naro-cli 0.29.0 → 0.30.0

package/dist/deploy.js

@@ -14,7 +14,7 @@ import {
   slugify,
   userAdapterUnreadable,
   workingTreeNotices
-} from "./chunk-BAP7PHBF.js";
+} from "./chunk-ITTYPT3A.js";
 import "./chunk-K3NQKI34.js";
 export {
   assertFunctionsNode,

package/dist/functions/deploy.d.ts

@@ -1,5 +1,11 @@
 import { bootCheck, bundleFunction } from "@next-deploy/functions-bundler";
 import { type FunctionUploadTarget, type NaroClient } from "@next-deploy/sdk";
+/**
+ * A function's own failures while its version is made: said, and the run
+ * goes on with the next. FUNCTION_BUSY is not one — the lease is the
+ * project's worker's (design 2026-11-08 G5), so the next function would
+ * meet it too; it is retried, then stops the run.
+ */
 export declare const PER_FUNCTION_CODES: ReadonlySet<string>;
 export interface DeploySteps {
     bundle: typeof bundleFunction;
@@ -67,4 +73,5 @@ export declare function assertFunctionsNode(version?: string): void;
  */
 export declare function uploadTimeoutMs(upload: FunctionUploadTarget, now?: number): number;
 export declare const deadlineReached: (name: string, deadlineMs: number) => string;
+export declare const batchDeadlineReached: (count: number, deadlineMs: number) => string;
 export declare function deployFunctions(options: DeployFunctionsOptions): Promise<DeployFunctionsResult>;

package/dist/functions/retry.d.ts

@@ -6,7 +6,22 @@ export declare const FUNCTION_RATE_LIMIT_MAX_SECONDS = 300;
 export declare function defaultSleep(ms: number): Promise<void>;
 /** `details.retryAfter` rounded up, at most 300; 60 when it is missing. */
 export declare function retryAfterSeconds(error: NaroError): number;
-export declare function withFunctionRetries<T>(op: () => Promise<T>, name: string, io: {
+/** What a retry says, for one function or for a batch of them. */
+export interface RetryWords {
+    rateLimited(seconds: number, attempt: number, of: number): string;
+    busy(attempt: number, of: number): string;
+}
+/**
+ * Several functions put live in one call (design 2026-11-08 G4): the lease
+ * the server waits on is the project's worker, not one function's.
+ */
+export declare const batchRetryWords: (count: number) => RetryWords;
+/**
+ * `op` again after FUNCTIONS_RATE_LIMITED and FUNCTION_BUSY, judged by the
+ * code alone (the words are the server's to change). `name` is the
+ * function's, or the words of a batch.
+ */
+export declare function withFunctionRetries<T>(op: () => Promise<T>, name: string | RetryWords, io: {
     sleep: (ms: number) => Promise<void>;
     log: (line: string) => void;
     /** Tries after FUNCTIONS_RATE_LIMITED: 3 by default; naro-mcp passes 0. */

package/dist/index.js

@@ -28,6 +28,7 @@ import {
   appliedMigrations,
   applyMigrationFiles,
   assertFunctionsNode,
+  assertProjectLinkWritable,
   buildResetPlan,
   cannotAsk,
   cellText,
@@ -66,6 +67,7 @@ import {
   isPrintable,
   isReservedEnvTarget,
   isStalledBackend,
+  isSymbolicLink,
   isTerminalStatus,
   listMigrationFiles,
   loadStoredSession,
@@ -136,7 +138,7 @@ import {
   warningLines,
   withFunctionRetries,
   writeProjectLink
-} from "./chunk-BAP7PHBF.js";
+} from "./chunk-ITTYPT3A.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -4301,6 +4303,7 @@ async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDep
   const target = deployTarget(flags);
   const flaggedAdapter = flaggedUserAdapter(flags);
   const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
+  assertProjectLinkWritable(context.cwd, "deploying");
   if (target.production && !flags.yes && !flags.json && isInteractive()) {
     const confirmed = await context.prompter.confirm("Deploy to production?");
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -5154,6 +5157,13 @@ function passwordRecoveryRequired() {
     message: "updateUser({ password }) works in the password recovery flow: open the link resetPasswordForEmail sent, then call it on that page."
   };
 }
+function recoveryForAnotherUser(email) {
+  return {
+    code: "RECOVERY_FOR_ANOTHER_USER",
+    message: "This password reset link is for another account than the one signed in on this browser, so it was not used. To reset that account's password, sign out first. If you did not ask for it, ignore it.",
+    details: { email }
+  };
+}
 function invalidProvider() {
   return {
     code: "VALIDATION_ERROR",
@@ -5179,6 +5189,12 @@ function websocketUnavailable() {
     message: "This runtime has no WebSocket. Pass one to createClient({ realtime: { WebSocket } })."
   };
 }
+function websocketHeadersUnavailable() {
+  return {
+    code: "WEBSOCKET_HEADERS_UNAVAILABLE",
+    message: "The service key goes in the apikey header of the realtime connection, which this runtime's WebSocket cannot send. Pass one that takes { headers } \u2014 ws (npm:ws) \u2014 as createClient({ realtime: { WebSocket } })."
+  };
+}
 function realtimeTimedOut(ms) {
   const seconds = Math.max(1, Math.round(ms / 1e3));
   return {
@@ -5852,8 +5868,11 @@ function isBrowser(scope = globalThis) {
   const g = scope;
   return g.window !== void 0 && g.document !== void 0;
 }
-function isWorkerd(g) {
-  return g.navigator?.userAgent === "Cloudflare-Workers";
+function isWorkerd(scope = globalThis) {
+  return scope.navigator?.userAgent === "Cloudflare-Workers";
+}
+function isDeno(scope = globalThis) {
+  return typeof scope.Deno?.version?.deno === "string";
 }
 function hasServerSignal(g) {
   return isWorkerd(g) || // Vercel's edge runtime and Next.js's edge (middleware, edge routes).
@@ -6229,12 +6248,8 @@ var AuthClient = class {
         await this.#flow.verifiers.take(fragment.naro_flow);
       return { data: none, error: flowError(type, fragment.naro_error) };
     }
-    if (type === "recovery" && fragment.naro_token) {
-      await this.#http.tokens.clear();
-      await this.#http.accessJwt?.clear();
-      await this.#flow.recovery.keep(fragment.naro_token);
-      return { data: none, error: null };
-    }
+    if (type === "recovery" && fragment.naro_token)
+      return this.#recoveryAnswer(none, fragment.naro_token);
     if (fragment.naro_code) {
       const traded = await this.exchangeCodeForSession(
         fragment.naro_code,
@@ -6244,6 +6259,45 @@ var AuthClient = class {
     }
     return { data: none, error: null };
   }
+  /**
+   * A reset link's token, read on the page it opened (security audit
+   * 2026-11-14 F6). The fragment is whoever sent the link's to write — one
+   * who holds a reset token of their own account can send the landing URL
+   * itself — so the worker is asked whose token it is: the answer names the
+   * account (masked, `data.email`, for the page to show) and whether it is
+   * the one signed in here.
+   *
+   * Signed in as another account, the link is not used: the session stays,
+   * the token is not kept, and the answer is RECOVERY_FOR_ANOTHER_USER — a
+   * password typed here cannot land on the sender's account. Otherwise,
+   * like supabase-js's recovery session, the link takes the place of
+   * whoever was signed in on this browser (the reset ends every session of
+   * that account anyway, PR #68 review 6): `updateUser` then acts on the
+   * link's account alone. A token the worker does not know is INVALID_TOKEN
+   * here, and nothing is kept.
+   */
+  async #recoveryAnswer(none, token) {
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/recovery-owner",
+      body: { token },
+      withToken: true,
+      // The page's queries wait on this; they must not wait forever.
+      timeoutMs: EXCHANGE_TIMEOUT_MS
+    });
+    if (result.error !== null) return { data: none, error: result.error };
+    const { body } = result.answer;
+    const owner = isRecord(body) && isRecord(body.data) ? body.data : null;
+    if (owner === null)
+      return { data: none, error: invalidResponse(result.answer.status) };
+    const email = typeof owner.email === "string" ? owner.email : null;
+    if (owner.self === false)
+      return { data: none, error: recoveryForAnotherUser(email) };
+    await this.#http.tokens.clear();
+    await this.#http.accessJwt?.clear();
+    await this.#flow.recovery.keep(token);
+    return { data: { ...none, email }, error: null };
+  }
   /**
    * Emails a password reset link, when the address has an account. The
    * answer is the same either way — it does not say whether it had one.
@@ -6267,11 +6321,12 @@ var AuthClient = class {
    * "(P1-2 리뷰 반영)".)
    *
    * Like supabase-js, it acts on the recovery link's account, which took the
-   * place of any signed-in session when the link was read — so the token is
-   * used only while no session is signed in on this browser, for 15 minutes
-   * after the link was opened, and never after a sign-in, sign-up or
-   * sign-out forgot it (PR #68 review 6). Otherwise PASSWORD_RECOVERY_REQUIRED,
-   * with no request.
+   * place of any signed-in session when the link was read (a link for
+   * another account than the signed-in one is not read, `#recoveryAnswer`)
+   * — so the token is used only while no session is signed in on this
+   * browser, for 15 minutes after the link was opened, and never after a
+   * sign-in, sign-up or sign-out forgot it (PR #68 review 6). Otherwise
+   * PASSWORD_RECOVERY_REQUIRED, with no request.
    */
   async updateUser(attributes) {
     await this.#pendingUrl();
@@ -7966,8 +8021,76 @@ function channelNameProblem(name) {
 function socketUrl(baseUrl, apiKey) {
   const url = new URL("/_naro/v1/realtime/websocket", baseUrl);
   url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
-  return `${url.href}?apikey=${encodeURIComponent(apiKey)}&vsn=${REALTIME_PROTOCOL_VERSION}`;
-}
+  const key = apiKey === null ? "" : `apikey=${encodeURIComponent(apiKey)}&`;
+  return `${url.href}?${key}vsn=${REALTIME_PROTOCOL_VERSION}`;
+}
+var UpgradeSocket = class {
+  onopen = null;
+  onmessage = null;
+  onclose = null;
+  onerror = null;
+  #ws = null;
+  /** `close()` was called, or the open failed: no event goes out after. */
+  #closed = null;
+  constructor(fetchLike, url, headers) {
+    let pending;
+    try {
+      pending = fetchLike(url, {
+        headers: { Upgrade: "websocket", ...headers }
+      });
+    } catch {
+      pending = Promise.reject(new Error("fetch threw"));
+    }
+    pending.then(
+      (response) => this.#arrived(response),
+      () => this.#failed()
+    );
+  }
+  #arrived(response) {
+    const ws = response.webSocket ?? null;
+    if (ws === null) {
+      void response.body?.cancel?.().catch(() => void 0);
+      this.#failed();
+      return;
+    }
+    if (this.#closed !== null) {
+      try {
+        ws.accept();
+        ws.close(this.#closed.code, this.#closed.reason);
+      } catch {
+      }
+      return;
+    }
+    this.#ws = ws;
+    ws.addEventListener("message", (event) => {
+      this.onmessage?.({ data: event.data });
+    });
+    ws.addEventListener("close", (event) => {
+      this.onclose?.({ code: event.code, reason: event.reason ?? "" });
+    });
+    ws.addEventListener("error", () => {
+      this.onerror?.();
+    });
+    ws.accept();
+    this.onopen?.();
+  }
+  /** No connection came of it: a close before the open. */
+  #failed() {
+    if (this.#closed !== null) return;
+    this.#closed = { code: void 0, reason: void 0 };
+    this.onclose?.({ code: 1006, reason: "" });
+  }
+  send(data) {
+    if (this.#ws === null)
+      throw new Error("The realtime connection is not open.");
+    this.#ws.send(data);
+  }
+  close(code, reason) {
+    if (this.#closed !== null) return;
+    this.#closed = { code, reason };
+    this.#ws?.close(code, reason);
+  }
+};
 var HEARTBEAT_MS = 25e3;
 var TIMEOUT_MS = 1e4;
 var PACED_BURST = CONNECTION_FRAME_BURST - 20;
@@ -8381,19 +8504,19 @@ var RealtimeSocket = class {
     }, this.#timeoutMs);
   }
   #open() {
-    const Impl = this.#config.options.WebSocket ?? globalThis.WebSocket;
+    const passed = this.#config.options.WebSocket;
+    const runtimes = globalThis.WebSocket;
+    const Impl = passed ?? runtimes;
     if (typeof Impl !== "function")
       return this.#stop(websocketUnavailable(), true);
     if (this.#config.service && !isKnownServer())
       return this.#stop(serviceKeyOffServer(), true);
-    let ws;
-    try {
-      ws = new Impl(
-        socketUrl(this.#config.baseUrl, this.#config.apiKey)
-      );
-    } catch (error) {
-      return this.#stop(socketRefused(error), true);
-    }
+    const made = this.#config.service ? this.#serviceSocket(
+      Impl,
+      passed === void 0 || passed === runtimes
+    ) : this.#anonSocket(Impl);
+    if ("error" in made) return this.#stop(made.error, true);
+    const ws = made.ws;
     this.#generation += 1;
     this.#ws = ws;
     this.#state = "connecting";
@@ -8408,6 +8531,48 @@ var RealtimeSocket = class {
       this.#timeoutMs
     );
   }
+  /**
+   * The anon key's connection: the one place a key goes into a URL (design
+   * §10 "3-2d") — a browser's WebSocket has no headers to put it in.
+   */
+  #anonSocket(Impl) {
+    try {
+      return {
+        ws: new Impl(socketUrl(this.#config.baseUrl, this.#config.apiKey))
+      };
+    } catch (error) {
+      return { error: socketRefused(error) };
+    }
+  }
+  /**
+   * The service key's connection (security audit 2026-11-14 F7): the key in
+   * the `apikey` header and never in the URL, where edge and worker logs
+   * would keep it. Node 22+, Bun and `ws` take `{ headers }` on the
+   * constructor; workerd's constructor takes none, so there — unless the
+   * app passed a WebSocket of its own, other than the runtime's — the
+   * connection is a `fetch` upgrade (`UpgradeSocket`); Deno's takes none
+   * either, and has no upgrade fetch, so the service key is refused there
+   * until a WebSocket that takes headers (`ws`) is passed. `runtimes` says
+   * the class is the runtime's own.
+   */
+  #serviceSocket(Impl, runtimes) {
+    const headers = { apikey: this.#config.apiKey };
+    const url = socketUrl(this.#config.baseUrl, null);
+    if (runtimes && isWorkerd())
+      return {
+        ws: new UpgradeSocket(
+          this.#config.fetch ?? globalThis.fetch,
+          `http${url.slice(2)}`,
+          headers
+        )
+      };
+    if (runtimes && isDeno()) return { error: websocketHeadersUnavailable() };
+    try {
+      return { ws: new Impl(url, { headers }) };
+    } catch (error) {
+      return { error: socketRefused(error) };
+    }
+  }
   #opened(ws) {
     if (this.#ws !== ws || this.#state !== "connecting") return;
     clearTimeout(this.#openTimer);
@@ -9591,6 +9756,7 @@ var RealtimeClient = class {
       apiKey: http.apiKey,
       service,
       options,
+      fetch: http.fetch,
       events: {
         // Not awaited, and not live yet: onLive says when the hub took it.
         opened: () => {
@@ -12688,6 +12854,12 @@ function parsePullSurface(value) {
 async function runEnvPull(context) {
   const file = context.positionals[0] ?? ".env.local";
   const surface = parsePullSurface(context.flags.env);
+  const path = resolve5(context.cwd, file);
+  if (isSymbolicLink(path))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${file} is a symbolic link. Remove it, or pass another file name.`
+    );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   if (!isReservedEnvTarget(surface))
@@ -12697,7 +12869,6 @@ async function runEnvPull(context) {
   const count2 = Object.keys(vars).length;
   const text = `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
 ${serializeDotenv(vars)}`;
-  const path = resolve5(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -13098,7 +13269,7 @@ function functionName(context, usage) {
 }
 function statusWord(fn) {
   if (fn.status !== "error") return fn.status;
-  return `error at ${fn.step ?? "upload"}: ${printable(fn.error ?? "unknown error")}`;
+  return `error: ${printable(fn.error ?? "unknown error")}`;
 }
 var cpuHours = (ms) => (ms / 36e5).toLocaleString("en-US", { maximumFractionDigits: 1 });
 function functionLines(list) {
@@ -13119,8 +13290,13 @@ function functionLines(list) {
     return `${fn.name.padEnd(width)}  ${version2.padEnd(versionWidth)}  ${verify}  ${statusWord(fn)}  ${fn.url}${stale}`;
   });
   lines.push(
-    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per ${list.limits.functionsScope} on this plan.`
+    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per project.`
   );
+  const today = list.today;
+  if (today)
+    lines.push(
+      `Functions today (UTC, the project's): ${today.invocations.toLocaleString("en-US")} calls, ${today.cpuMs.toLocaleString("en-US")} ms of CPU.`
+    );
   const usage = list.usage;
   if (usage !== null) {
     const percent2 = usage.cpuMsLimit > 0 ? Math.floor(usage.cpuMs / usage.cpuMsLimit * 100) : 0;
@@ -14555,7 +14731,8 @@ Usage:
   naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
   naro functions deploy [name\u2026] [--no-verify-jwt] [--import-map <file>] [--skip-check]
                                      Bundle on this machine (Node.js 22 or later), check that it starts, upload;
-                                     every function in the folder when no name is given
+                                     every function in the folder when no name is given;
+                                     several go live together in one upload
   naro functions versions <name>     Its stored versions, newest first
   naro functions rollback <name> [<version>]
                                      Put an earlier version live again (the one before the live one by default)

package/dist/{stack-PDV3NPWC.js → stack-DFLT7AVX.js}

@@ -4,9 +4,43 @@ import "./chunk-K3NQKI34.js";
 // ../../packages/build/src/stack.ts
 import { readFile, stat } from "fs/promises";
 import { join } from "path";
-import {
-  frameworkList
-} from "@vercel/frameworks";
+var STACKS = [
+  { slug: "nextjs", detectors: { every: [{ matchPackage: "next" }] } },
+  { slug: "gatsby", detectors: { every: [{ matchPackage: "gatsby" }] } },
+  { slug: "astro", detectors: { every: [{ matchPackage: "astro" }] } },
+  {
+    slug: "docusaurus-2",
+    detectors: { some: [{ matchPackage: "@docusaurus/core" }] }
+  },
+  { slug: "angular", detectors: { every: [{ matchPackage: "@angular/cli" }] } },
+  // Vercel spells this one as a content pattern on package.json — the very
+  // pattern matchPackage builds (see detectorMatches).
+  {
+    slug: "sveltekit-1",
+    detectors: { every: [{ matchPackage: "@sveltejs/kit" }] }
+  },
+  {
+    slug: "create-react-app",
+    detectors: {
+      some: [
+        { matchPackage: "react-scripts" },
+        { matchPackage: "react-dev-utils" }
+      ]
+    }
+  },
+  {
+    slug: "nuxtjs",
+    detectors: {
+      some: [
+        { matchPackage: "nuxt" },
+        { matchPackage: "nuxt3" },
+        { matchPackage: "nuxt-edge" },
+        { matchPackage: "nuxt-nightly" }
+      ]
+    }
+  },
+  { slug: "vite", detectors: { every: [{ matchPackage: "vite" }] } }
+];
 var PRESET_STACKS = {
   next: "nextjs",
   "next-export": "nextjs",
@@ -51,8 +85,7 @@ async function detectorMatches(reader, { path, matchContent, matchPackage }) {
   if (!await reader.isFile(file)) return false;
   return new RegExp(pattern, "m").test(await reader.readFile(file));
 }
-async function frameworkMatches(reader, framework) {
-  const { every, some } = framework.detectors ?? {};
+async function stackMatches(reader, { detectors: { every, some } }) {
   if (!every && !some) return false;
   if (every) {
     const results = await Promise.all(
@@ -68,27 +101,13 @@ async function frameworkMatches(reader, framework) {
   }
   return true;
 }
-function removeSuperseded(matches, slug) {
-  const index = matches.findIndex((framework2) => framework2?.slug === slug);
-  const framework = matches[index];
-  if (!framework) return;
-  for (const next of framework.supersedes ?? [])
-    removeSuperseded(matches, next);
-  matches.splice(index, 1);
-}
 async function detectStack(root, reader = localReader(root)) {
-  const candidates = frameworkList.filter(
-    (framework) => !framework.experimental && framework.slug
-  );
   const matches = await Promise.all(
-    candidates.map(
-      async (framework) => await frameworkMatches(reader, framework) ? framework : null
+    STACKS.map(
+      async (stack) => await stackMatches(reader, stack) ? stack.slug : null
     )
   );
-  for (const match of matches.slice()) {
-    for (const slug2 of match?.supersedes ?? []) removeSuperseded(matches, slug2);
-  }
-  const slug = matches.find((match) => match !== null)?.slug ?? null;
+  const slug = matches.find((match) => match !== null) ?? null;
   if (slug === "vite") return await viteLibrary(reader) ?? "vite";
   return slug && STACK_SLUG_PATTERN.test(slug) ? slug : null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -13,7 +13,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "exports": {
     ".": {
@@ -24,26 +24,25 @@
   "dependencies": {
     "@cloudflare/unenv-preset": "2.16.2",
     "@supabase/supabase-js": "2.112.3",
-    "@vercel/frameworks": "3.34.0",
-    "esbuild": "0.28.1",
-    "miniflare": "5.20261006.0-alpha",
+    "esbuild": "0.28.2",
+    "miniflare": "5.20261104.0-beta",
     "unenv": "2.0.0-rc.24",
     "vinext": "1.1.0",
-    "wrangler": "4.148.0"
+    "wrangler": "4.158.0"
   },
   "devDependencies": {
     "tsup": "8.5.0",
     "tsx": "4.23.12",
     "typescript": "7.0.2",
     "vitest": "3.2.7",
+    "@next-deploy/build": "0.1.0",
     "naro-js": "0.9.0",
+    "@next-deploy/config": "0.1.0",
     "@next-deploy/core": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
     "@next-deploy/functions-runtime": "0.1.0",
     "@next-deploy/sdk": "0.1.0",
-    "@next-deploy/config": "0.1.0",
-    "@next-deploy/functions-bundler": "0.1.0",
-    "@next-deploy/build": "0.1.0"
+    "@next-deploy/functions-bundler": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",