@prisma/cli 3.0.0-beta.9 → 3.0.0-dev.101.1

package/dist/presenters/auth.js

@@ -1,4 +1,7 @@
+import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { padDisplay } from "../shell/ui.js";
 import { renderMutate, renderShow } from "../output/patterns.js";
+import stringWidth from "string-width";
 //#region src/presenters/auth.ts
 function renderAuthSuccess(context, descriptor, command, result) {
 	if (command === "auth.login") {
@@ -62,11 +65,105 @@ function renderAuthSuccess(context, descriptor, command, result) {
 		}]
 	}, context.ui);
 }
+function renderAuthWorkspaceList(context, descriptor, result) {
+	const ui = context.ui;
+	const rail = ui.dim("│");
+	const lines = [
+		`${ui.strong(formatDescriptorLabel(descriptor))} ${ui.dim("→")} ${ui.dim("Listing authenticated workspaces on this machine.")}`,
+		"",
+		`${rail}  ${ui.accent("auth source:")}  ${authSourceLabel(result.authSource)}`
+	];
+	const hasMixedSources = new Set(result.workspaces.map((workspace) => workspace.source)).size > 1;
+	if (result.workspaces.length === 0) {
+		lines.push(`${rail}  ${ui.dim("No local OAuth workspaces found.")}`);
+		return lines;
+	}
+	const nameWidth = Math.max(4, ...result.workspaces.map((workspace) => stringWidth(workspace.name)));
+	const idWidth = Math.max(2, ...result.workspaces.map((workspace) => stringWidth(workspace.id)));
+	const sourceWidth = hasMixedSources ? Math.max(6, ...result.workspaces.map((workspace) => stringWidth(workspaceSourceLabel(workspace.source)))) : 0;
+	lines.push(rail);
+	lines.push(hasMixedSources ? `${rail}  ${ui.accent(padDisplay("name", nameWidth))}  ${ui.accent(padDisplay("id", idWidth))}  ${ui.accent(padDisplay("source", sourceWidth))}  ${ui.accent("status")}` : `${rail}  ${ui.accent(padDisplay("name", nameWidth))}  ${ui.accent(padDisplay("id", idWidth))}  ${ui.accent("status")}`);
+	for (const workspace of result.workspaces) {
+		const status = workspace.active ? "active" : "";
+		const source = workspaceSourceLabel(workspace.source);
+		lines.push(hasMixedSources ? `${rail}  ${padDisplay(workspace.name, nameWidth)}  ${padDisplay(workspace.id, idWidth)}  ${padDisplay(source, sourceWidth)}  ${status}` : `${rail}  ${padDisplay(workspace.name, nameWidth)}  ${padDisplay(workspace.id, idWidth)}  ${status}`);
+	}
+	return lines;
+}
+function serializeAuthWorkspaceList(result) {
+	return {
+		context: {
+			authSource: result.authSource,
+			activeWorkspaceId: result.activeWorkspace?.id ?? null,
+			activeWorkspaceName: result.activeWorkspace?.name ?? null
+		},
+		items: result.workspaces.map((workspace) => ({
+			id: workspace.id,
+			name: workspace.name,
+			status: workspace.active ? "active" : null,
+			source: workspace.source,
+			switchable: workspace.switchable,
+			credentialWorkspaceId: workspace.credentialWorkspaceId,
+			lastSeenAt: workspace.lastSeenAt
+		})),
+		count: result.workspaces.length
+	};
+}
+function renderAuthWorkspaceUse(context, descriptor, result) {
+	return renderMutate({
+		title: "Switching the local CLI workspace.",
+		descriptor,
+		context: [...result.previousWorkspace ? [{
+			key: "previous",
+			value: result.previousWorkspace.name
+		}] : [], {
+			key: "workspace",
+			value: result.workspace.name
+		}],
+		operationDescription: "Applying workspace selection",
+		operationCount: 1,
+		details: ["Local OAuth workspace selection updated."]
+	}, context.ui);
+}
+function serializeAuthWorkspaceUse(result) {
+	return result;
+}
+function renderAuthWorkspaceLogout(context, descriptor, result) {
+	return renderMutate({
+		title: "Removing a local OAuth workspace session.",
+		descriptor,
+		context: [{
+			key: "workspace",
+			value: result.workspace.name
+		}, ...result.activeWorkspace ? [{
+			key: "active",
+			value: result.activeWorkspace.name
+		}] : [{
+			key: "active",
+			value: "none",
+			tone: "dim"
+		}]],
+		operationDescription: "Removing workspace session",
+		operationCount: 1,
+		details: [result.wasActive ? "Removed active workspace session; no replacement workspace was selected." : "Removed workspace session."]
+	}, context.ui);
+}
+function serializeAuthWorkspaceLogout(result) {
+	return result;
+}
 function providerLabel(provider) {
 	if (provider === "github") return "GitHub";
 	if (provider === "google") return "Google";
 	return "";
 }
+function authSourceLabel(source) {
+	if (source === "oauth") return "local OAuth";
+	if (source === "service_token") return "PRISMA_SERVICE_TOKEN";
+	return "none";
+}
+function workspaceSourceLabel(source) {
+	return source === "service_token" ? "service token" : "OAuth";
+}
 function authUserLabel(result) {
 	return result.user?.email ?? credentialUserLabel(result);
 }
@@ -83,4 +180,4 @@ function credentialUserLabel(result) {
 	return null;
 }
 //#endregion
-export { renderAuthSuccess };
+export { renderAuthSuccess, renderAuthWorkspaceList, renderAuthWorkspaceLogout, renderAuthWorkspaceUse, serializeAuthWorkspaceList, serializeAuthWorkspaceLogout, serializeAuthWorkspaceUse };

package/dist/presenters/branch.js

@@ -1,5 +1,5 @@
-import { formatColumns } from "../shell/ui.js";
 import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { formatColumns } from "../shell/ui.js";
 import { renderResolvedProjectContextBlock } from "./verbose-context.js";
 //#region src/presenters/branch.ts
 function renderBranchList(context, descriptor, result) {

package/dist/presenters/database.js

@@ -1,5 +1,5 @@
-import { formatColumns, renderSummaryLine } from "../shell/ui.js";
 import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { formatColumns, renderSummaryLine } from "../shell/ui.js";
 import { renderMutate, renderShow, serializeList } from "../output/patterns.js";
 import { renderResolvedProjectContextBlock, stripVerboseContext } from "./verbose-context.js";
 //#region src/presenters/database.ts
@@ -234,7 +234,7 @@ function renderDatabaseConnectionRemove(context, descriptor, result) {
 	}, context.ui);
 }
 function serializeDatabaseConnectionRemove(result) {
-	return result;
+	return { connection: result.connection };
 }
 function formatStatus(database) {
 	return database.status ?? (database.isDefault ? "default" : "unknown");

package/dist/presenters/project.js

@@ -1,9 +1,9 @@
-import { padDisplay, renderNextSteps, renderSummaryLine, renderVerboseBlock } from "../shell/ui.js";
 import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { padDisplay, renderNextSteps, renderSummaryLine, renderVerboseBlock } from "../shell/ui.js";
+import { shortenHomePath } from "../lib/fs/home-path.js";
 import { formatCommandArgument } from "../shell/command-arguments.js";
 import { renderMutate, renderShow, serializeList } from "../output/patterns.js";
 import { renderResolvedProjectContextBlock } from "./verbose-context.js";
-import path from "node:path";
 import stringWidth from "string-width";
 //#region src/presenters/project.ts
 function renderProjectList(context, descriptor, result) {
@@ -160,13 +160,7 @@ function renderBoundProjectShow(context, descriptor, result) {
 	return lines;
 }
 function formatLocalRepoPath(cwd, env) {
-	const resolved = path.resolve(cwd);
-	const home = env.HOME ? path.resolve(env.HOME) : null;
-	if (home && (resolved === home || resolved.startsWith(`${home}${path.sep}`))) {
-		const relative = path.relative(home, resolved);
-		return relative ? `~/${relative}` : "~";
-	}
-	return resolved;
+	return shortenHomePath(cwd, env);
 }
 function formatGitConnectionDetail(status) {
 	switch (status) {

package/dist/shell/command-meta.js

@@ -50,6 +50,58 @@ const DESCRIPTORS = [
 		description: "Show the authenticated user and accessible workspace",
 		examples: ["prisma-cli auth whoami", "prisma-cli auth whoami --json"]
 	},
+	{
+		id: "auth.workspace",
+		path: [
+			"prisma",
+			"auth",
+			"workspace"
+		],
+		description: "Manage local authenticated workspaces",
+		examples: [
+			"prisma-cli auth workspace list",
+			"prisma-cli auth workspace use",
+			"prisma-cli auth workspace use wksp_123",
+			"prisma-cli auth workspace logout wksp_123"
+		]
+	},
+	{
+		id: "auth.workspace.list",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"list"
+		],
+		description: "List locally authenticated workspaces",
+		examples: ["prisma-cli auth workspace list", "prisma-cli auth workspace list --json"]
+	},
+	{
+		id: "auth.workspace.use",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"use"
+		],
+		description: "Switch the local CLI workspace",
+		examples: [
+			"prisma-cli auth workspace use",
+			"prisma-cli auth workspace use wksp_123",
+			"prisma-cli auth workspace use \"Acme Inc\""
+		]
+	},
+	{
+		id: "auth.workspace.logout",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"logout"
+		],
+		description: "Remove one local OAuth workspace session",
+		examples: ["prisma-cli auth workspace logout wksp_123", "prisma-cli auth workspace logout \"Acme Inc\""]
+	},
 	{
 		id: "project",
 		path: ["prisma", "project"],
@@ -289,7 +341,6 @@ const DESCRIPTORS = [
 			"deploy"
 		],
 		description: "Creates a new deployment for the app",
-		longDescription: "Agent skills for guided Next.js deploys are available from the Prisma CLI skill cluster.",
 		examples: [
 			"prisma-cli app deploy",
 			"prisma-cli app deploy --project proj_123",
@@ -301,7 +352,6 @@ const DESCRIPTORS = [
 			"prisma-cli app deploy --app my-app --framework nextjs --http-port 3000",
 			"prisma-cli app deploy --branch feat-login --framework hono",
 			"prisma-cli app deploy --prod --yes",
-			"pnpm dlx skills@latest add prisma/prisma-cli/skills#cli-v<cli-version> --all",
 			"prisma-cli app deploy --framework bun --entry src/server.ts"
 		]
 	},

package/dist/shell/command-runner.js

@@ -1,8 +1,8 @@
-import { CliError, authRequiredError, commandCanceledError } from "./errors.js";
-import { cliErrorToJson, writeHumanError, writeHumanLines, writeJsonError, writeJsonEvent, writeJsonSuccess } from "./output.js";
+import { CliError, authConfigInvalidError, authRequiredError, commandCanceledError } from "./errors.js";
 import { getCommandDescriptor } from "./command-meta.js";
 import { resolveGlobalFlags } from "./global-flags.js";
 import { createCommandContext } from "./runtime.js";
+import { cliErrorToJson, writeHumanError, writeHumanLines, writeJsonError, writeJsonEvent, writeJsonSuccess } from "./output.js";
 import { collectCommandDiagnostics } from "../lib/diagnostics.js";
 import { renderCommandDiagnostics } from "./diagnostics-output.js";
 import { AuthError } from "@prisma/management-api-sdk";
@@ -11,6 +11,7 @@ function toCliError(error, runtime) {
 	if (isCancellationError(error) || runtime.signal.aborted) return commandCanceledError();
 	if (error instanceof CliError) return error;
 	if (error instanceof AuthError) return authRequiredError(["prisma-cli auth login"], { debug: error.message });
+	if (error instanceof Error && error.message.startsWith("PRISMA_SERVICE_TOKEN is set but empty")) return authConfigInvalidError(error.message);
 	return null;
 }
 function isCancellationError(error) {
@@ -18,44 +19,54 @@ function isCancellationError(error) {
 	return error.name === "AbortError" || error.name === "CancelledError";
 }
 async function runCommand(runtime, commandName, options, handler, presenter) {
-	const flags = resolveGlobalFlags(runtime.argv, options);
-	const context = await createCommandContext(runtime, flags);
+	const context = await createCommandContext(runtime, resolveGlobalFlags(runtime.argv, options));
 	const descriptor = getCommandDescriptor(commandName);
 	const startedAt = Date.now();
 	try {
-		const success = await handler(context);
-		if (flags.json) {
-			writeJsonSuccess(context.output, {
-				...success,
-				result: presenter.renderJson ? presenter.renderJson(success.result) : success.result
-			});
-			return;
-		}
-		const stdout = presenter.renderStdout?.(context, descriptor, success.result) ?? [];
-		if (flags.quiet) {
-			if (stdout.length > 0) context.output.stdout.write(`${stdout.join("\n")}\n`);
-			return;
-		}
-		const rendered = presenter.renderHuman(context, descriptor, success.result);
-		const diagnostics = await renderBestEffortCommandDiagnostics(context, {
-			enabled: flags.verbose && rendered.length > 0,
-			durationMs: Date.now() - startedAt
-		});
-		const humanLines = [...rendered, ...diagnostics];
-		if (stdout.length > 0 && humanLines.length > 0) humanLines.push("");
-		writeHumanLines(context.output, humanLines);
-		if (stdout.length > 0) context.output.stdout.write(`${stdout.join("\n")}\n`);
+		await writeCommandSuccess(context, descriptor, await handler(context), presenter, Date.now() - startedAt);
 	} catch (error) {
 		const cliError = toCliError(error, runtime);
 		if (cliError) {
-			if (flags.json) writeJsonError(context.output, commandName, cliError);
-			else writeHumanError(context.output, context.ui, cliError, { trace: flags.trace });
+			writeCommandError(context, commandName, cliError);
 			process.exitCode = cliError.exitCode;
 			return;
 		}
 		throw error;
 	}
 }
+async function writeCommandSuccess(context, descriptor, success, presenter, durationMs) {
+	if (context.flags.json) {
+		writeJsonSuccess(context.output, {
+			...success,
+			result: presenter.renderJson ? presenter.renderJson(success.result) : success.result
+		});
+		return;
+	}
+	const stdout = presenter.renderStdout?.(context, descriptor, success.result) ?? [];
+	if (context.flags.quiet) {
+		writeStdoutLines(context, stdout);
+		return;
+	}
+	const rendered = presenter.renderHuman(context, descriptor, success.result);
+	const diagnostics = await renderBestEffortCommandDiagnostics(context, {
+		enabled: context.flags.verbose && rendered.length > 0,
+		durationMs
+	});
+	const humanLines = [...rendered, ...diagnostics];
+	if (stdout.length > 0 && humanLines.length > 0) humanLines.push("");
+	writeHumanLines(context.output, humanLines);
+	writeStdoutLines(context, stdout);
+}
+function writeCommandError(context, commandName, cliError) {
+	if (context.flags.json) {
+		writeJsonError(context.output, commandName, cliError);
+		return;
+	}
+	writeHumanError(context.output, context.ui, cliError, { trace: context.flags.trace });
+}
+function writeStdoutLines(context, lines) {
+	if (lines.length > 0) context.output.stdout.write(`${lines.join("\n")}\n`);
+}
 async function renderBestEffortCommandDiagnostics(context, options) {
 	if (!options.enabled) return [];
 	try {

package/dist/shell/diagnostics-output.js

@@ -1,5 +1,5 @@
 import { renderVerboseBlock } from "./ui.js";
-import path from "node:path";
+import { shortenHomePath } from "../lib/fs/home-path.js";
 //#region src/shell/diagnostics-output.ts
 function renderCommandDiagnostics(context, diagnostics, rows = [], options = {}) {
 	if (!diagnostics) return [];
@@ -43,13 +43,7 @@ function renderCommandDiagnostics(context, diagnostics, rows = [], options = {})
 	], { title: options.title ?? "Local context" });
 }
 function formatLocalPath(value, env) {
-	const resolved = path.resolve(value);
-	const home = env.HOME ? path.resolve(env.HOME) : null;
-	if (home && (resolved === home || resolved.startsWith(`${home}${path.sep}`))) {
-		const relative = path.relative(home, resolved);
-		return relative ? `~/${relative}` : "~";
-	}
-	return resolved;
+	return shortenHomePath(value, env);
 }
 function formatDirtyState(dirty) {
 	if (dirty === null) return "unknown";

package/dist/shell/errors.js

@@ -56,6 +56,17 @@ function authRequiredError(nextSteps = ["prisma-cli auth login"], options = {})
 		nextSteps
 	});
 }
+function authConfigInvalidError(message) {
+	return new CliError({
+		code: "AUTH_CONFIG_INVALID",
+		domain: "auth",
+		summary: "Authentication configuration is invalid",
+		why: message,
+		fix: "Provide a valid PRISMA_SERVICE_TOKEN value, or unset the variable to use local OAuth login.",
+		exitCode: 1,
+		nextSteps: ["prisma-cli auth login"]
+	});
+}
 function commandCanceledError() {
 	return new CliError({
 		code: "COMMAND_CANCELED",
@@ -70,6 +81,44 @@ function commandCanceledError() {
 function workspaceRequiredError() {
 	return usageError("Workspace required", "This command needs an active workspace, but the authenticated session does not have one.", "Run prisma-cli auth login and choose a workspace.", ["prisma-cli auth login"], "auth");
 }
+function workspaceSwitchUnavailableError() {
+	return new CliError({
+		code: "WORKSPACE_SWITCH_UNAVAILABLE",
+		domain: "auth",
+		summary: "Workspace switching is unavailable",
+		why: "PRISMA_SERVICE_TOKEN is set, so authenticated commands use that token instead of local OAuth workspaces.",
+		fix: "Unset PRISMA_SERVICE_TOKEN to switch between local OAuth workspaces, or use a token for the workspace you want.",
+		exitCode: 1,
+		nextSteps: ["unset PRISMA_SERVICE_TOKEN", "prisma-cli auth workspace list"]
+	});
+}
+function workspaceNotAuthenticatedError(workspaceRef) {
+	return new CliError({
+		code: "WORKSPACE_NOT_AUTHENTICATED",
+		domain: "auth",
+		summary: "Workspace is not authenticated",
+		why: `No stored OAuth session matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth login and authorize that workspace, then switch to it.",
+		meta: { workspaceRef },
+		exitCode: 1,
+		nextSteps: ["prisma-cli auth workspace list", "prisma-cli auth login"]
+	});
+}
+function workspaceAmbiguousError(workspaceRef, matches) {
+	return new CliError({
+		code: "WORKSPACE_AMBIGUOUS",
+		domain: "auth",
+		summary: "Workspace name is ambiguous",
+		why: `Multiple authenticated workspaces matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth workspace list and switch by workspace id.",
+		meta: {
+			workspaceRef,
+			matches
+		},
+		exitCode: 2,
+		nextSteps: ["prisma-cli auth workspace list"]
+	});
+}
 function featureUnavailableError(summary, why, fix, nextSteps = [], domain = "cli") {
 	return new CliError({
 		code: "FEATURE_UNAVAILABLE",
@@ -82,4 +131,4 @@ function featureUnavailableError(summary, why, fix, nextSteps = [], domain = "cl
 	});
 }
 //#endregion
-export { CliError, authRequiredError, commandCanceledError, featureUnavailableError, usageError, workspaceRequiredError };
+export { CliError, authConfigInvalidError, authRequiredError, commandCanceledError, featureUnavailableError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceRequiredError, workspaceSwitchUnavailableError };

package/dist/shell/help.js

@@ -1,6 +1,6 @@
-import { createShellUi, padDisplay, wrapText } from "./ui.js";
 import { formatDescriptorLabel, getDescriptorForCommand } from "./command-meta.js";
 import { COMPACT_GLOBAL_OPTION_FLAGS, resolveGlobalFlags } from "./global-flags.js";
+import { createShellUi, padDisplay, wrapText } from "./ui.js";
 //#region src/shell/help.ts
 function renderHelp(command, runtime) {
 	const descriptor = getDescriptorForCommand(command);
@@ -10,28 +10,38 @@ function renderHelp(command, runtime) {
 	const visibleCommands = command.commands.filter((candidate) => candidate.name() !== "help" && !candidate.hidden);
 	const visibleOptions = command.options.filter((candidate) => !candidate.hidden);
 	if (visibleCommands.length > 0) lines.push(...renderCommandRows(rail, ui, visibleCommands));
-	if (descriptor.longDescription) {
-		lines.push(`${rail}`);
-		const wrapped = wrapText(descriptor.longDescription, Math.max(ui.width - 3, 40));
-		for (const line of wrapped) lines.push(`${rail}  ${line}`);
-	}
-	if (visibleOptions.length > 0) {
-		if (visibleCommands.length > 0) lines.push(`${rail}`);
-		if (visibleCommands.length > 0 && visibleOptions.every((option) => COMPACT_GLOBAL_OPTION_FLAGS.includes(option.flags))) lines.push(`${rail}  Global options:`);
-		lines.push(...renderOptionRows(rail, ui, visibleOptions));
-	}
-	if (descriptor.examples && descriptor.examples.length > 0) {
-		lines.push(`${rail}`);
-		lines.push(`${rail}  Examples:`);
-		for (const example of descriptor.examples) lines.push(`${rail}    $ ${example}`);
-	}
-	if (descriptor.docsPath) {
-		lines.push(`${rail}`);
-		lines.push(`${rail}  ${ui.accent(padDisplay("Read more", 16))}  ${ui.link(descriptor.docsPath)}`);
-	}
+	lines.push(...renderLongDescription(rail, ui, descriptor.longDescription));
+	lines.push(...renderVisibleOptions(rail, ui, visibleCommands, visibleOptions));
+	lines.push(...renderExamples(rail, descriptor.examples));
+	lines.push(...renderDocsPath(rail, ui, descriptor.docsPath));
 	lines.push("");
 	return `${lines.join("\n")}`;
 }
+function renderLongDescription(rail, ui, longDescription) {
+	if (!longDescription) return [];
+	return [`${rail}`, ...wrapText(longDescription, Math.max(ui.width - 3, 40)).map((line) => `${rail}  ${line}`)];
+}
+function renderVisibleOptions(rail, ui, visibleCommands, visibleOptions) {
+	if (visibleOptions.length === 0) return [];
+	const lines = visibleCommands.length > 0 ? [`${rail}`] : [];
+	if (shouldLabelGlobalOptions(visibleCommands, visibleOptions)) lines.push(`${rail}  Global options:`);
+	return [...lines, ...renderOptionRows(rail, ui, visibleOptions)];
+}
+function shouldLabelGlobalOptions(visibleCommands, visibleOptions) {
+	return visibleCommands.length > 0 && visibleOptions.every((option) => COMPACT_GLOBAL_OPTION_FLAGS.includes(option.flags));
+}
+function renderExamples(rail, examples) {
+	if (!examples || examples.length === 0) return [];
+	return [
+		`${rail}`,
+		`${rail}  Examples:`,
+		...examples.map((example) => `${rail}    $ ${example}`)
+	];
+}
+function renderDocsPath(rail, ui, docsPath) {
+	if (!docsPath) return [];
+	return [`${rail}`, `${rail}  ${ui.accent(padDisplay("Read more", 16))}  ${ui.link(docsPath)}`];
+}
 function renderCommandRows(rail, ui, commands) {
 	return renderAlignedRows(rail, ui, commands.map((command) => {
 		const descriptor = getDescriptorForCommand(command);

package/dist/shell/runtime.js

@@ -1,7 +1,8 @@
-import { createShellUi } from "./ui.js";
 import { LocalStateStore } from "../adapters/local-state.js";
 import { MockApi } from "../adapters/mock-api.js";
+import { createShellUi } from "./ui.js";
 import { renderHelp } from "./help.js";
+import { findComputeConfigDir } from "@prisma/compute-sdk/config";
 import path from "node:path";
 //#region src/shell/runtime.ts
 const DEFAULT_STATE_DIR_NAME = path.join(".prisma", "cli");
@@ -20,7 +21,7 @@ function configureRuntimeCommand(command, runtime) {
 }
 async function createCommandContext(runtime, flags) {
 	const fixturePath = runtime.fixturePath ?? runtime.env.PRISMA_CLI_MOCK_FIXTURE_PATH;
-	const stateDir = resolveStateDir(runtime);
+	const stateDir = await resolveStateDir(runtime);
 	let loadedApi;
 	if (fixturePath) loadedApi = await MockApi.load(fixturePath, runtime.signal);
 	return {
@@ -38,8 +39,11 @@ async function createCommandContext(runtime, flags) {
 		ui: createShellUi(runtime, flags)
 	};
 }
-function resolveStateDir(runtime) {
-	return runtime.stateDir ?? runtime.env.PRISMA_CLI_STATE_DIR ?? path.join(runtime.cwd, DEFAULT_STATE_DIR_NAME);
+async function resolveStateDir(runtime) {
+	const explicitStateDir = runtime.stateDir ?? runtime.env.PRISMA_CLI_STATE_DIR;
+	if (explicitStateDir) return explicitStateDir;
+	const projectDir = await findComputeConfigDir(runtime.cwd, runtime.signal);
+	return path.join(projectDir ?? runtime.cwd, DEFAULT_STATE_DIR_NAME);
 }
 function canPrompt(context) {
 	if (context.flags.json) return false;

package/dist/shell/ui.js

@@ -1,8 +1,9 @@
+import { createColors } from "colorette";
 import stringWidth from "string-width";
 import stripAnsi from "strip-ansi";
 import wrapAnsi from "wrap-ansi";
-import { createColors } from "colorette";
 //#region src/shell/ui.ts
+const URL_CREDENTIALS_PATTERN = /:\/\/[^:@/\s]+:[^@/\s]+@/g;
 const DEFAULT_WIDTH = 80;
 function createShellUi(runtime, flags) {
 	const isTTY = Boolean(runtime.stderr.isTTY);
@@ -73,7 +74,23 @@ function padDisplay(text, width) {
 	return `${text}${" ".repeat(padding)}`;
 }
 function maskValue(value) {
-	return value.replace(/([A-Za-z0-9._%+-]{1,})(?=@)/g, "****").replace(/:\/\/[^:@/\s]+:[^@/\s]+@/g, "://****:****@");
+	return maskEmailLocalParts(value).replace(URL_CREDENTIALS_PATTERN, "://****:****@");
+}
+function maskEmailLocalParts(value) {
+	let masked = "";
+	let segmentStart = 0;
+	for (let index = 0; index < value.length; index += 1) {
+		if (value[index] !== "@") continue;
+		let localStart = index;
+		while (localStart > segmentStart && isEmailLocalPartChar(value[localStart - 1])) localStart -= 1;
+		if (localStart === index) continue;
+		masked += `${value.slice(segmentStart, localStart)}****@`;
+		segmentStart = index + 1;
+	}
+	return masked + value.slice(segmentStart);
+}
+function isEmailLocalPartChar(char) {
+	return char >= "A" && char <= "Z" || char >= "a" && char <= "z" || char >= "0" && char <= "9" || char === "!" || char === "#" || char === "$" || char === "." || char === "&" || char === "'" || char === "*" || char === "%" || char === "+" || char === "-" || char === "/" || char === "=" || char === "?" || char === "^" || char === "_" || char === "`" || char === "{" || char === "|" || char === "}" || char === "~";
 }
 function resolveColorEnabled(runtime, flags, isTTY) {
 	if (flags.color === true) return true;

package/dist/use-cases/auth.js

@@ -1,4 +1,4 @@
-import { usageError } from "../shell/errors.js";
+import { authRequiredError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError } from "../shell/errors.js";
 //#region src/use-cases/auth.ts
 function createAuthUseCases(dependencies) {
 	return {
@@ -15,6 +15,70 @@ function createAuthUseCases(dependencies) {
 			await dependencies.sessionGateway.clearAuthSession();
 			return resolveCurrentAuthState(dependencies);
 		},
+		listWorkspaces: async () => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) return {
+				authSource: "none",
+				activeWorkspace: null,
+				workspaces: []
+			};
+			const workspaces = dependencies.identityGateway.listUserWorkspaces(session.userId);
+			return {
+				authSource: "oauth",
+				activeWorkspace: workspaces.find((workspace) => workspace.id === session.workspaceId) ?? null,
+				workspaces: workspaces.map((workspace) => ({
+					...workspace,
+					credentialWorkspaceId: workspace.id,
+					active: workspace.id === session.workspaceId,
+					source: "oauth",
+					switchable: true,
+					lastSeenAt: null
+				}))
+			};
+		},
+		useWorkspace: async (workspaceRef) => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) throw authRequiredError(["prisma-cli auth login"]);
+			const ref = workspaceRef.trim();
+			const matches = dependencies.identityGateway.listUserWorkspaces(session.userId).filter((workspace) => workspaceMatchesRef(workspace, ref));
+			if (matches.length === 0) throw workspaceNotAuthenticatedError(workspaceRef);
+			if (matches.length > 1) throw workspaceAmbiguousError(workspaceRef, matches.map((workspace) => ({
+				id: workspace.id,
+				name: workspace.name,
+				credentialWorkspaceId: workspace.id
+			})));
+			const selected = matches[0];
+			const previousWorkspace = dependencies.identityGateway.getWorkspace(session.workspaceId) ?? null;
+			await dependencies.sessionGateway.writeAuthSession({
+				...session,
+				workspaceId: selected.id
+			});
+			return {
+				previousWorkspace,
+				workspace: selected
+			};
+		},
+		logoutWorkspace: async (workspaceRef) => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) throw workspaceNotAuthenticatedError(workspaceRef);
+			const ref = workspaceRef.trim();
+			const matches = dependencies.identityGateway.listUserWorkspaces(session.userId).filter((workspace) => workspaceMatchesRef(workspace, ref));
+			if (matches.length === 0) throw workspaceNotAuthenticatedError(workspaceRef);
+			if (matches.length > 1) throw workspaceAmbiguousError(workspaceRef, matches.map((workspace) => ({
+				id: workspace.id,
+				name: workspace.name,
+				credentialWorkspaceId: workspace.id
+			})));
+			const workspace = matches[0];
+			const wasActive = workspace.id === session.workspaceId;
+			const activeWorkspace = wasActive ? null : dependencies.identityGateway.getWorkspace(session.workspaceId) ?? null;
+			if (wasActive) await dependencies.sessionGateway.clearAuthSession();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace
+			};
+		},
 		listProviders: async () => dependencies.identityGateway.listProviders(),
 		resolveProvider: async (providerId) => {
 			const provider = dependencies.identityGateway.getProvider(providerId);
@@ -39,6 +103,9 @@ function createAuthUseCases(dependencies) {
 		}
 	};
 }
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.id === ref || workspace.name.toLowerCase() === ref.toLowerCase();
+}
 async function resolveCurrentAuthState(dependencies) {
 	const session = await dependencies.sessionGateway.readAuthSession();
 	if (!session) return {