naro-cli 0.2.0 → 0.3.0

package/dist/{chunk-UNCVFCTH.js → chunk-B6F7QIW7.js}

@@ -6,12 +6,63 @@ var __export = (target, all) => {
 };
 
 // src/deploy.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { cp, mkdtemp as mkdtemp2, readFile as readFile6, rm as rm2 } from "fs/promises";
-import { homedir as homedir3, tmpdir as tmpdir2 } from "os";
-import { basename, dirname, join as join9 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { cp, mkdtemp as mkdtemp2, readFile as readFile7, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { basename, dirname, join as join13 } from "path";
 import { fileURLToPath } from "url";
 
+// ../../packages/build/src/artifact-upload.ts
+function artifactUploadEntries(artifact) {
+  return [
+    ...[artifact.entrypoint, ...artifact.modules].map(
+      (file2) => ({ kind: "module", file: file2 })
+    ),
+    ...artifact.assets.map((file2) => ({
+      kind: "asset",
+      file: file2
+    }))
+  ];
+}
+function artifactUrlKey(kind, name) {
+  return `${kind}/${name}`;
+}
+var ARTIFACT_URL_BATCH_SIZE = 100;
+function parseArtifactPutUrls(payload) {
+  if (typeof payload !== "object" || payload === null) return null;
+  const { urls, disabled } = payload;
+  if (disabled === true) return null;
+  if (typeof urls !== "object" || urls === null) return null;
+  const resolved = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(urls)) {
+    if (typeof value === "string") resolved.set(key, value);
+  }
+  return resolved;
+}
+async function uploadArtifactFiles(artifact, ports) {
+  const entries = artifactUploadEntries(artifact);
+  let proxied = 0;
+  for (let index = 0; index < entries.length; index += ARTIFACT_URL_BATCH_SIZE) {
+    const batch = entries.slice(index, index + ARTIFACT_URL_BATCH_SIZE);
+    const urls = await ports.resolvePutUrls(batch);
+    for (const entry of batch) {
+      const url2 = urls?.get(artifactUrlKey(entry.kind, entry.file.name));
+      if (!url2) {
+        proxied += 1;
+        await ports.putProxied(entry);
+        continue;
+      }
+      try {
+        await ports.putSigned(url2, entry);
+      } catch {
+        proxied += 1;
+        await ports.putProxied(entry);
+      }
+    }
+  }
+  return { proxied, total: entries.length };
+}
+
 // ../../packages/build/src/cache.ts
 import { createHash } from "crypto";
 import { mkdir, readFile, stat, writeFile } from "fs/promises";
@@ -107,18 +158,31 @@ async function saveCache(args) {
   await log(observer, scope, "INFO", `Saved ${scope} cache (${key}).`);
 }
 
+// ../../packages/build/src/hash.ts
+import { createHash as createHash2 } from "crypto";
+function hashAsset(data) {
+  return createHash2("sha256").update(data).digest("hex").slice(0, 32);
+}
+
 // ../../packages/build/src/local-build-executor.ts
 import { mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
+
+// ../../packages/core/src/artifact-manifest.ts
+var MAX_FILE_BYTES = 25 * 1024 * 1024;
+var MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
 
 // ../../packages/core/src/errors.ts
 var DeploymentError = class extends Error {
   code;
+  /** HTTP status from the upstream response that caused this error, when known. */
+  status;
   constructor(code, message, options) {
     super(message, options);
     this.name = "DeploymentError";
     this.code = code;
+    if (options?.status !== void 0) this.status = options.status;
   }
 };
 
@@ -14636,6 +14700,41 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/core/src/subdomain.ts
+var RESERVED_SUBDOMAINS = [
+  "admin",
+  "api",
+  "app",
+  "assets",
+  "blog",
+  "cdn",
+  "dashboard",
+  "docs",
+  "help",
+  "imap",
+  "mail",
+  "mx",
+  "naro",
+  "ns1",
+  "ns2",
+  "preview",
+  "smtp",
+  "static",
+  "status",
+  "support",
+  "www"
+];
+var SUBDOMAIN_PATTERN = /^[a-z0-9](-?[a-z0-9])*$/;
+var SUBDOMAIN_MAX_LENGTH = 54;
+function subdomainProblem(value) {
+  if (value.length < 1 || value.length > SUBDOMAIN_MAX_LENGTH) return "invalid";
+  if (!SUBDOMAIN_PATTERN.test(value)) return "invalid";
+  if (value.endsWith("-preview")) return "reserved";
+  if (RESERVED_SUBDOMAINS.includes(value))
+    return "reserved";
+  return null;
+}
+
 // ../../packages/core/src/schemas.ts
 function isSupportedGitUrl(value) {
   if (/^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(?:\.git)?$/.test(value)) {
@@ -14666,12 +14765,30 @@ var createDeploymentSchema = external_exports.object({
   branch: external_exports.string().trim().max(240).optional().transform((value) => value || null)
 });
 var connectRepositorySchema = external_exports.object({
+  // Web-only route context: the only consumer is apps/web's
+  // POST /api/projects handler, which resolves this to a team id.
+  teamSlug: external_exports.string().trim().min(1),
   name: external_exports.string().trim().min(1).max(80),
   installationId: external_exports.number().int().positive(),
   repoId: external_exports.number().int().positive(),
   fullName: external_exports.string().trim().min(1).max(200).regex(/^[^/]+\/[^/]+$/, { message: "fullName must be owner/name" }),
   defaultBranch: external_exports.string().trim().min(1).max(240).default("main"),
-  rootDirectory: optionalRootDirectory
+  rootDirectory: optionalRootDirectory,
+  subdomain: external_exports.string().trim().max(60).optional().transform((value) => value ? value.toLowerCase() : null).superRefine((value, ctx) => {
+    if (value === null) return;
+    const problem = subdomainProblem(value);
+    if (problem === "invalid") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Use lowercase letters, numbers, and single hyphens (up to 54 characters)."
+      });
+    } else if (problem === "reserved") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "This subdomain is reserved."
+      });
+    }
+  })
 });
 
 // ../../packages/build/src/package-manager.ts
@@ -14777,6 +14894,16 @@ async function pathExists(path) {
     return false;
   }
 }
+async function createPackageManagerConfig(appRoot, writer = async (path, contents) => {
+  await writeFile3(path, contents, "utf8");
+}) {
+  const packageManagerConfigPath = join4(appRoot, ".next-deploy-user.npmrc");
+  await writer(
+    packageManagerConfigPath,
+    "# Host package-manager credentials are intentionally unavailable.\n"
+  );
+  return packageManagerConfigPath;
+}
 async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
   await writeFile3(path, contents, "utf8");
 }, cloudflareModulePath = createRequire(import.meta.url).resolve(
@@ -14784,7 +14911,6 @@ async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (
 ), exists3 = pathExists) {
   const openNextConfigPath = join4(appRoot, ".next-deploy-open-next.config.mjs");
   const wranglerConfigPath = join4(appRoot, ".next-deploy-wrangler.json");
-  const packageManagerConfigPath = join4(appRoot, ".next-deploy-user.npmrc");
   const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
   let hasNextConfig = false;
   for (const name of NEXT_CONFIG_FILES) {
@@ -14824,10 +14950,7 @@ export default defineCloudflareConfig({});
     )}
 `
   );
-  await writer(
-    packageManagerConfigPath,
-    "# Host package-manager credentials are intentionally unavailable.\n"
-  );
+  const packageManagerConfigPath = await createPackageManagerConfig(appRoot, writer);
   return {
     openNextConfigPath,
     wranglerConfigPath,
@@ -14835,9 +14958,129 @@ export default defineCloudflareConfig({});
   };
 }
 
+// ../../packages/build/src/frameworks.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join5 } from "path";
+var FRAMEWORK_PRESETS = {
+  next: {
+    id: "next",
+    detectDependency: "next",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: ".open-next",
+    needsServerRuntime: true,
+    spaFallback: false,
+    cachePath: ".next/cache"
+  },
+  vite: {
+    id: "vite",
+    detectDependency: "vite",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "dist",
+    needsServerRuntime: false,
+    spaFallback: true,
+    cachePath: "node_modules/.vite"
+  },
+  cra: {
+    id: "cra",
+    detectDependency: "react-scripts",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "build",
+    needsServerRuntime: false,
+    spaFallback: true,
+    cachePath: "node_modules/.cache"
+  },
+  static: {
+    id: "static",
+    detectDependency: null,
+    defaultBuildScript: null,
+    defaultOutputDirectory: ".",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: null
+  }
+};
+var DETECTION_ORDER = ["next", "vite", "cra"];
+var FRAMEWORK_LABELS = {
+  next: "Next.js",
+  vite: "Vite",
+  cra: "Create React App",
+  static: "static files"
+};
+function dependencyVersion(packageJson, name) {
+  const version2 = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+  return typeof version2 === "string" && version2.trim() !== "" ? version2 : null;
+}
+async function readPackageJson(root) {
+  let source;
+  try {
+    source = await readFile4(join5(root, "package.json"), "utf8");
+  } catch (error51) {
+    if (error51.code === "ENOENT") return null;
+    throw new DeploymentError(
+      "FRAMEWORK_DETECTION_FAILED",
+      "Could not read package.json.",
+      { cause: error51 }
+    );
+  }
+  try {
+    return JSON.parse(source);
+  } catch (error51) {
+    throw new DeploymentError(
+      "FRAMEWORK_DETECTION_FAILED",
+      "The selected root does not contain a valid package.json.",
+      { cause: error51 }
+    );
+  }
+}
+async function detectFramework(root, overrides = {}) {
+  const packageJson = await readPackageJson(root);
+  let preset;
+  if (overrides.framework) {
+    const candidate = FRAMEWORK_PRESETS[overrides.framework] ?? null;
+    if (!candidate || candidate.id !== overrides.framework)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        `Unknown framework "${overrides.framework}".`
+      );
+    preset = candidate;
+  } else if (!packageJson) {
+    preset = FRAMEWORK_PRESETS.static;
+  } else {
+    const detected = DETECTION_ORDER.map((id) => FRAMEWORK_PRESETS[id]).find(
+      (candidate) => candidate.detectDependency !== null && dependencyVersion(packageJson, candidate.detectDependency) !== null
+    );
+    if (!detected)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        "Could not detect the project framework from package.json. Set a framework (and build command / output directory) in the project settings."
+      );
+    preset = detected;
+  }
+  const buildScript = overrides.buildCommand ?? preset.defaultBuildScript;
+  if (buildScript !== null) {
+    if (!packageJson)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        "A build command requires a package.json."
+      );
+    if (typeof packageJson.scripts?.[buildScript] !== "string")
+      throw new DeploymentError(
+        "BUILD_FAILED",
+        `The project must declare a "${buildScript}" script.`
+      );
+  }
+  const version2 = packageJson && preset.detectDependency ? dependencyVersion(packageJson, preset.detectDependency) : null;
+  return {
+    preset,
+    buildScript,
+    outputDirectory: overrides.outputDirectory ?? preset.defaultOutputDirectory,
+    description: version2 ? `${FRAMEWORK_LABELS[preset.id]} ${version2}` : FRAMEWORK_LABELS[preset.id]
+  };
+}
+
 // ../../packages/build/src/open-next.ts
-import { access as access4, readdir, readFile as readFile4 } from "fs/promises";
-import { extname, isAbsolute, join as join5, relative, resolve, sep } from "path";
+import { access as access4, readdir, readFile as readFile5 } from "fs/promises";
+import { extname, isAbsolute, join as join6, relative, resolve, sep } from "path";
 function parseJsonc(source) {
   let output = "";
   let index = 0;
@@ -14932,7 +15175,7 @@ async function listFiles(root) {
     for (const entry of entries.sort(
       (left, right) => left.name.localeCompare(right.name)
     )) {
-      const path = join5(directory, entry.name);
+      const path = join6(directory, entry.name);
       if (entry.isSymbolicLink()) {
         throw new DeploymentError(
           "ARTIFACT_INVALID",
@@ -14943,7 +15186,7 @@ async function listFiles(root) {
       else if (entry.isFile()) {
         files.push({
           name: relative(root, path).split(sep).join("/"),
-          data: await readFile4(path),
+          data: await readFile5(path),
           contentType: contentType(path)
         });
       }
@@ -14966,7 +15209,7 @@ async function findWranglerConfig(root, configuredPath) {
     return resolved;
   }
   for (const name of ["wrangler.jsonc", "wrangler.json"]) {
-    const path = join5(root, name);
+    const path = join6(root, name);
     try {
       await access4(path);
       return path;
@@ -14982,7 +15225,7 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
   try {
     const configPath = await findWranglerConfig(appRoot, wranglerConfigPath);
     const metadata = parseJsonc(
-      await readFile4(configPath, "utf8")
+      await readFile5(configPath, "utf8")
     );
     if (typeof metadata.main !== "string" || typeof metadata.compatibility_date !== "string") {
       throw new DeploymentError(
@@ -15004,7 +15247,7 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
       );
     }
     await access4(entrypointPath);
-    const configuredAssets = typeof metadata.assets?.directory === "string" ? confinedPath(appRoot, metadata.assets.directory, "Assets directory") : join5(outputRoot, "assets");
+    const configuredAssets = typeof metadata.assets?.directory === "string" ? confinedPath(appRoot, metadata.assets.directory, "Assets directory") : join6(outputRoot, "assets");
     const assetsRelation = relative(outputRoot, configuredAssets);
     if (assetsRelation === ".." || assetsRelation.startsWith(`..${sep}`) || isAbsolute(assetsRelation)) {
       throw new DeploymentError(
@@ -15012,7 +15255,7 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
         "Assets directory must be inside .open-next."
       );
     }
-    const bundleRoot = join5(outputRoot, "worker-bundle");
+    const bundleRoot = join6(outputRoot, "worker-bundle");
     let bundleFiles = null;
     try {
       await access4(bundleRoot);
@@ -15197,48 +15440,99 @@ function resolveAppRoot(checkout, configuredRoot) {
   return appRoot;
 }
 
-// ../../packages/build/src/next-project.ts
-import { readFile as readFile5 } from "fs/promises";
-import { join as join6 } from "path";
-async function validateNextProject(root) {
-  let packageJson;
-  try {
-    packageJson = JSON.parse(
-      await readFile5(join6(root, "package.json"), "utf8")
+// ../../packages/build/src/static-artifact.ts
+import { readdir as readdir2, readFile as readFile6 } from "fs/promises";
+import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve3, sep as sep2 } from "path";
+var SHIM_WORKER_SOURCE = "export default { fetch: (request, env) => env.ASSETS.fetch(request) };\n";
+var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules"]);
+var ALLOWED_DOTFILE = ".well-known";
+function excluded(name) {
+  if (name === ALLOWED_DOTFILE) return false;
+  return name.startsWith(".") || EXCLUDED_DIRECTORIES.has(name);
+}
+async function readStaticArtifact(appRoot, outputDirectory, identity, options, onWarn) {
+  if (isAbsolute3(outputDirectory))
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      "Output directory must be relative to the application root."
     );
-  } catch (error51) {
+  const outputRoot = resolve3(appRoot, outputDirectory);
+  const relation = relative3(appRoot, outputRoot);
+  if (relation === ".." || relation.startsWith(`..${sep2}`) || isAbsolute3(relation))
     throw new DeploymentError(
-      "NOT_NEXTJS",
-      "The selected root does not contain a valid package.json.",
-      {
-        cause: error51
-      }
+      "ARTIFACT_INVALID",
+      "Output directory escapes the application root."
     );
+  const assets = [];
+  async function visit(directory) {
+    const entries = await readdir2(directory, { withFileTypes: true });
+    for (const entry of entries.sort(
+      (left, right) => left.name.localeCompare(right.name)
+    )) {
+      if (excluded(entry.name)) continue;
+      const path = join7(directory, entry.name);
+      if (entry.isSymbolicLink())
+        throw new DeploymentError(
+          "ARTIFACT_INVALID",
+          "Static output cannot contain symbolic links."
+        );
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile()) {
+        assets.push({
+          name: relative3(outputRoot, path).split(sep2).join("/"),
+          data: await readFile6(path),
+          contentType: contentType(path)
+        });
+      }
+    }
   }
-  const nextVersion = packageJson.dependencies?.next ?? packageJson.devDependencies?.next;
-  if (typeof nextVersion !== "string" || nextVersion.trim() === "") {
+  try {
+    await visit(outputRoot);
+  } catch (error51) {
+    if (error51 instanceof DeploymentError) throw error51;
     throw new DeploymentError(
-      "NOT_NEXTJS",
-      "The selected project does not declare Next.js."
+      "ARTIFACT_INVALID",
+      `Could not read the build output directory "${outputDirectory}".`,
+      { cause: error51 }
     );
   }
-  if (typeof packageJson.scripts?.build !== "string") {
+  if (assets.length === 0)
     throw new DeploymentError(
-      "BUILD_FAILED",
-      "The selected Next.js project must declare a build script."
+      "ARTIFACT_INVALID",
+      `The build output directory "${outputDirectory}" contains no files.`
     );
-  }
-  return { buildScript: "build", nextVersion };
+  if (!assets.some((file2) => file2.name === "index.html"))
+    await onWarn?.(
+      `No index.html in "${outputDirectory}" \u2014 the site root will not serve a page.`
+    );
+  return {
+    ...identity,
+    entrypoint: {
+      name: "worker.js",
+      data: new TextEncoder().encode(SHIM_WORKER_SOURCE),
+      contentType: "application/javascript"
+    },
+    modules: [],
+    assets,
+    compatibilityDate: COMPATIBILITY_DATE,
+    compatibilityFlags: [],
+    assetsBinding: "ASSETS",
+    assetsConfig: {
+      notFoundHandling: options.spaFallback ? "single-page-application" : "404-page"
+    }
+  };
 }
 
 // ../../packages/build/src/local-build-executor.ts
 var defaultDependencies = {
-  createWorkspace: () => mkdtemp(join7(tmpdir(), "next-deploy-build-")),
+  createWorkspace: () => mkdtemp(join8(tmpdir(), "next-deploy-build-")),
   removeWorkspace: (path) => rm(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
   resolveAppRoot,
-  validateNextProject,
+  detectFramework,
+  readStaticArtifact,
+  createPackageManagerConfig,
   createPlatformBuildConfig,
   readOpenNextArtifact,
   openNextCommand: "opennextjs-cloudflare",
@@ -15284,14 +15578,14 @@ var LocalBuildExecutor = class {
   }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
-    const checkout = join7(workspace, "checkout");
-    const pmCacheDir = join7(workspace, ".pm-store");
+    const checkout = join8(workspace, "checkout");
+    const pmCacheDir = join8(workspace, ".pm-store");
     let cacheSeq = 0;
     const cachePorts = cache ? {
       transport: cache,
       fetch: this.dependencies.cacheFetch ?? ((url2, init) => fetch(url2, init)),
       runCommand: this.dependencies.runCommand,
-      tmpFile: (suffix) => join7(workspace, `cache-${String(cacheSeq++)}${suffix}`)
+      tmpFile: (suffix) => join8(workspace, `cache-${String(cacheSeq++)}${suffix}`)
     } : null;
     try {
       await notifyStatus(observer, "CLONING");
@@ -15334,146 +15628,194 @@ var LocalBuildExecutor = class {
           "Git returned an invalid commit SHA."
         );
       }
-      await observer.onMetadata?.({ gitCommitSha });
+      const subject = await this.dependencies.runCommand(
+        {
+          command: "git",
+          args: ["log", "-1", "--format=%s"],
+          cwd: checkout,
+          timeoutMs: 1e4,
+          stage: "CLONING",
+          errorCode: "CLONE_FAILED"
+        },
+        observer
+      );
+      const gitCommitMessage = [...subject.stdout.at(-1)?.trim() ?? ""].slice(0, 300).join("");
+      await observer.onMetadata?.({
+        gitCommitSha,
+        ...gitCommitMessage ? { gitCommitMessage } : {}
+      });
       const appRoot = this.dependencies.resolveAppRoot(
         checkout,
         input.rootDirectory
       );
-      const project = await this.dependencies.validateNextProject(appRoot);
-      await info(
-        observer,
-        "CLONING",
-        `Validated Next.js ${project.nextVersion}`
-      );
-      const conversion = await (this.dependencies.convertProxyToMiddleware ?? convertProxyToMiddleware)(appRoot);
-      if (conversion.converted) {
-        await observer.onLog({
-          level: "WARN",
-          stage: "CLONING",
-          message: `Converted ${conversion.file ?? "proxy"} to edge middleware. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable.`
-        });
-      }
-      const platformConfig = await this.dependencies.createPlatformBuildConfig(
-        appRoot,
-        input.deploymentId
-      );
-      await notifyStatus(observer, "INSTALLING");
-      const packageManager = await this.dependencies.detectPackageManager(checkout);
-      const [installCommand, ...installArgs] = packageManager.install;
-      if (!installCommand)
-        throw new DeploymentError(
-          "UNSUPPORTED_PACKAGE_MANAGER",
-          "Install command is empty."
+      const resolved = await this.dependencies.detectFramework(appRoot, {
+        framework: input.framework ?? null,
+        buildCommand: input.buildCommand ?? null,
+        outputDirectory: input.outputDirectory ?? null
+      });
+      await info(observer, "CLONING", `Detected ${resolved.description}`);
+      const isNext = resolved.preset.id === "next";
+      let platformConfig = null;
+      let packageManagerConfigPath = null;
+      if (isNext) {
+        const conversion = await (this.dependencies.convertProxyToMiddleware ?? convertProxyToMiddleware)(appRoot);
+        if (conversion.converted) {
+          await observer.onLog({
+            level: "WARN",
+            stage: "CLONING",
+            message: `Converted ${conversion.file ?? "proxy"} to edge middleware. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable.`
+          });
+        }
+        platformConfig = await this.dependencies.createPlatformBuildConfig(
+          appRoot,
+          input.deploymentId
         );
-      let depsKey = null;
-      let depsRestored = false;
-      if (cachePorts) {
-        depsKey = await computeDepsCacheKey(checkout, packageManager.name);
-        if (depsKey) {
-          depsRestored = await tryRestore(
-            "deps",
-            depsKey,
-            pmCacheDir,
+        packageManagerConfigPath = platformConfig.packageManagerConfigPath;
+      } else if (resolved.buildScript !== null) {
+        packageManagerConfigPath = await this.dependencies.createPackageManagerConfig(appRoot);
+      }
+      if (resolved.buildScript !== null) {
+        await notifyStatus(observer, "INSTALLING");
+        const packageManager = await this.dependencies.detectPackageManager(checkout);
+        const [installCommand, ...installArgs] = packageManager.install;
+        if (!installCommand)
+          throw new DeploymentError(
+            "UNSUPPORTED_PACKAGE_MANAGER",
+            "Install command is empty."
+          );
+        let depsKey = null;
+        let depsRestored = false;
+        if (cachePorts) {
+          depsKey = await computeDepsCacheKey(checkout, packageManager.name);
+          if (depsKey) {
+            depsRestored = await tryRestore(
+              "deps",
+              depsKey,
+              pmCacheDir,
+              cachePorts,
+              observer
+            );
+          }
+        }
+        await this.dependencies.runCommand(
+          {
+            command: installCommand,
+            args: installArgs,
+            cwd: checkout,
+            env: {
+              NODE_ENV: "development",
+              NPM_CONFIG_USERCONFIG: packageManagerConfigPath,
+              ...cachePorts ? {
+                npm_config_store_dir: pmCacheDir,
+                npm_config_cache: pmCacheDir,
+                YARN_CACHE_FOLDER: pmCacheDir
+              } : {}
+            },
+            timeoutMs: 10 * 6e4,
+            stage: "INSTALLING",
+            errorCode: "INSTALL_FAILED"
+          },
+          observer
+        );
+        await notifyStatus(observer, "BUILDING");
+        const buildCacheDir = resolved.preset.cachePath ? join8(appRoot, resolved.preset.cachePath) : null;
+        const buildCacheKey = sanitizeCacheKey(input.branch);
+        if (cachePorts && buildCacheDir) {
+          await tryRestore(
+            "next",
+            buildCacheKey,
+            buildCacheDir,
             cachePorts,
             observer
           );
         }
-      }
-      await this.dependencies.runCommand(
-        {
-          command: installCommand,
-          args: installArgs,
-          cwd: checkout,
-          env: {
-            NODE_ENV: "development",
-            NPM_CONFIG_USERCONFIG: platformConfig.packageManagerConfigPath,
-            ...cachePorts ? {
-              npm_config_store_dir: pmCacheDir,
-              npm_config_cache: pmCacheDir,
-              YARN_CACHE_FOLDER: pmCacheDir
-            } : {}
-          },
-          timeoutMs: 10 * 6e4,
-          stage: "INSTALLING",
-          errorCode: "INSTALL_FAILED"
-        },
-        observer
-      );
-      await notifyStatus(observer, "BUILDING");
-      const nextCacheDir = join7(appRoot, ".next", "cache");
-      const nextKey = sanitizeCacheKey(input.branch);
-      if (cachePorts) {
-        await tryRestore("next", nextKey, nextCacheDir, cachePorts, observer);
-      }
-      await this.dependencies.runCommand(
-        {
-          command: packageManager.name,
-          args: ["run", project.buildScript],
-          cwd: appRoot,
-          env: {
-            ...input.env ?? {},
-            NEXT_PRIVATE_STANDALONE: "true",
-            NPM_CONFIG_USERCONFIG: platformConfig.packageManagerConfigPath
-          },
-          timeoutMs: 15 * 6e4,
-          stage: "BUILDING",
-          errorCode: "BUILD_FAILED"
-        },
-        observer
-      );
-      await this.dependencies.runCommand(
-        {
-          command: this.dependencies.openNextCommand,
-          args: [
-            "build",
-            "--skip-next-build",
-            "--openNextConfigPath",
-            platformConfig.openNextConfigPath,
-            "--config",
-            platformConfig.wranglerConfigPath
-          ],
-          cwd: appRoot,
-          timeoutMs: 15 * 6e4,
-          stage: "BUILDING",
-          errorCode: "OPENNEXT_FAILED"
-        },
-        observer
-      );
-      await this.dependencies.runCommand(
-        {
-          command: this.dependencies.wranglerCommand,
-          args: [
-            "deploy",
-            "--dry-run",
-            "--config",
-            platformConfig.wranglerConfigPath,
-            "--outdir",
-            ".open-next/worker-bundle"
-          ],
-          cwd: appRoot,
-          env: {
-            WRANGLER_LOG_PATH: join7(appRoot, ".open-next", "wrangler.log")
+        await this.dependencies.runCommand(
+          {
+            command: packageManager.name,
+            args: ["run", resolved.buildScript],
+            cwd: appRoot,
+            env: {
+              ...input.env ?? {},
+              ...isNext ? { NEXT_PRIVATE_STANDALONE: "true" } : {},
+              NPM_CONFIG_USERCONFIG: packageManagerConfigPath
+            },
+            timeoutMs: 15 * 6e4,
+            stage: "BUILDING",
+            errorCode: "BUILD_FAILED"
           },
-          timeoutMs: 5 * 6e4,
-          stage: "BUILDING",
-          errorCode: "OPENNEXT_FAILED"
-        },
-        observer
-      );
-      if (cachePorts) {
-        if (depsKey && !depsRestored) {
-          await trySave("deps", depsKey, pmCacheDir, cachePorts, observer);
+          observer
+        );
+        if (isNext) {
+          await this.dependencies.runCommand(
+            {
+              command: this.dependencies.openNextCommand,
+              args: [
+                "build",
+                "--skip-next-build",
+                "--openNextConfigPath",
+                platformConfig.openNextConfigPath,
+                "--config",
+                platformConfig.wranglerConfigPath
+              ],
+              cwd: appRoot,
+              timeoutMs: 15 * 6e4,
+              stage: "BUILDING",
+              errorCode: "OPENNEXT_FAILED"
+            },
+            observer
+          );
+          await this.dependencies.runCommand(
+            {
+              command: this.dependencies.wranglerCommand,
+              args: [
+                "deploy",
+                "--dry-run",
+                "--config",
+                platformConfig.wranglerConfigPath,
+                "--outdir",
+                ".open-next/worker-bundle"
+              ],
+              cwd: appRoot,
+              env: {
+                WRANGLER_LOG_PATH: join8(appRoot, ".open-next", "wrangler.log")
+              },
+              timeoutMs: 5 * 6e4,
+              stage: "BUILDING",
+              errorCode: "OPENNEXT_FAILED"
+            },
+            observer
+          );
+        }
+        if (cachePorts) {
+          if (depsKey && !depsRestored) {
+            await trySave("deps", depsKey, pmCacheDir, cachePorts, observer);
+          }
+          if (buildCacheDir) {
+            await trySave(
+              "next",
+              buildCacheKey,
+              buildCacheDir,
+              cachePorts,
+              observer
+            );
+          }
         }
-        await trySave("next", nextKey, nextCacheDir, cachePorts, observer);
       }
       await notifyStatus(observer, "DEPLOYING");
-      const artifact = await this.dependencies.readOpenNextArtifact(
+      const identity = {
+        deploymentId: input.deploymentId,
+        projectId: input.projectId
+      };
+      const artifact = isNext ? await this.dependencies.readOpenNextArtifact(
         appRoot,
-        {
-          deploymentId: input.deploymentId,
-          projectId: input.projectId
-        },
+        identity,
         platformConfig.wranglerConfigPath
+      ) : await this.dependencies.readStaticArtifact(
+        appRoot,
+        resolved.outputDirectory,
+        identity,
+        { spaFallback: resolved.preset.spaFallback },
+        (message) => observer.onLog({ level: "WARN", stage: "DEPLOYING", message })
       );
       return { gitCommitSha, artifact };
     } finally {
@@ -15482,49 +15824,66 @@ var LocalBuildExecutor = class {
   }
 };
 
-// src/git-info.ts
-import { execFile } from "child_process";
-var SUPPORTED_REMOTE = [
-  /^https:\/\/[^\s]+$/,
-  /^ssh:\/\/[^\s]+$/,
-  /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
-];
-var defaultExec = (args, cwd) => new Promise((resolve3, reject) => {
-  execFile("git", args, { cwd }, (error51, stdout) => {
-    if (error51) reject(error51);
-    else resolve3(stdout);
-  });
-});
-async function tryExec(exec, args, cwd) {
-  try {
-    const out = (await exec(args, cwd)).trim();
-    return out.length > 0 ? out : null;
-  } catch {
-    return null;
+// ../../packages/sdk/src/auth.ts
+import { homedir as homedir2 } from "os";
+
+// ../../packages/sdk/src/errors.ts
+var NaroError = class extends Error {
+  code;
+  /** HTTP status of the control plane response, when one was received. */
+  status;
+  /** Extra structured context (validation fields, deployment id...). */
+  details;
+  constructor(code, message, options) {
+    super(
+      message,
+      options?.cause !== void 0 ? { cause: options.cause } : {}
+    );
+    this.name = "NaroError";
+    this.code = code;
+    if (options?.status !== void 0) this.status = options.status;
+    if (options?.details !== void 0) this.details = options.details;
   }
+};
+function isNaroError(error51) {
+  return error51 instanceof NaroError || error51 instanceof Error && error51.name === "NaroError" && typeof error51.code === "string";
 }
-async function detectGitInfo(dir, exec = defaultExec) {
-  const remote = await tryExec(exec, ["remote", "get-url", "origin"], dir);
-  const branch = await tryExec(exec, ["rev-parse", "--abbrev-ref", "HEAD"], dir);
-  return {
-    repositoryUrl: remote !== null && SUPPORTED_REMOTE.some((re) => re.test(remote)) ? remote : null,
-    branch: branch !== null && branch !== "HEAD" ? branch : null
-  };
+function toNaroError(error51, fallbackCode = "INTERNAL_ERROR") {
+  if (error51 instanceof NaroError) return error51;
+  const message = error51 instanceof Error ? error51.message : String(error51);
+  return new NaroError(fallbackCode, message, { cause: error51 });
+}
+async function errorFromResponse(response, context) {
+  let body = null;
+  try {
+    body = await response.json();
+  } catch {
+    body = null;
+  }
+  const serverCode = typeof body?.error?.code === "string" ? body.error.code : null;
+  const serverMessage = typeof body?.error?.message === "string" ? body.error.message : null;
+  const code = serverCode ?? (response.status === 401 ? "UNAUTHORIZED" : response.status === 404 ? "NOT_FOUND" : response.status === 429 ? "RATE_LIMITED" : "INTERNAL_ERROR");
+  const details = {};
+  if (body?.error?.fields !== void 0) details.fields = body.error.fields;
+  return new NaroError(
+    code,
+    serverMessage ?? `${context} failed: the control plane returned ${String(response.status)}.`,
+    {
+      status: response.status,
+      ...Object.keys(details).length > 0 ? { details } : {}
+    }
+  );
 }
 
-// src/login.ts
-import { spawn as spawn2 } from "child_process";
-import { homedir as homedir2 } from "os";
-
-// src/session.ts
+// ../../packages/sdk/src/session.ts
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function credentialsDir(home = homedir()) {
-  return join8(home, ".naro");
+  return join9(home, ".naro");
 }
 function credentialsFile(home = homedir()) {
-  return join8(credentialsDir(home), "credentials.json");
+  return join9(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
   mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
@@ -15548,20 +15907,31 @@ function isExpired(session, skewSeconds = 60) {
   return session.expires_at * 1e3 <= Date.now() + skewSeconds * 1e3;
 }
 
-// src/supabase-auth.ts
+// ../../packages/sdk/src/supabase-auth.ts
 import {
   createClient
 } from "@supabase/supabase-js";
 
-// src/callback-server.ts
+// ../../packages/sdk/src/config.ts
+var DEFAULT_CONTROL_PLANE_URL = "https://naro.sh";
+var DEFAULT_SUPABASE_URL = "https://bymwzjpqfmwsdhtcpgjg.supabase.co";
+var DEFAULT_SUPABASE_KEY = "sb_publishable_qjM6NZsHnGZ1t6iwuTDwcQ_LQbq4aCX";
+function controlPlaneUrl(env = process.env) {
+  return (env.NARO_CONTROL_PLANE_URL ?? DEFAULT_CONTROL_PLANE_URL).replace(
+    /\/$/,
+    ""
+  );
+}
+
+// ../../packages/sdk/src/callback-server.ts
 import { createServer } from "http";
 var DONE_HTML = "<html><body><p>\u2705 Logged in. You can close this tab and return to the terminal.</p></body></html>";
 var FAIL_HTML = "<html><body><p>Login failed. You can close this tab and return to the terminal.</p></body></html>";
 async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
-  const codePromise = new Promise((resolve3, reject) => {
-    resolveCode = resolve3;
+  const codePromise = new Promise((resolve4, reject) => {
+    resolveCode = resolve4;
     rejectCode = reject;
   });
   const server = createServer((req, res) => {
@@ -15588,7 +15958,7 @@ async function startCallbackServer() {
     res.end(DONE_HTML);
     resolveCode(code);
   });
-  await new Promise((resolve3) => server.listen(0, "127.0.0.1", resolve3));
+  await new Promise((resolve4) => server.listen(0, "127.0.0.1", resolve4));
   const port = server.address().port;
   return {
     port,
@@ -15611,12 +15981,10 @@ async function startCallbackServer() {
   };
 }
 
-// src/supabase-auth.ts
-var DEFAULT_URL = "https://bymwzjpqfmwsdhtcpgjg.supabase.co";
-var DEFAULT_KEY = "sb_publishable_qjM6NZsHnGZ1t6iwuTDwcQ_LQbq4aCX";
+// ../../packages/sdk/src/supabase-auth.ts
 function createAuthClient(env = process.env) {
-  const url2 = env.NARO_SUPABASE_URL ?? DEFAULT_URL;
-  const key = env.NARO_SUPABASE_KEY ?? DEFAULT_KEY;
+  const url2 = env.NARO_SUPABASE_URL ?? DEFAULT_SUPABASE_URL;
+  const key = env.NARO_SUPABASE_KEY ?? DEFAULT_SUPABASE_KEY;
   const store = /* @__PURE__ */ new Map();
   return createClient(url2, key, {
     auth: {
@@ -15689,69 +16057,659 @@ async function login(deps) {
   }
 }
 
-// src/login.ts
-var stdio = {
-  out: (m) => process.stdout.write(`${m}
-`),
-  err: (m) => process.stderr.write(`${m}
-`)
-};
+// ../../packages/sdk/src/auth.ts
+async function resolveAuth(options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? homedir2();
+  if (options.explicitToken) {
+    const token = options.explicitToken;
+    return { getAccessToken: async () => token, source: "flag" };
+  }
+  if (env.NARO_TOKEN) {
+    const token = env.NARO_TOKEN;
+    return { getAccessToken: async () => token, source: "env" };
+  }
+  const refresh = options.refresh ?? refreshStoredSession;
+  let session = loadStoredSession(home);
+  if (!session || isExpired(session)) {
+    if (session) {
+      try {
+        session = await refresh(session.refresh_token);
+        saveSession(session, home);
+      } catch {
+        session = null;
+      }
+    }
+    if (!session) {
+      const interactive = options.interactiveLogin;
+      if (!interactive) {
+        throw new NaroError(
+          "NOT_LOGGED_IN",
+          "Not logged in. Run `naro login`, or set NARO_TOKEN."
+        );
+      }
+      interactive.log(
+        "Not logged in \u2014 opening your browser to sign in with GitHub\u2026"
+      );
+      const loginFlow = options.loginFlow ?? ((openBrowser2) => login({ openBrowser: openBrowser2 }));
+      session = await loginFlow((url2) => {
+        interactive.log(`If your browser did not open, visit:
+  ${url2}`);
+        interactive.openBrowser(url2);
+      });
+      saveSession(session, home);
+    }
+  }
+  const auth = {
+    source: "session",
+    user: session.user,
+    getAccessToken: async () => {
+      const current = loadStoredSession(home);
+      if (!current) {
+        throw new NaroError(
+          "NOT_LOGGED_IN",
+          "The session was logged out. Run `naro login` again."
+        );
+      }
+      if (!isExpired(current)) return current.access_token;
+      const refreshed = await refresh(current.refresh_token);
+      saveSession(refreshed, home);
+      return refreshed.access_token;
+    }
+  };
+  return auth;
+}
+
+// ../../packages/sdk/src/browser.ts
+import { spawn as spawn2 } from "child_process";
 function openBrowser(url2) {
   const platform = process.platform;
   const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url2] : [url2];
-  spawn2(command, args, { stdio: "ignore", detached: true }).unref();
-}
-async function runLogin(io = stdio) {
-  io.out("Opening your browser to sign in with GitHub...");
-  const session = await login({
-    openBrowser: (url2) => {
-      io.out(`If your browser did not open, visit:
-  ${url2}`);
-      openBrowser(url2);
-    }
+  const child = spawn2(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => {
   });
-  saveSession(session);
-  io.out(`\u2705 Logged in as ${session.user.email ?? session.user.id}`);
+  child.unref();
 }
-async function runWhoami(io = stdio, home = homedir2(), refresh = refreshStoredSession) {
-  let session = loadStoredSession(home);
-  if (!session) {
-    io.err("Not logged in. Run `naro login`.");
-    process.exitCode = 1;
-    return;
-  }
-  if (isExpired(session)) {
-    try {
-      session = await refresh(session.refresh_token);
-      saveSession(session, home);
-    } catch {
-      io.err("Session expired. Run `naro login`.");
-      process.exitCode = 1;
-      return;
+
+// ../../packages/sdk/src/types.ts
+var TERMINAL_DEPLOYMENT_STATUSES = [
+  "READY",
+  "FAILED"
+];
+function isTerminalStatus(status) {
+  return TERMINAL_DEPLOYMENT_STATUSES.includes(status);
+}
+function projectInfo(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    subdomain: row.subdomain,
+    teamId: row.team_id,
+    defaultBranch: row.default_branch,
+    rootDirectory: row.root_directory,
+    repositoryUrl: row.repository_url,
+    repositoryFullName: row.repository_full_name ?? null,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function deploymentInfo(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    status: row.status,
+    branch: row.branch,
+    url: row.preview_url,
+    artifactKey: row.artifact_key ?? null,
+    errorCode: row.error_code,
+    errorMessage: row.error_message,
+    gitCommitSha: row.git_commit_sha,
+    gitCommitMessage: row.git_commit_message,
+    createdAt: row.created_at,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at
+  };
+}
+function buildLogEntry(row) {
+  return {
+    sequence: row.sequence,
+    level: row.level,
+    stage: row.stage,
+    message: row.message,
+    createdAt: row.created_at
+  };
+}
+
+// ../../packages/sdk/src/client.ts
+var NaroClient = class {
+  baseUrl;
+  getAccessToken;
+  doFetch;
+  teams;
+  projects;
+  deployments;
+  env;
+  domains;
+  logs;
+  constructor(options) {
+    this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
+    this.getAccessToken = options.getAccessToken;
+    this.doFetch = options.fetch ?? fetch;
+    this.teams = new TeamsApi(this);
+    this.projects = new ProjectsApi(this);
+    this.deployments = new DeploymentsApi(this);
+    this.env = new EnvApi(this);
+    this.domains = new DomainsApi(this);
+    this.logs = new LogsApi(this);
+  }
+  async request(path, options) {
+    const token = await this.getAccessToken();
+    let response;
+    try {
+      response = await this.doFetch(`${this.baseUrl}${path}`, {
+        method: options.method ?? "GET",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+        },
+        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {}
+      });
+    } catch (error51) {
+      throw new NaroError(
+        "NETWORK_ERROR",
+        `${options.context} failed: could not reach ${this.baseUrl}.`,
+        { cause: error51 }
+      );
     }
+    if (!response.ok) throw await errorFromResponse(response, options.context);
+    return await response.json();
+  }
+};
+var TeamsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const body = await this.client.request(
+      "/api/teams",
+      { context: "List teams" }
+    );
+    return body.teams;
+  }
+};
+var ProjectsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(teamSlug) {
+    const body = await this.client.request(
+      `/api/projects?team=${encodeURIComponent(teamSlug)}`,
+      { context: "List projects" }
+    );
+    return body.projects.map(projectInfo);
+  }
+  async get(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      { context: "Read project" }
+    );
+    return projectInfo(body.project);
+  }
+};
+var DeploymentsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(`/api/projects/${encodeURIComponent(projectId)}/deployments`, {
+      context: "List deployments"
+    });
+    return body.deployments.map(deploymentInfo);
+  }
+  async get(deploymentId) {
+    const body = await this.client.request(`/api/deployments/${encodeURIComponent(deploymentId)}`, {
+      context: "Read deployment"
+    });
+    return {
+      deployment: deploymentInfo(body.deployment),
+      logs: body.logs.map(buildLogEntry)
+    };
   }
-  const handle = session.user.github ? ` (${session.user.github})` : "";
-  io.out(`Logged in as ${session.user.email ?? session.user.id}${handle}`);
+  /**
+   * Starts a CLI deployment: the control plane creates/loads the project,
+   * records the deployment and returns a callback token; the caller builds
+   * locally and uploads the artifact.
+   */
+  async createCli(input) {
+    return this.client.request("/api/cli/deployments", {
+      method: "POST",
+      body: input,
+      context: "Create deployment"
+    });
+  }
+  /**
+   * Queues a server-side git build (GitHub-connected projects): clone,
+   * build and deploy run on the platform.
+   */
+  async createRemote(projectId, options = {}) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/deployments`,
+      {
+        method: "POST",
+        // createDeploymentSchema accepts string | undefined — never null.
+        body: options.branch ? { branch: options.branch } : {},
+        context: "Create deployment"
+      }
+    );
+    return deploymentInfo(body.deployment);
+  }
+  /**
+   * Picks the deployment `naro rollback` restores: the newest READY
+   * production deployment serving a DIFFERENT artifact than the current one.
+   * Comparing artifacts (not row order) keeps repeated rollbacks from
+   * ping-ponging between the same two rows — promoted rows share their
+   * source's artifact.
+   */
+  async rollbackTarget(projectId, defaultBranch) {
+    const deployments = await this.list(projectId);
+    const production = deployments.filter(
+      (deployment) => deployment.status === "READY" && deployment.branch === defaultBranch
+    );
+    const current = production[0];
+    if (!current) {
+      throw new NaroError(
+        "DEPLOYMENT_NOT_FOUND",
+        "No production deployment to roll back from."
+      );
+    }
+    const differs = (candidate) => current.artifactKey && candidate.artifactKey ? candidate.artifactKey !== current.artifactKey : candidate.id !== current.id;
+    return { current, target: production.slice(1).find(differs) ?? null };
+  }
+  /**
+   * Redeploys an existing READY deployment's artifact to production.
+   * Used by both `naro promote` (preview → production) and `naro rollback`
+   * (older production build → production).
+   */
+  async promote(projectId, deploymentId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`,
+      { method: "POST", context: "Promote deployment" }
+    );
+    return deploymentInfo(body.deployment);
+  }
+  /** Polls a deployment until READY/FAILED, streaming new build logs. */
+  async wait(deploymentId, options = {}) {
+    const intervalMs = options.intervalMs ?? 2500;
+    const timeoutMs = options.timeoutMs ?? 15 * 6e4;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)));
+    const startedAt = Date.now();
+    let lastStatus = null;
+    let lastSequence = -1;
+    for (; ; ) {
+      const detail = await this.get(deploymentId);
+      for (const log2 of detail.logs) {
+        if (log2.sequence > lastSequence) {
+          lastSequence = log2.sequence;
+          options.onLog?.(log2);
+        }
+      }
+      if (detail.deployment.status !== lastStatus) {
+        lastStatus = detail.deployment.status;
+        options.onStatus?.(lastStatus);
+      }
+      if (isTerminalStatus(detail.deployment.status)) return detail;
+      if (Date.now() - startedAt > timeoutMs) {
+        throw new NaroError(
+          "TIMEOUT",
+          `Deployment ${deploymentId} did not finish within ${String(Math.round(timeoutMs / 1e3))}s.`,
+          { details: { deploymentId } }
+        );
+      }
+      await sleep(intervalMs);
+    }
+  }
+};
+var EnvApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId, options = {}) {
+    const query = options.reveal ? "?reveal=true" : "";
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env${query}`,
+      { context: "List environment variables" }
+    );
+    return body.envVars;
+  }
+  async set(projectId, entries) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env`,
+      {
+        method: "POST",
+        body: {
+          entries: entries.map((entry) => ({
+            key: entry.key,
+            value: entry.value,
+            target: entry.target ?? "all",
+            isSecret: entry.isSecret ?? true
+          }))
+        },
+        context: "Set environment variable"
+      }
+    );
+  }
+  async removeById(projectId, envVarId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(envVarId)}`,
+      { method: "DELETE", context: "Remove environment variable" }
+    );
+  }
+  /** Removes every row for a key (optionally narrowed to one target). */
+  async remove(projectId, key, target) {
+    const rows = await this.list(projectId);
+    const matches = rows.filter(
+      (row) => row.key === key && (target === void 0 || row.target === target)
+    );
+    if (matches.length === 0) {
+      throw new NaroError(
+        "ENV_NOT_FOUND",
+        target ? `No ${key} variable found for the ${target} environment.` : `No ${key} variable found.`,
+        { details: { key, ...target ? { target } : {} } }
+      );
+    }
+    for (const row of matches) await this.removeById(projectId, row.id);
+    return matches.length;
+  }
+};
+var DomainsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains`,
+      { context: "List domains" }
+    );
+    return body.domains;
+  }
+  async add(projectId, hostname3) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains`,
+      { method: "POST", body: { hostname: hostname3 }, context: "Add domain" }
+    );
+    return body.domain;
+  }
+  async refresh(projectId, domainId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
+      { method: "PATCH", context: "Refresh domain" }
+    );
+    return body.domain;
+  }
+  async removeById(projectId, domainId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
+      { method: "DELETE", context: "Remove domain" }
+    );
+  }
+  /** Removes a domain by hostname. */
+  async remove(projectId, hostname3) {
+    const domains = await this.list(projectId);
+    const match = domains.find((domain2) => domain2.hostname === hostname3);
+    if (!match) {
+      throw new NaroError(
+        "DOMAIN_NOT_FOUND",
+        `${hostname3} is not attached to this project.`,
+        { details: { hostname: hostname3 } }
+      );
+    }
+    await this.removeById(projectId, match.id);
+  }
+};
+var LogsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async runtime(projectId, options = {}) {
+    const params = new URLSearchParams();
+    params.set("env", options.environment ?? "production");
+    if (options.level) params.set("level", options.level);
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/logs?${params.toString()}`,
+      { context: "Read runtime logs" }
+    );
+    return body.entries;
+  }
+};
+
+// ../../packages/sdk/src/dotenv.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join as join10 } from "path";
+function parseDotenv(text) {
+  const out = {};
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+      value = value.slice(1, -1);
+    out[key] = value;
+  }
+  return out;
 }
-async function defaultSignOut(session) {
-  const client = createAuthClient();
-  await client.auth.setSession({
-    access_token: session.access_token,
-    refresh_token: session.refresh_token
-  });
-  await client.auth.signOut();
+function readProjectEnv(dir) {
+  for (const name of [".env.local", ".env.production", ".env"]) {
+    const path = join10(dir, name);
+    if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
+  }
+  return {};
 }
-async function runLogout(io = stdio, home = homedir2(), signOut = defaultSignOut) {
-  const session = loadStoredSession(home);
-  if (session) {
-    try {
-      await signOut(session);
-    } catch {
+function serializeDotenv(vars) {
+  const needsQuotes = /[\s"'#$`\\]/;
+  return `${Object.entries(vars).map(
+    ([key, value]) => needsQuotes.test(value) ? `${key}="${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"` : `${key}=${value}`
+  ).join("\n")}
+`;
+}
+
+// ../../packages/sdk/src/framework.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join11 } from "path";
+function readPackageJson2(dir) {
+  try {
+    return JSON.parse(
+      readFileSync3(join11(dir, "package.json"), "utf8")
+    );
+  } catch {
+    return null;
+  }
+}
+function hasDependency(pkg, name) {
+  return Boolean(pkg?.dependencies?.[name] ?? pkg?.devDependencies?.[name]);
+}
+function hasConfig(dir, base2, evidence) {
+  for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
+    if (existsSync2(join11(dir, `${base2}.${ext}`))) {
+      evidence.push(`${base2}.${ext}`);
+      return true;
     }
   }
-  clearSession(home);
-  io.out("Logged out.");
+  return false;
+}
+function detectFramework2(dir) {
+  const evidence = [];
+  const pkg = readPackageJson2(dir);
+  if (hasDependency(pkg, "next") || hasConfig(dir, "next.config", evidence)) {
+    if (hasDependency(pkg, "next")) evidence.push("package.json: next");
+    if (existsSync2(join11(dir, "app"))) evidence.push("app/");
+    if (existsSync2(join11(dir, "pages"))) evidence.push("pages/");
+    return {
+      framework: "nextjs",
+      name: "Next.js",
+      buildCommand: "next build",
+      outputDirectory: ".next",
+      evidence,
+      deployable: true
+    };
+  }
+  if (hasDependency(pkg, "nuxt") || hasConfig(dir, "nuxt.config", evidence)) {
+    if (hasDependency(pkg, "nuxt")) evidence.push("package.json: nuxt");
+    return {
+      framework: "nuxt",
+      name: "Nuxt",
+      buildCommand: "nuxt build",
+      outputDirectory: ".output",
+      evidence,
+      deployable: false
+    };
+  }
+  if (hasDependency(pkg, "astro") || hasConfig(dir, "astro.config", evidence)) {
+    if (hasDependency(pkg, "astro")) evidence.push("package.json: astro");
+    return {
+      framework: "astro",
+      name: "Astro",
+      buildCommand: "astro build",
+      outputDirectory: "dist",
+      evidence,
+      deployable: false
+    };
+  }
+  if (hasDependency(pkg, "vite") || hasConfig(dir, "vite.config", evidence)) {
+    if (hasDependency(pkg, "vite")) evidence.push("package.json: vite");
+    return {
+      framework: "vite",
+      name: "Vite",
+      buildCommand: "vite build",
+      outputDirectory: "dist",
+      evidence,
+      deployable: true
+    };
+  }
+  if (hasDependency(pkg, "react-scripts")) {
+    evidence.push("package.json: react-scripts");
+    return {
+      framework: "react",
+      name: "Create React App",
+      buildCommand: "react-scripts build",
+      outputDirectory: "build",
+      evidence,
+      deployable: true
+    };
+  }
+  if (!pkg && existsSync2(join11(dir, "index.html"))) {
+    evidence.push("index.html (no package.json)");
+    return {
+      framework: "static",
+      name: "Static site",
+      buildCommand: null,
+      outputDirectory: ".",
+      evidence,
+      deployable: true
+    };
+  }
+  return {
+    framework: "unknown",
+    name: "Unknown",
+    buildCommand: null,
+    outputDirectory: null,
+    evidence,
+    deployable: false
+  };
+}
+
+// ../../packages/sdk/src/link.ts
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join12 } from "path";
+function linkDir(dir) {
+  return join12(dir, ".naro");
+}
+function linkFile(dir) {
+  return join12(linkDir(dir), "project.json");
+}
+function readProjectLink(dir) {
+  try {
+    const parsed = JSON.parse(readFileSync4(linkFile(dir), "utf8"));
+    if (typeof parsed.projectId !== "string" || parsed.projectId.length === 0)
+      return null;
+    return {
+      projectId: parsed.projectId,
+      ...typeof parsed.teamSlug === "string" ? { teamSlug: parsed.teamSlug } : {},
+      ...typeof parsed.projectName === "string" ? { projectName: parsed.projectName } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writeProjectLink(dir, link) {
+  mkdirSync2(linkDir(dir), { recursive: true });
+  writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
+`);
+  writeFileSync2(
+    join12(linkDir(dir), "README.txt"),
+    "This directory links the project to Naro and should not be committed.\n"
+  );
+}
+function removeProjectLink(dir) {
+  if (!existsSync3(linkDir(dir))) return false;
+  rmSync2(linkDir(dir), { recursive: true, force: true });
+  return true;
+}
+function ensureGitignoreHasNaro(dir) {
+  const gitignorePath = join12(dir, ".gitignore");
+  const hasGitignore = existsSync3(gitignorePath);
+  if (!hasGitignore && !existsSync3(join12(dir, ".git"))) return false;
+  const current = hasGitignore ? readFileSync4(gitignorePath, "utf8") : "";
+  const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
+  if (covered) return false;
+  const suffix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
+  writeFileSync2(gitignorePath, `${current}${suffix}.naro
+`);
+  return true;
+}
+
+// src/git-info.ts
+import { execFile } from "child_process";
+var SUPPORTED_REMOTE = [
+  /^https:\/\/[^\s]+$/,
+  /^ssh:\/\/[^\s]+$/,
+  /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
+];
+var defaultExec = (args, cwd) => new Promise((resolve4, reject) => {
+  execFile("git", args, { cwd }, (error51, stdout) => {
+    if (error51) reject(error51);
+    else resolve4(stdout);
+  });
+});
+async function tryExec(exec, args, cwd) {
+  try {
+    const out = (await exec(args, cwd)).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+async function detectGitInfo(dir, exec = defaultExec) {
+  const remote = await tryExec(exec, ["remote", "get-url", "origin"], dir);
+  const branch = await tryExec(
+    exec,
+    ["rev-parse", "--abbrev-ref", "HEAD"],
+    dir
+  );
+  return {
+    repositoryUrl: remote !== null && SUPPORTED_REMOTE.some((re) => re.test(remote)) ? remote : null,
+    branch: branch !== null && branch !== "HEAD" ? branch : null
+  };
 }
 
 // src/upload.ts
@@ -15769,12 +16727,52 @@ async function authed(opts, path, init) {
     );
   return response;
 }
-async function put(opts, kind, file2) {
-  await authed(opts, `/artifacts/${kind}/${encodeURIComponent(file2.name)}`, {
-    method: "PUT",
-    headers: { "Content-Type": file2.contentType, "X-Artifact-Name": file2.name },
-    body: file2.data
-  });
+function uploadPorts(opts) {
+  const doFetch = opts.fetch ?? fetch;
+  return {
+    resolvePutUrls: async (entries) => {
+      try {
+        const response = await authed(opts, "/artifacts/urls", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            files: entries.map((entry) => ({
+              kind: entry.kind,
+              name: entry.file.name
+            }))
+          })
+        });
+        return parseArtifactPutUrls(await response.json());
+      } catch {
+        return null;
+      }
+    },
+    putSigned: async (url2, entry) => {
+      const response = await doFetch(url2, {
+        method: "PUT",
+        headers: { "Content-Type": entry.file.contentType },
+        body: entry.file.data
+      });
+      if (!response.ok)
+        throw new Error(
+          `Artifact upload returned ${String(response.status)} for ${entry.file.name}`
+        );
+    },
+    putProxied: async (entry) => {
+      await authed(
+        opts,
+        `/artifacts/${entry.kind}/${encodeURIComponent(entry.file.name)}`,
+        {
+          method: "PUT",
+          headers: {
+            "Content-Type": entry.file.contentType,
+            "X-Artifact-Name": entry.file.name
+          },
+          body: entry.file.data
+        }
+      );
+    }
+  };
 }
 function manifest(artifact) {
   const meta3 = ({ name, contentType: contentType2, data }) => ({
@@ -15787,16 +16785,18 @@ function manifest(artifact) {
     projectId: artifact.projectId,
     entrypoint: artifact.entrypoint.name,
     modules: [artifact.entrypoint, ...artifact.modules].map(meta3),
-    assets: artifact.assets.map(meta3),
+    assets: artifact.assets.map((file2) => ({
+      ...meta3(file2),
+      hash: hashAsset(file2.data)
+    })),
     compatibilityDate: artifact.compatibilityDate,
     compatibilityFlags: artifact.compatibilityFlags,
-    assetsBinding: artifact.assetsBinding
+    assetsBinding: artifact.assetsBinding,
+    ...artifact.assetsConfig ? { assetsConfig: artifact.assetsConfig } : {}
   };
 }
 async function uploadArtifact(artifact, opts) {
-  for (const file2 of [artifact.entrypoint, ...artifact.modules])
-    await put(opts, "module", file2);
-  for (const file2 of artifact.assets) await put(opts, "asset", file2);
+  await uploadArtifactFiles(artifact, uploadPorts(opts));
   const response = await authed(opts, "/artifacts/complete", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -15812,59 +16812,11 @@ async function uploadArtifact(artifact, opts) {
 }
 
 // src/deploy.ts
-async function startCliDeployment(accessToken, opts) {
-  const doFetch = opts.fetch ?? fetch;
-  const response = await doFetch(
-    `${opts.controlPlaneUrl.replace(/\/$/, "")}/api/cli/deployments`,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${accessToken}`
-      },
-      body: JSON.stringify({
-        name: opts.name,
-        production: opts.production,
-        ...opts.repositoryUrl != null && { repositoryUrl: opts.repositoryUrl },
-        ...opts.branch != null && { branch: opts.branch },
-        ...opts.rootDirectory != null && { rootDirectory: opts.rootDirectory },
-        ...opts.env !== void 0 && { env: opts.env }
-      })
-    }
-  );
-  if (!response.ok) {
-    if (response.status === 401)
-      throw new Error("Session expired or invalid. Run `naro login`.");
-    throw new Error(
-      `Could not start deployment: control plane returned ${String(response.status)}.`
-    );
-  }
-  return await response.json();
+function parseDotenv2(text) {
+  return parseDotenv(text);
 }
-function controlPlaneUrl(env = process.env) {
-  return (env.NARO_CONTROL_PLANE_URL ?? "https://naro.sh").replace(/\/$/, "");
-}
-async function requireSessionOrLogin(log2, home = homedir3(), loginFlow = () => login({
-  openBrowser: (url2) => {
-    log2(`If your browser did not open, visit:
-  ${url2}`);
-    openBrowser(url2);
-  }
-})) {
-  const stored = loadStoredSession(home);
-  if (stored) {
-    if (!isExpired(stored)) return stored;
-    try {
-      const refreshed = await refreshStoredSession(stored.refresh_token);
-      saveSession(refreshed, home);
-      return refreshed;
-    } catch {
-    }
-  }
-  log2("Not logged in \u2014 opening your browser to sign in with GitHub\u2026");
-  const session = await loginFlow();
-  saveSession(session, home);
-  return session;
+function readProjectEnv2(dir) {
+  return readProjectEnv(dir);
 }
 function eventsObserver(cp2, deploymentId, token, fetchImpl = fetch) {
   const post = (body) => fetchImpl(`${cp2}/api/internal/deployments/${deploymentId}/events`, {
@@ -15876,36 +16828,28 @@ function eventsObserver(cp2, deploymentId, token, fetchImpl = fetch) {
     body: JSON.stringify(body)
   }).then(() => {
   });
+  const postStatus = async (body) => {
+    let lastError;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        return await post(body);
+      } catch (error51) {
+        lastError = error51;
+        await new Promise(
+          (resolve4) => setTimeout(resolve4, 500 * (attempt + 1))
+        );
+      }
+    }
+    throw lastError;
+  };
   return {
-    onStatus: (status) => post({ type: "status", status }),
+    onStatus: (status) => postStatus({ type: "status", status }),
     onLog: (log2) => post({ type: "log", log: log2 }).catch(() => {
     }),
     onMetadata: (metadata) => post({ type: "metadata", metadata }).catch(() => {
     })
   };
 }
-function parseDotenv(text) {
-  const out = {};
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
-      value = value.slice(1, -1);
-    out[key] = value;
-  }
-  return out;
-}
-function readProjectEnv(dir) {
-  for (const name of [".env.local", ".env.production", ".env"]) {
-    const path = join9(dir, name);
-    if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
-  }
-  return {};
-}
 function slugify2(value) {
   const slug = value.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 54);
   return slug || "app";
@@ -15913,19 +16857,19 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile6(join9(sourceDir, "package.json"), "utf8")
+      await readFile7(join13(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
   }
   return basename(sourceDir);
 }
-var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo)([\\/]|$)/;
+var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 function resolveBin(name) {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = join9(dir, "node_modules", ".bin", name);
-    if (existsSync(candidate)) return candidate;
+    const candidate = join13(dir, "node_modules", ".bin", name);
+    if (existsSync4(candidate)) return candidate;
     const parent = dirname(dir);
     if (parent === dir) return name;
     dir = parent;
@@ -15949,7 +16893,7 @@ async function detectPackageManagerLenient(root) {
 }
 function localDependencies(sourceDir) {
   return {
-    createWorkspace: () => mkdtemp2(join9(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join13(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -15964,11 +16908,16 @@ function localDependencies(sourceDir) {
       if (spec.command === "git" && spec.args[0] === "rev-parse") {
         return { stdout: ["0".repeat(40)], stderr: [] };
       }
+      if (spec.command === "git" && spec.args[0] === "log") {
+        return { stdout: [], stderr: [] };
+      }
       return runCommand(spec, observer);
     },
     detectPackageManager: detectPackageManagerLenient,
     resolveAppRoot,
-    validateNextProject,
+    detectFramework,
+    readStaticArtifact,
+    createPackageManagerConfig,
     createPlatformBuildConfig,
     readOpenNextArtifact,
     openNextCommand: resolveBin("opennextjs-cloudflare"),
@@ -15976,61 +16925,142 @@ function localDependencies(sourceDir) {
   };
 }
 async function deployDirectory(sourceDir, options, log2) {
-  const cp2 = controlPlaneUrl();
-  const session = await requireSessionOrLogin(log2);
-  const name = slugify2(options.name ?? await projectName(sourceDir));
+  const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
+  const framework = detectFramework2(sourceDir);
+  if (!framework.deployable && !options.force) {
+    throw new NaroError(
+      "FRAMEWORK_UNSUPPORTED",
+      framework.framework === "unknown" ? "No supported framework detected here. Naro deploys Next.js, Vite, Create React App, and static sites \u2014 run this inside one of those projects." : `${framework.name} projects are not deployable on Naro yet.`,
+      { details: { framework: framework.framework } }
+    );
+  }
+  log2(`\u25B8 detected ${framework.name}`);
+  const auth = await resolveAuth({
+    explicitToken: options.token,
+    interactiveLogin: options.allowLogin === false ? false : {
+      openBrowser,
+      log: log2
+    }
+  });
+  const client = new NaroClient({
+    baseUrl: cpUrl,
+    getAccessToken: () => auth.getAccessToken(),
+    ...options.fetch ? { fetch: options.fetch } : {}
+  });
+  const name = slugify2(options.name ?? await projectName(sourceDir));
   const git = await detectGitInfo(sourceDir);
   const branch = options.branch ?? git.branch;
-  if (git.repositoryUrl) log2(`\u25B8 linking ${git.repositoryUrl}`);
+  if (options.projectId) log2(`\u25B8 linked project ${options.projectId}`);
+  else if (git.repositoryUrl) log2(`\u25B8 linking ${git.repositoryUrl}`);
   if (options.env && Object.keys(options.env).length > 0)
-    log2(`\u25B8 syncing ${Object.keys(options.env).length} env var(s)`);
+    log2(`\u25B8 syncing ${String(Object.keys(options.env).length)} env var(s)`);
   log2("\u25B8 starting deployment");
-  const ctx = await startCliDeployment(session.access_token, {
-    name,
+  const ctx = await client.deployments.createCli({
+    ...options.projectId ? { projectId: options.projectId } : { name },
     production,
-    controlPlaneUrl: cp2,
-    repositoryUrl: git.repositoryUrl,
-    branch,
-    rootDirectory: options.rootDirectory,
-    env: options.env
+    ...git.repositoryUrl != null && { repositoryUrl: git.repositoryUrl },
+    ...branch != null && { branch },
+    ...options.rootDirectory != null && {
+      rootDirectory: options.rootDirectory
+    },
+    ...options.env !== void 0 && { env: options.env }
   });
   if (ctx.envSkipped?.length)
     log2(`\u26A0 skipped env: ${ctx.envSkipped.join(", ")}`);
-  const executor = new LocalBuildExecutor(localDependencies(sourceDir));
-  const observer = eventsObserver(cp2, ctx.deploymentId, ctx.callbackToken);
-  const result = await executor.build(
-    {
-      deploymentId: ctx.deploymentId,
-      projectId: ctx.projectId,
-      repositoryUrl: sourceDir,
-      branch: ctx.branch,
-      rootDirectory: options.rootDirectory ?? ctx.rootDirectory,
-      env: { ...ctx.env, ...options.env ?? {} }
-    },
-    observer
+  const executor = options.executor ?? new LocalBuildExecutor(localDependencies(sourceDir));
+  const observer = eventsObserver(
+    cpUrl,
+    ctx.deploymentId,
+    ctx.callbackToken,
+    options.fetch
   );
-  const uploaded = await uploadArtifact(result.artifact, {
-    controlPlaneUrl: cp2,
+  let artifact;
+  try {
+    const result = await executor.build(
+      {
+        deploymentId: ctx.deploymentId,
+        projectId: ctx.projectId,
+        repositoryUrl: sourceDir,
+        branch: ctx.branch,
+        rootDirectory: options.rootDirectory ?? ctx.rootDirectory,
+        env: { ...ctx.env, ...options.env ?? {} }
+      },
+      observer
+    );
+    artifact = result.artifact;
+  } catch (error51) {
+    throw new NaroError(
+      "BUILD_FAILED",
+      error51 instanceof Error ? error51.message : "The local build failed.",
+      { details: { deploymentId: ctx.deploymentId }, cause: error51 }
+    );
+  }
+  await uploadArtifact(artifact, {
+    controlPlaneUrl: cpUrl,
     deploymentId: ctx.deploymentId,
-    callbackToken: ctx.callbackToken
+    callbackToken: ctx.callbackToken,
+    ...options.fetch ? { fetch: options.fetch } : {}
   });
+  log2("\u25B8 publishing worker");
+  const detail = await waitForFinish(client, ctx, log2);
+  const url2 = deploymentUrl(detail, ctx, production);
+  if (detail.deployment.status === "FAILED") {
+    throw new NaroError(
+      detail.deployment.errorCode ?? "DEPLOY_FAILED",
+      detail.deployment.errorMessage ?? "The deployment failed.",
+      { details: { deploymentId: ctx.deploymentId } }
+    );
+  }
   return {
-    workerName: name,
-    url: uploaded.previewUrl ?? `${name}${production ? "" : "-preview"}.naro.sh`
+    deploymentId: ctx.deploymentId,
+    projectId: ctx.projectId,
+    status: detail.deployment.status,
+    url: url2,
+    production
   };
 }
+async function waitForFinish(client, ctx, log2) {
+  return client.deployments.wait(ctx.deploymentId, {
+    intervalMs: 2500,
+    timeoutMs: 10 * 6e4,
+    onStatus: (status) => {
+      if (status === "READY") log2("\u2713 worker deployed");
+    }
+  });
+}
+function deploymentUrl(detail, ctx, production) {
+  if (detail.deployment.url) return detail.deployment.url;
+  const surface = ctx.subdomain ?? ctx.projectId;
+  const host = new URL(ctx.controlPlaneUrl || controlPlaneUrl()).hostname;
+  return `https://${surface}${production ? "" : "-preview"}.${host}`;
+}
 
 export {
-  runLogin,
-  runWhoami,
-  runLogout,
-  startCliDeployment,
+  NaroError,
+  isNaroError,
+  toNaroError,
+  saveSession,
+  loadStoredSession,
+  clearSession,
+  isExpired,
   controlPlaneUrl,
-  requireSessionOrLogin,
-  eventsObserver,
-  parseDotenv,
+  createAuthClient,
+  refreshStoredSession,
+  login,
+  resolveAuth,
+  openBrowser,
+  isTerminalStatus,
+  NaroClient,
   readProjectEnv,
+  serializeDotenv,
+  readProjectLink,
+  writeProjectLink,
+  removeProjectLink,
+  ensureGitignoreHasNaro,
+  parseDotenv2 as parseDotenv,
+  readProjectEnv2,
+  eventsObserver,
   slugify2 as slugify,
   deployDirectory
 };