naro-cli 0.6.1 → 0.8.0

package/dist/index.js

@@ -1,18 +1,25 @@
 #!/usr/bin/env node
 import {
+  BOOKMARK_FORMAT_MESSAGE,
   NaroClient,
   NaroError,
+  RESTORE_OUTCOME_UNKNOWN_CODES,
   clearSession,
+  compareMigrations,
   controlPlaneUrl,
   createAuthClient,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
+  generateTypes,
+  isBookmark,
   isExpired,
   isNaroError,
   isTerminalStatus,
+  listMigrationFiles,
   loadStoredSession,
   login,
+  nextMigrationFileName,
   openBrowser,
   parseGitHubRemote,
   projectPath,
@@ -20,13 +27,16 @@ import {
   readProjectLink,
   refreshStoredSession,
   removeProjectLink,
+  renderRows,
   resolveAuth,
+  resolveMigrationsDir,
   saveSession,
   serializeDotenv,
   slugify,
+  summarizeStatement,
   toNaroError,
   writeProjectLink
-} from "./chunk-WKJELBOU.js";
+} from "./chunk-ONALKL7O.js";
 
 // src/args.ts
 var BOOLEAN_FLAGS = {
@@ -42,7 +52,12 @@ var BOOLEAN_FLAGS = {
   "--production": "prod",
   "--follow": "follow",
   "-f": "follow",
-  "--reveal": "reveal"
+  "--reveal": "reveal",
+  "--wait": "wait",
+  "--no-www": "noWww",
+  "--dry-run": "dryRun",
+  "--schema-only": "schemaOnly",
+  "--data-only": "dataOnly"
 };
 var STRING_FLAGS = {
   "--token": "token",
@@ -54,8 +69,18 @@ var STRING_FLAGS = {
   "--branch": "branch",
   "--type": "type",
   "--env": "env",
-  "--level": "level"
+  "--level": "level",
+  "--file": "file",
+  "--output": "output",
+  "--dir": "dir",
+  "--table": "table",
+  "--timestamp": "timestamp",
+  "--bookmark": "bookmark"
 };
+function listFlag(value) {
+  if (value === void 0) return [];
+  return value.split(",").map((piece) => piece.trim()).filter((piece) => piece.length > 0);
+}
 function parseArgs(argv) {
   const flags = {
     json: false,
@@ -65,7 +90,9 @@ function parseArgs(argv) {
     version: false,
     prod: false,
     follow: false,
-    reveal: false
+    reveal: false,
+    wait: false,
+    noWww: false
   };
   const positionals = [];
   const unknown = [];
@@ -122,6 +149,14 @@ var Output = class {
     if (this.json) this.streams.stderr(`${message}
 `);
     else this.streams.stdout(`${message}
+`);
+  }
+  /**
+   * A warning that must never land in stdout, in either mode - for commands
+   * whose stdout is the deliverable itself (`naro gen types > db.d.ts`).
+   */
+  warn(message) {
+    this.streams.stderr(`${message}
 `);
   }
   /** Extra diagnostics, only with --debug. */
@@ -197,7 +232,7 @@ var TtyPrompter = class {
     });
     try {
       return await new Promise(
-        (resolve) => rl.question(question, resolve)
+        (resolve4) => rl.question(question, resolve4)
       );
     } finally {
       rl.close();
@@ -218,7 +253,7 @@ var TtyPrompter = class {
     });
     try {
       const answer = new Promise(
-        (resolve) => rl.question(question, resolve)
+        (resolve4) => rl.question(question, resolve4)
       );
       muted = true;
       const value = await answer;
@@ -329,8 +364,8 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync } from "fs";
-import { dirname, join as join2 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/commands/auth.ts
@@ -414,11 +449,603 @@ async function runToken(context) {
   );
 }
 
-// src/commands/git.ts
+// src/commands/confirm.ts
+async function confirmOrAbort(context, question) {
+  if (context.flags.yes) return;
+  if (context.flags.json || !isInteractive()) {
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `${question} Re-run with --yes to confirm.`
+    );
+  }
+  const confirmed = await context.prompter.confirm(question);
+  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+}
+
+// src/commands/cancel.ts
+async function runCancel(context) {
+  const [deploymentId] = context.positionalOrThrow(
+    1,
+    "Usage: naro cancel <deployment-id>"
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(context, `Cancel the build ${String(deploymentId)}?`);
+  const canceled = await client.deployments.cancel(
+    projectId,
+    deploymentId
+  );
+  context.output.result(
+    {
+      deploymentId: canceled.id,
+      projectId,
+      status: canceled.status,
+      errorCode: canceled.errorCode
+    },
+    [`\u2705 Canceled ${canceled.id}`]
+  );
+}
+
+// src/commands/db.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
+var processStdin = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+var USAGE = "Usage: naro db query <sql> | --file <path> | (stdin)";
+var ROW_CAP_NOTICE = "\u26A0 Output was cut at 10,000 rows. Add a LIMIT to see the rest.";
+function humanSize(bytes) {
+  const units = ["B", "KB", "MB", "GB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${unit === 0 ? String(value) : value.toFixed(1)} ${units[unit] ?? "B"}`;
+}
+function describeLines(info) {
+  const lines = [
+    `Provider: ${info.provider}`,
+    `Status:   ${info.status}`,
+    `Binding:  env.${info.binding}`
+  ];
+  if (info.resourceName)
+    lines.push(
+      `Database: ${info.resourceName}${info.resourceId ? ` (${info.resourceId})` : ""}`
+    );
+  if (info.cloudflare) {
+    const size = info.cloudflare.fileSize === null ? "?" : humanSize(info.cloudflare.fileSize);
+    const tables = info.cloudflare.numTables === null ? "?" : String(info.cloudflare.numTables);
+    lines.push(`Size:     ${size} \xB7 Tables: ${tables}`);
+  }
+  const { limits } = info;
+  lines.push(
+    `Limits:   ${humanSize(limits.maxSizeBytes)} per database \xB7 ${humanSize(limits.maxStatementBytes)} per statement \xB7 ${String(limits.maxParams)} params \xB7 ${String(limits.maxStatements)} statements per request \xB7 ${String(limits.maxQuerySeconds)} s per query`
+  );
+  if (info.provider === "none")
+    lines.push("Run `naro db enable` to create the database.");
+  return lines;
+}
+async function runDbInfo(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const database = await client.db.info(projectId);
+  context.output.result({ projectId, database }, describeLines(database));
+}
+async function runDbEnable(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const database = await client.db.enable(projectId);
+  context.output.result({ projectId, database }, [
+    `\u2705 Database enabled \u2014 ${database.resourceName ?? "(pending)"} (${database.status})`,
+    ...describeLines(database)
+  ]);
+}
+async function readSql(context, deps) {
+  const positional = context.positionals[0];
+  let sql;
+  if (positional !== void 0) {
+    sql = positional;
+  } else if (context.flags.file !== void 0) {
+    try {
+      sql = readFileSync(resolve(context.cwd, context.flags.file), "utf8");
+    } catch {
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `Could not read ${context.flags.file}.`
+      );
+    }
+  } else if (!deps.stdinIsTty()) {
+    sql = await deps.readStdin();
+  }
+  if (sql === void 0 || sql.trim().length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE);
+  return sql;
+}
+async function runDbQuery(context, deps = processStdin) {
+  const sql = await readSql(context, deps);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const result = await client.db.query(projectId, { sql });
+  const lines = [];
+  result.statements.forEach((statement, index) => {
+    if (index > 0) lines.push("");
+    lines.push(...renderRows(statement), summarizeStatement(statement));
+  });
+  if (result.truncated) lines.push(ROW_CAP_NOTICE);
+  context.output.result({ projectId, result }, lines);
+}
+
+// src/commands/db-backup.ts
+import {
+  createWriteStream,
+  mkdirSync as mkdirSync2,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { basename, dirname, join as join2, resolve as resolve2 } from "path";
+import { Transform } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/commands/migration.ts
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join, relative } from "path";
+var processStdin2 = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+function migrationsDir(context) {
+  return resolveMigrationsDir({
+    baseDir: context.cwd,
+    rootDirectory: context.flags.root,
+    dir: context.flags.dir
+  });
+}
+function relativeToCwd(context, path) {
+  const rel = relative(context.cwd, path);
+  return rel === "" ? "." : rel;
+}
+async function appliedMigrations(client, projectId) {
+  try {
+    return await client.db.migrations(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "DATABASE_NOT_READY") return [];
+    throw error;
+  }
+}
+function printable(text) {
+  let out = "";
+  for (const char of text) {
+    const code = char.charCodeAt(0);
+    const control = code < 32 || code >= 127 && code <= 159;
+    out += control ? "?" : char;
+  }
+  return out;
+}
+function warningLine(warning) {
+  if (warning === "out-of-order")
+    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
+  if (warning === "ledger-name-missing-extension")
+    return "  \u26A0 recorded without .sql in the ledger";
+  return null;
+}
+async function runMigrationNew(context, deps = processStdin2) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration new <name>"
+  );
+  const dir = migrationsDir(context);
+  const fileName = nextMigrationFileName(
+    listMigrationFiles(dir),
+    name
+  );
+  mkdirSync(dir, { recursive: true });
+  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
+  const fromStdin = piped.length > 0;
+  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
+` : `-- Migration: ${fileName}
+`;
+  const path = join(dir, fileName);
+  writeFileSync(path, body, { flag: "wx" });
+  const relPath = relativeToCwd(context, path);
+  context.output.result({ file: fileName, path: relPath, fromStdin }, [
+    `\u2705 Created ${relPath}`
+  ]);
+}
+async function runMigrationList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const migrations = compareMigrations(local, ledger);
+  const relDir = relativeToCwd(context, dir);
+  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
+    `Migrations in ${relDir} (${String(migrations.length)}):`,
+    ...migrations.flatMap((row) => {
+      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
+      const warning = warningLine(row.warning);
+      return warning ? [line, warning] : [line];
+    })
+  ];
+  context.output.result({ projectId, dir: relDir, migrations }, lines);
+}
+async function runMigrationUp(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
+  if (pending.length === 0) {
+    context.output.result({ projectId, applied: [], pending: [] }, [
+      "No pending migrations."
+    ]);
+    return;
+  }
+  if (context.flags.dryRun) {
+    context.output.result({ projectId, dryRun: true, pending }, [
+      `Pending migrations (${String(pending.length)}):`,
+      ...pending.map((name) => `  ${printable(name)}`)
+    ]);
+    return;
+  }
+  context.output.log(`Pending migrations (${String(pending.length)}):`);
+  for (const name of pending) context.output.log(`  ${printable(name)}`);
+  await confirmOrAbort(
+    context,
+    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
+  );
+  const applied = [];
+  for (const name of pending) {
+    const sql = readFileSync2(join(dir, name), "utf8");
+    try {
+      await client.db.applyMigration(projectId, { name, sql });
+    } catch (error) {
+      if (!isNaroError(error)) throw error;
+      const shown = context.output.json ? name : printable(name);
+      throw new NaroError(error.code, `${shown}: ${error.message}`, {
+        ...error.status === void 0 ? {} : { status: error.status },
+        details: { ...error.details, migration: name, applied },
+        cause: error
+      });
+    }
+    context.output.log(`\u2713 ${printable(name)}`);
+    applied.push(name);
+  }
+  context.output.result({ projectId, applied, pending: [] }, [
+    `\u2705 Applied ${String(applied.length)} migration(s).`
+  ]);
+}
+
+// src/commands/db-backup.ts
 var defaults = {
+  fetch: (input, init) => fetch(input, init),
+  stdout: process.stdout,
+  sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
+  writeFile: (path, data) => {
+    mkdirSync2(dirname(path), { recursive: true });
+    writeFileSync2(path, data, { flag: "wx" });
+  }
+};
+var EXPORT_NOTICE = "Exporting the project database. Cloudflare holds other queries to this database until the export finishes.";
+function reasonOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function withoutUrl(text, url) {
+  return text.split(url).join("the signed URL").replace(/\S*X-Amz-Signature=\S*/gi, "the signed URL");
+}
+function downloadFailed(url, reason, original) {
+  const scrubbed = withoutUrl(reason, url);
+  let cause;
+  if (original !== void 0) {
+    cause = new Error(scrubbed);
+    if (original instanceof Error) {
+      cause.name = original.name;
+      if (original.stack !== void 0)
+        cause.stack = withoutUrl(original.stack, url);
+    }
+  }
+  return new NaroError(
+    "DATABASE_UNAVAILABLE",
+    `Could not download the dump (${scrubbed}). Run naro db dump again.`,
+    cause === void 0 ? {} : { cause }
+  );
+}
+function writeFailed(shown, error) {
+  return new NaroError(
+    "INTERNAL_ERROR",
+    `Could not write ${shown}: ${reasonOf(error)}.`,
+    { cause: error }
+  );
+}
+var DownloadStreamError = class extends Error {
+  constructor(original) {
+    super(reasonOf(original));
+    this.original = original;
+    this.name = "DownloadStreamError";
+  }
+};
+async function openDownload(deps, url) {
+  let response;
+  try {
+    response = await deps.fetch(url);
+  } catch (error) {
+    throw downloadFailed(url, reasonOf(error), error);
+  }
+  if (!response.ok || response.body === null) {
+    await response.body?.cancel().catch(() => {
+    });
+    throw downloadFailed(url, `HTTP ${String(response.status)}`);
+  }
+  return response.body;
+}
+async function* chunksOf(body) {
+  const reader = body.getReader();
+  const read = async () => {
+    try {
+      return await reader.read();
+    } catch (error) {
+      throw new DownloadStreamError(error);
+    }
+  };
+  try {
+    for (; ; ) {
+      const next = await read();
+      if (next.done) return;
+      yield next.value;
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+}
+async function streamInto(body, destination, end) {
+  let bytes = 0;
+  const counter = new Transform({
+    transform(chunk, _encoding, done) {
+      bytes += chunk.length;
+      done(null, chunk);
+    }
+  });
+  await pipeline(chunksOf(body), counter, destination, { end });
+  return bytes;
+}
+function streamFailed(error, url, shown) {
+  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original) : writeFailed(shown, error);
+}
+function refuseDirectory(path, shown) {
+  let isDirectory = false;
+  try {
+    isDirectory = statSync(path, { throwIfNoEntry: false })?.isDirectory() ?? false;
+  } catch {
+  }
+  if (isDirectory)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--output ${shown} is a directory. Pass a file path.`
+    );
+}
+function makeOutputDirectory(path, shown) {
+  try {
+    mkdirSync2(dirname(path), { recursive: true });
+  } catch (error) {
+    throw writeFailed(shown, error);
+  }
+}
+async function downloadToFile(deps, url, path, shown) {
+  const body = await openDownload(deps, url);
+  const partial = join2(
+    dirname(path),
+    `.${basename(path)}.${String(process.pid)}.part`
+  );
+  try {
+    const bytes = await streamInto(body, createWriteStream(partial), true);
+    renameSync(partial, path);
+    return bytes;
+  } catch (error) {
+    try {
+      rmSync(partial, { force: true });
+    } catch {
+    }
+    throw streamFailed(error, url, shown);
+  }
+}
+async function downloadToStdout(deps, url) {
+  const body = await openDownload(deps, url);
+  try {
+    return await streamInto(body, deps.stdout, false);
+  } catch (error) {
+    throw streamFailed(error, url, "stdout");
+  }
+}
+async function runDbDump(context, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  const { flags } = context;
+  if (flags.schemaOnly && flags.dataOnly)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --schema-only or --data-only, not both."
+    );
+  if (flags.json && flags.output === void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--json needs --output: the dump and the JSON result would share stdout."
+    );
+  const tables = listFlag(flags.table);
+  if (flags.table !== void 0 && tables.length === 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--table needs at least one table name."
+    );
+  const options = {
+    ...flags.schemaOnly ? { schemaOnly: true } : {},
+    ...flags.dataOnly ? { dataOnly: true } : {},
+    ...tables.length > 0 ? { tables } : {}
+  };
+  const output = flags.output === void 0 ? null : { path: resolve2(context.cwd, flags.output), shown: flags.output };
+  if (output) refuseDirectory(output.path, output.shown);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (output) makeOutputDirectory(output.path, output.shown);
+  context.output.warn(EXPORT_NOTICE);
+  const step = await client.db.export(projectId, options, {
+    sleep: deps.sleep
+  });
+  const file = step.file;
+  if (file === null)
+    throw new NaroError(
+      "DATABASE_UNAVAILABLE",
+      "Could not download the dump (Cloudflare finished the export without a file). Run naro db dump again."
+    );
+  const bytes = output === null ? await downloadToStdout(deps, file.url) : await downloadToFile(deps, file.url, output.path, output.shown);
+  const bookmark = step.atBookmark;
+  if (!context.output.json) {
+    context.output.warn(
+      `\u2713 Wrote ${flags.output ?? "stdout"} (${humanSize(bytes)}) at bookmark ${bookmark}.`
+    );
+    context.output.warn(
+      `  naro db restore --bookmark ${bookmark} returns the database to this point.`
+    );
+  }
+  context.output.result({ output: flags.output, bytes, atBookmark: bookmark });
+}
+async function bookmarkNow(context, client, projectId) {
+  try {
+    const { bookmark } = await client.db.bookmark(projectId);
+    return isBookmark(bookmark) ? bookmark : null;
+  } catch (error) {
+    context.output.debugLog(
+      `Could not read the current bookmark before restoring: ${reasonOf(error)}`
+    );
+    return null;
+  }
+}
+function withWayBack(context, error, before) {
+  if (before === null || !isNaroError(error) || !RESTORE_OUTCOME_UNKNOWN_CODES.has(error.code))
+    return error;
+  if (!context.output.json)
+    context.output.warn(
+      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before} undoes it.`
+    );
+  return new NaroError(error.code, error.message, {
+    ...error.status === void 0 ? {} : { status: error.status },
+    details: { ...error.details, previousBookmark: before },
+    cause: error
+  });
+}
+async function runDbRestore(context) {
+  const { bookmark, timestamp } = context.flags;
+  const given = bookmark !== void 0 && timestamp === void 0 ? { bookmark } : timestamp !== void 0 && bookmark === void 0 ? { timestamp } : null;
+  if (given === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --timestamp <time> or --bookmark <id> (exactly one)."
+    );
+  if ("bookmark" in given && !isBookmark(given.bookmark))
+    throw new NaroError("VALIDATION_FAILED", BOOKMARK_FORMAT_MESSAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  let target;
+  let at = null;
+  if ("bookmark" in given) {
+    target = given.bookmark;
+  } else {
+    const resolved = await client.db.bookmark(projectId, {
+      timestamp: given.timestamp
+    });
+    target = resolved.bookmark;
+    at = resolved.timestamp ?? given.timestamp;
+  }
+  const label = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
+  if (context.flags.dryRun) {
+    context.output.result(
+      {
+        dryRun: true,
+        bookmark: target,
+        ...at === null ? {} : { timestamp: at }
+      },
+      [`Would restore to ${label}. Nothing was changed.`]
+    );
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    `Restore the project database to ${label}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+  );
+  const before = await bookmarkNow(context, client, projectId);
+  let restored;
+  try {
+    restored = await client.db.restore(projectId, { bookmark: target });
+  } catch (error) {
+    throw withWayBack(context, error, before);
+  }
+  context.output.result(
+    {
+      bookmark: restored.bookmark,
+      previousBookmark: restored.previousBookmark
+    },
+    [
+      `\u2713 Restored the project database to bookmark ${restored.bookmark}.`,
+      `  To undo: naro db restore --bookmark ${restored.previousBookmark}`
+    ]
+  );
+}
+async function runDbPull(context, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  const dir = migrationsDir(context);
+  const existing = listMigrationFiles(dir);
+  if (existing.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${relativeToCwd(context, dir)} already has ${String(existing.length)} migration file(s). naro db pull only baselines a project without migrations; to see the current schema, run naro db dump --schema-only.`
+    );
+  const name = nextMigrationFileName(existing, "remote_schema");
+  const path = join2(dir, name);
+  const shown = relativeToCwd(context, path);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    `Write ${shown} with the database's current schema and record it as already applied?`
+  );
+  const pulled = await client.db.pull(projectId, { name });
+  try {
+    deps.writeFile(path, `${pulled.sql}
+`);
+  } catch (error) {
+    if (!context.output.json) context.output.log(pulled.sql);
+    throw new NaroError(
+      "INTERNAL_ERROR",
+      `Recorded ${pulled.name} as applied but could not write ${shown}: ${reasonOf(error)}. The SQL is on stdout \u2014 save it as that file.`,
+      {
+        details: { migration: pulled.name, path: shown, sql: pulled.sql },
+        cause: error
+      }
+    );
+  }
+  context.output.result(
+    {
+      projectId,
+      name: pulled.name,
+      path: shown,
+      statements: pulled.statements
+    },
+    [
+      `\u2713 Wrote ${shown} (${String(pulled.statements)} ${pulled.statements === 1 ? "statement" : "statements"}) and recorded it as applied.`
+    ]
+  );
+}
+
+// src/commands/git.ts
+var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+  sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -437,7 +1064,7 @@ function connected(context, project) {
   );
 }
 async function runGitConnect(context, overrides = {}) {
-  const deps = { ...defaults, ...overrides };
+  const deps = { ...defaults2, ...overrides };
   const { output } = context;
   const explicit = context.positionals[0];
   let fullName;
@@ -524,7 +1151,7 @@ async function runGitDisconnect(context) {
   ]);
 }
 async function offerAutoDeploy(context, projectId, overrides) {
-  const deps = { ...defaults, ...overrides };
+  const deps = { ...defaults2, ...overrides };
   if (overrides.canPrompt === false) return;
   try {
     if (readProjectLink(context.cwd)?.autoDeployDeclined === true) return;
@@ -904,32 +1531,89 @@ async function runInspect(context) {
   ]);
 }
 
-// src/commands/confirm.ts
-async function confirmOrAbort(context, question) {
-  if (context.flags.yes) return;
-  if (context.flags.json || !isInteractive()) {
-    throw new NaroError(
-      "CONFIRMATION_REQUIRED",
-      `${question} Re-run with --yes to confirm.`
+// src/commands/domains.ts
+var defaults3 = {
+  sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms)),
+  now: () => Date.now()
+};
+var FIRST_DELAY_MS = 5e3;
+var MAX_DELAY_MS = 3e4;
+var WAIT_TIMEOUT_MS = 10 * 6e4;
+function isReady(domain) {
+  return domain.ready ?? (domain.status === "active" && domain.sslStatus === "active");
+}
+function isTerminal(domain) {
+  return domain.ownership === "deleted" || domain.status === "blocked" || domain.status === "moved" || domain.status === "deleted";
+}
+var AXIS_DONE = /* @__PURE__ */ new Set(["verified", "active", "live"]);
+var AXIS_FAILED = /* @__PURE__ */ new Set(["failed", "deleted"]);
+function axisMark(value) {
+  if (AXIS_DONE.has(value)) return "\u2713";
+  if (AXIS_FAILED.has(value)) return "\u2717";
+  return "\xB7";
+}
+function axisLines(domain) {
+  const axes = [
+    ["ownership", domain.ownership],
+    ["certificate", domain.certificate],
+    ["routing", domain.routing]
+  ];
+  return axes.filter((axis) => axis[1] !== void 0).map(
+    ([name, value]) => `    ${`${name}:`.padEnd(13)}${axisMark(value)} ${value}`
+  );
+}
+function axisSummary(domain) {
+  const axes = [
+    domain.ownership,
+    domain.certificate,
+    domain.routing
+  ].filter((value) => value !== void 0);
+  return axes.length > 0 ? axes.join(" \xB7 ") : `${domain.status} \xB7 ssl ${domain.sslStatus}`;
+}
+function recordLines(domain) {
+  const instructions = domain.instructions ?? [];
+  if (instructions.length > 0) {
+    const lines2 = ["    Required DNS records:"];
+    for (const instruction of instructions) {
+      lines2.push(
+        `      ${instruction.type.padEnd(5)} ${instruction.name}`,
+        `        host: ${instruction.host.padEnd(24)} value: ${instruction.value}`
+      );
+      if (instruction.note) lines2.push(`        note: ${instruction.note}`);
+    }
+    return lines2;
+  }
+  if (domain.verification.length === 0) return [];
+  const lines = ["    Required DNS records:"];
+  for (const record of domain.verification) {
+    lines.push(
+      `      Type: ${record.type.toUpperCase().padEnd(6)} Name: ${record.name}`,
+      `      Value: ${record.value}`
     );
   }
-  const confirmed = await context.prompter.confirm(question);
-  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  return lines;
 }
-
-// src/commands/domains.ts
 function domainLines(domain) {
   const lines = [
-    `  ${domain.hostname.padEnd(36)} ${domain.status.padEnd(12)} ssl: ${domain.sslStatus}`
+    `  ${domain.hostname.padEnd(36)} ${domain.status.padEnd(12)} ssl: ${domain.sslStatus}`,
+    ...axisLines(domain)
   ];
-  if (domain.status !== "active" && domain.verification.length > 0) {
-    lines.push("    Required DNS records:");
-    for (const record of domain.verification) {
-      lines.push(
-        `      Type: ${record.type.toUpperCase().padEnd(6)} Name: ${record.name}`,
-        `      Value: ${record.value}`
-      );
-    }
+  if (domain.redirectTo) {
+    const status = domain.redirectStatus ?? 308;
+    lines.push(`    redirects to ${domain.redirectTo} (${String(status)})`);
+  }
+  if (domain.cause) {
+    lines.push(`    \u2717 ${domain.cause.message}`);
+    if (domain.cause.fix) lines.push(`    \u2192 ${domain.cause.fix}`);
+  }
+  if (isReady(domain)) return lines;
+  lines.push(...recordLines(domain));
+  const guidance = domain.guidance;
+  if (guidance && guidance.notes.length > 0) {
+    lines.push(
+      guidance.apex ? `    Apex domain (${domain.hostname}):` : "    Note:"
+    );
+    for (const note of guidance.notes) lines.push(`      ${note}`);
   }
   return lines;
 }
@@ -937,28 +1621,141 @@ async function runDomainsList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const domains = await client.domains.list(projectId);
+  const pending = domains.filter((domain) => !isReady(domain));
   context.output.result(
     { projectId, domains },
     domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
       `Domains (${String(domains.length)}):`,
-      ...domains.flatMap(domainLines)
+      ...domains.flatMap(domainLines),
+      // list reads our stored copy; only verify goes and looks again.
+      ...pending.length > 0 ? ["", "Re-check DNS now: naro domains verify"] : []
     ]
   );
 }
 async function runDomainsAdd(context) {
   const [hostname] = context.positionalOrThrow(
     1,
-    "Usage: naro domains add <hostname>"
+    "Usage: naro domains add <hostname> [--no-www]"
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const domain = await client.domains.add(projectId, hostname);
-  context.output.result({ projectId, domain }, [
-    `\u2705 Domain added: ${domain.hostname}`,
-    "",
-    ...domainLines(domain),
+  const withWww = context.flags.noWww !== true;
+  const domain = await client.domains.add(projectId, hostname, {
+    withWww
+  });
+  const companion = domain.companion;
+  const apex = domain.apex ?? domain.guidance?.apex ?? false;
+  const alternative = domain.guidance?.alternative ?? `www.${domain.hostname}`;
+  context.output.result(
+    { projectId, domain, withWww, ...companion ? { companion } : {} },
+    [
+      `\u2705 Domain added: ${domain.hostname}`,
+      "",
+      ...domainLines(domain),
+      ...companion ? [
+        "",
+        `   Also registered ${companion.hostname} \u2014 an apex domain often cannot hold`,
+        "   the CNAME above, and this form always can.",
+        "",
+        ...domainLines(companion)
+      ] : [],
+      ...!companion && apex && !withWww ? [
+        "",
+        `   --no-www: ${domain.hostname} was registered on its own. If your registrar`,
+        `   refuses the record above, run \`naro domains add ${alternative}\`.`
+      ] : [],
+      "",
+      isReady(domain) ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains verify`."
+    ]
+  );
+}
+async function verifyAll(client, projectId, hostname, auto = false) {
+  if (hostname !== void 0)
+    return [
+      await client.domains.verifyByHostname(projectId, hostname, { auto })
+    ];
+  const listed = await client.domains.list(projectId);
+  const verified = [];
+  for (const domain of listed)
+    verified.push(await client.domains.verify(projectId, domain.id, { auto }));
+  return verified;
+}
+async function runDomainsVerify(context, overrides = {}) {
+  const deps = { ...defaults3, ...overrides };
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const hostname = context.positionals[0];
+  const wait = context.flags.wait === true;
+  const progress = (line) => {
+    if (!context.flags.json) context.output.log(line);
+  };
+  let domains = await verifyAll(client, projectId, hostname);
+  if (domains.length === 0) {
+    context.output.result({ projectId, domains, ready: false }, [
+      "No custom domains. Add one with `naro domains add example.com`."
+    ]);
+    return;
+  }
+  let timedOut = false;
+  let abandoned = false;
+  if (wait && !domains.every(isReady)) {
+    const deadline = deps.now() + WAIT_TIMEOUT_MS;
+    let delay = FIRST_DELAY_MS;
+    for (; ; ) {
+      const pending = domains.filter((domain) => !isReady(domain));
+      if (pending.length > 0 && pending.every(isTerminal)) {
+        abandoned = true;
+        break;
+      }
+      const remaining = deadline - deps.now();
+      if (remaining <= 0) {
+        timedOut = true;
+        break;
+      }
+      for (const domain of pending)
+        progress(
+          isTerminal(domain) ? `\u26A0 ${domain.hostname}: ${axisSummary(domain)} \u2014 waiting cannot fix this one` : `\u25B8 ${domain.hostname}: ${axisSummary(domain)}`
+        );
+      await deps.sleep(Math.min(delay, remaining));
+      delay = Math.min(delay * 2, MAX_DELAY_MS);
+      domains = await verifyAll(client, projectId, hostname, true);
+      if (domains.every(isReady)) break;
+    }
+  }
+  const ready = domains.every(isReady);
+  const body = domains.flatMap(domainLines);
+  if (!ready) {
+    for (const line of body) progress(line);
+    const notReady = domains.filter((domain) => !isReady(domain));
+    const names = notReady.map((domain) => domain.hostname).join(", ");
+    const details = { projectId, domains, ready: false };
+    if (timedOut) {
+      const cause2 = notReady[0]?.cause;
+      throw new NaroError(
+        "TIMEOUT",
+        `${names} did not go live within 10 minutes.${cause2 ? ` ${cause2.message}` : ""} DNS changes can take longer to propagate \u2014 re-run \`naro domains verify\` later.`,
+        { details }
+      );
+    }
+    if (abandoned) {
+      const blocked = domains.find(isTerminal);
+      throw new NaroError(
+        blocked?.cause?.code ?? "DOMAIN_VERIFICATION_FAILED",
+        blocked?.cause?.message ?? `${names} cannot be verified (status: ${blocked?.status ?? "unknown"}). Remove it and add it again.`,
+        { details }
+      );
+    }
+    const cause = notReady[0]?.cause;
+    throw new NaroError(
+      cause?.code ?? "DOMAIN_NOT_READY",
+      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} Add the records above, then run \`naro domains verify --wait\`.`,
+      { details }
+    );
+  }
+  context.output.result({ projectId, domains, ready }, [
+    ...body,
     "",
-    domain.status === "active" ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains list` to refresh."
+    domains.length === 1 ? `\u2705 ${domains[0]?.hostname ?? ""} is live.` : "\u2705 Every domain is live."
   ]);
 }
 async function runDomainsRemove(context) {
@@ -979,8 +1776,8 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { existsSync, writeFileSync } from "fs";
-import { join } from "path";
+import { existsSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
 var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseTarget(value) {
@@ -1083,12 +1880,12 @@ async function runEnvPull(context) {
   const vars = Object.fromEntries(
     selected.map((row) => [row.key, row.value ?? ""])
   );
-  const path = join(context.cwd, file);
+  const path = join3(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
-  writeFileSync(
+  writeFileSync3(
     path,
     `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
 ${serializeDotenv(vars)}`,
@@ -1100,10 +1897,48 @@ ${serializeDotenv(vars)}`,
   );
 }
 
+// src/commands/gen.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+async function runGenTypes(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const tables = await client.db.tables(projectId);
+  const types = generateTypes(tables);
+  const undescribed = tables.flatMap(
+    (table) => table.error === void 0 ? [] : [{ name: table.name, error: table.error }]
+  );
+  for (const { name, error } of undescribed)
+    context.output.warn(
+      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
+    );
+  const extra = undescribed.length > 0 ? { undescribed } : {};
+  if (context.flags.output) {
+    const path = resolve3(context.cwd, context.flags.output);
+    mkdirSync3(dirname2(path), { recursive: true });
+    writeFileSync4(path, types);
+    context.output.result(
+      {
+        projectId,
+        output: context.flags.output,
+        tables: tables.length,
+        ...extra
+      },
+      [
+        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
+      ]
+    );
+    return;
+  }
+  context.output.result({ projectId, types, ...extra }, [
+    types.replace(/\n$/, "")
+  ]);
+}
+
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -1367,6 +2202,7 @@ Usage:
        [--root <dir>] [--name <name>]  --root points at the app in a monorepo
   naro deployments                   List deployments of the linked project
   naro inspect <deployment-id>       Show one deployment + build logs
+  naro cancel <deployment-id>        Stop a build that is still running
 
   naro git connect [owner/repo]      Deploy on every push (defaults to your origin remote)
   naro git disconnect                Stop deploying on push
@@ -1379,7 +2215,27 @@ Usage:
   naro env remove KEY [environment]  Remove
   naro env pull [file]               Write env vars to .env.local
 
-  naro domains list | add <host> | remove <host>
+  naro domains list | add <host> [--no-www] | remove <host>
+       add example.com also connects www.example.com and redirects the apex to
+       it, because most registrars cannot put a CNAME on an apex; --no-www
+       registers the apex alone
+  naro domains verify [host] [--wait]  Re-check DNS and print what is missing
+       exits non-zero while a domain is not live yet
+
+  naro db enable                     Create the project's database (Cloudflare D1)
+  naro db info                       Database status, size, table count and limits
+  naro db query <sql> | --file <f>   Run SQL against it (reads stdin when piped)
+  naro db push [--dry-run]           Apply pending migrations from ./migrations (asks first; --yes to skip)
+  naro db dump [--output <f>]        Download a SQL dump of the database (stdout by default)
+       [--schema-only|--data-only] [--table a,b]  Cloudflare holds other queries until it finishes
+  naro db restore --bookmark <id>    Roll the database back (Time Travel, last 30 days; asks first)
+       | --timestamp <time> [--dry-run]  prints the command that undoes it
+  naro db pull [--dir <d>]           Write the remote schema as migrations/0001_remote_schema.sql
+                                     and record it as applied - a baseline (asks first)
+  naro migration new <name>          Create migrations/NNNN_<name>.sql (stdin becomes the body when piped)
+  naro migration list                Local vs applied migrations
+  naro migration up [--dry-run]      Same as db push
+  naro gen types [--output <file>]   TypeScript types for the schema (stdout by default; TypeScript only)
 
   naro promote <deployment-id>       Publish a build to production
   naro rollback [deployment-id]      Roll production back to the previous build
@@ -1394,6 +2250,17 @@ Global options:
   --team <slug>   Team scope for project listing/linking
   --cwd <dir>     Run as if started in <dir>
   --prod          Deploy/target production
+  --wait          Poll until the domain goes live (naro domains verify)
+  --no-www        Register the apex alone (naro domains add)
+  --file <path>   SQL file to run (naro db query)
+  --dry-run       Show what would change without changing it (naro db push, db restore)
+  --output <file> Write to a file instead of stdout (naro gen types, db dump)
+  --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations)
+  --schema-only   Dump the schema without rows (naro db dump)
+  --data-only     Dump rows without the schema (naro db dump)
+  --table <a,b>   Dump only these tables, comma-separated (naro db dump)
+  --bookmark <id> Restore point: a bookmark from db dump or db restore (naro db restore)
+  --timestamp <time>  Restore point: RFC 3339 with a timezone, or Unix seconds (naro db restore)
   --debug         Verbose diagnostics
 
 Credentials: \`naro login\` opens a browser (GitHub). CI: NARO_TOKEN=$(naro token).
@@ -1432,6 +2299,8 @@ function route(parsed) {
       return { handler: runDeployments, positionals };
     case "inspect":
       return { handler: runInspect, positionals };
+    case "cancel":
+      return { handler: runCancel, positionals };
     case "logs":
       return { handler: runLogs, positionals };
     case "env":
@@ -1464,9 +2333,56 @@ function route(parsed) {
             handler: runDomainsRemove,
             positionals: positionals.slice(1)
           };
+        case "verify":
+        case "check":
+          return {
+            handler: runDomainsVerify,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
+    case "db":
+      switch (sub) {
+        case void 0:
+        case "info":
+          return { handler: runDbInfo, positionals: positionals.slice(1) };
+        case "enable":
+          return { handler: runDbEnable, positionals: positionals.slice(1) };
+        case "query":
+          return { handler: runDbQuery, positionals: positionals.slice(1) };
+        case "push":
+          return { handler: runMigrationUp, positionals: positionals.slice(1) };
+        case "dump":
+          return { handler: runDbDump, positionals: positionals.slice(1) };
+        case "restore":
+          return { handler: runDbRestore, positionals: positionals.slice(1) };
+        case "pull":
+          return { handler: runDbPull, positionals: positionals.slice(1) };
+        default:
+          return null;
+      }
+    case "migration":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return {
+            handler: runMigrationList,
+            positionals: positionals.slice(1)
+          };
+        case "new":
+          return {
+            handler: runMigrationNew,
+            positionals: positionals.slice(1)
+          };
+        case "up":
+          return { handler: runMigrationUp, positionals: positionals.slice(1) };
         default:
           return null;
       }
+    case "gen":
+      return sub === "types" ? { handler: runGenTypes, positionals: positionals.slice(1) } : null;
     case "promote":
       return { handler: runPromote, positionals };
     case "rollback":
@@ -1487,8 +2403,8 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync(
-        join2(dirname(fileURLToPath(import.meta.url)), "..", "package.json"),
+      readFileSync3(
+        join4(dirname3(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );