naro-cli 0.22.0 → 0.24.0

package/dist/index.js

@@ -3,6 +3,8 @@ import {
   ANALYTICS_FILTER_KEYS,
   BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
+  BUNDLE_MESSAGES,
+  DATA_ENV_MESSAGES,
   INDEX_SQL,
   MAX_SINGLE_UPLOAD_BYTES,
   NAMED_POLICY_SQL,
@@ -19,28 +21,44 @@ import {
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
   STORAGE_OBJECTS_TABLE,
   STORAGE_SUBQUERIES_SQL,
+  UNSHOWN_WARNING_LINE,
+  appliedMigrations,
+  applyMigrationFiles,
+  assertFunctionsNode,
   buildResetPlan,
+  cannotAsk,
   cellText,
   checkObjectName,
   clearSession,
   commentText,
-  compareMigrations,
+  confirmOrAbort,
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
+  createPrompter,
+  dataClient,
+  dataEnvironment,
   dataError,
+  databaseName,
+  defaultSleep,
   deployDirectory,
+  deployFunctions,
   detectGitInfo,
+  enableBackendCommand,
   ensureGitignoreHasNaro,
-  environmentGuidance,
-  environmentSlugProblem,
+  envFlag,
+  forEnvironment,
   formatRedirectEntry,
+  functionsFolder,
   generateTypes,
   indexesFromRows,
   isBookmark,
   isEnvTargetName,
   isExpired,
+  isFunctionName,
+  isInteractive,
   isNaroError,
+  isPrintable,
   isReservedEnvTarget,
   isStalledBackend,
   isTerminalStatus,
@@ -51,19 +69,22 @@ import {
   login,
   maskEnvValue,
   migrationNameMismatch,
+  migrationsDir,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseCacheControl,
   parseDotenvDetailed,
   parseGitHubRemote,
+  parseJsonc,
   parsePolicyNode,
   parsePolicyStatement,
   parseRedirectEntry,
   pendingMigrationNames,
-  planPolicyMigration,
   policiesForTypes,
   policiesLostByReset,
+  policyProblems,
+  printable,
   projectPath,
   promoteTargetUnsupported,
   promptForMissingEnv,
@@ -71,7 +92,9 @@ import {
   quoteIdent,
   quotePolicyName,
   readProjectLink,
+  readStdin,
   refreshStoredSession,
+  relativeToCwd,
   removeProjectLink,
   renderRows,
   resetFileRefusedMessage,
@@ -79,14 +102,17 @@ import {
   resetPoliciesWithTablesMessage,
   resetStorageOutdatedMessage,
   resolveAuth,
-  resolveMigrationsDir,
+  retryAfterSeconds,
+  runMigrationList,
+  runMigrationNew,
+  runMigrationRepair,
+  runMigrationUp,
   saveSession,
   schemaMigrationTitle,
   serializeDotenv,
   slugify,
   snapshotFromRows,
   splitPolicyStatements,
-  splitStatements,
   storageRefusalOfFiles,
   storedPolicySql,
   summarizeStatement,
@@ -98,8 +124,11 @@ import {
   unreadablePolicyComment,
   usageMonthOf,
   userForAccessToken,
+  version,
+  warningLines,
+  withFunctionRetries,
   writeProjectLink
-} from "./chunk-MBSO3K6L.js";
+} from "./chunk-XJIWWZ2T.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -139,7 +168,11 @@ var BOOLEAN_FLAGS = {
   "--recursive": "recursive",
   "-r": "recursive",
   "--upsert": "upsert",
-  "--no-branch": "noBranch"
+  "--no-branch": "noBranch",
+  "--no-verify-jwt": "noVerifyJwt",
+  "--skip-check": "skipCheck",
+  "--no-sync": "noSync",
+  "--registry": "registry"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -199,7 +232,8 @@ var STRING_FLAGS = {
   "--copy-env": "copyEnv",
   "--database": "database",
   "--protection": "protection",
-  "--to": "to"
+  "--to": "to",
+  "--import-map": "importMap"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -214,6 +248,13 @@ function secretFlagProblem(unknown) {
   }
   return null;
 }
+var SECRETS_ARGV_REFUSAL = "Secrets are read from stdin or a file, never from the command line: pipe the value into naro functions secrets set <NAME>, or put it in a file for naro functions secrets import <file>.";
+function unknownOptionProblem(parsed) {
+  const [area, action] = parsed.positionals;
+  if (parsed.command === "functions" && area === "secrets" && action === "set")
+    return SECRETS_ARGV_REFUSAL;
+  return secretFlagProblem(parsed.unknown) ?? `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`;
+}
 function listFlag(value) {
   if (value === void 0) return [];
   return value.split(",").map((piece) => piece.trim()).filter((piece) => piece.length > 0);
@@ -373,123 +414,6 @@ var Output = class {
   }
 };
 
-// src/prompt.ts
-import { createInterface } from "readline";
-import { Writable } from "stream";
-function confirmHint(defaultYes) {
-  return defaultYes ? "(Y/n)" : "(y/N)";
-}
-function readConfirmAnswer(answer, defaultYes) {
-  const normalized = answer.trim().toLowerCase();
-  if (normalized === "") return defaultYes;
-  if (normalized === "y" || normalized === "yes") return true;
-  if (!defaultYes) return false;
-  if (normalized === "n" || normalized === "no") return false;
-  return null;
-}
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-async function readStdin() {
-  let data = "";
-  for await (const chunk2 of process.stdin) data += String(chunk2);
-  return data.replace(/\r?\n$/, "");
-}
-var TtyPrompter = class {
-  async ask(question) {
-    const rl = createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-    try {
-      return await new Promise(
-        (resolve7) => rl.question(question, resolve7)
-      );
-    } finally {
-      rl.close();
-    }
-  }
-  async askHidden(question) {
-    let muted = false;
-    const output = new Writable({
-      write(chunk2, _enc, done) {
-        if (!muted) process.stdout.write(chunk2);
-        done();
-      }
-    });
-    const rl = createInterface({
-      input: process.stdin,
-      output,
-      terminal: true
-    });
-    try {
-      const answer = new Promise(
-        (resolve7) => rl.question(question, resolve7)
-      );
-      muted = true;
-      const value = await answer;
-      process.stdout.write("\n");
-      return value;
-    } finally {
-      rl.close();
-    }
-  }
-  async confirm(question, options = {}) {
-    const defaultYes = options.defaultYes ?? false;
-    for (; ; ) {
-      const read = readConfirmAnswer(
-        await this.ask(`${question} ${confirmHint(defaultYes)} `),
-        defaultYes
-      );
-      if (read !== null) return read;
-    }
-  }
-  async select(question, options) {
-    process.stdout.write(`${question}
-`);
-    options.forEach((option, index) => {
-      process.stdout.write(`  ${String(index + 1)}. ${option}
-`);
-    });
-    for (; ; ) {
-      const answer = Number.parseInt(
-        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
-        10
-      );
-      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
-        return answer - 1;
-    }
-  }
-};
-var NonInteractivePrompter = class {
-  constructor(assumeYes) {
-    this.assumeYes = assumeYes;
-  }
-  refuse(question) {
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
-    );
-  }
-  async ask(question) {
-    this.refuse(question);
-  }
-  async askHidden(question) {
-    this.refuse(question);
-  }
-  async confirm() {
-    return this.assumeYes;
-  }
-  async select(question) {
-    this.refuse(question);
-  }
-};
-function createPrompter(options) {
-  if (options.yes || options.json || !isInteractive())
-    return new NonInteractivePrompter(options.yes);
-  return new TtyPrompter();
-}
-
 // src/context.ts
 function createContext(flags, positionals = []) {
   const cwd = flags.cwd ?? process.cwd();
@@ -523,7 +447,8 @@ function createContext(flags, positionals = []) {
       const resolved = await auth();
       resolvedClient = new NaroClient({
         baseUrl: controlPlaneUrl(),
-        getAccessToken: () => resolved.getAccessToken()
+        getAccessToken: () => resolved.getAccessToken(),
+        clientName: `naro-cli/${version()}`
       });
       return resolvedClient;
     },
@@ -540,295 +465,6 @@ function createContext(flags, positionals = []) {
   };
 }
 
-// src/router.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
-import { fileURLToPath } from "url";
-
-// src/data-environment.ts
-var DATA_ENV_MESSAGES = {
-  name: "--env must be production or an environment name.",
-  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
-  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
-};
-function dataEnvironment(flags) {
-  const value = flags.env;
-  if (value === void 0 || value === "production") return null;
-  if (value === "preview")
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
-  if (environmentSlugProblem(value) !== null)
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
-  return value;
-}
-async function dataClient(context) {
-  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
-}
-function databaseName(environment) {
-  return environment === null ? "the project database" : `the ${environment} environment's database`;
-}
-function enableBackendCommand(environment) {
-  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
-}
-function envFlag(environment) {
-  return environment === null ? "" : ` --env ${environment}`;
-}
-function forEnvironment(text, environment) {
-  return environmentGuidance(text, environment);
-}
-
-// src/commands/migration.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join, relative } from "path";
-
-// src/commands/confirm.ts
-function cannotAsk(context) {
-  return context.flags.json || !isInteractive();
-}
-async function confirmOrAbort(context, question) {
-  if (context.flags.yes) return;
-  if (cannotAsk(context)) {
-    throw new NaroError(
-      "CONFIRMATION_REQUIRED",
-      `${question} Re-run with --yes to confirm.`
-    );
-  }
-  const confirmed = await context.prompter.confirm(question);
-  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
-}
-
-// src/commands/migration.ts
-var processStdin = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-function migrationsDir(context) {
-  return resolveMigrationsDir({
-    baseDir: context.cwd,
-    rootDirectory: context.flags.root,
-    dir: context.flags.dir
-  });
-}
-function relativeToCwd(context, path) {
-  const rel = relative(context.cwd, path);
-  return rel === "" ? "." : rel;
-}
-async function appliedMigrations(client, projectId) {
-  try {
-    return await client.db.migrations(projectId);
-  } catch (error) {
-    if (isNaroError(error) && error.code === "DATABASE_NOT_READY") return [];
-    throw error;
-  }
-}
-var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable(text) {
-  return text.replace(UNPRINTABLE, "?");
-}
-function isPrintable(text) {
-  return printable(text) === text;
-}
-var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
-function warningLines(message) {
-  return message.split("\n").map(
-    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
-  );
-}
-function policyProblems(dir, names) {
-  return names.flatMap((name) => {
-    const split = splitStatements(readFileSync(join(dir, name), "utf8"));
-    if (!split.ok) return [];
-    const planned = planPolicyMigration(
-      split.statements.map((statement) => statement.text)
-    );
-    return planned.ok ? [] : [{ migration: name, message: planned.message }];
-  });
-}
-function warningLine(warning) {
-  if (warning === "out-of-order")
-    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
-  if (warning === "ledger-name-missing-extension")
-    return "  \u26A0 recorded without .sql in the ledger";
-  return null;
-}
-async function runMigrationNew(context, deps = processStdin) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration new <name>"
-  );
-  const dir = migrationsDir(context);
-  const fileName = nextMigrationFileName(
-    listMigrationFiles(dir),
-    name
-  );
-  mkdirSync(dir, { recursive: true });
-  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
-  const fromStdin = piped.length > 0;
-  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
-` : `-- Migration: ${fileName}
-`;
-  const path = join(dir, fileName);
-  writeFileSync(path, body, { flag: "wx" });
-  const relPath = relativeToCwd(context, path);
-  context.output.result({ file: fileName, path: relPath, fromStdin }, [
-    `\u2705 Created ${relPath}`
-  ]);
-}
-async function runMigrationList(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const migrations = compareMigrations(local, ledger);
-  const relDir = relativeToCwd(context, dir);
-  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
-    `Migrations in ${relDir} (${String(migrations.length)}):`,
-    ...migrations.flatMap((row) => {
-      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
-      const warning = warningLine(row.warning);
-      return warning ? [line, warning] : [line];
-    })
-  ];
-  context.output.result({ projectId, dir: relDir, migrations }, lines);
-}
-async function applyMigrationFiles(context, client, projectId, dir, names) {
-  const applied = [];
-  const warnings = [];
-  for (const name of names) {
-    const sql = readFileSync(join(dir, name), "utf8");
-    let answer;
-    try {
-      answer = await client.db.applyMigration(projectId, { name, sql });
-    } catch (error) {
-      if (!isNaroError(error)) throw error;
-      for (const message of serverWarnings(error.details))
-        for (const line of warningLines(message)) context.output.warn(line);
-      const shown = context.output.json ? name : printable(name);
-      throw new NaroError(error.code, `${shown}: ${error.message}`, {
-        ...error.status === void 0 ? {} : { status: error.status },
-        details: {
-          ...error.details,
-          migration: name,
-          applied,
-          appliedWarnings: warnings
-        },
-        cause: error
-      });
-    }
-    context.output.log(`\u2713 ${printable(name)}`);
-    applied.push(name);
-    for (const message of answer.warnings) {
-      warnings.push({ migration: name, message });
-      for (const line of warningLines(message)) context.output.warn(line);
-    }
-  }
-  return { applied, warnings };
-}
-function serverWarnings(details) {
-  const warnings = details?.warnings;
-  return Array.isArray(warnings) ? warnings.filter(
-    (warning) => typeof warning === "string"
-  ) : [];
-}
-var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
-var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
-var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
-var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
-function withoutSuffix(key) {
-  return key.slice(0, -".sql".length);
-}
-async function runMigrationRepair(context) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration repair <name> --status applied|reverted"
-  );
-  const key = name;
-  if (!MIGRATION_NAME_RE.test(key))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "name must end with .sql and contain only letters, digits, _ . -"
-    );
-  const status = context.flags.status;
-  if (status !== "applied" && status !== "reverted")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Pass --status applied or --status reverted."
-    );
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const ledger = await appliedMigrations(client, projectId);
-  const recorded = ledger.some(
-    (row) => row.name === key || row.name === withoutSuffix(key)
-  );
-  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
-  if (status === "applied" ? recorded : !recorded) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  await confirmOrAbort(
-    context,
-    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
-  );
-  if (status === "applied" && ledger.length === 0)
-    await client.db.query(projectId, { sql: LEDGER_DDL });
-  const answer = await client.db.query(projectId, {
-    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
-    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
-  });
-  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
-  if (!changed) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  context.output.result({ name: key, status, changed: true }, [
-    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
-  ]);
-}
-async function runMigrationUp(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
-  if (pending.length === 0) {
-    context.output.result({ projectId, applied: [], pending: [] }, [
-      "No pending migrations."
-    ]);
-    return;
-  }
-  if (context.flags.dryRun) {
-    const problems = policyProblems(dir, pending);
-    context.output.result({ projectId, dryRun: true, pending, problems }, [
-      `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable(name)}`),
-      ...problems.map(
-        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
-      )
-    ]);
-    if (problems.length > 0) process.exitCode = 1;
-    return;
-  }
-  context.output.log(`Pending migrations (${String(pending.length)}):`);
-  for (const name of pending) context.output.log(`  ${printable(name)}`);
-  await confirmOrAbort(
-    context,
-    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
-  );
-  const { applied, warnings } = await applyMigrationFiles(
-    context,
-    client,
-    projectId,
-    dir,
-    pending
-  );
-  context.output.result({ projectId, applied, pending: [], warnings }, [
-    `\u2705 Applied ${String(applied.length)} migration(s).`
-  ]);
-}
-
 // src/commands/filters.ts
 function filtersOf(flags, keys) {
   const filters = {};
@@ -1213,6 +849,86 @@ async function runToken(context) {
   );
 }
 
+// src/functions/sync-loop.ts
+var FUNCTIONS_SYNC_MAX_CALLS = 110;
+var FUNCTIONS_SYNC_STUCK_CALLS = 3;
+var FUNCTIONS_SYNC_BUSY_RETRIES = 3;
+var FUNCTIONS_SYNC_BUSY_WAIT_MS = 5e3;
+var FUNCTIONS_SYNC_RATE_RETRIES = 3;
+function functionCount(n) {
+  return n === 1 ? "1 function" : `${n.toLocaleString("en-US")} functions`;
+}
+function lastPerName(failures) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const failure2 of failures) {
+    byName.delete(failure2.name);
+    byName.set(failure2.name, failure2);
+  }
+  return [...byName.values()];
+}
+async function syncUntilDone(client, projectId, options = {}) {
+  const sleep2 = options.sleep ?? defaultSleep;
+  const synced = /* @__PURE__ */ new Set();
+  const removed = /* @__PURE__ */ new Set();
+  const state = {
+    complete: false,
+    synced: [],
+    removed: [],
+    pending: 0,
+    failures: [],
+    calls: 0
+  };
+  let busy = 0;
+  let limited = 0;
+  let stuck = 0;
+  let previous = null;
+  const body = options.registry ? { registry: true } : {};
+  while (state.calls < FUNCTIONS_SYNC_MAX_CALLS) {
+    state.calls += 1;
+    let answer;
+    try {
+      answer = await client.functions.sync(projectId, body);
+    } catch (error) {
+      if (isNaroError(error) && error.code === "FUNCTIONS_RATE_LIMITED" && limited < FUNCTIONS_SYNC_RATE_RETRIES) {
+        limited += 1;
+        const seconds = retryAfterSeconds(error);
+        options.log?.(
+          `\u23F3 Cloudflare is rate limiting function uploads; syncing again in ${String(seconds)} seconds.`
+        );
+        await sleep2(seconds * 1e3);
+        continue;
+      }
+      throw error;
+    }
+    const before = previous;
+    previous = answer.pending;
+    const progress = answer.synced.length > 0 || answer.removed.length > 0 || before !== null && answer.pending < before;
+    for (const name of answer.synced) synced.add(name);
+    for (const name of answer.removed) removed.add(name);
+    state.synced = [...synced];
+    state.removed = [...removed];
+    state.pending = answer.pending;
+    state.failures = lastPerName(answer.failures);
+    options.onCall?.({ ...state });
+    if (answer.pending === 0) {
+      state.complete = true;
+      return state;
+    }
+    if (progress) {
+      busy = 0;
+      limited = 0;
+      stuck = before !== null && answer.pending >= before ? stuck + 1 : 0;
+      if (stuck >= FUNCTIONS_SYNC_STUCK_CALLS) return state;
+      continue;
+    }
+    const onlyBusy = state.failures.length > 0 && state.failures.every((failure2) => failure2.code === "FUNCTION_BUSY");
+    if (!onlyBusy || busy >= FUNCTIONS_SYNC_BUSY_RETRIES) return state;
+    busy += 1;
+    await sleep2(FUNCTIONS_SYNC_BUSY_WAIT_MS);
+  }
+  return state;
+}
+
 // src/commands/backend.ts
 var SERVICE_KEY_WARNING = "\u26A0 The service key skips every policy. Keep it on a server (NARO_SERVICE_KEY) and never put it in browser code.";
 var ROTATE_USAGE = "Usage: naro backend keys rotate --anon | --service";
@@ -1413,6 +1129,57 @@ function rotationWarning(kind, backend, environment = null) {
     return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend${envFlag(environment)}\`.`;
   return null;
 }
+var FUNCTIONS_ROTATE_NOTE = (kind) => `Functions pick up the new key within a few minutes; until then their calls with the old ${kind} key fail.`;
+async function liveFunctionCount(client, projectId) {
+  try {
+    const { functions } = await client.functions.list(projectId);
+    return functions.filter(
+      (fn) => fn.version !== null && fn.status !== "deleting"
+    ).length;
+  } catch {
+    return 0;
+  }
+}
+async function syncAfterRotation(context, client, projectId, kind, live2) {
+  context.output.warn(
+    `\u23F3 Replaced the ${kind} key; syncing ${functionCount(live2)}\u2026`
+  );
+  try {
+    const sync = await syncUntilDone(client, projectId, {
+      log: (line) => context.output.warn(line),
+      onCall: (progress) => {
+        context.output.warn(
+          `\u23F3 Syncing functions\u2026 ${String(Math.min(progress.synced.length, live2))}/${String(live2)}`
+        );
+      }
+    });
+    if (!sync.complete)
+      context.output.warn(
+        `\u26A0 The ${kind} key is replaced, but ${functionCount(sync.pending)} still ${sync.pending === 1 ? "uses" : "use"} the old one. Run \`naro functions secrets sync\` to finish (the sweep also brings them up within minutes).`
+      );
+    return {
+      complete: sync.complete,
+      synced: sync.synced,
+      pending: sync.pending
+    };
+  } catch (error) {
+    const message = printable(
+      isNaroError(error) ? error.message : String(error)
+    );
+    context.output.warn(
+      `\u26A0 The ${kind} key is replaced, but the functions could not be synced now: ${message} The sweep brings them up within minutes.`
+    );
+    return {
+      complete: false,
+      synced: [],
+      pending: live2,
+      error: {
+        code: isNaroError(error) ? error.code : "INTERNAL_ERROR",
+        message
+      }
+    };
+  }
+}
 function checkKeysSentence(kind, environment = null) {
   const keys = kind === "service" ? "naro backend keys --reveal" : "naro backend keys";
   return `Run \`${keys}${envFlag(environment)}\` to see which key is live, then \`${enableBackendCommand(environment)}\`.`;
@@ -1425,13 +1192,14 @@ function outcomeUnknown(error) {
 }
 async function runBackendKeysRotate(context) {
   const kind = rotateKind(context);
-  await confirmOrAbort(
-    context,
-    `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.`
-  );
   const client = await dataClient(context);
   const environment = dataEnvironment(context.flags);
   const projectId = await context.resolveProjectId();
+  const functions = environment === null ? await liveFunctionCount(client, projectId) : 0;
+  await confirmOrAbort(
+    context,
+    `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.${functions > 0 ? ` ${FUNCTIONS_ROTATE_NOTE(kind)}` : ""}`
+  );
   let rotated;
   try {
     rotated = await client.backend.rotateKey(projectId, kind);
@@ -1454,20 +1222,48 @@ async function runBackendKeysRotate(context) {
   }
   const { backend, key } = rotated;
   const warning = rotationWarning(kind, backend, environment);
+  const synced = functions > 0 && !context.flags.noSync ? await syncAfterRotation(context, client, projectId, kind, functions) : null;
   if (kind === "service") context.output.warn(SERVICE_KEY_WARNING);
   if (warning) context.output.warn(warning);
   context.output.result(
-    { projectId, kind, key, backend, ...warning ? { warning } : {} },
+    {
+      projectId,
+      kind,
+      key,
+      backend,
+      ...warning ? { warning } : {},
+      ...synced ? { functions: synced } : {}
+    },
     [
       `\u2705 Replaced the ${kind} key. The old one no longer works.`,
       `${keyLabel(kind)}${key}`,
-      kind === "anon" ? "Put the new key in your app and redeploy." : "Update NARO_SERVICE_KEY wherever your servers read it."
+      kind === "anon" ? "Put the new key in your app and redeploy." : "Update NARO_SERVICE_KEY wherever your servers read it.",
+      ...synced?.complete ? [
+        `\u2705 Functions carry the new key: ${functionCount(synced.synced.length)} synced.`
+      ] : []
     ]
   );
 }
+async function runBackendSigningKeyRotate(context) {
+  const client = await dataClient(context);
+  const environment = dataEnvironment(context.flags);
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    "Replace the key that signs access tokens? New tokens are signed with the new key at once; tokens already issued keep working until they expire (up to 15 minutes). Nobody is signed out."
+  );
+  const rotated = await client.backend.rotateSigningKey(projectId);
+  context.output.result(
+    { projectId, ...rotated },
+    [
+      `\u2705 Replaced the signing key (kid ${rotated.kid}).`,
+      `Tokens signed with the old key work until ${rotated.previousKeysExpireAt}.`
+    ].map((line) => forEnvironment(line, environment))
+  );
+}
 
 // src/commands/backend-auth.ts
-var processStdin2 = {
+var processStdin = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1624,7 +1420,7 @@ async function change(context, send2, done, after) {
     )
   );
 }
-async function runBackendAuthEmailSet(context, input = processStdin2) {
+async function runBackendAuthEmailSet(context, input = processStdin) {
   const { provider, from } = context.flags;
   if (provider === void 0 || from === void 0)
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.email);
@@ -1670,7 +1466,7 @@ function providerOf(context, usage) {
     throw new NaroError("VALIDATION_FAILED", usage);
   return provider;
 }
-async function runBackendAuthOAuthSet(context, input = processStdin2) {
+async function runBackendAuthOAuthSet(context, input = processStdin) {
   const provider = providerOf(context, AUTH_USAGE.oauth);
   const clientId = context.flags.clientId;
   if (clientId === void 0)
@@ -1853,7 +1649,7 @@ var USERS_USAGE = {
 var PASSWORD_FLAG_WARNING = "\u26A0 --password puts the password in your shell history. Pipe it in with --password-stdin instead.";
 var OUTDATED_MESSAGE = "This project's backend is older than user management. Run `naro backend enable` once to update this project's backend. Then run this command again.";
 var PAGE_SIZE = 1e3;
-var processStdin3 = {
+var processStdin2 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1955,7 +1751,7 @@ function userLines(user) {
     `Created:     ${printable(user.createdAt)}`
   ];
 }
-async function runBackendUsersCreate(context, input = processStdin3) {
+async function runBackendUsersCreate(context, input = processStdin2) {
   const { username, email } = context.flags;
   if (username === void 0 && email === void 0 || context.positionals.length > 0)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
@@ -2033,9 +1829,9 @@ async function runCancel(context) {
 }
 
 // src/commands/db.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { resolve } from "path";
-var processStdin4 = {
+var processStdin3 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -2144,7 +1940,7 @@ async function readSql(context, deps) {
     sql = positional;
   } else if (context.flags.file !== void 0) {
     try {
-      sql = readFileSync2(resolve(context.cwd, context.flags.file), "utf8");
+      sql = readFileSync(resolve(context.cwd, context.flags.file), "utf8");
     } catch {
       throw new NaroError(
         "VALIDATION_FAILED",
@@ -2158,7 +1954,7 @@ async function readSql(context, deps) {
     throw new NaroError("VALIDATION_FAILED", USAGE);
   return sql;
 }
-async function runDbQuery(context, deps = processStdin4) {
+async function runDbQuery(context, deps = processStdin3) {
   const sql = await readSql(context, deps);
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
@@ -2177,13 +1973,13 @@ async function runDbQuery(context, deps = processStdin4) {
 // src/commands/db-backup.ts
 import {
   createWriteStream,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   renameSync,
   rmSync,
   statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "fs";
-import { basename, dirname, join as join2, resolve as resolve2 } from "path";
+import { basename, dirname, join, resolve as resolve2 } from "path";
 import { Transform } from "stream";
 import { pipeline } from "stream/promises";
 var defaults = {
@@ -2191,8 +1987,8 @@ var defaults = {
   stdout: process.stdout,
   sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
   writeFile: (path, data) => {
-    mkdirSync2(dirname(path), { recursive: true });
-    writeFileSync2(path, data, { flag: "wx" });
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, data, { flag: "wx" });
   }
 };
 function exportNotice(environment) {
@@ -2302,14 +2098,14 @@ function refuseDirectory(path, shown) {
 }
 function makeOutputDirectory(path, shown) {
   try {
-    mkdirSync2(dirname(path), { recursive: true });
+    mkdirSync(dirname(path), { recursive: true });
   } catch (error) {
     throw writeFailed(shown, error);
   }
 }
 async function downloadToFile(deps, url, path, shown, again) {
   const body = await openDownload(deps, url, again);
-  const partial = join2(
+  const partial = join(
     dirname(path),
     `.${basename(path)}.${String(process.pid)}.part`
   );
@@ -2477,7 +2273,7 @@ async function runDbPull(context, overrides = {}) {
       `${relativeToCwd(context, dir)} already has ${String(existing.length)} migration file(s). naro db pull only baselines a project without migrations; to see the current schema, run naro db dump --schema-only.`
     );
   const name = nextMigrationFileName(existing, "remote_schema");
-  const path = join2(dir, name);
+  const path = join(dir, name);
   const shown = relativeToCwd(context, path);
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
@@ -2559,12 +2355,12 @@ async function readPolicies(client, projectId, warn) {
     return void 0;
   }
   const policies = [];
-  const unreadable = [];
+  const unreadable2 = [];
   for (const row of objectsOf(stored)) {
     const policy = loadPolicy(row);
     if (policy === void 0) continue;
     if (policy.invalid !== null)
-      unreadable.push({
+      unreadable2.push({
         table: policy.table,
         name: policy.name,
         reason: policy.invalid
@@ -2585,7 +2381,7 @@ async function readPolicies(client, projectId, warn) {
   return {
     tables: tableNames(snapshot),
     policies,
-    unreadable,
+    unreadable: unreadable2,
     snapshot,
     indexes: indexesFromRows(objectsOf(indexes))
   };
@@ -2662,8 +2458,8 @@ async function runDbLint(context) {
 }
 
 // src/commands/db-reset.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
 var MAX_STATEMENTS = 50;
 var SCHEMA_FILTER = `${systemTablePredicate("name")} AND ${systemTablePredicate("tbl_name")}`;
 var SCHEMA_SQL2 = [
@@ -2845,7 +2641,7 @@ async function runDbReset(context) {
 ${problemLines.join("\n")}`,
       { details: { problems } }
     );
-  const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
+  const texts = files.map((name) => readFileSync2(join2(dir, name), "utf8"));
   const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
@@ -2985,11 +2781,11 @@ ${problemLines.join("\n")}`,
 }
 
 // src/commands/db-schema.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { resolve as resolve3 } from "path";
 
 // ../../packages/naro-sdk/src/query/filters.ts
@@ -3407,7 +3203,7 @@ function conditionsFrom(flags) {
 function patchFromFile(context, path, table3) {
   let text;
   try {
-    text = readFileSync4(resolve3(context.cwd, path), "utf8");
+    text = readFileSync3(resolve3(context.cwd, path), "utf8");
   } catch {
     refuse2(`Could not read ${path}.`);
   }
@@ -3569,12 +3365,12 @@ function conditionText(action, value) {
   if (isInvalid(value))
     return `cannot be read (${value.invalid}); it denies everyone but the service key`;
   const using = value.using ? filterText(value.using) : "";
-  const check = value.check ? filterText(value.check) : "";
-  if (using === void 0 || check === void 0)
+  const check2 = value.check ? filterText(value.check) : "";
+  if (using === void 0 || check2 === void 0)
     return `as JSON ${JSON.stringify(value)}`;
   const parts = [];
   if (using !== "") parts.push(`using ${using}`);
-  if (check !== "") parts.push(`check ${check}`);
+  if (check2 !== "") parts.push(`check ${check2}`);
   else if (action === "update") parts.push("check = using");
   const text = parts.join("; ");
   return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
@@ -3684,7 +3480,7 @@ function statementText(context) {
   let text = positional;
   if (file !== void 0) {
     try {
-      text = readFileSync4(resolve3(context.cwd, file), "utf8");
+      text = readFileSync3(resolve3(context.cwd, file), "utf8");
     } catch {
       refuse2(`Could not read ${file}.`);
     }
@@ -4041,13 +3837,13 @@ async function runSchemaChange(context, operations, question) {
   let file = null;
   let fileWarning;
   const relDir = relativeToCwd(context, dir);
-  const rel = join4(relDir === "." ? "" : relDir, name);
+  const rel = join3(relDir === "." ? "" : relDir, name);
   if (context.flags.noWrite) {
     fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
   } else {
     try {
-      mkdirSync3(dir, { recursive: true });
-      writeFileSync3(join4(dir, name), result.sql, { flag: "wx" });
+      mkdirSync2(dir, { recursive: true });
+      writeFileSync2(join3(dir, name), result.sql, { flag: "wx" });
       file = rel;
     } catch (error) {
       const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
@@ -4176,7 +3972,7 @@ async function runDbIndexDrop(context) {
 var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+  sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -4707,7 +4503,7 @@ async function runInspect(context) {
 
 // src/commands/domains.ts
 var defaults3 = {
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+  sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms)),
   now: () => Date.now()
 };
 var FIRST_DELAY_MS = 5e3;
@@ -4925,7 +4721,7 @@ async function runDomainsVerify(context, overrides = {}) {
     ]);
     return;
   }
-  let timedOut = false;
+  let timedOut2 = false;
   let abandoned = false;
   if (wait && !domains.every(isReady)) {
     const deadline = deps.now() + WAIT_TIMEOUT_MS;
@@ -4938,7 +4734,7 @@ async function runDomainsVerify(context, overrides = {}) {
       }
       const remaining = deadline - deps.now();
       if (remaining <= 0) {
-        timedOut = true;
+        timedOut2 = true;
         break;
       }
       for (const domain of pending)
@@ -4958,7 +4754,7 @@ async function runDomainsVerify(context, overrides = {}) {
     const notReady = domains.filter((domain) => !isReady(domain));
     const names = notReady.map((domain) => domain.hostname).join(", ");
     const details = { projectId, domains, ready: false };
-    if (timedOut) {
+    if (timedOut2) {
       const cause2 = notReady[0]?.cause;
       throw new NaroError(
         "TIMEOUT",
@@ -5005,7 +4801,7 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { chmodSync, existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, existsSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4 } from "path";
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var KEY_MAX_LENGTH = 256;
@@ -5120,7 +4916,7 @@ async function runEnvImport(context) {
   const target = parseTarget(targetArg);
   let text;
   try {
-    text = readFileSync5(resolve4(context.cwd, file), "utf8");
+    text = readFileSync4(resolve4(context.cwd, file), "utf8");
   } catch {
     throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
   }
@@ -5211,7 +5007,7 @@ ${serializeDotenv(vars)}`;
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
   }
-  writeFileSync4(path, text, { mode: 384 });
+  writeFileSync3(path, text, { mode: 384 });
   chmodSync(path, 384);
   context.output.result({ projectId, file, environment: surface, count: count2 }, [
     `\u2705 Pulled ${String(count2)} variable(s) into ${file}`
@@ -5370,131 +5166,100 @@ async function runEnvironmentsProvision(context) {
   ]);
 }
 
-// src/commands/gen.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname2, resolve as resolve5 } from "path";
-var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
-async function runGenTypes(context) {
-  const { lang } = context.flags;
-  if (lang !== void 0 && lang !== "typescript")
-    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const tables = await client.db.tables(projectId);
-  const read = await policiesForTypes(client, projectId);
-  const types = generateTypes(
-    tables,
-    read.policies === void 0 ? {} : { policies: read.policies }
-  );
-  const undescribed = tables.flatMap(
-    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
-  );
-  for (const { name, error } of undescribed)
-    context.output.warn(
-      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
-    );
-  if (read.policies === void 0)
-    context.output.warn(
-      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
-    );
-  const extra = {
-    ...undescribed.length > 0 ? { undescribed } : {},
-    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
-  };
-  if (context.flags.output) {
-    const path = resolve5(context.cwd, context.flags.output);
-    mkdirSync4(dirname2(path), { recursive: true });
-    writeFileSync5(path, types);
-    context.output.result(
-      {
-        projectId,
-        output: context.flags.output,
-        tables: tables.length,
-        ...extra
-      },
-      [
-        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
-      ]
-    );
-    return;
+// src/commands/functions.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// src/functions/scaffold.ts
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname2, join as join4, relative, resolve as resolve5, sep } from "path";
+var NARO_JS_FUNCTIONS_MISSING = 'Cannot find "naro-js/functions". Install naro-js 0.7.0 or later: npm install naro-js@latest.';
+function scaffoldSource(name) {
+  return `import { withNaro } from "naro-js/functions";
+
+// Called at https://<your-app>.naro.sh/_naro/v1/functions/${name}.
+// \`naro\` acts as the caller, so the tables' row-level security applies;
+// \`naroAdmin\` uses the service key.
+Deno.serve(
+  withNaro(async (req, { user }) => {
+    const { name } = await req.json().catch(() => ({ name: "world" }));
+    return Response.json({ message: \`Hello \${name}!\`, user: user?.id ?? null });
+  }),
+);
+`;
+}
+function naroJsInstalled(root) {
+  for (let dir = resolve5(root); ; dir = dirname2(dir)) {
+    if (existsSync2(join4(dir, "node_modules", "naro-js", "package.json")))
+      return true;
+    if (dirname2(dir) === dir) return false;
   }
-  context.output.result({ projectId, types, ...extra }, [
-    types.replace(/\n$/, "")
-  ]);
 }
-
-// src/commands/insights.ts
-function queryOf2(flags) {
-  const filters = filtersOf(flags, SPEED_INSIGHTS_FILTER_KEYS);
-  return {
-    ...flags.range !== void 0 ? { range: flags.range } : {},
-    ...flags.metric !== void 0 ? { metric: flags.metric } : {},
-    ...flags.env !== void 0 ? { environment: flags.env } : {},
-    ...Object.keys(filters).length > 0 ? { filters } : {}
-  };
+function naroJsFunctionsResolves(root) {
+  if (!naroJsInstalled(root)) return false;
+  try {
+    createRequire(join4(root, "package.json")).resolve("naro-js/functions");
+    return true;
+  } catch {
+    return false;
+  }
 }
-async function runInsights(context) {
-  if (context.flags.referrer !== void 0 && context.flags.referrer !== "")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Speed Insights has no referrer; drop --referrer."
-    );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const query = queryOf2(context.flags);
-  const filters = query.filters ?? {};
-  if (context.flags.route !== void 0) {
-    const result = await client.insights.paths(projectId, {
-      ...query,
-      route: context.flags.route
-    });
-    context.output.result(
-      { projectId, ...result },
-      routePathsLines(result, filters)
-    );
-    return;
+var COVERS = /^(\.\/)?(\*|\*\*|naro)(\/|$)|^\.\/?$/;
+var LEAVES_OUT = /^(\.\/)?naro(\/functions)?\/?(\*\*)?$/;
+function tsconfigCovers(root, functionsLabel) {
+  const file = join4(root, "tsconfig.json");
+  if (!existsSync2(file)) return false;
+  let config;
+  try {
+    config = parseJsonc(readFileSync5(file, "utf8"));
+  } catch {
+    return false;
   }
-  const overview = await client.insights.overview(projectId, query);
-  if (overview.deploymentsError)
-    context.output.warn(
-      `Deployments are unavailable right now: ${printable(overview.deploymentsError.message)}`
-    );
-  context.output.result(
-    { projectId, ...overview },
-    reportLines(overview.report, overview.deployments, filters)
-  );
+  const include = Array.isArray(config.include) ? config.include.filter((p) => typeof p === "string") : null;
+  const exclude = Array.isArray(config.exclude) ? config.exclude.filter((p) => typeof p === "string") : [];
+  const covered = include === null || include.some((pattern) => COVERS.test(pattern));
+  const leftOut = exclude.some(
+    (pattern) => LEAVES_OUT.test(pattern) || pattern === functionsLabel
+  );
+  return covered && !leftOut;
+}
+function gitignoreCovers(root, envPath) {
+  const file = join4(root, ".gitignore");
+  if (!existsSync2(file)) return false;
+  const accepted = /* @__PURE__ */ new Set([
+    envPath,
+    `/${envPath}`,
+    ".env",
+    "/.env",
+    "**/.env",
+    ".env*",
+    "*.env"
+  ]);
+  return readFileSync5(file, "utf8").split(/\r?\n/).some((line) => accepted.has(line.trim()));
 }
-async function setInsights(context, enabled) {
-  if (context.flags.env !== void 0)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Speed Insights has one switch for production and preview; drop --env."
+function scaffoldNotes(folder) {
+  const notes = [];
+  if (!naroJsFunctionsResolves(folder.root))
+    notes.push(`\u26A0 ${NARO_JS_FUNCTIONS_MISSING}`);
+  const functionsLabel = relative(folder.root, folder.dir).split(sep).join("/");
+  if (!folder.explicit && tsconfigCovers(folder.root, functionsLabel))
+    notes.push(
+      `\u26A0 tsconfig.json type-checks naro/functions too. If your app's type check trips on the functions' Deno code, add "exclude": ["naro/functions"] to it.`
     );
-  const filter = givenFilterFlag(context.flags);
-  if (filter !== void 0)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Filters only narrow a report; drop --${filter}.`
+  const envPath = `${functionsLabel}/.env`;
+  if (!gitignoreCovers(folder.root, envPath))
+    notes.push(
+      `\u26A0 ${envPath} is not in .gitignore. Add it before you keep local secrets there.`
     );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const result = await client.insights.setEnabled(projectId, enabled);
-  context.output.result({ projectId, enabled: result.enabled }, [
-    result.enabled ? TURNED_ON : TURNED_OFF
-  ]);
-}
-function runInsightsEnable(context) {
-  return setInsights(context, true);
-}
-function runInsightsDisable(context) {
-  return setInsights(context, false);
+  return notes;
 }
 
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
 var FOLLOW_TIMEOUT_MS = 30 * 6e4;
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -5504,6 +5269,27 @@ function formatRuntimeLog(entry) {
   const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
   return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
 }
+var FOLLOW_JSON_REFUSAL = "--follow streams runtime logs until you stop it, so it has no JSON result. Drop --json to stream, or drop --follow for the current entries as JSON.";
+async function followRuntimeEntries(context, read, format, wait = sleep) {
+  let lastTs = -1;
+  let boundary = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const entries = await read();
+    for (const entry of entries) {
+      if (entry.ts < lastTs) continue;
+      const key = JSON.stringify(entry);
+      if (entry.ts === lastTs) {
+        if (boundary.has(key)) continue;
+      } else {
+        lastTs = entry.ts;
+        boundary = /* @__PURE__ */ new Set();
+      }
+      boundary.add(key);
+      context.output.log(format(entry));
+    }
+    await wait(FOLLOW_INTERVAL_MS);
+  }
+}
 async function latestDeploymentId(client, projectId) {
   const [latest] = await client.deployments.list(projectId);
   if (!latest)
@@ -5565,60 +5351,648 @@ async function runtimeLogs(context, client, projectId) {
   context.output.log(
     `Following ${environment} runtime logs (Ctrl-C to stop)...`
   );
-  let lastTs = -1;
-  let boundary = /* @__PURE__ */ new Set();
-  for (; ; ) {
-    const entries = await client.logs.runtime(projectId, options);
-    for (const entry of entries) {
-      if (entry.ts < lastTs) continue;
-      const key = JSON.stringify(entry);
-      if (entry.ts === lastTs) {
-        if (boundary.has(key)) continue;
-      } else {
-        lastTs = entry.ts;
-        boundary = /* @__PURE__ */ new Set();
+  await followRuntimeEntries(
+    context,
+    () => client.logs.runtime(projectId, options),
+    formatRuntimeLog
+  );
+}
+async function runLogs(context) {
+  const [deploymentId] = context.positionals;
+  const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
+  if (type !== "build" && type !== "runtime")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--type must be build or runtime."
+    );
+  if (type === "runtime" && context.flags.follow && context.flags.json)
+    throw new NaroError("VALIDATION_FAILED", FOLLOW_JSON_REFUSAL);
+  if (type === "build" && context.flags.env)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env is for runtime logs. Build logs belong to one deployment: pass its id (naro deployments lists them)."
+    );
+  const client = await context.client();
+  if (type === "runtime") {
+    if (deploymentId)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        "Runtime logs are per project, not per deployment. Drop the deployment id or use --type build."
+      );
+    const projectId = await context.resolveProjectId();
+    await runtimeLogs(context, client, projectId);
+    return;
+  }
+  let target = deploymentId;
+  if (target === void 0) {
+    target = await latestDeploymentId(client, await context.resolveProjectId());
+    context.output.log(`Build logs of the latest deployment, ${target}`);
+  }
+  await buildLogs(context, client, target);
+}
+
+// src/commands/functions.ts
+var FUNCTIONS_ENV_REFUSAL = "naro functions works on the production backend only. Drop --env.";
+var VERSIONS_USAGE = "Usage: naro functions versions <name>";
+var LOGS_USAGE = "Usage: naro functions logs <name> [--level <l>] [--follow]";
+function functionName(context, usage) {
+  const [name] = context.positionals;
+  if (name === void 0 || name === "")
+    throw new NaroError("VALIDATION_FAILED", usage);
+  return name;
+}
+function statusWord(fn) {
+  if (fn.status !== "error") return fn.status;
+  return `error at ${fn.step ?? "upload"}: ${printable(fn.error ?? "unknown error")}`;
+}
+var cpuHours = (ms) => (ms / 36e5).toLocaleString("en-US", { maximumFractionDigits: 1 });
+function functionLines(list) {
+  if (list.functions.length === 0)
+    return [
+      "No functions yet. Create one with naro functions new <name>, then naro functions deploy <name>."
+    ];
+  const width = Math.max(...list.functions.map((fn) => fn.name.length));
+  const versionWidth = Math.max(
+    ...list.functions.map(
+      (fn) => fn.version === null ? 1 : String(fn.version).length + 1
+    )
+  );
+  const lines = list.functions.map((fn) => {
+    const version2 = fn.version === null ? "\u2014" : `v${String(fn.version)}`;
+    const verify = fn.verifyJwt ? "verify on " : "verify off";
+    const stale = fn.stale ? "  (stale: naro functions secrets sync brings it up)" : "";
+    return `${fn.name.padEnd(width)}  ${version2.padEnd(versionWidth)}  ${verify}  ${statusWord(fn)}  ${fn.url}${stale}`;
+  });
+  lines.push(
+    `Up to ${list.limits.functions.toLocaleString("en-US")} functions per ${list.limits.functionsScope} on this plan.`
+  );
+  const usage = list.usage;
+  if (usage !== null) {
+    const percent2 = usage.cpuMsLimit > 0 ? Math.floor(usage.cpuMs / usage.cpuMsLimit * 100) : 0;
+    lines.push(
+      `Function CPU this month (UTC, the team's): ${cpuHours(usage.cpuMs)} of ${cpuHours(usage.cpuMsLimit)} CPU-hours (${String(percent2)}%).`
+    );
+    if (usage.blocked)
+      lines.push(
+        "\u26A0 This team has used its monthly function CPU time. Functions answer 429 FUNCTIONS_QUOTA_EXCEEDED until the 1st at 00:00 UTC."
+      );
+    else if (usage.cpuMs >= Math.ceil(usage.cpuMsLimit * 0.8))
+      lines.push(
+        `\u26A0 This team has used ${String(percent2)}% of its monthly function CPU time.`
+      );
+  }
+  return lines;
+}
+var kib = (bytes) => `${(bytes / 1024).toFixed(1)} KB`;
+function versionLines(detail) {
+  const statusWidth = Math.max(...detail.versions.map((v) => v.status.length));
+  return detail.versions.map(
+    (v) => `v${String(v.number)}  ${v.status.padEnd(statusWidth)}  ${v.active ? "live" : "    "}  ${kib(v.size)}  ${v.verifyJwt ? "verify on " : "verify off"}  ${v.createdAt}`
+  );
+}
+async function runFunctionsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const list = await client.functions.list(projectId);
+  context.output.result({ projectId, ...list }, functionLines(list));
+}
+async function runFunctionsVersions(context) {
+  const name = functionName(context, VERSIONS_USAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const detail = await client.functions.get(projectId, name);
+  context.output.result({ projectId, ...detail }, versionLines(detail));
+}
+async function runFunctionsLogs(context) {
+  if (context.flags.follow && context.flags.json)
+    throw new NaroError("VALIDATION_FAILED", FOLLOW_JSON_REFUSAL);
+  const name = functionName(context, LOGS_USAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const options = context.flags.level ? { level: context.flags.level } : {};
+  const format = (entry) => printable(formatRuntimeLog(entry));
+  if (!context.flags.follow) {
+    const entries = await client.functions.logs(projectId, name, options);
+    context.output.result(
+      { projectId, name, entries },
+      entries.length > 0 ? entries.map(format) : [`(no logs from ${name} yet)`]
+    );
+    return;
+  }
+  context.output.log(`Following ${name}'s logs (Ctrl-C to stop)...`);
+  await followRuntimeEntries(
+    context,
+    () => client.functions.logs(projectId, name, options),
+    format
+  );
+}
+var NEW_USAGE = "Usage: naro functions new <name>";
+var ROLLBACK_USAGE = "Usage: naro functions rollback <name> [<version>]";
+var DELETE_USAGE2 = "Usage: naro functions delete <name>";
+async function runFunctionsNew(context) {
+  const name = functionName(context, NEW_USAGE);
+  if (!isFunctionName(name))
+    throw new NaroError("VALIDATION_FAILED", BUNDLE_MESSAGES.badName(name));
+  const folder = functionsFolder({
+    cwd: context.cwd,
+    root: context.flags.root,
+    dir: context.flags.dir
+  });
+  const target = join5(folder.dir, name);
+  mkdirSync3(folder.dir, { recursive: true });
+  try {
+    mkdirSync3(target);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${folder.label}/${name} already exists.`
+    );
+  }
+  writeFileSync4(join5(target, "index.ts"), scaffoldSource(name));
+  const file = `${folder.label}/${name}/index.ts`;
+  const notes = scaffoldNotes(folder);
+  context.output.result({ file, notes }, [
+    `\u2705 Created ${file}. Deploy it with naro functions deploy ${name}.`,
+    ...notes
+  ]);
+}
+async function runFunctionsDeploy(context) {
+  assertFunctionsNode();
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { deployed } = await deployFunctions({
+    client,
+    projectId,
+    cwd: context.cwd,
+    root: context.flags.root,
+    dir: context.flags.dir,
+    names: context.positionals,
+    verifyJwt: context.flags.noVerifyJwt ? false : void 0,
+    importMap: context.flags.importMap,
+    skipCheck: context.flags.skipCheck,
+    cliVersion: version(),
+    log: (line) => context.output.log(line)
+  });
+  context.output.result({ projectId, functions: deployed });
+}
+async function runFunctionsRollback(context) {
+  const name = functionName(context, ROLLBACK_USAGE);
+  const written = context.positionals[1];
+  if (written !== void 0 && !/^[1-9]\d*$/.test(written))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "The version must be a whole number from 1, like 3."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const io = {
+    sleep: defaultSleep,
+    log: (line) => context.output.log(line)
+  };
+  const live2 = await withFunctionRetries(
+    () => client.functions.rollback(
+      projectId,
+      name,
+      written === void 0 ? void 0 : Number(written)
+    ),
+    name,
+    io
+  );
+  context.output.result({ projectId, function: live2 }, [
+    `\u2705 Rolled ${name} back to v${String(live2.version)} \u2014 ${live2.url}`
+  ]);
+}
+async function runFunctionsDelete(context) {
+  const name = functionName(context, DELETE_USAGE2);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const detail = await client.functions.get(projectId, name);
+  const stored = detail.versions.filter((v) => v.status !== "pruned").length;
+  await confirmOrAbort(
+    context,
+    stored === 1 ? `Delete function ${name}? Its URL stops working and its 1 stored version is removed.` : `Delete function ${name}? Its URL stops working and its ${String(stored)} stored versions are removed.`
+  );
+  const io = {
+    sleep: defaultSleep,
+    log: (line) => context.output.log(line)
+  };
+  await withFunctionRetries(
+    () => client.functions.remove(projectId, name),
+    name,
+    io
+  );
+  context.output.result({ projectId, name, deleted: true }, [
+    `\u2705 Deleted ${name}. Its URL stops working within seconds.`
+  ]);
+}
+
+// src/commands/functions-secrets.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve6 } from "path";
+var SET_USAGE3 = "Usage: naro functions secrets set <NAME>";
+var IMPORT_USAGE = "Usage: naro functions secrets import <file>";
+var UNSET_USAGE = "Usage: naro functions secrets unset <NAME>\u2026";
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var NAME_MAX = 256;
+var VALUE_MAX_BYTES2 = 5120;
+var RESERVED = /* @__PURE__ */ new Set(["ASSETS", "DB"]);
+var PROTO_LINE = /^\s*(?:export\s+)?__proto__(?:\s*=|:\s)/m;
+function secretNameProblem(name) {
+  if (!NAME.test(name) || name.length > NAME_MAX)
+    return "Secret names must look like NAME: letters, digits and _, not starting with a digit.";
+  if (name === "__proto__") return "__proto__ cannot be a secret name.";
+  if (name.startsWith("NARO_") || RESERVED.has(name))
+    return `${name} is reserved for Naro. Secret names cannot start with NARO_ or be ASSETS or DB.`;
+  return null;
+}
+function secretValueProblem(name, value) {
+  const bytes = Buffer.byteLength(value, "utf8");
+  return bytes > VALUE_MAX_BYTES2 ? `The value of ${name} is ${bytes.toLocaleString("en-US")} bytes; secrets must be 5,120 bytes or less.` : null;
+}
+function check(problem) {
+  if (problem !== null) throw new NaroError("VALIDATION_FAILED", problem);
+}
+var plural = (n, one, many) => n === 1 ? one : many;
+function byteCount(value) {
+  const n = Buffer.byteLength(value, "utf8");
+  return `${n.toLocaleString("en-US")} ${plural(n, "byte", "bytes")}`;
+}
+function warnFailures(context, sync) {
+  for (const failure2 of sync.failures)
+    context.output.warn(
+      `  ${printable(failure2.name)}: ${printable(failure2.message)}`
+    );
+}
+var nameList = (list) => list.map(printable).join(", ");
+async function applyChange(context, client, projectId, pending) {
+  if (pending === 0)
+    return { lines: ["No live functions to update."], sync: null };
+  if (context.flags.noSync)
+    return {
+      lines: [
+        pending === null ? "The functions carry the change once synced: the sweep does it within minutes, or run naro functions secrets sync." : (
+          // The save counted before the control plane's own hook brought
+          // some up: "up to", not how many are left.
+          `Up to ${functionCount(pending)} still ${plural(pending, "runs", "run")} the old values: the sweep syncs them within minutes, or run naro functions secrets sync.`
+        )
+      ],
+      sync: null
+    };
+  if (pending === null)
+    context.output.log(
+      "\u26A0 Naro could not count the functions to update; syncing until none is left."
+    );
+  const total = pending;
+  let last = null;
+  let sync;
+  try {
+    sync = await syncUntilDone(client, projectId, {
+      log: (line) => context.output.log(line),
+      onCall: (progress) => {
+        last = progress;
+        if (total !== null)
+          context.output.log(
+            `\u23F3 Applying secrets to ${functionCount(total)}\u2026 ${String(Math.min(progress.synced.length, total))}/${String(total)}`
+          );
       }
-      boundary.add(key);
-      context.output.log(formatRuntimeLog(entry));
-    }
-    await sleep(FOLLOW_INTERVAL_MS);
+    });
+  } catch (error) {
+    if (last !== null) warnFailures(context, last);
+    const cause = toNaroError(error);
+    const retryAfter = cause.details?.retryAfter;
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `Secrets are saved, but the sync stopped: ${printable(cause.message)} Run \`naro functions secrets sync\` to finish.`,
+      {
+        details: {
+          saved: true,
+          cause: {
+            code: cause.code,
+            message: cause.message,
+            ...typeof retryAfter === "number" ? { retryAfter } : {}
+          },
+          pending
+        },
+        cause: error
+      }
+    );
+  }
+  if (!sync.complete) {
+    warnFailures(context, sync);
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `Secrets are saved, but ${functionCount(sync.pending)} still ${plural(sync.pending, "runs", "run")} the old values. Run \`naro functions secrets sync\` to finish.`,
+      {
+        details: {
+          saved: true,
+          pending: sync.pending,
+          failures: sync.failures,
+          synced: sync.synced
+        }
+      }
+    );
+  }
+  const live2 = Math.max(total ?? 0, sync.synced.length);
+  return {
+    lines: [
+      live2 === 0 ? "\u2705 All functions are up to date." : `\u2705 Secrets are live on all ${functionCount(live2)}.`
+    ],
+    sync
+  };
+}
+async function readyToChange(context) {
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  await client.functions.list(projectId);
+  return { client, projectId };
+}
+async function runFunctionsSecretsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const secrets = await client.functions.secrets(projectId);
+  const width = Math.max(0, ...secrets.map((s) => s.name.length));
+  context.output.result(
+    { projectId, secrets },
+    secrets.length === 0 ? ["No function secrets. Set one with naro functions secrets set <NAME>."] : secrets.map(
+      (s) => `${s.name.padEnd(width)}  ${s.digest}  ${s.updatedAt}`
+    )
+  );
+}
+async function runFunctionsSecretsSet(context) {
+  const [name] = context.positionals;
+  if (name === void 0) throw new NaroError("VALIDATION_FAILED", SET_USAGE3);
+  if (context.positionals.length > 1 || name.includes("="))
+    throw new NaroError("VALIDATION_FAILED", SECRETS_ARGV_REFUSAL);
+  check(secretNameProblem(name));
+  const typed = process.stdin.isTTY === true;
+  let value;
+  let client = null;
+  let projectId = null;
+  if (typed) {
+    projectId = await context.resolveProjectId();
+    client = await context.client();
+    await client.functions.list(projectId);
+    value = await context.prompter.askHidden(`? What's the value of ${name}? `);
+  } else {
+    value = await readStdin();
+  }
+  if (value.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No value provided for ${name}.`);
+  check(secretValueProblem(name, value));
+  projectId ??= await context.resolveProjectId();
+  client ??= await context.client();
+  const saved = await client.functions.setSecrets(projectId, {
+    set: { [name]: value }
+  });
+  context.output.log(`\u2705 Saved ${name}.`);
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsImport(context) {
+  const [file] = context.positionals;
+  if (file === void 0)
+    throw new NaroError("VALIDATION_FAILED", IMPORT_USAGE);
+  let text;
+  try {
+    text = readFileSync6(resolve6(context.cwd, file), "utf8");
+  } catch {
+    throw new NaroError("VALIDATION_FAILED", `Cannot read ${file}.`);
+  }
+  const parsed = parseDotenvDetailed(text);
+  const [unclosed] = parsed.unclosedQuotes;
+  if (unclosed !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Unclosed quote in ${file} at line ${String(unclosed)}.`
+    );
+  if (PROTO_LINE.test(text)) check(secretNameProblem("__proto__"));
+  const entries = Object.entries(parsed.vars);
+  if (entries.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No secrets found in ${file}.`);
+  const invalid = entries.map(([name]) => name).filter((name) => !NAME.test(name) || name.length > NAME_MAX);
+  if (invalid.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Invalid keys in ${file}: ${invalid.map(printable).join(", ")}.`
+    );
+  for (const [name, value] of entries) {
+    check(secretNameProblem(name));
+    check(secretValueProblem(name, value));
+  }
+  const { client, projectId } = await readyToChange(context);
+  context.output.log(`Secrets in ${file}:`);
+  for (const [name, value] of entries)
+    context.output.log(
+      `  ${name.padEnd(32)} ${value === "" ? "(empty)" : `\u2022\u2022\u2022\u2022\u2022\u2022 (${byteCount(value)})`}`
+    );
+  await confirmOrAbort(
+    context,
+    `Set ${String(entries.length)} function ${plural(entries.length, "secret", "secrets")} for all of this project's functions?`
+  );
+  const saved = await client.functions.setSecrets(projectId, {
+    set: Object.fromEntries(entries)
+  });
+  context.output.log(
+    `\u2705 Saved ${String(entries.length)} ${plural(entries.length, "secret", "secrets")}.`
+  );
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsUnset(context) {
+  const names = context.positionals;
+  if (names.length === 0) throw new NaroError("VALIDATION_FAILED", UNSET_USAGE);
+  for (const name of names) check(secretNameProblem(name));
+  const { client, projectId } = await readyToChange(context);
+  await confirmOrAbort(
+    context,
+    `Unset ${names.join(", ")} from all of this project's functions? Functions that read them get undefined once they are synced.`
+  );
+  const saved = await client.functions.setSecrets(projectId, {
+    unset: [...names]
+  });
+  context.output.log(
+    `\u2705 Unset ${String(names.length)} ${plural(names.length, "secret", "secrets")}.`
+  );
+  const { lines, sync } = await applyChange(
+    context,
+    client,
+    projectId,
+    saved.pending
+  );
+  context.output.result(
+    { projectId, secrets: saved.secrets, pending: saved.pending, sync },
+    lines
+  );
+}
+async function runFunctionsSecretsSync(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const registry = context.flags.registry === true;
+  const sync = await syncUntilDone(client, projectId, {
+    registry,
+    log: (line) => context.output.log(line)
+  });
+  if (!sync.complete) {
+    warnFailures(context, sync);
+    throw new NaroError(
+      "FUNCTIONS_SYNC_INCOMPLETE",
+      `The sync stopped with ${sync.pending.toLocaleString("en-US")} left to do. Run \`naro functions secrets sync${registry ? " --registry" : ""}\` again.`,
+      {
+        details: {
+          pending: sync.pending,
+          failures: sync.failures,
+          synced: sync.synced,
+          removed: sync.removed
+        }
+      }
+    );
+  }
+  const lines = [];
+  if (sync.synced.length > 0)
+    lines.push(
+      `Synced ${functionCount(sync.synced.length)}: ${nameList(sync.synced)}`
+    );
+  if (sync.removed.length > 0)
+    lines.push(`Removed from the function list: ${nameList(sync.removed)}`);
+  lines.push("\u2705 All functions are up to date.");
+  context.output.result({ projectId, ...sync }, lines);
+}
+
+// src/commands/gen.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname3, resolve as resolve7 } from "path";
+var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
+async function runGenTypes(context) {
+  const { lang } = context.flags;
+  if (lang !== void 0 && lang !== "typescript")
+    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const tables = await client.db.tables(projectId);
+  const read = await policiesForTypes(client, projectId);
+  const types = generateTypes(
+    tables,
+    read.policies === void 0 ? {} : { policies: read.policies }
+  );
+  const undescribed = tables.flatMap(
+    (table3) => table3.error === void 0 ? [] : [{ name: table3.name, error: table3.error }]
+  );
+  for (const { name, error } of undescribed)
+    context.output.warn(
+      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
+    );
+  if (read.policies === void 0)
+    context.output.warn(
+      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
+    );
+  const extra = {
+    ...undescribed.length > 0 ? { undescribed } : {},
+    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
+  };
+  if (context.flags.output) {
+    const path = resolve7(context.cwd, context.flags.output);
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync5(path, types);
+    context.output.result(
+      {
+        projectId,
+        output: context.flags.output,
+        tables: tables.length,
+        ...extra
+      },
+      [
+        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
+      ]
+    );
+    return;
+  }
+  context.output.result({ projectId, types, ...extra }, [
+    types.replace(/\n$/, "")
+  ]);
+}
+
+// src/commands/insights.ts
+function queryOf2(flags) {
+  const filters = filtersOf(flags, SPEED_INSIGHTS_FILTER_KEYS);
+  return {
+    ...flags.range !== void 0 ? { range: flags.range } : {},
+    ...flags.metric !== void 0 ? { metric: flags.metric } : {},
+    ...flags.env !== void 0 ? { environment: flags.env } : {},
+    ...Object.keys(filters).length > 0 ? { filters } : {}
+  };
+}
+async function runInsights(context) {
+  if (context.flags.referrer !== void 0 && context.flags.referrer !== "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Speed Insights has no referrer; drop --referrer."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const query = queryOf2(context.flags);
+  const filters = query.filters ?? {};
+  if (context.flags.route !== void 0) {
+    const result = await client.insights.paths(projectId, {
+      ...query,
+      route: context.flags.route
+    });
+    context.output.result(
+      { projectId, ...result },
+      routePathsLines(result, filters)
+    );
+    return;
   }
-}
-async function runLogs(context) {
-  const [deploymentId] = context.positionals;
-  const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
-  if (type !== "build" && type !== "runtime")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--type must be build or runtime."
+  const overview = await client.insights.overview(projectId, query);
+  if (overview.deploymentsError)
+    context.output.warn(
+      `Deployments are unavailable right now: ${printable(overview.deploymentsError.message)}`
     );
-  if (type === "runtime" && context.flags.follow && context.flags.json)
+  context.output.result(
+    { projectId, ...overview },
+    reportLines(overview.report, overview.deployments, filters)
+  );
+}
+async function setInsights(context, enabled) {
+  if (context.flags.env !== void 0)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "--follow streams runtime logs until you stop it, so it has no JSON result. Drop --json to stream, or drop --follow for the current entries as JSON."
+      "Speed Insights has one switch for production and preview; drop --env."
     );
-  if (type === "build" && context.flags.env)
+  const filter = givenFilterFlag(context.flags);
+  if (filter !== void 0)
     throw new NaroError(
       "VALIDATION_FAILED",
-      "--env is for runtime logs. Build logs belong to one deployment: pass its id (naro deployments lists them)."
+      `Filters only narrow a report; drop --${filter}.`
     );
   const client = await context.client();
-  if (type === "runtime") {
-    if (deploymentId)
-      throw new NaroError(
-        "VALIDATION_FAILED",
-        "Runtime logs are per project, not per deployment. Drop the deployment id or use --type build."
-      );
-    const projectId = await context.resolveProjectId();
-    await runtimeLogs(context, client, projectId);
-    return;
-  }
-  let target = deploymentId;
-  if (target === void 0) {
-    target = await latestDeploymentId(client, await context.resolveProjectId());
-    context.output.log(`Build logs of the latest deployment, ${target}`);
-  }
-  await buildLogs(context, client, target);
+  const projectId = await context.resolveProjectId();
+  const result = await client.insights.setEnabled(projectId, enabled);
+  context.output.result({ projectId, enabled: result.enabled }, [
+    result.enabled ? TURNED_ON : TURNED_OFF
+  ]);
+}
+function runInsightsEnable(context) {
+  return setInsights(context, true);
+}
+function runInsightsDisable(context) {
+  return setInsights(context, false);
 }
 
 // src/commands/projects.ts
@@ -5669,7 +6043,7 @@ async function runProjectInspect(context) {
 
 // src/commands/promote.ts
 var PROMOTE_USAGE = "Usage: naro promote <deployment-id> [--to <environment>]";
-var ROLLBACK_USAGE = "Usage: naro rollback [deployment-id]";
+var ROLLBACK_USAGE2 = "Usage: naro rollback [deployment-id]";
 var REBUILD_TIMEOUT_MS = 15 * 6e4;
 var REUPLOAD_TIMEOUT_MS = 5 * 6e4;
 async function promoteAndWait(context, client, project, sourceDeploymentId, action, target) {
@@ -5733,9 +6107,9 @@ function refuseWhatIsNotRead(context, usage, envMessage) {
     throw new NaroError("VALIDATION_FAILED", envMessage);
 }
 async function previewPromotion(context, client, projectId, sourceDeploymentId, target) {
-  let check;
+  let check2;
   try {
-    check = await client.deployments.promoteCheck(
+    check2 = await client.deployments.promoteCheck(
       projectId,
       sourceDeploymentId,
       target
@@ -5747,9 +6121,9 @@ async function previewPromotion(context, client, projectId, sourceDeploymentId,
     return;
   }
   context.output.log(
-    check.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
+    check2.mode === "rebuild" ? `\u25B8 rebuild: builds the same commit again with ${target ?? "production"}'s variables` : "\u25B8 reupload: publishes the stored build"
   );
-  for (const warning of check.warnings)
+  for (const warning of check2.warnings)
     for (const line of warningLines(warning)) context.output.log(line);
 }
 async function runPromote(context) {
@@ -5791,7 +6165,7 @@ async function runRollback(context) {
     );
   refuseWhatIsNotRead(
     context,
-    ROLLBACK_USAGE,
+    ROLLBACK_USAGE2,
     "--env is not an option of naro rollback: naro rollback always rolls production back."
   );
   const client = await context.client();
@@ -5877,6 +6251,21 @@ function tableName(table3) {
 function linesFor(lines, environment) {
   return lines.map((line) => forEnvironment(line, environment));
 }
+function usageLines2(usage) {
+  if (usage === null) return ["This month (UTC): not metered yet"];
+  const lines = [
+    `This month (UTC, all environments): ${number(usage.messages)} messages \xB7 est. $${usage.estCostUsd.toFixed(2)}`
+  ];
+  if (usage.blocked)
+    lines.push(
+      "\u26A0 This project has used its realtime messages for this month. Realtime resumes on the 1st at 00:00 UTC."
+    );
+  else if (usage.messageLimit !== null && usage.messages >= Math.ceil(usage.messageLimit * 0.8))
+    lines.push(
+      `\u26A0 This project has used ${String(Math.floor(usage.messages * 100 / usage.messageLimit))}% of its monthly realtime message limit (${number(usage.messageLimit)}).`
+    );
+  return lines;
+}
 function realtimeLines(info) {
   if (!info.enabled)
     return [
@@ -5887,7 +6276,9 @@ function realtimeLines(info) {
   return [
     "Realtime: on (public channels: off)",
     info.tables.length === 0 ? "Published tables: none \u2014 naro realtime tables add <table>" : `Published tables: ${info.tables.map(tableName).join(", ")}`,
-    live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`
+    live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`,
+    // A control plane older than 3-2e sends no `usage`.
+    ...usageLines2(info.usage ?? null)
   ];
 }
 async function enableRealtime(client, projectId, environment) {
@@ -6344,7 +6735,7 @@ async function runStorageBucketRemove(context) {
 import { randomUUID } from "crypto";
 import { createWriteStream as createWriteStream2, openAsBlob, rmSync as rmSync2 } from "fs";
 import { rename, rm, stat } from "fs/promises";
-import { basename as basename2, dirname as dirname3, extname, join as join5, resolve as resolve6 } from "path";
+import { basename as basename2, dirname as dirname4, extname, join as join6, resolve as resolve8 } from "path";
 import { Readable } from "stream";
 import { pipeline as pipeline2 } from "stream/promises";
 
@@ -6477,6 +6868,17 @@ function serviceKeyOffServer() {
     message: SERVICE_KEY_OFF_SERVER_MESSAGE
   };
 }
+function accessTokenUnavailable(cause) {
+  return {
+    code: "ACCESS_TOKEN_UNAVAILABLE",
+    message: "createClient's accessToken function failed or returned something that is not a string or null, so the request was not sent.",
+    details: { cause: describe(cause) }
+  };
+}
+function accessTokenAuthMessage(name) {
+  return `naro.auth.${name} is not available on a client made with accessToken: its token comes from your accessToken function. Use a client made without accessToken to sign in.`;
+}
+var ACCESS_TOKEN_CHANNEL_MESSAGE = "naro.channel() is not available on a client made with accessToken: Realtime signs in with a session, not an access token. Broadcast from a function with naroAdmin.";
 function notJoined(channel) {
   return {
     code: "NOT_JOINED",
@@ -6543,6 +6945,16 @@ function storeFor(config, path) {
   return SESSION_PREFIXES.some((prefix) => path.startsWith(prefix)) ? config.tokens : config.accessJwt ?? null;
 }
 var ACCESS_JWT_MARGIN_MS = 6e4;
+function deadlineOf(timeoutMs) {
+  return timeoutMs === void 0 ? null : { at: Date.now() + timeoutMs, ms: timeoutMs };
+}
+function remainingMs(deadline) {
+  return Math.max(0, deadline.at - Date.now());
+}
+var EXPIRED = Symbol("expired");
+function timedOut(deadline) {
+  return requestTimeout(deadline?.ms ?? 0);
+}
 function timesOf(jwt) {
   const payload = jwt.split(".")[1];
   if (payload === void 0 || payload === "") return null;
@@ -6638,6 +7050,13 @@ async function accessJwtFor(config, jwtStore) {
 async function bearerFor(config, path, withToken) {
   if (!withToken) return { token: null, session: null };
   const store = storeFor(config, path);
+  if (config.accessToken !== void 0 && store !== config.tokens) {
+    try {
+      return { token: await config.accessToken.get(), session: null };
+    } catch (cause) {
+      return { error: accessTokenUnavailable(cause) };
+    }
+  }
   if (store === null) return { token: null, session: null };
   if (store === config.tokens) {
     const token = await store.get();
@@ -6652,9 +7071,12 @@ async function retryBearer(config, path, error, first) {
   if ("error" in renewed) return renewed;
   return renewed.token === null || renewed.token === first.token || renewed.session !== first.session ? null : renewed;
 }
-async function receive(config, options, init) {
-  const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
+async function receive(config, options, init, deadline) {
+  if (deadline !== null && remainingMs(deadline) === 0)
+    return { error: timedOut(deadline) };
+  const controller = deadline !== null && typeof AbortController === "function" ? new AbortController() : null;
   if (controller) init.signal = controller.signal;
+  let gaveUp = false;
   const request = (async () => {
     try {
       const fetchImpl = config.fetch ?? globalThis.fetch;
@@ -6662,6 +7084,10 @@ async function receive(config, options, init) {
         `${config.baseUrl}/_naro/v1${options.path}`,
         init
       );
+      if (gaveUp) {
+        discard(response);
+        return { error: timedOut(deadline) };
+      }
       return {
         status: response.status,
         headers: response.headers,
@@ -6671,14 +7097,14 @@ async function receive(config, options, init) {
       return { error: networkError(error) };
     }
   })();
-  const { timeoutMs } = options;
-  if (timeoutMs === void 0) return request;
+  if (deadline === null) return request;
   let timer;
-  const expired = new Promise((resolve7) => {
+  const expired = new Promise((resolve9) => {
     timer = setTimeout(() => {
+      gaveUp = true;
       controller?.abort();
-      resolve7({ error: requestTimeout(timeoutMs) });
-    }, timeoutMs);
+      resolve9({ error: timedOut(deadline) });
+    }, remainingMs(deadline));
   });
   try {
     return await Promise.race([request, expired]);
@@ -6695,15 +7121,34 @@ async function call(config, options) {
       return { error: invalidQuery("", "is not JSON"), answer: null };
     }
   }
-  const bearer = await bearerFor(config, options.path, options.withToken);
+  const deadline = deadlineOf(options.timeoutMs);
+  const bearer = await untilStopped(
+    bearerFor(config, options.path, options.withToken),
+    void 0,
+    deadline
+  );
+  if (bearer === EXPIRED || bearer === ABORTED)
+    return { error: timedOut(deadline), answer: null };
   if ("error" in bearer) return { error: bearer.error, answer: null };
-  const result = await callWith(config, options, payload, bearer.token);
-  const again = await retryBearer(config, options.path, result.error, bearer);
+  const result = await callWith(
+    config,
+    options,
+    payload,
+    bearer.token,
+    deadline
+  );
+  const again = await untilStopped(
+    retryBearer(config, options.path, result.error, bearer),
+    void 0,
+    deadline
+  );
+  if (again === EXPIRED || again === ABORTED)
+    return { error: timedOut(deadline), answer: null };
   if (again === null) return result;
   if ("error" in again) return { error: again.error, answer: null };
-  return callWith(config, options, payload, again.token);
+  return callWith(config, options, payload, again.token, deadline);
 }
-async function callWith(config, options, payload, token) {
+async function callWith(config, options, payload, token, deadline = null) {
   const store = storeFor(config, options.path);
   const headers = {
     ...options.headers,
@@ -6723,7 +7168,7 @@ async function callWith(config, options, payload, token) {
     headers["Content-Type"] = "application/json";
     init.body = payload;
   }
-  const received = await receive(config, options, init);
+  const received = await receive(config, options, init, deadline);
   if ("error" in received) return { error: received.error, answer: null };
   const { status, headers: responseHeaders, text } = received;
   let body;
@@ -6770,13 +7215,13 @@ var ABORTED = Symbol("aborted");
 function untilAborted(promise, signal) {
   if (!signal) return promise;
   if (signal.aborted) return Promise.resolve(ABORTED);
-  return new Promise((resolve7, reject) => {
-    const stop = () => resolve7(ABORTED);
+  return new Promise((resolve9, reject) => {
+    const stop = () => resolve9(ABORTED);
     signal.addEventListener("abort", stop, { once: true });
     promise.then(
       (value) => {
         signal.removeEventListener("abort", stop);
-        resolve7(value);
+        resolve9(value);
       },
       (error) => {
         signal.removeEventListener("abort", stop);
@@ -6785,6 +7230,27 @@ function untilAborted(promise, signal) {
     );
   });
 }
+function untilStopped(promise, signal, deadline) {
+  if (signal?.aborted) return Promise.resolve(ABORTED);
+  if (!signal && deadline === null) return promise;
+  return new Promise((resolve9, reject) => {
+    let timer;
+    const stop = () => finish(ABORTED);
+    const finish = (value) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+      resolve9(value);
+    };
+    signal?.addEventListener("abort", stop, { once: true });
+    if (deadline !== null)
+      timer = setTimeout(() => finish(EXPIRED), remainingMs(deadline));
+    promise.then(finish, (error) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+      reject(error);
+    });
+  });
+}
 function isStream(body) {
   return typeof ReadableStream === "function" && body instanceof ReadableStream;
 }
@@ -6844,6 +7310,143 @@ async function sendWith(config, options, token) {
     status
   };
 }
+async function fetchUnread(config, options) {
+  const { signal } = options;
+  if (signal?.aborted) return { failed: "aborted", cause: signal.reason };
+  const deadline = deadlineOf(options.timeoutMs);
+  if (options.ready) {
+    const ready = await untilStopped(options.ready(), signal, deadline);
+    if (ready === ABORTED) return { failed: "aborted", cause: signal?.reason };
+    if (ready === EXPIRED) return { failed: "timeout", cause: null };
+  }
+  const own = options.headers.has("authorization");
+  const bearer = await untilStopped(
+    bearerFor(config, options.path, !own),
+    signal,
+    deadline
+  );
+  if (bearer === ABORTED) return { failed: "aborted", cause: signal?.reason };
+  if (bearer === EXPIRED) return { failed: "timeout", cause: null };
+  if ("error" in bearer) return { refused: bearer.error };
+  const first = await fetchOnce(config, options, bearer.token, deadline);
+  if (!("response" in first) || bearer.token === null) return first;
+  const refused = await refusesToken(first.response, signal, deadline);
+  if (refused === EXPIRED) {
+    discard(first.response);
+    return { failed: "timeout", cause: null };
+  }
+  if (refused === ABORTED) {
+    discard(first.response);
+    return { failed: "aborted", cause: signal?.reason };
+  }
+  if (!refused) return first;
+  await storeFor(config, options.path)?.clearIf(bearer.token);
+  if (isStream(options.body)) return first;
+  const again = await untilStopped(
+    retryBearer(config, options.path, invalidSession(), bearer),
+    signal,
+    deadline
+  );
+  if (again === EXPIRED) {
+    discard(first.response);
+    return { failed: "timeout", cause: null };
+  }
+  if (again === null || again !== ABORTED && "error" in again) return first;
+  discard(first.response);
+  if (again === ABORTED) return { failed: "aborted", cause: signal?.reason };
+  const second = await fetchOnce(config, options, again.token, deadline);
+  if (!("response" in second) || again.token === null) return second;
+  const refusedAgain = await refusesToken(second.response, signal, deadline);
+  if (refusedAgain === ABORTED) {
+    discard(second.response);
+    return { failed: "aborted", cause: signal?.reason };
+  }
+  if (refusedAgain === true || refusedAgain === EXPIRED)
+    await storeFor(config, options.path)?.clearIf(again.token);
+  return second;
+}
+async function refusesToken(response, signal, deadline) {
+  if (response.status !== 401 || response.headers.get("x-relay-error") !== "true")
+    return false;
+  let body;
+  try {
+    body = await untilStopped(response.clone().json(), signal, deadline);
+  } catch {
+    return signal?.aborted ? ABORTED : false;
+  }
+  if (body === ABORTED || body === EXPIRED) return body;
+  return isRecord(body) && isRecord(body.error) && body.error.code === "INVALID_SESSION";
+}
+var releases = /* @__PURE__ */ new WeakMap();
+function discard(response) {
+  releases.get(response)?.();
+  releases.delete(response);
+  response.body?.cancel().catch(() => {
+  });
+}
+async function fetchOnce(config, options, token, deadline) {
+  const { signal } = options;
+  if (signal?.aborted) return { failed: "aborted", cause: signal.reason };
+  if (deadline !== null && remainingMs(deadline) === 0)
+    return { failed: "timeout", cause: null };
+  const headers = new Headers(options.headers);
+  headers.set("apikey", config.apiKey);
+  if (token !== null) headers.set("authorization", `Bearer ${token}`);
+  const init = {
+    method: options.method,
+    headers,
+    credentials: "omit"
+  };
+  if (options.body !== void 0) init.body = options.body;
+  if (isStream(options.body)) init.duplex = "half";
+  const controller = typeof AbortController === "function" ? new AbortController() : null;
+  if (controller) init.signal = controller.signal;
+  let timer;
+  let stop = () => {
+  };
+  const stopped = new Promise((resolve9) => {
+    stop = resolve9;
+  });
+  const onAbort = () => {
+    stop({ failed: "aborted", cause: signal?.reason });
+    controller?.abort(signal?.reason);
+  };
+  if (deadline !== null)
+    timer = setTimeout(() => {
+      stop({ failed: "timeout", cause: null });
+      controller?.abort();
+    }, remainingMs(deadline));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  const request = (async () => {
+    try {
+      const fetchImpl = config.fetch ?? globalThis.fetch;
+      return {
+        response: await fetchImpl(
+          `${config.baseUrl}/_naro/v1${options.path}`,
+          init
+        )
+      };
+    } catch (cause) {
+      return { failed: "network", cause };
+    }
+  })();
+  const release = () => signal?.removeEventListener("abort", onAbort);
+  let outcome;
+  try {
+    outcome = await Promise.race([request, stopped]);
+    return outcome;
+  } finally {
+    clearTimeout(timer);
+    if (outcome !== void 0 && "response" in outcome)
+      releases.set(outcome.response, release);
+    else {
+      release();
+      void request.then((late) => {
+        if ("response" in late) discard(late.response);
+      });
+    }
+  }
+}
 var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "RATE_LIMITED",
   "WRITE_QUOTA_EXCEEDED",
@@ -6852,7 +7455,15 @@ var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   "OBJECT_RATE_LIMITED",
   "STORAGE_OPS_QUOTA_EXCEEDED",
   // Realtime's REST broadcast over the project's message budget (x-retry-after: 1).
-  "TOO_MANY_MESSAGES"
+  "TOO_MANY_MESSAGES",
+  // The dispatcher's REST 429 of a project over its month of Realtime (3-2e):
+  // `x-retry-after` is the seconds to the 1st at 00:00 UTC.
+  "REALTIME_QUOTA_EXCEEDED",
+  // Naro Functions (design F20): a team over its monthly function CPU, and
+  // the control plane's Cloudflare limit. `invoke` reads x-retry-after on
+  // every relay error anyway (invoke/client.ts).
+  "FUNCTIONS_QUOTA_EXCEEDED",
+  "FUNCTIONS_RATE_LIMITED"
 ]);
 function withRetryAfter(error, headers) {
   const header = headers.get("x-retry-after")?.trim() ?? "";
@@ -7166,14 +7777,14 @@ var AuthClient = class {
    */
   async signInWithOAuth(options) {
     const { provider } = options;
-    const failed = (error) => ({
+    const failed2 = (error) => ({
       data: { provider, url: null },
       error
     });
-    if (!OAUTH_PROVIDERS.includes(provider)) return failed(invalidProvider());
+    if (!OAUTH_PROVIDERS.includes(provider)) return failed2(invalidProvider());
     await this.#flow.recovery.forget();
     const pair = await createPkcePair();
-    if (!pair) return failed(cryptoUnavailable());
+    if (!pair) return failed2(cryptoUnavailable());
     await this.#flow.verifiers.add(pair.challenge, pair.verifier);
     const redirectTo = options.redirectTo ?? currentPage();
     const url = new URL(
@@ -7739,6 +8350,282 @@ var TokenStore = class {
     }
   }
 };
+function prepareBody(body) {
+  if (body === void 0) return { body: void 0, contentType: null };
+  if (typeof body === "string") return { body, contentType: "text/plain" };
+  if (typeof Blob === "function" && body instanceof Blob)
+    return { body, contentType: "application/octet-stream" };
+  if (body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+    return { body, contentType: "application/octet-stream" };
+  if (typeof FormData === "function" && body instanceof FormData)
+    return { body, contentType: null };
+  if (typeof URLSearchParams === "function" && body instanceof URLSearchParams)
+    return { body, contentType: null };
+  if (typeof ReadableStream === "function" && body instanceof ReadableStream)
+    return { body, contentType: null };
+  try {
+    const text = JSON.stringify(body);
+    return text === void 0 ? null : { body: text, contentType: "application/json" };
+  } catch {
+    return null;
+  }
+}
+async function readAnswer(response, method) {
+  if (response.status === 204 || method === "HEAD") return { data: null };
+  const type = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
+  try {
+    if (type === "application/json") {
+      const text = await response.text();
+      return {
+        data: text.trim() === "" ? null : JSON.parse(text)
+      };
+    }
+    if (type === "application/octet-stream" || type === "application/pdf")
+      return { data: await response.blob() };
+    if (type === "text/event-stream") return { data: response };
+    if (type === "multipart/form-data")
+      return { data: await response.formData() };
+    return { data: await response.text() };
+  } catch (cause) {
+    return { unreadable: cause };
+  }
+}
+var FunctionsError = class extends Error {
+  code;
+  context;
+  constructor(code, message, context, details) {
+    super(message);
+    this.name = "FunctionsError";
+    this.code = code;
+    this.context = context;
+    if (details !== void 0)
+      Object.defineProperty(this, "details", {
+        value: details,
+        enumerable: true
+      });
+  }
+};
+var FunctionsHttpError = class extends FunctionsError {
+  constructor(response) {
+    super(
+      "FUNCTION_HTTP_ERROR",
+      `The function answered with HTTP ${String(response.status)}.`,
+      response
+    );
+    this.name = "FunctionsHttpError";
+  }
+};
+var FunctionsRelayError = class extends FunctionsError {
+  constructor(code, message, response, details) {
+    super(code, message, response, details);
+    this.name = "FunctionsRelayError";
+  }
+};
+var FunctionsFetchError = class extends FunctionsError {
+  constructor(code, message, cause, details) {
+    super(code, message, cause, details);
+    this.name = "FunctionsFetchError";
+  }
+};
+var FUNCTIONS_MESSAGES = {
+  timeout: (ms) => `The function did not answer within ${String(ms)} ms.`,
+  aborted: "The function call was stopped before the function answered.",
+  invalidBody: "functions.invoke could not send this body: JSON cannot hold it (a BigInt or a cycle). Pass a string, a Blob, bytes, FormData, URLSearchParams or a stream instead.",
+  invalidTimeout: "functions.invoke's timeout is whole milliseconds from 1 to 2147483647.",
+  invalidHeaders: "functions.invoke's headers are not valid HTTP header names and values.",
+  invalidName: "functions.invoke's name is a string: the function's name, then any path and query.",
+  unencodableName: "functions.invoke's name is not well-formed Unicode: it has a lone surrogate.",
+  dotSegments: `functions.invoke's name cannot be "." or "..", and ".." in its path cannot leave /functions/.`,
+  invalidSignal: "functions.invoke's signal is not an AbortSignal.",
+  bodyWithGetOrHead: "functions.invoke cannot send a body with GET or HEAD.",
+  /** `RELAY_ERROR`: a HEAD answer has no body, so Naro's code is not in it. */
+  headRelay: (status) => `Naro answered HTTP ${String(status)} for the function, but a HEAD answer has no body to say why. Call it with GET to read the reason.`,
+  unreadable: (status) => `The function answered HTTP ${String(status)}, but its body could not be read as its content-type says.`
+};
+var MAX_TIMER_MS = 2147483647;
+function functionPath(name) {
+  const cut = name.search(/[/?#]/);
+  const head = cut === -1 ? name : name.slice(0, cut);
+  const tail = cut === -1 ? "" : name.slice(cut);
+  return `/functions/${encodeURIComponent(head)}${tail}`;
+}
+function dotSegment(segment) {
+  const dots = segment.toLowerCase().replace(/%2e/g, ".");
+  return dots === "." ? 1 : dots === ".." ? 2 : 0;
+}
+function leavesFunctions(input) {
+  const name = input.replace(/[\t\n\r]/g, "");
+  const cut = name.search(/[/?#]/);
+  const head = cut === -1 ? name : name.slice(0, cut);
+  if (head === "." || head === "..") return true;
+  if (cut === -1 || name[cut] !== "/") return false;
+  const rest = name.slice(cut + 1);
+  const end = rest.search(/[?#]/);
+  let depth = 1;
+  for (const segment of (end === -1 ? rest : rest.slice(0, end)).split(
+    /[/\\]/
+  )) {
+    const dots = dotSegment(segment);
+    if (dots === 0) depth += 1;
+    if (dots === 2) depth -= 1;
+    if (depth < 0) return true;
+  }
+  return false;
+}
+function pathOf(name) {
+  if (typeof name !== "string")
+    return { invalid: FUNCTIONS_MESSAGES.invalidName };
+  if (leavesFunctions(name)) return { invalid: FUNCTIONS_MESSAGES.dotSegments };
+  try {
+    return { path: functionPath(name) };
+  } catch {
+    return { invalid: FUNCTIONS_MESSAGES.unencodableName };
+  }
+}
+function isSignalOrNone(value) {
+  if (value === void 0 || value === null) return true;
+  if (typeof value !== "object") return false;
+  const signal = value;
+  return typeof signal.aborted === "boolean" && typeof signal.addEventListener === "function" && typeof signal.removeEventListener === "function";
+}
+function invalidOptions(message) {
+  return failed(new FunctionsFetchError("INVALID_OPTIONS", message, null));
+}
+function failed(error) {
+  return { data: null, error };
+}
+function fromNaroError(error, cause) {
+  return new FunctionsFetchError(
+    error.code,
+    error.message,
+    cause,
+    error.details
+  );
+}
+function failure(kind, cause, timeout) {
+  if (kind === "timeout")
+    return new FunctionsFetchError(
+      "TIMEOUT",
+      FUNCTIONS_MESSAGES.timeout(timeout ?? 0),
+      cause
+    );
+  if (kind === "aborted")
+    return new FunctionsFetchError(
+      "ABORTED",
+      FUNCTIONS_MESSAGES.aborted,
+      cause
+    );
+  return fromNaroError(networkError(cause), cause);
+}
+function unreadable(cause, status, signal) {
+  if (signal?.aborted)
+    return new FunctionsFetchError(
+      "ABORTED",
+      FUNCTIONS_MESSAGES.aborted,
+      cause
+    );
+  if (cause instanceof SyntaxError)
+    return new FunctionsFetchError(
+      "INVALID_RESPONSE",
+      FUNCTIONS_MESSAGES.unreadable(status),
+      cause
+    );
+  return fromNaroError(networkError(cause), cause);
+}
+async function relayError(response, head) {
+  let body;
+  try {
+    body = await response.clone().json();
+  } catch {
+    body = void 0;
+  }
+  const { status } = response;
+  const error = withRetryAfter(
+    head && body === void 0 ? {
+      code: "RELAY_ERROR",
+      message: FUNCTIONS_MESSAGES.headRelay(status),
+      details: { status }
+    } : errorFromBody(status, body) ?? invalidResponse(status),
+    response.headers
+  );
+  return new FunctionsRelayError(
+    error.code,
+    error.message,
+    response,
+    error.details
+  );
+}
+var FunctionsClient = class {
+  #http;
+  #auth;
+  constructor(http, auth) {
+    this.#http = http;
+    this.#auth = auth;
+  }
+  async invoke(name, options = {}) {
+    const method = options.method ?? "POST";
+    const { timeout, signal } = options;
+    const target = pathOf(name);
+    if ("invalid" in target) return invalidOptions(target.invalid);
+    if (timeout !== void 0 && !(Number.isInteger(timeout) && timeout > 0 && timeout <= MAX_TIMER_MS))
+      return invalidOptions(FUNCTIONS_MESSAGES.invalidTimeout);
+    if (!isSignalOrNone(signal))
+      return invalidOptions(FUNCTIONS_MESSAGES.invalidSignal);
+    const verb = typeof method === "string" ? method.toUpperCase() : "";
+    if (options.body !== void 0 && (verb === "GET" || verb === "HEAD"))
+      return invalidOptions(FUNCTIONS_MESSAGES.bodyWithGetOrHead);
+    let headers;
+    try {
+      headers = new Headers(options.headers);
+    } catch (cause) {
+      return failed(
+        new FunctionsFetchError(
+          "INVALID_OPTIONS",
+          FUNCTIONS_MESSAGES.invalidHeaders,
+          cause
+        )
+      );
+    }
+    const prepared = prepareBody(options.body);
+    if (prepared === null)
+      return failed(
+        new FunctionsFetchError(
+          "INVALID_BODY",
+          FUNCTIONS_MESSAGES.invalidBody,
+          null
+        )
+      );
+    if (prepared.contentType !== null && !headers.has("content-type"))
+      headers.set("content-type", prepared.contentType);
+    const result = await fetchUnread(this.#http, {
+      method,
+      path: target.path,
+      headers,
+      body: prepared.body,
+      timeoutMs: timeout,
+      signal,
+      // A sign-in the page URL carried goes first, as for a query (P2-6) —
+      // within the call's timeout and signal; the exchange is not cut.
+      ready: () => this.#auth.ready()
+    });
+    if ("refused" in result) return failed(fromNaroError(result.refused, null));
+    if ("failed" in result)
+      return failed(failure(result.failed, result.cause, timeout));
+    const { response } = result;
+    if (!response.ok) {
+      const error = response.headers.get("x-relay-error") === "true" ? await relayError(response, verb === "HEAD") : new FunctionsHttpError(response);
+      return { data: null, error, response };
+    }
+    const answer = await readAnswer(response, method);
+    if ("unreadable" in answer)
+      return {
+        data: null,
+        error: unreadable(answer.unreadable, response.status, signal),
+        response
+      };
+    return { data: answer.data, error: null, response };
+  }
+};
 function isSpace2(char) {
   return char.trim() === "";
 }
@@ -8493,6 +9380,7 @@ var TableBuilder = class {
 var BACKOFF_STEPS_MS = [1e3, 2e3, 5e3, 1e4];
 var RATE_LIMITED_MIN_MS = 5e3;
 var IP_LIMIT_WAIT_MS = 6e4;
+var QUOTA_WAIT_MS = 9e5;
 var RESTART_JITTER_MS = 1e4;
 var UNOPENED_SLOWDOWN_AFTER = 6;
 var UNOPENED_DELAY_MS = 6e4;
@@ -8509,7 +9397,7 @@ function closeAction(code, reason) {
   if (code === 4401) return { kind: "session" };
   if (code === 4503) return { kind: "restart" };
   if (code === 4029)
-    return reason === "IP_RATE_LIMITED" ? { kind: "wait", ms: IP_LIMIT_WAIT_MS } : { kind: "retry", minMs: RATE_LIMITED_MIN_MS };
+    return reason === "IP_RATE_LIMITED" ? { kind: "wait", ms: IP_LIMIT_WAIT_MS } : reason === "REALTIME_QUOTA_EXCEEDED" ? { kind: "wait", ms: QUOTA_WAIT_MS } : { kind: "retry", minMs: RATE_LIMITED_MIN_MS };
   return { kind: "retry", minMs: 0 };
 }
 function backoffMs(attempt22, random) {
@@ -8884,30 +9772,30 @@ var RealtimeSocket = class {
   request(topic, event, payload, options = {}) {
     const ref = options.ref ?? this.nextRef();
     const turn = options.turn ?? "app";
-    return new Promise((resolve7) => {
+    return new Promise((resolve9) => {
       const lost = {
         ok: false,
         error: realtimeClosed(1006),
         lost: true
       };
-      if (!this.isOpen()) return resolve7(lost);
+      if (!this.isOpen()) return resolve9(lost);
       let text;
       try {
         text = clientFrame(topic, event, payload, ref, options.joinRef);
       } catch {
-        return resolve7(lost);
+        return resolve9(lost);
       }
       const bytes = utf8Length(text);
       const limit = this.#frameLimit;
       if (limit !== null && bytes > limit)
-        return resolve7({ ok: false, error: frameTooLarge(limit), lost: false });
+        return resolve9({ ok: false, error: frameTooLarge(limit), lost: false });
       if (turn === "app" && event !== "phx_leave" && !this.#goesInTime())
-        return resolve7({
+        return resolve9({
           ok: false,
           error: clientFlooding(CONNECTION_FRAMES_PER_SECOND),
           lost: false
         });
-      this.#replies.set(ref, { resolve: resolve7, timer: void 0, bytes, turn });
+      this.#replies.set(ref, { resolve: resolve9, timer: void 0, bytes, turn });
       this.#enqueue({ text, bytes, ref, turn, presence: event === "presence" });
     });
   }
@@ -9231,19 +10119,19 @@ var RealtimeSocket = class {
   #closed(ws, code, reason, waitedMs) {
     if (this.#ws !== ws) return;
     const wasOpen = this.#state === "open";
-    const timedOut = waitedMs !== null;
+    const timedOut2 = waitedMs !== null;
     detach(ws);
     this.#ws = null;
     this.#clearTimers();
-    if (timedOut) closeQuietly(ws, 1e3);
+    if (timedOut2) closeQuietly(ws, 1e3);
     if (!wasOpen) this.#unopened += 1;
     const said = this.#said;
     this.#said = null;
-    if (!timedOut && code === 4008) this.#flooded = true;
-    const action = timedOut ? { kind: "retry", minMs: 0 } : closeAction(code, said?.code ?? reason);
+    if (!timedOut2 && code === 4008) this.#flooded = true;
+    const action = timedOut2 ? { kind: "retry", minMs: 0 } : closeAction(code, said?.code ?? reason);
     if (action.kind === "stop")
       return this.#stop(said ?? realtimeStopped(code, reason));
-    const error = timedOut ? realtimeTimedOut(waitedMs) : said ?? realtimeClosed(code);
+    const error = timedOut2 ? realtimeTimedOut(waitedMs) : said ?? realtimeClosed(code);
     this.#failReplies(error);
     this.#state = "waiting";
     const delay = delayAfter(
@@ -9256,7 +10144,7 @@ var RealtimeSocket = class {
     safely(
       () => this.#config.events.dropped(
         error,
-        timedOut ? "TIMED_OUT" : "CHANNEL_ERROR"
+        timedOut2 ? "TIMED_OUT" : "CHANNEL_ERROR"
       )
     );
   }
@@ -10026,9 +10914,9 @@ var RealtimeChannel = class {
    */
   #inTurn(joinRef, wait, send2) {
     if (!wait && this.#waiting.length === 0) return send2();
-    return new Promise((resolve7) => {
+    return new Promise((resolve9) => {
       this.#waiting.push(
-        () => resolve7(this.#joinRef === joinRef ? send2() : null)
+        () => resolve9(this.#joinRef === joinRef ? send2() : null)
       );
     });
   }
@@ -10643,13 +11531,13 @@ async function uploadInParts(a) {
     }).catch(() => void 0);
   };
   const etags = [];
-  const failure = {
+  const failure2 = {
     error: signal?.aborted ? uploadAborted() : null
   };
   let next = 1;
   let sentBytes = 0;
   const onAbort = () => {
-    failure.error ??= uploadAborted();
+    failure2.error ??= uploadAborted();
   };
   const tryPart = async (n, bytes) => {
     const sent2 = await send(a.http, {
@@ -10678,18 +11566,18 @@ async function uploadInParts(a) {
         progress(sentBytes);
         return null;
       }
-      if (attempt22 === ATTEMPTS || failure.error !== null || !retryable(tried.error, tried.status))
+      if (attempt22 === ATTEMPTS || failure2.error !== null || !retryable(tried.error, tried.status))
         return tried.error;
       await sleep2(waitAfter(tried.error, attempt22), signal);
-      if (failure.error !== null) return tried.error;
+      if (failure2.error !== null) return tried.error;
     }
   };
   const worker = async () => {
-    while (failure.error === null && next <= partCount) {
+    while (failure2.error === null && next <= partCount) {
       const n = next;
       next += 1;
       const error = await sendPart(n);
-      if (error !== null) failure.error ??= error;
+      if (error !== null) failure2.error ??= error;
     }
   };
   signal?.addEventListener("abort", onAbort);
@@ -10697,9 +11585,9 @@ async function uploadInParts(a) {
     Array.from({ length: Math.min(CONCURRENCY, partCount) }, worker)
   );
   signal?.removeEventListener("abort", onAbort);
-  if (failure.error !== null) {
+  if (failure2.error !== null) {
     await callOff();
-    return fail(failure.error);
+    return fail(failure2.error);
   }
   const completed = await call(a.http, {
     method: "POST",
@@ -10926,8 +11814,8 @@ var StorageFileApi = class {
     const payload = payloadOf(body, options.contentType);
     if (!payload.ok) return fail(payload.error);
     const cache = `max-age=${options.cacheControl ?? "3600"}`;
-    const unreadable = headerProblem(options.contentType, cache);
-    if (unreadable !== null) return fail(unreadable);
+    const unreadable2 = headerProblem(options.contentType, cache);
+    if (unreadable2 !== null) return fail(unreadable2);
     const { signal } = options;
     if (signal?.aborted) return fail(uploadAborted());
     await this.#auth.ready();
@@ -11228,8 +12116,8 @@ var StorageFileApi = class {
     const payload = payloadOf(body, given.contentType);
     if (!payload.ok) return fail(payload.error);
     const cache = `max-age=${given.cacheControl ?? "3600"}`;
-    const unreadable = headerProblem(given.contentType, cache);
-    if (unreadable !== null) return fail(unreadable);
+    const unreadable2 = headerProblem(given.contentType, cache);
+    if (unreadable2 !== null) return fail(unreadable2);
     const { signal } = given;
     if (signal?.aborted) return fail(uploadAborted());
     const uploaded = payload.size > MAX_SINGLE_UPLOAD_BYTES2 ? await uploadInParts({
@@ -11308,12 +12196,14 @@ var CONFIG_MESSAGES = {
   bothKeys: "Pass createClient an anonKey or a serviceKey, not both.",
   serviceKeyOffServer: SERVICE_KEY_OFF_SERVER_MESSAGE,
   fetch: "This runtime has no fetch. Pass one to createClient({ fetch }).",
-  realtime: "createClient's realtime options take a WebSocket class, and heartbeatIntervalMs and timeoutMs in whole milliseconds from 1 to 2147483647."
+  realtime: "createClient's realtime options take a WebSocket class, and heartbeatIntervalMs and timeoutMs in whole milliseconds from 1 to 2147483647.",
+  accessTokenWithServiceKey: "Pass createClient an accessToken or a serviceKey, not both: the service key skips every policy, so the user's token would not count.",
+  accessToken: "createClient's accessToken is a function that returns the user's access token, or null for none."
 };
 var SERVICE_KEY_PREFIX = "naro_sk_";
-var MAX_TIMER_MS = 2147483647;
+var MAX_TIMER_MS2 = 2147483647;
 function isMilliseconds(value) {
-  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_TIMER_MS;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_TIMER_MS2;
 }
 function realtimeOptionsOf(value) {
   if (value === void 0) return {};
@@ -11363,6 +12253,35 @@ function apiKeyOf(options) {
     throw new Error(CONFIG_MESSAGES.serviceKeyOffServer);
   return { key, service };
 }
+function accessTokenOf(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "function") throw new Error(CONFIG_MESSAGES.accessToken);
+  const read = value;
+  return {
+    async get() {
+      const token = await read();
+      if (token === null || token === void 0 || token === "") return null;
+      if (typeof token !== "string")
+        throw new TypeError(`accessToken returned a ${typeof token}`);
+      if (!/^[\x21-\x7E]+$/.test(token))
+        throw new TypeError(
+          "accessToken returned a string that is not a token"
+        );
+      return token;
+    }
+  };
+}
+function refusingAuth() {
+  return new Proxy(/* @__PURE__ */ Object.create(null), {
+    get(_target, property) {
+      if (typeof property === "symbol" || property === "then" || property === "toJSON" || property === "constructor" || property === "asymmetricMatch")
+        return void 0;
+      if (property === "toString") return Object.prototype.toString;
+      if (property === "valueOf") return Object.prototype.valueOf;
+      throw new Error(accessTokenAuthMessage(property));
+    }
+  });
+}
 function queryRunner(http, auth) {
   return async (query) => {
     await auth.ready();
@@ -11391,7 +12310,14 @@ var NaroClient2 = class {
    * them, as supabase-js does.
    */
   storage;
+  /**
+   * The project's Naro Functions (design §9): `functions.invoke(name, {
+   * body })`, as in supabase-js.
+   */
+  functions;
   #run;
+  /** Made with `accessToken`: `auth` and `channel()` refuse. */
+  #accessToken;
   #newRealtime;
   /**
    * Made by the first channel(), not by the constructor: it listens to every
@@ -11402,37 +12328,38 @@ var NaroClient2 = class {
   constructor(options) {
     const baseUrl = baseUrlOf(options.url);
     const { key: apiKey, service } = apiKeyOf(options);
+    const accessToken = accessTokenOf(options.accessToken);
+    if (accessToken !== void 0 && service)
+      throw new Error(CONFIG_MESSAGES.accessTokenWithServiceKey);
     if (options.fetch === void 0 && typeof globalThis.fetch !== "function")
       throw new Error(CONFIG_MESSAGES.fetch);
     const realtime = realtimeOptionsOf(options.realtime);
-    const storage = options.auth?.storage ?? defaultStorage();
+    const storage = accessToken !== void 0 ? memoryStorage() : options.auth?.storage ?? defaultStorage();
     const http = {
       baseUrl,
       apiKey,
       fetch: options.fetch,
       tokens: new TokenStore(storage, storageKey(baseUrl)),
-      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl)),
-      service
+      service,
+      ...accessToken !== void 0 ? { accessToken } : { accessJwt: new TokenStore(storage, accessJwtKey(baseUrl)) }
     };
-    this.auth = new AuthClient(http, {
+    const auth = new AuthClient(http, {
       verifiers: new FlowVerifiers(
         new TokenStore(storage, verifierKey(baseUrl))
       ),
       recovery: new RecoveryToken(
         new TokenStore(storage, recoveryKey(baseUrl))
       ),
-      detectSessionInUrl: options.auth?.detectSessionInUrl ?? true,
+      detectSessionInUrl: accessToken === void 0 && (options.auth?.detectSessionInUrl ?? true),
       shared: { storage, key: storageKey(baseUrl) },
       serviceKey: service
     });
-    this.#run = queryRunner(http, this.auth);
-    this.storage = new StorageClient(http, this.auth);
-    this.#newRealtime = () => new RealtimeClient({
-      http,
-      auth: this.auth,
-      service,
-      options: realtime
-    });
+    this.#accessToken = accessToken !== void 0;
+    this.auth = this.#accessToken ? refusingAuth() : auth;
+    this.#run = queryRunner(http, auth);
+    this.storage = new StorageClient(http, auth);
+    this.functions = new FunctionsClient(http, auth);
+    this.#newRealtime = () => new RealtimeClient({ http, auth, service, options: realtime });
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
   from(table3) {
@@ -11444,6 +12371,7 @@ var NaroClient2 = class {
    * `removeChannel`. Nothing connects until the first `subscribe()`.
    */
   channel(name, options) {
+    if (this.#accessToken) throw new Error(ACCESS_TOKEN_CHANNEL_MESSAGE);
     return this.#client().channel(name, options);
   }
   /** The channels made with `channel()` and not yet removed. */
@@ -11455,7 +12383,9 @@ var NaroClient2 = class {
    * one; the connection closes with the last channel.
    */
   removeChannel(channel) {
-    return this.#client().removeChannel(channel);
+    if (this.#realtime === void 0)
+      return Promise.resolve({ data: null, error: null });
+    return this.#realtime.removeChannel(channel);
   }
   /** `removeChannel()` for every channel; the connection closes. */
   removeAllChannels() {
@@ -11773,7 +12703,7 @@ function stopOnInterrupt(onFirst) {
   };
 }
 async function writeAtomically(bytes, destination) {
-  const partial = join5(dirname3(destination), `.${randomUUID()}.naro-partial`);
+  const partial = join6(dirname4(destination), `.${randomUUID()}.naro-partial`);
   const stopListening = removeOnInterrupt(partial);
   try {
     await pipeline2(bytes, createWriteStream2(partial, { flags: "wx" }));
@@ -11814,7 +12744,7 @@ function progressReporter(output, total) {
   };
 }
 async function upload(context, local, target) {
-  const file = resolve6(context.cwd, local);
+  const file = resolve8(context.cwd, local);
   const info = await stat(file).catch(() => null);
   if (info === null)
     throw new NaroError(
@@ -11948,10 +12878,10 @@ async function download(context, source, local) {
       "VALIDATION_FAILED",
       "naro storage cp downloads one object: name it, naro://<bucket>/<path>."
     );
-  const resolved = resolve6(context.cwd, local);
+  const resolved = resolve8(context.cwd, local);
   const isDirectory = local.endsWith("/") || (await stat(resolved).catch(() => null))?.isDirectory() === true;
-  const destination = isDirectory ? join5(resolved, savedAs(source.path)) : resolved;
-  const folder = await stat(dirname3(destination)).catch(() => null);
+  const destination = isDirectory ? join6(resolved, savedAs(source.path)) : resolved;
+  const folder = await stat(dirname4(destination)).catch(() => null);
   if (folder === null || !folder.isDirectory())
     throw new NaroError(
       "VALIDATION_FAILED",
@@ -12239,7 +13169,7 @@ function projectName(project) {
     return `Moved to another team ${printable(project.projectId)}`;
   return printable(project.name ?? project.projectId);
 }
-function usageLines2(report, summary) {
+function usageLines3(report, summary) {
   const lines = [
     `${printable(report.team.slug)} \xB7 ${planName(report.team.plan)} plan \xB7 ${printable(report.month)} (UTC)`
   ];
@@ -12286,7 +13216,7 @@ async function runUsage(context) {
     month !== void 0 ? { month } : {}
   );
   const summary = summarizeTeamUsage(report, usageMonthOf(/* @__PURE__ */ new Date()));
-  context.output.result({ ...report, summary }, usageLines2(report, summary));
+  context.output.result({ ...report, summary }, usageLines3(report, summary));
 }
 
 // src/router.ts
@@ -12411,6 +13341,8 @@ Usage:
   naro backend keys [--reveal]       API keys; --reveal prints the service key (a secret; needs database write)
   naro backend keys rotate --anon|--service
                                      Replace a key; the old one stops working at once (asks first)
+  naro backend signing-key rotate    Replace the key that signs access tokens (if it may have leaked);
+                                     tokens already issued keep working up to 15 minutes (asks first)
   naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs,
                                      sign-ups and the minimum password length
   naro backend auth signups <on|off>
@@ -12494,6 +13426,28 @@ Usage:
   naro realtime tables remove <table>\u2026 [--yes]
                                      Stop publishing tables' changes (asks first)
 
+  naro functions [list]              Naro Functions: name, version, verify_jwt, status and URL of each function
+  naro functions new <name>          Write naro/functions/<name>/index.ts, a handler to start from
+  naro functions deploy [name\u2026] [--no-verify-jwt] [--import-map <file>] [--skip-check]
+                                     Bundle on this machine (Node.js 22 or later), check that it starts, upload;
+                                     every function in the folder when no name is given
+  naro functions versions <name>     Its stored versions, newest first
+  naro functions rollback <name> [<version>]
+                                     Put an earlier version live again (the one before the live one by default)
+  naro functions delete <name>       Delete it: its URL stops working (asks first; --yes to skip)
+  naro functions logs <name> [--level <l>] [--follow]
+                                     Its newest log lines
+  naro functions secrets [list]      The project's function secrets: names and digests, never values
+  naro functions secrets set <NAME>  Set one (value from a hidden prompt or stdin), then sync the functions
+                                     (--no-sync leaves them to the control plane's sweep)
+  naro functions secrets import <file>
+                                     Set a dotenv file's lines (asks first; --yes in CI)
+  naro functions secrets unset <NAME>\u2026
+                                     Remove secrets (asks first)
+  naro functions secrets sync [--registry]
+                                     Upload out-of-date functions again until none is left; --registry also rewrites
+                                     the function list in the project's database (after naro db restore)
+
   naro promote <deployment-id> [--to <environment>]
                                      Publish a build to production, or to an environment with --to; it says what it will do, then asks.
                                      A build moving between an environment and another surface is built again from its commit with the
@@ -12522,6 +13476,11 @@ Global options:
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
   --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
+  --no-verify-jwt Let calls in without a project JWT (naro functions deploy; wins over function.json)
+  --import-map <file>  The import map for functions whose folder has no deno.json (naro functions deploy)
+  --skip-check    Upload without booting the bundle in workerd first (naro functions deploy)
+  --no-sync       Leave the functions to the control plane's sweep (naro functions secrets set, import, unset; naro backend keys rotate)
+  --registry      Also rewrite the function list in the project's database (naro functions secrets sync)
   --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name);
                   production or an environment name for the data commands (naro db, migration, gen, backend, policy, storage, realtime: production by default)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
@@ -12536,7 +13495,8 @@ Global options:
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
   --output <file> Write to a file instead of stdout (naro gen types, db dump)
   --lang <lang>   Language of the types; typescript, the default, is the only one (naro gen types)
-  --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations)
+  --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations) (naro db push \u2026);
+                  functions directory (default ./naro/functions, or <--root>/naro/functions) (naro functions \u2026)
   --strict        Fail on warnings too, not only errors (naro db lint)
   --schema-only   Dump the schema without rows (naro db dump)
   --data-only     Dump rows without the schema (naro db dump)
@@ -12745,9 +13705,65 @@ function routeRealtime(words) {
       return null;
   }
 }
+function routeFunctions(words) {
+  const [sub] = words;
+  switch (sub) {
+    case void 0:
+    case "list":
+    case "ls":
+      return words.length <= 1 ? { handler: runFunctionsList, positionals: [] } : null;
+    case "versions":
+      return { handler: runFunctionsVersions, positionals: words.slice(1) };
+    case "new":
+      return { handler: runFunctionsNew, positionals: words.slice(1) };
+    case "deploy":
+      return { handler: runFunctionsDeploy, positionals: words.slice(1) };
+    case "rollback":
+      return { handler: runFunctionsRollback, positionals: words.slice(1) };
+    case "delete":
+    case "remove":
+    case "rm":
+      return { handler: runFunctionsDelete, positionals: words.slice(1) };
+    case "logs":
+      return { handler: runFunctionsLogs, positionals: words.slice(1) };
+    case "secrets": {
+      const action = words[1];
+      switch (action) {
+        case void 0:
+        case "list":
+        case "ls":
+          return words.length <= 2 ? { handler: runFunctionsSecretsList, positionals: [] } : null;
+        case "set":
+          return {
+            handler: runFunctionsSecretsSet,
+            positionals: words.slice(2)
+          };
+        case "import":
+          return {
+            handler: runFunctionsSecretsImport,
+            positionals: words.slice(2)
+          };
+        case "unset":
+          return {
+            handler: runFunctionsSecretsUnset,
+            positionals: words.slice(2)
+          };
+        case "sync":
+          return words.length === 2 ? { handler: runFunctionsSecretsSync, positionals: [] } : null;
+        default:
+          return null;
+      }
+    }
+    default:
+      return null;
+  }
+}
 async function refuseTo() {
   throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
 }
+async function refuseFunctionsEnv() {
+  throw new NaroError("VALIDATION_FAILED", FUNCTIONS_ENV_REFUSAL);
+}
 var DATA_COMMANDS = /* @__PURE__ */ new Set([
   "db",
   "migration",
@@ -12789,10 +13805,26 @@ function guidedError(error, parsed) {
   error.message = usage === -1 ? forEnvironment(error.message, environment) : `${forEnvironment(error.message.slice(0, usage), environment)}${error.message.slice(usage)}`;
   return error;
 }
+function unknownFunctionsWords(words) {
+  const [sub = "", action = "", extra = ""] = words;
+  if (sub === "list" || sub === "ls") return [sub, action];
+  if (sub === "secrets")
+    return action === "list" || action === "ls" || action === "sync" ? [sub, action, extra] : [sub, action];
+  return [sub];
+}
+function unknownCommandMessage(parsed) {
+  const words = parsed.command === "functions" ? [
+    "functions",
+    ...unknownFunctionsWords(parsed.positionals).map(printable)
+  ] : [parsed.command, ...parsed.positionals];
+  return `Unknown command: ${words.join(" ")}. See \`naro help\`.`;
+}
 function route(parsed) {
   const routed = routeCommand(parsed);
   if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
     return { handler: refuseTo, positionals: routed.positionals };
+  if (routed && parsed.command === "functions" && parsed.flags.env !== void 0)
+    return { handler: refuseFunctionsEnv, positionals: routed.positionals };
   const refusal = routed ? dataEnvRefusal(parsed) : null;
   if (routed && refusal)
     return {
@@ -13040,6 +14072,13 @@ function routeCommand(parsed) {
               positionals: positionals.slice(2)
             };
           return null;
+        case "signing-key":
+          if (positionals[1] === "rotate")
+            return {
+              handler: runBackendSigningKeyRotate,
+              positionals: positionals.slice(2)
+            };
+          return null;
         case "auth":
           return routeBackendAuth(positionals.slice(1));
         case "users":
@@ -13051,6 +14090,8 @@ function routeCommand(parsed) {
       return routeStorage(positionals);
     case "realtime":
       return routeRealtime(positionals);
+    case "functions":
+      return routeFunctions(positionals);
     case "policy":
       switch (sub) {
         case void 0:
@@ -13094,19 +14135,6 @@ function routeCommand(parsed) {
       return null;
   }
 }
-function version() {
-  try {
-    const pkg = JSON.parse(
-      readFileSync6(
-        join6(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
-        "utf8"
-      )
-    );
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
 
 // src/index.ts
 async function main(argv = process.argv.slice(2)) {
@@ -13132,20 +14160,14 @@ async function main(argv = process.argv.slice(2)) {
   const output = new Output(parsed.flags.json, parsed.flags.debug);
   if (parsed.unknown.length > 0) {
     output.fail(
-      new NaroError(
-        "VALIDATION_FAILED",
-        secretFlagProblem(parsed.unknown) ?? `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`
-      )
+      new NaroError("VALIDATION_FAILED", unknownOptionProblem(parsed))
     );
     return;
   }
   const routed = route(parsed);
   if (!routed) {
     output.fail(
-      new NaroError(
-        "VALIDATION_FAILED",
-        `Unknown command: ${[parsed.command, ...parsed.positionals].join(" ")}. See \`naro help\`.`
-      )
+      new NaroError("VALIDATION_FAILED", unknownCommandMessage(parsed))
     );
     return;
   }