naro-cli 0.21.0 → 0.23.0

package/dist/index.js

@@ -3,6 +3,8 @@ import {
   ANALYTICS_FILTER_KEYS,
   BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
+  BUNDLE_MESSAGES,
+  DATA_ENV_MESSAGES,
   INDEX_SQL,
   MAX_SINGLE_UPLOAD_BYTES,
   NAMED_POLICY_SQL,
@@ -19,26 +21,44 @@ import {
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
   STORAGE_OBJECTS_TABLE,
   STORAGE_SUBQUERIES_SQL,
+  UNSHOWN_WARNING_LINE,
+  appliedMigrations,
+  applyMigrationFiles,
+  assertFunctionsNode,
   buildResetPlan,
+  cannotAsk,
   cellText,
   checkObjectName,
   clearSession,
   commentText,
-  compareMigrations,
+  confirmOrAbort,
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
+  createPrompter,
+  dataClient,
+  dataEnvironment,
   dataError,
+  databaseName,
+  defaultSleep,
   deployDirectory,
+  deployFunctions,
   detectGitInfo,
+  enableBackendCommand,
   ensureGitignoreHasNaro,
+  envFlag,
+  forEnvironment,
   formatRedirectEntry,
+  functionsFolder,
   generateTypes,
   indexesFromRows,
   isBookmark,
   isEnvTargetName,
   isExpired,
+  isFunctionName,
+  isInteractive,
   isNaroError,
+  isPrintable,
   isReservedEnvTarget,
   isStalledBackend,
   isTerminalStatus,
@@ -49,19 +69,22 @@ import {
   login,
   maskEnvValue,
   migrationNameMismatch,
+  migrationsDir,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
   parseDotenvDetailed,
   parseGitHubRemote,
+  parseJsonc,
   parsePolicyNode,
   parsePolicyStatement,
   parseRedirectEntry,
   pendingMigrationNames,
-  planPolicyMigration,
   policiesForTypes,
   policiesLostByReset,
+  policyProblems,
+  printable,
   projectPath,
   promoteTargetUnsupported,
   promptForMissingEnv,
@@ -69,7 +92,9 @@ import {
   quoteIdent,
   quotePolicyName,
   readProjectLink,
+  readStdin,
   refreshStoredSession,
+  relativeToCwd,
   removeProjectLink,
   renderRows,
   resetFileRefusedMessage,
@@ -77,14 +102,17 @@ import {
   resetPoliciesWithTablesMessage,
   resetStorageOutdatedMessage,
   resolveAuth,
-  resolveMigrationsDir,
+  retryAfterSeconds,
+  runMigrationList,
+  runMigrationNew,
+  runMigrationRepair,
+  runMigrationUp,
   saveSession,
   schemaMigrationTitle,
   serializeDotenv,
   slugify,
   snapshotFromRows,
   splitPolicyStatements,
-  splitStatements,
   storageRefusalOfFiles,
   storedPolicySql,
   summarizeStatement,
@@ -96,8 +124,11 @@ import {
   unreadablePolicyComment,
   usageMonthOf,
   userForAccessToken,
+  version,
+  warningLines,
+  withFunctionRetries,
   writeProjectLink
-} from "./chunk-FFPOVA7I.js";
+} from "./chunk-ALK4VTL2.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -137,7 +168,11 @@ var BOOLEAN_FLAGS = {
   "--recursive": "recursive",
   "-r": "recursive",
   "--upsert": "upsert",
-  "--no-branch": "noBranch"
+  "--no-branch": "noBranch",
+  "--no-verify-jwt": "noVerifyJwt",
+  "--skip-check": "skipCheck",
+  "--no-sync": "noSync",
+  "--registry": "registry"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -197,7 +232,8 @@ var STRING_FLAGS = {
   "--copy-env": "copyEnv",
   "--database": "database",
   "--protection": "protection",
-  "--to": "to"
+  "--to": "to",
+  "--import-map": "importMap"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -212,6 +248,13 @@ function secretFlagProblem(unknown) {
   }
   return null;
 }
+var SECRETS_ARGV_REFUSAL = "Secrets are read from stdin or a file, never from the command line: pipe the value into naro functions secrets set <NAME>, or put it in a file for naro functions secrets import <file>.";
+function unknownOptionProblem(parsed) {
+  const [area, action] = parsed.positionals;
+  if (parsed.command === "functions" && area === "secrets" && action === "set")
+    return SECRETS_ARGV_REFUSAL;
+  return secretFlagProblem(parsed.unknown) ?? `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`;
+}
 function listFlag(value) {
   if (value === void 0) return [];
   return value.split(",").map((piece) => piece.trim()).filter((piece) => piece.length > 0);
@@ -371,123 +414,6 @@ var Output = class {
   }
 };
 
-// src/prompt.ts
-import { createInterface } from "readline";
-import { Writable } from "stream";
-function confirmHint(defaultYes) {
-  return defaultYes ? "(Y/n)" : "(y/N)";
-}
-function readConfirmAnswer(answer, defaultYes) {
-  const normalized = answer.trim().toLowerCase();
-  if (normalized === "") return defaultYes;
-  if (normalized === "y" || normalized === "yes") return true;
-  if (!defaultYes) return false;
-  if (normalized === "n" || normalized === "no") return false;
-  return null;
-}
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-async function readStdin() {
-  let data = "";
-  for await (const chunk2 of process.stdin) data += String(chunk2);
-  return data.replace(/\r?\n$/, "");
-}
-var TtyPrompter = class {
-  async ask(question) {
-    const rl = createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-    try {
-      return await new Promise(
-        (resolve7) => rl.question(question, resolve7)
-      );
-    } finally {
-      rl.close();
-    }
-  }
-  async askHidden(question) {
-    let muted = false;
-    const output = new Writable({
-      write(chunk2, _enc, done) {
-        if (!muted) process.stdout.write(chunk2);
-        done();
-      }
-    });
-    const rl = createInterface({
-      input: process.stdin,
-      output,
-      terminal: true
-    });
-    try {
-      const answer = new Promise(
-        (resolve7) => rl.question(question, resolve7)
-      );
-      muted = true;
-      const value = await answer;
-      process.stdout.write("\n");
-      return value;
-    } finally {
-      rl.close();
-    }
-  }
-  async confirm(question, options = {}) {
-    const defaultYes = options.defaultYes ?? false;
-    for (; ; ) {
-      const read = readConfirmAnswer(
-        await this.ask(`${question} ${confirmHint(defaultYes)} `),
-        defaultYes
-      );
-      if (read !== null) return read;
-    }
-  }
-  async select(question, options) {
-    process.stdout.write(`${question}
-`);
-    options.forEach((option, index) => {
-      process.stdout.write(`  ${String(index + 1)}. ${option}
-`);
-    });
-    for (; ; ) {
-      const answer = Number.parseInt(
-        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
-        10
-      );
-      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
-        return answer - 1;
-    }
-  }
-};
-var NonInteractivePrompter = class {
-  constructor(assumeYes) {
-    this.assumeYes = assumeYes;
-  }
-  refuse(question) {
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
-    );
-  }
-  async ask(question) {
-    this.refuse(question);
-  }
-  async askHidden(question) {
-    this.refuse(question);
-  }
-  async confirm() {
-    return this.assumeYes;
-  }
-  async select(question) {
-    this.refuse(question);
-  }
-};
-function createPrompter(options) {
-  if (options.yes || options.json || !isInteractive())
-    return new NonInteractivePrompter(options.yes);
-  return new TtyPrompter();
-}
-
 // src/context.ts
 function createContext(flags, positionals = []) {
   const cwd = flags.cwd ?? process.cwd();
@@ -521,7 +447,8 @@ function createContext(flags, positionals = []) {
       const resolved = await auth();
       resolvedClient = new NaroClient({
         baseUrl: controlPlaneUrl(),
-        getAccessToken: () => resolved.getAccessToken()
+        getAccessToken: () => resolved.getAccessToken(),
+        clientName: `naro-cli/${version()}`
       });
       return resolvedClient;
     },
@@ -538,264 +465,6 @@ function createContext(flags, positionals = []) {
   };
 }
 
-// src/router.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
-import { fileURLToPath } from "url";
-
-// src/commands/migration.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join, relative } from "path";
-
-// src/commands/confirm.ts
-function cannotAsk(context) {
-  return context.flags.json || !isInteractive();
-}
-async function confirmOrAbort(context, question) {
-  if (context.flags.yes) return;
-  if (cannotAsk(context)) {
-    throw new NaroError(
-      "CONFIRMATION_REQUIRED",
-      `${question} Re-run with --yes to confirm.`
-    );
-  }
-  const confirmed = await context.prompter.confirm(question);
-  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
-}
-
-// src/commands/migration.ts
-var processStdin = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-function migrationsDir(context) {
-  return resolveMigrationsDir({
-    baseDir: context.cwd,
-    rootDirectory: context.flags.root,
-    dir: context.flags.dir
-  });
-}
-function relativeToCwd(context, path) {
-  const rel = relative(context.cwd, path);
-  return rel === "" ? "." : rel;
-}
-async function appliedMigrations(client, projectId) {
-  try {
-    return await client.db.migrations(projectId);
-  } catch (error) {
-    if (isNaroError(error) && error.code === "DATABASE_NOT_READY") return [];
-    throw error;
-  }
-}
-var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable(text) {
-  return text.replace(UNPRINTABLE, "?");
-}
-function isPrintable(text) {
-  return printable(text) === text;
-}
-var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
-function warningLines(message) {
-  return message.split("\n").map(
-    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
-  );
-}
-function policyProblems(dir, names) {
-  return names.flatMap((name) => {
-    const split = splitStatements(readFileSync(join(dir, name), "utf8"));
-    if (!split.ok) return [];
-    const planned = planPolicyMigration(
-      split.statements.map((statement) => statement.text)
-    );
-    return planned.ok ? [] : [{ migration: name, message: planned.message }];
-  });
-}
-function warningLine(warning) {
-  if (warning === "out-of-order")
-    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
-  if (warning === "ledger-name-missing-extension")
-    return "  \u26A0 recorded without .sql in the ledger";
-  return null;
-}
-async function runMigrationNew(context, deps = processStdin) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration new <name>"
-  );
-  const dir = migrationsDir(context);
-  const fileName = nextMigrationFileName(
-    listMigrationFiles(dir),
-    name
-  );
-  mkdirSync(dir, { recursive: true });
-  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
-  const fromStdin = piped.length > 0;
-  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
-` : `-- Migration: ${fileName}
-`;
-  const path = join(dir, fileName);
-  writeFileSync(path, body, { flag: "wx" });
-  const relPath = relativeToCwd(context, path);
-  context.output.result({ file: fileName, path: relPath, fromStdin }, [
-    `\u2705 Created ${relPath}`
-  ]);
-}
-async function runMigrationList(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const migrations = compareMigrations(local, ledger);
-  const relDir = relativeToCwd(context, dir);
-  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
-    `Migrations in ${relDir} (${String(migrations.length)}):`,
-    ...migrations.flatMap((row) => {
-      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
-      const warning = warningLine(row.warning);
-      return warning ? [line, warning] : [line];
-    })
-  ];
-  context.output.result({ projectId, dir: relDir, migrations }, lines);
-}
-async function applyMigrationFiles(context, client, projectId, dir, names) {
-  const applied = [];
-  const warnings = [];
-  for (const name of names) {
-    const sql = readFileSync(join(dir, name), "utf8");
-    let answer;
-    try {
-      answer = await client.db.applyMigration(projectId, { name, sql });
-    } catch (error) {
-      if (!isNaroError(error)) throw error;
-      for (const message of serverWarnings(error.details))
-        for (const line of warningLines(message)) context.output.warn(line);
-      const shown = context.output.json ? name : printable(name);
-      throw new NaroError(error.code, `${shown}: ${error.message}`, {
-        ...error.status === void 0 ? {} : { status: error.status },
-        details: {
-          ...error.details,
-          migration: name,
-          applied,
-          appliedWarnings: warnings
-        },
-        cause: error
-      });
-    }
-    context.output.log(`\u2713 ${printable(name)}`);
-    applied.push(name);
-    for (const message of answer.warnings) {
-      warnings.push({ migration: name, message });
-      for (const line of warningLines(message)) context.output.warn(line);
-    }
-  }
-  return { applied, warnings };
-}
-function serverWarnings(details) {
-  const warnings = details?.warnings;
-  return Array.isArray(warnings) ? warnings.filter(
-    (warning) => typeof warning === "string"
-  ) : [];
-}
-var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
-var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
-var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
-var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
-function withoutSuffix(key) {
-  return key.slice(0, -".sql".length);
-}
-async function runMigrationRepair(context) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration repair <name> --status applied|reverted"
-  );
-  const key = name;
-  if (!MIGRATION_NAME_RE.test(key))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "name must end with .sql and contain only letters, digits, _ . -"
-    );
-  const status = context.flags.status;
-  if (status !== "applied" && status !== "reverted")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Pass --status applied or --status reverted."
-    );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const ledger = await appliedMigrations(client, projectId);
-  const recorded = ledger.some(
-    (row) => row.name === key || row.name === withoutSuffix(key)
-  );
-  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
-  if (status === "applied" ? recorded : !recorded) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  await confirmOrAbort(
-    context,
-    status === "applied" ? `Mark ${key} as applied in the project database's ledger? Its SQL is not run.` : `Remove ${key} from the project database's ledger? Its SQL is not rolled back.`
-  );
-  if (status === "applied" && ledger.length === 0)
-    await client.db.query(projectId, { sql: LEDGER_DDL });
-  const answer = await client.db.query(projectId, {
-    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
-    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
-  });
-  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
-  if (!changed) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  context.output.result({ name: key, status, changed: true }, [
-    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
-  ]);
-}
-async function runMigrationUp(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
-  if (pending.length === 0) {
-    context.output.result({ projectId, applied: [], pending: [] }, [
-      "No pending migrations."
-    ]);
-    return;
-  }
-  if (context.flags.dryRun) {
-    const problems = policyProblems(dir, pending);
-    context.output.result({ projectId, dryRun: true, pending, problems }, [
-      `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable(name)}`),
-      ...problems.map(
-        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
-      )
-    ]);
-    if (problems.length > 0) process.exitCode = 1;
-    return;
-  }
-  context.output.log(`Pending migrations (${String(pending.length)}):`);
-  for (const name of pending) context.output.log(`  ${printable(name)}`);
-  await confirmOrAbort(
-    context,
-    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
-  );
-  const { applied, warnings } = await applyMigrationFiles(
-    context,
-    client,
-    projectId,
-    dir,
-    pending
-  );
-  context.output.result({ projectId, applied, pending: [], warnings }, [
-    `\u2705 Applied ${String(applied.length)} migration(s).`
-  ]);
-}
-
 // src/commands/filters.ts
 function filtersOf(flags, keys) {
   const filters = {};
@@ -1180,6 +849,86 @@ async function runToken(context) {
   );
 }
 
+// src/functions/sync-loop.ts
+var FUNCTIONS_SYNC_MAX_CALLS = 110;
+var FUNCTIONS_SYNC_STUCK_CALLS = 3;
+var FUNCTIONS_SYNC_BUSY_RETRIES = 3;
+var FUNCTIONS_SYNC_BUSY_WAIT_MS = 5e3;
+var FUNCTIONS_SYNC_RATE_RETRIES = 3;
+function functionCount(n) {
+  return n === 1 ? "1 function" : `${n.toLocaleString("en-US")} functions`;
+}
+function lastPerName(failures) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const failure2 of failures) {
+    byName.delete(failure2.name);
+    byName.set(failure2.name, failure2);
+  }
+  return [...byName.values()];
+}
+async function syncUntilDone(client, projectId, options = {}) {
+  const sleep2 = options.sleep ?? defaultSleep;
+  const synced = /* @__PURE__ */ new Set();
+  const removed = /* @__PURE__ */ new Set();
+  const state = {
+    complete: false,
+    synced: [],
+    removed: [],
+    pending: 0,
+    failures: [],
+    calls: 0
+  };
+  let busy = 0;
+  let limited = 0;
+  let stuck = 0;
+  let previous = null;
+  const body = options.registry ? { registry: true } : {};
+  while (state.calls < FUNCTIONS_SYNC_MAX_CALLS) {
+    state.calls += 1;
+    let answer;
+    try {
+      answer = await client.functions.sync(projectId, body);
+    } catch (error) {
+      if (isNaroError(error) && error.code === "FUNCTIONS_RATE_LIMITED" && limited < FUNCTIONS_SYNC_RATE_RETRIES) {
+        limited += 1;
+        const seconds = retryAfterSeconds(error);
+        options.log?.(
+          `\u23F3 Cloudflare is rate limiting function uploads; syncing again in ${String(seconds)} seconds.`
+        );
+        await sleep2(seconds * 1e3);
+        continue;
+      }
+      throw error;
+    }
+    const before = previous;
+    previous = answer.pending;
+    const progress = answer.synced.length > 0 || answer.removed.length > 0 || before !== null && answer.pending < before;
+    for (const name of answer.synced) synced.add(name);
+    for (const name of answer.removed) removed.add(name);
+    state.synced = [...synced];
+    state.removed = [...removed];
+    state.pending = answer.pending;
+    state.failures = lastPerName(answer.failures);
+    options.onCall?.({ ...state });
+    if (answer.pending === 0) {
+      state.complete = true;
+      return state;
+    }
+    if (progress) {
+      busy = 0;
+      limited = 0;
+      stuck = before !== null && answer.pending >= before ? stuck + 1 : 0;
+      if (stuck >= FUNCTIONS_SYNC_STUCK_CALLS) return state;
+      continue;
+    }
+    const onlyBusy = state.failures.length > 0 && state.failures.every((failure2) => failure2.code === "FUNCTION_BUSY");
+    if (!onlyBusy || busy >= FUNCTIONS_SYNC_BUSY_RETRIES) return state;
+    busy += 1;
+    await sleep2(FUNCTIONS_SYNC_BUSY_WAIT_MS);
+  }
+  return state;
+}
+
 // src/commands/backend.ts
 var SERVICE_KEY_WARNING = "\u26A0 The service key skips every policy. Keep it on a server (NARO_SERVICE_KEY) and never put it in browser code.";
 var ROTATE_USAGE = "Usage: naro backend keys rotate --anon | --service";
@@ -1227,14 +976,20 @@ function backendLines(info, now2 = Date.now()) {
     );
   return lines;
 }
-function adviceLines(info, now2) {
+var ENVIRONMENT_TURNING_OFF_ADVICE = "Turning it off did not finish: your app's /_naro/* requests may still be answered. The control plane finishes it within a few minutes: the backend's switch is production's, and every environment follows it.";
+function adviceLines(info, now2, environment = null) {
   if (!info.enabled && info.status !== "none") {
     if (!info.turningOff) return [OFF_ADVICE];
-    return [leaseHeld(info, now2) ? TURNING_OFF_NOW_ADVICE : TURNING_OFF_ADVICE];
+    if (leaseHeld(info, now2)) return [TURNING_OFF_NOW_ADVICE];
+    return [
+      environment === null ? TURNING_OFF_ADVICE : ENVIRONMENT_TURNING_OFF_ADVICE
+    ];
   }
   switch (info.status) {
     case "none":
-      return ["Run `naro backend enable` to turn it on."];
+      return [
+        environment === null ? "Run `naro backend enable` to turn it on." : `This environment has no backend yet: \`naro environments provision ${environment}\` makes it while production's backend is on \u2014 turn that on with \`naro backend enable\`.`
+      ];
     case "error":
       return [
         ...info.error ? [`Error:       ${printable(info.error)}`] : [],
@@ -1255,17 +1010,21 @@ function stoppedAt(info) {
   return `stopped at ${step}${info.error ? `: ${sentence(info.error)}` : "."}`;
 }
 async function runBackendInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
   const now2 = Date.now();
+  const environment = dataEnvironment(context.flags);
   context.output.result(
     { projectId, backend, stalled: isStalledBackend(backend, now2) },
-    [...backendLines(backend, now2), ...adviceLines(backend, now2)]
+    [
+      ...backendLines(backend, now2),
+      ...adviceLines(backend, now2, environment)
+    ].map((line) => forEnvironment(line, environment))
   );
 }
 async function runBackendEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let backend;
   try {
@@ -1309,7 +1068,7 @@ async function runBackendEnable(context) {
 }
 async function runBackendDisable(context) {
   await confirmOrAbort(context, DISABLE_QUESTION);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.disable(projectId);
   if (backend.status === "none") {
@@ -1326,7 +1085,8 @@ async function runBackendDisable(context) {
   ]);
 }
 async function runBackendKeys(context) {
-  const client = await context.client();
+  const environment = dataEnvironment(context.flags);
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const keys = await client.backend.keys(projectId);
   if (!context.flags.reveal) {
@@ -1339,7 +1099,10 @@ async function runBackendKeys(context) {
       [
         `Anon key:    ${keys.anonKey}`,
         `Service key: ${keys.serviceKeyPrefix}\u2026 (hidden)`,
-        "`naro backend keys --reveal` prints the service key (needs database write access)."
+        forEnvironment(
+          "`naro backend keys --reveal` prints the service key (needs database write access).",
+          environment
+        )
       ]
     );
     return;
@@ -1359,41 +1122,94 @@ function rotateKind(context) {
 function keyLabel(kind) {
   return kind === "anon" ? "Anon key:    " : "Service key: ";
 }
-function rotationWarning(kind, backend) {
+function rotationWarning(kind, backend, environment = null) {
   if (backend.status === "error")
-    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`naro backend enable\` to finish.`;
+    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`${enableBackendCommand(environment)}\` to finish.`;
   if (backend.status !== "ready")
-    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend\`.`;
+    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend${envFlag(environment)}\`.`;
   return null;
 }
-function checkKeysSentence(kind) {
+var FUNCTIONS_ROTATE_NOTE = (kind) => `Functions pick up the new key within a few minutes; until then their calls with the old ${kind} key fail.`;
+async function liveFunctionCount(client, projectId) {
+  try {
+    const { functions } = await client.functions.list(projectId);
+    return functions.filter(
+      (fn) => fn.version !== null && fn.status !== "deleting"
+    ).length;
+  } catch {
+    return 0;
+  }
+}
+async function syncAfterRotation(context, client, projectId, kind, live2) {
+  context.output.warn(
+    `\u23F3 Replaced the ${kind} key; syncing ${functionCount(live2)}\u2026`
+  );
+  try {
+    const sync = await syncUntilDone(client, projectId, {
+      log: (line) => context.output.warn(line),
+      onCall: (progress) => {
+        context.output.warn(
+          `\u23F3 Syncing functions\u2026 ${String(Math.min(progress.synced.length, live2))}/${String(live2)}`
+        );
+      }
+    });
+    if (!sync.complete)
+      context.output.warn(
+        `\u26A0 The ${kind} key is replaced, but ${functionCount(sync.pending)} still ${sync.pending === 1 ? "uses" : "use"} the old one. Run \`naro functions secrets sync\` to finish (the sweep also brings them up within minutes).`
+      );
+    return {
+      complete: sync.complete,
+      synced: sync.synced,
+      pending: sync.pending
+    };
+  } catch (error) {
+    const message = printable(
+      isNaroError(error) ? error.message : String(error)
+    );
+    context.output.warn(
+      `\u26A0 The ${kind} key is replaced, but the functions could not be synced now: ${message} The sweep brings them up within minutes.`
+    );
+    return {
+      complete: false,
+      synced: [],
+      pending: live2,
+      error: {
+        code: isNaroError(error) ? error.code : "INTERNAL_ERROR",
+        message
+      }
+    };
+  }
+}
+function checkKeysSentence(kind, environment = null) {
   const keys = kind === "service" ? "naro backend keys --reveal" : "naro backend keys";
-  return `Run \`${keys}\` to see which key is live, then \`naro backend enable\`.`;
+  return `Run \`${keys}${envFlag(environment)}\` to see which key is live, then \`${enableBackendCommand(environment)}\`.`;
 }
-function rotationHint(kind) {
-  return `The rotation may have gone through anyway. ${checkKeysSentence(kind)}`;
+function rotationHint(kind, environment = null) {
+  return `The rotation may have gone through anyway. ${checkKeysSentence(kind, environment)}`;
 }
 function outcomeUnknown(error) {
   return error.code === "BACKEND_ROTATION_FAILED" || error.code === "INTERNAL_ERROR" || error.code === "NETWORK_ERROR" || error.status !== void 0 && error.status >= 500;
 }
 async function runBackendKeysRotate(context) {
   const kind = rotateKind(context);
+  const client = await dataClient(context);
+  const environment = dataEnvironment(context.flags);
+  const projectId = await context.resolveProjectId();
+  const functions = environment === null ? await liveFunctionCount(client, projectId) : 0;
   await confirmOrAbort(
     context,
-    `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.`
+    `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.${functions > 0 ? ` ${FUNCTIONS_ROTATE_NOTE(kind)}` : ""}`
   );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
   let rotated;
   try {
     rotated = await client.backend.rotateKey(projectId, kind);
   } catch (error) {
     if (!isNaroError(error)) throw error;
-    const hint = rotationHint(kind);
+    const hint = rotationHint(kind, environment);
     if (error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind)}`,
+        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind, environment)}`,
         { details: { hint }, cause: error }
       );
     if (!outcomeUnknown(error)) throw error;
@@ -1405,21 +1221,32 @@ async function runBackendKeysRotate(context) {
     });
   }
   const { backend, key } = rotated;
-  const warning = rotationWarning(kind, backend);
+  const warning = rotationWarning(kind, backend, environment);
+  const synced = functions > 0 && !context.flags.noSync ? await syncAfterRotation(context, client, projectId, kind, functions) : null;
   if (kind === "service") context.output.warn(SERVICE_KEY_WARNING);
   if (warning) context.output.warn(warning);
   context.output.result(
-    { projectId, kind, key, backend, ...warning ? { warning } : {} },
+    {
+      projectId,
+      kind,
+      key,
+      backend,
+      ...warning ? { warning } : {},
+      ...synced ? { functions: synced } : {}
+    },
     [
       `\u2705 Replaced the ${kind} key. The old one no longer works.`,
       `${keyLabel(kind)}${key}`,
-      kind === "anon" ? "Put the new key in your app and redeploy." : "Update NARO_SERVICE_KEY wherever your servers read it."
+      kind === "anon" ? "Put the new key in your app and redeploy." : "Update NARO_SERVICE_KEY wherever your servers read it.",
+      ...synced?.complete ? [
+        `\u2705 Functions carry the new key: ${functionCount(synced.synced.length)} synced.`
+      ] : []
     ]
   );
 }
 
 // src/commands/backend-auth.ts
-var processStdin2 = {
+var processStdin = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1442,14 +1269,21 @@ function sentence2(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
-function stoppedMessage(backend) {
+function stoppedMessage(backend, environment = null) {
+  const enable = enableBackendCommand(environment);
   const step = backend.step ?? "worker";
   const reason = backend.error?.trim() ? `: ${sentence2(backend.error)}` : ".";
   if (BACKEND_STEPS.indexOf(step) > BACKEND_STEPS.indexOf("worker"))
-    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`naro backend enable\` to finish.`;
-  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`naro backend enable\` puts the saved ones on it.`;
+    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`${enable}\` to finish.`;
+  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`${enable}\` puts the saved ones on it.`;
 }
 var NOT_APPLIED_WARNING = "\u26A0 These are the saved settings. The Naro worker's last update did not get past its upload, so it may still run older ones \u2014 run `naro backend enable` to put these on it.";
+function notAppliedWarning(environment) {
+  return environment === null ? NOT_APPLIED_WARNING : NOT_APPLIED_WARNING.replace(
+    "`naro backend enable`",
+    `\`${enableBackendCommand(environment)}\``
+  );
+}
 function authLines(auth) {
   const lines = [
     auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
@@ -1495,14 +1329,18 @@ function adviceLines2(auth) {
   return lines;
 }
 async function runBackendAuthStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
-  if (auth.applied === false) context.output.warn(NOT_APPLIED_WARNING);
-  context.output.result({ projectId, auth }, [
-    ...authLines(auth),
-    ...adviceLines2(auth)
-  ]);
+  const environment = dataEnvironment(context.flags);
+  if (auth.applied === false)
+    context.output.warn(notAppliedWarning(environment));
+  context.output.result(
+    { projectId, auth },
+    [...authLines(auth), ...adviceLines2(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
 async function readSecret(context, input, given, flag, what, usage) {
   if (!given)
@@ -1518,6 +1356,7 @@ async function readSecret(context, input, given, flag, what, usage) {
 }
 async function change(context, send2, done, after) {
   const projectId = await context.resolveProjectId();
+  const environment = dataEnvironment(context.flags);
   let answer;
   try {
     answer = await send2(projectId);
@@ -1525,13 +1364,13 @@ async function change(context, send2, done, after) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
+        `The change did not answer within 2 minutes. \`naro backend auth${envFlag(environment)}\` shows what is saved, and \`${enableBackendCommand(environment)}\` finishes putting it on the Naro worker.`,
         { cause: error }
       );
     const saved = isNaroError(error) ? error.details?.auth : void 0;
     if (isNaroError(error) && error.code === "BACKEND_PROVISION_FAILED" && typeof saved === "object" && saved !== null) {
       for (const line of authLines(saved))
-        context.output.log(line);
+        context.output.log(forEnvironment(line, environment));
       throw new NaroError(error.code, error.message, {
         details: { projectId, ...error.details }
       });
@@ -1540,22 +1379,31 @@ async function change(context, send2, done, after) {
   }
   const { auth, backend } = answer;
   if (backend.status === "error") {
-    for (const line of authLines(auth)) context.output.log(line);
-    throw new NaroError("BACKEND_PROVISION_FAILED", stoppedMessage(backend), {
-      details: { projectId, auth, backend }
-    });
+    for (const line of authLines(auth))
+      context.output.log(forEnvironment(line, environment));
+    throw new NaroError(
+      "BACKEND_PROVISION_FAILED",
+      stoppedMessage(backend, environment),
+      {
+        details: { projectId, auth, backend }
+      }
+    );
   }
   if (backend.status !== "ready")
     context.output.warn(
-      "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`."
+      forEnvironment(
+        "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`.",
+        environment
+      )
     );
-  context.output.result({ projectId, auth, backend }, [
-    ...done,
-    ...after ? after(auth) : [],
-    ...authLines(auth)
-  ]);
+  context.output.result(
+    { projectId, auth, backend },
+    [...done, ...after ? after(auth) : [], ...authLines(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
-async function runBackendAuthEmailSet(context, input = processStdin2) {
+async function runBackendAuthEmailSet(context, input = processStdin) {
   const { provider, from } = context.flags;
   if (provider === void 0 || from === void 0)
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.email);
@@ -1572,7 +1420,7 @@ async function runBackendAuthEmailSet(context, input = processStdin2) {
     "Resend API key",
     AUTH_USAGE.email
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1588,7 +1436,7 @@ async function runBackendAuthEmailRemove(context) {
     context,
     "Remove email? Confirmation and password reset emails stop at once."
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, "email"),
@@ -1601,7 +1449,7 @@ function providerOf(context, usage) {
     throw new NaroError("VALIDATION_FAILED", usage);
   return provider;
 }
-async function runBackendAuthOAuthSet(context, input = processStdin2) {
+async function runBackendAuthOAuthSet(context, input = processStdin) {
   const provider = providerOf(context, AUTH_USAGE.oauth);
   const clientId = context.flags.clientId;
   if (clientId === void 0)
@@ -1614,7 +1462,7 @@ async function runBackendAuthOAuthSet(context, input = processStdin2) {
     `${LABELS[provider]} client secret`,
     AUTH_USAGE.oauth
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const patch = {
     oauth: { [provider]: { clientId, clientSecret } }
   };
@@ -1632,7 +1480,7 @@ async function runBackendAuthOAuthRemove(context) {
     context,
     `Remove ${LABELS[provider]} sign-in? Users who signed in with ${LABELS[provider]} cannot sign in with it until it is set up again.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, provider),
@@ -1640,7 +1488,7 @@ async function runBackendAuthOAuthRemove(context) {
   );
 }
 async function runBackendAuthRedirectsList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
   const production = productionOrigins(auth);
@@ -1657,7 +1505,10 @@ async function runBackendAuthRedirectsList(context) {
       ),
       ...auth.redirectOrigins,
       ...auth.redirectOrigins.length === 0 ? [
-        "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/."
+        forEnvironment(
+          "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/.",
+          dataEnvironment(context.flags)
+        )
       ] : []
     ]
   );
@@ -1670,7 +1521,7 @@ function originOf(context) {
 }
 async function runBackendAuthRedirectsAdd(context) {
   const origin = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1684,7 +1535,7 @@ function allowing(list, origin) {
 }
 async function runBackendAuthRedirectsRemove(context) {
   const given = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const parsed = parseRedirectEntry(given);
   if (parsed) {
@@ -1730,7 +1581,7 @@ async function runBackendAuthRequireVerification(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.verification);
   const on = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { requireEmailVerification: on }),
@@ -1744,7 +1595,7 @@ async function runBackendAuthSignups(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.signups);
   const open = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { signupsEnabled: open }),
@@ -1763,7 +1614,7 @@ async function runBackendAuthPassword(context) {
       "VALIDATION_FAILED",
       `--min-length must be a whole number from ${String(MIN_LENGTH_FLOOR)} to ${String(MIN_LENGTH_CEILING)}. ${AUTH_USAGE.password}`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { passwordMinLength: length }),
@@ -1781,7 +1632,7 @@ var USERS_USAGE = {
 var PASSWORD_FLAG_WARNING = "\u26A0 --password puts the password in your shell history. Pipe it in with --password-stdin instead.";
 var OUTDATED_MESSAGE = "This project's backend is older than user management. Run `naro backend enable` once to update this project's backend. Then run this command again.";
 var PAGE_SIZE = 1e3;
-var processStdin3 = {
+var processStdin2 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1835,13 +1686,16 @@ function userTable(users) {
   );
 }
 async function runBackendUsersList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users, total } = await allUsers(client, projectId);
   context.output.result(
     { projectId, users, total },
     users.length === 0 ? [
-      "No users yet. Create one with `naro backend users create --username <name> --password-stdin`."
+      forEnvironment(
+        "No users yet. Create one with `naro backend users create --username <name> --password-stdin`.",
+        dataEnvironment(context.flags)
+      )
     ] : [
       `${String(total)} ${total === 1 ? "user" : "users"}, newest first:`,
       ...userTable(users)
@@ -1880,12 +1734,12 @@ function userLines(user) {
     `Created:     ${printable(user.createdAt)}`
   ];
 }
-async function runBackendUsersCreate(context, input = processStdin3) {
+async function runBackendUsersCreate(context, input = processStdin2) {
   const { username, email } = context.flags;
   if (username === void 0 && email === void 0 || context.positionals.length > 0)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
   const password = await passwordOf(context, input);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const body = { password };
   if (username !== void 0) body.username = username;
@@ -1911,7 +1765,7 @@ async function runBackendUsersDelete(context) {
   const [given] = context.positionals;
   if (given === void 0 || context.positionals.length > 1)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.delete);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users } = await allUsers(client, projectId);
   const user = find(users, given);
@@ -1958,9 +1812,9 @@ async function runCancel(context) {
 }
 
 // src/commands/db.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { resolve } from "path";
-var processStdin4 = {
+var processStdin3 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -2018,7 +1872,7 @@ function usageLines(info) {
   }
   return lines;
 }
-function describeLines(info) {
+function describeLines(info, environment = null) {
   const lines = [
     `Provider: ${info.provider}`,
     `Status:   ${info.status}`,
@@ -2039,17 +1893,22 @@ function describeLines(info) {
   );
   lines.push(...usageLines(info));
   if (info.provider === "none")
-    lines.push("Run `naro db enable` to create the database.");
+    lines.push(
+      environment === null ? "Run `naro db enable` to create the database." : `The ${environment} environment has no database yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
   return lines;
 }
 async function runDbInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.info(projectId);
-  context.output.result({ projectId, database }, describeLines(database));
+  context.output.result(
+    { projectId, database },
+    describeLines(database, dataEnvironment(context.flags))
+  );
 }
 async function runDbEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.enable(projectId);
   context.output.result({ projectId, database }, [
@@ -2064,7 +1923,7 @@ async function readSql(context, deps) {
     sql = positional;
   } else if (context.flags.file !== void 0) {
     try {
-      sql = readFileSync2(resolve(context.cwd, context.flags.file), "utf8");
+      sql = readFileSync(resolve(context.cwd, context.flags.file), "utf8");
     } catch {
       throw new NaroError(
         "VALIDATION_FAILED",
@@ -2078,9 +1937,9 @@ async function readSql(context, deps) {
     throw new NaroError("VALIDATION_FAILED", USAGE);
   return sql;
 }
-async function runDbQuery(context, deps = processStdin4) {
+async function runDbQuery(context, deps = processStdin3) {
   const sql = await readSql(context, deps);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const result = await client.db.query(projectId, { sql });
   const lines = [];
@@ -2097,13 +1956,13 @@ async function runDbQuery(context, deps = processStdin4) {
 // src/commands/db-backup.ts
 import {
   createWriteStream,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   renameSync,
   rmSync,
   statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "fs";
-import { basename, dirname, join as join2, resolve as resolve2 } from "path";
+import { basename, dirname, join, resolve as resolve2 } from "path";
 import { Transform } from "stream";
 import { pipeline } from "stream/promises";
 var defaults = {
@@ -2111,18 +1970,20 @@ var defaults = {
   stdout: process.stdout,
   sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
   writeFile: (path, data) => {
-    mkdirSync2(dirname(path), { recursive: true });
-    writeFileSync2(path, data, { flag: "wx" });
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, data, { flag: "wx" });
   }
 };
-var EXPORT_NOTICE = "Exporting the project database. Cloudflare holds other queries to this database until the export finishes.";
+function exportNotice(environment) {
+  return `Exporting ${databaseName(environment)}. Cloudflare holds other queries to this database until the export finishes.`;
+}
 function reasonOf(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function withoutUrl(text, url) {
   return text.split(url).join("the signed URL").replace(/\S*X-Amz-Signature=\S*/gi, "the signed URL");
 }
-function downloadFailed(url, reason, original) {
+function downloadFailed(url, reason, original, again = "naro db dump") {
   const scrubbed = withoutUrl(reason, url);
   let cause;
   if (original !== void 0) {
@@ -2135,7 +1996,7 @@ function downloadFailed(url, reason, original) {
   }
   return new NaroError(
     "DATABASE_UNAVAILABLE",
-    `Could not download the dump (${scrubbed}). Run naro db dump again.`,
+    `Could not download the dump (${scrubbed}). Run ${again} again.`,
     cause === void 0 ? {} : { cause }
   );
 }
@@ -2153,17 +2014,22 @@ var DownloadStreamError = class extends Error {
     this.name = "DownloadStreamError";
   }
 };
-async function openDownload(deps, url) {
+async function openDownload(deps, url, again) {
   let response;
   try {
     response = await deps.fetch(url);
   } catch (error) {
-    throw downloadFailed(url, reasonOf(error), error);
+    throw downloadFailed(url, reasonOf(error), error, again);
   }
   if (!response.ok || response.body === null) {
     await response.body?.cancel().catch(() => {
     });
-    throw downloadFailed(url, `HTTP ${String(response.status)}`);
+    throw downloadFailed(
+      url,
+      `HTTP ${String(response.status)}`,
+      void 0,
+      again
+    );
   }
   return response.body;
 }
@@ -2198,8 +2064,8 @@ async function streamInto(body, destination, end) {
   await pipeline(chunksOf(body), counter, destination, { end });
   return bytes;
 }
-function streamFailed(error, url, shown) {
-  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original) : writeFailed(shown, error);
+function streamFailed(error, url, shown, again) {
+  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original, again) : writeFailed(shown, error);
 }
 function refuseDirectory(path, shown) {
   let isDirectory = false;
@@ -2215,14 +2081,14 @@ function refuseDirectory(path, shown) {
 }
 function makeOutputDirectory(path, shown) {
   try {
-    mkdirSync2(dirname(path), { recursive: true });
+    mkdirSync(dirname(path), { recursive: true });
   } catch (error) {
     throw writeFailed(shown, error);
   }
 }
-async function downloadToFile(deps, url, path, shown) {
-  const body = await openDownload(deps, url);
-  const partial = join2(
+async function downloadToFile(deps, url, path, shown, again) {
+  const body = await openDownload(deps, url, again);
+  const partial = join(
     dirname(path),
     `.${basename(path)}.${String(process.pid)}.part`
   );
@@ -2235,15 +2101,15 @@ async function downloadToFile(deps, url, path, shown) {
       rmSync(partial, { force: true });
     } catch {
     }
-    throw streamFailed(error, url, shown);
+    throw streamFailed(error, url, shown, again);
   }
 }
-async function downloadToStdout(deps, url) {
-  const body = await openDownload(deps, url);
+async function downloadToStdout(deps, url, again) {
+  const body = await openDownload(deps, url, again);
   try {
     return await streamInto(body, deps.stdout, false);
   } catch (error) {
-    throw streamFailed(error, url, "stdout");
+    throw streamFailed(error, url, "stdout", again);
   }
 }
 async function runDbDump(context, overrides = {}) {
@@ -2272,10 +2138,12 @@ async function runDbDump(context, overrides = {}) {
   };
   const output = flags.output === void 0 ? null : { path: resolve2(context.cwd, flags.output), shown: flags.output };
   if (output) refuseDirectory(output.path, output.shown);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   if (output) makeOutputDirectory(output.path, output.shown);
-  context.output.warn(EXPORT_NOTICE);
+  const environment = dataEnvironment(context.flags);
+  const again = `naro db dump${envFlag(environment)}`;
+  context.output.warn(exportNotice(environment));
   const step = await client.db.export(projectId, options, {
     sleep: deps.sleep
   });
@@ -2283,16 +2151,16 @@ async function runDbDump(context, overrides = {}) {
   if (file === null)
     throw new NaroError(
       "DATABASE_UNAVAILABLE",
-      "Could not download the dump (Cloudflare finished the export without a file). Run naro db dump again."
+      `Could not download the dump (Cloudflare finished the export without a file). Run ${again} again.`
     );
-  const bytes = output === null ? await downloadToStdout(deps, file.url) : await downloadToFile(deps, file.url, output.path, output.shown);
+  const bytes = output === null ? await downloadToStdout(deps, file.url, again) : await downloadToFile(deps, file.url, output.path, output.shown, again);
   const bookmark = step.atBookmark;
   if (!context.output.json) {
     context.output.warn(
       `\u2713 Wrote ${flags.output ?? "stdout"} (${humanSize(bytes)}) at bookmark ${bookmark}.`
     );
     context.output.warn(
-      `  naro db restore --bookmark ${bookmark} returns the database to this point.`
+      `  naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} returns the database to this point.`
     );
   }
   context.output.result({ output: flags.output, bytes, atBookmark: bookmark });
@@ -2313,7 +2181,7 @@ function withWayBack(context, error, before) {
     return error;
   if (!context.output.json)
     context.output.warn(
-      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before} undoes it.`
+      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before}${envFlag(dataEnvironment(context.flags))} undoes it.`
     );
   return new NaroError(error.code, error.message, {
     ...error.status === void 0 ? {} : { status: error.status },
@@ -2331,7 +2199,7 @@ async function runDbRestore(context) {
     );
   if ("bookmark" in given && !isBookmark(given.bookmark))
     throw new NaroError("VALIDATION_FAILED", BOOKMARK_FORMAT_MESSAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let target;
   let at = null;
@@ -2358,7 +2226,7 @@ async function runDbRestore(context) {
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore ${databaseName(dataEnvironment(context.flags))} to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -2373,8 +2241,8 @@ async function runDbRestore(context) {
       previousBookmark: restored.previousBookmark
     },
     [
-      `\u2713 Restored the project database to bookmark ${restored.bookmark}.`,
-      `  To undo: naro db restore --bookmark ${restored.previousBookmark}`
+      `\u2713 Restored ${databaseName(dataEnvironment(context.flags))} to bookmark ${restored.bookmark}.`,
+      `  To undo: naro db restore --bookmark ${restored.previousBookmark}${envFlag(dataEnvironment(context.flags))}`
     ]
   );
 }
@@ -2388,9 +2256,9 @@ async function runDbPull(context, overrides = {}) {
       `${relativeToCwd(context, dir)} already has ${String(existing.length)} migration file(s). naro db pull only baselines a project without migrations; to see the current schema, run naro db dump --schema-only.`
     );
   const name = nextMigrationFileName(existing, "remote_schema");
-  const path = join2(dir, name);
+  const path = join(dir, name);
   const shown = relativeToCwd(context, path);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
@@ -2470,12 +2338,12 @@ async function readPolicies(client, projectId, warn) {
     return void 0;
   }
   const policies = [];
-  const unreadable = [];
+  const unreadable2 = [];
   for (const row of objectsOf(stored)) {
     const policy = loadPolicy(row);
     if (policy === void 0) continue;
     if (policy.invalid !== null)
-      unreadable.push({
+      unreadable2.push({
         table: policy.table,
         name: policy.name,
         reason: policy.invalid
@@ -2496,7 +2364,7 @@ async function readPolicies(client, projectId, warn) {
   return {
     tables: tableNames(snapshot),
     policies,
-    unreadable,
+    unreadable: unreadable2,
     snapshot,
     indexes: indexesFromRows(objectsOf(indexes))
   };
@@ -2524,7 +2392,7 @@ function issueLines(issues, tables) {
   ];
 }
 async function runDbLint(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
@@ -2573,8 +2441,8 @@ async function runDbLint(context) {
 }
 
 // src/commands/db-reset.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
 var MAX_STATEMENTS = 50;
 var SCHEMA_FILTER = `${systemTablePredicate("name")} AND ${systemTablePredicate("tbl_name")}`;
 var SCHEMA_SQL2 = [
@@ -2730,7 +2598,7 @@ function resetStopped(context, error, bookmark, lead, message) {
   const naroError = isNaroError(error) ? error : toNaroError(error);
   if (!context.output.json)
     context.output.warn(
-      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   return new NaroError(naroError.code, message(naroError.message), {
     ...naroError.status === void 0 ? {} : { status: naroError.status },
@@ -2756,8 +2624,8 @@ async function runDbReset(context) {
 ${problemLines.join("\n")}`,
       { details: { problems } }
     );
-  const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
-  const client = await context.client();
+  const texts = files.map((name) => readFileSync2(join2(dir, name), "utf8"));
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
   const { policyTable: policyTable2, storageTable, ...input } = await readSchema(
@@ -2831,11 +2699,11 @@ ${problemLines.join("\n")}`,
   }
   if (bookmark !== null)
     context.output.log(
-      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   await confirmOrAbort(
     context,
-    `Reset the project database? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
+    `Reset ${databaseName(dataEnvironment(context.flags))}? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
   );
   let done = 0;
   const total = plan.batches.length;
@@ -2887,18 +2755,20 @@ ${problemLines.join("\n")}`,
       warnings
     },
     [
-      `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
-      ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
+      `\u2713 Reset ${databaseName(dataEnvironment(context.flags))}: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+      ...bookmark === null ? [] : [
+        `  To undo: naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))}`
+      ]
     ]
   );
 }
 
 // src/commands/db-schema.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { resolve as resolve3 } from "path";
 
 // ../../packages/naro-sdk/src/query/filters.ts
@@ -3316,7 +3186,7 @@ function conditionsFrom(flags) {
 function patchFromFile(context, path, table3) {
   let text;
   try {
-    text = readFileSync4(resolve3(context.cwd, path), "utf8");
+    text = readFileSync3(resolve3(context.cwd, path), "utf8");
   } catch {
     refuse2(`Could not read ${path}.`);
   }
@@ -3478,12 +3348,12 @@ function conditionText(action, value) {
   if (isInvalid(value))
     return `cannot be read (${value.invalid}); it denies everyone but the service key`;
   const using = value.using ? filterText(value.using) : "";
-  const check = value.check ? filterText(value.check) : "";
-  if (using === void 0 || check === void 0)
+  const check2 = value.check ? filterText(value.check) : "";
+  if (using === void 0 || check2 === void 0)
     return `as JSON ${JSON.stringify(value)}`;
   const parts = [];
   if (using !== "") parts.push(`using ${using}`);
-  if (check !== "") parts.push(`check ${check}`);
+  if (check2 !== "") parts.push(`check ${check2}`);
   else if (action === "update") parts.push("check = using");
   const text = parts.join("; ");
   return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
@@ -3524,6 +3394,12 @@ function policyTable(policies) {
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
+function hintsFor(lines, environment) {
+  if (environment === null) return lines;
+  return lines.map(
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+  );
+}
 function statementLine(policy) {
   if (policy.invalid !== null)
     return printable(
@@ -3556,7 +3432,7 @@ function policyStatements(policies) {
 }
 async function runPolicyList(context) {
   const table3 = context.flags.table;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
@@ -3574,7 +3450,10 @@ async function runPolicyList(context) {
       "No policies yet: every table denies anon and signed-in requests.",
       'Add one with `naro policy create "CREATE POLICY \u2026"` or `naro policy set <table> --select public`.'
     ];
-  context.output.result({ projectId, policies }, lines);
+  context.output.result(
+    { projectId, policies },
+    hintsFor(lines, dataEnvironment(context.flags))
+  );
 }
 function statementText(context) {
   const [positional] = context.positionals;
@@ -3584,7 +3463,7 @@ function statementText(context) {
   let text = positional;
   if (file !== void 0) {
     try {
-      text = readFileSync4(resolve3(context.cwd, file), "utf8");
+      text = readFileSync3(resolve3(context.cwd, file), "utf8");
     } catch {
       refuse2(`Could not read ${file}.`);
     }
@@ -3648,7 +3527,7 @@ async function runStatements(client, projectId, statements, allowUnindexed) {
 }
 async function runPolicyCreate(context) {
   const statements = policyStatementsOf(statementText(context));
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const applied = await runStatements(
     client,
@@ -3669,7 +3548,7 @@ async function runPolicyDrop(context) {
     context,
     `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
@@ -3683,7 +3562,7 @@ async function runPolicyDrop(context) {
 async function runPolicySet(context) {
   const [table3] = context.positionalOrThrow(1, SET_USAGE);
   const patch = policyPatch(context.flags, context, table3);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
@@ -3700,11 +3579,14 @@ async function runPolicySet(context) {
   }
   context.output.result(
     { projectId, policy, ...named === void 0 ? {} : { policies: named } },
-    [
-      `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-      ...policyTable([policy]),
-      ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
-    ]
+    hintsFor(
+      [
+        `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
+        ...policyTable([policy]),
+        ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
+      ],
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runPolicyRemove(context) {
@@ -3713,7 +3595,7 @@ async function runPolicyRemove(context) {
     context,
     `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
@@ -3846,7 +3728,7 @@ function ruleText(value) {
   return "invalid" in value ? "invalid" : "condition";
 }
 var SUGAR_NAME = /^naro_(?:select|insert|update|delete)$/;
-function removedLines(policy, dryRun) {
+function removedLines(policy, dryRun, environment) {
   const verb = dryRun ? "Would remove" : "\u2713 Removed";
   const names = policy.policies ?? [];
   let line;
@@ -3884,7 +3766,11 @@ function removedLines(policy, dryRun) {
     lines.push(
       `  As a command, for the owner ${one ? "rule" : "rules"} (${owners.map((owner) => printable(owner.name)).join(", ")}): CREATE POLICY has no owner column, so naro policy create cannot make ${one ? "it" : "them"} again.`,
       // The server's bytes, or not shown: a name may hold a line break.
-      typeof command !== "string" ? "  naro policy set <table> --<action> owner --owner <column> sets one." : isPrintable(command) ? command : "  The command has characters that cannot be shown here: --json has the exact text."
+      // Under --env, the command acts on the environment (PR #343 review 2).
+      typeof command !== "string" ? forEnvironment(
+        "  naro policy set <table> --<action> owner --owner <column> sets one.",
+        environment
+      ) : isPrintable(command) ? forEnvironment(command, environment) : "  The command has characters that cannot be shown here: --json has the exact text."
     );
   }
   return lines;
@@ -3899,7 +3785,7 @@ async function runSchemaChange(context, operations, question) {
     const { confirm: _confirm, ...rest } = operation;
     return rest;
   }) : operations;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -3924,7 +3810,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
       ...result.policies.map((policy) => policyLine(policy, true)),
-      ...removed.flatMap((policy) => removedLines(policy, true))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, true, dataEnvironment(context.flags))
+      )
     ]);
     return;
   }
@@ -3932,13 +3820,13 @@ async function runSchemaChange(context, operations, question) {
   let file = null;
   let fileWarning;
   const relDir = relativeToCwd(context, dir);
-  const rel = join4(relDir === "." ? "" : relDir, name);
+  const rel = join3(relDir === "." ? "" : relDir, name);
   if (context.flags.noWrite) {
     fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
   } else {
     try {
-      mkdirSync3(dir, { recursive: true });
-      writeFileSync3(join4(dir, name), result.sql, { flag: "wx" });
+      mkdirSync2(dir, { recursive: true });
+      writeFileSync2(join3(dir, name), result.sql, { flag: "wx" });
       file = rel;
     } catch (error) {
       const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
@@ -3946,7 +3834,10 @@ async function runSchemaChange(context, operations, question) {
     }
   }
   for (const warning of allWarnings)
-    context.output.warn(`\u26A0 ${printable(warning)}`);
+    context.output.warn(
+      `\u26A0 ${printable(forEnvironment(warning, dataEnvironment(context.flags)))}`
+    );
+  fileWarning &&= forEnvironment(fileWarning, dataEnvironment(context.flags));
   if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
   context.output.result(
     {
@@ -3960,7 +3851,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
       ...result.policies.map((policy) => policyLine(policy)),
-      ...removed.flatMap((policy) => removedLines(policy, false))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, false, dataEnvironment(context.flags))
+      )
     ]
   );
 }
@@ -4011,24 +3904,29 @@ async function runDbTableRename(context) {
   if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
   await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
+function inDatabase(environment) {
+  return environment === null ? "" : ` in ${databaseName(environment)}`;
+}
 async function runDbTableDropColumn(context) {
   const [table3, column] = context.positionals;
   if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
   const target = `${table3}.${column}`;
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropColumn", table: table3, column, confirm: target }],
-    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop column ${printable(target)}${inDatabase(env)} and its value in every row? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
   const [table3] = context.positionals;
   if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropTable", table: table3, confirm: table3 }],
-    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop table ${printable(table3)}${inDatabase(env)} and every row in it? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
@@ -4057,7 +3955,7 @@ async function runDbIndexDrop(context) {
 var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+  sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -4588,7 +4486,7 @@ async function runInspect(context) {
 
 // src/commands/domains.ts
 var defaults3 = {
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+  sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms)),
   now: () => Date.now()
 };
 var FIRST_DELAY_MS = 5e3;
@@ -4806,7 +4704,7 @@ async function runDomainsVerify(context, overrides = {}) {
     ]);
     return;
   }
-  let timedOut = false;
+  let timedOut2 = false;
   let abandoned = false;
   if (wait && !domains.every(isReady)) {
     const deadline = deps.now() + WAIT_TIMEOUT_MS;
@@ -4819,7 +4717,7 @@ async function runDomainsVerify(context, overrides = {}) {
       }
       const remaining = deadline - deps.now();
       if (remaining <= 0) {
-        timedOut = true;
+        timedOut2 = true;
         break;
       }
       for (const domain of pending)
@@ -4839,7 +4737,7 @@ async function runDomainsVerify(context, overrides = {}) {
     const notReady = domains.filter((domain) => !isReady(domain));
     const names = notReady.map((domain) => domain.hostname).join(", ");
     const details = { projectId, domains, ready: false };
-    if (timedOut) {
+    if (timedOut2) {
       const cause2 = notReady[0]?.cause;
       throw new NaroError(
         "TIMEOUT",
@@ -4886,7 +4784,7 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { chmodSync, existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, existsSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4 } from "path";
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var KEY_MAX_LENGTH = 256;
@@ -5001,7 +4899,7 @@ async function runEnvImport(context) {
   const target = parseTarget(targetArg);
   let text;
   try {
-    text = readFileSync5(resolve4(context.cwd, file), "utf8");
+    text = readFileSync4(resolve4(context.cwd, file), "utf8");
   } catch {
     throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
   }
@@ -5092,7 +4990,7 @@ ${serializeDotenv(vars)}`;
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
-  writeFileSync4(path, text, { mode: 384 });
+  writeFileSync3(path, text, { mode: 384 });
   chmodSync(path, 384);
   context.output.result({ projectId, file, environment: surface, count: count2 }, [
     `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
@@ -5103,6 +5001,7 @@ ${serializeDotenv(vars)}`;
 var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
 var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
 var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var PROVISION_USAGE = "Usage: naro environments provision <slug>";
 var NO_BRANCH = "\u2014";
 function parseCopyEnv(value) {
   if (value === void 0) return void 0;
@@ -5137,14 +5036,26 @@ function table2(rows) {
     ).join("  ")
   );
 }
+function dataCell(environment) {
+  const status = environment.data?.status ?? "none";
+  return status === "none" ? NO_BRANCH : status;
+}
 function environmentRow(environment) {
   return [
     environment.slug,
     environment.url,
     environment.branch ?? NO_BRANCH,
-    environment.protectionEnabled ? "on" : "off"
+    environment.protectionEnabled ? "on" : "off",
+    dataCell(environment)
   ];
 }
+function dataErrorLines(environments) {
+  return environments.flatMap(
+    (environment) => environment.data?.status === "error" ? [
+      `\u26A0 ${environment.slug}: ${environment.data.error ?? "its data could not be made."} Run \`naro environments provision ${environment.slug}\` to try again.`
+    ] : []
+  );
+}
 async function runEnvironmentsList(context) {
   const projectId = await context.resolveProjectId();
   const client = await context.client();
@@ -5152,9 +5063,10 @@ async function runEnvironmentsList(context) {
   const count2 = String(environments.length);
   context.output.result({ projectId, environments, limit }, [
     ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
-      ["slug", "url", "branch", "protection"],
+      ["slug", "url", "branch", "protection", "data"],
       ...environments.map(environmentRow)
     ]),
+    ...dataErrorLines(environments),
     limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
   ]);
 }
@@ -5217,7 +5129,7 @@ async function runEnvironmentsDelete(context) {
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
-    `Delete environment ${slug}? Its worker and protection key are removed.`
+    `Delete environment ${slug}? Its worker, protection key and data \u2014 database, backend and Storage files \u2014 are removed.`
   );
   const client = await context.client();
   const found = await client.environments.get(projectId, slug);
@@ -5226,132 +5138,111 @@ async function runEnvironmentsDelete(context) {
     `\u2705 Deleted environment ${slug}`
   ]);
 }
-
-// src/commands/gen.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname2, resolve as resolve5 } from "path";
-var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
-async function runGenTypes(context) {
-  const { lang } = context.flags;
-  if (lang !== void 0 && lang !== "typescript")
-    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
-  const client = await context.client();
+async function runEnvironmentsProvision(context) {
+  const [slug] = context.positionalOrThrow(1, PROVISION_USAGE);
   const projectId = await context.resolveProjectId();
-  const tables = await client.db.tables(projectId);
-  const read = await policiesForTypes(client, projectId);
-  const types = generateTypes(
-    tables,
-    read.policies === void 0 ? {} : { policies: read.policies }
-  );
-  const undescribed = tables.flatMap(
-    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
-  );
-  for (const { name, error } of undescribed)
-    context.output.warn(
-      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
-    );
-  if (read.policies === void 0)
-    context.output.warn(
-      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
-    );
-  const extra = {
-    ...undescribed.length > 0 ? { undescribed } : {},
-    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
-  };
-  if (context.flags.output) {
-    const path = resolve5(context.cwd, context.flags.output);
-    mkdirSync4(dirname2(path), { recursive: true });
-    writeFileSync5(path, types);
-    context.output.result(
-      {
-        projectId,
-        output: context.flags.output,
-        tables: tables.length,
-        ...extra
-      },
-      [
-        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
-      ]
-    );
-    return;
-  }
-  context.output.result({ projectId, types, ...extra }, [
-    types.replace(/\n$/, "")
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.provision(projectId, found.id);
+  context.output.result({ projectId, environment }, [
+    (environment.data?.status ?? "none") === "none" ? `Environment ${slug} has no data to make: the project uses neither a Naro database nor a backend.` : `\u2705 Making environment ${slug}'s data \u2014 \`naro environments\` shows how it goes.`
   ]);
 }
 
-// src/commands/insights.ts
-function queryOf2(flags) {
-  const filters = filtersOf(flags, SPEED_INSIGHTS_FILTER_KEYS);
-  return {
-    ...flags.range !== void 0 ? { range: flags.range } : {},
-    ...flags.metric !== void 0 ? { metric: flags.metric } : {},
-    ...flags.env !== void 0 ? { environment: flags.env } : {},
-    ...Object.keys(filters).length > 0 ? { filters } : {}
-  };
+// src/commands/functions.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// src/functions/scaffold.ts
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname2, join as join4, relative, resolve as resolve5, sep } from "path";
+var NARO_JS_FUNCTIONS_MISSING = 'Cannot find "naro-js/functions". Install naro-js 0.7.0 or later: npm install naro-js@latest.';
+function scaffoldSource(name) {
+  return `import { withNaro } from "naro-js/functions";
+
+// Called at https://<your-app>.naro.sh/_naro/v1/functions/${name}.
+// \`naro\` acts as the caller, so the tables' row-level security applies;
+// \`naroAdmin\` uses the service key.
+Deno.serve(
+  withNaro(async (req, { user }) => {
+    const { name } = await req.json().catch(() => ({ name: "world" }));
+    return Response.json({ message: \`Hello \${name}!\`, user: user?.id ?? null });
+  }),
+);
+`;
 }
-async function runInsights(context) {
-  if (context.flags.referrer !== void 0 && context.flags.referrer !== "")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Speed Insights has no referrer; drop --referrer."
-    );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const query = queryOf2(context.flags);
-  const filters = query.filters ?? {};
-  if (context.flags.route !== void 0) {
-    const result = await client.insights.paths(projectId, {
-      ...query,
-      route: context.flags.route
-    });
-    context.output.result(
-      { projectId, ...result },
-      routePathsLines(result, filters)
-    );
-    return;
+function naroJsInstalled(root) {
+  for (let dir = resolve5(root); ; dir = dirname2(dir)) {
+    if (existsSync2(join4(dir, "node_modules", "naro-js", "package.json")))
+      return true;
+    if (dirname2(dir) === dir) return false;
   }
-  const overview = await client.insights.overview(projectId, query);
-  if (overview.deploymentsError)
-    context.output.warn(
-      `Deployments are unavailable right now: ${printable(overview.deploymentsError.message)}`
-    );
-  context.output.result(
-    { projectId, ...overview },
-    reportLines(overview.report, overview.deployments, filters)
-  );
 }
-async function setInsights(context, enabled) {
-  if (context.flags.env !== void 0)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Speed Insights has one switch for production and preview; drop --env."
-    );
-  const filter = givenFilterFlag(context.flags);
-  if (filter !== void 0)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Filters only narrow a report; drop --${filter}.`
-    );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const result = await client.insights.setEnabled(projectId, enabled);
-  context.output.result({ projectId, enabled: result.enabled }, [
-    result.enabled ? TURNED_ON : TURNED_OFF
-  ]);
+function naroJsFunctionsResolves(root) {
+  if (!naroJsInstalled(root)) return false;
+  try {
+    createRequire(join4(root, "package.json")).resolve("naro-js/functions");
+    return true;
+  } catch {
+    return false;
+  }
 }
-function runInsightsEnable(context) {
-  return setInsights(context, true);
+var COVERS = /^(\.\/)?(\*|\*\*|naro)(\/|$)|^\.\/?$/;
+var LEAVES_OUT = /^(\.\/)?naro(\/functions)?\/?(\*\*)?$/;
+function tsconfigCovers(root, functionsLabel) {
+  const file = join4(root, "tsconfig.json");
+  if (!existsSync2(file)) return false;
+  let config;
+  try {
+    config = parseJsonc(readFileSync5(file, "utf8"));
+  } catch {
+    return false;
+  }
+  const include = Array.isArray(config.include) ? config.include.filter((p) => typeof p === "string") : null;
+  const exclude = Array.isArray(config.exclude) ? config.exclude.filter((p) => typeof p === "string") : [];
+  const covered = include === null || include.some((pattern) => COVERS.test(pattern));
+  const leftOut = exclude.some(
+    (pattern) => LEAVES_OUT.test(pattern) || pattern === functionsLabel
+  );
+  return covered && !leftOut;
+}
+function gitignoreCovers(root, envPath) {
+  const file = join4(root, ".gitignore");
+  if (!existsSync2(file)) return false;
+  const accepted = /* @__PURE__ */ new Set([
+    envPath,
+    `/${envPath}`,
+    ".env",
+    "/.env",
+    "**/.env",
+    ".env*",
+    "*.env"
+  ]);
+  return readFileSync5(file, "utf8").split(/\r?\n/).some((line) => accepted.has(line.trim()));
 }
-function runInsightsDisable(context) {
-  return setInsights(context, false);
+function scaffoldNotes(folder) {
+  const notes = [];
+  if (!naroJsFunctionsResolves(folder.root))
+    notes.push(`\u26A0 ${NARO_JS_FUNCTIONS_MISSING}`);
+  const functionsLabel = relative(folder.root, folder.dir).split(sep).join("/");
+  if (!folder.explicit && tsconfigCovers(folder.root, functionsLabel))
+    notes.push(
+      `\u26A0 tsconfig.json type-checks naro/functions too. If your app's type check trips on the functions' Deno code, add "exclude": ["naro/functions"] to it.`
+    );
+  const envPath = `${functionsLabel}/.env`;
+  if (!gitignoreCovers(folder.root, envPath))
+    notes.push(
+      `\u26A0 ${envPath} is not in .gitignore. Add it before you keep local secrets there.`
+    );
+  return notes;
 }
 
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
 var FOLLOW_TIMEOUT_MS = 30 * 6e4;
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -5361,6 +5252,27 @@ function formatRuntimeLog(entry) {
   const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
   return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
 }
+var FOLLOW_JSON_REFUSAL = "--follow streams runtime logs until you stop it, so it has no JSON result. Drop --json to stream, or drop --follow for the current entries as JSON.";
+async function followRuntimeEntries(context, read, format, wait = sleep) {
+  let lastTs = -1;
+  let boundary = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const entries = await read();
+    for (const entry of entries) {
+      if (entry.ts < lastTs) continue;
+      const key = JSON.stringify(entry);
+      if (entry.ts === lastTs) {
+        if (boundary.has(key)) continue;
+      } else {
+        lastTs = entry.ts;
+        boundary = /* @__PURE__ */ new Set();
+      }
+      boundary.add(key);
+      context.output.log(format(entry));
+    }
+    await wait(FOLLOW_INTERVAL_MS);
+  }
+}
 async function latestDeploymentId(client, projectId) {
   const [latest] = await client.deployments.list(projectId);
   if (!latest)
@@ -5422,24 +5334,11 @@ async function runtimeLogs(context, client, projectId) {
   context.output.log(
     `Following ${environment} runtime logs (Ctrl-C to stop)...`
   );
-  let lastTs = -1;
-  let boundary = /* @__PURE__ */ new Set();
-  for (; ; ) {
-    const entries = await client.logs.runtime(projectId, options);
-    for (const entry of entries) {
-      if (entry.ts < lastTs) continue;
-      const key = JSON.stringify(entry);
-      if (entry.ts === lastTs) {
-        if (boundary.has(key)) continue;
-      } else {
-        lastTs = entry.ts;
-        boundary = /* @__PURE__ */ new Set();
-      }
-      boundary.add(key);
-      context.output.log(formatRuntimeLog(entry));
-    }
-    await sleep(FOLLOW_INTERVAL_MS);
-  }
+  await followRuntimeEntries(
+    context,
+    () => client.logs.runtime(projectId, options),
+    formatRuntimeLog
+  );
 }
 async function runLogs(context) {
   const [deploymentId] = context.positionals;
@@ -5450,10 +5349,7 @@ async function runLogs(context) {
       "--type must be build or runtime."
     );
   if (type === "runtime" && context.flags.follow && context.flags.json)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--follow streams runtime logs until you stop it, so it has no JSON result. Drop --json to stream, or drop --follow for the current entries as JSON."
-    );
+    throw new NaroError("VALIDATION_FAILED", FOLLOW_JSON_REFUSAL);
   if (type === "build" && context.flags.env)
     throw new NaroError(
       "VALIDATION_FAILED",
@@ -5478,47 +5374,651 @@ async function runLogs(context) {
   await buildLogs(context, client, target);
 }
 
-// src/commands/projects.ts
-function productionUrl(subdomain) {
-  return `https://${subdomain}.${new URL(controlPlaneUrl()).hostname}`;
+// src/commands/functions.ts
+var FUNCTIONS_ENV_REFUSAL = "naro functions works on the production backend only. Drop --env.";
+var VERSIONS_USAGE = "Usage: naro functions versions <name>";
+var LOGS_USAGE = "Usage: naro functions logs <name> [--level <l>] [--follow]";
+function functionName(context, usage) {
+  const [name] = context.positionals;
+  if (name === void 0 || name === "")
+    throw new NaroError("VALIDATION_FAILED", usage);
+  return name;
 }
-async function runProjects(context) {
-  const client = await context.client();
-  const teams = await client.teams.list();
-  const team = await resolveTeam(context, teams, { intent: "read" });
-  const projects = await client.projects.list(team.slug);
-  context.output.result(
-    {
-      team: team.slug,
-      projects: projects.map((project) => ({
-        id: project.id,
-        name: project.name,
-        subdomain: project.subdomain,
-        url: productionUrl(project.subdomain),
-        defaultBranch: project.defaultBranch,
-        updatedAt: project.updatedAt
-      }))
-    },
-    [
-      `Projects in ${team.slug} (${String(projects.length)}):`,
-      ...projects.map(
-        (project) => `  ${project.name.padEnd(24)} ${productionUrl(project.subdomain).padEnd(40)} ${project.id}`
-      )
-    ]
+function statusWord(fn) {
+  if (fn.status !== "error") return fn.status;
+  return `error at ${fn.step ?? "upload"}: ${printable(fn.error ?? "unknown error")}`;
+}
+var cpuHours = (ms) => (ms / 36e5).toLocaleString("en-US", { maximumFractionDigits: 1 });
+function functionLines(list) {
+  if (list.functions.length === 0)
+    return [
+      "No functions yet. Create one with naro functions new <name>, then naro functions deploy <name>."
+    ];
+  const width = Math.max(...list.functions.map((fn) => fn.name.length));
+  const versionWidth = Math.max(
+    ...list.functions.map(
+      (fn) => fn.version === null ? 1 : String(fn.version).length + 1
+    )
+  );
+  const lines = list.functions.map((fn) => {
+    const version2 = fn.version === null ? "\u2014" : `v${String(fn.version)}`;
+    const verify = fn.verifyJwt ? "verify on " : "verify off";
+    const stale = fn.stale ? "  (stale: naro functions secrets sync brings it up)" : "";
+    return `${fn.name.padEnd(width)}  ${version2.padEnd(versionWidth)}  ${verify}  ${statusWord(fn)}  ${fn.url}${stale}`;
+  });
+  lines.push(
+    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per ${list.limits.functionsScope} on this plan.`
+  );
+  const usage = list.usage;
+  if (usage !== null) {
+    const percent2 = usage.cpuMsLimit > 0 ? Math.floor(usage.cpuMs / usage.cpuMsLimit * 100) : 0;
+    lines.push(
+      `Function CPU this month (UTC, the team's): ${cpuHours(usage.cpuMs)} of ${cpuHours(usage.cpuMsLimit)} CPU-hours (${String(percent2)}%).`
+    );
+    if (usage.blocked)
+      lines.push(
+        "\u26A0 This team has used its monthly function CPU time. Functions answer 429 FUNCTIONS_QUOTA_EXCEEDED until the 1st at 00:00 UTC."
+      );
+    else if (usage.cpuMs >= Math.ceil(usage.cpuMsLimit * 0.8))
+      lines.push(
+        `\u26A0 This team has used ${String(percent2)}% of its monthly function CPU time.`
+      );
+  }
+  return lines;
+}
+var kib = (bytes) => `${(bytes / 1024).toFixed(1)} KB`;
+function versionLines(detail) {
+  const statusWidth = Math.max(...detail.versions.map((v) => v.status.length));
+  return detail.versions.map(
+    (v) => `v${String(v.number)}  ${v.status.padEnd(statusWidth)}  ${v.active ? "live" : "    "}  ${kib(v.size)}  ${v.verifyJwt ? "verify on " : "verify off"}  ${v.createdAt}`
   );
 }
-async function runProjectInspect(context) {
+async function runFunctionsList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const project = await client.projects.get(projectId);
-  const url = productionUrl(project.subdomain);
-  context.output.result({ project: { ...project, url } }, [
-    `${project.name}`,
-    `  id:             ${project.id}`,
-    `  team:           ${project.teamId}`,
-    `  production URL: ${url}`,
-    `  preview URL:    https://${project.subdomain}-preview.${new URL(controlPlaneUrl()).hostname}`,
-    `  default branch: ${project.defaultBranch}`,
+  const list = await client.functions.list(projectId);
+  context.output.result({ projectId, ...list }, functionLines(list));
+}
+async function runFunctionsVersions(context) {
+  const name = functionName(context, VERSIONS_USAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const detail = await client.functions.get(projectId, name);
+  context.output.result({ projectId, ...detail }, versionLines(detail));
+}
+async function runFunctionsLogs(context) {
+  if (context.flags.follow && context.flags.json)
+    throw new NaroError("VALIDATION_FAILED", FOLLOW_JSON_REFUSAL);
+  const name = functionName(context, LOGS_USAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const options = context.flags.level ? { level: context.flags.level } : {};
+  const format = (entry) => printable(formatRuntimeLog(entry));
+  if (!context.flags.follow) {
+    const entries = await client.functions.logs(projectId, name, options);
+    context.output.result(
+      { projectId, name, entries },
+      entries.length > 0 ? entries.map(format) : [`(no logs from ${name} yet)`]
+    );
+    return;
+  }
+  context.output.log(`Following ${name}'s logs (Ctrl-C to stop)...`);
+  await followRuntimeEntries(
+    context,
+    () => client.functions.logs(projectId, name, options),
+    format
+  );
+}
+var NEW_USAGE = "Usage: naro functions new <name>";
+var ROLLBACK_USAGE = "Usage: naro functions rollback <name> [<version>]";
+var DELETE_USAGE2 = "Usage: naro functions delete <name>";
+async function runFunctionsNew(context) {
+  const name = functionName(context, NEW_USAGE);
+  if (!isFunctionName(name))
+    throw new NaroError("VALIDATION_FAILED", BUNDLE_MESSAGES.badName(name));
+  const folder = functionsFolder({
+    cwd: context.cwd,
+    root: context.flags.root,
+    dir: context.flags.dir
+  });
+  const target = join5(folder.dir, name);
+  mkdirSync3(folder.dir, { recursive: true });
+  try {
+    mkdirSync3(target);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${folder.label}/${name} already exists.`
+    );
+  }
+  writeFileSync4(join5(target, "index.ts"), scaffoldSource(name));
+  const file = `${folder.label}/${name}/index.ts`;
+  const notes = scaffoldNotes(folder);
+  context.output.result({ file, notes }, [
+    `\u2705 Created ${file}. Deploy it with naro functions deploy ${name}.`,
+    ...notes
+  ]);
+}
+async function runFunctionsDeploy(context) {
+  assertFunctionsNode();
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { deployed } = await deployFunctions({
+    client,
+    projectId,
+    cwd: context.cwd,
+    root: context.flags.root,
+    dir: context.flags.dir,
+    names: context.positionals,
+    verifyJwt: context.flags.noVerifyJwt ? false : void 0,
+    importMap: context.flags.importMap,
+    skipCheck: context.flags.skipCheck,
+    cliVersion: version(),
+    log: (line) => context.output.log(line)
+  });
+  context.output.result({ projectId, functions: deployed });
+}
+async function runFunctionsRollback(context) {
+  const name = functionName(context, ROLLBACK_USAGE);
+  const written = context.positionals[1];
+  if (written !== void 0 && !/^[1-9]\d*$/.test(written))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "The version must be a whole number from 1, like 3."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const io = {
+    sleep: defaultSleep,
+    log: (line) => context.output.log(line)
+  };
+  const live2 = await withFunctionRetries(
+    () => client.functions.rollback(
+      projectId,
+      name,
+      written === void 0 ? void 0 : Number(written)
+    ),
+    name,
+    io
+  );
+  context.output.result({ projectId, function: live2 }, [
+    `\u2705 Rolled ${name} back to v${String(live2.version)} \u2014 ${live2.url}`
+  ]);
+}
+async function runFunctionsDelete(context) {
+  const name = functionName(context, DELETE_USAGE2);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const detail = await client.functions.get(projectId, name);
+  const stored = detail.versions.filter((v) => v.status !== "pruned").length;
+  await confirmOrAbort(
+    context,
+    stored === 1 ? `Delete function ${name}? Its URL stops working and its 1 stored version is removed.` : `Delete function ${name}? Its URL stops working and its ${String(stored)} stored versions are removed.`
+  );
+  const io = {
+    sleep: defaultSleep,
+    log: (line) => context.output.log(line)
+  };
+  await withFunctionRetries(
+    () => client.functions.remove(projectId, name),
+    name,
+    io
+  );
+  context.output.result({ projectId, name, deleted: true }, [
+    `\u2705 Deleted ${name}. Its URL stops working within seconds.`
+  ]);
+}
+
+// src/commands/functions-secrets.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve6 } from "path";
+var SET_USAGE3 = "Usage: naro functions secrets set <NAME>";
+var IMPORT_USAGE = "Usage: naro functions secrets import <file>";
+var UNSET_USAGE = "Usage: naro functions secrets unset <NAME>\u2026";
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var NAME_MAX = 256;
+var VALUE_MAX_BYTES2 = 5120;
+var RESERVED = /* @__PURE__ */ new Set(["ASSETS", "DB"]);
+var PROTO_LINE = /^\s*(?:export\s+)?__proto__(?:\s*=|:\s)/m;
+function secretNameProblem(name) {
+  if (!NAME.test(name) || name.length > NAME_MAX)
+    return "Secret names must look like NAME: letters, digits and _, not starting with a digit.";
+  if (name === "__proto__") return "__proto__ cannot be a secret name.";
+  if (name.startsWith("NARO_") || RESERVED.has(name))
+    return `${name} is reserved for Naro. Secret names cannot start with NARO_ or be ASSETS or DB.`;
+  return null;
+}
+function secretValueProblem(name, value) {
+  const bytes = Buffer.byteLength(value, "utf8");
+  return bytes > VALUE_MAX_BYTES2 ? `The value of ${name} is ${bytes.toLocaleString("en-US")} bytes; secrets must be 5,120 bytes or less.` : null;
+}
+function check(problem) {
+  if (problem !== null) throw new NaroError("VALIDATION_FAILED", problem);
+}
+var plural = (n, one, many) => n === 1 ? one : many;
+function byteCount(value) {
+  const n = Buffer.byteLength(value, "utf8");
+  return `${n.toLocaleString("en-US")} ${plural(n, "byte", "bytes")}`;
+}
+function warnFailures(context, sync) {
+  for (const failure2 of sync.failures)
+    context.output.warn(
+      `  ${printable(failure2.name)}: ${printable(failure2.message)}`
+    );
+}
+var nameList = (list) => list.map(printable).join(", ");
+async function applyChange(context, client, projectId, pending) {
+  if (pending === 0)
+    return { lines: ["No live functions to update."], sync: null };
+  if (context.flags.noSync)
+    return {
+      lines: [
+        pending === null ? "The functions carry the change once synced: the sweep does it within minutes, or run naro functions secrets sync." : (
+          // The save counted before the control plane's own hook brought
+          // some up: "up to", not how many are left.
+          `Up to ${functionCount(pending)} still ${plural(pending, "runs", "run")} the old values: the sweep syncs them within minutes, or run naro functions secrets sync.`
+        )
+      ],
+      sync: null
+    };
+  if (pending === null)
+    context.output.log(
+      "\u26A0 Naro could not count the functions to update; syncing until none is left."
+    );
+  const total = pending;
+  let last = null;
+  let sync;
+  try {
+    sync = await syncUntilDone(client, projectId, {
+      log: (line) => context.output.log(line),
+      onCall: (progress) => {
+        last = progress;
+        if (total !== null)
+          context.output.log(
+            `\u23F3 Applying secrets to ${functionCount(total)}\u2026 ${String(Math.min(progress.synced.length, total))}/${String(total)}`
+          );
+      }
+    });
+  } catch (error) {
+    if (last !== null) warnFailures(context, last);
+    const cause = toNaroError(error);
+    const retryAfter = cause.details?.retryAfter;
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `Secrets are saved, but the sync stopped: ${printable(cause.message)} Run \`naro functions secrets sync\` to finish.`,
+      {
+        details: {
+          saved: true,
+          cause: {
+            code: cause.code,
+            message: cause.message,
+            ...typeof retryAfter === "number" ? { retryAfter } : {}
+          },
+          pending
+        },
+        cause: error
+      }
+    );
+  }
+  if (!sync.complete) {
+    warnFailures(context, sync);
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `Secrets are saved, but ${functionCount(sync.pending)} still ${plural(sync.pending, "runs", "run")} the old values. Run \`naro functions secrets sync\` to finish.`,
+      {
+        details: {
+          saved: true,
+          pending: sync.pending,
+          failures: sync.failures,
+          synced: sync.synced
+        }
+      }
+    );
+  }
+  const live2 = Math.max(total ?? 0, sync.synced.length);
+  return {
+    lines: [
+      live2 === 0 ? "\u2705 All functions are up to date." : `\u2705 Secrets are live on all ${functionCount(live2)}.`
+    ],
+    sync
+  };
+}
+async function readyToChange(context) {
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  await client.functions.list(projectId);
+  return { client, projectId };
+}
+async function runFunctionsSecretsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const secrets = await client.functions.secrets(projectId);
+  const width = Math.max(0, ...secrets.map((s) => s.name.length));
+  context.output.result(
+    { projectId, secrets },
+    secrets.length === 0 ? ["No function secrets. Set one with naro functions secrets set <NAME>."] : secrets.map(
+      (s) => `${s.name.padEnd(width)}  ${s.digest}  ${s.updatedAt}`
+    )
+  );
+}
+async function runFunctionsSecretsSet(context) {
+  const [name] = context.positionals;
+  if (name === void 0) throw new NaroError("VALIDATION_FAILED", SET_USAGE3);
+  if (context.positionals.length > 1 || name.includes("="))
+    throw new NaroError("VALIDATION_FAILED", SECRETS_ARGV_REFUSAL);
+  check(secretNameProblem(name));
+  const typed = process.stdin.isTTY === true;
+  let value;
+  let client = null;
+  let projectId = null;
+  if (typed) {
+    projectId = await context.resolveProjectId();
+    client = await context.client();
+    await client.functions.list(projectId);
+    value = await context.prompter.askHidden(`? What's the value of ${name}? `);
+  } else {
+    value = await readStdin();
+  }
+  if (value.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No value provided for ${name}.`);
+  check(secretValueProblem(name, value));
+  projectId ??= await context.resolveProjectId();
+  client ??= await context.client();
+  const saved = await client.functions.setSecrets(projectId, {
+    set: { [name]: value }
+  });
+  context.output.log(`\u2705 Saved ${name}.`);
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsImport(context) {
+  const [file] = context.positionals;
+  if (file === void 0)
+    throw new NaroError("VALIDATION_FAILED", IMPORT_USAGE);
+  let text;
+  try {
+    text = readFileSync6(resolve6(context.cwd, file), "utf8");
+  } catch {
+    throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
+  }
+  const parsed = parseDotenvDetailed(text);
+  const [unclosed] = parsed.unclosedQuotes;
+  if (unclosed !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Unclosed quote in ${file} at line ${String(unclosed)}.`
+    );
+  if (PROTO_LINE.test(text)) check(secretNameProblem("__proto__"));
+  const entries = Object.entries(parsed.vars);
+  if (entries.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No secrets found in ${file}.`);
+  const invalid = entries.map(([name]) => name).filter((name) => !NAME.test(name) || name.length > NAME_MAX);
+  if (invalid.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Invalid keys in ${file}: ${invalid.map(printable).join(", ")}.`
+    );
+  for (const [name, value] of entries) {
+    check(secretNameProblem(name));
+    check(secretValueProblem(name, value));
+  }
+  const { client, projectId } = await readyToChange(context);
+  context.output.log(`Secrets in ${file}:`);
+  for (const [name, value] of entries)
+    context.output.log(
+      `  ${name.padEnd(32)} ${value === "" ? "(empty)" : `\u2022\u2022\u2022\u2022\u2022\u2022 (${byteCount(value)})`}`
+    );
+  await confirmOrAbort(
+    context,
+    `Set ${String(entries.length)} function ${plural(entries.length, "secret", "secrets")} for all of this project's functions?`
+  );
+  const saved = await client.functions.setSecrets(projectId, {
+    set: Object.fromEntries(entries)
+  });
+  context.output.log(
+    `\u2705 Saved ${String(entries.length)} ${plural(entries.length, "secret", "secrets")}.`
+  );
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsUnset(context) {
+  const names = context.positionals;
+  if (names.length === 0) throw new NaroError("VALIDATION_FAILED", UNSET_USAGE);
+  for (const name of names) check(secretNameProblem(name));
+  const { client, projectId } = await readyToChange(context);
+  await confirmOrAbort(
+    context,
+    `Unset ${names.join(", ")} from all of this project's functions? Functions that read them get undefined once they are synced.`
+  );
+  const saved = await client.functions.setSecrets(projectId, {
+    unset: [...names]
+  });
+  context.output.log(
+    `\u2705 Unset ${String(names.length)} ${plural(names.length, "secret", "secrets")}.`
+  );
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsSync(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const registry = context.flags.registry === true;
+  const sync = await syncUntilDone(client, projectId, {
+    registry,
+    log: (line) => context.output.log(line)
+  });
+  if (!sync.complete) {
+    warnFailures(context, sync);
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `The sync stopped with ${sync.pending.toLocaleString("en-US")} left to do. Run \`naro functions secrets sync${registry ? " --registry" : ""}\` again.`,
+      {
+        details: {
+          pending: sync.pending,
+          failures: sync.failures,
+          synced: sync.synced,
+          removed: sync.removed
+        }
+      }
+    );
+  }
+  const lines = [];
+  if (sync.synced.length > 0)
+    lines.push(
+      `Synced ${functionCount(sync.synced.length)}: ${nameList(sync.synced)}`
+    );
+  if (sync.removed.length > 0)
+    lines.push(`Removed from the function list: ${nameList(sync.removed)}`);
+  lines.push("\u2705 All functions are up to date.");
+  context.output.result({ projectId, ...sync }, lines);
+}
+
+// src/commands/gen.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname3, resolve as resolve7 } from "path";
+var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
+async function runGenTypes(context) {
+  const { lang } = context.flags;
+  if (lang !== void 0 && lang !== "typescript")
+    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const tables = await client.db.tables(projectId);
+  const read = await policiesForTypes(client, projectId);
+  const types = generateTypes(
+    tables,
+    read.policies === void 0 ? {} : { policies: read.policies }
+  );
+  const undescribed = tables.flatMap(
+    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
+  );
+  for (const { name, error } of undescribed)
+    context.output.warn(
+      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
+    );
+  if (read.policies === void 0)
+    context.output.warn(
+      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
+    );
+  const extra = {
+    ...undescribed.length > 0 ? { undescribed } : {},
+    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
+  };
+  if (context.flags.output) {
+    const path = resolve7(context.cwd, context.flags.output);
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync5(path, types);
+    context.output.result(
+      {
+        projectId,
+        output: context.flags.output,
+        tables: tables.length,
+        ...extra
+      },
+      [
+        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
+      ]
+    );
+    return;
+  }
+  context.output.result({ projectId, types, ...extra }, [
+    types.replace(/\n$/, "")
+  ]);
+}
+
+// src/commands/insights.ts
+function queryOf2(flags) {
+  const filters = filtersOf(flags, SPEED_INSIGHTS_FILTER_KEYS);
+  return {
+    ...flags.range !== void 0 ? { range: flags.range } : {},
+    ...flags.metric !== void 0 ? { metric: flags.metric } : {},
+    ...flags.env !== void 0 ? { environment: flags.env } : {},
+    ...Object.keys(filters).length > 0 ? { filters } : {}
+  };
+}
+async function runInsights(context) {
+  if (context.flags.referrer !== void 0 && context.flags.referrer !== "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Speed Insights has no referrer; drop --referrer."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const query = queryOf2(context.flags);
+  const filters = query.filters ?? {};
+  if (context.flags.route !== void 0) {
+    const result = await client.insights.paths(projectId, {
+      ...query,
+      route: context.flags.route
+    });
+    context.output.result(
+      { projectId, ...result },
+      routePathsLines(result, filters)
+    );
+    return;
+  }
+  const overview = await client.insights.overview(projectId, query);
+  if (overview.deploymentsError)
+    context.output.warn(
+      `Deployments are unavailable right now: ${printable(overview.deploymentsError.message)}`
+    );
+  context.output.result(
+    { projectId, ...overview },
+    reportLines(overview.report, overview.deployments, filters)
+  );
+}
+async function setInsights(context, enabled) {
+  if (context.flags.env !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Speed Insights has one switch for production and preview; drop --env."
+    );
+  const filter = givenFilterFlag(context.flags);
+  if (filter !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Filters only narrow a report; drop --${filter}.`
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const result = await client.insights.setEnabled(projectId, enabled);
+  context.output.result({ projectId, enabled: result.enabled }, [
+    result.enabled ? TURNED_ON : TURNED_OFF
+  ]);
+}
+function runInsightsEnable(context) {
+  return setInsights(context, true);
+}
+function runInsightsDisable(context) {
+  return setInsights(context, false);
+}
+
+// src/commands/projects.ts
+function productionUrl(subdomain) {
+  return `https://${subdomain}.${new URL(controlPlaneUrl()).hostname}`;
+}
+async function runProjects(context) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const team = await resolveTeam(context, teams, { intent: "read" });
+  const projects = await client.projects.list(team.slug);
+  context.output.result(
+    {
+      team: team.slug,
+      projects: projects.map((project) => ({
+        id: project.id,
+        name: project.name,
+        subdomain: project.subdomain,
+        url: productionUrl(project.subdomain),
+        defaultBranch: project.defaultBranch,
+        updatedAt: project.updatedAt
+      }))
+    },
+    [
+      `Projects in ${team.slug} (${String(projects.length)}):`,
+      ...projects.map(
+        (project) => `  ${project.name.padEnd(24)} ${productionUrl(project.subdomain).padEnd(40)} ${project.id}`
+      )
+    ]
+  );
+}
+async function runProjectInspect(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.get(projectId);
+  const url = productionUrl(project.subdomain);
+  context.output.result({ project: { ...project, url } }, [
+    `${project.name}`,
+    `  id:             ${project.id}`,
+    `  team:           ${project.teamId}`,
+    `  production URL: ${url}`,
+    `  preview URL:    https://${project.subdomain}-preview.${new URL(controlPlaneUrl()).hostname}`,
+    `  default branch: ${project.defaultBranch}`,
     `  root directory: ${project.rootDirectory ?? "(repo root)"}`,
     `  repository:     ${project.repositoryFullName ?? project.repositoryUrl}`
   ]);
@@ -5526,7 +6026,7 @@ async function runProjectInspect(context) {
 
 // src/commands/promote.ts
 var PROMOTE_USAGE = "Usage: naro promote <deployment-id> [--to <environment>]";
-var ROLLBACK_USAGE = "Usage: naro rollback [deployment-id]";
+var ROLLBACK_USAGE2 = "Usage: naro rollback [deployment-id]";
 var REBUILD_TIMEOUT_MS = 15 * 6e4;
 var REUPLOAD_TIMEOUT_MS = 5 * 6e4;
 async function promoteAndWait(context, client, project, sourceDeploymentId, action, target) {
@@ -5590,9 +6090,9 @@ function refuseWhatIsNotRead(context, usage, envMessage) {
     throw new NaroError("VALIDATION_FAILED", envMessage);
 }
 async function previewPromotion(context, client, projectId, sourceDeploymentId, target) {
-  let check;
+  let check2;
   try {
-    check = await client.deployments.promoteCheck(
+    check2 = await client.deployments.promoteCheck(
       projectId,
       sourceDeploymentId,
       target
@@ -5604,9 +6104,9 @@ async function previewPromotion(context, client, projectId, sourceDeploymentId,
     return;
   }
   context.output.log(
-    check.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
+    check2.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
   );
-  for (const warning of check.warnings)
+  for (const warning of check2.warnings)
     for (const line of warningLines(warning)) context.output.log(line);
 }
 async function runPromote(context) {
@@ -5648,7 +6148,7 @@ async function runRollback(context) {
     );
   refuseWhatIsNotRead(
     context,
-    ROLLBACK_USAGE,
+    ROLLBACK_USAGE2,
     "--env is not an option of naro rollback: naro rollback always rolls production back."
   );
   const client = await context.client();
@@ -5731,6 +6231,9 @@ function tableName(table3) {
   const name = printable(table3.name);
   return table3.exists ? name : `${name} (dropped)`;
 }
+function linesFor(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
 function realtimeLines(info) {
   if (!info.enabled)
     return [
@@ -5744,14 +6247,14 @@ function realtimeLines(info) {
     live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`
   ];
 }
-async function enableRealtime(client, projectId) {
+async function enableRealtime(client, projectId, environment) {
   try {
     return await client.realtime.enable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Realtime on did not answer within 2 minutes. `naro realtime` shows where it got to, and `naro realtime enable` again picks up where it stopped.",
+        `Turning Realtime on did not answer within 2 minutes. \`naro realtime${envFlag(environment)}\` shows where it got to, and \`naro realtime enable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
@@ -5763,28 +6266,41 @@ function tableNames2(context, usage) {
   return context.positionals;
 }
 async function runRealtimeStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const realtime = await client.realtime.info(projectId);
-  context.output.result({ projectId, realtime }, realtimeLines(realtime));
+  context.output.result(
+    { projectId, realtime },
+    linesFor(realtimeLines(realtime), dataEnvironment(context.flags))
+  );
 }
 async function runRealtimeEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
-  const realtime = await enableRealtime(client, projectId);
-  context.output.result({ projectId, realtime }, [
-    "\u2705 Realtime is on. Publish a table with naro realtime tables add <table>.",
-    ...realtimeLines(realtime)
-  ]);
+  const environment = dataEnvironment(context.flags);
+  const realtime = await enableRealtime(client, projectId, environment);
+  context.output.result(
+    { projectId, realtime },
+    linesFor(
+      [
+        "\u2705 Realtime is on. Publish a table with naro realtime tables add <table>.",
+        ...realtimeLines(realtime)
+      ],
+      environment
+    )
+  );
 }
 async function runRealtimeTablesList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.realtime.listTables(projectId);
   context.output.result(
     { projectId, tables },
     tables.length === 0 ? [
-      "No published tables. `naro realtime tables add <table>` publishes one."
+      forEnvironment(
+        "No published tables. `naro realtime tables add <table>` publishes one.",
+        dataEnvironment(context.flags)
+      )
     ] : tables.map(
       (table3) => table3.exists ? `  ${printable(table3.name)}` : `  ${printable(table3.name)}  (dropped: no such table now)`
     )
@@ -5792,7 +6308,7 @@ async function runRealtimeTablesList(context) {
 }
 async function runRealtimeTablesAdd(context) {
   const names = tableNames2(context, ADD_USAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = [];
   for (const name of names) {
@@ -5814,7 +6330,7 @@ async function runRealtimeTablesRemove(context) {
     context,
     names.length === 1 ? `Stop publishing ${shown}? Subscribers stop receiving its changes within about 10 seconds.` : `Stop publishing ${shown}? Subscribers stop receiving their changes within about 10 seconds.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = [];
   for (const name of names) {
@@ -5934,6 +6450,9 @@ function meterLines(info) {
     );
   return lines;
 }
+function linesFor2(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
 function storageLines(info) {
   if (info.disabledAt !== null)
     return [
@@ -5957,27 +6476,27 @@ function storageLines(info) {
     ...info.buckets.map(bucketLine)
   ];
 }
-async function enableStorage(client, projectId) {
+async function enableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.enable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage on did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage enable` again picks up where it stopped.",
+        `Turning Storage on did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage enable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
   }
 }
-async function disableStorage(client, projectId) {
+async function disableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.disable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage off did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage disable` again picks up where it stopped.",
+        `Turning Storage off did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage disable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
@@ -6004,23 +6523,34 @@ function bucketFields(flags) {
   return fields;
 }
 async function runStorageStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const storage = await client.storage.info(projectId);
-  context.output.result({ projectId, storage }, storageLines(storage));
+  context.output.result(
+    { projectId, storage },
+    linesFor2(storageLines(storage), dataEnvironment(context.flags))
+  );
 }
 async function runStorageEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
-  const storage = await enableStorage(client, projectId);
+  const environment = dataEnvironment(context.flags);
+  const storage = await enableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
     `\u2705 Storage is on: R2 bucket ${printable(storage.bucket ?? "unknown")}.`,
-    ...storage.usage === null ? ["\u23F3 The backend is still finishing; check `naro backend` in a minute."] : [],
-    ...storageLines(storage)
+    ...linesFor2(
+      [
+        ...storage.usage === null ? [
+          "\u23F3 The backend is still finishing; check `naro backend` in a minute."
+        ] : [],
+        ...storageLines(storage)
+      ],
+      environment
+    )
   ]);
 }
 async function runStorageDisable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const current = await client.storage.info(projectId);
   if (current.bucket === null) {
@@ -6029,27 +6559,34 @@ async function runStorageDisable(context) {
     ]);
     return;
   }
+  const environment = dataEnvironment(context.flags);
   if (current.disabledAt === null)
-    await confirmOrAbort(context, DISABLE_QUESTION3);
-  const storage = await disableStorage(client, projectId);
+    await confirmOrAbort(
+      context,
+      forEnvironment(DISABLE_QUESTION3, environment)
+    );
+  const storage = await disableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
-    "\u2705 Storage is off. Buckets and files are kept; naro storage enable turns it on again.",
-    ...storageLines(storage)
+    `\u2705 Storage is off. Buckets and files are kept; naro storage enable${envFlag(environment)} turns it on again.`,
+    ...linesFor2(storageLines(storage), environment)
   ]);
 }
 async function runStorageBucketList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const buckets = await client.storage.listBuckets(projectId);
   context.output.result(
     { projectId, buckets },
-    buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine)
+    linesFor2(
+      buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine),
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runStorageBucketCreate(context) {
   const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let bucket;
   try {
@@ -6058,12 +6595,12 @@ async function runStorageBucketCreate(context) {
     if (!isNaroError(error) || error.code !== "STORAGE_NOT_ENABLED")
       throw error;
     context.output.log(ENABLE_FIRST);
-    await enableStorage(client, projectId);
+    await enableStorage(client, projectId, dataEnvironment(context.flags));
     bucket = await client.storage.createBucket(projectId, input);
   }
   context.output.result({ projectId, bucket }, [
     `\u2705 Created bucket ${printable(bucket.name)}.`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 async function runStorageBucketUpdate(context) {
@@ -6074,13 +6611,13 @@ async function runStorageBucketUpdate(context) {
       context,
       `Make bucket ${name} public? Anyone with an object's URL can download it.`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.updateBucket(projectId, name, patch);
   const takesEffect = patch.public === false ? "It takes effect within about 10 seconds; copies Naro's edge already holds can be served for up to 5 minutes." : "It takes effect within about 10 seconds.";
   context.output.result({ projectId, bucket }, [
     `\u2705 Updated bucket ${printable(bucket.name)}. ${takesEffect}`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 function refuseSearch(context, why) {
@@ -6116,7 +6653,7 @@ async function runStorageBucketEmpty(context) {
     context,
     `bucket empty deletes every object in the bucket. ${EMPTY_USAGE}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.getBucket(projectId, name);
   await confirmOrAbort(
@@ -6139,7 +6676,7 @@ async function runStorageBucketRemove(context) {
     context,
     empty ? `bucket remove --empty deletes every object in the bucket before it removes the bucket. ${REMOVE_USAGE3}` : `bucket remove removes the whole bucket. ${REMOVE_USAGE3}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let question = `Remove bucket ${name}?`;
   if (empty) {
@@ -6164,7 +6701,7 @@ async function runStorageBucketRemove(context) {
 import { randomUUID } from "crypto";
 import { createWriteStream as createWriteStream2, openAsBlob, rmSync as rmSync2 } from "fs";
 import { rename, rm, stat } from "fs/promises";
-import { basename as basename2, dirname as dirname3, extname, join as join5, resolve as resolve6 } from "path";
+import { basename as basename2, dirname as dirname4, extname, join as join6, resolve as resolve8 } from "path";
 import { Readable } from "stream";
 import { pipeline as pipeline2 } from "stream/promises";
 
@@ -6297,6 +6834,17 @@ function serviceKeyOffServer() {
     message: SERVICE_KEY_OFF_SERVER_MESSAGE
   };
 }
+function accessTokenUnavailable(cause) {
+  return {
+    code: "ACCESS_TOKEN_UNAVAILABLE",
+    message: "createClient's accessToken function failed or returned something that is not a string or null, so the request was not sent.",
+    details: { cause: describe(cause) }
+  };
+}
+function accessTokenAuthMessage(name) {
+  return `naro.auth.${name} is not available on a client made with accessToken: its token comes from your accessToken function. Use a client made without accessToken to sign in.`;
+}
+var ACCESS_TOKEN_CHANNEL_MESSAGE = "naro.channel() is not available on a client made with accessToken: Realtime signs in with a session, not an access token. Broadcast from a function with naroAdmin.";
 function notJoined(channel) {
   return {
     code: "NOT_JOINED",
@@ -6362,9 +6910,139 @@ var SESSION_PREFIXES = ["/auth/", "/realtime/"];
 function storeFor(config, path) {
   return SESSION_PREFIXES.some((prefix) => path.startsWith(prefix)) ? config.tokens : config.accessJwt ?? null;
 }
-async function receive(config, options, init) {
-  const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
+var ACCESS_JWT_MARGIN_MS = 6e4;
+function deadlineOf(timeoutMs) {
+  return timeoutMs === void 0 ? null : { at: Date.now() + timeoutMs, ms: timeoutMs };
+}
+function remainingMs(deadline) {
+  return Math.max(0, deadline.at - Date.now());
+}
+var EXPIRED = Symbol("expired");
+function timedOut(deadline) {
+  return requestTimeout(deadline?.ms ?? 0);
+}
+function timesOf(jwt) {
+  const payload = jwt.split(".")[1];
+  if (payload === void 0 || payload === "") return null;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const claims = JSON.parse(atob(padded));
+    if (!isRecord(claims)) return null;
+    const { exp, iat } = claims;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+    return {
+      exp: exp * 1e3,
+      iat: typeof iat === "number" && Number.isFinite(iat) ? iat * 1e3 : null
+    };
+  } catch {
+    return null;
+  }
+}
+function expiryOf(jwt) {
+  return timesOf(jwt)?.exp ?? null;
+}
+var skews = /* @__PURE__ */ new WeakMap();
+function localExpiry(config, jwt) {
+  const exp = expiryOf(jwt);
+  return exp === null ? null : exp - (skews.get(config.tokens) ?? 0);
+}
+var SESSION_GONE_CODES = /* @__PURE__ */ new Set([
+  "UNAUTHORIZED",
+  "INVALID_SESSION",
+  "FAILED_TO_GET_SESSION"
+]);
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewAccessJwt(config, jwtStore, session) {
+  const pending = renewing.get(config.tokens);
+  if (pending?.session === session) return pending.done;
+  const done = (async () => {
+    const result = await callWith(
+      config,
+      { method: "GET", path: "/auth/token", withToken: true },
+      void 0,
+      session
+    );
+    if (result.error !== null) {
+      if (result.answer?.status !== 401 || !SESSION_GONE_CODES.has(result.error.code))
+        return result.error;
+      await config.tokens.clearIf(session);
+      await config.tokens.whileIs(null, () => jwtStore.clear());
+      return invalidSession();
+    }
+    const { body, status } = result.answer;
+    const jwt = isRecord(body) ? body.token : void 0;
+    if (typeof jwt !== "string" || jwt === "") return invalidResponse(status);
+    const arrived = Date.now();
+    await config.tokens.whileIs(session, async () => {
+      const iat = timesOf(jwt)?.iat;
+      if (iat !== void 0 && iat !== null)
+        skews.set(config.tokens, iat - arrived);
+      await jwtStore.set(jwt);
+    });
+    return null;
+  })();
+  const entry = { session, done };
+  renewing.set(config.tokens, entry);
+  void done.finally(() => {
+    if (renewing.get(config.tokens) === entry) renewing.delete(config.tokens);
+  });
+  return done;
+}
+async function accessJwtFor(config, jwtStore) {
+  for (let round = 0; round < 2; round += 1) {
+    const session = await config.tokens.get();
+    const jwt = await jwtStore.get();
+    if (session === null || config.service) return { token: jwt, session };
+    const expiry = jwt === null ? null : localExpiry(config, jwt);
+    if (jwt !== null && (expiry === null || expiry - ACCESS_JWT_MARGIN_MS > Date.now()))
+      return { token: jwt, session };
+    const error = await renewAccessJwt(config, jwtStore, session);
+    const stored = await config.tokens.get();
+    if (stored !== session) {
+      if (stored === null) return error ? { error } : { token: null, session };
+      continue;
+    }
+    if (error === null) {
+      const renewed = await jwtStore.get();
+      return renewed === null ? { error: invalidSession() } : { token: renewed, session };
+    }
+    if (jwt !== null && expiry !== null && expiry > Date.now())
+      return { token: jwt, session };
+    return { error };
+  }
+  return { error: invalidSession() };
+}
+async function bearerFor(config, path, withToken) {
+  if (!withToken) return { token: null, session: null };
+  const store = storeFor(config, path);
+  if (config.accessToken !== void 0 && store !== config.tokens) {
+    try {
+      return { token: await config.accessToken.get(), session: null };
+    } catch (cause) {
+      return { error: accessTokenUnavailable(cause) };
+    }
+  }
+  if (store === null) return { token: null, session: null };
+  if (store === config.tokens) {
+    const token = await store.get();
+    return { token, session: token };
+  }
+  return accessJwtFor(config, store);
+}
+async function retryBearer(config, path, error, first) {
+  if (error?.code !== "INVALID_SESSION" || first.token === null || first.session === null || config.accessJwt === void 0 || storeFor(config, path) !== config.accessJwt || await config.tokens.get() !== first.session)
+    return null;
+  const renewed = await bearerFor(config, path, true);
+  if ("error" in renewed) return renewed;
+  return renewed.token === null || renewed.token === first.token || renewed.session !== first.session ? null : renewed;
+}
+async function receive(config, options, init, deadline) {
+  if (deadline !== null && remainingMs(deadline) === 0)
+    return { error: timedOut(deadline) };
+  const controller = deadline !== null && typeof AbortController === "function" ? new AbortController() : null;
   if (controller) init.signal = controller.signal;
+  let gaveUp = false;
   const request = (async () => {
     try {
       const fetchImpl = config.fetch ?? globalThis.fetch;
@@ -6372,6 +7050,10 @@ async function receive(config, options, init) {
         `${config.baseUrl}/_naro/v1${options.path}`,
         init
       );
+      if (gaveUp) {
+        discard(response);
+        return { error: timedOut(deadline) };
+      }
       return {
         status: response.status,
         headers: response.headers,
@@ -6381,14 +7063,14 @@ async function receive(config, options, init) {
       return { error: networkError(error) };
     }
   })();
-  const { timeoutMs } = options;
-  if (timeoutMs === void 0) return request;
+  if (deadline === null) return request;
   let timer;
-  const expired = new Promise((resolve7) => {
+  const expired = new Promise((resolve9) => {
     timer = setTimeout(() => {
+      gaveUp = true;
       controller?.abort();
-      resolve7({ error: requestTimeout(timeoutMs) });
-    }, timeoutMs);
+      resolve9({ error: timedOut(deadline) });
+    }, remainingMs(deadline));
   });
   try {
     return await Promise.race([request, expired]);
@@ -6405,8 +7087,35 @@ async function call(config, options) {
       return { error: invalidQuery("", "is not JSON"), answer: null };
     }
   }
+  const deadline = deadlineOf(options.timeoutMs);
+  const bearer = await untilStopped(
+    bearerFor(config, options.path, options.withToken),
+    void 0,
+    deadline
+  );
+  if (bearer === EXPIRED || bearer === ABORTED)
+    return { error: timedOut(deadline), answer: null };
+  if ("error" in bearer) return { error: bearer.error, answer: null };
+  const result = await callWith(
+    config,
+    options,
+    payload,
+    bearer.token,
+    deadline
+  );
+  const again = await untilStopped(
+    retryBearer(config, options.path, result.error, bearer),
+    void 0,
+    deadline
+  );
+  if (again === EXPIRED || again === ABORTED)
+    return { error: timedOut(deadline), answer: null };
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, answer: null };
+  return callWith(config, options, payload, again.token, deadline);
+}
+async function callWith(config, options, payload, token, deadline = null) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -6425,7 +7134,7 @@ async function call(config, options) {
     headers["Content-Type"] = "application/json";
     init.body = payload;
   }
-  const received = await receive(config, options, init);
+  const received = await receive(config, options, init, deadline);
   if ("error" in received) return { error: received.error, answer: null };
   const { status, headers: responseHeaders, text } = received;
   let body;
@@ -6450,8 +7159,69 @@ async function settled(store, error, headers, token) {
   return RETRY_AFTER_CODES.has(error.code) ? withRetryAfter(error, headers) : error;
 }
 async function send(config, options) {
+  const bearer = await untilAborted(
+    bearerFor(config, options.path, options.withToken),
+    options.signal
+  );
+  if (bearer === ABORTED) return { error: uploadAborted(), status: null };
+  if ("error" in bearer) return { error: bearer.error, status: null };
+  const result = await sendWith(config, options, bearer.token);
+  if (result.error?.code !== "INVALID_SESSION" || isStream(options.body))
+    return result;
+  const again = await untilAborted(
+    retryBearer(config, options.path, result.error, bearer),
+    options.signal
+  );
+  if (again === ABORTED) return { error: uploadAborted(), status: null };
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, status: null };
+  return sendWith(config, options, again.token);
+}
+var ABORTED = Symbol("aborted");
+function untilAborted(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(ABORTED);
+  return new Promise((resolve9, reject) => {
+    const stop = () => resolve9(ABORTED);
+    signal.addEventListener("abort", stop, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", stop);
+        resolve9(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", stop);
+        reject(error);
+      }
+    );
+  });
+}
+function untilStopped(promise, signal, deadline) {
+  if (signal?.aborted) return Promise.resolve(ABORTED);
+  if (!signal && deadline === null) return promise;
+  return new Promise((resolve9, reject) => {
+    let timer;
+    const stop = () => finish(ABORTED);
+    const finish = (value) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+      resolve9(value);
+    };
+    signal?.addEventListener("abort", stop, { once: true });
+    if (deadline !== null)
+      timer = setTimeout(() => finish(EXPIRED), remainingMs(deadline));
+    promise.then(finish, (error) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+      reject(error);
+    });
+  });
+}
+function isStream(body) {
+  return typeof ReadableStream === "function" && body instanceof ReadableStream;
+}
+async function sendWith(config, options, token) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -6506,6 +7276,143 @@ async function send(config, options) {
     status
   };
 }
+async function fetchUnread(config, options) {
+  const { signal } = options;
+  if (signal?.aborted) return { failed: "aborted", cause: signal.reason };
+  const deadline = deadlineOf(options.timeoutMs);
+  if (options.ready) {
+    const ready = await untilStopped(options.ready(), signal, deadline);
+    if (ready === ABORTED) return { failed: "aborted", cause: signal?.reason };
+    if (ready === EXPIRED) return { failed: "timeout", cause: null };
+  }
+  const own = options.headers.has("authorization");
+  const bearer = await untilStopped(
+    bearerFor(config, options.path, !own),
+    signal,
+    deadline
+  );
+  if (bearer === ABORTED) return { failed: "aborted", cause: signal?.reason };
+  if (bearer === EXPIRED) return { failed: "timeout", cause: null };
+  if ("error" in bearer) return { refused: bearer.error };
+  const first = await fetchOnce(config, options, bearer.token, deadline);
+  if (!("response" in first) || bearer.token === null) return first;
+  const refused = await refusesToken(first.response, signal, deadline);
+  if (refused === EXPIRED) {
+    discard(first.response);
+    return { failed: "timeout", cause: null };
+  }
+  if (refused === ABORTED) {
+    discard(first.response);
+    return { failed: "aborted", cause: signal?.reason };
+  }
+  if (!refused) return first;
+  await storeFor(config, options.path)?.clearIf(bearer.token);
+  if (isStream(options.body)) return first;
+  const again = await untilStopped(
+    retryBearer(config, options.path, invalidSession(), bearer),
+    signal,
+    deadline
+  );
+  if (again === EXPIRED) {
+    discard(first.response);
+    return { failed: "timeout", cause: null };
+  }
+  if (again === null || again !== ABORTED && "error" in again) return first;
+  discard(first.response);
+  if (again === ABORTED) return { failed: "aborted", cause: signal?.reason };
+  const second = await fetchOnce(config, options, again.token, deadline);
+  if (!("response" in second) || again.token === null) return second;
+  const refusedAgain = await refusesToken(second.response, signal, deadline);
+  if (refusedAgain === ABORTED) {
+    discard(second.response);
+    return { failed: "aborted", cause: signal?.reason };
+  }
+  if (refusedAgain === true || refusedAgain === EXPIRED)
+    await storeFor(config, options.path)?.clearIf(again.token);
+  return second;
+}
+async function refusesToken(response, signal, deadline) {
+  if (response.status !== 401 || response.headers.get("x-relay-error") !== "true")
+    return false;
+  let body;
+  try {
+    body = await untilStopped(response.clone().json(), signal, deadline);
+  } catch {
+    return signal?.aborted ? ABORTED : false;
+  }
+  if (body === ABORTED || body === EXPIRED) return body;
+  return isRecord(body) && isRecord(body.error) && body.error.code === "INVALID_SESSION";
+}
+var releases = /* @__PURE__ */ new WeakMap();
+function discard(response) {
+  releases.get(response)?.();
+  releases.delete(response);
+  response.body?.cancel().catch(() => {
+  });
+}
+async function fetchOnce(config, options, token, deadline) {
+  const { signal } = options;
+  if (signal?.aborted) return { failed: "aborted", cause: signal.reason };
+  if (deadline !== null && remainingMs(deadline) === 0)
+    return { failed: "timeout", cause: null };
+  const headers = new Headers(options.headers);
+  headers.set("apikey", config.apiKey);
+  if (token !== null) headers.set("authorization", `Bearer ${token}`);
+  const init = {
+    method: options.method,
+    headers,
+    credentials: "omit"
+  };
+  if (options.body !== void 0) init.body = options.body;
+  if (isStream(options.body)) init.duplex = "half";
+  const controller = typeof AbortController === "function" ? new AbortController() : null;
+  if (controller) init.signal = controller.signal;
+  let timer;
+  let stop = () => {
+  };
+  const stopped = new Promise((resolve9) => {
+    stop = resolve9;
+  });
+  const onAbort = () => {
+    stop({ failed: "aborted", cause: signal?.reason });
+    controller?.abort(signal?.reason);
+  };
+  if (deadline !== null)
+    timer = setTimeout(() => {
+      stop({ failed: "timeout", cause: null });
+      controller?.abort();
+    }, remainingMs(deadline));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  const request = (async () => {
+    try {
+      const fetchImpl = config.fetch ?? globalThis.fetch;
+      return {
+        response: await fetchImpl(
+          `${config.baseUrl}/_naro/v1${options.path}`,
+          init
+        )
+      };
+    } catch (cause) {
+      return { failed: "network", cause };
+    }
+  })();
+  const release = () => signal?.removeEventListener("abort", onAbort);
+  let outcome;
+  try {
+    outcome = await Promise.race([request, stopped]);
+    return outcome;
+  } finally {
+    clearTimeout(timer);
+    if (outcome !== void 0 && "response" in outcome)
+      releases.set(outcome.response, release);
+    else {
+      release();
+      void request.then((late) => {
+        if ("response" in late) discard(late.response);
+      });
+    }
+  }
+}
 var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "RATE_LIMITED",
   "WRITE_QUOTA_EXCEEDED",
@@ -6514,7 +7421,12 @@ var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "OBJECT_RATE_LIMITED",
   "STORAGE_OPS_QUOTA_EXCEEDED",
   // Realtime's REST broadcast over the project's message budget (x-retry-after: 1).
-  "TOO_MANY_MESSAGES"
+  "TOO_MANY_MESSAGES",
+  // Naro Functions (design F20): a team over its monthly function CPU, and
+  // the control plane's Cloudflare limit. `invoke` reads x-retry-after on
+  // every relay error anyway (invoke/client.ts).
+  "FUNCTIONS_QUOTA_EXCEEDED",
+  "FUNCTIONS_RATE_LIMITED"
 ]);
 function withRetryAfter(error, headers) {
   const header = headers.get("x-retry-after")?.trim() ?? "";
@@ -6828,14 +7740,14 @@ var AuthClient = class {
    */
   async signInWithOAuth(options) {
     const { provider } = options;
-    const failed = (error) => ({
+    const failed2 = (error) => ({
       data: { provider, url: null },
       error
     });
-    if (!OAUTH_PROVIDERS.includes(provider)) return failed(invalidProvider());
+    if (!OAUTH_PROVIDERS.includes(provider)) return failed2(invalidProvider());
     await this.#flow.recovery.forget();
     const pair = await createPkcePair();
-    if (!pair) return failed(cryptoUnavailable());
+    if (!pair) return failed2(cryptoUnavailable());
     await this.#flow.verifiers.add(pair.challenge, pair.verifier);
     const redirectTo = options.redirectTo ?? currentPage();
     const url = new URL(
@@ -7305,6 +8217,23 @@ var TokenStore = class {
       this.#changed();
     });
   }
+  /**
+   * Runs `operation` only while `expected` is the stored token (null: none
+   * is stored), inside this
+   * store's queue, and says whether it ran: no write to this store lands
+   * between the check and the end of the operation. A refreshed access JWT
+   * is kept this way (`http.ts`), so one minted for a session that a
+   * sign-in replaced meanwhile never lands on top of the new session's.
+   * `operation` must not call this store's public methods (it would wait
+   * on itself); another store's are fine.
+   */
+  whileIs(expected, operation) {
+    return this.#serial(async () => {
+      if (await this.#get() !== expected) return false;
+      await operation();
+      return true;
+    });
+  }
   /**
    * Calls `listener` after every write of the token — a sign-in, a
    * sign-out, a renewed session, a cleared INVALID_SESSION — from inside the
@@ -7384,6 +8313,282 @@ var TokenStore = class {
     }
   }
 };
+function prepareBody(body) {
+  if (body === void 0) return { body: void 0, contentType: null };
+  if (typeof body === "string") return { body, contentType: "text/plain" };
+  if (typeof Blob === "function" && body instanceof Blob)
+    return { body, contentType: "application/octet-stream" };
+  if (body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+    return { body, contentType: "application/octet-stream" };
+  if (typeof FormData === "function" && body instanceof FormData)
+    return { body, contentType: null };
+  if (typeof URLSearchParams === "function" && body instanceof URLSearchParams)
+    return { body, contentType: null };
+  if (typeof ReadableStream === "function" && body instanceof ReadableStream)
+    return { body, contentType: null };
+  try {
+    const text = JSON.stringify(body);
+    return text === void 0 ? null : { body: text, contentType: "application/json" };
+  } catch {
+    return null;
+  }
+}
+async function readAnswer(response, method) {
+  if (response.status === 204 || method === "HEAD") return { data: null };
+  const type = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
+  try {
+    if (type === "application/json") {
+      const text = await response.text();
+      return {
+        data: text.trim() === "" ? null : JSON.parse(text)
+      };
+    }
+    if (type === "application/octet-stream" || type === "application/pdf")
+      return { data: await response.blob() };
+    if (type === "text/event-stream") return { data: response };
+    if (type === "multipart/form-data")
+      return { data: await response.formData() };
+    return { data: await response.text() };
+  } catch (cause) {
+    return { unreadable: cause };
+  }
+}
+var FunctionsError = class extends Error {
+  code;
+  context;
+  constructor(code, message, context, details) {
+    super(message);
+    this.name = "FunctionsError";
+    this.code = code;
+    this.context = context;
+    if (details !== void 0)
+      Object.defineProperty(this, "details", {
+        value: details,
+        enumerable: true
+      });
+  }
+};
+var FunctionsHttpError = class extends FunctionsError {
+  constructor(response) {
+    super(
+      "FUNCTION_HTTP_ERROR",
+      `The function answered with HTTP ${String(response.status)}.`,
+      response
+    );
+    this.name = "FunctionsHttpError";
+  }
+};
+var FunctionsRelayError = class extends FunctionsError {
+  constructor(code, message, response, details) {
+    super(code, message, response, details);
+    this.name = "FunctionsRelayError";
+  }
+};
+var FunctionsFetchError = class extends FunctionsError {
+  constructor(code, message, cause, details) {
+    super(code, message, cause, details);
+    this.name = "FunctionsFetchError";
+  }
+};
+var FUNCTIONS_MESSAGES = {
+  timeout: (ms) => `The function did not answer within ${String(ms)} ms.`,
+  aborted: "The function call was stopped before the function answered.",
+  invalidBody: "functions.invoke could not send this body: JSON cannot hold it (a BigInt or a cycle). Pass a string, a Blob, bytes, FormData, URLSearchParams or a stream instead.",
+  invalidTimeout: "functions.invoke's timeout is whole milliseconds from 1 to 2147483647.",
+  invalidHeaders: "functions.invoke's headers are not valid HTTP header names and values.",
+  invalidName: "functions.invoke's name is a string: the function's name, then any path and query.",
+  unencodableName: "functions.invoke's name is not well-formed Unicode: it has a lone surrogate.",
+  dotSegments: `functions.invoke's name cannot be "." or "..", and ".." in its path cannot leave /functions/.`,
+  invalidSignal: "functions.invoke's signal is not an AbortSignal.",
+  bodyWithGetOrHead: "functions.invoke cannot send a body with GET or HEAD.",
+  /** `RELAY_ERROR`: a HEAD answer has no body, so Naro's code is not in it. */
+  headRelay: (status) => `Naro answered HTTP ${String(status)} for the function, but a HEAD answer has no body to say why. Call it with GET to read the reason.`,
+  unreadable: (status) => `The function answered HTTP ${String(status)}, but its body could not be read as its content-type says.`
+};
+var MAX_TIMER_MS = 2147483647;
+function functionPath(name) {
+  const cut = name.search(/[/?#]/);
+  const head = cut === -1 ? name : name.slice(0, cut);
+  const tail = cut === -1 ? "" : name.slice(cut);
+  return `/functions/${encodeURIComponent(head)}${tail}`;
+}
+function dotSegment(segment) {
+  const dots = segment.toLowerCase().replace(/%2e/g, ".");
+  return dots === "." ? 1 : dots === ".." ? 2 : 0;
+}
+function leavesFunctions(input) {
+  const name = input.replace(/[\t\n\r]/g, "");
+  const cut = name.search(/[/?#]/);
+  const head = cut === -1 ? name : name.slice(0, cut);
+  if (head === "." || head === "..") return true;
+  if (cut === -1 || name[cut] !== "/") return false;
+  const rest = name.slice(cut + 1);
+  const end = rest.search(/[?#]/);
+  let depth = 1;
+  for (const segment of (end === -1 ? rest : rest.slice(0, end)).split(
+    /[/\\]/
+  )) {
+    const dots = dotSegment(segment);
+    if (dots === 0) depth += 1;
+    if (dots === 2) depth -= 1;
+    if (depth < 0) return true;
+  }
+  return false;
+}
+function pathOf(name) {
+  if (typeof name !== "string")
+    return { invalid: FUNCTIONS_MESSAGES.invalidName };
+  if (leavesFunctions(name)) return { invalid: FUNCTIONS_MESSAGES.dotSegments };
+  try {
+    return { path: functionPath(name) };
+  } catch {
+    return { invalid: FUNCTIONS_MESSAGES.unencodableName };
+  }
+}
+function isSignalOrNone(value) {
+  if (value === void 0 || value === null) return true;
+  if (typeof value !== "object") return false;
+  const signal = value;
+  return typeof signal.aborted === "boolean" && typeof signal.addEventListener === "function" && typeof signal.removeEventListener === "function";
+}
+function invalidOptions(message) {
+  return failed(new FunctionsFetchError("INVALID_OPTIONS", message, null));
+}
+function failed(error) {
+  return { data: null, error };
+}
+function fromNaroError(error, cause) {
+  return new FunctionsFetchError(
+    error.code,
+    error.message,
+    cause,
+    error.details
+  );
+}
+function failure(kind, cause, timeout) {
+  if (kind === "timeout")
+    return new FunctionsFetchError(
+      "TIMEOUT",
+      FUNCTIONS_MESSAGES.timeout(timeout ?? 0),
+      cause
+    );
+  if (kind === "aborted")
+    return new FunctionsFetchError(
+      "ABORTED",
+      FUNCTIONS_MESSAGES.aborted,
+      cause
+    );
+  return fromNaroError(networkError(cause), cause);
+}
+function unreadable(cause, status, signal) {
+  if (signal?.aborted)
+    return new FunctionsFetchError(
+      "ABORTED",
+      FUNCTIONS_MESSAGES.aborted,
+      cause
+    );
+  if (cause instanceof SyntaxError)
+    return new FunctionsFetchError(
+      "INVALID_RESPONSE",
+      FUNCTIONS_MESSAGES.unreadable(status),
+      cause
+    );
+  return fromNaroError(networkError(cause), cause);
+}
+async function relayError(response, head) {
+  let body;
+  try {
+    body = await response.clone().json();
+  } catch {
+    body = void 0;
+  }
+  const { status } = response;
+  const error = withRetryAfter(
+    head && body === void 0 ? {
+      code: "RELAY_ERROR",
+      message: FUNCTIONS_MESSAGES.headRelay(status),
+      details: { status }
+    } : errorFromBody(status, body) ?? invalidResponse(status),
+    response.headers
+  );
+  return new FunctionsRelayError(
+    error.code,
+    error.message,
+    response,
+    error.details
+  );
+}
+var FunctionsClient = class {
+  #http;
+  #auth;
+  constructor(http, auth) {
+    this.#http = http;
+    this.#auth = auth;
+  }
+  async invoke(name, options = {}) {
+    const method = options.method ?? "POST";
+    const { timeout, signal } = options;
+    const target = pathOf(name);
+    if ("invalid" in target) return invalidOptions(target.invalid);
+    if (timeout !== void 0 && !(Number.isInteger(timeout) && timeout > 0 && timeout <= MAX_TIMER_MS))
+      return invalidOptions(FUNCTIONS_MESSAGES.invalidTimeout);
+    if (!isSignalOrNone(signal))
+      return invalidOptions(FUNCTIONS_MESSAGES.invalidSignal);
+    const verb = typeof method === "string" ? method.toUpperCase() : "";
+    if (options.body !== void 0 && (verb === "GET" || verb === "HEAD"))
+      return invalidOptions(FUNCTIONS_MESSAGES.bodyWithGetOrHead);
+    let headers;
+    try {
+      headers = new Headers(options.headers);
+    } catch (cause) {
+      return failed(
+        new FunctionsFetchError(
+          "INVALID_OPTIONS",
+          FUNCTIONS_MESSAGES.invalidHeaders,
+          cause
+        )
+      );
+    }
+    const prepared = prepareBody(options.body);
+    if (prepared === null)
+      return failed(
+        new FunctionsFetchError(
+          "INVALID_BODY",
+          FUNCTIONS_MESSAGES.invalidBody,
+          null
+        )
+      );
+    if (prepared.contentType !== null && !headers.has("content-type"))
+      headers.set("content-type", prepared.contentType);
+    const result = await fetchUnread(this.#http, {
+      method,
+      path: target.path,
+      headers,
+      body: prepared.body,
+      timeoutMs: timeout,
+      signal,
+      // A sign-in the page URL carried goes first, as for a query (P2-6) —
+      // within the call's timeout and signal; the exchange is not cut.
+      ready: () => this.#auth.ready()
+    });
+    if ("refused" in result) return failed(fromNaroError(result.refused, null));
+    if ("failed" in result)
+      return failed(failure(result.failed, result.cause, timeout));
+    const { response } = result;
+    if (!response.ok) {
+      const error = response.headers.get("x-relay-error") === "true" ? await relayError(response, verb === "HEAD") : new FunctionsHttpError(response);
+      return { data: null, error, response };
+    }
+    const answer = await readAnswer(response, method);
+    if ("unreadable" in answer)
+      return {
+        data: null,
+        error: unreadable(answer.unreadable, response.status, signal),
+        response
+      };
+    return { data: answer.data, error: null, response };
+  }
+};
 function isSpace2(char) {
   return char.trim() === "";
 }
@@ -8529,30 +9734,30 @@ var RealtimeSocket = class {
   request(topic, event, payload, options = {}) {
     const ref = options.ref ?? this.nextRef();
     const turn = options.turn ?? "app";
-    return new Promise((resolve7) => {
+    return new Promise((resolve9) => {
       const lost = {
         ok: false,
         error: realtimeClosed(1006),
         lost: true
       };
-      if (!this.isOpen()) return resolve7(lost);
+      if (!this.isOpen()) return resolve9(lost);
       let text;
       try {
         text = clientFrame(topic, event, payload, ref, options.joinRef);
       } catch {
-        return resolve7(lost);
+        return resolve9(lost);
       }
       const bytes = utf8Length(text);
       const limit = this.#frameLimit;
       if (limit !== null && bytes > limit)
-        return resolve7({ ok: false, error: frameTooLarge(limit), lost: false });
+        return resolve9({ ok: false, error: frameTooLarge(limit), lost: false });
       if (turn === "app" && event !== "phx_leave" && !this.#goesInTime())
-        return resolve7({
+        return resolve9({
           ok: false,
           error: clientFlooding(CONNECTION_FRAMES_PER_SECOND),
           lost: false
         });
-      this.#replies.set(ref, { resolve: resolve7, timer: void 0, bytes, turn });
+      this.#replies.set(ref, { resolve: resolve9, timer: void 0, bytes, turn });
       this.#enqueue({ text, bytes, ref, turn, presence: event === "presence" });
     });
   }
@@ -8876,19 +10081,19 @@ var RealtimeSocket = class {
   #closed(ws, code, reason, waitedMs) {
     if (this.#ws !== ws) return;
     const wasOpen = this.#state === "open";
-    const timedOut = waitedMs !== null;
+    const timedOut2 = waitedMs !== null;
     detach(ws);
     this.#ws = null;
     this.#clearTimers();
-    if (timedOut) closeQuietly(ws, 1e3);
+    if (timedOut2) closeQuietly(ws, 1e3);
     if (!wasOpen) this.#unopened += 1;
     const said = this.#said;
     this.#said = null;
-    if (!timedOut && code === 4008) this.#flooded = true;
-    const action = timedOut ? { kind: "retry", minMs: 0 } : closeAction(code, said?.code ?? reason);
+    if (!timedOut2 && code === 4008) this.#flooded = true;
+    const action = timedOut2 ? { kind: "retry", minMs: 0 } : closeAction(code, said?.code ?? reason);
     if (action.kind === "stop")
       return this.#stop(said ?? realtimeStopped(code, reason));
-    const error = timedOut ? realtimeTimedOut(waitedMs) : said ?? realtimeClosed(code);
+    const error = timedOut2 ? realtimeTimedOut(waitedMs) : said ?? realtimeClosed(code);
     this.#failReplies(error);
     this.#state = "waiting";
     const delay = delayAfter(
@@ -8901,7 +10106,7 @@ var RealtimeSocket = class {
     safely(
       () => this.#config.events.dropped(
         error,
-        timedOut ? "TIMED_OUT" : "CHANNEL_ERROR"
+        timedOut2 ? "TIMED_OUT" : "CHANNEL_ERROR"
       )
     );
   }
@@ -9671,9 +10876,9 @@ var RealtimeChannel = class {
    */
   #inTurn(joinRef, wait, send2) {
     if (!wait && this.#waiting.length === 0) return send2();
-    return new Promise((resolve7) => {
+    return new Promise((resolve9) => {
       this.#waiting.push(
-        () => resolve7(this.#joinRef === joinRef ? send2() : null)
+        () => resolve9(this.#joinRef === joinRef ? send2() : null)
       );
     });
   }
@@ -10288,13 +11493,13 @@ async function uploadInParts(a) {
     }).catch(() => void 0);
   };
   const etags = [];
-  const failure = {
+  const failure2 = {
     error: signal?.aborted ? uploadAborted() : null
   };
   let next = 1;
   let sentBytes = 0;
   const onAbort = () => {
-    failure.error ??= uploadAborted();
+    failure2.error ??= uploadAborted();
   };
   const tryPart = async (n, bytes) => {
     const sent2 = await send(a.http, {
@@ -10323,18 +11528,18 @@ async function uploadInParts(a) {
         progress(sentBytes);
         return null;
       }
-      if (attempt22 === ATTEMPTS || failure.error !== null || !retryable(tried.error, tried.status))
+      if (attempt22 === ATTEMPTS || failure2.error !== null || !retryable(tried.error, tried.status))
         return tried.error;
       await sleep2(waitAfter(tried.error, attempt22), signal);
-      if (failure.error !== null) return tried.error;
+      if (failure2.error !== null) return tried.error;
     }
   };
   const worker = async () => {
-    while (failure.error === null && next <= partCount) {
+    while (failure2.error === null && next <= partCount) {
       const n = next;
       next += 1;
       const error = await sendPart(n);
-      if (error !== null) failure.error ??= error;
+      if (error !== null) failure2.error ??= error;
     }
   };
   signal?.addEventListener("abort", onAbort);
@@ -10342,9 +11547,9 @@ async function uploadInParts(a) {
     Array.from({ length: Math.min(CONCURRENCY, partCount) }, worker)
   );
   signal?.removeEventListener("abort", onAbort);
-  if (failure.error !== null) {
+  if (failure2.error !== null) {
     await callOff();
-    return fail(failure.error);
+    return fail(failure2.error);
   }
   const completed = await call(a.http, {
     method: "POST",
@@ -10571,8 +11776,8 @@ var StorageFileApi = class {
     const payload = payloadOf(body, options.contentType);
     if (!payload.ok) return fail(payload.error);
     const cache = `max-age=${options.cacheControl ?? "3600"}`;
-    const unreadable = headerProblem(options.contentType, cache);
-    if (unreadable !== null) return fail(unreadable);
+    const unreadable2 = headerProblem(options.contentType, cache);
+    if (unreadable2 !== null) return fail(unreadable2);
     const { signal } = options;
     if (signal?.aborted) return fail(uploadAborted());
     await this.#auth.ready();
@@ -10873,8 +12078,8 @@ var StorageFileApi = class {
     const payload = payloadOf(body, given.contentType);
     if (!payload.ok) return fail(payload.error);
     const cache = `max-age=${given.cacheControl ?? "3600"}`;
-    const unreadable = headerProblem(given.contentType, cache);
-    if (unreadable !== null) return fail(unreadable);
+    const unreadable2 = headerProblem(given.contentType, cache);
+    if (unreadable2 !== null) return fail(unreadable2);
     const { signal } = given;
     if (signal?.aborted) return fail(uploadAborted());
     const uploaded = payload.size > MAX_SINGLE_UPLOAD_BYTES2 ? await uploadInParts({
@@ -10953,12 +12158,14 @@ var CONFIG_MESSAGES = {
   bothKeys: "Pass createClient an anonKey or a serviceKey, not both.",
   serviceKeyOffServer: SERVICE_KEY_OFF_SERVER_MESSAGE,
   fetch: "This runtime has no fetch. Pass one to createClient({ fetch }).",
-  realtime: "createClient's realtime options take a WebSocket class, and heartbeatIntervalMs and timeoutMs in whole milliseconds from 1 to 2147483647."
+  realtime: "createClient's realtime options take a WebSocket class, and heartbeatIntervalMs and timeoutMs in whole milliseconds from 1 to 2147483647.",
+  accessTokenWithServiceKey: "Pass createClient an accessToken or a serviceKey, not both: the service key skips every policy, so the user's token would not count.",
+  accessToken: "createClient's accessToken is a function that returns the user's access token, or null for none."
 };
 var SERVICE_KEY_PREFIX = "naro_sk_";
-var MAX_TIMER_MS = 2147483647;
+var MAX_TIMER_MS2 = 2147483647;
 function isMilliseconds(value) {
-  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_TIMER_MS;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_TIMER_MS2;
 }
 function realtimeOptionsOf(value) {
   if (value === void 0) return {};
@@ -11008,6 +12215,35 @@ function apiKeyOf(options) {
     throw new Error(CONFIG_MESSAGES.serviceKeyOffServer);
   return { key, service };
 }
+function accessTokenOf(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "function") throw new Error(CONFIG_MESSAGES.accessToken);
+  const read = value;
+  return {
+    async get() {
+      const token = await read();
+      if (token === null || token === void 0 || token === "") return null;
+      if (typeof token !== "string")
+        throw new TypeError(`accessToken returned a ${typeof token}`);
+      if (!/^[\x21-\x7E]+$/.test(token))
+        throw new TypeError(
+          "accessToken returned a string that is not a token"
+        );
+      return token;
+    }
+  };
+}
+function refusingAuth() {
+  return new Proxy(/* @__PURE__ */ Object.create(null), {
+    get(_target, property) {
+      if (typeof property === "symbol" || property === "then" || property === "toJSON" || property === "constructor" || property === "asymmetricMatch")
+        return void 0;
+      if (property === "toString") return Object.prototype.toString;
+      if (property === "valueOf") return Object.prototype.valueOf;
+      throw new Error(accessTokenAuthMessage(property));
+    }
+  });
+}
 function queryRunner(http, auth) {
   return async (query) => {
     await auth.ready();
@@ -11036,7 +12272,14 @@ var NaroClient2 = class {
    * them, as supabase-js does.
    */
   storage;
+  /**
+   * The project's Naro Functions (design §9): `functions.invoke(name, {
+   * body })`, as in supabase-js.
+   */
+  functions;
   #run;
+  /** Made with `accessToken`: `auth` and `channel()` refuse. */
+  #accessToken;
   #newRealtime;
   /**
    * Made by the first channel(), not by the constructor: it listens to every
@@ -11047,36 +12290,38 @@ var NaroClient2 = class {
   constructor(options) {
     const baseUrl = baseUrlOf(options.url);
     const { key: apiKey, service } = apiKeyOf(options);
+    const accessToken = accessTokenOf(options.accessToken);
+    if (accessToken !== void 0 && service)
+      throw new Error(CONFIG_MESSAGES.accessTokenWithServiceKey);
     if (options.fetch === void 0 && typeof globalThis.fetch !== "function")
       throw new Error(CONFIG_MESSAGES.fetch);
     const realtime = realtimeOptionsOf(options.realtime);
-    const storage = options.auth?.storage ?? defaultStorage();
+    const storage = accessToken !== void 0 ? memoryStorage() : options.auth?.storage ?? defaultStorage();
     const http = {
       baseUrl,
       apiKey,
       fetch: options.fetch,
       tokens: new TokenStore(storage, storageKey(baseUrl)),
-      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl))
+      service,
+      ...accessToken !== void 0 ? { accessToken } : { accessJwt: new TokenStore(storage, accessJwtKey(baseUrl)) }
     };
-    this.auth = new AuthClient(http, {
+    const auth = new AuthClient(http, {
       verifiers: new FlowVerifiers(
         new TokenStore(storage, verifierKey(baseUrl))
       ),
       recovery: new RecoveryToken(
         new TokenStore(storage, recoveryKey(baseUrl))
       ),
-      detectSessionInUrl: options.auth?.detectSessionInUrl ?? true,
+      detectSessionInUrl: accessToken === void 0 && (options.auth?.detectSessionInUrl ?? true),
       shared: { storage, key: storageKey(baseUrl) },
       serviceKey: service
     });
-    this.#run = queryRunner(http, this.auth);
-    this.storage = new StorageClient(http, this.auth);
-    this.#newRealtime = () => new RealtimeClient({
-      http,
-      auth: this.auth,
-      service,
-      options: realtime
-    });
+    this.#accessToken = accessToken !== void 0;
+    this.auth = this.#accessToken ? refusingAuth() : auth;
+    this.#run = queryRunner(http, auth);
+    this.storage = new StorageClient(http, auth);
+    this.functions = new FunctionsClient(http, auth);
+    this.#newRealtime = () => new RealtimeClient({ http, auth, service, options: realtime });
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
   from(table3) {
@@ -11088,6 +12333,7 @@ var NaroClient2 = class {
    * `removeChannel`. Nothing connects until the first `subscribe()`.
    */
   channel(name, options) {
+    if (this.#accessToken) throw new Error(ACCESS_TOKEN_CHANNEL_MESSAGE);
     return this.#client().channel(name, options);
   }
   /** The channels made with `channel()` and not yet removed. */
@@ -11099,7 +12345,9 @@ var NaroClient2 = class {
    * one; the connection closes with the last channel.
    */
   removeChannel(channel) {
-    return this.#client().removeChannel(channel);
+    if (this.#realtime === void 0)
+      return Promise.resolve({ data: null, error: null });
+    return this.#realtime.removeChannel(channel);
   }
   /** `removeChannel()` for every channel; the connection closes. */
   removeAllChannels() {
@@ -11207,18 +12455,27 @@ function unwrap(result) {
 }
 var ONE_KEY = /^[\x21-\x7e]+$/;
 async function objects(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
-  if (backend.status === "none")
+  const environment = dataEnvironment(context.flags);
+  if (backend.status === "none") {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
+      environment === null ? "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`." : `The ${environment} environment has no backend yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
+  }
+  if (!backend.enabled)
+    throw new NaroError(
+      "BACKEND_OFF",
+      forEnvironment(BACKEND_OFF_MESSAGE, environment)
     );
-  if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
   const state = await client.storage.info(projectId);
   if (state.disabledAt !== null)
-    throw new NaroError("STORAGE_OFF", STORAGE_OFF_MESSAGE);
+    throw new NaroError(
+      "STORAGE_OFF",
+      forEnvironment(STORAGE_OFF_MESSAGE, environment)
+    );
   let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
   if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
     throw new NaroError(
@@ -11239,7 +12496,10 @@ async function objects(context) {
   } catch (error) {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+      forEnvironment(
+        `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+        environment
+      ),
       { cause: error }
     );
   }
@@ -11313,7 +12573,7 @@ async function storageLs(context) {
         "VALIDATION_FAILED",
         `--search needs a naro:// path. ${LS_USAGE}`
       );
-    const client = await context.client();
+    const client = await dataClient(context);
     const projectId2 = await context.resolveProjectId();
     const buckets = await client.storage.listBuckets(projectId2);
     context.output.result(
@@ -11405,7 +12665,7 @@ function stopOnInterrupt(onFirst) {
   };
 }
 async function writeAtomically(bytes, destination) {
-  const partial = join5(dirname3(destination), `.${randomUUID()}.naro-partial`);
+  const partial = join6(dirname4(destination), `.${randomUUID()}.naro-partial`);
   const stopListening = removeOnInterrupt(partial);
   try {
     await pipeline2(bytes, createWriteStream2(partial, { flags: "wx" }));
@@ -11446,7 +12706,7 @@ function progressReporter(output, total) {
   };
 }
 async function upload(context, local, target) {
-  const file = resolve6(context.cwd, local);
+  const file = resolve8(context.cwd, local);
   const info = await stat(file).catch(() => null);
   if (info === null)
     throw new NaroError(
@@ -11580,10 +12840,10 @@ async function download(context, source, local) {
       "VALIDATION_FAILED",
       "naro storage cp downloads one object: name it, naro://<bucket>/<path>."
     );
-  const resolved = resolve6(context.cwd, local);
+  const resolved = resolve8(context.cwd, local);
   const isDirectory = local.endsWith("/") || (await stat(resolved).catch(() => null))?.isDirectory() === true;
-  const destination = isDirectory ? join5(resolved, savedAs(source.path)) : resolved;
-  const folder = await stat(dirname3(destination)).catch(() => null);
+  const destination = isDirectory ? join6(resolved, savedAs(source.path)) : resolved;
+  const folder = await stat(dirname4(destination)).catch(() => null);
   if (folder === null || !folder.isDirectory())
     throw new NaroError(
       "VALIDATION_FAILED",
@@ -11970,12 +13230,14 @@ Usage:
   naro env pull [file]               Write env vars to .env.local
        target is production, preview, all or an environment name; add and import use all when none is given
 
-  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments                  List the project's environments: address, branch, protection, data, and how many the plan allows
   naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
                                      A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
   naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
                                      Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
-  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker, protection key and data (asks first; --yes in CI)
+  naro environments provision <slug>
+                                     Make its data \u2014 database, backend, Storage \u2014 or go on after a stop
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -11984,6 +13246,9 @@ Usage:
   naro domains verify [host] [--wait]  Re-check DNS and print what is missing
        exits non-zero while a domain is not live yet
 
+  The data commands below (db, migration, gen, backend, policy, storage, realtime) take --env <name>:
+       a named environment's data instead of production's, which preview shares
+       (naro-cli 0.21.0 and older ignore --env on them and act on production)
   naro db enable                     Create the project's database (Cloudflare D1)
   naro db info                       Database status, size, table count and limits
        and today's writes against the daily write limit (UTC)
@@ -12121,6 +13386,28 @@ Usage:
   naro realtime tables remove <table>\u2026 [--yes]
                                      Stop publishing tables' changes (asks first)
 
+  naro functions [list]              Naro Functions: name, version, verify_jwt, status and URL of each function
+  naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
+  naro functions deploy [name\u2026] [--no-verify-jwt] [--import-map <file>] [--skip-check]
+                                     Bundle on this machine (Node.js 22 or later), check that it starts, upload;
+                                     every function in the folder when no name is given
+  naro functions versions <name>     Its stored versions, newest first
+  naro functions rollback <name> [<version>]
+                                     Put an earlier version live again (the one before the live one by default)
+  naro functions delete <name>       Delete it: its URL stops working (asks first; --yes to skip)
+  naro functions logs <name> [--level <l>] [--follow]
+                                     Its newest log lines
+  naro functions secrets [list]      The project's function secrets: names and digests, never values
+  naro functions secrets set <NAME>  Set one (value from a hidden prompt or stdin), then sync the functions
+                                     (--no-sync leaves them to the control plane's sweep)
+  naro functions secrets import <file>
+                                     Set a dotenv file's lines (asks first; --yes in CI)
+  naro functions secrets unset <NAME>\u2026
+                                     Remove secrets (asks first)
+  naro functions secrets sync [--registry]
+                                     Upload out-of-date functions again until none is left; --registry also rewrites
+                                     the function list in the project's database (after naro db restore)
+
   naro promote <deployment-id> [--to <environment>]
                                      Publish a build to production, or to an environment with --to; it says what it will do, then asks.
                                      A build moving between an environment and another surface is built again from its commit with the
@@ -12149,7 +13436,13 @@ Global options:
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
   --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --no-verify-jwt Let calls in without a project JWT (naro functions deploy; wins over function.json)
+  --import-map <file>  The import map for functions whose folder has no deno.json (naro functions deploy)
+  --skip-check    Upload without booting the bundle in workerd first (naro functions deploy)
+  --no-sync       Leave the functions to the control plane's sweep (naro functions secrets set, import, unset; naro backend keys rotate)
+  --registry      Also rewrite the function list in the project's database (naro functions secrets sync)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name);
+                  production or an environment name for the data commands (naro db, migration, gen, backend, policy, storage, realtime: production by default)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
                   branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
   --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
@@ -12162,7 +13455,8 @@ Global options:
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
   --output <file> Write to a file instead of stdout (naro gen types, db dump)
   --lang <lang>   Language of the types; typescript, the default, is the only one (naro gen types)
-  --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations)
+  --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations) (naro db push \u2026);
+                  functions directory (default ./naro/functions, or <--root>/naro/functions) (naro functions \u2026)
   --strict        Fail on warnings too, not only errors (naro db lint)
   --schema-only   Dump the schema without rows (naro db dump)
   --data-only     Dump rows without the schema (naro db dump)
@@ -12371,13 +13665,134 @@ function routeRealtime(words) {
       return null;
   }
 }
+function routeFunctions(words) {
+  const [sub] = words;
+  switch (sub) {
+    case void 0:
+    case "list":
+    case "ls":
+      return words.length <= 1 ? { handler: runFunctionsList, positionals: [] } : null;
+    case "versions":
+      return { handler: runFunctionsVersions, positionals: words.slice(1) };
+    case "new":
+      return { handler: runFunctionsNew, positionals: words.slice(1) };
+    case "deploy":
+      return { handler: runFunctionsDeploy, positionals: words.slice(1) };
+    case "rollback":
+      return { handler: runFunctionsRollback, positionals: words.slice(1) };
+    case "delete":
+    case "remove":
+    case "rm":
+      return { handler: runFunctionsDelete, positionals: words.slice(1) };
+    case "logs":
+      return { handler: runFunctionsLogs, positionals: words.slice(1) };
+    case "secrets": {
+      const action = words[1];
+      switch (action) {
+        case void 0:
+        case "list":
+        case "ls":
+          return words.length <= 2 ? { handler: runFunctionsSecretsList, positionals: [] } : null;
+        case "set":
+          return {
+            handler: runFunctionsSecretsSet,
+            positionals: words.slice(2)
+          };
+        case "import":
+          return {
+            handler: runFunctionsSecretsImport,
+            positionals: words.slice(2)
+          };
+        case "unset":
+          return {
+            handler: runFunctionsSecretsUnset,
+            positionals: words.slice(2)
+          };
+        case "sync":
+          return words.length === 2 ? { handler: runFunctionsSecretsSync, positionals: [] } : null;
+        default:
+          return null;
+      }
+    }
+    default:
+      return null;
+  }
+}
 async function refuseTo() {
   throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
 }
+async function refuseFunctionsEnv() {
+  throw new NaroError("VALIDATION_FAILED", FUNCTIONS_ENV_REFUSAL);
+}
+var DATA_COMMANDS = /* @__PURE__ */ new Set([
+  "db",
+  "migration",
+  "gen",
+  "backend",
+  "policy",
+  "storage",
+  "realtime"
+]);
+var PROJECT_WIDE_BACKEND = /* @__PURE__ */ new Set(["enable", "provision", "disable"]);
+function dataEnvRefusal(parsed) {
+  if (parsed.flags.env === void 0 || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return null;
+  const sub = parsed.positionals[0];
+  if (parsed.command === "backend" && sub !== void 0 && PROJECT_WIDE_BACKEND.has(sub) && parsed.flags.env !== "production")
+    return new NaroError(
+      "VALIDATION_FAILED",
+      DATA_ENV_MESSAGES.projectWide(`naro backend ${sub}`)
+    );
+  try {
+    dataEnvironment(parsed.flags);
+    return null;
+  } catch (error) {
+    return error;
+  }
+}
+function guidedError(error, parsed) {
+  if (!isNaroError(error) || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return error;
+  if (dataEnvRefusal(parsed) !== null) return error;
+  let environment;
+  try {
+    environment = dataEnvironment(parsed.flags);
+  } catch {
+    return error;
+  }
+  if (environment === null) return error;
+  const usage = error.message.indexOf("Usage: ");
+  error.message = usage === -1 ? forEnvironment(error.message, environment) : `${forEnvironment(error.message.slice(0, usage), environment)}${error.message.slice(usage)}`;
+  return error;
+}
+function unknownFunctionsWords(words) {
+  const [sub = "", action = "", extra = ""] = words;
+  if (sub === "list" || sub === "ls") return [sub, action];
+  if (sub === "secrets")
+    return action === "list" || action === "ls" || action === "sync" ? [sub, action, extra] : [sub, action];
+  return [sub];
+}
+function unknownCommandMessage(parsed) {
+  const words = parsed.command === "functions" ? [
+    "functions",
+    ...unknownFunctionsWords(parsed.positionals).map(printable)
+  ] : [parsed.command, ...parsed.positionals];
+  return `Unknown command: ${words.join(" ")}. See \`naro help\`.`;
+}
 function route(parsed) {
   const routed = routeCommand(parsed);
   if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
     return { handler: refuseTo, positionals: routed.positionals };
+  if (routed && parsed.command === "functions" && parsed.flags.env !== void 0)
+    return { handler: refuseFunctionsEnv, positionals: routed.positionals };
+  const refusal = routed ? dataEnvRefusal(parsed) : null;
+  if (routed && refusal)
+    return {
+      handler: async () => {
+        throw refusal;
+      },
+      positionals: routed.positionals
+    };
   return routed;
 }
 function routeCommand(parsed) {
@@ -12499,6 +13914,11 @@ function routeCommand(parsed) {
             handler: runEnvironmentsDelete,
             positionals: positionals.slice(1)
           };
+        case "provision":
+          return {
+            handler: runEnvironmentsProvision,
+            positionals: positionals.slice(1)
+          };
         default:
           return null;
       }
@@ -12623,6 +14043,8 @@ function routeCommand(parsed) {
       return routeStorage(positionals);
     case "realtime":
       return routeRealtime(positionals);
+    case "functions":
+      return routeFunctions(positionals);
     case "policy":
       switch (sub) {
         case void 0:
@@ -12666,19 +14088,6 @@ function routeCommand(parsed) {
       return null;
   }
 }
-function version() {
-  try {
-    const pkg = JSON.parse(
-      readFileSync6(
-        join6(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
-        "utf8"
-      )
-    );
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
 
 // src/index.ts
 async function main(argv = process.argv.slice(2)) {
@@ -12704,20 +14113,14 @@ async function main(argv = process.argv.slice(2)) {
   const output = new Output(parsed.flags.json, parsed.flags.debug);
   if (parsed.unknown.length > 0) {
     output.fail(
-      new NaroError(
-        "VALIDATION_FAILED",
-        secretFlagProblem(parsed.unknown) ?? `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`
-      )
+      new NaroError("VALIDATION_FAILED", unknownOptionProblem(parsed))
     );
     return;
   }
   const routed = route(parsed);
   if (!routed) {
     output.fail(
-      new NaroError(
-        "VALIDATION_FAILED",
-        `Unknown command: ${[parsed.command, ...parsed.positionals].join(" ")}. See \`naro help\`.`
-      )
+      new NaroError("VALIDATION_FAILED", unknownCommandMessage(parsed))
     );
     return;
   }
@@ -12725,7 +14128,7 @@ async function main(argv = process.argv.slice(2)) {
   try {
     await routed.handler(context);
   } catch (error) {
-    context.output.fail(error);
+    context.output.fail(guidedError(error, parsed));
   }
 }
 void main();