naro-cli 0.18.0 → 0.19.0

package/dist/index.js

@@ -33,8 +33,10 @@ import {
   generateTypes,
   indexesFromRows,
   isBookmark,
+  isEnvTargetName,
   isExpired,
   isNaroError,
+  isReservedEnvTarget,
   isStalledBackend,
   isTerminalStatus,
   lintSchema,
@@ -42,11 +44,13 @@ import {
   loadPolicy,
   loadStoredSession,
   login,
+  maskEnvValue,
   migrationNameMismatch,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
+  parseDotenv,
   parseGitHubRemote,
   parsePolicyNode,
   parsePolicyStatement,
@@ -57,6 +61,7 @@ import {
   policiesLostByReset,
   projectPath,
   promptForMissingEnv,
+  pullEnv,
   quoteIdent,
   quotePolicyName,
   readProjectLink,
@@ -86,7 +91,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-WLC42Y6U.js";
+} from "./chunk-DEEFHVDZ.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -125,7 +130,8 @@ var BOOLEAN_FLAGS = {
   "--empty": "empty",
   "--recursive": "recursive",
   "-r": "recursive",
-  "--upsert": "upsert"
+  "--upsert": "upsert",
+  "--no-branch": "noBranch"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -181,7 +187,10 @@ var STRING_FLAGS = {
   "--allowed-mime-types": "allowedMimeTypes",
   "--content-type": "contentType",
   "--cache-control": "cacheControl",
-  "--search": "search"
+  "--search": "search",
+  "--copy-env": "copyEnv",
+  "--database": "database",
+  "--protection": "protection"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -523,7 +532,7 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
@@ -2536,7 +2545,7 @@ async function runDbLint(context) {
     (message) => context.output.warn(message)
   );
   const input = {
-    tables: tables.filter((table2) => !shadow.has(table2.name)),
+    tables: tables.filter((table3) => !shadow.has(table3.name)),
     foreignKeyCheck,
     quickCheck: quick.rows.map(firstCell),
     triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
@@ -3263,7 +3272,7 @@ function conditionsFrom(flags) {
     );
   return conditions;
 }
-function patchFromFile(context, path, table2) {
+function patchFromFile(context, path, table3) {
   let text;
   try {
     text = readFileSync4(resolve3(context.cwd, path), "utf8");
@@ -3285,9 +3294,9 @@ function patchFromFile(context, path, table2) {
   if (Object.hasOwn(body, "table")) {
     if (typeof named !== "string")
       refuse2(`${path}: table must be a string, the table's name.`);
-    if (table2 !== void 0 && asciiLower(named) !== asciiLower(table2))
+    if (table3 !== void 0 && asciiLower(named) !== asciiLower(table3))
       refuse2(
-        `${path} is the policy of ${printable(named)}, not ${printable(table2)}. Remove its "table" to set it on ${printable(table2)}.`
+        `${path} is the policy of ${printable(named)}, not ${printable(table3)}. Remove its "table" to set it on ${printable(table3)}.`
       );
   }
   const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
@@ -3300,7 +3309,7 @@ function patchFromFile(context, path, table2) {
 function asciiLower(text) {
   return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
 }
-function policyPatch(flags, context, table2) {
+function policyPatch(flags, context, table3) {
   if (flags.fromFile !== void 0) {
     if (OTHER_FLAGS.some(
       (key) => flags[key] !== void 0 && flags[key] !== false
@@ -3309,7 +3318,7 @@ function policyPatch(flags, context, table2) {
         "--from-file takes the whole policy: leave out the other policy options."
       );
     if (!context) refuse2(SET_USAGE);
-    return patchFromFile(context, flags.fromFile, table2);
+    return patchFromFile(context, flags.fromFile, table3);
   }
   const patch = {};
   for (const action of POLICY_ACTIONS) {
@@ -3448,7 +3457,7 @@ function policyTable(policies) {
   const widths = header.map(
     (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
   );
-  const table2 = [header, ...rows].map(
+  const table3 = [header, ...rows].map(
     (cells) => cells.map(
       (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
     ).join("  ").trimEnd()
@@ -3465,10 +3474,10 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table2;
+  if (lines.length === 0) return table3;
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
-    ...table2,
+    ...table3,
     "",
     ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
   ];
@@ -3485,39 +3494,39 @@ function statementLine(policy) {
     );
   return shownStatement(policy, policy.table, "naro policy list --json");
 }
-function policyNamed(name, table2) {
-  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table2))}`;
+function policyNamed(name, table3) {
+  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table3))}`;
 }
-function shownStatement(statement, table2, exact) {
+function shownStatement(statement, table3, exact) {
   if (isPrintable(statement.sql)) return statement.sql;
   return printable(
-    `-- ${policyNamed(statement.name, table2)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
+    `-- ${policyNamed(statement.name, table3)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
   );
 }
 function policyStatements(policies) {
   const lines = [];
-  let table2;
+  let table3;
   for (const policy of policies) {
-    if (table2 !== void 0 && policy.table !== table2) lines.push("");
-    table2 = policy.table;
+    if (table3 !== void 0 && policy.table !== table3) lines.push("");
+    table3 = policy.table;
     lines.push(statementLine(policy));
   }
   return lines;
 }
 async function runPolicyList(context) {
-  const table2 = context.flags.table;
+  const table3 = context.flags.table;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
-    table2 === void 0 ? {} : { table: table2 }
+    table3 === void 0 ? {} : { table: table3 }
   );
   let lines;
   if (policies.length > 0)
     lines = [...policyStatements(policies), "", DEFAULT_DENY];
-  else if (table2 !== void 0)
+  else if (table3 !== void 0)
     lines = [
-      `No policies on ${printable(table2)}: anon and signed-in requests to it are denied.`
+      `No policies on ${printable(table3)}: anon and signed-in requests to it are denied.`
     ];
   else
     lines = [
@@ -3613,17 +3622,17 @@ async function runPolicyCreate(context) {
 }
 async function runPolicyDrop(context) {
   const [name] = context.positionalOrThrow(1, DROP_USAGE);
-  const table2 = context.flags.table;
-  if (table2 === void 0 || table2 === "") refuse2(DROP_USAGE);
+  const table3 = context.flags.table;
+  if (table3 === void 0 || table3 === "") refuse2(DROP_USAGE);
   await confirmOrAbort(
     context,
-    `Drop policy ${printable(name)} on ${printable(table2)}? It stops applying within about 10 seconds.`
+    `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
-    table2,
+    table3,
     name
   );
   context.output.result({ projectId, dropped }, [
@@ -3631,13 +3640,13 @@ async function runPolicyDrop(context) {
   ]);
 }
 async function runPolicySet(context) {
-  const [table2] = context.positionalOrThrow(1, SET_USAGE);
-  const patch = policyPatch(context.flags, context, table2);
+  const [table3] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table3);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
-    table2,
+    table3,
     patch
   );
   let named;
@@ -3658,14 +3667,14 @@ async function runPolicySet(context) {
   );
 }
 async function runPolicyRemove(context) {
-  const [table2] = context.positionalOrThrow(1, REMOVE_USAGE);
+  const [table3] = context.positionalOrThrow(1, REMOVE_USAGE);
   await confirmOrAbort(
     context,
-    `Remove every policy on ${printable(table2)}? Anon and signed-in requests to it are denied from then on.`
+    `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policy = await client.backend.removePolicy(projectId, table2);
+  const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
   context.output.result({ projectId, removed: true, policy }, [
     names.length === 0 ? `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.` : `\u2705 Removed ${names.length === 1 ? "policy" : "policies"} ${names.map(printable).join(", ")} on ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
@@ -3752,14 +3761,14 @@ function parseColumnSpec(spec) {
       column.default = defaultValue(value);
     else if (value !== void 0 && key === "references") {
       const dot = value.lastIndexOf(".");
-      const table2 = dot < 0 ? "" : value.slice(0, dot);
+      const table3 = dot < 0 ? "" : value.slice(0, dot);
       const target = dot < 0 ? "" : value.slice(dot + 1);
-      if (!table2 || !target)
+      if (!table3 || !target)
         throw new NaroError(
           "VALIDATION_FAILED",
           `${shown}: references needs <table>.<column>.`
         );
-      column.references = { table: table2, column: target };
+      column.references = { table: table3, column: target };
     } else if (value !== void 0 && key === "ondelete") {
       onDelete = ON_DELETE[value.toLowerCase()];
       if (!onDelete)
@@ -3839,14 +3848,6 @@ function removedLines(policy, dryRun) {
   }
   return lines;
 }
-function removedBeforeFailure(error) {
-  if (!isNaroError(error)) return [];
-  const removed = error.details?.removedPolicies;
-  if (!Array.isArray(removed)) return [];
-  return removed.filter(
-    (entry) => typeof entry === "object" && entry !== null && typeof entry.table === "string" && entry.ownerColumn !== void 0
-  );
-}
 async function runSchemaChange(context, operations, question) {
   const dryRun = context.flags.dryRun === true;
   if (question !== void 0 && !dryRun)
@@ -3872,12 +3873,6 @@ async function runSchemaChange(context, operations, question) {
   const result = await client.db.schema(projectId, sent, {
     ...dryRun ? { dryRun: true } : {},
     name
-  }).catch((error) => {
-    if (!context.flags.json)
-      for (const policy of removedBeforeFailure(error))
-        for (const line of removedLines(policy, false))
-          context.output.warn(line);
-    throw error;
   });
   const sqlLines = result.sql.trimEnd().split("\n").map(printable);
   const removed = result.removedPolicies ?? [];
@@ -3938,16 +3933,16 @@ async function runDbIndexUsage() {
   throw new NaroError("VALIDATION_FAILED", USAGE2.index);
 }
 async function runDbTableCreate(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
-  if (!table2 || specs.length === 0)
+  if (!table3 || specs.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.create);
   const columns = specs.map(parseColumnSpec);
   const owner = context.flags.ownerColumn;
   await runSchemaChange(context, [
     {
       op: "createTable",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.ifNotExists ? { ifNotExists: true } : {},
       ...owner === void 0 ? {} : { owner: { column: owner } }
@@ -3955,56 +3950,56 @@ async function runDbTableCreate(context) {
   ]);
 }
 async function runDbTableAddColumn(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
   const [spec] = specs;
-  if (!table2 || spec === void 0 || specs.length !== 1)
+  if (!table3 || spec === void 0 || specs.length !== 1)
     throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
   await runSchemaChange(context, [
-    { op: "addColumn", table: table2, column: parseColumnSpec(spec) }
+    { op: "addColumn", table: table3, column: parseColumnSpec(spec) }
   ]);
 }
 async function runDbTableRenameColumn(context) {
-  const [table2, column, to] = context.positionals;
-  if (!table2 || !column || !to)
+  const [table3, column, to] = context.positionals;
+  if (!table3 || !column || !to)
     throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
-  await runSchemaChange(context, [{ op: "renameColumn", table: table2, column, to }]);
+  await runSchemaChange(context, [{ op: "renameColumn", table: table3, column, to }]);
 }
 async function runDbTableRename(context) {
-  const [table2, to] = context.positionals;
-  if (!table2 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
-  await runSchemaChange(context, [{ op: "renameTable", table: table2, to }]);
+  const [table3, to] = context.positionals;
+  if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
 async function runDbTableDropColumn(context) {
-  const [table2, column] = context.positionals;
-  if (!table2 || !column)
+  const [table3, column] = context.positionals;
+  if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
-  const target = `${table2}.${column}`;
+  const target = `${table3}.${column}`;
   await runSchemaChange(
     context,
-    [{ op: "dropColumn", table: table2, column, confirm: target }],
+    [{ op: "dropColumn", table: table3, column, confirm: target }],
     `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
-  const [table2] = context.positionals;
-  if (!table2) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const [table3] = context.positionals;
+  if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
   await runSchemaChange(
     context,
-    [{ op: "dropTable", table: table2, confirm: table2 }],
-    `Drop table ${printable(table2)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    [{ op: "dropTable", table: table3, confirm: table3 }],
+    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
-  const [table2, list] = context.positionals;
+  const [table3, list] = context.positionals;
   const columns = listFlag(list);
-  if (!table2 || columns.length === 0)
+  if (!table3 || columns.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
   const name = context.flags.name;
   await runSchemaChange(context, [
     {
       op: "createIndex",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.unique ? { unique: true } : {},
       ...name === void 0 ? {} : { name }
@@ -4337,10 +4332,30 @@ async function runUnlink(context) {
 }
 
 // src/commands/deploy.ts
+function deployTarget(flags) {
+  if (flags.env === void 0)
+    return { production: flags.prod, environment: void 0 };
+  if (flags.env === "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production, preview or an environment name."
+    );
+  if (flags.prod)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env and --prod cannot be used together."
+    );
+  if (flags.env === "production")
+    return { production: true, environment: void 0 };
+  if (flags.env === "preview")
+    return { production: false, environment: void 0 };
+  return { production: false, environment: flags.env };
+}
 async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
   const { flags, output } = context;
+  const target = deployTarget(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
-  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
+  if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
@@ -4360,10 +4375,20 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
       teamSlug: team.slug,
       rootDirectory: flags.root ?? null,
       branch: flags.branch,
-      production: flags.prod,
+      production: target.production,
+      ...target.environment !== void 0 && {
+        environment: target.environment
+      },
       ...canPrompt && {
         onMissingEnv: (keys) => promptForMissingEnv(
-          { cwd: context.cwd, prompter: context.prompter, output },
+          {
+            cwd: context.cwd,
+            prompter: context.prompter,
+            output,
+            ...target.environment !== void 0 && {
+              environment: target.environment
+            }
+          },
           keys
         )
       },
@@ -4390,20 +4415,22 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
     teamSlug: result.teamSlug
   });
   const inspect = `${controlPlaneUrl()}${projectPath(result.teamSlug, result.projectSlug)}`;
+  const surface = result.environment ?? (result.production ? "production" : "preview");
   context.output.result(
     {
       deploymentId: result.deploymentId,
       projectId: result.projectId,
       status: result.status,
       url: result.url,
-      target: result.production ? "production" : "preview",
+      target: surface,
+      environment: result.environment ?? null,
       teamSlug: result.teamSlug,
       inspectUrl: inspect,
       missingEnvKeys: result.missingEnvKeys
     },
     [
       "",
-      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
+      `\u2705 Deployment ready (${surface})`,
       "",
       `   ${result.url}`,
       `   Inspect  ${inspect}`
@@ -4815,18 +4842,29 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { chmodSync, existsSync, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve4 } from "path";
-var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var KEY_MAX_LENGTH = 256;
+var IMPORT_BATCH_SIZE = 100;
+var VALUE_MAX_BYTES = 5 * 1024;
+var TARGET_USAGE = "[production|preview|all|<environment>]";
+function validKey(key) {
+  return KEY_RE.test(key) && key.length <= KEY_MAX_LENGTH;
+}
+function isSecretKey(key) {
+  return !key.startsWith("NEXT_PUBLIC_");
+}
+function variables(count2) {
+  return `${String(count2)} variable${count2 === 1 ? "" : "s"}`;
+}
 function parseTarget(value) {
   if (value === void 0) return "all";
-  if (!TARGETS.has(value))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Environment must be production, preview or all."
-    );
-  return value;
+  if (isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "Target must be production, preview, all or an environment name."
+  );
 }
 function maskedValue(row) {
   if (!row.isSecret) return row.value ?? "";
@@ -4857,12 +4895,9 @@ async function runEnvList(context) {
   );
 }
 async function runEnvAdd(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env add KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env add KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
-  if (!key || !KEY_RE.test(key) || key.length > 256)
+  if (!key || !validKey(key))
     throw new NaroError(
       "VALIDATION_FAILED",
       "Keys must look like MY_VARIABLE (letters, digits, underscore)."
@@ -4870,25 +4905,38 @@ async function runEnvAdd(context) {
   const target = parseTarget(targetArg);
   const projectId = await context.resolveProjectId();
   const client = await context.client();
+  const typed = process.stdin.isTTY === true;
+  if (typed) {
+    await client.projects.get(projectId);
+    if (!isReservedEnvTarget(target))
+      await client.environments.get(projectId, target);
+  }
   let value;
-  if (!process.stdin.isTTY) {
+  if (!typed) {
     value = await readStdin();
   } else {
     value = await context.prompter.askHidden(`? What's the value of ${key}? `);
   }
   if (value.length === 0)
     throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
-  const isSecret = !key.startsWith("NEXT_PUBLIC_");
-  await client.env.set(projectId, [{ key, value, target, isSecret }]);
-  context.output.result({ projectId, key, target, isSecret }, [
-    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  const isSecret = isSecretKey(key);
+  let saved = target;
+  try {
+    await client.env.set(projectId, [{ key, value, target, isSecret }]);
+  } catch (error) {
+    if (!typed || target !== "all" || !(error instanceof NaroError) || error.code !== "FORBIDDEN" || !await context.prompter.confirm(
+      `${error.message} Save ${key} for preview only?`
+    ))
+      throw error;
+    saved = "preview";
+    await client.env.set(projectId, [{ key, value, target: saved, isSecret }]);
+  }
+  context.output.result({ projectId, key, target: saved, isSecret }, [
+    `\u2705 Added ${key} (${saved}${isSecret ? ", secret" : ""})`
   ]);
 }
 async function runEnvRemove(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env remove KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env remove KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
   const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
   await confirmOrAbort(
@@ -4902,23 +4950,73 @@ async function runEnvRemove(context) {
     `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
   ]);
 }
-async function runEnvPull(context) {
-  const file = context.positionals[0] ?? ".env.local";
-  const surface = context.flags.env === "production" ? "production" : "preview";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+async function runEnvImport(context) {
+  context.positionalOrThrow(1, `Usage: naro env import <file> ${TARGET_USAGE}`);
+  const [file, targetArg] = context.positionals;
+  const target = parseTarget(targetArg);
+  let text;
+  try {
+    text = readFileSync5(resolve4(context.cwd, file), "utf8");
+  } catch {
+    throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
+  }
+  const vars = Object.entries(parseDotenv(text));
+  if (vars.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No variables found in ${file}.`);
+  const invalid = vars.map(([key]) => key).filter((key) => !validKey(key));
+  if (invalid.length > 0)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "--env must be production or preview."
+      `Invalid keys in ${file}: ${invalid.join(", ")}.`
+    );
+  const oversized = vars.filter(([, value]) => Buffer.byteLength(value, "utf8") > VALUE_MAX_BYTES).map(([key]) => key);
+  if (oversized.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Values over 5 KB in ${file}: ${oversized.join(", ")}.`
     );
-  const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const rows = await client.env.list(projectId, { reveal: true });
-  const selected = rows.filter(
-    (row) => row.target === "all" || row.target === surface
+  context.output.log(`Variables in ${file}:`);
+  for (const [key, value] of vars)
+    context.output.log(`  ${key.padEnd(32)} ${maskEnvValue(key, value)}`);
+  await confirmOrAbort(
+    context,
+    `Upload ${variables(vars.length)} to ${target}?`
   );
-  const vars = Object.fromEntries(
-    selected.map((row) => [row.key, row.value ?? ""])
+  const client = await context.client();
+  const entries = vars.map(([key, value]) => ({
+    key,
+    value,
+    target,
+    isSecret: isSecretKey(key)
+  }));
+  for (let start = 0; start < entries.length; start += IMPORT_BATCH_SIZE)
+    await client.env.set(
+      projectId,
+      entries.slice(start, start + IMPORT_BATCH_SIZE)
+    );
+  context.output.result({ projectId, file, target, count: entries.length }, [
+    `\u2705 Imported ${variables(entries.length)} (${target})`
+  ]);
+}
+function parsePullSurface(value) {
+  if (value === void 0) return "preview";
+  if (value !== "all" && isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--env must be production, preview or an environment name."
   );
+}
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = parsePullSurface(context.flags.env);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (!isReservedEnvTarget(surface))
+    await client.environments.get(projectId, surface);
+  const rows = await client.env.list(projectId, { reveal: true });
+  const vars = pullEnv(rows, surface);
+  const count2 = Object.keys(vars).length;
   const path = resolve4(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
@@ -4931,10 +5029,137 @@ ${serializeDotenv(vars)}`,
     { mode: 384 }
   );
   chmodSync(path, 384);
-  context.output.result(
-    { projectId, file, environment: surface, count: selected.length },
-    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+  context.output.result({ projectId, file, environment: surface, count: count2 }, [
+    `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
+  ]);
+}
+
+// src/commands/environments.ts
+var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
+var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
+var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var NO_BRANCH = "\u2014";
+function parseCopyEnv(value) {
+  if (value === void 0) return void 0;
+  if (value === "preview" || value === "production") return value;
+  if (value === "none") return null;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--copy-env must be preview, production or none."
+  );
+}
+function parseDatabase(value) {
+  if (value === void 0) return void 0;
+  if (value === "schema" || value === "empty") return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--database must be schema or empty."
+  );
+}
+function parseProtection(value) {
+  if (value === void 0) return void 0;
+  if (value === "on") return true;
+  if (value === "off") return false;
+  throw new NaroError("VALIDATION_FAILED", "--protection must be on or off.");
+}
+function table2(rows) {
+  const widths = (rows[0] ?? []).map(
+    (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
+  );
+  return rows.map(
+    (row) => row.map(
+      (cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)
+    ).join("  ")
+  );
+}
+function environmentRow(environment) {
+  return [
+    environment.slug,
+    environment.url,
+    environment.branch ?? NO_BRANCH,
+    environment.protectionEnabled ? "on" : "off"
+  ];
+}
+async function runEnvironmentsList(context) {
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const { environments, limit } = await client.environments.list(projectId);
+  const count2 = String(environments.length);
+  context.output.result({ projectId, environments, limit }, [
+    ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
+      ["slug", "url", "branch", "protection"],
+      ...environments.map(environmentRow)
+    ]),
+    limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
+  ]);
+}
+async function runEnvironmentsCreate(context) {
+  const [slug] = context.positionalOrThrow(1, CREATE_USAGE2);
+  const { branch, copyEnv, database } = context.flags;
+  const copyEnvFrom = parseCopyEnv(copyEnv);
+  const seed = parseDatabase(database);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const environment = await client.environments.create(projectId, {
+    slug,
+    ...branch !== void 0 && { branch },
+    // null is a value here (copy nothing): only undefined leaves the key out.
+    ...copyEnvFrom !== void 0 && { copyEnvFrom },
+    ...seed !== void 0 && { database: seed }
+  });
+  context.output.result({ projectId, environment }, [
+    `\u2705 Created environment ${environment.slug} \u2192 ${environment.url}`
+  ]);
+}
+async function runEnvironmentsSet(context) {
+  const [slug] = context.positionalOrThrow(1, SET_USAGE2);
+  const { branch, noBranch, protection } = context.flags;
+  if (branch !== void 0 && noBranch === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--branch and --no-branch cannot be used together."
+    );
+  const protectionEnabled = parseProtection(protection);
+  if (branch === void 0 && noBranch !== true && protectionEnabled === void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Nothing to change: pass --branch, --no-branch or --protection."
+    );
+  const patch = {
+    ...branch !== void 0 && { branch },
+    ...noBranch === true && { branch: null },
+    ...protectionEnabled !== void 0 && { protectionEnabled }
+  };
+  const projectId = await context.resolveProjectId();
+  if (protectionEnabled === false)
+    await confirmOrAbort(
+      context,
+      `Turn off protection for ${slug}? Anyone with the link can open it.`
+    );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.update(
+    projectId,
+    found.id,
+    patch
+  );
+  context.output.result({ projectId, environment }, [
+    `\u2705 Updated environment ${slug}`
+  ]);
+}
+async function runEnvironmentsDelete(context) {
+  const [slug] = context.positionalOrThrow(1, DELETE_USAGE);
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    `Delete environment ${slug}? Its worker and protection key are removed.`
   );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  await client.environments.delete(projectId, found.id);
+  context.output.result({ projectId, slug, deleted: true }, [
+    `\u2705 Deleted environment ${slug}`
+  ]);
 }
 
 // src/commands/gen.ts
@@ -4954,7 +5179,7 @@ async function runGenTypes(context) {
     read.policies === void 0 ? {} : { policies: read.policies }
   );
   const undescribed = tables.flatMap(
-    (table2) => table2.error === void 0 ? [] : [{ name: table2.name, error: table2.error }]
+    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
   );
   for (const { name, error } of undescribed)
     context.output.warn(
@@ -5395,7 +5620,7 @@ function count(n, noun) {
 }
 
 // src/commands/storage.ts
-var CREATE_USAGE2 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
+var CREATE_USAGE3 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
 var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]";
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
 var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
@@ -5535,7 +5760,7 @@ async function runStorageBucketList(context) {
   );
 }
 async function runStorageBucketCreate(context) {
-  const name = bucketName(context, CREATE_USAGE2);
+  const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -7152,8 +7377,8 @@ function patternOf(pattern) {
 }
 var MAX_LIMIT = 1e3;
 var CAP = `one select reads at most ${String(MAX_LIMIT)} rows, by limit() or range()`;
-function initialState(table2) {
-  return { table: table2, problem: null, filters: [], columns: "*", order: [] };
+function initialState(table3) {
+  return { table: table3, problem: null, filters: [], columns: "*", order: [] };
 }
 function copyRow(row) {
   return { ...row };
@@ -7386,11 +7611,11 @@ var SelectBuilder = class extends FilterBuilder {
     return this.next({ single: "maybe" });
   }
   build() {
-    const { table: table2, columns, order, limit, offset, single } = this.state;
+    const { table: table3, columns, order, limit, offset, single } = this.state;
     return {
       version: 1,
       action: "select",
-      table: table2,
+      table: table3,
       columns: columns === "*" ? "*" : [...columns],
       ...this.filtersPart(),
       ...order.length === 0 ? {} : { order: order.map((term) => ({ ...term })) },
@@ -7406,11 +7631,11 @@ var InsertBuilder = class extends Builder {
     return this.withReturning(columns);
   }
   build() {
-    const { table: table2, rows = [], returning } = this.state;
+    const { table: table3, rows = [], returning } = this.state;
     return {
       version: 1,
       action: "insert",
-      table: table2,
+      table: table3,
       rows: rows.map(copyRow),
       ...returning === void 0 ? {} : { returning }
     };
@@ -7427,7 +7652,7 @@ var MutationBuilder = class extends FilterBuilder {
   }
   build() {
     const {
-      table: table2,
+      table: table3,
       action,
       values = {},
       returning,
@@ -7438,10 +7663,10 @@ var MutationBuilder = class extends FilterBuilder {
       ...returning === void 0 ? {} : { returning },
       ...allowUnfiltered === void 0 ? {} : { allowUnfiltered }
     };
-    return action === "delete" ? { version: 1, action: "delete", table: table2, ...tail } : {
+    return action === "delete" ? { version: 1, action: "delete", table: table3, ...tail } : {
       version: 1,
       action: "update",
-      table: table2,
+      table: table3,
       values: copyRow(values),
       ...tail
     };
@@ -7450,9 +7675,9 @@ var MutationBuilder = class extends FilterBuilder {
 var TableBuilder = class {
   #run;
   #table;
-  constructor(run, table2) {
+  constructor(run, table3) {
     this.#run = run;
-    this.#table = table2;
+    this.#table = table3;
   }
   /** `"*"` (the default) or `"id, title"`. */
   select(columns) {
@@ -8268,8 +8493,8 @@ var NaroClient2 = class {
     this.storage = new StorageClient(http, this.auth);
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
-  from(table2) {
-    return new TableBuilder(this.#run, table2);
+  from(table3) {
+    return new TableBuilder(this.#run, table3);
   }
 };
 function createClient(options) {
@@ -8918,15 +9143,16 @@ function meterRow(meter, limitsKnown) {
   if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
   if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
   if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
-  return [
-    label3,
-    used,
-    formatCount(meter.limit),
-    `${String(meter.percent ?? 0)}%`
-  ];
+  return [label3, used, formatCount(meter.limit), usedPercent(meter)];
+}
+function usedPercent(meter) {
+  const percent2 = meter.percent ?? 0;
+  return percent2 === 0 && meter.used > 0 ? "<1%" : `${String(percent2)}%`;
 }
 function projectName(project) {
   if (project.deleted) return `Deleted project ${printable(project.projectId)}`;
+  if (project.moved)
+    return `Moved to another team ${printable(project.projectId)}`;
   return printable(project.name ?? project.projectId);
 }
 function usageLines2(report, summary) {
@@ -8995,6 +9221,7 @@ Usage:
 
   naro deploy [--prod]               Build locally and deploy (preview by default)
        [--root <dir>] [--name <name>]  --root points at the app in a monorepo
+       [--env <name>]                  Deploy to a named environment instead of preview (not with --prod)
   naro deployments                   List deployments of the linked project
   naro inspect <deployment-id>       Show one deployment + build logs
   naro cancel <deployment-id>        Stop a build that is still running
@@ -9020,10 +9247,19 @@ Usage:
   naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
   naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
 
-  naro env list                      List env vars (secrets masked)
-  naro env add KEY [environment]     Add/update (value from prompt or stdin)
-  naro env remove KEY [environment]  Remove
+  naro env list                      List env vars (secrets masked); an environment's value shows its name
+  naro env add KEY [target]          Add/update (value from prompt or stdin)
+  naro env remove KEY [target]       Remove; with no target only production, preview and all, never an environment's
+  naro env import <file> [target]    Upload a dotenv file's variables (asks first; --yes in CI)
   naro env pull [file]               Write env vars to .env.local
+       target is production, preview, all or an environment name; add and import use all when none is given
+
+  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
+                                     A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
+  naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
+                                     Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -9181,7 +9417,14 @@ Global options:
   --device <d>    Only this device: desktop, mobile or tablet (naro analytics, naro insights)
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull: preview by default)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
+                  branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
+  --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
+  --copy-env <source>  Where a new environment's variables come from: preview (default), production or none (naro environments create)
+  --database <seed>  What a new environment's database starts with: schema (default) or empty (naro environments create)
+  --protection <on|off>  on: only members of the project can open the environment; off: anyone with the link can
+                  (naro environments set; off asks first, --yes in CI)
   --no-www        Register the apex alone (naro domains add)
   --file <path>   SQL file to run (naro db query, naro policy create)
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
@@ -9447,11 +9690,41 @@ function route(parsed) {
         case "remove":
         case "rm":
           return { handler: runEnvRemove, positionals: positionals.slice(1) };
+        case "import":
+          return { handler: runEnvImport, positionals: positionals.slice(1) };
         case "pull":
           return { handler: runEnvPull, positionals: positionals.slice(1) };
         default:
           return null;
       }
+    // Spec 2026-10-18-named-environments §14.2.
+    case "environments":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return {
+            handler: runEnvironmentsList,
+            positionals: positionals.slice(1)
+          };
+        case "create":
+          return {
+            handler: runEnvironmentsCreate,
+            positionals: positionals.slice(1)
+          };
+        case "set":
+          return {
+            handler: runEnvironmentsSet,
+            positionals: positionals.slice(1)
+          };
+        case "delete":
+          return {
+            handler: runEnvironmentsDelete,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
     case "domains":
       switch (sub) {
         case void 0:
@@ -9617,7 +9890,7 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync5(
+      readFileSync6(
         join6(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )