@prisma/cli 3.0.0-dev.112.1 → 3.0.0-dev.115.1

package/dist/controllers/project.js

@@ -1,9 +1,12 @@
+import { resolvePrismaCliPackageCommandFormatterSync } from "../lib/agent/cli-command.js";
 import { formatCommandArgument } from "../shell/command-arguments.js";
-import { CliError, authRequiredError, featureUnavailableError, usageError, workspaceRequiredError } from "../shell/errors.js";
+import { CliError, authRequiredError, featureUnavailableError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceRequiredError } from "../shell/errors.js";
 import { renderSummaryLine } from "../shell/ui.js";
 import { canPrompt } from "../shell/runtime.js";
+import { SERVICE_TOKEN_ENV_VAR } from "../lib/auth/client.js";
+import { WorkspaceSelectionError } from "../adapters/token-storage.js";
 import { createAppProvider } from "../lib/app/app-provider.js";
-import { readLocalResolutionPin } from "../lib/project/local-pin.js";
+import { LOCAL_RESOLUTION_PIN_RELATIVE_PATH, readLocalResolutionPin, writeLocalResolutionPin } from "../lib/project/local-pin.js";
 import { buildProjectSetupNextActions, inferTargetName, inspectProjectBinding, projectResolutionErrorToCliError, resolveProjectTarget, sortProjects } from "../lib/project/resolution.js";
 import { bindProjectToDirectory, isValidProjectSetupName, projectCreateFailedError, projectDirectoryBindingErrorToCliError, projectSetupNameRequiredError, resolveProjectForSetup, toProjectSummary } from "../lib/project/setup.js";
 import { requireComputeAuth } from "../lib/auth/guard.js";
@@ -11,7 +14,11 @@ import { promptForProjectSetupChoice } from "../lib/project/interactive-setup.js
 import { createCliUseCaseGateways } from "../use-cases/create-cli-gateways.js";
 import { requireAuthenticatedAuthState } from "./auth.js";
 import { parseGitHubRepositoryUrl, readGitOriginRemote } from "../adapters/git.js";
+import { RecipientSessionInvalidError, resolveRecipientWorkspaceSession } from "../lib/auth/recipient.js";
+import { createManagementProjectProvider, projectRemoveBlockedError, projectRenameFailedError, projectTransferRejectedError } from "../lib/project/provider.js";
 import { createProjectUseCases } from "../use-cases/project.js";
+import path from "node:path";
+import { unlink } from "node:fs/promises";
 import { matchError } from "better-result";
 import open from "open";
 //#region src/controllers/project.ts
@@ -217,6 +224,322 @@ async function projectLinkTargetRequiredError(context, projects) {
 		})
 	});
 }
+async function runProjectRename(context, newName, options) {
+	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
+	if (!workspace) throw workspaceRequiredError();
+	const name = newName.trim();
+	if (!isValidProjectSetupName(name)) throw projectSetupNameRequiredError("project rename");
+	const { provider, target } = await requireProjectCommandContext(context, workspace, options.project, "project rename");
+	const previousName = target.project.name;
+	return {
+		command: "project.rename",
+		result: {
+			workspace,
+			project: await provider.renameProject({
+				projectId: target.project.id,
+				name,
+				signal: context.runtime.signal
+			}),
+			previousName
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runProjectRemove(context, projectRef, options) {
+	const formatCommand = resolvePrismaCliPackageCommandFormatterSync(context.runtime.cwd);
+	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
+	if (!workspace) throw workspaceRequiredError();
+	const { provider, projects } = await requireProjectMutationContext(context, workspace);
+	const project = toProjectSummary(resolveProjectForSetup(projectRef.trim(), projects, workspace));
+	requireProjectExactConfirmation({
+		id: project.id,
+		confirm: options.confirm,
+		summary: "Confirm project removal",
+		why: "Removing a project is permanent, deletes its databases, and stops its apps, so it requires the exact project id.",
+		nextStep: formatCommand([
+			"project",
+			"remove",
+			project.id,
+			"--confirm",
+			project.id
+		])
+	});
+	await provider.removeProject({
+		projectId: project.id,
+		signal: context.runtime.signal
+	});
+	const warnings = [];
+	return {
+		command: "project.remove",
+		result: {
+			workspace,
+			project,
+			localPin: { cleared: await cleanupLocalPinForProject(context, project.id, { onError: (message) => warnings.push(message) }) }
+		},
+		warnings,
+		nextSteps: []
+	};
+}
+async function runProjectTransfer(context, projectRef, options) {
+	const formatCommand = resolvePrismaCliPackageCommandFormatterSync(context.runtime.cwd);
+	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
+	if (!workspace) throw workspaceRequiredError();
+	if (options.toWorkspace && options.recipientToken) throw usageError("Choose one transfer recipient source", "--to-workspace and --recipient-token are mutually exclusive.", "Pass either --to-workspace <id-or-name> or --recipient-token <token>.", [formatCommand([
+		"project",
+		"transfer",
+		"<project>",
+		"--to-workspace",
+		"<id-or-name>",
+		"--confirm",
+		"<project-id>"
+	])], "project");
+	if (!options.toWorkspace?.trim() && !options.recipientToken?.trim()) throw transferRecipientRequiredError(formatCommand);
+	const { provider, projects } = await requireProjectMutationContext(context, workspace);
+	const project = toProjectSummary(resolveProjectForSetup(projectRef.trim(), projects, workspace));
+	requireProjectExactConfirmation({
+		id: project.id,
+		confirm: options.confirm,
+		summary: "Confirm project transfer",
+		why: "Transferring moves the project to another workspace and this workspace loses access, so it requires the exact project id.",
+		nextStep: `${formatCommand([
+			"project",
+			"transfer",
+			project.id
+		])} ${options.toWorkspace ? `--to-workspace ${formatCommandArgument(options.toWorkspace)}` : "--recipient-token <token>"} --confirm ${project.id}`
+	});
+	const recipient = await resolveTransferRecipient(context, options);
+	await provider.transferProject({
+		projectId: project.id,
+		recipientAccessToken: recipient.accessToken,
+		signal: context.runtime.signal
+	});
+	const warnings = [];
+	const pinAction = await rewriteOrClearLocalPinForProject(context, project.id, recipient.workspaceId, { onError: (message) => warnings.push(message) });
+	return {
+		command: "project.transfer",
+		result: {
+			workspace,
+			project,
+			recipient: {
+				workspaceId: recipient.workspaceId,
+				workspaceName: recipient.workspaceName,
+				source: recipient.source
+			},
+			localPin: { action: pinAction }
+		},
+		warnings,
+		nextSteps: options.toWorkspace ? [`${formatCommand([
+			"auth",
+			"workspace",
+			"use"
+		])} ${formatCommandArgument(options.toWorkspace)}`] : []
+	};
+}
+async function resolveTransferRecipient(context, options) {
+	const formatCommand = resolvePrismaCliPackageCommandFormatterSync(context.runtime.cwd);
+	const recipientToken = options.recipientToken?.trim();
+	if (recipientToken) return {
+		accessToken: recipientToken,
+		workspaceId: isRealMode(context) ? null : recipientToken,
+		workspaceName: null,
+		source: "recipient-token"
+	};
+	const workspaceRef = options.toWorkspace?.trim();
+	if (!workspaceRef) throw transferRecipientRequiredError(formatCommand);
+	if (!isRealMode(context)) {
+		const matches = context.api.listWorkspaces().filter((candidate) => candidate.id === workspaceRef || candidate.name.toLowerCase() === workspaceRef.toLowerCase());
+		if (matches.length === 0) throw workspaceNotAuthenticatedError(workspaceRef);
+		if (matches.length > 1) throw workspaceAmbiguousError(workspaceRef, matches.map((match) => ({
+			id: match.id,
+			name: match.name,
+			credentialWorkspaceId: match.id
+		})));
+		return {
+			accessToken: matches[0].id,
+			workspaceId: matches[0].id,
+			workspaceName: matches[0].name,
+			source: "workspace-session"
+		};
+	}
+	if (context.runtime.env["PRISMA_SERVICE_TOKEN"] !== void 0) throw transferRecipientUnavailableError(formatCommand);
+	try {
+		const session = await resolveRecipientWorkspaceSession(workspaceRef, context.runtime.env, context.runtime.signal);
+		return {
+			accessToken: session.accessToken,
+			workspaceId: session.workspace.id,
+			workspaceName: session.workspace.name,
+			source: "workspace-session"
+		};
+	} catch (error) {
+		if (error instanceof WorkspaceSelectionError) {
+			if (error.reason === "ambiguous") throw workspaceAmbiguousError(error.workspaceRef ?? workspaceRef, error.matches.map((match) => ({
+				id: match.id,
+				name: match.name,
+				credentialWorkspaceId: match.credentialWorkspaceId
+			})));
+			throw workspaceNotAuthenticatedError(error.workspaceRef ?? workspaceRef);
+		}
+		if (error instanceof RecipientSessionInvalidError) throw workspaceNotAuthenticatedError(error.workspaceRef);
+		throw error;
+	}
+}
+async function requireProjectMutationContext(context, workspace) {
+	if (isRealMode(context)) {
+		const client = await requireProjectClient(context);
+		return {
+			provider: createManagementProjectProvider(client),
+			projects: await listRealWorkspaceProjects(client, workspace, context.runtime.signal)
+		};
+	}
+	return {
+		provider: createFixtureProjectProvider(context),
+		projects: listFixtureWorkspaceProjects(context, workspace)
+	};
+}
+async function requireProjectCommandContext(context, workspace, explicitProject, commandName) {
+	const client = isRealMode(context) ? await requireProjectClient(context) : null;
+	const listProjects = async () => client ? listRealWorkspaceProjects(client, workspace, context.runtime.signal) : listFixtureWorkspaceProjects(context, workspace);
+	const targetResult = await resolveProjectTarget({
+		context,
+		workspace,
+		explicitProject,
+		listProjects,
+		commandName
+	});
+	if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
+	return {
+		provider: client ? createManagementProjectProvider(client) : createFixtureProjectProvider(context),
+		target: targetResult.value
+	};
+}
+async function requireProjectClient(context) {
+	const client = await requireComputeAuth(context.runtime.env, context.runtime.signal);
+	if (!client) throw authRequiredError();
+	return client;
+}
+function createFixtureProjectProvider(context) {
+	const fixtureFormatCommand = resolvePrismaCliPackageCommandFormatterSync(context.runtime.cwd);
+	return {
+		async renameProject(options) {
+			const renamed = context.api.renameProject(options.projectId, options.name);
+			if (!renamed) throw projectRenameFailedError(options.name, void 0);
+			return {
+				id: renamed.id,
+				name: renamed.name,
+				...renamed.url ? { url: renamed.url } : {}
+			};
+		},
+		async removeProject(options) {
+			const removed = context.api.removeProject(options.projectId);
+			if (removed.outcome === "blocked") throw projectRemoveBlockedError(options.projectId, void 0);
+			if (removed.outcome === "not-found") throw new CliError({
+				code: "PROJECT_NOT_FOUND",
+				domain: "project",
+				summary: "Project not found",
+				why: `No project matched "${options.projectId}".`,
+				fix: `Pass a project id or name from ${fixtureFormatCommand(["project", "list"])}.`,
+				exitCode: 1,
+				nextSteps: [fixtureFormatCommand(["project", "list"])]
+			});
+		},
+		async transferProject(options) {
+			if (context.api.transferProject(options.projectId, options.recipientAccessToken).outcome !== "transferred") throw projectTransferRejectedError(options.projectId, void 0);
+		}
+	};
+}
+function requireProjectExactConfirmation(options) {
+	if (options.confirm === options.id) return;
+	throw new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "project",
+		summary: options.summary,
+		why: options.why,
+		fix: `Rerun with --confirm ${options.id}.`,
+		exitCode: 2,
+		nextSteps: [options.nextStep],
+		meta: {
+			expectedConfirm: options.id,
+			receivedConfirm: options.confirm ?? null
+		}
+	});
+}
+function transferRecipientRequiredError(formatCommand) {
+	return new CliError({
+		code: "TRANSFER_RECIPIENT_REQUIRED",
+		domain: "project",
+		summary: "Transfer recipient required",
+		why: "Project transfer needs the receiving workspace.",
+		fix: "Pass --to-workspace <id-or-name> for a locally authenticated workspace, or --recipient-token <token> for a cross-account transfer.",
+		exitCode: 2,
+		nextSteps: [formatCommand([
+			"auth",
+			"workspace",
+			"list"
+		]), formatCommand([
+			"project",
+			"transfer",
+			"<project>",
+			"--to-workspace",
+			"<id-or-name>",
+			"--confirm",
+			"<project-id>"
+		])]
+	});
+}
+function transferRecipientUnavailableError(formatCommand) {
+	return new CliError({
+		code: "TRANSFER_RECIPIENT_UNAVAILABLE",
+		domain: "project",
+		summary: "Local workspace sessions are unavailable",
+		why: `--to-workspace resolves locally stored OAuth sessions, but ${SERVICE_TOKEN_ENV_VAR} is set and service-token mode does not read them.`,
+		fix: "Pass --recipient-token <token> with an access token for the receiving workspace, or unset the service token.",
+		exitCode: 1,
+		nextSteps: [formatCommand([
+			"project",
+			"transfer",
+			"<project>",
+			"--recipient-token",
+			"<token>",
+			"--confirm",
+			"<project-id>"
+		])]
+	});
+}
+async function cleanupLocalPinForProject(context, projectId, hooks) {
+	const pinResult = await readLocalResolutionPin(context.runtime.cwd, context.runtime.signal);
+	if (pinResult.isErr()) return false;
+	const pin = pinResult.value;
+	if (pin.kind !== "present" || pin.pin.projectId !== projectId) return false;
+	try {
+		await unlink(path.join(context.runtime.cwd, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
+		return true;
+	} catch {
+		hooks.onError(`The local pin ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} points at the removed project but could not be deleted.`);
+		return false;
+	}
+}
+async function rewriteOrClearLocalPinForProject(context, projectId, recipientWorkspaceId, hooks) {
+	const pinResult = await readLocalResolutionPin(context.runtime.cwd, context.runtime.signal);
+	if (pinResult.isErr()) return "none";
+	const pin = pinResult.value;
+	if (pin.kind !== "present" || pin.pin.projectId !== projectId) return "none";
+	if (recipientWorkspaceId) {
+		if ((await writeLocalResolutionPin(context.runtime.cwd, {
+			workspaceId: recipientWorkspaceId,
+			projectId
+		}, context.runtime.signal)).isOk()) return "rewritten";
+		hooks.onError(`The local pin ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} points at the transferred project but could not be rewritten.`);
+		return "none";
+	}
+	try {
+		await unlink(path.join(context.runtime.cwd, LOCAL_RESOLUTION_PIN_RELATIVE_PATH));
+		return "cleared";
+	} catch {
+		hooks.onError(`The local pin ${LOCAL_RESOLUTION_PIN_RELATIVE_PATH} points at the transferred project but could not be cleared.`);
+		return "none";
+	}
+}
 async function runGitConnect(context, gitUrl, options = {}) {
 	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
 	if (!workspace) throw workspaceRequiredError();
@@ -728,4 +1051,4 @@ function repoConnectionFixForStatus(status) {
 	return "Re-run with --trace for the underlying API response details.";
 }
 //#endregion
-export { listFixtureWorkspaceProjects, listRealWorkspaceProjects, runGitConnect, runGitDisconnect, runProjectCreate, runProjectLink, runProjectList, runProjectShow };
+export { listFixtureWorkspaceProjects, listRealWorkspaceProjects, runGitConnect, runGitDisconnect, runProjectCreate, runProjectLink, runProjectList, runProjectRemove, runProjectRename, runProjectShow, runProjectTransfer };

package/dist/lib/auth/recipient.js

@@ -0,0 +1,42 @@
+import { getApiBaseUrl } from "./client.js";
+import { FileTokenStorage } from "../../adapters/token-storage.js";
+import { createManagementApiSdk } from "@prisma/management-api-sdk";
+//#region src/lib/auth/recipient.ts
+var RecipientSessionInvalidError = class extends Error {
+	constructor(workspaceRef) {
+		super(`The stored session for workspace "${workspaceRef}" could not be validated.`);
+		this.workspaceRef = workspaceRef;
+		this.name = "RecipientSessionInvalidError";
+	}
+};
+/**
+* Resolve a locally stored OAuth workspace session and return a validated
+* access token for it, refreshing through the SDK when the stored token has
+* expired. The active workspace pointer is never touched.
+*
+* Throws WorkspaceSelectionError when the ref does not match exactly one
+* stored session, and RecipientSessionInvalidError when the session cannot
+* be validated or refreshed.
+*/
+async function resolveRecipientWorkspaceSession(workspaceRef, env = process.env, signal) {
+	const workspace = await new FileTokenStorage(env, signal).resolveWorkspace(workspaceRef);
+	const pinnedStorage = new FileTokenStorage(env, signal, {
+		activateOnSetTokens: false,
+		lockSetTokens: false,
+		pinnedWorkspaceId: workspace.credentialWorkspaceId
+	});
+	if ((await createManagementApiSdk({
+		clientId: "cmm3lndn701oo0uefvxzo0ivw",
+		redirectUri: "http://localhost:0/auth/callback",
+		tokenStorage: pinnedStorage,
+		apiBaseUrl: getApiBaseUrl(env)
+	}).client.GET("/v1/workspaces", { signal })).error) throw new RecipientSessionInvalidError(workspaceRef);
+	const tokens = await pinnedStorage.getTokens();
+	if (!tokens) throw new RecipientSessionInvalidError(workspaceRef);
+	return {
+		workspace,
+		accessToken: tokens.accessToken
+	};
+}
+//#endregion
+export { RecipientSessionInvalidError, resolveRecipientWorkspaceSession };

package/dist/lib/database/provider.js

@@ -1,6 +1,8 @@
+import { formatPrismaCliCommand } from "../../shell/cli-command.js";
 import { CliError } from "../../shell/errors.js";
 //#region src/lib/database/provider.ts
-function createManagementDatabaseProvider(client) {
+function createManagementDatabaseProvider(client, options) {
+	const formatCommand = options?.formatCommand ?? ((args) => formatPrismaCliCommand(args));
 	return {
 		async listDatabases(options) {
 			const databases = [];
@@ -75,6 +77,55 @@ function createManagementDatabaseProvider(client) {
 				signal: options?.signal
 			});
 			if (result.error) throw databaseApiError("Failed to remove database connection", result.response, result.error);
+		},
+		async getUsage(databaseId, options) {
+			const result = await client.GET("/v1/databases/{databaseId}/usage", {
+				params: {
+					path: { databaseId },
+					query: {
+						...options?.from ? { startDate: options.from } : {},
+						...options?.to ? { endDate: options.to } : {}
+					}
+				},
+				signal: options?.signal
+			});
+			if (result.error || !result.data) throw databaseApiError("Failed to fetch database usage", result.response, result.error);
+			return normalizeUsage(result.data);
+		},
+		async listBackups(databaseId, options) {
+			const result = await client.GET("/v1/databases/{databaseId}/backups", {
+				params: {
+					path: { databaseId },
+					query: { ...options?.limit !== void 0 ? { limit: options.limit } : {} }
+				},
+				signal: options?.signal
+			});
+			if (result.response?.status === 422) throw backupsUnsupportedError(databaseId, result.error);
+			if (result.error || !result.data) throw databaseApiError("Failed to list database backups", result.response, result.error);
+			return normalizeBackupList(result.data);
+		},
+		async restoreDatabase(options) {
+			const result = await client.POST("/v1/databases/{targetDatabaseId}/restore", {
+				params: { path: { targetDatabaseId: options.targetDatabaseId } },
+				body: { source: {
+					type: "backup",
+					databaseId: options.sourceDatabaseId,
+					backupId: options.backupId
+				} },
+				signal: options.signal
+			});
+			if (result.response?.status === 409) throw restoreConflictError(options.targetDatabaseId, result.error, formatCommand);
+			if (result.response?.status === 404) throw restoreBackupNotFoundError(options, result.error, formatCommand);
+			if (result.error || !result.data) throw databaseApiError("Failed to restore database", result.response, result.error);
+			return normalizeDatabase(result.data.data, options.projectId);
+		},
+		async rotateConnection(connectionId, options) {
+			const result = await client.POST("/v1/connections/{id}/rotate", {
+				params: { path: { id: connectionId } },
+				signal: options?.signal
+			});
+			if (result.error || !result.data) throw databaseApiError("Failed to rotate database connection", result.response, result.error);
+			return normalizeRotatedConnection(result.data.data);
 		}
 	};
 }
@@ -151,6 +202,102 @@ function requireDatabaseProjectId(database, fallbackProjectId) {
 function extractConnectionString(connection) {
 	return connection.endpoints?.pooled?.connectionString ?? connection.connectionString ?? connection.endpoints?.direct?.connectionString ?? connection.endpoints?.accelerate?.connectionString ?? null;
 }
+function normalizeUsage(usage) {
+	return {
+		period: {
+			start: usage.period?.start ?? "",
+			end: usage.period?.end ?? ""
+		},
+		metrics: {
+			operations: {
+				used: usage.metrics?.operations?.used ?? 0,
+				unit: usage.metrics?.operations?.unit ?? "ops"
+			},
+			storage: {
+				used: usage.metrics?.storage?.used ?? 0,
+				unit: usage.metrics?.storage?.unit ?? "GiB"
+			}
+		},
+		generatedAt: usage.generatedAt ?? ""
+	};
+}
+function normalizeBackupList(body) {
+	return {
+		backups: (body.data ?? []).map((backup) => ({
+			id: backup.id,
+			backupType: backup.backupType ?? "unknown",
+			status: backup.status ?? "unknown",
+			size: backup.size ?? null,
+			createdAt: backup.createdAt ?? ""
+		})),
+		retentionDays: body.meta?.backupRetentionDays ?? null,
+		hasMore: body.pagination?.hasMore ?? false
+	};
+}
+function normalizeRotatedConnection(connection) {
+	const connectionString = extractConnectionString(connection);
+	if (!connectionString) throw new CliError({
+		code: "DATABASE_CONNECTION_STRING_MISSING",
+		domain: "database",
+		summary: "Rotated connection did not return a connection string",
+		why: "Rotated connection strings are one-time-view secrets, but the Management API did not include one in this rotate response.",
+		fix: "Re-run the rotation, or create a replacement connection and store the returned URL immediately.",
+		exitCode: 1,
+		nextSteps: []
+	});
+	const database = connection.database?.id && connection.database?.name ? {
+		id: connection.database.id,
+		name: connection.database.name
+	} : null;
+	return {
+		connection: normalizeConnection(connection, connection.database?.id ?? connection.databaseId ?? ""),
+		database,
+		connectionString
+	};
+}
+function backupsUnsupportedError(databaseId, error) {
+	return new CliError({
+		code: "DATABASE_BACKUPS_UNSUPPORTED",
+		domain: "database",
+		summary: "Backups are not available for this database",
+		why: error?.error?.message ?? `The platform does not manage backups for database "${databaseId}", for example because it is a remote/BYO database.`,
+		fix: "Use your own backup tooling for externally managed databases.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+function restoreBackupNotFoundError(options, error, formatCommand) {
+	const listCommand = formatCommand([
+		"database",
+		"backup",
+		"list",
+		options.sourceDatabaseId
+	]);
+	return new CliError({
+		code: "DATABASE_BACKUP_NOT_FOUND",
+		domain: "database",
+		summary: "Database backup not found",
+		why: error?.error?.message ?? `No backup matched "${options.backupId}" for database "${options.sourceDatabaseId}".`,
+		fix: `Pass a backup id from ${listCommand}.`,
+		exitCode: 1,
+		nextSteps: [listCommand]
+	});
+}
+function restoreConflictError(targetDatabaseId, error, formatCommand) {
+	return new CliError({
+		code: "DATABASE_RESTORE_CONFLICT",
+		domain: "database",
+		summary: "Database cannot be restored right now",
+		why: error?.error?.message ?? `Database "${targetDatabaseId}" is provisioning or already recovering.`,
+		fix: "Wait for the database to become ready, then retry the restore.",
+		exitCode: 1,
+		nextSteps: [formatCommand([
+			"database",
+			"show",
+			targetDatabaseId
+		])]
+	});
+}
 function databaseApiError(summary, response, error) {
 	const status = response?.status ?? 0;
 	return new CliError({

package/dist/lib/project/provider.js

@@ -0,0 +1,92 @@
+import { formatPrismaCliCommand } from "../../shell/cli-command.js";
+import { CliError } from "../../shell/errors.js";
+//#region src/lib/project/provider.ts
+function createManagementProjectProvider(client) {
+	return {
+		async renameProject(options) {
+			const result = await client.PATCH("/v1/projects/{id}", {
+				params: { path: { id: options.projectId } },
+				body: { name: options.name },
+				signal: options.signal
+			});
+			const status = result.response?.status ?? 0;
+			if (status === 400 || status === 422) throw projectRenameFailedError(options.name, result.error);
+			if (result.error || !result.data) throw projectApiError("Failed to rename project", result.response, result.error);
+			const project = result.data.data;
+			return {
+				id: project.id,
+				name: project.name,
+				...project.url ? { url: project.url } : {}
+			};
+		},
+		async removeProject(options) {
+			const result = await client.DELETE("/v1/projects/{id}", {
+				params: { path: { id: options.projectId } },
+				signal: options.signal
+			});
+			if (result.response?.status === 400) throw projectRemoveBlockedError(options.projectId, result.error);
+			if (result.error) throw projectApiError("Failed to remove project", result.response, result.error);
+		},
+		async transferProject(options) {
+			const result = await client.POST("/v1/projects/{id}/transfer", {
+				params: { path: { id: options.projectId } },
+				body: { recipientAccessToken: options.recipientAccessToken },
+				signal: options.signal
+			});
+			if (result.response?.status === 400) throw projectTransferRejectedError(options.projectId, result.error);
+			if (result.error) throw projectApiError("Failed to transfer project", result.response, result.error);
+		}
+	};
+}
+function projectRenameFailedError(name, error) {
+	return new CliError({
+		code: "PROJECT_RENAME_FAILED",
+		domain: "project",
+		summary: "Project rename failed",
+		why: error?.error?.message ?? `The platform rejected the name "${name}".`,
+		fix: error?.error?.hint ?? "Pass a different project name and retry the rename.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+function projectRemoveBlockedError(projectId, error) {
+	return new CliError({
+		code: "PROJECT_REMOVE_BLOCKED",
+		domain: "project",
+		summary: "Project cannot be removed yet",
+		why: error?.error?.message ?? `Project "${projectId}" still has active deployments.`,
+		fix: "Remove the project's apps first, then retry the removal.",
+		exitCode: 1,
+		nextSteps: [formatPrismaCliCommand([
+			"app",
+			"remove",
+			"--app",
+			"<name>"
+		])]
+	});
+}
+function projectTransferRejectedError(projectId, error) {
+	return new CliError({
+		code: "PROJECT_TRANSFER_REJECTED",
+		domain: "project",
+		summary: "Project transfer was rejected",
+		why: error?.error?.message ?? `The platform rejected the transfer of project "${projectId}", for example because the recipient token is invalid or expired.`,
+		fix: "Check the recipient workspace session or token and retry the transfer.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+function projectApiError(summary, response, error) {
+	const status = response?.status ?? 0;
+	return new CliError({
+		code: error?.error?.code ?? "PROJECT_API_ERROR",
+		domain: "project",
+		summary,
+		why: error?.error?.message ?? `The Management API returned status ${status || "unknown"}.`,
+		fix: error?.error?.hint ?? "Re-run with --trace for the underlying API response details.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+//#endregion
+export { createManagementProjectProvider, projectRemoveBlockedError, projectRenameFailedError, projectTransferRejectedError };