naro-mcp 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,95 +1,1299 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// ../../packages/sdk/src/auth.ts
+import { homedir as homedir2 } from "os";
+
+// ../../packages/sdk/src/errors.ts
+var NaroError = class extends Error {
+  code;
+  /** HTTP status of the control plane response, when one was received. */
+  status;
+  /** Extra structured context (validation fields, deployment id...). */
+  details;
+  constructor(code, message, options) {
+    super(
+      message,
+      options?.cause !== void 0 ? { cause: options.cause } : {}
+    );
+    this.name = "NaroError";
+    this.code = code;
+    if (options?.status !== void 0) this.status = options.status;
+    if (options?.details !== void 0) this.details = options.details;
+  }
+};
+function isNaroError(error) {
+  return error instanceof NaroError || error instanceof Error && error.name === "NaroError" && typeof error.code === "string";
+}
+function toNaroError(error, fallbackCode = "INTERNAL_ERROR") {
+  if (error instanceof NaroError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  return new NaroError(fallbackCode, message, { cause: error });
+}
+async function errorFromResponse(response, context) {
+  let body = null;
+  try {
+    body = await response.json();
+  } catch {
+    body = null;
+  }
+  const serverCode = typeof body?.error?.code === "string" ? body.error.code : null;
+  const serverMessage = typeof body?.error?.message === "string" ? body.error.message : null;
+  const code = serverCode ?? (response.status === 401 ? "UNAUTHORIZED" : response.status === 404 ? "NOT_FOUND" : response.status === 429 ? "RATE_LIMITED" : "INTERNAL_ERROR");
+  const details = {};
+  if (body?.error?.fields !== void 0) details.fields = body.error.fields;
+  return new NaroError(
+    code,
+    serverMessage ?? `${context} failed: the control plane returned ${String(response.status)}.`,
+    {
+      status: response.status,
+      ...Object.keys(details).length > 0 ? { details } : {}
+    }
+  );
+}
+
+// ../../packages/sdk/src/session.ts
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function credentialsDir(home = homedir()) {
+  return join(home, ".naro");
+}
+function credentialsFile(home = homedir()) {
+  return join(credentialsDir(home), "credentials.json");
+}
+function saveSession(session, home = homedir()) {
+  mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
+  writeFileSync(credentialsFile(home), JSON.stringify(session, null, 2), {
+    mode: 384
+  });
+}
+function loadStoredSession(home = homedir()) {
+  try {
+    return JSON.parse(
+      readFileSync(credentialsFile(home), "utf8")
+    );
+  } catch {
+    return null;
+  }
+}
+function isExpired(session, skewSeconds = 60) {
+  return session.expires_at * 1e3 <= Date.now() + skewSeconds * 1e3;
+}
+
+// ../../packages/sdk/src/supabase-auth.ts
+import {
+  createClient
+} from "@supabase/supabase-js";
+
+// ../../packages/sdk/src/config.ts
+var DEFAULT_CONTROL_PLANE_URL = "https://naro.sh";
+var DEFAULT_SUPABASE_URL = "https://bymwzjpqfmwsdhtcpgjg.supabase.co";
+var DEFAULT_SUPABASE_KEY = "sb_publishable_qjM6NZsHnGZ1t6iwuTDwcQ_LQbq4aCX";
+function controlPlaneUrl(env = process.env) {
+  return (env.NARO_CONTROL_PLANE_URL ?? DEFAULT_CONTROL_PLANE_URL).replace(
+    /\/$/,
+    ""
+  );
+}
+
+// ../../packages/sdk/src/callback-server.ts
+import { createServer } from "http";
+var DONE_HTML = "<html><body><p>\u2705 Logged in. You can close this tab and return to the terminal.</p></body></html>";
+var FAIL_HTML = "<html><body><p>Login failed. You can close this tab and return to the terminal.</p></body></html>";
+async function startCallbackServer() {
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (url.pathname !== "/callback") {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    if (error) {
+      res.setHeader("content-type", "text/html");
+      res.end(FAIL_HTML);
+      rejectCode(new Error(`GitHub authorization failed: ${error}`));
+      return;
+    }
+    if (!code) {
+      res.statusCode = 400;
+      res.end("Missing code");
+      return;
+    }
+    res.setHeader("content-type", "text/html");
+    res.end(DONE_HTML);
+    resolveCode(code);
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const port = server.address().port;
+  return {
+    port,
+    waitForCode(timeoutMs) {
+      let timer;
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Timed out waiting for GitHub callback.")),
+          timeoutMs
+        );
+        timer.unref?.();
+      });
+      return Promise.race([codePromise, timeout]).finally(
+        () => clearTimeout(timer)
+      );
+    },
+    close() {
+      server.close();
+    }
+  };
+}
+
+// ../../packages/sdk/src/supabase-auth.ts
+function createAuthClient(env = process.env) {
+  const url = env.NARO_SUPABASE_URL ?? DEFAULT_SUPABASE_URL;
+  const key = env.NARO_SUPABASE_KEY ?? DEFAULT_SUPABASE_KEY;
+  const store = /* @__PURE__ */ new Map();
+  return createClient(url, key, {
+    auth: {
+      flowType: "pkce",
+      persistSession: false,
+      autoRefreshToken: false,
+      detectSessionInUrl: false,
+      storage: {
+        getItem: (k) => store.get(k) ?? null,
+        setItem: (k, v) => {
+          store.set(k, v);
+        },
+        removeItem: (k) => {
+          store.delete(k);
+        }
+      }
+    }
+  });
+}
+function toStoredSession(session) {
+  const meta = session.user.user_metadata ?? {};
+  const github = meta.user_name ?? meta.preferred_username ?? null;
+  return {
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+    expires_at: session.expires_at ?? 0,
+    user: {
+      id: session.user.id,
+      email: session.user.email ?? null,
+      github
+    }
+  };
+}
+async function refreshStoredSession(refreshToken, client = createAuthClient()) {
+  const { data, error } = await client.auth.refreshSession({
+    refresh_token: refreshToken
+  });
+  if (error || !data.session) {
+    throw new Error(
+      `Session refresh failed: ${error?.message ?? "no session"}`
+    );
+  }
+  return toStoredSession(data.session);
+}
+async function login(deps) {
+  const client = deps.client ?? createAuthClient();
+  const server = await startCallbackServer();
+  try {
+    const redirectTo = `http://localhost:${server.port}/callback`;
+    const { data, error } = await client.auth.signInWithOAuth({
+      provider: "github",
+      options: { redirectTo, skipBrowserRedirect: true }
+    });
+    if (error || !data?.url) {
+      throw new Error(
+        `Could not start GitHub login: ${error?.message ?? "no authorize URL"}`
+      );
+    }
+    deps.openBrowser(data.url);
+    const code = await server.waitForCode(deps.timeoutMs ?? 12e4);
+    const { data: exchanged, error: exchangeError } = await client.auth.exchangeCodeForSession(code);
+    if (exchangeError || !exchanged?.session) {
+      throw new Error(
+        `Could not complete login: ${exchangeError?.message ?? "no session"}`
+      );
+    }
+    return toStoredSession(exchanged.session);
+  } finally {
+    server.close();
+  }
+}
+
+// ../../packages/sdk/src/auth.ts
+async function resolveAuth(options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? homedir2();
+  if (options.explicitToken) {
+    const token = options.explicitToken;
+    return { getAccessToken: async () => token, source: "flag" };
+  }
+  if (env.NARO_TOKEN) {
+    const token = env.NARO_TOKEN;
+    return { getAccessToken: async () => token, source: "env" };
+  }
+  const refresh = options.refresh ?? refreshStoredSession;
+  let session = loadStoredSession(home);
+  if (!session || isExpired(session)) {
+    if (session) {
+      try {
+        session = await refresh(session.refresh_token);
+        saveSession(session, home);
+      } catch {
+        session = null;
+      }
+    }
+    if (!session) {
+      const interactive = options.interactiveLogin;
+      if (!interactive) {
+        throw new NaroError(
+          "NOT_LOGGED_IN",
+          "Not logged in. Run `naro login`, or set NARO_TOKEN."
+        );
+      }
+      interactive.log(
+        "Not logged in \u2014 opening your browser to sign in with GitHub\u2026"
+      );
+      const loginFlow = options.loginFlow ?? ((openBrowser) => login({ openBrowser }));
+      session = await loginFlow((url) => {
+        interactive.log(`If your browser did not open, visit:
+  ${url}`);
+        interactive.openBrowser(url);
+      });
+      saveSession(session, home);
+    }
+  }
+  const auth = {
+    source: "session",
+    user: session.user,
+    getAccessToken: async () => {
+      const current = loadStoredSession(home);
+      if (!current) {
+        throw new NaroError(
+          "NOT_LOGGED_IN",
+          "The session was logged out. Run `naro login` again."
+        );
+      }
+      if (!isExpired(current)) return current.access_token;
+      const refreshed = await refresh(current.refresh_token);
+      saveSession(refreshed, home);
+      return refreshed.access_token;
+    }
+  };
+  return auth;
+}
+
+// ../../packages/sdk/src/browser.ts
+import { spawn } from "child_process";
+
+// ../../packages/sdk/src/types.ts
+var TERMINAL_DEPLOYMENT_STATUSES = [
+  "READY",
+  "FAILED"
+];
+function isTerminalStatus(status) {
+  return TERMINAL_DEPLOYMENT_STATUSES.includes(status);
+}
+function projectInfo(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    subdomain: row.subdomain,
+    teamId: row.team_id,
+    defaultBranch: row.default_branch,
+    rootDirectory: row.root_directory,
+    repositoryUrl: row.repository_url,
+    repositoryFullName: row.repository_full_name ?? null,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function deploymentInfo(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    status: row.status,
+    branch: row.branch,
+    url: row.preview_url,
+    artifactKey: row.artifact_key ?? null,
+    errorCode: row.error_code,
+    errorMessage: row.error_message,
+    gitCommitSha: row.git_commit_sha,
+    gitCommitMessage: row.git_commit_message,
+    createdAt: row.created_at,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at
+  };
+}
+function buildLogEntry(row) {
+  return {
+    sequence: row.sequence,
+    level: row.level,
+    stage: row.stage,
+    message: row.message,
+    createdAt: row.created_at
+  };
+}
+
+// ../../packages/sdk/src/client.ts
+var NaroClient = class {
+  baseUrl;
+  getAccessToken;
+  doFetch;
+  teams;
+  projects;
+  deployments;
+  env;
+  domains;
+  logs;
+  constructor(options) {
+    this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
+    this.getAccessToken = options.getAccessToken;
+    this.doFetch = options.fetch ?? fetch;
+    this.teams = new TeamsApi(this);
+    this.projects = new ProjectsApi(this);
+    this.deployments = new DeploymentsApi(this);
+    this.env = new EnvApi(this);
+    this.domains = new DomainsApi(this);
+    this.logs = new LogsApi(this);
+  }
+  async request(path, options) {
+    const token = await this.getAccessToken();
+    let response;
+    try {
+      response = await this.doFetch(`${this.baseUrl}${path}`, {
+        method: options.method ?? "GET",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+        },
+        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {}
+      });
+    } catch (error) {
+      throw new NaroError(
+        "NETWORK_ERROR",
+        `${options.context} failed: could not reach ${this.baseUrl}.`,
+        { cause: error }
+      );
+    }
+    if (!response.ok) throw await errorFromResponse(response, options.context);
+    return await response.json();
+  }
+};
+var TeamsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const body = await this.client.request(
+      "/api/teams",
+      { context: "List teams" }
+    );
+    return body.teams;
+  }
+};
+var ProjectsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(teamSlug) {
+    const body = await this.client.request(
+      `/api/projects?team=${encodeURIComponent(teamSlug)}`,
+      { context: "List projects" }
+    );
+    return body.projects.map(projectInfo);
+  }
+  async get(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      { context: "Read project" }
+    );
+    return projectInfo(body.project);
+  }
+};
+var DeploymentsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(`/api/projects/${encodeURIComponent(projectId)}/deployments`, {
+      context: "List deployments"
+    });
+    return body.deployments.map(deploymentInfo);
+  }
+  async get(deploymentId) {
+    const body = await this.client.request(`/api/deployments/${encodeURIComponent(deploymentId)}`, {
+      context: "Read deployment"
+    });
+    return {
+      deployment: deploymentInfo(body.deployment),
+      logs: body.logs.map(buildLogEntry)
+    };
+  }
+  /**
+   * Starts a CLI deployment: the control plane creates/loads the project,
+   * records the deployment and returns a callback token; the caller builds
+   * locally and uploads the artifact.
+   */
+  async createCli(input) {
+    return this.client.request("/api/cli/deployments", {
+      method: "POST",
+      body: input,
+      context: "Create deployment"
+    });
+  }
+  /**
+   * Queues a server-side git build (GitHub-connected projects): clone,
+   * build and deploy run on the platform.
+   */
+  async createRemote(projectId, options = {}) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/deployments`,
+      {
+        method: "POST",
+        // createDeploymentSchema accepts string | undefined — never null.
+        body: options.branch ? { branch: options.branch } : {},
+        context: "Create deployment"
+      }
+    );
+    return deploymentInfo(body.deployment);
+  }
+  /**
+   * Picks the deployment `naro rollback` restores: the newest READY
+   * production deployment serving a DIFFERENT artifact than the current one.
+   * Comparing artifacts (not row order) keeps repeated rollbacks from
+   * ping-ponging between the same two rows — promoted rows share their
+   * source's artifact.
+   */
+  async rollbackTarget(projectId, defaultBranch) {
+    const deployments = await this.list(projectId);
+    const production = deployments.filter(
+      (deployment) => deployment.status === "READY" && deployment.branch === defaultBranch
+    );
+    const current = production[0];
+    if (!current) {
+      throw new NaroError(
+        "DEPLOYMENT_NOT_FOUND",
+        "No production deployment to roll back from."
+      );
+    }
+    const differs = (candidate) => current.artifactKey && candidate.artifactKey ? candidate.artifactKey !== current.artifactKey : candidate.id !== current.id;
+    return { current, target: production.slice(1).find(differs) ?? null };
+  }
+  /**
+   * Redeploys an existing READY deployment's artifact to production.
+   * Used by both `naro promote` (preview → production) and `naro rollback`
+   * (older production build → production).
+   */
+  async promote(projectId, deploymentId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`,
+      { method: "POST", context: "Promote deployment" }
+    );
+    return deploymentInfo(body.deployment);
+  }
+  /** Polls a deployment until READY/FAILED, streaming new build logs. */
+  async wait(deploymentId, options = {}) {
+    const intervalMs = options.intervalMs ?? 2500;
+    const timeoutMs = options.timeoutMs ?? 15 * 6e4;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const startedAt = Date.now();
+    let lastStatus = null;
+    let lastSequence = -1;
+    for (; ; ) {
+      const detail = await this.get(deploymentId);
+      for (const log of detail.logs) {
+        if (log.sequence > lastSequence) {
+          lastSequence = log.sequence;
+          options.onLog?.(log);
+        }
+      }
+      if (detail.deployment.status !== lastStatus) {
+        lastStatus = detail.deployment.status;
+        options.onStatus?.(lastStatus);
+      }
+      if (isTerminalStatus(detail.deployment.status)) return detail;
+      if (Date.now() - startedAt > timeoutMs) {
+        throw new NaroError(
+          "TIMEOUT",
+          `Deployment ${deploymentId} did not finish within ${String(Math.round(timeoutMs / 1e3))}s.`,
+          { details: { deploymentId } }
+        );
+      }
+      await sleep(intervalMs);
+    }
+  }
+};
+var EnvApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId, options = {}) {
+    const query = options.reveal ? "?reveal=true" : "";
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env${query}`,
+      { context: "List environment variables" }
+    );
+    return body.envVars;
+  }
+  async set(projectId, entries) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env`,
+      {
+        method: "POST",
+        body: {
+          entries: entries.map((entry) => ({
+            key: entry.key,
+            value: entry.value,
+            target: entry.target ?? "all",
+            isSecret: entry.isSecret ?? true
+          }))
+        },
+        context: "Set environment variable"
+      }
+    );
+  }
+  async removeById(projectId, envVarId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(envVarId)}`,
+      { method: "DELETE", context: "Remove environment variable" }
+    );
+  }
+  /** Removes every row for a key (optionally narrowed to one target). */
+  async remove(projectId, key, target) {
+    const rows = await this.list(projectId);
+    const matches = rows.filter(
+      (row) => row.key === key && (target === void 0 || row.target === target)
+    );
+    if (matches.length === 0) {
+      throw new NaroError(
+        "ENV_NOT_FOUND",
+        target ? `No ${key} variable found for the ${target} environment.` : `No ${key} variable found.`,
+        { details: { key, ...target ? { target } : {} } }
+      );
+    }
+    for (const row of matches) await this.removeById(projectId, row.id);
+    return matches.length;
+  }
+};
+var DomainsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains`,
+      { context: "List domains" }
+    );
+    return body.domains;
+  }
+  async add(projectId, hostname) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains`,
+      { method: "POST", body: { hostname }, context: "Add domain" }
+    );
+    return body.domain;
+  }
+  async refresh(projectId, domainId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
+      { method: "PATCH", context: "Refresh domain" }
+    );
+    return body.domain;
+  }
+  async removeById(projectId, domainId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
+      { method: "DELETE", context: "Remove domain" }
+    );
+  }
+  /** Removes a domain by hostname. */
+  async remove(projectId, hostname) {
+    const domains = await this.list(projectId);
+    const match = domains.find((domain) => domain.hostname === hostname);
+    if (!match) {
+      throw new NaroError(
+        "DOMAIN_NOT_FOUND",
+        `${hostname} is not attached to this project.`,
+        { details: { hostname } }
+      );
+    }
+    await this.removeById(projectId, match.id);
+  }
+};
+var LogsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async runtime(projectId, options = {}) {
+    const params = new URLSearchParams();
+    params.set("env", options.environment ?? "production");
+    if (options.level) params.set("level", options.level);
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/logs?${params.toString()}`,
+      { context: "Read runtime logs" }
+    );
+    return body.entries;
+  }
+};
+
+// ../../packages/sdk/src/dotenv.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+
+// ../../packages/sdk/src/framework.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+
+// ../../packages/sdk/src/link.ts
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join4 } from "path";
+function linkDir(dir) {
+  return join4(dir, ".naro");
+}
+function linkFile(dir) {
+  return join4(linkDir(dir), "project.json");
+}
+function readProjectLink(dir) {
+  try {
+    const parsed = JSON.parse(readFileSync4(linkFile(dir), "utf8"));
+    if (typeof parsed.projectId !== "string" || parsed.projectId.length === 0)
+      return null;
+    return {
+      projectId: parsed.projectId,
+      ...typeof parsed.teamSlug === "string" ? { teamSlug: parsed.teamSlug } : {},
+      ...typeof parsed.projectName === "string" ? { projectName: parsed.projectName } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writeProjectLink(dir, link) {
+  mkdirSync2(linkDir(dir), { recursive: true });
+  writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
+`);
+  writeFileSync2(
+    join4(linkDir(dir), "README.txt"),
+    "This directory links the project to Naro and should not be committed.\n"
+  );
+}
+function ensureGitignoreHasNaro(dir) {
+  const gitignorePath = join4(dir, ".gitignore");
+  const hasGitignore = existsSync3(gitignorePath);
+  if (!hasGitignore && !existsSync3(join4(dir, ".git"))) return false;
+  const current = hasGitignore ? readFileSync4(gitignorePath, "utf8") : "";
+  const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
+  if (covered) return false;
+  const suffix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
+  writeFileSync2(gitignorePath, `${current}${suffix}.naro
+`);
+  return true;
+}
+
+// src/naro.ts
+function createNaroDeps() {
+  let cachedAuth = null;
+  let cached = null;
+  const auth = async () => {
+    cachedAuth ??= await resolveAuth({ interactiveLogin: false });
+    return cachedAuth;
+  };
+  const client = async () => {
+    if (cached) return cached;
+    const resolved = await auth();
+    cached = new NaroClient({
+      baseUrl: controlPlaneUrl(),
+      getAccessToken: () => resolved.getAccessToken()
+    });
+    return cached;
+  };
+  return {
+    client,
+    auth,
+    cwd: () => process.cwd(),
+    resolveProjectId: async (args) => {
+      if (args.projectId) return args.projectId;
+      const directory = args.directory ?? process.cwd();
+      const link = readProjectLink(directory);
+      if (link) return link.projectId;
+      throw new NaroError(
+        "PROJECT_NOT_LINKED",
+        `No Naro project is linked in ${directory}. Pass projectId, or link the directory first (link_project / \`naro link\`).`
+      );
+    }
+  };
+}
+
+// src/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import {
   CallToolRequestSchema,
   ListToolsRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
+
+// src/tools.ts
 import { deployDirectory, readProjectEnv } from "naro-cli";
-console.log = (...args) => {
-  process.stderr.write(`${args.map(String).join(" ")}
-`);
+var PROJECT_ARGS = {
+  projectId: {
+    type: "string",
+    description: "Naro project id (UUID). Omit to use the .naro/project.json link in `directory`."
+  },
+  directory: {
+    type: "string",
+    description: "Absolute path of the project directory used to resolve the linked project. Defaults to the current working directory."
+  }
 };
-var DEPLOY_TOOL = {
-  name: "deploy",
-  description: "Deploy the current Next.js project to naro using the naro login session. If the user is not logged in, a browser window opens for GitHub sign-in \u2014 tell the user to approve it. Local git remote/branch and .env variables are detected and registered to the project automatically. Builds locally and publishes to Cloudflare, returning a live {name}.naro.sh URL.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      directory: {
-        type: "string",
-        description: "Absolute path to the project directory. Defaults to the current working directory."
-      },
-      name: {
-        type: "string",
-        description: "Deployment name / subdomain label. Defaults to the package.json name."
+var DESTRUCTIVE = "\u26A0 DESTRUCTIVE: ";
+function str(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+var TOOLS = [
+  {
+    name: "whoami",
+    description: "Returns the authenticated Naro user (from the `naro login` session or NARO_TOKEN).",
+    inputSchema: { type: "object", properties: {} },
+    handler: async (_args, deps) => {
+      const auth = await deps.auth();
+      const teams = await (await deps.client()).teams.list();
+      return {
+        user: auth.user ?? null,
+        tokenSource: auth.source,
+        teams
+      };
+    }
+  },
+  {
+    name: "list_teams",
+    description: "Lists the teams the authenticated user belongs to.",
+    inputSchema: { type: "object", properties: {} },
+    handler: async (_args, deps) => ({
+      teams: await (await deps.client()).teams.list()
+    })
+  },
+  {
+    name: "list_projects",
+    description: "Lists the Naro projects of a team (defaults to the personal team).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        team: {
+          type: "string",
+          description: "Team slug. Omit for the personal team."
+        }
+      }
+    },
+    handler: async (args, deps) => {
+      const client = await deps.client();
+      let slug = str(args.team);
+      if (!slug) {
+        const teams = await client.teams.list();
+        slug = (teams.find((team) => team.isPersonal) ?? teams[0])?.slug;
+        if (!slug) return { projects: [] };
+      }
+      return { team: slug, projects: await client.projects.list(slug) };
+    }
+  },
+  {
+    name: "get_project",
+    description: "Returns one project (id, subdomain/URL, default branch, root directory).",
+    inputSchema: { type: "object", properties: { ...PROJECT_ARGS } },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      return { project: await (await deps.client()).projects.get(projectId) };
+    }
+  },
+  {
+    name: "link_project",
+    description: "Links a local directory to a Naro project by writing .naro/project.json (and gitignoring it). Later tools can then omit projectId.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectId: { type: "string", description: "Project id to link to." },
+        directory: {
+          type: "string",
+          description: "Directory to link. Defaults to the current directory."
+        }
       },
-      production: {
-        type: "boolean",
-        description: "Publish to production ({name}.naro.sh). Defaults to false, which deploys a preview at {name}-preview.naro.sh."
+      required: ["projectId"]
+    },
+    handler: async (args, deps) => {
+      const projectId = str(args.projectId);
+      if (!projectId) throw new Error("projectId is required.");
+      const directory = str(args.directory) ?? deps.cwd();
+      const project = await (await deps.client()).projects.get(projectId);
+      writeProjectLink(directory, {
+        projectId: project.id,
+        projectName: project.name
+      });
+      ensureGitignoreHasNaro(directory);
+      return { linked: true, directory, project };
+    }
+  },
+  {
+    name: "deploy",
+    description: "Deploys a local project to Naro (create_deployment): registers the deployment, builds the Next.js app locally, uploads the artifact and waits for the live URL. Preview by default; production:true publishes to the main domain. If the user is not logged in and no NARO_TOKEN is set, a browser window opens for GitHub sign-in \u2014 tell the user to approve it. On the FIRST deploy of a directory, local .env variables seed the project; afterwards env is managed on the platform (set_environment_variable).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        directory: {
+          type: "string",
+          description: "Absolute path to the project directory. Defaults to the current working directory."
+        },
+        production: {
+          type: "boolean",
+          description: `${DESTRUCTIVE}when true, publishes to the production domain. Defaults to false (preview).`
+        },
+        name: {
+          type: "string",
+          description: "Project name / subdomain label for first deploys. Defaults to the package.json name."
+        },
+        rootDirectory: {
+          type: "string",
+          description: 'Sub-directory containing the Next.js app (where its package.json lives), e.g. "client". Inspect the project structure and pass this whenever the app is not at the repository root.'
+        },
+        branch: {
+          type: "string",
+          description: "Override the recorded git branch. Usually omit \u2014 the current branch is detected."
+        }
+      }
+    },
+    handler: async (args, deps) => {
+      const directory = str(args.directory) ?? deps.cwd();
+      const link = readProjectLink(directory);
+      const logs = [];
+      const result = await deployDirectory(
+        directory,
+        {
+          name: str(args.name),
+          projectId: link?.projectId,
+          production: args.production === true,
+          rootDirectory: str(args.rootDirectory) ?? null,
+          branch: str(args.branch),
+          // Local dotenv files seed the project once (first, unlinked
+          // deploy); afterwards the platform owns env vars.
+          env: link ? {} : readProjectEnv(directory)
+        },
+        (message) => logs.push(message)
+      );
+      if (!link) {
+        writeProjectLink(directory, { projectId: result.projectId });
+        ensureGitignoreHasNaro(directory);
+      }
+      return {
+        deploymentId: result.deploymentId,
+        projectId: result.projectId,
+        status: result.status,
+        url: result.url,
+        target: result.production ? "production" : "preview",
+        logs
+      };
+    }
+  },
+  {
+    name: "list_deployments",
+    description: "Lists recent deployments of a project (id, status, branch, URL).",
+    inputSchema: { type: "object", properties: { ...PROJECT_ARGS } },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      return {
+        projectId,
+        deployments: await (await deps.client()).deployments.list(projectId)
+      };
+    }
+  },
+  {
+    name: "get_deployment",
+    description: "Returns one deployment's status, URL and error details. Poll this after deploy/promote to track progress.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        deploymentId: { type: "string", description: "Deployment id." }
       },
-      rootDirectory: {
-        type: "string",
-        description: 'Sub-directory containing the Next.js app (where its package.json lives), e.g. "client". Inspect the project structure and pass this whenever the app is not at the repository root.'
+      required: ["deploymentId"]
+    },
+    handler: async (args, deps) => {
+      const deploymentId = str(args.deploymentId);
+      if (!deploymentId) throw new Error("deploymentId is required.");
+      const detail = await (await deps.client()).deployments.get(deploymentId);
+      return { deployment: detail.deployment, logCount: detail.logs.length };
+    }
+  },
+  {
+    name: "get_build_logs",
+    description: "Returns the build logs of a deployment \u2014 use this to diagnose why a build FAILED, then fix the code and redeploy.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        deploymentId: { type: "string", description: "Deployment id." }
       },
-      branch: {
-        type: "string",
-        description: "Override the git branch recorded for this deployment. Usually omit \u2014 the CLI detects the current branch automatically."
+      required: ["deploymentId"]
+    },
+    handler: async (args, deps) => {
+      const deploymentId = str(args.deploymentId);
+      if (!deploymentId) throw new Error("deploymentId is required.");
+      const detail = await (await deps.client()).deployments.get(deploymentId);
+      return {
+        deploymentId,
+        status: detail.deployment.status,
+        errorCode: detail.deployment.errorCode,
+        errorMessage: detail.deployment.errorMessage,
+        logs: detail.logs
+      };
+    }
+  },
+  {
+    name: "get_runtime_logs",
+    description: "Returns recent runtime (request/console) logs of the deployed worker.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        environment: {
+          type: "string",
+          enum: ["production", "preview"],
+          description: "Which surface to read. Defaults to production."
+        },
+        level: {
+          type: "string",
+          enum: ["log", "info", "warn", "error", "debug"],
+          description: "Only entries at this level."
+        }
       }
+    },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const environment = str(args.environment) === "preview" ? "preview" : "production";
+      const level = str(args.level);
+      const entries = await (await deps.client()).logs.runtime(projectId, {
+        environment,
+        ...level !== void 0 ? { level } : {}
+      });
+      return { projectId, environment, entries };
     }
-  }
-};
-var server = new Server(
-  { name: "naro", version: "0.1.0" },
-  { capabilities: { tools: {} } }
-);
-server.setRequestHandler(ListToolsRequestSchema, () => ({
-  tools: [DEPLOY_TOOL]
-}));
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-  if (request.params.name !== "deploy") {
-    throw new Error(`Unknown tool: ${request.params.name}`);
-  }
-  const args = request.params.arguments ?? {};
-  const directory = args.directory ?? process.cwd();
-  const logs = [];
-  try {
-    const result = await deployDirectory(
-      directory,
-      {
-        name: args.name,
-        production: args.production ?? false,
-        rootDirectory: args.rootDirectory ?? null,
-        branch: args.branch,
-        env: readProjectEnv(directory)
+  },
+  {
+    name: "list_environment_variables",
+    description: "Lists environment variables (secret values are never returned).",
+    inputSchema: { type: "object", properties: { ...PROJECT_ARGS } },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const rows = await (await deps.client()).env.list(projectId);
+      return {
+        projectId,
+        envVars: rows.map((row) => ({
+          key: row.key,
+          target: row.target,
+          isSecret: row.isSecret,
+          value: row.isSecret ? null : row.value
+        }))
+      };
+    }
+  },
+  {
+    name: "set_environment_variable",
+    description: "Adds or overwrites one environment variable. Takes effect on the NEXT deployment.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        key: {
+          type: "string",
+          description: "Variable name, e.g. DATABASE_URL."
+        },
+        value: { type: "string", description: "Variable value." },
+        target: {
+          type: "string",
+          enum: ["production", "preview", "all"],
+          description: "Which deployments receive it. Defaults to all."
+        },
+        isSecret: {
+          type: "boolean",
+          description: "Hide the value in listings. Defaults to true unless the key starts with NEXT_PUBLIC_."
+        }
       },
-      (message) => logs.push(message)
-    );
-    return {
-      content: [
-        {
-          type: "text",
-          text: `Deployed ${directory} to ${result.url}
-
-${logs.join("\n")}`
+      required: ["key", "value"]
+    },
+    handler: async (args, deps) => {
+      const key = str(args.key);
+      const value = typeof args.value === "string" ? args.value : void 0;
+      if (!key || value === void 0)
+        throw new Error("key and value are required.");
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const rawTarget = str(args.target);
+      if (rawTarget !== void 0 && rawTarget !== "production" && rawTarget !== "preview" && rawTarget !== "all")
+        throw new Error(
+          `Invalid target "${rawTarget}" \u2014 use production, preview or all.`
+        );
+      const target = rawTarget ?? "all";
+      const isSecret = typeof args.isSecret === "boolean" ? args.isSecret : !key.startsWith("NEXT_PUBLIC_");
+      await (await deps.client()).env.set(projectId, [{ key, value, target, isSecret }]);
+      return { projectId, key, target, isSecret };
+    }
+  },
+  {
+    name: "remove_environment_variable",
+    description: `${DESTRUCTIVE}deletes an environment variable from the project (all matching targets).`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        key: { type: "string", description: "Variable name to remove." },
+        target: {
+          type: "string",
+          enum: ["production", "preview", "all"],
+          description: "Only remove the row for this target."
         }
-      ]
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      isError: true,
-      content: [
-        {
-          type: "text",
-          text: `Deploy failed: ${message}
-
-${logs.join("\n")}`
+      },
+      required: ["key"]
+    },
+    handler: async (args, deps) => {
+      const key = str(args.key);
+      if (!key) throw new Error("key is required.");
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const target = str(args.target);
+      const removed = await (await deps.client()).env.remove(projectId, key, target);
+      return { projectId, key, removed };
+    }
+  },
+  {
+    name: "list_domains",
+    description: "Lists the project's custom domains with verification status and required DNS records.",
+    inputSchema: { type: "object", properties: { ...PROJECT_ARGS } },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      return {
+        projectId,
+        domains: await (await deps.client()).domains.list(projectId)
+      };
+    }
+  },
+  {
+    name: "add_domain",
+    description: "Attaches a custom domain to the project's production deployment and returns the DNS records the user must create.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        hostname: {
+          type: "string",
+          description: "Domain to attach, e.g. www.example.com."
         }
-      ]
-    };
+      },
+      required: ["hostname"]
+    },
+    handler: async (args, deps) => {
+      const hostname = str(args.hostname);
+      if (!hostname) throw new Error("hostname is required.");
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const domain = await (await deps.client()).domains.add(projectId, hostname);
+      return { projectId, domain };
+    }
+  },
+  {
+    name: "remove_domain",
+    description: `${DESTRUCTIVE}detaches a custom domain \u2014 traffic to it stops routing to this project.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        hostname: { type: "string", description: "Domain to detach." }
+      },
+      required: ["hostname"]
+    },
+    handler: async (args, deps) => {
+      const hostname = str(args.hostname);
+      if (!hostname) throw new Error("hostname is required.");
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      await (await deps.client()).domains.remove(projectId, hostname);
+      return { projectId, hostname, removed: true };
+    }
+  },
+  {
+    name: "promote_deployment",
+    description: `${DESTRUCTIVE}publishes an existing READY deployment (e.g. a preview build) to production. Production traffic switches to it once READY.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        deploymentId: {
+          type: "string",
+          description: "The READY deployment to promote."
+        }
+      },
+      required: ["deploymentId"]
+    },
+    handler: async (args, deps) => {
+      const deploymentId = str(args.deploymentId);
+      if (!deploymentId) throw new Error("deploymentId is required.");
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const client = await deps.client();
+      const promoted = await client.deployments.promote(
+        projectId,
+        deploymentId
+      );
+      const detail = await client.deployments.wait(promoted.id, {
+        timeoutMs: 5 * 6e4
+      });
+      return {
+        deploymentId: promoted.id,
+        sourceDeploymentId: deploymentId,
+        status: detail.deployment.status,
+        url: detail.deployment.url,
+        errorCode: detail.deployment.errorCode
+      };
+    }
+  },
+  {
+    name: "rollback_deployment",
+    description: `${DESTRUCTIVE}rolls production back. Without deploymentId, the previous READY production deployment is restored; with deploymentId, that specific build is restored.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...PROJECT_ARGS,
+        deploymentId: {
+          type: "string",
+          description: "Specific deployment to restore. Omit for the previous production build."
+        }
+      }
+    },
+    handler: async (args, deps) => {
+      const projectId = await deps.resolveProjectId({
+        projectId: str(args.projectId),
+        directory: str(args.directory)
+      });
+      const client = await deps.client();
+      let target = str(args.deploymentId);
+      if (!target) {
+        const project = await client.projects.get(projectId);
+        const { target: candidate } = await client.deployments.rollbackTarget(
+          projectId,
+          project.defaultBranch
+        );
+        if (!candidate)
+          throw Object.assign(
+            new Error(
+              "No earlier production build with a different artifact to roll back to."
+            ),
+            { code: "DEPLOYMENT_NOT_FOUND" }
+          );
+        target = candidate.id;
+      }
+      const promoted = await client.deployments.promote(projectId, target);
+      const detail = await client.deployments.wait(promoted.id, {
+        timeoutMs: 5 * 6e4
+      });
+      return {
+        deploymentId: promoted.id,
+        rolledBackTo: target,
+        status: detail.deployment.status,
+        url: detail.deployment.url,
+        errorCode: detail.deployment.errorCode
+      };
+    }
   }
-});
-await server.connect(new StdioServerTransport());
+];
+function toolResultJson(data) {
+  return JSON.stringify({ success: true, ...data }, null, 2);
+}
+function toolErrorJson(error) {
+  const naroError = isNaroError(error) ? error : toNaroError(error);
+  const code = isNaroError(error) || !(error instanceof Error && "code" in error) ? naroError.code : String(error.code);
+  return JSON.stringify(
+    {
+      success: false,
+      code,
+      message: naroError.message,
+      ...naroError.details ?? {}
+    },
+    null,
+    2
+  );
+}
+
+// src/server.ts
+function createServer2(deps) {
+  const server = new Server(
+    { name: "naro", version: "0.3.0" },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: TOOLS.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const tool = TOOLS.find(
+      (candidate) => candidate.name === request.params.name
+    );
+    if (!tool) throw new Error(`Unknown tool: ${request.params.name}`);
+    try {
+      const data = await tool.handler(request.params.arguments ?? {}, deps);
+      return { content: [{ type: "text", text: toolResultJson(data) }] };
+    } catch (error) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: toolErrorJson(error) }]
+      };
+    }
+  });
+  return server;
+}
+
+// src/index.ts
+console.log = (...args) => {
+  process.stderr.write(`${args.map(String).join(" ")}
+`);
+};
+await createServer2(createNaroDeps()).connect(new StdioServerTransport());