naro-cli 0.28.0 → 0.30.0

package/dist/deploy.js

@@ -14,7 +14,7 @@ import {
   slugify,
   userAdapterUnreadable,
   workingTreeNotices
-} from "./chunk-UJGDKNDM.js";
+} from "./chunk-ITTYPT3A.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,

package/dist/functions/deploy.d.ts

@@ -1,5 +1,11 @@
 import { bootCheck, bundleFunction } from "@next-deploy/functions-bundler";
 import { type FunctionUploadTarget, type NaroClient } from "@next-deploy/sdk";
+/**
+ * A function's own failures while its version is made: said, and the run
+ * goes on with the next. FUNCTION_BUSY is not one — the lease is the
+ * project's worker's (design 2026-11-08 G5), so the next function would
+ * meet it too; it is retried, then stops the run.
+ */
 export declare const PER_FUNCTION_CODES: ReadonlySet<string>;
 export interface DeploySteps {
     bundle: typeof bundleFunction;
@@ -67,4 +73,5 @@ export declare function assertFunctionsNode(version?: string): void;
  */
 export declare function uploadTimeoutMs(upload: FunctionUploadTarget, now?: number): number;
 export declare const deadlineReached: (name: string, deadlineMs: number) => string;
+export declare const batchDeadlineReached: (count: number, deadlineMs: number) => string;
 export declare function deployFunctions(options: DeployFunctionsOptions): Promise<DeployFunctionsResult>;

package/dist/functions/retry.d.ts

@@ -6,7 +6,22 @@ export declare const FUNCTION_RATE_LIMIT_MAX_SECONDS = 300;
 export declare function defaultSleep(ms: number): Promise<void>;
 /** `details.retryAfter` rounded up, at most 300; 60 when it is missing. */
 export declare function retryAfterSeconds(error: NaroError): number;
-export declare function withFunctionRetries<T>(op: () => Promise<T>, name: string, io: {
+/** What a retry says, for one function or for a batch of them. */
+export interface RetryWords {
+    rateLimited(seconds: number, attempt: number, of: number): string;
+    busy(attempt: number, of: number): string;
+}
+/**
+ * Several functions put live in one call (design 2026-11-08 G4): the lease
+ * the server waits on is the project's worker, not one function's.
+ */
+export declare const batchRetryWords: (count: number) => RetryWords;
+/**
+ * `op` again after FUNCTIONS_RATE_LIMITED and FUNCTION_BUSY, judged by the
+ * code alone (the words are the server's to change). `name` is the
+ * function's, or the words of a batch.
+ */
+export declare function withFunctionRetries<T>(op: () => Promise<T>, name: string | RetryWords, io: {
     sleep: (ms: number) => Promise<void>;
     log: (line: string) => void;
     /** Tries after FUNCTIONS_RATE_LIMITED: 3 by default; naro-mcp passes 0. */

package/dist/index.js

@@ -28,6 +28,7 @@ import {
   appliedMigrations,
   applyMigrationFiles,
   assertFunctionsNode,
+  assertProjectLinkWritable,
   buildResetPlan,
   cannotAsk,
   cellText,
@@ -66,6 +67,7 @@ import {
   isPrintable,
   isReservedEnvTarget,
   isStalledBackend,
+  isSymbolicLink,
   isTerminalStatus,
   listMigrationFiles,
   loadStoredSession,
@@ -136,7 +138,7 @@ import {
   warningLines,
   withFunctionRetries,
   writeProjectLink
-} from "./chunk-UJGDKNDM.js";
+} from "./chunk-ITTYPT3A.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -1704,12 +1706,12 @@ async function allUsers(client, projectId) {
   const users = [];
   let total = 0;
   for (let page = 1; ; page++) {
-    const listed = await usersCall(
+    const listed2 = await usersCall(
       () => client.backend.listUsers(projectId, { page, perPage: PAGE_SIZE })
     );
-    total = listed.total;
-    users.push(...listed.users);
-    if (listed.users.length < PAGE_SIZE || users.length >= total)
+    total = listed2.total;
+    users.push(...listed2.users);
+    if (listed2.users.length < PAGE_SIZE || users.length >= total)
       return { users, total };
   }
 }
@@ -2365,8 +2367,8 @@ function chunk(items3, size) {
 }
 async function readSchema(client, projectId) {
   const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
-  const [listed, virtual, internal] = schema.statements;
-  if (listed === void 0 || virtual === void 0 || internal === void 0)
+  const [listed2, virtual, internal] = schema.statements;
+  if (listed2 === void 0 || virtual === void 0 || internal === void 0)
     throw new NaroError(
       "DATABASE_QUERY_FAILED",
       `The schema could not be read: the database answered with ${String(schema.statements.length)} result sets instead of 3.`
@@ -2377,9 +2379,9 @@ async function readSchema(client, projectId) {
   const virtualNames = new Set(
     virtual.rows.map((row) => cellText(virtual, row, "name").toLowerCase())
   );
-  const objects2 = listed.rows.map((row) => {
-    const name = cellText(listed, row, "name");
-    const type = cellText(listed, row, "type");
+  const objects2 = listed2.rows.map((row) => {
+    const name = cellText(listed2, row, "name");
+    const type = cellText(listed2, row, "type");
     if (type === "view" || type === "trigger") return { type, name };
     return {
       type: virtualNames.has(name.toLowerCase()) ? "virtual" : "table",
@@ -3247,6 +3249,72 @@ function cellOf(value) {
   if (typeof value === "string") return value;
   return isInvalid(value) ? "invalid" : "condition";
 }
+var SET_POLICY_NAMES = new Set(
+  POLICY_ACTIONS.map((action) => `naro_${action}`)
+);
+function customPolicies(named) {
+  const byTable = /* @__PURE__ */ new Map();
+  for (const policy of named) {
+    if (SET_POLICY_NAMES.has(policy.name)) continue;
+    const invalid = policy.invalid !== null;
+    if (!invalid && policy.as !== "permissive") continue;
+    const key = asciiLower(policy.table);
+    const list = byTable.get(key) ?? [];
+    list.push({ name: policy.name, command: policy.command, invalid });
+    byTable.set(key, list);
+  }
+  return byTable;
+}
+function covers(policy, action) {
+  return policy.command === "all" || policy.command === action;
+}
+var CUSTOM_NOTE = "custom: a policy written as CREATE POLICY allows it. naro policy list shows it.";
+var INVALID_NOTE = "invalid: a policy that cannot be read covers it, so the Data API refuses it (500 POLICY_INVALID). naro policy list shows why.";
+var NAMES_ONLY_NOTE = "`none` may not mean denied on those tables: naro policy list shows their policies.";
+function listed(entries) {
+  return entries.map((entry) => `${printable(entry.name)} (${entry.command})`).toSorted().join(", ");
+}
+function customLines(policies, custom) {
+  const lines = [];
+  let allows = false;
+  let unreadable2 = false;
+  for (const policy of policies) {
+    const table3 = printable(policy.table);
+    if (custom) {
+      const list = custom.get(asciiLower(policy.table)) ?? [];
+      const valid = list.filter((entry) => !entry.invalid);
+      const invalid = list.filter((entry) => entry.invalid);
+      if (valid.length > 0) {
+        allows = true;
+        lines.push(`${table3}  custom: ${listed(valid)}`);
+      }
+      if (invalid.length > 0) {
+        unreadable2 = true;
+        lines.push(`${table3}  invalid: ${listed(invalid)}`);
+      }
+      continue;
+    }
+    const names = (policy.policies ?? []).filter(
+      (name) => !SET_POLICY_NAMES.has(name)
+    );
+    if (names.length === 0) continue;
+    lines.push(
+      `${table3}  also has policies written as SQL: ${names.map(printable).join(", ")}`
+    );
+  }
+  if (lines.length === 0) return lines;
+  if (!custom) return [...lines, NAMES_ONLY_NOTE];
+  return [
+    ...lines,
+    ...allows ? [CUSTOM_NOTE] : [],
+    ...unreadable2 ? [INVALID_NOTE] : []
+  ];
+}
+var POLICY_TABLE_HINTS = /* @__PURE__ */ new Set([
+  CUSTOM_NOTE,
+  INVALID_NOTE,
+  NAMES_ONLY_NOTE
+]);
 function conditionText(action, value) {
   if (typeof value === "string") return value;
   if (isInvalid(value))
@@ -3262,11 +3330,19 @@ function conditionText(action, value) {
   const text = parts.join("; ");
   return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
 }
-function policyTable(policies) {
+function policyTable(policies, custom) {
   const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
+  const shown = (policy, action) => {
+    const value = policy[action];
+    const sql2 = (custom?.get(asciiLower(policy.table)) ?? []).filter(
+      (entry) => covers(entry, action)
+    );
+    if (sql2.some((entry) => entry.invalid)) return "invalid";
+    return value === "none" && sql2.length > 0 ? "custom" : cellOf(value);
+  };
   const rows = policies.map((policy) => [
     printable(policy.table),
-    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
+    ...POLICY_ACTIONS.map((action) => shown(policy, action)),
     policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
   ]);
   const widths = header.map(
@@ -3289,19 +3365,22 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table3;
+  const sql = customLines(policies, custom);
+  const below = sql.length > 0 ? ["", ...sql] : [];
+  if (lines.length === 0) return [...table3, ...below];
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
     ...table3,
     "",
-    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
+    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`),
+    ...below
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
 function hintsFor(lines, environment) {
   if (environment === null) return lines;
   return lines.map(
-    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") || POLICY_TABLE_HINTS.has(line) ? forEnvironment(line, environment) : line
   );
 }
 function statementLine(policy) {
@@ -3364,9 +3443,13 @@ async function runPolicyRules(context) {
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const all = await client.backend.policies(projectId);
-  const wanted = table3?.toLowerCase();
-  const policies = wanted === void 0 ? all : all.filter((policy) => policy.table.toLowerCase() === wanted);
-  const lines = policies.length > 0 ? [...policyTable(policies), "", DEFAULT_DENY] : [
+  const wanted = table3 === void 0 ? void 0 : asciiLower(table3);
+  const policies = wanted === void 0 ? all : all.filter((policy) => asciiLower(policy.table) === wanted);
+  const custom = context.flags.json || policies.length === 0 ? void 0 : await client.backend.rlsPolicies(projectId, table3 === void 0 ? {} : { table: table3 }).then(customPolicies, (error) => {
+    if (!isNaroError(error)) throw error;
+    return null;
+  });
+  const lines = policies.length > 0 ? [...policyTable(policies, custom), "", DEFAULT_DENY] : [
     table3 === void 0 ? "No tables yet." : `No table named ${printable(table3)}.`
   ];
   context.output.result(
@@ -3501,7 +3584,10 @@ async function runPolicySet(context) {
     hintsFor(
       [
         `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-        ...policyTable([policy]),
+        ...policyTable(
+          [policy],
+          named === void 0 ? void 0 : customPolicies(named)
+        ),
         ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
       ],
       dataEnvironment(context.flags)
@@ -4217,6 +4303,7 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
   const target = deployTarget(flags);
   const flaggedAdapter = flaggedUserAdapter(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
+  assertProjectLinkWritable(context.cwd, "deploying");
   if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -4670,9 +4757,9 @@ async function verifyAll(client, projectId, hostname, auto = false) {
     return [
       await client.domains.verifyByHostname(projectId, hostname, { auto })
     ];
-  const listed = await client.domains.list(projectId);
+  const listed2 = await client.domains.list(projectId);
   const verified = [];
-  for (const domain of listed)
+  for (const domain of listed2)
     verified.push(await client.domains.verify(projectId, domain.id, { auto }));
   return verified;
 }
@@ -5070,6 +5157,13 @@ function passwordRecoveryRequired() {
     message: "updateUser({ password }) works in the password recovery flow: open the link resetPasswordForEmail sent, then call it on that page."
   };
 }
+function recoveryForAnotherUser(email) {
+  return {
+    code: "RECOVERY_FOR_ANOTHER_USER",
+    message: "This password reset link is for another account than the one signed in on this browser, so it was not used. To reset that account's password, sign out first. If you did not ask for it, ignore it.",
+    details: { email }
+  };
+}
 function invalidProvider() {
   return {
     code: "VALIDATION_ERROR",
@@ -5095,6 +5189,12 @@ function websocketUnavailable() {
     message: "This runtime has no WebSocket. Pass one to createClient({ realtime: { WebSocket } })."
   };
 }
+function websocketHeadersUnavailable() {
+  return {
+    code: "WEBSOCKET_HEADERS_UNAVAILABLE",
+    message: "The service key goes in the apikey header of the realtime connection, which this runtime's WebSocket cannot send. Pass one that takes { headers } \u2014 ws (npm:ws) \u2014 as createClient({ realtime: { WebSocket } })."
+  };
+}
 function realtimeTimedOut(ms) {
   const seconds = Math.max(1, Math.round(ms / 1e3));
   return {
@@ -5768,8 +5868,11 @@ function isBrowser(scope = globalThis) {
   const g = scope;
   return g.window !== void 0 && g.document !== void 0;
 }
-function isWorkerd(g) {
-  return g.navigator?.userAgent === "Cloudflare-Workers";
+function isWorkerd(scope = globalThis) {
+  return scope.navigator?.userAgent === "Cloudflare-Workers";
+}
+function isDeno(scope = globalThis) {
+  return typeof scope.Deno?.version?.deno === "string";
 }
 function hasServerSignal(g) {
   return isWorkerd(g) || // Vercel's edge runtime and Next.js's edge (middleware, edge routes).
@@ -6145,12 +6248,8 @@ var AuthClient = class {
         await this.#flow.verifiers.take(fragment.naro_flow);
       return { data: none, error: flowError(type, fragment.naro_error) };
     }
-    if (type === "recovery" && fragment.naro_token) {
-      await this.#http.tokens.clear();
-      await this.#http.accessJwt?.clear();
-      await this.#flow.recovery.keep(fragment.naro_token);
-      return { data: none, error: null };
-    }
+    if (type === "recovery" && fragment.naro_token)
+      return this.#recoveryAnswer(none, fragment.naro_token);
     if (fragment.naro_code) {
       const traded = await this.exchangeCodeForSession(
         fragment.naro_code,
@@ -6160,6 +6259,45 @@ var AuthClient = class {
     }
     return { data: none, error: null };
   }
+  /**
+   * A reset link's token, read on the page it opened (security audit
+   * 2026-11-14 F6). The fragment is whoever sent the link's to write — one
+   * who holds a reset token of their own account can send the landing URL
+   * itself — so the worker is asked whose token it is: the answer names the
+   * account (masked, `data.email`, for the page to show) and whether it is
+   * the one signed in here.
+   *
+   * Signed in as another account, the link is not used: the session stays,
+   * the token is not kept, and the answer is RECOVERY_FOR_ANOTHER_USER — a
+   * password typed here cannot land on the sender's account. Otherwise,
+   * like supabase-js's recovery session, the link takes the place of
+   * whoever was signed in on this browser (the reset ends every session of
+   * that account anyway, PR #68 review 6): `updateUser` then acts on the
+   * link's account alone. A token the worker does not know is INVALID_TOKEN
+   * here, and nothing is kept.
+   */
+  async #recoveryAnswer(none, token) {
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/recovery-owner",
+      body: { token },
+      withToken: true,
+      // The page's queries wait on this; they must not wait forever.
+      timeoutMs: EXCHANGE_TIMEOUT_MS
+    });
+    if (result.error !== null) return { data: none, error: result.error };
+    const { body } = result.answer;
+    const owner = isRecord(body) && isRecord(body.data) ? body.data : null;
+    if (owner === null)
+      return { data: none, error: invalidResponse(result.answer.status) };
+    const email = typeof owner.email === "string" ? owner.email : null;
+    if (owner.self === false)
+      return { data: none, error: recoveryForAnotherUser(email) };
+    await this.#http.tokens.clear();
+    await this.#http.accessJwt?.clear();
+    await this.#flow.recovery.keep(token);
+    return { data: { ...none, email }, error: null };
+  }
   /**
    * Emails a password reset link, when the address has an account. The
    * answer is the same either way — it does not say whether it had one.
@@ -6183,11 +6321,12 @@ var AuthClient = class {
    * "(P1-2 리뷰 반영)".)
    *
    * Like supabase-js, it acts on the recovery link's account, which took the
-   * place of any signed-in session when the link was read — so the token is
-   * used only while no session is signed in on this browser, for 15 minutes
-   * after the link was opened, and never after a sign-in, sign-up or
-   * sign-out forgot it (PR #68 review 6). Otherwise PASSWORD_RECOVERY_REQUIRED,
-   * with no request.
+   * place of any signed-in session when the link was read (a link for
+   * another account than the signed-in one is not read, `#recoveryAnswer`)
+   * — so the token is used only while no session is signed in on this
+   * browser, for 15 minutes after the link was opened, and never after a
+   * sign-in, sign-up or sign-out forgot it (PR #68 review 6). Otherwise
+   * PASSWORD_RECOVERY_REQUIRED, with no request.
    */
   async updateUser(attributes) {
     await this.#pendingUrl();
@@ -7882,8 +8021,76 @@ function channelNameProblem(name) {
 function socketUrl(baseUrl, apiKey) {
   const url = new URL("/_naro/v1/realtime/websocket", baseUrl);
   url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
-  return `${url.href}?apikey=${encodeURIComponent(apiKey)}&vsn=${REALTIME_PROTOCOL_VERSION}`;
-}
+  const key = apiKey === null ? "" : `apikey=${encodeURIComponent(apiKey)}&`;
+  return `${url.href}?${key}vsn=${REALTIME_PROTOCOL_VERSION}`;
+}
+var UpgradeSocket = class {
+  onopen = null;
+  onmessage = null;
+  onclose = null;
+  onerror = null;
+  #ws = null;
+  /** `close()` was called, or the open failed: no event goes out after. */
+  #closed = null;
+  constructor(fetchLike, url, headers) {
+    let pending;
+    try {
+      pending = fetchLike(url, {
+        headers: { Upgrade: "websocket", ...headers }
+      });
+    } catch {
+      pending = Promise.reject(new Error("fetch threw"));
+    }
+    pending.then(
+      (response) => this.#arrived(response),
+      () => this.#failed()
+    );
+  }
+  #arrived(response) {
+    const ws = response.webSocket ?? null;
+    if (ws === null) {
+      void response.body?.cancel?.().catch(() => void 0);
+      this.#failed();
+      return;
+    }
+    if (this.#closed !== null) {
+      try {
+        ws.accept();
+        ws.close(this.#closed.code, this.#closed.reason);
+      } catch {
+      }
+      return;
+    }
+    this.#ws = ws;
+    ws.addEventListener("message", (event) => {
+      this.onmessage?.({ data: event.data });
+    });
+    ws.addEventListener("close", (event) => {
+      this.onclose?.({ code: event.code, reason: event.reason ?? "" });
+    });
+    ws.addEventListener("error", () => {
+      this.onerror?.();
+    });
+    ws.accept();
+    this.onopen?.();
+  }
+  /** No connection came of it: a close before the open. */
+  #failed() {
+    if (this.#closed !== null) return;
+    this.#closed = { code: void 0, reason: void 0 };
+    this.onclose?.({ code: 1006, reason: "" });
+  }
+  send(data) {
+    if (this.#ws === null)
+      throw new Error("The realtime connection is not open.");
+    this.#ws.send(data);
+  }
+  close(code, reason) {
+    if (this.#closed !== null) return;
+    this.#closed = { code, reason };
+    this.#ws?.close(code, reason);
+  }
+};
 var HEARTBEAT_MS = 25e3;
 var TIMEOUT_MS = 1e4;
 var PACED_BURST = CONNECTION_FRAME_BURST - 20;
@@ -8297,19 +8504,19 @@ var RealtimeSocket = class {
     }, this.#timeoutMs);
   }
   #open() {
-    const Impl = this.#config.options.WebSocket ?? globalThis.WebSocket;
+    const passed = this.#config.options.WebSocket;
+    const runtimes = globalThis.WebSocket;
+    const Impl = passed ?? runtimes;
     if (typeof Impl !== "function")
       return this.#stop(websocketUnavailable(), true);
     if (this.#config.service && !isKnownServer())
       return this.#stop(serviceKeyOffServer(), true);
-    let ws;
-    try {
-      ws = new Impl(
-        socketUrl(this.#config.baseUrl, this.#config.apiKey)
-      );
-    } catch (error) {
-      return this.#stop(socketRefused(error), true);
-    }
+    const made = this.#config.service ? this.#serviceSocket(
+      Impl,
+      passed === void 0 || passed === runtimes
+    ) : this.#anonSocket(Impl);
+    if ("error" in made) return this.#stop(made.error, true);
+    const ws = made.ws;
     this.#generation += 1;
     this.#ws = ws;
     this.#state = "connecting";
@@ -8324,6 +8531,48 @@ var RealtimeSocket = class {
       this.#timeoutMs
     );
   }
+  /**
+   * The anon key's connection: the one place a key goes into a URL (design
+   * §10 "3-2d") — a browser's WebSocket has no headers to put it in.
+   */
+  #anonSocket(Impl) {
+    try {
+      return {
+        ws: new Impl(socketUrl(this.#config.baseUrl, this.#config.apiKey))
+      };
+    } catch (error) {
+      return { error: socketRefused(error) };
+    }
+  }
+  /**
+   * The service key's connection (security audit 2026-11-14 F7): the key in
+   * the `apikey` header and never in the URL, where edge and worker logs
+   * would keep it. Node 22+, Bun and `ws` take `{ headers }` on the
+   * constructor; workerd's constructor takes none, so there — unless the
+   * app passed a WebSocket of its own, other than the runtime's — the
+   * connection is a `fetch` upgrade (`UpgradeSocket`); Deno's takes none
+   * either, and has no upgrade fetch, so the service key is refused there
+   * until a WebSocket that takes headers (`ws`) is passed. `runtimes` says
+   * the class is the runtime's own.
+   */
+  #serviceSocket(Impl, runtimes) {
+    const headers = { apikey: this.#config.apiKey };
+    const url = socketUrl(this.#config.baseUrl, null);
+    if (runtimes && isWorkerd())
+      return {
+        ws: new UpgradeSocket(
+          this.#config.fetch ?? globalThis.fetch,
+          `http${url.slice(2)}`,
+          headers
+        )
+      };
+    if (runtimes && isDeno()) return { error: websocketHeadersUnavailable() };
+    try {
+      return { ws: new Impl(url, { headers }) };
+    } catch (error) {
+      return { error: socketRefused(error) };
+    }
+  }
   #opened(ws) {
     if (this.#ws !== ws || this.#state !== "connecting") return;
     clearTimeout(this.#openTimer);
@@ -9507,6 +9756,7 @@ var RealtimeClient = class {
       apiKey: http.apiKey,
       service,
       options,
+      fetch: http.fetch,
       events: {
         // Not awaited, and not live yet: onLive says when the hub took it.
         opened: () => {
@@ -11211,14 +11461,14 @@ async function listAll(storage, bucket, prefix, recursive, search) {
         truncated = true;
         break;
       }
-      const listed = await storage.from(bucket).list(folder, {
+      const listed2 = await storage.from(bucket).list(folder, {
         limit: PAGE,
         offset,
         ...search === "" ? {} : { search }
       });
-      if (isOldSearchRefusal(listed.error))
+      if (isOldSearchRefusal(listed2.error))
         throw new NaroError("BACKEND_OUTDATED", STORAGE_OUTDATED_MESSAGE);
-      const page = unwrap(listed);
+      const page = unwrap(listed2);
       for (const entry of page) {
         const path = folder === "" ? entry.name : `${folder}/${entry.name}`;
         if (isFolder(entry)) {
@@ -12604,6 +12854,12 @@ function parsePullSurface(value) {
 async function runEnvPull(context) {
   const file = context.positionals[0] ?? ".env.local";
   const surface = parsePullSurface(context.flags.env);
+  const path = resolve5(context.cwd, file);
+  if (isSymbolicLink(path))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${file} is a symbolic link. Remove it, or pass another file name.`
+    );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   if (!isReservedEnvTarget(surface))
@@ -12613,7 +12869,6 @@ async function runEnvPull(context) {
   const count2 = Object.keys(vars).length;
   const text = `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
 ${serializeDotenv(vars)}`;
-  const path = resolve5(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -13014,7 +13269,7 @@ function functionName(context, usage) {
 }
 function statusWord(fn) {
   if (fn.status !== "error") return fn.status;
-  return `error at ${fn.step ?? "upload"}: ${printable(fn.error ?? "unknown error")}`;
+  return `error: ${printable(fn.error ?? "unknown error")}`;
 }
 var cpuHours = (ms) => (ms / 36e5).toLocaleString("en-US", { maximumFractionDigits: 1 });
 function functionLines(list) {
@@ -13035,8 +13290,13 @@ function functionLines(list) {
     return `${fn.name.padEnd(width)}  ${version2.padEnd(versionWidth)}  ${verify}  ${statusWord(fn)}  ${fn.url}${stale}`;
   });
   lines.push(
-    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per ${list.limits.functionsScope} on this plan.`
+    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per project.`
   );
+  const today = list.today;
+  if (today)
+    lines.push(
+      `Functions today (UTC, the project's): ${today.invocations.toLocaleString("en-US")} calls, ${today.cpuMs.toLocaleString("en-US")} ms of CPU.`
+    );
   const usage = list.usage;
   if (usage !== null) {
     const percent2 = usage.cpuMsLimit > 0 ? Math.floor(usage.cpuMs / usage.cpuMsLimit * 100) : 0;
@@ -14067,6 +14327,8 @@ function meterRow(meter, limitsKnown) {
   const label3 = METRIC_LABELS[meter.metric];
   const used = formatCount(meter.used);
   if (!limitsKnown) return [label3, used, "\u2014", "\u2014"];
+  if (typeof meter.perProject === "number")
+    return [label3, used, `${formatCount(meter.perProject)} per project`, "\u2014"];
   if (meter.limit === null) return [label3, used, "No limit", "\u2014"];
   if (meter.limit === 0) return [label3, used, "Not included", "\u2014"];
   return [label3, used, formatCount(meter.limit), usedPercent(meter)];
@@ -14408,7 +14670,7 @@ Usage:
   naro backend users delete <id|username|email>
                                      Delete a user and end its sessions (asks first; --yes to skip)
   naro policy list [--table <t>]     Row-level security policies as CREATE POLICY (no policy = deny)
-  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none) and conditions
+  naro policy rules [--table <t>]    Each table's policies as rules (public, authenticated, owner, none, custom, invalid) and conditions
   naro policy create "CREATE POLICY <name> ON <table> \u2026" | --file <policies.sql>
                                      Postgres's CREATE POLICY: AS PERMISSIVE|RESTRICTIVE,
                                      FOR ALL|SELECT|INSERT|UPDATE|DELETE, TO anon|authenticated|public,
@@ -14469,7 +14731,8 @@ Usage:
   naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
   naro functions deploy [name\u2026] [--no-verify-jwt] [--import-map <file>] [--skip-check]
                                      Bundle on this machine (Node.js 22 or later), check that it starts, upload;
-                                     every function in the folder when no name is given
+                                     every function in the folder when no name is given;
+                                     several go live together in one upload
   naro functions versions <name>     Its stored versions, newest first
   naro functions rollback <name> [<version>]
                                      Put an earlier version live again (the one before the live one by default)