fix(db): validate database name length before create (#126)

* fix(db): validate database name length before create

* validate inline values

* tidy comments

Author: jamie-at-bunny

.changeset/shaky-horses-like.md

@@ -0,0 +1,5 @@
+---
+"@bunny.net/cli": patch
+---
+
+fix(db): validate database name length before create

AGENTS.md

@@ -1309,7 +1309,7 @@ The manifest path mirrors `bunny scripts link` — both write to `.bunny/<resour
 
 **Lifecycle integration:**
 
-- `bunny db create` — after creating the database, prompts "Link this directory to <name>?" and (on yes) writes the manifest. If a link already exists it shows what will be replaced. The follow-up flow (link → token → save-env) exposes three flags for non-interactive control: `--link`/`--no-link`, `--token`/`--no-token`, `--save-env`/`--no-save-env`. When a flag is provided the prompt is skipped; in `--output json` mode prompts are suppressed entirely so flags become the only way to opt in. The JSON output then includes `linked`, `token`, and `saved_to_env` fields reflecting what happened.
+- `bunny db create` — the name is validated client-side against `DB_NAME_MAX_LENGTH` (16) before any API call, since longer names make the backend 500 instead of returning a validation error. After creating the database, prompts "Link this directory to <name>?" and (on yes) writes the manifest. If a link already exists it shows what will be replaced. The follow-up flow (link → token → save-env) exposes three flags for non-interactive control: `--link`/`--no-link`, `--token`/`--no-token`, `--save-env`/`--no-save-env`. When a flag is provided the prompt is skipped; in `--output json` mode prompts are suppressed entirely so flags become the only way to opt in. The JSON output then includes `linked`, `token`, and `saved_to_env` fields reflecting what happened.
 - `bunny db delete` — after deleting the database, if `.bunny/database.json` points at the deleted ID it is removed silently via `removeManifest()` (no prompt — a manifest pointing at a deleted DB is unambiguously stale).
 
 ### `bunny.jsonc` (app config)

packages/cli/src/commands/db/constants.ts

@@ -13,6 +13,9 @@ export const DATABASE_MANIFEST = "database.json";
 /** Page size used when paginating the database list endpoint. */
 export const DB_PAGE_SIZE = 100;
 
+/** Maximum length the backend accepts for a database name. */
+export const DB_NAME_MAX_LENGTH = 16;
+
 /** Default lifetime for tokens minted by `db shell` / `db studio`. */
 export const TOKEN_TTL_MINUTES = 30;
 

packages/cli/src/commands/db/create.ts

@@ -14,6 +14,7 @@ import { fetchRegionConfig, generateToken } from "./api.ts";
 import {
   DATABASE_MANIFEST,
   type DatabaseManifest,
+  DB_NAME_MAX_LENGTH,
   ENV_DATABASE_AUTH_TOKEN,
   ENV_DATABASE_URL,
 } from "./constants.ts";
@@ -33,6 +34,14 @@ async function getCdnServerToken(): Promise<string | null> {
   }
 }
 
+/** Validate a database name; returns an error message, or null when valid. */
+function validateDbName(name: string): string | null {
+  if (name.length > DB_NAME_MAX_LENGTH) {
+    return `Database name must be ${DB_NAME_MAX_LENGTH} characters or fewer (got ${name.length}).`;
+  }
+  return null;
+}
+
 const COMMAND = "create";
 const DESCRIPTION = "Create a new database.";
 
@@ -138,10 +147,13 @@ export const dbCreateCommand = defineCommand<CreateArgs>({
         type: "text",
         name: "value",
         message: "Database name:",
+        validate: (v: string) => validateDbName(v) ?? true,
       });
       name = value;
     }
     if (!name) throw new UserError("Database name is required.");
+    const nameError = validateDbName(name);
+    if (nameError) throw new UserError(nameError);
 
     // Fetch available regions from config
     const configSpin = spinner("Fetching available regions...");