@prisma/cli 3.0.0-beta.1 → 3.0.0-beta.11

package/dist/controllers/app-env.js

@@ -1,39 +1,38 @@
 import { CliError, authRequiredError, usageError, workspaceRequiredError } from "../shell/errors.js";
+import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
+import { formatScopeLabel, parseKeyValuePositional, resolveEnvScope } from "../lib/app/env-config.js";
+import { readEnvFileAssignments } from "../lib/app/env-file.js";
 import { requireComputeAuth } from "../lib/auth/guard.js";
-import { resolveProjectTarget } from "../lib/project/resolution.js";
+import { readLocalGitBranch } from "../lib/git/local-branch.js";
 import { requireAuthenticatedAuthState } from "./auth.js";
 import { listRealWorkspaceProjects } from "./project.js";
-import { formatScopeLabel, parseKeyValuePositional, resolveEnvScope } from "../lib/app/env-config.js";
+import { apiCallError, findVariableByNaturalKey, toMetadata } from "./app-env-api.js";
+import { runEnvAddFile, runEnvUpdateFile } from "./app-env-file.js";
 //#region src/controllers/app-env.ts
-function defaultRoleScope() {
-	return {
-		kind: "role",
-		role: "production"
-	};
-}
 async function runEnvAdd(context, rawAssignment, flags) {
-	const { key, value } = parseKeyValuePositional(rawAssignment, "add", context.runtime.env);
+	const source = resolveEnvWriteSource(rawAssignment, flags.filePath, "add");
 	const scope = resolveEnvScope(flags, {
 		requireExplicit: true,
 		command: "add"
 	});
-	if (!scope) throw usageError(`prisma-cli project env add requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", [`prisma-cli project env add ${key}=${value} --role production`], "app");
-	const { client, projectId } = await requireClientAndProject(context, flags.projectRef, "project env add");
-	const resolved = await resolveScopeToApi(client, projectId, scope, { createBranchIfMissing: true });
-	if (await findVariableByNaturalKey(client, projectId, key, resolved)) throw new CliError({
+	if (!scope) throw usageError(`prisma-cli project env add requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", ["prisma-cli project env add KEY=value --role production"], "app");
+	const input = await resolveEnvWriteInput(context, source, "add");
+	const { client, projectId, verboseContext } = await requireClientAndProject(context, flags.projectRef, "project env add");
+	const resolved = await resolveScopeToApi(client, projectId, scope, {
+		createBranchIfMissing: true,
+		signal: context.runtime.signal
+	});
+	if (input.kind === "file") return runEnvAddFile(context, client, projectId, resolved, input.filePath, input.assignments, verboseContext);
+	if (await findVariableByNaturalKey(client, projectId, input.key, resolved, context.runtime.signal)) throw new CliError({
 		code: "ENV_VARIABLE_ALREADY_EXISTS",
 		domain: "app",
-		summary: `Variable "${key}" already exists in ${formatScopeLabel(scope)}`,
+		summary: `Variable "${input.key}" already exists in ${formatScopeLabel(scope)}`,
 		why: "A variable with this key already exists in the targeted scope.",
 		fix: "Use `prisma-cli project env update` to change an existing variable's value.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli project env update ${key}=<new-value> ${formatScopeFlag(scope)}`]
+		nextSteps: [`prisma-cli project env update ${input.key}=<new-value> ${formatScopeFlag(scope)}`]
 	});
-	const warnings = scope.kind === "branch" && !await findVariableByNaturalKey(client, projectId, key, {
-		scope: {
-			kind: "role",
-			role: "preview"
-		},
+	const warnings = scope.kind === "branch" && !await findVariableByNaturalKey(client, projectId, input.key, {
 		descriptor: {
 			kind: "role",
 			role: "preview"
@@ -42,19 +41,23 @@ async function runEnvAdd(context, rawAssignment, flags) {
 			class: "preview",
 			branchId: null
 		}
-	}) ? [`Variable "${key}" does not exist in preview. It will only exist on ${formatScopeLabel(scope)}.`] : [];
-	const { data, error, response } = await client.POST("/v1/environment-variables", { body: {
-		projectId,
-		class: resolved.apiTarget.class,
-		...resolved.apiTarget.branchId !== null ? { branchId: resolved.apiTarget.branchId } : {},
-		key,
-		value
-	} });
-	if (error || !data) throw apiCallError(`Failed to add ${key}`, response, error);
+	}, context.runtime.signal) ? [`Variable "${input.key}" does not exist in preview. It will only exist on ${formatScopeLabel(scope)}.`] : [];
+	const { data, error, response } = await client.POST("/v1/environment-variables", {
+		body: {
+			projectId,
+			class: resolved.apiTarget.class,
+			...resolved.apiTarget.branchId !== null ? { branchId: resolved.apiTarget.branchId } : {},
+			key: input.key,
+			value: input.value
+		},
+		signal: context.runtime.signal
+	});
+	if (error || !data) throw apiCallError(`Failed to add ${input.key}`, response, error);
 	return {
 		command: "project.env.add",
 		result: {
 			projectId,
+			verboseContext,
 			scope: resolved.descriptor,
 			variable: toMetadata(data.data, resolved.descriptor)
 		},
@@ -63,33 +66,40 @@ async function runEnvAdd(context, rawAssignment, flags) {
 	};
 }
 async function runEnvUpdate(context, rawAssignment, flags) {
-	const { key, value } = parseKeyValuePositional(rawAssignment, "update", context.runtime.env);
+	const source = resolveEnvWriteSource(rawAssignment, flags.filePath, "update");
 	const scope = resolveEnvScope(flags, {
 		requireExplicit: true,
 		command: "update"
 	});
-	if (!scope) throw usageError(`prisma-cli project env update requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", [`prisma-cli project env update ${key}=${value} --role production`], "app");
-	const { client, projectId } = await requireClientAndProject(context, flags.projectRef, "project env update");
-	const resolved = await resolveScopeToApi(client, projectId, scope, { createBranchIfMissing: false });
-	const existing = await findVariableByNaturalKey(client, projectId, key, resolved);
+	if (!scope) throw usageError(`prisma-cli project env update requires --role or --branch`, "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", ["prisma-cli project env update KEY=value --role production"], "app");
+	const input = await resolveEnvWriteInput(context, source, "update");
+	const { client, projectId, verboseContext } = await requireClientAndProject(context, flags.projectRef, "project env update");
+	const resolved = await resolveScopeToApi(client, projectId, scope, {
+		createBranchIfMissing: false,
+		signal: context.runtime.signal
+	});
+	if (input.kind === "file") return runEnvUpdateFile(context, client, projectId, resolved, input.filePath, input.assignments, verboseContext);
+	const existing = await findVariableByNaturalKey(client, projectId, input.key, resolved, context.runtime.signal);
 	if (!existing) throw new CliError({
 		code: "ENV_VARIABLE_NOT_FOUND",
 		domain: "app",
-		summary: `Variable "${key}" not found in ${formatScopeLabel(scope)}`,
+		summary: `Variable "${input.key}" not found in ${formatScopeLabel(scope)}`,
 		why: "No variable with this key exists in the targeted scope.",
 		fix: "Use `prisma-cli project env add` to create a new variable.",
 		exitCode: 1,
-		nextSteps: [`prisma-cli project env add ${key}=<value> ${formatScopeFlag(scope)}`]
+		nextSteps: [`prisma-cli project env add ${input.key}=<value> ${formatScopeFlag(scope)}`]
 	});
 	const { data, error, response } = await client.PATCH("/v1/environment-variables/{envVarId}", {
 		params: { path: { envVarId: existing.id } },
-		body: { value }
+		body: { value: input.value },
+		signal: context.runtime.signal
 	});
-	if (error || !data) throw apiCallError(`Failed to update value for ${key}`, response, error);
+	if (error || !data) throw apiCallError(`Failed to update value for ${input.key}`, response, error);
 	return {
 		command: "project.env.update",
 		result: {
 			projectId,
+			verboseContext,
 			scope: resolved.descriptor,
 			variable: toMetadata(data.data, resolved.descriptor)
 		},
@@ -97,23 +107,58 @@ async function runEnvUpdate(context, rawAssignment, flags) {
 		nextSteps: []
 	};
 }
+function resolveEnvWriteSource(rawAssignment, filePath, command) {
+	if (filePath !== void 0 && rawAssignment !== void 0) throw usageError(`prisma-cli project env ${command} accepts either KEY=VALUE or --file`, "The command received both a positional assignment and a dotenv file path.", "Pass one input source.", [`prisma-cli project env ${command} KEY=value --role preview`, `prisma-cli project env ${command} --file .env --role preview`], "app");
+	if (filePath !== void 0) {
+		if (filePath.length === 0) throw usageError(`prisma-cli project env ${command} --file requires a path`, "The --file flag was passed without a file path.", "Pass a readable dotenv file path.", [`prisma-cli project env ${command} --file .env --role preview`], "app");
+		return {
+			kind: "file",
+			filePath
+		};
+	}
+	if (rawAssignment === void 0) throw usageError(`prisma-cli project env ${command} requires KEY=VALUE or --file`, "No environment variable input was supplied.", "Pass a single KEY=VALUE assignment or a dotenv file path.", [`prisma-cli project env ${command} KEY=value --role preview`, `prisma-cli project env ${command} --file .env --role preview`], "app");
+	return {
+		kind: "single",
+		rawAssignment
+	};
+}
+async function resolveEnvWriteInput(context, source, command) {
+	if (source.kind === "file") return {
+		kind: "file",
+		filePath: source.filePath,
+		assignments: await readEnvFileAssignments(context.runtime.cwd, source.filePath, command)
+	};
+	return {
+		kind: "single",
+		...parseKeyValuePositional(source.rawAssignment, command, context.runtime.env)
+	};
+}
 async function runEnvList(context, flags) {
-	const scope = resolveEnvScope(flags, {
+	const explicit = resolveEnvScope(flags, {
 		requireExplicit: false,
 		command: "list"
-	}) ?? defaultRoleScope();
-	const { client, projectId } = await requireClientAndProject(context, flags.projectRef, "project env list");
-	const resolved = await resolveScopeToApi(client, projectId, scope, { createBranchIfMissing: false });
-	const variables = await listVariables(client, projectId, resolved);
+	});
+	const { client, projectId, verboseContext } = await requireClientAndProject(context, flags.projectRef, "project env list");
+	const resolved = await resolveListScopeToApi(client, projectId, explicit ?? void 0, {
+		cwd: context.runtime.cwd,
+		signal: context.runtime.signal
+	});
+	const variables = resolved.kind === "scoped" ? await listVariables(client, projectId, {
+		scope: resolved.addScope,
+		descriptor: resolved.descriptor,
+		apiTarget: resolved.apiTarget
+	}, context.runtime.signal) : await listOverviewVariables(client, projectId, context.runtime.signal);
 	return {
 		command: "project.env.list",
 		result: {
 			projectId,
+			verboseContext,
 			scope: resolved.descriptor,
+			target: resolved.target,
 			variables: variables.map((row) => toMetadata(row, resolved.descriptor))
 		},
 		warnings: [],
-		nextSteps: variables.length === 0 ? [`prisma-cli project env add KEY=value ${formatScopeFlag(scope)}`] : []
+		nextSteps: variables.length === 0 ? [`prisma-cli project env add KEY=value ${formatScopeFlag(resolved.addScope)}`] : []
 	};
 }
 async function runEnvRemove(context, key, flags) {
@@ -123,9 +168,12 @@ async function runEnvRemove(context, key, flags) {
 		command: "remove"
 	});
 	if (!scope) throw usageError("prisma-cli project env remove requires --role or --branch", "Writing without an explicit scope is rejected.", "Pass --role production, --role preview, or --branch <git-name>.", [`prisma-cli project env remove ${key} --role production`], "app");
-	const { client, projectId } = await requireClientAndProject(context, flags.projectRef, "project env remove");
-	const resolved = await resolveScopeToApi(client, projectId, scope, { createBranchIfMissing: false });
-	const existing = await findVariableByNaturalKey(client, projectId, key, resolved);
+	const { client, projectId, verboseContext } = await requireClientAndProject(context, flags.projectRef, "project env remove");
+	const resolved = await resolveScopeToApi(client, projectId, scope, {
+		createBranchIfMissing: false,
+		signal: context.runtime.signal
+	});
+	const existing = await findVariableByNaturalKey(client, projectId, key, resolved, context.runtime.signal);
 	if (!existing) throw new CliError({
 		code: "ENV_VARIABLE_NOT_FOUND",
 		domain: "app",
@@ -135,12 +183,16 @@ async function runEnvRemove(context, key, flags) {
 		exitCode: 1,
 		nextSteps: [`prisma-cli project env list ${formatScopeFlag(scope)}`]
 	});
-	const { error, response } = await client.DELETE("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: existing.id } } });
+	const { error, response } = await client.DELETE("/v1/environment-variables/{envVarId}", {
+		params: { path: { envVarId: existing.id } },
+		signal: context.runtime.signal
+	});
 	if (error) throw apiCallError(`Failed to remove ${key}`, response, error);
 	return {
 		command: "project.env.remove",
 		result: {
 			projectId,
+			verboseContext,
 			scope: resolved.descriptor,
 			key
 		},
@@ -150,18 +202,27 @@ async function runEnvRemove(context, key, flags) {
 }
 async function requireClientAndProject(context, explicitProject, commandName) {
 	const authState = await requireAuthenticatedAuthState(context);
-	const client = await requireComputeAuth(context.runtime.env);
+	const client = await requireComputeAuth(context.runtime.env, context.runtime.signal);
 	if (!client) throw authRequiredError(["prisma-cli auth login"]);
-	if (!authState.workspace) throw workspaceRequiredError();
+	const workspace = authState.workspace;
+	if (!workspace) throw workspaceRequiredError();
+	const targetResult = await resolveProjectTarget({
+		context,
+		workspace,
+		explicitProject,
+		listProjects: () => listRealWorkspaceProjects(client, workspace, context.runtime.signal),
+		commandName
+	});
+	if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
+	const target = targetResult.value;
 	return {
 		client,
-		projectId: (await resolveProjectTarget({
-			context,
-			workspace: authState.workspace,
-			explicitProject,
-			listProjects: () => listRealWorkspaceProjects(client, authState.workspace),
-			commandName
-		})).project.id
+		projectId: target.project.id,
+		verboseContext: {
+			workspace,
+			project: target.project,
+			resolution: target.resolution
+		}
 	};
 }
 async function resolveScopeToApi(client, projectId, scope, options) {
@@ -176,13 +237,13 @@ async function resolveScopeToApi(client, projectId, scope, options) {
 			branchId: null
 		}
 	};
-	const branch = options.createBranchIfMissing ? await resolveOrCreateBranch(client, projectId, scope.branchName) : await resolveExistingBranch(client, projectId, scope.branchName);
-	if (branch.isDefault) throw new CliError({
+	const branch = options.createBranchIfMissing ? await resolveOrCreateBranch(client, projectId, scope.branchName, options.signal) : await resolveExistingBranch(client, projectId, scope.branchName, options.signal);
+	if (branch.role === "production") throw new CliError({
 		code: "ENV_BRANCH_SCOPE_IS_PRODUCTION",
 		domain: "app",
-		summary: `Branch "${scope.branchName}" is the default branch`,
+		summary: `Branch "${scope.branchName}" is the production branch`,
 		why: "Production variables are project-level only; branch overrides apply to preview branches.",
-		fix: "Use --role production for the default branch.",
+		fix: "Use --role production for the production branch.",
 		exitCode: 1,
 		nextSteps: ["prisma-cli project env list --role production"]
 	});
@@ -199,20 +260,140 @@ async function resolveScopeToApi(client, projectId, scope, options) {
 		}
 	};
 }
+async function resolveListScopeToApi(client, projectId, explicit, options) {
+	if (explicit) {
+		const resolved = await resolveScopeToApi(client, projectId, explicit, {
+			createBranchIfMissing: false,
+			signal: options.signal
+		});
+		return {
+			kind: "scoped",
+			descriptor: resolved.descriptor,
+			target: targetFromExplicitScope(resolved.descriptor),
+			apiTarget: resolved.apiTarget,
+			addScope: resolved.scope
+		};
+	}
+	const gitBranch = await readLocalGitBranch(options.cwd, options.signal);
+	if (gitBranch) {
+		const branch = (await listBranchesByName(client, projectId, gitBranch, options.signal))[0];
+		if (!branch) return {
+			kind: "scoped",
+			descriptor: {
+				kind: "role",
+				role: "preview"
+			},
+			target: {
+				source: "local-git",
+				branchName: gitBranch,
+				branchExists: false,
+				envMap: "preview"
+			},
+			apiTarget: {
+				class: "preview",
+				branchId: null
+			},
+			addScope: {
+				kind: "branch",
+				branchName: gitBranch
+			}
+		};
+		if (branch.role === "production") return {
+			kind: "scoped",
+			descriptor: {
+				kind: "role",
+				role: "production"
+			},
+			target: {
+				source: "local-git",
+				branchName: branch.gitName,
+				branchId: branch.id,
+				branchRole: branch.role,
+				branchExists: true,
+				envMap: "production"
+			},
+			apiTarget: {
+				class: "production",
+				branchId: null
+			},
+			addScope: {
+				kind: "role",
+				role: "production"
+			}
+		};
+		return {
+			kind: "scoped",
+			descriptor: {
+				kind: "branch",
+				branchName: branch.gitName,
+				branchId: branch.id
+			},
+			target: {
+				source: "local-git",
+				branchName: branch.gitName,
+				branchId: branch.id,
+				branchRole: branch.role,
+				branchExists: true,
+				envMap: "preview"
+			},
+			apiTarget: {
+				class: "preview",
+				branchId: branch.id
+			},
+			addScope: {
+				kind: "branch",
+				branchName: branch.gitName
+			}
+		};
+	}
+	return {
+		kind: "overview",
+		descriptor: { kind: "overview" },
+		target: {
+			source: "overview",
+			envMap: "overview"
+		},
+		addScope: {
+			kind: "role",
+			role: "preview"
+		}
+	};
+}
+function targetFromExplicitScope(scope) {
+	if (scope.kind === "branch") return {
+		source: "explicit",
+		branchName: scope.branchName,
+		branchId: scope.branchId,
+		branchRole: "preview",
+		branchExists: true,
+		envMap: "preview"
+	};
+	if (scope.kind === "role") return {
+		source: "explicit",
+		envMap: scope.role
+	};
+	return {
+		source: "overview",
+		envMap: "overview"
+	};
+}
 function formatScopeFlag(scope) {
 	if (scope.kind === "role") return `--role ${scope.role}`;
 	return `--branch ${scope.branchName}`;
 }
-async function listBranchesByName(client, projectId, branchName) {
-	const { data, error, response } = await client.GET("/v1/projects/{projectId}/branches", { params: {
-		path: { projectId },
-		query: { gitName: branchName }
-	} });
+async function listBranchesByName(client, projectId, branchName, signal) {
+	const { data, error, response } = await client.GET("/v1/projects/{projectId}/branches", {
+		params: {
+			path: { projectId },
+			query: { gitName: branchName }
+		},
+		signal
+	});
 	if (error || !data) throw apiCallError(`Failed to resolve branch "${branchName}"`, response, error);
 	return data.data;
 }
-async function resolveExistingBranch(client, projectId, branchName) {
-	const branch = (await listBranchesByName(client, projectId, branchName))[0];
+async function resolveExistingBranch(client, projectId, branchName, signal) {
+	const branch = (await listBranchesByName(client, projectId, branchName, signal))[0];
 	if (!branch) throw new CliError({
 		code: "ENV_BRANCH_NOT_FOUND",
 		domain: "app",
@@ -224,10 +405,10 @@ async function resolveExistingBranch(client, projectId, branchName) {
 	});
 	return branch;
 }
-async function resolveOrCreateBranch(client, projectId, branchName) {
-	const existing = (await listBranchesByName(client, projectId, branchName))[0];
+async function resolveOrCreateBranch(client, projectId, branchName, signal) {
+	const existing = (await listBranchesByName(client, projectId, branchName, signal))[0];
 	if (existing) return existing;
-	if (!await projectHasDefaultBranch(client, projectId)) throw new CliError({
+	if (!await projectHasDefaultBranch(client, projectId, signal)) throw new CliError({
 		code: "ENV_BRANCH_CREATE_REQUIRES_DEFAULT_BRANCH",
 		domain: "app",
 		summary: `Cannot create branch "${branchName}" from project env`,
@@ -241,67 +422,75 @@ async function resolveOrCreateBranch(client, projectId, branchName) {
 		body: {
 			gitName: branchName,
 			isDefault: false
-		}
+		},
+		signal
 	});
 	if (error || !data) {
 		if (response?.status === 409) {
-			const raced = (await listBranchesByName(client, projectId, branchName))[0];
+			const raced = (await listBranchesByName(client, projectId, branchName, signal))[0];
 			if (raced) return raced;
 		}
 		throw apiCallError(`Failed to create branch "${branchName}"`, response, error);
 	}
 	return data.data;
 }
-async function projectHasDefaultBranch(client, projectId) {
+async function projectHasDefaultBranch(client, projectId, signal) {
 	let cursor;
 	while (true) {
 		const query = {};
 		if (cursor !== void 0) query.cursor = cursor;
-		const result = await client.GET("/v1/projects/{projectId}/branches", { params: {
-			path: { projectId },
-			query
-		} });
+		const result = await client.GET("/v1/projects/{projectId}/branches", {
+			params: {
+				path: { projectId },
+				query
+			},
+			signal
+		});
 		if (result.error || !result.data) throw apiCallError("Failed to check project default branch", result.response, result.error);
 		if (result.data.data.some((branch) => branch.isDefault)) return true;
 		if (!result.data.pagination.hasMore || !result.data.pagination.nextCursor) return false;
 		cursor = result.data.pagination.nextCursor;
 	}
 }
-async function findVariableByNaturalKey(client, projectId, key, resolved) {
-	const { data, error, response } = await client.GET("/v1/environment-variables", { params: { query: {
-		projectId,
-		class: resolved.apiTarget.class,
-		key
-	} } });
-	if (error || !data) throw apiCallError(`Failed to look up ${key}`, response, error);
-	return data.data.filter((row) => rowMatchesExactScope(row, resolved))[0] ?? null;
+async function listVariables(client, projectId, resolved, signal) {
+	return materializeEffectiveRows(await collectEnvironmentVariables(client, projectId, signal, {
+		className: resolved.apiTarget.class,
+		filter: (row) => rowMatchesScope(row, resolved)
+	}), resolved);
+}
+async function listOverviewVariables(client, projectId, signal) {
+	return (await collectEnvironmentVariables(client, projectId, signal, { filter: (row) => row.branchId === null && (row.class === "production" || row.class === "preview") })).sort((left, right) => {
+		const roleOrder = roleSortOrder(left.class) - roleSortOrder(right.class);
+		return roleOrder !== 0 ? roleOrder : left.key.localeCompare(right.key);
+	});
 }
-async function listVariables(client, projectId, resolved) {
+async function collectEnvironmentVariables(client, projectId, signal, options) {
 	const collected = [];
 	let cursor;
 	while (true) {
-		const query = {
-			projectId,
-			class: resolved.apiTarget.class
-		};
+		const query = { projectId };
+		if (options.className !== void 0) query.class = options.className;
 		if (cursor !== void 0) query.cursor = cursor;
-		const result = await client.GET("/v1/environment-variables", { params: { query } });
+		const result = await client.GET("/v1/environment-variables", {
+			params: { query },
+			signal
+		});
 		if (result.error || !result.data) throw apiCallError(`Failed to list environment variables`, result.response, result.error);
-		const page = result.data.data.filter((row) => rowMatchesScope(row, resolved));
+		const page = result.data.data.filter(options.filter);
 		collected.push(...page);
 		if (!result.data.pagination.hasMore || !result.data.pagination.nextCursor) break;
 		cursor = result.data.pagination.nextCursor;
 	}
-	return materializeEffectiveRows(collected, resolved);
+	return collected;
+}
+function roleSortOrder(role) {
+	return role === "production" ? 0 : 1;
 }
 function rowMatchesScope(row, resolved) {
 	if (row.class !== resolved.apiTarget.class) return false;
 	if (resolved.apiTarget.branchId === null) return row.branchId === null;
 	return row.branchId === null || row.branchId === resolved.apiTarget.branchId;
 }
-function rowMatchesExactScope(row, resolved) {
-	return row.class === resolved.apiTarget.class && row.branchId === resolved.apiTarget.branchId;
-}
 function materializeEffectiveRows(rows, resolved) {
 	if (resolved.apiTarget.branchId === null) return rows;
 	const byKey = /* @__PURE__ */ new Map();
@@ -309,39 +498,5 @@ function materializeEffectiveRows(rows, resolved) {
 	for (const row of rows) if (row.branchId === resolved.apiTarget.branchId) byKey.set(row.key, row);
 	return [...byKey.values()].sort((left, right) => left.key.localeCompare(right.key));
 }
-function toMetadata(row, requestedScope) {
-	const rowScope = row.branchId === null ? {
-		kind: "role",
-		role: row.class
-	} : requestedScope;
-	return {
-		id: row.id,
-		key: row.key,
-		scope: rowScope,
-		source: formatDescriptorLabel(rowScope),
-		isManagedBySystem: row.isManagedBySystem,
-		updatedAt: row.updatedAt
-	};
-}
-function formatDescriptorLabel(scope) {
-	if (scope.kind === "role") return scope.role ?? "unknown";
-	return `branch:${scope.branchName ?? scope.branchId ?? "unknown"}`;
-}
-function apiCallError(summary, response, error) {
-	const status = response?.status ?? 0;
-	const apiCode = error?.error?.code;
-	const apiMessage = error?.error?.message;
-	const apiHint = error?.error?.hint;
-	if (status === 401 || status === 403) return authRequiredError(["prisma auth login"]);
-	return new CliError({
-		code: apiCode ?? "ENV_API_ERROR",
-		domain: "app",
-		summary,
-		why: apiMessage ?? `The Management API returned status ${status || "unknown"}.`,
-		fix: apiHint ?? "Re-run with --trace for the underlying API response details.",
-		exitCode: 1,
-		nextSteps: []
-	});
-}
 //#endregion
 export { runEnvAdd, runEnvList, runEnvRemove, runEnvUpdate };