@prisma/cli 3.0.0-dev.97.1 → 8.0.0-rc.1

package/dist/controllers/auth.js

@@ -1,40 +1,45 @@
-import { CLIENT_ID, SERVICE_TOKEN_ENV_VAR, getApiBaseUrl } from "../lib/auth/client.js";
-import { FileTokenStorage, WorkspaceSelectionError } from "../adapters/token-storage.js";
-import { authRequiredError, usageError, workspaceAmbiguousError, workspaceNotAuthenticatedError, workspaceSwitchUnavailableError } from "../shell/errors.js";
+import { resolvePrismaCliPackageCommand } from "../lib/agent/cli-command.js";
+import { PRISMA_AGENT_INSTALL_ARGS } from "../lib/agent/constants.js";
+import { isLikelyProjectDirectory, readPrismaAgentSetupStatus, resolvePrismaAgentSetupCwd, shouldOfferPrismaAgentSetup } from "../lib/agent/setup-status.js";
+import { authRequiredError, usageError } from "../errors.js";
+import { performLogin, performLogout, readAuthState, storeLegacyCredential } from "../auth/operations.js";
 import { canPrompt } from "../shell/runtime.js";
-import { performLogin, performLogout, readAuthState } from "../lib/auth/auth-ops.js";
-import { createAuthUseCases } from "../use-cases/auth.js";
-import { createCliUseCaseGateways } from "../use-cases/create-cli-gateways.js";
+import { workspaceSwitchUnavailableError } from "../auth/errors.js";
+import { listAuthWorkspaces, logoutAuthWorkspace, switchAuthWorkspace } from "../auth/workspaces.js";
 import { createSelectPromptPort } from "./select-prompt-port.js";
-import { createManagementApiSdk } from "@prisma/management-api-sdk";
+import { SERVICE_TOKEN_ENV_VAR } from "@prisma/cli-engine";
 //#region src/controllers/auth.ts
-function isRealMode(context) {
-	return !context.runtime.fixturePath && !context.runtime.env.PRISMA_CLI_MOCK_FIXTURE_PATH;
+function workspaceOperationContext(context) {
+	return {
+		env: context.runtime.env,
+		signal: context.runtime.signal
+	};
 }
-async function runAuthLogin(context, options) {
-	let result;
-	if (isRealMode(context)) {
-		await performLogin(context.runtime.env, context.runtime.signal);
-		result = await readAuthState(context.runtime.env, context.runtime.signal);
-	} else result = await loginWithSelectionFlow(context, createAuthUseCases(createCliUseCaseGateways(context)), options);
-	return createAuthSuccess("auth.login", result, ["prisma-cli auth whoami", "prisma-cli project list"]);
+async function runAuthLogin(context) {
+	const credential = await performLogin(context.runtime.env, context.runtime.signal);
+	await storeLegacyCredential(context.runtime.env, credential, context.runtime.signal);
+	let result = await readAuthState(context.runtime.env, context.runtime.signal);
+	const agentSetupTipCommand = await resolveAgentSetupTipCommand(context);
+	if (agentSetupTipCommand) result = {
+		...result,
+		agentSetupTip: { command: agentSetupTipCommand }
+	};
+	return createAuthSuccess("auth.login", result, [
+		"prisma-cli auth whoami",
+		"prisma-cli project list",
+		...result.agentSetupTip ? [result.agentSetupTip.command] : []
+	]);
 }
 async function runAuthLogout(context) {
-	let result;
-	if (isRealMode(context)) {
-		await performLogout(context.runtime.env, context.runtime.signal);
-		result = await readAuthState(context.runtime.env, context.runtime.signal);
-	} else result = await createAuthUseCases(createCliUseCaseGateways(context)).logout();
-	return createAuthSuccess("auth.logout", result, ["prisma-cli auth login"]);
+	await performLogout(context.runtime.env, context.runtime.signal);
+	return createAuthSuccess("auth.logout", await readAuthState(context.runtime.env, context.runtime.signal), ["prisma-cli auth login"]);
 }
 async function runAuthWhoAmI(context) {
-	let result;
-	if (isRealMode(context)) result = await readAuthState(context.runtime.env, context.runtime.signal);
-	else result = await createAuthUseCases(createCliUseCaseGateways(context)).whoami();
+	const result = await readAuthState(context.runtime.env, context.runtime.signal);
 	return createAuthSuccess("auth.whoami", result, result.authenticated ? [] : ["prisma-cli auth login"]);
 }
 async function runAuthWorkspaceList(context) {
-	const result = isRealMode(context) ? await listRealAuthWorkspaces(context) : await createAuthUseCases(createCliUseCaseGateways(context)).listWorkspaces();
+	const result = await listAuthWorkspaces(workspaceOperationContext(context));
 	return {
 		command: "auth.workspace.list",
 		result,
@@ -47,14 +52,14 @@ async function runAuthWorkspaceUse(context, workspaceRef) {
 	const selectedWorkspaceRef = trimmedWorkspaceRef ? trimmedWorkspaceRef : await selectWorkspaceSession(context);
 	return {
 		command: "auth.workspace.use",
-		result: isRealMode(context) ? await useRealAuthWorkspace(context, selectedWorkspaceRef) : await createAuthUseCases(createCliUseCaseGateways(context)).useWorkspace(selectedWorkspaceRef),
+		result: await switchAuthWorkspace(workspaceOperationContext(context), selectedWorkspaceRef),
 		warnings: [],
 		nextSteps: ["prisma-cli auth whoami", "prisma-cli project list"]
 	};
 }
 async function runAuthWorkspaceLogout(context, workspaceRef) {
 	if (!workspaceRef?.trim()) throw usageError("Workspace required", "auth workspace logout needs a workspace id or cached workspace name.", "Pass a workspace from prisma-cli auth workspace list.", ["prisma-cli auth workspace list"], "auth");
-	const result = isRealMode(context) ? await logoutRealAuthWorkspace(context, workspaceRef) : await createAuthUseCases(createCliUseCaseGateways(context)).logoutWorkspace(workspaceRef);
+	const result = await logoutAuthWorkspace(workspaceOperationContext(context), workspaceRef);
 	return {
 		command: "auth.workspace.logout",
 		result,
@@ -63,107 +68,16 @@ async function runAuthWorkspaceLogout(context, workspaceRef) {
 	};
 }
 async function requireAuthenticatedAuthState(context) {
-	if (isRealMode(context)) {
-		const current = await readAuthState(context.runtime.env, context.runtime.signal);
-		if (current.authenticated) return current;
-		if (!canPrompt(context)) throw authRequiredError();
-		await performLogin(context.runtime.env, context.runtime.signal);
-		return readAuthState(context.runtime.env, context.runtime.signal);
-	}
-	const useCases = createAuthUseCases(createCliUseCaseGateways(context));
-	const current = await useCases.whoami();
+	const current = await readAuthState(context.runtime.env, context.runtime.signal);
 	if (current.authenticated) return current;
 	if (!canPrompt(context)) throw authRequiredError();
-	return loginWithSelectionFlow(context, useCases, {});
-}
-async function listRealAuthWorkspaces(context) {
-	const rawServiceToken = context.runtime.env[SERVICE_TOKEN_ENV_VAR];
-	const storage = new FileTokenStorage(context.runtime.env, context.runtime.signal);
-	const localWorkspaces = await hydrateLocalAuthWorkspaces(context, storage, await storage.listWorkspaces());
-	if (rawServiceToken !== void 0) {
-		const authState = await readAuthState(context.runtime.env, context.runtime.signal);
-		return {
-			authSource: authState.authenticated ? "service_token" : "none",
-			activeWorkspace: authState.workspace,
-			workspaces: [...authState.workspace ? [{
-				...authState.workspace,
-				credentialWorkspaceId: null,
-				active: true,
-				source: "service_token",
-				switchable: false,
-				lastSeenAt: null
-			}] : [], ...localWorkspaces.map((workspace) => ({
-				...toAuthWorkspace(workspace),
-				credentialWorkspaceId: workspace.credentialWorkspaceId,
-				active: false,
-				source: "oauth",
-				switchable: false,
-				lastSeenAt: workspace.lastSeenAt
-			}))]
-		};
-	}
-	const active = localWorkspaces.find((workspace) => workspace.active) ?? null;
-	return {
-		authSource: localWorkspaces.length > 0 ? "oauth" : "none",
-		activeWorkspace: active ? toAuthWorkspace(active) : null,
-		workspaces: localWorkspaces.map((workspace) => ({
-			...toAuthWorkspace(workspace),
-			credentialWorkspaceId: workspace.credentialWorkspaceId,
-			active: workspace.active,
-			source: "oauth",
-			switchable: true,
-			lastSeenAt: workspace.lastSeenAt
-		}))
-	};
-}
-async function useRealAuthWorkspace(context, workspaceRef) {
-	if (context.runtime.env["PRISMA_SERVICE_TOKEN"] !== void 0) throw workspaceSwitchUnavailableError();
-	const storage = new FileTokenStorage(context.runtime.env, context.runtime.signal);
-	await hydrateLocalAuthWorkspaces(context, storage, await storage.listWorkspaces());
-	try {
-		const result = await storage.useWorkspace(workspaceRef);
-		return {
-			previousWorkspace: result.previous ? toAuthWorkspace(result.previous) : null,
-			workspace: toAuthWorkspace(result.selected)
-		};
-	} catch (error) {
-		if (error instanceof WorkspaceSelectionError) {
-			if (error.reason === "ambiguous") throw workspaceAmbiguousError(error.workspaceRef ?? workspaceRef, error.matches.map((match) => ({
-				id: match.id,
-				name: match.name,
-				credentialWorkspaceId: match.credentialWorkspaceId
-			})));
-			throw workspaceNotAuthenticatedError(error.workspaceRef ?? workspaceRef);
-		}
-		throw error;
-	}
-}
-async function logoutRealAuthWorkspace(context, workspaceRef) {
-	const storage = new FileTokenStorage(context.runtime.env, context.runtime.signal);
-	await hydrateLocalAuthWorkspaces(context, storage, await storage.listWorkspaces());
-	try {
-		const result = await storage.logoutWorkspace(workspaceRef);
-		return {
-			workspace: toAuthWorkspace(result.workspace),
-			wasActive: result.wasActive,
-			activeWorkspace: result.activeWorkspace ? toAuthWorkspace(result.activeWorkspace) : null
-		};
-	} catch (error) {
-		if (error instanceof WorkspaceSelectionError) {
-			if (error.reason === "ambiguous") throw workspaceAmbiguousError(error.workspaceRef ?? workspaceRef, error.matches.map((match) => ({
-				id: match.id,
-				name: match.name,
-				credentialWorkspaceId: match.credentialWorkspaceId
-			})));
-			throw workspaceNotAuthenticatedError(error.workspaceRef ?? workspaceRef);
-		}
-		throw error;
-	}
+	const credential = await performLogin(context.runtime.env, context.runtime.signal);
+	await storeLegacyCredential(context.runtime.env, credential, context.runtime.signal);
+	return readAuthState(context.runtime.env, context.runtime.signal);
 }
 async function selectWorkspaceSession(context) {
-	const realMode = isRealMode(context);
-	if (realMode && context.runtime.env["PRISMA_SERVICE_TOKEN"] !== void 0) throw workspaceSwitchUnavailableError();
-	const workspaces = (realMode ? await listRealAuthWorkspaces(context) : await createAuthUseCases(createCliUseCaseGateways(context)).listWorkspaces()).workspaces.filter((workspace) => workspace.switchable);
+	if (context.runtime.env[SERVICE_TOKEN_ENV_VAR] !== void 0) throw workspaceSwitchUnavailableError();
+	const workspaces = (await listAuthWorkspaces(workspaceOperationContext(context))).workspaces.filter((workspace) => workspace.switchable);
 	if (workspaces.length === 0) throw usageError("No authenticated workspaces", "There are no local OAuth workspace sessions to select.", "Run prisma-cli auth login and authorize a workspace.", ["prisma-cli auth login"], "auth");
 	if (workspaces.length === 1) return workspaces[0].id;
 	if (!canPrompt(context)) throw usageError("Interactive workspace selection unavailable", "auth workspace use needs an interactive terminal when no workspace is provided and more than one workspace is available.", "Run prisma-cli auth workspace use <id-or-name> with a workspace from prisma-cli auth workspace list.", ["prisma-cli auth workspace list"], "auth");
@@ -175,135 +89,6 @@ async function selectWorkspaceSession(context) {
 		}))
 	})).id;
 }
-async function hydrateLocalAuthWorkspaces(context, storage, workspaces) {
-	const candidates = workspaces.filter(needsWorkspaceMetadataHydration);
-	if (candidates.length === 0) return workspaces;
-	const tokensByCredentialWorkspaceId = new Map((await storage.listWorkspaceTokens()).map((tokens) => [tokens.workspaceId, tokens]));
-	let nextWorkspaces = workspaces;
-	for (const workspace of candidates) {
-		const tokens = tokensByCredentialWorkspaceId.get(workspace.credentialWorkspaceId);
-		if (!tokens) continue;
-		const resolved = await resolveOAuthWorkspaceMetadata(context, tokens);
-		if (!resolved) continue;
-		await rememberResolvedWorkspaceMetadata(context, storage, tokens, resolved);
-		nextWorkspaces = nextWorkspaces.map((candidate) => candidate.credentialWorkspaceId === workspace.credentialWorkspaceId ? {
-			...candidate,
-			id: resolved.id,
-			name: resolved.name,
-			lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : candidate);
-	}
-	return nextWorkspaces;
-}
-async function rememberResolvedWorkspaceMetadata(context, storage, tokens, resolved) {
-	try {
-		await storage.rememberWorkspace(tokens.workspaceId, resolved);
-	} catch {
-		context.runtime.signal?.throwIfAborted();
-	}
-}
-function needsWorkspaceMetadataHydration(workspace) {
-	return workspace.id === workspace.credentialWorkspaceId || workspace.name === "Unknown workspace" || workspace.name === workspace.credentialWorkspaceId;
-}
-async function resolveOAuthWorkspaceMetadata(context, tokens) {
-	const sdk = createManagementApiSdk({
-		clientId: CLIENT_ID,
-		redirectUri: "http://localhost:0/auth/callback",
-		tokenStorage: createSingleWorkspaceTokenStorage(new FileTokenStorage(context.runtime.env, context.runtime.signal, { activateOnSetTokens: false }), tokens),
-		apiBaseUrl: getApiBaseUrl(context.runtime.env)
-	});
-	try {
-		const { data } = await sdk.client.GET("/v1/workspaces/{id}", {
-			params: { path: { id: tokens.workspaceId } },
-			signal: context.runtime.signal
-		});
-		const id = stringOrNull(data?.data?.id) ?? tokens.workspaceId;
-		const name = stringOrNull(data?.data?.name) ?? id;
-		if (id === tokens.workspaceId && name === tokens.workspaceId) return null;
-		return {
-			id,
-			name
-		};
-	} catch {
-		context.runtime.signal?.throwIfAborted();
-		return null;
-	}
-}
-function createSingleWorkspaceTokenStorage(storage, initialTokens) {
-	let currentTokens = initialTokens;
-	return {
-		getTokens: async () => currentTokens,
-		setTokens: async (tokens) => {
-			currentTokens = tokens;
-			await storage.setTokens(tokens);
-		},
-		clearTokens: async () => {
-			const tokens = currentTokens;
-			currentTokens = null;
-			if (tokens) await storage.clearTokensIfCurrent(tokens);
-		}
-	};
-}
-function stringOrNull(value) {
-	return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-function toAuthWorkspace(workspace) {
-	return {
-		id: workspace.id,
-		name: workspace.name
-	};
-}
-async function loginWithSelectionFlow(context, useCases, options) {
-	const selection = await resolveLoginSelection(useCases, canPrompt(context) ? createSelectPromptPort(context) : null, options);
-	return useCases.login(selection);
-}
-async function resolveLoginSelection(useCases, prompt, options) {
-	const provider = options.provider ? (await useCases.resolveProvider(options.provider)).id : (await selectProvider(useCases, prompt)).id;
-	const user = options.user ? await useCases.resolveUserForProvider(provider, options.user) : await selectUser(useCases, prompt, provider);
-	const workspace = options.workspace ? await useCases.resolveWorkspaceForUser(user.id, options.workspace) : await selectWorkspace(useCases, prompt, user.id);
-	return {
-		provider,
-		userId: user.id,
-		workspaceId: workspace.id
-	};
-}
-async function selectProvider(useCases, prompt) {
-	if (!prompt) throw nonInteractiveLoginError("Re-run prisma-cli auth login in a TTY, or provide --provider and --user, and --workspace when required.");
-	const providers = await useCases.listProviders();
-	return prompt.select({
-		message: "Select a provider",
-		choices: providers.map((provider) => ({
-			label: provider.name,
-			value: provider
-		}))
-	});
-}
-async function selectUser(useCases, prompt, provider) {
-	const users = await useCases.listUsersForProvider(provider);
-	if (!prompt) throw nonInteractiveLoginError("Re-run prisma-cli auth login in a TTY, or provide --provider and --user, and --workspace when required.");
-	return prompt.select({
-		message: "Select a user",
-		choices: users.map((user) => ({
-			label: `${user.name} <${user.email}>`,
-			value: user
-		}))
-	});
-}
-async function selectWorkspace(useCases, prompt, userId) {
-	const workspaces = await useCases.listWorkspacesForUser(userId);
-	if (workspaces.length === 1) return workspaces[0];
-	if (!prompt) throw usageError("Login requires explicit selectors in non-interactive mode", "The selected mock user belongs to more than one workspace and the shell cannot prompt in the current mode.", "Re-run prisma-cli auth login in a TTY, or provide --workspace.", ["prisma-cli auth login"], "auth");
-	return prompt.select({
-		message: "Select a workspace",
-		choices: workspaces.map((workspace) => ({
-			label: `${workspace.name} (${workspace.id})`,
-			value: workspace
-		}))
-	});
-}
-function nonInteractiveLoginError(fix) {
-	return usageError("Login requires explicit selectors in non-interactive mode", "The fixture mode cannot prompt in the current mode.", fix, ["prisma-cli auth login"], "auth");
-}
 function createAuthSuccess(command, result, nextSteps) {
 	return {
 		command,
@@ -312,5 +97,28 @@ function createAuthSuccess(command, result, nextSteps) {
 		nextSteps
 	};
 }
+async function resolveAgentSetupTipCommand(context) {
+	if (context.flags.json || context.flags.quiet) return null;
+	if (context.runtime.env.CI && context.flags.interactive !== true) return null;
+	if (!context.runtime.stderr.isTTY && context.flags.interactive !== true) return null;
+	const setupCwd = await resolvePrismaAgentSetupCwd({
+		cwd: context.runtime.cwd,
+		signal: context.runtime.signal
+	});
+	if (!await isLikelyProjectDirectory({
+		cwd: setupCwd,
+		signal: context.runtime.signal
+	})) return null;
+	if (!shouldOfferPrismaAgentSetup(await readPrismaAgentSetupStatus({
+		cwd: setupCwd,
+		stateStore: context.stateStore,
+		signal: context.runtime.signal
+	}))) return null;
+	return await resolvePrismaCliPackageCommand({
+		cwd: setupCwd,
+		signal: context.runtime.signal,
+		args: PRISMA_AGENT_INSTALL_ARGS
+	});
+}
 //#endregion
 export { requireAuthenticatedAuthState, runAuthLogin, runAuthLogout, runAuthWhoAmI, runAuthWorkspaceList, runAuthWorkspaceLogout, runAuthWorkspaceUse };

package/dist/controllers/branch.js

@@ -1,38 +1,27 @@
-import { CliError, authRequiredError, workspaceRequiredError } from "../shell/errors.js";
+import { CliError, authRequiredError, workspaceRequiredError } from "../errors.js";
+import { authenticatedManagementApiClient } from "../auth/guard.js";
 import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
-import { requireComputeAuth } from "../lib/auth/guard.js";
-import { createCliUseCaseGateways } from "../use-cases/create-cli-gateways.js";
 import { requireAuthenticatedAuthState } from "./auth.js";
 import { listRealWorkspaceProjects } from "./project.js";
-import { createBranchUseCases } from "../use-cases/branch.js";
 //#region src/controllers/branch.ts
-function isRealMode(context) {
-	return !context.runtime.fixturePath && !context.runtime.env.PRISMA_CLI_MOCK_FIXTURE_PATH;
-}
 async function runBranchList(context) {
-	if (isRealMode(context)) return {
-		command: "branch.list",
-		result: await listRealBranches(context),
-		warnings: [],
-		nextSteps: []
-	};
 	return {
 		command: "branch.list",
-		result: await createBranchUseCases(createCliUseCaseGateways(context)).list(),
+		result: await listRealBranches(context),
 		warnings: [],
 		nextSteps: []
 	};
 }
 async function listRealBranches(context) {
 	const authState = await requireAuthenticatedAuthState(context);
-	const client = await requireComputeAuth(context.runtime.env, context.runtime.signal);
+	const client = await authenticatedManagementApiClient(context.runtime.env, context.runtime.signal);
 	if (!client) throw authRequiredError(["prisma-cli auth login"]);
 	const workspace = authState.workspace;
 	if (!workspace) throw workspaceRequiredError();
 	const targetResult = await resolveProjectTarget({
 		context,
 		workspace,
-		listProjects: () => listRealWorkspaceProjects(client, workspace, context.runtime.signal)
+		listProjects: () => listRealWorkspaceProjects(client, context.runtime.signal)
 	});
 	if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
 	const target = targetResult.value;

package/dist/controllers/bucket.js

@@ -0,0 +1,184 @@
+import { CliError, authRequiredError, workspaceRequiredError } from "../errors.js";
+import { authenticatedManagementApiClient } from "../auth/guard.js";
+import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
+import { requireAuthenticatedAuthState } from "./auth.js";
+import { listRealWorkspaceProjects } from "./project.js";
+import { createManagementBucketProvider } from "../lib/bucket/provider.js";
+//#region src/controllers/bucket.ts
+async function runBucketList(context, flags) {
+	const { provider, target } = await requireBucketContext(context, flags, "bucket list");
+	const buckets = await provider.listBuckets({
+		projectId: target.project.id,
+		branchName: flags.branchName,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.list",
+		result: {
+			projectId: target.project.id,
+			projectName: target.project.name,
+			branchName: flags.branchName ?? null,
+			verboseContext: target,
+			buckets
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketCreate(context, flags) {
+	const { provider, target } = await requireBucketContext(context, flags, "bucket create");
+	const bucket = await provider.createBucket({
+		projectId: target.project.id,
+		name: flags.name?.trim() || void 0,
+		branchGitName: flags.branchName,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.create",
+		result: {
+			projectId: target.project.id,
+			projectName: target.project.name,
+			verboseContext: target,
+			bucket
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketDelete(context, bucketId, flags) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket deletion needs a bucket id.",
+		fix: "Pass the bucket id to delete.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	if (flags.confirm !== id) throw new CliError({
+		code: "CONFIRMATION_REQUIRED",
+		domain: "bucket",
+		summary: "Confirm bucket deletion",
+		why: "Deleting this bucket permanently removes all objects and access keys.",
+		fix: `Rerun with --confirm ${id}.`,
+		exitCode: 2,
+		nextSteps: [`prisma-cli bucket delete ${id} --confirm ${id}`],
+		meta: {
+			expectedConfirm: id,
+			receivedConfirm: flags.confirm ?? null
+		}
+	});
+	await (await requireBucketProviderOnly(context)).deleteBucket(id, { signal: context.runtime.signal });
+	return {
+		command: "bucket.delete",
+		result: { bucket: { id } },
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyList(context, bucketId) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket key listing needs a bucket id.",
+		fix: "Pass the bucket id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	return {
+		command: "bucket.key.list",
+		result: {
+			bucketId: id,
+			keys: await (await requireBucketProviderOnly(context)).listKeys(id, { signal: context.runtime.signal })
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyCreate(context, bucketId, flags) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket key creation needs a bucket id.",
+		fix: "Pass the bucket id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	const role = resolveKeyRole(flags.role);
+	const created = await (await requireBucketProviderOnly(context)).createKey({
+		bucketId: id,
+		name: flags.name?.trim() || void 0,
+		role,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.key.create",
+		result: {
+			bucketId: id,
+			key: created.key,
+			secretAccessKey: created.secretAccessKey,
+			accessKeyId: created.accessKeyId,
+			endpoint: created.endpoint,
+			bucketName: created.bucketName
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyDelete(context, bucketId, keyId) {
+	const bktId = bucketId.trim();
+	const kId = keyId.trim();
+	if (!bktId || !kId) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id and key id required",
+		why: "Bucket key deletion needs both a bucket id and a key id.",
+		fix: "Pass the bucket id and key id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket key list <bucketId>"]
+	});
+	await (await requireBucketProviderOnly(context)).deleteKey(bktId, kId, { signal: context.runtime.signal });
+	return {
+		command: "bucket.key.delete",
+		result: { key: { id: kId } },
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function resolveBucketProvider(context) {
+	const client = await authenticatedManagementApiClient(context.runtime.env, context.runtime.signal);
+	if (!client) throw authRequiredError();
+	return createManagementBucketProvider(client);
+}
+async function requireBucketContext(context, flags, commandName) {
+	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
+	if (!workspace) throw workspaceRequiredError();
+	const client = await authenticatedManagementApiClient(context.runtime.env, context.runtime.signal);
+	if (!client) throw authRequiredError();
+	const targetResult = await resolveProjectTarget({
+		context,
+		workspace,
+		explicitProject: flags.projectRef,
+		listProjects: () => listRealWorkspaceProjects(client, context.runtime.signal),
+		commandName
+	});
+	if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
+	return {
+		provider: createManagementBucketProvider(client),
+		target: targetResult.value
+	};
+}
+async function requireBucketProviderOnly(context) {
+	await requireAuthenticatedAuthState(context);
+	return resolveBucketProvider(context);
+}
+function resolveKeyRole(role) {
+	return role === "read" ? "read" : "read_write";
+}
+//#endregion
+export { runBucketCreate, runBucketDelete, runBucketKeyCreate, runBucketKeyDelete, runBucketKeyList, runBucketList };

package/dist/controllers/build.js

@@ -0,0 +1,88 @@
+import { CliError, authRequiredError } from "../errors.js";
+import { authenticatedManagementApiClient } from "../auth/guard.js";
+import { writeJsonEvent } from "../shell/output.js";
+//#region src/controllers/build.ts
+async function runBuildLogs(context, buildId, options = {}) {
+	const client = await authenticatedManagementApiClient(context.runtime.env, context.runtime.signal);
+	if (!client) throw authRequiredError(["prisma-cli auth login"]);
+	if (!context.flags.json && !context.flags.quiet) context.output.stderr.write(`build logs → Streaming logs for build ${buildId}\n\n`);
+	const { data, response } = await client.GET("/v1/builds/{buildId}/logs", {
+		params: {
+			path: { buildId },
+			query: {
+				...options.follow ? { follow: "true" } : {},
+				...options.cursor ? { cursor: options.cursor } : {}
+			}
+		},
+		parseAs: "stream",
+		signal: context.runtime.signal
+	});
+	const body = data;
+	if (!response.ok || !body) throw buildLogsRequestError(buildId, response.status);
+	let sawError = false;
+	await forEachNdjsonRecord(body, (record) => {
+		if (record.type === "terminal" && record.kind === "error") sawError = true;
+		writeBuildLogRecord(context, record);
+	});
+	if (sawError) process.exitCode = 1;
+}
+function writeBuildLogRecord(context, record) {
+	if (context.flags.json) {
+		writeJsonEvent(context.output, {
+			type: record.type,
+			command: "build.logs",
+			timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+			data: record
+		});
+		return;
+	}
+	if (record.type === "log") {
+		const stream = record.source === "stderr" || record.level === "error" ? context.output.stderr : context.output.stdout;
+		stream.write(record.text);
+		if (!record.text.endsWith("\n")) stream.write("\n");
+		return;
+	}
+	if (record.code !== "end") context.output.stderr.write(`${record.message}\n`);
+}
+/** Reads a newline-delimited JSON body line by line, parsing each into a record. */
+async function forEachNdjsonRecord(body, onRecord) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (value) buffer += decoder.decode(value, { stream: true });
+		let newlineIndex = buffer.indexOf("\n");
+		while (newlineIndex !== -1) {
+			const line = buffer.slice(0, newlineIndex).trim();
+			buffer = buffer.slice(newlineIndex + 1);
+			if (line) onRecord(JSON.parse(line));
+			newlineIndex = buffer.indexOf("\n");
+		}
+		if (done) {
+			const tail = buffer.trim();
+			if (tail) onRecord(JSON.parse(tail));
+			return;
+		}
+	}
+}
+function buildLogsRequestError(buildId, status) {
+	if (status === 404) return new CliError({
+		code: "BUILD_NOT_FOUND",
+		domain: "app",
+		summary: `Build ${buildId} was not found`,
+		why: "The build does not exist, or your workspace does not have access to it.",
+		fix: "Check the build id, or run prisma-cli auth login to switch to the workspace that owns it.",
+		exitCode: 1
+	});
+	return new CliError({
+		code: "BUILD_LOGS_FAILED",
+		domain: "app",
+		summary: `Failed to read logs for build ${buildId}`,
+		why: `The Management API returned HTTP ${status}.`,
+		fix: "Retry the command, or rerun with --trace for more detail.",
+		exitCode: 1
+	});
+}
+//#endregion
+export { runBuildLogs };