naro-cli 0.18.0 → 0.19.0

package/dist/{chunk-WLC42Y6U.js → chunk-DEEFHVDZ.js}

@@ -15091,7 +15091,13 @@ var createProjectSchema = external_exports.object({
   rootDirectory: optionalRootDirectory
 });
 var createDeploymentSchema = external_exports.object({
-  branch: external_exports.string().trim().max(240).optional().transform((value) => value || null)
+  branch: external_exports.string().trim().max(240).optional().transform((value) => value || null),
+  /**
+   * The surface to deploy to: `production`, `preview`, or the slug of one of
+   * the project's environments. Whether the name exists is the route's to say;
+   * 63 is the DNS label a worker name has to fit in.
+   */
+  environment: external_exports.string().trim().min(1).max(63).optional()
 });
 var connectRepositorySchema = external_exports.object({
   // Web-only route context: the only consumer is apps/web's
@@ -15354,6 +15360,40 @@ function splitStatements(sql) {
   };
 }
 
+// ../../packages/core/src/surface.ts
+var PRODUCTION_SURFACE = { kind: "production" };
+var PREVIEW_SURFACE = { kind: "preview" };
+var ENVIRONMENT_SLUG_MAX_LENGTH = 20;
+var RESERVED_ENVIRONMENT_SLUGS = [
+  "production",
+  "preview",
+  "all"
+];
+var SLUG_PATTERN = /^[a-z0-9](-?[a-z0-9])*$/;
+var ENVIRONMENT_SEPARATOR = "--";
+var PREVIEW_SUFFIX = "-preview";
+function environmentSlugProblem(value) {
+  if (value.length < 1 || value.length > ENVIRONMENT_SLUG_MAX_LENGTH)
+    return "invalid";
+  if (!SLUG_PATTERN.test(value)) return "invalid";
+  if (RESERVED_ENVIRONMENT_SLUGS.includes(value))
+    return "reserved";
+  return null;
+}
+function environmentWorkerName(subdomain, slug) {
+  return `${subdomain}${ENVIRONMENT_SEPARATOR}${slug}`;
+}
+function workerNameForSurface(subdomain, surface) {
+  switch (surface.kind) {
+    case "production":
+      return subdomain;
+    case "preview":
+      return `${subdomain}${PREVIEW_SUFFIX}`;
+    case "environment":
+      return environmentWorkerName(subdomain, surface.slug);
+  }
+}
+
 // ../../packages/build/src/next-version.ts
 var NEXT_RELEASE_DATES = {
   16: "2025-10-21",
@@ -17104,6 +17144,12 @@ async function collectProjectFacts(appRoot) {
 function label(strategy) {
   return `P${String(strategy.priority)} ${strategy.id}`;
 }
+function clause(text2) {
+  return text2.endsWith(".") && !text2.endsWith("..") ? text2.slice(0, -1) : text2;
+}
+function sentence(text2) {
+  return text2.endsWith(".") ? text2 : `${text2}.`;
+}
 function describeOutcome(outcome) {
   switch (outcome.status) {
     case "success":
@@ -17128,7 +17174,7 @@ async function evaluateOne(strategy, context, observer) {
   await observer.onLog({
     level: outcome.status === "success" ? "INFO" : "WARN",
     stage: "BUILDING",
-    message: `${label(strategy)} ${describeOutcome(outcome)}.`
+    message: sentence(`${label(strategy)} ${describeOutcome(outcome)}`)
   });
   return { id: strategy.id, priority: strategy.priority, outcome };
 }
@@ -17226,10 +17272,13 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
           attempts
         };
       }
+      const othersLeft = candidates.some(
+        (candidate) => candidate.id !== pinnedStrategy.id
+      );
       await observer.onLog({
         level: "WARN",
         stage: "BUILDING",
-        message: `Stored strategy ${label(pinnedStrategy)} no longer works; resolving again with the remaining candidates.`
+        message: othersLeft ? `Stored strategy ${label(pinnedStrategy)} no longer works; resolving again with the remaining candidates.` : `Stored strategy ${label(pinnedStrategy)} no longer works, and no other deployment strategy is left to try for Next.js ${context.nextVersion}.`
       });
     }
   } else if (options.pinned) {
@@ -17242,13 +17291,14 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
   const remaining = candidates.filter(
     (candidate) => !attempts.some((attempt) => attempt.id === candidate.id)
   );
-  await observer.onLog({
-    level: "INFO",
-    stage: "BUILDING",
-    message: `Resolving deployment strategy for Next.js ${context.nextVersion}: ${remaining.map(label).join(
-      ", "
-    )}${options.concurrency > 1 && remaining.length > 1 ? " (in parallel)" : ""}.`
-  });
+  if (remaining.length > 0)
+    await observer.onLog({
+      level: "INFO",
+      stage: "BUILDING",
+      message: `Resolving deployment strategy for Next.js ${context.nextVersion}: ${remaining.map(label).join(
+        ", "
+      )}${options.concurrency > 1 && remaining.length > 1 ? " (in parallel)" : ""}.`
+    });
   if (options.concurrency > 1) {
     const results = await runPool(
       remaining.map(
@@ -17266,11 +17316,25 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
   }
   const best = pickBest(candidates, attempts);
   if (!best) {
+    const summary = attempts.map(
+      (attempt) => clause(
+        `P${String(attempt.priority)} ${attempt.id} ${describeOutcome(attempt.outcome)}`
+      )
+    ).join("; ");
+    if (attempts.some(
+      (attempt) => attempt.outcome.status === "failed" && attempt.outcome.appBuild
+    ))
+      throw new DeploymentError(
+        "BUILD_FAILED",
+        sentence(
+          `The app's own build failed for Next.js ${context.nextVersion}: ${summary}`
+        )
+      );
     throw new DeploymentError(
       "NO_DEPLOYMENT_STRATEGY",
-      `No deployment strategy succeeded for Next.js ${context.nextVersion}: ${attempts.map(
-        (attempt) => `P${String(attempt.priority)} ${attempt.id} ${describeOutcome(attempt.outcome)}`
-      ).join("; ")}.`
+      sentence(
+        `No deployment strategy succeeded for Next.js ${context.nextVersion}: ${summary}`
+      )
     );
   }
   await observer.onLog({
@@ -17499,6 +17563,9 @@ function describeFailure(step) {
 function failed(stage, reason) {
   return { status: "failed", stage, reason };
 }
+function appBuildFailed(reason) {
+  return { status: "failed", stage: "build", reason, appBuild: true };
+}
 async function info(observer, message) {
   await observer.onLog({ level: "INFO", stage: "BUILDING", message });
 }
@@ -17797,7 +17864,7 @@ async function buildDeclaresNodeMiddleware(appRoot) {
   }
 }
 function createOpenNextCloudflareStrategy(options) {
-  async function attempt(context, roots, observer) {
+  async function attempt(context, roots, observer, ownBuild) {
     let platform;
     try {
       platform = await options.createPlatformBuildConfig(
@@ -17832,7 +17899,7 @@ function createOpenNextCloudflareStrategy(options) {
       return {
         ok: false,
         nodeMiddleware: null,
-        outcome: failed("build", describeFailure(nextBuild))
+        outcome: ownBuild ? appBuildFailed(describeFailure(nextBuild)) : failed("build", describeFailure(nextBuild))
       };
     }
     if (await buildDeclaresNodeMiddleware(roots.appRoot)) {
@@ -17941,7 +18008,7 @@ function createOpenNextCloudflareStrategy(options) {
           observer,
           "P2 opennext-cloudflare: building the project as written."
         );
-        const first = await attempt(context, context.workspace, observer);
+        const first = await attempt(context, context.workspace, observer, true);
         if (first.ok) {
           return {
             status: "success",
@@ -17973,8 +18040,47 @@ function createOpenNextCloudflareStrategy(options) {
         observer,
         `Converted ${conversion.file ?? context.facts.proxyFile} to edge middleware for this build only. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable. Your repository is unchanged.`
       );
-      const second = await attempt(context, fork, observer);
-      if (!second.ok) return second.outcome;
+      const second = await attempt(context, fork, observer, rememberedRewrite);
+      if (!second.ok) {
+        if (!rememberedRewrite || second.outcome.status !== "failed" || !second.outcome.appBuild)
+          return second.outcome;
+        await info(
+          observer,
+          `P2 opennext-cloudflare: the rewritten copy did not build; building the project as written once to tell the app's own error from the rewrite's.`
+        );
+        const asWritten = await attempt(
+          context,
+          context.workspace,
+          observer,
+          true
+        );
+        if (asWritten.ok) {
+          await info(
+            observer,
+            "P2 opennext-cloudflare: the project as written builds and ships as it is; the rewrite is no longer needed."
+          );
+          return {
+            status: "success",
+            artifact: {
+              kind: "cloudflare-worker",
+              artifact: asWritten.artifact
+            },
+            notes: []
+          };
+        }
+        if (asWritten.outcome.status === "failed" && asWritten.outcome.appBuild) {
+          await warn(
+            observer,
+            "P2 opennext-cloudflare: the project as written does not build either, so the error is the app's own."
+          );
+          return asWritten.outcome;
+        }
+        await warn(
+          observer,
+          "P2 opennext-cloudflare: the project as written builds, so the rewritten copy's error is the Edge rewrite's (a Node-only API reached from proxy.ts), not the app's code."
+        );
+        return failed("build", second.outcome.reason);
+      }
       return {
         status: "success",
         artifact: { kind: "cloudflare-worker", artifact: second.artifact },
@@ -19351,6 +19457,14 @@ function openBrowser(url2) {
   child.unref();
 }
 
+// ../../packages/sdk/src/environments.ts
+function isReservedEnvTarget(value) {
+  return RESERVED_ENVIRONMENT_SLUGS.includes(value);
+}
+function isEnvTargetName(value) {
+  return environmentSlugProblem(value) !== "invalid";
+}
+
 // ../../packages/sdk/src/insights.ts
 var SPEED_INSIGHTS_METRICS = [
   "lcp",
@@ -19463,6 +19577,7 @@ var NaroClient = class {
   insights;
   analytics;
   protection;
+  environments;
   constructor(options) {
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
@@ -19481,6 +19596,7 @@ var NaroClient = class {
     this.insights = new InsightsApi(this);
     this.analytics = new AnalyticsApi(this);
     this.protection = new ProtectionApi(this);
+    this.environments = new EnvironmentsApi(this);
   }
   async request(path, options) {
     const token = await this.getAccessToken();
@@ -19645,7 +19761,10 @@ var DeploymentsApi = class {
       {
         method: "POST",
         // createDeploymentSchema accepts string | undefined — never null.
-        body: options.branch ? { branch: options.branch } : {},
+        body: {
+          ...options.branch ? { branch: options.branch } : {},
+          ...options.environment ? { environment: options.environment } : {}
+        },
         context: "Create deployment"
       }
     );
@@ -19764,11 +19883,16 @@ var EnvApi = class {
       { method: "DELETE", context: "Remove environment variable" }
     );
   }
-  /** Removes every row for a key (optionally narrowed to one target). */
+  /**
+   * Removes a key's rows: the one `target` names, or, with no target, the
+   * `production`, `preview` and `all` rows. An environment's value goes only
+   * when its slug is the target, so removing a key everywhere else does not
+   * take a QA or staging value with it.
+   */
   async remove(projectId, key, target2) {
     const rows = await this.list(projectId);
     const matches = rows.filter(
-      (row) => row.key === key && (target2 === void 0 || row.target === target2)
+      (row) => row.key === key && (target2 === void 0 ? isReservedEnvTarget(row.target) : row.target === target2)
     );
     if (matches.length === 0) {
       throw new NaroError(
@@ -20061,6 +20185,55 @@ var ProtectionApi = class {
     );
   }
 };
+var EnvironmentsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(projectId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/environments`;
+  }
+  /** The project's environments and how many its plan allows (null: no limit). */
+  async list(projectId) {
+    return this.client.request(this.base(projectId), {
+      context: "List environments"
+    });
+  }
+  /** One environment by its slug, from the list: the routes address it by id. */
+  async get(projectId, slug) {
+    const { environments } = await this.list(projectId);
+    const environment = environments.find((entry) => entry.slug === slug);
+    if (!environment)
+      throw new NaroError("ENVIRONMENT_NOT_FOUND", "Environment not found.");
+    return environment;
+  }
+  async create(projectId, input) {
+    const body = await this.client.request(
+      this.base(projectId),
+      {
+        method: "POST",
+        // JSON drops a key that is undefined and keeps a null, which is what
+        // the route reads: no copyEnvFrom is "preview", null copies nothing.
+        body: input,
+        context: "Create environment"
+      }
+    );
+    return body.environment;
+  }
+  async update(projectId, environmentId, patch) {
+    const body = await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}`,
+      { method: "PATCH", body: patch, context: "Update environment" }
+    );
+    return body.environment;
+  }
+  /** Removes the environment, its worker and its protection. */
+  async delete(projectId, environmentId) {
+    await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}`,
+      { method: "DELETE", context: "Delete environment" }
+    );
+  }
+};
 var EXPORT_FIRST_POLL_MS = 1e3;
 var EXPORT_MAX_POLL_MS = 5e3;
 var EXPORT_TIMEOUT_MS = 15 * 6e4;
@@ -20245,10 +20418,12 @@ var DbApi = class {
    * `d1_migrations` — all operations or none. `dryRun` returns the SQL and
    * the name without applying anything. Save `sql` as `migrations/<name>` so
    * `naro db reset` re-applies it; a refused operation's index is in
-   * `details.operation`. Policies left under a name the change gives to a
-   * table are removed before it runs and stay removed if it then fails:
-   * that refusal carries them in `details.removedPolicies`, shaped as the
-   * result's `removedPolicies`.
+   * `details.operation`, or — refused by the policy translation, or failed
+   * in SQLite — in `statementIndex` (one statement per operation). The Data API policies go in the same migration: a
+   * rename carries the table's and rewrites the others that read it, a
+   * dropped table's go with it, and what an earlier table left under a name
+   * the change gives is removed — `removedPolicies` lists what went. A change
+   * that fails changes none of them.
    */
   async schema(projectId, operations, options = {}) {
     return this.client.request(
@@ -20996,7 +21171,7 @@ import { join as join19 } from "path";
 function parseDotenv(text2) {
   const out = {};
   for (const line of text2.split(/\r?\n/)) {
-    const trimmed = line.trim();
+    const trimmed = line.trim().replace(/^export\s+(?=[^=\s])/, "");
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
     if (eq <= 0) continue;
@@ -27501,16 +27676,16 @@ function readCreate(stream, start) {
   let check2 = null;
   let position = start.position;
   if (stream.acceptKeyword("using")) {
-    const clause = readClause(stream);
-    using = clause.text;
-    position = clause.position;
+    const clause2 = readClause(stream);
+    using = clause2.text;
+    position = clause2.position;
   }
   if (isKeyword(stream.peek(), "with")) {
     stream.next();
     stream.expectKeyword("check");
-    const clause = readClause(stream);
-    check2 = clause.text;
-    position = clause.position;
+    const clause2 = readClause(stream);
+    check2 = clause2.text;
+    position = clause2.position;
   }
   if (!roles.ok) throw new Error("unreachable");
   readEnd(stream);
@@ -28024,6 +28199,7 @@ COMMENT ON POLICY ${quotePolicyName(policy.name)} ON ${policyTableSql(policy.tab
 function unreadablePolicyComment(policy) {
   return `-- Policy ${commentText(quotePolicyName(policy.name))} on ${commentText(policyTableSql(policy.table))} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped and created again.`;
 }
+var STORED_POLICIES_SQL = `SELECT table_name, name, kind, command, roles, using_expr, check_expr, owner_column, updated_at FROM ${NAMED_POLICY_TABLE} ORDER BY table_name, name`;
 var SYSTEM_PREDICATE = systemTablePredicate("name");
 var STORAGE_EXISTS = `EXISTS (SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ${sqlStringLiteral(STORAGE_OBJECTS_TABLE)})`;
 
@@ -28968,9 +29144,20 @@ function policiesFromFiles(files) {
         tables,
         refused: { file: file2, reason: planned.message }
       };
-    for (const statement2 of planned.plan.statements) {
+    for (const [index, statement2] of planned.plan.statements.entries()) {
       if (statement2.kind === "create-policy") {
         const { table, name } = statement2.policy;
+        if (policies.some(
+          (policy) => sameTable(policy.table, table) && policy.name === name
+        ))
+          return {
+            policies,
+            tables,
+            refused: {
+              file: file2,
+              reason: `statement ${String(index + 1)} of ${String(planned.plan.statements.length)} failed and the migration was rolled back: policy "${name}" for table "${table}" already exists`
+            }
+          };
         policies.push({ table, name });
       } else if (statement2.kind === "drop-policy") {
         policies = policies.filter(
@@ -28988,6 +29175,10 @@ function policiesFromFiles(files) {
           if (!tables.has(asciiLower(head.to))) forget(head.to);
           tables.delete(asciiLower(head.table));
           tables.add(asciiLower(head.to));
+          if (!sameTable(head.table, STORAGE_OBJECTS) && !sameTable(head.table, REALTIME_MESSAGES))
+            policies = policies.map(
+              (policy) => sameTable(policy.table, head.table) ? { ...policy, table: head.to } : policy
+            );
         }
       }
     }
@@ -29093,26 +29284,31 @@ function usageStatus(report, currentMonth, requests) {
 import { existsSync as existsSync6 } from "fs";
 import { join as join23 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
-var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_"];
+var PUBLIC_PREFIX = "NEXT_PUBLIC_";
+function maskSecretValue(value) {
+  return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
+}
 function maskEnvValue(key, value) {
-  if (PUBLIC_PREFIXES.some((prefix) => key.startsWith(prefix)))
+  if (key.startsWith(PUBLIC_PREFIX))
     return value.length > 60 ? `${value.slice(0, 60)}\u2026` : value;
-  return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
+  return maskSecretValue(value);
 }
 function findDotenvFile(dir) {
   for (const name of DOTENV_FILES) if (existsSync6(join23(dir, name))) return name;
   return null;
 }
-function envAddGuidance(keys) {
+function envAddGuidance(keys, environment) {
+  const suffix = environment === void 0 ? "" : ` ${environment}`;
   return [
     "  Set them yourself:",
-    ...keys.map((key) => `    npx naro-cli env add ${key}`),
+    ...keys.map((key) => `    npx naro-cli env add ${key}${suffix}`),
     "  (values come from a hidden prompt or stdin, never from argv)"
   ];
 }
 async function promptForMissingEnv(ctx, keys) {
   const guide = (remaining2) => {
-    for (const line of envAddGuidance(remaining2)) ctx.output.log(line);
+    for (const line of envAddGuidance(remaining2, ctx.environment))
+      ctx.output.log(line);
   };
   const file2 = findDotenvFile(ctx.cwd);
   if (!file2) {
@@ -29150,6 +29346,20 @@ async function promptForMissingEnv(ctx, keys) {
   return collected;
 }
 
+// src/env-surface.ts
+function pullEnv(rows, surface) {
+  const chosen = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    if (row.target !== "all" && row.target !== surface) continue;
+    const held = chosen.get(row.key);
+    if (!held || held.target === "all" && row.target !== "all")
+      chosen.set(row.key, row);
+  }
+  return Object.fromEntries(
+    [...chosen.values()].map((row) => [row.key, row.value ?? ""])
+  );
+}
+
 // src/git-info.ts
 import { execFile as execFile2 } from "child_process";
 var SUPPORTED_REMOTE = [
@@ -29740,6 +29950,13 @@ function localDependencies(sourceDir, say = () => void 0) {
 async function deployDirectory(sourceDir, options, log2) {
   const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
+  const environment = production ? void 0 : options.environment;
+  if (environment === "production" || environment === "preview")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass production: true for production; preview is the default."
+    );
+  const surface = production ? "production" : environment ?? "preview";
   const appRoot = options.rootDirectory ? resolve11(sourceDir, options.rootDirectory) : sourceDir;
   const framework = detectFramework2(appRoot);
   if (!framework.deployable && !options.force) {
@@ -29762,6 +29979,8 @@ async function deployDirectory(sourceDir, options, log2) {
     getAccessToken: () => auth.getAccessToken(),
     ...options.fetch ? { fetch: options.fetch } : {}
   });
+  if (environment !== void 0 && options.projectId)
+    await client.environments.get(options.projectId, environment);
   const name = slugify2(options.name ?? await projectName(appRoot));
   const git2 = await (options.gitInfo ?? detectGitInfo)(sourceDir);
   const branch = options.branch ?? git2.branch;
@@ -29779,7 +29998,7 @@ async function deployDirectory(sourceDir, options, log2) {
     if (options.projectId) {
       try {
         const rows = await client.env.list(options.projectId);
-        existing = new Set(rows.map((row) => row.key));
+        existing = new Set(Object.keys(pullEnv(rows, surface)));
       } catch {
       }
     }
@@ -29791,8 +30010,10 @@ async function deployDirectory(sourceDir, options, log2) {
     log2(
       `\u25B8 ${String(missing.length)} env var(s) needed, not set on this project: ${missing.join(", ")}`
     );
-    if (options.onMissingEnv) collected = await options.onMissingEnv(missing);
-    else for (const line of envAddGuidance(missing)) log2(line);
+    const canCollect = environment === void 0 || options.projectId;
+    if (options.onMissingEnv && canCollect)
+      collected = await options.onMissingEnv(missing);
+    else for (const line of envAddGuidance(missing, environment)) log2(line);
   }
   const missingEnvKeys = missing.filter((key) => !(key in collected));
   const envToSend = { ...options.env, ...collected };
@@ -29801,6 +30022,9 @@ async function deployDirectory(sourceDir, options, log2) {
     ...options.projectId ? { projectId: options.projectId } : { name },
     ...options.teamSlug ? { teamSlug: options.teamSlug } : {},
     production,
+    ...options.environment !== void 0 && {
+      environment: options.environment
+    },
     ...git2.repositoryUrl != null && { repositoryUrl: git2.repositoryUrl },
     ...branch != null && { branch },
     ...repositoryRoot != null && { rootDirectory: repositoryRoot },
@@ -29891,6 +30115,8 @@ async function deployDirectory(sourceDir, options, log2) {
     status: detail.deployment.status,
     url: url2,
     production,
+    // A control plane from before named environments sends no environment.
+    environment: ctx.environment ?? null,
     missingEnvKeys,
     teamSlug: ctx.teamSlug,
     projectSlug: ctx.projectSlug,
@@ -29908,9 +30134,10 @@ async function waitForFinish(client, ctx, log2, intervalMs) {
 }
 function deploymentUrl(detail, ctx, production) {
   if (detail.deployment.url) return detail.deployment.url;
-  const surface = ctx.subdomain ?? ctx.projectId;
+  const surface = ctx.environment ? { kind: "environment", slug: ctx.environment, environmentId: null } : production ? PRODUCTION_SURFACE : PREVIEW_SURFACE;
+  const worker = workerNameForSurface(ctx.subdomain ?? ctx.projectId, surface);
   const host = new URL(ctx.controlPlaneUrl || controlPlaneUrl()).hostname;
-  return `https://${surface}${production ? "" : "-preview"}.${host}`;
+  return `https://${worker}.${host}`;
 }
 
 export {
@@ -29934,6 +30161,8 @@ export {
   suppliedToken,
   resolveAuth,
   openBrowser,
+  isReservedEnvTarget,
+  isEnvTargetName,
   SPEED_INSIGHTS_METRICS,
   SPEED_INSIGHTS_FILTER_KEYS,
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
@@ -29949,6 +30178,7 @@ export {
   cellText,
   renderRows,
   summarizeStatement,
+  parseDotenv,
   serializeDotenv,
   MAX_SINGLE_UPLOAD_BYTES,
   parseCacheControl,
@@ -29996,9 +30226,11 @@ export {
   storedPolicySql,
   usageMonthOf,
   summarizeTeamUsage,
+  maskEnvValue,
   promptForMissingEnv,
+  pullEnv,
   detectGitInfo,
-  parseDotenv2 as parseDotenv,
+  parseDotenv2,
   readProjectEnv2 as readProjectEnv,
   eventsObserver,
   slugify2 as slugify,

package/dist/deploy.d.ts

@@ -53,6 +53,13 @@ export interface DeployOptions {
     teamSlug?: string | undefined;
     rootDirectory?: string | null;
     production?: boolean;
+    /**
+     * Deploy to this named environment (its slug) instead of preview. Not with
+     * `production` (the control plane refuses both), and not `production` or
+     * `preview` themselves: those are `production: true` and the default, and
+     * are refused with VALIDATION_FAILED before anything runs.
+     */
+    environment?: string | undefined;
     env?: Record<string, string> | undefined;
     branch?: string | undefined;
     /** Explicit token (--token / MCP config); wins over the stored session. */
@@ -84,6 +91,11 @@ export interface DeployResult {
     status: DeploymentStatus;
     url: string;
     production: boolean;
+    /**
+     * The named environment it went to, as the control plane confirmed; null
+     * for production and preview.
+     */
+    environment?: string | null;
     /** 끝까지 채워지지 않은 키. */
     missingEnvKeys: string[];
     /** 서버가 확정한 목적지 — 출력과 링크 파일이 이 값을 쓴다. */

package/dist/deploy.js

@@ -3,11 +3,11 @@ import {
   deployDirectory,
   eventsObserver,
   localDependencies,
-  parseDotenv,
+  parseDotenv2 as parseDotenv,
   readProjectEnv,
   slugify,
   workingTreeNotices
-} from "./chunk-WLC42Y6U.js";
+} from "./chunk-DEEFHVDZ.js";
 import "./chunk-K3NQKI34.js";
 export {
   deployDirectory,

package/dist/env-consent.d.ts

@@ -4,13 +4,21 @@ export interface EnvConsentContext {
     cwd: string;
     prompter: Prompter;
     output: Output;
+    /** 배포가 가는 이름 있는 환경의 slug. 없으면 production·preview 배포다. */
+    environment?: string;
     /** 테스트 주입용. 기본값은 SDK의 readProjectEnv. */
     readEnv?: (dir: string) => Record<string, string>;
 }
+/** 비밀값은 앞 네 글자까지만 — 8자 이하면 하나도 보이지 않는다. */
+export declare function maskSecretValue(value: string): string;
 export declare function maskEnvValue(key: string, value: string): string;
 /** 동의를 구하기 전에는 존재만 확인한다. 내용은 열지 않는다. */
 export declare function findDotenvFile(dir: string): string | null;
-export declare function envAddGuidance(keys: string[]): string[];
+/**
+ * 값을 채우는 명령 안내. `env add KEY`만 쓰면 target이 `all`이라 production에도
+ * 닿으므로, 환경에 배포할 때는 그 환경의 slug를 붙여 그 환경에만 저장하게 한다.
+ */
+export declare function envAddGuidance(keys: string[], environment?: string): string[];
 /**
  * 누락된 env 키를 채운다. dotenv 파일은 사용자가 명시적으로 동의한 뒤에만
  * 열리고, 그때도 요청된 키의 값만 꺼낸다 — 파일의 나머지 내용은 전송되지 않는다.

package/dist/env-surface.d.ts

@@ -0,0 +1,12 @@
+import type { EnvVarInfo } from "@next-deploy/sdk";
+/**
+ * The values one surface gets, one per key, the way the server's
+ * `envForSurface` picks them for a deployment: the surface's own row beats
+ * `all` whichever the list shows first, and no other surface's row applies
+ * (preview's never reaches an environment). A row's target is its surface's
+ * name: `production`, `preview` or an environment's slug.
+ *
+ * A leaf module on purpose: `naro env pull` and the library deploy (which MCP
+ * imports) both read it, and neither should pull in the other's commands.
+ */
+export declare function pullEnv(rows: EnvVarInfo[], surface: string): Record<string, string>;