@prisma/cli 3.0.0-dev.91.1 → 3.0.0-dev.93.1

package/dist/adapters/token-storage.js

@@ -4,6 +4,18 @@ import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { CredentialsStore } from "@prisma/credentials-store";
 //#region src/adapters/token-storage.ts
+const REFRESH_LOCK_RETRY_MS = 100;
+const REFRESH_LOCK_STALE_MS = 3e4;
+const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
+const EMPTY_AUTH_CONTEXT = {
+	activeWorkspaceId: null,
+	workspaces: {}
+};
+function getAuthContextFilePath(authFilePath) {
+	const extension = path.extname(authFilePath);
+	if (!extension) return `${authFilePath}.context.json`;
+	return `${authFilePath.slice(0, -extension.length)}.context${extension}`;
+}
 function findLatestValidTokens(allCredentials) {
 	for (let i = allCredentials.length - 1; i >= 0; i -= 1) {
 		const credential = allCredentials[i];
@@ -17,6 +29,18 @@ function findLatestValidTokens(allCredentials) {
 	}
 	return null;
 }
+function storedCredentialToTokens(credential) {
+	if (!credential) return null;
+	if (typeof credential.workspaceId !== "string" || credential.workspaceId.length === 0 || typeof credential.token !== "string" || credential.token.length === 0 || typeof credential.refreshToken !== "string" || credential.refreshToken.length === 0) return null;
+	return {
+		workspaceId: credential.workspaceId,
+		accessToken: credential.token,
+		refreshToken: credential.refreshToken
+	};
+}
+function findTokensForWorkspace(allCredentials, workspaceId) {
+	return storedCredentialToTokens(allCredentials.find((credential) => credential?.workspaceId === workspaceId)) ?? null;
+}
 function tokensEqual(a, b) {
 	return a?.workspaceId === b?.workspaceId && a?.accessToken === b?.accessToken && a?.refreshToken === b?.refreshToken;
 }
@@ -36,25 +60,44 @@ function sleep(ms, signal) {
 }
 var FileTokenStorage = class {
 	credentialsStore;
+	authFilePath;
+	contextFilePath;
 	lockFilePath;
-	constructor(env = process.env, signal) {
+	constructor(env = process.env, signal, options = {}) {
 		this.signal = signal;
+		this.options = options;
 		const authFilePath = getAuthFilePath(env);
+		this.authFilePath = authFilePath;
+		this.contextFilePath = getAuthContextFilePath(authFilePath);
 		this.credentialsStore = new CredentialsStore(authFilePath);
 		this.lockFilePath = `${authFilePath}.lock`;
 	}
 	async getTokens() {
 		this.signal?.throwIfAborted();
 		try {
-			const all = await this.credentialsStore.getCredentials();
-			this.signal?.throwIfAborted();
-			return findLatestValidTokens(all);
+			const credentials = await this.readCredentialsFromDisk();
+			const context = await this.readAuthContext();
+			if (context.state.activeWorkspaceId) return findTokensForWorkspace(credentials, context.state.activeWorkspaceId);
+			const latest = findLatestValidTokens(credentials);
+			if (!latest) return null;
+			if (!context.exists) {
+				await this.setActiveWorkspaceId(latest.workspaceId);
+				return latest;
+			}
+			return null;
 		} catch (_error) {
 			if (this.signal?.aborted) throw this.signal.reason;
 			return null;
 		}
 	}
 	async setTokens(tokens) {
+		if (this.options.lockSetTokens === false) {
+			await this.setTokensUnlocked(tokens);
+			return;
+		}
+		await this.withRefreshLock(() => this.setTokensUnlocked(tokens));
+	}
+	async setTokensUnlocked(tokens) {
 		this.signal?.throwIfAborted();
 		await this.credentialsStore.storeCredentials({
 			workspaceId: tokens.workspaceId,
@@ -62,20 +105,115 @@ var FileTokenStorage = class {
 			refreshToken: tokens.refreshToken
 		});
 		this.signal?.throwIfAborted();
+		await this.rememberWorkspaceUnlocked(tokens.workspaceId, {
+			id: tokens.workspaceId,
+			name: tokens.workspaceId
+		});
+		await this.maybeActivateWorkspaceId(tokens.workspaceId);
 	}
 	async clearTokens() {
+		await this.withRefreshLock(() => this.clearTokensUnlocked());
+	}
+	async clearTokensUnlocked() {
 		this.signal?.throwIfAborted();
-		const all = await this.credentialsStore.getCredentials();
+		await fs.mkdir(path.dirname(this.authFilePath), { recursive: true });
 		this.signal?.throwIfAborted();
-		const tokens = findLatestValidTokens(all);
-		if (!tokens) return;
-		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await fs.writeFile(this.authFilePath, `${JSON.stringify({ tokens: [] }, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		await this.clearAuthContext();
+		await this.credentialsStore.reloadCredentialsFromDisk();
 		this.signal?.throwIfAborted();
 	}
 	async clearTokensIfCurrent(tokens) {
 		this.signal?.throwIfAborted();
 		if (!tokensEqual(await this.getTokens(), tokens)) return;
-		await this.clearTokens();
+		await this.credentialsStore.deleteCredentials(tokens.workspaceId);
+		await this.removeRememberedWorkspace(tokens.workspaceId, { preserveActivePointer: true });
+		this.signal?.throwIfAborted();
+	}
+	async listWorkspaces() {
+		this.signal?.throwIfAborted();
+		const credentials = await this.readCredentialsFromDisk();
+		const context = await this.ensureMigratedAuthContext(credentials);
+		return credentials.map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null).map((tokens) => {
+			const cached = context.state.workspaces[tokens.workspaceId];
+			const id = typeof cached?.id === "string" && cached.id.trim().length > 0 ? cached.id.trim() : tokens.workspaceId;
+			const name = typeof cached?.name === "string" && cached.name.trim().length > 0 ? cached.name.trim() : id;
+			const lastSeenAt = typeof cached?.lastSeenAt === "string" && cached.lastSeenAt.trim().length > 0 ? cached.lastSeenAt.trim() : null;
+			return {
+				id,
+				name,
+				credentialWorkspaceId: tokens.workspaceId,
+				active: context.state.activeWorkspaceId === tokens.workspaceId,
+				lastSeenAt
+			};
+		});
+	}
+	async useWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.useWorkspaceUnlocked(workspaceRef));
+	}
+	async useWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const previous = workspaces.find((workspace) => workspace.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null;
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const selected = matches[0];
+		await this.setActiveWorkspaceId(selected.credentialWorkspaceId);
+		return {
+			previous,
+			selected
+		};
+	}
+	async logoutWorkspace(workspaceRef) {
+		return this.withRefreshLock(() => this.logoutWorkspaceUnlocked(workspaceRef));
+	}
+	async logoutWorkspaceUnlocked(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		const workspaces = await this.listWorkspaces();
+		const context = await this.readAuthContext();
+		const matches = workspaces.filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		const workspace = matches[0];
+		const wasActive = context.state.activeWorkspaceId === workspace.credentialWorkspaceId;
+		await this.credentialsStore.deleteCredentials(workspace.credentialWorkspaceId);
+		this.signal?.throwIfAborted();
+		const remainingWorkspaces = workspaces.filter((candidate) => candidate.credentialWorkspaceId !== workspace.credentialWorkspaceId);
+		if (remainingWorkspaces.length === 0) {
+			await this.clearAuthContext();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace: null
+			};
+		}
+		delete context.state.workspaces[workspace.credentialWorkspaceId];
+		if (wasActive) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+		return {
+			workspace,
+			wasActive,
+			activeWorkspace: context.state.activeWorkspaceId === null ? null : remainingWorkspaces.find((candidate) => candidate.credentialWorkspaceId === context.state.activeWorkspaceId) ?? null
+		};
+	}
+	async rememberWorkspace(credentialWorkspaceId, workspace) {
+		await this.withRefreshLock(() => this.rememberWorkspaceUnlocked(credentialWorkspaceId, workspace));
+	}
+	async rememberWorkspaceUnlocked(credentialWorkspaceId, workspace) {
+		const context = await this.readAuthContext();
+		context.state.workspaces[credentialWorkspaceId] = {
+			id: workspace.id,
+			name: workspace.name,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
 	}
 	async withRefreshLock(fn) {
 		const lockId = await this.acquireRefreshLock();
@@ -87,34 +225,48 @@ var FileTokenStorage = class {
 	}
 	async acquireRefreshLock() {
 		const lockId = randomUUID();
+		const startedAt = Date.now();
+		const retryMs = this.options.lockRetryMs ?? REFRESH_LOCK_RETRY_MS;
+		const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? REFRESH_LOCK_WAIT_TIMEOUT_MS;
 		this.signal?.throwIfAborted();
 		await fs.mkdir(path.dirname(this.lockFilePath), { recursive: true });
 		while (true) {
 			this.signal?.throwIfAborted();
-			let lockFileCreated = false;
+			if (await this.tryCreateRefreshLock(lockId)) return lockId;
+			if (await this.releaseStaleRefreshLock()) continue;
+			this.throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs);
+			await sleep(retryMs, this.signal);
+		}
+	}
+	async tryCreateRefreshLock(lockId) {
+		let lockFileCreated = false;
+		try {
+			const handle = await fs.open(this.lockFilePath, "wx");
+			lockFileCreated = true;
 			try {
-				const handle = await fs.open(this.lockFilePath, "wx");
-				lockFileCreated = true;
-				try {
-					this.signal?.throwIfAborted();
-					await handle.writeFile(lockId, { encoding: "utf8" });
-					this.signal?.throwIfAborted();
-				} finally {
-					await handle.close();
-				}
-				return lockId;
-			} catch (error) {
-				if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
-				if (error.code !== "EEXIST") throw error;
-				const staleLockId = await this.getStaleRefreshLockId();
-				if (staleLockId) {
-					await this.releaseRefreshLock(staleLockId);
-					continue;
-				}
-				await sleep(100, this.signal);
+				this.signal?.throwIfAborted();
+				await handle.writeFile(lockId, { encoding: "utf8" });
+				this.signal?.throwIfAborted();
+			} finally {
+				await handle.close();
 			}
+			return true;
+		} catch (error) {
+			if (lockFileCreated) await fs.unlink(this.lockFilePath).catch(() => void 0);
+			if (error.code === "EEXIST") return false;
+			throw error;
 		}
 	}
+	async releaseStaleRefreshLock() {
+		const staleLockId = await this.getStaleRefreshLockId();
+		if (!staleLockId) return false;
+		await this.releaseRefreshLock(staleLockId);
+		return true;
+	}
+	throwIfRefreshLockWaitTimedOut(startedAt, waitTimeoutMs) {
+		if (Date.now() - startedAt < waitTimeoutMs) return;
+		throw new RefreshLockTimeoutError(this.lockFilePath, waitTimeoutMs);
+	}
 	async getStaleRefreshLockId() {
 		this.signal?.throwIfAborted();
 		const lockId = await fs.readFile(this.lockFilePath, {
@@ -129,12 +281,130 @@ var FileTokenStorage = class {
 		const stats = await fs.stat(this.lockFilePath).catch(() => null);
 		this.signal?.throwIfAborted();
 		if (!stats) return null;
-		return Date.now() - stats.mtimeMs > 3e4 ? lockId : null;
+		const staleMs = this.options.lockStaleMs ?? REFRESH_LOCK_STALE_MS;
+		return Date.now() - stats.mtimeMs > staleMs ? lockId : null;
 	}
 	async releaseRefreshLock(lockId) {
 		if (await fs.readFile(this.lockFilePath, { encoding: "utf8" }).catch(() => null) !== lockId) return;
 		await fs.unlink(this.lockFilePath).catch(() => {});
 	}
+	async readCredentialsFromDisk() {
+		this.signal?.throwIfAborted();
+		await this.credentialsStore.reloadCredentialsFromDisk();
+		this.signal?.throwIfAborted();
+		return await this.credentialsStore.getCredentials();
+	}
+	async ensureMigratedAuthContext(credentials) {
+		const context = await this.readAuthContext();
+		if (context.state.activeWorkspaceId || context.exists) return context;
+		const latest = findLatestValidTokens(credentials);
+		if (!latest) return context;
+		context.state.activeWorkspaceId = latest.workspaceId;
+		context.state.workspaces[latest.workspaceId] ??= {
+			id: latest.workspaceId,
+			name: latest.workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+		return {
+			exists: true,
+			state: context.state
+		};
+	}
+	async setActiveWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async maybeActivateWorkspaceId(workspaceId) {
+		const context = await this.readAuthContext();
+		if (this.options.activateOnSetTokens === false && context.exists && context.state.activeWorkspaceId && context.state.activeWorkspaceId !== workspaceId) return;
+		context.state.activeWorkspaceId = workspaceId;
+		context.state.workspaces[workspaceId] ??= {
+			id: workspaceId,
+			name: workspaceId,
+			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.writeAuthContext(context.state);
+	}
+	async removeRememberedWorkspace(workspaceId, options) {
+		const context = await this.readAuthContext();
+		delete context.state.workspaces[workspaceId];
+		if (!options.preserveActivePointer && context.state.activeWorkspaceId === workspaceId) context.state.activeWorkspaceId = null;
+		await this.writeAuthContext(context.state);
+	}
+	async readAuthContext() {
+		this.signal?.throwIfAborted();
+		const raw = await fs.readFile(this.contextFilePath, {
+			encoding: "utf8",
+			signal: this.signal
+		}).catch((error) => {
+			if (this.signal?.aborted) throw error;
+			if (error.code === "ENOENT") return null;
+			throw error;
+		});
+		if (raw === null) return {
+			exists: false,
+			state: structuredClone(EMPTY_AUTH_CONTEXT)
+		};
+		try {
+			const parsed = JSON.parse(raw);
+			return {
+				exists: true,
+				state: {
+					activeWorkspaceId: typeof parsed.activeWorkspaceId === "string" && parsed.activeWorkspaceId.trim().length > 0 ? parsed.activeWorkspaceId.trim() : null,
+					workspaces: parsed.workspaces && typeof parsed.workspaces === "object" && !Array.isArray(parsed.workspaces) ? parsed.workspaces : {}
+				}
+			};
+		} catch {
+			return {
+				exists: false,
+				state: structuredClone(EMPTY_AUTH_CONTEXT)
+			};
+		}
+	}
+	async writeAuthContext(state) {
+		this.signal?.throwIfAborted();
+		await fs.mkdir(path.dirname(this.contextFilePath), { recursive: true });
+		this.signal?.throwIfAborted();
+		await fs.writeFile(this.contextFilePath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			signal: this.signal
+		});
+		this.signal?.throwIfAborted();
+	}
+	async clearAuthContext() {
+		await fs.unlink(this.contextFilePath).catch((error) => {
+			if (error.code === "ENOENT") return;
+			throw error;
+		});
+	}
+};
+var WorkspaceSelectionError = class extends Error {
+	constructor(reason, workspaceRef, matches = []) {
+		super(reason);
+		this.reason = reason;
+		this.workspaceRef = workspaceRef;
+		this.matches = matches;
+		this.name = "WorkspaceSelectionError";
+	}
 };
+var RefreshLockTimeoutError = class extends Error {
+	constructor(lockFilePath, waitTimeoutMs) {
+		super(`Timed out waiting ${waitTimeoutMs}ms for auth refresh lock at ${lockFilePath}`);
+		this.name = "RefreshLockTimeoutError";
+	}
+};
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.credentialWorkspaceId === ref || workspace.id === ref || stripWorkspacePrefix(workspace.credentialWorkspaceId) === stripWorkspacePrefix(ref) || stripWorkspacePrefix(workspace.id) === stripWorkspacePrefix(ref) || workspace.name.toLowerCase() === ref.toLowerCase();
+}
+function stripWorkspacePrefix(value) {
+	return value.startsWith("wksp_") ? value.slice(5) : value;
+}
 //#endregion
-export { FileTokenStorage };
+export { FileTokenStorage, WorkspaceSelectionError };

package/dist/commands/auth/index.js

@@ -1,9 +1,9 @@
 import { attachCommandDescriptor } from "../../shell/command-meta.js";
 import { addCompactGlobalFlags, addGlobalFlags } from "../../shell/global-flags.js";
 import { configureRuntimeCommand } from "../../shell/runtime.js";
-import { runAuthLogin, runAuthLogout, runAuthWhoAmI } from "../../controllers/auth.js";
+import { runAuthLogin, runAuthLogout, runAuthWhoAmI, runAuthWorkspaceList, runAuthWorkspaceLogout, runAuthWorkspaceSelect, runAuthWorkspaceUse } from "../../controllers/auth.js";
 import { runCommand } from "../../shell/command-runner.js";
-import { renderAuthSuccess } from "../../presenters/auth.js";
+import { renderAuthSuccess, renderAuthWorkspaceList, renderAuthWorkspaceLogout, renderAuthWorkspaceUse, serializeAuthWorkspaceList, serializeAuthWorkspaceLogout, serializeAuthWorkspaceUse } from "../../presenters/auth.js";
 import { Command, Option } from "commander";
 //#region src/commands/auth/index.ts
 function createAuthCommand(runtime) {
@@ -12,6 +12,7 @@ function createAuthCommand(runtime) {
 	auth.addCommand(createAuthLoginCommand(runtime));
 	auth.addCommand(createAuthLogoutCommand(runtime));
 	auth.addCommand(createAuthWhoAmICommand(runtime));
+	auth.addCommand(createAuthWorkspaceCommand(runtime));
 	return auth;
 }
 function createAuthLoginCommand(runtime) {
@@ -25,8 +26,17 @@ function createAuthLoginCommand(runtime) {
 }
 function createAuthLogoutCommand(runtime) {
 	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("logout"), runtime), "auth.logout");
+	command.addOption(new Option("--workspace <id-or-name>", "Remove one stored OAuth workspace session"));
 	addGlobalFlags(command);
 	command.action(async (options) => {
+		const logoutOptions = options;
+		if (logoutOptions.workspace?.trim()) {
+			await runCommand(runtime, "auth.workspace.logout", options, (context) => runAuthWorkspaceLogout(context, logoutOptions.workspace), {
+				renderHuman: (context, descriptor, result) => renderAuthWorkspaceLogout(context, descriptor, result),
+				renderJson: (result) => serializeAuthWorkspaceLogout(result)
+			});
+			return;
+		}
 		await runCommand(runtime, "auth.logout", options, (context) => runAuthLogout(context), { renderHuman: (context, descriptor, result) => renderAuthSuccess(context, descriptor, "auth.logout", result) });
 	});
 	return command;
@@ -39,5 +49,60 @@ function createAuthWhoAmICommand(runtime) {
 	});
 	return command;
 }
+function createAuthWorkspaceCommand(runtime) {
+	const workspace = attachCommandDescriptor(configureRuntimeCommand(new Command("workspace"), runtime), "auth.workspace");
+	addCompactGlobalFlags(workspace);
+	workspace.addCommand(createAuthWorkspaceListCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceUseCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceSelectCommand(runtime));
+	workspace.addCommand(createAuthWorkspaceLogoutCommand(runtime));
+	return workspace;
+}
+function createAuthWorkspaceListCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("list"), runtime), "auth.workspace.list");
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		await runCommand(runtime, "auth.workspace.list", options, (context) => runAuthWorkspaceList(context), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceList(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceList(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceSelectCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("select"), runtime), "auth.workspace.select");
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		await runCommand(runtime, "auth.workspace.select", options, (context) => runAuthWorkspaceSelect(context), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceUse(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceUse(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceLogoutCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("logout"), runtime), "auth.workspace.logout");
+	command.argument("<id-or-name>", "Workspace id or exact name");
+	addGlobalFlags(command);
+	command.action(async (workspaceRef, options) => {
+		await runCommand(runtime, "auth.workspace.logout", options, (context) => runAuthWorkspaceLogout(context, typeof workspaceRef === "string" ? workspaceRef : void 0), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceLogout(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceLogout(result)
+		});
+	});
+	return command;
+}
+function createAuthWorkspaceUseCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("use"), runtime), "auth.workspace.use");
+	command.argument("<id-or-name>", "Workspace id or exact name");
+	addGlobalFlags(command);
+	command.action(async (workspaceRef, options) => {
+		await runCommand(runtime, "auth.workspace.use", options, (context) => runAuthWorkspaceUse(context, typeof workspaceRef === "string" ? workspaceRef : void 0), {
+			renderHuman: (context, descriptor, result) => renderAuthWorkspaceUse(context, descriptor, result),
+			renderJson: (result) => serializeAuthWorkspaceUse(result)
+		});
+	});
+	return command;
+}
 //#endregion
 export { createAuthCommand };

package/dist/controllers/app.js

@@ -11,7 +11,7 @@ import { renderCommandHeader } from "../shell/ui.js";
 import { canPrompt } from "../shell/runtime.js";
 import { LOCAL_RESOLUTION_PIN_RELATIVE_PATH, readLocalResolutionPin } from "../lib/project/local-pin.js";
 import { formatCommandArgument } from "../shell/command-arguments.js";
-import { buildProjectSetupNextActions, inferTargetName, projectNotFoundError, projectResolutionErrorToCliError, resolveDurablePlatformMapping, resolveProjectTarget, sortProjects } from "../lib/project/resolution.js";
+import { buildProjectSetupNextActions, inferTargetName, localProjectWorkspaceMismatchError, projectNotFoundError, projectResolutionErrorToCliError, resolveDurablePlatformMapping, resolveProjectTarget, sortProjects } from "../lib/project/resolution.js";
 import { bindProjectToDirectory, projectCreateFailedError, projectDirectoryBindingErrorToCliError, projectSetupNameRequiredError, resolveProjectForSetup, toProjectSummary } from "../lib/project/setup.js";
 import { maybeSetupBranchDatabase } from "../lib/app/branch-database-deploy.js";
 import { readBunPackageEntrypoint, readBunPackageJson } from "../lib/app/bun-project.js";
@@ -1644,7 +1644,11 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 	}
 	const localPin = options.localPin;
 	if (localPin.kind === "present") {
-		if (localPin.pin.workspaceId !== workspace.id) throw localResolutionPinStaleError();
+		if (localPin.pin.workspaceId !== workspace.id) throw localProjectWorkspaceMismatchError({
+			pinnedWorkspaceId: localPin.pin.workspaceId,
+			pinnedProjectId: localPin.pin.projectId,
+			activeWorkspace: workspace
+		});
 		const project = projects.find((candidate) => candidate.id === localPin.pin.projectId);
 		if (!project) throw localResolutionPinStaleError();
 		return withRemoteDeployBranch(provider, {

package/dist/controllers/auth.js

@@ -1,4 +1,6 @@
-import { authRequiredError, usageError } from "../shell/errors.js";
+import { SERVICE_TOKEN_ENV_VAR } from "../lib/auth/client.js";
+import { FileTokenStorage, WorkspaceSelectionError } from "../adapters/token-storage.js";
+import { authRequiredError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceSwitchUnavailableError } from "../shell/errors.js";
 import { canPrompt } from "../shell/runtime.js";
 import { performLogin, performLogout, readAuthState } from "../lib/auth/auth-ops.js";
 import { createAuthUseCases } from "../use-cases/auth.js";
@@ -30,6 +32,40 @@ async function runAuthWhoAmI(context) {
 	else result = await createAuthUseCases(createCliUseCaseGateways(context)).whoami();
 	return createAuthSuccess("auth.whoami", result, result.authenticated ? [] : ["prisma-cli auth login"]);
 }
+async function runAuthWorkspaceList(context) {
+	const result = isRealMode(context) ? await listRealAuthWorkspaces(context) : await createAuthUseCases(createCliUseCaseGateways(context)).listWorkspaces();
+	return {
+		command: "auth.workspace.list",
+		result,
+		warnings: [],
+		nextSteps: result.workspaces.length === 0 ? ["prisma-cli auth login"] : []
+	};
+}
+async function runAuthWorkspaceUse(context, workspaceRef) {
+	if (!workspaceRef?.trim()) throw usageError("Workspace required", "auth workspace use needs a workspace id or cached workspace name.", "Pass a workspace from prisma-cli auth workspace list.", ["prisma-cli auth workspace list"], "auth");
+	return {
+		command: "auth.workspace.use",
+		result: isRealMode(context) ? await useRealAuthWorkspace(context, workspaceRef) : await createAuthUseCases(createCliUseCaseGateways(context)).useWorkspace(workspaceRef),
+		warnings: [],
+		nextSteps: ["prisma-cli auth whoami", "prisma-cli project list"]
+	};
+}
+async function runAuthWorkspaceSelect(context) {
+	return {
+		...await runAuthWorkspaceUse(context, await selectWorkspaceSession(context)),
+		command: "auth.workspace.select"
+	};
+}
+async function runAuthWorkspaceLogout(context, workspaceRef) {
+	if (!workspaceRef?.trim()) throw usageError("Workspace required", "auth workspace logout needs a workspace id or cached workspace name.", "Pass a workspace from prisma-cli auth workspace list.", ["prisma-cli auth workspace list"], "auth");
+	const result = isRealMode(context) ? await logoutRealAuthWorkspace(context, workspaceRef) : await createAuthUseCases(createCliUseCaseGateways(context)).logoutWorkspace(workspaceRef);
+	return {
+		command: "auth.workspace.logout",
+		result,
+		warnings: [],
+		nextSteps: result.activeWorkspace ? ["prisma-cli auth workspace list"] : ["prisma-cli auth workspace list", "prisma-cli auth workspace use <id>"]
+	};
+}
 async function requireAuthenticatedAuthState(context) {
 	if (isRealMode(context)) {
 		const current = await readAuthState(context.runtime.env, context.runtime.signal);
@@ -44,6 +80,108 @@ async function requireAuthenticatedAuthState(context) {
 	if (!canPrompt(context)) throw authRequiredError();
 	return loginWithSelectionFlow(context, useCases, {});
 }
+async function listRealAuthWorkspaces(context) {
+	const rawServiceToken = context.runtime.env[SERVICE_TOKEN_ENV_VAR];
+	const localWorkspaces = await new FileTokenStorage(context.runtime.env, context.runtime.signal).listWorkspaces();
+	if (rawServiceToken !== void 0) {
+		const authState = await readAuthState(context.runtime.env, context.runtime.signal);
+		return {
+			authSource: authState.authenticated ? "service_token" : "none",
+			activeWorkspace: authState.workspace,
+			workspaces: [...authState.workspace ? [{
+				...authState.workspace,
+				credentialWorkspaceId: null,
+				active: true,
+				source: "service_token",
+				switchable: false,
+				lastSeenAt: null
+			}] : [], ...localWorkspaces.map((workspace) => ({
+				...toAuthWorkspace(workspace),
+				credentialWorkspaceId: workspace.credentialWorkspaceId,
+				active: false,
+				source: "oauth",
+				switchable: false,
+				lastSeenAt: workspace.lastSeenAt
+			}))]
+		};
+	}
+	const active = localWorkspaces.find((workspace) => workspace.active) ?? null;
+	return {
+		authSource: localWorkspaces.length > 0 ? "oauth" : "none",
+		activeWorkspace: active ? toAuthWorkspace(active) : null,
+		workspaces: localWorkspaces.map((workspace) => ({
+			...toAuthWorkspace(workspace),
+			credentialWorkspaceId: workspace.credentialWorkspaceId,
+			active: workspace.active,
+			source: "oauth",
+			switchable: true,
+			lastSeenAt: workspace.lastSeenAt
+		}))
+	};
+}
+async function useRealAuthWorkspace(context, workspaceRef) {
+	if (context.runtime.env["PRISMA_SERVICE_TOKEN"] !== void 0) throw workspaceSwitchUnavailableError();
+	const storage = new FileTokenStorage(context.runtime.env, context.runtime.signal);
+	try {
+		const result = await storage.useWorkspace(workspaceRef);
+		return {
+			previousWorkspace: result.previous ? toAuthWorkspace(result.previous) : null,
+			workspace: toAuthWorkspace(result.selected)
+		};
+	} catch (error) {
+		if (error instanceof WorkspaceSelectionError) {
+			if (error.reason === "ambiguous") throw workspaceAmbiguousError(error.workspaceRef ?? workspaceRef, error.matches.map((match) => ({
+				id: match.id,
+				name: match.name,
+				credentialWorkspaceId: match.credentialWorkspaceId
+			})));
+			throw workspaceNotAuthenticatedError(error.workspaceRef ?? workspaceRef);
+		}
+		throw error;
+	}
+}
+async function logoutRealAuthWorkspace(context, workspaceRef) {
+	const storage = new FileTokenStorage(context.runtime.env, context.runtime.signal);
+	try {
+		const result = await storage.logoutWorkspace(workspaceRef);
+		return {
+			workspace: toAuthWorkspace(result.workspace),
+			wasActive: result.wasActive,
+			activeWorkspace: result.activeWorkspace ? toAuthWorkspace(result.activeWorkspace) : null
+		};
+	} catch (error) {
+		if (error instanceof WorkspaceSelectionError) {
+			if (error.reason === "ambiguous") throw workspaceAmbiguousError(error.workspaceRef ?? workspaceRef, error.matches.map((match) => ({
+				id: match.id,
+				name: match.name,
+				credentialWorkspaceId: match.credentialWorkspaceId
+			})));
+			throw workspaceNotAuthenticatedError(error.workspaceRef ?? workspaceRef);
+		}
+		throw error;
+	}
+}
+async function selectWorkspaceSession(context) {
+	const realMode = isRealMode(context);
+	if (realMode && context.runtime.env["PRISMA_SERVICE_TOKEN"] !== void 0) throw workspaceSwitchUnavailableError();
+	const workspaces = (realMode ? await listRealAuthWorkspaces(context) : await createAuthUseCases(createCliUseCaseGateways(context)).listWorkspaces()).workspaces.filter((workspace) => workspace.switchable);
+	if (workspaces.length === 0) throw usageError("No authenticated workspaces", "There are no local OAuth workspace sessions to select.", "Run prisma-cli auth login and authorize a workspace.", ["prisma-cli auth login"], "auth");
+	if (workspaces.length === 1) return workspaces[0].id;
+	if (!canPrompt(context)) throw usageError("Interactive workspace selection unavailable", "auth workspace select needs an interactive terminal when more than one workspace is available.", "Run prisma-cli auth workspace use <id-or-name> with a workspace from prisma-cli auth workspace list.", ["prisma-cli auth workspace list"], "auth");
+	return (await createSelectPromptPort(context).select({
+		message: "Select a workspace",
+		choices: workspaces.map((workspace) => ({
+			label: `${workspace.name} (${workspace.id})${workspace.active ? " active" : ""}`,
+			value: workspace
+		}))
+	})).id;
+}
+function toAuthWorkspace(workspace) {
+	return {
+		id: workspace.id,
+		name: workspace.name
+	};
+}
 async function loginWithSelectionFlow(context, useCases, options) {
 	const selection = await resolveLoginSelection(useCases, canPrompt(context) ? createSelectPromptPort(context) : null, options);
 	return useCases.login(selection);
@@ -104,4 +242,4 @@ function createAuthSuccess(command, result, nextSteps) {
 	};
 }
 //#endregion
-export { requireAuthenticatedAuthState, runAuthLogin, runAuthLogout, runAuthWhoAmI };
+export { requireAuthenticatedAuthState, runAuthLogin, runAuthLogout, runAuthWhoAmI, runAuthWorkspaceList, runAuthWorkspaceLogout, runAuthWorkspaceSelect, runAuthWorkspaceUse };

package/dist/lib/auth/auth-ops.js

@@ -26,7 +26,7 @@ function workspaceIdFromClaims(claims) {
 }
 async function performLogin(env, signal) {
 	await login({
-		tokenStorage: new FileTokenStorage(env, signal),
+		tokenStorage: new FileTokenStorage(env, signal, { activateOnSetTokens: true }),
 		env,
 		signal
 	});
@@ -38,7 +38,8 @@ async function readAuthState(env, signal) {
 		if (serviceToken.length === 0) throw new Error(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
 		return readServiceTokenAuthState(serviceToken, env, signal);
 	}
-	const tokens = await new FileTokenStorage(env, signal).getTokens();
+	const tokenStorage = new FileTokenStorage(env, signal);
+	const tokens = await tokenStorage.getTokens();
 	if (!tokens) return {
 		authenticated: false,
 		provider: null,
@@ -48,15 +49,20 @@ async function readAuthState(env, signal) {
 	};
 	const client = await requireComputeAuth(env, signal);
 	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
-	if (currentPrincipal) return currentPrincipal;
+	if (currentPrincipal) {
+		if (currentPrincipal.authenticated && currentPrincipal.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, currentPrincipal.workspace);
+		return currentPrincipal;
+	}
 	const claims = decodeJwtPayload(tokens.accessToken);
-	return buildAuthState({
+	const authState = await buildAuthState({
 		workspaceIdFromCredential: tokens.workspaceId,
 		claims,
 		env,
 		client,
 		signal
 	});
+	if (authState.authenticated && authState.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, authState.workspace);
+	return authState;
 }
 async function readServiceTokenAuthState(token, env, signal) {
 	const client = await requireComputeAuth(env, signal);

package/dist/lib/auth/guard.js

@@ -22,7 +22,10 @@ async function requireComputeAuth(env = process.env, signal) {
 			token
 		});
 	}
-	const tokenStorage = new FileTokenStorage(env, signal);
+	const tokenStorage = new FileTokenStorage(env, signal, {
+		activateOnSetTokens: false,
+		lockSetTokens: false
+	});
 	if (!await tokenStorage.getTokens()) return null;
 	return createManagementApiSdk({
 		clientId: CLIENT_ID,

package/dist/lib/auth/login.js

@@ -151,7 +151,7 @@ var LoginState = class {
 	output;
 	constructor(options) {
 		this.options = options;
-		this.tokenStorage = options.tokenStorage ?? new FileTokenStorage(options.env, options.signal);
+		this.tokenStorage = options.tokenStorage ?? new FileTokenStorage(options.env, options.signal, { activateOnSetTokens: true });
 		this.sdk = createManagementApiSdk({
 			clientId: options.clientId ?? "cmm3lndn701oo0uefvxzo0ivw",
 			redirectUri: `http://${options.hostname}:${options.port}/auth/callback`,

package/dist/lib/project/resolution.js

@@ -138,13 +138,16 @@ function localStateStaleCliError() {
 		nextSteps: ["prisma-cli project list", "prisma-cli project link <id-or-name>"]
 	});
 }
+function localProjectWorkspaceMismatchError(options) {
+	return projectResolutionErrorToCliError(new LocalProjectWorkspaceMismatchError(options));
+}
 function localProjectWorkspaceMismatchCliError(options) {
 	return new CliError({
 		code: "LOCAL_PROJECT_WORKSPACE_MISMATCH",
 		domain: "project",
 		summary: "Project link uses another workspace",
 		why: `${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} links this directory to project ${options.pinnedProjectId} in workspace ${options.pinnedWorkspaceId}, but your current CLI session is workspace "${options.activeWorkspace.name}" (${options.activeWorkspace.id}).`,
-		fix: "Sign in to the linked workspace, or relink this directory to a project in the current workspace.",
+		fix: "Switch to the linked workspace, or relink this directory to a project in the current workspace.",
 		meta: {
 			pinPath: LOCAL_RESOLUTION_PIN_RELATIVE_PATH,
 			pinnedWorkspaceId: options.pinnedWorkspaceId,
@@ -154,7 +157,7 @@ function localProjectWorkspaceMismatchCliError(options) {
 		},
 		exitCode: 1,
 		nextSteps: [
-			"prisma-cli auth login",
+			`prisma-cli auth workspace use ${options.pinnedWorkspaceId}`,
 			"prisma-cli project list",
 			"prisma-cli project link <id-or-name>"
 		]
@@ -380,4 +383,4 @@ function toProjectSummary(project) {
 	};
 }
 //#endregion
-export { buildProjectSetupNextActions, inferTargetName, inspectProjectBinding, projectAmbiguousError, projectNotFoundError, projectResolutionErrorToCliError, resolveDurablePlatformMapping, resolveProjectTarget, sortProjects };
+export { buildProjectSetupNextActions, inferTargetName, inspectProjectBinding, localProjectWorkspaceMismatchError, projectAmbiguousError, projectNotFoundError, projectResolutionErrorToCliError, resolveDurablePlatformMapping, resolveProjectTarget, sortProjects };

package/dist/presenters/auth.js

@@ -1,4 +1,7 @@
+import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { padDisplay } from "../shell/ui.js";
 import { renderMutate, renderShow } from "../output/patterns.js";
+import stringWidth from "string-width";
 //#region src/presenters/auth.ts
 function renderAuthSuccess(context, descriptor, command, result) {
 	if (command === "auth.login") {
@@ -62,11 +65,105 @@ function renderAuthSuccess(context, descriptor, command, result) {
 		}]
 	}, context.ui);
 }
+function renderAuthWorkspaceList(context, descriptor, result) {
+	const ui = context.ui;
+	const rail = ui.dim("│");
+	const lines = [
+		`${ui.strong(formatDescriptorLabel(descriptor))} ${ui.dim("→")} ${ui.dim("Listing authenticated workspaces on this machine.")}`,
+		"",
+		`${rail}  ${ui.accent("auth source:")}  ${authSourceLabel(result.authSource)}`
+	];
+	const hasMixedSources = new Set(result.workspaces.map((workspace) => workspace.source)).size > 1;
+	if (result.workspaces.length === 0) {
+		lines.push(`${rail}  ${ui.dim("No local OAuth workspaces found.")}`);
+		return lines;
+	}
+	const nameWidth = Math.max(4, ...result.workspaces.map((workspace) => stringWidth(workspace.name)));
+	const idWidth = Math.max(2, ...result.workspaces.map((workspace) => stringWidth(workspace.id)));
+	const sourceWidth = hasMixedSources ? Math.max(6, ...result.workspaces.map((workspace) => stringWidth(workspaceSourceLabel(workspace.source)))) : 0;
+	lines.push(rail);
+	lines.push(hasMixedSources ? `${rail}  ${ui.accent(padDisplay("name", nameWidth))}  ${ui.accent(padDisplay("id", idWidth))}  ${ui.accent(padDisplay("source", sourceWidth))}  ${ui.accent("status")}` : `${rail}  ${ui.accent(padDisplay("name", nameWidth))}  ${ui.accent(padDisplay("id", idWidth))}  ${ui.accent("status")}`);
+	for (const workspace of result.workspaces) {
+		const status = workspace.active ? "active" : "";
+		const source = workspaceSourceLabel(workspace.source);
+		lines.push(hasMixedSources ? `${rail}  ${padDisplay(workspace.name, nameWidth)}  ${padDisplay(workspace.id, idWidth)}  ${padDisplay(source, sourceWidth)}  ${status}` : `${rail}  ${padDisplay(workspace.name, nameWidth)}  ${padDisplay(workspace.id, idWidth)}  ${status}`);
+	}
+	return lines;
+}
+function serializeAuthWorkspaceList(result) {
+	return {
+		context: {
+			authSource: result.authSource,
+			activeWorkspaceId: result.activeWorkspace?.id ?? null,
+			activeWorkspaceName: result.activeWorkspace?.name ?? null
+		},
+		items: result.workspaces.map((workspace) => ({
+			id: workspace.id,
+			name: workspace.name,
+			status: workspace.active ? "active" : null,
+			source: workspace.source,
+			switchable: workspace.switchable,
+			credentialWorkspaceId: workspace.credentialWorkspaceId,
+			lastSeenAt: workspace.lastSeenAt
+		})),
+		count: result.workspaces.length
+	};
+}
+function renderAuthWorkspaceUse(context, descriptor, result) {
+	return renderMutate({
+		title: "Switching the local CLI workspace.",
+		descriptor,
+		context: [...result.previousWorkspace ? [{
+			key: "previous",
+			value: result.previousWorkspace.name
+		}] : [], {
+			key: "workspace",
+			value: result.workspace.name
+		}],
+		operationDescription: "Applying workspace selection",
+		operationCount: 1,
+		details: ["Local OAuth workspace selection updated."]
+	}, context.ui);
+}
+function serializeAuthWorkspaceUse(result) {
+	return result;
+}
+function renderAuthWorkspaceLogout(context, descriptor, result) {
+	return renderMutate({
+		title: "Removing a local OAuth workspace session.",
+		descriptor,
+		context: [{
+			key: "workspace",
+			value: result.workspace.name
+		}, ...result.activeWorkspace ? [{
+			key: "active",
+			value: result.activeWorkspace.name
+		}] : [{
+			key: "active",
+			value: "none",
+			tone: "dim"
+		}]],
+		operationDescription: "Removing workspace session",
+		operationCount: 1,
+		details: [result.wasActive ? "Removed active workspace session; no replacement workspace was selected." : "Removed workspace session."]
+	}, context.ui);
+}
+function serializeAuthWorkspaceLogout(result) {
+	return result;
+}
 function providerLabel(provider) {
 	if (provider === "github") return "GitHub";
 	if (provider === "google") return "Google";
 	return "";
 }
+function authSourceLabel(source) {
+	if (source === "oauth") return "local OAuth";
+	if (source === "service_token") return "PRISMA_SERVICE_TOKEN";
+	return "none";
+}
+function workspaceSourceLabel(source) {
+	return source === "service_token" ? "service token" : "OAuth";
+}
 function authUserLabel(result) {
 	return result.user?.email ?? credentialUserLabel(result);
 }
@@ -83,4 +180,4 @@ function credentialUserLabel(result) {
 	return null;
 }
 //#endregion
-export { renderAuthSuccess };
+export { renderAuthSuccess, renderAuthWorkspaceList, renderAuthWorkspaceLogout, renderAuthWorkspaceUse, serializeAuthWorkspaceList, serializeAuthWorkspaceLogout, serializeAuthWorkspaceUse };

package/dist/shell/command-meta.js

@@ -50,6 +50,65 @@ const DESCRIPTORS = [
 		description: "Show the authenticated user and accessible workspace",
 		examples: ["prisma-cli auth whoami", "prisma-cli auth whoami --json"]
 	},
+	{
+		id: "auth.workspace",
+		path: [
+			"prisma",
+			"auth",
+			"workspace"
+		],
+		description: "Manage local authenticated workspaces",
+		examples: [
+			"prisma-cli auth workspace list",
+			"prisma-cli auth workspace select",
+			"prisma-cli auth workspace use wksp_123",
+			"prisma-cli auth workspace logout wksp_123"
+		]
+	},
+	{
+		id: "auth.workspace.list",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"list"
+		],
+		description: "List locally authenticated workspaces",
+		examples: ["prisma-cli auth workspace list", "prisma-cli auth workspace list --json"]
+	},
+	{
+		id: "auth.workspace.use",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"use"
+		],
+		description: "Switch the local CLI workspace",
+		examples: ["prisma-cli auth workspace use wksp_123", "prisma-cli auth workspace use \"Acme Inc\""]
+	},
+	{
+		id: "auth.workspace.select",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"select"
+		],
+		description: "Interactively select the local CLI workspace",
+		examples: ["prisma-cli auth workspace select"]
+	},
+	{
+		id: "auth.workspace.logout",
+		path: [
+			"prisma",
+			"auth",
+			"workspace",
+			"logout"
+		],
+		description: "Remove one local OAuth workspace session",
+		examples: ["prisma-cli auth workspace logout wksp_123", "prisma-cli auth workspace logout \"Acme Inc\""]
+	},
 	{
 		id: "project",
 		path: ["prisma", "project"],

package/dist/shell/command-runner.js

@@ -1,4 +1,4 @@
-import { CliError, authRequiredError, commandCanceledError } from "./errors.js";
+import { CliError, authConfigInvalidError, authRequiredError, commandCanceledError } from "./errors.js";
 import { getCommandDescriptor } from "./command-meta.js";
 import { resolveGlobalFlags } from "./global-flags.js";
 import { createCommandContext } from "./runtime.js";
@@ -11,6 +11,7 @@ function toCliError(error, runtime) {
 	if (isCancellationError(error) || runtime.signal.aborted) return commandCanceledError();
 	if (error instanceof CliError) return error;
 	if (error instanceof AuthError) return authRequiredError(["prisma-cli auth login"], { debug: error.message });
+	if (error instanceof Error && error.message.startsWith("PRISMA_SERVICE_TOKEN is set but empty")) return authConfigInvalidError(error.message);
 	return null;
 }
 function isCancellationError(error) {

package/dist/shell/errors.js

@@ -56,6 +56,17 @@ function authRequiredError(nextSteps = ["prisma-cli auth login"], options = {})
 		nextSteps
 	});
 }
+function authConfigInvalidError(message) {
+	return new CliError({
+		code: "AUTH_CONFIG_INVALID",
+		domain: "auth",
+		summary: "Authentication configuration is invalid",
+		why: message,
+		fix: "Provide a valid PRISMA_SERVICE_TOKEN value, or unset the variable to use local OAuth login.",
+		exitCode: 1,
+		nextSteps: ["prisma-cli auth login"]
+	});
+}
 function commandCanceledError() {
 	return new CliError({
 		code: "COMMAND_CANCELED",
@@ -70,6 +81,44 @@ function commandCanceledError() {
 function workspaceRequiredError() {
 	return usageError("Workspace required", "This command needs an active workspace, but the authenticated session does not have one.", "Run prisma-cli auth login and choose a workspace.", ["prisma-cli auth login"], "auth");
 }
+function workspaceSwitchUnavailableError() {
+	return new CliError({
+		code: "WORKSPACE_SWITCH_UNAVAILABLE",
+		domain: "auth",
+		summary: "Workspace switching is unavailable",
+		why: "PRISMA_SERVICE_TOKEN is set, so authenticated commands use that token instead of local OAuth workspaces.",
+		fix: "Unset PRISMA_SERVICE_TOKEN to switch between local OAuth workspaces, or use a token for the workspace you want.",
+		exitCode: 1,
+		nextSteps: ["unset PRISMA_SERVICE_TOKEN", "prisma-cli auth workspace list"]
+	});
+}
+function workspaceNotAuthenticatedError(workspaceRef) {
+	return new CliError({
+		code: "WORKSPACE_NOT_AUTHENTICATED",
+		domain: "auth",
+		summary: "Workspace is not authenticated",
+		why: `No stored OAuth session matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth login and authorize that workspace, then switch to it.",
+		meta: { workspaceRef },
+		exitCode: 1,
+		nextSteps: ["prisma-cli auth workspace list", "prisma-cli auth login"]
+	});
+}
+function workspaceAmbiguousError(workspaceRef, matches) {
+	return new CliError({
+		code: "WORKSPACE_AMBIGUOUS",
+		domain: "auth",
+		summary: "Workspace name is ambiguous",
+		why: `Multiple authenticated workspaces matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth workspace list and switch by workspace id.",
+		meta: {
+			workspaceRef,
+			matches
+		},
+		exitCode: 2,
+		nextSteps: ["prisma-cli auth workspace list"]
+	});
+}
 function featureUnavailableError(summary, why, fix, nextSteps = [], domain = "cli") {
 	return new CliError({
 		code: "FEATURE_UNAVAILABLE",
@@ -82,4 +131,4 @@ function featureUnavailableError(summary, why, fix, nextSteps = [], domain = "cl
 	});
 }
 //#endregion
-export { CliError, authRequiredError, commandCanceledError, featureUnavailableError, usageError, workspaceRequiredError };
+export { CliError, authConfigInvalidError, authRequiredError, commandCanceledError, featureUnavailableError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceRequiredError, workspaceSwitchUnavailableError };

package/dist/use-cases/auth.js

@@ -1,4 +1,4 @@
-import { usageError } from "../shell/errors.js";
+import { authRequiredError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError } from "../shell/errors.js";
 //#region src/use-cases/auth.ts
 function createAuthUseCases(dependencies) {
 	return {
@@ -15,6 +15,70 @@ function createAuthUseCases(dependencies) {
 			await dependencies.sessionGateway.clearAuthSession();
 			return resolveCurrentAuthState(dependencies);
 		},
+		listWorkspaces: async () => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) return {
+				authSource: "none",
+				activeWorkspace: null,
+				workspaces: []
+			};
+			const workspaces = dependencies.identityGateway.listUserWorkspaces(session.userId);
+			return {
+				authSource: "oauth",
+				activeWorkspace: workspaces.find((workspace) => workspace.id === session.workspaceId) ?? null,
+				workspaces: workspaces.map((workspace) => ({
+					...workspace,
+					credentialWorkspaceId: workspace.id,
+					active: workspace.id === session.workspaceId,
+					source: "oauth",
+					switchable: true,
+					lastSeenAt: null
+				}))
+			};
+		},
+		useWorkspace: async (workspaceRef) => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) throw authRequiredError(["prisma-cli auth login"]);
+			const ref = workspaceRef.trim();
+			const matches = dependencies.identityGateway.listUserWorkspaces(session.userId).filter((workspace) => workspaceMatchesRef(workspace, ref));
+			if (matches.length === 0) throw workspaceNotAuthenticatedError(workspaceRef);
+			if (matches.length > 1) throw workspaceAmbiguousError(workspaceRef, matches.map((workspace) => ({
+				id: workspace.id,
+				name: workspace.name,
+				credentialWorkspaceId: workspace.id
+			})));
+			const selected = matches[0];
+			const previousWorkspace = dependencies.identityGateway.getWorkspace(session.workspaceId) ?? null;
+			await dependencies.sessionGateway.writeAuthSession({
+				...session,
+				workspaceId: selected.id
+			});
+			return {
+				previousWorkspace,
+				workspace: selected
+			};
+		},
+		logoutWorkspace: async (workspaceRef) => {
+			const session = await dependencies.sessionGateway.readAuthSession();
+			if (!session) throw workspaceNotAuthenticatedError(workspaceRef);
+			const ref = workspaceRef.trim();
+			const matches = dependencies.identityGateway.listUserWorkspaces(session.userId).filter((workspace) => workspaceMatchesRef(workspace, ref));
+			if (matches.length === 0) throw workspaceNotAuthenticatedError(workspaceRef);
+			if (matches.length > 1) throw workspaceAmbiguousError(workspaceRef, matches.map((workspace) => ({
+				id: workspace.id,
+				name: workspace.name,
+				credentialWorkspaceId: workspace.id
+			})));
+			const workspace = matches[0];
+			const wasActive = workspace.id === session.workspaceId;
+			const activeWorkspace = wasActive ? null : dependencies.identityGateway.getWorkspace(session.workspaceId) ?? null;
+			if (wasActive) await dependencies.sessionGateway.clearAuthSession();
+			return {
+				workspace,
+				wasActive,
+				activeWorkspace
+			};
+		},
 		listProviders: async () => dependencies.identityGateway.listProviders(),
 		resolveProvider: async (providerId) => {
 			const provider = dependencies.identityGateway.getProvider(providerId);
@@ -39,6 +103,9 @@ function createAuthUseCases(dependencies) {
 		}
 	};
 }
+function workspaceMatchesRef(workspace, ref) {
+	return workspace.id === ref || workspace.name.toLowerCase() === ref.toLowerCase();
+}
 async function resolveCurrentAuthState(dependencies) {
 	const session = await dependencies.sessionGateway.readAuthSession();
 	if (!session) return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "3.0.0-dev.91.1",
+  "version": "3.0.0-dev.93.1",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {