@prisma/cli 3.0.0-dev.54.1 → 3.0.0-dev.57.1

package/README.md

@@ -57,6 +57,7 @@ Useful next commands:
 npx prisma-cli app logs
 npx prisma-cli app open
 npx prisma-cli project env add DATABASE_URL=postgresql://example --role preview
+npx prisma-cli project env list
 npx prisma-cli project env list --role preview
 ```
 

package/dist/commands/app/index.js

@@ -64,7 +64,7 @@ function createDeployCommand(runtime) {
 		"hono",
 		"tanstack-start",
 		"bun"
-	])).addOption(new Option("--entry <path>", "Entrypoint path for Bun deploys")).addOption(new Option("--http-port <port>", "HTTP port override for the deployed app")).addOption(new Option("--env <name=value>", "Environment variable").argParser(collectRepeatableValues));
+	])).addOption(new Option("--entry <path>", "Entrypoint path for Bun deploys")).addOption(new Option("--http-port <port>", "HTTP port override for the deployed app")).addOption(new Option("--env <name=value>", "Environment variable").argParser(collectRepeatableValues)).addOption(new Option("--prod", "Confirm intent to deploy to production"));
 	addGlobalFlags(command);
 	command.action(async (options) => {
 		const appName = options.app;
@@ -75,6 +75,7 @@ function createDeployCommand(runtime) {
 		const envAssignments = options.env;
 		const projectRef = options.project;
 		const createProjectName = options.createProject;
+		const prod = options.prod;
 		await runCommand(runtime, "app.deploy", options, (context) => runAppDeploy(context, appName, {
 			projectRef,
 			createProjectName,
@@ -82,7 +83,8 @@ function createDeployCommand(runtime) {
 			entrypoint: entry,
 			framework,
 			httpPort,
-			envAssignments
+			envAssignments,
+			prod: prod === true
 		}), {
 			renderHuman: (context, descriptor, result) => renderAppDeploy(context, descriptor, result),
 			renderJson: (result) => serializeAppDeploy(result)

package/dist/controllers/app-env.js

@@ -1,16 +1,11 @@
 import { CliError, authRequiredError, usageError, workspaceRequiredError } from "../shell/errors.js";
 import { requireComputeAuth } from "../lib/auth/guard.js";
 import { resolveProjectTarget } from "../lib/project/resolution.js";
+import { readLocalGitBranch } from "../lib/git/local-branch.js";
 import { requireAuthenticatedAuthState } from "./auth.js";
 import { listRealWorkspaceProjects } from "./project.js";
 import { formatScopeLabel, parseKeyValuePositional, resolveEnvScope } from "../lib/app/env-config.js";
 //#region src/controllers/app-env.ts
-function defaultRoleScope() {
-	return {
-		kind: "role",
-		role: "production"
-	};
-}
 async function runEnvAdd(context, rawAssignment, flags) {
 	const { key, value } = parseKeyValuePositional(rawAssignment, "add", context.runtime.env);
 	const scope = resolveEnvScope(flags, {
@@ -108,25 +103,30 @@ async function runEnvUpdate(context, rawAssignment, flags) {
 	};
 }
 async function runEnvList(context, flags) {
-	const scope = resolveEnvScope(flags, {
+	const explicit = resolveEnvScope(flags, {
 		requireExplicit: false,
 		command: "list"
-	}) ?? defaultRoleScope();
+	});
 	const { client, projectId } = await requireClientAndProject(context, flags.projectRef, "project env list");
-	const resolved = await resolveScopeToApi(client, projectId, scope, {
-		createBranchIfMissing: false,
+	const resolved = await resolveListScopeToApi(client, projectId, explicit, {
+		cwd: context.runtime.cwd,
 		signal: context.runtime.signal
 	});
-	const variables = await listVariables(client, projectId, resolved, context.runtime.signal);
+	const variables = resolved.kind === "scoped" ? await listVariables(client, projectId, {
+		scope: resolved.addScope,
+		descriptor: resolved.descriptor,
+		apiTarget: resolved.apiTarget
+	}, context.runtime.signal) : await listOverviewVariables(client, projectId, context.runtime.signal);
 	return {
 		command: "project.env.list",
 		result: {
 			projectId,
 			scope: resolved.descriptor,
+			target: resolved.target,
 			variables: variables.map((row) => toMetadata(row, resolved.descriptor))
 		},
 		warnings: [],
-		nextSteps: variables.length === 0 ? [`prisma-cli project env add KEY=value ${formatScopeFlag(scope)}`] : []
+		nextSteps: variables.length === 0 ? [`prisma-cli project env add KEY=value ${formatScopeFlag(resolved.addScope)}`] : []
 	};
 }
 async function runEnvRemove(context, key, flags) {
@@ -196,12 +196,12 @@ async function resolveScopeToApi(client, projectId, scope, options) {
 		}
 	};
 	const branch = options.createBranchIfMissing ? await resolveOrCreateBranch(client, projectId, scope.branchName, options.signal) : await resolveExistingBranch(client, projectId, scope.branchName, options.signal);
-	if (branch.isDefault) throw new CliError({
+	if (branch.role === "production") throw new CliError({
 		code: "ENV_BRANCH_SCOPE_IS_PRODUCTION",
 		domain: "app",
-		summary: `Branch "${scope.branchName}" is the default branch`,
+		summary: `Branch "${scope.branchName}" is the production branch`,
 		why: "Production variables are project-level only; branch overrides apply to preview branches.",
-		fix: "Use --role production for the default branch.",
+		fix: "Use --role production for the production branch.",
 		exitCode: 1,
 		nextSteps: ["prisma-cli project env list --role production"]
 	});
@@ -218,6 +218,123 @@ async function resolveScopeToApi(client, projectId, scope, options) {
 		}
 	};
 }
+async function resolveListScopeToApi(client, projectId, explicit, options) {
+	if (explicit) {
+		const resolved = await resolveScopeToApi(client, projectId, explicit, {
+			createBranchIfMissing: false,
+			signal: options.signal
+		});
+		return {
+			kind: "scoped",
+			descriptor: resolved.descriptor,
+			target: targetFromExplicitScope(resolved.descriptor),
+			apiTarget: resolved.apiTarget,
+			addScope: resolved.scope
+		};
+	}
+	const gitBranch = await readLocalGitBranch(options.cwd, options.signal);
+	if (gitBranch) {
+		const branch = (await listBranchesByName(client, projectId, gitBranch, options.signal))[0];
+		if (!branch) return {
+			kind: "scoped",
+			descriptor: {
+				kind: "role",
+				role: "preview"
+			},
+			target: {
+				source: "local-git",
+				branchName: gitBranch,
+				branchExists: false,
+				envMap: "preview"
+			},
+			apiTarget: {
+				class: "preview",
+				branchId: null
+			},
+			addScope: {
+				kind: "branch",
+				branchName: gitBranch
+			}
+		};
+		if (branch.role === "production") return {
+			kind: "scoped",
+			descriptor: {
+				kind: "role",
+				role: "production"
+			},
+			target: {
+				source: "local-git",
+				branchName: branch.gitName,
+				branchId: branch.id,
+				branchRole: branch.role,
+				branchExists: true,
+				envMap: "production"
+			},
+			apiTarget: {
+				class: "production",
+				branchId: null
+			},
+			addScope: {
+				kind: "role",
+				role: "production"
+			}
+		};
+		return {
+			kind: "scoped",
+			descriptor: {
+				kind: "branch",
+				branchName: branch.gitName,
+				branchId: branch.id
+			},
+			target: {
+				source: "local-git",
+				branchName: branch.gitName,
+				branchId: branch.id,
+				branchRole: branch.role,
+				branchExists: true,
+				envMap: "preview"
+			},
+			apiTarget: {
+				class: "preview",
+				branchId: branch.id
+			},
+			addScope: {
+				kind: "branch",
+				branchName: branch.gitName
+			}
+		};
+	}
+	return {
+		kind: "overview",
+		descriptor: { kind: "overview" },
+		target: {
+			source: "overview",
+			envMap: "overview"
+		},
+		addScope: {
+			kind: "role",
+			role: "preview"
+		}
+	};
+}
+function targetFromExplicitScope(scope) {
+	if (scope.kind === "branch") return {
+		source: "explicit",
+		branchName: scope.branchName,
+		branchId: scope.branchId,
+		branchRole: "preview",
+		branchExists: true,
+		envMap: "preview"
+	};
+	if (scope.kind === "role") return {
+		source: "explicit",
+		envMap: scope.role
+	};
+	return {
+		source: "overview",
+		envMap: "overview"
+	};
+}
 function formatScopeFlag(scope) {
 	if (scope.kind === "role") return `--role ${scope.role}`;
 	return `--branch ${scope.branchName}`;
@@ -306,25 +423,38 @@ async function findVariableByNaturalKey(client, projectId, key, resolved, signal
 	return data.data.filter((row) => rowMatchesExactScope(row, resolved))[0] ?? null;
 }
 async function listVariables(client, projectId, resolved, signal) {
+	return materializeEffectiveRows(await collectEnvironmentVariables(client, projectId, signal, {
+		className: resolved.apiTarget.class,
+		filter: (row) => rowMatchesScope(row, resolved)
+	}), resolved);
+}
+async function listOverviewVariables(client, projectId, signal) {
+	return (await collectEnvironmentVariables(client, projectId, signal, { filter: (row) => row.branchId === null && (row.class === "production" || row.class === "preview") })).sort((left, right) => {
+		const roleOrder = roleSortOrder(left.class) - roleSortOrder(right.class);
+		return roleOrder !== 0 ? roleOrder : left.key.localeCompare(right.key);
+	});
+}
+async function collectEnvironmentVariables(client, projectId, signal, options) {
 	const collected = [];
 	let cursor;
 	while (true) {
-		const query = {
-			projectId,
-			class: resolved.apiTarget.class
-		};
+		const query = { projectId };
+		if (options.className !== void 0) query.class = options.className;
 		if (cursor !== void 0) query.cursor = cursor;
 		const result = await client.GET("/v1/environment-variables", {
 			params: { query },
 			signal
 		});
 		if (result.error || !result.data) throw apiCallError(`Failed to list environment variables`, result.response, result.error);
-		const page = result.data.data.filter((row) => rowMatchesScope(row, resolved));
+		const page = result.data.data.filter(options.filter);
 		collected.push(...page);
 		if (!result.data.pagination.hasMore || !result.data.pagination.nextCursor) break;
 		cursor = result.data.pagination.nextCursor;
 	}
-	return materializeEffectiveRows(collected, resolved);
+	return collected;
+}
+function roleSortOrder(role) {
+	return role === "production" ? 0 : 1;
 }
 function rowMatchesScope(row, resolved) {
 	if (row.class !== resolved.apiTarget.class) return false;
@@ -357,6 +487,7 @@ function toMetadata(row, requestedScope) {
 }
 function formatDescriptorLabel(scope) {
 	if (scope.kind === "role") return scope.role ?? "unknown";
+	if (scope.kind === "overview") return "overview";
 	return `branch:${scope.branchName ?? scope.branchId ?? "unknown"}`;
 }
 function apiCallError(summary, response, error) {

package/dist/controllers/app.js

@@ -16,10 +16,12 @@ import { LOCAL_RESOLUTION_PIN_RELATIVE_PATH, readLocalResolutionPin } from "../l
 import { buildProjectSetupNextActions, inferTargetName, projectNotFoundError, resolveDurablePlatformMapping, resolveProjectTarget, sortProjects } from "../lib/project/resolution.js";
 import { bindProjectToDirectory, projectCreateFailedError, projectSetupNameRequiredError, resolveProjectForSetup, toProjectSummary } from "../lib/project/setup.js";
 import { promptForProjectSetupChoice } from "../lib/project/interactive-setup.js";
+import { readLocalGitBranch } from "../lib/git/local-branch.js";
 import { PREVIEW_BUILD_TYPES, RESOLVED_PREVIEW_BUILD_TYPES, executePreviewBuild } from "../lib/app/preview-build.js";
 import { PREVIEW_DEFAULT_REGION } from "../lib/app/preview-interaction.js";
 import { createPreviewDeployProgress, createPreviewDeployProgressState, createPreviewPromoteProgress } from "../lib/app/preview-progress.js";
 import { PreviewDomainApiError, createPreviewAppProvider } from "../lib/app/preview-provider.js";
+import { enforceProductionDeployGate } from "../lib/app/production-deploy-gate.js";
 import { formatDomainFailureFix } from "../lib/app/domain-guidance.js";
 import { createSelectPromptPort } from "./select-prompt-port.js";
 import { requireAuthenticatedAuthState } from "./auth.js";
@@ -158,6 +160,12 @@ async function runAppDeploy(context, appName, options) {
 	});
 	framework = customized.framework;
 	runtime = customized.runtime;
+	await enforceProductionDeployGate(context, provider, {
+		appId: selectedApp.appId,
+		appName: selectedApp.displayName,
+		branchKind: target.branch.kind,
+		prod: options?.prod === true
+	});
 	const buildType = framework.buildType;
 	assertSupportedEntrypoint(buildType, options?.entrypoint, "deploy");
 	const entrypoint = await resolveDeployEntrypoint(context.runtime.cwd, framework, options?.entrypoint, context.runtime.signal);
@@ -1322,7 +1330,7 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 	if (!workspace) throw workspaceRequiredError();
 	const branch = options.branch ?? await resolveDeployBranch(context, void 0);
 	const projects = await listRealWorkspaceProjects(client, workspace, context.runtime.signal);
-	if (explicitProject) return withDeployBranch({
+	if (explicitProject) return withRemoteDeployBranch(provider, {
 		workspace,
 		project: toProjectSummary(resolveProjectForSetup(explicitProject, projects, workspace)),
 		resolution: {
@@ -1331,11 +1339,11 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 			targetNameSource: "explicit"
 		},
 		localPinAction: "linked"
-	}, branch);
+	}, branch, context.runtime.signal);
 	if (options.createProjectName) {
 		const projectName = options.createProjectName.trim();
 		if (!projectName) throw projectSetupNameRequiredError("app deploy --create-project");
-		return withDeployBranch({
+		return withRemoteDeployBranch(provider, {
 			workspace,
 			project: toProjectSummary(await createProjectForDeploySetup(provider, projectName, workspace, context.runtime.signal)),
 			resolution: {
@@ -1344,12 +1352,12 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 				targetNameSource: "explicit"
 			},
 			localPinAction: "created"
-		}, branch);
+		}, branch, context.runtime.signal);
 	}
 	if (options.envProjectId) {
 		const project = projects.find((candidate) => candidate.id === options.envProjectId);
 		if (!project) throw projectNotFoundError(options.envProjectId, workspace);
-		return withDeployBranch({
+		return withRemoteDeployBranch(provider, {
 			workspace,
 			project: toProjectSummary(project),
 			resolution: {
@@ -1357,14 +1365,14 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 				targetName: options.envProjectId,
 				targetNameSource: "env"
 			}
-		}, branch);
+		}, branch, context.runtime.signal);
 	}
 	const localPin = options.localPin;
 	if (localPin.kind === "present") {
 		if (localPin.pin.workspaceId !== workspace.id) throw localResolutionPinStaleError();
 		const project = projects.find((candidate) => candidate.id === localPin.pin.projectId);
 		if (!project) throw localResolutionPinStaleError();
-		return withDeployBranch({
+		return withRemoteDeployBranch(provider, {
 			workspace,
 			project: toProjectSummary(project),
 			resolution: {
@@ -1372,10 +1380,10 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 				targetName: project.name,
 				targetNameSource: "local-pin"
 			}
-		}, branch);
+		}, branch, context.runtime.signal);
 	}
 	const platformMapping = await resolveDurablePlatformMapping();
-	if (platformMapping && platformMapping.workspace.id === workspace.id) return withDeployBranch({
+	if (platformMapping && platformMapping.workspace.id === workspace.id) return withRemoteDeployBranch(provider, {
 		workspace,
 		project: toProjectSummary(platformMapping),
 		resolution: {
@@ -1383,8 +1391,8 @@ async function resolveDeployProjectContext(context, client, provider, explicitPr
 			targetName: platformMapping.name,
 			targetNameSource: "platform-mapping"
 		}
-	}, branch);
-	if (canPrompt(context) && !context.flags.yes) return withDeployBranch(await resolveInteractiveDeployProjectSetup(context, provider, workspace, projects), branch);
+	}, branch, context.runtime.signal);
+	if (canPrompt(context) && !context.flags.yes) return withRemoteDeployBranch(provider, await resolveInteractiveDeployProjectSetup(context, provider, workspace, projects), branch, context.runtime.signal);
 	throw projectSetupRequiredError(projects, await inferTargetName(context.runtime.cwd, context.runtime.signal));
 }
 async function resolveInteractiveDeployProjectSetup(context, provider, workspace, projects) {
@@ -1430,12 +1438,16 @@ async function createProjectForDeploySetup(provider, projectName, workspace, sig
 		workspace
 	};
 }
-function withDeployBranch(target, branch) {
+async function withRemoteDeployBranch(provider, target, branch, signal) {
+	const remoteBranch = await provider.resolveBranch(target.project.id, {
+		branchName: branch.name,
+		signal
+	});
 	return {
 		...target,
 		branch: {
-			name: branch.name,
-			kind: toBranchKind(branch.name)
+			name: remoteBranch.name,
+			kind: remoteBranch.role
 		}
 	};
 }
@@ -1470,42 +1482,6 @@ async function resolveDeployBranch(context, explicitBranchName) {
 		annotation: "default"
 	};
 }
-async function readLocalGitBranch(cwd, signal) {
-	const headPath = await resolveGitHeadPath(path.join(cwd, ".git"), signal);
-	if (!headPath) return null;
-	try {
-		const head = (await readFile(headPath, {
-			encoding: "utf8",
-			signal
-		})).trim();
-		if (head.startsWith("ref: refs/heads/")) return head.slice(16);
-	} catch (error) {
-		if (signal.aborted) throw error;
-		return null;
-	}
-	return null;
-}
-async function resolveGitHeadPath(gitPath, signal) {
-	signal.throwIfAborted();
-	try {
-		const raw = await readFile(gitPath, {
-			encoding: "utf8",
-			signal
-		});
-		if (raw.startsWith("gitdir:")) return path.join(path.resolve(path.dirname(gitPath), raw.slice(7).trim()), "HEAD");
-	} catch (error) {
-		if (signal.aborted) throw error;
-	}
-	signal.throwIfAborted();
-	try {
-		await access(path.join(gitPath, "HEAD"));
-		signal.throwIfAborted();
-		return path.join(gitPath, "HEAD");
-	} catch (error) {
-		if (signal.aborted) throw error;
-		return null;
-	}
-}
 async function resolveDeployFramework(context, options) {
 	if (options.requestedFramework) return frameworkFromUserFacingValue(options.requestedFramework, "set by --framework");
 	if (options.entrypoint) return {

package/dist/lib/app/preview-provider.js

@@ -36,6 +36,18 @@ function createPreviewAppProvider(client, options) {
 				signal: options?.signal
 			});
 		},
+		async resolveBranch(projectId, options) {
+			const branch = await resolveOrCreateBranch(client, {
+				projectId,
+				gitName: options.branchName,
+				signal: options.signal
+			});
+			return {
+				id: branch.id,
+				name: branch.gitName,
+				role: branch.role
+			};
+		},
 		async removeApp(appId, options) {
 			const appResult = await sdk.showService({
 				serviceId: appId,
@@ -316,17 +328,19 @@ async function listBranches(client, options) {
 		signal: options.signal
 	});
 	if (result.error || !result.data) throw apiCallError("Failed to list branches", result.response, result.error);
-	return result.data.data;
+	return result.data.data.map((branch) => ({
+		id: branch.id,
+		gitName: branch.gitName,
+		isDefault: branch.isDefault,
+		role: branch.role
+	}));
 }
 async function resolveOrCreateBranch(client, options) {
 	const existing = (await listBranches(client, options))[0];
 	if (existing) return existing;
 	const result = await client.POST("/v1/projects/{projectId}/branches", {
 		params: { path: { projectId: options.projectId } },
-		body: {
-			gitName: options.gitName,
-			isDefault: options.gitName === "main"
-		},
+		body: { gitName: options.gitName },
 		signal: options.signal
 	});
 	if (result.error || !result.data) {
@@ -336,7 +350,13 @@ async function resolveOrCreateBranch(client, options) {
 		}
 		throw apiCallError(`Failed to create branch "${options.gitName}"`, result.response, result.error);
 	}
-	return result.data.data;
+	const branch = result.data.data;
+	return {
+		id: branch.id,
+		gitName: branch.gitName,
+		isDefault: branch.isDefault,
+		role: branch.role
+	};
 }
 async function listComputeServices(client, options) {
 	const services = [];

package/dist/lib/app/production-deploy-gate.js

@@ -0,0 +1,160 @@
+import { CliError } from "../../shell/errors.js";
+import { canPrompt } from "../../shell/runtime.js";
+import { confirmPrompt } from "../../shell/prompt.js";
+//#region src/lib/app/production-deploy-gate.ts
+async function enforceProductionDeployGate(context, provider, options) {
+	if (options.branchKind !== "production") return;
+	if (!options.appId) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return;
+	}
+	const currentLiveDeployment = resolveCurrentProductionDeployment(await provider.listDeployments(options.appId).catch((error) => {
+		throw productionDeployInspectionFailedError(error);
+	}));
+	if (!currentLiveDeployment) {
+		renderFirstProductionDeployLine(context, options.appName);
+		return;
+	}
+	if (!options.prod) throw productionDeployRequiresFlagError();
+	if (context.flags.yes) {
+		renderProductionDeployYesLine(context);
+		return;
+	}
+	if (!canPrompt(context)) throw productionDeployConfirmationRequiredError(options.appName);
+	renderProductionDeployConfirmation(context, currentLiveDeployment);
+	if (!await confirmPrompt({
+		input: context.runtime.stdin,
+		output: context.output.stderr,
+		message: "Deploy to production?",
+		initialValue: false
+	})) throw productionDeployCancelledError();
+}
+function resolveCurrentProductionDeployment(result) {
+	if (result.deployments.length === 0) return null;
+	if (result.app.liveDeploymentId) {
+		const live = result.deployments.find((deployment) => deployment.id === result.app.liveDeploymentId);
+		if (live) return live;
+	}
+	return result.deployments.find((deployment) => deployment.live === true) ?? result.deployments[0] ?? null;
+}
+function renderFirstProductionDeployLine(context, appName) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write(`First deploy of "${appName}" -- promoting to production.\n\n`);
+}
+function renderProductionDeployYesLine(context) {
+	if (context.flags.json || context.flags.quiet) return;
+	context.output.stderr.write("Deploying to production (--prod --yes).\n\n");
+}
+function renderProductionDeployConfirmation(context, currentLiveDeployment) {
+	if (context.flags.json || context.flags.quiet) return;
+	const lines = [
+		"This will deploy to production and replace the live deployment.",
+		"",
+		`  Current live:  ${currentLiveDeployment.id} deployed ${formatDeploymentAge(currentLiveDeployment.createdAt)}`,
+		"  New deploy:    will be built from your local code",
+		""
+	];
+	context.output.stderr.write(`${lines.join("\n")}\n`);
+}
+function formatDeploymentAge(createdAt) {
+	const createdAtMs = Date.parse(createdAt);
+	if (!Number.isFinite(createdAtMs)) return createdAt;
+	const elapsedMs = Math.max(0, Date.now() - createdAtMs);
+	for (const unit of [
+		{
+			label: "day",
+			ms: 1440 * 60 * 1e3
+		},
+		{
+			label: "hour",
+			ms: 3600 * 1e3
+		},
+		{
+			label: "minute",
+			ms: 60 * 1e3
+		}
+	]) if (elapsedMs >= unit.ms) {
+		const value = Math.floor(elapsedMs / unit.ms);
+		return `${value} ${unit.label}${value === 1 ? "" : "s"} ago`;
+	}
+	return "less than a minute ago";
+}
+function productionDeployRequiresFlagError() {
+	return new CliError({
+		code: "PROD_DEPLOY_REQUIRES_FLAG",
+		domain: "app",
+		summary: "Production deploy requires --prod",
+		why: "The resolved Branch is production and this App already has a production deployment.",
+		fix: "Re-run with --prod, or deploy from a preview Branch.",
+		exitCode: 2,
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production",
+			command: "prisma-cli app deploy --prod"
+		}, {
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Create a preview branch",
+			commands: ["git checkout -b <branch-name>", "prisma-cli app deploy"]
+		}],
+		humanLines: [
+			"This would deploy to production.",
+			"",
+			"Production deploys require explicit intent. Re-run with:",
+			"",
+			"  prisma app deploy --prod",
+			"",
+			"Or deploy a preview from a feature branch:",
+			"",
+			"  git checkout -b <branch-name>",
+			"  prisma app deploy"
+		]
+	});
+}
+function productionDeployConfirmationRequiredError(appName) {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy requires confirmation in the current mode",
+		why: "This command cannot prompt for production deploy confirmation in the current mode.",
+		fix: `Pass --prod --yes to confirm deployment of "${appName}" to production.`,
+		exitCode: 1,
+		nextSteps: ["prisma-cli app deploy --prod --yes"],
+		nextActions: [{
+			kind: "run-command",
+			journey: "deploy-app",
+			label: "Deploy to production non-interactively",
+			command: "prisma-cli app deploy --prod --yes"
+		}]
+	});
+}
+function productionDeployCancelledError() {
+	return new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "app",
+		summary: "Production deploy cancelled",
+		why: null,
+		fix: null,
+		exitCode: 0,
+		humanLines: ["Cancelled."]
+	});
+}
+function productionDeployInspectionFailedError(error) {
+	return new CliError({
+		code: "DEPLOY_FAILED",
+		domain: "app",
+		summary: "Failed to inspect production deployments",
+		why: error instanceof Error ? error.message : String(error),
+		fix: "Retry the command, or rerun with --trace for more detailed diagnostics.",
+		debug: formatDebugDetails(error),
+		exitCode: 1,
+		nextSteps: ["prisma-cli app list-deploys"]
+	});
+}
+function formatDebugDetails(error) {
+	if (error instanceof Error) return error.stack ?? error.message;
+	return typeof error === "string" ? error : null;
+}
+//#endregion
+export { enforceProductionDeployGate };

package/dist/lib/git/local-branch.js

@@ -0,0 +1,41 @@
+import { access, readFile } from "node:fs/promises";
+import path from "node:path";
+//#region src/lib/git/local-branch.ts
+async function readLocalGitBranch(cwd, signal) {
+	const headPath = await resolveGitHeadPath(path.join(cwd, ".git"), signal);
+	if (!headPath) return null;
+	try {
+		const head = (await readFile(headPath, {
+			encoding: "utf8",
+			signal
+		})).trim();
+		if (head.startsWith("ref: refs/heads/")) return head.slice(16);
+	} catch (error) {
+		if (signal.aborted) throw error;
+		return null;
+	}
+	return null;
+}
+async function resolveGitHeadPath(gitPath, signal) {
+	signal.throwIfAborted();
+	try {
+		const raw = await readFile(gitPath, {
+			encoding: "utf8",
+			signal
+		});
+		if (raw.startsWith("gitdir:")) return path.join(path.resolve(path.dirname(gitPath), raw.slice(7).trim()), "HEAD");
+	} catch (error) {
+		if (signal.aborted) throw error;
+	}
+	signal.throwIfAborted();
+	try {
+		await access(path.join(gitPath, "HEAD"));
+		signal.throwIfAborted();
+		return path.join(gitPath, "HEAD");
+	} catch (error) {
+		if (signal.aborted) throw error;
+		return null;
+	}
+}
+//#endregion
+export { readLocalGitBranch };

package/dist/presenters/app-env.js

@@ -2,8 +2,18 @@ import { renderList, renderShow, serializeList } from "../output/patterns.js";
 //#region src/presenters/app-env.ts
 function scopeLabel(scope) {
 	if (scope.kind === "role") return scope.role ?? "unknown";
+	if (scope.kind === "overview") return "overview";
 	return `branch:${scope.branchName ?? scope.branchId ?? "unknown"}`;
 }
+function listTargetLabel(result) {
+	const target = result.target;
+	if (target.source === "overview") return "overview";
+	if (target.branchName) {
+		const suffix = target.branchExists === false ? " (not created yet)" : "";
+		return `branch:${target.branchName} -> ${target.envMap}${suffix}`;
+	}
+	return scopeLabel(result.scope);
+}
 function renderEnvAdd(context, descriptor, result) {
 	return renderShow({
 		title: "Setting a new environment variable.",
@@ -75,8 +85,8 @@ function renderEnvList(context, descriptor, result) {
 		title: "Listing environment variables for the selected scope.",
 		descriptor,
 		parentContext: {
-			key: "scope",
-			value: scopeLabel(result.scope)
+			key: "target",
+			value: listTargetLabel(result)
 		},
 		items: result.variables.map((variable) => ({
 			noun: "variable",
@@ -91,8 +101,9 @@ function serializeEnvList(result) {
 	return {
 		projectId: result.projectId,
 		scope: result.scope,
+		target: result.target,
 		...serializeList({
-			context: { scope: scopeLabel(result.scope) },
+			context: { target: listTargetLabel(result) },
 			items: result.variables.map((variable) => ({
 				noun: "variable",
 				label: `${variable.key} (${variable.source})`,

package/dist/shell/command-meta.js

@@ -216,6 +216,7 @@ const DESCRIPTORS = [
 			"prisma-cli app deploy --app my-app --env DATABASE_URL=postgresql://example",
 			"prisma-cli app deploy --app my-app --framework nextjs --http-port 3000",
 			"prisma-cli app deploy --branch feat-login --framework hono",
+			"prisma-cli app deploy --prod --yes",
 			"pnpm dlx skills@latest add prisma/prisma-cli/skills#cli-v<cli-version> --all",
 			"prisma-cli app deploy --framework bun --entry src/server.ts"
 		]
@@ -378,7 +379,7 @@ const DESCRIPTORS = [
 		],
 		description: "Manage environment variables for the active project",
 		examples: [
-			"prisma-cli project env list --role production",
+			"prisma-cli project env list",
 			"prisma-cli project env add STRIPE_KEY=sk_test_xxx --role production",
 			"prisma-cli project env add DATABASE_URL=postgresql://branch --branch feature/foo",
 			"prisma-cli project env remove STRIPE_KEY --role preview"
@@ -425,6 +426,7 @@ const DESCRIPTORS = [
 		],
 		description: "List environment variable metadata for a scope (no values).",
 		examples: [
+			"prisma-cli project env list",
 			"prisma-cli project env list --role production",
 			"prisma-cli project env list --role preview",
 			"prisma-cli project env list --branch feature/foo"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "3.0.0-dev.54.1",
+  "version": "3.0.0-dev.57.1",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {