naro-cli 0.21.0 → 0.23.0

package/dist/{chunk-FFPOVA7I.js → chunk-ALK4VTL2.js}

@@ -4,11 +4,11 @@ import {
 } from "./chunk-K3NQKI34.js";
 
 // src/deploy.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { mkdtemp as mkdtemp2, readFile as readFile15, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename4, dirname as dirname6, join as join26, resolve as resolve11 } from "path";
-import { fileURLToPath } from "url";
+import { basename as basename5, dirname as dirname10, join as join32, resolve as resolve14 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
 function artifactUploadEntries(artifact) {
@@ -41,7 +41,7 @@ function parseArtifactPutUrls(payload) {
 }
 async function eachWithinBudget(items, limit, budget, weigh, work) {
   if (items.length === 0) return;
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve15, reject) => {
     let next = 0;
     let running = 0;
     let weight = 0;
@@ -58,7 +58,7 @@ async function eachWithinBudget(items, limit, budget, weigh, work) {
           running -= 1;
           weight -= itemWeight;
           finished += 1;
-          if (finished === items.length) resolve12();
+          if (finished === items.length) resolve15();
           else pump();
         }, reject);
       }
@@ -98,11 +98,11 @@ async function uploadArtifactFiles(artifact, ports, limits = {}) {
       await ports.putProxied(entry);
     }
   }
-  const bytes = entries.reduce(
+  const bytes2 = entries.reduce(
     (total, entry) => total + entry.file.data.byteLength,
     0
   );
-  return { proxied, total: entries.length, bytes };
+  return { proxied, total: entries.length, bytes: bytes2 };
 }
 function artifactUploadSummary(report, elapsedMs) {
   const kilobytes = Math.ceil(report.bytes / 1e3);
@@ -326,6 +326,162 @@ var STALL_WINDOW_MS = 10 * 6e4;
 // ../../packages/core/src/deployment-strategy.ts
 var MIN_SUPPORTED_NEXT_MAJOR = 15;
 
+// ../../packages/core/src/environment-guidance.ts
+var DATA_COMMANDS = /* @__PURE__ */ new Set([
+  "db",
+  "migration",
+  "gen",
+  "backend",
+  "policy",
+  "storage",
+  "realtime"
+]);
+var BACKEND_SWITCHES = /* @__PURE__ */ new Set([
+  "enable",
+  "provision",
+  "disable"
+]);
+var PRODUCTION_SWITCH_NOTE = "production's switch, which every environment follows";
+var SWITCH_CONTEXT = /\bturned off\b|\bturn(?:s|ing)? (?:it|them) (?:back )?on\b|\bbackend is on\b/i;
+var SUBCOMMANDS = {
+  db: /* @__PURE__ */ new Set([
+    "info",
+    "enable",
+    "query",
+    "push",
+    "dump",
+    "restore",
+    "pull",
+    "reset",
+    "lint",
+    "table",
+    "index",
+    "create",
+    "add-column",
+    "rename-column",
+    "rename",
+    "drop-column",
+    "drop"
+  ]),
+  migration: /* @__PURE__ */ new Set(["list", "ls", "new", "up", "repair"]),
+  gen: /* @__PURE__ */ new Set(["types"]),
+  backend: /* @__PURE__ */ new Set([
+    "info",
+    "status",
+    "enable",
+    "provision",
+    "disable",
+    "keys",
+    "rotate",
+    "auth",
+    "email",
+    "oauth",
+    "redirects",
+    "require-verification",
+    "signups",
+    "password",
+    "set",
+    "add",
+    "remove",
+    "users",
+    "create",
+    "delete"
+  ]),
+  policy: /* @__PURE__ */ new Set(["list", "ls", "set", "create", "drop", "remove", "rm"]),
+  storage: /* @__PURE__ */ new Set([
+    "enable",
+    "disable",
+    "bucket",
+    "list",
+    "create",
+    "update",
+    "empty",
+    "remove",
+    "cp",
+    "mv",
+    "ls",
+    "rm"
+  ]),
+  realtime: /* @__PURE__ */ new Set(["enable", "disable", "tables", "add", "remove"])
+};
+function kindOf(words) {
+  const command = words[1] ?? "";
+  if (!DATA_COMMANDS.has(command)) return "leave";
+  if (words.some((word) => word === "--env" || word.startsWith("--env=")))
+    return "leave";
+  if (command === "migration" && words[2] === "new") return "leave";
+  if (command === "backend" && BACKEND_SWITCHES.has(words[2] ?? ""))
+    return words.length === 3 ? "switch" : "leave";
+  return "env";
+}
+function quoted(span, slug, switchContext) {
+  const words = span.split(" ");
+  switch (kindOf(words)) {
+    case "env":
+      return `\`${span} --env ${slug}\``;
+    case "switch":
+      return words[2] !== "disable" && !switchContext ? `\`naro environments provision ${slug}\`` : `\`${span}\` (${PRODUCTION_SWITCH_NOTE})`;
+    default:
+      return `\`${span}\``;
+  }
+}
+var QUOTED = /`(naro [^`\n]+)`/g;
+var BARE = /(?<![`\w/-])naro ([a-z]+)((?: [a-z][a-z-]*)*)/g;
+function bare(match, command, rest, after, slug, switchContext) {
+  const vocabulary = SUBCOMMANDS[command];
+  if (vocabulary === void 0) return match;
+  const words = rest.split(" ").filter((word) => word !== "");
+  let count2 = 0;
+  while (count2 < words.length && vocabulary.has(words[count2] ?? "")) count2++;
+  if (count2 === 0) return match;
+  const head = ["naro", command, ...words.slice(0, count2)];
+  const tail = words.slice(count2);
+  const following = after.split(/\n|[.;,)](?:\s|$)/, 1)[0] ?? "";
+  if (/(?:^|\s)--env[\s=]/.test(following) || after.startsWith(` \u2014 ${PRODUCTION_SWITCH_NOTE}`))
+    return match;
+  const shown = head.join(" ");
+  const remainder = tail.length > 0 ? ` ${tail.join(" ")}` : "";
+  switch (kindOf(head)) {
+    case "env":
+      return `${shown} --env ${slug}${remainder}`;
+    case "switch":
+      return head[2] !== "disable" && !switchContext ? `naro environments provision ${slug}${remainder}` : `${shown} \u2014 ${PRODUCTION_SWITCH_NOTE}${remainder}`;
+    default:
+      return match;
+  }
+}
+function environmentGuidance(text3, slug) {
+  if (slug === null || !text3.includes("naro ")) return text3;
+  const switchContext = SWITCH_CONTEXT.test(text3);
+  const spans = [];
+  const marked = text3.replaceAll(
+    QUOTED,
+    (match, span, offset) => {
+      const noted = text3.startsWith(
+        ` (${PRODUCTION_SWITCH_NOTE})`,
+        offset + match.length
+      );
+      spans.push(noted ? match : quoted(span, slug, switchContext));
+      return `\uE000${String(spans.length - 1)}\uE000`;
+    }
+  );
+  const rewritten = marked.replaceAll(
+    BARE,
+    (match, command, rest, offset) => bare(
+      match,
+      command,
+      rest,
+      marked.slice(offset + match.length),
+      slug,
+      switchContext
+    )
+  );
+  return rewritten.replaceAll(
+    /\uE000(\d+)\uE000/g,
+    (_match, index) => spans[Number(index)] ?? ""
+  );
+}
+
 // ../../packages/core/src/errors.ts
 var DEPLOYMENT_ERROR_CODES = [
   "CLONE_FAILED",
@@ -436,7 +592,11 @@ var DEPLOYMENT_ERROR_CODES = [
   "ENVIRONMENT_BRANCH_IS_PRODUCTION",
   /** The plan's environment count is full. */
   "ENVIRONMENT_LIMIT_REACHED",
-  /** The project uses a Naro database, which environments do not support yet (stages 1 and 2 only). */
+  /**
+   * The project uses a Naro database, which environments did not yet support
+   * (stages 1 and 2 only). No route answers it since named environments 3c;
+   * kept for clients of a control plane from before.
+   */
   "ENVIRONMENT_DATABASE_UNSUPPORTED",
   "ENVIRONMENT_NOT_FOUND",
   /** The project's new default branch is the one an environment deploys. */
@@ -460,6 +620,13 @@ var DeploymentError = class extends Error {
   }
 };
 
+// ../../packages/core/src/functions.ts
+var FUNCTION_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+var FUNCTION_WORKER_NAME_PREFIX = "naro-fn-";
+function isFunctionName(name) {
+  return FUNCTION_NAME_RE.test(name);
+}
+
 // ../../packages/core/src/git-remote.ts
 var SCP_LIKE = /^[^@\s/]+@([^:\s/]+):(.+)$/;
 function parseGitHubRemote(url2) {
@@ -1771,16 +1938,16 @@ function cleanEnum(obj) {
 }
 function base64ToUint8Array(base643) {
   const binaryString = atob(base643);
-  const bytes = new Uint8Array(binaryString.length);
+  const bytes2 = new Uint8Array(binaryString.length);
   for (let i = 0; i < binaryString.length; i++) {
-    bytes[i] = binaryString.charCodeAt(i);
+    bytes2[i] = binaryString.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToBase64(bytes) {
+function uint8ArrayToBase64(bytes2) {
   let binaryString = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binaryString += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.length; i++) {
+    binaryString += String.fromCharCode(bytes2[i]);
   }
   return btoa(binaryString);
 }
@@ -1789,22 +1956,22 @@ function base64urlToUint8Array(base64url3) {
   const padding = "=".repeat((4 - base643.length % 4) % 4);
   return base64ToUint8Array(base643 + padding);
 }
-function uint8ArrayToBase64url(bytes) {
-  return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function uint8ArrayToBase64url(bytes2) {
+  return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function hexToUint8Array(hex3) {
   const cleanHex = hex3.replace(/^0x/, "");
   if (cleanHex.length % 2 !== 0) {
     throw new Error("Invalid hex string length");
   }
-  const bytes = new Uint8Array(cleanHex.length / 2);
+  const bytes2 = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+    bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function uint8ArrayToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 var Class = class {
   constructor(..._args) {
@@ -2110,10 +2277,10 @@ var nanoid = /^[a-zA-Z0-9_-]{21}$/;
 var duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
 var extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
 var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-var uuid = (version2) => {
-  if (!version2)
+var uuid = (version3) => {
+  if (!version3)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 var uuid4 = /* @__PURE__ */ uuid(4);
 var uuid6 = /* @__PURE__ */ uuid(6);
@@ -3595,7 +3762,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   const _normalized = cached(() => normalizeDef(def));
   const generateFastpass = (shape) => {
     const doc = new Doc(["shape", "payload", "ctx"]);
-    const normalized = _normalized.value;
+    const normalized2 = _normalized.value;
     const parseStr = (key) => {
       const k = esc(key);
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
@@ -3603,11 +3770,11 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     doc.write(`const input = payload.value;`);
     const ids = /* @__PURE__ */ Object.create(null);
     let counter = 0;
-    for (const key of normalized.keys) {
+    for (const key of normalized2.keys) {
       ids[key] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
-    for (const key of normalized.keys) {
+    for (const key of normalized2.keys) {
       const id = ids[key];
       const k = esc(key);
       const schema = shape[key];
@@ -8154,8 +8321,8 @@ function ko_default() {
 }
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/locales/lt.js
-var capitalizeFirstCharacter = (text2) => {
-  return text2.charAt(0).toUpperCase() + text2.slice(1);
+var capitalizeFirstCharacter = (text3) => {
+  return text3.charAt(0).toUpperCase() + text3.slice(1);
 };
 function getUnitTypeFromNumber(number4) {
   const abs = Math.abs(number4);
@@ -14983,23 +15150,23 @@ function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
     return schema ? z.any() : z.never();
   }
-  let normalized;
+  let normalized2;
   try {
-    normalized = JSON.parse(JSON.stringify(schema));
+    normalized2 = JSON.parse(JSON.stringify(schema));
   } catch {
     throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
   }
-  const version2 = detectVersion(normalized, params?.defaultTarget);
-  const defs = normalized.$defs || normalized.definitions || {};
+  const version3 = detectVersion(normalized2, params?.defaultTarget);
+  const defs = normalized2.$defs || normalized2.definitions || {};
   const ctx = {
-    version: version2,
+    version: version3,
     defs,
     refs: /* @__PURE__ */ new Map(),
     processing: /* @__PURE__ */ new Set(),
-    rootSchema: normalized,
+    rootSchema: normalized2,
     registry: params?.registry ?? globalRegistry
   };
-  return convertSchema(normalized, ctx);
+  return convertSchema(normalized2, ctx);
 }
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/coerce.js
@@ -15064,6 +15231,8 @@ function subdomainProblem(value) {
   if (value.endsWith("-preview")) return "reserved";
   if (value === BACKEND_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(BACKEND_WORKER_NAME_PREFIX))
     return "reserved";
+  if (value === FUNCTION_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(FUNCTION_WORKER_NAME_PREFIX))
+    return "reserved";
   if (RESERVED_SUBDOMAINS.includes(value))
     return "reserved";
   return null;
@@ -15142,8 +15311,8 @@ var ISSPACE = /[ \t\n\r\f\v]/;
 var NUL = String.fromCharCode(0);
 var BOM = 65279;
 var PRAGMA_PREFIX = "PRAGMA_";
-function asciiUpper(text2) {
-  return text2.replace(/[a-z]+/g, (run) => run.toUpperCase());
+function asciiUpper(text3) {
+  return text3.replace(/[a-z]+/g, (run) => run.toUpperCase());
 }
 function pragmaCandidate(sql, start, end, doubled) {
   const prefix = sql.slice(start + 1, start + 1 + PRAGMA_PREFIX.length);
@@ -15399,6 +15568,72 @@ function workerNameForSurface(subdomain, surface) {
   }
 }
 
+// ../../packages/core/src/usage-alert-mail.ts
+var REQUESTS = {
+  en: {
+    subject80: (team) => `${team} has used 80% of its monthly requests`,
+    subject100: (team) => `${team} has reached its monthly request limit`,
+    usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} requests the Hobby plan includes for ${month}.`,
+    warning: "When it reaches the limit, requests past it may be blocked until the month ends (UTC).",
+    blocked: "Sites on this team answer 503 until the month ends (UTC).",
+    running: "Sites keep running for now.",
+    button: "View usage",
+    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on naro.`
+  },
+  ko: {
+    subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
+    subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
+    usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uC694\uCCAD ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
+    warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uADF8 \uB4A4 \uC694\uCCAD\uC774 \uB9C9\uD790 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
+    running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
+    button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
+    footer: (team) => `naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
+  },
+  ja: {
+    subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
+    subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
+    usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
+    warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u4EE5\u964D\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30D6\u30ED\u30C3\u30AF\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
+    running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
+    button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
+    footer: (team) => `naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
+  }
+};
+var BUILDS = {
+  en: {
+    subject80: (team) => `${team} has used 80% of its monthly builds`,
+    subject100: (team) => `${team} has reached its monthly build limit`,
+    usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} builds the Hobby plan includes for ${month}.`,
+    warning: "When it reaches the limit, new deploys may be refused until the month ends (UTC).",
+    blocked: "New deploys on this team are refused until the month ends (UTC).",
+    running: "Deploys keep working for now.",
+    button: REQUESTS.en.button,
+    footer: REQUESTS.en.footer
+  },
+  ko: {
+    subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uBE4C\uB4DC \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
+    subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uBE4C\uB4DC \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
+    usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uBE4C\uB4DC ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
+    warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC0C8 \uBC30\uD3EC\uAC00 \uAC70\uC808\uB420 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0C8 \uBC30\uD3EC\uB294 \uAC70\uC808\uB429\uB2C8\uB2E4.",
+    running: "\uC9C0\uAE08\uC740 \uBC30\uD3EC\uAC00 \uACC4\uC18D \uB429\uB2C8\uB2E4.",
+    button: REQUESTS.ko.button,
+    footer: REQUESTS.ko.footer
+  },
+  ja: {
+    subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30D3\u30EB\u30C9\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
+    subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30D3\u30EB\u30C9\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
+    usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30D3\u30EB\u30C9\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
+    warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u65B0\u3057\u3044\u30C7\u30D7\u30ED\u30A4\u304C\u62D2\u5426\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u65B0\u3057\u3044\u30C7\u30D7\u30ED\u30A4\u306F\u62D2\u5426\u3055\u308C\u307E\u3059\u3002",
+    running: "\u73FE\u5728\u3001\u30C7\u30D7\u30ED\u30A4\u306F\u5F15\u304D\u7D9A\u304D\u884C\u3048\u307E\u3059\u3002",
+    button: REQUESTS.ja.button,
+    footer: REQUESTS.ja.footer
+  }
+};
+
 // ../../packages/build/src/next-version.ts
 var NEXT_RELEASE_DATES = {
   16: "2025-10-21",
@@ -15435,46 +15670,46 @@ function supportEndsAt(major) {
 function compare(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
 }
-function withinVerifiedRange(version2) {
-  if (version2.major === 15) return compare(version2, VERIFIED_15_FLOOR) >= 0;
-  if (version2.major === 16) return compare(version2, VERIFIED_16_FLOOR) >= 0;
-  return version2.major > 16;
+function withinVerifiedRange(version3) {
+  if (version3.major === 15) return compare(version3, VERIFIED_15_FLOOR) >= 0;
+  if (version3.major === 16) return compare(version3, VERIFIED_16_FLOOR) >= 0;
+  return version3.major > 16;
 }
 function formatDate(date5) {
   return date5.toISOString().slice(0, 10);
 }
 function classifyNextVersion(raw, now) {
-  const version2 = parseNextVersion(raw);
-  if (!version2) {
+  const version3 = parseNextVersion(raw);
+  if (!version3) {
     return {
       status: "unknown",
       version: null,
       reason: `Could not read a Next.js version from "${raw}".`
     };
   }
-  const windowEnd = supportEndsAt(version2.major);
-  if (!windowEnd || version2.major < VERIFIED_15_FLOOR.major) {
+  const windowEnd = supportEndsAt(version3.major);
+  if (!windowEnd || version3.major < VERIFIED_15_FLOOR.major) {
     return {
       status: "too-old",
-      version: version2,
+      version: version3,
       reason: `Next.js ${raw} is too old to deploy. Naro deploys Next.js 15 or newer. Upgrade to Next.js 16.`
     };
   }
   if (now > windowEnd) {
     return {
       status: "needs-unsupported-flag",
-      version: version2,
-      reason: `Next.js ${version2.major} left its support window on ${formatDate(windowEnd)}. The build continues, but unsupported releases stop receiving security patches \u2014 upgrade to Next.js 16. See https://nextjs.org/support-policy`
+      version: version3,
+      reason: `Next.js ${version3.major} left its support window on ${formatDate(windowEnd)}. The build continues, but unsupported releases stop receiving security patches \u2014 upgrade to Next.js 16. See https://nextjs.org/support-policy`
     };
   }
-  if (!withinVerifiedRange(version2)) {
+  if (!withinVerifiedRange(version3)) {
     return {
       status: "outside-peer-range",
-      version: version2,
+      version: version3,
       reason: `Next.js ${raw} is outside the range Naro verifies deploys on (>=15.5.21 <16 || >=16.2.11). The build may fail in ways Naro cannot explain.`
     };
   }
-  return { status: "supported", version: version2, reason: "" };
+  return { status: "supported", version: version3, reason: "" };
 }
 
 // ../../packages/build/src/package-manager.ts
@@ -15512,8 +15747,8 @@ async function usesModernYarn(root) {
     const raw = await readFile2(join2(root, "package.json"), "utf8");
     const packageJson = JSON.parse(raw);
     if (typeof packageJson.packageManager !== "string") return false;
-    const version2 = /^yarn@(\d+)/.exec(packageJson.packageManager)?.[1];
-    return version2 !== void 0 && Number(version2) >= 2;
+    const version3 = /^yarn@(\d+)/.exec(packageJson.packageManager)?.[1];
+    return version3 !== void 0 && Number(version3) >= 2;
   } catch {
     return false;
   }
@@ -16401,8 +16636,8 @@ var FRAMEWORK_LABELS = {
   static: "static files"
 };
 function dependencyVersion(packageJson, name) {
-  const version2 = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
-  return typeof version2 === "string" && version2.trim() !== "" ? version2 : null;
+  const version3 = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+  return typeof version3 === "string" && version3.trim() !== "" ? version3 : null;
 }
 var STATIC_EXPORT = /(?:^|[\s,{;])output\s*:\s*(["'`])export\1/;
 function declaresStaticExport(source) {
@@ -16591,13 +16826,13 @@ async function detectFramework(root, overrides = {}) {
         `The project must declare a "${buildScript}" script.`
       );
   }
-  const version2 = packageJson && preset.detectDependency ? dependencyVersion(packageJson, preset.detectDependency) : null;
+  const version3 = packageJson && preset.detectDependency ? dependencyVersion(packageJson, preset.detectDependency) : null;
   return {
     preset,
     buildScript,
     outputDirectory: overrides.outputDirectory ?? (preset.id === "angular" ? await angularOutput(root) : preset.defaultOutputDirectory),
-    description: version2 ? `${FRAMEWORK_LABELS[preset.id]} ${version2}` : FRAMEWORK_LABELS[preset.id],
-    dependencyRange: version2
+    description: version3 ? `${FRAMEWORK_LABELS[preset.id]} ${version3}` : FRAMEWORK_LABELS[preset.id],
+    dependencyRange: version3
   };
 }
 
@@ -17131,11 +17366,11 @@ function adapterKeyFromConfigSource(source) {
   return EXPERIMENTAL_ADAPTER_PATH.test(code) ? "experimental.adapterPath" : "adapterPath";
 }
 function keysNextReads(nextVersion) {
-  const version2 = parseNextVersion(nextVersion);
-  if (!version2) return ["adapterPath", "experimental.adapterPath"];
-  if (version2.major < 15 || version2.major === 15 && version2.minor < 4)
+  const version3 = parseNextVersion(nextVersion);
+  if (!version3) return ["adapterPath", "experimental.adapterPath"];
+  if (version3.major < 15 || version3.major === 15 && version3.minor < 4)
     return [];
-  if (version2.major > 16 || version2.major === 16 && version2.minor >= 2)
+  if (version3.major > 16 || version3.major === 16 && version3.minor >= 2)
     return ["adapterPath", "experimental.adapterPath"];
   return ["experimental.adapterPath"];
 }
@@ -17203,10 +17438,10 @@ async function exists4(path) {
     return false;
   }
 }
-async function findSourceFile(appRoot, basename5) {
+async function findSourceFile(appRoot, basename6) {
   for (const dir of SOURCE_DIRECTORIES) {
     for (const ext of SOURCE_EXTENSIONS2) {
-      const rel = dir ? `${dir}/${basename5}.${ext}` : `${basename5}.${ext}`;
+      const rel = dir ? `${dir}/${basename6}.${ext}` : `${basename6}.${ext}`;
       if (await exists4(join12(appRoot, rel))) return rel;
     }
   }
@@ -17283,11 +17518,11 @@ async function collectProjectFacts(appRoot) {
 function label(strategy) {
   return `P${String(strategy.priority)} ${strategy.id}`;
 }
-function clause(text2) {
-  return text2.endsWith(".") && !text2.endsWith("..") ? text2.slice(0, -1) : text2;
+function clause(text3) {
+  return text3.endsWith(".") && !text3.endsWith("..") ? text3.slice(0, -1) : text3;
 }
-function sentence(text2) {
-  return text2.endsWith(".") ? text2 : `${text2}.`;
+function sentence(text3) {
+  return text3.endsWith(".") ? text3 : `${text3}.`;
 }
 function describeOutcome(outcome) {
   switch (outcome.status) {
@@ -18568,8 +18803,8 @@ async function readInstalledNextVersion(appRoot, checkout) {
         join18(dir, "node_modules", "next", "package.json"),
         "utf8"
       );
-      const version2 = JSON.parse(source).version;
-      return typeof version2 === "string" ? version2 : null;
+      const version3 = JSON.parse(source).version;
+      return typeof version3 === "string" ? version3 : null;
     } catch {
     }
     if (dir === stop) return null;
@@ -19244,7 +19479,7 @@ async function errorFromResponse(response, context) {
   if (typeof serverDetails === "object" && serverDetails !== null && !Array.isArray(serverDetails))
     Object.assign(details, serverDetails);
   const retryAfter = response.headers.get("retry-after")?.trim() ?? "";
-  if (response.status === 429 && /^\d{1,9}$/.test(retryAfter))
+  if ((response.status === 429 || response.status === 503) && /^\d{1,9}$/.test(retryAfter))
     details.retryAfter = Number(retryAfter);
   if (body?.error?.fields !== void 0) details.fields = body.error.fields;
   if (typeof body?.error?.installUrl === "string")
@@ -19458,8 +19693,8 @@ function sendPage(res, status, html) {
 async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
-  const codePromise = new Promise((resolve12, reject) => {
-    resolveCode = resolve12;
+  const codePromise = new Promise((resolve15, reject) => {
+    resolveCode = resolve15;
     rejectCode = reject;
   });
   const server = createServer2((req, res) => {
@@ -19488,7 +19723,7 @@ async function startCallbackServer() {
     sendPage(res, 200, successPage());
     resolveCode(code);
   });
-  await new Promise((resolve12) => server.listen(0, "127.0.0.1", resolve12));
+  await new Promise((resolve15) => server.listen(0, "127.0.0.1", resolve15));
   const port = server.address().port;
   return {
     port,
@@ -19712,6 +19947,16 @@ function isReservedEnvTarget(value) {
 function isEnvTargetName(value) {
   return environmentSlugProblem(value) !== "invalid";
 }
+var NARO_SYSTEM_ENV_NAMES = [
+  "NARO_URL",
+  "NEXT_PUBLIC_NARO_URL",
+  "VITE_NARO_URL",
+  "PUBLIC_NARO_URL",
+  "NARO_ANON_KEY",
+  "NEXT_PUBLIC_NARO_ANON_KEY",
+  "VITE_NARO_ANON_KEY",
+  "PUBLIC_NARO_ANON_KEY"
+];
 
 // ../../packages/sdk/src/insights.ts
 var SPEED_INSIGHTS_METRICS = [
@@ -19745,6 +19990,7 @@ var BACKEND_STEPS = [
   "worker",
   "routes",
   "migrate",
+  "schema",
   "health"
 ];
 var STALLED_GRACE_MS = 2 * 6e4;
@@ -19808,9 +20054,17 @@ function buildLogEntry(row) {
 }
 
 // ../../packages/sdk/src/client.ts
+var DATA_PATH = /^\/api\/projects\/[^/?]+\/(?:database|backend(?!\/functions))(?:[/?]|$)/;
+function withDataEnvironment(path, environment) {
+  if (environment === null || !DATA_PATH.test(path)) return path;
+  return `${path}${path.includes("?") ? "&" : "?"}environment=${encodeURIComponent(environment)}`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 45e3;
-var NaroClient = class {
+var NaroClient = class _NaroClient {
   baseUrl;
+  /** The environment whose data the data calls act on; null: production. */
+  environment;
+  options;
   getAccessToken;
   doFetch;
   requestTimeoutMs;
@@ -19825,11 +20079,14 @@ var NaroClient = class {
   backend;
   storage;
   realtime;
+  functions;
   insights;
   analytics;
   protection;
   environments;
   constructor(options) {
+    this.options = options;
+    this.environment = options.environment ?? null;
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
     this.doFetch = options.fetch ?? fetch;
@@ -19845,25 +20102,42 @@ var NaroClient = class {
     this.backend = new BackendApi(this);
     this.storage = new StorageApi(this);
     this.realtime = new RealtimeApi(this);
+    this.functions = new FunctionsApi(this);
     this.insights = new InsightsApi(this);
     this.analytics = new AnalyticsApi(this);
     this.protection = new ProtectionApi(this);
     this.environments = new EnvironmentsApi(this);
   }
+  /**
+   * The same client acting on `environment`'s data — or production's, for
+   * null. Every other call is the same: the scope is only the
+   * `?environment=` on database and backend paths.
+   */
+  inEnvironment(environment) {
+    if (environment === this.environment) return this;
+    const options = { ...this.options };
+    delete options.environment;
+    if (environment !== null) options.environment = environment;
+    return new _NaroClient(options);
+  }
   async request(path, options) {
     const token = await this.getAccessToken();
     const timeoutMs = options.timeoutMs ?? this.requestTimeoutMs;
     let response;
     try {
-      response = await this.doFetch(`${this.baseUrl}${path}`, {
-        method: options.method ?? "GET",
-        headers: {
-          Authorization: `Bearer ${token}`,
-          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
-        signal: AbortSignal.timeout(timeoutMs)
-      });
+      response = await this.doFetch(
+        `${this.baseUrl}${withDataEnvironment(path, this.environment)}`,
+        {
+          method: options.method ?? "GET",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "X-Naro-Client": this.options.clientName ?? "next-deploy-sdk",
+            ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+          },
+          ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
     } catch (error51) {
       if (error51 instanceof Error && (error51.name === "TimeoutError" || error51.name === "AbortError")) {
         throw new NaroError(
@@ -19901,9 +20175,9 @@ var TeamsApi = class {
   async usage(teamSlug, query = {}) {
     const params = new URLSearchParams();
     if (query.month !== void 0) params.set("month", query.month);
-    const text2 = params.toString();
+    const text3 = params.toString();
     return this.client.request(
-      `/api/teams/${encodeURIComponent(teamSlug)}/usage${text2 ? `?${text2}` : ""}`,
+      `/api/teams/${encodeURIComponent(teamSlug)}/usage${text3 ? `?${text3}` : ""}`,
       { context: "Read team usage" }
     );
   }
@@ -20061,17 +20335,23 @@ var DeploymentsApi = class {
    * `PROMOTE_TARGET_UNSUPPORTED` before anything is promoted. The target is
    * trimmed once, as the control plane trims it, so `" production"` is
    * production and asks no preview.
+   *
+   * `check: true` asks the preview for production too, for a caller that
+   * cannot show it first and returns it instead (MCP's `promote_deployment`):
+   * a 405 there means a control plane from before previews, and production
+   * is promoted unchecked as before. The preview asked is the result's
+   * `check`, so its migration warnings reach the caller (spec §9.4).
    */
   async promote(projectId, deploymentId, options = {}) {
     const target2 = options.target?.trim();
-    if (target2 !== void 0 && target2 !== "production") {
+    const toEnvironment = target2 !== void 0 && target2 !== "production";
+    let check2;
+    if (toEnvironment || options.check === true) {
       try {
-        await this.promoteCheck(projectId, deploymentId, target2);
+        check2 = await this.promoteCheck(projectId, deploymentId, target2);
       } catch (error51) {
-        if (isNaroError(error51) && error51.status === 405) {
-          throw promoteTargetUnsupported(error51);
-        }
-        throw error51;
+        if (!isNaroError(error51) || error51.status !== 405) throw error51;
+        if (toEnvironment) throw promoteTargetUnsupported(error51);
       }
     }
     const body = await this.client.request(this.promotePath(projectId, deploymentId), {
@@ -20081,7 +20361,8 @@ var DeploymentsApi = class {
     });
     return {
       ...deploymentInfo(body.deployment),
-      mode: body.mode ?? "reupload"
+      mode: body.mode ?? "reupload",
+      ...check2 === void 0 ? {} : { check: check2 }
     };
   }
   /**
@@ -20121,7 +20402,7 @@ var DeploymentsApi = class {
   async wait(deploymentId, options = {}) {
     const intervalMs = options.intervalMs ?? 2500;
     const timeoutMs = options.timeoutMs ?? 15 * 6e4;
-    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
     const startedAt = Date.now();
     let lastStatus = null;
     let lastSequence = -1;
@@ -20414,8 +20695,8 @@ function insightsQuery(options) {
   if (options.environment !== void 0) params.set("env", options.environment);
   if (options.route !== void 0) params.set("route", options.route);
   appendFilters(params, SPEED_INSIGHTS_FILTER_KEYS, options.filters);
-  const text2 = params.toString();
-  return text2 ? `?${text2}` : "";
+  const text3 = params.toString();
+  return text3 ? `?${text3}` : "";
 }
 var InsightsApi = class {
   constructor(client) {
@@ -20493,9 +20774,9 @@ var AnalyticsApi = class {
     const params = new URLSearchParams();
     if (options.range !== void 0) params.set("range", options.range);
     appendFilters(params, ANALYTICS_FILTER_KEYS, options.filters);
-    const text2 = params.toString();
+    const text3 = params.toString();
     return this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/analytics${text2 ? `?${text2}` : ""}`,
+      `/api/projects/${encodeURIComponent(projectId)}/analytics${text3 ? `?${text3}` : ""}`,
       { context: "Read Analytics" }
     );
   }
@@ -20582,6 +20863,19 @@ var EnvironmentsApi = class {
       { method: "DELETE", context: "Delete environment" }
     );
   }
+  /**
+   * Makes or continues the environment's data — its D1, Naro backend and
+   * Storage bucket (spec §11.2): the run goes on after the answer, which
+   * says `data.status` `provisioning`. A run that stopped (`error`) starts
+   * again from where it stopped; `none` when the project uses neither.
+   */
+  async provision(projectId, environmentId) {
+    const body = await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}/provision`,
+      { method: "POST", context: "Provision environment" }
+    );
+    return body.environment;
+  }
 };
 var EXPORT_FIRST_POLL_MS = 1e3;
 var EXPORT_MAX_POLL_MS = 5e3;
@@ -20720,7 +21014,7 @@ var DbApi = class {
    */
   async export(projectId, options = {}, wait = {}) {
     const timeoutMs = wait.timeoutMs ?? EXPORT_TIMEOUT_MS;
-    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
     const given = wait.pollIntervalMs;
     const firstPollMs = given !== void 0 && Number.isFinite(given) && given > 0 ? given : EXPORT_FIRST_POLL_MS;
     const maxPollMs = Math.max(EXPORT_MAX_POLL_MS, firstPollMs);
@@ -21615,6 +21909,207 @@ var RealtimeApi = class {
     );
   }
 };
+var FunctionsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/backend/functions${suffix}`;
+  }
+  /**
+   * A segment no URL can carry is refused before a request, like
+   * `StorageApi.bucketPath`: URL parsing folds `/`, `.` and `..` into the
+   * path, an empty one is the collection, and `encodeURIComponent` throws on
+   * a lone surrogate. The server checks the name's own rule.
+   */
+  segment(value, what) {
+    if (value === "" || value === "." || value === ".." || value.includes("/") || LONE_SURROGATE.test(value))
+      throw new NaroError("INVALID_PATH", `The ${what} is not valid.`);
+    return encodeURIComponent(value);
+  }
+  functionPath(projectId, name, suffix = "") {
+    return this.path(
+      projectId,
+      `/${this.segment(name, "function name")}${suffix}`
+    );
+  }
+  /** The project's functions, the plan's limits, and (3-3e) this month's usage. */
+  async list(projectId) {
+    return this.client.request(this.path(projectId), {
+      context: "List functions"
+    });
+  }
+  /** One function and its newest 20 versions. `FUNCTION_NOT_FOUND` (404). */
+  async get(projectId, name) {
+    return this.client.request(
+      this.functionPath(projectId, name),
+      { context: "Read a function" }
+    );
+  }
+  /**
+   * A new version — the function too, the first time — and where to PUT its
+   * bundle: `upload.url` with `upload.headers` (the checksum header is
+   * signed). Refusals in the order they are checked: `BACKEND_DISABLED`,
+   * `UNAUTHORIZED`, `NOT_FOUND`, `FORBIDDEN` (`deployment.create`),
+   * `FUNCTIONS_DISABLED`, `FORBIDDEN` (a suspended project),
+   * `VALIDATION_FAILED` (the name or the request), `BUNDLE_TOO_LARGE`,
+   * `DATABASE_NOT_ENABLED`, `BACKEND_NOT_READY`, `BACKEND_OFF`,
+   * `BACKEND_BUSY` (the project's Naro worker is not the current version and
+   * could not be brought up to date just now), `FUNCTION_LIMIT` (a new name
+   * over the plan's cap) and `FUNCTION_BUSY` (the function is being deleted).
+   * It never turns the backend on. Two minutes, or `options.timeoutMs`
+   * (naro-mcp's deploy_function shares two minutes across its steps).
+   */
+  async createVersion(projectId, name, request2, options = {}) {
+    return this.client.request(
+      this.functionPath(projectId, name, "/versions"),
+      {
+        method: "POST",
+        body: request2,
+        context: "Create a function version",
+        timeoutMs: options.timeoutMs ?? PROVISION_TIMEOUT_MS
+      }
+    );
+  }
+  /**
+   * Uploads a version whose bundle is in R2 and makes it live. `versionId` is
+   * `CreatedFunctionVersion.version.id`. The refusals before anything is
+   * uploaded leave the function as it was: `FUNCTION_NOT_FOUND`,
+   * `VERSION_NOT_FOUND`, `VERSION_NOT_DEPLOYABLE` (pruned),
+   * `BACKEND_NOT_READY`, `BACKEND_OFF`, `FUNCTION_BUSY`, `BUNDLE_MISSING`,
+   * `BUNDLE_MISMATCH`. Then `FUNCTION_DEPLOY_FAILED` (Cloudflare refused or
+   * could not be reached; the version that was live still runs),
+   * `FUNCTIONS_RATE_LIMITED` (503, `retry-after`),
+   * `FUNCTION_DEPLOY_INCOMPLETE` (the code runs but the function list did
+   * not take it, so callers may still get the previous `verifyJwt` setting
+   * or 404 — deploy again) and `BACKEND_OUTDATED` (the project's
+   * database predates the function list — `backend.enable` updates it).
+   * Two minutes, or `options.timeoutMs`; a timeout here does not say
+   * whether the version went live — `get` does.
+   */
+  async deploy(projectId, name, versionId, options = {}) {
+    const body = await this.client.request(
+      this.functionPath(
+        projectId,
+        name,
+        `/versions/${this.segment(versionId, "version id")}/deploy`
+      ),
+      {
+        method: "POST",
+        context: "Deploy a function",
+        timeoutMs: options.timeoutMs ?? PROVISION_TIMEOUT_MS
+      }
+    );
+    return body.function;
+  }
+  /**
+   * Puts a stored version live again: the one numbered `version`, which must
+   * have been live before (`VERSION_NOT_FOUND` otherwise — put a version that
+   * never went live up with `deploy`), or without it the deployed version
+   * before the live one. The code comes back, not the old keys or secrets:
+   * the bindings are the project's now. The refusals are `deploy`'s, and
+   * `VERSION_NOT_FOUND` also says there is no earlier deployed version.
+   * Two minutes.
+   */
+  async rollback(projectId, name, version3) {
+    const body = await this.client.request(
+      this.functionPath(projectId, name, "/rollback"),
+      {
+        method: "POST",
+        body: version3 === void 0 ? {} : { version: version3 },
+        context: "Roll back a function",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return body.function;
+  }
+  /**
+   * `verifyJwt` without an upload, live within seconds; the next deploy sets
+   * it again from the version it puts live. `FUNCTION_NOT_FOUND`,
+   * `FUNCTION_BUSY`, `FUNCTION_UPDATE_FAILED` (502: the function list in the
+   * project's database could not be written — nothing changed, send it again)
+   * and `BACKEND_OUTDATED`.
+   */
+  async update(projectId, name, patch) {
+    const body = await this.client.request(
+      this.functionPath(projectId, name),
+      { method: "PATCH", body: patch, context: "Update a function" }
+    );
+    return body.function;
+  }
+  /**
+   * Its URL stops working within seconds; its stored versions are removed by
+   * the control plane's sweep. `FUNCTION_NOT_FOUND`, `FUNCTION_BUSY`.
+   */
+  async remove(projectId, name) {
+    await this.client.request(
+      this.functionPath(projectId, name),
+      {
+        method: "DELETE",
+        context: "Delete a function"
+      }
+    );
+  }
+  /**
+   * The function's newest 200 log lines, optionally of one level (`log`,
+   * `info`, `warn`, `error` or `debug`; anything else is `400
+   * VALIDATION_FAILED`). `LOGS_DISABLED` (503) while the control plane has no
+   * log tail.
+   */
+  async logs(projectId, name, options = {}) {
+    const query = options.level ? `?${new URLSearchParams({ level: options.level }).toString()}` : "";
+    const body = await this.client.request(
+      this.functionPath(projectId, name, `/logs${query}`),
+      { context: "Read function logs" }
+    );
+    return body.entries;
+  }
+  /** The project's function secrets: names, digests and when — never a value. `env.read`. */
+  async secrets(projectId, options = {}) {
+    const body = await this.client.request(
+      this.path(projectId, "-secrets"),
+      {
+        context: "List function secrets",
+        ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+      }
+    );
+    return body.secrets;
+  }
+  /**
+   * Sets and unsets function secrets in one change (`env.write.production`;
+   * a suspended project is refused). `VALIDATION_FAILED` names the first
+   * problem — a name, a reserved name (`NARO_*`, `ASSETS`, `DB`) or
+   * `__proto__`, a value over 5,120 bytes, more than 100 secrets. Live
+   * functions carry the change once synced: `pending` says how many. The
+   * control plane starts two at once and its five-minute sweep goes on with
+   * the rest, 20 a run; `sync` brings them up now — call it until `pending`
+   * is 0 to be sure, as a change racing another can leave a function only
+   * `sync` finds (known-issues #322).
+   */
+  async setSecrets(projectId, change) {
+    return this.client.request(
+      this.path(projectId, "-secrets"),
+      { method: "PUT", body: change, context: "Change function secrets" }
+    );
+  }
+  /**
+   * Uploads stale functions again — `limit` of them — and with `registry`
+   * writes the function list in the project's database again. Call it
+   * again while `pending` is above 0 and the call made progress.
+   * `FUNCTIONS_RATE_LIMITED` (503) carries `details.retryAfter`. Two minutes.
+   */
+  async sync(projectId, options = {}) {
+    return this.client.request(
+      this.path(projectId, "-sync"),
+      {
+        method: "POST",
+        body: options,
+        context: "Sync functions",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+  }
+};
 
 // ../../packages/sdk/src/database.ts
 var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
@@ -21636,9 +22131,9 @@ function cellText(statement2, row, column2) {
 var MAX_CELL_CHARS = 60;
 function formatCell(value) {
   if (value === null || value === void 0) return "NULL";
-  const text2 = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
-  const oneLine = text2.replace(/\s+/g, " ");
-  return oneLine.length > MAX_CELL_CHARS ? `${oneLine.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine;
+  const text3 = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+  const oneLine2 = text3.replace(/\s+/g, " ");
+  return oneLine2.length > MAX_CELL_CHARS ? `${oneLine2.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine2;
 }
 function renderRows(statement2) {
   if (statement2.columns.length === 0) return [];
@@ -21669,10 +22164,10 @@ import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { join as join20 } from "path";
 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/dgm;
 var QUOTES = /* @__PURE__ */ new Set(["'", '"', "`"]);
-function parseDotenvDetailed(text2) {
+function parseDotenvDetailed(text3) {
   const vars = {};
   const unclosedQuotes = [];
-  const lines = text2.replace(/\r\n?/g, "\n");
+  const lines = text3.replace(/\r\n?/g, "\n");
   let line = 1;
   let counted = 0;
   for (const match of lines.matchAll(LINE)) {
@@ -21692,8 +22187,8 @@ function parseDotenvDetailed(text2) {
   }
   return { vars, unclosedQuotes };
 }
-function parseDotenv(text2) {
-  return parseDotenvDetailed(text2).vars;
+function parseDotenv(text3) {
+  return parseDotenvDetailed(text3).vars;
 }
 function readProjectEnv(dir) {
   for (const name of [".env.local", ".env.production", ".env"]) {
@@ -21824,14 +22319,14 @@ function scanEnvReferences(dir) {
   const files = [];
   collect(dir, files);
   for (const file2 of files) {
-    let text2;
+    let text3;
     try {
       if (statSync(file2).size > MAX_FILE_BYTES2) continue;
-      text2 = readFileSync3(file2, "utf8");
+      text3 = readFileSync3(file2, "utf8");
     } catch {
       continue;
     }
-    for (const match of text2.matchAll(REFERENCE)) {
+    for (const match of text3.matchAll(REFERENCE)) {
       const key = match[1] ?? match[2];
       if (!key || ignored(key)) continue;
       found.set(key, "code");
@@ -22019,15 +22514,15 @@ var SYSTEM_TABLE_PREFIXES = [
   "sqlite_"
 ];
 var SYSTEM_TABLE_NAMES = ["d1_migrations"];
-function asciiLower(text2) {
-  return text2.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+function asciiLower(text3) {
+  return text3.replace(/[A-Z]+/g, (run) => run.toLowerCase());
 }
 function isSystemTable(name) {
   const lower = asciiLower(name);
   return SYSTEM_TABLE_PREFIXES.some((prefix) => lower.startsWith(prefix)) || SYSTEM_TABLE_NAMES.includes(lower);
 }
-function likeLiteral(text2) {
-  return text2.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
+function likeLiteral(text3) {
+  return text3.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
 }
 var COLUMN_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$/;
 function systemTablePredicate(column2 = "name") {
@@ -22053,10 +22548,10 @@ function isSpace(char) {
 function isWordChar(char) {
   return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
 }
-function asciiUpper2(text2) {
-  return text2.replace(/[a-z]/g, (letter) => letter.toUpperCase());
+function asciiUpper2(text3) {
+  return text3.replace(/[a-z]/g, (letter) => letter.toUpperCase());
 }
-function quoted(sql, start, close, doubles) {
+function quoted2(sql, start, close, doubles) {
   let value = "";
   for (let index = start + 1; index < sql.length; index++) {
     const char = sql.charAt(index);
@@ -22089,7 +22584,7 @@ function tokenize(sql) {
       index = end + 2;
     } else if (char === '"' || char === "`" || char === "[" || char === "'") {
       const close = char === "[" ? "]" : char;
-      const read = quoted(sql, index, close, char !== "[");
+      const read = quoted2(sql, index, close, char !== "[");
       if (!read) return void 0;
       tokens.push({
         kind: char === "'" ? "string" : "name",
@@ -22192,16 +22687,16 @@ function declaredCollations(sql, columns) {
 }
 
 // ../../packages/data-core/src/unicode-controls.ts
-function hasControlCharacter(text2) {
-  for (let i = 0; i < text2.length; i += 1) {
-    const code = text2.charCodeAt(i);
+function hasControlCharacter(text3) {
+  for (let i = 0; i < text3.length; i += 1) {
+    const code = text3.charCodeAt(i);
     if (code <= 31 || code >= 127 && code <= 159) return true;
   }
   return false;
 }
-function hasBidiControl(text2) {
-  for (let i = 0; i < text2.length; i += 1) {
-    const code = text2.charCodeAt(i);
+function hasBidiControl(text3) {
+  for (let i = 0; i < text3.length; i += 1) {
+    const code = text3.charCodeAt(i);
     if (code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)
       return true;
   }
@@ -22226,8 +22721,8 @@ var RESERVED = new Set(STORAGE_RESERVED_WORDS);
 var ENCODER = new TextEncoder();
 var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
 var LONE_SURROGATES = new RegExp(LONE_SURROGATE2.source, "g");
-function hasLoneSurrogate(text2) {
-  return LONE_SURROGATE2.test(text2);
+function hasLoneSurrogate(text3) {
+  return LONE_SURROGATE2.test(text3);
 }
 function refuse(reason) {
   return { ok: false, reason };
@@ -22269,9 +22764,9 @@ function parseCacheControl(header) {
   return maxAge <= MAX_MAX_AGE ? { ok: true, maxAge } : { ok: false };
 }
 var MAX_NAME_IN_MESSAGE = 256;
-function storageName(text2) {
-  if (text2.length <= MAX_NAME_IN_MESSAGE) return text2;
-  const cut = text2.slice(0, MAX_NAME_IN_MESSAGE);
+function storageName(text3) {
+  if (text3.length <= MAX_NAME_IN_MESSAGE) return text3;
+  const cut = text3.slice(0, MAX_NAME_IN_MESSAGE);
   const last = cut.charCodeAt(MAX_NAME_IN_MESSAGE - 1);
   return last >= 55296 && last <= 56319 ? cut.slice(0, MAX_NAME_IN_MESSAGE - 1) : cut;
 }
@@ -22416,15 +22911,15 @@ var CATALOG = {
       policy,
       recursion,
       values,
-      bytes,
+      bytes: bytes2,
       depth
     }) => {
       if (recursion)
         return `Infinite recursion detected in policy for relation ${table}.`;
       if (values)
         return `The policies of ${table} bind more than ${values === true ? "50" : String(values)} values in one statement.`;
-      if (bytes)
-        return `The policies of ${table} write more than ${bytes === true ? "50000" : String(bytes)} bytes of SQL into one statement.`;
+      if (bytes2)
+        return `The policies of ${table} write more than ${bytes2 === true ? "50000" : String(bytes2)} bytes of SQL into one statement.`;
       if (depth)
         return `The policies of ${table} nest an expression more than 100 deep into one statement.`;
       if (policy !== void 0)
@@ -22625,11 +23120,11 @@ function isDigit(char) {
   return char >= "0" && char <= "9";
 }
 var NUMBER = /^(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?/;
-function tokenize2(text2) {
+function tokenize2(text3) {
   const tokens = [];
   let index = 0;
-  const at = (offset = 0) => text2.charAt(index + offset);
-  while (index < text2.length) {
+  const at = (offset = 0) => text3.charAt(index + offset);
+  while (index < text3.length) {
     const char = at();
     const position = index + 1;
     if (char === "\0")
@@ -22639,12 +23134,12 @@ function tokenize2(text2) {
       continue;
     }
     if (char === "-" && at(1) === "-") {
-      while (index < text2.length && at() !== "\n" && at() !== "\r") index++;
+      while (index < text3.length && at() !== "\n" && at() !== "\r") index++;
       continue;
     }
     if (char === "/" && at(1) === "*") {
       let depth = 0;
-      while (index < text2.length) {
+      while (index < text3.length) {
         if (at() === "/" && at(1) === "*") {
           depth++;
           index += 2;
@@ -22662,7 +23157,7 @@ function tokenize2(text2) {
       let value = "";
       index++;
       for (; ; ) {
-        if (index >= text2.length)
+        if (index >= text3.length)
           throw new PolicySyntaxError("unterminated quoted string", position);
         if (at() === "'") {
           if (at(1) === "'") {
@@ -22683,7 +23178,7 @@ function tokenize2(text2) {
       let value = "";
       index++;
       for (; ; ) {
-        if (index >= text2.length)
+        if (index >= text3.length)
           throw new PolicySyntaxError(
             "unterminated quoted identifier",
             position
@@ -22711,10 +23206,10 @@ function tokenize2(text2) {
         position
       );
     if (isDigit(char) || char === "." && isDigit(at(1))) {
-      const match = NUMBER.exec(text2.slice(index));
+      const match = NUMBER.exec(text3.slice(index));
       const value = match?.[0] ?? char;
       index += value.length;
-      if (index < text2.length && isIdentChar(at()))
+      if (index < text3.length && isIdentChar(at()))
         throw new PolicySyntaxError(
           `trailing junk after numeric literal ${value}`,
           position
@@ -22724,9 +23219,9 @@ function tokenize2(text2) {
     }
     if (isIdentStart(char)) {
       let end = index + 1;
-      while (end < text2.length && isIdentChar(text2.charAt(end))) end++;
-      const value = text2.slice(index, end);
-      if (text2.charAt(end) === "'")
+      while (end < text3.length && isIdentChar(text3.charAt(end))) end++;
+      const value = text3.slice(index, end);
+      if (text3.charAt(end) === "'")
         throw new PolicySyntaxError(
           `${value}'\u2026' strings are not supported: use a plain '\u2026' string`,
           position
@@ -22736,7 +23231,7 @@ function tokenize2(text2) {
       continue;
     }
     const operator = OPERATORS.find(
-      (candidate) => text2.startsWith(candidate, index)
+      (candidate) => text3.startsWith(candidate, index)
     );
     if (!operator)
       throw new PolicySyntaxError(
@@ -22750,7 +23245,7 @@ function tokenize2(text2) {
     kind: "eof",
     value: "",
     quoted: false,
-    position: text2.length + 1
+    position: text3.length + 1
   });
   return tokens;
 }
@@ -23079,21 +23574,21 @@ function toBoundValue(value) {
   if (typeof value === "string" || typeof value === "number") return value;
   return JSON.stringify(value);
 }
-function utf8ByteLength(text2) {
-  let bytes = 0;
-  for (let index = 0; index < text2.length; index++) {
-    const unit = text2.charCodeAt(index);
-    if (unit < 128) bytes += 1;
-    else if (unit < 2048) bytes += 2;
-    else if (unit >= 55296 && unit <= 56319 && index + 1 < text2.length) {
-      const next = text2.charCodeAt(index + 1);
+function utf8ByteLength(text3) {
+  let bytes2 = 0;
+  for (let index = 0; index < text3.length; index++) {
+    const unit = text3.charCodeAt(index);
+    if (unit < 128) bytes2 += 1;
+    else if (unit < 2048) bytes2 += 2;
+    else if (unit >= 55296 && unit <= 56319 && index + 1 < text3.length) {
+      const next = text3.charCodeAt(index + 1);
       if (next >= 56320 && next <= 57343) {
-        bytes += 4;
+        bytes2 += 4;
         index++;
-      } else bytes += 3;
-    } else bytes += 3;
+      } else bytes2 += 3;
+    } else bytes2 += 3;
   }
-  return bytes;
+  return bytes2;
 }
 
 // ../../packages/data-core/src/sql-fragments.ts
@@ -23187,9 +23682,9 @@ function isNumeric(item) {
   const affinity2 = columnAffinity(item);
   return affinity2 !== "TEXT" && affinity2 !== "BLOB";
 }
-function refusesText(item, text2) {
+function refusesText(item, text3) {
   const kind = numberClass(item.type);
-  return kind === "number" || kind === "fallback" && storesAsNumber(text2);
+  return kind === "number" || kind === "fallback" && storesAsNumber(text3);
 }
 function readsAsIs(item, value) {
   return typeof value === "string" && numberClass(item.type) === "fallback" && !storesAsNumber(value);
@@ -23215,15 +23710,15 @@ function asStored(item, sql) {
 var LITERAL_DEFAULT = /^(?:null|true|false|[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|'(?:[^']|'')*')$/i;
 function omittedSql(item) {
   if (item.primaryKey > 0) return void 0;
-  const text2 = item.defaultValue;
-  if (text2 === null) return "NULL";
-  if (!LITERAL_DEFAULT.test(text2)) return void 0;
-  const word = asciiLower(text2);
+  const text3 = item.defaultValue;
+  if (text3 === null) return "NULL";
+  if (!LITERAL_DEFAULT.test(text3)) return void 0;
+  const word = asciiLower(text3);
   if (word === "null") return "NULL";
   if (word === "true" || word === "false")
     return asStored(item, word === "true" ? "1" : "0");
-  if (text2.startsWith("'") && isNumeric(item)) return void 0;
-  return asStored(item, text2);
+  if (text3.startsWith("'") && isNumeric(item)) return void 0;
+  return asStored(item, text3);
 }
 var DEFAULT_KEYWORDS = /* @__PURE__ */ new Set([
   "true",
@@ -23234,27 +23729,27 @@ var DEFAULT_KEYWORDS = /* @__PURE__ */ new Set([
   "current_timestamp"
 ]);
 var BARE_WORD = /^[A-Za-z_\u0080-￿][A-Za-z0-9_$\u0080-￿]*$/;
-function quotedName(text2) {
-  const double = /^"((?:[^"]|"")*)"$/.exec(text2);
+function quotedName(text3) {
+  const double = /^"((?:[^"]|"")*)"$/.exec(text3);
   if (double) return (double[1] ?? "").replaceAll('""', '"');
-  const tick = /^`((?:[^`]|``)*)`$/.exec(text2);
+  const tick = /^`((?:[^`]|``)*)`$/.exec(text3);
   if (tick) return (tick[1] ?? "").replaceAll("``", "`");
-  const bracket = /^\[([^\]]*)\]$/.exec(text2);
+  const bracket = /^\[([^\]]*)\]$/.exec(text3);
   return bracket ? bracket[1] ?? "" : void 0;
 }
 function stringDefault(item) {
-  let text2 = item.defaultValue?.trim();
-  if (text2 === void 0) return void 0;
-  while (text2.startsWith("(") && text2.endsWith(")"))
-    text2 = text2.slice(1, -1).trim();
-  if (/^\+\s*(?:'|x')/i.test(text2)) text2 = text2.slice(1).trim();
-  if (/^'(?:[^']|'')*'$/.test(text2))
-    return { kind: "text", text: text2.slice(1, -1).replaceAll("''", "'") };
-  if (/^x'[0-9a-f]*'$/i.test(text2)) return { kind: "blob" };
-  const name = quotedName(text2);
+  let text3 = item.defaultValue?.trim();
+  if (text3 === void 0) return void 0;
+  while (text3.startsWith("(") && text3.endsWith(")"))
+    text3 = text3.slice(1, -1).trim();
+  if (/^\+\s*(?:'|x')/i.test(text3)) text3 = text3.slice(1).trim();
+  if (/^'(?:[^']|'')*'$/.test(text3))
+    return { kind: "text", text: text3.slice(1, -1).replaceAll("''", "'") };
+  if (/^x'[0-9a-f]*'$/i.test(text3)) return { kind: "blob" };
+  const name = quotedName(text3);
   if (name !== void 0) return { kind: "text", text: name };
-  if (BARE_WORD.test(text2) && !DEFAULT_KEYWORDS.has(asciiLower(text2)))
-    return { kind: "text", text: text2 };
+  if (BARE_WORD.test(text3) && !DEFAULT_KEYWORDS.has(asciiLower(text3)))
+    return { kind: "text", text: text3 };
   return void 0;
 }
 var DEFAULT_CHECK_NONCE = "0";
@@ -23386,25 +23881,25 @@ function nested(state, token, read) {
   }
 }
 function truthProblem(operand) {
-  const text2 = "is text, where 'true' reads as false";
+  const text3 = "is text, where 'true' reads as false";
   switch (operand.kind) {
     case "column":
       return void 0;
     case "literal":
-      return typeof operand.value === "string" ? `a '\u2026' string ${text2}: write TRUE or FALSE, or compare the string with =` : void 0;
+      return typeof operand.value === "string" ? `a '\u2026' string ${text3}: write TRUE or FALSE, or compare the string with =` : void 0;
     case "jwt": {
       const claim = printValue(operand);
-      return `${claim} ${text2}: compare it with text, ${claim} = 'true'`;
+      return `${claim} ${text3}: compare it with text, ${claim} = 'true'`;
     }
     case "auth":
       return operand.fn === "uid" ? "auth.uid() is text: compare it, auth.uid() = user_id, or test auth.uid() IS NOT NULL" : "auth.role() is text: compare it, auth.role() = 'authenticated'";
     case "cast":
-      return `a ::text cast ${text2}: compare it with text, (\u2026)::text = 'true'`;
+      return `a ::text cast ${text3}: compare it with text, (\u2026)::text = 'true'`;
     case "func":
       switch (operand.name) {
         case "lower":
         case "upper":
-          return `${operand.name}(\u2026) ${text2}: compare it with text, ${operand.name}(\u2026) = 'true'`;
+          return `${operand.name}(\u2026) ${text3}: compare it with text, ${operand.name}(\u2026) = 'true'`;
         case "coalesce":
           return "coalesce(\u2026) is not a boolean: compare it, coalesce(\u2026) = 'true'";
         case "length":
@@ -23414,10 +23909,10 @@ function truthProblem(operand) {
       }
     case "storage": {
       const call = operand.fn === "foldername" ? "(storage.foldername(\u2026))[n]" : `storage.${operand.fn}(\u2026)`;
-      return `${call} ${text2}: compare it with text, ${call} = 'true'`;
+      return `${call} ${text3}: compare it with text, ${call} = 'true'`;
     }
     case "realtime":
-      return `realtime.topic() ${text2}: compare it with text, realtime.topic() = 'room:1'`;
+      return `realtime.topic() ${text3}: compare it with text, realtime.topic() = 'room:1'`;
   }
 }
 function truthTestProblem(operand) {
@@ -23471,9 +23966,9 @@ function booleanComparisonProblem(expr) {
     const met = [...operandValues(left), ...operandValues(right)];
     if (!met.some(isBooleanConstant)) continue;
     const texts = met.filter(isTextValue);
-    const text2 = texts.find((value) => value.kind !== "literal") ?? texts[0];
-    if (text2 === void 0) continue;
-    const problem = text2.kind === "literal" ? "a '\u2026' string is text, where 'true' reads as false: write TRUE or FALSE on both sides, or a '\u2026' string on both" : truthProblem(text2);
+    const text3 = texts.find((value) => value.kind !== "literal") ?? texts[0];
+    if (text3 === void 0) continue;
+    const problem = text3.kind === "literal" ? "a '\u2026' string is text, where 'true' reads as false: write TRUE or FALSE on both sides, or a '\u2026' string on both" : truthProblem(text3);
     return `a comparison with TRUE or FALSE compares a boolean, and ${String(problem)}`;
   }
   return void 0;
@@ -23551,17 +24046,17 @@ function readPredicate(state) {
   }
   const left = readValue(state);
   const next = stream.peek();
-  const compare2 = ["=", "<>", "!=", "<", "<=", ">", ">="].find(
+  const compare3 = ["=", "<>", "!=", "<", "<=", ">", ">="].find(
     (op) => isOperator(next, op)
   );
-  if (compare2) {
+  if (compare3) {
     stream.next();
     count(state, next);
     const right = readValue(state);
     return comparable(
       {
         kind: "compare",
-        op: compare2 === "!=" ? "<>" : compare2,
+        op: compare3 === "!=" ? "<>" : compare3,
         left: requireValue(left, token),
         right: requireValue(right, next)
       },
@@ -23663,8 +24158,8 @@ function policyPatternProblem(pattern, ci) {
   if (!patternTooLong(pattern, ci)) return void 0;
   const chars = [...pattern];
   const shown = `${commentText(chars.slice(0, PATTERN_SHOWN).join(""))}${chars.length > PATTERN_SHOWN ? "\u2026" : ""}`;
-  const bytes = utf8ByteLength(boundPattern(pattern, ci));
-  return `${ci ? "an ILIKE" : "a LIKE"} pattern may be at most ${String(MAX_POLICY_PATTERN_LENGTH)} bytes of UTF-8, D1's limit, and '${shown}' is ${String(bytes)}${ci ? "" : " (LIKE counts each *, ? and [ as 3 bytes)"}`;
+  const bytes2 = utf8ByteLength(boundPattern(pattern, ci));
+  return `${ci ? "an ILIKE" : "a LIKE"} pattern may be at most ${String(MAX_POLICY_PATTERN_LENGTH)} bytes of UTF-8, D1's limit, and '${shown}' is ${String(bytes2)}${ci ? "" : " (LIKE counts each *, ? and [ as 3 bytes)"}`;
 }
 function checkPattern(token, ci) {
   const pattern = token.value;
@@ -24179,23 +24674,23 @@ function readCondition(stream) {
   const token = stream.peek();
   const state = newState(stream);
   const expr = readOr(state);
-  const bare = state.foldernames.find(({ node }) => node.index === null);
-  if (bare)
-    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, bare.token.position);
+  const bare2 = state.foldernames.find(({ node }) => node.index === null);
+  if (bare2)
+    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, bare2.token.position);
   return requireCondition(expr, token);
 }
 function checkExpressionSize(expr, position) {
-  const text2 = printExpr(expr);
-  if (utf8ByteLength(text2) > MAX_EXPRESSION_BYTES)
+  const text3 = printExpr(expr);
+  if (utf8ByteLength(text3) > MAX_EXPRESSION_BYTES)
     throw new PolicySyntaxError(
       `the expression is longer than ${String(MAX_EXPRESSION_BYTES)} bytes`,
       position
     );
-  return text2;
+  return text3;
 }
-function parseExpression(text2) {
+function parseExpression(text3) {
   try {
-    const stream = new TokenStream(tokenize2(text2));
+    const stream = new TokenStream(tokenize2(text3));
     if (stream.peek().kind === "eof")
       throw new PolicySyntaxError("the expression is empty", 1);
     const expr = readCondition(stream);
@@ -24210,22 +24705,22 @@ function parseExpression(text2) {
 function quoteIdent(name) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !SPECIAL_WORDS.has(asciiLower(name)) ? name : `"${name.replaceAll('"', '""')}"`;
 }
-function commentText(text2) {
+function commentText(text3) {
   let out = "";
-  for (const char of text2) {
+  for (const char of text3) {
     const code = char.charCodeAt(0);
     const control = code < 32 || code >= 127 && code <= 159 || code === 8232 || code === 8233;
     out += control ? `\\u${code.toString(16).padStart(4, "0")}` : char;
   }
   return out;
 }
-function quoteString(text2) {
-  return `'${text2.replaceAll("'", "''")}'`;
+function quoteString(text3) {
+  return `'${text3.replaceAll("'", "''")}'`;
 }
 function printNumber(value) {
   if (Object.is(value, -0)) return "-0.0";
-  const text2 = String(value);
-  return Number.isSafeInteger(value) || /[.e]/.test(text2) ? text2 : `${text2}.0`;
+  const text3 = String(value);
+  return Number.isSafeInteger(value) || /[.e]/.test(text3) ? text3 : `${text3}.0`;
 }
 function printLiteral(value) {
   if (value === null) return "NULL";
@@ -24479,8 +24974,8 @@ function ownerExpression(column2) {
   });
 }
 function ownerClauses(column2, command) {
-  const text2 = ownerExpression(column2);
-  return command === "insert" ? { using: null, check: text2 } : { using: text2, check: null };
+  const text3 = ownerExpression(column2);
+  return command === "insert" ? { using: null, check: text3 } : { using: text3, check: null };
 }
 var NAMED_POLICY_TABLE = "_naro_policies_v2";
 var NAMED_POLICY_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ${NAMED_POLICY_TABLE} (table_name TEXT NOT NULL, name TEXT NOT NULL, kind TEXT NOT NULL DEFAULT 'permissive', command TEXT NOT NULL DEFAULT 'all', roles TEXT NOT NULL DEFAULT 'public', using_expr TEXT, check_expr TEXT, owner_column TEXT, created_at TEXT NOT NULL DEFAULT (datetime('now')), updated_at TEXT NOT NULL DEFAULT (datetime('now')), PRIMARY KEY (table_name, name))`;
@@ -24589,14 +25084,14 @@ function policiesOn(policies, table) {
   const folded = asciiLower(table);
   return policies.filter((policy) => asciiLower(policy.table) === folded);
 }
-function foldPolicyName(name, quoted2) {
-  return quoted2 ? name : asciiLower(name);
+function foldPolicyName(name, quoted3) {
+  return quoted3 ? name : asciiLower(name);
 }
-function sqlStringLiteral(text2) {
-  return text2 === null ? "NULL" : quoteString(text2);
+function sqlStringLiteral(text3) {
+  return text3 === null ? "NULL" : quoteString(text3);
 }
-function policySqlTooLong(text2) {
-  return utf8ByteLength(text2) > MAX_POLICY_SQL_BYTES;
+function policySqlTooLong(text3) {
+  return utf8ByteLength(text3) > MAX_POLICY_SQL_BYTES;
 }
 
 // ../../packages/data-core/src/query.ts
@@ -24686,11 +25181,11 @@ function readValue2(value, path, auth = false) {
     );
   return value;
 }
-function longerThan(text2, max) {
-  if (text2.length <= max) return false;
-  if (text2.length > max * 2) return true;
+function longerThan(text3, max) {
+  if (text3.length <= max) return false;
+  if (text3.length > max * 2) return true;
   let count2 = 0;
-  for (const _ of text2) if (++count2 > max) return true;
+  for (const _ of text3) if (++count2 > max) return true;
   return false;
 }
 function endsWithLoneEscape(pattern) {
@@ -24847,8 +25342,8 @@ function parseCondition(action, value) {
 }
 function conditionsTooLarge(texts) {
   let total = 0;
-  for (const text2 of texts)
-    if (typeof text2 === "string") total += utf8ByteLength(text2);
+  for (const text3 of texts)
+    if (typeof text3 === "string") total += utf8ByteLength(text3);
   return total > MAX_CONDITION_BYTES;
 }
 function isInvalidCondition(value) {
@@ -24934,14 +25429,14 @@ var POLICY_SQL = {
    */
   insertConverted: `INSERT OR IGNORE INTO _naro_policies_v2 (table_name, name, kind, command, roles, using_expr, check_expr, owner_column) SELECT ?, ?, ?, ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM _naro_policies WHERE ${ROW_AS_READ})`
 };
-function readStoredCondition(action, text2, tooLarge) {
-  if (text2 === void 0 || text2 === null) return "is missing";
-  if (typeof text2 !== "string") return "is not JSON";
+function readStoredCondition(action, text3, tooLarge) {
+  if (text3 === void 0 || text3 === null) return "is missing";
+  if (typeof text3 !== "string") return "is not JSON";
   if (tooLarge)
     return `the conditions of the policy are larger than ${String(MAX_CONDITION_BYTES)} bytes`;
   let value;
   try {
-    value = JSON.parse(text2);
+    value = JSON.parse(text3);
   } catch {
     return "is not JSON";
   }
@@ -24956,7 +25451,7 @@ function policyFromRow(row, log2) {
     (action) => row[`${action}_rule`] === CONDITION_RULE ? row[`${action}_condition`] : void 0
   );
   const tooLarge = conditionsTooLarge(
-    texts.filter((text2) => typeof text2 === "string")
+    texts.filter((text3) => typeof text3 === "string")
   );
   const read = POLICY_ACTIONS2.map(
     (action, index) => {
@@ -26134,13 +26629,13 @@ function boundBytes(value) {
   return typeof value === "string" ? utf8ByteLength(value) : 8;
 }
 function captureGuard(table, where, params, nonce, set2) {
-  const bytes = balancedSum(
+  const bytes2 = balancedSum(
     table.columns.map(
       (item) => set2.has(item.name) ? String(boundBytes(set2.get(item.name) ?? null)) : `coalesce(length(CAST(${qualifiedColumn(table.name, item.name)} AS BLOB)), 8)`
     )
   );
   return statement(
-    `SELECT CASE WHEN n > ${String(MAX_CAPTURE_ROWS)} OR b > ${String(MAX_CAPTURE_BYTES)} THEN ${captureMarker(nonce)} ELSE 1 END AS ok FROM (SELECT count(*) AS n, coalesce(sum(r), 0) AS b FROM (SELECT ${bytes} AS r FROM ${quoteIdentifier(table.name)}${where} LIMIT ${String(MAX_CAPTURE_ROWS + 1)}))`,
+    `SELECT CASE WHEN n > ${String(MAX_CAPTURE_ROWS)} OR b > ${String(MAX_CAPTURE_BYTES)} THEN ${captureMarker(nonce)} ELSE 1 END AS ok FROM (SELECT count(*) AS n, coalesce(sum(r), 0) AS b FROM (SELECT ${bytes2} AS r FROM ${quoteIdentifier(table.name)}${where} LIMIT ${String(MAX_CAPTURE_ROWS + 1)}))`,
     params
   );
 }
@@ -26795,18 +27290,18 @@ var Rls = class {
         }),
         `they bind ${String(count2)}`
       );
-    const bytes = parts.reduce(
+    const bytes2 = parts.reduce(
       (sum, part) => sum + utf8ByteLength(part.sql),
       0
     );
-    if (bytes > MAX_POLICY_STATEMENT_BYTES)
+    if (bytes2 > MAX_POLICY_STATEMENT_BYTES)
       fail(
         dataError("POLICY_INVALID", {
           action: "select",
           table: this.policyTable,
           bytes: true
         }),
-        `they write ${String(bytes)}`
+        `they write ${String(bytes2)}`
       );
   }
 };
@@ -27495,11 +27990,11 @@ function tokenize3(sql) {
       at = closing("'") + 1;
       tokens.push({ kind: "literal" });
     } else if (isDigit2(code) || code === 46 && isDigit2(next)) {
-      const text2 = NUMBER2.exec(sql.slice(at, at + 64))?.[0] || sql[at] || "";
+      const text3 = NUMBER2.exec(sql.slice(at, at + 64))?.[0] || sql[at] || "";
       tokens.push(
-        /^[0-9]+$/.test(text2) ? { kind: "literal", integer: Number(text2) } : { kind: "literal" }
+        /^[0-9]+$/.test(text3) ? { kind: "literal", integer: Number(text3) } : { kind: "literal" }
       );
-      at += text2.length;
+      at += text3.length;
     } else if (code === 63 || code === 58 || code === 64 || code === 36) {
       at++;
       while (at < length && isWordPart(sql.charCodeAt(at))) at++;
@@ -27507,8 +28002,8 @@ function tokenize3(sql) {
     } else if (isWordStart(code)) {
       const start = at;
       while (at < length && isWordPart(sql.charCodeAt(at))) at++;
-      const text2 = sql.slice(start, at);
-      tokens.push({ kind: "word", text: text2, upper: text2.toUpperCase() });
+      const text3 = sql.slice(start, at);
+      tokens.push({ kind: "word", text: text3, upper: text3.toUpperCase() });
     } else if (sql.startsWith("->>", at)) {
       tokens.push({ kind: "op", text: "->>" });
       at += 3;
@@ -28218,31 +28713,31 @@ function isWordStart2(char) {
 function isWordPart2(char) {
   return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
 }
-function skipBlanks(text2, from) {
+function skipBlanks(text3, from) {
   let index = from;
   for (; ; ) {
-    const char = text2.charAt(index);
+    const char = text3.charAt(index);
     if (isBlankStart(char)) {
       index++;
-      while (index < text2.length && isBlank(text2.charAt(index))) index++;
-    } else if (text2.charCodeAt(index) === BOM2) index++;
-    else if (char === "-" && text2.charAt(index + 1) === "-") {
-      const end = text2.indexOf("\n", index + 2);
-      index = end < 0 ? text2.length : end;
-    } else if (char === "/" && text2.charAt(index + 1) === "*") {
-      const end = text2.indexOf("*/", index + 2);
-      index = end < 0 ? text2.length : end + 2;
+      while (index < text3.length && isBlank(text3.charAt(index))) index++;
+    } else if (text3.charCodeAt(index) === BOM2) index++;
+    else if (char === "-" && text3.charAt(index + 1) === "-") {
+      const end = text3.indexOf("\n", index + 2);
+      index = end < 0 ? text3.length : end;
+    } else if (char === "/" && text3.charAt(index + 1) === "*") {
+      const end = text3.indexOf("*/", index + 2);
+      index = end < 0 ? text3.length : end + 2;
     } else return index;
   }
 }
-function readQuoted(text2, start, delimiter) {
+function readQuoted(text3, start, delimiter) {
   let value = "";
   let index = start + 1;
   for (; ; ) {
-    const close = text2.indexOf(delimiter, index);
+    const close = text3.indexOf(delimiter, index);
     if (close < 0) return void 0;
-    value += text2.slice(index, close);
-    if (text2.charAt(close + 1) === delimiter) {
+    value += text3.slice(index, close);
+    if (text3.charAt(close + 1) === delimiter) {
       value += delimiter;
       index = close + 2;
       continue;
@@ -28250,31 +28745,31 @@ function readQuoted(text2, start, delimiter) {
     return { text: value, end: close + 1 };
   }
 }
-function headTokens(text2) {
+function headTokens(text3) {
   const tokens = [];
   let index = 0;
   while (tokens.length < HEAD_TOKENS) {
-    index = skipBlanks(text2, index);
-    const char = text2.charAt(index);
-    if (index >= text2.length) break;
+    index = skipBlanks(text3, index);
+    const char = text3.charAt(index);
+    if (index >= text3.length) break;
     if (char === '"' || char === "`" || char === "'") {
-      const quoted2 = readQuoted(text2, index, char);
-      if (!quoted2) break;
-      tokens.push({ kind: "name", text: quoted2.text });
-      index = quoted2.end;
+      const quoted3 = readQuoted(text3, index, char);
+      if (!quoted3) break;
+      tokens.push({ kind: "name", text: quoted3.text });
+      index = quoted3.end;
     } else if (char === "[") {
-      const close = text2.indexOf("]", index + 1);
+      const close = text3.indexOf("]", index + 1);
       if (close < 0) break;
-      tokens.push({ kind: "name", text: text2.slice(index + 1, close) });
+      tokens.push({ kind: "name", text: text3.slice(index + 1, close) });
       index = close + 1;
-    } else if ((char === "x" || char === "X") && text2.charAt(index + 1) === "'") {
+    } else if ((char === "x" || char === "X") && text3.charAt(index + 1) === "'") {
       break;
     } else if (isWordStart2(char)) {
       let end = index + 1;
-      while (end < text2.length && isWordPart2(text2.charAt(end))) end++;
-      tokens.push({ kind: "word", text: text2.slice(index, end) });
+      while (end < text3.length && isWordPart2(text3.charAt(end))) end++;
+      tokens.push({ kind: "word", text: text3.slice(index, end) });
       index = end;
-    } else if (char === "." && !/[0-9]/.test(text2.charAt(index + 1))) {
+    } else if (char === "." && !/[0-9]/.test(text3.charAt(index + 1))) {
       tokens.push({ kind: "dot" });
       index++;
     } else break;
@@ -28414,10 +28909,10 @@ function readAlter(head) {
     return { kind: "rls" };
   return sqlite.ok ? OTHER : sqlite.head;
 }
-function readSqlHead(text2) {
-  if (text2.includes("\0"))
+function readSqlHead(text3) {
+  if (text3.includes("\0"))
     return { kind: "unreadable", reason: "the statement has a NUL character" };
-  const head = new Head(headTokens(text2));
+  const head = new Head(headTokens(text3));
   if (head.is(0, "create")) return readCreate(head);
   if (head.is(0, "drop")) return readDrop(head);
   if (head.is(0, "alter")) return readAlter(head);
@@ -28428,6 +28923,13 @@ function readSqlHead(text2) {
   return OTHER;
 }
 
+// ../../packages/data-core/src/functions-registry.ts
+var FUNCTIONS_TABLE = "_naro_functions";
+var FUNCTIONS_REGISTRY_VERSION = 9;
+var FUNCTIONS_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ${FUNCTIONS_TABLE} (name TEXT NOT NULL PRIMARY KEY CHECK (name GLOB '[a-z]*' AND length(name) BETWEEN 1 AND 64), verify_jwt INTEGER NOT NULL DEFAULT 1 CHECK (verify_jwt IN (0, 1)), updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')))`;
+var MAX_REGISTERED_FUNCTIONS = 2e3;
+var FUNCTIONS_REGISTRY_SQL = `SELECT name, verify_jwt FROM ${FUNCTIONS_TABLE} ORDER BY name LIMIT ${String(MAX_REGISTERED_FUNCTIONS)}`;
+
 // ../../packages/data-core/src/policy-index.ts
 var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
 function indexesFromRows(rows) {
@@ -28931,15 +29433,15 @@ function storageStatementProblem(statement2, action) {
       }),
       reason: `the ${STORAGE_OBJECTS} policies need more than ${String(STORAGE_STATEMENT_PARAM_LIMIT)} values in one statement`
     };
-  const bytes = utf8ByteLength(statement2.sql);
-  if (bytes > STORAGE_STATEMENT_BYTE_LIMIT)
+  const bytes2 = utf8ByteLength(statement2.sql);
+  if (bytes2 > STORAGE_STATEMENT_BYTE_LIMIT)
     return {
       error: dataError("POLICY_INVALID", {
         action,
         table: STORAGE_OBJECTS,
         bytes: STORAGE_STATEMENT_BYTE_LIMIT
       }),
-      reason: `the ${STORAGE_OBJECTS} policies make one statement ${String(bytes)} bytes long, more than ${String(STORAGE_STATEMENT_BYTE_LIMIT)}`
+      reason: `the ${STORAGE_OBJECTS} policies make one statement ${String(bytes2)} bytes long, more than ${String(STORAGE_STATEMENT_BYTE_LIMIT)}`
     };
   return void 0;
 }
@@ -29212,8 +29714,8 @@ function budgetProblem(fragment, action) {
       }),
       reason: `the ${STORAGE_OBJECTS} policies need more than ${String(STORAGE_STATEMENT_PARAM_LIMIT)} values in one statement`
     };
-  const bytes = utf8ByteLength(fragment.sql);
-  if (bytes > MAX_POLICY_STATEMENT_BYTES)
+  const bytes2 = utf8ByteLength(fragment.sql);
+  if (bytes2 > MAX_POLICY_STATEMENT_BYTES)
     return {
       ok: false,
       error: dataError("POLICY_INVALID", {
@@ -29221,7 +29723,7 @@ function budgetProblem(fragment, action) {
         table: STORAGE_OBJECTS,
         bytes: true
       }),
-      reason: `they write ${String(bytes)}`
+      reason: `they write ${String(bytes2)}`
     };
   return void 0;
 }
@@ -29375,7 +29877,7 @@ function depthContexts(contexts, claims) {
 function readsClaims(policies) {
   return policies.some(
     (policy) => [policy.using, policy.check].some(
-      (text2) => text2 !== null && /auth\s*\.\s*jwt\s*\(/i.test(text2)
+      (text3) => text3 !== null && /auth\s*\.\s*jwt\s*\(/i.test(text3)
     )
   );
 }
@@ -30005,15 +30507,15 @@ function readEnd(stream) {
       rest.position
     );
 }
-function parsePolicyStatement(text2) {
-  if (policySqlTooLong(text2))
+function parsePolicyStatement(text3) {
+  if (policySqlTooLong(text3))
     return {
       ok: false,
       reason: `the statement is longer than ${String(MAX_POLICY_SQL_BYTES)} bytes`,
       position: 1
     };
   try {
-    const stream = new TokenStream(tokenize2(text2));
+    const stream = new TokenStream(tokenize2(text3));
     const start = stream.next();
     let statement2;
     if (isKeyword(start, "create")) statement2 = readCreate2(stream, start);
@@ -30037,10 +30539,10 @@ function parsePolicyStatement(text2) {
     throw error51;
   }
 }
-function splitPolicyStatements(text2) {
+function splitPolicyStatements(text3) {
   let tokens;
   try {
-    tokens = tokenize2(text2);
+    tokens = tokenize2(text3);
   } catch (error51) {
     if (error51 instanceof PolicySyntaxError)
       return { ok: false, reason: error51.reason, position: error51.position };
@@ -30052,30 +30554,30 @@ function splitPolicyStatements(text2) {
     if (token.kind === "eof") break;
     start ??= token.position - 1;
     if (token.kind === "op" && token.value === ";") {
-      statements.push(text2.slice(start, token.position).trim());
+      statements.push(text3.slice(start, token.position).trim());
       start = void 0;
     }
   }
   if (start !== void 0) {
-    const last = text2.slice(start).trim();
+    const last = text3.slice(start).trim();
     if (last !== "") statements.push(last);
   }
   return { ok: true, statements };
 }
 var OWNER_PREFIX = "naro:owner";
-function ownerComment(text2, position) {
-  if (!text2.startsWith(OWNER_PREFIX)) return void 0;
-  const rest = text2.slice(OWNER_PREFIX.length);
+function ownerComment(text3, position) {
+  if (!text3.startsWith(OWNER_PREFIX)) return void 0;
+  const rest = text3.slice(OWNER_PREFIX.length);
   if (rest !== "" && !/^[ \t]/.test(rest)) return void 0;
   let column2 = rest.replace(/^[ \t]+|[ \t]+$/g, "");
   if (column2.startsWith('"')) {
-    const quoted2 = /^"((?:[^"]|"")*)"$/.exec(column2);
-    if (!quoted2)
+    const quoted3 = /^"((?:[^"]|"")*)"$/.exec(column2);
+    if (!quoted3)
       throw new PolicySyntaxError(
         "naro:owner needs one column name, bare or in double quotes",
         position
       );
-    column2 = (quoted2[1] ?? "").replaceAll('""', '"');
+    column2 = (quoted3[1] ?? "").replaceAll('""', '"');
   }
   if (column2 === "")
     throw new PolicySyntaxError("naro:owner needs a column name", position);
@@ -30121,22 +30623,22 @@ function readRowLevelSecurity(stream) {
   stream.expectKeyword("security");
   return { kind: "rls", table, action };
 }
-function parseMigrationPolicyStatement(text2) {
-  if (policySqlTooLong(text2))
+function parseMigrationPolicyStatement(text3) {
+  if (policySqlTooLong(text3))
     return {
       ok: false,
       reason: `the statement is longer than ${String(MAX_POLICY_SQL_BYTES)} bytes`,
       position: 1
     };
   try {
-    const stream = new TokenStream(tokenize2(text2));
+    const stream = new TokenStream(tokenize2(text3));
     let statement2;
     if (stream.acceptKeyword("comment")) statement2 = readComment(stream);
     else if (isKeyword(stream.peek(), "alter") && isKeyword(stream.peek(1), "table")) {
       stream.next();
       stream.next();
       statement2 = readRowLevelSecurity(stream);
-    } else return parsePolicyStatement(text2);
+    } else return parsePolicyStatement(text3);
     readEnd(stream);
     return { ok: true, statement: statement2 };
   } catch (error51) {
@@ -30282,6 +30784,15 @@ var SYSTEM_MIGRATIONS = [
     version: REALTIME_TABLES_VERSION,
     name: "realtime",
     statements: [REALTIME_TABLES_SQL]
+  },
+  {
+    // Functions 3-3a (design 2026-10-29 §6.3): the function registry the
+    // gate reads. Every backend gets it, Functions on or not; the control
+    // plane (3-3b) writes it. A worker from before it never reads it, and a
+    // worker that reads it on a D1 without it answers 409 BACKEND_OUTDATED.
+    version: FUNCTIONS_REGISTRY_VERSION,
+    name: "functions",
+    statements: [FUNCTIONS_TABLE_SQL]
   }
 ];
 
@@ -30313,17 +30824,17 @@ function tablesChanged(head) {
   }
 }
 function readsBareSubqueryColumn(policy) {
-  return [policy.using, policy.check].some((text2) => {
-    if (text2 === null) return false;
-    const parsed = parseExpression(text2);
+  return [policy.using, policy.check].some((text3) => {
+    if (text3 === null) return false;
+    const parsed = parseExpression(text3);
     return parsed.ok && unqualifiedInSubquery(parsed.expr) !== void 0;
   });
 }
 function tablesInScope(policy) {
   const tables = /* @__PURE__ */ new Set([asciiLower(policy.table)]);
-  for (const text2 of [policy.using, policy.check]) {
-    if (text2 === null) continue;
-    const parsed = parseExpression(text2);
+  for (const text3 of [policy.using, policy.check]) {
+    if (text3 === null) continue;
+    const parsed = parseExpression(text3);
     if (!parsed.ok) continue;
     for (const subquery of subqueriesOf(parsed.expr))
       tables.add(asciiLower(subquery.table));
@@ -30331,9 +30842,9 @@ function tablesInScope(policy) {
   return tables;
 }
 function readsStorageObjects(policy) {
-  return [policy.using, policy.check].some((text2) => {
-    if (text2 === null) return false;
-    const parsed = parseExpression(text2);
+  return [policy.using, policy.check].some((text3) => {
+    if (text3 === null) return false;
+    const parsed = parseExpression(text3);
     return parsed.ok && subqueriesOf(parsed.expr).some(
       (subquery) => isStorageObjects(subquery.table)
     );
@@ -30345,54 +30856,54 @@ function planPolicyMigration(statements) {
   let hasPolicyStatements = false;
   let touchesTables = false;
   let renamesColumns = false;
-  const heads = statements.map((text2) => readSqlHead(text2));
+  const heads = statements.map((text3) => readSqlHead(text3));
   const changes = heads.map(tablesChanged);
   const changedAfter = (index, tables) => changes.slice(index + 1).some(
     (changed) => changed === "any" || changed.some((table) => tables.has(table))
   );
-  for (const [index, text2] of statements.entries()) {
-    const refuse2 = (message) => ({
+  for (const [index, text3] of statements.entries()) {
+    const refuse3 = (message) => ({
       ok: false,
       index,
       message: `Statement ${String(index + 1)} of ${String(count2)}: ${message}`
     });
-    const head = heads[index] ?? readSqlHead(text2);
+    const head = heads[index] ?? readSqlHead(text3);
     switch (head.kind) {
       case "grant":
       case "revoke":
-        return refuse2(GRANT_REFUSAL);
+        return refuse3(GRANT_REFUSAL);
       case "unreadable":
-        return refuse2(`${head.reason}.`);
+        return refuse3(`${head.reason}.`);
       case "create-table":
       case "drop-table":
       case "rename-table":
         touchesTables = true;
-        planned.push({ kind: "verbatim", text: text2, head });
+        planned.push({ kind: "verbatim", text: text3, head });
         continue;
       case "rename-column":
         renamesColumns = true;
-        planned.push({ kind: "verbatim", text: text2, head });
+        planned.push({ kind: "verbatim", text: text3, head });
         continue;
       case "alter-table":
       case "other":
-        planned.push({ kind: "verbatim", text: text2, head });
+        planned.push({ kind: "verbatim", text: text3, head });
         continue;
       default:
         break;
     }
-    const parsed = parseMigrationPolicyStatement(text2);
+    const parsed = parseMigrationPolicyStatement(text3);
     if (!parsed.ok)
-      return refuse2(
+      return refuse3(
         `${parsed.reason} at character ${String(parsed.position)}.`
       );
     const statement2 = parsed.statement;
     const table = statement2.kind === "create" ? statement2.policy.table : statement2.table;
     if (!isStorageObjects(table) && isSystemTable(table))
-      return refuse2(`${relationMissing(table)}.`);
+      return refuse3(`${relationMissing(table)}.`);
     switch (statement2.kind) {
       case "create":
         if (readsBareSubqueryColumn(statement2.policy) && changedAfter(index, tablesInScope(statement2.policy)))
-          return refuse2(LATER_TABLE_CHANGE);
+          return refuse3(LATER_TABLE_CHANGE);
         hasPolicyStatements = true;
         planned.push({ kind: "create-policy", policy: statement2.policy });
         break;
@@ -30420,7 +30931,7 @@ function planPolicyMigration(statements) {
         break;
       case "rls":
         if (statement2.action === "disable")
-          return refuse2(disableRefusal(table));
+          return refuse3(disableRefusal(table));
         planned.push({ kind: "noop" });
         break;
     }
@@ -30500,19 +31011,19 @@ var TYPED_PATH = /^[a-z][a-z0-9+.-]*:\/\/[^/]*(\/.*)?$/i;
 var SEGMENT = /^[A-Za-z0-9._~-]+$/;
 function parseRedirectEntry(value) {
   if (typeof value !== "string") return null;
-  const text2 = value.trim();
-  if (text2 === "" || text2.length > MAX_ENTRY_LENGTH) return null;
-  if (/[\s?#*%\\]/.test(text2)) return null;
+  const text3 = value.trim();
+  if (text3 === "" || text3.length > MAX_ENTRY_LENGTH) return null;
+  if (/[\s?#*%\\]/.test(text3)) return null;
   let url2;
   try {
-    url2 = new URL(text2);
+    url2 = new URL(text3);
   } catch {
     return null;
   }
   if (url2.username !== "" || url2.password !== "") return null;
   if (url2.search !== "" || url2.hash !== "") return null;
   if (!isSecureOrLoopback(url2)) return null;
-  const typed = TYPED_PATH.exec(text2)?.[1] ?? "/";
+  const typed = TYPED_PATH.exec(text3)?.[1] ?? "/";
   if (typed !== url2.pathname) return null;
   const path = url2.pathname;
   if (path !== "/") {
@@ -31034,13 +31545,13 @@ function listMigrationFiles(dir) {
   );
 }
 function nextMigrationFileName(existing, name) {
-  const normalized = normalizeMigrationName(name);
-  if (normalized === "")
+  const normalized2 = normalizeMigrationName(name);
+  if (normalized2 === "")
     throw new NaroError(
       "VALIDATION_FAILED",
       "Migration name must contain letters or digits."
     );
-  return numberedMigrationName(existing, normalized);
+  return numberedMigrationName(existing, normalized2);
 }
 function compareMigrations(local, applied) {
   const ledger = new Map(applied.map((row) => [row.name, row]));
@@ -31053,13 +31564,13 @@ function compareMigrations(local, applied) {
       rows.push({ name, status: "applied", appliedAt: exact.appliedAt });
       continue;
     }
-    const bare = ledger.get(name.replace(/\.sql$/, ""));
-    if (bare) {
-      ledger.delete(bare.name);
+    const bare2 = ledger.get(name.replace(/\.sql$/, ""));
+    if (bare2) {
+      ledger.delete(bare2.name);
       rows.push({
         name,
         status: "applied",
-        appliedAt: bare.appliedAt,
+        appliedAt: bare2.appliedAt,
         warning: "ledger-name-missing-extension"
       });
       continue;
@@ -31541,10 +32052,10 @@ var SUPPORTED_REMOTE = [
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
-var defaultExec = (args, cwd) => new Promise((resolve12, reject) => {
+var defaultExec = (args, cwd) => new Promise((resolve15, reject) => {
   execFile2("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
-    else resolve12(stdout);
+    else resolve15(stdout);
   });
 });
 async function tryExec(exec, args, cwd) {
@@ -31693,6 +32204,24 @@ async function uploadArtifact(artifact, opts) {
   };
 }
 
+// src/version.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname5, join as join25 } from "path";
+import { fileURLToPath } from "url";
+function version2() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync6(
+        join25(dirname5(fileURLToPath(import.meta.url)), "..", "package.json"),
+        "utf8"
+      )
+    );
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/working-tree.ts
 import { execFile as execFile3 } from "child_process";
 import {
@@ -31710,9 +32239,9 @@ import {
 } from "fs/promises";
 import {
   basename as basename3,
-  dirname as dirname5,
+  dirname as dirname6,
   isAbsolute as isAbsolute4,
-  join as join25,
+  join as join26,
   relative as relative6,
   resolve as resolve10,
   sep as sep5
@@ -31751,15 +32280,15 @@ async function committedEnvFiles(sourceDir) {
     return [];
   });
 }
-async function staysInside(link, text2, root) {
+async function staysInside(link, text3, root) {
   try {
     return inside(await realpath3(link), root);
   } catch (error51) {
-    return error51.code === "ENOENT" && !text2.split(/[\\/]/).includes("..");
+    return error51.code === "ENOENT" && !text3.split(/[\\/]/).includes("..");
   }
 }
-function climbsOnlyFirst(text2) {
-  const segments = text2.split(/[\\/]/).filter((s) => s !== "" && s !== ".");
+function climbsOnlyFirst(text3) {
+  const segments = text3.split(/[\\/]/).filter((s) => s !== "" && s !== ".");
   const down = segments.findIndex((segment) => segment !== "..");
   return down < 0 || !segments.slice(down).includes("..");
 }
@@ -31779,11 +32308,11 @@ async function readLocal(path) {
   return readFile14(path).catch(() => null);
 }
 async function realAncestor(dir) {
-  for (let current = dir; ; current = dirname5(current)) {
+  for (let current = dir; ; current = dirname6(current)) {
     try {
       return await realpath3(current);
     } catch {
-      if (dirname5(current) === current)
+      if (dirname6(current) === current)
         throw new Error(`No ancestor of ${dir}`);
     }
   }
@@ -31821,7 +32350,7 @@ async function copyWorkingTree(source, checkout) {
           absoluteLinks.push(path);
           return false;
         }
-        if (!inside(resolve10(dirname5(src), target2), sourceDir)) {
+        if (!inside(resolve10(dirname6(src), target2), sourceDir)) {
           linksOutside.push(path);
           return false;
         }
@@ -31837,14 +32366,14 @@ async function copyWorkingTree(source, checkout) {
   const root = await realpath3(checkout);
   const strays = await keptOnly(
     keptLinks,
-    async ({ path, text: text2 }) => {
+    async ({ path, text: text3 }) => {
       try {
-        return inside(await realpath3(join25(checkout, path)), root);
+        return inside(await realpath3(join26(checkout, path)), root);
       } catch (error51) {
-        return error51.code === "ENOENT" && climbsOnlyFirst(text2);
+        return error51.code === "ENOENT" && climbsOnlyFirst(text3);
       }
     },
-    ({ path }) => unlink(join25(checkout, path))
+    ({ path }) => unlink(join26(checkout, path))
   );
   linksElsewhere.push(...strays.map(({ path }) => path));
   const committed = await committedEnvFiles(sourceDir);
@@ -31858,13 +32387,13 @@ async function copyWorkingTree(source, checkout) {
       outsideProject.push(path);
       continue;
     }
-    const target2 = join25(checkout, path);
-    if (!inside(await realAncestor(dirname5(target2)), root)) {
+    const target2 = join26(checkout, path);
+    if (!inside(await realAncestor(dirname6(target2)), root)) {
       outsideProject.push(path);
       continue;
     }
     try {
-      await mkdir3(dirname5(target2), { recursive: true });
+      await mkdir3(dirname6(target2), { recursive: true });
     } catch {
       outsideProject.push(path);
       continue;
@@ -31873,7 +32402,7 @@ async function copyWorkingTree(source, checkout) {
     const content = await git(sourceDir, ["show", `HEAD:./${path}`]);
     if (isLink) {
       const linkTarget = content.toString("utf8");
-      const pointsAt = resolve10(dirname5(target2), linkTarget);
+      const pointsAt = resolve10(dirname6(target2), linkTarget);
       if (isAbsolute4(linkTarget) || !inside(pointsAt, checkout)) {
         outsideProject.push(path);
         continue;
@@ -31883,16 +32412,16 @@ async function copyWorkingTree(source, checkout) {
       continue;
     }
     await writeFile7(target2, content, { flag: "wx" });
-    const local = await readLocal(join25(sourceDir, path));
+    const local = await readLocal(join26(sourceDir, path));
     if (!local || !sameText(local, content)) committedVersion.push(path);
   }
   const envStrays = await keptOnly(
     envLinks,
     async (path) => {
-      const real = await realpath3(join25(checkout, path)).catch(() => null);
+      const real = await realpath3(join26(checkout, path)).catch(() => null);
       return real !== null && inside(real, root);
     },
-    (path) => unlink(join25(checkout, path))
+    (path) => unlink(join26(checkout, path))
   );
   outsideProject.push(...envStrays);
   const inCommit = new Set(
@@ -31912,38 +32441,1805 @@ async function copyWorkingTree(source, checkout) {
   };
 }
 
-// src/deploy.ts
-function parseDotenv2(text2) {
-  return parseDotenv(text2);
+// src/functions/deploy.ts
+import { relative as relative11, resolve as resolve13, sep as sep10 } from "path";
+
+// ../../packages/functions-bundler/src/errors.ts
+var FunctionBundleError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "FunctionBundleError";
+    this.code = code;
+  }
+};
+var NAME_RULE = "names are 1\u201364 characters of lowercase letters, digits, - and _, starting with a letter";
+var JSR_REGISTRY = '"@jsr:registry=https://npm.jsr.io"';
+var bytes = (n) => n.toLocaleString("en-US");
+var SHELL_SAFE = /^[A-Za-z0-9@/._^=+:-]+$/;
+var shellArg = (spec) => SHELL_SAFE.test(spec) ? spec : `'${spec.replaceAll("'", "'\\''")}'`;
+var BUNDLE_MESSAGES = {
+  noDir: (dir) => `There is no ${dir} folder here. Create a function with naro functions new <name>.`,
+  supabaseFound: "Found supabase/functions. Deploy it with --dir supabase/functions.",
+  noFunctions: (dir) => `No functions in ${dir}. Create one with naro functions new <name>.`,
+  badName: (name) => `Function folder ${name} is not a valid function name: ${NAME_RULE}.`,
+  noFolder: (name, dir) => `Function ${name} has no folder: ${dir}/${name} does not exist.`,
+  jsonInvalid: (name) => `function.json of ${name} is not valid JSON.`,
+  jsonKeys: (name, keys) => `function.json of ${name} has keys Naro does not read: ${keys.join(", ")}. It takes verifyJwt and entrypoint.`,
+  jsonVerifyJwt: (name) => `verifyJwt in function.json of ${name} must be true or false.`,
+  jsonEntrypoint: (name) => `entrypoint in function.json of ${name} must be a relative path inside the function folder.`,
+  noEntry: (name, dir) => `Function ${name} has no entry file. Add ${dir}/${name}/index.ts (or set "entrypoint" in function.json).`,
+  entryMissing: (name, entrypoint) => `Function ${name} has no ${entrypoint}, the entrypoint its function.json names.`,
+  supabaseVerifyJwt: (dir) => `\u26A0 supabase/config.toml's verify_jwt is not read. Set "verifyJwt": false in ${dir}/<name>/function.json, or deploy with --no-verify-jwt.`,
+  importMapMissing: (file2) => `--import-map ${file2} does not exist.`,
+  importMapInvalid: (file2) => `${file2} is not valid JSON.`,
+  importMapShape: (file2) => `The imports of ${file2} must map names to text.`,
+  importMapPrefix: (file2, key, value) => `The imports of ${file2} map ${JSON.stringify(key)} to ${JSON.stringify(value)}: a key ending in / needs a value ending in / too.`,
+  npmMissing: (spec, install, dir) => `npm:${spec} is not installed. Run npm install ${shellArg(install)} in ${dir}.`,
+  jsrMissing: (spec, install) => `jsr:${spec} is not installed. Add ${JSR_REGISTRY} to .npmrc, then run npm install ${shellArg(install)}.`,
+  missingMany: (specs, installs, jsr) => jsr ? `Missing packages: ${specs.join(", ")}. Add ${JSR_REGISTRY} to .npmrc, then install them with: npm install ${installs.map(shellArg).join(" ")}` : `Missing packages: ${specs.join(", ")}. Install them with: npm install ${installs.map(shellArg).join(" ")}`,
+  noPackageName: (specifier, example) => `${specifier} names no package. Write it like ${example}.`,
+  jsrNoScope: (spec) => `jsr:${spec} needs a scope, like jsr:@scope/${spec}.`,
+  urlNpm: (url2, target2) => `URL imports are not supported: ${url2}. Use ${target2} instead.`,
+  urlStd: (url2, module) => `URL imports are not supported: ${url2}. Use jsr:@std/${module} instead.`,
+  urlOther: (url2) => `URL imports are not supported: ${url2}. Install the package from npm and import it by name.`,
+  outOfRange: (pkg, version3, range, file2) => `\u26A0 ${pkg} is installed at ${version3}, outside the range ${range} that ${file2} asks for.`,
+  wasm: (file2) => `WebAssembly modules are not supported in functions yet: ${file2}.`,
+  naroJsMissing: 'Cannot find "naro-js/functions". Install naro-js 0.7.0 or later: npm install naro-js@latest.',
+  tooLarge: (name, size, inputs) => `Function ${name} bundles to ${bytes(size)} bytes; the limit is 67,108,864 (64 MiB). The biggest inputs: ${inputs}.`,
+  // Rounded up: a size over the limit never reads as the limit (10.0 MB).
+  tooLargeCompressed: (name, size) => `Function ${name} is ${(Math.ceil(size / 1048576 * 10) / 10).toFixed(1)} MB after compression; Cloudflare accepts 10 MB.`,
+  otherBundle: (name, text3, location2) => `Function ${name} did not bundle: ${text3}${location2 ? ` (${location2})` : ""}`,
+  noHandler: (name) => `Function ${name} did not register a handler. Call Deno.serve(handler) or export default { fetch }.`,
+  failedToStart: (name, line) => `Function ${name} failed to start: ${line}`,
+  esbuildMissing: (name, cause) => `Function ${name} did not bundle: esbuild could not be loaded (${cause}). Reinstall naro-cli.`,
+  miniflareMissing: (name, cause) => `Function ${name} could not be checked: miniflare could not be loaded (${cause}). Reinstall naro-cli, or skip the check with --skip-check (skipCheck: true in naro-mcp).`,
+  bootTimeout: (name, ms) => `Function ${name} did not start within ${String(ms / 1e3)} seconds.`
+};
+
+// ../../packages/functions-bundler/src/discover.ts
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import { join as join27, relative as relative7, resolve as resolve11, sep as sep6 } from "path";
+
+// ../../packages/functions-bundler/src/limits.ts
+var FUNCTION_BUNDLE_MAX_BYTES = 67108864;
+var FUNCTION_COMPRESSED_BUNDLE_MAX_BYTES = 10485760;
+var ENTRY_FILES = [
+  "index.ts",
+  "index.js",
+  "index.mjs",
+  "index.tsx",
+  "index.jsx"
+];
+
+// ../../packages/functions-bundler/src/discover.ts
+var SEGMENT2 = /^[A-Za-z0-9._@+-]+$/;
+function isEntrypoint(value) {
+  if (value.length < 1 || value.length > 200) return false;
+  return value.split("/").every(
+    (segment) => segment !== "." && segment !== ".." && SEGMENT2.test(segment)
+  );
 }
-function readProjectEnv2(dir) {
-  return readProjectEnv(dir);
+function functionsFolder(options) {
+  const root = resolve11(options.cwd, options.root ?? ".");
+  const explicit = options.dir !== void 0;
+  const dir = explicit ? resolve11(options.cwd, options.dir) : join27(root, "naro", "functions");
+  const label2 = relative7(options.cwd, dir).split(sep6).join("/") || ".";
+  return { dir, label: label2, root, explicit };
 }
-function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUrl) {
-  const post = (body) => fetchImpl(`${cp3}/api/internal/deployments/${deploymentId}/events`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify(body)
-  }).then(() => {
-  });
-  const postStatus = async (body) => {
-    let lastError;
-    for (let attempt = 0; attempt < 3; attempt++) {
-      try {
-        return await post(body);
-      } catch (error51) {
-        lastError = error51;
-        await new Promise(
-          (resolve12) => setTimeout(resolve12, 500 * (attempt + 1))
-        );
+function listFunctionNames(folder) {
+  let entries;
+  try {
+    entries = readdirSync3(folder.dir, { withFileTypes: true });
+  } catch {
+    if (!folder.explicit && existsSync7(join27(folder.root, "supabase", "functions")))
+      throw new FunctionBundleError(
+        "VALIDATION_FAILED",
+        BUNDLE_MESSAGES.supabaseFound
+      );
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.noDir(folder.label)
+    );
+  }
+  const names = entries.filter(
+    (entry) => entry.isDirectory() && !entry.name.startsWith("_") && !entry.name.startsWith(".") && entry.name !== "node_modules"
+  ).map((entry) => entry.name).sort();
+  if (names.length === 0)
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.noFunctions(folder.label)
+    );
+  return names;
+}
+function readFunctionJson(dir, name) {
+  const file2 = join27(dir, "function.json");
+  if (!existsSync7(file2)) return { verifyJwt: void 0, entrypoint: void 0 };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(file2, "utf8"));
+  } catch {
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.jsonInvalid(name)
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.jsonInvalid(name)
+    );
+  const record3 = parsed;
+  const unknown2 = Object.keys(record3).filter(
+    (key) => key !== "verifyJwt" && key !== "entrypoint"
+  );
+  if (unknown2.length > 0)
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.jsonKeys(name, unknown2)
+    );
+  const { verifyJwt, entrypoint } = record3;
+  if (verifyJwt !== void 0 && typeof verifyJwt !== "boolean")
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.jsonVerifyJwt(name)
+    );
+  if (entrypoint !== void 0 && (typeof entrypoint !== "string" || !isEntrypoint(entrypoint)))
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.jsonEntrypoint(name)
+    );
+  return { verifyJwt, entrypoint };
+}
+function readFunctionSource(folder, name) {
+  if (!isFunctionName(name))
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.badName(name)
+    );
+  const dir = join27(folder.dir, name);
+  if (!statSync2(dir, { throwIfNoEntry: false })?.isDirectory())
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.noFolder(name, folder.label)
+    );
+  const config2 = readFunctionJson(dir, name);
+  let entrypoint;
+  if (config2.entrypoint !== void 0) {
+    if (!existsSync7(join27(dir, ...config2.entrypoint.split("/"))))
+      throw new FunctionBundleError(
+        "FUNCTION_BUNDLE_FAILED",
+        BUNDLE_MESSAGES.entryMissing(name, config2.entrypoint)
+      );
+    entrypoint = config2.entrypoint;
+  } else {
+    const found = ENTRY_FILES.find((file2) => existsSync7(join27(dir, file2)));
+    if (found === void 0)
+      throw new FunctionBundleError(
+        "FUNCTION_BUNDLE_FAILED",
+        BUNDLE_MESSAGES.noEntry(name, folder.label)
+      );
+    entrypoint = found;
+  }
+  return {
+    name,
+    dir,
+    entry: join27(dir, ...entrypoint.split("/")),
+    entrypoint,
+    verifyJwt: config2.verifyJwt
+  };
+}
+function configTomlWarning(folder) {
+  if (!folder.dir.endsWith(join27("supabase", "functions"))) return null;
+  const file2 = join27(folder.dir, "..", "config.toml");
+  if (!existsSync7(file2)) return null;
+  return /^\s*verify_jwt\s*=/m.test(readFileSync7(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
+}
+
+// ../../packages/functions-bundler/src/jsonc.ts
+function closesNext(text3, from) {
+  let i = from;
+  while (i < text3.length && /\s/.test(text3[i] ?? "")) i += 1;
+  return text3[i] === "}" || text3[i] === "]";
+}
+function parseJsonc2(text3) {
+  const uncommented = stripComments2(text3);
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < uncommented.length; i += 1) {
+    const char = uncommented[i] ?? "";
+    if (inString) {
+      out += char;
+      if (char === "\\") {
+        out += uncommented[i + 1] ?? "";
+        i += 1;
+      } else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    if (char === "," && closesNext(uncommented, i + 1)) continue;
+    out += char;
+  }
+  return JSON.parse(out);
+}
+function stripComments2(text3) {
+  let out = "";
+  let i = 0;
+  let inString = false;
+  while (i < text3.length) {
+    const char = text3[i] ?? "";
+    const next = text3[i + 1] ?? "";
+    if (inString) {
+      out += char;
+      if (char === "\\") {
+        out += next;
+        i += 2;
+        continue;
       }
+      if (char === '"') inString = false;
+      i += 1;
+      continue;
     }
-    throw lastError;
-  };
-  const send = createLogSender({
+    if (char === '"') {
+      inString = true;
+      out += char;
+      i += 1;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      while (i < text3.length && text3[i] !== "\n") i += 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      const end = text3.indexOf("*/", i + 2);
+      i = end === -1 ? text3.length : end + 2;
+      out += " ";
+      continue;
+    }
+    out += char;
+    i += 1;
+  }
+  return out;
+}
+
+// ../../packages/functions-bundler/src/node-compat.ts
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname7, resolve as resolvePath } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var require2 = createRequire2(import.meta.url);
+var MODULE_DIR = dirname7(fileURLToPath2(import.meta.url));
+var REQUIRED_NODE_BUILT_IN_NAMESPACE = "node-built-in-modules";
+var REQUIRED_UNENV_ALIAS_NAMESPACE = "required-unenv-alias";
+var SKIPPED_ALIASES = /* @__PURE__ */ new Set(["debug"]);
+async function nodeCompatEnvironment(options) {
+  const { defineEnv } = await import("unenv");
+  const { getCloudflarePreset } = await import("@cloudflare/unenv-preset");
+  return defineEnv({
+    presets: [
+      getCloudflarePreset({
+        compatibilityDate: options.compatibilityDate,
+        compatibilityFlags: [...options.compatibilityFlags]
+      })
+    ],
+    npmShims: true
+  }).env;
+}
+function nodeCompatPlugin(options) {
+  return {
+    name: "hybrid-nodejs_compat",
+    async setup(build) {
+      const { nonPrefixedNodeModules } = await import("@cloudflare/unenv-preset");
+      const { alias, inject, external, polyfill } = await nodeCompatEnvironment(options);
+      const nodeJsModuleRegexp = new RegExp(
+        `^(${nonPrefixedNodeModules.join("|")}|node:.+)$`
+      );
+      handleRequireCallsToNodeJSBuiltins(build, nodeJsModuleRegexp);
+      handleUnenvAliasedPackages(build, alias, external);
+      handleNodeJSGlobals(build, inject, polyfill, options.virtualBase);
+    }
+  };
+}
+function handleRequireCallsToNodeJSBuiltins(build, nodeJsModuleRegexp) {
+  build.onResolve({ filter: nodeJsModuleRegexp }, (args) => {
+    if (args.kind === "require-call")
+      return { path: args.path, namespace: REQUIRED_NODE_BUILT_IN_NAMESPACE };
+    return void 0;
+  });
+  build.onLoad(
+    { filter: /.*/, namespace: REQUIRED_NODE_BUILT_IN_NAMESPACE },
+    ({ path }) => ({
+      contents: `import libDefault from '${path}';
+module.exports = libDefault;`,
+      loader: "js"
+    })
+  );
+}
+function handleUnenvAliasedPackages(build, alias, external) {
+  const aliasAbsolute = {};
+  for (const [module, unresolvedAlias] of Object.entries(alias)) {
+    if (SKIPPED_ALIASES.has(module)) continue;
+    try {
+      aliasAbsolute[module] = require2.resolve(unresolvedAlias);
+    } catch {
+    }
+  }
+  const UNENV_ALIAS_RE = new RegExp(
+    `^(${Object.keys(aliasAbsolute).join("|")})$`
+  );
+  build.onResolve({ filter: UNENV_ALIAS_RE }, (args) => {
+    const unresolvedAlias = alias[args.path] ?? "";
+    if (args.kind === "require-call" && (unresolvedAlias.startsWith("unenv/npm/") || unresolvedAlias.startsWith("unenv/mock/")))
+      return { path: args.path, namespace: REQUIRED_UNENV_ALIAS_NAMESPACE };
+    return {
+      path: aliasAbsolute[args.path] ?? args.path,
+      external: external.includes(unresolvedAlias)
+    };
+  });
+  build.onLoad(
+    { filter: /.*/, namespace: REQUIRED_UNENV_ALIAS_NAMESPACE },
+    ({ path }) => ({
+      contents: `import * as esm from '${path}';
+module.exports = Object.entries(esm)
+  .filter(([k,]) => k !== 'default')
+  .reduce((cjs, [k, value]) =>
+    Object.defineProperty(cjs, k, { value, enumerable: true }),
+    "default" in esm ? esm.default : {}
+  );`,
+      loader: "js"
+    })
+  );
+}
+function handleNodeJSGlobals(build, inject, polyfill, virtualBase) {
+  const UNENV_VIRTUAL_MODULE_RE = /_virtual_unenv_global_polyfill-(.+)$/;
+  const prefix = resolvePath(virtualBase, "_virtual_unenv_global_polyfill-");
+  const injectsByModule = /* @__PURE__ */ new Map();
+  const virtualModulePathToSpecifier = /* @__PURE__ */ new Map();
+  for (const [injectedName, moduleSpecifier] of Object.entries(inject)) {
+    const [module, exportName, importName] = Array.isArray(moduleSpecifier) ? [
+      moduleSpecifier[0] ?? "",
+      moduleSpecifier[1] ?? "",
+      moduleSpecifier[1] ?? ""
+    ] : [moduleSpecifier, "default", "defaultExport"];
+    if (!injectsByModule.has(module)) {
+      injectsByModule.set(module, []);
+      virtualModulePathToSpecifier.set(
+        prefix + module.replaceAll("/", "-"),
+        module
+      );
+    }
+    injectsByModule.get(module)?.push({ injectedName, exportName, importName });
+  }
+  build.initialOptions.inject = [
+    ...build.initialOptions.inject ?? [],
+    ...virtualModulePathToSpecifier.keys(),
+    ...polyfill.map((module) => require2.resolve(module))
+  ];
+  build.onResolve({ filter: UNENV_VIRTUAL_MODULE_RE }, ({ path }) => ({
+    path
+  }));
+  build.onLoad({ filter: UNENV_VIRTUAL_MODULE_RE }, ({ path }) => {
+    const module = virtualModulePathToSpecifier.get(path);
+    const injects = module === void 0 ? void 0 : injectsByModule.get(module);
+    if (module === void 0 || injects === void 0)
+      throw new Error(`Expected ${path} to be mapped to a module specifier`);
+    const imports = injects.map(
+      ({ exportName, importName }) => importName === exportName ? exportName : `${exportName} as ${importName}`
+    );
+    return {
+      resolveDir: MODULE_DIR,
+      contents: `import { ${imports.join(", ")} } from "${module}";
+${injects.map(
+        ({ injectedName, importName }) => `globalThis.${injectedName} = ${importName};`
+      ).join("\n")}`
+    };
+  });
+}
+
+// ../../packages/functions-bundler/src/deno-imports.ts
+import { existsSync as existsSync9, readFileSync as readFileSync9, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join29, relative as relative8, sep as sep8 } from "path";
+
+// ../../packages/functions-bundler/src/import-map.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8, realpathSync } from "fs";
+import { basename as basename4, dirname as dirname8, join as join28, resolve as resolve12, sep as sep7 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+
+// ../../packages/functions-bundler/src/printable.ts
+var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable(text3) {
+  return text3.replace(UNPRINTABLE, "?");
+}
+function causeLine(error51) {
+  const text3 = error51 instanceof Error ? error51.message : String(error51);
+  return printable(
+    text3.split("\n").map((line) => line.trim()).find((line) => line.length > 0) ?? "unknown error"
+  );
+}
+
+// ../../packages/functions-bundler/src/import-map.ts
+var FILES = ["deno.json", "deno.jsonc", "import_map.json"];
+var DENO_CONFIGS = /* @__PURE__ */ new Set(["deno.json", "deno.jsonc"]);
+function expandBareKeys(imports) {
+  const out = {};
+  for (const [key, value] of Object.entries(imports)) {
+    out[key] = value;
+    if (key.endsWith("/") || Object.hasOwn(imports, `${key}/`)) continue;
+    if (value.endsWith("/")) continue;
+    const scheme = value.startsWith("jsr:") ? "jsr:" : value.startsWith("npm:") ? "npm:" : null;
+    if (scheme === null) continue;
+    const rest = value.slice(scheme.length).replace(/^\//, "");
+    out[`${key}/`] = `${scheme}/${rest}/`;
+  }
+  return out;
+}
+function load(file2, label2) {
+  let parsed;
+  try {
+    parsed = parseJsonc2(readFileSync8(file2, "utf8"));
+  } catch {
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.importMapInvalid(label2)
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const imports = parsed.imports;
+  if (imports === void 0) return null;
+  if (typeof imports !== "object" || imports === null || Array.isArray(imports) || Object.values(imports).some((target2) => typeof target2 !== "string"))
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.importMapShape(label2)
+    );
+  const written = imports;
+  for (const [key, value] of Object.entries(written))
+    if (key.endsWith("/") && !value.endsWith("/"))
+      throw new FunctionBundleError(
+        "VALIDATION_FAILED",
+        printable(BUNDLE_MESSAGES.importMapPrefix(label2, key, value))
+      );
+  return {
+    imports: DENO_CONFIGS.has(basename4(file2)) ? expandBareKeys(written) : written,
+    base: dirname8(file2),
+    label: label2
+  };
+}
+function readImportMapFile(file2, label2) {
+  if (!existsSync8(file2))
+    throw new FunctionBundleError(
+      "VALIDATION_FAILED",
+      BUNDLE_MESSAGES.importMapMissing(label2)
+    );
+  return load(file2, label2);
+}
+function readImportMap(functionDir, fallback, labelOf) {
+  for (const name of FILES) {
+    const file2 = join28(functionDir, name);
+    if (!existsSync8(file2)) continue;
+    const map2 = load(file2, labelOf(file2));
+    if (map2 !== null) return map2;
+  }
+  if (fallback === void 0 || fallback === null) return null;
+  return typeof fallback === "string" ? readImportMapFile(fallback, labelOf(fallback)) : fallback;
+}
+function realPath(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return path;
+  }
+}
+var isPathLike = (text3) => text3.startsWith("./") || text3.startsWith("../") || text3.startsWith("/");
+function filePath(text3) {
+  if (!text3.startsWith("file:")) return null;
+  try {
+    return fileURLToPath3(text3);
+  } catch {
+    return null;
+  }
+}
+function realKey(path, trailing) {
+  const real = realPath(path);
+  return trailing && !real.endsWith(sep7) ? `${real}${sep7}` : real;
+}
+var normalized = /* @__PURE__ */ new WeakMap();
+function keysOf(map2) {
+  const cached2 = normalized.get(map2);
+  if (cached2 !== void 0) return cached2;
+  const base2 = realPath(map2.base);
+  const keys = /* @__PURE__ */ new Map();
+  for (const [key, target2] of Object.entries(map2.imports)) {
+    const trailing = key.endsWith("/");
+    const file2 = filePath(key);
+    const name = file2 !== null ? realKey(file2, trailing) : isPathLike(key) ? realKey(resolve12(base2, key), trailing) : key;
+    if (!keys.has(name)) keys.set(name, target2);
+  }
+  normalized.set(map2, keys);
+  return keys;
+}
+function mapSpecifier(map2, specifier, importerDir) {
+  let lookup = specifier;
+  const trailing = specifier.endsWith("/");
+  const file2 = filePath(specifier);
+  if (file2 !== null) lookup = realKey(file2, trailing);
+  else if (specifier.startsWith("/"))
+    lookup = realKey(resolve12(specifier), trailing);
+  else if (isPathLike(specifier)) {
+    if (importerDir === void 0) return null;
+    lookup = realKey(resolve12(importerDir, specifier), trailing);
+  }
+  const keys = keysOf(map2);
+  let target2 = keys.get(lookup);
+  if (target2 === void 0) {
+    let prefix;
+    for (const key of keys.keys())
+      if ((key.endsWith("/") || key.endsWith(sep7)) && lookup.startsWith(key) && (prefix === void 0 || key.length > prefix.length))
+        prefix = key;
+    if (prefix === void 0) return null;
+    target2 = `${keys.get(prefix) ?? ""}${lookup.slice(prefix.length)}`;
+  }
+  if (target2.startsWith("./") || target2.startsWith("../"))
+    return resolve12(map2.base, target2);
+  return filePath(target2) ?? target2;
+}
+
+// ../../packages/functions-bundler/src/range.ts
+function parse3(text3) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(text3.trim());
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function partial2(text3) {
+  if (!/^\d+(\.\d+){0,2}$/.test(text3)) return null;
+  return text3.split(".").map(Number);
+}
+function compare2(a, b) {
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (a[i] ?? 0) - (b[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+var filled = (parts) => [
+  parts[0] ?? 0,
+  parts[1] ?? 0,
+  parts[2] ?? 0
+];
+function inRange(versionText, rangeText) {
+  const version3 = parse3(versionText);
+  if (version3 === null) return null;
+  const range = rangeText.trim();
+  if (range === "" || range === "*" || range === "latest") return true;
+  const operator = /^(\^|~|>=)?(.*)$/.exec(range);
+  const op = operator?.[1] ?? "";
+  const parts = partial2(operator?.[2] ?? "");
+  if (parts === null) return null;
+  const floor = filled(parts);
+  if (op === ">=") return compare2(version3, floor) >= 0;
+  if (op === "") return parts.every((part, i) => version3[i] === part);
+  if (compare2(version3, floor) < 0) return false;
+  if (op === "~")
+    return version3[0] === floor[0] && (parts.length < 2 || version3[1] === floor[1]);
+  if (floor[0] !== 0 || parts.length === 1) return version3[0] === floor[0];
+  if (floor[1] !== 0 || parts.length === 2)
+    return version3[0] === 0 && version3[1] === floor[1];
+  return version3[0] === 0 && version3[1] === 0 && version3[2] === floor[2];
+}
+
+// ../../packages/functions-bundler/src/deno-imports.ts
+var MISSING_NAMESPACE = "naro-missing-package";
+var MAPPED = "naroMapped";
+function parseNpm(text3) {
+  const scoped = text3.startsWith("@");
+  const slash = text3.indexOf("/", scoped ? text3.indexOf("/") + 1 : 0);
+  const head = slash === -1 ? text3 : text3.slice(0, slash);
+  const sub = slash === -1 ? "" : text3.slice(slash);
+  const at = head.indexOf("@", scoped ? 1 : 0);
+  return at === -1 ? { pkg: head, range: void 0, sub } : { pkg: head.slice(0, at), range: head.slice(at + 1) || void 0, sub };
+}
+var afterScheme = (specifier) => specifier.slice(4).replace(/^\//, "");
+var isPackageName = (pkg) => pkg.startsWith("@") ? /^@[^/]+\/[^/]+$/.test(pkg) : /^[^/]+$/.test(pkg);
+var refuse2 = (text3) => ({ errors: [{ text: printable(text3) }] });
+var installOf = (pkg, range) => range ? `${pkg}@${range}` : pkg;
+function realPath2(path) {
+  try {
+    return realpathSync2.native(path);
+  } catch {
+    return path;
+  }
+}
+var fromRoot = (projectRoot, path) => relative8(projectRoot, path).split(sep8).join("/");
+function isInside(path, projectRoot) {
+  const rel = relative8(projectRoot, path);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep8}`) && !isAbsolute5(rel);
+}
+function packageDir(from, projectRoot) {
+  let current = from;
+  while (isInside(current, projectRoot)) {
+    const inNodeModules = fromRoot(projectRoot, current).split("/").includes("node_modules");
+    if (!inNodeModules && existsSync9(join29(current, "package.json")))
+      return fromRoot(projectRoot, current) || ".";
+    const up = dirname9(current);
+    if (up === current) break;
+    current = up;
+  }
+  return ".";
+}
+function isInstalled(from, pkg) {
+  if (pkg === "") return false;
+  let current = from;
+  for (; ; ) {
+    if (existsSync9(join29(current, "node_modules", pkg))) return true;
+    const up = dirname9(current);
+    if (up === current) return false;
+    current = up;
+  }
+}
+var NODE_MODULES = /[\\/]node_modules[\\/]/;
+function installedVersion(resolved, pkg) {
+  let current = dirname9(resolved);
+  for (; ; ) {
+    const file2 = join29(current, "package.json");
+    if (existsSync9(file2)) {
+      try {
+        const manifest2 = JSON.parse(readFileSync9(file2, "utf8"));
+        if (manifest2.name === pkg && typeof manifest2.version === "string")
+          return manifest2.version;
+      } catch {
+      }
+    }
+    const up = dirname9(current);
+    if (up === current) return null;
+    current = up;
+  }
+}
+var byCodePoint = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function missingPackagesMessage(unsorted) {
+  return printable(installSentence(unsorted));
+}
+function installSentence(unsorted) {
+  const missing = [...unsorted].sort(
+    (a, b) => byCodePoint(`${a.kind}:${a.spec}`, `${b.kind}:${b.spec}`)
+  );
+  const [only] = missing;
+  if (missing.length === 1 && only !== void 0)
+    return only.kind === "npm" ? BUNDLE_MESSAGES.npmMissing(only.spec, only.install, only.dir) : BUNDLE_MESSAGES.jsrMissing(only.spec, only.install);
+  return BUNDLE_MESSAGES.missingMany(
+    missing.map((item) => `${item.kind}:${item.spec}`),
+    // npm:zod@3 and npm:zod@3/x need one zod@3; zod@3 and zod@4 stay two.
+    [...new Set(missing.map((item) => item.install))].sort(byCodePoint),
+    missing.some((item) => item.kind === "jsr")
+  );
+}
+var ESM_SH_NOT_NPM = /* @__PURE__ */ new Set(["stable", "gh", "jsr", "pr"]);
+var URL_IMPORT = /^https?:\/\//;
+var WASM = /\.wasm(\?.*)?$/;
+function urlRefusal(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    return BUNDLE_MESSAGES.urlOther(url2);
+  }
+  if (parsed.hostname === "esm.sh") {
+    const path = parsed.pathname.replace(/^\/v\d+(?=\/)/, "");
+    const first = path.split("/")[1] ?? "";
+    if (ESM_SH_NOT_NPM.has(first) || first.startsWith("*"))
+      return BUNDLE_MESSAGES.urlOther(url2);
+    const match = /^\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/?]+))?/.exec(path);
+    if (match?.[1])
+      return BUNDLE_MESSAGES.urlNpm(
+        url2,
+        `npm:${installOf(match[1], match[2])}`
+      );
+  }
+  if (parsed.hostname === "deno.land") {
+    const match = /^\/std(?:@[^/]+)?\/([^/]+)/.exec(parsed.pathname);
+    if (match?.[1]) return BUNDLE_MESSAGES.urlStd(url2, match[1]);
+  }
+  return BUNDLE_MESSAGES.urlOther(url2);
+}
+function denoImportsPlugin(options) {
+  const { importMap, state } = options;
+  const projectRoot = realPath2(options.projectRoot);
+  const seenMissing = /* @__PURE__ */ new Set();
+  return {
+    name: "naro-deno-imports",
+    setup(build) {
+      build.onStart(() => {
+        state.missing.length = 0;
+        state.warnings.length = 0;
+        seenMissing.clear();
+      });
+      const rewritten = async (kind, written, spec, target2, args) => {
+        const result = await build.resolve(target2, {
+          kind: args.kind,
+          resolveDir: args.resolveDir,
+          importer: args.importer,
+          pluginData: { [MAPPED]: true }
+        });
+        const pkgName = kind === "npm" ? spec.pkg : target2.split("/").slice(0, 2).join("/");
+        if (result.errors.length > 0) {
+          if (isInstalled(args.resolveDir, pkgName))
+            return { errors: result.errors };
+          if (!seenMissing.has(`${kind}:${written}`)) {
+            seenMissing.add(`${kind}:${written}`);
+            state.missing.push({
+              kind,
+              spec: written,
+              install: installOf(pkgName, spec.range),
+              dir: packageDir(args.resolveDir, projectRoot)
+            });
+          }
+          return { path: `${kind}:${written}`, namespace: MISSING_NAMESPACE };
+        }
+        if (spec.range) {
+          const version3 = installedVersion(result.path, pkgName);
+          if (version3 !== null && inRange(version3, spec.range) === false) {
+            const warning = printable(
+              BUNDLE_MESSAGES.outOfRange(
+                pkgName,
+                version3,
+                spec.range,
+                fromRoot(projectRoot, args.importer)
+              )
+            );
+            if (!state.warnings.includes(warning)) state.warnings.push(warning);
+          }
+        }
+        return {
+          path: result.path,
+          external: result.external,
+          namespace: result.namespace,
+          sideEffects: result.sideEffects
+        };
+      };
+      build.onResolve({ filter: /.*/, namespace: "file" }, async (args) => {
+        if (importMap === null || args.kind === "entry-point") return void 0;
+        if (NODE_MODULES.test(args.importer)) return void 0;
+        if (args.pluginData?.[MAPPED])
+          return void 0;
+        const mapped = mapSpecifier(importMap, args.path, args.resolveDir);
+        if (mapped === null) return void 0;
+        if (WASM.test(mapped)) return refuse2(BUNDLE_MESSAGES.wasm(args.path));
+        if (URL_IMPORT.test(mapped)) return refuse2(urlRefusal(mapped));
+        const result = await build.resolve(mapped, {
+          kind: args.kind,
+          resolveDir: args.resolveDir,
+          importer: args.importer,
+          pluginData: { [MAPPED]: true }
+        });
+        if (result.errors.length > 0) return { errors: result.errors };
+        return {
+          path: result.path,
+          external: result.external,
+          namespace: result.namespace,
+          sideEffects: result.sideEffects
+        };
+      });
+      build.onResolve({ filter: /^npm:/ }, async (args) => {
+        const written = afterScheme(args.path);
+        const spec = parseNpm(written);
+        if (!isPackageName(spec.pkg))
+          return refuse2(BUNDLE_MESSAGES.noPackageName(args.path, "npm:zod@3"));
+        return rewritten("npm", written, spec, `${spec.pkg}${spec.sub}`, args);
+      });
+      build.onResolve({ filter: /^jsr:/ }, async (args) => {
+        const written = afterScheme(args.path);
+        const spec = parseNpm(written);
+        if (spec.pkg !== "" && !spec.pkg.startsWith("@"))
+          return refuse2(BUNDLE_MESSAGES.jsrNoScope(written));
+        if (!isPackageName(spec.pkg))
+          return refuse2(
+            BUNDLE_MESSAGES.noPackageName(args.path, "jsr:@std/http@1")
+          );
+        const [scope, name] = spec.pkg.slice(1).split("/");
+        return rewritten(
+          "jsr",
+          written,
+          spec,
+          `@jsr/${scope ?? ""}__${name ?? ""}${spec.sub}`,
+          args
+        );
+      });
+      build.onResolve(
+        { filter: URL_IMPORT },
+        (args) => refuse2(urlRefusal(args.path))
+      );
+      build.onResolve(
+        { filter: WASM },
+        (args) => refuse2(BUNDLE_MESSAGES.wasm(args.path))
+      );
+      build.onLoad({ filter: /.*/, namespace: MISSING_NAMESPACE }, () => ({
+        contents: "module.exports = {};",
+        loader: "js"
+      }));
+      build.onEnd(
+        () => state.missing.length === 0 ? void 0 : { errors: [{ text: missingPackagesMessage(state.missing) }] }
+      );
+    }
+  };
+}
+
+// ../../packages/functions-bundler/src/bundle.ts
+import { createHash as createHash4 } from "crypto";
+import { join as join30, relative as relative9, sep as sep9 } from "path";
+import { gzipSync } from "zlib";
+
+// ../../packages/functions-runtime/dist/index.js
+var NARO_SHIM_MODULE = "naro-shim.js";
+var NARO_USER_MODULE = "user.js";
+var NARO_BOOT_MODULE = "naro-boot.js";
+var NARO_ENTRY_SOURCE = '// src/naro-entry.ts\nimport "./naro-shim.js";\nimport * as user from "./user.js";\n\n// src/context.ts\nvar CONTEXT_HEADER = "x-naro-context";\nvar MAX_CONTEXT_LENGTH = 4096;\nvar BASE64URL = /^[A-Za-z0-9_-]+$/;\nvar TRACE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;\nvar MAX_HOP = 1e3;\nvar ROLES = /* @__PURE__ */ new Set([\n  "anon",\n  "authenticated",\n  "service"\n]);\nfunction fieldsOf(value) {\n  if (typeof value !== "object" || value === null || Array.isArray(value))\n    return null;\n  return value;\n}\nfunction own(fields, key) {\n  return Object.hasOwn(fields, key) ? fields[key] : void 0;\n}\nfunction nonEmptyText(value) {\n  return typeof value === "string" && value !== "";\n}\nvar MAX_USER_ID_LENGTH = 256;\nfunction headerSafeId(value) {\n  if (!nonEmptyText(value) || value.length > MAX_USER_ID_LENGTH) return false;\n  if (value.trim() !== value) return false;\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code < 32 || code >= 127 && code <= 159) return false;\n    if (code >= 55296 && code <= 57343) {\n      const next = value.charCodeAt(index + 1);\n      if (code >= 56320 || !(next >= 56320 && next <= 57343)) return false;\n      index += 1;\n    }\n  }\n  return true;\n}\nfunction userOf(value) {\n  const fields = fieldsOf(value);\n  if (fields === null) return null;\n  const id = own(fields, "id");\n  const email = own(fields, "email");\n  const emailVerified = own(fields, "emailVerified");\n  if (!headerSafeId(id)) return null;\n  if (email !== null && typeof email !== "string") return null;\n  if (typeof emailVerified !== "boolean") return null;\n  return { id, email, emailVerified };\n}\nfunction contextOf(value, projectId, name) {\n  const fields = fieldsOf(value);\n  if (fields === null) return null;\n  if (own(fields, "v") !== 1) return null;\n  if (own(fields, "projectId") !== projectId) return null;\n  if (own(fields, "function") !== name) return null;\n  const traceId = own(fields, "traceId");\n  if (typeof traceId !== "string" || !TRACE_ID_RE.test(traceId)) return null;\n  const hop = own(fields, "hop");\n  if (typeof hop !== "number" || !Number.isInteger(hop) || hop < 0 || hop > MAX_HOP)\n    return null;\n  const role = own(fields, "role");\n  if (role !== null && !ROLES.has(role)) return null;\n  const sentUser = own(fields, "user");\n  let user2 = null;\n  if (role === "authenticated") {\n    user2 = userOf(sentUser);\n    if (user2 === null) return null;\n  } else if (sentUser !== null) return null;\n  return {\n    v: 1,\n    projectId,\n    function: name,\n    role,\n    user: user2,\n    traceId,\n    hop\n  };\n}\nfunction bytesOf(value) {\n  if (!BASE64URL.test(value) || value.length % 4 === 1) return null;\n  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");\n  let binary;\n  try {\n    binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));\n  } catch {\n    return null;\n  }\n  const again = btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");\n  if (again !== value) return null;\n  return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n}\nfunction decodeContext(value, bindings) {\n  const projectId = bindings.NARO_PROJECT_ID;\n  const name = bindings.NARO_FUNCTION_NAME;\n  if (!nonEmptyText(projectId) || !nonEmptyText(name)) return null;\n  if (typeof value !== "string" || value.length > MAX_CONTEXT_LENGTH)\n    return null;\n  const bytes = bytesOf(value);\n  if (bytes === null) return null;\n  let parsed;\n  try {\n    parsed = JSON.parse(\n      new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)\n    );\n  } catch {\n    return null;\n  }\n  return contextOf(parsed, projectId, name);\n}\n\n// src/rejections.ts\nfunction loggedRejection(promise, name) {\n  return Promise.resolve(promise).then(\n    () => void 0,\n    (error) => {\n      console.error(`naro functions: ${name} waitUntil rejected`, error);\n    }\n  );\n}\n\n// src/respond.ts\nvar FUNCTION_EXPOSE_HEADERS = [\n  "x-relay-error",\n  "x-naro-trace-id",\n  "retry-after",\n  "x-retry-after"\n];\nvar WRAPPER_ERRORS = {\n  FUNCTION_ERROR: "The function threw an error. See `naro functions logs {name}`.",\n  FUNCTION_NO_HANDLER: "The function has no handler. Call Deno.serve(handler) or export default { fetch }.",\n  FUNCTION_MISROUTED: "This function was reached without the Naro gateway."\n};\nfunction appendExposeHeaders(value) {\n  const listed = (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "");\n  const seen = new Set(listed.map((part) => part.toLowerCase()));\n  for (const name of FUNCTION_EXPOSE_HEADERS)\n    if (!seen.has(name)) listed.push(name);\n  return listed.join(", ");\n}\nfunction wrapperError(code, name, traceId) {\n  const headers = new Headers({\n    "access-control-allow-origin": "*",\n    "access-control-expose-headers": appendExposeHeaders(null),\n    "cache-control": "no-store"\n  });\n  if (traceId !== null) headers.set("x-naro-trace-id", traceId);\n  return Response.json(\n    {\n      data: null,\n      error: {\n        code,\n        // A function, not a string: `$&` in a name stays as it is.\n        message: WRAPPER_ERRORS[code].replace("{name}", () => name)\n      }\n    },\n    { status: 500, headers }\n  );\n}\nfunction withFunctionHeaders(response, traceId) {\n  if (response.status === 101) return response;\n  const out = new Response(response.body, response);\n  const headers = out.headers;\n  headers.delete("x-relay-error");\n  if (!headers.has("access-control-allow-origin"))\n    headers.set("access-control-allow-origin", "*");\n  headers.set(\n    "access-control-expose-headers",\n    appendExposeHeaders(headers.get("access-control-expose-headers"))\n  );\n  headers.set("x-naro-trace-id", traceId);\n  return out;\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar CONTEXT_KEY = /* @__PURE__ */ Symbol.for("naro.functions.context");\nvar SHIM_FIRST = "The Naro functions shim must be imported before the wrapper.";\nfunction globals() {\n  return globalThis;\n}\nfunction runtimeState() {\n  const state2 = globals()[RUNTIME_KEY];\n  if (state2 === void 0) throw new Error(SHIM_FIRST);\n  return state2;\n}\nfunction callContexts() {\n  const contexts2 = globals()[CONTEXT_KEY];\n  if (contexts2 === void 0) throw new Error(SHIM_FIRST);\n  return contexts2;\n}\n\n// src/naro-entry.ts\nvar state = runtimeState();\nvar contexts = callContexts();\nasync function serveWithInfo(registered, request) {\n  let complete;\n  const info = {\n    remoteAddr: {\n      transport: "tcp",\n      hostname: request.headers.get("cf-connecting-ip") ?? "0.0.0.0",\n      port: 0\n    },\n    completed: new Promise((resolve) => {\n      complete = resolve;\n    })\n  };\n  try {\n    return await registered(request, info);\n  } finally {\n    complete();\n  }\n}\nfunction chooseHandler() {\n  const registered = state.handler;\n  if (registered !== null)\n    return {\n      handler: async (request) => serveWithInfo(registered, request),\n      onError: state.onError\n    };\n  const exported = user.default;\n  if (typeof exported === "object" && exported !== null) {\n    const fetchHandler = exported.fetch;\n    if (typeof fetchHandler === "function")\n      return {\n        handler: async (request, env, ctx) => fetchHandler.call(exported, request, env, ctx),\n        onError: null\n      };\n  }\n  if (typeof exported === "function") {\n    const prototype = exported.prototype;\n    if (typeof prototype === "object" && prototype !== null && typeof prototype.fetch === "function")\n      return {\n        handler: async (request, env, ctx) => new exported(ctx, env).fetch(request),\n        onError: null\n      };\n    return {\n      handler: async (request, env, ctx) => exported(request, env, ctx),\n      onError: null\n    };\n  }\n  return null;\n}\nfunction callerRequest(request, context) {\n  const headers = new Headers();\n  for (const [name, value] of request.headers)\n    if (!name.startsWith("x-naro-")) headers.append(name, value);\n  if (context.role !== null) headers.set("x-naro-role", context.role);\n  if (context.user !== null) headers.set("x-naro-user-id", context.user.id);\n  headers.set("x-naro-trace-id", context.traceId);\n  return new Request(request, { headers });\n}\nfunction logWaitUntilRejections(ctx, name) {\n  const waitUntil = ctx.waitUntil.bind(ctx);\n  try {\n    Object.defineProperty(ctx, "waitUntil", {\n      configurable: true,\n      writable: true,\n      value: (promise) => waitUntil(loggedRejection(promise, name))\n    });\n  } catch {\n  }\n}\nfunction textOf(value) {\n  return typeof value === "string" ? value : "";\n}\nfunction responseOf(value, what) {\n  if (value instanceof Response) return value;\n  throw new TypeError(`${what} did not return a Response.`);\n}\nasync function answerOf(chosen, name, request, env, ctx) {\n  try {\n    return responseOf(await chosen.handler(request, env, ctx), "The handler");\n  } catch (error) {\n    if (chosen.onError === null) {\n      console.error(`naro functions: ${name} threw`, error);\n      return null;\n    }\n    try {\n      return responseOf(await chosen.onError(error), "onError");\n    } catch (failed) {\n      console.error(`naro functions: ${name} threw`, error, failed);\n      return null;\n    }\n  }\n}\nasync function answerCall(request, env, ctx, seen) {\n  const name = textOf(env.NARO_FUNCTION_NAME);\n  const context = decodeContext(request.headers.get(CONTEXT_HEADER), env);\n  if (context === null) return wrapperError("FUNCTION_MISROUTED", name, null);\n  let forwarded;\n  try {\n    forwarded = callerRequest(request, context);\n  } catch (error) {\n    console.error(`naro functions: ${name} misrouted`, error);\n    return wrapperError("FUNCTION_MISROUTED", name, null);\n  }\n  seen.traceId = context.traceId;\n  const call = {\n    role: context.role,\n    user: context.user,\n    traceId: context.traceId\n  };\n  contexts.set(forwarded, call);\n  const chosen = chooseHandler();\n  if (chosen === null)\n    return wrapperError("FUNCTION_NO_HANDLER", name, context.traceId);\n  logWaitUntilRejections(ctx, name);\n  const answer = await state.requests.run(\n    { ctx, hop: context.hop, traceId: context.traceId, call },\n    () => answerOf(chosen, name, forwarded, env, ctx)\n  );\n  if (answer === null)\n    return wrapperError("FUNCTION_ERROR", name, context.traceId);\n  try {\n    return withFunctionHeaders(answer, context.traceId);\n  } catch (error) {\n    console.error(\n      `naro functions: ${name} answered with a response that cannot be sent`,\n      error\n    );\n    return wrapperError("FUNCTION_ERROR", name, context.traceId);\n  }\n}\nvar naro_entry_default = {\n  async fetch(request, env, ctx) {\n    const seen = { traceId: null };\n    let answer;\n    try {\n      answer = await answerCall(request, env, ctx, seen);\n    } catch (error) {\n      return state.lastResort(error, seen.traceId);\n    }\n    if (state.isResponse(answer)) return answer;\n    return state.lastResort(\n      new TypeError("The wrapper\'s answer is not a Response."),\n      seen.traceId\n    );\n  }\n};\nexport {\n  naro_entry_default as default\n};\n';
+var NARO_SHIM_SOURCE = '// src/naro-shim.ts\nimport { AsyncLocalStorage } from "node:async_hooks";\nimport { env } from "cloudflare:workers";\n\n// src/hosts.ts\nfunction bareHost(host) {\n  return host.toLowerCase().replace(/\\.+$/, "");\n}\nfunction isNaroHost(hostname, rootDomain2, naroUrl2) {\n  const host = bareHost(hostname);\n  if (host === "") return false;\n  const root = rootDomain2.toLowerCase().replace(/^\\.+|\\.+$/g, "");\n  if (root !== "" && host.endsWith(`.${root}`)) return true;\n  if (naroUrl2 === "") return false;\n  try {\n    return bareHost(new URL(naroUrl2).hostname) === host;\n  } catch {\n    return false;\n  }\n}\n\n// src/redact.ts\nvar MIN_REDACTED_LENGTH = 8;\nvar REDACTED = "[redacted]";\nfunction isSecretBinding(name) {\n  return name === "NARO_SERVICE_KEY" || !name.startsWith("NARO_") && name !== "DB";\n}\nfunction secretValues(bindings2) {\n  const values = /* @__PURE__ */ new Set();\n  for (const [name, value] of Object.entries(bindings2)) {\n    if (typeof value !== "string" || value.length < MIN_REDACTED_LENGTH)\n      continue;\n    if (!isSecretBinding(name)) continue;\n    values.add(value);\n    values.add(JSON.stringify(value).slice(1, -1));\n  }\n  return [...values].toSorted(\n    (left, right) => right.length - left.length || (left < right ? -1 : left > right ? 1 : 0)\n  );\n}\nfunction redactText(text, secrets2) {\n  const spans = [];\n  for (const secret of secrets2) {\n    if (secret === "") continue;\n    let last;\n    for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1)) {\n      if (last !== void 0 && at <= last[1]) last[1] = at + secret.length;\n      else spans.push(last = [at, at + secret.length]);\n    }\n  }\n  if (spans.length === 0) return text;\n  const ordered = spans.toSorted((left, right) => left[0] - right[0]);\n  let out = "";\n  let kept = 0;\n  let [start, end] = ordered[0];\n  for (const [nextStart, nextEnd] of ordered) {\n    if (nextStart <= end) {\n      end = Math.max(end, nextEnd);\n      continue;\n    }\n    out += text.slice(kept, start) + REDACTED;\n    kept = end;\n    start = nextStart;\n    end = nextEnd;\n  }\n  return out + text.slice(kept, start) + REDACTED + text.slice(end);\n}\nfunction stringOf(value) {\n  try {\n    return String(value);\n  } catch {\n    return void 0;\n  }\n}\nfunction withHead(stack, head) {\n  if (stack === head || stack.startsWith(`${head}\n`)) return stack;\n  const frames = stack.indexOf("\\n    at ");\n  return frames === -1 ? `${head}\n${stack}` : `${head}${stack.slice(frames)}`;\n}\nfunction redactError(error, secrets2) {\n  const stack = typeof error.stack === "string" ? error.stack : `${error.name}: ${error.message}`;\n  const head = stringOf(error);\n  let json;\n  try {\n    json = JSON.stringify(error);\n  } catch {\n    json = void 0;\n  }\n  const cleanStack = redactText(stack, secrets2);\n  const cleanHead = head === void 0 ? void 0 : redactText(head, secrets2);\n  const cleanJson = json === void 0 ? void 0 : redactText(json, secrets2);\n  if (cleanStack === stack && head !== void 0 && cleanHead === head && json !== void 0 && cleanJson === json)\n    return error;\n  const text = cleanHead === void 0 ? cleanStack : withHead(cleanStack, cleanHead);\n  return cleanJson === void 0 || cleanJson === "{}" ? text : `${text}\n${cleanJson}`;\n}\nfunction isPlain(value) {\n  if (Array.isArray(value)) return true;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\nfunction redactArg(arg, secrets2) {\n  if (typeof arg === "string") return redactText(arg, secrets2);\n  if (arg === null || typeof arg !== "object" && typeof arg !== "function")\n    return arg;\n  try {\n    if (arg instanceof Error) return redactError(arg, secrets2);\n    let json;\n    try {\n      json = JSON.stringify(arg);\n    } catch {\n      return redactText(String(arg), secrets2);\n    }\n    if (json !== void 0) {\n      const clean2 = redactText(json, secrets2);\n      if (clean2 !== json) return clean2;\n    }\n    if (isPlain(arg)) return arg;\n    const text = stringOf(arg);\n    if (text === void 0) return arg;\n    const clean = redactText(text, secrets2);\n    return clean === text ? arg : clean;\n  } catch {\n    return REDACTED;\n  }\n}\nfunction redactArgs(args, secrets2) {\n  if (secrets2.length === 0) return [...args];\n  return args.map((arg) => redactArg(arg, secrets2));\n}\n\n// src/rejections.ts\nfunction loggedRejection(promise, name) {\n  return Promise.resolve(promise).then(\n    () => void 0,\n    (error) => {\n      console.error(`naro functions: ${name} waitUntil rejected`, error);\n    }\n  );\n}\n\n// src/respond.ts\nvar FUNCTION_EXPOSE_HEADERS = [\n  "x-relay-error",\n  "x-naro-trace-id",\n  "retry-after",\n  "x-retry-after"\n];\nvar WRAPPER_ERRORS = {\n  FUNCTION_ERROR: "The function threw an error. See `naro functions logs {name}`.",\n  FUNCTION_NO_HANDLER: "The function has no handler. Call Deno.serve(handler) or export default { fetch }.",\n  FUNCTION_MISROUTED: "This function was reached without the Naro gateway."\n};\nfunction appendExposeHeaders(value) {\n  const listed = (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "");\n  const seen = new Set(listed.map((part) => part.toLowerCase()));\n  for (const name of FUNCTION_EXPOSE_HEADERS)\n    if (!seen.has(name)) listed.push(name);\n  return listed.join(", ");\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar CONTEXT_KEY = /* @__PURE__ */ Symbol.for("naro.functions.context");\n\n// src/naro-shim.ts\nvar bindings = env;\nvar globals = globalThis;\nvar functionName = typeof bindings.NARO_FUNCTION_NAME === "string" ? bindings.NARO_FUNCTION_NAME : "";\nvar secrets = secretValues(bindings);\nfor (const level of ["log", "info", "warn", "error", "debug"]) {\n  const original = console[level].bind(console);\n  console[level] = (...args) => {\n    original(...redactArgs(args, secrets));\n  };\n}\nvar logError = console.error;\nvar NativeResponse = Response;\nvar bareRecord = Object.create;\nvar failedBody = JSON.stringify({\n  data: null,\n  error: {\n    code: "FUNCTION_ERROR",\n    message: WRAPPER_ERRORS.FUNCTION_ERROR.replace(\n      "{name}",\n      () => functionName\n    )\n  }\n});\nvar exposedHeaders = appendExposeHeaders(null);\nfunction lastResort(error, traceId) {\n  try {\n    logError(`naro functions: ${functionName} threw`, error);\n  } catch {\n  }\n  const headers = bareRecord(null);\n  headers["content-type"] = "application/json";\n  headers["access-control-allow-origin"] = "*";\n  headers["access-control-expose-headers"] = exposedHeaders;\n  headers["cache-control"] = "no-store";\n  if (traceId !== null) headers["x-naro-trace-id"] = traceId;\n  const init = bareRecord(null);\n  init.status = 500;\n  init.headers = headers;\n  return new NativeResponse(failedBody, init);\n}\nvar reflectApply = Reflect.apply;\nvar responseStatus = Object.getOwnPropertyDescriptor(\n  NativeResponse.prototype,\n  "status"\n)?.get;\nfunction isResponse(value) {\n  if (typeof value !== "object" || value === null) return false;\n  try {\n    if (responseStatus === void 0) return value instanceof NativeResponse;\n    reflectApply(responseStatus, value, []);\n    return true;\n  } catch {\n    return false;\n  }\n}\nvar state = {\n  handler: null,\n  onError: null,\n  requests: new AsyncLocalStorage(),\n  lastResort,\n  isResponse\n};\nglobals[RUNTIME_KEY] = state;\nglobals[CONTEXT_KEY] = /* @__PURE__ */ new WeakMap();\nvar rootDomain = typeof bindings.NARO_ROOT_DOMAIN === "string" ? bindings.NARO_ROOT_DOMAIN : "";\nvar naroUrl = typeof bindings.NARO_URL === "string" ? bindings.NARO_URL : "";\nvar originalFetch = globalThis.fetch.bind(globalThis);\nasync function naroFetch(input, init) {\n  const store = state.requests.getStore();\n  if (store === void 0) return originalFetch(input, init);\n  let host;\n  try {\n    host = new URL(input instanceof Request ? input.url : String(input)).hostname;\n  } catch {\n    return originalFetch(input, init);\n  }\n  if (!isNaroHost(host, rootDomain, naroUrl)) return originalFetch(input, init);\n  const request = new Request(input, init);\n  const headers = new Headers(request.headers);\n  headers.set("x-naro-fn-hop", String(store.hop + 1));\n  headers.set("x-naro-trace-id", store.traceId);\n  return originalFetch(new Request(request, { headers }));\n}\nglobalThis.fetch = naroFetch;\nvar addListener = EventTarget.prototype.addEventListener;\nvar removeListener = EventTarget.prototype.removeEventListener;\nvar standIns = /* @__PURE__ */ new WeakMap();\nfunction standInFor(socket, listener, store) {\n  let listeners = standIns.get(socket);\n  if (listeners === void 0)\n    standIns.set(socket, listeners = /* @__PURE__ */ new WeakMap());\n  let standIn = listeners.get(listener);\n  if (standIn === void 0) {\n    standIn = function(event) {\n      state.requests.run(\n        store,\n        () => typeof listener === "function" ? Reflect.apply(listener, this, [event]) : listener.handleEvent(event)\n      );\n    };\n    listeners.set(listener, standIn);\n  }\n  return standIn;\n}\nObject.defineProperties(WebSocket.prototype, {\n  addEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const store = state.requests.getStore();\n      const runs = store !== void 0 && listener !== null && (typeof listener === "function" || typeof listener === "object");\n      return Reflect.apply(addListener, this, [\n        type,\n        runs ? standInFor(this, listener, store) : listener,\n        ...rest\n      ]);\n    }\n  },\n  removeEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const standIn = typeof listener === "function" || typeof listener === "object" && listener !== null ? standIns.get(this)?.get(listener) : void 0;\n      return Reflect.apply(removeListener, this, [\n        type,\n        standIn ?? listener,\n        ...rest\n      ]);\n    }\n  }\n});\nvar ON_EVENTS = ["onopen", "onmessage", "onclose", "onerror"];\nvar onHandlers = /* @__PURE__ */ new WeakMap();\nfunction nativeAccessor(target, name) {\n  for (let at = target; at !== null; at = Object.getPrototypeOf(at)) {\n    const descriptor = Object.getOwnPropertyDescriptor(at, name);\n    if (descriptor === void 0) continue;\n    return descriptor.get !== void 0 && descriptor.set !== void 0 ? { get: descriptor.get, set: descriptor.set } : void 0;\n  }\n  return void 0;\n}\nfor (const name of ON_EVENTS) {\n  const native = nativeAccessor(WebSocket.prototype, name);\n  Object.defineProperty(WebSocket.prototype, name, {\n    configurable: true,\n    enumerable: true,\n    get() {\n      const set = onHandlers.get(this)?.get(name);\n      if (set === void 0)\n        return native === void 0 ? void 0 : Reflect.apply(native.get, this, []);\n      return state.requests.getStore() === void 0 ? set.standIn : set.handler;\n    },\n    set(handler) {\n      const store = state.requests.getStore();\n      const standIn = store !== void 0 && typeof handler === "function" ? standInFor(this, handler, store) : handler;\n      let handlers = onHandlers.get(this);\n      if (handlers === void 0) onHandlers.set(this, handlers = /* @__PURE__ */ new Map());\n      handlers.set(name, { handler, standIn });\n      if (native !== void 0) Reflect.apply(native.set, this, [standIn]);\n    }\n  });\n}\nfunction serve(first, second) {\n  const options = typeof first === "function" ? {} : first ?? {};\n  const handler = typeof first === "function" ? first : second ?? options.handler;\n  if (typeof handler !== "function")\n    throw new TypeError("Deno.serve needs a handler.");\n  state.handler = handler;\n  state.onError = typeof options.onError === "function" ? options.onError : null;\n  return {\n    finished: new Promise(() => {\n    }),\n    shutdown: () => Promise.resolve()\n  };\n}\nfunction textBindings() {\n  const out = {};\n  for (const [name, value] of Object.entries(bindings))\n    if (typeof value === "string") out[name] = value;\n  return out;\n}\nvar build = Object.freeze({\n  os: "linux",\n  arch: "x86_64",\n  target: "x86_64-unknown-linux-gnu",\n  vendor: "unknown",\n  env: "gnu"\n});\nvar version = Object.freeze({\n  deno: "2.1.4",\n  v8: "13.0.245.12",\n  typescript: "5.6.2"\n});\nvar DENO_ERROR_NAMES = [\n  "NotFound",\n  "PermissionDenied",\n  "ConnectionRefused",\n  "ConnectionReset",\n  "ConnectionAborted",\n  "NotConnected",\n  "AddrInUse",\n  "AddrNotAvailable",\n  "BrokenPipe",\n  "AlreadyExists",\n  "InvalidData",\n  "TimedOut",\n  "Interrupted",\n  "WriteZero",\n  "WouldBlock",\n  "UnexpectedEof",\n  "BadResource",\n  "Http",\n  "Busy",\n  "NotSupported",\n  "FilesystemLoop",\n  "IsADirectory",\n  "NetworkUnreachable",\n  "NotADirectory",\n  "NotCapable"\n];\nfunction denoError(name) {\n  const made = { [name]: class extends Error {\n  } }[name];\n  Object.defineProperty(made.prototype, "name", {\n    configurable: true,\n    writable: true,\n    value: name\n  });\n  return made;\n}\nvar errors = Object.freeze(\n  Object.fromEntries(DENO_ERROR_NAMES.map((name) => [name, denoError(name)]))\n);\nvar deno = {\n  serve,\n  env: {\n    get: (name) => {\n      const value = bindings[name];\n      return typeof value === "string" ? value : void 0;\n    },\n    has: (name) => typeof bindings[name] === "string",\n    toObject: () => textBindings(),\n    set: () => {\n      throw new Error("Deno.env.set is not available on Naro Functions.");\n    },\n    delete: () => {\n      throw new Error("Deno.env.delete is not available on Naro Functions.");\n    }\n  },\n  build,\n  version,\n  errors\n};\nvar PROBES = /* @__PURE__ */ new Set(["then", "toJSON"]);\nglobals.Deno = new Proxy(deno, {\n  get(target, property) {\n    if (typeof property === "symbol" || PROBES.has(property)) return void 0;\n    if (Object.hasOwn(target, property)) return target[property];\n    return () => {\n      throw new Error(`Deno.${property} is not available on Naro Functions.`);\n    };\n  }\n});\nglobals.EdgeRuntime = {\n  waitUntil(promise) {\n    const logged = loggedRejection(promise, functionName);\n    state.requests.getStore()?.ctx.waitUntil(logged);\n    return promise;\n  }\n};\naddEventListener("unhandledrejection", (event) => {\n  event.preventDefault();\n  console.error(\n    `naro functions: ${functionName} unhandled rejection`,\n    event.reason\n  );\n});\n';
+var NARO_BOOT_SOURCE = '// src/naro-boot.ts\nimport "./naro-shim.js";\nimport * as user from "./user.js";\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar SHIM_FIRST = "The Naro functions shim must be imported before the wrapper.";\nfunction globals() {\n  return globalThis;\n}\nfunction runtimeState() {\n  const state2 = globals()[RUNTIME_KEY];\n  if (state2 === void 0) throw new Error(SHIM_FIRST);\n  return state2;\n}\n\n// src/naro-boot.ts\nvar BOOT_PATH = "/__naro/boot";\nvar state = runtimeState();\nfunction hasHandler(exported) {\n  if (state.handler !== null) return true;\n  if (typeof exported === "function") return true;\n  return typeof exported === "object" && exported !== null && typeof exported.fetch === "function";\n}\nvar naro_boot_default = {\n  fetch(request) {\n    if (new URL(request.url).pathname !== BOOT_PATH)\n      return new Response("Not found", { status: 404 });\n    return Response.json({ handler: hasHandler(user.default) });\n  }\n};\nexport {\n  naro_boot_default as default\n};\n';
+var FUNCTIONS_COMPATIBILITY_DATE = "2026-08-19";
+var FUNCTIONS_COMPATIBILITY_FLAGS = Object.freeze(["nodejs_compat", "global_fetch_strictly_public"]);
+
+// ../../packages/functions-bundler/src/bundle.ts
+var NARO_JS_FUNCTIONS = /Could not resolve "naro-js\/functions"/;
+var runtimeGzip;
+function runtimeCompressedBytes() {
+  runtimeGzip ??= gzipSync(NARO_ENTRY_SOURCE).byteLength + gzipSync(NARO_SHIM_SOURCE).byteLength;
+  return runtimeGzip;
+}
+function relativeLabel(root, file2) {
+  return relative9(root, file2).split(sep9).join("/");
+}
+function location(message) {
+  return message.location ? `${message.location.file}:${String(message.location.line)}` : null;
+}
+function failure(name, error51, state) {
+  if (error51 instanceof FunctionBundleError) return error51;
+  if (state.missing.length > 0)
+    return new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      missingPackagesMessage(state.missing)
+    );
+  const errors = error51.errors ?? [];
+  if (errors.length === 0)
+    return new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      BUNDLE_MESSAGES.otherBundle(
+        name,
+        error51 instanceof Error ? error51.message : String(error51),
+        null
+      )
+    );
+  const lines = errors.map((message) => {
+    if (NARO_JS_FUNCTIONS.test(message.text))
+      return BUNDLE_MESSAGES.naroJsMissing;
+    if (message.pluginName === "naro-deno-imports") return message.text;
+    return BUNDLE_MESSAGES.otherBundle(name, message.text, location(message));
+  });
+  return new FunctionBundleError(
+    "FUNCTION_BUNDLE_FAILED",
+    [...new Set(lines)].sort().join("\n")
+  );
+}
+async function bundleFunction(source, folder, options = {}) {
+  let build;
+  try {
+    ({ build } = await import("esbuild"));
+  } catch (error51) {
+    throw new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      BUNDLE_MESSAGES.esbuildMissing(source.name, causeLine(error51)),
+      { cause: error51 }
+    );
+  }
+  const importMap = readImportMap(
+    source.dir,
+    options.importMap !== void 0 ? options.importMap : options.importMapFile,
+    (file2) => relativeLabel(folder.root, file2)
+  );
+  const state = { missing: [], warnings: [] };
+  let result;
+  try {
+    result = await build({
+      absWorkingDir: folder.root,
+      entryPoints: [source.entry],
+      outfile: join30(source.dir, NARO_USER_MODULE),
+      bundle: true,
+      write: false,
+      format: "esm",
+      platform: "neutral",
+      target: "es2024",
+      conditions: ["workerd", "worker", "browser"],
+      mainFields: ["browser", "module", "main"],
+      external: ["cloudflare:*"],
+      metafile: true,
+      legalComments: "none",
+      logLevel: "silent",
+      plugins: [
+        denoImportsPlugin({ importMap, state, projectRoot: folder.root }),
+        nodeCompatPlugin({
+          compatibilityDate: FUNCTIONS_COMPATIBILITY_DATE,
+          compatibilityFlags: FUNCTIONS_COMPATIBILITY_FLAGS,
+          virtualBase: folder.root
+        })
+      ]
+    });
+  } catch (error51) {
+    throw failure(source.name, error51, state);
+  }
+  if (state.missing.length > 0)
+    throw new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      missingPackagesMessage(state.missing)
+    );
+  const [output] = result.outputFiles;
+  if (output === void 0 || result.outputFiles.length !== 1)
+    throw new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      BUNDLE_MESSAGES.otherBundle(
+        source.name,
+        "esbuild did not produce exactly one file",
+        null
+      )
+    );
+  const bytes2 = output.contents.byteLength;
+  if (bytes2 > (options.maxBytes ?? FUNCTION_BUNDLE_MAX_BYTES)) {
+    const inputs = Object.values(result.metafile.outputs)[0]?.inputs ?? {};
+    const biggest = Object.entries(inputs).sort(([, a], [, b]) => b.bytesInOutput - a.bytesInOutput).slice(0, 5).map(
+      ([path, input]) => `${path} (${input.bytesInOutput.toLocaleString("en-US")} bytes)`
+    ).join(", ");
+    throw new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      BUNDLE_MESSAGES.tooLarge(source.name, bytes2, biggest)
+    );
+  }
+  const compressedBytes = gzipSync(output.contents).byteLength + runtimeCompressedBytes();
+  if (compressedBytes > (options.maxCompressedBytes ?? FUNCTION_COMPRESSED_BUNDLE_MAX_BYTES))
+    throw new FunctionBundleError(
+      "FUNCTION_BUNDLE_FAILED",
+      BUNDLE_MESSAGES.tooLargeCompressed(source.name, compressedBytes)
+    );
+  return {
+    name: source.name,
+    code: output.text,
+    contents: output.contents,
+    bytes: bytes2,
+    compressedBytes,
+    sha256: createHash4("sha256").update(output.contents).digest("hex"),
+    warnings: [...state.warnings]
+  };
+}
+
+// ../../packages/functions-bundler/src/boot.ts
+var BOOT_PATH = "/__naro/boot";
+var BOOT_TIMEOUT_MS = 3e4;
+var BOOT_SECRET_PLACEHOLDER = "naro-boot-check-placeholder";
+var text2 = (value) => ({ type: "text", value });
+function bindings(name, secretNames) {
+  return {
+    // First, so a name that is also a fixed binding never replaces it.
+    ...Object.fromEntries(
+      secretNames.map((secret) => [secret, text2(BOOT_SECRET_PLACEHOLDER)])
+    ),
+    NARO_PROJECT_ID: text2("00000000-0000-4000-8000-000000000000"),
+    NARO_FUNCTION_NAME: text2(name),
+    NARO_ROOT_DOMAIN: text2("naro.sh"),
+    NARO_URL: text2("https://boot-check.naro.sh"),
+    NARO_ANON_KEY: text2("naro_pk_boot_check"),
+    NARO_SERVICE_KEY: text2("naro_sk_boot_check"),
+    DB: { type: "d1", id: "boot-check" }
+  };
+}
+var WORKERD_SERVICE_HEAD = /^service core:user:naro-boot: /;
+function bootErrorLine(logs, error51) {
+  const logged = logs.find((line2) => line2.includes("Uncaught")) ?? logs.find((line2) => line2.includes("Error"));
+  const raw = logged ?? (error51 instanceof Error ? error51.message : String(error51));
+  const line = raw.split("\n").map((part) => part.trim()).find((part) => part.length > 0) ?? "unknown error";
+  return printable(line.replace(WORKERD_SERVICE_HEAD, ""));
+}
+async function bootCheck(name, code, options = {}) {
+  const timeoutMs = options.timeoutMs ?? BOOT_TIMEOUT_MS;
+  let Miniflare;
+  try {
+    ({ Miniflare } = await import("miniflare"));
+  } catch (error51) {
+    throw new FunctionBundleError(
+      "FUNCTION_BOOT_FAILED",
+      BUNDLE_MESSAGES.miniflareMissing(name, causeLine(error51)),
+      { cause: error51 }
+    );
+  }
+  const logs = [];
+  let mf;
+  let timer;
+  try {
+    mf = new Miniflare({
+      handleStructuredLogs: (log2) => logs.push(log2.message),
+      workers: [
+        {
+          config: {
+            // No `type`: the Miniflare wrangler pins (5.20261006) refuses
+            // the key the functions-runtime tests' older one still takes.
+            name: "naro-boot",
+            compatibilityDate: FUNCTIONS_COMPATIBILITY_DATE,
+            compatibilityFlags: [...FUNCTIONS_COMPATIBILITY_FLAGS],
+            manifest: {
+              mainModule: NARO_BOOT_MODULE,
+              modules: {
+                [NARO_BOOT_MODULE]: { type: "esm", contents: NARO_BOOT_SOURCE },
+                [NARO_SHIM_MODULE]: { type: "esm", contents: NARO_SHIM_SOURCE },
+                [NARO_USER_MODULE]: { type: "esm", contents: code }
+              }
+            },
+            env: bindings(name, options.secretNames ?? [])
+          }
+        }
+      ]
+    });
+    const started = mf;
+    const answer = async () => {
+      await started.ready;
+      const worker = await started.getWorker("naro-boot");
+      const response2 = await worker.fetch(`http://boot.local${BOOT_PATH}`);
+      const body2 = await response2.json().catch(() => null);
+      return { response: response2, body: body2 };
+    };
+    const timedOut = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(
+          new FunctionBundleError(
+            "FUNCTION_BOOT_FAILED",
+            BUNDLE_MESSAGES.bootTimeout(name, timeoutMs)
+          )
+        );
+      }, timeoutMs);
+    });
+    const { response, body } = await Promise.race([answer(), timedOut]);
+    if (response.status !== 200 || body === null)
+      throw new Error(
+        logs[0] ?? `the boot request answered ${String(response.status)}`
+      );
+    if (body.handler !== true)
+      throw new FunctionBundleError(
+        "FUNCTION_BOOT_FAILED",
+        BUNDLE_MESSAGES.noHandler(name)
+      );
+  } catch (error51) {
+    if (error51 instanceof FunctionBundleError) throw error51;
+    throw new FunctionBundleError(
+      "FUNCTION_BOOT_FAILED",
+      BUNDLE_MESSAGES.failedToStart(name, bootErrorLine(logs, error51))
+    );
+  } finally {
+    clearTimeout(timer);
+    await mf?.dispose().catch(() => void 0);
+  }
+}
+
+// src/commands/migration.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
+import { join as join31, relative as relative10 } from "path";
+
+// src/data-environment.ts
+var DATA_ENV_MESSAGES = {
+  name: "--env must be production or an environment name.",
+  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
+  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
+};
+function dataEnvironment(flags) {
+  const value = flags.env;
+  if (value === void 0 || value === "production") return null;
+  if (value === "preview")
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
+  if (environmentSlugProblem(value) !== null)
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
+  return value;
+}
+async function dataClient(context) {
+  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
+}
+function databaseName(environment) {
+  return environment === null ? "the project database" : `the ${environment} environment's database`;
+}
+function enableBackendCommand(environment) {
+  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
+}
+function envFlag(environment) {
+  return environment === null ? "" : ` --env ${environment}`;
+}
+function forEnvironment(text3, environment) {
+  return environmentGuidance(text3, environment);
+}
+
+// src/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+import { Writable } from "stream";
+function confirmHint(defaultYes) {
+  return defaultYes ? "(Y/n)" : "(y/N)";
+}
+function readConfirmAnswer(answer, defaultYes) {
+  const normalized2 = answer.trim().toLowerCase();
+  if (normalized2 === "") return defaultYes;
+  if (normalized2 === "y" || normalized2 === "yes") return true;
+  if (!defaultYes) return false;
+  if (normalized2 === "n" || normalized2 === "no") return false;
+  return null;
+}
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += String(chunk);
+  return data.replace(/\r?\n$/, "");
+}
+var TtyPrompter = class {
+  async ask(question) {
+    const rl = createInterface2({
+      input: process.stdin,
+      output: process.stdout
+    });
+    try {
+      return await new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+    } finally {
+      rl.close();
+    }
+  }
+  async askHidden(question) {
+    let muted = false;
+    const output = new Writable({
+      write(chunk, _enc, done) {
+        if (!muted) process.stdout.write(chunk);
+        done();
+      }
+    });
+    const rl = createInterface2({
+      input: process.stdin,
+      output,
+      terminal: true
+    });
+    try {
+      const answer = new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+      muted = true;
+      const value = await answer;
+      process.stdout.write("\n");
+      return value;
+    } finally {
+      rl.close();
+    }
+  }
+  async confirm(question, options = {}) {
+    const defaultYes = options.defaultYes ?? false;
+    for (; ; ) {
+      const read = readConfirmAnswer(
+        await this.ask(`${question} ${confirmHint(defaultYes)} `),
+        defaultYes
+      );
+      if (read !== null) return read;
+    }
+  }
+  async select(question, options) {
+    process.stdout.write(`${question}
+`);
+    options.forEach((option, index) => {
+      process.stdout.write(`  ${String(index + 1)}. ${option}
+`);
+    });
+    for (; ; ) {
+      const answer = Number.parseInt(
+        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
+        10
+      );
+      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
+        return answer - 1;
+    }
+  }
+};
+var NonInteractivePrompter = class {
+  constructor(assumeYes) {
+    this.assumeYes = assumeYes;
+  }
+  refuse(question) {
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
+    );
+  }
+  async ask(question) {
+    this.refuse(question);
+  }
+  async askHidden(question) {
+    this.refuse(question);
+  }
+  async confirm() {
+    return this.assumeYes;
+  }
+  async select(question) {
+    this.refuse(question);
+  }
+};
+function createPrompter(options) {
+  if (options.yes || options.json || !isInteractive())
+    return new NonInteractivePrompter(options.yes);
+  return new TtyPrompter();
+}
+
+// src/commands/confirm.ts
+function cannotAsk(context) {
+  return context.flags.json || !isInteractive();
+}
+async function confirmOrAbort(context, question) {
+  if (context.flags.yes) return;
+  if (cannotAsk(context)) {
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `${question} Re-run with --yes to confirm.`
+    );
+  }
+  const confirmed = await context.prompter.confirm(question);
+  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+}
+
+// src/commands/migration.ts
+var processStdin = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+function migrationsDir(context) {
+  return resolveMigrationsDir({
+    baseDir: context.cwd,
+    rootDirectory: context.flags.root,
+    dir: context.flags.dir
+  });
+}
+function relativeToCwd(context, path) {
+  const rel = relative10(context.cwd, path);
+  return rel === "" ? "." : rel;
+}
+async function appliedMigrations(client, projectId) {
+  try {
+    return await client.db.migrations(projectId);
+  } catch (error51) {
+    if (isNaroError(error51) && error51.code === "DATABASE_NOT_READY") return [];
+    throw error51;
+  }
+}
+var UNPRINTABLE2 = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable2(text3) {
+  return text3.replace(UNPRINTABLE2, "?");
+}
+function isPrintable(text3) {
+  return printable2(text3) === text3;
+}
+var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
+function warningLines(message) {
+  return message.split("\n").map(
+    (line, index) => index === 0 ? `\u26A0 ${printable2(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
+  );
+}
+function policyProblems(dir, names) {
+  return names.flatMap((name) => {
+    const split2 = splitStatements(readFileSync10(join31(dir, name), "utf8"));
+    if (!split2.ok) return [];
+    const planned = planPolicyMigration(
+      split2.statements.map((statement2) => statement2.text)
+    );
+    return planned.ok ? [] : [{ migration: name, message: planned.message }];
+  });
+}
+function warningLine(warning) {
+  if (warning === "out-of-order")
+    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
+  if (warning === "ledger-name-missing-extension")
+    return "  \u26A0 recorded without .sql in the ledger";
+  return null;
+}
+async function runMigrationNew(context, deps = processStdin) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration new <name>"
+  );
+  const dir = migrationsDir(context);
+  const fileName = nextMigrationFileName(
+    listMigrationFiles(dir),
+    name
+  );
+  mkdirSync3(dir, { recursive: true });
+  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
+  const fromStdin = piped.length > 0;
+  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
+` : `-- Migration: ${fileName}
+`;
+  const path = join31(dir, fileName);
+  writeFileSync3(path, body, { flag: "wx" });
+  const relPath = relativeToCwd(context, path);
+  context.output.result({ file: fileName, path: relPath, fromStdin }, [
+    `\u2705 Created ${relPath}`
+  ]);
+}
+async function runMigrationList(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const migrations = compareMigrations(local, ledger);
+  const relDir = relativeToCwd(context, dir);
+  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
+    `Migrations in ${relDir} (${String(migrations.length)}):`,
+    ...migrations.flatMap((row) => {
+      const line = `  ${row.status.padEnd(12)}${printable2(row.name)}${row.appliedAt ? `  ${printable2(row.appliedAt)}` : ""}`;
+      const warning = warningLine(row.warning);
+      return warning ? [line, warning] : [line];
+    })
+  ];
+  context.output.result({ projectId, dir: relDir, migrations }, lines);
+}
+async function applyMigrationFiles(context, client, projectId, dir, names) {
+  const applied = [];
+  const warnings = [];
+  for (const name of names) {
+    const sql = readFileSync10(join31(dir, name), "utf8");
+    let answer;
+    try {
+      answer = await client.db.applyMigration(projectId, { name, sql });
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      for (const message of serverWarnings(error51.details))
+        for (const line of warningLines(message)) context.output.warn(line);
+      const shown = context.output.json ? name : printable2(name);
+      throw new NaroError(error51.code, `${shown}: ${error51.message}`, {
+        ...error51.status === void 0 ? {} : { status: error51.status },
+        details: {
+          ...error51.details,
+          migration: name,
+          applied,
+          appliedWarnings: warnings
+        },
+        cause: error51
+      });
+    }
+    context.output.log(`\u2713 ${printable2(name)}`);
+    applied.push(name);
+    for (const message of answer.warnings) {
+      warnings.push({ migration: name, message });
+      for (const line of warningLines(message)) context.output.warn(line);
+    }
+  }
+  return { applied, warnings };
+}
+function serverWarnings(details) {
+  const warnings = details?.warnings;
+  return Array.isArray(warnings) ? warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
+}
+var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
+var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
+var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
+var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
+function withoutSuffix(key) {
+  return key.slice(0, -".sql".length);
+}
+async function runMigrationRepair(context) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration repair <name> --status applied|reverted"
+  );
+  const key = name;
+  if (!MIGRATION_NAME_RE.test(key))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "name must end with .sql and contain only letters, digits, _ . -"
+    );
+  const status = context.flags.status;
+  if (status !== "applied" && status !== "reverted")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --status applied or --status reverted."
+    );
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const ledger = await appliedMigrations(client, projectId);
+  const recorded = ledger.some(
+    (row) => row.name === key || row.name === withoutSuffix(key)
+  );
+  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
+  if (status === "applied" ? recorded : !recorded) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
+  );
+  if (status === "applied" && ledger.length === 0)
+    await client.db.query(projectId, { sql: LEDGER_DDL });
+  const answer = await client.db.query(projectId, {
+    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
+    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
+  });
+  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
+  if (!changed) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  context.output.result({ name: key, status, changed: true }, [
+    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
+  ]);
+}
+async function runMigrationUp(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
+  if (pending.length === 0) {
+    context.output.result({ projectId, applied: [], pending: [] }, [
+      "No pending migrations."
+    ]);
+    return;
+  }
+  if (context.flags.dryRun) {
+    const problems2 = policyProblems(dir, pending);
+    context.output.result({ projectId, dryRun: true, pending, problems: problems2 }, [
+      `Pending migrations (${String(pending.length)}):`,
+      ...pending.map((name) => `  ${printable2(name)}`),
+      ...problems2.map(
+        (problem) => `${printable2(problem.migration)}: ${printable2(problem.message)}`
+      )
+    ]);
+    if (problems2.length > 0) process.exitCode = 1;
+    return;
+  }
+  context.output.log(`Pending migrations (${String(pending.length)}):`);
+  for (const name of pending) context.output.log(`  ${printable2(name)}`);
+  await confirmOrAbort(
+    context,
+    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
+  );
+  const { applied, warnings } = await applyMigrationFiles(
+    context,
+    client,
+    projectId,
+    dir,
+    pending
+  );
+  context.output.result({ projectId, applied, pending: [], warnings }, [
+    `\u2705 Applied ${String(applied.length)} migration(s).`
+  ]);
+}
+
+// src/functions/retry.ts
+var FUNCTION_RETRIES = 3;
+var FUNCTION_BUSY_WAIT_MS = 5e3;
+var FUNCTION_RATE_LIMIT_DEFAULT_SECONDS = 60;
+var FUNCTION_RATE_LIMIT_MAX_SECONDS = 300;
+function defaultSleep(ms) {
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
+}
+function retryAfterSeconds(error51) {
+  const value = error51.details?.retryAfter;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.min(Math.ceil(value), FUNCTION_RATE_LIMIT_MAX_SECONDS) : FUNCTION_RATE_LIMIT_DEFAULT_SECONDS;
+}
+async function withFunctionRetries(op, name, io) {
+  const rateRetries = io.rateLimitRetries ?? FUNCTION_RETRIES;
+  const busyRetries = io.busyRetries ?? FUNCTION_RETRIES;
+  let rate = 0;
+  let busy = 0;
+  for (; ; ) {
+    try {
+      return await op();
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      if (error51.code === "FUNCTIONS_RATE_LIMITED" && rate < rateRetries) {
+        rate += 1;
+        const seconds = retryAfterSeconds(error51);
+        io.log(
+          `\u23F3 Cloudflare is rate limiting function uploads; trying ${name} again in ${String(seconds)} seconds (${String(rate)}/${String(rateRetries)}).`
+        );
+        await io.sleep(seconds * 1e3);
+        continue;
+      }
+      if (error51.code === "FUNCTION_BUSY" && busy < busyRetries) {
+        busy += 1;
+        io.log(
+          `\u23F3 ${name} is being changed right now; trying again in ${String(FUNCTION_BUSY_WAIT_MS / 1e3)} seconds (${String(busy)}/${String(busyRetries)}).`
+        );
+        await io.sleep(FUNCTION_BUSY_WAIT_MS);
+        continue;
+      }
+      throw error51;
+    }
+  }
+}
+
+// src/functions/deploy.ts
+var PER_FUNCTION_CODES = /* @__PURE__ */ new Set([
+  "VALIDATION_FAILED",
+  "FUNCTION_BUNDLE_FAILED",
+  "FUNCTION_BOOT_FAILED",
+  "FUNCTION_UPLOAD_FAILED",
+  "BUNDLE_TOO_LARGE",
+  "BUNDLE_MISSING",
+  "BUNDLE_MISMATCH",
+  "FUNCTION_LIMIT",
+  "FUNCTION_BUSY",
+  "FUNCTION_NOT_FOUND",
+  "VERSION_NOT_FOUND",
+  "VERSION_NOT_DEPLOYABLE",
+  "FUNCTION_DEPLOY_FAILED",
+  "FUNCTION_DEPLOY_INCOMPLETE",
+  "FUNCTIONS_RATE_LIMITED"
+]);
+function assertFunctionsNode(version3 = process.versions.node) {
+  const major = Number(version3.split(".")[0]);
+  if (!(major >= 22))
+    throw new NaroError(
+      "NODE_VERSION_UNSUPPORTED",
+      `naro functions needs Node.js 22 or later (found ${version3}).`
+    );
+}
+function asNaroError(error51) {
+  return error51 instanceof FunctionBundleError ? new NaroError(error51.code, error51.message) : error51;
+}
+var UPLOAD_TIMEOUT_DEFAULT_MS = 15 * 6e4;
+var UPLOAD_TIMEOUT_MIN_MS = 6e4;
+var UPLOAD_TIMEOUT_SLACK_MS = 3e4;
+function uploadTimeoutMs(upload, now = Date.now()) {
+  const expires = typeof upload.expiresAt === "string" ? Date.parse(upload.expiresAt) : NaN;
+  if (Number.isNaN(expires)) return UPLOAD_TIMEOUT_DEFAULT_MS;
+  return Math.max(expires - now, UPLOAD_TIMEOUT_MIN_MS) + UPLOAD_TIMEOUT_SLACK_MS;
+}
+var SECRETS_LIST_TIMEOUT_MS = 45e3;
+var FUNCTION_CALL_TIMEOUT_MS = 12e4;
+var deadlineReached = (name, deadlineMs) => `Deploying ${name} reached the ${String(deadlineMs / 1e3)}-second limit before it went live; the live version did not change. Try again.`;
+function budgetOf(options) {
+  const { deadlineMs } = options;
+  if (deadlineMs === void 0) return null;
+  const now = options.now ?? Date.now;
+  const end = now() + deadlineMs;
+  return {
+    left(name, cap) {
+      const left = end - now();
+      if (left <= 0)
+        throw new NaroError("TIMEOUT", deadlineReached(name, deadlineMs));
+      return Math.min(cap, left);
+    }
+  };
+}
+var bootSeconds = (ms) => Math.max(1e3, Math.floor(ms / 1e3) * 1e3);
+async function putBundle(doFetch, name, upload, contents, timeoutMs) {
+  const headers = Object.fromEntries(
+    Object.entries(upload.headers).filter(
+      ([header]) => header.toLowerCase() !== "content-length"
+    )
+  );
+  const again = `Run naro functions deploy ${name} again.`;
+  const signal = AbortSignal.timeout(timeoutMs);
+  let response;
+  try {
+    response = await doFetch(upload.url, {
+      method: upload.method,
+      headers,
+      body: contents,
+      signal
+    });
+  } catch (cause) {
+    const timedOut = signal.aborted || cause instanceof Error && cause.name === "TimeoutError";
+    throw new NaroError(
+      "FUNCTION_UPLOAD_FAILED",
+      `Uploading the bundle of ${name} failed (${timedOut ? "timed out" : "network error"}). ${again}`,
+      { cause }
+    );
+  }
+  if (!response.ok)
+    throw new NaroError(
+      "FUNCTION_UPLOAD_FAILED",
+      `Uploading the bundle of ${name} failed (${String(response.status)}). ${again}`,
+      { status: response.status }
+    );
+}
+async function projectSecretNames(client, projectId, timeoutMs) {
+  try {
+    const secrets = timeoutMs === void 0 ? await client.functions.secrets(projectId) : await client.functions.secrets(projectId, { timeoutMs });
+    return secrets.map((secret) => secret.name);
+  } catch {
+    return [];
+  }
+}
+async function deployOne(options, folder, name, importMap, secretNames, io, budget) {
+  const steps = options.steps ?? { bundle: bundleFunction, boot: bootCheck };
+  const { client, projectId } = options;
+  const call = () => budget ? { timeoutMs: budget.left(name, FUNCTION_CALL_TIMEOUT_MS) } : null;
+  io.log(`\u23F3 Deploying ${name}\u2026`);
+  try {
+    const source = readFunctionSource(folder, name);
+    const bundle = await steps.bundle(source, folder, { importMap });
+    for (const warning of bundle.warnings) io.log(warning);
+    if (!options.skipCheck)
+      await steps.boot(
+        name,
+        bundle.code,
+        budget ? {
+          secretNames,
+          timeoutMs: bootSeconds(budget.left(name, BOOT_TIMEOUT_MS))
+        } : { secretNames }
+      );
+    const verifyJwt = options.verifyJwt ?? source.verifyJwt ?? true;
+    const request2 = {
+      size: bundle.bytes,
+      sha256: bundle.sha256,
+      verifyJwt,
+      entrypoint: source.entrypoint,
+      ...options.cliVersion ? { cliVersion: options.cliVersion } : {}
+    };
+    const created = await withFunctionRetries(
+      () => {
+        const limit = call();
+        return limit ? client.functions.createVersion(projectId, name, request2, limit) : client.functions.createVersion(projectId, name, request2);
+      },
+      name,
+      io
+    );
+    const urlLife = uploadTimeoutMs(created.upload);
+    await putBundle(
+      options.fetch ?? fetch,
+      name,
+      created.upload,
+      bundle.contents,
+      budget ? budget.left(name, urlLife) : urlLife
+    );
+    const live = await withFunctionRetries(
+      () => {
+        const limit = call();
+        return limit ? client.functions.deploy(projectId, name, created.version.id, limit) : client.functions.deploy(projectId, name, created.version.id);
+      },
+      name,
+      io
+    );
+    io.log(
+      `\u2705 Deployed ${name} (v${String(live.version ?? created.version.number)}) \u2014 ${live.url}`
+    );
+    return {
+      name,
+      version: live.version,
+      url: live.url,
+      verifyJwt: live.verifyJwt
+    };
+  } catch (error51) {
+    throw asNaroError(error51);
+  }
+}
+function readFlagImportMap(options, folder) {
+  if (options.importMap === void 0) return void 0;
+  const file2 = resolve13(options.cwd, options.importMap);
+  try {
+    return readImportMapFile(
+      file2,
+      relative11(folder.root, file2).split(sep10).join("/")
+    );
+  } catch (error51) {
+    throw asNaroError(error51);
+  }
+}
+function withProgress(error51, deployed, failures) {
+  return new NaroError(error51.code, error51.message, {
+    ...error51.status === void 0 ? {} : { status: error51.status },
+    details: { ...error51.details, deployed, failures },
+    cause: error51
+  });
+}
+async function deployFunctions(options) {
+  assertFunctionsNode(options.nodeVersion);
+  const budget = budgetOf(options);
+  const io = {
+    sleep: options.sleep ?? defaultSleep,
+    log: options.log ?? (() => {
+    }),
+    rateLimitRetries: options.rateLimitRetries,
+    busyRetries: options.busyRetries
+  };
+  const folder = functionsFolder({
+    cwd: options.cwd,
+    root: options.root,
+    dir: options.dir
+  });
+  let names;
+  try {
+    names = options.names && options.names.length > 0 ? [...new Set(options.names)] : listFunctionNames(folder);
+  } catch (error51) {
+    throw asNaroError(error51);
+  }
+  const importMap = readFlagImportMap(options, folder);
+  const warning = configTomlWarning(folder);
+  if (warning !== null) io.log(warning);
+  const [only] = names;
+  const secretNames = options.skipCheck ? [] : await projectSecretNames(
+    options.client,
+    options.projectId,
+    budget?.left(only ?? "", SECRETS_LIST_TIMEOUT_MS)
+  );
+  if (names.length === 1 && only !== void 0)
+    return {
+      deployed: [
+        await deployOne(
+          options,
+          folder,
+          only,
+          importMap,
+          secretNames,
+          io,
+          budget
+        )
+      ]
+    };
+  const deployed = [];
+  const failures = [];
+  for (const name of names) {
+    try {
+      deployed.push(
+        await deployOne(
+          options,
+          folder,
+          name,
+          importMap,
+          secretNames,
+          io,
+          budget
+        )
+      );
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      if (!PER_FUNCTION_CODES.has(error51.code))
+        throw withProgress(error51, deployed, failures);
+      failures.push({ name, code: error51.code, message: error51.message });
+      io.log(`\u2717 ${name}: ${printable2(error51.message)}`);
+    }
+  }
+  if (failures.length > 0)
+    throw new NaroError(
+      "FUNCTIONS_DEPLOY_PARTIAL",
+      `Deployed ${String(deployed.length)} of ${String(names.length)} functions. Failed: ${failures.map((failure2) => `${failure2.name} (${failure2.code})`).join(", ")}.`,
+      { details: { deployed, failures } }
+    );
+  return { deployed };
+}
+
+// src/deploy.ts
+function parseDotenv2(text3) {
+  return parseDotenv(text3);
+}
+function readProjectEnv2(dir) {
+  return readProjectEnv(dir);
+}
+function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUrl) {
+  const post = (body) => fetchImpl(`${cp3}/api/internal/deployments/${deploymentId}/events`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify(body)
+  }).then(() => {
+  });
+  const postStatus = async (body) => {
+    let lastError;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        return await post(body);
+      } catch (error51) {
+        lastError = error51;
+        await new Promise(
+          (resolve15) => setTimeout(resolve15, 500 * (attempt + 1))
+        );
+      }
+    }
+    throw lastError;
+  };
+  const send = createLogSender({
     ...logIngestUrl ? { ingestUrl: logIngestUrl } : {},
     toIngest: logIngestUrl ? (logs) => fetchImpl(`${logIngestUrl}/deployments/${deploymentId}/logs`, {
       method: "POST",
@@ -32002,6 +34298,10 @@ function failureCode(error51, fallback) {
   const code = error51 && typeof error51 === "object" ? error51.code : void 0;
   return typeof code === "string" && DEPLOYMENT_CODES.has(code) ? code : fallback;
 }
+var SYSTEM_NAMES = new Set(NARO_SYSTEM_ENV_NAMES);
+function isNaroSystemName(key) {
+  return SYSTEM_NAMES.has(key);
+}
 function slugify2(value) {
   const slug = value.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 54);
   return slug || "app";
@@ -32009,19 +34309,19 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile15(join26(sourceDir, "package.json"), "utf8")
+      await readFile15(join32(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
   }
-  return basename4(sourceDir);
+  return basename5(sourceDir);
 }
 function resolveBin(name) {
-  let dir = dirname6(fileURLToPath(import.meta.url));
+  let dir = dirname10(fileURLToPath4(import.meta.url));
   for (; ; ) {
-    const candidate = join26(dir, "node_modules", ".bin", name);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname6(dir);
+    const candidate = join32(dir, "node_modules", ".bin", name);
+    if (existsSync10(candidate)) return candidate;
+    const parent = dirname10(dir);
     if (parent === dir) return name;
     dir = parent;
   }
@@ -32086,7 +34386,7 @@ function workingTreeNotices(copy) {
 }
 function localDependencies(sourceDir, say = () => void 0) {
   return {
-    createWorkspace: () => mkdtemp2(join26(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join32(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm5(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -32136,7 +34436,7 @@ async function deployDirectory(sourceDir, options, log2) {
       "Pass production: true for production; preview is the default."
     );
   const surface = production ? "production" : environment ?? "preview";
-  const appRoot = options.rootDirectory ? resolve11(sourceDir, options.rootDirectory) : sourceDir;
+  const appRoot = options.rootDirectory ? resolve14(sourceDir, options.rootDirectory) : sourceDir;
   const framework = detectFramework2(appRoot);
   if (!framework.deployable && !options.force) {
     throw new NaroError(
@@ -32156,6 +34456,7 @@ async function deployDirectory(sourceDir, options, log2) {
   const client = new NaroClient({
     baseUrl: cpUrl,
     getAccessToken: () => auth.getAccessToken(),
+    clientName: `naro-cli/${version2()}`,
     ...options.fetch ? { fetch: options.fetch } : {}
   });
   if (environment !== void 0 && options.projectId)
@@ -32184,6 +34485,16 @@ async function deployDirectory(sourceDir, options, log2) {
     const provided = options.env ?? {};
     missing = scanned.filter((key) => !existing.has(key) && !(key in provided));
   }
+  if (environment !== void 0 && options.projectId && missing.some((key) => isNaroSystemName(key))) {
+    const backend = await client.backend.info(options.projectId).catch(() => null);
+    if (backend !== null && backend.status !== "none") {
+      const set2 = missing.filter((key) => isNaroSystemName(key));
+      missing = missing.filter((key) => !isNaroSystemName(key));
+      log2(
+        `\u25B8 naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
+      );
+    }
+  }
   let collected = {};
   if (missing.length > 0) {
     log2(
@@ -32229,7 +34540,16 @@ async function deployDirectory(sourceDir, options, log2) {
         repositoryUrl: sourceDir,
         branch: ctx.branch,
         rootDirectory: options.rootDirectory ?? null,
-        env: { ...ctx.env, ...envToSend },
+        // An environment's deploy: the control plane saved what this sent for
+        // that environment and then chose its values, so a key sent and a key
+        // chosen usually hold the same value — except the names naro sets for
+        // an environment with a backend (named environments spec §8.3), which
+        // must win here too, or this build would call another backend than
+        // the worker's bindings, and a key the server failed to save
+        // (`envSkipped`), whose stored value the worker gets and so this build
+        // takes too. Production and preview keep a value sent over the stored
+        // one, as before.
+        env: ctx.environment ? { ...envToSend, ...ctx.env } : { ...ctx.env, ...envToSend },
         strategy: ctx.strategy ?? null,
         ...ctx.vinextEnabled === void 0 ? {} : { vinextEnabled: ctx.vinextEnabled }
       },
@@ -32320,10 +34640,10 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  isFunctionName,
   parseGitHubRemote,
   schemaMigrationTitle,
   projectPath,
-  splitStatements,
   ANALYTICS_FILTER_KEYS,
   NaroError,
   promoteTargetUnsupported,
@@ -32381,7 +34701,6 @@ export {
   parsePolicyStatement,
   splitPolicyStatements,
   STORAGE_SUBQUERIES_SQL,
-  planPolicyMigration,
   unreadablePolicyComment,
   parseRedirectEntry,
   formatRedirectEntry,
@@ -32393,10 +34712,8 @@ export {
   ensureGitignoreHasNaro,
   countLintedTables,
   lintSchema,
-  resolveMigrationsDir,
   listMigrationFiles,
   nextMigrationFileName,
-  compareMigrations,
   pendingMigrationNames,
   migrationsPendingError,
   migrationNameMismatch,
@@ -32415,6 +34732,40 @@ export {
   promptForMissingEnv,
   pullEnv,
   detectGitInfo,
+  version2 as version,
+  BUNDLE_MESSAGES,
+  functionsFolder,
+  parseJsonc2 as parseJsonc,
+  DATA_ENV_MESSAGES,
+  dataEnvironment,
+  dataClient,
+  databaseName,
+  enableBackendCommand,
+  envFlag,
+  forEnvironment,
+  isInteractive,
+  readStdin,
+  createPrompter,
+  cannotAsk,
+  confirmOrAbort,
+  migrationsDir,
+  relativeToCwd,
+  appliedMigrations,
+  printable2 as printable,
+  isPrintable,
+  UNSHOWN_WARNING_LINE,
+  warningLines,
+  policyProblems,
+  runMigrationNew,
+  runMigrationList,
+  applyMigrationFiles,
+  runMigrationRepair,
+  runMigrationUp,
+  defaultSleep,
+  retryAfterSeconds,
+  withFunctionRetries,
+  assertFunctionsNode,
+  deployFunctions,
   parseDotenv2 as parseDotenv,
   readProjectEnv2 as readProjectEnv,
   eventsObserver,