naro-cli 0.24.0 → 0.25.0

package/README.md

@@ -27,7 +27,7 @@ When those names give away a service you are already running, the deploy says
 so instead of leaving you with a list of names. An app that talks to an
 existing Supabase project prints `Supabase — in that project's dashboard:` and
 the screen each missing value is on, so moving the app here is a copy from one
-tab to another. naro never calls Supabase: the values arrive like any other
+tab to another. Naro never calls Supabase: the values arrive like any other
 env var, from `.env.local` once you agree or from `naro env add`.
 
 Values you register are encrypted at rest, and `naro env pull` /
@@ -102,6 +102,8 @@ naro env remove DATABASE_URL       The production, preview and all values; an en
 naro env pull [.env.local]         Preview's values by default; --env production, or --env qa for an environment
                                    (its own value wins over all; an unknown name fails before anything is written,
                                    and so does a value no dotenv line reads back)
+naro supabase [list]               The project's Supabase links, per target (connect in the dashboard)
+naro supabase disconnect [target]  Remove a target's link, or (no target or all) every link your role may change, with its env vars (asks first)
 naro env import .env.qa qa         Upload every variable in a dotenv file to one target (all by default; asks first,
                                    --yes in CI; an unclosed quote, an invalid key, ASSETS or a value over 5 KB
                                    stops it before any request, and so does a key a storage binding already uses
@@ -255,7 +257,7 @@ naro rollback [deployment-id]      Back to the previous production build
 
 `naro domains list` reads the stored status; `naro domains verify` is the one
 that asks the DNS and Cloudflare again — and registers the domain on the spot
-once its CNAME points at naro — so it is what turns a stuck "pending" into the
+once its CNAME points at Naro — so it is what turns a stuck "pending" into the
 reason it is stuck. It exits non-zero while a domain is not live —
 with or without `--wait` — so CI can gate on it:
 
@@ -278,7 +280,7 @@ The check lasts 7 days. `naro domains list` shows open checks with their
 expiry, and adding the domain again prints the same token.
 
 `naro db dump` asks Cloudflare for the dump and streams it straight from
-Cloudflare's storage to the file — the bytes never pass through naro. While the
+Cloudflare's storage to the file — the bytes never pass through Naro. While the
 export runs, Cloudflare holds every other query to the database, so dump a busy
 production database when a short pause is acceptable. It ends with the bookmark
 the dump reflects; `naro db restore --bookmark <that>` brings the database back
@@ -337,13 +339,13 @@ naro db lint --strict --json || exit 1
 
 `db lint` changes nothing, but it needs **write** access to the database, not
 read: its two checks (`foreign_key_check`, `quick_check`) are whole-database
-scans, and naro classifies those as writes on purpose so a read-only role
+scans, and Naro classifies those as writes on purpose so a read-only role
 cannot start them. That is also the cost warning — both walk every row that
 has a foreign key, and `quick_check` walks the file, so on a large database
 the lint is billed rows-read and can run into the 30-second query limit. Run
 it in CI on a branch's own data, not on a busy production database.
 
-`naro db table` and `naro db index` change the schema without SQL. naro
+`naro db table` and `naro db index` change the schema without SQL. Naro
 renders the DDL from checked input — every name quoted, types and defaults
 from a fixed list — and applies it as one migration, recorded in
 `d1_migrations` and written to `./migrations` as `NNNN_schema_<op>_<table>.sql`,
@@ -392,7 +394,7 @@ reads `members`. The command names each policy the change breaks and why;
 
 SQLite cannot add a PRIMARY KEY, UNIQUE or NOT-NULL-without-default column, or
 drop a primary key, a unique or indexed column, or a table another table
-references; naro refuses those before it tries and says why. It also reads the
+references; Naro refuses those before it tries and says why. It also reads the
 SQL of your triggers and views, and refuses to drop or rename a table or
 column one of them uses (it warns when the SQL leaves that open) — drop or
 recreate the trigger or view with a migration first. Changing a
@@ -443,7 +445,7 @@ are unchanged.
 `naro backend` is the project's Naro backend: its own D1, email and password
 sign-in, and a Data API that browser code calls through `naro-js` at the
 project's URL. It is off until you turn it on, one project at a time:
-`naro backend enable` (or the Database page of the dashboard). The anon key
+`naro backend enable` (or Turn on in the Backend section of the project's Settings page in the dashboard). The anon key
 is public — it identifies the project and grants nothing. The service key
 skips every policy, so the CLI prints it only for
 `naro backend keys --reveal` and for a rotation that made a new one; keep it
@@ -484,7 +486,7 @@ message that the worker may still expect the new key — run
 `naro backend enable`; the CLI prints that hint (JSON `hint`) and exits 1.
 For a few seconds during a rotation the worker can already refuse the old key.
 
-Sign-in is naro Auth, the project's own (like Supabase Auth). Email and
+Sign-in is Naro Auth, the project's own (like Supabase Auth). Email and
 password sign-up and sign-in work as soon as the backend is on, with nothing
 to set up. `naro backend auth` adds the rest with the project's own
 accounts — Naro runs no shared sender. Sending email (confirmation and
@@ -607,7 +609,7 @@ EXISTS` skips a missing table too, as in Postgres); `COMMENT ON POLICY p ON t
 IS 'naro:owner <column>'`, which makes `p` the owner rule `naro policy set
 --owner` writes (any other comment is ignored); and `ALTER TABLE t ENABLE |
 FORCE | NO FORCE ROW LEVEL SECURITY`, which changes nothing because
-row-level security is always on. Before anything runs, naro refuses these with
+row-level security is always on. Before anything runs, Naro refuses these with
 `400 VALIDATION_FAILED` "Statement <i> of <n>: …":
 
 - `ALTER TABLE … DISABLE ROW LEVEL SECURITY` — it is always on; to let
@@ -623,7 +625,7 @@ has no schema "public": write the table name without "public."`
   or alters the policy's table or a table its subqueries read: `a later
 statement changes a table, so name the table of every column inside this
 policy's subqueries (for example members.user_id).` Postgres decides whose
-  column it is when the policy is created; naro binds it once the file is in,
+  column it is when the policy is created; Naro binds it once the file is in,
   when the later statement may have added that name to the subquery's table.
   A later statement that changes only other tables — the next table of a file
   grouped table by table — leaves the policy alone.
@@ -774,7 +776,7 @@ to write — as text, `'true'` would read as false. So is comparing text with
 `IS DISTINCT FROM`, also through `coalesce` — since the text `'true'` is not
 `TRUE`: `<> false` would hold for everyone.
 
-Where naro differs from Postgres: no policy for a command is a 403, not zero
+Where Naro differs from Postgres: no policy for a command is a 403, not zero
 rows; row-level security is always on; roles are only `anon` and
 `authenticated`, with no `security definer` functions; comparisons follow
 SQLite (column affinity and collation), and `lower`, `upper` and `ILIKE` fold
@@ -884,6 +886,44 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.25.0
+
+Everything the dashboard does, the CLI now does too, except what needs a
+browser or your own folder (the capability registry in
+`packages/core/src/capabilities.ts` says which and why).
+
+- Teams: `naro teams`, `naro team create | set | delete`, `naro team members`
+  (`set`, `remove`) and `naro team invites` (`create`, `revoke`). Deleting a
+  team asks you to type its slug, or `--team` with `--yes` in CI.
+- Projects: `naro project set` (name, subdomain), `naro project check
+<subdomain>`, `naro project access` (`grant`, `revoke`) and `naro project
+delete`, which asks you to type the project's name (`--yes` only with
+  `--project`).
+- The edge: `naro firewall` (`add`, `enable`, `disable`, `remove`), `naro flags`
+  (`add`, `on`, `off`, `remove`) and `naro bindings` (`add`, `remove` — removing
+  deletes the R2 bucket, KV namespace or D1 database with its data, and asks).
+- DNS: `naro dns` with `add`, `remove`, `check`, `mail`, `scan`, `import` and
+  `records` (`add`, `update`, `remove`).
+- Readouts: `naro billing` and `naro observability`. `naro deployments create`
+  deploys a branch from Git (`--prod` for production; `--env production` is
+  refused).
+- Data: `naro storage sign` (a download link without a key), `naro functions
+update --verify-jwt <on|off>`, `naro functions invoke` (method, `--data`,
+  the first 64 KiB of the answer, 120 seconds), `naro policy rules` and
+  `naro backend signing-key rotate`.
+- `naro supabase [list]` shows the Supabase project the dashboard connected
+  per target; `naro supabase disconnect [target]` removes a link with the env
+  vars it set (asks first). With no target, or `all`, it removes every link
+  your role may change and names the ones it could not.
+- naro-mcp 0.24.0 goes out with it: tools for teams, DNS, the firewall, flags,
+  bindings, the backend and its sign-in settings, Realtime, Storage bucket
+  details, upload URLs and moves, policies and policy rules, `lint_database`,
+  `pull_database_schema`, billing, Observability, `check_promotion`,
+  `deploy_from_git` and the Supabase links. Destructive tools say so in their
+  description and set `destructiveHint`; tools that answer text someone else
+  typed wrap it as untrusted. It imports from this release, so publish
+  naro-cli first.
+
 ### 0.24.0
 
 - `naro deploy` names the service behind the env vars it is missing. Names that
@@ -920,7 +960,7 @@ An `--update-check` you give replaces the default: without
 - `naro deploy --env <name>` builds with the values the control plane
   chose for the environment, over the ones it sent (named environments 3d).
   The control plane saves what the deploy sends for that environment first,
-  so the two differ only where naro sets a name itself: for a project with a
+  so the two differ only where Naro sets a name itself: for a project with a
   Naro backend, an environment's build gets `NARO_URL`,
   `NEXT_PUBLIC_NARO_URL`, `VITE_NARO_URL`, `PUBLIC_NARO_URL` and the four
   `…_NARO_ANON_KEY` names set to that environment's own address and anon key.
@@ -956,7 +996,7 @@ An `--update-check` you give replaces the default: without
   `naro environments delete` now says it removes the environment's data too.
 - `naro deploy --env <name>` no longer asks for `NARO_URL`,
   `NEXT_PUBLIC_NARO_URL`, `VITE_NARO_URL`, `PUBLIC_NARO_URL` or the four
-  `…_NARO_ANON_KEY` names when the project has a Naro backend: naro sets them
+  `…_NARO_ANON_KEY` names when the project has a Naro backend: Naro sets them
   for the environment over any value, so a typed one only lost. It reads the
   project's backend once, and only when one of those names is missing
   (`▸ naro sets … for qa to its own backend's: not asked for`); a role that
@@ -1591,7 +1631,7 @@ RENAME` the way the control plane now reads it: a column rename whose
   and `Next.js <version> is too old to deploy. Naro deploys Next.js 15 or newer. Upgrade to Next.js 16.`
 - A Next.js app built with vinext reads its bindings with
   `getCloudflareContext().env`, as under OpenNext. Before, `env` was missing
-  there, so `env.MY_BUCKET` was `undefined` and nothing was thrown. naro
+  there, so `env.MY_BUCKET` was `undefined` and nothing was thrown. Naro
   writes this Worker entry as `naro-worker.js`, so a project with its own
   file of that name is not built with vinext.
 - Build logs hide more secrets: upper-case names that end in `TOKEN`,
@@ -1617,7 +1657,7 @@ RENAME` the way the control plane now reads it: a column rename whose
 
 ### 0.17.0
 
-- `naro domains add` prints one CNAME record and no TXT records. naro
+- `naro domains add` prints one CNAME record and no TXT records. Naro
   registers the domain once the CNAME points at it, usually within about five
   minutes. The status line reads `Waiting for DNS — add the CNAME above; naro
 connects it within about five minutes.` `naro domains verify` registers it at
@@ -1725,10 +1765,10 @@ server.`), and the CLI prints that message. Before, the CLI got a 500.
   and preview together (one switch, so `--env` is refused there).
 - `naro protection` shows whether the project's preview URL is protected and
   whether a bypass secret is set. Protection is on by default: only members
-  of the project can open `<name>-preview.naro.sh`, after signing in to naro.
+  of the project can open `<name>-preview.naro.sh`, after signing in to Naro.
   A GET or HEAD that is a page navigation (`Sec-Fetch-Mode: navigate`), or that
   sends no `Sec-Fetch-Mode` and an `Accept` including `text/html`, is
-  redirected to the naro sign-in; every other request gets
+  redirected to the Naro sign-in; every other request gets
   `401 PREVIEW_PROTECTED`. A request the browser sends without cookies (a
   `<link rel="manifest">` without `crossorigin="use-credentials"`) gets 401
   too.
@@ -1745,7 +1785,7 @@ server.`), and the CLI prints that message. Before, the CLI got a 500.
   (public or private, the largest file, the types taken), and `ls`, `cp`
   and `rm` work on `naro://<bucket>/<path>` with the project's service key
   (`NARO_SERVICE_KEY`, or fetched with a warning) — the bytes go to the
-  project's backend, not through naro. One request carries 50 MiB at most; a
+  project's backend, not through Naro. One request carries 50 MiB at most; a
   larger file goes in parts since 0.16.0 (under 4 GiB).
   `bucket update --public`, `empty`, `remove` and `rm` ask first; without a
   terminal they need `--yes` (`CONFIRMATION_REQUIRED` otherwise, nothing
@@ -1784,7 +1824,7 @@ server.`), and the CLI prints that message. Before, the CLI got a 500.
   INT, REAL, FLOA, DOUB, NUM, DEC, BOOL or BIT (a form's `"true"` for a
   BOOLEAN, `"high"` for an INTEGER), even when no policy reads the column.
   The backend worker takes this on at the project's next deploy or
-  `naro backend enable`, not when naro itself updates. Before that, look for
+  `naro backend enable`, not when Naro itself updates. Before that, look for
   such rows: `naro db query "select count(*) from t where typeof(c) = 'text'"`
   for each number or boolean column — a count above 0 means a client writes
   strings there and needs fixing first.

package/dist/args.d.ts

@@ -1,4 +1,53 @@
 export interface GlobalFlags {
+    /**
+     * `naro dns records add|update`: the record's fields, passed as typed — the
+     * control plane checks them (apps/web/src/lib/dns-records.ts). CAA takes
+     * `--caa-flags --tag --value`, SRV `--priority --weight --port --target`.
+     */
+    content?: string | undefined;
+    ttl?: string | undefined;
+    priority?: string | undefined;
+    caaFlags?: string | undefined;
+    tag?: string | undefined;
+    value?: string | undefined;
+    weight?: string | undefined;
+    port?: string | undefined;
+    target?: string | undefined;
+    /** `naro team set --slug <new-slug>`: the team's new slug. */
+    slug?: string | undefined;
+    /** `naro team members set <user-id> --role <role>`; the server checks it. */
+    role?: string | undefined;
+    /**
+     * `naro firewall add --kind <ip|country|path|rate_limit> --value <value>`;
+     * a rate limit also takes `--rate-limit <n> --period <seconds>`. Strings, as
+     * typed: the control plane checks them (apps/web/src/lib/firewall-input.ts).
+     */
+    kind?: string | undefined;
+    rateLimit?: string | undefined;
+    period?: string | undefined;
+    /** `naro firewall add --disabled`: save the rule switched off. */
+    disabled?: boolean | undefined;
+    /** `naro flags add <name> --on`: the new flag starts on. */
+    on?: boolean | undefined;
+    /**
+     * `naro project set`: the General settings, as typed — the control plane
+     * checks them. An empty value clears the setting back to the preset.
+     */
+    subdomain?: string | undefined;
+    framework?: string | undefined;
+    buildCommand?: string | undefined;
+    outputDir?: string | undefined;
+    /** `naro project set --vinext on|off`. */
+    vinext?: string | undefined;
+    /** `naro storage sign --expires <seconds>`: 1-3600, an hour by default. */
+    expires?: string | undefined;
+    /** `naro storage sign --download`: the browser saves the file. */
+    download?: boolean | undefined;
+    /** `naro functions update <name> --verify-jwt on|off`. */
+    verifyJwt?: string | undefined;
+    /** `naro functions invoke <name> --method <M> --data <body>`. */
+    method?: string | undefined;
+    data?: string | undefined;
     json: boolean;
     yes: boolean;
     debug: boolean;