naro-cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,91 +1,1262 @@
 #!/usr/bin/env node
 import {
+  NaroClient,
+  NaroError,
+  clearSession,
+  controlPlaneUrl,
+  createAuthClient,
   deployDirectory,
+  ensureGitignoreHasNaro,
+  isExpired,
+  isNaroError,
+  isTerminalStatus,
+  loadStoredSession,
+  login,
+  openBrowser,
   readProjectEnv,
-  runLogin,
-  runLogout,
-  runWhoami
-} from "./chunk-UNCVFCTH.js";
+  readProjectLink,
+  refreshStoredSession,
+  removeProjectLink,
+  resolveAuth,
+  saveSession,
+  serializeDotenv,
+  slugify,
+  toNaroError,
+  writeProjectLink
+} from "./chunk-B6F7QIW7.js";
 
-// src/index.ts
-function parseFlags(argv) {
-  const flags = { production: false };
+// src/args.ts
+var BOOLEAN_FLAGS = {
+  "--json": "json",
+  "--yes": "yes",
+  "-y": "yes",
+  "--debug": "debug",
+  "--help": "help",
+  "-h": "help",
+  "--version": "version",
+  "-v": "version",
+  "--prod": "prod",
+  "--production": "prod",
+  "--follow": "follow",
+  "-f": "follow",
+  "--reveal": "reveal"
+};
+var STRING_FLAGS = {
+  "--token": "token",
+  "--project": "project",
+  "--team": "team",
+  "--cwd": "cwd",
+  "--name": "name",
+  "--root": "root",
+  "--branch": "branch",
+  "--type": "type",
+  "--env": "env",
+  "--level": "level"
+};
+function parseArgs(argv) {
+  const flags = {
+    json: false,
+    yes: false,
+    debug: false,
+    help: false,
+    version: false,
+    prod: false,
+    follow: false,
+    reveal: false
+  };
+  const positionals = [];
+  const unknown = [];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (arg === "--prod" || arg === "--production") flags.production = true;
-    else if (arg === "--name") flags.name = argv[++i];
-    else if (arg === "--root") flags.root = argv[++i];
-    else if (arg === "--branch") flags.branch = argv[++i];
+    if (arg === void 0) continue;
+    const booleanKey = BOOLEAN_FLAGS[arg];
+    if (booleanKey) {
+      flags[booleanKey] = true;
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const stringKey = STRING_FLAGS[arg] ?? (eq > 0 ? STRING_FLAGS[arg.slice(0, eq)] : void 0);
+    if (stringKey) {
+      if (eq > 0 && STRING_FLAGS[arg.slice(0, eq)]) {
+        flags[stringKey] = arg.slice(
+          eq + 1
+        );
+        continue;
+      }
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("-") && value !== "-") {
+        unknown.push(`${arg} (missing value)`);
+        continue;
+      }
+      i += 1;
+      flags[stringKey] = value;
+      continue;
+    }
+    if (arg.startsWith("-") && arg !== "-") {
+      unknown.push(arg);
+      continue;
+    }
+    positionals.push(arg);
   }
-  return flags;
+  const [command, ...rest] = positionals;
+  return { command, positionals: rest, flags, unknown };
 }
-var HELP = `naro \u2014 deploy the current app to naro
 
-Usage:
-  naro login
-  naro whoami
-  naro logout
-  naro deploy [--name <name>] [--root <dir>] [--branch <name>] [--prod]
-
-Options:
-  --name    Override the deployment name (defaults to package.json name)
-  --root    Sub-directory that contains the Next.js app (where package.json is)
-  --branch  Override the detected git branch
-  --prod    Publish to production ({name}.naro.sh) instead of preview
-
-Credentials:
-  Run \`naro login\` to authenticate via GitHub.
-  \`naro deploy\` signs you in automatically (opens your browser) when needed.
-  Set NARO_CONTROL_PLANE_URL to use a custom control plane (defaults to https://naro.sh).
-`;
-async function main() {
-  const [command, ...rest] = process.argv.slice(2);
-  if (!command || command === "help" || command === "--help") {
-    process.stdout.write(HELP);
-    return;
+// src/output.ts
+var processStreams = {
+  stdout: (text) => process.stdout.write(text),
+  stderr: (text) => process.stderr.write(text)
+};
+var Output = class {
+  constructor(json, debug, streams = processStreams) {
+    this.json = json;
+    this.debug = debug;
+    this.streams = streams;
   }
-  if (command === "login") return runLogin();
-  if (command === "whoami") return runWhoami();
-  if (command === "logout") return runLogout();
-  if (command !== "deploy") {
-    process.stderr.write(`Unknown command: ${command}
-
-${HELP}`);
+  resultPrinted = false;
+  /** Progress/log line for humans. */
+  log(message) {
+    if (this.json) this.streams.stderr(`${message}
+`);
+    else this.streams.stdout(`${message}
+`);
+  }
+  /** Extra diagnostics, only with --debug. */
+  debugLog(message) {
+    if (this.debug) this.streams.stderr(`[debug] ${message}
+`);
+  }
+  /**
+   * Final command result. JSON mode prints {success:true, ...data}; human
+   * mode prints the lines instead.
+   */
+  result(data, humanLines = []) {
+    this.resultPrinted = true;
+    if (this.json) {
+      this.streams.stdout(
+        `${JSON.stringify({ success: true, ...data }, null, 2)}
+`
+      );
+      return;
+    }
+    for (const line of humanLines) this.streams.stdout(`${line}
+`);
+  }
+  /** Command failure: stable {success:false, code, message} in JSON mode. */
+  fail(error) {
+    const naroError = isNaroError(error) ? error : toNaroError(error);
+    this.resultPrinted = true;
     process.exitCode = 1;
-    return;
+    if (this.json) {
+      this.streams.stdout(
+        `${JSON.stringify(
+          {
+            success: false,
+            code: naroError.code,
+            message: naroError.message,
+            ...naroError.details ?? {}
+          },
+          null,
+          2
+        )}
+`
+      );
+      return;
+    }
+    this.streams.stderr(`\u2717 ${naroError.message}
+`);
+    if (this.debug && naroError.cause instanceof Error) {
+      this.streams.stderr(`[debug] cause: ${naroError.cause.stack ?? ""}
+`);
+    }
+  }
+  get hasResult() {
+    return this.resultPrinted;
   }
-  const flags = parseFlags(rest);
-  const cwd = process.cwd();
-  const env = readProjectEnv(cwd);
-  process.stdout.write(`
-\u{1F680} Deploying ${cwd}
+};
 
+// src/prompt.ts
+import { createInterface } from "readline";
+import { Writable } from "stream";
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += String(chunk);
+  return data.replace(/\r?\n$/, "");
+}
+var TtyPrompter = class {
+  async ask(question) {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    try {
+      return await new Promise(
+        (resolve) => rl.question(question, resolve)
+      );
+    } finally {
+      rl.close();
+    }
+  }
+  async askHidden(question) {
+    let muted = false;
+    const output = new Writable({
+      write(chunk, _enc, done) {
+        if (!muted) process.stdout.write(chunk);
+        done();
+      }
+    });
+    const rl = createInterface({
+      input: process.stdin,
+      output,
+      terminal: true
+    });
+    try {
+      const answer = new Promise(
+        (resolve) => rl.question(question, resolve)
+      );
+      muted = true;
+      const value = await answer;
+      process.stdout.write("\n");
+      return value;
+    } finally {
+      rl.close();
+    }
+  }
+  async confirm(question) {
+    const answer = (await this.ask(`${question} (y/N) `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  }
+  async select(question, options) {
+    process.stdout.write(`${question}
 `);
-  const result = await deployDirectory(
+    options.forEach((option, index) => {
+      process.stdout.write(`  ${String(index + 1)}. ${option}
+`);
+    });
+    for (; ; ) {
+      const answer = Number.parseInt(
+        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
+        10
+      );
+      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
+        return answer - 1;
+    }
+  }
+};
+var NonInteractivePrompter = class {
+  constructor(assumeYes) {
+    this.assumeYes = assumeYes;
+  }
+  refuse(question) {
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
+    );
+  }
+  async ask(question) {
+    this.refuse(question);
+  }
+  async askHidden(question) {
+    this.refuse(question);
+  }
+  async confirm() {
+    return this.assumeYes;
+  }
+  async select(question) {
+    this.refuse(question);
+  }
+};
+function createPrompter(options) {
+  if (options.yes || options.json || !isInteractive())
+    return new NonInteractivePrompter(options.yes);
+  return new TtyPrompter();
+}
+
+// src/context.ts
+function createContext(flags, positionals = []) {
+  const cwd = flags.cwd ?? process.cwd();
+  const output = new Output(flags.json, flags.debug);
+  const prompter = createPrompter({ json: flags.json, yes: flags.yes });
+  let resolvedAuth = null;
+  let resolvedClient = null;
+  const auth = async () => {
+    if (resolvedAuth) return resolvedAuth;
+    const interactive = !flags.json && !flags.yes && isInteractive() ? { openBrowser, log: (message) => output.log(message) } : false;
+    resolvedAuth = await resolveAuth({
+      explicitToken: flags.token,
+      interactiveLogin: interactive
+    });
+    return resolvedAuth;
+  };
+  return {
     cwd,
+    flags,
+    positionals,
+    output,
+    prompter,
+    positionalOrThrow: (count, usage) => {
+      if (positionals.length < count)
+        throw new NaroError("VALIDATION_FAILED", usage);
+      return positionals.slice(0, count);
+    },
+    auth,
+    client: async () => {
+      if (resolvedClient) return resolvedClient;
+      const resolved = await auth();
+      resolvedClient = new NaroClient({
+        baseUrl: controlPlaneUrl(),
+        getAccessToken: () => resolved.getAccessToken()
+      });
+      return resolvedClient;
+    },
+    projectLink: () => readProjectLink(cwd),
+    resolveProjectId: async () => {
+      if (flags.project) return flags.project;
+      const link = readProjectLink(cwd);
+      if (link) return link.projectId;
+      throw new NaroError(
+        "PROJECT_NOT_LINKED",
+        "No project is linked here. Run `naro link` first, or pass --project <id>."
+      );
+    }
+  };
+}
+
+// src/router.ts
+import { readFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/commands/auth.ts
+async function runLogin(context) {
+  const { output } = context;
+  output.log("Opening your browser to sign in with GitHub...");
+  const session = await login({
+    openBrowser: (url) => {
+      output.log(`If your browser did not open, visit:
+  ${url}`);
+      openBrowser(url);
+    }
+  });
+  saveSession(session);
+  output.result(
+    {
+      user: {
+        id: session.user.id,
+        email: session.user.email,
+        github: session.user.github
+      }
+    },
+    [`\u2705 Logged in as ${session.user.email ?? session.user.id}`]
+  );
+}
+async function runLogout(context) {
+  const session = loadStoredSession();
+  if (session) {
+    try {
+      const client = createAuthClient();
+      await client.auth.setSession({
+        access_token: session.access_token,
+        refresh_token: session.refresh_token
+      });
+      await client.auth.signOut();
+    } catch {
+    }
+  }
+  clearSession();
+  context.output.result({ loggedOut: true }, ["Logged out."]);
+}
+async function currentSession() {
+  let session = loadStoredSession();
+  if (!session)
+    throw new NaroError("NOT_LOGGED_IN", "Not logged in. Run `naro login`.");
+  if (isExpired(session)) {
+    try {
+      session = await refreshStoredSession(session.refresh_token);
+      saveSession(session);
+    } catch {
+      throw new NaroError(
+        "NOT_LOGGED_IN",
+        "Session expired. Run `naro login`."
+      );
+    }
+  }
+  return session;
+}
+async function runWhoami(context) {
+  const session = await currentSession();
+  const handle = session.user.github ? ` (${session.user.github})` : "";
+  context.output.result(
+    {
+      user: {
+        id: session.user.id,
+        email: session.user.email,
+        github: session.user.github
+      }
+    },
+    [`Logged in as ${session.user.email ?? session.user.id}${handle}`]
+  );
+}
+async function runToken(context) {
+  const session = await currentSession();
+  process.stderr.write(
+    "\u26A0 Access tokens expire after about an hour \u2014 generate one per CI run.\n"
+  );
+  context.output.result(
+    { token: session.access_token, expiresAt: session.expires_at },
+    [session.access_token]
+  );
+}
+
+// src/commands/deploy.ts
+async function runDeploy(context) {
+  const { flags, output } = context;
+  const link = flags.project ? { projectId: flags.project } : readProjectLink(context.cwd);
+  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
+    const confirmed = await context.prompter.confirm("Deploy to production?");
+    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  }
+  output.log(`
+\u{1F680} Deploying ${context.cwd}
+`);
+  const localEnv = link ? {} : readProjectEnv(context.cwd);
+  if (link)
+    output.log(
+      "\u25B8 using project env vars (manage them with `naro env`, sync local files with `naro env pull`)"
+    );
+  const result = await deployDirectory(
+    context.cwd,
     {
       name: flags.name,
+      projectId: link?.projectId,
       rootDirectory: flags.root ?? null,
       branch: flags.branch,
-      production: flags.production,
-      env
+      production: flags.prod,
+      // Local dotenv files seed the project ONCE (first, unlinked deploy).
+      // After that the platform owns env — a stray .env.local must not
+      // silently overwrite values set via the dashboard or `naro env add`.
+      env: localEnv,
+      token: flags.token,
+      allowLogin: !flags.json && !flags.yes
+    },
+    (message) => output.log(message)
+  );
+  if (!link) {
+    writeProjectLink(context.cwd, { projectId: result.projectId });
+    if (ensureGitignoreHasNaro(context.cwd))
+      output.log("\u25B8 added .naro to .gitignore");
+    output.log("\u25B8 linked (.naro/project.json)");
+  }
+  context.output.result(
+    {
+      deploymentId: result.deploymentId,
+      projectId: result.projectId,
+      status: result.status,
+      url: result.url,
+      target: result.production ? "production" : "preview"
     },
-    (message) => process.stdout.write(`${message}
-`)
+    [
+      "",
+      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
+      "",
+      result.url
+    ]
   );
-  process.stdout.write(`
-\u2705 Live at ${result.url}
+}
 
-`);
+// src/commands/deployments.ts
+function shortSha(sha) {
+  return sha ? sha.slice(0, 7) : "-";
 }
-void main().catch((error) => {
-  process.stderr.write(
-    `
-\u2717 ${error instanceof Error ? error.message : String(error)}
-`
+function formatDeploymentLine(deployment) {
+  return [
+    deployment.id.padEnd(38),
+    deployment.status.padEnd(10),
+    deployment.branch.padEnd(16),
+    shortSha(deployment.gitCommitSha).padEnd(9),
+    deployment.url ?? ""
+  ].join(" ");
+}
+async function runDeployments(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const deployments = await client.deployments.list(projectId);
+  context.output.result({ projectId, deployments }, [
+    `Deployments for ${projectId}:`,
+    "",
+    [
+      "ID".padEnd(38),
+      "STATUS".padEnd(10),
+      "BRANCH".padEnd(16),
+      "COMMIT".padEnd(9),
+      "URL"
+    ].join(" "),
+    ...deployments.map(formatDeploymentLine)
+  ]);
+}
+async function runInspect(context) {
+  const [deploymentId] = context.positionalOrThrow(
+    1,
+    "Usage: naro inspect <deployment-id>"
+  );
+  const client = await context.client();
+  const detail = await client.deployments.get(deploymentId);
+  const { deployment } = detail;
+  const lastLogs = detail.logs.slice(-15);
+  context.output.result({ deployment, logs: detail.logs }, [
+    `Deployment ${deployment.id}`,
+    `  status:   ${deployment.status}${deployment.errorCode ? ` (${deployment.errorCode})` : ""}`,
+    `  branch:   ${deployment.branch}`,
+    `  commit:   ${deployment.gitCommitSha ?? "-"}`,
+    `  url:      ${deployment.url ?? "-"}`,
+    `  created:  ${deployment.createdAt}`,
+    `  finished: ${deployment.finishedAt ?? "-"}`,
+    ...deployment.errorMessage ? [`  error:    ${deployment.errorMessage}`] : [],
+    ...lastLogs.length > 0 ? [
+      "",
+      "Recent build logs:",
+      ...lastLogs.map((log) => `  [${log.stage}] ${log.message}`)
+    ] : []
+  ]);
+}
+
+// src/commands/confirm.ts
+async function confirmOrAbort(context, question) {
+  if (context.flags.yes) return;
+  if (context.flags.json || !isInteractive()) {
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `${question} Re-run with --yes to confirm.`
+    );
+  }
+  const confirmed = await context.prompter.confirm(question);
+  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+}
+
+// src/commands/domains.ts
+function domainLines(domain) {
+  const lines = [
+    `  ${domain.hostname.padEnd(36)} ${domain.status.padEnd(12)} ssl: ${domain.sslStatus}`
+  ];
+  if (domain.status !== "active" && domain.verification.length > 0) {
+    lines.push("    Required DNS records:");
+    for (const record of domain.verification) {
+      lines.push(
+        `      Type: ${record.type.toUpperCase().padEnd(6)} Name: ${record.name}`,
+        `      Value: ${record.value}`
+      );
+    }
+  }
+  return lines;
+}
+async function runDomainsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const domains = await client.domains.list(projectId);
+  context.output.result(
+    { projectId, domains },
+    domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
+      `Domains (${String(domains.length)}):`,
+      ...domains.flatMap(domainLines)
+    ]
+  );
+}
+async function runDomainsAdd(context) {
+  const [hostname] = context.positionalOrThrow(
+    1,
+    "Usage: naro domains add <hostname>"
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const domain = await client.domains.add(projectId, hostname);
+  context.output.result({ projectId, domain }, [
+    `\u2705 Domain added: ${domain.hostname}`,
+    "",
+    ...domainLines(domain),
+    "",
+    domain.status === "active" ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains list` to refresh."
+  ]);
+}
+async function runDomainsRemove(context) {
+  const [hostname] = context.positionalOrThrow(
+    1,
+    "Usage: naro domains remove <hostname>"
+  );
+  await confirmOrAbort(
+    context,
+    `Remove ${String(hostname)}? Traffic to it will stop routing here.`
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await client.domains.remove(projectId, hostname);
+  context.output.result({ projectId, hostname, removed: true }, [
+    `\u2705 Removed ${String(hostname)}`
+  ]);
+}
+
+// src/commands/env.ts
+import { existsSync, writeFileSync } from "fs";
+import { join } from "path";
+var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function parseTarget(value) {
+  if (value === void 0) return "all";
+  if (!TARGETS.has(value))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Environment must be production, preview or all."
+    );
+  return value;
+}
+function maskedValue(row) {
+  if (!row.isSecret) return row.value ?? "";
+  return "\u2022\u2022\u2022\u2022\u2022\u2022 (secret)";
+}
+async function runEnvList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const reveal = context.flags.reveal;
+  const rows = await client.env.list(projectId, { reveal });
+  context.output.result(
+    {
+      projectId,
+      envVars: rows.map((row) => ({
+        id: row.id,
+        key: row.key,
+        target: row.target,
+        isSecret: row.isSecret,
+        value: row.isSecret && !reveal ? null : row.value
+      }))
+    },
+    [
+      `Environment variables (${String(rows.length)}):`,
+      ...rows.map(
+        (row) => `  ${row.key.padEnd(32)} ${row.target.padEnd(12)} ${reveal ? row.value ?? "" : maskedValue(row)}`
+      )
+    ]
+  );
+}
+async function runEnvAdd(context) {
+  context.positionalOrThrow(
+    1,
+    "Usage: naro env add KEY [production|preview|all]"
+  );
+  const [key, targetArg] = context.positionals;
+  if (!key || !KEY_RE.test(key) || key.length > 256)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Keys must look like MY_VARIABLE (letters, digits, underscore)."
+    );
+  const target = parseTarget(targetArg);
+  let value;
+  if (!process.stdin.isTTY) {
+    value = await readStdin();
+  } else {
+    value = await context.prompter.askHidden(`? What's the value of ${key}? `);
+  }
+  if (value.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
+  const isSecret = !key.startsWith("NEXT_PUBLIC_");
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await client.env.set(projectId, [{ key, value, target, isSecret }]);
+  context.output.result({ projectId, key, target, isSecret }, [
+    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  ]);
+}
+async function runEnvRemove(context) {
+  context.positionalOrThrow(
+    1,
+    "Usage: naro env remove KEY [production|preview|all]"
+  );
+  const [key, targetArg] = context.positionals;
+  const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
+  await confirmOrAbort(
+    context,
+    `Remove ${String(key)}${target ? ` (${target})` : ""} from this project?`
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const removed = await client.env.remove(projectId, key, target);
+  context.output.result({ projectId, key, removed }, [
+    `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
+  ]);
+}
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = context.flags.env === "production" ? "production" : "preview";
+  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production or preview."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const rows = await client.env.list(projectId, { reveal: true });
+  const selected = rows.filter(
+    (row) => row.target === "all" || row.target === surface
+  );
+  const vars = Object.fromEntries(
+    selected.map((row) => [row.key, row.value ?? ""])
+  );
+  const path = join(context.cwd, file);
+  if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
+    const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
+    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  }
+  writeFileSync(
+    path,
+    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
+${serializeDotenv(vars)}`,
+    { mode: 384 }
+  );
+  context.output.result(
+    { projectId, file, environment: surface, count: selected.length },
+    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+  );
+}
+
+// src/commands/link.ts
+async function resolveTeam(context, teams) {
+  if (context.flags.team) {
+    const match = teams.find((team) => team.slug === context.flags.team);
+    if (!match)
+      throw new NaroError(
+        "NOT_FOUND",
+        `You are not a member of team "${context.flags.team}".`
+      );
+    return match;
+  }
+  const linked = context.projectLink();
+  if (linked?.teamSlug) {
+    const match = teams.find((team) => team.slug === linked.teamSlug);
+    if (match) return match;
+  }
+  const personal = teams.find((team) => team.isPersonal);
+  const fallback = personal ?? teams[0];
+  if (!fallback)
+    throw new NaroError("NOT_FOUND", "Your account has no teams yet.");
+  if (teams.length > 1 && !personal) {
+    const index = await context.prompter.select(
+      "Which team?",
+      teams.map((team) => `${team.name} (${team.slug})`)
+    );
+    return teams[index] ?? fallback;
+  }
+  return fallback;
+}
+function saveLink(context, project, teamSlug) {
+  writeProjectLink(context.cwd, {
+    projectId: project.id,
+    teamSlug,
+    projectName: project.name
+  });
+  if (ensureGitignoreHasNaro(context.cwd))
+    context.output.log("\u25B8 added .naro to .gitignore");
+}
+async function runLink(context) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const team = await resolveTeam(context, teams);
+  const projects = await client.projects.list(team.slug);
+  let project;
+  if (context.flags.project) {
+    project = projects.find(
+      (candidate) => candidate.id === context.flags.project
+    );
+    if (!project) {
+      project = await client.projects.get(context.flags.project);
+    }
+  } else if (context.flags.name) {
+    project = projects.find(
+      (candidate) => candidate.name === context.flags.name || candidate.slug === context.flags.name
+    );
+    if (!project)
+      throw new NaroError(
+        "PROJECT_NOT_FOUND",
+        `No project named "${context.flags.name}" in team ${team.slug}. Run \`naro deploy\` to create it.`
+      );
+  } else {
+    const guess = slugify(context.cwd.split("/").at(-1) ?? "app");
+    const exact = projects.find(
+      (candidate) => candidate.name === guess || candidate.slug === guess
+    );
+    if (exact && (context.flags.yes || context.flags.json)) {
+      project = exact;
+    } else if (projects.length === 0) {
+      throw new NaroError(
+        "PROJECT_NOT_FOUND",
+        `Team ${team.slug} has no projects yet. Run \`naro deploy\` to create one.`
+      );
+    } else {
+      const options = projects.map(
+        (candidate) => `${candidate.name} (${candidate.subdomain})`
+      );
+      const index = await context.prompter.select(
+        `Link ${context.cwd} to which project?`,
+        options
+      );
+      project = projects[index];
+    }
+  }
+  if (!project)
+    throw new NaroError("PROJECT_NOT_FOUND", "No project selected.");
+  const owningTeam = teams.find((candidate) => candidate.id === project.teamId) ?? team;
+  saveLink(context, project, owningTeam.slug);
+  context.output.result(
+    {
+      projectId: project.id,
+      projectName: project.name,
+      teamSlug: owningTeam.slug,
+      subdomain: project.subdomain
+    },
+    [`\u2705 Linked to ${owningTeam.slug}/${project.name} (.naro/project.json)`]
+  );
+}
+async function runUnlink(context) {
+  const existing = readProjectLink(context.cwd);
+  const removed = removeProjectLink(context.cwd);
+  context.output.result(
+    { removed, ...existing ? { projectId: existing.projectId } : {} },
+    [removed ? "\u2705 Unlinked (.naro removed)" : "Nothing to unlink here."]
+  );
+}
+
+// src/commands/logs.ts
+var FOLLOW_INTERVAL_MS = 3e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function formatBuildLog(log) {
+  return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
+}
+function formatRuntimeLog(entry) {
+  const time = new Date(entry.ts).toISOString();
+  const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
+  return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
+}
+async function latestProductionDeploymentId(client, projectId) {
+  const deployments = await client.deployments.list(projectId);
+  const latest = deployments.find(
+    (deployment) => deployment.status === "READY"
+  );
+  const fallback = deployments[0];
+  const chosen = latest ?? fallback;
+  if (!chosen)
+    throw new NaroError(
+      "DEPLOYMENT_NOT_FOUND",
+      "This project has no deployments yet."
+    );
+  return chosen.id;
+}
+async function buildLogs(context, client, deploymentId) {
+  if (!context.flags.follow) {
+    const detail = await client.deployments.get(deploymentId);
+    context.output.result(
+      { deploymentId, type: "build", logs: detail.logs },
+      detail.logs.map(formatBuildLog)
+    );
+    return;
+  }
+  let lastSequence = -1;
+  for (; ; ) {
+    const detail = await client.deployments.get(deploymentId);
+    for (const log of detail.logs) {
+      if (log.sequence > lastSequence) {
+        lastSequence = log.sequence;
+        context.output.log(formatBuildLog(log));
+      }
+    }
+    if (isTerminalStatus(detail.deployment.status)) {
+      context.output.result(
+        {
+          deploymentId,
+          type: "build",
+          status: detail.deployment.status,
+          logs: detail.logs
+        },
+        [`\u2014 deployment ${detail.deployment.status} \u2014`]
+      );
+      return;
+    }
+    await sleep(FOLLOW_INTERVAL_MS);
+  }
+}
+async function runtimeLogs(context, client, projectId) {
+  const environment = context.flags.env === "preview" ? "preview" : "production";
+  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production or preview."
+    );
+  const options = {
+    environment,
+    ...context.flags.level ? { level: context.flags.level } : {}
+  };
+  if (!context.flags.follow) {
+    const entries = await client.logs.runtime(projectId, options);
+    context.output.result(
+      { projectId, type: "runtime", environment, entries },
+      entries.length > 0 ? entries.map(formatRuntimeLog) : ["(no runtime logs yet \u2014 the worker logs on each request)"]
+    );
+    return;
+  }
+  context.output.log(
+    `Following ${environment} runtime logs (Ctrl-C to stop)...`
+  );
+  let lastTs = -1;
+  let boundary = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const entries = await client.logs.runtime(projectId, options);
+    for (const entry of entries) {
+      if (entry.ts < lastTs) continue;
+      const key = JSON.stringify(entry);
+      if (entry.ts === lastTs) {
+        if (boundary.has(key)) continue;
+      } else {
+        lastTs = entry.ts;
+        boundary = /* @__PURE__ */ new Set();
+      }
+      boundary.add(key);
+      context.output.log(formatRuntimeLog(entry));
+    }
+    await sleep(FOLLOW_INTERVAL_MS);
+  }
+}
+async function runLogs(context) {
+  const client = await context.client();
+  const [deploymentId] = context.positionals;
+  const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
+  if (type !== "build" && type !== "runtime")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--type must be build or runtime."
+    );
+  if (type === "runtime") {
+    if (deploymentId)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        "Runtime logs are per project, not per deployment. Drop the deployment id or use --type build."
+      );
+    const projectId = await context.resolveProjectId();
+    await runtimeLogs(context, client, projectId);
+    return;
+  }
+  const target = deploymentId ?? await latestProductionDeploymentId(
+    client,
+    await context.resolveProjectId()
+  );
+  await buildLogs(context, client, target);
+}
+
+// src/commands/projects.ts
+function productionUrl(subdomain) {
+  return `https://${subdomain}.${new URL(controlPlaneUrl()).hostname}`;
+}
+async function runProjects(context) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const team = await resolveTeam(context, teams);
+  const projects = await client.projects.list(team.slug);
+  context.output.result(
+    {
+      team: team.slug,
+      projects: projects.map((project) => ({
+        id: project.id,
+        name: project.name,
+        subdomain: project.subdomain,
+        url: productionUrl(project.subdomain),
+        defaultBranch: project.defaultBranch,
+        updatedAt: project.updatedAt
+      }))
+    },
+    [
+      `Projects in ${team.slug} (${String(projects.length)}):`,
+      ...projects.map(
+        (project) => `  ${project.name.padEnd(24)} ${productionUrl(project.subdomain).padEnd(40)} ${project.id}`
+      )
+    ]
   );
-  process.exitCode = 1;
-});
+}
+async function runProjectInspect(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.get(projectId);
+  const url = productionUrl(project.subdomain);
+  context.output.result({ project: { ...project, url } }, [
+    `${project.name}`,
+    `  id:             ${project.id}`,
+    `  team:           ${project.teamId}`,
+    `  production URL: ${url}`,
+    `  preview URL:    https://${project.subdomain}-preview.${new URL(controlPlaneUrl()).hostname}`,
+    `  default branch: ${project.defaultBranch}`,
+    `  root directory: ${project.rootDirectory ?? "(repo root)"}`,
+    `  repository:     ${project.repositoryFullName ?? project.repositoryUrl}`
+  ]);
+}
+
+// src/commands/promote.ts
+async function promoteAndWait(context, client, project, sourceDeploymentId, action) {
+  const promoted = await client.deployments.promote(
+    project.id,
+    sourceDeploymentId
+  );
+  context.output.log(
+    `\u25B8 ${action === "promote" ? "promoting" : "rolling back to"} ${sourceDeploymentId}`
+  );
+  const detail = await client.deployments.wait(promoted.id, {
+    timeoutMs: 5 * 6e4
+  });
+  if (detail.deployment.status !== "READY") {
+    throw new NaroError(
+      detail.deployment.errorCode ?? "DEPLOY_FAILED",
+      detail.deployment.errorMessage ?? `The ${action} failed.`,
+      { details: { deploymentId: promoted.id } }
+    );
+  }
+  context.output.result(
+    {
+      deploymentId: promoted.id,
+      sourceDeploymentId,
+      projectId: project.id,
+      status: detail.deployment.status,
+      url: detail.deployment.url
+    },
+    [
+      `\u2705 Production now serves ${sourceDeploymentId}`,
+      "",
+      detail.deployment.url ?? ""
+    ]
+  );
+}
+async function runPromote(context) {
+  const [deploymentId] = context.positionalOrThrow(
+    1,
+    "Usage: naro promote <deployment-id>"
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.get(projectId);
+  await confirmOrAbort(
+    context,
+    `Promote ${String(deploymentId)} to production (${project.subdomain})?`
+  );
+  await promoteAndWait(
+    context,
+    client,
+    project,
+    deploymentId,
+    "promote"
+  );
+}
+async function runRollback(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.get(projectId);
+  let target = context.positionals[0];
+  if (!target) {
+    const { current, target: candidate } = await client.deployments.rollbackTarget(projectId, project.defaultBranch);
+    if (!candidate)
+      throw new NaroError(
+        "DEPLOYMENT_NOT_FOUND",
+        "No earlier production build with a different artifact to roll back to. Pass a deployment id explicitly."
+      );
+    context.output.log(
+      `\u25B8 current production: ${current.id}${current.gitCommitSha ? ` (${current.gitCommitSha.slice(0, 7)})` : ""}`
+    );
+    target = candidate.id;
+  }
+  await confirmOrAbort(
+    context,
+    `Are you sure you want to rollback production to ${target}?`
+  );
+  await promoteAndWait(context, client, project, target, "rollback");
+}
+
+// src/router.ts
+var HELP = `naro \u2014 deploy Next.js apps to Naro (https://naro.sh)
+
+Usage:
+  naro login | logout | whoami
+  naro token                         Print an access token for CI (NARO_TOKEN)
+
+  naro link | init                   Link this directory to a Naro project
+  naro unlink                        Remove the link (.naro/)
+  naro projects [--team <slug>]      List projects
+  naro project inspect               Show the linked project
+
+  naro deploy [--prod]               Build locally and deploy (preview by default)
+  naro deployments                   List deployments of the linked project
+  naro inspect <deployment-id>       Show one deployment + build logs
+
+  naro logs [deployment-id]          Runtime logs (or build logs of a deployment)
+       [--type build|runtime] [--env production|preview] [--level error] [--follow]
+
+  naro env list                      List env vars (secrets masked)
+  naro env add KEY [environment]     Add/update (value from prompt or stdin)
+  naro env remove KEY [environment]  Remove
+  naro env pull [file]               Write env vars to .env.local
+
+  naro domains list | add <host> | remove <host>
+
+  naro promote <deployment-id>       Publish a build to production
+  naro rollback [deployment-id]      Roll production back to the previous build
+
+Global options:
+  --json          Machine-readable output (single JSON object on stdout)
+  --yes, -y       Never prompt; assume yes (CI / agents)
+  --token <t>     Access token (or set NARO_TOKEN)
+  --project <id>  Target project (overrides .naro/project.json)
+  --team <slug>   Team scope for project listing/linking
+  --cwd <dir>     Run as if started in <dir>
+  --prod          Deploy/target production
+  --debug         Verbose diagnostics
+
+Credentials: \`naro login\` opens a browser (GitHub). CI: NARO_TOKEN=$(naro token).
+Set NARO_CONTROL_PLANE_URL to use a custom control plane (default https://naro.sh).
+`;
+function route(parsed) {
+  const { command, positionals } = parsed;
+  const sub = positionals[0];
+  switch (command) {
+    case "login":
+      return { handler: runLogin, positionals };
+    case "logout":
+      return { handler: runLogout, positionals };
+    case "whoami":
+      return { handler: runWhoami, positionals };
+    case "token":
+      return { handler: runToken, positionals };
+    case "link":
+    case "init":
+      return { handler: runLink, positionals };
+    case "unlink":
+      return { handler: runUnlink, positionals };
+    case "projects":
+      return { handler: runProjects, positionals };
+    case "project":
+      if (sub === void 0 || sub === "inspect")
+        return {
+          handler: runProjectInspect,
+          positionals: positionals.slice(1)
+        };
+      return null;
+    case "deploy":
+      return { handler: runDeploy, positionals };
+    case "deployments":
+    case "ls":
+      return { handler: runDeployments, positionals };
+    case "inspect":
+      return { handler: runInspect, positionals };
+    case "logs":
+      return { handler: runLogs, positionals };
+    case "env":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return { handler: runEnvList, positionals: positionals.slice(1) };
+        case "add":
+          return { handler: runEnvAdd, positionals: positionals.slice(1) };
+        case "remove":
+        case "rm":
+          return { handler: runEnvRemove, positionals: positionals.slice(1) };
+        case "pull":
+          return { handler: runEnvPull, positionals: positionals.slice(1) };
+        default:
+          return null;
+      }
+    case "domains":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return { handler: runDomainsList, positionals: positionals.slice(1) };
+        case "add":
+          return { handler: runDomainsAdd, positionals: positionals.slice(1) };
+        case "remove":
+        case "rm":
+          return {
+            handler: runDomainsRemove,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
+    case "promote":
+      return { handler: runPromote, positionals };
+    case "rollback":
+      return { handler: runRollback, positionals };
+    default:
+      return null;
+  }
+}
+function version() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(
+        join2(dirname(fileURLToPath(import.meta.url)), "..", "package.json"),
+        "utf8"
+      )
+    );
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/index.ts
+async function main(argv = process.argv.slice(2)) {
+  const parsed = parseArgs(argv);
+  if (parsed.flags.version) {
+    process.stdout.write(`${version()}
+`);
+    return;
+  }
+  if (!parsed.command || parsed.command === "help" || parsed.flags.help) {
+    if (parsed.flags.json) {
+      process.stdout.write(
+        `${JSON.stringify({ success: true, help: HELP }, null, 2)}
+`
+      );
+      return;
+    }
+    process.stdout.write(HELP);
+    if (parsed.command === void 0 && !parsed.flags.help && argv.length > 0)
+      process.exitCode = 1;
+    return;
+  }
+  const output = new Output(parsed.flags.json, parsed.flags.debug);
+  if (parsed.unknown.length > 0) {
+    output.fail(
+      new NaroError(
+        "VALIDATION_FAILED",
+        `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`
+      )
+    );
+    return;
+  }
+  const routed = route(parsed);
+  if (!routed) {
+    output.fail(
+      new NaroError(
+        "VALIDATION_FAILED",
+        `Unknown command: ${[parsed.command, ...parsed.positionals].join(" ")}. See \`naro help\`.`
+      )
+    );
+    return;
+  }
+  const context = createContext(parsed.flags, routed.positionals);
+  try {
+    await routed.handler(context);
+  } catch (error) {
+    context.output.fail(error);
+  }
+}
+void main();
 export {
-  parseFlags
+  main
 };