naro-cli 0.12.0 → 0.13.0

package/README.md

@@ -69,6 +69,15 @@ naro logs <deployment-id>          Build logs of a deployment
 naro logs --type build --follow    Stream build logs until READY/FAILED
 naro logs --env preview            Preview-surface runtime logs
 
+naro insights                      Speed Insights: Web Vitals p75 (--metric lcp, --range 7d)
+naro insights --route '/posts/[id]'  The paths under one route
+naro insights --env preview        The same for the preview worker
+naro insights enable | disable     Turn measuring on or off
+
+naro protection                    Preview protection: on or off, and whether a bypass secret is set
+naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
+naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
+
 naro env list [--reveal]           Secrets masked unless --reveal
 naro env add DATABASE_URL production
 naro env remove DATABASE_URL
@@ -160,6 +169,18 @@ naro policy set posts --from-file policy.json
                                    Shorthand: writes the policies naro_select … naro_delete
 naro policy remove todos           Drop every policy on the table: back to deny (asks first)
 
+naro storage                       Naro Storage: on or off, limits, usage, buckets
+naro storage enable                Turn it on: the project's R2 bucket, bound to the backend
+naro storage bucket create avatars --public --file-size-limit 5MiB --allowed-mime-types image/png,image/jpeg
+naro storage bucket update avatars --private | --file-size-limit none | --allowed-mime-types any
+naro storage bucket update docs --public   (asks first: anyone with an object's URL can download it)
+naro storage bucket list | empty <name> | remove <name> [--empty]   (empty and remove ask first)
+naro storage ls naro://avatars/u1 [--recursive]
+naro storage cp ./me.png naro://avatars/u1/me.png [--upsert]   Up to 50 MiB, with the service key
+naro storage cp naro://docs/team-1/plan.pdf ./                  Replaces a local file of the same name
+naro storage rm naro://avatars/u1/old.png [--recursive]   (asks first)
+naro storage rm naro://avatars/u1/ --recursive   Everything under u1/; written u1, an object u1 too
+
 naro promote <deployment-id>       Publish a build to production
 naro rollback [deployment-id]      Back to the previous production build
 ```
@@ -768,6 +789,50 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.13.0
+
+- `naro insights` shows the project's Speed Insights from the terminal: each
+  Web Vital's p75 with its good, needs-improvement and poor shares, then the
+  selected metric (`--metric`, `--range`) by page, device, the elements
+  behind slow visits and deployment. Production by default; `--env preview`
+  reads the preview worker. `--route '/posts/[id]'` lists the paths under
+  one route, `--json` prints the whole report, and
+  `naro insights enable | disable` turns measuring on or off for production
+  and preview together (one switch, so `--env` is refused there).
+- `naro protection` shows whether the project's preview URL is protected and
+  whether a bypass secret is set. Protection is on by default: only members
+  of the project can open `<name>-preview.naro.sh`, after signing in to naro.
+  A GET or HEAD that is a page navigation (`Sec-Fetch-Mode: navigate`), or that
+  sends no `Sec-Fetch-Mode` and an `Accept` including `text/html`, is
+  redirected to the naro sign-in; every other request gets
+  `401 PREVIEW_PROTECTED`. A request the browser sends without cookies (a
+  `<link rel="manifest">` without `crossorigin="use-credentials"`) gets 401
+  too.
+  `naro protection enable` and `naro protection disable` switch it (the edge
+  picks the change up within about a minute). `naro protection bypass`
+  creates the secret CI or a monitor sends as the `x-naro-protection-bypass`
+  header (shown once; it replaces any earlier one) and
+  `naro protection bypass remove` deletes it. `disable`, a `bypass` that
+  replaces a secret and `bypass remove` ask first; without a terminal they need
+  `--yes` and exit 1 with `CONFIRMATION_REQUIRED` otherwise, nothing written.
+  The Naro backend API (`/_naro/v1`) and production are never protected.
+- `naro storage` manages the project's Naro Storage: `enable` turns it on,
+  `bucket list | create | update | empty | remove` manage the buckets
+  (public or private, the largest file, the types taken), and `ls`, `cp`
+  and `rm` work on `naro://<bucket>/<path>` with the project's service key
+  (`NARO_SERVICE_KEY`, or fetched with a warning) — the bytes go to the
+  project's backend, not through naro. One upload is 50 MiB at most.
+  `bucket update --public`, `empty`, `remove` and `rm` ask first; without a
+  terminal they need `--yes` (`CONFIRMATION_REQUIRED` otherwise, nothing
+  sent).
+- `naro policy create` and `naro policy set` take `storage.objects`, as
+  migrations already did. A backend from before Storage answers
+  `409 BACKEND_OUTDATED`.
+- `naro db push --dry-run`, `naro db reset` and `naro db lint` read
+  `CREATE POLICY … ON storage.objects`. 0.12.0 refused such a file on this
+  machine (`schema storage does not exist`), and its `db lint` and
+  `db reset` did not know Storage's policies.
+
 ### 0.12.0
 
 - Migrations and `naro db query` take Postgres's `CREATE POLICY`,
@@ -837,7 +902,9 @@ command run non-interactively without `--yes` fails with
 
 `--yes` (or `-y`) suppresses every prompt — destructive actions
 (production rollback/promote, env/domain removal, database reset, backend key
-rotation, policy removal and drop) run unconfirmed, so use it deliberately in
+rotation, policy removal and drop, opening the preview with
+`naro protection disable`, replacing or removing the bypass secret) run
+unconfirmed, so use it deliberately in
 automation.
 
 ## CI authentication
@@ -864,4 +931,5 @@ NARO_TOKEN=$(naro token) npx naro-cli deploy --prod --yes --json
 | ------------------------ | ---------------------------------------------- |
 | `NARO_TOKEN`             | CI/agent access token (skips `naro login`)     |
 | `NARO_CONTROL_PLANE_URL` | Custom control plane (default https://naro.sh) |
+| `NARO_SERVICE_KEY`       | Service key for `naro storage ls\|cp\|rm`      |
 | `NARO_SUPABASE_URL/KEY`  | Auth backend override (self-hosted setups)     |