naro-cli 0.22.0 → 0.24.0

package/README.md

@@ -23,6 +23,13 @@ asks before opening a dotenv file to fill what is missing. Decline and it
 prints the `naro env add` commands instead. With `--yes`, `--json` or outside
 a TTY it never asks — it just lists what is missing and deploys.
 
+When those names give away a service you are already running, the deploy says
+so instead of leaving you with a list of names. An app that talks to an
+existing Supabase project prints `Supabase — in that project's dashboard:` and
+the screen each missing value is on, so moving the app here is a copy from one
+tab to another. naro never calls Supabase: the values arrive like any other
+env var, from `.env.local` once you agree or from `naro env add`.
+
 Values you register are encrypted at rest, and `naro env pull` /
 `naro env list --reveal` can read them back — your account credentials are
 effectively your env credentials.
@@ -220,6 +227,28 @@ naro realtime tables add <table>…  Publish tables' changes (within about 10 se
 naro realtime tables remove <table>… [--yes]
                                    Stop publishing tables' changes (asks first)
 
+naro functions [list]              Naro Functions: name, version, verify_jwt, status and URL of each function
+naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
+naro functions deploy [name…] [--no-verify-jwt] [--import-map <file>] [--skip-check]
+                                   Bundle on this machine (Node.js 22 or later), check that it starts, upload;
+                                   every function in the folder when no name is given
+naro functions versions <name>     Its stored versions, newest first
+naro functions rollback <name> [<version>]
+                                   Put an earlier version live again (the one before the live one by default)
+naro functions delete <name>       Delete it: its URL stops working (asks first; --yes to skip)
+naro functions logs <name> [--level <l>] [--follow]
+                                   Its newest log lines
+naro functions secrets [list]      The project's function secrets: names and digests, never values
+naro functions secrets set <NAME>  Set one (value from a hidden prompt or stdin), then sync the functions
+                                   (--no-sync leaves them to the control plane's sweep)
+naro functions secrets import <file>
+                                   Set a dotenv file's lines (asks first; --yes in CI)
+naro functions secrets unset <NAME>…
+                                   Remove secrets (asks first)
+naro functions secrets sync [--registry]
+                                   Upload out-of-date functions again until none is left; --registry also rewrites
+                                   the function list in the project's database (after naro db restore)
+
 naro promote <deployment-id> [--to <environment>]   Publish a build to production, or to an environment (0.20.0); says rebuild or reupload first, then asks
 naro rollback [deployment-id]      Back to the previous production build
 ```
@@ -855,6 +884,35 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.24.0
+
+- `naro deploy` names the service behind the env vars it is missing. Names that
+  are `SUPABASE_*` under any framework prefix (`NEXT_PUBLIC_`, `VITE_`,
+  `EXPO_PUBLIC_`, …) print `Supabase — in that project's dashboard:` beneath
+  the missing-keys line, then only the screens a missing value is actually on —
+  `the project URL — the Connect dialog at the top of the page` for a name
+  ending `_URL`, `the keys — Settings > API Keys` for one ending `_KEY`. A
+  `SUPABASE_*` name neither screen holds (`SUPABASE_ACCESS_TOKEN` is made on
+  the account, not in a project; `SUPABASE_DB_PASSWORD`, `SUPABASE_PROJECT_REF`
+  and `SUPABASE_JWT_SECRET` are elsewhere) gets no hint at all rather than a
+  screen it is not on. When other keys are missing too the line names only the
+  ones it placed. Nothing is sent to Supabase and no token is stored; the
+  values still come from `.env.local` with your consent or from
+  `naro env add`.
+- `naro realtime [status]` ends with the project's month of Realtime, across its environments: `This month (UTC, all environments): <n> messages · est. $<x.xx>`, or `This month (UTC): not metered yet` before the meter's first run (and from a control plane older than this). When an operator caps the project's monthly messages it adds `⚠ This project has used <p>% of its monthly realtime message limit (<limit>).` from 80%, and `⚠ This project has used its realtime messages for this month. Realtime resumes on the 1st at 00:00 UTC.` once new connections are refused. `--json` carries the same as `realtime.usage`.
+- naro-mcp 0.23.0 goes out with it (no tool changes).
+
+### 0.23.0
+
+0.22.0 went out on 2026-10-31 without these.
+
+- `naro functions` — Naro Functions (early access; the control plane answers `FUNCTIONS_DISABLED` until it is switched on). `new` writes a function that imports `withNaro` from `naro-js/functions` (naro-js 0.7.0). `deploy` bundles on this machine with esbuild (Node.js 22 or later; `npm:`, `jsr:` and import maps from `deno.json`, `node:` modules as wrangler resolves them, URL imports refused), boots the bundle in workerd (`--skip-check` to skip) with each project secret's name set to the text `naro-boot-check-placeholder`, never its value, uploads it and puts it live; without a name, every function in `naro/functions` (or `--dir`). `list`, `versions`, `rollback <name> [<version>]`, `delete`, `logs [--follow]`.
+- `naro functions secrets set <NAME>` reads the value from stdin or a hidden prompt, never argv; `secrets import <file>` previews the names and each value's size in bytes, never the value; `secrets unset`; each syncs the live functions until none is left (`--no-sync` to leave it to the control plane). `secrets sync [--registry]` finishes a stopped sync and, with `--registry`, rewrites the function list after `naro db restore`. A sync makes at most 110 calls.
+- `naro backend keys rotate` reads the function list before it asks (production's key only: functions are not on an environment's backend, so `--env <name>` reads none): with live functions, the question says they pick up the new key within minutes, and the functions are synced after the rotation (a stop is a warning, not a failure; with `--json`, `functions.error` says why it stopped).
+- naro-cli now depends on esbuild, miniflare, unenv and @cloudflare/unenv-preset directly, at the versions its wrangler pins.
+- Every request names this CLI in an `X-Naro-Client` header (`naro-cli/0.23.0`; naro-mcp 0.22.0 sends `naro-mcp/0.22.0`). Once the operator turns the check on (it waits for these versions to be on npm), the control plane refuses, on a project that has environments, a change to its data sent with a token, no `?environment=` and no such header, with `400 ENVIRONMENT_REQUIRED` — the `db` and `migration` routes, and the backend's keys, sign-in, users, policies, Storage and Realtime, when the call is not a read or reveals a key (turning the backend on or off is not one of them): 0.21.0 and earlier drop `--env` without a word, and their `naro db query "drop table t" --env qa` would have changed production. 0.22.0 understands `--env` but sends no header, so it is refused too on such a project, `--env production` included (it sends no parameter for production): update. Other reads are not refused; scripts that call the API with a token add `?environment=production`.
+- naro-mcp 0.22.0 goes out with it and adds the `functions` tools (see its README). It needs this naro-cli: 0.22.0 and earlier have no `deployFunctions`.
+
 ### 0.22.0
 
 0.21.0 went out without this.

package/dist/args.d.ts

@@ -0,0 +1,238 @@
+export interface GlobalFlags {
+    json: boolean;
+    yes: boolean;
+    debug: boolean;
+    help: boolean;
+    version: boolean;
+    prod: boolean;
+    follow: boolean;
+    reveal: boolean;
+    /**
+     * Optional, unlike the booleans above: callers that build flags by hand
+     * (tests, embedders) predate it and must keep compiling.
+     */
+    wait?: boolean | undefined;
+    /**
+     * `naro domains add --no-www`: register an apex on its own instead of the
+     * apex/www pair the dashboard creates by default.
+     */
+    noWww?: boolean | undefined;
+    token?: string | undefined;
+    project?: string | undefined;
+    team?: string | undefined;
+    cwd?: string | undefined;
+    name?: string | undefined;
+    root?: string | undefined;
+    branch?: string | undefined;
+    type?: string | undefined;
+    env?: string | undefined;
+    level?: string | undefined;
+    /** `naro insights --metric inp`: the metric of the sections; the server checks it. */
+    metric?: string | undefined;
+    /** `naro insights --range 30d`: how far back; the server checks it. */
+    range?: string | undefined;
+    /** `naro usage --month 2026-09`: a UTC calendar month; the server checks it. */
+    month?: string | undefined;
+    /** `naro insights --route '/posts/[id]'`: the paths opened under one route. */
+    route?: string | undefined;
+    /**
+     * `naro analytics` and `naro insights` narrow a report by these dimensions
+     * (spec 2026-10-08 §5); one value each, ANDed, checked by the server.
+     * `naro insights` has no referrer and refuses `--referrer`.
+     */
+    path?: string | undefined;
+    referrer?: string | undefined;
+    country?: string | undefined;
+    device?: string | undefined;
+    browser?: string | undefined;
+    os?: string | undefined;
+    /** `naro db query --file <path>`: read the SQL from a file instead of argv. */
+    file?: string | undefined;
+    /** `naro db push --dry-run`: list pending migrations without applying. */
+    dryRun?: boolean | undefined;
+    /** Output path (`naro gen types --output`). Input files use --file. */
+    output?: string | undefined;
+    /** `naro gen types --lang typescript`: the one language, and the default. */
+    lang?: string | undefined;
+    /** Migrations directory (`--dir`), relative to the cwd. */
+    dir?: string | undefined;
+    /** `naro db lint --strict`: a warning fails the run too, not only an error. */
+    strict?: boolean | undefined;
+    /** `naro db dump --schema-only`: CREATE statements, no rows. */
+    schemaOnly?: boolean | undefined;
+    /** `naro db dump --data-only`: rows, no CREATE statements. */
+    dataOnly?: boolean | undefined;
+    /**
+     * `naro db dump --table a,b`. A repeated flag keeps only its last value, so
+     * this is a comma list — split it with `listFlag`.
+     */
+    table?: string | undefined;
+    /** `naro db restore --timestamp`: RFC 3339 with a timezone, or Unix seconds. */
+    timestamp?: string | undefined;
+    /** `naro db restore --bookmark`: a Time Travel bookmark. */
+    bookmark?: string | undefined;
+    /**
+     * `naro migration repair --status applied|reverted`: which way the ledger
+     * row is wrong. A string, not two boolean flags, so `--status` can be
+     * missing (the command refuses to guess) rather than silently defaulting.
+     */
+    status?: string | undefined;
+    /** `naro backend keys rotate --anon`: replace the anon key. */
+    anon?: boolean | undefined;
+    /** `naro backend keys rotate --service`: replace the service key. */
+    service?: boolean | undefined;
+    /**
+     * `naro policy set <table> --select <rule>` and its three siblings. Strings,
+     * so the command can name the flag whose rule it does not know.
+     */
+    selectRule?: string | undefined;
+    insertRule?: string | undefined;
+    updateRule?: string | undefined;
+    deleteRule?: string | undefined;
+    /** `naro policy set --owner <column>`: the column `owner` compares with the user id. */
+    ownerColumn?: string | undefined;
+    /**
+     * `naro db table create|add-column --column <spec>`. The one flag that
+     * repeats: every value, in order (spec 2026-09-24 P2-4 §9.2).
+     */
+    columns?: string[] | undefined;
+    /** `naro db table create --if-not-exists`: leave an existing table alone. */
+    ifNotExists?: boolean | undefined;
+    /** `naro db index create --unique`. */
+    unique?: boolean | undefined;
+    /** `naro db table|index … --no-write`: apply, but write no migration file. */
+    noWrite?: boolean | undefined;
+    /**
+     * `naro policy set <table> --select-when '<filter>'` and its siblings
+     * (P2-2): a condition in Supabase's filter syntax. `--insert-when` is
+     * insert's check, `--update-when` update's using, `--update-check` its
+     * check.
+     */
+    selectWhen?: string | undefined;
+    insertWhen?: string | undefined;
+    updateWhen?: string | undefined;
+    updateCheck?: string | undefined;
+    deleteWhen?: string | undefined;
+    /** `naro policy set --signed-in`: the conditions given need a signed-in user. */
+    signedIn?: boolean | undefined;
+    /** `naro policy set --from-file <path>`: the whole policy as JSON. */
+    fromFile?: string | undefined;
+    /**
+     * `naro policy create --allow-unindexed` (P2-7 적대적 리뷰 반영): accept a
+     * correlated subquery no index serves, which the control plane otherwise
+     * refuses — every run of it reads its whole table.
+     */
+    allowUnindexed?: boolean | undefined;
+    /** `naro backend auth email set --provider resend` (P2-6). */
+    provider?: string | undefined;
+    /** `naro backend auth email set --from "App <no-reply@example.com>"`. */
+    from?: string | undefined;
+    /** `naro backend auth oauth set <provider> --client-id <id>`. */
+    clientId?: string | undefined;
+    /**
+     * `--api-key-stdin` / `--client-secret-stdin`: the secret comes from stdin
+     * (a pipe, or a hidden prompt in a terminal) — never from argv, where it
+     * would land in shell history.
+     */
+    apiKeyStdin?: boolean | undefined;
+    clientSecretStdin?: boolean | undefined;
+    /** `naro backend users create --username <name>` (spec 2026-09-26 §2.2). */
+    username?: string | undefined;
+    /** `naro backend users create --email <address>`. */
+    email?: string | undefined;
+    /**
+     * `naro backend users create --password <password>`: allowed, unlike the
+     * other secrets, but it lands in shell history, so the command warns;
+     * `--password-stdin` is the way that does not.
+     */
+    password?: string | undefined;
+    passwordStdin?: boolean | undefined;
+    /** `naro backend auth password --min-length <n>` (spec 2026-09-26 §2.4). */
+    minLength?: string | undefined;
+    /** `naro storage bucket create|update --public`: anyone with the URL may download its objects. */
+    public?: boolean | undefined;
+    /** `naro storage bucket update --private`: only the policies decide again. */
+    private?: boolean | undefined;
+    /** `naro storage bucket create|update --file-size-limit <size>`: bytes, 5MB or 5MiB; `none` clears it. */
+    fileSizeLimit?: string | undefined;
+    /** `naro storage bucket create|update --allowed-mime-types <t,…>`: a comma list; `any` clears it. */
+    allowedMimeTypes?: string | undefined;
+    /** `naro storage bucket remove --empty`: delete the bucket's objects first. */
+    empty?: boolean | undefined;
+    /** `naro storage ls|rm --recursive` (`-r`): everything under a folder. */
+    recursive?: boolean | undefined;
+    /**
+     * `naro storage ls --search <text>`: the names below the prefix that start
+     * with it, ASCII case ignored (Storage 3-1g); the worker checks it.
+     */
+    search?: string | undefined;
+    /**
+     * `naro storage cp --upsert`: replace an object that is there, in an
+     * upload or in a copy inside Storage. `naro storage mv` refuses it.
+     */
+    upsert?: boolean | undefined;
+    /**
+     * `naro storage cp --content-type <t>`: an upload's type; by default from
+     * the extension. A copy inside Storage keeps the object's own, and
+     * `naro storage mv` takes none: both refuse the flag.
+     */
+    contentType?: string | undefined;
+    /**
+     * `naro storage cp --cache-control <seconds>`: how long a browser may keep
+     * an upload. A copy inside Storage keeps the object's own, and
+     * `naro storage mv` takes none: both refuse the flag.
+     */
+    cacheControl?: string | undefined;
+    /**
+     * `naro environments set --no-branch`: no branch deploys to the environment
+     * any more. Not with `--branch`; the command says so.
+     */
+    noBranch?: boolean | undefined;
+    /**
+     * `naro environments create --copy-env preview|production|none`: where the
+     * new environment's variables come from. Strings, so the command can name
+     * the flag whose value it does not know.
+     */
+    copyEnv?: string | undefined;
+    /** `naro environments create --database schema|empty`: what the new environment's database starts with. */
+    database?: string | undefined;
+    /** `naro environments set --protection on|off`: who may open the environment. */
+    protection?: string | undefined;
+    /** `naro functions deploy --no-verify-jwt`: the version takes calls without a project JWT (wins over function.json). */
+    noVerifyJwt?: boolean | undefined;
+    /** `naro functions deploy --skip-check`: upload without booting the bundle in workerd first. */
+    skipCheck?: boolean | undefined;
+    /** `naro functions deploy --import-map <file>`: the import map for functions whose folder has none. */
+    importMap?: string | undefined;
+    /** `naro functions secrets set|import|unset --no-sync`, `naro backend keys rotate --no-sync`: leave the functions to the sweep. */
+    noSync?: boolean | undefined;
+    /** `naro functions secrets sync --registry`: write the function list in the project's database again too. */
+    registry?: boolean | undefined;
+    /**
+     * `naro promote <id> --to <environment>`: where the deployment goes —
+     * `production` or an environment's slug. A string, so the command can refuse
+     * an empty one or `preview` before it sends anything.
+     */
+    to?: string | undefined;
+}
+export interface ParsedArgs {
+    command: string | undefined;
+    /** Positional arguments after the command (sub-commands, ids, keys...). */
+    positionals: string[];
+    flags: GlobalFlags;
+    /** Flags the parser did not recognize, e.g. ["--frod"]. */
+    unknown: string[];
+}
+/** The message for a secret given in argv, or null when there was none. */
+export declare function secretFlagProblem(unknown: readonly string[]): string | null;
+export declare const SECRETS_ARGV_REFUSAL = "Secrets are read from stdin or a file, never from the command line: pipe the value into naro functions secrets set <NAME>, or put it in a file for naro functions secrets import <file>.";
+/**
+ * The refusal for options naro does not know. `naro functions secrets set
+ * <NAME>` takes its value on stdin, so an unknown option there may be the
+ * value itself (`-----BEGIN …`, `--value=…`): it is refused without being
+ * shown. Every other command names the options as before.
+ */
+export declare function unknownOptionProblem(parsed: ParsedArgs): string;
+/** A comma-list flag (`--table users, posts`) as its trimmed, non-empty pieces. */
+export declare function listFlag(value: string | undefined): string[];
+export declare function parseArgs(argv: string[]): ParsedArgs;