authorized to submit on +behalf of the copyright owner. For the purposes of this definition, "submitted" +means any form of electronic, verbal, or written communication sent to the +Licensor or its representatives, including but not limited to communication on +electronic mailing lists, source code control systems, and issue tracking +systems that are managed by, or on behalf of, the Licensor for the purpose of +discussing and improving the Work, but excluding communication that is +conspicuously marked or otherwise designated in writing by the copyright owner +as "Not a Contribution." + +"Contributor" shall mean Licensor and any individual or Legal Entity on behalf +of whom a Contribution has been received by Licensor and subsequently +incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of this +License, each Contributor hereby grants to You a perpetual, worldwide, +non-exclusive, no-charge, royalty-free, irrevocable copyright license to +reproduce, prepare Derivative Works of, publicly display, publicly perform, +sublicense, and distribute the Work and such Derivative Works in Source or Object +form. + +3. Grant of Patent License. Subject to the terms and conditions of this License, +each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) patent +license to make, have made, use, offer to sell, sell, import, and otherwise +transfer the Work, where such license applies only to those patent claims +licensable by such Contributor that are necessarily infringed by their +Contribution(s) alone or by combination of their Contribution(s) with the Work to +which such Contribution(s) was submitted. If You institute patent litigation +against any entity (including a cross-claim or counterclaim in a lawsuit) +alleging that the Work or a Contribution incorporated within the Work +constitutes direct or contributory patent infringement, then any patent licenses +granted to You under this License for that Work shall terminate as of the date +such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the Work or +Derivative Works thereof in any medium, with or without modifications, and in +Source or Object form, provided that You meet the following conditions: + +(a) You must give any other recipients of the Work or Derivative Works a copy of +this License; and + +(b) You must cause any modified files to carry prominent notices stating that You +changed the files; and + +(c) You must retain, in the Source form of any Derivative Works that You +distribute, all copyright, patent, trademark, and attribution notices from the +Source form of the Work, excluding those notices that do not pertain to any part +of the Derivative Works; and + +(d) If the Work includes a "NOTICE" text file as part of its distribution, then +any Derivative Works that You distribute must include a readable copy of the +attribution notices contained within such NOTICE file, excluding those notices +that do not pertain to any part of the Derivative Works, in at least one of the +following places: within a NOTICE text file distributed as part of the Derivative +Works; within the Source form or documentation, if provided along with the +Derivative Works; or, within a display generated by the Derivative Works, if and +wherever such third-party notices normally appear. The contents of the NOTICE +file are for informational purposes only and do not modify the License. You may +add Your own attribution notices within Derivative Works that You distribute, +alongside or as an addendum to the NOTICE text from the Work, provided that such +additional attribution notices cannot be construed as modifying the License. + +You may add Your own copyright statement to Your modifications and may provide +additional or different license terms and conditions for use, reproduction, or +distribution of Your modifications, or for any such Derivative Works as a whole, +provided Your use, reproduction, and distribution of the Work otherwise complies +with the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, any +Contribution intentionally submitted for inclusion in the Work by You to the +Licensor shall be under the terms and conditions of this License, without any +additional terms or conditions. Notwithstanding the above, nothing herein shall +supersede or modify the terms of any separate license agreement you may have +executed with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade names, +trademarks, service marks, or product names of the Licensor, except as required +for reasonable and customary use in describing the origin of the Work and +reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or agreed to in +writing, Licensor provides the Work (and each Contributor provides its +Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, +either express or implied, including, without limitation, any warranties or +conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A +PARTICULAR PURPOSE. You are solely responsible for determining the +appropriateness of using or redistributing the Work and assume any risks +associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, whether in +tort (including negligence), contract, or otherwise, unless required by +applicable law (such as deliberate and grossly negligent acts) or agreed to in +writing, shall any Contributor be liable to You for damages, including any +direct, indirect, special, incidental, or consequential damages of any character +arising as a result of this License or out of the use or inability to use the +Work (including but not limited to damages for loss of goodwill, work stoppage, +computer failure or malfunction, or any and all other commercial damages or +losses), even if such Contributor has been advised of the possibility of such +damages. + +9. Accepting Warranty or Additional Liability. While redistributing the Work or +Derivative Works thereof, You may choose to offer, and charge a fee for, +acceptance of support, warranty, indemnity, or other liability obligations and/or +rights consistent with this License. However, in accepting such obligations, You +may act only on Your own behalf and on Your sole responsibility, not on behalf of +any other Contributor, and only if You agree to indemnify, defend, and hold each +Contributor harmless for any liability incurred by, or claims asserted against, +such Contributor by reason of your accepting any such warranty or additional +liability. + +END OF TERMS AND CONDITIONS diff --git a/packages/prisma/README.md b/packages/prisma/README.md new file mode 100644 index 00000000..a73a812d --- /dev/null +++ b/packages/prisma/README.md @@ -0,0 +1,36 @@ +

+ Prisma +

+ +# Prisma CLI + +[![npm version](https://img.shields.io/npm/v/prisma/next?label=npm%40next)](https://www.npmjs.com/package/prisma) +[![license](https://img.shields.io/npm/l/prisma)](https://github.com/prisma/prisma-cli/blob/main/LICENSE) + +This is the Prisma 8 release candidate of the `prisma` package: the command-line interface for the Prisma Developer Platform. It is published under the `next` dist-tag while the release candidate matures; the `latest` dist-tag continues to serve the current stable Prisma CLI. + +The package installs the `prisma` binary and delegates to [`@prisma/cli`](https://www.npmjs.com/package/@prisma/cli), which contains the CLI implementation. + +## Quickstart + +```bash +npm install --save-dev prisma@next +npx prisma --help +npx prisma auth login +npx prisma app deploy +``` + +## Documentation + +- [CLI docs index](https://github.com/prisma/prisma-cli/blob/main/docs/README.md) +- [Command spec](https://github.com/prisma/prisma-cli/blob/main/docs/product/command-spec.md) + +## Support + +Please use [GitHub issues](https://github.com/prisma/prisma-cli/issues) for bug reports and feature requests. + +Security reports should follow Prisma's [security policy](https://github.com/prisma/prisma-cli/blob/main/SECURITY.md) and should not be filed as public issues. + +## License + +Apache-2.0 diff --git a/packages/prisma/bin/prisma.js b/packages/prisma/bin/prisma.js new file mode 100644 index 00000000..73c9bf09 --- /dev/null +++ b/packages/prisma/bin/prisma.js @@ -0,0 +1,2 @@ +#!/usr/bin/env node +import "@prisma/cli/cli"; diff --git a/packages/prisma/package.json b/packages/prisma/package.json new file mode 100644 index 00000000..a984ac00 --- /dev/null +++ b/packages/prisma/package.json @@ -0,0 +1,40 @@ +{ + "name": "prisma", + "version": "8.0.0-rc.1", + "description": "Command-line interface for the Prisma Developer Platform.", + "type": "module", + "bin": { + "prisma": "./bin/prisma.js" + }, + "files": [ + "bin", + "README.md", + "LICENSE" + ], + "publishConfig": { + "access": "public" + }, + "engines": { + "node": ">=22.18.0" + }, + "keywords": [ + "prisma", + "cli", + "database", + "app", + "deployment" + ], + "repository": { + "type": "git", + "url": "https://github.com/prisma/prisma-cli.git", + "directory": "packages/prisma" + }, + "homepage": "https://github.com/prisma/prisma-cli#readme", + "bugs": { + "url": "https://github.com/prisma/prisma-cli/issues" + }, + "license": "Apache-2.0", + "dependencies": { + "@prisma/cli": "workspace:8.0.0-rc.1" + } +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e55316a3..94aa515f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -189,6 +189,12 @@ importers: specifier: ^4.1.8 version: 4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)) + packages/prisma: + dependencies: + '@prisma/cli': + specifier: workspace:8.0.0-rc.1 + version: link:../cli + packages/tsconfig: {} packages: