naro-cli 0.17.0 → 0.19.0

package/dist/index.js

@@ -33,8 +33,10 @@ import {
   generateTypes,
   indexesFromRows,
   isBookmark,
+  isEnvTargetName,
   isExpired,
   isNaroError,
+  isReservedEnvTarget,
   isStalledBackend,
   isTerminalStatus,
   lintSchema,
@@ -42,11 +44,13 @@ import {
   loadPolicy,
   loadStoredSession,
   login,
+  maskEnvValue,
   migrationNameMismatch,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
+  parseDotenv,
   parseGitHubRemote,
   parsePolicyNode,
   parsePolicyStatement,
@@ -57,6 +61,7 @@ import {
   policiesLostByReset,
   projectPath,
   promptForMissingEnv,
+  pullEnv,
   quoteIdent,
   quotePolicyName,
   readProjectLink,
@@ -77,12 +82,16 @@ import {
   splitStatements,
   storedPolicySql,
   summarizeStatement,
+  summarizeTeamUsage,
+  suppliedToken,
   systemTablePredicate,
   tableNames,
   toNaroError,
   unreadablePolicyComment,
+  usageMonthOf,
+  userForAccessToken,
   writeProjectLink
-} from "./chunk-PYRN5XR6.js";
+} from "./chunk-DEEFHVDZ.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -121,7 +130,8 @@ var BOOLEAN_FLAGS = {
   "--empty": "empty",
   "--recursive": "recursive",
   "-r": "recursive",
-  "--upsert": "upsert"
+  "--upsert": "upsert",
+  "--no-branch": "noBranch"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -139,6 +149,7 @@ var STRING_FLAGS = {
   "--level": "level",
   "--metric": "metric",
   "--range": "range",
+  "--month": "month",
   "--route": "route",
   "--path": "path",
   "--referrer": "referrer",
@@ -175,7 +186,11 @@ var STRING_FLAGS = {
   "--file-size-limit": "fileSizeLimit",
   "--allowed-mime-types": "allowedMimeTypes",
   "--content-type": "contentType",
-  "--cache-control": "cacheControl"
+  "--cache-control": "cacheControl",
+  "--search": "search",
+  "--copy-env": "copyEnv",
+  "--database": "database",
+  "--protection": "protection"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -352,6 +367,17 @@ var Output = class {
 // src/prompt.ts
 import { createInterface } from "readline";
 import { Writable } from "stream";
+function confirmHint(defaultYes) {
+  return defaultYes ? "(Y/n)" : "(y/N)";
+}
+function readConfirmAnswer(answer, defaultYes) {
+  const normalized = answer.trim().toLowerCase();
+  if (normalized === "") return defaultYes;
+  if (normalized === "y" || normalized === "yes") return true;
+  if (!defaultYes) return false;
+  if (normalized === "n" || normalized === "no") return false;
+  return null;
+}
 function isInteractive() {
   return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
@@ -368,7 +394,7 @@ var TtyPrompter = class {
     });
     try {
       return await new Promise(
-        (resolve6) => rl.question(question, resolve6)
+        (resolve7) => rl.question(question, resolve7)
       );
     } finally {
       rl.close();
@@ -389,7 +415,7 @@ var TtyPrompter = class {
     });
     try {
       const answer = new Promise(
-        (resolve6) => rl.question(question, resolve6)
+        (resolve7) => rl.question(question, resolve7)
       );
       muted = true;
       const value = await answer;
@@ -399,9 +425,15 @@ var TtyPrompter = class {
       rl.close();
     }
   }
-  async confirm(question) {
-    const answer = (await this.ask(`${question} (y/N) `)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
+  async confirm(question, options = {}) {
+    const defaultYes = options.defaultYes ?? false;
+    for (; ; ) {
+      const read = readConfirmAnswer(
+        await this.ask(`${question} ${confirmHint(defaultYes)} `),
+        defaultYes
+      );
+      if (read !== null) return read;
+    }
   }
   async select(question, options) {
     process.stdout.write(`${question}
@@ -500,8 +532,8 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/commands/migration.ts
@@ -1107,22 +1139,31 @@ async function currentSession() {
   }
   return session;
 }
-async function runWhoami(context) {
-  const session = await currentSession();
-  const handle = session.user.github ? ` (${session.user.github})` : "";
+var SOURCE_LABEL = { flag: "--token", env: "NARO_TOKEN" };
+async function runWhoami(context, deps = { userForAccessToken }) {
+  const supplied = suppliedToken({ explicitToken: context.flags.token });
+  const user = supplied ? await deps.userForAccessToken(supplied.token) : (await currentSession()).user;
+  const handle = user.github ? ` (${user.github})` : "";
+  const via = supplied ? ` \u2014 from ${SOURCE_LABEL[supplied.source]}` : "";
   context.output.result(
     {
-      user: {
-        id: session.user.id,
-        email: session.user.email,
-        github: session.user.github
-      }
+      user: { id: user.id, email: user.email, github: user.github },
+      // The name and values MCP whoami already answers with.
+      tokenSource: supplied?.source ?? "session"
     },
-    [`Logged in as ${session.user.email ?? session.user.id}${handle}`]
+    [`Logged in as ${user.email ?? user.id}${handle}${via}`]
   );
 }
 async function runToken(context) {
-  const session = await currentSession();
+  const supplied = suppliedToken({ explicitToken: context.flags.token });
+  const session = await currentSession().catch((error) => {
+    if (supplied)
+      throw new NaroError(
+        "NOT_LOGGED_IN",
+        `\`naro token\` makes a token from a \`naro login\` session, and there is none here. ${SOURCE_LABEL[supplied.source]} is already a token: the other commands use it as is.`
+      );
+    throw error;
+  });
   process.stderr.write(
     "\u26A0 Access tokens expire after about an hour \u2014 generate one per CI run.\n"
   );
@@ -2504,7 +2545,7 @@ async function runDbLint(context) {
     (message) => context.output.warn(message)
   );
   const input = {
-    tables: tables.filter((table2) => !shadow.has(table2.name)),
+    tables: tables.filter((table3) => !shadow.has(table3.name)),
     foreignKeyCheck,
     quickCheck: quick.rows.map(firstCell),
     triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
@@ -2639,7 +2680,8 @@ async function policyPlan(client, projectId, schema, dir, files) {
       tables: schema.tables,
       files: files.map((name) => readFileSync3(join3(dir, name), "utf8")),
       // Storage's table stays; its policies are emptied with the rest (PR
-      // #85 리뷰).
+      // #85 리뷰). Realtime's messages need no flag: a virtual target, which
+      // reset-plan counts as a table always there (Realtime 3-2a).
       storage: schema.storageTable
     })
   };
@@ -3230,7 +3272,7 @@ function conditionsFrom(flags) {
     );
   return conditions;
 }
-function patchFromFile(context, path, table2) {
+function patchFromFile(context, path, table3) {
   let text;
   try {
     text = readFileSync4(resolve3(context.cwd, path), "utf8");
@@ -3252,9 +3294,9 @@ function patchFromFile(context, path, table2) {
   if (Object.hasOwn(body, "table")) {
     if (typeof named !== "string")
       refuse2(`${path}: table must be a string, the table's name.`);
-    if (table2 !== void 0 && asciiLower(named) !== asciiLower(table2))
+    if (table3 !== void 0 && asciiLower(named) !== asciiLower(table3))
       refuse2(
-        `${path} is the policy of ${printable(named)}, not ${printable(table2)}. Remove its "table" to set it on ${printable(table2)}.`
+        `${path} is the policy of ${printable(named)}, not ${printable(table3)}. Remove its "table" to set it on ${printable(table3)}.`
       );
   }
   const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
@@ -3267,7 +3309,7 @@ function patchFromFile(context, path, table2) {
 function asciiLower(text) {
   return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
 }
-function policyPatch(flags, context, table2) {
+function policyPatch(flags, context, table3) {
   if (flags.fromFile !== void 0) {
     if (OTHER_FLAGS.some(
       (key) => flags[key] !== void 0 && flags[key] !== false
@@ -3276,7 +3318,7 @@ function policyPatch(flags, context, table2) {
         "--from-file takes the whole policy: leave out the other policy options."
       );
     if (!context) refuse2(SET_USAGE);
-    return patchFromFile(context, flags.fromFile, table2);
+    return patchFromFile(context, flags.fromFile, table3);
   }
   const patch = {};
   for (const action of POLICY_ACTIONS) {
@@ -3415,7 +3457,7 @@ function policyTable(policies) {
   const widths = header.map(
     (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
   );
-  const table2 = [header, ...rows].map(
+  const table3 = [header, ...rows].map(
     (cells) => cells.map(
       (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
     ).join("  ").trimEnd()
@@ -3432,10 +3474,10 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table2;
+  if (lines.length === 0) return table3;
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
-    ...table2,
+    ...table3,
     "",
     ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
   ];
@@ -3452,39 +3494,39 @@ function statementLine(policy) {
     );
   return shownStatement(policy, policy.table, "naro policy list --json");
 }
-function policyNamed(name, table2) {
-  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table2))}`;
+function policyNamed(name, table3) {
+  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table3))}`;
 }
-function shownStatement(statement, table2, exact) {
+function shownStatement(statement, table3, exact) {
   if (isPrintable(statement.sql)) return statement.sql;
   return printable(
-    `-- ${policyNamed(statement.name, table2)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
+    `-- ${policyNamed(statement.name, table3)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
   );
 }
 function policyStatements(policies) {
   const lines = [];
-  let table2;
+  let table3;
   for (const policy of policies) {
-    if (table2 !== void 0 && policy.table !== table2) lines.push("");
-    table2 = policy.table;
+    if (table3 !== void 0 && policy.table !== table3) lines.push("");
+    table3 = policy.table;
     lines.push(statementLine(policy));
   }
   return lines;
 }
 async function runPolicyList(context) {
-  const table2 = context.flags.table;
+  const table3 = context.flags.table;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
-    table2 === void 0 ? {} : { table: table2 }
+    table3 === void 0 ? {} : { table: table3 }
   );
   let lines;
   if (policies.length > 0)
     lines = [...policyStatements(policies), "", DEFAULT_DENY];
-  else if (table2 !== void 0)
+  else if (table3 !== void 0)
     lines = [
-      `No policies on ${printable(table2)}: anon and signed-in requests to it are denied.`
+      `No policies on ${printable(table3)}: anon and signed-in requests to it are denied.`
     ];
   else
     lines = [
@@ -3580,17 +3622,17 @@ async function runPolicyCreate(context) {
 }
 async function runPolicyDrop(context) {
   const [name] = context.positionalOrThrow(1, DROP_USAGE);
-  const table2 = context.flags.table;
-  if (table2 === void 0 || table2 === "") refuse2(DROP_USAGE);
+  const table3 = context.flags.table;
+  if (table3 === void 0 || table3 === "") refuse2(DROP_USAGE);
   await confirmOrAbort(
     context,
-    `Drop policy ${printable(name)} on ${printable(table2)}? It stops applying within about 10 seconds.`
+    `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
-    table2,
+    table3,
     name
   );
   context.output.result({ projectId, dropped }, [
@@ -3598,13 +3640,13 @@ async function runPolicyDrop(context) {
   ]);
 }
 async function runPolicySet(context) {
-  const [table2] = context.positionalOrThrow(1, SET_USAGE);
-  const patch = policyPatch(context.flags, context, table2);
+  const [table3] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table3);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
-    table2,
+    table3,
     patch
   );
   let named;
@@ -3625,14 +3667,14 @@ async function runPolicySet(context) {
   );
 }
 async function runPolicyRemove(context) {
-  const [table2] = context.positionalOrThrow(1, REMOVE_USAGE);
+  const [table3] = context.positionalOrThrow(1, REMOVE_USAGE);
   await confirmOrAbort(
     context,
-    `Remove every policy on ${printable(table2)}? Anon and signed-in requests to it are denied from then on.`
+    `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policy = await client.backend.removePolicy(projectId, table2);
+  const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
   context.output.result({ projectId, removed: true, policy }, [
     names.length === 0 ? `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.` : `\u2705 Removed ${names.length === 1 ? "policy" : "policies"} ${names.map(printable).join(", ")} on ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
@@ -3719,14 +3761,14 @@ function parseColumnSpec(spec) {
       column.default = defaultValue(value);
     else if (value !== void 0 && key === "references") {
       const dot = value.lastIndexOf(".");
-      const table2 = dot < 0 ? "" : value.slice(0, dot);
+      const table3 = dot < 0 ? "" : value.slice(0, dot);
       const target = dot < 0 ? "" : value.slice(dot + 1);
-      if (!table2 || !target)
+      if (!table3 || !target)
         throw new NaroError(
           "VALIDATION_FAILED",
           `${shown}: references needs <table>.<column>.`
         );
-      column.references = { table: table2, column: target };
+      column.references = { table: table3, column: target };
     } else if (value !== void 0 && key === "ondelete") {
       onDelete = ON_DELETE[value.toLowerCase()];
       if (!onDelete)
@@ -3806,14 +3848,6 @@ function removedLines(policy, dryRun) {
   }
   return lines;
 }
-function removedBeforeFailure(error) {
-  if (!isNaroError(error)) return [];
-  const removed = error.details?.removedPolicies;
-  if (!Array.isArray(removed)) return [];
-  return removed.filter(
-    (entry) => typeof entry === "object" && entry !== null && typeof entry.table === "string" && entry.ownerColumn !== void 0
-  );
-}
 async function runSchemaChange(context, operations, question) {
   const dryRun = context.flags.dryRun === true;
   if (question !== void 0 && !dryRun)
@@ -3839,12 +3873,6 @@ async function runSchemaChange(context, operations, question) {
   const result = await client.db.schema(projectId, sent, {
     ...dryRun ? { dryRun: true } : {},
     name
-  }).catch((error) => {
-    if (!context.flags.json)
-      for (const policy of removedBeforeFailure(error))
-        for (const line of removedLines(policy, false))
-          context.output.warn(line);
-    throw error;
   });
   const sqlLines = result.sql.trimEnd().split("\n").map(printable);
   const removed = result.removedPolicies ?? [];
@@ -3905,16 +3933,16 @@ async function runDbIndexUsage() {
   throw new NaroError("VALIDATION_FAILED", USAGE2.index);
 }
 async function runDbTableCreate(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
-  if (!table2 || specs.length === 0)
+  if (!table3 || specs.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.create);
   const columns = specs.map(parseColumnSpec);
   const owner = context.flags.ownerColumn;
   await runSchemaChange(context, [
     {
       op: "createTable",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.ifNotExists ? { ifNotExists: true } : {},
       ...owner === void 0 ? {} : { owner: { column: owner } }
@@ -3922,56 +3950,56 @@ async function runDbTableCreate(context) {
   ]);
 }
 async function runDbTableAddColumn(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
   const [spec] = specs;
-  if (!table2 || spec === void 0 || specs.length !== 1)
+  if (!table3 || spec === void 0 || specs.length !== 1)
     throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
   await runSchemaChange(context, [
-    { op: "addColumn", table: table2, column: parseColumnSpec(spec) }
+    { op: "addColumn", table: table3, column: parseColumnSpec(spec) }
   ]);
 }
 async function runDbTableRenameColumn(context) {
-  const [table2, column, to] = context.positionals;
-  if (!table2 || !column || !to)
+  const [table3, column, to] = context.positionals;
+  if (!table3 || !column || !to)
     throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
-  await runSchemaChange(context, [{ op: "renameColumn", table: table2, column, to }]);
+  await runSchemaChange(context, [{ op: "renameColumn", table: table3, column, to }]);
 }
 async function runDbTableRename(context) {
-  const [table2, to] = context.positionals;
-  if (!table2 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
-  await runSchemaChange(context, [{ op: "renameTable", table: table2, to }]);
+  const [table3, to] = context.positionals;
+  if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
 async function runDbTableDropColumn(context) {
-  const [table2, column] = context.positionals;
-  if (!table2 || !column)
+  const [table3, column] = context.positionals;
+  if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
-  const target = `${table2}.${column}`;
+  const target = `${table3}.${column}`;
   await runSchemaChange(
     context,
-    [{ op: "dropColumn", table: table2, column, confirm: target }],
+    [{ op: "dropColumn", table: table3, column, confirm: target }],
     `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
-  const [table2] = context.positionals;
-  if (!table2) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const [table3] = context.positionals;
+  if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
   await runSchemaChange(
     context,
-    [{ op: "dropTable", table: table2, confirm: table2 }],
-    `Drop table ${printable(table2)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    [{ op: "dropTable", table: table3, confirm: table3 }],
+    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
-  const [table2, list] = context.positionals;
+  const [table3, list] = context.positionals;
   const columns = listFlag(list);
-  if (!table2 || columns.length === 0)
+  if (!table3 || columns.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
   const name = context.flags.name;
   await runSchemaChange(context, [
     {
       op: "createIndex",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.unique ? { unique: true } : {},
       ...name === void 0 ? {} : { name }
@@ -3988,7 +4016,7 @@ async function runDbIndexDrop(context) {
 var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -4043,6 +4071,13 @@ async function runGitConnect(context, overrides = {}) {
       `Naro cannot reach ${fullName}, and no install URL was offered. Connect it from the dashboard.`
     );
   }
+  if (cannotAsk(context)) {
+    throw new NaroError(
+      "REPOSITORY_NOT_ACCESSIBLE",
+      `Naro cannot reach ${fullName} yet. Install the Naro GitHub App at ${first.installUrl}, then run: naro git connect`,
+      { details: { projectId, installUrl: first.installUrl } }
+    );
+  }
   output.log(`
 \u25B8 Naro needs access to ${fullName}.`);
   output.log(`  Opening ${first.installUrl}`);
@@ -4189,7 +4224,8 @@ async function resolveTeam(context, teams, deps = {}) {
     context.output.log(`
    ${account} \u2192 ${label3}`);
     const ok = await context.prompter.confirm(
-      "Deploy to this account and team?"
+      "Deploy to this account and team?",
+      { defaultYes: true }
     );
     if (ok) return only;
     return switchAndRetry(context, deps);
@@ -4296,10 +4332,30 @@ async function runUnlink(context) {
 }
 
 // src/commands/deploy.ts
+function deployTarget(flags) {
+  if (flags.env === void 0)
+    return { production: flags.prod, environment: void 0 };
+  if (flags.env === "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production, preview or an environment name."
+    );
+  if (flags.prod)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env and --prod cannot be used together."
+    );
+  if (flags.env === "production")
+    return { production: true, environment: void 0 };
+  if (flags.env === "preview")
+    return { production: false, environment: void 0 };
+  return { production: false, environment: flags.env };
+}
 async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
   const { flags, output } = context;
+  const target = deployTarget(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
-  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
+  if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
@@ -4319,10 +4375,20 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
       teamSlug: team.slug,
       rootDirectory: flags.root ?? null,
       branch: flags.branch,
-      production: flags.prod,
+      production: target.production,
+      ...target.environment !== void 0 && {
+        environment: target.environment
+      },
       ...canPrompt && {
         onMissingEnv: (keys) => promptForMissingEnv(
-          { cwd: context.cwd, prompter: context.prompter, output },
+          {
+            cwd: context.cwd,
+            prompter: context.prompter,
+            output,
+            ...target.environment !== void 0 && {
+              environment: target.environment
+            }
+          },
           keys
         )
       },
@@ -4349,20 +4415,22 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
     teamSlug: result.teamSlug
   });
   const inspect = `${controlPlaneUrl()}${projectPath(result.teamSlug, result.projectSlug)}`;
+  const surface = result.environment ?? (result.production ? "production" : "preview");
   context.output.result(
     {
       deploymentId: result.deploymentId,
       projectId: result.projectId,
       status: result.status,
       url: result.url,
-      target: result.production ? "production" : "preview",
+      target: surface,
+      environment: result.environment ?? null,
       teamSlug: result.teamSlug,
       inspectUrl: inspect,
       missingEnvKeys: result.missingEnvKeys
     },
     [
       "",
-      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
+      `\u2705 Deployment ready (${surface})`,
       "",
       `   ${result.url}`,
       `   Inspect  ${inspect}`
@@ -4476,7 +4544,7 @@ async function runInspect(context) {
 
 // src/commands/domains.ts
 var defaults3 = {
-  sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
   now: () => Date.now()
 };
 var FIRST_DELAY_MS = 5e3;
@@ -4774,18 +4842,29 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { existsSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
-var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
+import { chmodSync, existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve4 } from "path";
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var KEY_MAX_LENGTH = 256;
+var IMPORT_BATCH_SIZE = 100;
+var VALUE_MAX_BYTES = 5 * 1024;
+var TARGET_USAGE = "[production|preview|all|<environment>]";
+function validKey(key) {
+  return KEY_RE.test(key) && key.length <= KEY_MAX_LENGTH;
+}
+function isSecretKey(key) {
+  return !key.startsWith("NEXT_PUBLIC_");
+}
+function variables(count2) {
+  return `${String(count2)} variable${count2 === 1 ? "" : "s"}`;
+}
 function parseTarget(value) {
   if (value === void 0) return "all";
-  if (!TARGETS.has(value))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Environment must be production, preview or all."
-    );
-  return value;
+  if (isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "Target must be production, preview, all or an environment name."
+  );
 }
 function maskedValue(row) {
   if (!row.isSecret) return row.value ?? "";
@@ -4816,38 +4895,48 @@ async function runEnvList(context) {
   );
 }
 async function runEnvAdd(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env add KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env add KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
-  if (!key || !KEY_RE.test(key) || key.length > 256)
+  if (!key || !validKey(key))
     throw new NaroError(
       "VALIDATION_FAILED",
       "Keys must look like MY_VARIABLE (letters, digits, underscore)."
     );
   const target = parseTarget(targetArg);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const typed = process.stdin.isTTY === true;
+  if (typed) {
+    await client.projects.get(projectId);
+    if (!isReservedEnvTarget(target))
+      await client.environments.get(projectId, target);
+  }
   let value;
-  if (!process.stdin.isTTY) {
+  if (!typed) {
     value = await readStdin();
   } else {
     value = await context.prompter.askHidden(`? What's the value of ${key}? `);
   }
   if (value.length === 0)
     throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
-  const isSecret = !key.startsWith("NEXT_PUBLIC_");
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  await client.env.set(projectId, [{ key, value, target, isSecret }]);
-  context.output.result({ projectId, key, target, isSecret }, [
-    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  const isSecret = isSecretKey(key);
+  let saved = target;
+  try {
+    await client.env.set(projectId, [{ key, value, target, isSecret }]);
+  } catch (error) {
+    if (!typed || target !== "all" || !(error instanceof NaroError) || error.code !== "FORBIDDEN" || !await context.prompter.confirm(
+      `${error.message} Save ${key} for preview only?`
+    ))
+      throw error;
+    saved = "preview";
+    await client.env.set(projectId, [{ key, value, target: saved, isSecret }]);
+  }
+  context.output.result({ projectId, key, target: saved, isSecret }, [
+    `\u2705 Added ${key} (${saved}${isSecret ? ", secret" : ""})`
   ]);
 }
 async function runEnvRemove(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env remove KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env remove KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
   const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
   await confirmOrAbort(
@@ -4861,24 +4950,74 @@ async function runEnvRemove(context) {
     `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
   ]);
 }
-async function runEnvPull(context) {
-  const file = context.positionals[0] ?? ".env.local";
-  const surface = context.flags.env === "production" ? "production" : "preview";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+async function runEnvImport(context) {
+  context.positionalOrThrow(1, `Usage: naro env import <file> ${TARGET_USAGE}`);
+  const [file, targetArg] = context.positionals;
+  const target = parseTarget(targetArg);
+  let text;
+  try {
+    text = readFileSync5(resolve4(context.cwd, file), "utf8");
+  } catch {
+    throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
+  }
+  const vars = Object.entries(parseDotenv(text));
+  if (vars.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No variables found in ${file}.`);
+  const invalid = vars.map(([key]) => key).filter((key) => !validKey(key));
+  if (invalid.length > 0)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "--env must be production or preview."
+      `Invalid keys in ${file}: ${invalid.join(", ")}.`
+    );
+  const oversized = vars.filter(([, value]) => Buffer.byteLength(value, "utf8") > VALUE_MAX_BYTES).map(([key]) => key);
+  if (oversized.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Values over 5 KB in ${file}: ${oversized.join(", ")}.`
     );
-  const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const rows = await client.env.list(projectId, { reveal: true });
-  const selected = rows.filter(
-    (row) => row.target === "all" || row.target === surface
+  context.output.log(`Variables in ${file}:`);
+  for (const [key, value] of vars)
+    context.output.log(`  ${key.padEnd(32)} ${maskEnvValue(key, value)}`);
+  await confirmOrAbort(
+    context,
+    `Upload ${variables(vars.length)} to ${target}?`
   );
-  const vars = Object.fromEntries(
-    selected.map((row) => [row.key, row.value ?? ""])
+  const client = await context.client();
+  const entries = vars.map(([key, value]) => ({
+    key,
+    value,
+    target,
+    isSecret: isSecretKey(key)
+  }));
+  for (let start = 0; start < entries.length; start += IMPORT_BATCH_SIZE)
+    await client.env.set(
+      projectId,
+      entries.slice(start, start + IMPORT_BATCH_SIZE)
+    );
+  context.output.result({ projectId, file, target, count: entries.length }, [
+    `\u2705 Imported ${variables(entries.length)} (${target})`
+  ]);
+}
+function parsePullSurface(value) {
+  if (value === void 0) return "preview";
+  if (value !== "all" && isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--env must be production, preview or an environment name."
   );
-  const path = join5(context.cwd, file);
+}
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = parsePullSurface(context.flags.env);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (!isReservedEnvTarget(surface))
+    await client.environments.get(projectId, surface);
+  const rows = await client.env.list(projectId, { reveal: true });
+  const vars = pullEnv(rows, surface);
+  const count2 = Object.keys(vars).length;
+  const path = resolve4(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -4889,15 +5028,143 @@ async function runEnvPull(context) {
 ${serializeDotenv(vars)}`,
     { mode: 384 }
   );
-  context.output.result(
-    { projectId, file, environment: surface, count: selected.length },
-    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+  chmodSync(path, 384);
+  context.output.result({ projectId, file, environment: surface, count: count2 }, [
+    `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
+  ]);
+}
+
+// src/commands/environments.ts
+var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
+var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
+var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var NO_BRANCH = "\u2014";
+function parseCopyEnv(value) {
+  if (value === void 0) return void 0;
+  if (value === "preview" || value === "production") return value;
+  if (value === "none") return null;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--copy-env must be preview, production or none."
+  );
+}
+function parseDatabase(value) {
+  if (value === void 0) return void 0;
+  if (value === "schema" || value === "empty") return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--database must be schema or empty."
+  );
+}
+function parseProtection(value) {
+  if (value === void 0) return void 0;
+  if (value === "on") return true;
+  if (value === "off") return false;
+  throw new NaroError("VALIDATION_FAILED", "--protection must be on or off.");
+}
+function table2(rows) {
+  const widths = (rows[0] ?? []).map(
+    (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
+  );
+  return rows.map(
+    (row) => row.map(
+      (cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)
+    ).join("  ")
+  );
+}
+function environmentRow(environment) {
+  return [
+    environment.slug,
+    environment.url,
+    environment.branch ?? NO_BRANCH,
+    environment.protectionEnabled ? "on" : "off"
+  ];
+}
+async function runEnvironmentsList(context) {
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const { environments, limit } = await client.environments.list(projectId);
+  const count2 = String(environments.length);
+  context.output.result({ projectId, environments, limit }, [
+    ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
+      ["slug", "url", "branch", "protection"],
+      ...environments.map(environmentRow)
+    ]),
+    limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
+  ]);
+}
+async function runEnvironmentsCreate(context) {
+  const [slug] = context.positionalOrThrow(1, CREATE_USAGE2);
+  const { branch, copyEnv, database } = context.flags;
+  const copyEnvFrom = parseCopyEnv(copyEnv);
+  const seed = parseDatabase(database);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const environment = await client.environments.create(projectId, {
+    slug,
+    ...branch !== void 0 && { branch },
+    // null is a value here (copy nothing): only undefined leaves the key out.
+    ...copyEnvFrom !== void 0 && { copyEnvFrom },
+    ...seed !== void 0 && { database: seed }
+  });
+  context.output.result({ projectId, environment }, [
+    `\u2705 Created environment ${environment.slug} \u2192 ${environment.url}`
+  ]);
+}
+async function runEnvironmentsSet(context) {
+  const [slug] = context.positionalOrThrow(1, SET_USAGE2);
+  const { branch, noBranch, protection } = context.flags;
+  if (branch !== void 0 && noBranch === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--branch and --no-branch cannot be used together."
+    );
+  const protectionEnabled = parseProtection(protection);
+  if (branch === void 0 && noBranch !== true && protectionEnabled === void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Nothing to change: pass --branch, --no-branch or --protection."
+    );
+  const patch = {
+    ...branch !== void 0 && { branch },
+    ...noBranch === true && { branch: null },
+    ...protectionEnabled !== void 0 && { protectionEnabled }
+  };
+  const projectId = await context.resolveProjectId();
+  if (protectionEnabled === false)
+    await confirmOrAbort(
+      context,
+      `Turn off protection for ${slug}? Anyone with the link can open it.`
+    );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.update(
+    projectId,
+    found.id,
+    patch
+  );
+  context.output.result({ projectId, environment }, [
+    `\u2705 Updated environment ${slug}`
+  ]);
+}
+async function runEnvironmentsDelete(context) {
+  const [slug] = context.positionalOrThrow(1, DELETE_USAGE);
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    `Delete environment ${slug}? Its worker and protection key are removed.`
   );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  await client.environments.delete(projectId, found.id);
+  context.output.result({ projectId, slug, deleted: true }, [
+    `\u2705 Deleted environment ${slug}`
+  ]);
 }
 
 // src/commands/gen.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname2, resolve as resolve4 } from "path";
+import { dirname as dirname2, resolve as resolve5 } from "path";
 var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
 async function runGenTypes(context) {
   const { lang } = context.flags;
@@ -4912,7 +5179,7 @@ async function runGenTypes(context) {
     read.policies === void 0 ? {} : { policies: read.policies }
   );
   const undescribed = tables.flatMap(
-    (table2) => table2.error === void 0 ? [] : [{ name: table2.name, error: table2.error }]
+    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
   );
   for (const { name, error } of undescribed)
     context.output.warn(
@@ -4927,7 +5194,7 @@ async function runGenTypes(context) {
     ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
   };
   if (context.flags.output) {
-    const path = resolve4(context.cwd, context.flags.output);
+    const path = resolve5(context.cwd, context.flags.output);
     mkdirSync4(dirname2(path), { recursive: true });
     writeFileSync5(path, types);
     context.output.result(
@@ -5017,8 +5284,9 @@ function runInsightsDisable(context) {
 
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
+var FOLLOW_TIMEOUT_MS = 30 * 6e4;
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -5028,52 +5296,44 @@ function formatRuntimeLog(entry) {
   const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
   return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
 }
-async function latestProductionDeploymentId(client, projectId) {
-  const deployments = await client.deployments.list(projectId);
-  const latest = deployments.find(
-    (deployment) => deployment.status === "READY"
-  );
-  const fallback = deployments[0];
-  const chosen = latest ?? fallback;
-  if (!chosen)
+async function latestDeploymentId(client, projectId) {
+  const [latest] = await client.deployments.list(projectId);
+  if (!latest)
     throw new NaroError(
       "DEPLOYMENT_NOT_FOUND",
       "This project has no deployments yet."
     );
-  return chosen.id;
+  return latest.id;
 }
 async function buildLogs(context, client, deploymentId) {
   if (!context.flags.follow) {
-    const detail = await client.deployments.get(deploymentId);
+    const detail2 = await client.deployments.get(deploymentId);
+    const { status } = detail2.deployment;
+    const empty = isTerminalStatus(status) ? `(no build logs for ${deploymentId} \u2014 ${status})` : `(no build logs yet \u2014 ${deploymentId} is ${status}; add --follow to stream)`;
     context.output.result(
-      { deploymentId, type: "build", logs: detail.logs },
-      detail.logs.map(formatBuildLog)
+      { deploymentId, type: "build", status, logs: detail2.logs },
+      detail2.logs.length > 0 ? detail2.logs.map(formatBuildLog) : [empty]
     );
     return;
   }
-  let lastSequence = -1;
-  for (; ; ) {
-    const detail = await client.deployments.get(deploymentId);
-    for (const log of detail.logs) {
-      if (log.sequence > lastSequence) {
-        lastSequence = log.sequence;
-        context.output.log(formatBuildLog(log));
-      }
-    }
-    if (isTerminalStatus(detail.deployment.status)) {
-      context.output.result(
-        {
-          deploymentId,
-          type: "build",
-          status: detail.deployment.status,
-          logs: detail.logs
-        },
-        [`\u2014 deployment ${detail.deployment.status} \u2014`]
-      );
-      return;
-    }
-    await sleep(FOLLOW_INTERVAL_MS);
-  }
+  const detail = await client.deployments.wait(deploymentId, {
+    intervalMs: FOLLOW_INTERVAL_MS,
+    timeoutMs: FOLLOW_TIMEOUT_MS,
+    onLog: (log) => context.output.log(formatBuildLog(log))
+  });
+  const result = {
+    deploymentId,
+    type: "build",
+    status: detail.deployment.status,
+    logs: detail.logs
+  };
+  if (detail.deployment.status === "FAILED")
+    throw new NaroError(
+      detail.deployment.errorCode ?? "DEPLOY_FAILED",
+      detail.deployment.errorMessage ?? "The deployment failed.",
+      { details: result }
+    );
+  context.output.result(result, [`\u2014 deployment ${detail.deployment.status} \u2014`]);
 }
 async function runtimeLogs(context, client, projectId) {
   const environment = context.flags.env === "preview" ? "preview" : "production";
@@ -5117,7 +5377,6 @@ async function runtimeLogs(context, client, projectId) {
   }
 }
 async function runLogs(context) {
-  const client = await context.client();
   const [deploymentId] = context.positionals;
   const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
   if (type !== "build" && type !== "runtime")
@@ -5125,6 +5384,17 @@ async function runLogs(context) {
       "VALIDATION_FAILED",
       "--type must be build or runtime."
     );
+  if (type === "runtime" && context.flags.follow && context.flags.json)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--follow streams runtime logs until you stop it, so it has no JSON result. Drop --json to stream, or drop --follow for the current entries as JSON."
+    );
+  if (type === "build" && context.flags.env)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env is for runtime logs. Build logs belong to one deployment: pass its id (naro deployments lists them)."
+    );
+  const client = await context.client();
   if (type === "runtime") {
     if (deploymentId)
       throw new NaroError(
@@ -5135,10 +5405,11 @@ async function runLogs(context) {
     await runtimeLogs(context, client, projectId);
     return;
   }
-  const target = deploymentId ?? await latestProductionDeploymentId(
-    client,
-    await context.resolveProjectId()
-  );
+  let target = deploymentId;
+  if (target === void 0) {
+    target = await latestDeploymentId(client, await context.resolveProjectId());
+    context.output.log(`Build logs of the latest deployment, ${target}`);
+  }
   await buildLogs(context, client, target);
 }
 
@@ -5349,7 +5620,7 @@ function count(n, noun) {
 }
 
 // src/commands/storage.ts
-var CREATE_USAGE2 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
+var CREATE_USAGE3 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
 var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]";
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
 var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
@@ -5489,7 +5760,7 @@ async function runStorageBucketList(context) {
   );
 }
 async function runStorageBucketCreate(context) {
-  const name = bucketName(context, CREATE_USAGE2);
+  const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -5519,11 +5790,19 @@ async function runStorageBucketUpdate(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.updateBucket(projectId, name, patch);
+  const takesEffect = patch.public === false ? "It takes effect within about 10 seconds; copies Naro's edge already holds can be served for up to 5 minutes." : "It takes effect within about 10 seconds.";
   context.output.result({ projectId, bucket }, [
-    `\u2705 Updated bucket ${printable(bucket.name)}. It takes effect within about 10 seconds.`,
+    `\u2705 Updated bucket ${printable(bucket.name)}. ${takesEffect}`,
     bucketLine(bucket)
   ]);
 }
+function refuseSearch(context, why) {
+  if (context.flags.search !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--search is for naro storage ls: ${why}`
+    );
+}
 async function untilDone(context, bucket, page) {
   let deleted = 0;
   let idle = 0;
@@ -5546,6 +5825,10 @@ function objectsSentence(objects2) {
 }
 async function runStorageBucketEmpty(context) {
   const name = bucketName(context, EMPTY_USAGE);
+  refuseSearch(
+    context,
+    `bucket empty deletes every object in the bucket. ${EMPTY_USAGE}`
+  );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.getBucket(projectId, name);
@@ -5565,6 +5848,10 @@ async function runStorageBucketEmpty(context) {
 async function runStorageBucketRemove(context) {
   const name = bucketName(context, REMOVE_USAGE2);
   const empty = context.flags.empty === true;
+  refuseSearch(
+    context,
+    empty ? `bucket remove --empty deletes every object in the bucket before it removes the bucket. ${REMOVE_USAGE2}` : `bucket remove removes the whole bucket. ${REMOVE_USAGE2}`
+  );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   let question = `Remove bucket ${name}?`;
@@ -5590,7 +5877,7 @@ async function runStorageBucketRemove(context) {
 import { randomUUID } from "crypto";
 import { createWriteStream as createWriteStream2, openAsBlob, rmSync as rmSync2 } from "fs";
 import { rename, rm, stat } from "fs/promises";
-import { basename as basename2, dirname as dirname3, extname, join as join6, resolve as resolve5 } from "path";
+import { basename as basename2, dirname as dirname3, extname, join as join5, resolve as resolve6 } from "path";
 import { Readable } from "stream";
 import { pipeline as pipeline2 } from "stream/promises";
 
@@ -5685,6 +5972,10 @@ function errorFromBody(status, body) {
   if (status >= 200 && status < 300) return null;
   return invalidResponse(status);
 }
+var AUTH_PREFIX = "/auth/";
+function storeFor(config, path) {
+  return path.startsWith(AUTH_PREFIX) ? config.tokens : config.accessJwt ?? null;
+}
 async function receive(config, options, init) {
   const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
   if (controller) init.signal = controller.signal;
@@ -5707,10 +5998,10 @@ async function receive(config, options, init) {
   const { timeoutMs } = options;
   if (timeoutMs === void 0) return request;
   let timer;
-  const expired = new Promise((resolve6) => {
+  const expired = new Promise((resolve7) => {
     timer = setTimeout(() => {
       controller?.abort();
-      resolve6({ error: requestTimeout(timeoutMs) });
+      resolve7({ error: requestTimeout(timeoutMs) });
     }, timeoutMs);
   });
   try {
@@ -5728,7 +6019,8 @@ async function call(config, options) {
       return { error: invalidQuery("", "is not JSON"), answer: null };
     }
   }
-  const token = options.withToken ? await config.tokens.get() : null;
+  const store = storeFor(config, options.path);
+  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -5762,17 +6054,18 @@ async function call(config, options) {
   const error = errorFromBody(status, body);
   if (error === null) return { error: null, answer };
   return {
-    error: await settled(config, error, responseHeaders, token),
+    error: await settled(store, error, responseHeaders, token),
     answer
   };
 }
-async function settled(config, error, headers, token) {
-  if (error.code === "INVALID_SESSION" && token !== null)
-    await config.tokens.clearIf(token);
+async function settled(store, error, headers, token) {
+  if (error.code === "INVALID_SESSION" && token !== null && store)
+    await store.clearIf(token);
   return RETRY_AFTER_CODES.has(error.code) ? withRetryAfter(error, headers) : error;
 }
 async function send(config, options) {
-  const token = options.withToken ? await config.tokens.get() : null;
+  const store = storeFor(config, options.path);
+  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -5823,7 +6116,7 @@ async function send(config, options) {
   }
   const error = errorFromBody(status, body) ?? invalidResponse(status);
   return {
-    error: await settled(config, error, response.headers, token),
+    error: await settled(store, error, response.headers, token),
     status
   };
 }
@@ -6008,6 +6301,7 @@ async function createPkcePair() {
   return { verifier, challenge: base64url(new Uint8Array(digest)) };
 }
 var TOKEN_HEADER = "set-auth-token";
+var JWT_HEADER = "set-auth-jwt";
 var FRAGMENT_PREFIX = "naro_";
 var OAUTH_PROVIDERS = ["google", "github"];
 var FLOW_TYPES = [
@@ -6026,6 +6320,9 @@ function nonEmpty(value) {
 function tokenFrom(answer) {
   return nonEmpty(answer.headers.get(TOKEN_HEADER));
 }
+function jwtFrom(answer) {
+  return nonEmpty(answer.headers.get(JWT_HEADER));
+}
 function userFrom(body) {
   return isRecord(body) && isRecord(body.user) ? body.user : null;
 }
@@ -6188,7 +6485,7 @@ var AuthClient = class {
     const user = userFrom(body);
     if (token === null || user === null || !isRecord(body) || !isRecord(body.session))
       return { data: signedOut, error: invalidResponse(result.answer.status) };
-    await this.#http.tokens.set(token);
+    await this.#storeSession(token, jwtFrom(result.answer));
     await this.#flow.recovery.forget();
     return { data: { session: body.session, user }, error: null };
   }
@@ -6224,6 +6521,7 @@ var AuthClient = class {
     }
     if (type === "recovery" && fragment.naro_token) {
       await this.#http.tokens.clear();
+      await this.#http.accessJwt?.clear();
       await this.#flow.recovery.keep(fragment.naro_token);
       return { data: none, error: null };
     }
@@ -6314,6 +6612,7 @@ var AuthClient = class {
       withToken: true
     });
     await tokens.clearIf(result.answer?.token ?? token);
+    await this.#http.accessJwt?.clear();
     return { data: null, error: result.error };
   }
   /**
@@ -6335,7 +6634,10 @@ var AuthClient = class {
     if (result.error !== null) return { data: signedOut, error: result.error };
     const { body, token } = result.answer;
     if (body === null) {
-      if (token !== null) await tokens.clearIf(token);
+      if (token !== null) {
+        await tokens.clearIf(token);
+        await this.#http.accessJwt?.clear();
+      }
       return { data: signedOut, error: invalidSession() };
     }
     const user = userFrom(body);
@@ -6366,6 +6668,15 @@ var AuthClient = class {
   async #pendingUrl() {
     if (this.#fromUrl) await this.#fromUrl;
   }
+  /**
+   * Keeps a new session: its token, and the access JWT beside it. An answer
+   * without a JWT drops the old one — it belonged to the previous session.
+   */
+  async #storeSession(token, jwt) {
+    await this.#http.tokens.set(token);
+    if (jwt !== null) await this.#http.accessJwt?.set(jwt);
+    else await this.#http.accessJwt?.clear();
+  }
   async #signIn(path, body, needsToken) {
     await this.#flow.recovery.forget();
     const result = await call(this.#http, {
@@ -6385,7 +6696,7 @@ var AuthClient = class {
         data: { user: null },
         error: invalidResponse(result.answer.status)
       };
-    if (token !== null) await this.#http.tokens.set(token);
+    if (token !== null) await this.#storeSession(token, jwtFrom(result.answer));
     return { data: { user }, error: null };
   }
 };
@@ -6533,6 +6844,9 @@ function defaultStorage() {
 function storageKey(baseUrl) {
   return `naro-auth-token:${baseUrl}`;
 }
+function accessJwtKey(baseUrl) {
+  return `naro-auth-jwt:${baseUrl}`;
+}
 function verifierKey(baseUrl) {
   return `naro-auth-code-verifiers:${baseUrl}`;
 }
@@ -7063,8 +7377,8 @@ function patternOf(pattern) {
 }
 var MAX_LIMIT = 1e3;
 var CAP = `one select reads at most ${String(MAX_LIMIT)} rows, by limit() or range()`;
-function initialState(table2) {
-  return { table: table2, problem: null, filters: [], columns: "*", order: [] };
+function initialState(table3) {
+  return { table: table3, problem: null, filters: [], columns: "*", order: [] };
 }
 function copyRow(row) {
   return { ...row };
@@ -7297,11 +7611,11 @@ var SelectBuilder = class extends FilterBuilder {
     return this.next({ single: "maybe" });
   }
   build() {
-    const { table: table2, columns, order, limit, offset, single } = this.state;
+    const { table: table3, columns, order, limit, offset, single } = this.state;
     return {
       version: 1,
       action: "select",
-      table: table2,
+      table: table3,
       columns: columns === "*" ? "*" : [...columns],
       ...this.filtersPart(),
       ...order.length === 0 ? {} : { order: order.map((term) => ({ ...term })) },
@@ -7317,11 +7631,11 @@ var InsertBuilder = class extends Builder {
     return this.withReturning(columns);
   }
   build() {
-    const { table: table2, rows = [], returning } = this.state;
+    const { table: table3, rows = [], returning } = this.state;
     return {
       version: 1,
       action: "insert",
-      table: table2,
+      table: table3,
       rows: rows.map(copyRow),
       ...returning === void 0 ? {} : { returning }
     };
@@ -7338,7 +7652,7 @@ var MutationBuilder = class extends FilterBuilder {
   }
   build() {
     const {
-      table: table2,
+      table: table3,
       action,
       values = {},
       returning,
@@ -7349,10 +7663,10 @@ var MutationBuilder = class extends FilterBuilder {
       ...returning === void 0 ? {} : { returning },
       ...allowUnfiltered === void 0 ? {} : { allowUnfiltered }
     };
-    return action === "delete" ? { version: 1, action: "delete", table: table2, ...tail } : {
+    return action === "delete" ? { version: 1, action: "delete", table: table3, ...tail } : {
       version: 1,
       action: "update",
-      table: table2,
+      table: table3,
       values: copyRow(values),
       ...tail
     };
@@ -7361,9 +7675,9 @@ var MutationBuilder = class extends FilterBuilder {
 var TableBuilder = class {
   #run;
   #table;
-  constructor(run, table2) {
+  constructor(run, table3) {
     this.#run = run;
-    this.#table = table2;
+    this.#table = table3;
   }
   /** `"*"` (the default) or `"id, title"`. */
   select(columns) {
@@ -7739,6 +8053,7 @@ function withoutToken(error, token) {
 var isFileObject = (value) => isRecord(value) && typeof value.id === "string" && typeof value.name === "string" && isRecord(value.metadata);
 var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (value.id === null || isFileObject(value));
 var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
+var isSignedEntry = (value) => isRecord(value) && typeof value.path === "string" && (value.signedUrl === null || typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX)) && (value.error === null || typeof value.error === "string");
 var isSignedUpload = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_UPLOAD_PREFIX) && typeof value.token === "string" && value.token !== "" && typeof value.path === "string";
 var partsBody = (body) => isArrayBuffer(body) ? new Uint8Array(body) : body;
 function listOf(guard) {
@@ -7868,7 +8183,11 @@ var StorageFileApi = class {
   }
   /**
    * What is directly below `prefix` (the whole bucket by default): folders
-   * first, then files. The options go to the worker as they are given.
+   * first, then files. `search` keeps the names below the prefix that start
+   * with it, ASCII case ignored (Storage 3-1g); a backend whose Storage was
+   * turned on before it answers `INVALID_REQUEST` (`details.path`
+   * `search`) — update it with `naro backend enable`. The options go to the
+   * worker as they are given.
    */
   async list(prefix, options = {}) {
     const target = this.#bucketPath("list/");
@@ -7916,6 +8235,44 @@ var StorageFileApi = class {
       error: null
     };
   }
+  /**
+   * Links to several objects at once (Storage 3-1g): up to 100 paths, each
+   * for `expiresIn` seconds (1–604,800), with the same `download`. One entry
+   * per path, in the order given — a path given twice is answered twice.
+   * A path that is not there, or that the caller cannot read, has
+   * `signedUrl: null` and `error` "Object <path> was not found in bucket
+   * <bucket>." — the same words for both. The paths go in the body, so the
+   * backend checks them: a bad one fails the call with `INVALID_REQUEST`
+   * (`details.path` `paths[<i>]`). A backend whose Storage was turned on
+   * before this method came answers `NOT_FOUND`: update it with
+   * `naro backend enable`.
+   */
+  async createSignedUrls(paths, expiresIn, options = {}) {
+    const target = this.#bucketPath("sign/");
+    if (!target.ok) return fail(target.error);
+    const { download: download2 } = options ?? {};
+    const signed = await this.#json(
+      {
+        method: "POST",
+        path: target.path,
+        body: {
+          expiresIn,
+          paths,
+          ...download2 === void 0 || download2 === false ? {} : { download: download2 }
+        }
+      },
+      listOf(isSignedEntry)
+    );
+    if (signed.error !== null) return signed;
+    return {
+      data: signed.data.map((entry) => ({
+        path: entry.path,
+        signedUrl: entry.signedUrl === null ? null : `${this.#http.baseUrl}${entry.signedUrl}`,
+        error: entry.error
+      })),
+      error: null
+    };
+  }
   /**
    * A token that lets whoever holds it upload `path` for two hours (Storage
    * 3-1e-2), as supabase-js's: made where the key is — a server with the
@@ -8118,7 +8475,8 @@ var NaroClient2 = class {
       baseUrl,
       apiKey,
       fetch: options.fetch,
-      tokens: new TokenStore(storage, storageKey(baseUrl))
+      tokens: new TokenStore(storage, storageKey(baseUrl)),
+      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl))
     };
     this.auth = new AuthClient(http, {
       verifiers: new FlowVerifiers(
@@ -8135,8 +8493,8 @@ var NaroClient2 = class {
     this.storage = new StorageClient(http, this.auth);
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
-  from(table2) {
-    return new TableBuilder(this.#run, table2);
+  from(table3) {
+    return new TableBuilder(this.#run, table3);
   }
 };
 function createClient(options) {
@@ -8147,8 +8505,17 @@ function createClient(options) {
 var NARO_SCHEME = "naro://";
 var CP_USAGE = "Usage: naro storage cp <from> <to> (one side naro://<bucket>/<path>, the other a local file)";
 var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
-var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]";
+var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive] [--search <text>]";
 var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
+var STORAGE_OUTDATED_MESSAGE = "The project backend is older than this Storage command. Run `naro backend enable` to update it, then try again.";
+var OLD_SEARCH_REASON = "search is not supported yet";
+function isOldSearchRefusal(error) {
+  if (error === null || error.code !== "INVALID_REQUEST") return false;
+  const { details } = error;
+  if (typeof details !== "object" || details === null) return false;
+  const { path, reason } = details;
+  return path === "search" && reason === OLD_SEARCH_REASON;
+}
 var FOUR_GIB = 4294967296;
 var PAGE = 1e3;
 var MAX_OFFSET = 1e5;
@@ -8268,7 +8635,7 @@ function fileEntry(path, object) {
     updatedAt: object.updated_at
   };
 }
-async function listAll(storage, bucket, prefix, recursive) {
+async function listAll(storage, bucket, prefix, recursive, search) {
   const entries = [];
   let truncated = false;
   const folders = [prefix];
@@ -8278,9 +8645,14 @@ async function listAll(storage, bucket, prefix, recursive) {
         truncated = true;
         break;
       }
-      const page = unwrap(
-        await storage.from(bucket).list(folder, { limit: PAGE, offset })
-      );
+      const listed = await storage.from(bucket).list(folder, {
+        limit: PAGE,
+        offset,
+        ...search === "" ? {} : { search }
+      });
+      if (isOldSearchRefusal(listed.error))
+        throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
+      const page = unwrap(listed);
       for (const entry of page) {
         const path = folder === "" ? entry.name : `${folder}/${entry.name}`;
         if (isFolder(entry)) {
@@ -8310,7 +8682,13 @@ function entryLine(bucket, entry) {
 async function storageLs(context) {
   const [target, ...extra] = context.positionals;
   if (extra.length > 0) throw new NaroError("VALIDATION_FAILED", LS_USAGE);
+  const search = context.flags.search ?? "";
   if (target === void 0) {
+    if (search !== "")
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `--search needs a naro:// path. ${LS_USAGE}`
+      );
     const client = await context.client();
     const projectId2 = await context.resolveProjectId();
     const buckets = await client.storage.listBuckets(projectId2);
@@ -8332,17 +8710,28 @@ async function storageLs(context) {
     storage,
     url.bucket,
     prefix,
-    context.flags.recursive === true
+    context.flags.recursive === true,
+    search
   );
   if (truncated) context.output.warn(TRUNCATED_WARNING);
-  if (entries.length === 0 && prefix !== "" && !url.path.endsWith("/")) {
+  if (search === "" && entries.length === 0 && prefix !== "" && !url.path.endsWith("/")) {
     const found = await storage.from(url.bucket).info(prefix);
     if (found.error === null) entries.push(fileEntry(prefix, found.data));
     else if (found.error.code !== "OBJECT_NOT_FOUND") unwrap(found);
   }
+  const where = `${NARO_SCHEME}${url.bucket}/${printable(prefix)}`;
   context.output.result(
-    { projectId, bucket: url.bucket, prefix, entries, truncated },
-    entries.length === 0 ? [`Nothing under ${NARO_SCHEME}${url.bucket}/${printable(prefix)}.`] : entries.map((entry) => entryLine(url.bucket, entry))
+    {
+      projectId,
+      bucket: url.bucket,
+      prefix,
+      ...search === "" ? {} : { search },
+      entries,
+      truncated
+    },
+    entries.length === 0 ? [
+      search === "" ? `Nothing under ${where}.` : `No name under ${where} starts with ${printable(search)}.`
+    ] : entries.map((entry) => entryLine(url.bucket, entry))
   );
 }
 var INTERRUPTS = ["SIGINT", "SIGTERM", "SIGHUP"];
@@ -8392,7 +8781,7 @@ function stopOnInterrupt(onFirst) {
   };
 }
 async function writeAtomically(bytes, destination) {
-  const partial = join6(dirname3(destination), `.${randomUUID()}.naro-partial`);
+  const partial = join5(dirname3(destination), `.${randomUUID()}.naro-partial`);
   const stopListening = removeOnInterrupt(partial);
   try {
     await pipeline2(bytes, createWriteStream2(partial, { flags: "wx" }));
@@ -8433,7 +8822,7 @@ function progressReporter(output, total) {
   };
 }
 async function upload(context, local, target) {
-  const file = resolve5(context.cwd, local);
+  const file = resolve6(context.cwd, local);
   const info = await stat(file).catch(() => null);
   if (info === null)
     throw new NaroError(
@@ -8567,9 +8956,9 @@ async function download(context, source, local) {
       "VALIDATION_FAILED",
       "naro storage cp downloads one object: name it, naro://<bucket>/<path>."
     );
-  const resolved = resolve5(context.cwd, local);
+  const resolved = resolve6(context.cwd, local);
   const isDirectory = local.endsWith("/") || (await stat(resolved).catch(() => null))?.isDirectory() === true;
-  const destination = isDirectory ? join6(resolved, savedAs(source.path)) : resolved;
+  const destination = isDirectory ? join5(resolved, savedAs(source.path)) : resolved;
   const folder = await stat(dirname3(destination)).catch(() => null);
   if (folder === null || !folder.isDirectory())
     throw new NaroError(
@@ -8615,7 +9004,7 @@ async function namesUnder(storage, bucket, prefixes) {
     const prefix = written.replace(/\/+$/, "");
     if (prefix !== "" && !written.endsWith("/") && unwrap(await storage.from(bucket).exists(prefix)))
       names.add(prefix);
-    const found = await listAll(storage, bucket, prefix, true);
+    const found = await listAll(storage, bucket, prefix, true, "");
     for (const entry of found.entries) names.add(entry.path);
     truncated ||= found.truncated;
   }
@@ -8624,6 +9013,11 @@ async function namesUnder(storage, bucket, prefixes) {
 async function storageRm(context) {
   if (context.positionals.length === 0)
     throw new NaroError("VALIDATION_FAILED", RM_USAGE);
+  if (context.flags.search !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--search is for naro storage ls: rm removes everything under the path it is given. ${RM_USAGE}`
+    );
   const recursive = context.flags.recursive === true;
   const byBucket = /* @__PURE__ */ new Map();
   for (const arg of context.positionals) {
@@ -8716,6 +9110,101 @@ function runStorageRm(context) {
   return explainingKey(context, storageRm);
 }
 
+// src/commands/usage-format.ts
+var PLAN_NAMES = {
+  hobby: "Hobby",
+  pro: "Pro",
+  enterprise: "Enterprise"
+};
+var METRIC_LABELS = {
+  requests: "Requests",
+  builds: "Builds",
+  domains: "Custom domains"
+};
+var BUILDS_NOTE = "Builds are builds that started; the Hobby limit counts deployments created.";
+var LAG_NOTE = "Requests are counted every 15 minutes. Blocked requests (firewall, pauses) do not count toward the limit.";
+function planName(plan) {
+  return PLAN_NAMES[plan] ?? printable(plan);
+}
+function statusLine2(status, limit) {
+  const amount = typeof limit === "number" ? `${formatCount(limit)} requests` : "requests";
+  switch (status) {
+    case "paused":
+      return `\u2717 This team used the Hobby plan's ${amount} this month. Its sites are paused until the 1st of next month (UTC).`;
+    case "over":
+      return `\u26A0 This team used more than the Hobby plan's ${amount} this month. Sites are not paused yet.`;
+    case "near":
+      return `\u26A0 This team has used 80% of the Hobby plan's ${amount} this month.`;
+  }
+}
+function meterRow(meter, limitsKnown) {
+  const label3 = METRIC_LABELS[meter.metric];
+  const used = formatCount(meter.used);
+  if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
+  if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
+  if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
+  return [label3, used, formatCount(meter.limit), usedPercent(meter)];
+}
+function usedPercent(meter) {
+  const percent2 = meter.percent ?? 0;
+  return percent2 === 0 && meter.used > 0 ? "<1%" : `${String(percent2)}%`;
+}
+function projectName(project) {
+  if (project.deleted) return `Deleted project ${printable(project.projectId)}`;
+  if (project.moved)
+    return `Moved to another team ${printable(project.projectId)}`;
+  return printable(project.name ?? project.projectId);
+}
+function usageLines2(report, summary) {
+  const lines = [
+    `${printable(report.team.slug)} \xB7 ${planName(report.team.plan)} plan \xB7 ${printable(report.month)} (UTC)`
+  ];
+  if (summary.status)
+    lines.push(statusLine2(summary.status, report.limits?.requests));
+  lines.push(
+    "",
+    ...table([
+      ["Metric", "Used", "Included", "Used %"],
+      ...summary.meters.map((meter) => meterRow(meter, summary.limitsKnown))
+    ]),
+    ""
+  );
+  if (report.team.plan === "hobby") lines.push(BUILDS_NOTE);
+  lines.push(LAG_NOTE, "");
+  if (report.projects.length === 0) {
+    lines.push("Nothing was recorded for this month.");
+    return lines;
+  }
+  lines.push(
+    "By project",
+    ...table([
+      ["Requests", "Blocked", "Builds", "Domains (peak)", "Project"],
+      ...report.projects.map((project) => [
+        formatCount(project.requests),
+        formatCount(project.requestsBlocked),
+        formatCount(project.builds),
+        formatCount(project.domains),
+        projectName(project)
+      ])
+    ])
+  );
+  return lines;
+}
+
+// src/commands/usage.ts
+async function runUsage(context) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const team = await resolveTeam(context, teams, { intent: "read" });
+  const month = context.flags.month;
+  const report = await client.teams.usage(
+    team.slug,
+    month !== void 0 ? { month } : {}
+  );
+  const summary = summarizeTeamUsage(report, usageMonthOf(/* @__PURE__ */ new Date()));
+  context.output.result({ ...report, summary }, usageLines2(report, summary));
+}
+
 // src/router.ts
 var HELP = `naro \u2014 deploy Next.js apps to Naro (https://naro.sh)
 
@@ -8727,9 +9216,12 @@ Usage:
   naro unlink                        Remove the link (.naro/)
   naro projects [--team <slug>]      List projects
   naro project inspect               Show the linked project
+  naro usage [--month YYYY-MM] [--team <slug>]
+                                     Team usage: requests, builds and custom domains against the plan, then by project
 
   naro deploy [--prod]               Build locally and deploy (preview by default)
        [--root <dir>] [--name <name>]  --root points at the app in a monorepo
+       [--env <name>]                  Deploy to a named environment instead of preview (not with --prod)
   naro deployments                   List deployments of the linked project
   naro inspect <deployment-id>       Show one deployment + build logs
   naro cancel <deployment-id>        Stop a build that is still running
@@ -8755,10 +9247,19 @@ Usage:
   naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
   naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
 
-  naro env list                      List env vars (secrets masked)
-  naro env add KEY [environment]     Add/update (value from prompt or stdin)
-  naro env remove KEY [environment]  Remove
+  naro env list                      List env vars (secrets masked); an environment's value shows its name
+  naro env add KEY [target]          Add/update (value from prompt or stdin)
+  naro env remove KEY [target]       Remove; with no target only production, preview and all, never an environment's
+  naro env import <file> [target]    Upload a dotenv file's variables (asks first; --yes in CI)
   naro env pull [file]               Write env vars to .env.local
+       target is production, preview, all or an environment name; add and import use all when none is given
+
+  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
+                                     A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
+  naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
+                                     Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -8879,8 +9380,10 @@ Usage:
   naro storage bucket empty <name>   Delete every object in it and keep the bucket (asks first)
   naro storage bucket remove <name> [--empty]
                                      Remove an empty bucket; --empty deletes its objects first (asks first)
-  naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]
-                                     The buckets, or the folders and objects under a prefix
+  naro storage ls [naro://<bucket>[/<prefix>]] [--recursive] [--search <text>]
+                                     The buckets, or the folders and objects under a prefix;
+                                     --search keeps the names below it that start with <text>, ASCII case ignored
+                                     (with --recursive, on every level: it does not find a name deep below)
   naro storage cp <from> <to> [--upsert] [--content-type <t>] [--cache-control <seconds>]
                                      One file between this machine and naro://<bucket>/<path>, up to the object limit (over 50 MiB in parts),
                                      with the project's service key (NARO_SERVICE_KEY, or fetched with a warning).
@@ -8900,12 +9403,13 @@ Global options:
   --project <id>  Target project (overrides .naro/project.json)
   --root <dir>    App directory inside the repo (monorepos), e.g. apps/web
   --name <name>   Project name for a first deploy (defaults to package.json); the index name (naro db index create)
-  --team <slug>   Team scope for project listing/linking
+  --team <slug>   Team scope for project listing/linking and naro usage
   --cwd <dir>     Run as if started in <dir>
   --prod          Deploy/target production
   --wait          Poll until the domain goes live (naro domains verify)
   --metric <m>    lcp, inp, cls, fcp or ttfb; lcp by default (naro insights)
   --range <r>     24h, 7d or 30d; 7d by default (naro analytics, naro insights)
+  --month <YYYY-MM>  A UTC calendar month, e.g. 2026-09; this month by default (naro usage)
   --route <pattern>  A route from the pages table, e.g. '/posts/[id]': the paths under it (naro insights)
   --path <p>      Only this page, starting with /, e.g. /pricing (naro analytics, naro insights)
   --referrer <host>  Only visits that came from this lowercase host, e.g. t.co (naro analytics only: Speed Insights has no referrer)
@@ -8913,7 +9417,14 @@ Global options:
   --device <d>    Only this device: desktop, mobile or tablet (naro analytics, naro insights)
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull: preview by default)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
+                  branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
+  --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
+  --copy-env <source>  Where a new environment's variables come from: preview (default), production or none (naro environments create)
+  --database <seed>  What a new environment's database starts with: schema (default) or empty (naro environments create)
+  --protection <on|off>  on: only members of the project can open the environment; off: anyone with the link can
+                  (naro environments set; off asks first, --yes in CI)
   --no-www        Register the apex alone (naro domains add)
   --file <path>   SQL file to run (naro db query, naro policy create)
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
@@ -8945,6 +9456,7 @@ Global options:
   --allowed-mime-types <t,\u2026>  The types a bucket takes, like image/png,image/*; any clears it
   --empty         Delete the bucket's objects first (naro storage bucket remove)
   --recursive, -r Everything under a folder (naro storage ls, naro storage rm)
+  --search <text> Names below the prefix that start with <text>, ASCII case ignored (naro storage ls)
   --upsert        Replace an object that is there (naro storage cp)
   --content-type <t>  The object's type; by default from the file's extension (naro storage cp)
   --cache-control <seconds>  How long a browser may keep it; 3600 by default (naro storage cp)
@@ -9110,6 +9622,9 @@ function route(parsed) {
       return { handler: runUnlink, positionals };
     case "projects":
       return { handler: runProjects, positionals };
+    // Spec 2026-10-18-usage-cli-mcp §2.
+    case "usage":
+      return positionals.length === 0 ? { handler: runUsage, positionals: [] } : null;
     case "project":
       if (sub === void 0 || sub === "inspect")
         return {
@@ -9175,11 +9690,41 @@ function route(parsed) {
         case "remove":
         case "rm":
           return { handler: runEnvRemove, positionals: positionals.slice(1) };
+        case "import":
+          return { handler: runEnvImport, positionals: positionals.slice(1) };
         case "pull":
           return { handler: runEnvPull, positionals: positionals.slice(1) };
         default:
           return null;
       }
+    // Spec 2026-10-18-named-environments §14.2.
+    case "environments":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return {
+            handler: runEnvironmentsList,
+            positionals: positionals.slice(1)
+          };
+        case "create":
+          return {
+            handler: runEnvironmentsCreate,
+            positionals: positionals.slice(1)
+          };
+        case "set":
+          return {
+            handler: runEnvironmentsSet,
+            positionals: positionals.slice(1)
+          };
+        case "delete":
+          return {
+            handler: runEnvironmentsDelete,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
     case "domains":
       switch (sub) {
         case void 0:
@@ -9345,8 +9890,8 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync5(
-        join7(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
+      readFileSync6(
+        join6(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );