naro-cli 0.12.0 → 0.14.0

package/README.md

@@ -69,6 +69,19 @@ naro logs <deployment-id>          Build logs of a deployment
 naro logs --type build --follow    Stream build logs until READY/FAILED
 naro logs --env preview            Preview-surface runtime logs
 
+naro analytics                     Web Analytics: visitors, page views, top pages, referrers, countries, devices, browsers, operating systems (--range 7d)
+naro analytics --country KR --os ios  Narrow it: --path, --referrer, --country, --device, --browser, --os (one value each, all must match)
+
+naro insights                      Speed Insights: Web Vitals p75, and the page load's p75 and the mean of each step (--metric lcp, --range 7d)
+naro insights --route '/posts/[id]'  The paths under one route
+naro insights --env preview        The same for the preview worker
+naro insights --country KR --device mobile  Narrow it: --path, --country, --device, --browser, --os (no --referrer: Speed Insights has none)
+naro insights enable | disable     Turn measuring on or off
+
+naro protection                    Preview protection: on or off, and whether a bypass secret is set
+naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
+naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
+
 naro env list [--reveal]           Secrets masked unless --reveal
 naro env add DATABASE_URL production
 naro env remove DATABASE_URL
@@ -160,6 +173,18 @@ naro policy set posts --from-file policy.json
                                    Shorthand: writes the policies naro_select … naro_delete
 naro policy remove todos           Drop every policy on the table: back to deny (asks first)
 
+naro storage                       Naro Storage: on or off, limits, usage, buckets
+naro storage enable                Turn it on: the project's R2 bucket, bound to the backend
+naro storage bucket create avatars --public --file-size-limit 5MiB --allowed-mime-types image/png,image/jpeg
+naro storage bucket update avatars --private | --file-size-limit none | --allowed-mime-types any
+naro storage bucket update docs --public   (asks first: anyone with an object's URL can download it)
+naro storage bucket list | empty <name> | remove <name> [--empty]   (empty and remove ask first)
+naro storage ls naro://avatars/u1 [--recursive]
+naro storage cp ./me.png naro://avatars/u1/me.png [--upsert]   Up to 50 MiB, with the service key
+naro storage cp naro://docs/team-1/plan.pdf ./                  Replaces a local file of the same name
+naro storage rm naro://avatars/u1/old.png [--recursive]   (asks first)
+naro storage rm naro://avatars/u1/ --recursive   Everything under u1/; written u1, an object u1 too
+
 naro promote <deployment-id>       Publish a build to production
 naro rollback [deployment-id]      Back to the previous production build
 ```
@@ -768,6 +793,83 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.14.0
+
+- `naro analytics` shows the project's Web Analytics from the terminal: the
+  range's visitors and page views (`--range 24h|7d|30d`, 7d by default), then
+  the top pages, referrers, countries, devices, browsers and operating systems
+  by page views, and `--json` prints the whole report, trend included. The
+  same six filters as on the dashboard narrow it, one value each, all of them
+  at once: `naro analytics --country KR --os ios`. The first line names the
+  filters that applied; filters that leave no visit print one line under it,
+  `No visits match these filters. Drop a filter to see more.`, instead of six
+  empty tables. The CLI does not check the values; the server answers
+  `400 VALIDATION_FAILED` with the rule the value broke (`--country` is an
+  uppercase two-letter code like `KR`, `--referrer` a lowercase host like
+  `t.co`; `kr` and `T.co` are refused). It reads the
+  production worker only, so `--env` is refused with `VALIDATION_FAILED` and
+  nothing is sent. An API token (`--token`, `NARO_TOKEN`) can read it.
+- `naro insights` takes the same filters: `--path`, `--country`, `--device`,
+  `--browser` and `--os` narrow it to one value each (`--referrer` is refused
+  with `VALIDATION_FAILED` and nothing is sent: a vitals row has no referrer).
+  The first line names the filters that applied
+  (`· filtered by country=KR, os=ios`); filters that leave no measurement print
+  `No measurements match these filters. Drop a filter to see more.` instead of
+  waiting advice.
+  The filters narrow a report only: `naro insights enable | disable` refuses
+  them (`Filters only narrow a report; drop --country.`) and sends nothing, and
+  an empty value (`--referrer=`) is no filter.
+- `naro insights` prints a `Page load p75 … · mean per step: …` line under the
+  metrics table: the p75 of how long visits took to load the page, to the end
+  of the load event, then the mean of each step (wait, DNS, connect, server,
+  download, processing, onload), so the steps need not add up to the p75. It is
+  left out until a visit has sent a page load. The dashboard's Speed Insights
+  tab has the same Page load card.
+
+### 0.13.0
+
+- `naro insights` shows the project's Speed Insights from the terminal: each
+  Web Vital's p75 with its good, needs-improvement and poor shares, then the
+  selected metric (`--metric`, `--range`) by page, device, the elements
+  behind slow visits and deployment. Production by default; `--env preview`
+  reads the preview worker. `--route '/posts/[id]'` lists the paths under
+  one route, `--json` prints the whole report, and
+  `naro insights enable | disable` turns measuring on or off for production
+  and preview together (one switch, so `--env` is refused there).
+- `naro protection` shows whether the project's preview URL is protected and
+  whether a bypass secret is set. Protection is on by default: only members
+  of the project can open `<name>-preview.naro.sh`, after signing in to naro.
+  A GET or HEAD that is a page navigation (`Sec-Fetch-Mode: navigate`), or that
+  sends no `Sec-Fetch-Mode` and an `Accept` including `text/html`, is
+  redirected to the naro sign-in; every other request gets
+  `401 PREVIEW_PROTECTED`. A request the browser sends without cookies (a
+  `<link rel="manifest">` without `crossorigin="use-credentials"`) gets 401
+  too.
+  `naro protection enable` and `naro protection disable` switch it (the edge
+  picks the change up within about a minute). `naro protection bypass`
+  creates the secret CI or a monitor sends as the `x-naro-protection-bypass`
+  header (shown once; it replaces any earlier one) and
+  `naro protection bypass remove` deletes it. `disable`, a `bypass` that
+  replaces a secret and `bypass remove` ask first; without a terminal they need
+  `--yes` and exit 1 with `CONFIRMATION_REQUIRED` otherwise, nothing written.
+  The Naro backend API (`/_naro/v1`) and production are never protected.
+- `naro storage` manages the project's Naro Storage: `enable` turns it on,
+  `bucket list | create | update | empty | remove` manage the buckets
+  (public or private, the largest file, the types taken), and `ls`, `cp`
+  and `rm` work on `naro://<bucket>/<path>` with the project's service key
+  (`NARO_SERVICE_KEY`, or fetched with a warning) — the bytes go to the
+  project's backend, not through naro. One upload is 50 MiB at most.
+  `bucket update --public`, `empty`, `remove` and `rm` ask first; without a
+  terminal they need `--yes` (`CONFIRMATION_REQUIRED` otherwise, nothing
+  sent).
+- `naro policy create` and `naro policy set` take `storage.objects`, as
+  migrations already did. A backend from before Storage answers
+  `409 BACKEND_OUTDATED`.
+- `naro db push --dry-run`, `naro db reset` and `naro db lint` read
+  `CREATE POLICY … ON storage.objects`. 0.12.0 refused such a file on this
+  machine (`schema storage does not exist`), and its `db lint` and
+  `db reset` did not know Storage's policies.
+
 ### 0.12.0
 
 - Migrations and `naro db query` take Postgres's `CREATE POLICY`,
@@ -837,7 +939,9 @@ command run non-interactively without `--yes` fails with
 
 `--yes` (or `-y`) suppresses every prompt — destructive actions
 (production rollback/promote, env/domain removal, database reset, backend key
-rotation, policy removal and drop) run unconfirmed, so use it deliberately in
+rotation, policy removal and drop, opening the preview with
+`naro protection disable`, replacing or removing the bypass secret) run
+unconfirmed, so use it deliberately in
 automation.
 
 ## CI authentication
@@ -864,4 +968,5 @@ NARO_TOKEN=$(naro token) npx naro-cli deploy --prod --yes --json
 | ------------------------ | ---------------------------------------------- |
 | `NARO_TOKEN`             | CI/agent access token (skips `naro login`)     |
 | `NARO_CONTROL_PLANE_URL` | Custom control plane (default https://naro.sh) |
+| `NARO_SERVICE_KEY`       | Service key for `naro storage ls\|cp\|rm`      |
 | `NARO_SUPABASE_URL/KEY`  | Auth backend override (self-hosted setups)     |