feat(cli): require --confirm for bucket delete and document cascade deletion

[sorenbs]

Purpose of change

Bucket deletion now cascades (the Management API force-deletes all stored objects and revokes all access keys), so the CLI must guard against accidental data loss with the same --confirm <id> gate that database remove already uses.

What's changed and why

• controllers/bucket.ts: runBucketDelete now accepts a BucketDeleteFlags parameter with confirm?: string. Before calling the provider it checks flags.confirm !== id and throws CONFIRMATION_REQUIRED (exit 2) with meta: { expectedConfirm, receivedConfirm } — matching the database remove error shape exactly.
• commands/bucket/index.ts: createBucketDeleteCommand wires a --confirm <bucket-id> option and passes it through to the controller.
• tests/bucket.test.ts: Updated the two existing delete tests to include --confirm; added tests for missing confirm (null receivedConfirm) and mismatched confirm.
• docs/product/command-spec.md: bucket delete heading now shows --confirm <bucketId>; behavior section replaces the empty-bucket limitation note with cascade semantics and the confirmation requirement.
• docs/product/resource-model.md: Object Store section updated to describe cascade deletion and the --confirm guard.

Testing notes / Before-after

Before: prisma-cli bucket delete bkt_123 succeeded immediately.
After: same command exits 2 with CONFIRMATION_REQUIRED; must pass --confirm bkt_123.

Verify manually:

1. prisma-cli bucket delete bkt_123 → exit 2, error CONFIRMATION_REQUIRED
2. prisma-cli bucket delete bkt_123 --confirm bkt_456 → exit 2, receivedConfirm: "bkt_456"
3. prisma-cli bucket delete bkt_123 --confirm bkt_123 → exit 0, success

Notes for reviewers:

• The cascade behavior (force=true on the Tigris partner API) is gated on a pdp-control-plane PR landing first. The CLI change is safe to merge independently — it guards deletion regardless of whether the platform side has landed.
• Breaking change: any script passing bucket delete <id> without --confirm will now exit 2. This is intentional and matches database remove precedent.
• bucket key delete does not get a --confirm flag — keys are individually revocable and don't cascade to other resources, so the guard would be disproportionate.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 25efbdd8-7c02-4001-a880-de8661fa3cd9

📥 Commits

Reviewing files that changed from the base of the PR and between a098ccd and 7e15a66.

📒 Files selected for processing (1)

• packages/cli/tests/bucket.test.ts

---

Summary by CodeRabbit

• New Features

  • Added an explicit --confirm <bucket-id> requirement to bucket delete commands.
  • Updated bucket deletion to be cascading: removes stored objects and revokes access keys before destroying the bucket.
  • Added clear errors when confirmation is missing or does not match the bucket ID.

• Documentation

  • Updated bucket delete command usage and examples to include --confirm.
  • Refreshed documented deletion semantics and revised described failure modes accordingly.

Walkthrough

The bucket delete command now accepts --confirm <bucket-id> and requires an exact match with the positional bucket ID. The controller returns structured confirmation errors for missing or mismatched values. Tests cover confirmation validation and preserve the unknown-bucket error path. Product documentation now describes cascading deletion of objects and access keys and updates command examples.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main CLI confirmation change and the related deletion documentation update.
Description check	✅ Passed	The description is directly related to the bucket delete confirmation and cascade-deletion changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/bucket-delete-confirm

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/bucket-delete-confirm

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/tests/bucket.test.ts`:
- Around line 220-264: The bucket deletion tests only validate the error
payload, not that the bucket remains intact. Extend both rejected-confirmation
cases in the “requires --confirm…” and “rejects --confirm…” tests with a
post-failure existence or listing assertion, or mock the provider to verify
deleteBucket is not called, while preserving the existing payload and exit-code
assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8571cc2b-d252-4e3e-a489-167c9381f248

📥 Commits

Reviewing files that changed from the base of the PR and between b12c585 and a098ccd.

📒 Files selected for processing (5)

• docs/product/command-spec.md
• docs/product/resource-model.md
• packages/cli/src/commands/bucket/index.ts
• packages/cli/src/controllers/bucket.ts
• packages/cli/tests/bucket.test.ts

Finding fixed in 7e15a66.