naro-cli 0.11.0 → 0.12.0

package/dist/deploy.js

@@ -5,7 +5,7 @@ import {
   parseDotenv,
   readProjectEnv,
   slugify
-} from "./chunk-L7JOGWP3.js";
+} from "./chunk-GFCG5C7D.js";
 import "./chunk-K3NQKI34.js";
 export {
   deployDirectory,

package/dist/index.js

@@ -2,11 +2,16 @@
 import {
   BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
+  INDEX_SQL,
+  NAMED_POLICY_SQL,
+  NAMED_POLICY_TABLE,
   NaroClient,
   NaroError,
   POLICY_ACTIONS,
   POLICY_RULES,
+  RESET_BACKEND_OUTDATED,
   RESTORE_OUTCOME_UNKNOWN_CODES,
+  SCHEMA_SQL,
   buildResetPlan,
   cellText,
   clearSession,
@@ -20,6 +25,7 @@ import {
   ensureGitignoreHasNaro,
   formatRedirectEntry,
   generateTypes,
+  indexesFromRows,
   isBookmark,
   isExpired,
   isNaroError,
@@ -27,6 +33,7 @@ import {
   isTerminalStatus,
   lintSchema,
   listMigrationFiles,
+  loadPolicy,
   loadStoredSession,
   login,
   migrationNameMismatch,
@@ -38,7 +45,9 @@ import {
   parsePolicyStatement,
   parseRedirectEntry,
   pendingMigrationNames,
+  planPolicyMigration,
   policiesForTypes,
+  policiesLostByReset,
   projectPath,
   promptForMissingEnv,
   quoteIdent,
@@ -47,18 +56,26 @@ import {
   refreshStoredSession,
   removeProjectLink,
   renderRows,
+  resetFileRefusedMessage,
+  resetPoliciesLostMessage,
+  resetPoliciesWithTablesMessage,
   resolveAuth,
   resolveMigrationsDir,
   saveSession,
   schemaMigrationTitle,
   serializeDotenv,
   slugify,
+  snapshotFromRows,
   splitPolicyStatements,
+  splitStatements,
+  storedPolicySql,
   summarizeStatement,
   systemTablePredicate,
+  tableNames,
   toNaroError,
+  unreadablePolicyComment,
   writeProjectLink
-} from "./chunk-L7JOGWP3.js";
+} from "./chunk-GFCG5C7D.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -450,8 +467,8 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname3, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/commands/auth.ts
@@ -586,6 +603,22 @@ function printable(text) {
 function isPrintable(text) {
   return printable(text) === text;
 }
+var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
+function warningLines(message) {
+  return message.split("\n").map(
+    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
+  );
+}
+function policyProblems(dir, names) {
+  return names.flatMap((name) => {
+    const split = splitStatements(readFileSync(join(dir, name), "utf8"));
+    if (!split.ok) return [];
+    const planned = planPolicyMigration(
+      split.statements.map((statement) => statement.text)
+    );
+    return planned.ok ? [] : [{ migration: name, message: planned.message }];
+  });
+}
 function warningLine(warning) {
   if (warning === "out-of-order")
     return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
@@ -636,23 +669,42 @@ async function runMigrationList(context) {
 }
 async function applyMigrationFiles(context, client, projectId, dir, names) {
   const applied = [];
+  const warnings = [];
   for (const name of names) {
     const sql = readFileSync(join(dir, name), "utf8");
+    let answer;
     try {
-      await client.db.applyMigration(projectId, { name, sql });
+      answer = await client.db.applyMigration(projectId, { name, sql });
     } catch (error) {
       if (!isNaroError(error)) throw error;
+      for (const message of serverWarnings(error.details))
+        for (const line of warningLines(message)) context.output.warn(line);
       const shown = context.output.json ? name : printable(name);
       throw new NaroError(error.code, `${shown}: ${error.message}`, {
         ...error.status === void 0 ? {} : { status: error.status },
-        details: { ...error.details, migration: name, applied },
+        details: {
+          ...error.details,
+          migration: name,
+          applied,
+          appliedWarnings: warnings
+        },
         cause: error
       });
     }
     context.output.log(`\u2713 ${printable(name)}`);
     applied.push(name);
+    for (const message of answer.warnings) {
+      warnings.push({ migration: name, message });
+      for (const line of warningLines(message)) context.output.warn(line);
+    }
   }
-  return applied;
+  return { applied, warnings };
+}
+function serverWarnings(details) {
+  const warnings = details?.warnings;
+  return Array.isArray(warnings) ? warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
 }
 var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
 var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
@@ -724,10 +776,15 @@ async function runMigrationUp(context) {
     return;
   }
   if (context.flags.dryRun) {
-    context.output.result({ projectId, dryRun: true, pending }, [
+    const problems = policyProblems(dir, pending);
+    context.output.result({ projectId, dryRun: true, pending, problems }, [
       `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable(name)}`)
+      ...pending.map((name) => `  ${printable(name)}`),
+      ...problems.map(
+        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
+      )
     ]);
+    if (problems.length > 0) process.exitCode = 1;
     return;
   }
   context.output.log(`Pending migrations (${String(pending.length)}):`);
@@ -736,14 +793,14 @@ async function runMigrationUp(context) {
     context,
     `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
   );
-  const applied = await applyMigrationFiles(
+  const { applied, warnings } = await applyMigrationFiles(
     context,
     client,
     projectId,
     dir,
     pending
   );
-  context.output.result({ projectId, applied, pending: [] }, [
+  context.output.result({ projectId, applied, pending: [], warnings }, [
     `\u2705 Applied ${String(applied.length)} migration(s).`
   ]);
 }
@@ -1658,6 +1715,8 @@ async function runDbQuery(context, deps = processStdin4) {
   });
   if (result.truncated) lines.push(ROW_CAP_NOTICE);
   context.output.result({ projectId, result }, lines);
+  for (const warning of result.warnings ?? [])
+    for (const line of warningLines(warning)) context.output.warn(line);
 }
 
 // src/commands/db-backup.ts
@@ -1998,6 +2057,77 @@ var DIAGNOSTICS_SQL = [
   "SELECT * FROM pragma_foreign_key_check;"
 ].join("\n");
 var TRUNCATED_NOTICE = "\u26A0 The diagnostics were cut at 10,000 rows \u2014 there may be more broken rows than these.";
+var POLICIES_TRUNCATED_NOTICE = "\u26A0 The policies were cut at 10,000 rows, so they were not checked.";
+var POLICY_TABLE_PROBE = `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '${NAMED_POLICY_TABLE}'`;
+var POLICY_READ_SQL = [NAMED_POLICY_SQL.list, INDEX_SQL, ...SCHEMA_SQL].map((sql) => `${sql};`).join("\n");
+function objectsOf(statement) {
+  return statement.rows.map(
+    (row) => Object.fromEntries(
+      statement.columns.map((column, index) => [column, row[index]])
+    )
+  );
+}
+async function readPolicies(client, projectId, warn) {
+  let backend;
+  try {
+    backend = await client.backend.info(projectId);
+  } catch (error) {
+    if (error instanceof NaroError && error.code === "BACKEND_DISABLED")
+      return void 0;
+    throw error;
+  }
+  if (backend.status === "none") return void 0;
+  const probe = await client.db.query(projectId, {
+    sql: POLICY_TABLE_PROBE,
+    readOnly: true
+  });
+  if ((probe.statements[0]?.rows.length ?? 0) === 0) return void 0;
+  const answer = await client.db.query(projectId, { sql: POLICY_READ_SQL });
+  const [stored, indexes, columns, definitions] = answer.statements;
+  if (stored === void 0 || indexes === void 0 || columns === void 0 || definitions === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The policies could not be read: the database answered with ${String(answer.statements.length)} result sets instead of 4.`
+    );
+  if (answer.truncated) {
+    warn(POLICIES_TRUNCATED_NOTICE);
+    return void 0;
+  }
+  const policies = [];
+  const unreadable = [];
+  for (const row of objectsOf(stored)) {
+    const policy = loadPolicy(row);
+    if (policy === void 0) continue;
+    if (policy.invalid !== null)
+      unreadable.push({
+        table: policy.table,
+        name: policy.name,
+        reason: policy.invalid
+      });
+    else
+      policies.push({
+        table: policy.table,
+        name: policy.name,
+        permissive: policy.permissive,
+        command: policy.command,
+        roles: policy.roles,
+        using: policy.using,
+        check: policy.check,
+        owner: policy.owner
+      });
+  }
+  const snapshot = snapshotFromRows([
+    ...objectsOf(columns),
+    ...objectsOf(definitions)
+  ]);
+  return {
+    tables: tableNames(snapshot),
+    policies,
+    unreadable,
+    snapshot,
+    indexes: indexesFromRows(objectsOf(indexes))
+  };
+}
 function firstCell(row) {
   const value = row[0];
   return value === null || value === void 0 ? "" : String(value);
@@ -2043,12 +2173,18 @@ async function runDbLint(context) {
     rowid: rowidOf(cellText(broken, row, "rowid")),
     parent: cellText(broken, row, "parent")
   }));
+  const policies = await readPolicies(
+    client,
+    projectId,
+    (message) => context.output.warn(message)
+  );
   const input = {
     tables: tables.filter((table) => !shadow.has(table.name)),
     foreignKeyCheck,
     quickCheck: quick.rows.map(firstCell),
     triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
-    virtualTables
+    virtualTables,
+    ...policies === void 0 ? {} : { policies }
   };
   const issues = lintSchema(input);
   const counted = countLintedTables(input);
@@ -2064,12 +2200,14 @@ async function runDbLint(context) {
 }
 
 // src/commands/db-reset.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
 var MAX_STATEMENTS = 50;
 var SCHEMA_FILTER = `${systemTablePredicate("name")} AND ${systemTablePredicate("tbl_name")}`;
-var SCHEMA_SQL = [
+var SCHEMA_SQL2 = [
   `SELECT type, name FROM sqlite_master WHERE type IN ('table', 'view', 'trigger') AND ${SCHEMA_FILTER} ORDER BY name;`,
   "SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'virtual';",
-  "SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('sqlite_sequence', 'd1_migrations');"
+  `SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('sqlite_sequence', 'd1_migrations', '${NAMED_POLICY_TABLE}');`
 ].join("\n");
 function literal(value) {
   return `'${value.replace(/'/g, "''")}'`;
@@ -2081,7 +2219,7 @@ function chunk(items2, size) {
   return pieces;
 }
 async function readSchema(client, projectId) {
-  const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
+  const schema = await client.db.query(projectId, { sql: SCHEMA_SQL2 });
   const [listed, virtual, internal] = schema.statements;
   if (listed === void 0 || virtual === void 0 || internal === void 0)
     throw new NaroError(
@@ -2127,7 +2265,54 @@ async function readSchema(client, projectId) {
     internal: {
       sqliteSequence: internalNames.has("sqlite_sequence"),
       ledger: internalNames.has("d1_migrations")
-    }
+    },
+    policyTable: internalNames.has(NAMED_POLICY_TABLE)
+  };
+}
+async function hasBackend(client, projectId) {
+  try {
+    return (await client.backend.info(projectId)).status !== "none";
+  } catch (error) {
+    if (isNaroError(error) && error.code === "BACKEND_DISABLED") return false;
+    throw error;
+  }
+}
+async function policyPlan(client, projectId, schema, dir, files) {
+  if (!schema.policyTable) {
+    if (await hasBackend(client, projectId))
+      throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
+    return { clearPolicies: false, lost: [], withTables: [] };
+  }
+  const answer = await client.db.query(projectId, {
+    sql: NAMED_POLICY_SQL.list
+  });
+  const stored = answer.statements[0];
+  if (stored === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      "The policies could not be read: the database answered with no result set."
+    );
+  if (answer.truncated)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      "The policies are too many to read in one pass: the list was cut at 10,000 rows, so the reset cannot tell which ones your migration files do not make."
+    );
+  const current = stored.rows.map((row) => ({
+    table: cellText(stored, row, "table_name"),
+    name: cellText(stored, row, "name"),
+    ...storedPolicySql(
+      Object.fromEntries(
+        stored.columns.map((column, index) => [column, row[index]])
+      )
+    )
+  }));
+  return {
+    clearPolicies: true,
+    ...policiesLostByReset({
+      current,
+      tables: schema.tables,
+      files: files.map((name) => readFileSync3(join3(dir, name), "utf8"))
+    })
   };
 }
 function resetStopped(context, error, bookmark, lead, message) {
@@ -2149,16 +2334,72 @@ async function runDbReset(context) {
   const dir = migrationsDir(context);
   const shownDir = relativeToCwd(context, dir);
   const files = listMigrationFiles(dir);
+  const problems = policyProblems(dir, files);
+  const problemLines = problems.map(
+    (problem) => `${context.output.json ? problem.migration : printable(problem.migration)}: ${context.output.json ? problem.message : printable(problem.message)}`
+  );
+  if (problems.length > 0 && !context.flags.dryRun)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `The control plane would refuse these migration files, so the reset would stop at the first of them with the schema already dropped. Nothing was changed:
+${problemLines.join("\n")}`,
+      { details: { problems } }
+    );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
-  const plan = buildResetPlan(await readSchema(client, projectId));
+  const { policyTable: policyTable2, ...input } = await readSchema(client, projectId);
+  const plan = buildResetPlan(input, { clearPolicies: policyTable2 });
   const { tables, views, triggers } = plan.dropped;
   const counts = `${String(tables.length)} table(s), ${String(views.length)} view(s) and ${String(triggers.length)} trigger(s)`;
   const dropped = tables.length + views.length + triggers.length;
+  const policies = await policyPlan(
+    client,
+    projectId,
+    { policyTable: policyTable2, tables },
+    dir,
+    files
+  );
+  const policiesNotInFiles = policies.lost.map((policy) => ({
+    name: `${policy.table}.${policy.name}`,
+    sql: policy.sql
+  }));
+  const policiesOfTablesNotInFiles = policies.withTables.map(
+    (policy) => `${policy.table}.${policy.name}`
+  );
+  const refused = policies.refused && {
+    migration: files[policies.refused.file] ?? "",
+    message: policies.refused.reason
+  };
+  if (refused && !problems.some((one) => one.migration === refused.migration))
+    context.output.warn(
+      `\u26A0 ${printable(resetFileRefusedMessage(refused.migration, refused.message))}`
+    );
+  if (policies.lost.length > 0) {
+    context.output.warn(
+      `\u26A0 ${printable(resetPoliciesLostMessage(policies.lost))}`
+    );
+    for (const policy of policies.lost)
+      for (const line of policy.statements.every(isPrintable) ? policy.statements : [UNSHOWN_WARNING_LINE])
+        context.output.warn(`  ${line}`);
+  }
+  if (policies.withTables.length > 0)
+    context.output.warn(
+      `\u26A0 ${printable(resetPoliciesWithTablesMessage(policies.withTables))}`
+    );
   if (context.flags.dryRun) {
     context.output.result(
-      { dryRun: true, tables, views, triggers, migrations: files },
+      {
+        dryRun: true,
+        tables,
+        views,
+        triggers,
+        migrations: files,
+        policiesNotInFiles,
+        policiesOfTablesNotInFiles,
+        problems,
+        ...refused ? { wouldBeRefused: refused } : {}
+      },
       [
         `Would drop ${counts}:`,
         ...views.map((name) => `  ${"view".padEnd(9)}${printable(name)}`),
@@ -2166,9 +2407,11 @@ async function runDbReset(context) {
         ...tables.map((name) => `  ${"table".padEnd(9)}${printable(name)}`),
         `Would re-apply ${String(files.length)} migration file(s) from ${shownDir}:`,
         ...files.map((name) => `  ${printable(name)}`),
-        "Nothing was changed."
+        "Nothing was changed.",
+        ...problemLines
       ]
     );
+    if (problems.length > 0 || refused) process.exitCode = 1;
     return;
   }
   if (bookmark !== null)
@@ -2200,15 +2443,16 @@ async function runDbReset(context) {
       `No migration files in ${shownDir} \u2014 the database is now empty.`
     );
   let reapplied = [];
+  let warnings = [];
   try {
     if (files.length > 0)
-      reapplied = await applyMigrationFiles(
+      ({ applied: reapplied, warnings } = await applyMigrationFiles(
         context,
         client,
         projectId,
         dir,
         files
-      );
+      ));
   } catch (error) {
     throw resetStopped(
       context,
@@ -2218,18 +2462,28 @@ async function runDbReset(context) {
       (underlying) => underlying
     );
   }
-  context.output.result({ dropped, reapplied: reapplied.length, bookmark }, [
-    `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
-    ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
-  ]);
+  context.output.result(
+    {
+      dropped,
+      reapplied: reapplied.length,
+      bookmark,
+      policiesNotInFiles,
+      policiesOfTablesNotInFiles,
+      warnings
+    },
+    [
+      `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+      ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
+    ]
+  );
 }
 
 // src/commands/db-schema.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve3 } from "path";
 
 // ../../packages/naro-sdk/src/query/filters.ts
@@ -2647,7 +2901,7 @@ function conditionsFrom(flags) {
 function patchFromFile(context, path, table) {
   let text;
   try {
-    text = readFileSync3(resolve3(context.cwd, path), "utf8");
+    text = readFileSync4(resolve3(context.cwd, path), "utf8");
   } catch {
     refuse2(`Could not read ${path}.`);
   }
@@ -2858,7 +3112,11 @@ var UNSHOWN = "has characters that cannot be shown here";
 function statementLine(policy) {
   if (policy.invalid !== null)
     return printable(
-      `-- ${policyNamed(policy.name, policy.table)} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped or created again.`
+      unreadablePolicyComment({
+        name: policy.name,
+        table: policy.table,
+        invalid: policy.invalid
+      })
     );
   return shownStatement(policy, policy.table, "naro policy list --json");
 }
@@ -2911,7 +3169,7 @@ function statementText(context) {
   let text = positional;
   if (file !== void 0) {
     try {
-      text = readFileSync3(resolve3(context.cwd, file), "utf8");
+      text = readFileSync4(resolve3(context.cwd, file), "utf8");
     } catch {
       refuse2(`Could not read ${file}.`);
     }
@@ -3273,13 +3531,13 @@ async function runSchemaChange(context, operations, question) {
   let file = null;
   let fileWarning;
   const relDir = relativeToCwd(context, dir);
-  const rel = join3(relDir === "." ? "" : relDir, name);
+  const rel = join4(relDir === "." ? "" : relDir, name);
   if (context.flags.noWrite) {
     fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
   } else {
     try {
       mkdirSync3(dir, { recursive: true });
-      writeFileSync3(join3(dir, name), result.sql, { flag: "wx" });
+      writeFileSync3(join4(dir, name), result.sql, { flag: "wx" });
       file = rel;
     } catch (error) {
       const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
@@ -4130,7 +4388,7 @@ async function runDomainsRemove(context) {
 
 // src/commands/env.ts
 import { existsSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseTarget(value) {
@@ -4233,7 +4491,7 @@ async function runEnvPull(context) {
   const vars = Object.fromEntries(
     selected.map((row) => [row.key, row.value ?? ""])
   );
-  const path = join4(context.cwd, file);
+  const path = join5(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -4595,16 +4853,21 @@ Usage:
        and today's writes against the daily write limit (UTC)
   naro db query <sql> | --file <f>   Run SQL against it (reads stdin when piped)
   naro db push [--dry-run]           Apply pending migrations from ./migrations (asks first; --yes to skip)
+                                     --dry-run checks their policy statements on this machine and
+                                     exits 1 on one the server would refuse
   naro db dump [--output <f>]        Download a SQL dump of the database (stdout by default)
        [--schema-only|--data-only] [--table a,b]  Cloudflare holds other queries until it finishes
   naro db restore --bookmark <id>    Roll the database back (Time Travel, last 30 days; asks first)
        | --timestamp <time> [--dry-run]  prints the command that undoes it
   naro db pull [--dir <d>]           Write the remote schema as migrations/0001_remote_schema.sql
                                      and record it as applied - a baseline (asks first)
-  naro db reset [--dir <d>]          Drop everything, clear the ledger, re-apply ./migrations
-       [--dry-run] [--yes]           (asks first; db restore --bookmark undoes it)
-  naro db lint [--strict]            Check the schema for what D1 actually trips on
-                                     (exits 1 on an error, --strict on a warning too)
+  naro db reset [--dir <d>]          Drop everything and clear the policies and the ledger, then re-apply
+       [--dry-run] [--yes]           ./migrations, which create the policies again. Refuses files the server
+                                     would refuse; lists first the policies the files do not make
+                                     (asks first; db restore --bookmark undoes it)
+  naro db lint [--strict]            Check the schema for what D1 actually trips on, and the RLS policies
+                                     (rls_no_policy, rls_policy_invalid, rls_policy_text_default,
+                                     rls_policy_unindexed; exits 1 on an error, --strict on a warning too)
   naro db table create <name> --column <spec> [--column <spec>\u2026]
        [--owner <column>] [--if-not-exists]  Create a table without SQL. <spec> is name:type[:modifier\u2026]:
                                      types integer, real, text, blob, numeric, boolean, datetime, json;
@@ -5035,8 +5298,8 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync4(
-        join5(dirname3(fileURLToPath(import.meta.url)), "..", "package.json"),
+      readFileSync5(
+        join6(dirname3(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -34,11 +34,11 @@
     "typescript": "7.0.2",
     "vitest": "3.2.7",
     "naro-js": "0.2.0",
-    "@next-deploy/build": "0.1.0",
-    "@next-deploy/config": "0.1.0",
-    "@next-deploy/sdk": "0.1.0",
+    "@next-deploy/core": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
-    "@next-deploy/core": "0.1.0"
+    "@next-deploy/sdk": "0.1.0",
+    "@next-deploy/config": "0.1.0",
+    "@next-deploy/build": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",