naro-cli 0.27.0 → 0.29.0

package/dist/deploy.d.ts

@@ -2,6 +2,7 @@ import { type CacheTransport, type LocalBuildDependencies } from "@next-deploy/b
 import { type CliGitConnection } from "@next-deploy/sdk";
 import type { BuildObserver, DeploymentArtifact, DeploymentStatus, DeploymentStrategyRecord } from "./artifact-types";
 import { type GitInfo } from "./git-info";
+import { type UserAdapterChoice } from "./user-adapter";
 import { type WorkingTreeCopy } from "./working-tree";
 /** The slice of LocalBuildExecutor the deploy flow needs — injectable in tests. */
 export interface DeployBuildExecutor {
@@ -14,6 +15,7 @@ export interface DeployBuildExecutor {
         env: Record<string, string>;
         strategy?: DeploymentStrategyRecord | null;
         vinextEnabled?: boolean;
+        userAdapter?: "replace" | "keep" | null;
     }, observer: BuildObserver, cache?: CacheTransport): Promise<{
         artifact: DeploymentArtifact;
     }>;
@@ -75,7 +77,7 @@ export interface DeployOptions {
      * enough to time some out when the whole suite ran at once.
      */
     pollIntervalMs?: number;
-    /** Test seam: replaces the local OpenNext build. */
+    /** Test seam: replaces the local build. */
     executor?: DeployBuildExecutor;
     /** Test seam: replaces the `git` calls that read the repository. */
     gitInfo?: (dir: string) => Promise<GitInfo>;
@@ -84,6 +86,12 @@ export interface DeployOptions {
      * 대화형 CLI만 전달한다 — MCP·CI는 생략하고 안내만 받는다.
      */
     onMissingEnv?: (keys: string[]) => Promise<Record<string, string>>;
+    /**
+     * The answer to the adapter question (`--user-adapter`, the prompt, MCP's
+     * userAdapter), saved to the project once the deployment exists when it
+     * differs from the stored choice (spec 2026-11-07 S3).
+     */
+    userAdapter?: UserAdapterChoice | undefined;
 }
 export interface DeployResult {
     deploymentId: string;
@@ -105,7 +113,7 @@ export interface DeployResult {
 }
 /**
  * The full CLI deploy: authenticate, register the deployment with the
- * control plane, build locally (OpenNext for Next.js, the static pipeline
+ * control plane, build locally (vinext for Next.js, the static pipeline
  * for Vite/CRA/static sites), upload the artifact and poll until the
  * platform finishes publishing the worker.
  *
@@ -115,3 +123,4 @@ export declare function deployDirectory(sourceDir: string, options: DeployOption
 export { lintDatabase, type DatabaseLint } from "./commands/db-lint";
 export { readCapped } from "./functions/read-capped";
 export { assertFunctionsNode, deployFunctions, type DeployedFunction, type DeployFunctionsOptions, type DeployFunctionsResult, } from "./functions/deploy";
+export { detectUserAdapter, parseUserAdapter, userAdapterUnreadable, type DetectedUserAdapter, type UserAdapterChoice, } from "./user-adapter";

package/dist/deploy.js

@@ -3,26 +3,32 @@ import {
   assertFunctionsNode,
   deployDirectory,
   deployFunctions,
+  detectUserAdapter,
   eventsObserver,
   lintDatabase,
   localDependencies,
   parseDotenv,
+  parseUserAdapter,
   readCapped,
   readProjectEnv,
   slugify,
+  userAdapterUnreadable,
   workingTreeNotices
-} from "./chunk-UGJFIEH7.js";
+} from "./chunk-BAP7PHBF.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,
   deployDirectory,
   deployFunctions,
+  detectUserAdapter,
   eventsObserver,
   lintDatabase,
   localDependencies,
   parseDotenv,
+  parseUserAdapter,
   readCapped,
   readProjectEnv,
   slugify,
+  userAdapterUnreadable,
   workingTreeNotices
 };

package/dist/index.js

@@ -24,6 +24,7 @@ import {
   STORAGE_OBJECTS_TABLE,
   STORAGE_SUBQUERIES_SQL,
   UNSHOWN_WARNING_LINE,
+  USER_ADAPTER_OPTIONS,
   appliedMigrations,
   applyMigrationFiles,
   assertFunctionsNode,
@@ -48,6 +49,7 @@ import {
   deployDirectory,
   deployFunctions,
   detectGitInfo,
+  detectUserAdapter,
   enableBackendCommand,
   ensureGitignoreHasNaro,
   envFlag,
@@ -81,6 +83,7 @@ import {
   parsePolicyNode,
   parsePolicyStatement,
   parseRedirectEntry,
+  parseUserAdapter,
   pendingMigrationNames,
   policiesForTypes,
   policiesLostByReset,
@@ -124,12 +127,16 @@ import {
   toNaroError,
   unreadablePolicyComment,
   usageMonthOf,
+  userAdapterQuestion,
+  userAdapterStored,
+  userAdapterUnasked,
+  userAdapterUnreadable,
   userForAccessToken,
   version,
   warningLines,
   withFunctionRetries,
   writeProjectLink
-} from "./chunk-UGJFIEH7.js";
+} from "./chunk-BAP7PHBF.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -257,6 +264,7 @@ var STRING_FLAGS = {
   "--build-command": "buildCommand",
   "--output-dir": "outputDir",
   "--vinext": "vinext",
+  "--user-adapter": "userAdapter",
   "--expires": "expires",
   "--verify-jwt": "verifyJwt",
   "--method": "method",
@@ -1696,12 +1704,12 @@ async function allUsers(client, projectId) {
   const users = [];
   let total = 0;
   for (let page = 1; ; page++) {
-    const listed = await usersCall(
+    const listed2 = await usersCall(
       () => client.backend.listUsers(projectId, { page, perPage: PAGE_SIZE })
     );
-    total = listed.total;
-    users.push(...listed.users);
-    if (listed.users.length < PAGE_SIZE || users.length >= total)
+    total = listed2.total;
+    users.push(...listed2.users);
+    if (listed2.users.length < PAGE_SIZE || users.length >= total)
       return { users, total };
   }
 }
@@ -2357,8 +2365,8 @@ function chunk(items3, size) {
 }
 async function readSchema(client, projectId) {
   const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
-  const [listed, virtual, internal] = schema.statements;
-  if (listed === void 0 || virtual === void 0 || internal === void 0)
+  const [listed2, virtual, internal] = schema.statements;
+  if (listed2 === void 0 || virtual === void 0 || internal === void 0)
     throw new NaroError(
       "DATABASE_QUERY_FAILED",
       `The schema could not be read: the database answered with ${String(schema.statements.length)} result sets instead of 3.`
@@ -2369,9 +2377,9 @@ async function readSchema(client, projectId) {
   const virtualNames = new Set(
     virtual.rows.map((row) => cellText(virtual, row, "name").toLowerCase())
   );
-  const objects2 = listed.rows.map((row) => {
-    const name = cellText(listed, row, "name");
-    const type = cellText(listed, row, "type");
+  const objects2 = listed2.rows.map((row) => {
+    const name = cellText(listed2, row, "name");
+    const type = cellText(listed2, row, "type");
     if (type === "view" || type === "trigger") return { type, name };
     return {
       type: virtualNames.has(name.toLowerCase()) ? "virtual" : "table",
@@ -3239,6 +3247,72 @@ function cellOf(value) {
   if (typeof value === "string") return value;
   return isInvalid(value) ? "invalid" : "condition";
 }
+var SET_POLICY_NAMES = new Set(
+  POLICY_ACTIONS.map((action) => `naro_${action}`)
+);
+function customPolicies(named) {
+  const byTable = /* @__PURE__ */ new Map();
+  for (const policy of named) {
+    if (SET_POLICY_NAMES.has(policy.name)) continue;
+    const invalid = policy.invalid !== null;
+    if (!invalid && policy.as !== "permissive") continue;
+    const key = asciiLower(policy.table);
+    const list = byTable.get(key) ?? [];
+    list.push({ name: policy.name, command: policy.command, invalid });
+    byTable.set(key, list);
+  }
+  return byTable;
+}
+function covers(policy, action) {
+  return policy.command === "all" || policy.command === action;
+}
+var CUSTOM_NOTE = "custom: a policy written as CREATE POLICY allows it. naro policy list shows it.";
+var INVALID_NOTE = "invalid: a policy that cannot be read covers it, so the Data API refuses it (500 POLICY_INVALID). naro policy list shows why.";
+var NAMES_ONLY_NOTE = "`none` may not mean denied on those tables: naro policy list shows their policies.";
+function listed(entries) {
+  return entries.map((entry) => `${printable(entry.name)} (${entry.command})`).toSorted().join(", ");
+}
+function customLines(policies, custom) {
+  const lines = [];
+  let allows = false;
+  let unreadable2 = false;
+  for (const policy of policies) {
+    const table3 = printable(policy.table);
+    if (custom) {
+      const list = custom.get(asciiLower(policy.table)) ?? [];
+      const valid = list.filter((entry) => !entry.invalid);
+      const invalid = list.filter((entry) => entry.invalid);
+      if (valid.length > 0) {
+        allows = true;
+        lines.push(`${table3}  custom: ${listed(valid)}`);
+      }
+      if (invalid.length > 0) {
+        unreadable2 = true;
+        lines.push(`${table3}  invalid: ${listed(invalid)}`);
+      }
+      continue;
+    }
+    const names = (policy.policies ?? []).filter(
+      (name) => !SET_POLICY_NAMES.has(name)
+    );
+    if (names.length === 0) continue;
+    lines.push(
+      `${table3}  also has policies written as SQL: ${names.map(printable).join(", ")}`
+    );
+  }
+  if (lines.length === 0) return lines;
+  if (!custom) return [...lines, NAMES_ONLY_NOTE];
+  return [
+    ...lines,
+    ...allows ? [CUSTOM_NOTE] : [],
+    ...unreadable2 ? [INVALID_NOTE] : []
+  ];
+}
+var POLICY_TABLE_HINTS = /* @__PURE__ */ new Set([
+  CUSTOM_NOTE,
+  INVALID_NOTE,
+  NAMES_ONLY_NOTE
+]);
 function conditionText(action, value) {
   if (typeof value === "string") return value;
   if (isInvalid(value))
@@ -3254,11 +3328,19 @@ function conditionText(action, value) {
   const text = parts.join("; ");
   return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
 }
-function policyTable(policies) {
+function policyTable(policies, custom) {
   const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
+  const shown = (policy, action) => {
+    const value = policy[action];
+    const sql2 = (custom?.get(asciiLower(policy.table)) ?? []).filter(
+      (entry) => covers(entry, action)
+    );
+    if (sql2.some((entry) => entry.invalid)) return "invalid";
+    return value === "none" && sql2.length > 0 ? "custom" : cellOf(value);
+  };
   const rows = policies.map((policy) => [
     printable(policy.table),
-    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
+    ...POLICY_ACTIONS.map((action) => shown(policy, action)),
     policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
   ]);
   const widths = header.map(
@@ -3281,19 +3363,22 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table3;
+  const sql = customLines(policies, custom);
+  const below = sql.length > 0 ? ["", ...sql] : [];
+  if (lines.length === 0) return [...table3, ...below];
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
     ...table3,
     "",
-    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
+    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`),
+    ...below
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
 function hintsFor(lines, environment) {
   if (environment === null) return lines;
   return lines.map(
-    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") || POLICY_TABLE_HINTS.has(line) ? forEnvironment(line, environment) : line
   );
 }
 function statementLine(policy) {
@@ -3356,9 +3441,13 @@ async function runPolicyRules(context) {
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const all = await client.backend.policies(projectId);
-  const wanted = table3?.toLowerCase();
-  const policies = wanted === void 0 ? all : all.filter((policy) => policy.table.toLowerCase() === wanted);
-  const lines = policies.length > 0 ? [...policyTable(policies), "", DEFAULT_DENY] : [
+  const wanted = table3 === void 0 ? void 0 : asciiLower(table3);
+  const policies = wanted === void 0 ? all : all.filter((policy) => asciiLower(policy.table) === wanted);
+  const custom = context.flags.json || policies.length === 0 ? void 0 : await client.backend.rlsPolicies(projectId, table3 === void 0 ? {} : { table: table3 }).then(customPolicies, (error) => {
+    if (!isNaroError(error)) throw error;
+    return null;
+  });
+  const lines = policies.length > 0 ? [...policyTable(policies, custom), "", DEFAULT_DENY] : [
     table3 === void 0 ? "No tables yet." : `No table named ${printable(table3)}.`
   ];
   context.output.result(
@@ -3493,7 +3582,10 @@ async function runPolicySet(context) {
     hintsFor(
       [
         `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-        ...policyTable([policy]),
+        ...policyTable(
+          [policy],
+          named === void 0 ? void 0 : customPolicies(named)
+        ),
         ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
       ],
       dataEnvironment(context.flags)
@@ -4207,6 +4299,7 @@ function deployTarget(flags) {
 async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
   const { flags, output } = context;
   const target = deployTarget(flags);
+  const flaggedAdapter = flaggedUserAdapter(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
   if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
@@ -4220,6 +4313,12 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
   const account = await accountLabel(context);
   output.log(`   ${account} \u2192 ${team.slug}
 `);
+  const userAdapter = await askUserAdapter(
+    context,
+    flaggedAdapter,
+    link,
+    canPrompt
+  );
   const result = await deps.deploy(
     context.cwd,
     {
@@ -4246,7 +4345,8 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
         )
       },
       token: flags.token,
-      allowLogin: !flags.json && !flags.yes
+      allowLogin: !flags.json && !flags.yes,
+      ...userAdapter ? { userAdapter } : {}
     },
     (message) => output.log(message)
   );
@@ -4290,6 +4390,44 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
     ]
   );
 }
+function flaggedUserAdapter(flags) {
+  if (flags.userAdapter === void 0) return void 0;
+  const choice = parseUserAdapter(flags.userAdapter);
+  if (!choice)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--user-adapter takes replace or keep."
+    );
+  return choice;
+}
+async function askUserAdapter(context, flagged, link, canPrompt) {
+  const { flags, output } = context;
+  if (flagged) return flagged;
+  const adapter = await detectUserAdapter(context.cwd, flags.root ?? null);
+  if (!adapter) return void 0;
+  let stored = null;
+  if (link?.projectId) {
+    try {
+      stored = (await (await context.client()).projects.get(link.projectId)).userAdapter;
+    } catch {
+      output.log(userAdapterUnreadable(adapter));
+      return void 0;
+    }
+  }
+  if (stored) {
+    output.log(userAdapterStored(adapter, stored));
+    return void 0;
+  }
+  if (!canPrompt) {
+    output.log(userAdapterUnasked(adapter));
+    return void 0;
+  }
+  const index = await context.prompter.select(
+    userAdapterQuestion(adapter),
+    USER_ADAPTER_OPTIONS.map((option) => option.label)
+  );
+  return USER_ADAPTER_OPTIONS[index]?.value ?? "replace";
+}
 async function resolveDestination(context, link, canPrompt) {
   const client = await context.client();
   const teams = await client.teams.list();
@@ -4616,9 +4754,9 @@ async function verifyAll(client, projectId, hostname, auto = false) {
     return [
       await client.domains.verifyByHostname(projectId, hostname, { auto })
     ];
-  const listed = await client.domains.list(projectId);
+  const listed2 = await client.domains.list(projectId);
   const verified = [];
-  for (const domain of listed)
+  for (const domain of listed2)
     verified.push(await client.domains.verify(projectId, domain.id, { auto }));
   return verified;
 }
@@ -11157,14 +11295,14 @@ async function listAll(storage, bucket, prefix, recursive, search) {
         truncated = true;
         break;
       }
-      const listed = await storage.from(bucket).list(folder, {
+      const listed2 = await storage.from(bucket).list(folder, {
         limit: PAGE,
         offset,
         ...search === "" ? {} : { search }
       });
-      if (isOldSearchRefusal(listed.error))
+      if (isOldSearchRefusal(listed2.error))
         throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
-      const page = unwrap(listed);
+      const page = unwrap(listed2);
       for (const entry of page) {
         const path = folder === "" ? entry.name : `${folder}/${entry.name}`;
         if (isFolder(entry)) {
@@ -11935,7 +12073,7 @@ async function runObservability(context) {
 }
 
 // src/commands/project-settings.ts
-var SET_USAGE2 = "Usage: naro project set [--subdomain <name>] [--framework <preset>] [--root <dir>] [--branch <branch>] [--build-command <script>] [--output-dir <dir>] [--vinext on|off]";
+var SET_USAGE2 = "Usage: naro project set [--subdomain <name>] [--framework <preset>] [--root <dir>] [--branch <branch>] [--build-command <script>] [--output-dir <dir>] [--vinext on|off] [--user-adapter replace|keep]";
 var GRANT_USAGE = "Usage: naro project access grant <user-id> --role <project_admin|project_developer|project_viewer>";
 function clearable(value) {
   return value === "" ? null : value;
@@ -11957,6 +12095,15 @@ function settingsFrom(context) {
       throw new NaroError("VALIDATION_FAILED", "--vinext takes on or off.");
     patch.vinextEnabled = flags.vinext === "on";
   }
+  if (flags.userAdapter !== void 0) {
+    const choice = parseUserAdapter(flags.userAdapter);
+    if (!choice)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        "--user-adapter takes replace or keep."
+      );
+    patch.userAdapter = choice;
+  }
   if (Object.keys(patch).length === 0)
     throw new NaroError("VALIDATION_FAILED", SET_USAGE2);
   return patch;
@@ -14004,6 +14151,8 @@ function meterRow(meter, limitsKnown) {
   const label3 = METRIC_LABELS[meter.metric];
   const used = formatCount(meter.used);
   if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
+  if (typeof meter.perProject === "number")
+    return [label3, used, `${formatCount(meter.perProject)} per project`, "\u2014"];
   if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
   if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
   return [label3, used, formatCount(meter.limit), usedPercent(meter)];
@@ -14053,6 +14202,53 @@ function usageLines3(report, summary) {
   );
   return lines;
 }
+function tenths(value) {
+  return Math.round(value * 10) / 10;
+}
+function cpuText(ms) {
+  const whole = Math.round(ms);
+  if (whole < 1e3) return `${String(whole)} ms`;
+  const seconds = tenths(ms / 1e3);
+  if (seconds < 60) return `${seconds.toFixed(1)} s`;
+  const minutes = tenths(ms / 6e4);
+  if (minutes < 60) return `${minutes.toFixed(1)} min`;
+  return `${tenths(ms / 36e5).toFixed(1)} h`;
+}
+function environmentName(environment) {
+  switch (environment.kind) {
+    case "production":
+      return "production";
+    case "preview":
+      return "preview";
+    case "environment":
+      return printable(environment.label);
+    case "former":
+      return `earlier name ${printable(environment.workerName)}`;
+  }
+}
+function hostingLines(hosting) {
+  if (!hosting || hosting.projects.length === 0) return [];
+  const rows = [["CPU", "Invocations", "Project / environment"]];
+  for (const project of hosting.projects) {
+    rows.push([
+      cpuText(project.cpuMs),
+      formatCount(project.invocations),
+      project.name === null ? `Not in this team ${printable(project.projectId)}` : printable(project.name)
+    ]);
+    for (const environment of project.environments)
+      rows.push([
+        cpuText(environment.cpuMs),
+        formatCount(environment.invocations),
+        `  ${environmentName(environment)}`
+      ]);
+  }
+  return [
+    "",
+    "Compute (CPU) \xB7 observed, not billed \xB7 sampled estimate",
+    ...table(rows),
+    `Total: ${cpuText(hosting.totals.cpuMs)} of CPU over ${formatCount(hosting.totals.invocations)} invocations`
+  ];
+}
 
 // src/commands/usage.ts
 async function runUsage(context) {
@@ -14060,12 +14256,26 @@ async function runUsage(context) {
   const teams = await client.teams.list();
   const team = await resolveTeam(context, teams, { intent: "read" });
   const month = context.flags.month;
-  const report = await client.teams.usage(
-    team.slug,
-    month !== void 0 ? { month } : {}
-  );
+  const query = month !== void 0 ? { month } : {};
+  const report = await client.teams.usage(team.slug, query);
   const summary = summarizeTeamUsage(report, usageMonthOf(/* @__PURE__ */ new Date()));
-  context.output.result({ ...report, summary }, usageLines3(report, summary));
+  let hosting = null;
+  let hostingError;
+  try {
+    hosting = await client.teams.usageHosting(team.slug, query);
+  } catch (error) {
+    hostingError = {
+      code: error instanceof NaroError ? error.code : "UNKNOWN",
+      message: error instanceof Error ? error.message : String(error)
+    };
+    context.output.warn(
+      `Could not read compute usage: ${hostingError.message}`
+    );
+  }
+  context.output.result(
+    hostingError ? { ...report, summary, hosting, hostingError } : { ...report, summary, hosting },
+    [...usageLines3(report, summary), ...hostingLines(hosting)]
+  );
 }
 
 // src/router.ts
@@ -14098,6 +14308,7 @@ Usage:
   naro project delete                Delete the project and everything under it: type its name to confirm
   naro project set [--subdomain <name>] [--framework <preset>] [--root <dir>] [--branch <branch>]
        [--build-command <script>] [--output-dir <dir>] [--vinext on|off]
+       [--user-adapter replace|keep]
                                      Change the General settings; an empty value clears one. A new subdomain
                                      moves the project's address at once (asks first; --yes in CI)
   naro project check <subdomain>     Whether a subdomain is free
@@ -14107,7 +14318,7 @@ Usage:
                                      Take a contributor's project role away (asks first)
        [--project <id> --yes]          (in CI both; --yes alone is refused so the folder cannot choose the project)
   naro usage [--month YYYY-MM] [--team <slug>]
-                                     Team usage: requests, builds and custom domains against the plan, then by project
+                                     Team usage: requests, builds and custom domains against the plan, then by project, then CPU by project and environment
   naro billing [--team <slug>]      The team's plan, subscription and this month's overage; the plan changes in the dashboard
   naro dashboard [<capability>]      The dashboard URL for what the CLI leaves there (payments, GitHub App, \u2026); no argument lists them
 
@@ -14283,7 +14494,7 @@ Usage:
   naro backend users delete <id|username|email>
                                      Delete a user and end its sessions (asks first; --yes to skip)
   naro policy list [--table <t>]     Row-level security policies as CREATE POLICY (no policy = deny)
-  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none) and conditions
+  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none, custom, invalid) and conditions
   naro policy create "CREATE POLICY <name> ON <table> \u2026" | --file <policies.sql>
                                      Postgres's CREATE POLICY: AS PERMISSIVE|RESTRICTIVE,
                                      FOR ALL|SELECT|INSERT|UPDATE|DELETE, TO anon|authenticated|public,

package/dist/user-adapter.d.ts

@@ -0,0 +1,32 @@
+export type UserAdapterChoice = "replace" | "keep";
+export interface DetectedUserAdapter {
+    /** The active next.config, relative to the app directory. */
+    file: string;
+    key: "adapterPath" | "experimental.adapterPath";
+}
+/** The next.config Next would load sets adapterPath, read the way Naro's builders read it. */
+export declare function detectUserAdapter(directory: string, rootDirectory: string | null): Promise<DetectedUserAdapter | null>;
+export declare function parseUserAdapter(value: unknown): UserAdapterChoice | null;
+export declare const USER_ADAPTER_OPTIONS: ReadonlyArray<{
+    value: UserAdapterChoice;
+    label: string;
+}>;
+export declare function userAdapterQuestion(adapter: DetectedUserAdapter): string;
+/** One line on what a choice means for this deploy (the local build has no Naro adapter, spec S2 D8). */
+export declare function userAdapterOutcome(choice: UserAdapterChoice): string;
+/** The line for a project that already chose. */
+export declare function userAdapterStored(adapter: DetectedUserAdapter, choice: UserAdapterChoice): string;
+/** The warning when nobody chose and nobody can be asked. */
+export declare function userAdapterUnasked(adapter: DetectedUserAdapter): string;
+/** Where each surface changes the stored choice. */
+declare const CHOOSE_USER_ADAPTER: {
+    readonly cli: "naro project set --user-adapter replace|keep";
+    readonly mcp: "update_project with userAdapter replace|keep";
+};
+/**
+ * The warning when the project's stored choice could not be read. It may
+ * already say keep, so this line must not claim replace the way
+ * userAdapterUnasked does.
+ */
+export declare function userAdapterUnreadable(adapter: DetectedUserAdapter, surface?: keyof typeof CHOOSE_USER_ADAPTER): string;
+export {};

package/dist/working-tree.d.ts

@@ -49,7 +49,7 @@ export interface WorkingTreeCopy {
  * edit to a committed `.env`, one hidden behind `skip-worktree`, one only
  * staged, and an untracked `.env.local` all stay on the machine. `next build`
  * reads those files on its own and inlines NEXT_PUBLIC_* into the bundle, and
- * OpenNext bundles every value they hold into the Worker, so a file copied
+ * the bundler inlines every value they hold into the Worker, so a file copied
  * here would ship values the developer declined to send. The env consent
  * prompt is the only way local values reach a build (known-issues #7,
  * CLI-DEPLOY-011).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -23,7 +23,6 @@
   },
   "dependencies": {
     "@cloudflare/unenv-preset": "2.16.2",
-    "@opennextjs/cloudflare": "1.20.12",
     "@supabase/supabase-js": "2.112.3",
     "@vercel/frameworks": "3.34.0",
     "esbuild": "0.28.1",
@@ -38,13 +37,13 @@
     "typescript": "7.0.2",
     "vitest": "3.2.7",
     "naro-js": "0.9.0",
-    "@next-deploy/config": "0.1.0",
-    "@next-deploy/build": "0.1.0",
     "@next-deploy/core": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
-    "@next-deploy/functions-bundler": "0.1.0",
     "@next-deploy/functions-runtime": "0.1.0",
-    "@next-deploy/sdk": "0.1.0"
+    "@next-deploy/sdk": "0.1.0",
+    "@next-deploy/config": "0.1.0",
+    "@next-deploy/functions-bundler": "0.1.0",
+    "@next-deploy/build": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",