@prisma/cli 3.0.0-dev.97.1 → 8.0.0-rc.1

package/README.md

@@ -76,6 +76,8 @@ The beta package exposes `prisma-cli` so it can coexist with the existing
 | `project` | List projects, show the resolved project, and manage project environment variables. |
 | `git` | Connect or disconnect a project from a GitHub repository. |
 | `branch` | List Prisma branches for the resolved project. |
+| `database` | Create, inspect, and remove Prisma Postgres databases and their connection strings. |
+| `bucket` | Create, list, and delete Tigris object-store buckets and their access keys. |
 | `app` | Build, run, deploy, inspect, open, stream logs, promote, roll back, and remove apps. |
 
 Common examples:
@@ -98,24 +100,11 @@ npx prisma-cli app promote <deployment-id>
 - Stable command groups, flags, and error codes for scripts and agents.
 - Environment variable values are not printed back to the terminal.
 
-### Agent skills
-
-For agent-guided Next.js deploys, install the Prisma CLI skill cluster at the
-project level. Match the skill ref to the installed CLI version:
-
-```bash
-npx prisma-cli version
-pnpm dlx skills@latest add prisma/prisma-cli/skills#cli-v<cli-version> --all
-```
-
-The skills teach agents how to prepare a Next.js app, run `app deploy`, verify
-the result, and route CLI / Compute feedback to the right Prisma channel.
-
 ---
 
 ## Beta notes
 
-- Requires Node.js 22.12 or newer.
+- Requires Node.js 22.18 or newer.
 - This is a beta package and may change quickly.
 - Official beta releases publish as `@prisma/cli`.
 - The package binary is `prisma-cli`, not `prisma`, during beta.

package/dist/adapters/local-state.js

@@ -1,5 +1,5 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 //#region src/adapters/local-state.ts
 const DEFAULT_STATE = {
 	auth: null,
@@ -12,7 +12,8 @@ const DEFAULT_STATE = {
 	app: {
 		selectedByProject: {},
 		knownLiveDeploymentByProject: {}
-	}
+	},
+	agent: { setupPromptDismissedAt: null }
 };
 const DEFAULT_STATE_FILE_NAME = "state.json";
 function resolveLocalStateFilePath(stateDir) {
@@ -43,7 +44,8 @@ var LocalStateStore = class {
 				app: {
 					selectedByProject: parsed.app?.selectedByProject ?? {},
 					knownLiveDeploymentByProject: parsed.app?.knownLiveDeploymentByProject ?? {}
-				}
+				},
+				agent: { setupPromptDismissedAt: parsed.agent?.setupPromptDismissedAt ?? null }
 			};
 		} catch (error) {
 			if (error.code === "ENOENT") return structuredClone(DEFAULT_STATE);
@@ -139,6 +141,15 @@ var LocalStateStore = class {
 		await this.write(state);
 		return state;
 	}
+	async readAgentSetupPromptDismissedAt() {
+		return (await this.read()).agent.setupPromptDismissedAt;
+	}
+	async setAgentSetupPromptDismissedAt(dismissedAt) {
+		const state = await this.read();
+		state.agent.setupPromptDismissedAt = dismissedAt;
+		await this.write(state);
+		return state;
+	}
 };
 //#endregion
 export { LocalStateStore, resolveLocalStateFilePath };

package/dist/{lib/auth → auth}/client.js

@@ -1,15 +1,23 @@
 import path from "node:path";
 import os from "node:os";
-//#region src/lib/auth/client.ts
+//#region src/auth/client.ts
 const CLIENT_ID = "cmm3lndn701oo0uefvxzo0ivw";
-const SERVICE_TOKEN_ENV_VAR = "PRISMA_SERVICE_TOKEN";
 const AUTH_FILE_ENV_VAR = "PRISMA_COMPUTE_AUTH_FILE";
+/**
+* The SDK's config demands a redirect URI even for a client that only
+* ever makes API calls with tokens it already has. Port 0 is the
+* honest value: no browser is ever sent here, and nothing listens.
+*/
+const UNUSED_REDIRECT_URI = "http://localhost:0/auth/callback";
 function getApiBaseUrl(env = process.env) {
 	return env.PRISMA_MANAGEMENT_API_URL?.trim() || "https://api.prisma.io";
 }
 function getAuthFilePath(env = process.env) {
 	const configured = env[AUTH_FILE_ENV_VAR];
 	if (configured?.trim()) return path.resolve(configured);
+	return defaultAuthFilePath(env);
+}
+function defaultAuthFilePath(env = process.env) {
 	if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", "prisma", "auth.json");
 	if (process.platform === "win32") {
 		const appData = env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
@@ -19,4 +27,4 @@ function getAuthFilePath(env = process.env) {
 	return path.join(xdgConfigHome, "prisma", "auth.json");
 }
 //#endregion
-export { CLIENT_ID, SERVICE_TOKEN_ENV_VAR, getApiBaseUrl, getAuthFilePath };
+export { CLIENT_ID, UNUSED_REDIRECT_URI, getApiBaseUrl, getAuthFilePath };

package/dist/auth/errors.js

@@ -0,0 +1,50 @@
+import { CliError } from "../errors.js";
+//#region src/auth/errors.ts
+/**
+* Auth-specific error constructors, owned by the auth module. The
+* CliError base class still lives in the legacy shell (`shell/errors`);
+* it is the one remaining legacy dependency of this module and is
+* named as an S2d survivor until the operations layer throws structured
+* errors directly. The shell re-exports these constructors so legacy
+* imports keep working.
+*/
+function workspaceSwitchUnavailableError() {
+	return new CliError({
+		code: "WORKSPACE_SWITCH_UNAVAILABLE",
+		domain: "auth",
+		summary: "Workspace switching is unavailable",
+		why: "PRISMA_SERVICE_TOKEN is set, so authenticated commands use that token instead of local OAuth workspaces.",
+		fix: "Unset PRISMA_SERVICE_TOKEN to switch between local OAuth workspaces, or use a token for the workspace you want.",
+		exitCode: 1,
+		nextSteps: ["unset PRISMA_SERVICE_TOKEN", "prisma-cli auth workspace list"]
+	});
+}
+function workspaceNotAuthenticatedError(workspaceRef) {
+	return new CliError({
+		code: "WORKSPACE_NOT_AUTHENTICATED",
+		domain: "auth",
+		summary: "Workspace is not authenticated",
+		why: `No stored OAuth session matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth login and authorize that workspace, then switch to it.",
+		meta: { workspaceRef },
+		exitCode: 1,
+		nextSteps: ["prisma-cli auth workspace list", "prisma-cli auth login"]
+	});
+}
+function workspaceAmbiguousError(workspaceRef, matches) {
+	return new CliError({
+		code: "WORKSPACE_AMBIGUOUS",
+		domain: "auth",
+		summary: "Workspace name is ambiguous",
+		why: `Multiple authenticated workspaces matched "${workspaceRef}".`,
+		fix: "Run prisma-cli auth workspace list and switch by workspace id.",
+		meta: {
+			workspaceRef,
+			matches
+		},
+		exitCode: 2,
+		nextSteps: ["prisma-cli auth workspace list"]
+	});
+}
+//#endregion
+export { workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceSwitchUnavailableError };

package/dist/{lib/auth → auth}/guard.js

@@ -1,7 +1,8 @@
-import { CLIENT_ID, SERVICE_TOKEN_ENV_VAR, getApiBaseUrl } from "./client.js";
-import { FileTokenStorage } from "../../adapters/token-storage.js";
+import { CLIENT_ID, UNUSED_REDIRECT_URI, getApiBaseUrl } from "./client.js";
+import { FileTokenStorage } from "./token-storage.js";
 import { createManagementApiClient, createManagementApiSdk } from "@prisma/management-api-sdk";
-//#region src/lib/auth/guard.ts
+import { SERVICE_TOKEN_ENV_VAR } from "@prisma/cli-engine";
+//#region src/auth/guard.ts
 /**
 * Resolve authentication and return a ManagementApiClient.
 *
@@ -11,7 +12,7 @@ import { createManagementApiClient, createManagementApiSdk } from "@prisma/manag
 *
 * Returns null if not authenticated.
 */
-async function requireComputeAuth(env = process.env, signal) {
+async function authenticatedManagementApiClient(env = process.env, signal) {
 	signal?.throwIfAborted();
 	const rawToken = env[SERVICE_TOKEN_ENV_VAR];
 	if (rawToken !== void 0) {
@@ -29,10 +30,10 @@ async function requireComputeAuth(env = process.env, signal) {
 	if (!await tokenStorage.getTokens()) return null;
 	return createManagementApiSdk({
 		clientId: CLIENT_ID,
-		redirectUri: "http://localhost:0/auth/callback",
+		redirectUri: UNUSED_REDIRECT_URI,
 		tokenStorage,
 		apiBaseUrl: getApiBaseUrl(env)
 	}).client;
 }
 //#endregion
-export { requireComputeAuth };
+export { authenticatedManagementApiClient };

package/dist/{lib/auth → auth}/login.js

@@ -1,11 +1,11 @@
 import { getApiBaseUrl } from "./client.js";
-import { FileTokenStorage } from "../../adapters/token-storage.js";
-import open from "open";
+import { FileTokenStorage } from "./token-storage.js";
 import { AuthError, createManagementApiSdk } from "@prisma/management-api-sdk";
 import events from "node:events";
 import http from "node:http";
 import readline from "node:readline/promises";
-//#region src/lib/auth/login.ts
+import open from "open";
+//#region src/auth/login.ts
 var AuthError$1 = class extends Error {
 	constructor(message) {
 		super(message);
@@ -33,6 +33,7 @@ async function login(options = {}) {
 			apiBaseUrl: options.apiBaseUrl,
 			authBaseUrl: options.authBaseUrl,
 			openUrl: options.openUrl,
+			onVerificationUrl: options.onVerificationUrl,
 			env: options.env,
 			signal: options.signal,
 			output
@@ -78,8 +79,8 @@ async function login(options = {}) {
 					settle(resolve);
 				} catch (error) {
 					res.statusCode = 400;
-					const message = error instanceof Error ? error.message : String(error);
-					res.end(message);
+					res.setHeader("Content-Type", "text/plain; charset=utf-8");
+					res.end("Sign-in could not be completed. Return to your terminal.");
 					settle(() => reject(error));
 					return;
 				}
@@ -174,6 +175,9 @@ var LoginState = class {
 		});
 		this.latestState = state;
 		this.latestVerifier = verifier;
+		try {
+			this.options.onVerificationUrl?.(url);
+		} catch {}
 		this.options.signal?.throwIfAborted();
 		if (interactive) this.printLoginInstructions(url);
 		try {
@@ -242,6 +246,9 @@ function renderSuccessPage(workspaceName) {
       --foreground: #1f2430;
       --muted: #4f5665;
       --mark-color: #050812;
+      --surface: #f6f7fb;
+      --border: #e4e7ee;
+      --success: #15803d;
     }
 
     @media (prefers-color-scheme: dark) {
@@ -250,6 +257,9 @@ function renderSuccessPage(workspaceName) {
         --foreground: #f6f7fb;
         --muted: #c5cad6;
         --mark-color: #ffffff;
+        --surface: #0d1322;
+        --border: #232a3d;
+        --success: #4ade80;
       }
     }
 
@@ -303,6 +313,93 @@ function renderSuccessPage(workspaceName) {
       line-height: 1.55;
       letter-spacing: 0;
     }
+
+    .skills {
+      margin-top: 40px;
+      padding-top: 28px;
+      border-top: 1px solid var(--border);
+      text-align: left;
+    }
+
+    .skills-lead {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      margin: 0 0 12px;
+      font-size: 15px;
+      color: var(--foreground);
+    }
+
+    .skills-lead svg {
+      flex: none;
+      color: var(--muted);
+    }
+
+    .command {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 8px 10px 16px;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+    }
+
+    .command code {
+      flex: 1;
+      overflow-x: auto;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+      font-size: 13.5px;
+      white-space: nowrap;
+    }
+
+    .command .prompt {
+      color: var(--muted);
+      user-select: none;
+    }
+
+    .copy {
+      flex: none;
+      display: grid;
+      place-items: center;
+      padding: 6px;
+      border: 0;
+      border-radius: 6px;
+      background: transparent;
+      color: var(--muted);
+      cursor: pointer;
+    }
+
+    .copy:hover {
+      background: var(--border);
+      color: var(--foreground);
+    }
+
+    .copy .icon-check,
+    .copy.copied .icon-copy {
+      display: none;
+    }
+
+    .copy.copied .icon-check {
+      display: block;
+    }
+
+    .copy.copied,
+    .copy.copied:hover {
+      color: var(--success);
+    }
+
+    .visually-hidden {
+      position: absolute;
+      width: 1px;
+      height: 1px;
+      margin: -1px;
+      padding: 0;
+      overflow: hidden;
+      clip: rect(0 0 0 0);
+      white-space: nowrap;
+      border: 0;
+    }
   </style>
 </head>
 <body>
@@ -310,7 +407,51 @@ function renderSuccessPage(workspaceName) {
   <main>
     <h1>You're all set.</h1>
     <p>${workspaceName ? `Your terminal is now connected to your ${escapeHtml(workspaceName)} workspace. Head back to your terminal to continue.` : "Your terminal is now connected to your Prisma workspace. Head back to your terminal to continue."}</p>
+    <section class="skills">
+      <div class="skills-lead">
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9.937 15.5A2 2 0 0 0 8.5 14.063l-6.135-1.582a.5.5 0 0 1 0-.962L8.5 9.936A2 2 0 0 0 9.937 8.5l1.582-6.135a.5.5 0 0 1 .963 0L14.063 8.5A2 2 0 0 0 15.5 9.937l6.135 1.581a.5.5 0 0 1 0 .964L15.5 14.063a2 2 0 0 0-1.437 1.437l-1.582 6.135a.5.5 0 0 1-.963 0z"/><path d="M20 3v4"/><path d="M22 5h-4"/></svg>
+        Using an AI coding agent? Add the Prisma skills:
+      </div>
+      <div class="command">
+        <code><span class="prompt">$ </span><span class="command-text">npx skills add prisma/skills</span></code>
+        <button class="copy" type="button" aria-label="Copy command to clipboard">
+          <svg class="icon-copy" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/></svg>
+          <svg class="icon-check" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="20 6 9 17 4 12"/></svg>
+        </button>
+      </div>
+      <span class="visually-hidden skills-status" role="status"></span>
+    </section>
   </main>
+  <script>
+    (() => {
+      const command = "npx skills add prisma/skills";
+      const button = document.querySelector(".copy");
+      const status = document.querySelector(".skills-status");
+      let timer;
+      button.addEventListener("click", async () => {
+        try {
+          await navigator.clipboard.writeText(command);
+        } catch {
+          // Clipboard access denied: select the command so Cmd/Ctrl+C works.
+          const range = document.createRange();
+          range.selectNodeContents(document.querySelector(".command-text"));
+          const selection = window.getSelection();
+          selection.removeAllRanges();
+          selection.addRange(range);
+          status.textContent =
+            "Copying failed. The command is selected; press Ctrl+C or Cmd+C to copy it.";
+          return;
+        }
+        button.classList.add("copied");
+        status.textContent = "Command copied to clipboard.";
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+          button.classList.remove("copied");
+          status.textContent = "";
+        }, 2000);
+      });
+    })();
+  <\/script>
 </body>
 </html>`;
 }
@@ -327,4 +468,4 @@ function escapeHtml(value) {
 	});
 }
 //#endregion
-export { login };
+export { AuthError$1 as AuthError, login };

package/dist/{lib/auth/auth-ops.js → auth/operations.js}

@@ -1,9 +1,22 @@
-import { SERVICE_TOKEN_ENV_VAR } from "./client.js";
-import { FileTokenStorage } from "../../adapters/token-storage.js";
-import { requireComputeAuth } from "./guard.js";
-import { login } from "./login.js";
-//#region src/lib/auth/auth-ops.ts
+import { FileTokenStorage } from "./token-storage.js";
+import { authenticatedManagementApiClient } from "./guard.js";
+import { AuthError, login } from "./login.js";
+import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, credentialWorkspaceId } from "@prisma/cli-engine";
+//#region src/auth/operations.ts
 const WORKSPACE_SUB_PREFIX = "workspace:";
+/** Thrown when PRISMA_SERVICE_TOKEN is set to an empty/blank value. */
+var EmptyServiceTokenError = class extends Error {
+	code = "EMPTY_SERVICE_TOKEN";
+	constructor() {
+		super(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
+		this.name = "EmptyServiceTokenError";
+	}
+};
+/** Matches by the code discriminator, not instanceof, so the check
+*  survives duplicate module instances. */
+function isEmptyServiceTokenError(error) {
+	return typeof error === "object" && error !== null && error.code === "EMPTY_SERVICE_TOKEN";
+}
 function decodeJwtPayload(token) {
 	try {
 		const payload = token.split(".")[1];
@@ -24,18 +37,55 @@ function workspaceIdFromClaims(claims) {
 	const id = sub.slice(10).trim();
 	return id.length > 0 ? id : null;
 }
-async function performLogin(env, signal) {
+/** Holds the tokens the SDK writes at callback time and nothing else:
+*  minting and custody stay separate, so a login never writes through
+*  the credential manager. */
+var ThrowawayTokenStorage = class {
+	tokens = null;
+	async getTokens() {
+		return this.tokens;
+	}
+	async setTokens(tokens) {
+		this.tokens = tokens;
+	}
+	async clearTokens() {
+		this.tokens = null;
+	}
+};
+/** Runs the browser consent flow and RETURNS the minted credential.
+*  Storing it is the caller's job. */
+async function performLogin(env, signal, options) {
+	const tokenStorage = new ThrowawayTokenStorage();
 	await login({
-		tokenStorage: new FileTokenStorage(env, signal, { activateOnSetTokens: true }),
+		tokenStorage,
 		env,
-		signal
+		signal,
+		onVerificationUrl: options?.onVerificationUrl
+	});
+	const tokens = tokenStorage.tokens;
+	if (!tokens) throw new AuthError("Sign-in finished without producing a credential.");
+	return {
+		token: tokens.accessToken,
+		refreshToken: tokens.refreshToken,
+		expiresAt: claimedExpiresAt(tokens.accessToken)
+	};
+}
+/** Writes a minted credential into the legacy store, which the legacy
+*  shell still reads. Dies with the legacy shell. */
+async function storeLegacyCredential(env, credential, signal) {
+	const workspaceId = credentialWorkspaceId(credential.token);
+	if (workspaceId === void 0) return;
+	await new FileTokenStorage(env, signal, { activateOnSetTokens: true }).setTokens({
+		workspaceId,
+		accessToken: credential.token,
+		...credential.refreshToken === void 0 ? {} : { refreshToken: credential.refreshToken }
 	});
 }
 async function readAuthState(env, signal) {
 	const rawServiceToken = env[SERVICE_TOKEN_ENV_VAR];
 	if (rawServiceToken !== void 0) {
 		const serviceToken = rawServiceToken.trim();
-		if (serviceToken.length === 0) throw new Error(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
+		if (serviceToken.length === 0) throw new EmptyServiceTokenError();
 		return readServiceTokenAuthState(serviceToken, env, signal);
 	}
 	const tokenStorage = new FileTokenStorage(env, signal);
@@ -47,7 +97,7 @@ async function readAuthState(env, signal) {
 		workspace: null,
 		credential: null
 	};
-	const client = await requireComputeAuth(env, signal);
+	const client = await authenticatedManagementApiClient(env, signal);
 	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
 	if (currentPrincipal) {
 		if (currentPrincipal.authenticated && currentPrincipal.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, currentPrincipal.workspace);
@@ -65,7 +115,7 @@ async function readAuthState(env, signal) {
 	return authState;
 }
 async function readServiceTokenAuthState(token, env, signal) {
-	const client = await requireComputeAuth(env, signal);
+	const client = await authenticatedManagementApiClient(env, signal);
 	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
 	if (currentPrincipal) return currentPrincipal;
 	const claims = decodeJwtPayload(token);
@@ -88,7 +138,7 @@ async function readServiceTokenAuthState(token, env, signal) {
 async function buildAuthState({ workspaceIdFromCredential, claims, env, client, signal }) {
 	let workspaceId = workspaceIdFromCredential;
 	let workspaceName = workspaceIdFromCredential;
-	client ??= await requireComputeAuth(env, signal);
+	client ??= await authenticatedManagementApiClient(env, signal);
 	if (client) try {
 		const { data, response } = await client.GET("/v1/workspaces/{id}", {
 			params: { path: { id: workspaceIdFromCredential } },
@@ -155,4 +205,4 @@ async function performLogout(env, signal) {
 	await new FileTokenStorage(env, signal).clearTokens();
 }
 //#endregion
-export { performLogin, performLogout, readAuthState };
+export { isEmptyServiceTokenError, performLogin, performLogout, readAuthState, storeLegacyCredential };

package/dist/auth/recipient.js

@@ -0,0 +1,42 @@
+import { getApiBaseUrl } from "./client.js";
+import { FileTokenStorage } from "./token-storage.js";
+import { createManagementApiSdk } from "@prisma/management-api-sdk";
+//#region src/auth/recipient.ts
+var RecipientSessionInvalidError = class extends Error {
+	constructor(workspaceRef) {
+		super(`The stored session for workspace "${workspaceRef}" could not be validated.`);
+		this.workspaceRef = workspaceRef;
+		this.name = "RecipientSessionInvalidError";
+	}
+};
+/**
+* Resolve a locally stored OAuth workspace session and return a validated
+* access token for it, refreshing through the SDK when the stored token has
+* expired. The active workspace pointer is never touched.
+*
+* Throws WorkspaceSelectionError when the ref does not match exactly one
+* stored session, and RecipientSessionInvalidError when the session cannot
+* be validated or refreshed.
+*/
+async function resolveRecipientWorkspaceSession(workspaceRef, env = process.env, signal) {
+	const workspace = await new FileTokenStorage(env, signal).resolveWorkspace(workspaceRef);
+	const pinnedStorage = new FileTokenStorage(env, signal, {
+		activateOnSetTokens: false,
+		lockSetTokens: false,
+		pinnedWorkspaceId: workspace.credentialWorkspaceId
+	});
+	if ((await createManagementApiSdk({
+		clientId: "cmm3lndn701oo0uefvxzo0ivw",
+		redirectUri: "http://localhost:0/auth/callback",
+		tokenStorage: pinnedStorage,
+		apiBaseUrl: getApiBaseUrl(env)
+	}).client.GET("/v1/workspaces", { signal })).error) throw new RecipientSessionInvalidError(workspaceRef);
+	const tokens = await pinnedStorage.getTokens();
+	if (!tokens) throw new RecipientSessionInvalidError(workspaceRef);
+	return {
+		workspace,
+		accessToken: tokens.accessToken
+	};
+}
+//#endregion
+export { RecipientSessionInvalidError, resolveRecipientWorkspaceSession };

package/dist/{adapters → auth}/token-storage.js

@@ -1,9 +1,10 @@
-import { getAuthFilePath } from "../lib/auth/client.js";
-import fs from "node:fs/promises";
+import { getAuthFilePath } from "./client.js";
+import { sameWorkspaceId } from "../lib/workspace-id.js";
 import path from "node:path";
+import fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { CredentialsStore } from "@prisma/credentials-store";
-//#region src/adapters/token-storage.ts
+//#region src/auth/token-storage.ts
 const REFRESH_LOCK_RETRY_MS = 100;
 const REFRESH_LOCK_STALE_MS = 3e4;
 const REFRESH_LOCK_WAIT_TIMEOUT_MS = 25e3;
@@ -77,6 +78,7 @@ var FileTokenStorage = class {
 		this.signal?.throwIfAborted();
 		try {
 			const credentials = await this.readCredentialsFromDisk();
+			if (this.options.pinnedWorkspaceId) return findTokensForWorkspace(credentials, this.options.pinnedWorkspaceId);
 			const context = await this.readAuthContext();
 			if (context.state.activeWorkspaceId) return findTokensForWorkspace(credentials, context.state.activeWorkspaceId);
 			const latest = findLatestValidTokens(credentials);
@@ -138,6 +140,9 @@ var FileTokenStorage = class {
 		this.signal?.throwIfAborted();
 		const credentials = await this.readCredentialsFromDisk();
 		const context = await this.ensureMigratedAuthContext(credentials);
+		return this.workspacesFromState(credentials, context);
+	}
+	workspacesFromState(credentials, context) {
 		return credentials.map((credential) => storedCredentialToTokens(credential)).filter((tokens) => tokens !== null).map((tokens) => {
 			const cached = context.state.workspaces[tokens.workspaceId];
 			const id = typeof cached?.id === "string" && cached.id.trim().length > 0 ? cached.id.trim() : tokens.workspaceId;
@@ -159,6 +164,24 @@ var FileTokenStorage = class {
 	async useWorkspace(workspaceRef) {
 		return this.withRefreshLock(() => this.useWorkspaceUnlocked(workspaceRef));
 	}
+	/**
+	* Resolve a workspace ref (id, credential workspace id, or cached name)
+	* against the locally stored sessions without changing the active
+	* workspace. Read-only counterpart of useWorkspace: it reads the auth
+	* context as-is and never runs the legacy-state migration, so it writes
+	* nothing.
+	*/
+	async resolveWorkspace(workspaceRef) {
+		const ref = workspaceRef.trim();
+		if (!ref) throw new WorkspaceSelectionError("missing");
+		this.signal?.throwIfAborted();
+		const credentials = await this.readCredentialsFromDisk();
+		const context = await this.readAuthContext();
+		const matches = this.workspacesFromState(credentials, context).filter((workspace) => workspaceMatchesRef(workspace, ref));
+		if (matches.length === 0) throw new WorkspaceSelectionError("not-found", ref);
+		if (matches.length > 1) throw new WorkspaceSelectionError("ambiguous", ref, matches);
+		return matches[0];
+	}
 	async useWorkspaceUnlocked(workspaceRef) {
 		const ref = workspaceRef.trim();
 		if (!ref) throw new WorkspaceSelectionError("missing");
@@ -327,6 +350,7 @@ var FileTokenStorage = class {
 		await this.writeAuthContext(context.state);
 	}
 	async maybeActivateWorkspaceId(workspaceId) {
+		if (this.options.pinnedWorkspaceId) return;
 		const context = await this.readAuthContext();
 		if (this.options.activateOnSetTokens === false && context.exists && context.state.activeWorkspaceId && context.state.activeWorkspaceId !== workspaceId) return;
 		context.state.activeWorkspaceId = workspaceId;
@@ -406,10 +430,7 @@ var RefreshLockTimeoutError = class extends Error {
 	}
 };
 function workspaceMatchesRef(workspace, ref) {
-	return workspace.credentialWorkspaceId === ref || workspace.id === ref || stripWorkspacePrefix(workspace.credentialWorkspaceId) === stripWorkspacePrefix(ref) || stripWorkspacePrefix(workspace.id) === stripWorkspacePrefix(ref) || workspace.name.toLowerCase() === ref.toLowerCase();
-}
-function stripWorkspacePrefix(value) {
-	return value.startsWith("wksp_") ? value.slice(5) : value;
+	return sameWorkspaceId(workspace.credentialWorkspaceId, ref) || sameWorkspaceId(workspace.id, ref) || workspace.name.toLowerCase() === ref.toLowerCase();
 }
 function workspaceDisplayName(name, credentialWorkspaceId) {
 	return name === credentialWorkspaceId ? UNKNOWN_WORKSPACE_NAME : name;