naro-cli 0.19.1 → 0.20.0

package/README.md

@@ -198,6 +198,7 @@ naro policy remove todos           Drop every policy on the table: back to deny
 
 naro storage                       Naro Storage: on or off, limits, usage, today's operations, buckets
 naro storage enable                Turn it on: the project's R2 bucket, bound to the backend
+naro storage disable [--yes]       Turn it off and keep the files: Storage calls and file URLs answer 404 until enable (asks first)
 naro storage bucket create avatars --public --file-size-limit 5MiB --allowed-mime-types image/png,image/jpeg
 naro storage bucket update avatars --private | --file-size-limit none | --allowed-mime-types any
 naro storage bucket update docs --public   (asks first: anyone with an object's URL can download it)
@@ -210,7 +211,7 @@ naro storage mv naro://docs/a.pdf naro://docs/old/a.pdf         Inside one bucke
 naro storage rm naro://avatars/u1/old.png [--recursive]   (asks first)
 naro storage rm naro://avatars/u1/ --recursive   Everything under u1/; written u1, an object u1 too
 
-naro promote <deployment-id>       Publish a build to production
+naro promote <deployment-id> [--to <environment>]   Publish a build to production, or to an environment (0.20.0); says rebuild or reupload first, then asks
 naro rollback [deployment-id]      Back to the previous production build
 ```
 
@@ -594,8 +595,16 @@ tables: a policy on a table that does not exist
 (`relation "nope" does not exist`), a name already taken, or a 33rd policy on
 one table fails the whole request with `400 DATABASE_QUERY_FAILED`, names the
 statement, and applies nothing — not even the `CREATE TABLE` before it. Policy
-statements, and statements that create, drop or rename a table, take no
-`params` (`400 VALIDATION_FAILED`): write the values into the SQL.
+statements, statements that create, drop or rename a table, and statements
+that add a generated column take no `params` (`400 VALIDATION_FAILED`): write
+the values into the SQL.
+
+`ALTER TABLE t ADD COLUMN c … AS (…)` computes the generated column for the
+rows already in `t` right after it, as Postgres does: a row it cannot be
+computed for (`json_extract` over text that is not JSON) fails the request
+with SQLite's error (`400 DATABASE_QUERY_FAILED` `malformed JSON:
+SQLITE_ERROR`) and nothing changes. Fix those rows first, in an earlier
+statement.
 
 Policies go with their table, as in Postgres: `DROP TABLE` drops them, and a
 new table never inherits the leftovers of an earlier one with the same name
@@ -837,6 +846,110 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.20.0
+
+0.19.1 went out on 2026-10-24 without these.
+
+- `naro promote <deployment-id> --to <environment>` publishes a build to a
+  named environment. `--to` takes `production` (what no `--to` does) or an
+  environment's slug; an empty value, only blanks or `preview` fails before
+  any request with `VALIDATION_FAILED`
+  `--to must be production or an environment name.` The usage line is
+  `Usage: naro promote <deployment-id> [--to <environment>]`.
+  - Before it asks, it says what the promotion will do, from the control
+    plane's preview (`GET …/promote?target=`, which changes nothing):
+    `▸ rebuild: builds the same commit again with qa's variables` or
+    `▸ reupload: publishes the stored build`, then each warning as
+    `⚠ <warning>`. Without `--to` the same line is printed for production
+    (`… with production's variables`); that is one request more than 0.19.1
+    sent.
+  - A build moving between an environment and another surface (a preview or
+    production build to `qa`, a `qa` build to `staging` or to production) is
+    built again from its commit with the target's variables, and counts
+    against the plan's builds. Any other build is published as stored: one
+    promoted within its own surface, and a preview to production.
+  - The question is `Promote <id> to qa (<subdomain>--qa)?`; for production it
+    is the one it always was, `Promote <id> to production (<subdomain>)?`.
+    `--json` or no terminal without `--yes` still fails
+    `CONFIRMATION_REQUIRED`.
+  - Progress is `▸ promoting <id> to qa (rebuild)` (`(reupload)`), and the
+    result `✅ qa now serves a rebuild of <id>` or `✅ qa now serves <id>`; for
+    production `✅ Production now serves a rebuild of <id>` or, as before,
+    `✅ Production now serves <id>`. A rebuild is waited for up to 15 minutes
+    (a published build, 5 as before), and a failed one fails with its own
+    code and message. While a rebuild runs its build log lines print the way
+    `naro logs --type build --follow` prints them (`[BUILDING] next build`,
+    `[BUILDING] ✗ <error>`), on stderr with `--json` so stdout stays one
+    object; a published build prints none.
+  - `--json` adds `target` (`null` without `--to`) and `mode` (`rebuild` or
+    `reupload`): `{ deploymentId, sourceDeploymentId, projectId, target, mode, status, url }`.
+    `naro rollback`'s result gains `mode` too (as MCP's `rollback_deployment`
+    says it) and has no `target`: a rollback is always production's.
+  - `409 PROMOTE_NEEDS_GIT_SOURCE`
+    `Only deployments built from Git can be promoted to another environment. Deploy the code again with naro deploy instead.`
+    for a deployment `naro deploy` uploaded. This and every other refusal of
+    the preview (`404 ENVIRONMENT_NOT_FOUND` `Environment not found.`) stop
+    it in the control plane's words before it asks, and nothing is promoted.
+  - A rebuild checks out the pinned commit as a detached HEAD, not the
+    branch, so a build script that reads the branch name from git
+    (`git branch --show-current`, `git rev-parse --abbrev-ref HEAD`) sees
+    none.
+  - Against a control plane from before named environments 2a, which has no
+    preview (it answers 405) and whose promote ignores the target and
+    republishes to production, `--to <environment>` stops before it promotes
+    anything: `PROMOTE_TARGET_UNSUPPORTED`
+    `This control plane cannot promote to an environment yet. Deploy the latest web first, then try again.`
+    With no `--to` or `--to production` the 405 is ignored: no preview line,
+    and the promotion goes as it always did.
+- `--to` belongs to `naro promote`; `naro rollback` refuses it before any
+  request with `VALIDATION_FAILED`
+  `--to is for naro promote: naro rollback always rolls production back.`
+  (it always targets production, and ignoring `--to` would roll production
+  back for someone who named an environment).
+- Any other command given `--to` fails before any request with
+  `VALIDATION_FAILED` `--to is only for naro promote.`, so a flag a command
+  does not read is never dropped silently.
+- `naro promote` and `naro rollback` refuse `--env` and any word after the
+  deployment id before any request, with `VALIDATION_FAILED`
+  `--env is not an option of naro promote: use --to <environment>.`,
+  `--env is not an option of naro rollback: naro rollback always rolls production back.`
+  or the usage line (`Usage: naro promote <deployment-id> [--to <environment>]`,
+  `Usage: naro rollback [deployment-id]`), instead of acting on production for
+  someone who named an environment (`naro promote d1 --env qa --yes` and
+  `naro promote d1 qa --yes` promoted to production in 0.19.1).
+- A control plane with named environments 2a rebuilds a deployment of an
+  environment that is promoted to production, which it used to refuse with
+  `400 DEPLOYMENT_NOT_PROMOTABLE`. `naro promote <id>` says so before it
+  asks (`▸ rebuild: … with production's variables`) and waits up to 15
+  minutes; `naro rollback <id>` waits 15 minutes for such a rebuild too and
+  prints `✅ Production now serves a rebuild of <id>`. The build that
+  `naro rollback` picks on its own is never one.
+- `naro storage disable [--yes]` turns the project's Storage off and keeps
+  its files (Storage 3-1k). It asks first —
+  `Turn Storage off for this project? Its Storage calls and file URLs answer 404 until naro storage enable; buckets and files are kept.`
+  — and without a terminal or with `--json` only `--yes` answers it. The
+  backend is uploaded again without the bucket: the app's Storage calls and
+  file URLs answer `404 STORAGE_NOT_ENABLED` until `naro storage enable`
+  binds the same bucket again, and the buckets, the files and their storage
+  cost stay. To delete the files instead, remove the buckets with
+  `naro storage bucket remove <name> --empty` while Storage is on. Storage
+  that was never turned on prints `Storage is already off.` and changes
+  nothing; Storage that is already off is finished without asking again (a
+  turn-off whose upload stopped answers `BACKEND_PROVISION_FAILED` and says
+  to run it again).
+- `naro storage` says
+  `Storage:     off since <YYYY-MM-DD HH:MM> UTC — buckets and files are kept`
+  while it is off, with the buckets.
+- `naro storage ls`, `cp`, `mv` and `rm` read the Storage state before the
+  service key and stop with `STORAGE_OFF`
+  ``Storage is turned off for this project. Turn it on with `naro storage enable` first.``
+  while it is off. `naro storage bucket create` on Storage that is off gets
+  the control plane's `409 STORAGE_OFF`: it turns Storage on by itself only
+  when Storage was never on.
+- Published naro-cli 0.19.1 and earlier show Storage that is off as `off`
+  and pass the backend's `404 STORAGE_NOT_ENABLED` on from `ls`, `cp`,
+  `mv` and `rm`; their `bucket create` stops at `409 STORAGE_OFF` too.
+
 ### 0.19.1
 
 0.19.0 went out on 2026-10-19 without these.
@@ -996,7 +1109,7 @@ RENAME` the way the control plane now reads it: a column rename whose
   too), migration files the backend would stop at for Storage: a policy that
   reads `storage.objects` in a subquery while the backend's ledger lacks
   system migration 7 (it reads the ledger only when a file has one), and
-  any statement on `storage.objects` (CREATE POLICY, DROP POLICY without
+  a statement that needs `storage.objects` (CREATE POLICY, DROP POLICY without
   IF EXISTS, the `naro:owner` COMMENT) on a backend from before Storage or a
   project with none. It fails `BACKEND_OUTDATED`
   ``0002_b.sql needs storage.objects (statement 2 of 2), which is not available on this backend yet, so the reset would stop there with the schema already dropped. Nothing was changed. Run `naro backend enable` to update it, then try again.``
@@ -1556,7 +1669,7 @@ not fail but no strategy can ship it, `NO_DEPLOYMENT_STRATEGY`. Either way the m
 what each strategy failed at.
 
 `--yes` (or `-y`) suppresses every prompt — destructive actions
-(production rollback/promote, env/domain/environment removal, `naro env import`, turning off an environment's protection, database reset, backend key
+(production rollback, promote to production or to an environment, env/domain/environment removal, `naro env import`, turning off an environment's protection, database reset, backend key
 rotation, policy removal and drop, opening the preview with
 `naro protection disable`, replacing or removing the bypass secret) run
 unconfirmed, so use it deliberately in

package/dist/{chunk-ZO2BEC46.js → chunk-SAA66XLD.js}

@@ -345,6 +345,8 @@ var DEPLOYMENT_ERROR_CODES = [
   "FORBIDDEN",
   "NOT_FOUND",
   "DEPLOYMENT_NOT_PROMOTABLE",
+  /** A promotion to another surface rebuilds the commit, and the source was not built from Git (spec 2026-10-18-named-environments §9.1). */
+  "PROMOTE_NEEDS_GIT_SOURCE",
   "DEPLOYMENT_NOT_CANCELABLE",
   "SUBDOMAIN_TAKEN",
   "FLAG_EXISTS",
@@ -511,6 +513,9 @@ function projectPath(teamSlug, projectSlug) {
   return `/${teamSlug}/projects/${projectSlug}`;
 }
 
+// ../../packages/core/src/platform-mail.ts
+var encoder = new TextEncoder();
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -18506,6 +18511,7 @@ function forkedAppRoot(checkout, appRoot, forkCheckout) {
 }
 
 // ../../packages/build/src/local-build-executor.ts
+var PINNED_COMMIT_SHA = /^[0-9a-f]{40}$/;
 function concurrencyFromEnvironment() {
   const raw = Number(process.env.NARO_RESOLVER_CONCURRENCY ?? "1");
   return Number.isInteger(raw) && raw > 0 ? raw : 1;
@@ -18650,6 +18656,68 @@ var LocalBuildExecutor = class {
   constructor(dependencies = defaultLocalBuildDependencies) {
     this.dependencies = dependencies;
   }
+  /**
+   * Checks out one commit, whichever ref reaches it: GitHub serves any
+   * reachable commit by SHA, which `clone --branch` cannot ask for. The URL
+   * carries the installation token and is only ever an argument — runCommand
+   * logs a command's output (redacted), never the command line, and a failed
+   * command's message names the command, not its arguments.
+   *
+   * The commit is an argument of `git fetch`, so it is checked before any git
+   * command runs: a value git could read as an option (`--upload-pack=…`) or a
+   * ref name must not get that far. The build container checks it on the way
+   * in; the local runner passes claim's input straight through, so this is the
+   * check that covers it.
+   */
+  async checkoutPinnedCommit(commitSha, repositoryUrl, workspace, checkout, observer) {
+    if (!PINNED_COMMIT_SHA.test(commitSha)) {
+      throw new DeploymentError(
+        "CLONE_FAILED",
+        "The pinned commit is not a 40-character lowercase hex SHA."
+      );
+    }
+    const git2 = (args) => this.dependencies.runCommand(
+      {
+        command: "git",
+        args,
+        cwd: workspace,
+        timeoutMs: 12e4,
+        stage: "CLONING",
+        errorCode: "CLONE_FAILED"
+      },
+      observer
+    );
+    await git2(["init", "--quiet", checkout]);
+    await git2(["-C", checkout, "remote", "add", "origin", "--", repositoryUrl]);
+    try {
+      await git2([
+        "-C",
+        checkout,
+        "fetch",
+        "--quiet",
+        "--depth",
+        "1",
+        "origin",
+        commitSha
+      ]);
+    } catch (error51) {
+      if (!(error51 instanceof CommandExecutionError)) throw error51;
+      if (error51.timedOut) throw error51;
+      throw new DeploymentError(
+        "CLONE_FAILED",
+        `Could not fetch commit ${commitSha.slice(0, 7)}. It may have been removed from the repository.`,
+        { cause: error51 }
+      );
+    }
+    await git2([
+      "-C",
+      checkout,
+      "checkout",
+      "--quiet",
+      "--detach",
+      "FETCH_HEAD"
+    ]);
+  }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
     const checkout = join18(workspace, "checkout");
@@ -18675,27 +18743,37 @@ var LocalBuildExecutor = class {
           message: `Build cache disabled: ${compressor} is not installed. Install it to reuse dependencies between deploys.`
         });
       }
-      await this.dependencies.runCommand(
-        {
-          command: "git",
-          args: [
-            "clone",
-            "--depth",
-            "1",
-            "--branch",
-            input.branch,
-            "--single-branch",
-            "--",
-            input.repositoryUrl,
-            checkout
-          ],
-          cwd: workspace,
-          timeoutMs: 12e4,
-          stage: "CLONING",
-          errorCode: "CLONE_FAILED"
-        },
-        observer
-      );
+      if (input.commitSha !== void 0) {
+        await this.checkoutPinnedCommit(
+          input.commitSha,
+          input.repositoryUrl,
+          workspace,
+          checkout,
+          observer
+        );
+      } else {
+        await this.dependencies.runCommand(
+          {
+            command: "git",
+            args: [
+              "clone",
+              "--depth",
+              "1",
+              "--branch",
+              input.branch,
+              "--single-branch",
+              "--",
+              input.repositoryUrl,
+              checkout
+            ],
+            cwd: workspace,
+            timeoutMs: 12e4,
+            stage: "CLONING",
+            errorCode: "CLONE_FAILED"
+          },
+          observer
+        );
+      }
       const revision = await this.dependencies.runCommand(
         {
           command: "git",
@@ -18714,6 +18792,12 @@ var LocalBuildExecutor = class {
           "Git returned an invalid commit SHA."
         );
       }
+      if (input.commitSha !== void 0 && gitCommitSha !== input.commitSha) {
+        throw new DeploymentError(
+          "CLONE_FAILED",
+          `Checked out ${gitCommitSha.slice(0, 7)} instead of the pinned commit ${input.commitSha.slice(0, 7)}.`
+        );
+      }
       const reportedSha = gitCommitSha.length === 40 ? gitCommitSha : null;
       if (!reportedSha)
         await info2(
@@ -19129,6 +19213,14 @@ var NaroError = class extends Error {
     if (options?.details !== void 0) this.details = options.details;
   }
 };
+var PROMOTE_TARGET_UNSUPPORTED_MESSAGE = "This control plane cannot promote to an environment yet. Deploy the latest web first, then try again.";
+function promoteTargetUnsupported(cause) {
+  return new NaroError(
+    "PROMOTE_TARGET_UNSUPPORTED",
+    PROMOTE_TARGET_UNSUPPORTED_MESSAGE,
+    cause !== void 0 ? { cause } : void 0
+  );
+}
 function isNaroError(error51) {
   return error51 instanceof NaroError || error51 instanceof Error && error51.name === "NaroError" && typeof error51.code === "string";
 }
@@ -19234,7 +19326,7 @@ var STYLES = `
   *{box-sizing:border-box}
   :root{
     --bg:#000;--surface:#0a0a0a;--surface-2:#111;--border:#232323;
-    --text:#ededed;--muted:#a1a1a1;--faint:#6f6f6f;
+    --text:#ededed;--muted:#a1a1a1;--faint:#808080;
     --sans:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;
     --mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
   }
@@ -19698,6 +19790,8 @@ function deploymentInfo(row) {
     errorMessage: row.error_message,
     gitCommitSha: row.git_commit_sha,
     gitCommitMessage: row.git_commit_message,
+    pinnedCommitSha: row.pinned_commit_sha ?? null,
+    rebuiltFromDeploymentId: row.rebuilt_from_deployment_id ?? null,
     createdAt: row.created_at,
     startedAt: row.started_at,
     finishedAt: row.finished_at
@@ -19949,16 +20043,65 @@ var DeploymentsApi = class {
     return { current, target: production.slice(1).find(differs) ?? null };
   }
   /**
-   * Redeploys an existing READY deployment's artifact to production.
-   * Used by both `naro promote` (preview → production) and `naro rollback`
-   * (older production build → production).
+   * Promotes an existing READY deployment: with no `target` (or
+   * `production`) it goes to production — `naro promote` (preview →
+   * production) and `naro rollback` (older production build → production).
+   * A deployment from an environment is rebuilt from its commit with
+   * production's variables (`mode: "rebuild"`); any other is published as
+   * stored (`mode: "reupload"`). With an environment `target` the control
+   * plane likewise rebuilds the deployment's commit with that environment's
+   * variables or publishes the stored build.
+   *
+   * No `target` sends no body, exactly as clients before targets did. A
+   * control plane from before targets ignores `target` and promotes to
+   * production, so an environment target is first checked with
+   * `promoteCheck`: a 405 there (no such route) stops with
+   * `PROMOTE_TARGET_UNSUPPORTED` before anything is promoted. The target is
+   * trimmed once, as the control plane trims it, so `" production"` is
+   * production and asks no preview.
+   */
+  async promote(projectId, deploymentId, options = {}) {
+    const target2 = options.target?.trim();
+    if (target2 !== void 0 && target2 !== "production") {
+      try {
+        await this.promoteCheck(projectId, deploymentId, target2);
+      } catch (error51) {
+        if (isNaroError(error51) && error51.status === 405) {
+          throw promoteTargetUnsupported(error51);
+        }
+        throw error51;
+      }
+    }
+    const body = await this.client.request(this.promotePath(projectId, deploymentId), {
+      method: "POST",
+      ...target2 !== void 0 ? { body: { target: target2 } } : {},
+      context: "Promote deployment"
+    });
+    return {
+      ...deploymentInfo(body.deployment),
+      mode: body.mode ?? "reupload"
+    };
+  }
+  /**
+   * What promoting to `target` would do, changing nothing: how it gets its
+   * build, the migrations the target's database has not applied (null when
+   * they cannot be compared) and the warnings to show first. Answers 405 from
+   * a control plane that predates promote targets.
    */
-  async promote(projectId, deploymentId) {
+  async promoteCheck(projectId, deploymentId, target2) {
+    const query = target2 !== void 0 ? `?target=${encodeURIComponent(target2)}` : "";
     const body = await this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`,
-      { method: "POST", context: "Promote deployment" }
+      `${this.promotePath(projectId, deploymentId)}${query}`,
+      { context: "Check promotion" }
     );
-    return deploymentInfo(body.deployment);
+    return {
+      mode: body.mode ?? "reupload",
+      pendingMigrations: body.pendingMigrations ?? null,
+      warnings: body.warnings ?? []
+    };
+  }
+  promotePath(projectId, deploymentId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`;
   }
   /**
    * Stops an in-flight build (QUEUED through BUILDING) and marks the row
@@ -20713,6 +20856,7 @@ function storageInfo(body) {
   return {
     enabled: body.enabled,
     bucket: body.bucket ?? null,
+    disabledAt: body.disabledAt ?? null,
     limits: {
       bytes: body.limits.bytes,
       objectBytes: body.limits.objectBytes,
@@ -20724,6 +20868,18 @@ function storageInfo(body) {
     buckets: (body.buckets ?? []).map(storageBucket)
   };
 }
+function storageRunFailure(error51) {
+  const details = isNaroError(error51) ? error51.details : void 0;
+  if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
+    return new NaroError(error51.code, error51.message, {
+      ...error51.status !== void 0 ? { status: error51.status } : {},
+      details: {
+        ...details,
+        backend: backendInfo(details.backend)
+      }
+    });
+  return error51;
+}
 function bucketFields(fields, into = {}) {
   for (const key of ["public", "fileSizeLimit", "allowedMimeTypes"])
     if (fields[key] !== void 0) into[key] = fields[key];
@@ -21152,16 +21308,45 @@ var StorageApi = class {
         }
       );
     } catch (error51) {
-      const details = isNaroError(error51) ? error51.details : void 0;
-      if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
-        throw new NaroError(error51.code, error51.message, {
-          ...error51.status !== void 0 ? { status: error51.status } : {},
-          details: {
-            ...details,
-            backend: backendInfo(details.backend)
-          }
-        });
-      throw error51;
+      throw storageRunFailure(error51);
+    }
+    return storageInfo(body.storage);
+  }
+  /**
+   * Turns Storage off and keeps its files (Storage 3-1k): the Naro worker is
+   * uploaded again without the bucket, so the app's Storage calls and file
+   * URLs answer `404 STORAGE_NOT_ENABLED` until `enable` binds the same
+   * bucket again. The bucket, its files and their storage cost stay; while
+   * it is off, bucket writes and the object routes answer `409
+   * STORAGE_OFF`, and reads go on. Safe to repeat: Storage never on, or
+   * already off, comes back as it is, and a turn-off that stopped is
+   * finished. Two minutes, like `enable`.
+   *
+   * Refusals, in the order they are checked: `BACKEND_DISABLED`,
+   * `FORBIDDEN` (`storage.manage`), `DATABASE_NOT_ENABLED`,
+   * `BACKEND_NOT_READY` (no backend), `BACKEND_OFF`, `BACKEND_BUSY` (another
+   * change holds the backend — or turning Storage on again took this
+   * turn-off over, and Storage is on), `STORAGE_DISABLE_FAILED` (502: the
+   * turn-off could not be recorded; nothing changed), and
+   * `BACKEND_PROVISION_FAILED` (502) when it is
+   * recorded but the worker's upload — or a step after it — stopped:
+   * `details` holds `{ storage: { applied: false, enabled: false }, backend
+   * }`, and `disable` again finishes. Never `STORAGE_DISABLED`: the control
+   * plane's Storage switch does not hold a removal back.
+   */
+  async disable(projectId) {
+    let body;
+    try {
+      body = await this.client.request(
+        this.path(projectId),
+        {
+          method: "DELETE",
+          context: "Turn off Storage",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      );
+    } catch (error51) {
+      throw storageRunFailure(error51);
     }
     return storageInfo(body.storage);
   }
@@ -31628,6 +31813,7 @@ export {
   splitStatements,
   ANALYTICS_FILTER_KEYS,
   NaroError,
+  promoteTargetUnsupported,
   isNaroError,
   toNaroError,
   saveSession,

package/dist/deploy.js

@@ -7,7 +7,7 @@ import {
   readProjectEnv,
   slugify,
   workingTreeNotices
-} from "./chunk-ZO2BEC46.js";
+} from "./chunk-SAA66XLD.js";
 import "./chunk-K3NQKI34.js";
 export {
   deployDirectory,

package/dist/index.js

@@ -63,6 +63,7 @@ import {
   policiesForTypes,
   policiesLostByReset,
   projectPath,
+  promoteTargetUnsupported,
   promptForMissingEnv,
   pullEnv,
   quoteIdent,
@@ -96,7 +97,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-ZO2BEC46.js";
+} from "./chunk-SAA66XLD.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -195,7 +196,8 @@ var STRING_FLAGS = {
   "--search": "search",
   "--copy-env": "copyEnv",
   "--database": "database",
-  "--protection": "protection"
+  "--protection": "protection",
+  "--to": "to"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -5523,17 +5525,27 @@ async function runProjectInspect(context) {
 }
 
 // src/commands/promote.ts
-async function promoteAndWait(context, client, project, sourceDeploymentId, action) {
+var PROMOTE_USAGE = "Usage: naro promote <deployment-id> [--to <environment>]";
+var ROLLBACK_USAGE = "Usage: naro rollback [deployment-id]";
+var REBUILD_TIMEOUT_MS = 15 * 6e4;
+var REUPLOAD_TIMEOUT_MS = 5 * 6e4;
+async function promoteAndWait(context, client, project, sourceDeploymentId, action, target) {
   const promoted = await client.deployments.promote(
     project.id,
-    sourceDeploymentId
+    sourceDeploymentId,
+    target !== void 0 ? { target } : void 0
   );
+  const rebuild = promoted.mode === "rebuild";
   context.output.log(
-    `\u25B8 ${action === "promote" ? "promoting" : "rolling back to"} ${sourceDeploymentId}`
+    `\u25B8 ${action === "promote" ? "promoting" : "rolling back to"} ${sourceDeploymentId}${target !== void 0 ? ` to ${target} (${promoted.mode})` : ""}`
+  );
+  const detail = await client.deployments.wait(
+    promoted.id,
+    rebuild ? {
+      timeoutMs: REBUILD_TIMEOUT_MS,
+      onLog: (log) => context.output.log(formatBuildLog(log))
+    } : { timeoutMs: REUPLOAD_TIMEOUT_MS }
   );
-  const detail = await client.deployments.wait(promoted.id, {
-    timeoutMs: 5 * 6e4
-  });
   if (detail.deployment.status !== "READY") {
     throw new NaroError(
       detail.deployment.errorCode ?? "DEPLOY_FAILED",
@@ -5541,42 +5553,104 @@ async function promoteAndWait(context, client, project, sourceDeploymentId, acti
       { details: { deploymentId: promoted.id } }
     );
   }
+  const serving = target === void 0 || target === "production" ? "Production" : target;
   context.output.result(
     {
       deploymentId: promoted.id,
       sourceDeploymentId,
       projectId: project.id,
+      // Both say the mode the control plane answered (MCP's rollback does
+      // too). Only a promotion has a target: a rollback is production's.
+      ...action === "promote" ? { target: target ?? null } : {},
+      mode: promoted.mode,
       status: detail.deployment.status,
       url: detail.deployment.url
     },
     [
-      `\u2705 Production now serves ${sourceDeploymentId}`,
+      `\u2705 ${serving} now serves ${rebuild ? "a rebuild of " : ""}${sourceDeploymentId}`,
       "",
       detail.deployment.url ?? ""
     ]
   );
 }
+function promoteTarget(flags) {
+  if (flags.to === void 0) return void 0;
+  const target = flags.to.trim();
+  if (target === "" || target === "preview")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--to must be production or an environment name."
+    );
+  return target;
+}
+function refuseWhatIsNotRead(context, usage, envMessage) {
+  if (context.positionals.length > 1)
+    throw new NaroError("VALIDATION_FAILED", usage);
+  if (context.flags.env !== void 0)
+    throw new NaroError("VALIDATION_FAILED", envMessage);
+}
+async function previewPromotion(context, client, projectId, sourceDeploymentId, target) {
+  let check;
+  try {
+    check = await client.deployments.promoteCheck(
+      projectId,
+      sourceDeploymentId,
+      target
+    );
+  } catch (error) {
+    if (!isNaroError(error) || error.status !== 405) throw error;
+    if (target !== void 0 && target !== "production")
+      throw promoteTargetUnsupported(error);
+    return;
+  }
+  context.output.log(
+    check.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
+  );
+  for (const warning of check.warnings)
+    for (const line of warningLines(warning)) context.output.log(line);
+}
 async function runPromote(context) {
-  const [deploymentId] = context.positionalOrThrow(
-    1,
-    "Usage: naro promote <deployment-id>"
+  const [deploymentId] = context.positionalOrThrow(1, PROMOTE_USAGE);
+  refuseWhatIsNotRead(
+    context,
+    PROMOTE_USAGE,
+    "--env is not an option of naro promote: use --to <environment>."
   );
+  const target = promoteTarget(context.flags);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const project = await client.projects.get(projectId);
+  await previewPromotion(
+    context,
+    client,
+    projectId,
+    deploymentId,
+    target
+  );
   await confirmOrAbort(
     context,
-    `Promote ${String(deploymentId)} to production (${project.subdomain})?`
+    target === void 0 || target === "production" ? `Promote ${String(deploymentId)} to production (${project.subdomain})?` : `Promote ${String(deploymentId)} to ${target} (${project.subdomain}--${target})?`
   );
   await promoteAndWait(
     context,
     client,
     project,
     deploymentId,
-    "promote"
+    "promote",
+    target
   );
 }
 async function runRollback(context) {
+  if (context.flags.to !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--to is for naro promote: naro rollback always rolls production back."
+    );
+  refuseWhatIsNotRead(
+    context,
+    ROLLBACK_USAGE,
+    "--env is not an option of naro rollback: naro rollback always rolls production back."
+  );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const project = await client.projects.get(projectId);
@@ -5688,6 +5762,7 @@ var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --priva
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
 var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
 var ENABLE_FIRST = "Storage is not enabled yet; enabling it first.";
+var DISABLE_QUESTION3 = "Turn Storage off for this project? Its Storage calls and file URLs answer 404 until naro storage enable; buckets and files are kept.";
 var NO_BUCKETS = "No buckets yet. `naro storage bucket create <name>` makes one.";
 var IDLE_PAGES = 3;
 function bucketLine(bucket) {
@@ -5708,6 +5783,12 @@ function utcClock(iso) {
   const at = new Date(iso);
   return Number.isNaN(at.getTime()) ? null : at.toISOString().slice(11, 16);
 }
+function utcMinute(iso) {
+  const at = new Date(iso);
+  if (Number.isNaN(at.getTime())) return printable(iso);
+  const text = at.toISOString();
+  return `${text.slice(0, 10)} ${text.slice(11, 16)} UTC`;
+}
 function warnedPercent(value, limit) {
   if (limit === null || !(limit > 0)) return null;
   const percent2 = Math.floor(value * 100 / limit);
@@ -5749,6 +5830,13 @@ function meterLines(info) {
   return lines;
 }
 function storageLines(info) {
+  if (info.disabledAt !== null)
+    return [
+      `Storage:     off since ${utcMinute(info.disabledAt)} \u2014 buckets and files are kept`,
+      "Run `naro storage enable` to turn it on again: the same buckets and files come back.",
+      info.buckets.length === 0 ? "Buckets:     none" : `Buckets:     ${String(info.buckets.length)}`,
+      ...info.buckets.map(bucketLine)
+    ];
   if (!info.enabled)
     return [
       "Storage:     off",
@@ -5777,6 +5865,19 @@ async function enableStorage(client, projectId) {
     throw error;
   }
 }
+async function disableStorage(client, projectId) {
+  try {
+    return await client.storage.disable(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        "Turning Storage off did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage disable` again picks up where it stopped.",
+        { cause: error }
+      );
+    throw error;
+  }
+}
 function bucketName(context, usage) {
   if (context.positionals.length !== 1)
     throw new NaroError("VALIDATION_FAILED", usage);
@@ -5813,6 +5914,24 @@ async function runStorageEnable(context) {
     ...storageLines(storage)
   ]);
 }
+async function runStorageDisable(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const current = await client.storage.info(projectId);
+  if (current.bucket === null) {
+    context.output.result({ projectId, storage: current }, [
+      "Storage is already off."
+    ]);
+    return;
+  }
+  if (current.disabledAt === null)
+    await confirmOrAbort(context, DISABLE_QUESTION3);
+  const storage = await disableStorage(client, projectId);
+  context.output.result({ projectId, storage }, [
+    "\u2705 Storage is off. Buckets and files are kept; naro storage enable turns it on again.",
+    ...storageLines(storage)
+  ]);
+}
 async function runStorageBucketList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -8639,6 +8758,7 @@ var MV_USAGE = "Usage: naro storage mv naro://<bucket>/<from> naro://<bucket>/<t
 var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
 var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive] [--search <text>]";
 var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
+var STORAGE_OFF_MESSAGE = "Storage is turned off for this project. Turn it on with `naro storage enable` first.";
 var STORAGE_OUTDATED_MESSAGE = "The project backend is older than this Storage command. Run `naro backend enable` to update it, then try again.";
 var OLD_SEARCH_REASON = "search is not supported yet";
 function isOldSearchRefusal(error) {
@@ -8731,6 +8851,9 @@ async function objects(context) {
       "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
     );
   if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
+  const state = await client.storage.info(projectId);
+  if (state.disabledAt !== null)
+    throw new NaroError("STORAGE_OFF", STORAGE_OFF_MESSAGE);
   let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
   if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
     throw new NaroError(
@@ -9600,6 +9723,8 @@ Usage:
   naro storage [status]              Naro Storage: on or off, limits, what is stored, today's operations, the buckets
   naro storage enable                Turn Storage on: the project's R2 bucket, bound to its backend
                                      (safe to re-run; applies a plan change's limits)
+  naro storage disable [--yes]       Turn Storage off and keep its files: its calls and file URLs answer 404
+                                     until naro storage enable binds the same bucket again (asks first)
   naro storage bucket list           The buckets: public or private, objects, bytes, limits
   naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]
                                      <size>: bytes, 5MB (1000s) or 5MiB (1024s); turns Storage on first if needed
@@ -9624,7 +9749,10 @@ Usage:
                                      Remove objects; --recursive removes what is under a folder (asks first):
                                      <path>/ is the folder alone, <path> also an object of that name
 
-  naro promote <deployment-id>       Publish a build to production
+  naro promote <deployment-id> [--to <environment>]
+                                     Publish a build to production, or to an environment with --to; it says what it will do, then asks.
+                                     A build moving between an environment and another surface is built again from its commit with the
+                                     target's variables, which takes up to 15 minutes; any other build is published as stored.
   naro rollback [deployment-id]      Roll production back to the previous build
 
 Global options:
@@ -9648,6 +9776,7 @@ Global options:
   --device <d>    Only this device: desktop, mobile or tablet (naro analytics, naro insights)
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
+  --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
   --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
                   branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
@@ -9792,6 +9921,8 @@ function routeStorage(words) {
       return words.length <= 1 ? { handler: runStorageStatus, positionals: [] } : null;
     case "enable":
       return words.length === 1 ? { handler: runStorageEnable, positionals: [] } : null;
+    case "disable":
+      return words.length === 1 ? { handler: runStorageDisable, positionals: [] } : null;
     case "bucket":
     case "buckets":
       switch (action) {
@@ -9836,7 +9967,16 @@ function routeStorage(words) {
       return null;
   }
 }
+async function refuseTo() {
+  throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
+}
 function route(parsed) {
+  const routed = routeCommand(parsed);
+  if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
+    return { handler: refuseTo, positionals: routed.positionals };
+  return routed;
+}
+function routeCommand(parsed) {
   const { command, positionals } = parsed;
   const sub = positionals[0];
   switch (command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -37,8 +37,8 @@
     "@next-deploy/build": "0.1.0",
     "@next-deploy/core": "0.1.0",
     "@next-deploy/config": "0.1.0",
-    "@next-deploy/sdk": "0.1.0",
-    "@next-deploy/data-core": "0.1.0"
+    "@next-deploy/data-core": "0.1.0",
+    "@next-deploy/sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",