naro-cli 0.28.0 → 0.29.0

package/README.md

@@ -897,6 +897,18 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.29.0
+
+- `naro usage` shows Hobby custom domains as `1 per project` (an apex and its
+  `www.` form count as one) instead of `No limit`.
+- `naro policy rules` marks an action allowed by a policy written as
+  `CREATE POLICY` as `custom`, and one covered by a policy it cannot read as
+  `invalid`, and lists those policies under the table. `--json` is unchanged.
+- The hints under `naro policy rules --env <name>` point at that environment.
+- naro-mcp 0.28.0 goes out with it: `get_team_usage` explains
+  `domainsPerProject` and `perProject`, and `list_policy_rules` says that
+  `none` means no rule `naro policy set` wrote, not nobody.
+
 ### 0.28.0
 
 - Next.js 15 and below are refused up front with `NEXT_VERSION_UNSUPPORTED`

package/dist/{chunk-UJGDKNDM.js → chunk-BAP7PHBF.js}

@@ -306,6 +306,9 @@ function sanitizeRoutes(value) {
   return JSON.stringify(routes).length > MAX_ROUTE_LIST_BYTES ? void 0 : routes;
 }
 
+// ../../packages/core/src/static-assets.ts
+var IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+
 // ../../packages/core/src/artifact-manifest.ts
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
@@ -2511,12 +2514,20 @@ var DEPLOYMENT_ERROR_CODES = [
   "DATABASE_FULL",
   /** Usage limits spec 2026-10-18 §6: a hobby team created its 100 deployments this UTC month. */
   "USAGE_LIMIT_REACHED",
+  /** Hobby: another limit (requests, D1, Storage, Functions, Realtime) is reached, so new builds wait (spec 2026-11-07-hobby-any-limit-blocks-build). */
+  "BUILDS_PAUSED",
   /** A hobby team has its 3 projects; no project can be added. */
   "PROJECT_LIMIT_REACHED",
   /** A hobby team has its 1 member; no member or invite can be added. */
   "MEMBER_LIMIT_REACHED",
-  /** Custom domains are not part of the Hobby plan. */
+  /**
+   * Custom domains were not part of the Hobby plan. No longer answered since
+   * 202611070030 (one domain per hobby project); kept so an older client
+   * still names it.
+   */
   "PLAN_DOMAINS_NOT_INCLUDED",
+  /** A hobby project has its 1 custom domain (with its www form); no other can be added. */
+  "PLAN_DOMAIN_LIMIT_REACHED",
   /** Named environments (spec 2026-10-18-named-environments §15): the name is not lowercase letters, digits and single hyphens, or is over 20 characters. */
   "ENVIRONMENT_NAME_INVALID",
   /** `production` and `preview` are reserved names. */
@@ -17567,7 +17578,7 @@ var REQUESTS = {
     subject100: (team) => `${team} has reached its monthly request limit`,
     usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} requests the Hobby plan includes for ${month}.`,
     warning: "When it reaches the limit, requests past it may be blocked until the month ends (UTC).",
-    blocked: "Sites on this team answer 503 until the month ends (UTC).",
+    blocked: "Sites on this team are blocked (HTTP 403 or 503) until the month ends (UTC).",
     running: "Sites keep running for now.",
     button: "View usage",
     footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on Naro.`
@@ -17577,7 +17588,7 @@ var REQUESTS = {
     subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
     usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uC694\uCCAD ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
     warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uADF8 \uB4A4 \uC694\uCCAD\uC774 \uB9C9\uD790 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
-    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 \uC694\uCCAD\uC744 \uB9C9\uC2B5\uB2C8\uB2E4(HTTP 403 \uB610\uB294 503).",
     running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
     button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
     footer: (team) => `Naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
@@ -17587,7 +17598,7 @@ var REQUESTS = {
     subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
     usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
     warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u4EE5\u964D\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30D6\u30ED\u30C3\u30AF\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
-    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u62D2\u5426\u3057\u307E\u3059(HTTP 403 \u307E\u305F\u306F 503)\u3002",
     running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
     button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
     footer: (team) => `Naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
@@ -17739,6 +17750,63 @@ async function wrapNextConfig(appRoot, file2) {
   );
   return { wrapper: plan.wrapper, project: project2 };
 }
+function assetPrefixWrapperSource(projectSpecifier, typescript) {
+  return `${typescript ? "// @ts-nocheck\n" : ""}// Written by Naro for this build only. The project's own next.config is
+// ${projectSpecifier}, unchanged; this wrapper serves _next/static from
+// Naro's CDN unless the project sets its own assetPrefix.
+import projectConfig from ${JSON.stringify(projectSpecifier)};
+
+export default async function naroNextConfig(phase, context) {
+  const config =
+    typeof projectConfig === "function"
+      ? await projectConfig(phase, context)
+      : await projectConfig;
+  const rest = { ...(config ?? {}) };
+  return {
+    ...rest,
+    assetPrefix: rest.assetPrefix || process.env.NARO_STATIC_ASSET_PREFIX,
+  };
+}
+`;
+}
+var ASSET_PREFIX_ONLY_CONFIG = `// Written by Naro for this build only: the project has no next.config.
+export default { assetPrefix: process.env.NARO_STATIC_ASSET_PREFIX };
+`;
+var CONFIG_LOOKUP = [
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.ts",
+  "next.config.mts",
+  "next.config.cjs"
+];
+async function wrapNextConfigForAssetPrefix(appRoot, prefix) {
+  if (!prefix) return "skipped";
+  let file2;
+  for (const name of CONFIG_LOOKUP)
+    if (await exists(join2(appRoot, name))) {
+      file2 = name;
+      break;
+    }
+  if (!file2) {
+    await writeFile2(join2(appRoot, "next.config.mjs"), ASSET_PREFIX_ONLY_CONFIG);
+    return "created";
+  }
+  const plan = WRAPPABLE[file2];
+  if (!plan) return "skipped";
+  const project2 = `${PROJECT_CONFIG_BASENAME}.${file2.slice("next.config.".length)}`;
+  if (await exists(join2(appRoot, project2))) return "skipped";
+  await rename(join2(appRoot, file2), join2(appRoot, project2));
+  try {
+    await writeFile2(
+      join2(appRoot, plan.wrapper),
+      assetPrefixWrapperSource(plan.specifier, plan.typescript)
+    );
+  } catch (error51) {
+    await rename(join2(appRoot, project2), join2(appRoot, file2));
+    throw error51;
+  }
+  return "wrapped";
+}
 
 // ../../packages/next-adapter/src/index.ts
 function nextAdapterPath(base2 = import.meta.url) {
@@ -19201,6 +19269,54 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
   };
 }
 
+// ../../packages/build/src/static-cdn.ts
+var STATIC_ASSET_PREFIX_ENV = "NARO_STATIC_ASSET_PREFIX";
+var STATIC_ASSETS_ON_CDN_NOTE = "Static assets (_next/static) are served from static.naro.sh.";
+var STATIC_ASSETS_ON_WORKER_NOTE = "Static assets stay on the Worker: the build did not use Naro's asset prefix (the project sets its own assetPrefix or a basePath, or it is not a Next.js build).";
+function buildEnvWithStaticPrefix(env, prefix) {
+  const result = { ...env };
+  delete result[STATIC_ASSET_PREFIX_ENV];
+  if (prefix) result[STATIC_ASSET_PREFIX_ENV] = prefix;
+  return result;
+}
+function contains(file2, needle) {
+  return Buffer.from(
+    file2.data.buffer,
+    file2.data.byteOffset,
+    file2.data.byteLength
+  ).includes(needle);
+}
+function withStaticAssetPrefix(artifact, prefix) {
+  if (!prefix) return { artifact, note: null };
+  const needle = Buffer.from(prefix, "utf8");
+  const files = [artifact.entrypoint, ...artifact.modules, ...artifact.assets];
+  if (!files.some((file2) => contains(file2, needle)))
+    return { artifact, note: STATIC_ASSETS_ON_WORKER_NOTE };
+  return {
+    artifact: { ...artifact, staticAssetPrefix: prefix },
+    note: STATIC_ASSETS_ON_CDN_NOTE
+  };
+}
+var IMMUTABLE_HEADERS_FILE = "_headers";
+var IMMUTABLE_HEADERS = `/_next/static/*
+  Cache-Control: ${IMMUTABLE_CACHE_CONTROL}
+`;
+function withImmutableHeaders(artifact) {
+  if (artifact.assets.some((asset) => asset.name === IMMUTABLE_HEADERS_FILE))
+    return artifact;
+  return {
+    ...artifact,
+    assets: [
+      ...artifact.assets,
+      {
+        name: IMMUTABLE_HEADERS_FILE,
+        data: new TextEncoder().encode(IMMUTABLE_HEADERS),
+        contentType: "text/plain"
+      }
+    ]
+  };
+}
+
 // ../../packages/build/src/strategy/fingerprint.ts
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile9 } from "fs/promises";
@@ -20352,6 +20468,17 @@ function createVinextCloudflareStrategy(options) {
         );
         if (!added.ok) return failed("prepare", describeFailure(added));
       }
+      try {
+        await wrapNextConfigForAssetPrefix(
+          fork.appRoot,
+          context.env[STATIC_ASSET_PREFIX_ENV]
+        );
+      } catch (error51) {
+        await warn(
+          observer,
+          `Could not point static assets at static.naro.sh: ${describeError(error51)}`
+        );
+      }
       const projectBin = adopt ? null : await findProjectBin(fork.appRoot, fork.checkout, "vinext");
       const build = await runStep(
         context,
@@ -20920,7 +21047,7 @@ var LocalBuildExecutor = class {
           const context = {
             identity,
             branch: input.branch,
-            env: input.env ?? {},
+            env: buildEnvWithStaticPrefix(input.env, input.staticAssetPrefix),
             // The toolchain add has to use the store the install linked
             // node_modules from (withSharedCache).
             packageManager: cachePorts ? withSharedCache(packageManager, pmCacheDir) : packageManager,
@@ -20976,7 +21103,10 @@ var LocalBuildExecutor = class {
               args: ["run", resolved.buildScript],
               cwd: appRoot,
               env: {
-                ...input.env,
+                // Static presets never get the asset prefix (spec
+                // 2026-11-07-static-asset-cdn §3): a Vite base or CRA
+                // PUBLIC_URL also moves the router and public/ files.
+                ...buildEnvWithStaticPrefix(input.env, void 0),
                 NPM_CONFIG_USERCONFIG: packageManagerConfigPath
               },
               timeoutMs: 15 * 6e4,
@@ -21010,6 +21140,14 @@ var LocalBuildExecutor = class {
           appRoot,
           observer
         );
+      const cdn = withStaticAssetPrefix(artifact, input.staticAssetPrefix);
+      if (cdn.note)
+        await observer.onLog({
+          level: "INFO",
+          stage: "DEPLOYING",
+          message: cdn.note
+        });
+      artifact = withImmutableHeaders(cdn.artifact);
       return {
         gitCommitSha,
         artifact,
@@ -34236,11 +34374,13 @@ function summarizeTeamUsage(report, currentMonth) {
   };
   const meters = USAGE_METRICS.map((metric) => {
     const limit = report.limits?.[metric] ?? null;
+    const perProject = metric === "domains" ? report.limits?.domainsPerProject ?? null : null;
     return {
       metric,
       used: used[metric],
       limit,
-      percent: limit ? Math.floor(used[metric] * 100 / limit) : null
+      percent: limit ? Math.floor(used[metric] * 100 / limit) : null,
+      perProject
     };
   });
   return {

package/dist/deploy.js

@@ -14,7 +14,7 @@ import {
   slugify,
   userAdapterUnreadable,
   workingTreeNotices
-} from "./chunk-UJGDKNDM.js";
+} from "./chunk-BAP7PHBF.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,

package/dist/index.js

@@ -136,7 +136,7 @@ import {
   warningLines,
   withFunctionRetries,
   writeProjectLink
-} from "./chunk-UJGDKNDM.js";
+} from "./chunk-BAP7PHBF.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -1704,12 +1704,12 @@ async function allUsers(client, projectId) {
   const users = [];
   let total = 0;
   for (let page = 1; ; page++) {
-    const listed = await usersCall(
+    const listed2 = await usersCall(
       () => client.backend.listUsers(projectId, { page, perPage: PAGE_SIZE })
     );
-    total = listed.total;
-    users.push(...listed.users);
-    if (listed.users.length < PAGE_SIZE || users.length >= total)
+    total = listed2.total;
+    users.push(...listed2.users);
+    if (listed2.users.length < PAGE_SIZE || users.length >= total)
       return { users, total };
   }
 }
@@ -2365,8 +2365,8 @@ function chunk(items3, size) {
 }
 async function readSchema(client, projectId) {
   const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
-  const [listed, virtual, internal] = schema.statements;
-  if (listed === void 0 || virtual === void 0 || internal === void 0)
+  const [listed2, virtual, internal] = schema.statements;
+  if (listed2 === void 0 || virtual === void 0 || internal === void 0)
     throw new NaroError(
       "DATABASE_QUERY_FAILED",
       `The schema could not be read: the database answered with ${String(schema.statements.length)} result sets instead of 3.`
@@ -2377,9 +2377,9 @@ async function readSchema(client, projectId) {
   const virtualNames = new Set(
     virtual.rows.map((row) => cellText(virtual, row, "name").toLowerCase())
   );
-  const objects2 = listed.rows.map((row) => {
-    const name = cellText(listed, row, "name");
-    const type = cellText(listed, row, "type");
+  const objects2 = listed2.rows.map((row) => {
+    const name = cellText(listed2, row, "name");
+    const type = cellText(listed2, row, "type");
     if (type === "view" || type === "trigger") return { type, name };
     return {
       type: virtualNames.has(name.toLowerCase()) ? "virtual" : "table",
@@ -3247,6 +3247,72 @@ function cellOf(value) {
   if (typeof value === "string") return value;
   return isInvalid(value) ? "invalid" : "condition";
 }
+var SET_POLICY_NAMES = new Set(
+  POLICY_ACTIONS.map((action) => `naro_${action}`)
+);
+function customPolicies(named) {
+  const byTable = /* @__PURE__ */ new Map();
+  for (const policy of named) {
+    if (SET_POLICY_NAMES.has(policy.name)) continue;
+    const invalid = policy.invalid !== null;
+    if (!invalid && policy.as !== "permissive") continue;
+    const key = asciiLower(policy.table);
+    const list = byTable.get(key) ?? [];
+    list.push({ name: policy.name, command: policy.command, invalid });
+    byTable.set(key, list);
+  }
+  return byTable;
+}
+function covers(policy, action) {
+  return policy.command === "all" || policy.command === action;
+}
+var CUSTOM_NOTE = "custom: a policy written as CREATE POLICY allows it. naro policy list shows it.";
+var INVALID_NOTE = "invalid: a policy that cannot be read covers it, so the Data API refuses it (500 POLICY_INVALID). naro policy list shows why.";
+var NAMES_ONLY_NOTE = "`none` may not mean denied on those tables: naro policy list shows their policies.";
+function listed(entries) {
+  return entries.map((entry) => `${printable(entry.name)} (${entry.command})`).toSorted().join(", ");
+}
+function customLines(policies, custom) {
+  const lines = [];
+  let allows = false;
+  let unreadable2 = false;
+  for (const policy of policies) {
+    const table3 = printable(policy.table);
+    if (custom) {
+      const list = custom.get(asciiLower(policy.table)) ?? [];
+      const valid = list.filter((entry) => !entry.invalid);
+      const invalid = list.filter((entry) => entry.invalid);
+      if (valid.length > 0) {
+        allows = true;
+        lines.push(`${table3}  custom: ${listed(valid)}`);
+      }
+      if (invalid.length > 0) {
+        unreadable2 = true;
+        lines.push(`${table3}  invalid: ${listed(invalid)}`);
+      }
+      continue;
+    }
+    const names = (policy.policies ?? []).filter(
+      (name) => !SET_POLICY_NAMES.has(name)
+    );
+    if (names.length === 0) continue;
+    lines.push(
+      `${table3}  also has policies written as SQL: ${names.map(printable).join(", ")}`
+    );
+  }
+  if (lines.length === 0) return lines;
+  if (!custom) return [...lines, NAMES_ONLY_NOTE];
+  return [
+    ...lines,
+    ...allows ? [CUSTOM_NOTE] : [],
+    ...unreadable2 ? [INVALID_NOTE] : []
+  ];
+}
+var POLICY_TABLE_HINTS = /* @__PURE__ */ new Set([
+  CUSTOM_NOTE,
+  INVALID_NOTE,
+  NAMES_ONLY_NOTE
+]);
 function conditionText(action, value) {
   if (typeof value === "string") return value;
   if (isInvalid(value))
@@ -3262,11 +3328,19 @@ function conditionText(action, value) {
   const text = parts.join("; ");
   return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
 }
-function policyTable(policies) {
+function policyTable(policies, custom) {
   const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
+  const shown = (policy, action) => {
+    const value = policy[action];
+    const sql2 = (custom?.get(asciiLower(policy.table)) ?? []).filter(
+      (entry) => covers(entry, action)
+    );
+    if (sql2.some((entry) => entry.invalid)) return "invalid";
+    return value === "none" && sql2.length > 0 ? "custom" : cellOf(value);
+  };
   const rows = policies.map((policy) => [
     printable(policy.table),
-    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
+    ...POLICY_ACTIONS.map((action) => shown(policy, action)),
     policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
   ]);
   const widths = header.map(
@@ -3289,19 +3363,22 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table3;
+  const sql = customLines(policies, custom);
+  const below = sql.length > 0 ? ["", ...sql] : [];
+  if (lines.length === 0) return [...table3, ...below];
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
     ...table3,
     "",
-    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
+    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`),
+    ...below
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
 function hintsFor(lines, environment) {
   if (environment === null) return lines;
   return lines.map(
-    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") || POLICY_TABLE_HINTS.has(line) ? forEnvironment(line, environment) : line
   );
 }
 function statementLine(policy) {
@@ -3364,9 +3441,13 @@ async function runPolicyRules(context) {
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const all = await client.backend.policies(projectId);
-  const wanted = table3?.toLowerCase();
-  const policies = wanted === void 0 ? all : all.filter((policy) => policy.table.toLowerCase() === wanted);
-  const lines = policies.length > 0 ? [...policyTable(policies), "", DEFAULT_DENY] : [
+  const wanted = table3 === void 0 ? void 0 : asciiLower(table3);
+  const policies = wanted === void 0 ? all : all.filter((policy) => asciiLower(policy.table) === wanted);
+  const custom = context.flags.json || policies.length === 0 ? void 0 : await client.backend.rlsPolicies(projectId, table3 === void 0 ? {} : { table: table3 }).then(customPolicies, (error) => {
+    if (!isNaroError(error)) throw error;
+    return null;
+  });
+  const lines = policies.length > 0 ? [...policyTable(policies, custom), "", DEFAULT_DENY] : [
     table3 === void 0 ? "No tables yet." : `No table named ${printable(table3)}.`
   ];
   context.output.result(
@@ -3501,7 +3582,10 @@ async function runPolicySet(context) {
     hintsFor(
       [
         `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-        ...policyTable([policy]),
+        ...policyTable(
+          [policy],
+          named === void 0 ? void 0 : customPolicies(named)
+        ),
         ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
       ],
       dataEnvironment(context.flags)
@@ -4670,9 +4754,9 @@ async function verifyAll(client, projectId, hostname, auto = false) {
     return [
       await client.domains.verifyByHostname(projectId, hostname, { auto })
     ];
-  const listed = await client.domains.list(projectId);
+  const listed2 = await client.domains.list(projectId);
   const verified = [];
-  for (const domain of listed)
+  for (const domain of listed2)
     verified.push(await client.domains.verify(projectId, domain.id, { auto }));
   return verified;
 }
@@ -11211,14 +11295,14 @@ async function listAll(storage, bucket, prefix, recursive, search) {
         truncated = true;
         break;
       }
-      const listed = await storage.from(bucket).list(folder, {
+      const listed2 = await storage.from(bucket).list(folder, {
         limit: PAGE,
         offset,
         ...search === "" ? {} : { search }
       });
-      if (isOldSearchRefusal(listed.error))
+      if (isOldSearchRefusal(listed2.error))
         throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
-      const page = unwrap(listed);
+      const page = unwrap(listed2);
       for (const entry of page) {
         const path = folder === "" ? entry.name : `${folder}/${entry.name}`;
         if (isFolder(entry)) {
@@ -14067,6 +14151,8 @@ function meterRow(meter, limitsKnown) {
   const label3 = METRIC_LABELS[meter.metric];
   const used = formatCount(meter.used);
   if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
+  if (typeof meter.perProject === "number")
+    return [label3, used, `${formatCount(meter.perProject)} per project`, "\u2014"];
   if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
   if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
   return [label3, used, formatCount(meter.limit), usedPercent(meter)];
@@ -14408,7 +14494,7 @@ Usage:
   naro backend users delete <id|username|email>
                                      Delete a user and end its sessions (asks first; --yes to skip)
   naro policy list [--table <t>]     Row-level security policies as CREATE POLICY (no policy = deny)
-  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none) and conditions
+  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none, custom, invalid) and conditions
   naro policy create "CREATE POLICY <name> ON <table> \u2026" | --file <policies.sql>
                                      Postgres's CREATE POLICY: AS PERMISSIVE|RESTRICTIVE,
                                      FOR ALL|SELECT|INSERT|UPDATE|DELETE, TO anon|authenticated|public,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -37,13 +37,13 @@
     "typescript": "7.0.2",
     "vitest": "3.2.7",
     "naro-js": "0.9.0",
-    "@next-deploy/build": "0.1.0",
-    "@next-deploy/config": "0.1.0",
+    "@next-deploy/core": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
     "@next-deploy/functions-runtime": "0.1.0",
-    "@next-deploy/functions-bundler": "0.1.0",
     "@next-deploy/sdk": "0.1.0",
-    "@next-deploy/core": "0.1.0"
+    "@next-deploy/config": "0.1.0",
+    "@next-deploy/functions-bundler": "0.1.0",
+    "@next-deploy/build": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",