naro-cli 0.16.0 → 0.17.0

package/README.md

@@ -88,7 +88,8 @@ naro env remove DATABASE_URL
 naro env pull [.env.local]
 
 naro domains list
-naro domains add www.example.com   Prints the DNS records to create
+naro domains add www.example.com   Prints the CNAME to create; naro connects
+                                   it within ~5 minutes of the record appearing
 naro domains add example.com       Apex: also connects www.example.com and
                                    redirects the apex to it (--no-www to skip)
 naro domains verify [host]         Re-check DNS now and print what is missing
@@ -190,8 +191,9 @@ naro rollback [deployment-id]      Back to the previous production build
 ```
 
 `naro domains list` reads the stored status; `naro domains verify` is the one
-that asks Cloudflare and the DNS again, so it is what turns a stuck "pending"
-into the reason it is stuck. It exits non-zero while a domain is not live —
+that asks the DNS and Cloudflare again — and registers the domain on the spot
+once its CNAME points at naro — so it is what turns a stuck "pending" into the
+reason it is stuck. It exits non-zero while a domain is not live —
 with or without `--wait` — so CI can gate on it:
 
 ```bash
@@ -203,6 +205,15 @@ An apex (`example.com`) is added as a pair by default because most registrars
 goes on `www.example.com` and the apex answers with a 308 redirect to it.
 `--no-www` registers the apex alone.
 
+A domain another naro project already has is not refused. `naro domains add`
+fails with `DOMAIN_VERIFICATION_REQUIRED`, and the message names a TXT record:
+`_naro-verify.<host>` with the value `naro-verify=<token>`. Create it, then run
+`naro domains verify <host>`. Once the record is visible, the domain moves to
+this project. After that, the CNAME is added as usual. Add the TXT record
+before the CNAME: until the move, the other project still serves the domain.
+The check lasts 7 days. `naro domains list` shows open checks with their
+expiry, and adding the domain again prints the same token.
+
 `naro db dump` asks Cloudflare for the dump and streams it straight from
 Cloudflare's storage to the file — the bytes never pass through naro. While the
 export runs, Cloudflare holds every other query to the database, so dump a busy
@@ -793,6 +804,27 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.17.0
+
+- `naro domains add` prints one CNAME record and no TXT records. naro
+  registers the domain once the CNAME points at it, usually within about five
+  minutes. The status line reads `Waiting for DNS — add the CNAME above; naro
+connects it within about five minutes.` `naro domains verify` registers it at
+  once.
+- A domain another project holds now gets an ownership check instead of
+  `DOMAIN_EXISTS` (see the `naro domains` notes under Commands). `naro domains verify <host>`
+  reads the TXT record and moves the domain here. `naro domains list` shows
+  open checks under `Ownership checks (n):`. Against a control plane that
+  predates ownership checks, list shows none.
+- A control plane without custom domains set up answers domain changes with
+  `503 DOMAINS_NOT_CONFIGURED` (`Custom domains are not configured on this
+server.`), and the CLI prints that message. Before, the CLI got a 500.
+- `naro deploy` builds Next.js apps that use npm faster:
+  - A second build candidate copies the installed packages instead of
+    installing them again.
+  - npm's audit and funding notices are off during the build. A project
+    `.npmrc` that turns audit on still wins.
+
 ### 0.16.0
 
 - `naro storage cp` uploads a file up to the object limit, under 4 GiB. Over

package/dist/{chunk-XNT7SINN.js → chunk-PYRN5XR6.js}

@@ -5,9 +5,9 @@ import {
 
 // src/deploy.ts
 import { existsSync as existsSync7 } from "fs";
-import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm3 } from "fs/promises";
+import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm4 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname4, join as join24, resolve as resolve10 } from "path";
+import { basename as basename3, dirname as dirname5, join as join24, resolve as resolve10 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -102,7 +102,7 @@ var ERROR_CODE = {
   deps: "INSTALL_FAILED",
   next: "BUILD_FAILED"
 };
-async function computeDepsCacheKey(checkoutDir, packageManager) {
+async function computeDepsCacheKey(checkoutDir, packageManager, extra = []) {
   for (const name of LOCKFILES) {
     let content;
     try {
@@ -110,7 +110,10 @@ async function computeDepsCacheKey(checkoutDir, packageManager) {
     } catch {
       continue;
     }
-    const hash2 = createHash("sha256").update(name).update("\n").update(content).digest("hex");
+    const hasher = createHash("sha256").update(name).update("\n").update(content);
+    if (extra.length > 0) hasher.update(`
+${extra.join("\n")}`);
+    const hash2 = hasher.digest("hex");
     return `${packageManager}-${hash2}`;
   }
   return null;
@@ -262,9 +265,9 @@ function hashAsset(data, contentType2) {
 }
 
 // ../../packages/build/src/local-build-executor.ts
-import { access as access8, mkdtemp, readFile as readFile12, rm as rm2 } from "fs/promises";
+import { access as access8, mkdtemp, readFile as readFile12, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join17, resolve as resolve7 } from "path";
+import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/route-patterns.ts
 var ROUTE_PATTERN = /^\/[A-Za-z0-9\-._~%!$&()*+,;=:@/[\]]*$/;
@@ -15302,7 +15305,11 @@ function cacheEnv(dir) {
 function withSharedCache(spec, dir) {
   return {
     ...spec,
-    addArgs: (specs) => [...spec.addArgs(specs), ...spec.cacheArgs(dir)],
+    addArgs: (specs) => [
+      ...spec.addArgs(specs),
+      ...spec.sharedCacheAddArgs ?? [],
+      ...spec.cacheArgs(dir)
+    ],
     addEnv: { ...spec.addEnv, ...cacheEnv(dir) }
   };
 }
@@ -15343,7 +15350,24 @@ async function detectPackageManager(root) {
       install: ["npm", "ci"],
       cacheArgs: (dir) => ["--cache", dir],
       // --no-save keeps package.json and the lockfile untouched.
-      addArgs: (specs) => ["npm", "install", "--no-save", ...specs]
+      addArgs: (specs) => ["npm", "install", "--no-save", ...specs],
+      // --prefer-offline takes package metadata from the restored cache instead
+      // of asking the registry again for each of the toolchain's ~160 packages
+      // (npm keeps metadata in the same cache, which the deps cache saves).
+      // Measured on one vCPU like the build container: 8.8 s → 7.9 s locally,
+      // and the live add took 17 s against 8.8 s here — the gap is registry
+      // round trips.
+      //
+      // npm trusts cached metadata outright: a cached packument that lacks the
+      // asked-for version fails with ETARGET instead of being fetched again
+      // (pacote leaves that revalidation as a TODO). That cannot happen in the
+      // build's own cache because its key carries the toolchain
+      // (computeDepsCacheKey): a toolchain bump starts from an empty cache, and
+      // the cache restored under a key was filled by this same add over the
+      // same lockfile. A machine's default cache has no such key, so without
+      // the build cache (no zstd, no transport — mostly the CLI) the add stays
+      // online (PR #134 review).
+      sharedCacheAddArgs: ["--prefer-offline"]
     };
   }
   if (await exists(join2(root, "yarn.lock"))) {
@@ -15691,14 +15715,18 @@ async function pathExists(path) {
     return false;
   }
 }
+var BUILD_NPMRC = [
+  "# Host package-manager credentials are intentionally unavailable.",
+  "audit=false",
+  "fund=false",
+  "update-notifier=false",
+  ""
+].join("\n");
 async function createPackageManagerConfig(appRoot, writer = async (path, contents) => {
   await writeFile3(path, contents, "utf8");
 }) {
   const packageManagerConfigPath = join5(appRoot, ".next-deploy-user.npmrc");
-  await writer(
-    packageManagerConfigPath,
-    "# Host package-manager credentials are intentionally unavailable.\n"
-  );
+  await writer(packageManagerConfigPath, BUILD_NPMRC);
   return packageManagerConfigPath;
 }
 async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
@@ -17964,8 +17992,11 @@ function createVinextCloudflareStrategy(options) {
 }
 
 // ../../packages/build/src/strategy/workspace.ts
-import { cp } from "fs/promises";
-import { basename as basename2, join as join16, relative as relative5, resolve as resolve6 } from "path";
+import { execFile } from "child_process";
+import { cp, mkdir as mkdir2, readdir as readdir4, rm as rm2 } from "fs/promises";
+import { basename as basename2, dirname as dirname3, join as join16, relative as relative5, resolve as resolve6 } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
 var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
 function shouldCopy(path) {
   const name = basename2(path);
@@ -17980,6 +18011,33 @@ async function copyCheckout(source, target2) {
     filter: (path) => resolve6(path) === origin || shouldCopy(path)
   });
 }
+async function copyInstalledPackages(source, target2) {
+  const origin = resolve6(source);
+  const installs = [];
+  const walk2 = async (dir) => {
+    for (const entry of await readdir4(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name === ".git") continue;
+      const path = join16(dir, entry.name);
+      if (entry.name === "node_modules") installs.push(path);
+      else await walk2(path);
+    }
+  };
+  await walk2(origin);
+  for (const install of installs)
+    await copyTree(install, join16(target2, relative5(origin, install)));
+}
+async function copyTree(from, to) {
+  await mkdir2(dirname3(to), { recursive: true });
+  if (process.platform !== "win32") {
+    try {
+      await execFileAsync("cp", ["-a", from, to]);
+      return;
+    } catch {
+      await rm2(to, { recursive: true, force: true });
+    }
+  }
+  await cp(from, to, { recursive: true, verbatimSymlinks: true });
+}
 function forkedAppRoot(checkout, appRoot, forkCheckout) {
   return join16(forkCheckout, relative5(checkout, appRoot));
 }
@@ -18004,7 +18062,7 @@ async function withRouteList(artifact, list, appRoot, observer) {
 }
 var defaultLocalBuildDependencies = {
   createWorkspace: () => mkdtemp(join17(tmpdir(), "next-deploy-build-")),
-  removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
+  removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
   resolveAppRoot,
@@ -18024,6 +18082,7 @@ var defaultLocalBuildDependencies = {
   readVinextArtifact,
   vinextCommand: "vinext",
   forkWorkspace: copyCheckout,
+  copyInstalledPackages,
   collectProjectFacts,
   listNextRoutes,
   hashFingerprintInputs: hashStrategyInputs,
@@ -18045,7 +18104,7 @@ async function readInstalledNextVersion(appRoot, checkout) {
     } catch {
     }
     if (dir === stop) return null;
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -18263,7 +18322,11 @@ var LocalBuildExecutor = class {
         let depsKey = null;
         let depsRestored = false;
         if (cachePorts) {
-          depsKey = await computeDepsCacheKey(checkout, packageManager.name);
+          depsKey = await computeDepsCacheKey(
+            checkout,
+            packageManager.name,
+            isNext ? VINEXT_TOOLCHAIN : []
+          );
           if (depsKey) {
             depsRestored = await tryRestore(
               "deps",
@@ -18348,6 +18411,7 @@ var LocalBuildExecutor = class {
           const fork = this.dependencies.forkWorkspace ?? defaultFork;
           await fork(checkout, pristine);
           let forks = 0;
+          const resolverConcurrency = this.dependencies.resolverConcurrency ?? 1;
           const forkWorkspace = async (label2) => {
             const target2 = join17(
               workspace,
@@ -18355,7 +18419,9 @@ var LocalBuildExecutor = class {
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
             );
             await fork(pristine, target2);
-            await install(target2);
+            if (packageManager.name === "npm" && resolverConcurrency === 1)
+              await (this.dependencies.copyInstalledPackages ?? copyInstalledPackages)(checkout, target2);
+            else await install(target2);
             return {
               checkout: target2,
               appRoot: forkedAppRoot(checkout, appRoot, target2)
@@ -18398,7 +18464,7 @@ var LocalBuildExecutor = class {
             {
               pinned: input.strategy ?? null,
               fingerprint: fingerprint.hash,
-              concurrency: this.dependencies.resolverConcurrency ?? 1,
+              concurrency: resolverConcurrency,
               ...this.dependencies.now ? { now: this.dependencies.now } : {}
             }
           );
@@ -19533,6 +19599,31 @@ var DomainsApi = class {
     const match = await this.findByHostname(projectId, hostname3);
     return this.verify(projectId, match.id, options);
   }
+  /**
+   * Ownership checks the project opened for domains another project holds
+   * (known-issues #156). Adding such a domain fails with
+   * DOMAIN_VERIFICATION_REQUIRED and its check in `details.claim`.
+   */
+  async listClaims(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims`,
+      { context: "List ownership checks" }
+    );
+    return body.claims;
+  }
+  /** Reads the TXT record; when it matches, the domain moves to this project. */
+  async verifyClaim(projectId, claimId) {
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims/${encodeURIComponent(claimId)}/verify`,
+      { method: "POST", body: {}, context: "Verify domain ownership" }
+    );
+  }
+  async removeClaim(projectId, claimId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims/${encodeURIComponent(claimId)}`,
+      { method: "DELETE", context: "Remove ownership check" }
+    );
+  }
   async removeById(projectId, domainId) {
     await this.client.request(
       `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
@@ -20002,6 +20093,14 @@ function bucketFields(fields, into = {}) {
     if (fields[key] !== void 0) into[key] = fields[key];
   return into;
 }
+function listFields(options) {
+  const body = {};
+  if (options.prefix !== void 0) body.prefix = options.prefix;
+  if (options.limit !== void 0) body.limit = options.limit;
+  if (options.offset !== void 0) body.offset = options.offset;
+  if (options.sortBy !== void 0) body.sortBy = options.sortBy;
+  return body;
+}
 var BackendApi = class {
   constructor(client) {
     this.client = client;
@@ -20526,6 +20625,60 @@ var StorageApi = class {
     );
     return { deleted: body.deleted, done: body.done };
   }
+  /**
+   * What is directly below a folder of a bucket — its folders first, by
+   * name, then its files — through the control plane's object proxy
+   * (Storage 3-1e): the project's Naro worker lists it with the stored
+   * service key, so every object is listed whatever the policies say. There
+   * is no search. Needs `storage.manage`, Storage on and the backend on and
+   * ready (`STORAGE_NOT_ENABLED`, `BACKEND_OFF`, `BACKEND_NOT_READY`, 409);
+   * the worker's refusals — `BUCKET_NOT_FOUND`, `INVALID_REQUEST` with
+   * `details.path` and `details.reason` — come through as they are.
+   */
+  async listObjects(projectId, bucket, options = {}) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/list"),
+      { method: "POST", body: listFields(options), context: "List objects" }
+    );
+    return body.objects;
+  }
+  /**
+   * A link that downloads one object without a key, for `expiresIn` seconds
+   * (1–3600 through the control plane; `VALIDATION_FAILED` past it), on the
+   * project's URL. Replacing or deleting the object ends it. The path is
+   * held to the object name rules (`INVALID_PATH`); one not there is the
+   * worker's `OBJECT_NOT_FOUND`.
+   */
+  async signObject(projectId, bucket, path, options) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/sign"),
+      {
+        method: "POST",
+        body: {
+          path,
+          expiresIn: options.expiresIn,
+          // false is no download (supabase-js): left out, since the worker
+          // answers it 400 INVALID_REQUEST — it is not a file name.
+          ...options.download === void 0 || options.download === false ? {} : { download: options.download }
+        },
+        context: "Sign an object URL"
+      }
+    );
+    return { signedUrl: body.signedUrl };
+  }
+  /**
+   * Deletes up to 1,000 objects by their full paths and answers the ones it
+   * deleted, in the order asked: a path not there, or being written, is left
+   * out — not an error (supabase-js's `remove`). A folder is not deleted by
+   * its name; list it and delete what is in it.
+   */
+  async removeObjects(projectId, bucket, prefixes) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects"),
+      { method: "DELETE", body: { prefixes }, context: "Remove objects" }
+    );
+    return body.objects;
+  }
 };
 
 // ../../packages/sdk/src/database.ts
@@ -28135,14 +28288,14 @@ async function promptForMissingEnv(ctx, keys) {
 }
 
 // src/git-info.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 var SUPPORTED_REMOTE = [
   /^https:\/\/[^\s]+$/,
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
 var defaultExec = (args, cwd) => new Promise((resolve11, reject) => {
-  execFile("git", args, { cwd }, (error51, stdout) => {
+  execFile2("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
     else resolve11(stdout);
   });
@@ -28385,11 +28538,11 @@ async function projectName(sourceDir) {
 }
 var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 function resolveBin(name) {
-  let dir = dirname4(fileURLToPath(import.meta.url));
+  let dir = dirname5(fileURLToPath(import.meta.url));
   for (; ; ) {
     const candidate = join24(dir, "node_modules", ".bin", name);
     if (existsSync7(candidate)) return candidate;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return name;
     dir = parent;
   }
@@ -28415,7 +28568,7 @@ async function detectPackageManagerLenient(root) {
 function localDependencies(sourceDir) {
   return {
     createWorkspace: () => mkdtemp2(join24(tmpdir2(), "naro-build-")),
-    removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
+    removeWorkspace: (path) => rm4(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
         const checkout = spec.args.at(-1);

package/dist/deploy.js

@@ -5,7 +5,7 @@ import {
   parseDotenv,
   readProjectEnv,
   slugify
-} from "./chunk-XNT7SINN.js";
+} from "./chunk-PYRN5XR6.js";
 import "./chunk-K3NQKI34.js";
 export {
   deployDirectory,

package/dist/index.js

@@ -82,7 +82,7 @@ import {
   toNaroError,
   unreadablePolicyComment,
   writeProjectLink
-} from "./chunk-XNT7SINN.js";
+} from "./chunk-PYRN5XR6.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -4560,21 +4560,69 @@ function domainLines(domain) {
   }
   return lines;
 }
+function claimLines(claim) {
+  return [
+    `   \u23F3 ${claim.hostname} \u2014 another project holds it. Publish this TXT record, then run \`naro domains verify ${claim.hostname}\`:`,
+    `      TXT ${claim.record.name}`,
+    `        host:  ${claim.record.host}`,
+    `        value: ${claim.record.value}`
+  ];
+}
+async function openClaims(client, projectId) {
+  try {
+    return await client.domains.listClaims(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "NOT_FOUND") return [];
+    throw error;
+  }
+}
 async function runDomainsList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const domains = await client.domains.list(projectId);
+  const claims = await openClaims(client, projectId);
   const pending = domains.filter((domain) => !isReady(domain));
   context.output.result(
-    { projectId, domains },
-    domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
-      `Domains (${String(domains.length)}):`,
-      ...domains.flatMap(domainLines),
+    { projectId, domains, claims },
+    domains.length === 0 && claims.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
+      ...domains.length > 0 ? [
+        `Domains (${String(domains.length)}):`,
+        ...domains.flatMap(domainLines)
+      ] : [],
+      ...claims.length > 0 ? [
+        ...domains.length > 0 ? [""] : [],
+        `Ownership checks (${String(claims.length)}):`,
+        ...claims.flatMap(claimLines)
+      ] : [],
       // list reads our stored copy; only verify goes and looks again.
       ...pending.length > 0 ? ["", "Re-check DNS now: naro domains verify"] : []
     ]
   );
 }
+async function verifyClaimFor(context, client, projectId, hostname) {
+  const wanted = hostname.toLowerCase().replace(/\.+$/, "");
+  const claim = (await openClaims(client, projectId)).find(
+    (candidate) => candidate.hostname === wanted
+  );
+  if (!claim) return false;
+  const result = await client.domains.verifyClaim(projectId, claim.id);
+  if (!result.verified) {
+    const cause = result.claim.cause;
+    throw new NaroError(
+      cause?.code ?? "DOMAIN_VERIFICATION_REQUIRED",
+      cause ? `${cause.message}${cause.fix ? ` ${cause.fix}` : ""}` : `${wanted} is not verified yet.`,
+      { details: { claim: result.claim } }
+    );
+  }
+  context.output.result({ projectId, verified: true, domain: result.domain }, [
+    `\u2705 Ownership of ${result.domain.hostname} verified \u2014 it now belongs to this project.`,
+    "",
+    ...domainLines(result.domain),
+    "",
+    "Status: Waiting for DNS \u2014 add the CNAME above; naro connects it within about five minutes. Check with `naro domains verify`."
+  ]);
+  return true;
+}
 async function runDomainsAdd(context) {
   const [hostname] = context.positionalOrThrow(
     1,
@@ -4608,7 +4656,7 @@ async function runDomainsAdd(context) {
         `   refuses the record above, run \`naro domains add ${alternative}\`.`
       ] : [],
       "",
-      isReady(domain) ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains verify`."
+      isReady(domain) ? "The domain is active." : "Status: Waiting for DNS \u2014 add the CNAME above; naro connects it within about five minutes. Check with `naro domains verify`."
     ]
   );
 }
@@ -4632,7 +4680,14 @@ async function runDomainsVerify(context, overrides = {}) {
   const progress = (line) => {
     if (!context.flags.json) context.output.log(line);
   };
-  let domains = await verifyAll(client, projectId, hostname);
+  let domains;
+  try {
+    domains = await verifyAll(client, projectId, hostname);
+  } catch (error) {
+    if (hostname !== void 0 && isNaroError(error) && error.code === "DOMAIN_NOT_FOUND" && await verifyClaimFor(context, client, projectId, hostname))
+      return;
+    throw error;
+  }
   if (domains.length === 0) {
     context.output.result({ projectId, domains, ready: false }, [
       "No custom domains. Add one with `naro domains add example.com`."
@@ -4691,7 +4746,7 @@ async function runDomainsVerify(context, overrides = {}) {
     const cause = notReady[0]?.cause;
     throw new NaroError(
       cause?.code ?? "DOMAIN_NOT_READY",
-      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} Add the records above, then run \`naro domains verify --wait\`.`,
+      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} naro connects it within about five minutes of the CNAME appearing; \`naro domains verify --wait\` waits for it.`,
       { details }
     );
   }
@@ -5674,7 +5729,10 @@ async function call(config, options) {
     }
   }
   const token = options.withToken ? await config.tokens.get() : null;
-  const headers = { apikey: config.apiKey };
+  const headers = {
+    ...options.headers,
+    apikey: config.apiKey
+  };
   if (token !== null) headers.Authorization = `Bearer ${token}`;
   const init = {
     method: options.method,
@@ -7363,6 +7421,7 @@ async function readJson(response, guard) {
   return dataOf2(response.status, body, guard);
 }
 var ROUTE = "/storage/upload/multipart";
+var UPLOAD_TOKEN_HEADER = "x-naro-upload-token";
 var CONCURRENCY = 4;
 var ATTEMPTS = 4;
 var BACKOFF_MS = [1e3, 2e3, 4e3];
@@ -7393,6 +7452,8 @@ var sleepFor = (ms, signal) => new Promise((done) => {
 async function uploadInParts(a) {
   const { signal } = a;
   const sleep2 = a.sleep ?? sleepFor;
+  const signed = a.uploadToken === void 0 ? {} : { [UPLOAD_TOKEN_HEADER]: a.uploadToken };
+  const withToken = a.uploadToken === void 0;
   if (signal?.aborted) return fail(uploadAborted());
   const started = await call(a.http, {
     method: a.method,
@@ -7406,7 +7467,8 @@ async function uploadInParts(a) {
       // PUT always replaces: the worker refuses `upsert` on it.
       ...a.method === "POST" && a.upsert ? { upsert: true } : {}
     },
-    withToken: true
+    headers: signed,
+    withToken
   });
   if (started.error !== null) return fail(started.error);
   const plan = dataOf2(
@@ -7426,9 +7488,12 @@ async function uploadInParts(a) {
     }
   };
   const callOff = async () => {
-    await call(a.http, { method: "DELETE", path: base, withToken: true }).catch(
-      () => void 0
-    );
+    await call(a.http, {
+      method: "DELETE",
+      path: base,
+      headers: signed,
+      withToken
+    }).catch(() => void 0);
   };
   const etags = [];
   const failure = {
@@ -7443,9 +7508,9 @@ async function uploadInParts(a) {
     const sent = await send(a.http, {
       method: "PUT",
       path: `${base}/${String(n)}`,
-      headers: { "content-type": "application/octet-stream" },
+      headers: { "content-type": "application/octet-stream", ...signed },
       body: bytes,
-      withToken: true,
+      withToken,
       signal
     });
     if (sent.error !== null) return sent;
@@ -7495,7 +7560,8 @@ async function uploadInParts(a) {
     body: {
       parts: etags.map((etag, i) => ({ partNumber: i + 1, etag }))
     },
-    withToken: true
+    headers: signed,
+    withToken
   });
   if (completed.error !== null) {
     if (completed.answer !== null && completed.error.code !== "INVALID_RESPONSE")
@@ -7509,7 +7575,8 @@ var MAX_SINGLE_UPLOAD_BYTES2 = 52428800;
 var STORAGE_MESSAGES = {
   bucket: "The bucket name is not valid.",
   request: "The storage request is not valid.",
-  body: "upload takes a Blob, File, ArrayBuffer, typed array or string."
+  body: "upload takes a Blob, File, ArrayBuffer, typed array or string.",
+  signature: "The signed URL is not valid."
 };
 var RESERVED_BUCKETS = /* @__PURE__ */ new Set([
   "authenticated",
@@ -7658,9 +7725,22 @@ function payloadOf(body, contentType) {
   };
 }
 var SIGNED_PREFIX = "/_naro/v1/storage/object/sign/";
+var SIGNED_UPLOAD_PREFIX = "/_naro/v1/storage/object/upload/sign/";
+var TOKEN_TEXT = /^[\x21-\x7e]+$/;
+var TOKEN_PARAMETER = /([?&]token=)[^&#\s"'<>]*/g;
+function withoutToken(error, token) {
+  const { details } = error;
+  if (!isRecord(details) || typeof details.cause !== "string") return error;
+  let cause = details.cause.replace(TOKEN_PARAMETER, "$1[redacted]");
+  for (const form of [encodeURIComponent(token), token])
+    cause = cause.replaceAll(form, "[redacted]");
+  return { ...error, details: { ...details, cause } };
+}
 var isFileObject = (value) => isRecord(value) && typeof value.id === "string" && typeof value.name === "string" && isRecord(value.metadata);
 var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (value.id === null || isFileObject(value));
 var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
+var isSignedUpload = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_UPLOAD_PREFIX) && typeof value.token === "string" && value.token !== "" && typeof value.path === "string";
+var partsBody = (body) => isArrayBuffer(body) ? new Uint8Array(body) : body;
 function listOf(guard) {
   return (value) => Array.isArray(value) && value.every(guard);
 }
@@ -7708,8 +7788,7 @@ var StorageFileApi = class {
         method,
         bucket: this.#bucket,
         path,
-        // No copy: a Blob stays lazy, a Uint8Array is viewed, an ArrayBuffer wrapped.
-        body: isArrayBuffer(payload.body) ? new Uint8Array(payload.body) : payload.body,
+        body: partsBody(payload.body),
         size: payload.size,
         contentType: payload.type,
         cacheControl: cache,
@@ -7837,6 +7916,101 @@ var StorageFileApi = class {
       error: null
     };
   }
+  /**
+   * A token that lets whoever holds it upload `path` for two hours (Storage
+   * 3-1e-2), as supabase-js's: made where the key is — a server with the
+   * service key for any path, anon or a signed-in user only where the
+   * policies let them upload. With `upsert: true` it may replace a file
+   * that is there.
+   * The token goes to `uploadToSignedUrl`; `signedUrl` is where a client
+   * without naro-js PUTs the bytes.
+   */
+  async createSignedUploadUrl(path, options = {}) {
+    const target = this.#objectPath("upload/sign/", path);
+    if (!target.ok) return fail(target.error);
+    const upsert = (options ?? {}).upsert === true;
+    const signed = await this.#json(
+      {
+        method: "POST",
+        path: target.path,
+        body: upsert ? { upsert: true } : {}
+      },
+      isSignedUpload
+    );
+    if (signed.error !== null) return signed;
+    return {
+      data: {
+        signedUrl: `${this.#http.baseUrl}${signed.data.signedUrl}`,
+        token: signed.data.token,
+        path: signed.data.path
+      },
+      error: null
+    };
+  }
+  /**
+   * Uploads `body` to `path` with a token from `createSignedUploadUrl`
+   * (Storage 3-1e-2). No session is sent, or needed: the token is the
+   * permission, so a page's anon-key client uploads where only a server
+   * could sign. It works until the token expires, two hours from when it
+   * was made; one made without `upsert` uploads one new file
+   * (`OBJECT_EXISTS` for a name that is there). A body over 50 MiB goes in
+   * parts with the token on every step, and once started may finish after
+   * the two hours. `contentType`, `cacheControl`, `onProgress` and `signal`
+   * are `upload`'s.
+   */
+  async uploadToSignedUrl(path, token, body, options = {}) {
+    const given = options ?? {};
+    const target = this.#objectPath("upload/sign/", path);
+    if (!target.ok) return fail(target.error);
+    if (typeof token !== "string" || !TOKEN_TEXT.test(token))
+      return fail({
+        code: "INVALID_SIGNATURE",
+        message: STORAGE_MESSAGES.signature
+      });
+    const payload = payloadOf(body, given.contentType);
+    if (!payload.ok) return fail(payload.error);
+    const cache = `max-age=${given.cacheControl ?? "3600"}`;
+    const unreadable = headerProblem(given.contentType, cache);
+    if (unreadable !== null) return fail(unreadable);
+    const { signal } = given;
+    if (signal?.aborted) return fail(uploadAborted());
+    const uploaded = payload.size > MAX_SINGLE_UPLOAD_BYTES2 ? await uploadInParts({
+      http: this.#http,
+      method: "POST",
+      bucket: this.#bucket,
+      path,
+      body: partsBody(payload.body),
+      size: payload.size,
+      contentType: payload.type,
+      cacheControl: cache,
+      upsert: false,
+      uploadToken: token,
+      ...given.onProgress ? { onProgress: given.onProgress } : {},
+      signal
+    }) : await this.#putSigned(target.path, token, payload, cache, signal);
+    if (uploaded.error !== null) return fail(uploaded.error);
+    return {
+      data: { path: uploaded.data.path, fullPath: uploaded.data.fullPath },
+      error: null
+    };
+  }
+  /**
+   * The one-request signed upload: the token in the query, no session — it
+   * is the permission. A failure's cause never carries the token.
+   */
+  async #putSigned(path, token, payload, cache, signal) {
+    const sent = await send(this.#http, {
+      method: "PUT",
+      path: `${path}?token=${encodeURIComponent(token)}`,
+      headers: { "content-type": payload.type, "cache-control": cache },
+      body: payload.body,
+      withToken: false,
+      signal
+    });
+    if (sent.error !== null) return fail(withoutToken(sent.error, token));
+    const read = await readJson(sent.response, isUploadResult);
+    return read.error === null ? read : fail(withoutToken(read.error, token));
+  }
   /**
    * A public bucket's URL for the object. No request is made, so whether
    * the bucket is public is not checked (as in supabase-js); a path no URL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -33,12 +33,12 @@
     "tsx": "4.23.12",
     "typescript": "7.0.2",
     "vitest": "3.2.7",
-    "naro-js": "0.4.0",
+    "naro-js": "0.5.0",
+    "@next-deploy/config": "0.1.0",
     "@next-deploy/core": "0.1.0",
-    "@next-deploy/data-core": "0.1.0",
-    "@next-deploy/sdk": "0.1.0",
     "@next-deploy/build": "0.1.0",
-    "@next-deploy/config": "0.1.0"
+    "@next-deploy/data-core": "0.1.0",
+    "@next-deploy/sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",