@prisma/cli 3.0.0-beta.11 → 3.0.0-beta.13

package/dist/adapters/token-storage.js

@@ -4,6 +4,18 @@ import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { CredentialsStore } from "@prisma/credentials-store";
 //#region src/adapters/token-storage.ts
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const EMPTY_AUTH_CONTEXT = {
+	activeWorkspaceId: null,
+	workspaces: {}
+};
+function getAuthContextFilePath(authFilePath) {
+	const extension = path.extname(authFilePath);
+	if (!extension) return `${authFilePath}.context.json`;
+	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
+}
 function findLatestValidTokens(allCredentials) {
 	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
 		const credential = allCredentials[i];
@@ -17,6 +29,18 @@ function findLatestValidTokens(allCredentials) {
 	}
 	return null;
 }
+function storedCredentialToTokens(credential) {
+	if (!credential) return null;
+	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
+	return {
+		workspaceId: credential.workspaceId,
+		accessToken: credential.token,
+		refreshToken: credential.refreshToken
+	};
+}
+function findTokensForWorkspace(allCredentials, workspaceId) {
+	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
+}
 function tokensEqual(a, b) {
 	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
@@ -36,25 +60,44 @@ function sleep(ms, signal) {
 }
 var FileTokenStorage = class {
 	credentialsStore;
+	authFilePath;
+	contextFilePath;
 	lockFilePath;
-	constructor(env = process.env, signal) {
+	constructor(env = process.env, signal, options = {}) {
 		this.signal = signal;
+		this.options = options;
 		const authFilePath = getAuthFilePath(env);
+		this.authFilePath = authFilePath;
+		this.contextFilePath = getAuthContextFilePath(authFilePath);
 		this.credentialsStore = new CredentialsStore(authFilePath);
 		this.lockFilePath = `${authFilePath}.lock`;
 	}
 	async getTokens() {
 		this.signal?.throwIfAborted();
 		try {
-			const all = await this.credentialsStore.getCredentials();
-			this.signal?.throwIfAborted();
-			return findLatestValidTokens(all);
+			const credentials = await this.readCredentialsFromDisk();
+			const context = await this.readAuthContext();
+			if (context.state.activeWorkspaceId) return findTokensForWorkspace(credentials, context.state.activeWorkspaceId);
+			const latest = findLatestValidTokens(credentials);
+			if (!latest) return null;
+			if (!context.exists) {
+				await this.setActiveWorkspaceId(latest.workspaceId);
+				return latest;
+			}
+			return null;
 		} catch (_error) {
 			if (this.signal?.aborted) throw this.signal.reason;
 			return null;
 		}
 	}
 	async setTokens(tokens) {
+		if (this.options.lockSetTokens === false) {
+			await this.setTokensUnlocked(tokens);
+			return;
+		}
+		await this.withRefreshLock(() => this.setTokensUnlocked(tokens));
+	}
+	async setTokensUnlocked(tokens) {
 		this.signal?.throwIfAborted();
 		await this.credentialsStore.storeCredentials({
 			workspaceId: tokens.workspaceId,
@@ -62,20 +105,115 @@ var FileTokenStorage = class {
 			refreshToken: tokens.refreshToken
 		});
 		this.signal?.throwIfAborted();
+		await this.rememberWorkspaceUnlocked(tokens.workspaceId, {
+			id: tokens.workspaceId,
+			name: tokens.workspaceId
+		});
+		await this.maybeActivateWorkspaceId(tokens.workspaceId);
 	}
 	async clearTokens() {
+		await this.withRefreshLock(() => this.clearTokensUnlocked());
+	}
+	async clearTokensUnlocked() {
 		this.signal?.throwIfAborted();
-		const all = await this.credentialsStore.getCredentials();
+		await fs.mkdir(path.dirname(this.authFilePath), { recursive: true });
 		this.signal?.throwIfAborted();
-		const tokens = findLatestValidTokens(all);
-		if (!tokens) return;
-		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await fs.writeFile(this.authFilePath, `${JSON.stringify({ tokens: [] }, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		await this.clearAuthContext();
+		await this.credentialsStore.reloadCredentialsFromDisk();
 		this.signal?.throwIfAborted();
 	}
 	async clearTokensIfCurrent(tokens) {
 		this.signal?.throwIfAborted();
 		if (!tokensEqual(await this.getTokens(), tokens)) return;
-		await this.clearTokens();
+		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await this.removeRememberedWorkspace(tokens.workspaceId, { preserveActivePointer: true });
+		this.signal?.throwIfAborted();
+	}
+	async listWorkspaces() {
+		this.signal?.throwIfAborted();
+		const credentials = await this.readCredentialsFromDisk();
+		const context = await this.ensureMigratedAuthContext(credentials);
+		return credentials.map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null).map((tokens) => {
+			const cached = context.state.workspaces[tokens.workspaceId];
+			const id = typeof cached?.id === "string" && cached.id.trim().length > 0 ? cached.id.trim() : tokens.workspaceId;
+			const name = typeof cached?.name === "string" && cached.name.trim().length > 0 ? cached.name.trim() : id;
+			const lastSeenAt = typeof cached?.lastSeenAt === "string" && cached.lastSeenAt.trim().length > 0 ? cached.lastSeenAt.trim() : null;
+			return {
+				id,
+				name,
+				credentialWorkspaceId: tokens.workspaceId,
+				active: context.state.activeWorkspaceId === tokens.workspaceId,
+				lastSeenAt
+			};
+		});
+	}
+	async useWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.useWorkspaceUnlocked(workspaceRef));
+	}
+	async useWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const previous = workspaces.find((workspace) => workspace.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null;
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const selected = matches[0];
+		await this.setActiveWorkspaceId(selected.credentialWorkspaceId);
+		return {
+			previous,
+			selected
+		};
+	}
+	async logoutWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.logoutWorkspaceUnlocked(workspaceRef));
+	}
+	async logoutWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const workspace = matches[0];
+		const wasActive = context.state.activeWorkspaceId === workspace.credentialWorkspaceId;
+		await this.credentialsStore.deleteCredentials(workspace.credentialWorkspaceId);
+		this.signal?.throwIfAborted();
+		const remainingWorkspaces = workspaces.filter((candidate) => candidate.credentialWorkspaceId !== workspace.credentialWorkspaceId);
+		if (remainingWorkspaces.length === 0) {
+			await this.clearAuthContext();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace: null
+			};
+		}
+		delete context.state.workspaces[workspace.credentialWorkspaceId];
+		if (wasActive) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+		return {
+			workspace,
+			wasActive,
+			activeWorkspace: context.state.activeWorkspaceId === null ? null : remainingWorkspaces.find((candidate) => candidate.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null
+		};
+	}
+	async rememberWorkspace(credentialWorkspaceId, workspace) {
+		await this.withRefreshLock(() => this.rememberWorkspaceUnlocked(credentialWorkspaceId, workspace));
+	}
+	async rememberWorkspaceUnlocked(credentialWorkspaceId, workspace) {
+		const context = await this.readAuthContext();
+		context.state.workspaces[credentialWorkspaceId] = {
+			id: workspace.id,
+			name: workspace.name,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
 	}
 	async withRefreshLock(fn) {
 		const lockId = await this.acquireRefreshLock();
@@ -87,34 +225,48 @@ var FileTokenStorage = class {
 	}
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
+		const startedAt = Date.now();
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
 			this.signal?.throwIfAborted();
-			let lockFileCreated = false;
+			if (await this.tryCreateRefreshLock(lockId)) return lockId;
+			if (await this.releaseStaleRefreshLock()) continue;
+			this.throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs);
+			await sleep(retryMs, this.signal);
+		}
+	}
+	async tryCreateRefreshLock(lockId) {
+		let lockFileCreated = false;
+		try {
+			const handle = await fs.open(this.lockFilePath, "wx");
+			lockFileCreated = true;
 			try {
-				const handle = await fs.open(this.lockFilePath, "wx");
-				lockFileCreated = true;
-				try {
-					this.signal?.throwIfAborted();
-					await handle.writeFile(lockId, { encoding: "utf8" });
-					this.signal?.throwIfAborted();
-				} finally {
-					await handle.close();
-				}
-				return lockId;
-			} catch (error) {
-				if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
-				if (error.code !== "EEXIST") throw error;
-				const staleLockId = await this.getStaleRefreshLockId();
-				if (staleLockId) {
-					await this.releaseRefreshLock(staleLockId);
-					continue;
-				}
-				await sleep(100, this.signal);
+				this.signal?.throwIfAborted();
+				await handle.writeFile(lockId, { encoding: "utf8" });
+				this.signal?.throwIfAborted();
+			} finally {
+				await handle.close();
 			}
+			return true;
+		} catch (error) {
+			if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
+			if (error.code === "EEXIST") return false;
+			throw error;
 		}
 	}
+	async releaseStaleRefreshLock() {
+		const staleLockId = await this.getStaleRefreshLockId();
+		if (!staleLockId) return false;
+		await this.releaseRefreshLock(staleLockId);
+		return true;
+	}
+	throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs) {
+		if (Date.now() - startedAt < waitTimeoutMs) return;
+		throw new RefreshLockTimeoutError(this.lockFilePath, waitTimeoutMs);
+	}
 	async getStaleRefreshLockId() {
 		this.signal?.throwIfAborted();
 		const lockId = await fs.readFile(this.lockFilePath, {
@@ -129,12 +281,130 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		return Date.now() - stats.mtimeMs > 3e4 ? lockId : null;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
 		if (await fs.readFile(this.lockFilePath, { encoding: "utf8" }).catch(() => null) !== lockId) return;
 		await fs.unlink(this.lockFilePath).catch(() => {});
 	}
+	async readCredentialsFromDisk() {
+		this.signal?.throwIfAborted();
+		await this.credentialsStore.reloadCredentialsFromDisk();
+		this.signal?.throwIfAborted();
+		return await this.credentialsStore.getCredentials();
+	}
+	async ensureMigratedAuthContext(credentials) {
+		const context = await this.readAuthContext();
+		if (context.state.activeWorkspaceId || context.exists) return context;
+		const latest = findLatestValidTokens(credentials);
+		if (!latest) return context;
+		context.state.activeWorkspaceId = latest.workspaceId;
+		context.state.workspaces[latest.workspaceId] ??= {
+			id: latest.workspaceId,
+			name: latest.workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+		return {
+			exists: true,
+			state: context.state
+		};
+	}
+	async setActiveWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async maybeActivateWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		if (this.options.activateOnSetTokens === false && context.exists && context.state.activeWorkspaceId && context.state.activeWorkspaceId !== workspaceId) return;
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async removeRememberedWorkspace(workspaceId, options) {
+		const context = await this.readAuthContext();
+		delete context.state.workspaces[workspaceId];
+		if (!options.preserveActivePointer && context.state.activeWorkspaceId === workspaceId) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+	}
+	async readAuthContext() {
+		this.signal?.throwIfAborted();
+		const raw = await fs.readFile(this.contextFilePath, {
+			encoding: "utf8",
+			signal: this.signal
+		}).catch((error) => {
+			if (this.signal?.aborted) throw error;
+			if (error.code === "ENOENT") return null;
+			throw error;
+		});
+		if (raw === null) return {
+			exists: false,
+			state: structuredClone(EMPTY_AUTH_CONTEXT)
+		};
+		try {
+			const parsed = JSON.parse(raw);
+			return {
+				exists: true,
+				state: {
+					activeWorkspaceId: typeof parsed.activeWorkspaceId === "string" && parsed.activeWorkspaceId.trim().length > 0 ? parsed.activeWorkspaceId.trim() : null,
+					workspaces: parsed.workspaces && typeof parsed.workspaces === "object" && !Array.isArray(parsed.workspaces) ? parsed.workspaces : {}
+				}
+			};
+		} catch {
+			return {
+				exists: false,
+				state: structuredClone(EMPTY_AUTH_CONTEXT)
+			};
+		}
+	}
+	async writeAuthContext(state) {
+		this.signal?.throwIfAborted();
+		await fs.mkdir(path.dirname(this.contextFilePath), { recursive: true });
+		this.signal?.throwIfAborted();
+		await fs.writeFile(this.contextFilePath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		this.signal?.throwIfAborted();
+	}
+	async clearAuthContext() {
+		await fs.unlink(this.contextFilePath).catch((error) => {
+			if (error.code === "ENOENT") return;
+			throw error;
+		});
+	}
+};
+var WorkspaceSelectionError = class extends Error {
+	constructor(reason, workspaceRef, matches = []) {
+		super(reason);
+		this.reason = reason;
+		this.workspaceRef = workspaceRef;
+		this.matches = matches;
+		this.name = "WorkspaceSelectionError";
+	}
 };
+var RefreshLockTimeoutError = class extends Error {
+	constructor(lockFilePath, waitTimeoutMs) {
+		super(`Timed out waiting ${waitTimeoutMs}ms for auth refresh lock at ${lockFilePath}`);
+		this.name = "RefreshLockTimeoutError";
+	}
+};
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.credentialWorkspaceId === ref || workspace.id === ref || stripWorkspacePrefix(workspace.credentialWorkspaceId) === stripWorkspacePrefix(ref) || stripWorkspacePrefix(workspace.id) === stripWorkspacePrefix(ref) || workspace.name.toLowerCase() === ref.toLowerCase();
+}
+function stripWorkspacePrefix(value) {
+	return value.startsWith("wksp_") ? value.slice(5) : value;
+}
 //#endregion
-export { FileTokenStorage };
+export { FileTokenStorage, WorkspaceSelectionError };

package/dist/commands/app/index.js

@@ -1,8 +1,8 @@
 import { usageError } from "../../shell/errors.js";
+import { APP_BUILD_TYPES } from "../../lib/app/build.js";
 import { attachCommandDescriptor } from "../../shell/command-meta.js";
 import { addCompactGlobalFlags, addGlobalFlags } from "../../shell/global-flags.js";
 import { configureRuntimeCommand } from "../../shell/runtime.js";
-import { PREVIEW_BUILD_TYPES } from "../../lib/app/preview-build.js";
 import { runAppBuild, runAppDeploy, runAppDomainAdd, runAppDomainRemove, runAppDomainRetry, runAppDomainShow, runAppDomainWait, runAppListDeploys, runAppLogs, runAppOpen, runAppPromote, runAppRemove, runAppRollback, runAppRun, runAppShow, runAppShowDeploy } from "../../controllers/app.js";
 import { isAppDeployAllResult, renderAppBuild, renderAppDeploy, renderAppDeployAll, renderAppDomainAdd, renderAppDomainRemove, renderAppDomainRetry, renderAppDomainShow, renderAppListDeploys, renderAppOpen, renderAppPromote, renderAppRemove, renderAppRollback, renderAppRun, renderAppShow, renderAppShowDeploy, serializeAppBuild, serializeAppDeploy, serializeAppDeployAll, serializeAppDomainAdd, serializeAppDomainRemove, serializeAppDomainRetry, serializeAppDomainShow, serializeAppListDeploys, serializeAppOpen, serializeAppPromote, serializeAppRemove, serializeAppRollback, serializeAppRun, serializeAppShow, serializeAppShowDeploy } from "../../presenters/app.js";
 import { runCommand, runStreamingCommand } from "../../shell/command-runner.js";
@@ -28,7 +28,7 @@ function createAppCommand(runtime) {
 }
 function createBuildCommand(runtime) {
 	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("build"), runtime), "app.build");
-	command.argument("[app]", "App target from prisma.compute.ts when the config defines multiple apps").addOption(new Option("--entry <path>", "Entrypoint path for Bun or auto builds")).addOption(new Option("--build-type <type>", "Local build type").choices([...PREVIEW_BUILD_TYPES]).default("auto"));
+	command.argument("[app]", "App target from prisma.compute.ts when the config defines multiple apps").addOption(new Option("--entry <path>", "Entrypoint path for Bun or auto builds")).addOption(new Option("--build-type <type>", "Local build type").choices([...APP_BUILD_TYPES]).default("auto"));
 	addGlobalFlags(command);
 	command.action(async (configTarget, options) => {
 		const entry = options.entry;

package/dist/commands/auth/index.js

@@ -1,9 +1,9 @@
 import { attachCommandDescriptor } from "../../shell/command-meta.js";
 import { addCompactGlobalFlags, addGlobalFlags } from "../../shell/global-flags.js";
 import { configureRuntimeCommand } from "../../shell/runtime.js";
-import { runAuthLogin, runAuthLogout, runAuthWhoAmI } from "../../controllers/auth.js";
+import { runAuthLogin, runAuthLogout, runAuthWhoAmI, runAuthWorkspaceList, runAuthWorkspaceLogout, runAuthWorkspaceSelect, runAuthWorkspaceUse } from "../../controllers/auth.js";
 import { runCommand } from "../../shell/command-runner.js";
-import { renderAuthSuccess } from "../../presenters/auth.js";
+import { renderAuthSuccess, renderAuthWorkspaceList, renderAuthWorkspaceLogout, renderAuthWorkspaceUse, serializeAuthWorkspaceList, serializeAuthWorkspaceLogout, serializeAuthWorkspaceUse } from "../../presenters/auth.js";
 import { Command, Option } from "commander";
 //#region src/commands/auth/index.ts
 function createAuthCommand(runtime) {
@@ -12,6 +12,7 @@ function createAuthCommand(runtime) {
 	auth.addCommand(createAuthLoginCommand(runtime));
 	auth.addCommand(createAuthLogoutCommand(runtime));
 	auth.addCommand(createAuthWhoAmICommand(runtime));
+	auth.addCommand(createAuthWorkspaceCommand(runtime));
 	return auth;
 }
 function createAuthLoginCommand(runtime) {
@@ -25,8 +26,17 @@ function createAuthLoginCommand(runtime) {
 }
 function createAuthLogoutCommand(runtime) {
 	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("logout"), runtime), "auth.logout");
+	command.addOption(new Option("--workspace <id-or-name>", "Remove one stored OAuth workspace session"));
 	addGlobalFlags(command);
 	command.action(async (options) => {
+		const logoutOptions = options;
+		if (logoutOptions.workspace?.trim()) {
+			await runCommand(runtime, "auth.workspace.logout", options, (context) => runAuthWorkspaceLogout(context, logoutOptions.workspace), {
+				renderHuman: (context, descriptor, result) => renderAuthWorkspaceLogout(context, descriptor, result),
+				renderJson: (result) => serializeAuthWorkspaceLogout(result)
+			});
+			return;
+		}
 		await runCommand(runtime, "auth.logout", options, (context) => runAuthLogout(context), { renderHuman: (context, descriptor, result) => renderAuthSuccess(context, descriptor, "auth.logout", result) });
 	});
 	return command;
@@ -39,5 +49,60 @@ function createAuthWhoAmICommand(runtime) {
 	});
 	return command;
 }
+function createAuthWorkspaceCommand(runtime) {
+	const workspace = attachCommandDescriptor(configureRuntimeCommand(new Command("workspace"), runtime), "auth.workspace");
+	addCompactGlobalFlags(workspace);
+	workspace.addCommand(createAuthWorkspaceListCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceUseCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceSelectCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceLogoutCommand(runtime));
+	return workspace;
+}
+function createAuthWorkspaceListCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("list"), runtime), "auth.workspace.list");
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		await runCommand(runtime, "auth.workspace.list", options, (context) => runAuthWorkspaceList(context), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceList(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceList(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceSelectCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("select"), runtime), "auth.workspace.select");
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		await runCommand(runtime, "auth.workspace.select", options, (context) => runAuthWorkspaceSelect(context), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceUse(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceUse(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceLogoutCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("logout"), runtime), "auth.workspace.logout");
+	command.argument("<id-or-name>", "Workspace id or exact name");
+	addGlobalFlags(command);
+	command.action(async (workspaceRef, options) => {
+		await runCommand(runtime, "auth.workspace.logout", options, (context) => runAuthWorkspaceLogout(context, typeof workspaceRef === "string" ? workspaceRef : void 0), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceLogout(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceLogout(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceUseCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("use"), runtime), "auth.workspace.use");
+	command.argument("<id-or-name>", "Workspace id or exact name");
+	addGlobalFlags(command);
+	command.action(async (workspaceRef, options) => {
+		await runCommand(runtime, "auth.workspace.use", options, (context) => runAuthWorkspaceUse(context, typeof workspaceRef === "string" ? workspaceRef : void 0), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceUse(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceUse(result)
+		});
+	});
+	return command;
+}
 //#endregion
 export { createAuthCommand };

package/dist/controllers/app-env.js

@@ -1,7 +1,7 @@
 import { CliError, authRequiredError, usageError, workspaceRequiredError } from "../shell/errors.js";
-import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
 import { formatScopeLabel, parseKeyValuePositional, resolveEnvScope } from "../lib/app/env-config.js";
 import { readEnvFileAssignments } from "../lib/app/env-file.js";
+import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
 import { requireComputeAuth } from "../lib/auth/guard.js";
 import { readLocalGitBranch } from "../lib/git/local-branch.js";
 import { requireAuthenticatedAuthState } from "./auth.js";