@prisma/cli 3.0.0-beta.2 → 3.0.0-beta.20

package/README.md

@@ -57,6 +57,8 @@ Useful next commands:
 npx prisma-cli app logs
 npx prisma-cli app open
 npx prisma-cli project env add DATABASE_URL=postgresql://example --role preview
+npx prisma-cli project env add --file .env --role preview
+npx prisma-cli project env list
 npx prisma-cli project env list --role preview
 ```
 
@@ -73,7 +75,7 @@ The beta package exposes `prisma-cli` so it can coexist with the existing
 | `auth` | Log in, log out, and inspect the active Prisma account. |
 | `project` | List projects, show the resolved project, and manage project environment variables. |
 | `git` | Connect or disconnect a project from a GitHub repository. |
-| `branch` | Inspect the Prisma branch that maps to the current work context. |
+| `branch` | List Prisma branches for the resolved project. |
 | `app` | Build, run, deploy, inspect, open, stream logs, promote, roll back, and remove apps. |
 
 Common examples:
@@ -82,7 +84,7 @@ Common examples:
 npx prisma-cli version
 npx prisma-cli auth whoami
 npx prisma-cli project show
-npx prisma-cli branch show
+npx prisma-cli branch list
 npx prisma-cli app deploy --branch feat-login --framework nextjs
 npx prisma-cli app promote <deployment-id>
 ```
@@ -96,24 +98,11 @@ npx prisma-cli app promote <deployment-id>
 - Stable command groups, flags, and error codes for scripts and agents.
 - Environment variable values are not printed back to the terminal.
 
-### Agent skills
-
-For agent-guided Next.js deploys, install the Prisma CLI skill cluster at the
-project level. Match the skill ref to the installed CLI version:
-
-```bash
-npx prisma-cli version
-pnpm dlx skills@latest add prisma/prisma-cli/skills#cli-v<cli-version> --all
-```
-
-The skills teach agents how to prepare a Next.js app, run `app deploy`, verify
-the result, and route CLI / Compute feedback to the right Prisma channel.
-
 ---
 
 ## Beta notes
 
-- Requires Node.js 20 or newer.
+- Requires Node.js 22.12 or newer.
 - This is a beta package and may change quickly.
 - Official beta releases publish as `@prisma/cli`.
 - The package binary is `prisma-cli`, not `prisma`, during beta.

package/dist/adapters/git.js

@@ -2,7 +2,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/adapters/git.ts
 const execFileAsync = promisify(execFile);
-async function readGitOriginRemote(cwd) {
+async function readGitOriginRemote(cwd, signal) {
 	try {
 		const { stdout } = await execFileAsync("git", [
 			"config",
@@ -10,14 +10,19 @@ async function readGitOriginRemote(cwd) {
 			"remote.origin.url"
 		], {
 			cwd,
-			timeout: 5e3
+			timeout: 5e3,
+			signal
 		});
 		const remote = stdout.trim();
 		return remote.length > 0 ? remote : null;
-	} catch {
+	} catch (error) {
+		if (signal?.aborted || isAbortError(error)) throw error;
 		return null;
 	}
 }
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
 function parseGitHubRepositoryUrl(value) {
 	const input = value.trim();
 	const shorthand = input.match(/^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?$/);

package/dist/adapters/local-state.js

@@ -1,5 +1,5 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 //#region src/adapters/local-state.ts
 const DEFAULT_STATE = {
 	auth: null,
@@ -12,7 +12,8 @@ const DEFAULT_STATE = {
 	app: {
 		selectedByProject: {},
 		knownLiveDeploymentByProject: {}
-	}
+	},
+	agent: { setupPromptDismissedAt: null }
 };
 const DEFAULT_STATE_FILE_NAME = "state.json";
 function resolveLocalStateFilePath(stateDir) {
@@ -20,12 +21,17 @@ function resolveLocalStateFilePath(stateDir) {
 }
 var LocalStateStore = class {
 	stateFilePath;
-	constructor(stateDir) {
+	constructor(stateDir, signal) {
+		this.signal = signal;
 		this.stateFilePath = resolveLocalStateFilePath(stateDir);
 	}
 	async read() {
+		this.signal?.throwIfAborted();
 		try {
-			const raw = await readFile(this.stateFilePath, "utf8");
+			const raw = await readFile(this.stateFilePath, {
+				encoding: "utf8",
+				signal: this.signal
+			});
 			const parsed = JSON.parse(raw);
 			return {
 				auth: parsed.auth ?? structuredClone(DEFAULT_STATE.auth),
@@ -38,7 +44,8 @@ var LocalStateStore = class {
 				app: {
 					selectedByProject: parsed.app?.selectedByProject ?? {},
 					knownLiveDeploymentByProject: parsed.app?.knownLiveDeploymentByProject ?? {}
-				}
+				},
+				agent: { setupPromptDismissedAt: parsed.agent?.setupPromptDismissedAt ?? null }
 			};
 		} catch (error) {
 			if (error.code === "ENOENT") return structuredClone(DEFAULT_STATE);
@@ -46,8 +53,11 @@ var LocalStateStore = class {
 		}
 	}
 	async write(state) {
+		this.signal?.throwIfAborted();
 		await mkdir(path.dirname(this.stateFilePath), { recursive: true });
-		await writeFile(this.stateFilePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+		this.signal?.throwIfAborted();
+		await writeFile(this.stateFilePath, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8" });
+		this.signal?.throwIfAborted();
 	}
 	async setAuthSession(session) {
 		const state = await this.read();
@@ -131,6 +141,15 @@ var LocalStateStore = class {
 		await this.write(state);
 		return state;
 	}
+	async readAgentSetupPromptDismissedAt() {
+		return (await this.read()).agent.setupPromptDismissedAt;
+	}
+	async setAgentSetupPromptDismissedAt(dismissedAt) {
+		const state = await this.read();
+		state.agent.setupPromptDismissedAt = dismissedAt;
+		await this.write(state);
+		return state;
+	}
 };
 //#endregion
-export { LocalStateStore };
+export { LocalStateStore, resolveLocalStateFilePath };

package/dist/adapters/mock-api.js

@@ -5,8 +5,12 @@ var MockApi = class MockApi {
 	constructor(data) {
 		this.data = data;
 	}
-	static async load(fixturePath) {
-		const raw = await readFile(fixturePath, "utf8");
+	static async load(fixturePath, signal) {
+		signal?.throwIfAborted();
+		const raw = await readFile(fixturePath, {
+			encoding: "utf8",
+			signal
+		});
 		return new MockApi(JSON.parse(raw));
 	}
 	listProviders() {
@@ -52,6 +56,81 @@ var MockApi = class MockApi {
 	getDeployment(deploymentId) {
 		return this.data.deployments.find((deployment) => deployment.id === deploymentId);
 	}
+	listDatabasesForProject(projectId, branchName) {
+		return (this.data.databases ?? []).filter((database) => database.projectId === projectId && (!branchName || database.branchName === branchName));
+	}
+	getDatabase(databaseId) {
+		return (this.data.databases ?? []).find((database) => database.id === databaseId);
+	}
+	createDatabase(input) {
+		this.data.databases ??= [];
+		this.data.databaseConnections ??= [];
+		const database = {
+			id: `db_${this.data.databases.length + 1e3}`,
+			projectId: input.projectId,
+			branchId: input.branchName ? this.getBranchForProject(input.projectId, input.branchName)?.id ?? null : null,
+			branchName: input.branchName ?? null,
+			name: input.name,
+			region: input.region ?? null,
+			status: "ready",
+			isDefault: false,
+			createdAt: "2026-06-09T00:00:00.000Z"
+		};
+		const connectionString = `postgresql://${database.id}.example.prisma.io/postgres`;
+		const connection = {
+			id: `conn_${this.data.databaseConnections.length + 1e3}`,
+			databaseId: database.id,
+			name: "primary",
+			createdAt: "2026-06-09T00:00:00.000Z",
+			connectionString
+		};
+		this.data.databases.push(database);
+		this.data.databaseConnections.push(connection);
+		return {
+			database,
+			connection,
+			connectionString
+		};
+	}
+	removeDatabase(databaseId) {
+		this.data.databases ??= [];
+		this.data.databaseConnections ??= [];
+		const database = this.getDatabase(databaseId);
+		if (!database) return;
+		this.data.databases = this.data.databases.filter((candidate) => candidate.id !== databaseId);
+		this.data.databaseConnections = this.data.databaseConnections.filter((connection) => connection.databaseId !== databaseId);
+		return database;
+	}
+	listDatabaseConnections(databaseId) {
+		return (this.data.databaseConnections ?? []).filter((connection) => connection.databaseId === databaseId);
+	}
+	getDatabaseConnection(connectionId) {
+		return (this.data.databaseConnections ?? []).find((connection) => connection.id === connectionId);
+	}
+	createDatabaseConnection(input) {
+		if (!this.getDatabase(input.databaseId)) return;
+		this.data.databaseConnections ??= [];
+		const connectionString = `postgresql://${input.databaseId}-${this.data.databaseConnections.length + 1}.example.prisma.io/postgres`;
+		const connection = {
+			id: `conn_${this.data.databaseConnections.length + 1e3}`,
+			databaseId: input.databaseId,
+			name: input.name,
+			createdAt: "2026-06-09T00:00:00.000Z",
+			connectionString
+		};
+		this.data.databaseConnections.push(connection);
+		return {
+			connection,
+			connectionString
+		};
+	}
+	removeDatabaseConnection(connectionId) {
+		this.data.databaseConnections ??= [];
+		const connection = this.getDatabaseConnection(connectionId);
+		if (!connection) return;
+		this.data.databaseConnections = this.data.databaseConnections.filter((candidate) => candidate.id !== connectionId);
+		return connection;
+	}
 };
 //#endregion
 export { MockApi };

package/dist/adapters/token-storage.js

@@ -1,9 +1,22 @@
 import { getAuthFilePath } from "../lib/auth/client.js";
-import fs from "node:fs/promises";
 import path from "node:path";
-import { CredentialsStore } from "@prisma/credentials-store";
+import fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import { CredentialsStore } from "@prisma/credentials-store";
 //#region src/adapters/token-storage.ts
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const EMPTY_AUTH_CONTEXT = {
+	activeWorkspaceId: null,
+	workspaces: {}
+};
+const UNKNOWN_WORKSPACE_NAME = "Unknown workspace";
+function getAuthContextFilePath(authFilePath) {
+	const extension = path.extname(authFilePath);
+	if (!extension) return `${authFilePath}.context.json`;
+	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
+}
 function findLatestValidTokens(allCredentials) {
 	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
 		const credential = allCredentials[i];
@@ -17,42 +30,195 @@ function findLatestValidTokens(allCredentials) {
 	}
 	return null;
 }
+function storedCredentialToTokens(credential) {
+	if (!credential) return null;
+	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
+	return {
+		workspaceId: credential.workspaceId,
+		accessToken: credential.token,
+		refreshToken: credential.refreshToken
+	};
+}
+function findTokensForWorkspace(allCredentials, workspaceId) {
+	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
+}
 function tokensEqual(a, b) {
 	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms, signal) {
+	signal?.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(signal?.reason);
+		};
+		const timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
 }
 var FileTokenStorage = class {
 	credentialsStore;
+	authFilePath;
+	contextFilePath;
 	lockFilePath;
-	constructor(env = process.env) {
+	constructor(env = process.env, signal, options = {}) {
+		this.signal = signal;
+		this.options = options;
 		const authFilePath = getAuthFilePath(env);
+		this.authFilePath = authFilePath;
+		this.contextFilePath = getAuthContextFilePath(authFilePath);
 		this.credentialsStore = new CredentialsStore(authFilePath);
 		this.lockFilePath = `${authFilePath}.lock`;
 	}
 	async getTokens() {
+		this.signal?.throwIfAborted();
 		try {
-			return findLatestValidTokens(await this.credentialsStore.getCredentials());
-		} catch {
+			const credentials = await this.readCredentialsFromDisk();
+			const context = await this.readAuthContext();
+			if (context.state.activeWorkspaceId) return findTokensForWorkspace(credentials, context.state.activeWorkspaceId);
+			const latest = findLatestValidTokens(credentials);
+			if (!latest) return null;
+			if (!context.exists) {
+				await this.setActiveWorkspaceId(latest.workspaceId);
+				return latest;
+			}
+			return null;
+		} catch (_error) {
+			if (this.signal?.aborted) throw this.signal.reason;
 			return null;
 		}
 	}
 	async setTokens(tokens) {
+		if (this.options.lockSetTokens === false) {
+			await this.setTokensUnlocked(tokens);
+			return;
+		}
+		await this.withRefreshLock(() => this.setTokensUnlocked(tokens));
+	}
+	async setTokensUnlocked(tokens) {
+		this.signal?.throwIfAborted();
 		await this.credentialsStore.storeCredentials({
 			workspaceId: tokens.workspaceId,
 			token: tokens.accessToken,
 			refreshToken: tokens.refreshToken
 		});
+		this.signal?.throwIfAborted();
+		await this.rememberWorkspaceUnlocked(tokens.workspaceId, {
+			id: tokens.workspaceId,
+			name: tokens.workspaceId
+		});
+		await this.maybeActivateWorkspaceId(tokens.workspaceId);
 	}
 	async clearTokens() {
-		const tokens = findLatestValidTokens(await this.credentialsStore.getCredentials());
-		if (!tokens) return;
-		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await this.withRefreshLock(() => this.clearTokensUnlocked());
+	}
+	async clearTokensUnlocked() {
+		this.signal?.throwIfAborted();
+		await fs.mkdir(path.dirname(this.authFilePath), { recursive: true });
+		this.signal?.throwIfAborted();
+		await fs.writeFile(this.authFilePath, `${JSON.stringify({ tokens: [] }, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		await this.clearAuthContext();
+		await this.credentialsStore.reloadCredentialsFromDisk();
+		this.signal?.throwIfAborted();
 	}
 	async clearTokensIfCurrent(tokens) {
+		this.signal?.throwIfAborted();
 		if (!tokensEqual(await this.getTokens(), tokens)) return;
-		await this.clearTokens();
+		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await this.removeRememberedWorkspace(tokens.workspaceId, { preserveActivePointer: true });
+		this.signal?.throwIfAborted();
+	}
+	async listWorkspaces() {
+		this.signal?.throwIfAborted();
+		const credentials = await this.readCredentialsFromDisk();
+		const context = await this.ensureMigratedAuthContext(credentials);
+		return credentials.map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null).map((tokens) => {
+			const cached = context.state.workspaces[tokens.workspaceId];
+			const id = typeof cached?.id === "string" && cached.id.trim().length > 0 ? cached.id.trim() : tokens.workspaceId;
+			const name = typeof cached?.name === "string" && cached.name.trim().length > 0 ? workspaceDisplayName(cached.name.trim(), tokens.workspaceId) : UNKNOWN_WORKSPACE_NAME;
+			const lastSeenAt = typeof cached?.lastSeenAt === "string" && cached.lastSeenAt.trim().length > 0 ? cached.lastSeenAt.trim() : null;
+			return {
+				id,
+				name,
+				credentialWorkspaceId: tokens.workspaceId,
+				active: context.state.activeWorkspaceId === tokens.workspaceId,
+				lastSeenAt
+			};
+		});
+	}
+	async listWorkspaceTokens() {
+		this.signal?.throwIfAborted();
+		return (await this.readCredentialsFromDisk()).map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null);
+	}
+	async useWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.useWorkspaceUnlocked(workspaceRef));
+	}
+	async useWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const previous = workspaces.find((workspace) => workspace.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null;
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const selected = matches[0];
+		await this.setActiveWorkspaceId(selected.credentialWorkspaceId);
+		return {
+			previous,
+			selected
+		};
+	}
+	async logoutWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.logoutWorkspaceUnlocked(workspaceRef));
+	}
+	async logoutWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const workspace = matches[0];
+		const wasActive = context.state.activeWorkspaceId === workspace.credentialWorkspaceId;
+		await this.credentialsStore.deleteCredentials(workspace.credentialWorkspaceId);
+		this.signal?.throwIfAborted();
+		const remainingWorkspaces = workspaces.filter((candidate) => candidate.credentialWorkspaceId !== workspace.credentialWorkspaceId);
+		if (remainingWorkspaces.length === 0) {
+			await this.clearAuthContext();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace: null
+			};
+		}
+		delete context.state.workspaces[workspace.credentialWorkspaceId];
+		if (wasActive) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+		return {
+			workspace,
+			wasActive,
+			activeWorkspace: context.state.activeWorkspaceId === null ? null : remainingWorkspaces.find((candidate) => candidate.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null
+		};
+	}
+	async rememberWorkspace(credentialWorkspaceId, workspace) {
+		await this.withRefreshLock(() => this.rememberWorkspaceUnlocked(credentialWorkspaceId, workspace));
+	}
+	async rememberWorkspaceUnlocked(credentialWorkspaceId, workspace) {
+		const context = await this.readAuthContext();
+		context.state.workspaces[credentialWorkspaceId] = {
+			id: workspace.id,
+			name: workspace.name,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
 	}
 	async withRefreshLock(fn) {
 		const lockId = await this.acquireRefreshLock();
@@ -64,36 +230,189 @@ var FileTokenStorage = class {
 	}
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
+		const startedAt = Date.now();
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
+		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
-		while (true) try {
+		while (true) {
+			this.signal?.throwIfAborted();
+			if (await this.tryCreateRefreshLock(lockId)) return lockId;
+			if (await this.releaseStaleRefreshLock()) continue;
+			this.throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs);
+			await sleep(retryMs, this.signal);
+		}
+	}
+	async tryCreateRefreshLock(lockId) {
+		let lockFileCreated = false;
+		try {
 			const handle = await fs.open(this.lockFilePath, "wx");
+			lockFileCreated = true;
 			try {
-				await handle.writeFile(lockId, "utf8");
+				this.signal?.throwIfAborted();
+				await handle.writeFile(lockId, { encoding: "utf8" });
+				this.signal?.throwIfAborted();
 			} finally {
 				await handle.close();
 			}
-			return lockId;
+			return true;
 		} catch (error) {
-			if (error.code !== "EEXIST") throw error;
-			const staleLockId = await this.getStaleRefreshLockId();
-			if (staleLockId) {
-				await this.releaseRefreshLock(staleLockId);
-				continue;
-			}
-			await sleep(100);
+			if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
+			if (error.code === "EEXIST") return false;
+			throw error;
 		}
 	}
+	async releaseStaleRefreshLock() {
+		const staleLockId = await this.getStaleRefreshLockId();
+		if (!staleLockId) return false;
+		await this.releaseRefreshLock(staleLockId);
+		return true;
+	}
+	throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs) {
+		if (Date.now() - startedAt < waitTimeoutMs) return;
+		throw new RefreshLockTimeoutError(this.lockFilePath, waitTimeoutMs);
+	}
 	async getStaleRefreshLockId() {
-		const lockId = await fs.readFile(this.lockFilePath, "utf8").catch(() => null);
+		this.signal?.throwIfAborted();
+		const lockId = await fs.readFile(this.lockFilePath, {
+			encoding: "utf8",
+			signal: this.signal
+		}).catch((error) => {
+			if (this.signal?.aborted) throw error;
+			return null;
+		});
 		if (lockId === null) return null;
+		this.signal?.throwIfAborted();
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
+		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		return Date.now() - stats.mtimeMs > 3e4 ? lockId : null;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
-		if (await fs.readFile(this.lockFilePath, "utf8").catch(() => null) !== lockId) return;
+		if (await fs.readFile(this.lockFilePath, { encoding: "utf8" }).catch(() => null) !== lockId) return;
 		await fs.unlink(this.lockFilePath).catch(() => {});
 	}
+	async readCredentialsFromDisk() {
+		this.signal?.throwIfAborted();
+		await this.credentialsStore.reloadCredentialsFromDisk();
+		this.signal?.throwIfAborted();
+		return await this.credentialsStore.getCredentials();
+	}
+	async ensureMigratedAuthContext(credentials) {
+		const context = await this.readAuthContext();
+		if (context.state.activeWorkspaceId || context.exists) return context;
+		const latest = findLatestValidTokens(credentials);
+		if (!latest) return context;
+		context.state.activeWorkspaceId = latest.workspaceId;
+		context.state.workspaces[latest.workspaceId] ??= {
+			id: latest.workspaceId,
+			name: latest.workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+		return {
+			exists: true,
+			state: context.state
+		};
+	}
+	async setActiveWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async maybeActivateWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		if (this.options.activateOnSetTokens === false && context.exists && context.state.activeWorkspaceId && context.state.activeWorkspaceId !== workspaceId) return;
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async removeRememberedWorkspace(workspaceId, options) {
+		const context = await this.readAuthContext();
+		delete context.state.workspaces[workspaceId];
+		if (!options.preserveActivePointer && context.state.activeWorkspaceId === workspaceId) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+	}
+	async readAuthContext() {
+		this.signal?.throwIfAborted();
+		const raw = await fs.readFile(this.contextFilePath, {
+			encoding: "utf8",
+			signal: this.signal
+		}).catch((error) => {
+			if (this.signal?.aborted) throw error;
+			if (error.code === "ENOENT") return null;
+			throw error;
+		});
+		if (raw === null) return {
+			exists: false,
+			state: structuredClone(EMPTY_AUTH_CONTEXT)
+		};
+		try {
+			const parsed = JSON.parse(raw);
+			return {
+				exists: true,
+				state: {
+					activeWorkspaceId: typeof parsed.activeWorkspaceId === "string" && parsed.activeWorkspaceId.trim().length > 0 ? parsed.activeWorkspaceId.trim() : null,
+					workspaces: parsed.workspaces && typeof parsed.workspaces === "object" && !Array.isArray(parsed.workspaces) ? parsed.workspaces : {}
+				}
+			};
+		} catch {
+			return {
+				exists: false,
+				state: structuredClone(EMPTY_AUTH_CONTEXT)
+			};
+		}
+	}
+	async writeAuthContext(state) {
+		this.signal?.throwIfAborted();
+		await fs.mkdir(path.dirname(this.contextFilePath), { recursive: true });
+		this.signal?.throwIfAborted();
+		await fs.writeFile(this.contextFilePath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		this.signal?.throwIfAborted();
+	}
+	async clearAuthContext() {
+		await fs.unlink(this.contextFilePath).catch((error) => {
+			if (error.code === "ENOENT") return;
+			throw error;
+		});
+	}
+};
+var WorkspaceSelectionError = class extends Error {
+	constructor(reason, workspaceRef, matches = []) {
+		super(reason);
+		this.reason = reason;
+		this.workspaceRef = workspaceRef;
+		this.matches = matches;
+		this.name = "WorkspaceSelectionError";
+	}
+};
+var RefreshLockTimeoutError = class extends Error {
+	constructor(lockFilePath, waitTimeoutMs) {
+		super(`Timed out waiting ${waitTimeoutMs}ms for auth refresh lock at ${lockFilePath}`);
+		this.name = "RefreshLockTimeoutError";
+	}
 };
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.credentialWorkspaceId === ref || workspace.id === ref || stripWorkspacePrefix(workspace.credentialWorkspaceId) === stripWorkspacePrefix(ref) || stripWorkspacePrefix(workspace.id) === stripWorkspacePrefix(ref) || workspace.name.toLowerCase() === ref.toLowerCase();
+}
+function stripWorkspacePrefix(value) {
+	return value.startsWith("wksp_") ? value.slice(5) : value;
+}
+function workspaceDisplayName(name, credentialWorkspaceId) {
+	return name === credentialWorkspaceId ? UNKNOWN_WORKSPACE_NAME : name;
+}
 //#endregion
-export { FileTokenStorage };
+export { FileTokenStorage, WorkspaceSelectionError };