naro-cli 0.18.0 → 0.19.1

package/dist/index.js

@@ -18,14 +18,17 @@ import {
   SPEED_INSIGHTS_METRICS,
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
   STORAGE_OBJECTS_TABLE,
+  STORAGE_SUBQUERIES_SQL,
   buildResetPlan,
   cellText,
+  checkObjectName,
   clearSession,
   commentText,
   compareMigrations,
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
+  dataError,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
@@ -33,8 +36,10 @@ import {
   generateTypes,
   indexesFromRows,
   isBookmark,
+  isEnvTargetName,
   isExpired,
   isNaroError,
+  isReservedEnvTarget,
   isStalledBackend,
   isTerminalStatus,
   lintSchema,
@@ -42,11 +47,13 @@ import {
   loadPolicy,
   loadStoredSession,
   login,
+  maskEnvValue,
   migrationNameMismatch,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
+  parseDotenvDetailed,
   parseGitHubRemote,
   parsePolicyNode,
   parsePolicyStatement,
@@ -57,6 +64,7 @@ import {
   policiesLostByReset,
   projectPath,
   promptForMissingEnv,
+  pullEnv,
   quoteIdent,
   quotePolicyName,
   readProjectLink,
@@ -66,6 +74,7 @@ import {
   resetFileRefusedMessage,
   resetPoliciesLostMessage,
   resetPoliciesWithTablesMessage,
+  resetStorageOutdatedMessage,
   resolveAuth,
   resolveMigrationsDir,
   saveSession,
@@ -75,6 +84,7 @@ import {
   snapshotFromRows,
   splitPolicyStatements,
   splitStatements,
+  storageRefusalOfFiles,
   storedPolicySql,
   summarizeStatement,
   summarizeTeamUsage,
@@ -86,7 +96,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-WLC42Y6U.js";
+} from "./chunk-ZO2BEC46.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -125,7 +135,8 @@ var BOOLEAN_FLAGS = {
   "--empty": "empty",
   "--recursive": "recursive",
   "-r": "recursive",
-  "--upsert": "upsert"
+  "--upsert": "upsert",
+  "--no-branch": "noBranch"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -181,7 +192,10 @@ var STRING_FLAGS = {
   "--allowed-mime-types": "allowedMimeTypes",
   "--content-type": "contentType",
   "--cache-control": "cacheControl",
-  "--search": "search"
+  "--search": "search",
+  "--copy-env": "copyEnv",
+  "--database": "database",
+  "--protection": "protection"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -523,7 +537,7 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
@@ -2536,7 +2550,7 @@ async function runDbLint(context) {
     (message) => context.output.warn(message)
   );
   const input = {
-    tables: tables.filter((table2) => !shadow.has(table2.name)),
+    tables: tables.filter((table3) => !shadow.has(table3.name)),
     foreignKeyCheck,
     quickCheck: quick.rows.map(firstCell),
     triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
@@ -2635,12 +2649,45 @@ async function hasBackend(client, projectId) {
     throw error;
   }
 }
-async function policyPlan(client, projectId, schema, dir, files) {
-  if (!schema.policyTable) {
-    if (await hasBackend(client, projectId))
-      throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
-    return { clearPolicies: false, lost: [], withTables: [] };
+async function refuseStorageOutdated(client, projectId, storageTable, files, texts) {
+  let refused = storageRefusalOfFiles(texts, {
+    storage: storageTable,
+    storageSubqueries: false
+  });
+  if (refused?.needs === "subqueries" && storageTable) {
+    const answer = await client.db.query(projectId, {
+      sql: STORAGE_SUBQUERIES_SQL
+    });
+    if ((answer.statements[0]?.rows.length ?? 0) > 0)
+      refused = storageRefusalOfFiles(texts, {
+        storage: true,
+        storageSubqueries: true
+      });
   }
+  if (refused)
+    throw new NaroError(
+      "BACKEND_OUTDATED",
+      resetStorageOutdatedMessage(files[refused.file] ?? "", refused),
+      {
+        details: {
+          migration: files[refused.file] ?? "",
+          statement: refused.statement
+        }
+      }
+    );
+}
+async function policyPlan(client, projectId, schema, files, texts) {
+  if (!schema.policyTable && await hasBackend(client, projectId))
+    throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
+  await refuseStorageOutdated(
+    client,
+    projectId,
+    schema.storageTable,
+    files,
+    texts
+  );
+  if (!schema.policyTable)
+    return { clearPolicies: false, lost: [], withTables: [] };
   const answer = await client.db.query(projectId, {
     sql: NAMED_POLICY_SQL.list
   });
@@ -2669,7 +2716,7 @@ async function policyPlan(client, projectId, schema, dir, files) {
     ...policiesLostByReset({
       current,
       tables: schema.tables,
-      files: files.map((name) => readFileSync3(join3(dir, name), "utf8")),
+      files: texts,
       // Storage's table stays; its policies are emptied with the rest (PR
       // #85 리뷰). Realtime's messages need no flag: a virtual target, which
       // reset-plan counts as a table always there (Realtime 3-2a).
@@ -2707,6 +2754,7 @@ async function runDbReset(context) {
 ${problemLines.join("\n")}`,
       { details: { problems } }
     );
+  const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
@@ -2722,8 +2770,8 @@ ${problemLines.join("\n")}`,
     client,
     projectId,
     { policyTable: policyTable2, storageTable, tables },
-    dir,
-    files
+    files,
+    texts
   );
   const policiesNotInFiles = policies.lost.map((policy) => ({
     name: `${policy.table}.${policy.name}`,
@@ -3263,7 +3311,7 @@ function conditionsFrom(flags) {
     );
   return conditions;
 }
-function patchFromFile(context, path, table2) {
+function patchFromFile(context, path, table3) {
   let text;
   try {
     text = readFileSync4(resolve3(context.cwd, path), "utf8");
@@ -3285,9 +3333,9 @@ function patchFromFile(context, path, table2) {
   if (Object.hasOwn(body, "table")) {
     if (typeof named !== "string")
       refuse2(`${path}: table must be a string, the table's name.`);
-    if (table2 !== void 0 && asciiLower(named) !== asciiLower(table2))
+    if (table3 !== void 0 && asciiLower(named) !== asciiLower(table3))
       refuse2(
-        `${path} is the policy of ${printable(named)}, not ${printable(table2)}. Remove its "table" to set it on ${printable(table2)}.`
+        `${path} is the policy of ${printable(named)}, not ${printable(table3)}. Remove its "table" to set it on ${printable(table3)}.`
       );
   }
   const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
@@ -3300,7 +3348,7 @@ function patchFromFile(context, path, table2) {
 function asciiLower(text) {
   return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
 }
-function policyPatch(flags, context, table2) {
+function policyPatch(flags, context, table3) {
   if (flags.fromFile !== void 0) {
     if (OTHER_FLAGS.some(
       (key) => flags[key] !== void 0 && flags[key] !== false
@@ -3309,7 +3357,7 @@ function policyPatch(flags, context, table2) {
         "--from-file takes the whole policy: leave out the other policy options."
       );
     if (!context) refuse2(SET_USAGE);
-    return patchFromFile(context, flags.fromFile, table2);
+    return patchFromFile(context, flags.fromFile, table3);
   }
   const patch = {};
   for (const action of POLICY_ACTIONS) {
@@ -3448,7 +3496,7 @@ function policyTable(policies) {
   const widths = header.map(
     (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
   );
-  const table2 = [header, ...rows].map(
+  const table3 = [header, ...rows].map(
     (cells) => cells.map(
       (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
     ).join("  ").trimEnd()
@@ -3465,10 +3513,10 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table2;
+  if (lines.length === 0) return table3;
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
-    ...table2,
+    ...table3,
     "",
     ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
   ];
@@ -3485,39 +3533,39 @@ function statementLine(policy) {
     );
   return shownStatement(policy, policy.table, "naro policy list --json");
 }
-function policyNamed(name, table2) {
-  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table2))}`;
+function policyNamed(name, table3) {
+  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table3))}`;
 }
-function shownStatement(statement, table2, exact) {
+function shownStatement(statement, table3, exact) {
   if (isPrintable(statement.sql)) return statement.sql;
   return printable(
-    `-- ${policyNamed(statement.name, table2)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
+    `-- ${policyNamed(statement.name, table3)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
   );
 }
 function policyStatements(policies) {
   const lines = [];
-  let table2;
+  let table3;
   for (const policy of policies) {
-    if (table2 !== void 0 && policy.table !== table2) lines.push("");
-    table2 = policy.table;
+    if (table3 !== void 0 && policy.table !== table3) lines.push("");
+    table3 = policy.table;
     lines.push(statementLine(policy));
   }
   return lines;
 }
 async function runPolicyList(context) {
-  const table2 = context.flags.table;
+  const table3 = context.flags.table;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
-    table2 === void 0 ? {} : { table: table2 }
+    table3 === void 0 ? {} : { table: table3 }
   );
   let lines;
   if (policies.length > 0)
     lines = [...policyStatements(policies), "", DEFAULT_DENY];
-  else if (table2 !== void 0)
+  else if (table3 !== void 0)
     lines = [
-      `No policies on ${printable(table2)}: anon and signed-in requests to it are denied.`
+      `No policies on ${printable(table3)}: anon and signed-in requests to it are denied.`
     ];
   else
     lines = [
@@ -3613,17 +3661,17 @@ async function runPolicyCreate(context) {
 }
 async function runPolicyDrop(context) {
   const [name] = context.positionalOrThrow(1, DROP_USAGE);
-  const table2 = context.flags.table;
-  if (table2 === void 0 || table2 === "") refuse2(DROP_USAGE);
+  const table3 = context.flags.table;
+  if (table3 === void 0 || table3 === "") refuse2(DROP_USAGE);
   await confirmOrAbort(
     context,
-    `Drop policy ${printable(name)} on ${printable(table2)}? It stops applying within about 10 seconds.`
+    `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
-    table2,
+    table3,
     name
   );
   context.output.result({ projectId, dropped }, [
@@ -3631,13 +3679,13 @@ async function runPolicyDrop(context) {
   ]);
 }
 async function runPolicySet(context) {
-  const [table2] = context.positionalOrThrow(1, SET_USAGE);
-  const patch = policyPatch(context.flags, context, table2);
+  const [table3] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table3);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
-    table2,
+    table3,
     patch
   );
   let named;
@@ -3658,14 +3706,14 @@ async function runPolicySet(context) {
   );
 }
 async function runPolicyRemove(context) {
-  const [table2] = context.positionalOrThrow(1, REMOVE_USAGE);
+  const [table3] = context.positionalOrThrow(1, REMOVE_USAGE);
   await confirmOrAbort(
     context,
-    `Remove every policy on ${printable(table2)}? Anon and signed-in requests to it are denied from then on.`
+    `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policy = await client.backend.removePolicy(projectId, table2);
+  const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
   context.output.result({ projectId, removed: true, policy }, [
     names.length === 0 ? `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.` : `\u2705 Removed ${names.length === 1 ? "policy" : "policies"} ${names.map(printable).join(", ")} on ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
@@ -3752,14 +3800,14 @@ function parseColumnSpec(spec) {
       column.default = defaultValue(value);
     else if (value !== void 0 && key === "references") {
       const dot = value.lastIndexOf(".");
-      const table2 = dot < 0 ? "" : value.slice(0, dot);
+      const table3 = dot < 0 ? "" : value.slice(0, dot);
       const target = dot < 0 ? "" : value.slice(dot + 1);
-      if (!table2 || !target)
+      if (!table3 || !target)
         throw new NaroError(
           "VALIDATION_FAILED",
           `${shown}: references needs <table>.<column>.`
         );
-      column.references = { table: table2, column: target };
+      column.references = { table: table3, column: target };
     } else if (value !== void 0 && key === "ondelete") {
       onDelete = ON_DELETE[value.toLowerCase()];
       if (!onDelete)
@@ -3839,14 +3887,6 @@ function removedLines(policy, dryRun) {
   }
   return lines;
 }
-function removedBeforeFailure(error) {
-  if (!isNaroError(error)) return [];
-  const removed = error.details?.removedPolicies;
-  if (!Array.isArray(removed)) return [];
-  return removed.filter(
-    (entry) => typeof entry === "object" && entry !== null && typeof entry.table === "string" && entry.ownerColumn !== void 0
-  );
-}
 async function runSchemaChange(context, operations, question) {
   const dryRun = context.flags.dryRun === true;
   if (question !== void 0 && !dryRun)
@@ -3872,12 +3912,6 @@ async function runSchemaChange(context, operations, question) {
   const result = await client.db.schema(projectId, sent, {
     ...dryRun ? { dryRun: true } : {},
     name
-  }).catch((error) => {
-    if (!context.flags.json)
-      for (const policy of removedBeforeFailure(error))
-        for (const line of removedLines(policy, false))
-          context.output.warn(line);
-    throw error;
   });
   const sqlLines = result.sql.trimEnd().split("\n").map(printable);
   const removed = result.removedPolicies ?? [];
@@ -3938,16 +3972,16 @@ async function runDbIndexUsage() {
   throw new NaroError("VALIDATION_FAILED", USAGE2.index);
 }
 async function runDbTableCreate(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
-  if (!table2 || specs.length === 0)
+  if (!table3 || specs.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.create);
   const columns = specs.map(parseColumnSpec);
   const owner = context.flags.ownerColumn;
   await runSchemaChange(context, [
     {
       op: "createTable",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.ifNotExists ? { ifNotExists: true } : {},
       ...owner === void 0 ? {} : { owner: { column: owner } }
@@ -3955,56 +3989,56 @@ async function runDbTableCreate(context) {
   ]);
 }
 async function runDbTableAddColumn(context) {
-  const [table2] = context.positionals;
+  const [table3] = context.positionals;
   const specs = columnsFlag(context);
   const [spec] = specs;
-  if (!table2 || spec === void 0 || specs.length !== 1)
+  if (!table3 || spec === void 0 || specs.length !== 1)
     throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
   await runSchemaChange(context, [
-    { op: "addColumn", table: table2, column: parseColumnSpec(spec) }
+    { op: "addColumn", table: table3, column: parseColumnSpec(spec) }
   ]);
 }
 async function runDbTableRenameColumn(context) {
-  const [table2, column, to] = context.positionals;
-  if (!table2 || !column || !to)
+  const [table3, column, to] = context.positionals;
+  if (!table3 || !column || !to)
     throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
-  await runSchemaChange(context, [{ op: "renameColumn", table: table2, column, to }]);
+  await runSchemaChange(context, [{ op: "renameColumn", table: table3, column, to }]);
 }
 async function runDbTableRename(context) {
-  const [table2, to] = context.positionals;
-  if (!table2 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
-  await runSchemaChange(context, [{ op: "renameTable", table: table2, to }]);
+  const [table3, to] = context.positionals;
+  if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
 async function runDbTableDropColumn(context) {
-  const [table2, column] = context.positionals;
-  if (!table2 || !column)
+  const [table3, column] = context.positionals;
+  if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
-  const target = `${table2}.${column}`;
+  const target = `${table3}.${column}`;
   await runSchemaChange(
     context,
-    [{ op: "dropColumn", table: table2, column, confirm: target }],
+    [{ op: "dropColumn", table: table3, column, confirm: target }],
     `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
-  const [table2] = context.positionals;
-  if (!table2) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const [table3] = context.positionals;
+  if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
   await runSchemaChange(
     context,
-    [{ op: "dropTable", table: table2, confirm: table2 }],
-    `Drop table ${printable(table2)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    [{ op: "dropTable", table: table3, confirm: table3 }],
+    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
-  const [table2, list] = context.positionals;
+  const [table3, list] = context.positionals;
   const columns = listFlag(list);
-  if (!table2 || columns.length === 0)
+  if (!table3 || columns.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
   const name = context.flags.name;
   await runSchemaChange(context, [
     {
       op: "createIndex",
-      table: table2,
+      table: table3,
       columns,
       ...context.flags.unique ? { unique: true } : {},
       ...name === void 0 ? {} : { name }
@@ -4079,13 +4113,16 @@ async function runGitConnect(context, overrides = {}) {
   if (cannotAsk(context)) {
     throw new NaroError(
       "REPOSITORY_NOT_ACCESSIBLE",
-      `Naro cannot reach ${fullName} yet. Install the Naro GitHub App at ${first.installUrl}, then run: naro git connect`,
+      `Naro cannot reach ${fullName} yet. Open ${first.installUrl} to give Naro access (if the repository is not among the ones the Naro GitHub App was granted on GitHub, add it there first), then run: naro git connect`,
       { details: { projectId, installUrl: first.installUrl } }
     );
   }
   output.log(`
 \u25B8 Naro needs access to ${fullName}.`);
   output.log(`  Opening ${first.installUrl}`);
+  output.log(
+    "  If the repository is not among the ones the Naro GitHub App was granted on GitHub, add it there first."
+  );
   deps.openBrowser(first.installUrl);
   output.log("  Waiting for the installation to finish...\n");
   await waitForInstall(context, projectId, fullName, deps);
@@ -4337,10 +4374,30 @@ async function runUnlink(context) {
 }
 
 // src/commands/deploy.ts
+function deployTarget(flags) {
+  if (flags.env === void 0)
+    return { production: flags.prod, environment: void 0 };
+  if (flags.env === "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production, preview or an environment name."
+    );
+  if (flags.prod)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env and --prod cannot be used together."
+    );
+  if (flags.env === "production")
+    return { production: true, environment: void 0 };
+  if (flags.env === "preview")
+    return { production: false, environment: void 0 };
+  return { production: false, environment: flags.env };
+}
 async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
   const { flags, output } = context;
+  const target = deployTarget(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
-  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
+  if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
@@ -4360,10 +4417,20 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
       teamSlug: team.slug,
       rootDirectory: flags.root ?? null,
       branch: flags.branch,
-      production: flags.prod,
+      production: target.production,
+      ...target.environment !== void 0 && {
+        environment: target.environment
+      },
       ...canPrompt && {
         onMissingEnv: (keys) => promptForMissingEnv(
-          { cwd: context.cwd, prompter: context.prompter, output },
+          {
+            cwd: context.cwd,
+            prompter: context.prompter,
+            output,
+            ...target.environment !== void 0 && {
+              environment: target.environment
+            }
+          },
           keys
         )
       },
@@ -4390,20 +4457,22 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
     teamSlug: result.teamSlug
   });
   const inspect = `${controlPlaneUrl()}${projectPath(result.teamSlug, result.projectSlug)}`;
+  const surface = result.environment ?? (result.production ? "production" : "preview");
   context.output.result(
     {
       deploymentId: result.deploymentId,
       projectId: result.projectId,
       status: result.status,
       url: result.url,
-      target: result.production ? "production" : "preview",
+      target: surface,
+      environment: result.environment ?? null,
       teamSlug: result.teamSlug,
       inspectUrl: inspect,
       missingEnvKeys: result.missingEnvKeys
     },
     [
       "",
-      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
+      `\u2705 Deployment ready (${surface})`,
       "",
       `   ${result.url}`,
       `   Inspect  ${inspect}`
@@ -4815,18 +4884,30 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { chmodSync, existsSync, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve4 } from "path";
-var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var KEY_MAX_LENGTH = 256;
+var IMPORT_BATCH_SIZE = 100;
+var VALUE_MAX_BYTES = 5 * 1024;
+var STATIC_ASSETS_BINDING = "ASSETS";
+var TARGET_USAGE = "[production|preview|all|<environment>]";
+function validKey(key) {
+  return KEY_RE.test(key) && key.length <= KEY_MAX_LENGTH;
+}
+function isSecretKey(key) {
+  return !key.startsWith("NEXT_PUBLIC_");
+}
+function variables(count2) {
+  return `${String(count2)} variable${count2 === 1 ? "" : "s"}`;
+}
 function parseTarget(value) {
   if (value === void 0) return "all";
-  if (!TARGETS.has(value))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Environment must be production, preview or all."
-    );
-  return value;
+  if (isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "Target must be production, preview, all or an environment name."
+  );
 }
 function maskedValue(row) {
   if (!row.isSecret) return row.value ?? "";
@@ -4857,12 +4938,9 @@ async function runEnvList(context) {
   );
 }
 async function runEnvAdd(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env add KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env add KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
-  if (!key || !KEY_RE.test(key) || key.length > 256)
+  if (!key || !validKey(key))
     throw new NaroError(
       "VALIDATION_FAILED",
       "Keys must look like MY_VARIABLE (letters, digits, underscore)."
@@ -4870,25 +4948,38 @@ async function runEnvAdd(context) {
   const target = parseTarget(targetArg);
   const projectId = await context.resolveProjectId();
   const client = await context.client();
+  const typed = process.stdin.isTTY === true;
+  if (typed) {
+    await client.projects.get(projectId);
+    if (!isReservedEnvTarget(target))
+      await client.environments.get(projectId, target);
+  }
   let value;
-  if (!process.stdin.isTTY) {
+  if (!typed) {
     value = await readStdin();
   } else {
     value = await context.prompter.askHidden(`? What's the value of ${key}? `);
   }
   if (value.length === 0)
     throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
-  const isSecret = !key.startsWith("NEXT_PUBLIC_");
-  await client.env.set(projectId, [{ key, value, target, isSecret }]);
-  context.output.result({ projectId, key, target, isSecret }, [
-    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  const isSecret = isSecretKey(key);
+  let saved = target;
+  try {
+    await client.env.set(projectId, [{ key, value, target, isSecret }]);
+  } catch (error) {
+    if (!typed || target !== "all" || !(error instanceof NaroError) || error.code !== "FORBIDDEN" || !await context.prompter.confirm(
+      `${error.message} Save ${key} for preview only?`
+    ))
+      throw error;
+    saved = "preview";
+    await client.env.set(projectId, [{ key, value, target: saved, isSecret }]);
+  }
+  context.output.result({ projectId, key, target: saved, isSecret }, [
+    `\u2705 Added ${key} (${saved}${isSecret ? ", secret" : ""})`
   ]);
 }
 async function runEnvRemove(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env remove KEY [production|preview|all]"
-  );
+  context.positionalOrThrow(1, `Usage: naro env remove KEY ${TARGET_USAGE}`);
   const [key, targetArg] = context.positionals;
   const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
   await confirmOrAbort(
@@ -4902,40 +4993,237 @@ async function runEnvRemove(context) {
     `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
   ]);
 }
-async function runEnvPull(context) {
-  const file = context.positionals[0] ?? ".env.local";
-  const surface = context.flags.env === "production" ? "production" : "preview";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+async function runEnvImport(context) {
+  context.positionalOrThrow(1, `Usage: naro env import <file> ${TARGET_USAGE}`);
+  const [file, targetArg] = context.positionals;
+  const target = parseTarget(targetArg);
+  let text;
+  try {
+    text = readFileSync5(resolve4(context.cwd, file), "utf8");
+  } catch {
+    throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
+  }
+  const parsed = parseDotenvDetailed(text);
+  const [unclosed] = parsed.unclosedQuotes;
+  if (unclosed !== void 0)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "--env must be production or preview."
+      `Unclosed quote in ${file} at line ${String(unclosed)}.`
+    );
+  const vars = Object.entries(parsed.vars);
+  if (vars.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No variables found in ${file}.`);
+  const invalid = vars.map(([key]) => key).filter((key) => !validKey(key));
+  if (invalid.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Invalid keys in ${file}: ${invalid.join(", ")}.`
+    );
+  if (vars.some(([key]) => key === STATIC_ASSETS_BINDING))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${STATIC_ASSETS_BINDING} is reserved for the project's static files; pick another name.`
+    );
+  const oversized = vars.filter(([, value]) => Buffer.byteLength(value, "utf8") > VALUE_MAX_BYTES).map(([key]) => key);
+  if (oversized.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Values over 5 KB in ${file}: ${oversized.join(", ")}.`
     );
-  const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const rows = await client.env.list(projectId, { reveal: true });
-  const selected = rows.filter(
-    (row) => row.target === "all" || row.target === surface
+  context.output.log(`Variables in ${file}:`);
+  for (const [key, value] of vars)
+    context.output.log(
+      `  ${key.padEnd(32)} ${value === "" ? "(empty)" : maskEnvValue(key, value)}`
+    );
+  await confirmOrAbort(
+    context,
+    `Upload ${variables(vars.length)} to ${target}?`
   );
-  const vars = Object.fromEntries(
-    selected.map((row) => [row.key, row.value ?? ""])
+  const client = await context.client();
+  const entries = vars.map(([key, value]) => ({
+    key,
+    value,
+    target,
+    isSecret: isSecretKey(key)
+  }));
+  if (entries.length > IMPORT_BATCH_SIZE) {
+    const taken = new Set(await client.env.takenBindingNames(projectId));
+    const conflict = entries.find((entry) => taken.has(entry.key));
+    if (conflict)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${conflict.key} is already used by a storage binding.`
+      );
+  }
+  for (let start = 0; start < entries.length; start += IMPORT_BATCH_SIZE)
+    await client.env.set(
+      projectId,
+      entries.slice(start, start + IMPORT_BATCH_SIZE)
+    );
+  context.output.result({ projectId, file, target, count: entries.length }, [
+    `\u2705 Imported ${variables(entries.length)} (${target})`
+  ]);
+}
+function parsePullSurface(value) {
+  if (value === void 0) return "preview";
+  if (value !== "all" && isEnvTargetName(value)) return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--env must be production, preview or an environment name."
   );
+}
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = parsePullSurface(context.flags.env);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (!isReservedEnvTarget(surface))
+    await client.environments.get(projectId, surface);
+  const rows = await client.env.list(projectId, { reveal: true });
+  const vars = pullEnv(rows, surface);
+  const count2 = Object.keys(vars).length;
+  const text = `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
+${serializeDotenv(vars)}`;
   const path = resolve4(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
-  writeFileSync4(
-    path,
-    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
-${serializeDotenv(vars)}`,
-    { mode: 384 }
-  );
+  writeFileSync4(path, text, { mode: 384 });
   chmodSync(path, 384);
-  context.output.result(
-    { projectId, file, environment: surface, count: selected.length },
-    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+  context.output.result({ projectId, file, environment: surface, count: count2 }, [
+    `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
+  ]);
+}
+
+// src/commands/environments.ts
+var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
+var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
+var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var NO_BRANCH = "\u2014";
+function parseCopyEnv(value) {
+  if (value === void 0) return void 0;
+  if (value === "preview" || value === "production") return value;
+  if (value === "none") return null;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--copy-env must be preview, production or none."
+  );
+}
+function parseDatabase(value) {
+  if (value === void 0) return void 0;
+  if (value === "schema" || value === "empty") return value;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    "--database must be schema or empty."
+  );
+}
+function parseProtection(value) {
+  if (value === void 0) return void 0;
+  if (value === "on") return true;
+  if (value === "off") return false;
+  throw new NaroError("VALIDATION_FAILED", "--protection must be on or off.");
+}
+function table2(rows) {
+  const widths = (rows[0] ?? []).map(
+    (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
+  );
+  return rows.map(
+    (row) => row.map(
+      (cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)
+    ).join("  ")
   );
 }
+function environmentRow(environment) {
+  return [
+    environment.slug,
+    environment.url,
+    environment.branch ?? NO_BRANCH,
+    environment.protectionEnabled ? "on" : "off"
+  ];
+}
+async function runEnvironmentsList(context) {
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const { environments, limit } = await client.environments.list(projectId);
+  const count2 = String(environments.length);
+  context.output.result({ projectId, environments, limit }, [
+    ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
+      ["slug", "url", "branch", "protection"],
+      ...environments.map(environmentRow)
+    ]),
+    limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
+  ]);
+}
+async function runEnvironmentsCreate(context) {
+  const [slug] = context.positionalOrThrow(1, CREATE_USAGE2);
+  const { branch, copyEnv, database } = context.flags;
+  const copyEnvFrom = parseCopyEnv(copyEnv);
+  const seed = parseDatabase(database);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const environment = await client.environments.create(projectId, {
+    slug,
+    ...branch !== void 0 && { branch },
+    // null is a value here (copy nothing): only undefined leaves the key out.
+    ...copyEnvFrom !== void 0 && { copyEnvFrom },
+    ...seed !== void 0 && { database: seed }
+  });
+  context.output.result({ projectId, environment }, [
+    `\u2705 Created environment ${environment.slug} \u2192 ${environment.url}`
+  ]);
+}
+async function runEnvironmentsSet(context) {
+  const [slug] = context.positionalOrThrow(1, SET_USAGE2);
+  const { branch, noBranch, protection } = context.flags;
+  if (branch !== void 0 && noBranch === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--branch and --no-branch cannot be used together."
+    );
+  const protectionEnabled = parseProtection(protection);
+  if (branch === void 0 && noBranch !== true && protectionEnabled === void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Nothing to change: pass --branch, --no-branch or --protection."
+    );
+  const patch = {
+    ...branch !== void 0 && { branch },
+    ...noBranch === true && { branch: null },
+    ...protectionEnabled !== void 0 && { protectionEnabled }
+  };
+  const projectId = await context.resolveProjectId();
+  if (protectionEnabled === false)
+    await confirmOrAbort(
+      context,
+      `Turn off protection for ${slug}? Anyone with the link can open it.`
+    );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.update(
+    projectId,
+    found.id,
+    patch
+  );
+  context.output.result({ projectId, environment }, [
+    `\u2705 Updated environment ${slug}`
+  ]);
+}
+async function runEnvironmentsDelete(context) {
+  const [slug] = context.positionalOrThrow(1, DELETE_USAGE);
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    `Delete environment ${slug}? Its worker and protection key are removed.`
+  );
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  await client.environments.delete(projectId, found.id);
+  context.output.result({ projectId, slug, deleted: true }, [
+    `\u2705 Deleted environment ${slug}`
+  ]);
+}
 
 // src/commands/gen.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
@@ -4954,7 +5242,7 @@ async function runGenTypes(context) {
     read.policies === void 0 ? {} : { policies: read.policies }
   );
   const undescribed = tables.flatMap(
-    (table2) => table2.error === void 0 ? [] : [{ name: table2.name, error: table2.error }]
+    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
   );
   for (const { name, error } of undescribed)
     context.output.warn(
@@ -5395,7 +5683,7 @@ function count(n, noun) {
 }
 
 // src/commands/storage.ts
-var CREATE_USAGE2 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
+var CREATE_USAGE3 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
 var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]";
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
 var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
@@ -5535,7 +5823,7 @@ async function runStorageBucketList(context) {
   );
 }
 async function runStorageBucketCreate(context) {
-  const name = bucketName(context, CREATE_USAGE2);
+  const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -7152,8 +7440,8 @@ function patternOf(pattern) {
 }
 var MAX_LIMIT = 1e3;
 var CAP = `one select reads at most ${String(MAX_LIMIT)} rows, by limit() or range()`;
-function initialState(table2) {
-  return { table: table2, problem: null, filters: [], columns: "*", order: [] };
+function initialState(table3) {
+  return { table: table3, problem: null, filters: [], columns: "*", order: [] };
 }
 function copyRow(row) {
   return { ...row };
@@ -7386,11 +7674,11 @@ var SelectBuilder = class extends FilterBuilder {
     return this.next({ single: "maybe" });
   }
   build() {
-    const { table: table2, columns, order, limit, offset, single } = this.state;
+    const { table: table3, columns, order, limit, offset, single } = this.state;
     return {
       version: 1,
       action: "select",
-      table: table2,
+      table: table3,
       columns: columns === "*" ? "*" : [...columns],
       ...this.filtersPart(),
       ...order.length === 0 ? {} : { order: order.map((term) => ({ ...term })) },
@@ -7406,11 +7694,11 @@ var InsertBuilder = class extends Builder {
     return this.withReturning(columns);
   }
   build() {
-    const { table: table2, rows = [], returning } = this.state;
+    const { table: table3, rows = [], returning } = this.state;
     return {
       version: 1,
       action: "insert",
-      table: table2,
+      table: table3,
       rows: rows.map(copyRow),
       ...returning === void 0 ? {} : { returning }
     };
@@ -7427,7 +7715,7 @@ var MutationBuilder = class extends FilterBuilder {
   }
   build() {
     const {
-      table: table2,
+      table: table3,
       action,
       values = {},
       returning,
@@ -7438,10 +7726,10 @@ var MutationBuilder = class extends FilterBuilder {
       ...returning === void 0 ? {} : { returning },
       ...allowUnfiltered === void 0 ? {} : { allowUnfiltered }
     };
-    return action === "delete" ? { version: 1, action: "delete", table: table2, ...tail } : {
+    return action === "delete" ? { version: 1, action: "delete", table: table3, ...tail } : {
       version: 1,
       action: "update",
-      table: table2,
+      table: table3,
       values: copyRow(values),
       ...tail
     };
@@ -7450,9 +7738,9 @@ var MutationBuilder = class extends FilterBuilder {
 var TableBuilder = class {
   #run;
   #table;
-  constructor(run, table2) {
+  constructor(run, table3) {
     this.#run = run;
-    this.#table = table2;
+    this.#table = table3;
   }
   /** `"*"` (the default) or `"id, title"`. */
   select(columns) {
@@ -7830,6 +8118,7 @@ var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (
 var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
 var isSignedEntry = (value) => isRecord(value) && typeof value.path === "string" && (value.signedUrl === null || typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX)) && (value.error === null || typeof value.error === "string");
 var isSignedUpload = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_UPLOAD_PREFIX) && typeof value.token === "string" && value.token !== "" && typeof value.path === "string";
+var isMoved = (value) => isRecord(value) && typeof value.message === "string";
 var partsBody = (body) => isArrayBuffer(body) ? new Uint8Array(body) : body;
 function listOf(guard) {
   return (value) => Array.isArray(value) && value.every(guard);
@@ -7985,9 +8274,76 @@ var StorageFileApi = class {
       listOf(isFileObject)
     );
   }
+  /**
+   * The body a move and a copy send (Storage 3-1i): the bucket and both
+   * names, as supabase-js sends them. The names are not checked here — they
+   * are in the body, and the backend answers a bad one `INVALID_REQUEST`
+   * (`details.path` "sourceKey" or "destinationKey"), as `remove` does.
+   */
+  #transferBody(fromPath, toPath, options) {
+    const { destinationBucket, upsert } = options;
+    return {
+      bucketId: this.#bucket,
+      sourceKey: fromPath,
+      destinationKey: toPath,
+      ...destinationBucket === void 0 ? {} : { destinationBucket },
+      ...upsert === true ? { upsert: true } : {}
+    };
+  }
+  /**
+   * Renames an object inside its bucket (Storage 3-1i): the same object — its
+   * id and owner — under `toPath`, its old name gone. It never replaces an
+   * object that is there (`OBJECT_EXISTS`), takes files up to 5 GiB − 5 MiB
+   * (`OBJECT_TOO_LARGE`), and needs room in the project for a second copy
+   * until it is done (`STORAGE_QUOTA_EXCEEDED`). Its signed links stop
+   * working at the old name: a link is bound to the name, the object's id
+   * and its bytes, so moving it back can open them again. A backend whose
+   * Storage was turned on before this method came answers `NOT_FOUND`:
+   * update it with `naro backend enable`.
+   */
+  async move(fromPath, toPath, options = {}) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return fail(bucket.error);
+    const { destinationBucket } = options ?? {};
+    return this.#json(
+      {
+        method: "POST",
+        path: "/storage/object/move",
+        body: this.#transferBody(
+          fromPath,
+          toPath,
+          destinationBucket === void 0 ? {} : { destinationBucket }
+        )
+      },
+      isMoved
+    );
+  }
+  /**
+   * Copies an object inside its bucket (Storage 3-1i): the source's bytes,
+   * type and cache-control under `toPath` — a new object of the caller's,
+   * or with `upsert: true` the one that is there, which keeps its owner.
+   * Files up to 5 GiB − 5 MiB, within the bucket's limits as they are now.
+   * It answers `{ id, path, fullPath }` — `path` is the name inside the
+   * bucket; supabase-js's copy puts the bucket in front of it. A backend
+   * whose Storage was turned on before this method came answers
+   * `NOT_FOUND`: update it with `naro backend enable`.
+   */
+  async copy(fromPath, toPath, options = {}) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return fail(bucket.error);
+    return this.#json(
+      {
+        method: "POST",
+        path: "/storage/object/copy",
+        body: this.#transferBody(fromPath, toPath, options ?? {})
+      },
+      isUploadResult
+    );
+  }
   /**
    * A link to the object for `expiresIn` seconds (1–604,800). It stops
-   * working once the object is replaced or removed.
+   * working once the object is replaced or removed, and while the object is
+   * moved away from `path` (moved back, it can open it again).
    */
   async createSignedUrl(path, expiresIn, options = {}) {
     const target = this.#objectPath("sign/", path);
@@ -8268,8 +8624,8 @@ var NaroClient2 = class {
     this.storage = new StorageClient(http, this.auth);
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
-  from(table2) {
-    return new TableBuilder(this.#run, table2);
+  from(table3) {
+    return new TableBuilder(this.#run, table3);
   }
 };
 function createClient(options) {
@@ -8278,7 +8634,8 @@ function createClient(options) {
 
 // src/commands/storage-objects.ts
 var NARO_SCHEME = "naro://";
-var CP_USAGE = "Usage: naro storage cp <from> <to> (one side naro://<bucket>/<path>, the other a local file)";
+var CP_USAGE = "Usage: naro storage cp <from> <to> (a local file and naro://<bucket>/<path>, or two naro://<bucket>/<path> in one bucket)";
+var MV_USAGE = "Usage: naro storage mv naro://<bucket>/<from> naro://<bucket>/<to>";
 var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
 var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive] [--search <text>]";
 var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
@@ -8291,6 +8648,10 @@ function isOldSearchRefusal(error) {
   const { path, reason } = details;
   return path === "search" && reason === OLD_SEARCH_REASON;
 }
+var NO_ENDPOINT = "There is no Naro endpoint at this path.";
+function isOldRouteRefusal(error) {
+  return error !== null && error.code === "NOT_FOUND" && error.message === NO_ENDPOINT;
+}
 var FOUR_GIB = 4294967296;
 var PAGE = 1e3;
 var MAX_OFFSET = 1e5;
@@ -8757,17 +9118,106 @@ async function download(context, source, local) {
     ]
   );
 }
-async function storageCp(context) {
+function unwrapTransfer(result) {
+  if (isOldRouteRefusal(result.error))
+    throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
+  return unwrap(result);
+}
+function refuseBadName(bucket, name) {
+  const route2 = objectRoute(bucket, name);
+  if (!route2.ok) throw new NaroError(route2.error.code, route2.error.message);
+  const checked = checkObjectName(name);
+  if (!checked.ok) {
+    const { code, message } = dataError("INVALID_PATH", {
+      reason: checked.reason
+    });
+    throw new NaroError(code, message);
+  }
+}
+function insideStorage(source, target, command) {
+  if (source.bucket !== target.bucket)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage cp and mv work inside one bucket: both sides must be in naro://<bucket>."
+    );
+  if (source.path === "" || source.path.endsWith("/"))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `naro storage ${command} ${command === "mv" ? "moves" : "copies"} one object: name it, naro://<bucket>/<path>.`
+    );
+  const name = source.path.slice(source.path.lastIndexOf("/") + 1);
+  const to = target.path === "" || target.path.endsWith("/") ? `${target.path}${name}` : target.path;
+  refuseBadName(source.bucket, source.path);
+  refuseBadName(source.bucket, to);
+  if (to === source.path)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `naro storage ${command} needs a different destination: ${printable(`${NARO_SCHEME}${source.bucket}/${source.path}`)} is the source.`
+    );
+  return { bucket: source.bucket, from: source.path, to };
+}
+async function copyInside(context, source, target) {
+  const { contentType, cacheControl } = context.flags;
+  if (contentType !== void 0 || cacheControl !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "A copy inside Storage keeps the object's type and cache-control: --content-type and --cache-control are for uploads."
+    );
+  if (context.flags.recursive === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "A copy inside Storage takes no --recursive: it copies one object, naro://<bucket>/<path>. --recursive is for naro storage ls and rm."
+    );
+  const { bucket, from, to } = insideStorage(source, target, "cp");
+  const { projectId, storage } = await objects(context);
+  const object = unwrapTransfer(
+    await storage.from(bucket).copy(from, to, { upsert: context.flags.upsert === true })
+  );
+  const fromUrl = `${NARO_SCHEME}${bucket}/${from}`;
+  const toUrl = `${NARO_SCHEME}${bucket}/${to}`;
+  context.output.result({ projectId, from: fromUrl, to: toUrl, object }, [
+    `\u2705 Copied ${printable(fromUrl)} \u2192 ${printable(toUrl)}.`
+  ]);
+}
+async function storageMv(context) {
   const [from, to, ...extra] = context.positionals;
   if (from === void 0 || to === void 0 || extra.length > 0)
-    throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+    throw new NaroError("VALIDATION_FAILED", MV_USAGE);
   const source = parseStorageUrl(from);
   const target = parseStorageUrl(to);
-  if (source !== null && target !== null)
+  if (source === null || target === null)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "naro storage cp copies between this machine and Storage: one side is naro://<bucket>/<path>, the other a local file. Copying inside Storage is not supported yet."
+      "naro storage mv moves inside Storage: both sides are naro://<bucket>/<path>."
     );
+  const { upsert, contentType, cacheControl } = context.flags;
+  if (upsert === true || contentType !== void 0 || cacheControl !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage mv takes no --upsert, --content-type or --cache-control: a move keeps the object as it is and never replaces one."
+    );
+  if (context.flags.recursive === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage mv takes no --recursive: it moves one object, naro://<bucket>/<path>. --recursive is for naro storage ls and rm."
+    );
+  const moved = insideStorage(source, target, "mv");
+  const { projectId, storage } = await objects(context);
+  unwrapTransfer(await storage.from(moved.bucket).move(moved.from, moved.to));
+  const fromUrl = `${NARO_SCHEME}${moved.bucket}/${moved.from}`;
+  const toUrl = `${NARO_SCHEME}${moved.bucket}/${moved.to}`;
+  context.output.result({ projectId, from: fromUrl, to: toUrl }, [
+    `\u2705 Moved ${printable(fromUrl)} \u2192 ${printable(toUrl)}.`
+  ]);
+}
+async function storageCp(context) {
+  const [from, to, ...extra] = context.positionals;
+  if (from === void 0 || to === void 0 || extra.length > 0)
+    throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+  const source = parseStorageUrl(from);
+  const target = parseStorageUrl(to);
+  if (source !== null && target !== null)
+    return copyInside(context, source, target);
   if (target !== null) return upload(context, from, target);
   if (source !== null) return download(context, source, to);
   throw new NaroError("VALIDATION_FAILED", CP_USAGE);
@@ -8881,6 +9331,9 @@ function runStorageLs(context) {
 function runStorageCp(context) {
   return explainingKey(context, storageCp);
 }
+function runStorageMv(context) {
+  return explainingKey(context, storageMv);
+}
 function runStorageRm(context) {
   return explainingKey(context, storageRm);
 }
@@ -8918,15 +9371,16 @@ function meterRow(meter, limitsKnown) {
   if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
   if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
   if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
-  return [
-    label3,
-    used,
-    formatCount(meter.limit),
-    `${String(meter.percent ?? 0)}%`
-  ];
+  return [label3, used, formatCount(meter.limit), usedPercent(meter)];
+}
+function usedPercent(meter) {
+  const percent2 = meter.percent ?? 0;
+  return percent2 === 0 && meter.used > 0 ? "<1%" : `${String(percent2)}%`;
 }
 function projectName(project) {
   if (project.deleted) return `Deleted project ${printable(project.projectId)}`;
+  if (project.moved)
+    return `Moved to another team ${printable(project.projectId)}`;
   return printable(project.name ?? project.projectId);
 }
 function usageLines2(report, summary) {
@@ -8995,6 +9449,7 @@ Usage:
 
   naro deploy [--prod]               Build locally and deploy (preview by default)
        [--root <dir>] [--name <name>]  --root points at the app in a monorepo
+       [--env <name>]                  Deploy to a named environment instead of preview (not with --prod)
   naro deployments                   List deployments of the linked project
   naro inspect <deployment-id>       Show one deployment + build logs
   naro cancel <deployment-id>        Stop a build that is still running
@@ -9020,10 +9475,19 @@ Usage:
   naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
   naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
 
-  naro env list                      List env vars (secrets masked)
-  naro env add KEY [environment]     Add/update (value from prompt or stdin)
-  naro env remove KEY [environment]  Remove
+  naro env list                      List env vars (secrets masked); an environment's value shows its name
+  naro env add KEY [target]          Add/update (value from prompt or stdin)
+  naro env remove KEY [target]       Remove; with no target only production, preview and all, never an environment's
+  naro env import <file> [target]    Upload a dotenv file's variables (asks first; --yes in CI)
   naro env pull [file]               Write env vars to .env.local
+       target is production, preview, all or an environment name; add and import use all when none is given
+
+  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
+                                     A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
+  naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
+                                     Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -9152,7 +9616,10 @@ Usage:
                                      One file between this machine and naro://<bucket>/<path>, up to the object limit (over 50 MiB in parts),
                                      with the project's service key (NARO_SERVICE_KEY, or fetched with a warning).
                                      A big upload shows its progress on stderr; a file of 4 GiB or more cannot be uploaded yet.
-                                     A download replaces a local file of the same name
+                                     A download replaces a local file of the same name.
+                                     Two naro:// paths in one bucket: a copy inside Storage, up to 5 GiB \u2212 5 MiB (--upsert replaces)
+  naro storage mv naro://<bucket>/<from> naro://<bucket>/<to>
+                                     Move an object inside its bucket, up to 5 GiB \u2212 5 MiB; it never replaces one that is there
   naro storage rm naro://<bucket>/<path>\u2026 [--recursive]
                                      Remove objects; --recursive removes what is under a folder (asks first):
                                      <path>/ is the folder alone, <path> also an object of that name
@@ -9181,7 +9648,14 @@ Global options:
   --device <d>    Only this device: desktop, mobile or tablet (naro analytics, naro insights)
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull: preview by default)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
+                  branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
+  --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
+  --copy-env <source>  Where a new environment's variables come from: preview (default), production or none (naro environments create)
+  --database <seed>  What a new environment's database starts with: schema (default) or empty (naro environments create)
+  --protection <on|off>  on: only members of the project can open the environment; off: anyone with the link can
+                  (naro environments set; off asks first, --yes in CI)
   --no-www        Register the apex alone (naro domains add)
   --file <path>   SQL file to run (naro db query, naro policy create)
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
@@ -9215,8 +9689,8 @@ Global options:
   --recursive, -r Everything under a folder (naro storage ls, naro storage rm)
   --search <text> Names below the prefix that start with <text>, ASCII case ignored (naro storage ls)
   --upsert        Replace an object that is there (naro storage cp)
-  --content-type <t>  The object's type; by default from the file's extension (naro storage cp)
-  --cache-control <seconds>  How long a browser may keep it; 3600 by default (naro storage cp)
+  --content-type <t>  The uploaded object's type; by default from the file's extension (naro storage cp, uploads only)
+  --cache-control <seconds>  How long a browser may keep an upload; 3600 by default (naro storage cp, uploads only)
   --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
   --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
   --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
@@ -9354,6 +9828,8 @@ function routeStorage(words) {
       return { handler: runStorageLs, positionals: words.slice(1) };
     case "cp":
       return { handler: runStorageCp, positionals: words.slice(1) };
+    case "mv":
+      return { handler: runStorageMv, positionals: words.slice(1) };
     case "rm":
       return { handler: runStorageRm, positionals: words.slice(1) };
     default:
@@ -9447,11 +9923,41 @@ function route(parsed) {
         case "remove":
         case "rm":
           return { handler: runEnvRemove, positionals: positionals.slice(1) };
+        case "import":
+          return { handler: runEnvImport, positionals: positionals.slice(1) };
         case "pull":
           return { handler: runEnvPull, positionals: positionals.slice(1) };
         default:
           return null;
       }
+    // Spec 2026-10-18-named-environments §14.2.
+    case "environments":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return {
+            handler: runEnvironmentsList,
+            positionals: positionals.slice(1)
+          };
+        case "create":
+          return {
+            handler: runEnvironmentsCreate,
+            positionals: positionals.slice(1)
+          };
+        case "set":
+          return {
+            handler: runEnvironmentsSet,
+            positionals: positionals.slice(1)
+          };
+        case "delete":
+          return {
+            handler: runEnvironmentsDelete,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
     case "domains":
       switch (sub) {
         case void 0:
@@ -9617,7 +10123,7 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync5(
+      readFileSync6(
         join6(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )