naro-cli 0.15.0 → 0.17.0

package/dist/index.js

@@ -26,7 +26,6 @@ import {
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
-  dataError,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
@@ -83,7 +82,7 @@ import {
   toNaroError,
   unreadablePolicyComment,
   writeProjectLink
-} from "./chunk-6WJ3QQ5Y.js";
+} from "./chunk-PYRN5XR6.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -289,6 +288,13 @@ var Output = class {
     this.streams.stderr(`${message}
 `);
   }
+  /**
+   * Text on stderr exactly as given, with no line break added: a progress
+   * line a terminal rewrites in place (`\r…`). Never stdout, in either mode.
+   */
+  progress(text) {
+    this.streams.stderr(text);
+  }
   /** Extra diagnostics, only with --debug. */
   debugLog(message) {
     if (this.debug) this.streams.stderr(`[debug] ${message}
@@ -4554,21 +4560,69 @@ function domainLines(domain) {
   }
   return lines;
 }
+function claimLines(claim) {
+  return [
+    `   \u23F3 ${claim.hostname} \u2014 another project holds it. Publish this TXT record, then run \`naro domains verify ${claim.hostname}\`:`,
+    `      TXT ${claim.record.name}`,
+    `        host:  ${claim.record.host}`,
+    `        value: ${claim.record.value}`
+  ];
+}
+async function openClaims(client, projectId) {
+  try {
+    return await client.domains.listClaims(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "NOT_FOUND") return [];
+    throw error;
+  }
+}
 async function runDomainsList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const domains = await client.domains.list(projectId);
+  const claims = await openClaims(client, projectId);
   const pending = domains.filter((domain) => !isReady(domain));
   context.output.result(
-    { projectId, domains },
-    domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
-      `Domains (${String(domains.length)}):`,
-      ...domains.flatMap(domainLines),
+    { projectId, domains, claims },
+    domains.length === 0 && claims.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
+      ...domains.length > 0 ? [
+        `Domains (${String(domains.length)}):`,
+        ...domains.flatMap(domainLines)
+      ] : [],
+      ...claims.length > 0 ? [
+        ...domains.length > 0 ? [""] : [],
+        `Ownership checks (${String(claims.length)}):`,
+        ...claims.flatMap(claimLines)
+      ] : [],
       // list reads our stored copy; only verify goes and looks again.
       ...pending.length > 0 ? ["", "Re-check DNS now: naro domains verify"] : []
     ]
   );
 }
+async function verifyClaimFor(context, client, projectId, hostname) {
+  const wanted = hostname.toLowerCase().replace(/\.+$/, "");
+  const claim = (await openClaims(client, projectId)).find(
+    (candidate) => candidate.hostname === wanted
+  );
+  if (!claim) return false;
+  const result = await client.domains.verifyClaim(projectId, claim.id);
+  if (!result.verified) {
+    const cause = result.claim.cause;
+    throw new NaroError(
+      cause?.code ?? "DOMAIN_VERIFICATION_REQUIRED",
+      cause ? `${cause.message}${cause.fix ? ` ${cause.fix}` : ""}` : `${wanted} is not verified yet.`,
+      { details: { claim: result.claim } }
+    );
+  }
+  context.output.result({ projectId, verified: true, domain: result.domain }, [
+    `\u2705 Ownership of ${result.domain.hostname} verified \u2014 it now belongs to this project.`,
+    "",
+    ...domainLines(result.domain),
+    "",
+    "Status: Waiting for DNS \u2014 add the CNAME above; naro connects it within about five minutes. Check with `naro domains verify`."
+  ]);
+  return true;
+}
 async function runDomainsAdd(context) {
   const [hostname] = context.positionalOrThrow(
     1,
@@ -4602,7 +4656,7 @@ async function runDomainsAdd(context) {
         `   refuses the record above, run \`naro domains add ${alternative}\`.`
       ] : [],
       "",
-      isReady(domain) ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains verify`."
+      isReady(domain) ? "The domain is active." : "Status: Waiting for DNS \u2014 add the CNAME above; naro connects it within about five minutes. Check with `naro domains verify`."
     ]
   );
 }
@@ -4626,7 +4680,14 @@ async function runDomainsVerify(context, overrides = {}) {
   const progress = (line) => {
     if (!context.flags.json) context.output.log(line);
   };
-  let domains = await verifyAll(client, projectId, hostname);
+  let domains;
+  try {
+    domains = await verifyAll(client, projectId, hostname);
+  } catch (error) {
+    if (hostname !== void 0 && isNaroError(error) && error.code === "DOMAIN_NOT_FOUND" && await verifyClaimFor(context, client, projectId, hostname))
+      return;
+    throw error;
+  }
   if (domains.length === 0) {
     context.output.result({ projectId, domains, ready: false }, [
       "No custom domains. Add one with `naro domains add example.com`."
@@ -4685,7 +4746,7 @@ async function runDomainsVerify(context, overrides = {}) {
     const cause = notReady[0]?.cause;
     throw new NaroError(
       cause?.code ?? "DOMAIN_NOT_READY",
-      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} Add the records above, then run \`naro domains verify --wait\`.`,
+      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} naro connects it within about five minutes of the CNAME appearing; \`naro domains verify --wait\` waits for it.`,
       { details }
     );
   }
@@ -5337,7 +5398,7 @@ function meterLines(info) {
   }
   if (today.bytesBlocked)
     lines.push(
-      today.measuredBytes === null ? `\u2717 Uploads are stopped: the bucket is at the storage limit of ${binarySize(limits.bytes)}. Delete objects; uploads reopen after the next measurement (usually within an hour).` : `\u2717 Uploads are stopped: R2 holds ${binarySize(today.measuredBytes, 2)} of ${binarySize(limits.bytes)}. Delete objects; uploads reopen after the next measurement (usually within an hour).`
+      today.measuredBytes === null ? `\u2717 Uploads are stopped: the bucket is at the storage limit of ${binarySize(limits.bytes)}. Delete objects; uploads reopen after the next measurement (usually within an hour and a half).` : `\u2717 Uploads are stopped: R2 holds ${binarySize(today.measuredBytes, 2)} of ${binarySize(limits.bytes)}. Delete objects; uploads reopen after the next measurement (usually within an hour and a half).`
     );
   if (today.opsBlocked)
     lines.push(
@@ -5362,7 +5423,7 @@ function storageLines(info) {
   const { limits, usage } = info;
   return [
     `Storage:     on (R2 bucket ${printable(info.bucket ?? "unknown")})`,
-    `Limits:      ${binarySize(limits.bytes)} in all, ${binarySize(limits.objectBytes)} per object, ${binarySize(limits.singleUploadBytes)} per upload`,
+    `Limits:      ${binarySize(limits.bytes)} in all, ${binarySize(limits.objectBytes)} per object, ${binarySize(limits.singleUploadBytes)} per request (larger files go in parts)`,
     usage === null ? "Used:        not known yet: the backend is not ready (`naro backend` shows where it got to)" : `Used:        ${binarySize(usage.bytes)} in ${count(usage.objects, "object")}`,
     ...meterLines(info),
     info.buckets.length === 0 ? "Buckets:     none yet (`naro storage bucket create <name>` makes one)" : `Buckets:     ${String(info.buckets.length)}`,
@@ -5549,6 +5610,12 @@ function requestTimeout(ms) {
     message: `The Naro backend did not answer within ${String(Math.round(ms / 1e3))} seconds. Check the network and try again.`
   };
 }
+function uploadAborted() {
+  return {
+    code: "ABORTED",
+    message: "The upload was stopped before it finished."
+  };
+}
 function invalidResponse(status) {
   return {
     code: "INVALID_RESPONSE",
@@ -5662,7 +5729,10 @@ async function call(config, options) {
     }
   }
   const token = options.withToken ? await config.tokens.get() : null;
-  const headers = { apikey: config.apiKey };
+  const headers = {
+    ...options.headers,
+    apikey: config.apiKey
+  };
   if (token !== null) headers.Authorization = `Bearer ${token}`;
   const init = {
     method: options.method,
@@ -5714,6 +5784,12 @@ async function send(config, options) {
     credentials: "omit"
   };
   if (options.body !== void 0) init.body = options.body;
+  const { signal } = options;
+  if (signal?.aborted) return { error: uploadAborted(), status: null };
+  const controller = signal ? new AbortController() : null;
+  const stop = () => controller?.abort();
+  if (controller) init.signal = controller.signal;
+  signal?.addEventListener("abort", stop);
   let response;
   try {
     const fetchImpl = config.fetch ?? globalThis.fetch;
@@ -5722,26 +5798,34 @@ async function send(config, options) {
       init
     );
   } catch (error2) {
-    return { error: networkError(error2) };
+    return {
+      error: signal?.aborted ? uploadAborted() : networkError(error2),
+      status: null
+    };
+  } finally {
+    signal?.removeEventListener("abort", stop);
   }
-  if (response.status >= 200 && response.status < 300)
-    return { error: null, response };
+  const { status } = response;
+  if (status >= 200 && status < 300) return { error: null, response };
   let text;
   try {
     text = await response.text();
   } catch (error2) {
-    return { error: networkError(error2) };
+    return { error: networkError(error2), status: null };
   }
   let body;
   if (text.trim() !== "") {
     try {
       body = JSON.parse(text);
     } catch {
-      return { error: invalidResponse(response.status) };
+      return { error: invalidResponse(status), status };
     }
   }
-  const error = errorFromBody(response.status, body) ?? invalidResponse(response.status);
-  return { error: await settled(config, error, response.headers, token) };
+  const error = errorFromBody(status, body) ?? invalidResponse(status);
+  return {
+    error: await settled(config, error, response.headers, token),
+    status
+  };
 }
 var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "RATE_LIMITED",
@@ -7312,12 +7396,187 @@ var TableBuilder = class {
     });
   }
 };
+function fail(error) {
+  return { data: null, error };
+}
+var isUploadResult = (value) => isRecord(value) && typeof value.id === "string" && typeof value.path === "string" && typeof value.fullPath === "string";
+function dataOf2(status, body, guard) {
+  if (isRecord(body) && Object.hasOwn(body, "data") && guard(body.data))
+    return { data: body.data, error: null };
+  return fail(invalidResponse(status));
+}
+async function readJson(response, guard) {
+  let text;
+  try {
+    text = await response.text();
+  } catch (error) {
+    return fail(networkError(error));
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    return fail(invalidResponse(response.status));
+  }
+  return dataOf2(response.status, body, guard);
+}
+var ROUTE = "/storage/upload/multipart";
+var UPLOAD_TOKEN_HEADER = "x-naro-upload-token";
+var CONCURRENCY = 4;
+var ATTEMPTS = 4;
+var BACKOFF_MS = [1e3, 2e3, 4e3];
+var UPLOAD_ID = /^[\w-][\w.-]*$/;
+var positive = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+var planFor = (size) => (value) => isRecord(value) && typeof value.uploadId === "string" && UPLOAD_ID.test(value.uploadId) && positive(value.partSize) && positive(value.partCount) && (value.partCount - 1) * value.partSize < size && value.partCount * value.partSize >= size;
+var partAnswer = (n) => (value) => isRecord(value) && value.partNumber === n && typeof value.etag === "string" && value.etag !== "";
+var retryable = (error, status) => error.code === "NETWORK_ERROR" || error.code === "OBJECT_RATE_LIMITED" || status !== null && status >= 500 && error.code !== "STORAGE_QUOTA_EXCEEDED";
+function waitAfter(error, attempt22) {
+  const after = isRecord(error.details) ? error.details.retryAfter : void 0;
+  if (typeof after === "number") return after * 1e3;
+  if (error.code === "OBJECT_RATE_LIMITED") return 1e3;
+  return BACKOFF_MS[attempt22 - 1] ?? 4e3;
+}
+var sleepFor = (ms, signal) => new Promise((done) => {
+  if (signal?.aborted) {
+    done();
+    return;
+  }
+  const end = () => {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", end);
+    done();
+  };
+  const timer = setTimeout(end, ms);
+  signal?.addEventListener("abort", end);
+});
+async function uploadInParts(a) {
+  const { signal } = a;
+  const sleep2 = a.sleep ?? sleepFor;
+  const signed = a.uploadToken === void 0 ? {} : { [UPLOAD_TOKEN_HEADER]: a.uploadToken };
+  const withToken = a.uploadToken === void 0;
+  if (signal?.aborted) return fail(uploadAborted());
+  const started = await call(a.http, {
+    method: a.method,
+    path: ROUTE,
+    body: {
+      bucket: a.bucket,
+      path: a.path,
+      size: a.size,
+      contentType: a.contentType,
+      cacheControl: a.cacheControl,
+      // PUT always replaces: the worker refuses `upsert` on it.
+      ...a.method === "POST" && a.upsert ? { upsert: true } : {}
+    },
+    headers: signed,
+    withToken
+  });
+  if (started.error !== null) return fail(started.error);
+  const plan = dataOf2(
+    started.answer.status,
+    started.answer.body,
+    planFor(a.size)
+  );
+  if (plan.error !== null) return fail(plan.error);
+  const { uploadId, partSize, partCount } = plan.data;
+  const base = `${ROUTE}/${uploadId}`;
+  const progress = (sentBytes2) => {
+    if (signal?.aborted) return;
+    try {
+      const result = a.onProgress?.(sentBytes2, a.size);
+      if (isThenable(result)) result.then(void 0, () => void 0);
+    } catch {
+    }
+  };
+  const callOff = async () => {
+    await call(a.http, {
+      method: "DELETE",
+      path: base,
+      headers: signed,
+      withToken
+    }).catch(() => void 0);
+  };
+  const etags = [];
+  const failure = {
+    error: signal?.aborted ? uploadAborted() : null
+  };
+  let next = 1;
+  let sentBytes = 0;
+  const onAbort = () => {
+    failure.error ??= uploadAborted();
+  };
+  const tryPart = async (n, bytes) => {
+    const sent = await send(a.http, {
+      method: "PUT",
+      path: `${base}/${String(n)}`,
+      headers: { "content-type": "application/octet-stream", ...signed },
+      body: bytes,
+      withToken,
+      signal
+    });
+    if (sent.error !== null) return sent;
+    const read = await readJson(sent.response, partAnswer(n));
+    if (read.error !== null)
+      return { error: read.error, status: sent.response.status };
+    return { etag: read.data.etag };
+  };
+  const sendPart = async (n) => {
+    const from = (n - 1) * partSize;
+    const to = Math.min(from + partSize, a.size);
+    const bytes = a.body instanceof Uint8Array ? a.body.subarray(from, to) : a.body.slice(from, to);
+    for (let attempt22 = 1; ; attempt22 += 1) {
+      const tried = await tryPart(n, bytes);
+      if ("etag" in tried) {
+        etags[n - 1] = tried.etag;
+        sentBytes += to - from;
+        progress(sentBytes);
+        return null;
+      }
+      if (attempt22 === ATTEMPTS || failure.error !== null || !retryable(tried.error, tried.status))
+        return tried.error;
+      await sleep2(waitAfter(tried.error, attempt22), signal);
+      if (failure.error !== null) return tried.error;
+    }
+  };
+  const worker = async () => {
+    while (failure.error === null && next <= partCount) {
+      const n = next;
+      next += 1;
+      const error = await sendPart(n);
+      if (error !== null) failure.error ??= error;
+    }
+  };
+  signal?.addEventListener("abort", onAbort);
+  await Promise.all(
+    Array.from({ length: Math.min(CONCURRENCY, partCount) }, worker)
+  );
+  signal?.removeEventListener("abort", onAbort);
+  if (failure.error !== null) {
+    await callOff();
+    return fail(failure.error);
+  }
+  const completed = await call(a.http, {
+    method: "POST",
+    path: `${base}/complete`,
+    body: {
+      parts: etags.map((etag, i) => ({ partNumber: i + 1, etag }))
+    },
+    headers: signed,
+    withToken
+  });
+  if (completed.error !== null) {
+    if (completed.answer !== null && completed.error.code !== "INVALID_RESPONSE")
+      await callOff();
+    return fail(completed.error);
+  }
+  return dataOf2(completed.answer.status, completed.answer.body, isUploadResult);
+}
+var isThenable = (value) => typeof value === "object" && value !== null && typeof value.then === "function";
 var MAX_SINGLE_UPLOAD_BYTES2 = 52428800;
 var STORAGE_MESSAGES = {
   bucket: "The bucket name is not valid.",
-  tooLarge: "Uploads over 50 MiB are not supported yet.",
   request: "The storage request is not valid.",
-  body: "upload takes a Blob, File, ArrayBuffer, typed array or string."
+  body: "upload takes a Blob, File, ArrayBuffer, typed array or string.",
+  signature: "The signed URL is not valid."
 };
 var RESERVED_BUCKETS = /* @__PURE__ */ new Set([
   "authenticated",
@@ -7340,9 +7599,6 @@ function invalidPath(reason) {
     message: `The object path is not valid: it ${reason}.`
   };
 }
-function objectTooLarge() {
-  return { code: "OBJECT_TOO_LARGE", message: STORAGE_MESSAGES.tooLarge };
-}
 function encodePath(path) {
   if (typeof path !== "string" || path === "")
     return { ok: false, error: invalidPath("is empty") };
@@ -7379,6 +7635,16 @@ function encodeBucket(bucket) {
     };
   return { ok: true, encoded: encodeURIComponent(bucket) };
 }
+function objectRoute(bucket, path) {
+  const encodedBucket = encodeBucket(bucket);
+  if (!encodedBucket.ok) return encodedBucket;
+  const encodedPath = encodePath(path);
+  if (!encodedPath.ok) return encodedPath;
+  return {
+    ok: true,
+    encoded: `${encodedBucket.encoded}/${encodedPath.encoded}`
+  };
+}
 var isArrayBuffer = (value) => Object.prototype.toString.call(value) === "[object ArrayBuffer]";
 function isDetached(buffer) {
   if (!isArrayBuffer(buffer)) return false;
@@ -7459,36 +7725,25 @@ function payloadOf(body, contentType) {
   };
 }
 var SIGNED_PREFIX = "/_naro/v1/storage/object/sign/";
-function fail(error) {
-  return { data: null, error };
+var SIGNED_UPLOAD_PREFIX = "/_naro/v1/storage/object/upload/sign/";
+var TOKEN_TEXT = /^[\x21-\x7e]+$/;
+var TOKEN_PARAMETER = /([?&]token=)[^&#\s"'<>]*/g;
+function withoutToken(error, token) {
+  const { details } = error;
+  if (!isRecord(details) || typeof details.cause !== "string") return error;
+  let cause = details.cause.replace(TOKEN_PARAMETER, "$1[redacted]");
+  for (const form of [encodeURIComponent(token), token])
+    cause = cause.replaceAll(form, "[redacted]");
+  return { ...error, details: { ...details, cause } };
 }
-var isUploadResult = (value) => isRecord(value) && typeof value.id === "string" && typeof value.path === "string" && typeof value.fullPath === "string";
 var isFileObject = (value) => isRecord(value) && typeof value.id === "string" && typeof value.name === "string" && isRecord(value.metadata);
 var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (value.id === null || isFileObject(value));
 var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
+var isSignedUpload = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_UPLOAD_PREFIX) && typeof value.token === "string" && value.token !== "" && typeof value.path === "string";
+var partsBody = (body) => isArrayBuffer(body) ? new Uint8Array(body) : body;
 function listOf(guard) {
   return (value) => Array.isArray(value) && value.every(guard);
 }
-function dataOf2(status, body, guard) {
-  if (isRecord(body) && Object.hasOwn(body, "data") && guard(body.data))
-    return { data: body.data, error: null };
-  return fail(invalidResponse(status));
-}
-async function readJson(response, guard) {
-  let text;
-  try {
-    text = await response.text();
-  } catch (error) {
-    return fail(networkError(error));
-  }
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch {
-    return fail(invalidResponse(response.status));
-  }
-  return dataOf2(response.status, body, guard);
-}
 var StorageFileApi = class {
   #http;
   #auth;
@@ -7500,14 +7755,9 @@ var StorageFileApi = class {
   }
   /** `/storage/object/<route><bucket>/<path>`, or the refusal no request needs. */
   #objectPath(route2, path) {
-    const bucket = encodeBucket(this.#bucket);
-    if (!bucket.ok) return bucket;
-    const name = encodePath(path);
-    if (!name.ok) return name;
-    return {
-      ok: true,
-      path: `/storage/object/${route2}${bucket.encoded}/${name.encoded}`
-    };
+    const target = objectRoute(this.#bucket, path);
+    if (!target.ok) return target;
+    return { ok: true, path: `/storage/object/${route2}${target.encoded}` };
   }
   /** `/storage/object/<route><bucket>`, for the routes that take names in the body. */
   #bucketPath(route2) {
@@ -7529,8 +7779,23 @@ var StorageFileApi = class {
     const cache = `max-age=${options.cacheControl ?? "3600"}`;
     const unreadable = headerProblem(options.contentType, cache);
     if (unreadable !== null) return fail(unreadable);
-    if (payload.size > MAX_SINGLE_UPLOAD_BYTES2) return fail(objectTooLarge());
+    const { signal } = options;
+    if (signal?.aborted) return fail(uploadAborted());
     await this.#auth.ready();
+    if (payload.size > MAX_SINGLE_UPLOAD_BYTES2)
+      return uploadInParts({
+        http: this.#http,
+        method,
+        bucket: this.#bucket,
+        path,
+        body: partsBody(payload.body),
+        size: payload.size,
+        contentType: payload.type,
+        cacheControl: cache,
+        upsert,
+        ...options.onProgress ? { onProgress: options.onProgress } : {},
+        signal
+      });
     const headers = {
       "content-type": payload.type,
       "cache-control": cache
@@ -7541,7 +7806,9 @@ var StorageFileApi = class {
       path: target.path,
       headers,
       body: payload.body,
-      withToken: true
+      withToken: true,
+      // The fetch stops with the body: the worker undoes its claim at once.
+      signal
     });
     if (sent.error !== null) return fail(sent.error);
     return readJson(sent.response, isUploadResult);
@@ -7649,6 +7916,101 @@ var StorageFileApi = class {
       error: null
     };
   }
+  /**
+   * A token that lets whoever holds it upload `path` for two hours (Storage
+   * 3-1e-2), as supabase-js's: made where the key is — a server with the
+   * service key for any path, anon or a signed-in user only where the
+   * policies let them upload. With `upsert: true` it may replace a file
+   * that is there.
+   * The token goes to `uploadToSignedUrl`; `signedUrl` is where a client
+   * without naro-js PUTs the bytes.
+   */
+  async createSignedUploadUrl(path, options = {}) {
+    const target = this.#objectPath("upload/sign/", path);
+    if (!target.ok) return fail(target.error);
+    const upsert = (options ?? {}).upsert === true;
+    const signed = await this.#json(
+      {
+        method: "POST",
+        path: target.path,
+        body: upsert ? { upsert: true } : {}
+      },
+      isSignedUpload
+    );
+    if (signed.error !== null) return signed;
+    return {
+      data: {
+        signedUrl: `${this.#http.baseUrl}${signed.data.signedUrl}`,
+        token: signed.data.token,
+        path: signed.data.path
+      },
+      error: null
+    };
+  }
+  /**
+   * Uploads `body` to `path` with a token from `createSignedUploadUrl`
+   * (Storage 3-1e-2). No session is sent, or needed: the token is the
+   * permission, so a page's anon-key client uploads where only a server
+   * could sign. It works until the token expires, two hours from when it
+   * was made; one made without `upsert` uploads one new file
+   * (`OBJECT_EXISTS` for a name that is there). A body over 50 MiB goes in
+   * parts with the token on every step, and once started may finish after
+   * the two hours. `contentType`, `cacheControl`, `onProgress` and `signal`
+   * are `upload`'s.
+   */
+  async uploadToSignedUrl(path, token, body, options = {}) {
+    const given = options ?? {};
+    const target = this.#objectPath("upload/sign/", path);
+    if (!target.ok) return fail(target.error);
+    if (typeof token !== "string" || !TOKEN_TEXT.test(token))
+      return fail({
+        code: "INVALID_SIGNATURE",
+        message: STORAGE_MESSAGES.signature
+      });
+    const payload = payloadOf(body, given.contentType);
+    if (!payload.ok) return fail(payload.error);
+    const cache = `max-age=${given.cacheControl ?? "3600"}`;
+    const unreadable = headerProblem(given.contentType, cache);
+    if (unreadable !== null) return fail(unreadable);
+    const { signal } = given;
+    if (signal?.aborted) return fail(uploadAborted());
+    const uploaded = payload.size > MAX_SINGLE_UPLOAD_BYTES2 ? await uploadInParts({
+      http: this.#http,
+      method: "POST",
+      bucket: this.#bucket,
+      path,
+      body: partsBody(payload.body),
+      size: payload.size,
+      contentType: payload.type,
+      cacheControl: cache,
+      upsert: false,
+      uploadToken: token,
+      ...given.onProgress ? { onProgress: given.onProgress } : {},
+      signal
+    }) : await this.#putSigned(target.path, token, payload, cache, signal);
+    if (uploaded.error !== null) return fail(uploaded.error);
+    return {
+      data: { path: uploaded.data.path, fullPath: uploaded.data.fullPath },
+      error: null
+    };
+  }
+  /**
+   * The one-request signed upload: the token in the query, no session — it
+   * is the permission. A failure's cause never carries the token.
+   */
+  async #putSigned(path, token, payload, cache, signal) {
+    const sent = await send(this.#http, {
+      method: "PUT",
+      path: `${path}?token=${encodeURIComponent(token)}`,
+      headers: { "content-type": payload.type, "cache-control": cache },
+      body: payload.body,
+      withToken: false,
+      signal
+    });
+    if (sent.error !== null) return fail(withoutToken(sent.error, token));
+    const read = await readJson(sent.response, isUploadResult);
+    return read.error === null ? read : fail(withoutToken(read.error, token));
+  }
   /**
    * A public bucket's URL for the object. No request is made, so whether
    * the bucket is public is not checked (as in supabase-js); a path no URL
@@ -7787,6 +8149,7 @@ var CP_USAGE = "Usage: naro storage cp <from> <to> (one side naro://<bucket>/<pa
 var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
 var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]";
 var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
+var FOUR_GIB = 4294967296;
 var PAGE = 1e3;
 var MAX_OFFSET = 1e5;
 var TRUNCATED_WARNING = `\u26A0 A folder's listing stopped at ${(MAX_OFFSET + PAGE).toLocaleString("en-US")} entries, as far as the API's offset reaches; there may be more.`;
@@ -7889,7 +8252,8 @@ async function objects(context) {
       { cause: error }
     );
   }
-  return { projectId, storage: naro.storage };
+  const url = new URL(backend.url.trim().replace(/\/+$/, "")).origin;
+  return { projectId, storage: naro.storage, url, serviceKey };
 }
 function isFolder(entry) {
   return entry.id === null;
@@ -7982,33 +8346,56 @@ async function storageLs(context) {
   );
 }
 var INTERRUPTS = ["SIGINT", "SIGTERM", "SIGHUP"];
-function removeOnInterrupt(partial) {
-  const stop = () => {
+function endWith(signal) {
+  try {
+    process.kill(process.pid, signal);
+  } catch {
+    process.exit(1);
+  }
+}
+function onInterrupt(onSignal) {
+  for (const signal of INTERRUPTS) process.on(signal, onSignal);
+  return () => {
     for (const signal of INTERRUPTS) process.off(signal, onSignal);
   };
-  function onSignal(signal) {
+}
+function removeOnInterrupt(partial) {
+  const stop = onInterrupt((signal) => {
     stop();
     try {
       rmSync2(partial, { force: true });
     } catch {
     }
-    try {
-      process.kill(process.pid, signal);
-    } catch {
-      process.exit(1);
-    }
-  }
-  for (const signal of INTERRUPTS) process.on(signal, onSignal);
+    endWith(signal);
+  });
   return stop;
 }
-async function writeAtomically(blob, destination) {
+function stopOnInterrupt(onFirst) {
+  const controller = new AbortController();
+  let caught = null;
+  const stop = onInterrupt((signal) => {
+    if (caught !== null) {
+      stop();
+      endWith(signal);
+      return;
+    }
+    caught = signal;
+    onFirst();
+    controller.abort();
+  });
+  return {
+    signal: controller.signal,
+    settle: () => {
+      stop();
+      return caught;
+    }
+  };
+}
+async function writeAtomically(bytes, destination) {
   const partial = join6(dirname3(destination), `.${randomUUID()}.naro-partial`);
   const stopListening = removeOnInterrupt(partial);
   try {
-    await pipeline2(
-      Readable.fromWeb(blob.stream()),
-      createWriteStream2(partial, { flags: "wx" })
-    );
+    await pipeline2(bytes, createWriteStream2(partial, { flags: "wx" }));
     await rename(partial, destination);
   } catch (error) {
     await rm(partial, { force: true }).catch(() => void 0);
@@ -8017,6 +8404,34 @@ async function writeAtomically(blob, destination) {
     stopListening();
   }
 }
+function progressReporter(output, total) {
+  const tty = process.stderr.isTTY === true;
+  let lastTenth = -1;
+  let lastLength = 0;
+  let open = false;
+  return {
+    report(sent) {
+      const percent2 = Math.floor(sent / total * 100);
+      const line = `\u2191 ${binarySize(sent)} / ${binarySize(total)} (${String(percent2)}%)`;
+      if (tty) {
+        open = sent !== total;
+        output.progress(`\r${line.padEnd(lastLength)}${open ? "" : "\n"}`);
+        lastLength = line.length;
+        return;
+      }
+      const tenth = Math.floor(percent2 / 10);
+      if (tenth === lastTenth && sent !== total) return;
+      lastTenth = tenth;
+      output.progress(`${line}
+`);
+    },
+    close() {
+      if (!open) return;
+      open = false;
+      output.progress("\n");
+    }
+  };
+}
 async function upload(context, local, target) {
   const file = resolve5(context.cwd, local);
   const info = await stat(file).catch(() => null);
@@ -8035,32 +8450,49 @@ async function upload(context, local, target) {
       "VALIDATION_FAILED",
       `${printable(local)} is not a regular file.`
     );
-  if (info.size > MAX_SINGLE_UPLOAD_BYTES)
-    throw new NaroError(
-      "OBJECT_TOO_LARGE",
-      dataError("OBJECT_TOO_LARGE", { single: true }).message
-    );
   const { cacheControl } = context.flags;
   if (cacheControl !== void 0 && !isMaxAge(cacheControl))
     throw new NaroError("VALIDATION_FAILED", CACHE_CONTROL_RULE);
   const path = target.path === "" || target.path.endsWith("/") ? `${target.path}${basename2(file)}` : target.path;
-  const { projectId, storage } = await objects(context);
   const body = await openAsBlob(file);
+  if (body.size !== info.size)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      info.size >= FOUR_GIB ? `${printable(local)} is ${binarySize(info.size)}, but Node reads it as ${binarySize(body.size)}: naro storage cp cannot upload a file of 4 GiB or more yet.` : `${printable(local)} changed while it was being opened (${binarySize(info.size)}, then ${binarySize(body.size)}). Run the copy again once nothing is writing to it.`
+    );
+  const { projectId, storage } = await objects(context);
   const contentType = context.flags.contentType ?? typeFor(file);
-  const result = unwrap(
-    await storage.from(target.bucket).upload(path, body, {
+  const progress = body.size > MAX_SINGLE_UPLOAD_BYTES && !context.output.json ? progressReporter(context.output, body.size) : void 0;
+  const interrupt = stopOnInterrupt(() => {
+    progress?.close();
+    context.output.progress("Stopping the upload\u2026\n");
+  });
+  let answer;
+  let caught;
+  try {
+    answer = await storage.from(target.bucket).upload(path, body, {
       ...contentType === void 0 ? {} : { contentType },
       ...cacheControl === void 0 ? {} : { cacheControl },
-      upsert: context.flags.upsert === true
-    })
-  );
-  const to = `${NARO_SCHEME}${target.bucket}/${path}`;
-  context.output.result(
-    { projectId, from: local, to, bytes: body.size, id: result.id },
-    [
-      `\u2705 Uploaded ${printable(local)} \u2192 ${printable(to)} (${binarySize(body.size)})`
-    ]
-  );
+      upsert: context.flags.upsert === true,
+      ...progress === void 0 ? {} : { onProgress: progress.report },
+      signal: interrupt.signal
+    });
+  } finally {
+    progress?.close();
+    caught = interrupt.settle();
+  }
+  try {
+    const result = unwrap(answer);
+    const to = `${NARO_SCHEME}${target.bucket}/${path}`;
+    context.output.result(
+      { projectId, from: local, to, bytes: body.size, id: result.id },
+      [
+        `\u2705 Uploaded ${printable(local)} \u2192 ${printable(to)} (${binarySize(body.size)})`
+      ]
+    );
+  } finally {
+    if (caught !== null) endWith(caught);
+  }
 }
 var WINDOWS_DEVICE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
 var MAX_FILE_NAME_BYTES = 255;
@@ -8073,6 +8505,62 @@ function savedAs(path) {
     );
   return name;
 }
+var NETWORK_MESSAGE = "The request did not reach the Naro backend. Check the url and the network.";
+async function failureOf(response) {
+  const { status } = response;
+  const invalid = {
+    code: "INVALID_RESPONSE",
+    message: `The server did not answer like a Naro backend (HTTP ${String(status)}).`,
+    details: { status }
+  };
+  let text;
+  try {
+    text = await response.text();
+  } catch {
+    return { code: "NETWORK_ERROR", message: NETWORK_MESSAGE };
+  }
+  let body;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      return invalid;
+    }
+  }
+  const error = typeof body === "object" && body !== null && "error" in body ? body.error : void 0;
+  if (typeof error !== "object" || error === null) return invalid;
+  const { code, message, details } = error;
+  if (typeof code !== "string" || code === "" || typeof message !== "string")
+    return invalid;
+  return details === void 0 ? { code, message } : { code, message, details };
+}
+async function getObject(url, serviceKey) {
+  let response;
+  try {
+    response = await fetch(url, {
+      headers: { apikey: serviceKey },
+      redirect: "error"
+    });
+  } catch {
+    throw new NaroError("NETWORK_ERROR", NETWORK_MESSAGE);
+  }
+  if (response.ok) return response;
+  return unwrap({ data: null, error: await failureOf(response) });
+}
+async function* chunksOf2(response, received) {
+  if (response.body === null) return;
+  try {
+    for await (const chunk2 of Readable.fromWeb(
+      response.body
+    )) {
+      const bytes = chunk2;
+      received.bytes += bytes.byteLength;
+      yield bytes;
+    }
+  } catch {
+    throw new NaroError("NETWORK_ERROR", NETWORK_MESSAGE);
+  }
+}
 async function download(context, source, local) {
   if (source.path === "" || source.path.endsWith("/"))
     throw new NaroError(
@@ -8088,14 +8576,20 @@ async function download(context, source, local) {
       "VALIDATION_FAILED",
       `Cannot save to ${printable(local)}: its folder does not exist.`
     );
-  const { projectId, storage } = await objects(context);
-  const blob = unwrap(await storage.from(source.bucket).download(source.path));
-  await writeAtomically(blob, destination);
+  const route2 = objectRoute(source.bucket, source.path);
+  if (!route2.ok) throw new NaroError(route2.error.code, route2.error.message);
+  const { projectId, url, serviceKey } = await objects(context);
+  const response = await getObject(
+    `${url}/_naro/v1/storage/object/${route2.encoded}`,
+    serviceKey
+  );
+  const received = { bytes: 0 };
+  await writeAtomically(chunksOf2(response, received), destination);
   const from = `${NARO_SCHEME}${source.bucket}/${source.path}`;
   context.output.result(
-    { projectId, from, to: destination, bytes: blob.size },
+    { projectId, from, to: destination, bytes: received.bytes },
     [
-      `\u2705 Downloaded ${printable(from)} \u2192 ${printable(destination)} (${binarySize(blob.size)})`
+      `\u2705 Downloaded ${printable(from)} \u2192 ${printable(destination)} (${binarySize(received.bytes)})`
     ]
   );
 }
@@ -8388,8 +8882,9 @@ Usage:
   naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]
                                      The buckets, or the folders and objects under a prefix
   naro storage cp <from> <to> [--upsert] [--content-type <t>] [--cache-control <seconds>]
-                                     One file between this machine and naro://<bucket>/<path>, 50 MiB at most,
+                                     One file between this machine and naro://<bucket>/<path>, up to the object limit (over 50 MiB in parts),
                                      with the project's service key (NARO_SERVICE_KEY, or fetched with a warning).
+                                     A big upload shows its progress on stderr; a file of 4 GiB or more cannot be uploaded yet.
                                      A download replaces a local file of the same name
   naro storage rm naro://<bucket>/<path>\u2026 [--recursive]
                                      Remove objects; --recursive removes what is under a folder (asks first):