naro-cli 0.19.0 → 0.20.0

package/dist/index.js

@@ -18,14 +18,17 @@ import {
   SPEED_INSIGHTS_METRICS,
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
   STORAGE_OBJECTS_TABLE,
+  STORAGE_SUBQUERIES_SQL,
   buildResetPlan,
   cellText,
+  checkObjectName,
   clearSession,
   commentText,
   compareMigrations,
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
+  dataError,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
@@ -50,7 +53,7 @@ import {
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
-  parseDotenv,
+  parseDotenvDetailed,
   parseGitHubRemote,
   parsePolicyNode,
   parsePolicyStatement,
@@ -60,6 +63,7 @@ import {
   policiesForTypes,
   policiesLostByReset,
   projectPath,
+  promoteTargetUnsupported,
   promptForMissingEnv,
   pullEnv,
   quoteIdent,
@@ -71,6 +75,7 @@ import {
   resetFileRefusedMessage,
   resetPoliciesLostMessage,
   resetPoliciesWithTablesMessage,
+  resetStorageOutdatedMessage,
   resolveAuth,
   resolveMigrationsDir,
   saveSession,
@@ -80,6 +85,7 @@ import {
   snapshotFromRows,
   splitPolicyStatements,
   splitStatements,
+  storageRefusalOfFiles,
   storedPolicySql,
   summarizeStatement,
   summarizeTeamUsage,
@@ -91,7 +97,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-DEEFHVDZ.js";
+} from "./chunk-SAA66XLD.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -190,7 +196,8 @@ var STRING_FLAGS = {
   "--search": "search",
   "--copy-env": "copyEnv",
   "--database": "database",
-  "--protection": "protection"
+  "--protection": "protection",
+  "--to": "to"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -2644,12 +2651,45 @@ async function hasBackend(client, projectId) {
     throw error;
   }
 }
-async function policyPlan(client, projectId, schema, dir, files) {
-  if (!schema.policyTable) {
-    if (await hasBackend(client, projectId))
-      throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
-    return { clearPolicies: false, lost: [], withTables: [] };
+async function refuseStorageOutdated(client, projectId, storageTable, files, texts) {
+  let refused = storageRefusalOfFiles(texts, {
+    storage: storageTable,
+    storageSubqueries: false
+  });
+  if (refused?.needs === "subqueries" && storageTable) {
+    const answer = await client.db.query(projectId, {
+      sql: STORAGE_SUBQUERIES_SQL
+    });
+    if ((answer.statements[0]?.rows.length ?? 0) > 0)
+      refused = storageRefusalOfFiles(texts, {
+        storage: true,
+        storageSubqueries: true
+      });
   }
+  if (refused)
+    throw new NaroError(
+      "BACKEND_OUTDATED",
+      resetStorageOutdatedMessage(files[refused.file] ?? "", refused),
+      {
+        details: {
+          migration: files[refused.file] ?? "",
+          statement: refused.statement
+        }
+      }
+    );
+}
+async function policyPlan(client, projectId, schema, files, texts) {
+  if (!schema.policyTable && await hasBackend(client, projectId))
+    throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
+  await refuseStorageOutdated(
+    client,
+    projectId,
+    schema.storageTable,
+    files,
+    texts
+  );
+  if (!schema.policyTable)
+    return { clearPolicies: false, lost: [], withTables: [] };
   const answer = await client.db.query(projectId, {
     sql: NAMED_POLICY_SQL.list
   });
@@ -2678,7 +2718,7 @@ async function policyPlan(client, projectId, schema, dir, files) {
     ...policiesLostByReset({
       current,
       tables: schema.tables,
-      files: files.map((name) => readFileSync3(join3(dir, name), "utf8")),
+      files: texts,
       // Storage's table stays; its policies are emptied with the rest (PR
       // #85 리뷰). Realtime's messages need no flag: a virtual target, which
       // reset-plan counts as a table always there (Realtime 3-2a).
@@ -2716,6 +2756,7 @@ async function runDbReset(context) {
 ${problemLines.join("\n")}`,
       { details: { problems } }
     );
+  const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
@@ -2731,8 +2772,8 @@ ${problemLines.join("\n")}`,
     client,
     projectId,
     { policyTable: policyTable2, storageTable, tables },
-    dir,
-    files
+    files,
+    texts
   );
   const policiesNotInFiles = policies.lost.map((policy) => ({
     name: `${policy.table}.${policy.name}`,
@@ -4074,13 +4115,16 @@ async function runGitConnect(context, overrides = {}) {
   if (cannotAsk(context)) {
     throw new NaroError(
       "REPOSITORY_NOT_ACCESSIBLE",
-      `Naro cannot reach ${fullName} yet. Install the Naro GitHub App at ${first.installUrl}, then run: naro git connect`,
+      `Naro cannot reach ${fullName} yet. Open ${first.installUrl} to give Naro access (if the repository is not among the ones the Naro GitHub App was granted on GitHub, add it there first), then run: naro git connect`,
       { details: { projectId, installUrl: first.installUrl } }
     );
   }
   output.log(`
 \u25B8 Naro needs access to ${fullName}.`);
   output.log(`  Opening ${first.installUrl}`);
+  output.log(
+    "  If the repository is not among the ones the Naro GitHub App was granted on GitHub, add it there first."
+  );
   deps.openBrowser(first.installUrl);
   output.log("  Waiting for the installation to finish...\n");
   await waitForInstall(context, projectId, fullName, deps);
@@ -4848,6 +4892,7 @@ var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var KEY_MAX_LENGTH = 256;
 var IMPORT_BATCH_SIZE = 100;
 var VALUE_MAX_BYTES = 5 * 1024;
+var STATIC_ASSETS_BINDING = "ASSETS";
 var TARGET_USAGE = "[production|preview|all|<environment>]";
 function validKey(key) {
   return KEY_RE.test(key) && key.length <= KEY_MAX_LENGTH;
@@ -4960,7 +5005,14 @@ async function runEnvImport(context) {
   } catch {
     throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
   }
-  const vars = Object.entries(parseDotenv(text));
+  const parsed = parseDotenvDetailed(text);
+  const [unclosed] = parsed.unclosedQuotes;
+  if (unclosed !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Unclosed quote in ${file} at line ${String(unclosed)}.`
+    );
+  const vars = Object.entries(parsed.vars);
   if (vars.length === 0)
     throw new NaroError("VALIDATION_FAILED", `No variables found in ${file}.`);
   const invalid = vars.map(([key]) => key).filter((key) => !validKey(key));
@@ -4969,6 +5021,11 @@ async function runEnvImport(context) {
       "VALIDATION_FAILED",
       `Invalid keys in ${file}: ${invalid.join(", ")}.`
     );
+  if (vars.some(([key]) => key === STATIC_ASSETS_BINDING))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${STATIC_ASSETS_BINDING} is reserved for the project's static files; pick another name.`
+    );
   const oversized = vars.filter(([, value]) => Buffer.byteLength(value, "utf8") > VALUE_MAX_BYTES).map(([key]) => key);
   if (oversized.length > 0)
     throw new NaroError(
@@ -4978,7 +5035,9 @@ async function runEnvImport(context) {
   const projectId = await context.resolveProjectId();
   context.output.log(`Variables in ${file}:`);
   for (const [key, value] of vars)
-    context.output.log(`  ${key.padEnd(32)} ${maskEnvValue(key, value)}`);
+    context.output.log(
+      `  ${key.padEnd(32)} ${value === "" ? "(empty)" : maskEnvValue(key, value)}`
+    );
   await confirmOrAbort(
     context,
     `Upload ${variables(vars.length)} to ${target}?`
@@ -4990,6 +5049,15 @@ async function runEnvImport(context) {
     target,
     isSecret: isSecretKey(key)
   }));
+  if (entries.length > IMPORT_BATCH_SIZE) {
+    const taken = new Set(await client.env.takenBindingNames(projectId));
+    const conflict = entries.find((entry) => taken.has(entry.key));
+    if (conflict)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${conflict.key} is already used by a storage binding.`
+      );
+  }
   for (let start = 0; start < entries.length; start += IMPORT_BATCH_SIZE)
     await client.env.set(
       projectId,
@@ -5017,17 +5085,14 @@ async function runEnvPull(context) {
   const rows = await client.env.list(projectId, { reveal: true });
   const vars = pullEnv(rows, surface);
   const count2 = Object.keys(vars).length;
+  const text = `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
+${serializeDotenv(vars)}`;
   const path = resolve4(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
-  writeFileSync4(
-    path,
-    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
-${serializeDotenv(vars)}`,
-    { mode: 384 }
-  );
+  writeFileSync4(path, text, { mode: 384 });
   chmodSync(path, 384);
   context.output.result({ projectId, file, environment: surface, count: count2 }, [
     `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
@@ -5460,17 +5525,27 @@ async function runProjectInspect(context) {
 }
 
 // src/commands/promote.ts
-async function promoteAndWait(context, client, project, sourceDeploymentId, action) {
+var PROMOTE_USAGE = "Usage: naro promote <deployment-id> [--to <environment>]";
+var ROLLBACK_USAGE = "Usage: naro rollback [deployment-id]";
+var REBUILD_TIMEOUT_MS = 15 * 6e4;
+var REUPLOAD_TIMEOUT_MS = 5 * 6e4;
+async function promoteAndWait(context, client, project, sourceDeploymentId, action, target) {
   const promoted = await client.deployments.promote(
     project.id,
-    sourceDeploymentId
+    sourceDeploymentId,
+    target !== void 0 ? { target } : void 0
   );
+  const rebuild = promoted.mode === "rebuild";
   context.output.log(
-    `\u25B8 ${action === "promote" ? "promoting" : "rolling back to"} ${sourceDeploymentId}`
+    `\u25B8 ${action === "promote" ? "promoting" : "rolling back to"} ${sourceDeploymentId}${target !== void 0 ? ` to ${target} (${promoted.mode})` : ""}`
+  );
+  const detail = await client.deployments.wait(
+    promoted.id,
+    rebuild ? {
+      timeoutMs: REBUILD_TIMEOUT_MS,
+      onLog: (log) => context.output.log(formatBuildLog(log))
+    } : { timeoutMs: REUPLOAD_TIMEOUT_MS }
   );
-  const detail = await client.deployments.wait(promoted.id, {
-    timeoutMs: 5 * 6e4
-  });
   if (detail.deployment.status !== "READY") {
     throw new NaroError(
       detail.deployment.errorCode ?? "DEPLOY_FAILED",
@@ -5478,42 +5553,104 @@ async function promoteAndWait(context, client, project, sourceDeploymentId, acti
       { details: { deploymentId: promoted.id } }
     );
   }
+  const serving = target === void 0 || target === "production" ? "Production" : target;
   context.output.result(
     {
       deploymentId: promoted.id,
       sourceDeploymentId,
       projectId: project.id,
+      // Both say the mode the control plane answered (MCP's rollback does
+      // too). Only a promotion has a target: a rollback is production's.
+      ...action === "promote" ? { target: target ?? null } : {},
+      mode: promoted.mode,
       status: detail.deployment.status,
       url: detail.deployment.url
     },
     [
-      `\u2705 Production now serves ${sourceDeploymentId}`,
+      `\u2705 ${serving} now serves ${rebuild ? "a rebuild of " : ""}${sourceDeploymentId}`,
       "",
       detail.deployment.url ?? ""
     ]
   );
 }
+function promoteTarget(flags) {
+  if (flags.to === void 0) return void 0;
+  const target = flags.to.trim();
+  if (target === "" || target === "preview")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--to must be production or an environment name."
+    );
+  return target;
+}
+function refuseWhatIsNotRead(context, usage, envMessage) {
+  if (context.positionals.length > 1)
+    throw new NaroError("VALIDATION_FAILED", usage);
+  if (context.flags.env !== void 0)
+    throw new NaroError("VALIDATION_FAILED", envMessage);
+}
+async function previewPromotion(context, client, projectId, sourceDeploymentId, target) {
+  let check;
+  try {
+    check = await client.deployments.promoteCheck(
+      projectId,
+      sourceDeploymentId,
+      target
+    );
+  } catch (error) {
+    if (!isNaroError(error) || error.status !== 405) throw error;
+    if (target !== void 0 && target !== "production")
+      throw promoteTargetUnsupported(error);
+    return;
+  }
+  context.output.log(
+    check.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
+  );
+  for (const warning of check.warnings)
+    for (const line of warningLines(warning)) context.output.log(line);
+}
 async function runPromote(context) {
-  const [deploymentId] = context.positionalOrThrow(
-    1,
-    "Usage: naro promote <deployment-id>"
+  const [deploymentId] = context.positionalOrThrow(1, PROMOTE_USAGE);
+  refuseWhatIsNotRead(
+    context,
+    PROMOTE_USAGE,
+    "--env is not an option of naro promote: use --to <environment>."
   );
+  const target = promoteTarget(context.flags);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const project = await client.projects.get(projectId);
+  await previewPromotion(
+    context,
+    client,
+    projectId,
+    deploymentId,
+    target
+  );
   await confirmOrAbort(
     context,
-    `Promote ${String(deploymentId)} to production (${project.subdomain})?`
+    target === void 0 || target === "production" ? `Promote ${String(deploymentId)} to production (${project.subdomain})?` : `Promote ${String(deploymentId)} to ${target} (${project.subdomain}--${target})?`
   );
   await promoteAndWait(
     context,
     client,
     project,
     deploymentId,
-    "promote"
+    "promote",
+    target
   );
 }
 async function runRollback(context) {
+  if (context.flags.to !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--to is for naro promote: naro rollback always rolls production back."
+    );
+  refuseWhatIsNotRead(
+    context,
+    ROLLBACK_USAGE,
+    "--env is not an option of naro rollback: naro rollback always rolls production back."
+  );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const project = await client.projects.get(projectId);
@@ -5625,6 +5762,7 @@ var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --priva
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
 var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
 var ENABLE_FIRST = "Storage is not enabled yet; enabling it first.";
+var DISABLE_QUESTION3 = "Turn Storage off for this project? Its Storage calls and file URLs answer 404 until naro storage enable; buckets and files are kept.";
 var NO_BUCKETS = "No buckets yet. `naro storage bucket create <name>` makes one.";
 var IDLE_PAGES = 3;
 function bucketLine(bucket) {
@@ -5645,6 +5783,12 @@ function utcClock(iso) {
   const at = new Date(iso);
   return Number.isNaN(at.getTime()) ? null : at.toISOString().slice(11, 16);
 }
+function utcMinute(iso) {
+  const at = new Date(iso);
+  if (Number.isNaN(at.getTime())) return printable(iso);
+  const text = at.toISOString();
+  return `${text.slice(0, 10)} ${text.slice(11, 16)} UTC`;
+}
 function warnedPercent(value, limit) {
   if (limit === null || !(limit > 0)) return null;
   const percent2 = Math.floor(value * 100 / limit);
@@ -5686,6 +5830,13 @@ function meterLines(info) {
   return lines;
 }
 function storageLines(info) {
+  if (info.disabledAt !== null)
+    return [
+      `Storage:     off since ${utcMinute(info.disabledAt)} \u2014 buckets and files are kept`,
+      "Run `naro storage enable` to turn it on again: the same buckets and files come back.",
+      info.buckets.length === 0 ? "Buckets:     none" : `Buckets:     ${String(info.buckets.length)}`,
+      ...info.buckets.map(bucketLine)
+    ];
   if (!info.enabled)
     return [
       "Storage:     off",
@@ -5714,6 +5865,19 @@ async function enableStorage(client, projectId) {
     throw error;
   }
 }
+async function disableStorage(client, projectId) {
+  try {
+    return await client.storage.disable(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        "Turning Storage off did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage disable` again picks up where it stopped.",
+        { cause: error }
+      );
+    throw error;
+  }
+}
 function bucketName(context, usage) {
   if (context.positionals.length !== 1)
     throw new NaroError("VALIDATION_FAILED", usage);
@@ -5750,6 +5914,24 @@ async function runStorageEnable(context) {
     ...storageLines(storage)
   ]);
 }
+async function runStorageDisable(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const current = await client.storage.info(projectId);
+  if (current.bucket === null) {
+    context.output.result({ projectId, storage: current }, [
+      "Storage is already off."
+    ]);
+    return;
+  }
+  if (current.disabledAt === null)
+    await confirmOrAbort(context, DISABLE_QUESTION3);
+  const storage = await disableStorage(client, projectId);
+  context.output.result({ projectId, storage }, [
+    "\u2705 Storage is off. Buckets and files are kept; naro storage enable turns it on again.",
+    ...storageLines(storage)
+  ]);
+}
 async function runStorageBucketList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -8055,6 +8237,7 @@ var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (
 var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
 var isSignedEntry = (value) => isRecord(value) && typeof value.path === "string" && (value.signedUrl === null || typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX)) && (value.error === null || typeof value.error === "string");
 var isSignedUpload = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_UPLOAD_PREFIX) && typeof value.token === "string" && value.token !== "" && typeof value.path === "string";
+var isMoved = (value) => isRecord(value) && typeof value.message === "string";
 var partsBody = (body) => isArrayBuffer(body) ? new Uint8Array(body) : body;
 function listOf(guard) {
   return (value) => Array.isArray(value) && value.every(guard);
@@ -8210,9 +8393,76 @@ var StorageFileApi = class {
       listOf(isFileObject)
     );
   }
+  /**
+   * The body a move and a copy send (Storage 3-1i): the bucket and both
+   * names, as supabase-js sends them. The names are not checked here — they
+   * are in the body, and the backend answers a bad one `INVALID_REQUEST`
+   * (`details.path` "sourceKey" or "destinationKey"), as `remove` does.
+   */
+  #transferBody(fromPath, toPath, options) {
+    const { destinationBucket, upsert } = options;
+    return {
+      bucketId: this.#bucket,
+      sourceKey: fromPath,
+      destinationKey: toPath,
+      ...destinationBucket === void 0 ? {} : { destinationBucket },
+      ...upsert === true ? { upsert: true } : {}
+    };
+  }
+  /**
+   * Renames an object inside its bucket (Storage 3-1i): the same object — its
+   * id and owner — under `toPath`, its old name gone. It never replaces an
+   * object that is there (`OBJECT_EXISTS`), takes files up to 5 GiB − 5 MiB
+   * (`OBJECT_TOO_LARGE`), and needs room in the project for a second copy
+   * until it is done (`STORAGE_QUOTA_EXCEEDED`). Its signed links stop
+   * working at the old name: a link is bound to the name, the object's id
+   * and its bytes, so moving it back can open them again. A backend whose
+   * Storage was turned on before this method came answers `NOT_FOUND`:
+   * update it with `naro backend enable`.
+   */
+  async move(fromPath, toPath, options = {}) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return fail(bucket.error);
+    const { destinationBucket } = options ?? {};
+    return this.#json(
+      {
+        method: "POST",
+        path: "/storage/object/move",
+        body: this.#transferBody(
+          fromPath,
+          toPath,
+          destinationBucket === void 0 ? {} : { destinationBucket }
+        )
+      },
+      isMoved
+    );
+  }
+  /**
+   * Copies an object inside its bucket (Storage 3-1i): the source's bytes,
+   * type and cache-control under `toPath` — a new object of the caller's,
+   * or with `upsert: true` the one that is there, which keeps its owner.
+   * Files up to 5 GiB − 5 MiB, within the bucket's limits as they are now.
+   * It answers `{ id, path, fullPath }` — `path` is the name inside the
+   * bucket; supabase-js's copy puts the bucket in front of it. A backend
+   * whose Storage was turned on before this method came answers
+   * `NOT_FOUND`: update it with `naro backend enable`.
+   */
+  async copy(fromPath, toPath, options = {}) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return fail(bucket.error);
+    return this.#json(
+      {
+        method: "POST",
+        path: "/storage/object/copy",
+        body: this.#transferBody(fromPath, toPath, options ?? {})
+      },
+      isUploadResult
+    );
+  }
   /**
    * A link to the object for `expiresIn` seconds (1–604,800). It stops
-   * working once the object is replaced or removed.
+   * working once the object is replaced or removed, and while the object is
+   * moved away from `path` (moved back, it can open it again).
    */
   async createSignedUrl(path, expiresIn, options = {}) {
     const target = this.#objectPath("sign/", path);
@@ -8503,10 +8753,12 @@ function createClient(options) {
 
 // src/commands/storage-objects.ts
 var NARO_SCHEME = "naro://";
-var CP_USAGE = "Usage: naro storage cp <from> <to> (one side naro://<bucket>/<path>, the other a local file)";
+var CP_USAGE = "Usage: naro storage cp <from> <to> (a local file and naro://<bucket>/<path>, or two naro://<bucket>/<path> in one bucket)";
+var MV_USAGE = "Usage: naro storage mv naro://<bucket>/<from> naro://<bucket>/<to>";
 var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
 var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive] [--search <text>]";
 var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
+var STORAGE_OFF_MESSAGE = "Storage is turned off for this project. Turn it on with `naro storage enable` first.";
 var STORAGE_OUTDATED_MESSAGE = "The project backend is older than this Storage command. Run `naro backend enable` to update it, then try again.";
 var OLD_SEARCH_REASON = "search is not supported yet";
 function isOldSearchRefusal(error) {
@@ -8516,6 +8768,10 @@ function isOldSearchRefusal(error) {
   const { path, reason } = details;
   return path === "search" && reason === OLD_SEARCH_REASON;
 }
+var NO_ENDPOINT = "There is no Naro endpoint at this path.";
+function isOldRouteRefusal(error) {
+  return error !== null && error.code === "NOT_FOUND" && error.message === NO_ENDPOINT;
+}
 var FOUR_GIB = 4294967296;
 var PAGE = 1e3;
 var MAX_OFFSET = 1e5;
@@ -8595,6 +8851,9 @@ async function objects(context) {
       "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
     );
   if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
+  const state = await client.storage.info(projectId);
+  if (state.disabledAt !== null)
+    throw new NaroError("STORAGE_OFF", STORAGE_OFF_MESSAGE);
   let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
   if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
     throw new NaroError(
@@ -8982,17 +9241,106 @@ async function download(context, source, local) {
     ]
   );
 }
-async function storageCp(context) {
+function unwrapTransfer(result) {
+  if (isOldRouteRefusal(result.error))
+    throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
+  return unwrap(result);
+}
+function refuseBadName(bucket, name) {
+  const route2 = objectRoute(bucket, name);
+  if (!route2.ok) throw new NaroError(route2.error.code, route2.error.message);
+  const checked = checkObjectName(name);
+  if (!checked.ok) {
+    const { code, message } = dataError("INVALID_PATH", {
+      reason: checked.reason
+    });
+    throw new NaroError(code, message);
+  }
+}
+function insideStorage(source, target, command) {
+  if (source.bucket !== target.bucket)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage cp and mv work inside one bucket: both sides must be in naro://<bucket>."
+    );
+  if (source.path === "" || source.path.endsWith("/"))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `naro storage ${command} ${command === "mv" ? "moves" : "copies"} one object: name it, naro://<bucket>/<path>.`
+    );
+  const name = source.path.slice(source.path.lastIndexOf("/") + 1);
+  const to = target.path === "" || target.path.endsWith("/") ? `${target.path}${name}` : target.path;
+  refuseBadName(source.bucket, source.path);
+  refuseBadName(source.bucket, to);
+  if (to === source.path)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `naro storage ${command} needs a different destination: ${printable(`${NARO_SCHEME}${source.bucket}/${source.path}`)} is the source.`
+    );
+  return { bucket: source.bucket, from: source.path, to };
+}
+async function copyInside(context, source, target) {
+  const { contentType, cacheControl } = context.flags;
+  if (contentType !== void 0 || cacheControl !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "A copy inside Storage keeps the object's type and cache-control: --content-type and --cache-control are for uploads."
+    );
+  if (context.flags.recursive === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "A copy inside Storage takes no --recursive: it copies one object, naro://<bucket>/<path>. --recursive is for naro storage ls and rm."
+    );
+  const { bucket, from, to } = insideStorage(source, target, "cp");
+  const { projectId, storage } = await objects(context);
+  const object = unwrapTransfer(
+    await storage.from(bucket).copy(from, to, { upsert: context.flags.upsert === true })
+  );
+  const fromUrl = `${NARO_SCHEME}${bucket}/${from}`;
+  const toUrl = `${NARO_SCHEME}${bucket}/${to}`;
+  context.output.result({ projectId, from: fromUrl, to: toUrl, object }, [
+    `\u2705 Copied ${printable(fromUrl)} \u2192 ${printable(toUrl)}.`
+  ]);
+}
+async function storageMv(context) {
   const [from, to, ...extra] = context.positionals;
   if (from === void 0 || to === void 0 || extra.length > 0)
-    throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+    throw new NaroError("VALIDATION_FAILED", MV_USAGE);
   const source = parseStorageUrl(from);
   const target = parseStorageUrl(to);
-  if (source !== null && target !== null)
+  if (source === null || target === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage mv moves inside Storage: both sides are naro://<bucket>/<path>."
+    );
+  const { upsert, contentType, cacheControl } = context.flags;
+  if (upsert === true || contentType !== void 0 || cacheControl !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage mv takes no --upsert, --content-type or --cache-control: a move keeps the object as it is and never replaces one."
+    );
+  if (context.flags.recursive === true)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "naro storage cp copies between this machine and Storage: one side is naro://<bucket>/<path>, the other a local file. Copying inside Storage is not supported yet."
+      "naro storage mv takes no --recursive: it moves one object, naro://<bucket>/<path>. --recursive is for naro storage ls and rm."
     );
+  const moved = insideStorage(source, target, "mv");
+  const { projectId, storage } = await objects(context);
+  unwrapTransfer(await storage.from(moved.bucket).move(moved.from, moved.to));
+  const fromUrl = `${NARO_SCHEME}${moved.bucket}/${moved.from}`;
+  const toUrl = `${NARO_SCHEME}${moved.bucket}/${moved.to}`;
+  context.output.result({ projectId, from: fromUrl, to: toUrl }, [
+    `\u2705 Moved ${printable(fromUrl)} \u2192 ${printable(toUrl)}.`
+  ]);
+}
+async function storageCp(context) {
+  const [from, to, ...extra] = context.positionals;
+  if (from === void 0 || to === void 0 || extra.length > 0)
+    throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+  const source = parseStorageUrl(from);
+  const target = parseStorageUrl(to);
+  if (source !== null && target !== null)
+    return copyInside(context, source, target);
   if (target !== null) return upload(context, from, target);
   if (source !== null) return download(context, source, to);
   throw new NaroError("VALIDATION_FAILED", CP_USAGE);
@@ -9106,6 +9454,9 @@ function runStorageLs(context) {
 function runStorageCp(context) {
   return explainingKey(context, storageCp);
 }
+function runStorageMv(context) {
+  return explainingKey(context, storageMv);
+}
 function runStorageRm(context) {
   return explainingKey(context, storageRm);
 }
@@ -9372,6 +9723,8 @@ Usage:
   naro storage [status]              Naro Storage: on or off, limits, what is stored, today's operations, the buckets
   naro storage enable                Turn Storage on: the project's R2 bucket, bound to its backend
                                      (safe to re-run; applies a plan change's limits)
+  naro storage disable [--yes]       Turn Storage off and keep its files: its calls and file URLs answer 404
+                                     until naro storage enable binds the same bucket again (asks first)
   naro storage bucket list           The buckets: public or private, objects, bytes, limits
   naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]
                                      <size>: bytes, 5MB (1000s) or 5MiB (1024s); turns Storage on first if needed
@@ -9388,12 +9741,18 @@ Usage:
                                      One file between this machine and naro://<bucket>/<path>, up to the object limit (over 50 MiB in parts),
                                      with the project's service key (NARO_SERVICE_KEY, or fetched with a warning).
                                      A big upload shows its progress on stderr; a file of 4 GiB or more cannot be uploaded yet.
-                                     A download replaces a local file of the same name
+                                     A download replaces a local file of the same name.
+                                     Two naro:// paths in one bucket: a copy inside Storage, up to 5 GiB \u2212 5 MiB (--upsert replaces)
+  naro storage mv naro://<bucket>/<from> naro://<bucket>/<to>
+                                     Move an object inside its bucket, up to 5 GiB \u2212 5 MiB; it never replaces one that is there
   naro storage rm naro://<bucket>/<path>\u2026 [--recursive]
                                      Remove objects; --recursive removes what is under a folder (asks first):
                                      <path>/ is the folder alone, <path> also an object of that name
 
-  naro promote <deployment-id>       Publish a build to production
+  naro promote <deployment-id> [--to <environment>]
+                                     Publish a build to production, or to an environment with --to; it says what it will do, then asks.
+                                     A build moving between an environment and another surface is built again from its commit with the
+                                     target's variables, which takes up to 15 minutes; any other build is published as stored.
   naro rollback [deployment-id]      Roll production back to the previous build
 
 Global options:
@@ -9417,6 +9776,7 @@ Global options:
   --device <d>    Only this device: desktop, mobile or tablet (naro analytics, naro insights)
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
+  --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
   --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
                   branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
@@ -9458,8 +9818,8 @@ Global options:
   --recursive, -r Everything under a folder (naro storage ls, naro storage rm)
   --search <text> Names below the prefix that start with <text>, ASCII case ignored (naro storage ls)
   --upsert        Replace an object that is there (naro storage cp)
-  --content-type <t>  The object's type; by default from the file's extension (naro storage cp)
-  --cache-control <seconds>  How long a browser may keep it; 3600 by default (naro storage cp)
+  --content-type <t>  The uploaded object's type; by default from the file's extension (naro storage cp, uploads only)
+  --cache-control <seconds>  How long a browser may keep an upload; 3600 by default (naro storage cp, uploads only)
   --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
   --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
   --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
@@ -9561,6 +9921,8 @@ function routeStorage(words) {
       return words.length <= 1 ? { handler: runStorageStatus, positionals: [] } : null;
     case "enable":
       return words.length === 1 ? { handler: runStorageEnable, positionals: [] } : null;
+    case "disable":
+      return words.length === 1 ? { handler: runStorageDisable, positionals: [] } : null;
     case "bucket":
     case "buckets":
       switch (action) {
@@ -9597,13 +9959,24 @@ function routeStorage(words) {
       return { handler: runStorageLs, positionals: words.slice(1) };
     case "cp":
       return { handler: runStorageCp, positionals: words.slice(1) };
+    case "mv":
+      return { handler: runStorageMv, positionals: words.slice(1) };
     case "rm":
       return { handler: runStorageRm, positionals: words.slice(1) };
     default:
       return null;
   }
 }
+async function refuseTo() {
+  throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
+}
 function route(parsed) {
+  const routed = routeCommand(parsed);
+  if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
+    return { handler: refuseTo, positionals: routed.positionals };
+  return routed;
+}
+function routeCommand(parsed) {
   const { command, positionals } = parsed;
   const sub = positionals[0];
   switch (command) {