naro-cli 0.28.0 → 0.30.0

package/README.md

@@ -48,6 +48,9 @@ effectively your env credentials.
 
 ## Requirements
 
+Node.js **22 or newer** (Node 20 reached end of life on 2026-04-30; npm warns
+with `EBADENGINE` and, with `engine-strict`, refuses to install).
+
 Next.js **16 or newer**. Next 15 and below are not supported — they stop at the
 version gate right after install with `NEXT_VERSION_UNSUPPORTED`.
 
@@ -244,7 +247,8 @@ naro functions [list]              Naro Functions: name, version, verify_jwt, st
 naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
 naro functions deploy [name…] [--no-verify-jwt] [--import-map <file>] [--skip-check]
                                    Bundle on this machine (Node.js 22 or later), check that it starts, upload;
-                                   every function in the folder when no name is given
+                                   every function in the folder when no name is given;
+                                   several go live together in one upload
 naro functions versions <name>     Its stored versions, newest first
 naro functions rollback <name> [<version>]
                                    Put an earlier version live again (the one before the live one by default)
@@ -897,6 +901,42 @@ An `--update-check` you give replaces the default: without
 
 ## Release notes
 
+### 0.30.0
+
+- `naro functions deploy` with several names (or none, for the whole folder)
+  puts them live in one upload. A project's functions now run in one worker;
+  each function still has its own versions, rollback and URL. Projects can have
+  up to 100 functions, adding up to 64 MiB (`413 FUNCTIONS_TOO_LARGE`); the
+  compressed-size check is gone.
+- `naro env pull` and `naro link` refuse a symbolic link where they write, and
+  `naro deploy` checks `.naro/` before it deploys, so a repository cannot point
+  them at another file.
+- Login: the callback server checks `Host` and answers `410` after the first
+  callback; the session file is written to a temporary name, then moved into
+  place with mode `0600`; `naro logout` also removes a leftover temporary file.
+  On Windows the login URL opens with `rundll32` instead of `cmd.exe`.
+- Node.js 22 or later. wrangler, miniflare and esbuild are pinned to patched
+  releases; `@vercel/frameworks` is no longer a dependency (the 10 presets keep
+  their detection rules).
+- naro-mcp 0.29.0 goes out with it: `deploy_function` takes `names` (1–100),
+  the MCP SDK is pinned to 1.32.2, and `get_runtime_logs`, `get_build_logs`,
+  `list_deployments` and `get_deployment` mark their results as untrusted data.
+- naro-js 0.9.0 goes out with it: a recovery link is not used while another
+  account is signed in, and on the server the service key goes in the `apikey`
+  header, not the WebSocket URL.
+
+### 0.29.0
+
+- `naro usage` shows Hobby custom domains as `1 per project` (an apex and its
+  `www.` form count as one) instead of `No limit`.
+- `naro policy rules` marks an action allowed by a policy written as
+  `CREATE POLICY` as `custom`, and one covered by a policy it cannot read as
+  `invalid`, and lists those policies under the table. `--json` is unchanged.
+- The hints under `naro policy rules --env <name>` point at that environment.
+- naro-mcp 0.28.0 goes out with it: `get_team_usage` explains
+  `domainsPerProject` and `perProject`, and `list_policy_rules` says that
+  `none` means no rule `naro policy set` wrote, not nobody.
+
 ### 0.28.0
 
 - Next.js 15 and below are refused up front with `NEXT_VERSION_UNSUPPORTED`
@@ -1673,6 +1713,21 @@ RENAME` the way the control plane now reads it: a column rename whose
   `<cwd>/tmp/x.env`. A file it overwrites is set to 0600 as well. Before,
   only a new file was, and an existing 0644 `.env.local` kept 0644 with the
   secrets in it.
+- `naro env pull` refuses to write through a symbolic link, before it asks
+  for the values: `VALIDATION_FAILED`
+  `.env.local is a symbolic link. Remove it, or pass another file name.`
+  A cloned repository can commit `.env.local` as a link (git keeps mode
+  120000), and the file followed it — into `public/`, say, which the next
+  deploy ships. `naro link` refuses a `.naro`, `.naro/project.json` or
+  `.naro/README.txt` that is a link the same way
+  (`.naro is a symbolic link. Remove it before linking the project.`);
+  `naro deploy` checks the same places before it asks or sends anything
+  (`Remove it before deploying.`), since it writes the link only once the
+  deployment exists. Both leave a `.gitignore` that is a link alone.
+- naro-cli now ships `wrangler` 4.158.0 (was 4.148.0), `miniflare`
+  5.20261104.0-beta and `esbuild` 0.28.2. miniflare's `undici` 7.30.1 and
+  `sharp` 0.35.5 close what `npm audit` reported against 7.29.1 (dropped TLS
+  options, cache poisoning over cross-origin redirects) and 0.35.4 (librsvg).
 - `naro git connect` with `--json` or without a terminal no longer opens a
   browser and waits three minutes when the Naro GitHub App cannot reach the
   repository. It fails at once with `REPOSITORY_NOT_ACCESSIBLE`