naro-cli 0.23.0 → 0.24.0

package/README.md

@@ -23,6 +23,13 @@ asks before opening a dotenv file to fill what is missing. Decline and it
 prints the `naro env add` commands instead. With `--yes`, `--json` or outside
 a TTY it never asks — it just lists what is missing and deploys.
 
+When those names give away a service you are already running, the deploy says
+so instead of leaving you with a list of names. An app that talks to an
+existing Supabase project prints `Supabase — in that project's dashboard:` and
+the screen each missing value is on, so moving the app here is a copy from one
+tab to another. naro never calls Supabase: the values arrive like any other
+env var, from `.env.local` once you agree or from `naro env add`.
+
 Values you register are encrypted at rest, and `naro env pull` /
 `naro env list --reveal` can read them back — your account credentials are
 effectively your env credentials.
@@ -877,6 +884,24 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.24.0
+
+- `naro deploy` names the service behind the env vars it is missing. Names that
+  are `SUPABASE_*` under any framework prefix (`NEXT_PUBLIC_`, `VITE_`,
+  `EXPO_PUBLIC_`, …) print `Supabase — in that project's dashboard:` beneath
+  the missing-keys line, then only the screens a missing value is actually on —
+  `the project URL — the Connect dialog at the top of the page` for a name
+  ending `_URL`, `the keys — Settings > API Keys` for one ending `_KEY`. A
+  `SUPABASE_*` name neither screen holds (`SUPABASE_ACCESS_TOKEN` is made on
+  the account, not in a project; `SUPABASE_DB_PASSWORD`, `SUPABASE_PROJECT_REF`
+  and `SUPABASE_JWT_SECRET` are elsewhere) gets no hint at all rather than a
+  screen it is not on. When other keys are missing too the line names only the
+  ones it placed. Nothing is sent to Supabase and no token is stored; the
+  values still come from `.env.local` with your consent or from
+  `naro env add`.
+- `naro realtime [status]` ends with the project's month of Realtime, across its environments: `This month (UTC, all environments): <n> messages · est. $<x.xx>`, or `This month (UTC): not metered yet` before the meter's first run (and from a control plane older than this). When an operator caps the project's monthly messages it adds `⚠ This project has used <p>% of its monthly realtime message limit (<limit>).` from 80%, and `⚠ This project has used its realtime messages for this month. Realtime resumes on the 1st at 00:00 UTC.` once new connections are refused. `--json` carries the same as `realtime.usage`.
+- naro-mcp 0.23.0 goes out with it (no tool changes).
+
 ### 0.23.0
 
 0.22.0 went out on 2026-10-31 without these.

package/dist/{chunk-ALK4VTL2.js → chunk-XJIWWZ2T.js}

@@ -320,6 +320,33 @@ var PHASES = [
 ];
 var ACTIVE_STATUSES = new Set(PHASES);
 
+// ../../packages/core/src/dotenv.ts
+var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/dgm;
+var QUOTES = /* @__PURE__ */ new Set(["'", '"', "`"]);
+function parseDotenvDetailed(text3) {
+  const vars = {};
+  const unclosedQuotes = [];
+  const lines = text3.replace(/\r\n?/g, "\n");
+  let line = 1;
+  let counted = 0;
+  for (const match of lines.matchAll(LINE)) {
+    const key = match[1];
+    const raw = match[2] ?? "";
+    let value = raw.trim();
+    const maybeQuote = value[0];
+    if (maybeQuote !== void 0 && QUOTES.has(maybeQuote) && !value.includes(maybeQuote, 1)) {
+      const at = (match.indices?.[2]?.[0] ?? match.index) + (raw.length - raw.trimStart().length);
+      for (; counted < at; counted += 1) if (lines[counted] === "\n") line += 1;
+      unclosedQuotes.push(line);
+    }
+    value = value.replace(/^(['"`])([\s\S]*)\1$/gm, "$2");
+    if (maybeQuote === '"')
+      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+    vars[key] = value;
+  }
+  return { vars, unclosedQuotes };
+}
+
 // ../../packages/core/src/deployment-stall.ts
 var STALL_WINDOW_MS = 10 * 6e4;
 
@@ -15223,13 +15250,22 @@ var RESERVED_SUBDOMAINS = [
   "www"
 ];
 var BACKEND_WORKER_NAME_PREFIX = "naro-backend-";
+var AUTH_WORKER_NAME_PREFIX = "naro-auth-";
+var DATA_WORKER_NAME_PREFIX = "naro-data-";
+var NARO_WORKER_NAME_PREFIXES = [
+  BACKEND_WORKER_NAME_PREFIX,
+  AUTH_WORKER_NAME_PREFIX,
+  DATA_WORKER_NAME_PREFIX
+];
 var SUBDOMAIN_PATTERN = /^[a-z0-9](-?[a-z0-9])*$/;
 var SUBDOMAIN_MAX_LENGTH = 54;
 function subdomainProblem(value) {
   if (value.length < 1 || value.length > SUBDOMAIN_MAX_LENGTH) return "invalid";
   if (!SUBDOMAIN_PATTERN.test(value)) return "invalid";
   if (value.endsWith("-preview")) return "reserved";
-  if (value === BACKEND_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(BACKEND_WORKER_NAME_PREFIX))
+  if (NARO_WORKER_NAME_PREFIXES.some(
+    (prefix) => value === prefix.slice(0, -1) || value.startsWith(prefix)
+  ))
     return "reserved";
   if (value === FUNCTION_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(FUNCTION_WORKER_NAME_PREFIX))
     return "reserved";
@@ -21316,6 +21352,23 @@ var BackendApi = class {
       );
     return { backend, key };
   }
+  /**
+   * Replaces the access JWT's signing key (design 2026-11-01). Signing moves
+   * to the new key at once; tokens the old keys signed keep working until
+   * `previousKeysExpireAt` (their own 15 minutes), so nobody is signed out.
+   * The API keys and the sessions are untouched. A worker uploaded before
+   * this answers `BACKEND_OUTDATED` — `enable` updates it.
+   */
+  async rotateSigningKey(projectId) {
+    return this.client.request(
+      this.path(projectId, "/signing-key/rotate"),
+      {
+        method: "POST",
+        body: {},
+        context: "Rotate signing key"
+      }
+    );
+  }
   /**
    * The sign-in settings (spec P2-6 §12): email, Google and GitHub, the
    * allowed redirect origins, whether sign-in waits for a confirmed email,
@@ -22162,31 +22215,7 @@ function summarizeStatement(statement2) {
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { join as join20 } from "path";
-var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/dgm;
-var QUOTES = /* @__PURE__ */ new Set(["'", '"', "`"]);
-function parseDotenvDetailed(text3) {
-  const vars = {};
-  const unclosedQuotes = [];
-  const lines = text3.replace(/\r\n?/g, "\n");
-  let line = 1;
-  let counted = 0;
-  for (const match of lines.matchAll(LINE)) {
-    const key = match[1];
-    const raw = match[2] ?? "";
-    let value = raw.trim();
-    const maybeQuote = value[0];
-    if (maybeQuote !== void 0 && QUOTES.has(maybeQuote) && !value.includes(maybeQuote, 1)) {
-      const at = (match.indices?.[2]?.[0] ?? match.index) + (raw.length - raw.trimStart().length);
-      for (; counted < at; counted += 1) if (lines[counted] === "\n") line += 1;
-      unclosedQuotes.push(line);
-    }
-    value = value.replace(/^(['"`])([\s\S]*)\1$/gm, "$2");
-    if (maybeQuote === '"')
-      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
-    vars[key] = value;
-  }
-  return { vars, unclosedQuotes };
-}
+var QUOTES2 = /* @__PURE__ */ new Set(["'", '"', "`"]);
 function parseDotenv(text3) {
   return parseDotenvDetailed(text3).vars;
 }
@@ -22199,7 +22228,7 @@ function readProjectEnv(dir) {
 }
 var PLAIN = /^[^\s"'#$`\\]*$/;
 function bareReadsBack(value) {
-  return !/[#\r\n\u2028\u2029]/.test(value) && value.trim() === value && !QUOTES.has(value[0] ?? "");
+  return !/[#\r\n\u2028\u2029]/.test(value) && value.trim() === value && !QUOTES2.has(value[0] ?? "");
 }
 function dotenvValue(value) {
   if (PLAIN.test(value)) return value;
@@ -32031,6 +32060,43 @@ async function promptForMissingEnv(ctx, keys) {
   return collected;
 }
 
+// src/env-services.ts
+var PUBLIC_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "NUXT_PUBLIC_",
+  "EXPO_PUBLIC_",
+  "REACT_APP_",
+  "PUBLIC_",
+  "GATSBY_",
+  "VITE_"
+];
+function bareEnvKey(key) {
+  let longest = "";
+  for (const prefix of PUBLIC_PREFIXES)
+    if (key.startsWith(prefix) && prefix.length > longest.length)
+      longest = prefix;
+  return key.slice(longest.length);
+}
+function supabaseKeys(keys) {
+  return keys.filter((key) => bareEnvKey(key).startsWith("SUPABASE_"));
+}
+function envServiceHints(keys) {
+  const own2 = supabaseKeys(keys);
+  const isUrl = (key) => bareEnvKey(key).endsWith("_URL");
+  const isKey = (key) => bareEnvKey(key).endsWith("_KEY");
+  const placed = own2.filter((key) => isUrl(key) || isKey(key));
+  if (placed.length === 0) return [];
+  const lines = [
+    placed.length === keys.length ? "  Supabase \u2014 in that project's dashboard:" : `  Supabase (${placed.join(", ")}) \u2014 in that project's dashboard:`
+  ];
+  if (placed.some(isUrl))
+    lines.push(
+      "    the project URL \u2014 the Connect dialog at the top of the page"
+    );
+  if (placed.some(isKey)) lines.push("    the keys \u2014 Settings > API Keys");
+  return lines;
+}
+
 // src/env-surface.ts
 function pullEnv(rows, surface) {
   const chosen = /* @__PURE__ */ new Map();
@@ -34500,6 +34566,7 @@ async function deployDirectory(sourceDir, options, log2) {
     log2(
       `\u25B8 ${String(missing.length)} env var(s) needed, not set on this project: ${missing.join(", ")}`
     );
+    for (const line of envServiceHints(missing)) log2(line);
     const canCollect = environment === void 0 || options.projectId;
     if (options.onMissingEnv && canCollect)
       collected = await options.onMissingEnv(missing);
@@ -34640,6 +34707,7 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  parseDotenvDetailed,
   isFunctionName,
   parseGitHubRemote,
   schemaMigrationTitle,
@@ -34678,7 +34746,6 @@ export {
   cellText,
   renderRows,
   summarizeStatement,
-  parseDotenvDetailed,
   serializeDotenv,
   systemTablePredicate,
   MAX_SINGLE_UPLOAD_BYTES,

package/dist/deploy.js

@@ -9,7 +9,7 @@ import {
   readProjectEnv,
   slugify,
   workingTreeNotices
-} from "./chunk-ALK4VTL2.js";
+} from "./chunk-XJIWWZ2T.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,

package/dist/env-services.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Which outside service the env keys a deploy is missing belong to, and where
+ * that service keeps their values.
+ *
+ * The deploy already works out the names it needs by scanning the source
+ * (`scanEnvReferences`), but a list of bare names only helps someone who
+ * already knows where each value comes from. The first thing anyone moving an
+ * existing app here hits is exactly that gap: the app talks to a Supabase
+ * project that is already running, and the deploy asks for
+ * `NEXT_PUBLIC_SUPABASE_URL` without saying it is asking for something they
+ * have in another browser tab.
+ *
+ * This only names the service and the screen its values are on. Nothing here
+ * reaches Supabase's API, stores a token or creates anything there — the
+ * values still arrive the way every other env var does, from `.env.local`
+ * with the user's consent or from `naro env add`.
+ */
+/** The key without that prefix. The longest match wins, so order is free. */
+export declare function bareEnvKey(key: string): string;
+/**
+ * The given keys that name a Supabase project, in the order given.
+ *
+ * Everything Supabase hands a project is `SUPABASE_*`: the project URL, the
+ * publishable and secret keys, the legacy `anon` and `service_role` keys, the
+ * JWT secret, the account's access token, the database password. Matching the
+ * prefix rather than a fixed list keeps a name we have not seen — Supabase
+ * renamed its keys once already — from dropping out. A name that merely
+ * contains the word (`MY_SUPABASE_URL`) is not one of theirs.
+ *
+ * Belonging to Supabase is not the same as being on one of the screens
+ * `envServiceHints` knows; that function decides which of these it can place.
+ */
+export declare function supabaseKeys(keys: readonly string[]): string[];
+/**
+ * Lines naming the service the missing keys belong to, to print under the
+ * "env var(s) needed" line. Empty when nothing is recognised, which is the
+ * common case — this adds to that line, it never replaces it.
+ *
+ * Adding a second service means another `supabaseKeys`-shaped filter and
+ * another branch here. It is deliberately not a table of services yet: the
+ * useful half of each entry is the screen its values are on, and that is
+ * prose we can only write for a dashboard we have actually checked.
+ */
+export declare function envServiceHints(keys: readonly string[]): string[];

package/dist/index.js

@@ -128,7 +128,7 @@ import {
   warningLines,
   withFunctionRetries,
   writeProjectLink
-} from "./chunk-ALK4VTL2.js";
+} from "./chunk-XJIWWZ2T.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -1244,6 +1244,23 @@ async function runBackendKeysRotate(context) {
     ]
   );
 }
+async function runBackendSigningKeyRotate(context) {
+  const client = await dataClient(context);
+  const environment = dataEnvironment(context.flags);
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    "Replace the key that signs access tokens? New tokens are signed with the new key at once; tokens already issued keep working until they expire (up to 15 minutes). Nobody is signed out."
+  );
+  const rotated = await client.backend.rotateSigningKey(projectId);
+  context.output.result(
+    { projectId, ...rotated },
+    [
+      `\u2705 Replaced the signing key (kid ${rotated.kid}).`,
+      `Tokens signed with the old key work until ${rotated.previousKeysExpireAt}.`
+    ].map((line) => forEnvironment(line, environment))
+  );
+}
 
 // src/commands/backend-auth.ts
 var processStdin = {
@@ -6234,6 +6251,21 @@ function tableName(table3) {
 function linesFor(lines, environment) {
   return lines.map((line) => forEnvironment(line, environment));
 }
+function usageLines2(usage) {
+  if (usage === null) return ["This month (UTC): not metered yet"];
+  const lines = [
+    `This month (UTC, all environments): ${number(usage.messages)} messages \xB7 est. $${usage.estCostUsd.toFixed(2)}`
+  ];
+  if (usage.blocked)
+    lines.push(
+      "\u26A0 This project has used its realtime messages for this month. Realtime resumes on the 1st at 00:00 UTC."
+    );
+  else if (usage.messageLimit !== null && usage.messages >= Math.ceil(usage.messageLimit * 0.8))
+    lines.push(
+      `\u26A0 This project has used ${String(Math.floor(usage.messages * 100 / usage.messageLimit))}% of its monthly realtime message limit (${number(usage.messageLimit)}).`
+    );
+  return lines;
+}
 function realtimeLines(info) {
   if (!info.enabled)
     return [
@@ -6244,7 +6276,9 @@ function realtimeLines(info) {
   return [
     "Realtime: on (public channels: off)",
     info.tables.length === 0 ? "Published tables: none \u2014 naro realtime tables add <table>" : `Published tables: ${info.tables.map(tableName).join(", ")}`,
-    live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`
+    live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`,
+    // A control plane older than 3-2e sends no `usage`.
+    ...usageLines2(info.usage ?? null)
   ];
 }
 async function enableRealtime(client, projectId, environment) {
@@ -7422,6 +7456,9 @@ var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "STORAGE_OPS_QUOTA_EXCEEDED",
   // Realtime's REST broadcast over the project's message budget (x-retry-after: 1).
   "TOO_MANY_MESSAGES",
+  // The dispatcher's REST 429 of a project over its month of Realtime (3-2e):
+  // `x-retry-after` is the seconds to the 1st at 00:00 UTC.
+  "REALTIME_QUOTA_EXCEEDED",
   // Naro Functions (design F20): a team over its monthly function CPU, and
   // the control plane's Cloudflare limit. `invoke` reads x-retry-after on
   // every relay error anyway (invoke/client.ts).
@@ -9343,6 +9380,7 @@ var TableBuilder = class {
 var BACKOFF_STEPS_MS = [1e3, 2e3, 5e3, 1e4];
 var RATE_LIMITED_MIN_MS = 5e3;
 var IP_LIMIT_WAIT_MS = 6e4;
+var QUOTA_WAIT_MS = 9e5;
 var RESTART_JITTER_MS = 1e4;
 var UNOPENED_SLOWDOWN_AFTER = 6;
 var UNOPENED_DELAY_MS = 6e4;
@@ -9359,7 +9397,7 @@ function closeAction(code, reason) {
   if (code === 4401) return { kind: "session" };
   if (code === 4503) return { kind: "restart" };
   if (code === 4029)
-    return reason === "IP_RATE_LIMITED" ? { kind: "wait", ms: IP_LIMIT_WAIT_MS } : { kind: "retry", minMs: RATE_LIMITED_MIN_MS };
+    return reason === "IP_RATE_LIMITED" ? { kind: "wait", ms: IP_LIMIT_WAIT_MS } : reason === "REALTIME_QUOTA_EXCEEDED" ? { kind: "wait", ms: QUOTA_WAIT_MS } : { kind: "retry", minMs: RATE_LIMITED_MIN_MS };
   return { kind: "retry", minMs: 0 };
 }
 function backoffMs(attempt22, random) {
@@ -13131,7 +13169,7 @@ function projectName(project) {
     return `Moved to another team ${printable(project.projectId)}`;
   return printable(project.name ?? project.projectId);
 }
-function usageLines2(report, summary) {
+function usageLines3(report, summary) {
   const lines = [
     `${printable(report.team.slug)} \xB7 ${planName(report.team.plan)} plan \xB7 ${printable(report.month)} (UTC)`
   ];
@@ -13178,7 +13216,7 @@ async function runUsage(context) {
     month !== void 0 ? { month } : {}
   );
   const summary = summarizeTeamUsage(report, usageMonthOf(/* @__PURE__ */ new Date()));
-  context.output.result({ ...report, summary }, usageLines2(report, summary));
+  context.output.result({ ...report, summary }, usageLines3(report, summary));
 }
 
 // src/router.ts
@@ -13303,6 +13341,8 @@ Usage:
   naro backend keys [--reveal]       API keys; --reveal prints the service key (a secret; needs database write)
   naro backend keys rotate --anon|--service
                                      Replace a key; the old one stops working at once (asks first)
+  naro backend signing-key rotate    Replace the key that signs access tokens (if it may have leaked);
+                                     tokens already issued keep working up to 15 minutes (asks first)
   naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs,
                                      sign-ups and the minimum password length
   naro backend auth signups <on|off>
@@ -14032,6 +14072,13 @@ function routeCommand(parsed) {
               positionals: positionals.slice(2)
             };
           return null;
+        case "signing-key":
+          if (positionals[1] === "rotate")
+            return {
+              handler: runBackendSigningKeyRotate,
+              positionals: positionals.slice(2)
+            };
+          return null;
         case "auth":
           return routeBackendAuth(positionals.slice(1));
         case "users":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -37,14 +37,14 @@
     "tsx": "4.23.12",
     "typescript": "7.0.2",
     "vitest": "3.2.7",
-    "naro-js": "0.7.0",
-    "@next-deploy/config": "0.1.0",
     "@next-deploy/core": "0.1.0",
     "@next-deploy/build": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
+    "naro-js": "0.7.1",
+    "@next-deploy/functions-bundler": "0.1.0",
     "@next-deploy/functions-runtime": "0.1.0",
     "@next-deploy/sdk": "0.1.0",
-    "@next-deploy/functions-bundler": "0.1.0"
+    "@next-deploy/config": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",