naro-cli 0.24.0 → 0.25.0

package/dist/commands/confirm.d.ts

@@ -8,5 +8,15 @@ export declare function cannotAsk(context: CommandContext): boolean;
  * Gate for destructive actions. Throws instead of silently returning so a
  * declined/unavailable confirmation is a real failure (exit 1, structured
  * JSON) — CI must never read "nothing happened" as success.
+ *
+ * What asks: removing or deleting something (`remove`, `delete`, `realtime
+ * tables remove`), and a change that reaches past the value typed — what
+ * production serves (`promote`, `rollback`, `cancel`), keys that stop working
+ * (`backend keys rotate`, `signing-key rotate`), a service turned off
+ * (`storage disable`), who can see the project (`protection disable`), or an
+ * address given up (`project set --subdomain`, `dns records update`). Adding
+ * or switching a setting whose value the person typed in full (`naro firewall
+ * add`, `naro flags on`) does not ask: MCP marks those destructive because no
+ * one watches its calls (PR #429 and #433 reviews).
  */
 export declare function confirmOrAbort(context: CommandContext, question: string): Promise<void>;

package/dist/commands/db-lint.d.ts

@@ -0,0 +1,16 @@
+import type { CommandContext } from "../context";
+export { DIAGNOSTICS_SQL, lintDatabase, POLICY_READ_SQL, POLICY_TABLE_PROBE, type DatabaseLint, } from "@next-deploy/sdk";
+/**
+ * `naro db lint [--json] [--strict]` — read-only diagnostics over the schema
+ * `GET /tables` describes and the checks D1 allows. The rules are the ones D1
+ * actually trips on (spec §17.3); there is no performance heuristic, because
+ * D1 keeps no execution statistics to base one on.
+ *
+ * A project with a backend also gets its row-level security checked: a table
+ * with no policy is a warning (the Data API refuses every request to it) and a
+ * policy that cannot work on today's schema is an error (spec P2-7b).
+ *
+ * The exit code is the point: an error fails the run so CI can gate on it, a
+ * warning does not unless `--strict` says it should.
+ */
+export declare function runDbLint(context: CommandContext): Promise<void>;

package/dist/deploy.d.ts

@@ -112,4 +112,6 @@ export interface DeployResult {
  * Shared by `naro deploy` and the MCP `deploy` tool.
  */
 export declare function deployDirectory(sourceDir: string, options: DeployOptions, log: (message: string) => void): Promise<DeployResult>;
+export { lintDatabase, type DatabaseLint } from "./commands/db-lint";
+export { readCapped } from "./functions/read-capped";
 export { assertFunctionsNode, deployFunctions, type DeployedFunction, type DeployFunctionsOptions, type DeployFunctionsResult, } from "./functions/deploy";

package/dist/deploy.js

@@ -4,20 +4,24 @@ import {
   deployDirectory,
   deployFunctions,
   eventsObserver,
+  lintDatabase,
   localDependencies,
   parseDotenv,
+  readCapped,
   readProjectEnv,
   slugify,
   workingTreeNotices
-} from "./chunk-XJIWWZ2T.js";
+} from "./chunk-X5TUBMEU.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,
   deployDirectory,
   deployFunctions,
   eventsObserver,
+  lintDatabase,
   localDependencies,
   parseDotenv,
+  readCapped,
   readProjectEnv,
   slugify,
   workingTreeNotices

package/dist/functions/read-capped.d.ts

@@ -0,0 +1 @@
+export { readCapped } from "@next-deploy/core";