fix(app): resolve the custom-domain production branch by role, not name

Custom-domain commands required a branch literally named `production`:
`toBranchKind` only treats `production`/`main` as production, and the flow
used the literal name "production". So a project whose production branch is
named e.g. `master` could never attach a custom domain — `domain add` looked
for a "production" branch, found none, and failed with "no app on the
production branch".

Resolve the production branch from the project's branches by role (the durable
default branch) and use its real name. The production-only gate now checks the
resolved branch's role instead of guessing from the name.

- read-branch.ts: extract listProjectBranches; add resolveProductionBranch
  (match an explicit --branch by name, else the production-role / default
  branch).
- resolveProjectContext: a `productionBranch` mode resolves by role.
- resolveAppDomainTarget: drop the early name-based gate; gate on the resolved
  branch's role after resolution.

Tests: the branch mock now marks the default branch as production role; new
coverage for a `master`-named production branch and for rejecting a real
preview branch by its role.

Author: AmanVarshney01

packages/cli/src/controllers/app.ts

@@ -86,7 +86,10 @@ import {
   runLocalApp,
 } from "../lib/app/local-dev";
 import { enforceProductionDeployGate } from "../lib/app/production-deploy-gate";
-import { resolveReadBranch } from "../lib/app/read-branch";
+import {
+  resolveProductionBranch,
+  resolveReadBranch,
+} from "../lib/app/read-branch";
 import { readAuthState } from "../lib/auth/auth-ops";
 import { getApiBaseUrl, SERVICE_TOKEN_ENV_VAR } from "../lib/auth/client";
 import { requireComputeAuth } from "../lib/auth/guard";
@@ -2050,17 +2053,6 @@ async function resolveAppDomainTarget(
     commandName.replace(/^app /, ""),
   );
   const branch = resolveDomainBranch(options?.branchName);
-  if (toBranchKind(branch.name) !== "production") {
-    throw new CliError({
-      code: "BRANCH_NOT_DEPLOYABLE",
-      domain: "branch",
-      summary: "Custom domains require the production branch",
-      why: `Custom domains on preview branch "${branch.name}" are not supported in Public Beta.`,
-      fix: "Use --branch production, or attach the domain after promoting/deploying to the production branch.",
-      exitCode: 2,
-      nextSteps: ["prisma-cli app domain add <hostname> --branch production"],
-    });
-  }
 
   const envProjectId = readDeployEnvOverride(
     context,
@@ -2071,10 +2063,27 @@ async function resolveAppDomainTarget(
   const { provider, target, projectId } =
     await requireProviderAndProjectContext(context, options?.projectRef, {
       branch,
+      // Domains attach to the production branch; resolve it by role (not by the
+      // literal name "production") so a project whose production branch is
+      // named e.g. `master` still works.
+      productionBranch: true,
       commandName,
       envProjectId,
       projectDir: compute.projectDir,
     });
+
+  // Gate on the resolved branch's role, not a guess from its name.
+  if (target.branch.kind !== "production") {
+    throw new CliError({
+      code: "BRANCH_NOT_DEPLOYABLE",
+      domain: "branch",
+      summary: "Custom domains require the production branch",
+      why: `Custom domains on preview branch "${target.branch.name}" are not supported in Public Beta.`,
+      fix: "Use --branch <production-branch>, or attach the domain after promoting/deploying to the production branch.",
+      exitCode: 2,
+      nextSteps: ["prisma-cli app domain add <hostname>"],
+    });
+  }
   const apps = await listApps(context, provider, projectId, target.branch.name);
   const selectedApp = await resolveDomainAppSelection(
     context,
@@ -2111,7 +2120,9 @@ function resolveDomainBranch(
 ): ResolvedDeployBranch {
   return {
     name: explicitBranchName?.trim() || "production",
-    annotation: explicitBranchName ? "set by --branch" : "production default",
+    annotation: explicitBranchName
+      ? BRANCH_FLAG_ANNOTATION
+      : "production default",
   };
 }
 
@@ -3188,6 +3199,7 @@ async function requireProviderAndProjectContext(
   explicitProject: string | undefined,
   options?: {
     branch?: ResolvedDeployBranch;
+    productionBranch?: boolean;
     commandName?: string;
     envProjectId?: string;
     projectDir?: string;
@@ -3252,6 +3264,7 @@ async function resolveProjectContext(
   explicitProject: string | undefined,
   options?: {
     branch?: ResolvedDeployBranch;
+    productionBranch?: boolean;
     commandName?: string;
     envProjectId?: string;
     projectDir?: string;
@@ -3283,6 +3296,28 @@ async function resolveProjectContext(
   const requested =
     options?.branch ?? (await resolveDeployBranch(context, undefined));
 
+  const fallback = {
+    id: null,
+    name: requested.name,
+    kind: toBranchKind(requested.name),
+  };
+
+  if (options?.productionBranch) {
+    // Production-only commands (custom domains) target the production branch.
+    // Resolve it by role so a project whose production branch is named e.g.
+    // `master` still resolves, instead of guessing from the literal name. An
+    // explicit --branch is matched by name so the caller can validate its role.
+    const production = await resolveProductionBranch(client, {
+      projectId: resolved.project.id,
+      branchName:
+        options.branch?.annotation === BRANCH_FLAG_ANNOTATION
+          ? requested.name
+          : undefined,
+      signal: context.runtime.signal,
+    });
+    return { ...resolved, branch: production ?? fallback };
+  }
+
   // An explicit --branch is honored as-is. An inferred branch (active Git
   // branch or the default) is resolved against the project's branches and
   // falls back to the default branch so a git-push app on a non-`main`
@@ -3295,14 +3330,7 @@ async function resolveProjectContext(
         signal: context.runtime.signal,
       });
 
-  return {
-    ...resolved,
-    branch: remoteBranch ?? {
-      id: null,
-      name: requested.name,
-      kind: toBranchKind(requested.name),
-    },
-  };
+  return { ...resolved, branch: remoteBranch ?? fallback };
 }
 
 async function resolveDeployProjectContext(
@@ -3632,6 +3660,9 @@ function assertExclusiveDeployProjectInputs(options: {
   );
 }
 
+/** Branch annotation marking a branch the user named via `--branch`. */
+const BRANCH_FLAG_ANNOTATION = "set by --branch";
+
 interface ResolvedDeployBranch {
   name: string;
   annotation: string;
@@ -3644,7 +3675,7 @@ async function resolveDeployBranch(
   if (explicitBranchName) {
     return {
       name: explicitBranchName,
-      annotation: "set by --branch",
+      annotation: BRANCH_FLAG_ANNOTATION,
     };
   }
 

packages/cli/src/lib/app/read-branch.ts

@@ -8,15 +8,18 @@ export interface ReadBranch {
   kind: BranchKind;
 }
 
+interface ProjectBranch extends ReadBranch {
+  isDefault: boolean;
+}
+
 /**
- * Resolves the branch an app management command should read from, without ever
- * creating one. Returns the branch whose `gitName` matches `branchName`, else
- * the project's default branch, else null when the project has no branches.
+ * Lists every branch in a project, following pagination. Management commands
+ * read branch context against this list so they never create a branch.
  */
-export async function resolveReadBranch(
+export async function listProjectBranches(
   client: ManagementApiClient,
-  options: { projectId: string; branchName: string; signal?: AbortSignal },
-): Promise<ReadBranch | null> {
+  options: { projectId: string; signal?: AbortSignal },
+): Promise<ProjectBranch[]> {
   const branches: Array<{
     id: string;
     gitName: string;
@@ -42,11 +45,62 @@ export async function resolveReadBranch(
       : undefined;
   } while (cursor);
 
+  return branches.map((branch) => ({
+    id: branch.id,
+    name: branch.gitName,
+    kind: branch.role,
+    isDefault: branch.isDefault,
+  }));
+}
+
+/**
+ * Resolves the branch an app management command should read from, without ever
+ * creating one. Returns the branch whose name matches `branchName`, else the
+ * project's default branch, else null when the project has no branches.
+ */
+export async function resolveReadBranch(
+  client: ManagementApiClient,
+  options: { projectId: string; branchName: string; signal?: AbortSignal },
+): Promise<ReadBranch | null> {
+  const branches = await listProjectBranches(client, {
+    projectId: options.projectId,
+    signal: options.signal,
+  });
+  const chosen =
+    branches.find((branch) => branch.name === options.branchName) ??
+    branches.find((branch) => branch.isDefault) ??
+    null;
+  return chosen
+    ? { id: chosen.id, name: chosen.name, kind: chosen.kind }
+    : null;
+}
+
+/**
+ * Resolves a project's production branch by role, not by name. The production
+ * branch is the durable default branch; resolving it from the API keeps
+ * production-only commands (custom domains) working when that branch is named
+ * something other than `production` or `main` (for example `master`).
+ *
+ * When `branchName` is given (an explicit `--branch`), that branch is matched
+ * first so the caller can validate its role; otherwise the production-role
+ * branch (falling back to the default branch) is returned.
+ */
+export async function resolveProductionBranch(
+  client: ManagementApiClient,
+  options: { projectId: string; branchName?: string; signal?: AbortSignal },
+): Promise<ReadBranch | null> {
+  const branches = await listProjectBranches(client, {
+    projectId: options.projectId,
+    signal: options.signal,
+  });
   const chosen =
-    branches.find((branch) => branch.gitName === options.branchName) ??
+    (options.branchName
+      ? branches.find((branch) => branch.name === options.branchName)
+      : undefined) ??
+    branches.find((branch) => branch.kind === "production") ??
     branches.find((branch) => branch.isDefault) ??
     null;
   return chosen
-    ? { id: chosen.id, name: chosen.gitName, kind: chosen.role }
+    ? { id: chosen.id, name: chosen.name, kind: chosen.kind }
     : null;
 }

packages/cli/tests/app-controller.test.ts

@@ -73,7 +73,7 @@ function expectedAppVerboseContext() {
     branch: {
       id: "branch_main",
       name: "main",
-      kind: "preview",
+      kind: "production",
     },
     resolution: {
       projectSource: "local-pin",
@@ -791,7 +791,7 @@ describe("app controller", () => {
         name: "Acme Dashboard",
       },
       branch: {
-        name: "production",
+        name: "main",
         kind: "production",
       },
       app: {
@@ -1336,6 +1336,15 @@ describe("app controller", () => {
   });
 
   it("domain add rejects preview branches", async () => {
+    const requireComputeAuth = vi.fn().mockResolvedValue(
+      createProjectClient("proj_123", {
+        extraBranches: [{ name: "feat/login", role: "preview" }],
+      }),
+    );
+    vi.doMock("../src/lib/auth/guard", () => ({
+      requireComputeAuth,
+    }));
+
     const { createTempCwd, createTestCommandContext } = await import(
       "./helpers"
     );
@@ -1351,6 +1360,8 @@ describe("app controller", () => {
       },
     });
 
+    // The project's production branch is `main`; `feat/login` is a real preview
+    // branch, so resolving it by role rejects the domain on its actual role.
     await expect(
       runAppDomainAdd(context, "shop.acme.com", {
         projectRef: "proj_123",
@@ -1364,6 +1375,76 @@ describe("app controller", () => {
     });
   });
 
+  it("resolves the production branch by role when it is named master", async () => {
+    const requireComputeAuth = vi
+      .fn()
+      .mockResolvedValue(
+        createProjectClient("proj_123", { defaultBranchName: "master" }),
+      );
+    const activeDomain = createDomain({ status: "active" });
+    const listApps = vi.fn().mockResolvedValue([
+      {
+        id: "app_1",
+        name: "shop",
+        region: "eu-central-1",
+        liveDeploymentId: "dep_live",
+        liveUrl: "https://shop.prisma.app",
+      },
+    ]);
+    const addDomain = vi
+      .fn()
+      .mockResolvedValue({ domain: activeDomain, existing: true });
+
+    vi.doMock("../src/lib/auth/guard", () => ({
+      requireComputeAuth,
+    }));
+    vi.doMock("../src/lib/app/app-provider", async (importOriginal) => {
+      const actual =
+        await importOriginal<typeof import("../src/lib/app/app-provider")>();
+      return {
+        ...actual,
+        createAppProvider: vi.fn(() =>
+          withBranchDatabaseProviderDefaults({
+            resolveBranch: createResolveBranch(),
+            listApps,
+            listDomains: vi.fn(),
+            addDomain,
+            retryDomain: vi.fn(),
+          }),
+        ),
+      };
+    });
+
+    const { createTempCwd, createTestCommandContext } = await import(
+      "./helpers"
+    );
+    const { runAppDomainAdd } = await import("../src/controllers/app");
+    const cwd = await createTempCwd();
+    const stateDir = path.join(cwd, ".state");
+    const { context } = await createTestCommandContext({
+      cwd,
+      stateDir,
+      env: {
+        ...process.env,
+        PRISMA_CLI_MOCK_FIXTURE_PATH: undefined,
+      },
+    });
+
+    // No --branch: the production branch is resolved by role, so the domain is
+    // added on `master` instead of failing because no branch is named
+    // "production".
+    const result = await runAppDomainAdd(context, "shop.acme.com", {
+      projectRef: "proj_123",
+      appName: "shop",
+    });
+
+    expect(addDomain).toHaveBeenCalled();
+    expect(result.result).toMatchObject({
+      branch: { name: "master", kind: "production" },
+      domain: { hostname: "shop.acme.com" },
+    });
+  });
+
   it("domain retry maps API 409 to DOMAIN_RETRY_NOT_ELIGIBLE", async () => {
     const requireComputeAuth = vi.fn().mockResolvedValue(createProjectClient());
     const listApps = vi.fn().mockResolvedValue([