naro-cli 0.24.0 → 0.25.0

package/dist/{chunk-XJIWWZ2T.js → chunk-R4XGSZQL.js}

@@ -310,6 +310,13 @@ function sanitizeRoutes(value) {
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
 
+// ../../packages/core/src/brand-case.ts
+var CLI_WORDS = "analytics|auth|backend|cancel|confirm|db|deploy|deployments|domains|env|environments|filters|functions|gen|git|insights|inspect|link|login|logout|logs|migration|policy|project|projects|promote|protection|realtime|secrets|storage|token|unlink|usage|whoami|dev|init|help|version|rollback";
+var IDENTIFIER = new RegExp(
+  `(?:[@_\\-/.:$]naro\\b|\\bnaro[_\\-/:]|\\bnaro\\.\\w|\\bnaro (?:${CLI_WORDS}) (?:[a-z][a-z-]*|--)|\\bnaro --|\\bnaro (?:\u2026|\\.\\.\\.)|\\bnaro [a-z][a-z-]*:)`,
+  "g"
+);
+
 // ../../packages/core/src/deployment.ts
 var PHASES = [
   "QUEUED",
@@ -453,7 +460,7 @@ function quoted(span, slug, switchContext) {
   }
 }
 var QUOTED = /`(naro [^`\n]+)`/g;
-var BARE = /(?<![`\w/-])naro ([a-z]+)((?: [a-z][a-z-]*)*)/g;
+var BARE = /(?<![`\w/-])naro ([a-z]+)((?: (?!naro\b)[a-z][a-z-]*)*)/g;
 function bare(match, command, rest, after, slug, switchContext) {
   const vocabulary = SUBCOMMANDS[command];
   if (vocabulary === void 0) return match;
@@ -463,7 +470,7 @@ function bare(match, command, rest, after, slug, switchContext) {
   if (count2 === 0) return match;
   const head = ["naro", command, ...words.slice(0, count2)];
   const tail = words.slice(count2);
-  const following = after.split(/\n|[.;,)](?:\s|$)/, 1)[0] ?? "";
+  const following = after.split(/\n|[.;,)](?:\s|$)|\uE000/, 1)[0] ?? "";
   if (/(?:^|\s)--env[\s=]/.test(following) || after.startsWith(` \u2014 ${PRODUCTION_SWITCH_NOTE}`))
     return match;
   const shown = head.join(" ");
@@ -633,7 +640,13 @@ var DEPLOYMENT_ERROR_CODES = [
   /** A deployment failure: the environment was deleted before its deployment finished. */
   "ENVIRONMENT_DELETED",
   /** The edge refused the environment's protection change; the database change is rolled back. */
-  "ENVIRONMENT_PROTECTION_PUBLISH_FAILED"
+  "ENVIRONMENT_PROTECTION_PUBLISH_FAILED",
+  /** The variable came from the Supabase connection; only its card changes it (spec 2026-11-04 §6.3). */
+  "ENV_MANAGED",
+  /** The 10-minute Supabase sign-in cookie is gone or expired (spec 2026-11-04 §6.4). */
+  "SUPABASE_SESSION_EXPIRED",
+  /** The Supabase Management API refused or did not answer (spec 2026-11-04 §6.4). */
+  "SUPABASE_API_FAILED"
 ];
 var DeploymentError = class extends Error {
   code;
@@ -650,6 +663,15 @@ var DeploymentError = class extends Error {
 // ../../packages/core/src/functions.ts
 var FUNCTION_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
 var FUNCTION_WORKER_NAME_PREFIX = "naro-fn-";
+var FUNCTION_INVOKE_METHODS = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+];
+var FUNCTION_INVOKE_MAX_RESPONSE_BYTES = 65536;
+var FUNCTION_INVOKE_TIMEOUT_MS = 12e4;
 function isFunctionName(name) {
   return FUNCTION_NAME_RE.test(name);
 }
@@ -710,6 +732,33 @@ function projectPath(teamSlug, projectSlug) {
 // ../../packages/core/src/platform-mail.ts
 var encoder = new TextEncoder();
 
+// ../../packages/core/src/read-capped.ts
+async function readCapped(response, limit) {
+  const reader = response.body?.getReader();
+  if (!reader) return { text: "", truncated: false };
+  const chunks = [];
+  let size = 0;
+  while (size <= limit) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    size += value.byteLength;
+  }
+  if (size > limit) await reader.cancel().catch(() => void 0);
+  const all = new Uint8Array(Math.min(size, limit));
+  let offset = 0;
+  for (const chunk of chunks) {
+    const part = chunk.subarray(
+      0,
+      Math.min(chunk.byteLength, all.byteLength - offset)
+    );
+    all.set(part, offset);
+    offset += part.byteLength;
+    if (offset >= all.byteLength) break;
+  }
+  return { text: new TextDecoder().decode(all), truncated: size > limit };
+}
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15614,7 +15663,7 @@ var REQUESTS = {
     blocked: "Sites on this team answer 503 until the month ends (UTC).",
     running: "Sites keep running for now.",
     button: "View usage",
-    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on naro.`
+    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on Naro.`
   },
   ko: {
     subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
@@ -15624,7 +15673,7 @@ var REQUESTS = {
     blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
     running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
     button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
-    footer: (team) => `naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
+    footer: (team) => `Naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
   },
   ja: {
     subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
@@ -15634,7 +15683,7 @@ var REQUESTS = {
     blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
     running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
     button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
-    footer: (team) => `naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
+    footer: (team) => `Naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
   }
 };
 var BUILDS = {
@@ -16342,7 +16391,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
   if (await exists3(workerEntryPath)) {
     throw new DeploymentError(
       "ARTIFACT_INVALID",
-      `The project already has a ${GENERATED_WORKER_ENTRY}. naro writes its vinext Worker entry under that name and will not overwrite a file of the project's.`
+      `The project already has a ${GENERATED_WORKER_ENTRY}. Naro writes its vinext Worker entry under that name and will not overwrite a file of the project's.`
     );
   }
   const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
@@ -16395,7 +16444,7 @@ function parseVinextCheckReport(output) {
   const plain = output.replace(ANSI_ESCAPE, "");
   const match = SUMMARY_LINE.exec(plain);
   if (!match) return null;
-  const issueLines = [
+  const issueLines2 = [
     ...new Set(
       plain.split("\n").map((line) => ISSUE_LINE.exec(line)?.[1]?.trim()).filter((line) => Boolean(line))
     )
@@ -16410,7 +16459,7 @@ function parseVinextCheckReport(output) {
     supported: Number(match[2]),
     partial: Number(match[3]),
     issues: Number(match[4]),
-    issueLines,
+    issueLines: issueLines2,
     partialLines
   };
 }
@@ -16762,10 +16811,10 @@ async function angularOutput(root) {
   } catch {
     workspace = null;
   }
-  const project = Object.values(workspace?.projects ?? {}).find(
+  const project2 = Object.values(workspace?.projects ?? {}).find(
     (entry) => entry.projectType === "application"
   );
-  const build = project?.architect?.build;
+  const build = project2?.architect?.build;
   const outputPath = build?.options?.outputPath;
   const legacy = build?.builder?.endsWith(":browser") ?? false;
   const clean = (path) => path.replace(/^\.?\/+/, "").replace(/\/+$/, "");
@@ -16777,7 +16826,7 @@ async function angularOutput(root) {
       ""
     );
   const name = Object.entries(workspace?.projects ?? {}).find(
-    ([, entry]) => entry === project
+    ([, entry]) => entry === project2
   )?.[0];
   if (name) return `dist/${name}/browser`;
   throw new DeploymentError(
@@ -19681,13 +19730,13 @@ function page(options) {
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${title} \xB7 naro</title>
+<title>${title} \xB7 Naro</title>
 <link rel="icon" href="${FAVICON}">
 <style>:root{--tone:${tone.color};--tone-soft:${tone.soft};--tone-edge:${tone.edge};--glow:${tone.glow}}${STYLES}</style>
 </head>
 <body>
 <main class="card">
-  <span class="brand"><span class="brand-mark">n</span>naro</span>
+  <span class="brand"><span class="brand-mark">n</span>Naro</span>
   <div class="glyph">${tone.icon}</div>
   <h1>${title}</h1>
   <p>${escapeHtml(options.message)}</p>
@@ -19976,6 +20025,271 @@ function openBrowser(url2) {
   child.unref();
 }
 
+// ../../packages/sdk/src/dns.ts
+var DnsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(teamSlug, suffix = "") {
+    return `/api/teams/${encodeURIComponent(teamSlug)}/dns-zones${suffix}`;
+  }
+  zone(teamSlug, zoneId, suffix = "") {
+    return this.base(teamSlug, `/${encodeURIComponent(zoneId)}${suffix}`);
+  }
+  /** The team's zones and the project domains each one could carry. */
+  async state(teamSlug) {
+    return this.client.request(this.base(teamSlug), {
+      context: "Read naro DNS"
+    });
+  }
+  /** Starts moving a domain onto naro DNS; the zone answers its name servers. */
+  async addZone(teamSlug, name) {
+    const body = await this.client.request(
+      this.base(teamSlug),
+      { method: "POST", body: { name }, context: "Start a DNS move" }
+    );
+    return body.zone;
+  }
+  /** Cancels a move, or takes an active zone off naro DNS. */
+  async removeZone(teamSlug, zoneId) {
+    await this.client.request(this.zone(teamSlug, zoneId), {
+      method: "DELETE",
+      context: "Remove a DNS zone"
+    });
+  }
+  /** Reads the zone's status and asks Cloudflare for an activation check. */
+  async check(teamSlug, zoneId) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/check"),
+      { method: "POST", context: "Check a DNS zone" }
+    );
+    return body.zone;
+  }
+  /** The mail records (MX, SPF, DMARC, DKIM) to keep before the move. */
+  async mailCheck(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/precheck"),
+      { context: "Check mail records" }
+    );
+  }
+  /** The records Cloudflare's scan of the current DNS found. */
+  async scan(teamSlug, zoneId) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/scan"),
+      { context: "Read the DNS scan" }
+    );
+    return body.records;
+  }
+  /** Adds every scanned record to the zone. */
+  async importScan(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/scan"),
+      { method: "POST", context: "Import the DNS scan" }
+    );
+  }
+  async records(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/records"),
+      { context: "List DNS records" }
+    );
+  }
+  /** Adds a record, always DNS only. */
+  async addRecord(teamSlug, zoneId, input) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/records"),
+      { method: "POST", body: input, context: "Add a DNS record" }
+    );
+    return body.record;
+  }
+  /** Overwrites the whole record; its type cannot change. */
+  async replaceRecord(teamSlug, zoneId, recordId, input) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, `/records/${encodeURIComponent(recordId)}`),
+      { method: "PATCH", body: input, context: "Change a DNS record" }
+    );
+    return body.record;
+  }
+  async removeRecord(teamSlug, zoneId, recordId) {
+    await this.client.request(
+      this.zone(teamSlug, zoneId, `/records/${encodeURIComponent(recordId)}`),
+      { method: "DELETE", context: "Remove a DNS record" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/edge-config.ts
+var project = (projectId, suffix) => `/api/projects/${encodeURIComponent(projectId)}${suffix}`;
+var FirewallApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      project(projectId, "/firewall"),
+      { context: "List firewall rules" }
+    );
+    return body.rules;
+  }
+  /** `VALIDATION_FAILED` for a bad kind or value, `RULE_LIMIT` past the cap. */
+  async add(projectId, input) {
+    const body = {
+      kind: input.kind,
+      value: input.value
+    };
+    if (input.rateLimit !== void 0) body.rate_limit = input.rateLimit;
+    if (input.periodSeconds !== void 0)
+      body.period_seconds = input.periodSeconds;
+    if (input.enabled !== void 0) body.enabled = input.enabled;
+    const answer = await this.client.request(
+      project(projectId, "/firewall"),
+      { method: "POST", body, context: "Add firewall rule" }
+    );
+    return answer.rule;
+  }
+  async setEnabled(projectId, ruleId, enabled) {
+    const answer = await this.client.request(
+      project(projectId, `/firewall/${encodeURIComponent(ruleId)}`),
+      { method: "PATCH", body: { enabled }, context: "Change firewall rule" }
+    );
+    return answer.rule;
+  }
+  async remove(projectId, ruleId) {
+    await this.client.request(
+      project(projectId, `/firewall/${encodeURIComponent(ruleId)}`),
+      { method: "DELETE", context: "Remove firewall rule" }
+    );
+  }
+};
+var FlagsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      project(projectId, "/flags"),
+      { context: "List flags" }
+    );
+    return body.flags;
+  }
+  /** Off unless `enabled`. `FLAG_LIMIT` past 32. */
+  async add(projectId, name, enabled = false) {
+    const answer = await this.client.request(
+      project(projectId, "/flags"),
+      { method: "POST", body: { name, enabled }, context: "Add flag" }
+    );
+    return answer.flag;
+  }
+  async setEnabled(projectId, flagId, enabled) {
+    const answer = await this.client.request(
+      project(projectId, `/flags/${encodeURIComponent(flagId)}`),
+      { method: "PATCH", body: { enabled }, context: "Change flag" }
+    );
+    return answer.flag;
+  }
+  async remove(projectId, flagId) {
+    await this.client.request(
+      project(projectId, `/flags/${encodeURIComponent(flagId)}`),
+      { method: "DELETE", context: "Remove flag" }
+    );
+  }
+};
+var BindingsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      project(projectId, "/storage"),
+      { context: "List storage bindings" }
+    );
+    return body.storage;
+  }
+  /**
+   * Makes the Cloudflare resource and binds it at the next deploy.
+   * `VALIDATION_FAILED` for a bad type or binding name (ASSETS and DB are
+   * reserved), `STORAGE_PROVISION_FAILED` (502) when Cloudflare refused.
+   */
+  async add(projectId, type, bindingName) {
+    const answer = await this.client.request(
+      project(projectId, "/storage"),
+      {
+        method: "POST",
+        body: { type, bindingName },
+        context: "Add storage binding"
+      }
+    );
+    return answer.storage;
+  }
+  /**
+   * Deletes the Cloudflare resource and what it holds — it cannot be undone.
+   * `STORAGE_MANAGED` refuses the Naro database.
+   */
+  async remove(projectId, bindingId) {
+    await this.client.request(
+      project(projectId, `/storage/${encodeURIComponent(bindingId)}`),
+      { method: "DELETE", context: "Remove storage binding" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/ops.ts
+var BillingApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** `usage.read`: `403 FORBIDDEN "Your role cannot read this team's billing."` otherwise. */
+  async get(teamSlug) {
+    const body = await this.client.request(`/api/teams/${encodeURIComponent(teamSlug)}/billing`, {
+      context: "Read billing"
+    });
+    return {
+      team: body.team,
+      subscription: body.subscription,
+      canManage: body.canManage,
+      overage: body.overage
+    };
+  }
+};
+var ObservabilityApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** 7d unless given; `400 VALIDATION_FAILED "range must be 24h, 7d or 30d."` otherwise. */
+  async report(projectId, options = {}) {
+    const query = options.range === void 0 ? "" : `?range=${encodeURIComponent(options.range)}`;
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/observability${query}`,
+      { context: "Read observability" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/supabase-links.ts
+var SupabaseApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async links(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/supabase`,
+      { context: "Read Supabase links" }
+    );
+    return body.links;
+  }
+  /**
+   * Removes the link of one target (production, preview or an environment's
+   * slug), or every link the role may write when `target` is left out, with
+   * the env rows they hold. Answers how many went.
+   */
+  async disconnect(projectId, options = {}) {
+    const query = options.target === void 0 ? "" : `?target=${encodeURIComponent(options.target)}`;
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/supabase${query}`,
+      { method: "DELETE", context: "Disconnect Supabase" }
+    );
+  }
+};
+
 // ../../packages/sdk/src/environments.ts
 function isReservedEnvTarget(value) {
   return RESERVED_ENVIRONMENT_SLUGS.includes(value);
@@ -20110,6 +20424,13 @@ var NaroClient = class _NaroClient {
   deployments;
   env;
   domains;
+  dns;
+  firewall;
+  flags;
+  bindings;
+  billing;
+  observability;
+  supabase;
   logs;
   db;
   backend;
@@ -20133,6 +20454,13 @@ var NaroClient = class _NaroClient {
     this.deployments = new DeploymentsApi(this);
     this.env = new EnvApi(this);
     this.domains = new DomainsApi(this);
+    this.dns = new DnsApi(this);
+    this.firewall = new FirewallApi(this);
+    this.flags = new FlagsApi(this);
+    this.bindings = new BindingsApi(this);
+    this.billing = new BillingApi(this);
+    this.observability = new ObservabilityApi(this);
+    this.supabase = new SupabaseApi(this);
     this.logs = new LogsApi(this);
     this.db = new DbApi(this);
     this.backend = new BackendApi(this);
@@ -20217,7 +20545,93 @@ var TeamsApi = class {
       { context: "Read team usage" }
     );
   }
+  path(teamSlug, suffix = "") {
+    return `/api/teams/${encodeURIComponent(teamSlug)}${suffix}`;
+  }
+  /** A new team, owned by the caller. `TEAM_SLUG_TAKEN` (409) for a slug in use. */
+  async create(slug, name) {
+    const body = await this.client.request("/api/teams", {
+      method: "POST",
+      body: { slug, name },
+      context: "Create team"
+    });
+    return teamSummary(body.team);
+  }
+  /** Renames the team or changes its slug (`team.update`); only the fields given. */
+  async update(teamSlug, patch) {
+    const body = await this.client.request(
+      this.path(teamSlug),
+      { method: "PATCH", body: patch, context: "Update team" }
+    );
+    return teamSummary(body.team);
+  }
+  /**
+   * Deletes the team with its projects and their data. Owner only;
+   * `PERSONAL_TEAM` and `SUBSCRIPTION_ACTIVE` (cancel the subscription first)
+   * refuse it. The route tears every project down before it answers, so this
+   * waits two minutes, like `projects.delete`.
+   */
+  async delete(teamSlug) {
+    await this.client.request(this.path(teamSlug), {
+      method: "DELETE",
+      context: "Delete team",
+      timeoutMs: PROVISION_TIMEOUT_MS
+    });
+  }
+  /** The members the caller may see: all of them with `team.read`, else only themselves. */
+  async members(teamSlug) {
+    const body = await this.client.request(
+      this.path(teamSlug, "/members"),
+      { context: "List team members" }
+    );
+    return body.members;
+  }
+  /** `team.members.manage`; `LAST_OWNER` (409) keeps the team's last owner. */
+  async setMemberRole(teamSlug, userId, role) {
+    await this.client.request(
+      this.path(teamSlug, `/members/${encodeURIComponent(userId)}`),
+      { method: "PATCH", body: { role }, context: "Change member role" }
+    );
+  }
+  /** Removes a member, or leaves the team when it is the caller. */
+  async removeMember(teamSlug, userId) {
+    await this.client.request(
+      this.path(teamSlug, `/members/${encodeURIComponent(userId)}`),
+      { method: "DELETE", context: "Remove member" }
+    );
+  }
+  async invites(teamSlug) {
+    const body = await this.client.request(
+      this.path(teamSlug, "/invites"),
+      { context: "List invites" }
+    );
+    return body.invites;
+  }
+  /**
+   * A new invite link; with `email` the control plane also mails it.
+   * `PERSONAL_TEAM` refuses a personal team, `INVALID_EMAIL` a bad address.
+   */
+  async createInvite(teamSlug, options = {}) {
+    return this.client.request(
+      this.path(teamSlug, "/invites"),
+      { method: "POST", body: options, context: "Create invite" }
+    );
+  }
+  async revokeInvite(teamSlug, inviteId) {
+    await this.client.request(
+      this.path(teamSlug, `/invites/${encodeURIComponent(inviteId)}`),
+      { method: "DELETE", context: "Revoke invite" }
+    );
+  }
 };
+function teamSummary(row) {
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    isPersonal: row.is_personal
+  };
+}
 var ProjectsApi = class {
   constructor(client) {
     this.client = client;
@@ -20236,6 +20650,28 @@ var ProjectsApi = class {
     );
     return projectInfo(body.project);
   }
+  /**
+   * Deletes the project and everything under it: its workers, its D1 and
+   * Storage, its domains, environments and deployment history. It cannot be
+   * undone. `project.delete` (owner and admin); a suspended project is `403
+   * FORBIDDEN`, one that is gone or out of sight `404 NOT_FOUND`. Only the
+   * CLI calls it, behind typing the name — naro-mcp has no tool for it
+   * (project_cli_mcp_backlog #6).
+   *
+   * Two minutes, like `backend.enable`: the route answers only after it has
+   * torn down the workers, D1s, backends and environments one after another
+   * (PR #420 review). A TIMEOUT does not mean the project is still there.
+   */
+  async delete(projectId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      {
+        method: "DELETE",
+        context: "Delete project",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+  }
   /**
    * Connects a project to a GitHub repository, turning `git push` into a
    * deployment.
@@ -20269,6 +20705,52 @@ var ProjectsApi = class {
     );
     return projectInfo(body.project);
   }
+  /**
+   * The dashboard's General settings: only the fields given are sent, and the
+   * control plane checks them (`400 VALIDATION_FAILED "Check the project
+   * settings."`, `SUBDOMAIN_INVALID`, `SUBDOMAIN_RESERVED`, `409
+   * SUBDOMAIN_TAKEN`). A new subdomain moves the project's URL at once: the
+   * old `{subdomain}.naro.sh` stops answering. Build settings need
+   * `project.update`.
+   */
+  async update(projectId, patch) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      { method: "PATCH", body: patch, context: "Update project" }
+    );
+    return projectInfo(body.project);
+  }
+  /** Whether a subdomain is free: `reason` is `taken`, `reserved` or the format problem. */
+  async subdomainAvailability(name) {
+    return this.client.request(
+      `/api/subdomains/availability?name=${encodeURIComponent(name)}`,
+      { context: "Check subdomain" }
+    );
+  }
+  /** The project roles given to the team's contributors. */
+  async access(projectId) {
+    const body = await this.client.request(`/api/projects/${encodeURIComponent(projectId)}/access`, {
+      context: "List project access"
+    });
+    return body.assignments;
+  }
+  /** Gives a contributor a project role (`project.update`); a member of another role is refused. */
+  async grantAccess(projectId, userId, role) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/access`,
+      {
+        method: "PUT",
+        body: { userId, role },
+        context: "Grant project access"
+      }
+    );
+  }
+  async revokeAccess(projectId, userId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/access?userId=${encodeURIComponent(userId)}`,
+      { method: "DELETE", context: "Revoke project access" }
+    );
+  }
 };
 var GithubApi = class {
   constructor(client) {
@@ -20510,7 +20992,7 @@ var EnvApi = class {
    */
   async takenBindingNames(projectId) {
     const base2 = `/api/projects/${encodeURIComponent(projectId)}`;
-    const [storage, project] = await Promise.all([
+    const [storage, project2] = await Promise.all([
       this.client.request(
         `${base2}/storage`,
         { context: "List storage" }
@@ -20524,7 +21006,7 @@ var EnvApi = class {
       STATIC_ASSETS_BINDING,
       ...storage.storage.map((row) => row.bindingName)
     ]);
-    if (project.project.database_provider === "d1")
+    if (project2.project.database_provider === "d1")
       names.add(MANAGED_DATABASE_BINDING);
     return [...names];
   }
@@ -21816,6 +22298,41 @@ var StorageApi = class {
     );
     return body.objects;
   }
+  /**
+   * One object under another name in its bucket (Storage 3-1i), moved by the
+   * project's Naro worker with the stored service key. It never replaces an
+   * object (`409 OBJECT_EXISTS`); both names are held to the name rules
+   * (`INVALID_PATH`). An old worker answers `NOT_FOUND` until
+   * `naro backend enable` updates it.
+   */
+  async moveObject(projectId, bucket, from, to) {
+    return this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/move"),
+      { method: "POST", body: { from, to }, context: "Move an object" }
+    );
+  }
+  /**
+   * A token that lets whoever holds it upload `path` once, for two hours,
+   * without a key (Storage 3-1e §4.5) — the bytes go straight to the
+   * project's worker, never through the control plane. `upsert` lets it
+   * replace a file that is there (`409 OBJECT_EXISTS` otherwise, at upload).
+   * `signedUrl` is built the worker's way: each path segment encoded.
+   */
+  async createUploadUrl(projectId, bucket, path, options = {}) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/upload-url"),
+      {
+        method: "POST",
+        body: { path, ...options.upsert === true && { upsert: true } },
+        context: "Create an upload URL"
+      }
+    );
+    const encoded = body.path.split("/").map(encodeURIComponent).join("/");
+    return {
+      ...body,
+      signedUrl: `${body.url}/_naro/v1/storage/object/upload/sign/${encodeURIComponent(bucket)}/${encoded}?token=${encodeURIComponent(body.token)}`
+    };
+  }
   /**
    * A link that downloads one object without a key, for `expiresIn` seconds
    * (1–3600 through the control plane; `VALIDATION_FAILED` past it), on the
@@ -23400,10 +23917,10 @@ var REALTIME_COMMAND_PROBLEM = "realtime.messages takes SELECT, INSERT and ALL p
 var REALTIME_COLUMNS_PROBLEM = "realtime.messages policies are checked once per join, so they can read topic, extension and private only";
 var REALTIME_TOPIC_PROBLEM = "realtime.topic() is available only in policies of realtime.messages";
 function quotedRealtimeMessagesProblem(written) {
-  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Realtime: write realtime.messages, without quotes, for Realtime's messages`;
+  return `a table named "${written}" cannot be used in policies, as Naro keeps the name for Realtime: write realtime.messages, without quotes, for Realtime's messages`;
 }
 function quotedRealtimeAliasProblem(written) {
-  return `an alias named "${written}" cannot be used in policies, as naro keeps the name for Realtime: give the subquery another alias`;
+  return `an alias named "${written}" cannot be used in policies, as Naro keeps the name for Realtime: give the subquery another alias`;
 }
 function realtimeFunctionProblem(name) {
   return `function realtime.${name} is not available in policies: use realtime.topic()`;
@@ -23888,7 +24405,7 @@ function storageHelperColumnProblem(fn) {
   return `storage.${fn}() takes the name column of storage.objects`;
 }
 function quotedStorageObjectsProblem(written) {
-  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Storage: write storage.objects, without quotes, for Storage's objects`;
+  return `a table named "${written}" cannot be used in policies, as Naro keeps the name for Storage: write storage.objects, without quotes, for Storage's objects`;
 }
 function count(state, token) {
   if (++state.nodes > MAX_EXPRESSION_NODES)
@@ -24346,7 +24863,7 @@ function readTableName(stream) {
   if (stream.acceptOperator(".")) {
     if (first.quoted ? name !== "public" : asciiLower(name) !== "public")
       throw new PolicySyntaxError(
-        `schema ${name} does not exist: naro's tables are in public`,
+        `schema ${name} does not exist: Naro's tables are in public`,
         first.position
       );
     token = stream.peek();
@@ -24457,7 +24974,7 @@ function readJwtAccess(stream) {
   const next = stream.peek();
   if (isOperator(next, "->") || isOperator(next, "->>"))
     throw new PolicySyntaxError(
-      "naro's auth.jwt() claims are not nested",
+      "Naro's auth.jwt() claims are not nested",
       next.position
     );
   return {
@@ -24556,7 +25073,7 @@ function readPrimary(state) {
         stream.next();
         if (isOperator(stream.peek(), "(") || isOperator(stream.peek(), "."))
           throw new PolicySyntaxError(
-            `${token.value}.${name.value} is not a column: naro reads column or table.column`,
+            `${token.value}.${name.value} is not a column: Naro reads column or table.column`,
             token.position
           );
         return { kind: "column", qualifier: token.value, name: name.value };
@@ -24609,7 +25126,7 @@ function readRealtimeColumn(state) {
   const next = stream.peek();
   if (isOperator(next, "(") || isOperator(next, "."))
     throw new PolicySyntaxError(
-      `realtime.messages.${name} is not a column: naro reads realtime.messages.column`,
+      `realtime.messages.${name} is not a column: Naro reads realtime.messages.column`,
       next.position
     );
   return { kind: "column", qualifier: REALTIME_MESSAGES, name };
@@ -26531,7 +27048,7 @@ function textTruthProblem(snapshot, table, expr, names = [asciiLower(table.name)
 function selectCheckRefusal(path, column2, problem) {
   const reason = {
     generated: `is not available: the select policy reads the generated column ${column2}, which a new row cannot be checked against`,
-    collation: `is not available: the select policy reads ${column2}, whose collation naro cannot read, so a new row cannot be checked against it`,
+    collation: `is not available: the select policy reads ${column2}, whose collation Naro cannot read, so a new row cannot be checked against it`,
     pattern: `is not available: the select policy compares the number column ${column2} with like or ilike, which a new row cannot be checked against`,
     textual: `is not available: the select policy turns the number column ${column2} into text, which a new row cannot be checked against`,
     readBack: `is not available: the select policy reads ${column2}, a number in a column that declares no number type, as text, which a new row cannot be checked against`,
@@ -26929,7 +27446,7 @@ function checkProblemReason(column2, problem) {
     case "generated":
       return `${column2} is a generated column, which a WITH CHECK cannot read (an update policy without WITH CHECK checks its USING)`;
     case "collation":
-      return `${column2} has a collation naro cannot read, which a WITH CHECK needs to compare it`;
+      return `${column2} has a collation Naro cannot read, which a WITH CHECK needs to compare it`;
     case "pattern":
       return `${column2} is a number column, which a WITH CHECK cannot compare with LIKE or ILIKE`;
     case "textual":
@@ -26945,7 +27462,7 @@ function usingProblemReason(name, problem) {
     case "generated":
       return `${name} is a generated column, which a USING judged on a row's values cannot read`;
     case "collation":
-      return `${name} has a collation naro cannot read, which a USING judged on a row's values needs to compare it`;
+      return `${name} has a collation Naro cannot read, which a USING judged on a row's values needs to compare it`;
     case "pattern":
       return `${name} is a number column, which a USING judged on a row's values cannot compare with LIKE or ILIKE`;
     case "textual":
@@ -27343,7 +27860,7 @@ function checkCase(table, terms, guard, pass, action, nonce) {
       fail(
         invalidQuery(
           action === "insert" ? "returning" : "values",
-          `is not available: naro cannot read the schema of ${table.name}, so a new row cannot be checked against its select policy`
+          `is not available: Naro cannot read the schema of ${table.name}, so a new row cannot be checked against its select policy`
         )
       );
     fail(policyInvalid(first.policy, action));
@@ -27505,7 +28022,7 @@ function checkFragment(target2, req, snapshot, command, row, nonce, stored, with
     const first = terms.find((term) => term.policy !== void 0)?.policy;
     return fail(
       first ? policyInvalid(first, command) : dataError("INTERNAL_ERROR"),
-      `naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
+      `Naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
     );
   }
   return [schemaGuard(name, sql, command, checked), ...guards, ...terms];
@@ -28686,7 +29203,7 @@ var Reader = class {
       }
       if (this.takeWord("WHERE")) top.resolved.push(this.where());
       this.returning(top.resolved);
-    } else throw new Unreadable("not a statement naro compiles");
+    } else throw new Unreadable("not a statement Naro compiles");
     return top;
   }
 };
@@ -30826,9 +31343,9 @@ var SYSTEM_MIGRATIONS = [
 ];
 
 // ../../packages/data-core/src/policy-migration.ts
-var GRANT_REFUSAL = "naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
+var GRANT_REFUSAL = "Naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
 function disableRefusal(table) {
-  return `naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${policyTableSql(table)} USING (true) WITH CHECK (true);`;
+  return `Naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${policyTableSql(table)} USING (true) WITH CHECK (true);`;
 }
 function isStorageObjects(table) {
   return asciiLower(table) === STORAGE_OBJECTS;
@@ -31549,6 +32066,159 @@ function lintSchema(input) {
   ];
 }
 
+// ../../packages/sdk/src/lint-database.ts
+function hasCode(error51, code) {
+  return typeof error51 === "object" && error51 !== null && error51.code === code;
+}
+var DIAGNOSTICS_SQL = [
+  `SELECT name FROM sqlite_master WHERE type = 'trigger' AND ${systemTablePredicate("name")} ORDER BY name;`,
+  "SELECT name, type FROM pragma_table_list WHERE schema = 'main' AND type IN ('virtual', 'shadow') ORDER BY name;",
+  "SELECT * FROM pragma_quick_check;",
+  "SELECT * FROM pragma_foreign_key_check;"
+].join("\n");
+var POLICIES_TRUNCATED_NOTICE = "\u26A0 The policies were cut at 10,000 rows, so they were not checked.";
+var POLICY_TABLE_PROBE = `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '${NAMED_POLICY_TABLE}'`;
+var POLICY_READ_SQL = [NAMED_POLICY_SQL.list, INDEX_SQL, ...SCHEMA_SQL].map((sql) => `${sql};`).join("\n");
+function objectsOf(statement2) {
+  return statement2.rows.map(
+    (row) => Object.fromEntries(
+      statement2.columns.map((column2, index) => [column2, row[index]])
+    )
+  );
+}
+async function readPolicies(client, projectId, warn2) {
+  let backend;
+  try {
+    backend = await client.backend.info(projectId);
+  } catch (error51) {
+    if (hasCode(error51, "BACKEND_DISABLED")) return void 0;
+    throw error51;
+  }
+  if (backend.status === "none") return void 0;
+  const probe = await client.db.query(projectId, {
+    sql: POLICY_TABLE_PROBE,
+    readOnly: true
+  });
+  if ((probe.statements[0]?.rows.length ?? 0) === 0) return void 0;
+  const answer = await client.db.query(projectId, { sql: POLICY_READ_SQL });
+  const [stored, indexes, ...schema] = answer.statements;
+  const expected = SCHEMA_SQL.length + 2;
+  if (stored === void 0 || indexes === void 0 || answer.statements.length !== expected)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The policies could not be read: the database answered with ${String(answer.statements.length)} result sets instead of ${String(expected)}.`
+    );
+  if (answer.truncated) {
+    warn2(POLICIES_TRUNCATED_NOTICE);
+    return void 0;
+  }
+  const policies = [];
+  const unreadable = [];
+  for (const row of objectsOf(stored)) {
+    const policy = loadPolicy(row);
+    if (policy === void 0) continue;
+    if (policy.invalid !== null)
+      unreadable.push({
+        table: policy.table,
+        name: policy.name,
+        reason: policy.invalid
+      });
+    else
+      policies.push({
+        table: policy.table,
+        name: policy.name,
+        permissive: policy.permissive,
+        command: policy.command,
+        roles: policy.roles,
+        using: policy.using,
+        check: policy.check,
+        owner: policy.owner
+      });
+  }
+  const snapshot = snapshotFromRows(schema.flatMap(objectsOf));
+  return {
+    tables: tableNames(snapshot),
+    policies,
+    unreadable,
+    snapshot,
+    indexes: indexesFromRows(objectsOf(indexes))
+  };
+}
+function firstCell(row) {
+  const value = row[0];
+  return value === null || value === void 0 ? "" : String(value);
+}
+function rowidOf(text3) {
+  if (text3 === "") return null;
+  const value = Number(text3);
+  return Number.isFinite(value) ? value : null;
+}
+async function lintDatabase(client, projectId, warn2) {
+  const tables = await client.db.tables(projectId);
+  const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
+  const [triggers, objects, quick, broken] = answer.statements;
+  if (triggers === void 0 || objects === void 0 || quick === void 0 || broken === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The diagnostics could not be read: the database answered with ${String(answer.statements.length)} result sets instead of 4.`
+    );
+  const virtualTables = [];
+  const shadow = /* @__PURE__ */ new Set();
+  for (const row of objects.rows) {
+    const name = cellText(objects, row, "name");
+    if (cellText(objects, row, "type") === "shadow") shadow.add(name);
+    else virtualTables.push(name);
+  }
+  const foreignKeyCheck = broken.rows.map((row) => ({
+    table: cellText(broken, row, "table"),
+    rowid: rowidOf(cellText(broken, row, "rowid")),
+    parent: cellText(broken, row, "parent")
+  }));
+  const policies = await readPolicies(client, projectId, warn2);
+  const input = {
+    tables: tables.filter((table) => !shadow.has(table.name)),
+    foreignKeyCheck,
+    quickCheck: quick.rows.map(firstCell),
+    triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
+    virtualTables,
+    ...policies === void 0 ? {} : { policies }
+  };
+  const issues = lintSchema(input);
+  const errors = issues.filter((issue2) => issue2.severity === "error").length;
+  return {
+    issues,
+    errors,
+    warnings: issues.length - errors,
+    tables: countLintedTables(input),
+    truncated: answer.truncated
+  };
+}
+
+// ../../packages/sdk/src/migration-repair.ts
+var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
+var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
+var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
+var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
+function withoutSuffix(key) {
+  return key.endsWith(".sql") ? key.slice(0, -".sql".length) : key;
+}
+var MIGRATION_NAME_MESSAGE = "name must end with .sql and contain only letters, digits, _ . -";
+function repairIsNoop(ledger, key, status) {
+  const recorded = ledger.some(
+    (row) => row.name === key || row.name === withoutSuffix(key)
+  );
+  return status === "applied" ? recorded : !recorded;
+}
+async function repairLedger(client, projectId, key, status, ledgerIsEmpty) {
+  if (status === "applied" && ledgerIsEmpty)
+    await client.db.query(projectId, { sql: LEDGER_DDL });
+  const answer = await client.db.query(projectId, {
+    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
+    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
+  });
+  return (answer.statements[0]?.meta.changes ?? 0) > 0;
+}
+
 // ../../packages/sdk/src/migrations.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
 import { resolve as resolve9 } from "path";
@@ -31630,7 +32300,7 @@ function migrationsPendingError(pending) {
   );
 }
 function migrationNameMismatch(sent, recorded) {
-  return `The control plane recorded the migration as ${recorded}, but naro sent ${sent} and wrote the file under that name. Until the two match, naro migration list shows them apart and naro db push would apply the file again.`;
+  return `The control plane recorded the migration as ${recorded}, but Naro sent ${sent} and wrote the file under that name. Until the two match, naro migration list shows them apart and naro db push would apply the file again.`;
 }
 
 // ../../packages/sdk/src/reset-plan.ts
@@ -32507,6 +33177,427 @@ async function copyWorkingTree(source, checkout) {
   };
 }
 
+// src/data-environment.ts
+var DATA_ENV_MESSAGES = {
+  name: "--env must be production or an environment name.",
+  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
+  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
+};
+function dataEnvironment(flags) {
+  const value = flags.env;
+  if (value === void 0 || value === "production") return null;
+  if (value === "preview")
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
+  if (environmentSlugProblem(value) !== null)
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
+  return value;
+}
+async function dataClient(context) {
+  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
+}
+function databaseName(environment) {
+  return environment === null ? "the project database" : `the ${environment} environment's database`;
+}
+function enableBackendCommand(environment) {
+  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
+}
+function envFlag(environment) {
+  return environment === null ? "" : ` --env ${environment}`;
+}
+function forEnvironment(text3, environment) {
+  return environmentGuidance(text3, environment);
+}
+
+// src/commands/migration.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { join as join27, relative as relative7 } from "path";
+
+// src/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+import { Writable } from "stream";
+function confirmHint(defaultYes) {
+  return defaultYes ? "(Y/n)" : "(y/N)";
+}
+function readConfirmAnswer(answer, defaultYes) {
+  const normalized2 = answer.trim().toLowerCase();
+  if (normalized2 === "") return defaultYes;
+  if (normalized2 === "y" || normalized2 === "yes") return true;
+  if (!defaultYes) return false;
+  if (normalized2 === "n" || normalized2 === "no") return false;
+  return null;
+}
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += String(chunk);
+  return data.replace(/\r?\n$/, "");
+}
+var TtyPrompter = class {
+  async ask(question) {
+    const rl = createInterface2({
+      input: process.stdin,
+      output: process.stdout
+    });
+    try {
+      return await new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+    } finally {
+      rl.close();
+    }
+  }
+  async askHidden(question) {
+    let muted = false;
+    const output = new Writable({
+      write(chunk, _enc, done) {
+        if (!muted) process.stdout.write(chunk);
+        done();
+      }
+    });
+    const rl = createInterface2({
+      input: process.stdin,
+      output,
+      terminal: true
+    });
+    try {
+      const answer = new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+      muted = true;
+      const value = await answer;
+      process.stdout.write("\n");
+      return value;
+    } finally {
+      rl.close();
+    }
+  }
+  async confirm(question, options = {}) {
+    const defaultYes = options.defaultYes ?? false;
+    for (; ; ) {
+      const read = readConfirmAnswer(
+        await this.ask(`${question} ${confirmHint(defaultYes)} `),
+        defaultYes
+      );
+      if (read !== null) return read;
+    }
+  }
+  async select(question, options) {
+    process.stdout.write(`${question}
+`);
+    options.forEach((option, index) => {
+      process.stdout.write(`  ${String(index + 1)}. ${option}
+`);
+    });
+    for (; ; ) {
+      const answer = Number.parseInt(
+        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
+        10
+      );
+      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
+        return answer - 1;
+    }
+  }
+};
+var NonInteractivePrompter = class {
+  constructor(assumeYes) {
+    this.assumeYes = assumeYes;
+  }
+  refuse(question) {
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
+    );
+  }
+  async ask(question) {
+    this.refuse(question);
+  }
+  async askHidden(question) {
+    this.refuse(question);
+  }
+  async confirm() {
+    return this.assumeYes;
+  }
+  async select(question) {
+    this.refuse(question);
+  }
+};
+function createPrompter(options) {
+  if (options.yes || options.json || !isInteractive())
+    return new NonInteractivePrompter(options.yes);
+  return new TtyPrompter();
+}
+
+// src/commands/confirm.ts
+function cannotAsk(context) {
+  return context.flags.json || !isInteractive();
+}
+async function confirmOrAbort(context, question) {
+  if (context.flags.yes) return;
+  if (cannotAsk(context)) {
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `${question} Re-run with --yes to confirm.`
+    );
+  }
+  const confirmed = await context.prompter.confirm(question);
+  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+}
+
+// src/commands/migration.ts
+var processStdin = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+function migrationsDir(context) {
+  return resolveMigrationsDir({
+    baseDir: context.cwd,
+    rootDirectory: context.flags.root,
+    dir: context.flags.dir
+  });
+}
+function relativeToCwd(context, path) {
+  const rel = relative7(context.cwd, path);
+  return rel === "" ? "." : rel;
+}
+async function appliedMigrations(client, projectId) {
+  try {
+    return await client.db.migrations(projectId);
+  } catch (error51) {
+    if (isNaroError(error51) && error51.code === "DATABASE_NOT_READY") return [];
+    throw error51;
+  }
+}
+var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable(text3) {
+  return text3.replace(UNPRINTABLE, "?");
+}
+function isPrintable(text3) {
+  return printable(text3) === text3;
+}
+var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
+function warningLines(message) {
+  return message.split("\n").map(
+    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
+  );
+}
+function policyProblems(dir, names) {
+  return names.flatMap((name) => {
+    const split2 = splitStatements(readFileSync7(join27(dir, name), "utf8"));
+    if (!split2.ok) return [];
+    const planned = planPolicyMigration(
+      split2.statements.map((statement2) => statement2.text)
+    );
+    return planned.ok ? [] : [{ migration: name, message: planned.message }];
+  });
+}
+function warningLine(warning) {
+  if (warning === "out-of-order")
+    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
+  if (warning === "ledger-name-missing-extension")
+    return "  \u26A0 recorded without .sql in the ledger";
+  return null;
+}
+async function runMigrationNew(context, deps = processStdin) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration new <name>"
+  );
+  const dir = migrationsDir(context);
+  const fileName = nextMigrationFileName(
+    listMigrationFiles(dir),
+    name
+  );
+  mkdirSync3(dir, { recursive: true });
+  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
+  const fromStdin = piped.length > 0;
+  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
+` : `-- Migration: ${fileName}
+`;
+  const path = join27(dir, fileName);
+  writeFileSync3(path, body, { flag: "wx" });
+  const relPath = relativeToCwd(context, path);
+  context.output.result({ file: fileName, path: relPath, fromStdin }, [
+    `\u2705 Created ${relPath}`
+  ]);
+}
+async function runMigrationList(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const migrations = compareMigrations(local, ledger);
+  const relDir = relativeToCwd(context, dir);
+  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
+    `Migrations in ${relDir} (${String(migrations.length)}):`,
+    ...migrations.flatMap((row) => {
+      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
+      const warning = warningLine(row.warning);
+      return warning ? [line, warning] : [line];
+    })
+  ];
+  context.output.result({ projectId, dir: relDir, migrations }, lines);
+}
+async function applyMigrationFiles(context, client, projectId, dir, names) {
+  const applied = [];
+  const warnings = [];
+  for (const name of names) {
+    const sql = readFileSync7(join27(dir, name), "utf8");
+    let answer;
+    try {
+      answer = await client.db.applyMigration(projectId, { name, sql });
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      for (const message of serverWarnings(error51.details))
+        for (const line of warningLines(message)) context.output.warn(line);
+      const shown = context.output.json ? name : printable(name);
+      throw new NaroError(error51.code, `${shown}: ${error51.message}`, {
+        ...error51.status === void 0 ? {} : { status: error51.status },
+        details: {
+          ...error51.details,
+          migration: name,
+          applied,
+          appliedWarnings: warnings
+        },
+        cause: error51
+      });
+    }
+    context.output.log(`\u2713 ${printable(name)}`);
+    applied.push(name);
+    for (const message of answer.warnings) {
+      warnings.push({ migration: name, message });
+      for (const line of warningLines(message)) context.output.warn(line);
+    }
+  }
+  return { applied, warnings };
+}
+function serverWarnings(details) {
+  const warnings = details?.warnings;
+  return Array.isArray(warnings) ? warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
+}
+async function runMigrationRepair(context) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration repair <name> --status applied|reverted"
+  );
+  const key = name;
+  if (!MIGRATION_NAME_RE.test(key))
+    throw new NaroError("VALIDATION_FAILED", MIGRATION_NAME_MESSAGE);
+  const status = context.flags.status;
+  if (status !== "applied" && status !== "reverted")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --status applied or --status reverted."
+    );
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const ledger = await appliedMigrations(client, projectId);
+  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
+  if (repairIsNoop(ledger, key, status)) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
+  );
+  const changed = await repairLedger(
+    client,
+    projectId,
+    key,
+    status,
+    ledger.length === 0
+  );
+  if (!changed) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  context.output.result({ name: key, status, changed: true }, [
+    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
+  ]);
+}
+async function runMigrationUp(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
+  if (pending.length === 0) {
+    context.output.result({ projectId, applied: [], pending: [] }, [
+      "No pending migrations."
+    ]);
+    return;
+  }
+  if (context.flags.dryRun) {
+    const problems2 = policyProblems(dir, pending);
+    context.output.result({ projectId, dryRun: true, pending, problems: problems2 }, [
+      `Pending migrations (${String(pending.length)}):`,
+      ...pending.map((name) => `  ${printable(name)}`),
+      ...problems2.map(
+        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
+      )
+    ]);
+    if (problems2.length > 0) process.exitCode = 1;
+    return;
+  }
+  context.output.log(`Pending migrations (${String(pending.length)}):`);
+  for (const name of pending) context.output.log(`  ${printable(name)}`);
+  await confirmOrAbort(
+    context,
+    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
+  );
+  const { applied, warnings } = await applyMigrationFiles(
+    context,
+    client,
+    projectId,
+    dir,
+    pending
+  );
+  context.output.result({ projectId, applied, pending: [], warnings }, [
+    `\u2705 Applied ${String(applied.length)} migration(s).`
+  ]);
+}
+
+// src/commands/db-lint.ts
+var TRUNCATED_NOTICE = "\u26A0 The diagnostics were cut at 10,000 rows \u2014 there may be more broken rows than these.";
+function issueLines(issues, tables) {
+  const errors = issues.filter((issue2) => issue2.severity === "error").length;
+  if (issues.length === 0)
+    return [`\u2713 No issues found in ${String(tables)} table(s).`];
+  return [
+    ...issues.map(
+      (issue2) => printable(
+        `${issue2.severity.padEnd(5)}  ${issue2.rule}  ${issue2.object}: ${issue2.message}`
+      )
+    ),
+    `${String(errors)} error(s), ${String(issues.length - errors)} warning(s) in ${String(tables)} table(s).`
+  ];
+}
+async function runDbLint(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const linted = await lintDatabase(
+    client,
+    projectId,
+    (message) => context.output.warn(message)
+  );
+  const { issues, errors, warnings, tables: counted } = linted;
+  if (linted.truncated) context.output.warn(TRUNCATED_NOTICE);
+  context.output.result(
+    { issues, errors, warnings, tables: counted },
+    issueLines(issues, counted)
+  );
+  if (errors > 0 || context.flags.strict === true && warnings > 0)
+    process.exitCode = 1;
+}
+
 // src/functions/deploy.ts
 import { relative as relative11, resolve as resolve13, sep as sep10 } from "path";
 
@@ -32564,8 +33655,8 @@ var BUNDLE_MESSAGES = {
 };
 
 // ../../packages/functions-bundler/src/discover.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { join as join27, relative as relative7, resolve as resolve11, sep as sep6 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { join as join28, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
 
 // ../../packages/functions-bundler/src/limits.ts
 var FUNCTION_BUNDLE_MAX_BYTES = 67108864;
@@ -32589,8 +33680,8 @@ function isEntrypoint(value) {
 function functionsFolder(options) {
   const root = resolve11(options.cwd, options.root ?? ".");
   const explicit = options.dir !== void 0;
-  const dir = explicit ? resolve11(options.cwd, options.dir) : join27(root, "naro", "functions");
-  const label2 = relative7(options.cwd, dir).split(sep6).join("/") || ".";
+  const dir = explicit ? resolve11(options.cwd, options.dir) : join28(root, "naro", "functions");
+  const label2 = relative8(options.cwd, dir).split(sep6).join("/") || ".";
   return { dir, label: label2, root, explicit };
 }
 function listFunctionNames(folder) {
@@ -32598,7 +33689,7 @@ function listFunctionNames(folder) {
   try {
     entries = readdirSync3(folder.dir, { withFileTypes: true });
   } catch {
-    if (!folder.explicit && existsSync7(join27(folder.root, "supabase", "functions")))
+    if (!folder.explicit && existsSync7(join28(folder.root, "supabase", "functions")))
       throw new FunctionBundleError(
         "VALIDATION_FAILED",
         BUNDLE_MESSAGES.supabaseFound
@@ -32619,11 +33710,11 @@ function listFunctionNames(folder) {
   return names;
 }
 function readFunctionJson(dir, name) {
-  const file2 = join27(dir, "function.json");
+  const file2 = join28(dir, "function.json");
   if (!existsSync7(file2)) return { verifyJwt: void 0, entrypoint: void 0 };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync7(file2, "utf8"));
+    parsed = JSON.parse(readFileSync8(file2, "utf8"));
   } catch {
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -32663,7 +33754,7 @@ function readFunctionSource(folder, name) {
       "VALIDATION_FAILED",
       BUNDLE_MESSAGES.badName(name)
     );
-  const dir = join27(folder.dir, name);
+  const dir = join28(folder.dir, name);
   if (!statSync2(dir, { throwIfNoEntry: false })?.isDirectory())
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -32672,14 +33763,14 @@ function readFunctionSource(folder, name) {
   const config2 = readFunctionJson(dir, name);
   let entrypoint;
   if (config2.entrypoint !== void 0) {
-    if (!existsSync7(join27(dir, ...config2.entrypoint.split("/"))))
+    if (!existsSync7(join28(dir, ...config2.entrypoint.split("/"))))
       throw new FunctionBundleError(
         "FUNCTION_BUNDLE_FAILED",
         BUNDLE_MESSAGES.entryMissing(name, config2.entrypoint)
       );
     entrypoint = config2.entrypoint;
   } else {
-    const found = ENTRY_FILES.find((file2) => existsSync7(join27(dir, file2)));
+    const found = ENTRY_FILES.find((file2) => existsSync7(join28(dir, file2)));
     if (found === void 0)
       throw new FunctionBundleError(
         "FUNCTION_BUNDLE_FAILED",
@@ -32690,16 +33781,16 @@ function readFunctionSource(folder, name) {
   return {
     name,
     dir,
-    entry: join27(dir, ...entrypoint.split("/")),
+    entry: join28(dir, ...entrypoint.split("/")),
     entrypoint,
     verifyJwt: config2.verifyJwt
   };
 }
 function configTomlWarning(folder) {
-  if (!folder.dir.endsWith(join27("supabase", "functions"))) return null;
-  const file2 = join27(folder.dir, "..", "config.toml");
+  if (!folder.dir.endsWith(join28("supabase", "functions"))) return null;
+  const file2 = join28(folder.dir, "..", "config.toml");
   if (!existsSync7(file2)) return null;
-  return /^\s*verify_jwt\s*=/m.test(readFileSync7(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
+  return /^\s*verify_jwt\s*=/m.test(readFileSync8(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
 }
 
 // ../../packages/functions-bundler/src/jsonc.ts
@@ -32902,22 +33993,22 @@ ${injects.map(
 }
 
 // ../../packages/functions-bundler/src/deno-imports.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join29, relative as relative8, sep as sep8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join30, relative as relative9, sep as sep8 } from "path";
 
 // ../../packages/functions-bundler/src/import-map.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, realpathSync } from "fs";
-import { basename as basename4, dirname as dirname8, join as join28, resolve as resolve12, sep as sep7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync9, realpathSync } from "fs";
+import { basename as basename4, dirname as dirname8, join as join29, resolve as resolve12, sep as sep7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // ../../packages/functions-bundler/src/printable.ts
-var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable(text3) {
-  return text3.replace(UNPRINTABLE, "?");
+var UNPRINTABLE2 = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable2(text3) {
+  return text3.replace(UNPRINTABLE2, "?");
 }
 function causeLine(error51) {
   const text3 = error51 instanceof Error ? error51.message : String(error51);
-  return printable(
+  return printable2(
     text3.split("\n").map((line) => line.trim()).find((line) => line.length > 0) ?? "unknown error"
   );
 }
@@ -32941,7 +34032,7 @@ function expandBareKeys(imports) {
 function load(file2, label2) {
   let parsed;
   try {
-    parsed = parseJsonc2(readFileSync8(file2, "utf8"));
+    parsed = parseJsonc2(readFileSync9(file2, "utf8"));
   } catch {
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -32961,7 +34052,7 @@ function load(file2, label2) {
     if (key.endsWith("/") && !value.endsWith("/"))
       throw new FunctionBundleError(
         "VALIDATION_FAILED",
-        printable(BUNDLE_MESSAGES.importMapPrefix(label2, key, value))
+        printable2(BUNDLE_MESSAGES.importMapPrefix(label2, key, value))
       );
   return {
     imports: DENO_CONFIGS.has(basename4(file2)) ? expandBareKeys(written) : written,
@@ -32979,7 +34070,7 @@ function readImportMapFile(file2, label2) {
 }
 function readImportMap(functionDir, fallback, labelOf) {
   for (const name of FILES) {
-    const file2 = join28(functionDir, name);
+    const file2 = join29(functionDir, name);
     if (!existsSync8(file2)) continue;
     const map2 = load(file2, labelOf(file2));
     if (map2 !== null) return map2;
@@ -33104,7 +34195,7 @@ function parseNpm(text3) {
 }
 var afterScheme = (specifier) => specifier.slice(4).replace(/^\//, "");
 var isPackageName = (pkg) => pkg.startsWith("@") ? /^@[^/]+\/[^/]+$/.test(pkg) : /^[^/]+$/.test(pkg);
-var refuse2 = (text3) => ({ errors: [{ text: printable(text3) }] });
+var refuse2 = (text3) => ({ errors: [{ text: printable2(text3) }] });
 var installOf = (pkg, range) => range ? `${pkg}@${range}` : pkg;
 function realPath2(path) {
   try {
@@ -33113,16 +34204,16 @@ function realPath2(path) {
     return path;
   }
 }
-var fromRoot = (projectRoot, path) => relative8(projectRoot, path).split(sep8).join("/");
+var fromRoot = (projectRoot, path) => relative9(projectRoot, path).split(sep8).join("/");
 function isInside(path, projectRoot) {
-  const rel = relative8(projectRoot, path);
+  const rel = relative9(projectRoot, path);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep8}`) && !isAbsolute5(rel);
 }
 function packageDir(from, projectRoot) {
   let current = from;
   while (isInside(current, projectRoot)) {
     const inNodeModules = fromRoot(projectRoot, current).split("/").includes("node_modules");
-    if (!inNodeModules && existsSync9(join29(current, "package.json")))
+    if (!inNodeModules && existsSync9(join30(current, "package.json")))
       return fromRoot(projectRoot, current) || ".";
     const up = dirname9(current);
     if (up === current) break;
@@ -33134,7 +34225,7 @@ function isInstalled(from, pkg) {
   if (pkg === "") return false;
   let current = from;
   for (; ; ) {
-    if (existsSync9(join29(current, "node_modules", pkg))) return true;
+    if (existsSync9(join30(current, "node_modules", pkg))) return true;
     const up = dirname9(current);
     if (up === current) return false;
     current = up;
@@ -33144,10 +34235,10 @@ var NODE_MODULES = /[\\/]node_modules[\\/]/;
 function installedVersion(resolved, pkg) {
   let current = dirname9(resolved);
   for (; ; ) {
-    const file2 = join29(current, "package.json");
+    const file2 = join30(current, "package.json");
     if (existsSync9(file2)) {
       try {
-        const manifest2 = JSON.parse(readFileSync9(file2, "utf8"));
+        const manifest2 = JSON.parse(readFileSync10(file2, "utf8"));
         if (manifest2.name === pkg && typeof manifest2.version === "string")
           return manifest2.version;
       } catch {
@@ -33160,7 +34251,7 @@ function installedVersion(resolved, pkg) {
 }
 var byCodePoint = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 function missingPackagesMessage(unsorted) {
-  return printable(installSentence(unsorted));
+  return printable2(installSentence(unsorted));
 }
 function installSentence(unsorted) {
   const missing = [...unsorted].sort(
@@ -33241,7 +34332,7 @@ function denoImportsPlugin(options) {
         if (spec.range) {
           const version3 = installedVersion(result.path, pkgName);
           if (version3 !== null && inRange(version3, spec.range) === false) {
-            const warning = printable(
+            const warning = printable2(
               BUNDLE_MESSAGES.outOfRange(
                 pkgName,
                 version3,
@@ -33328,7 +34419,7 @@ function denoImportsPlugin(options) {
 
 // ../../packages/functions-bundler/src/bundle.ts
 import { createHash as createHash4 } from "crypto";
-import { join as join30, relative as relative9, sep as sep9 } from "path";
+import { join as join31, relative as relative10, sep as sep9 } from "path";
 import { gzipSync } from "zlib";
 
 // ../../packages/functions-runtime/dist/index.js
@@ -33349,7 +34440,7 @@ function runtimeCompressedBytes() {
   return runtimeGzip;
 }
 function relativeLabel(root, file2) {
-  return relative9(root, file2).split(sep9).join("/");
+  return relative10(root, file2).split(sep9).join("/");
 }
 function location(message) {
   return message.location ? `${message.location.file}:${String(message.location.line)}` : null;
@@ -33404,7 +34495,7 @@ async function bundleFunction(source, folder, options = {}) {
     result = await build({
       absWorkingDir: folder.root,
       entryPoints: [source.entry],
-      outfile: join30(source.dir, NARO_USER_MODULE),
+      outfile: join31(source.dir, NARO_USER_MODULE),
       bundle: true,
       write: false,
       format: "esm",
@@ -33496,7 +34587,7 @@ function bootErrorLine(logs, error51) {
   const logged = logs.find((line2) => line2.includes("Uncaught")) ?? logs.find((line2) => line2.includes("Error"));
   const raw = logged ?? (error51 instanceof Error ? error51.message : String(error51));
   const line = raw.split("\n").map((part) => part.trim()).find((part) => part.length > 0) ?? "unknown error";
-  return printable(line.replace(WORKERD_SERVICE_HEAD, ""));
+  return printable2(line.replace(WORKERD_SERVICE_HEAD, ""));
 }
 async function bootCheck(name, code, options = {}) {
   const timeoutMs = options.timeoutMs ?? BOOT_TIMEOUT_MS;
@@ -33577,407 +34668,6 @@ async function bootCheck(name, code, options = {}) {
   }
 }
 
-// src/commands/migration.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
-import { join as join31, relative as relative10 } from "path";
-
-// src/data-environment.ts
-var DATA_ENV_MESSAGES = {
-  name: "--env must be production or an environment name.",
-  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
-  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
-};
-function dataEnvironment(flags) {
-  const value = flags.env;
-  if (value === void 0 || value === "production") return null;
-  if (value === "preview")
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
-  if (environmentSlugProblem(value) !== null)
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
-  return value;
-}
-async function dataClient(context) {
-  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
-}
-function databaseName(environment) {
-  return environment === null ? "the project database" : `the ${environment} environment's database`;
-}
-function enableBackendCommand(environment) {
-  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
-}
-function envFlag(environment) {
-  return environment === null ? "" : ` --env ${environment}`;
-}
-function forEnvironment(text3, environment) {
-  return environmentGuidance(text3, environment);
-}
-
-// src/prompt.ts
-import { createInterface as createInterface2 } from "readline";
-import { Writable } from "stream";
-function confirmHint(defaultYes) {
-  return defaultYes ? "(Y/n)" : "(y/N)";
-}
-function readConfirmAnswer(answer, defaultYes) {
-  const normalized2 = answer.trim().toLowerCase();
-  if (normalized2 === "") return defaultYes;
-  if (normalized2 === "y" || normalized2 === "yes") return true;
-  if (!defaultYes) return false;
-  if (normalized2 === "n" || normalized2 === "no") return false;
-  return null;
-}
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-async function readStdin() {
-  let data = "";
-  for await (const chunk of process.stdin) data += String(chunk);
-  return data.replace(/\r?\n$/, "");
-}
-var TtyPrompter = class {
-  async ask(question) {
-    const rl = createInterface2({
-      input: process.stdin,
-      output: process.stdout
-    });
-    try {
-      return await new Promise(
-        (resolve15) => rl.question(question, resolve15)
-      );
-    } finally {
-      rl.close();
-    }
-  }
-  async askHidden(question) {
-    let muted = false;
-    const output = new Writable({
-      write(chunk, _enc, done) {
-        if (!muted) process.stdout.write(chunk);
-        done();
-      }
-    });
-    const rl = createInterface2({
-      input: process.stdin,
-      output,
-      terminal: true
-    });
-    try {
-      const answer = new Promise(
-        (resolve15) => rl.question(question, resolve15)
-      );
-      muted = true;
-      const value = await answer;
-      process.stdout.write("\n");
-      return value;
-    } finally {
-      rl.close();
-    }
-  }
-  async confirm(question, options = {}) {
-    const defaultYes = options.defaultYes ?? false;
-    for (; ; ) {
-      const read = readConfirmAnswer(
-        await this.ask(`${question} ${confirmHint(defaultYes)} `),
-        defaultYes
-      );
-      if (read !== null) return read;
-    }
-  }
-  async select(question, options) {
-    process.stdout.write(`${question}
-`);
-    options.forEach((option, index) => {
-      process.stdout.write(`  ${String(index + 1)}. ${option}
-`);
-    });
-    for (; ; ) {
-      const answer = Number.parseInt(
-        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
-        10
-      );
-      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
-        return answer - 1;
-    }
-  }
-};
-var NonInteractivePrompter = class {
-  constructor(assumeYes) {
-    this.assumeYes = assumeYes;
-  }
-  refuse(question) {
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
-    );
-  }
-  async ask(question) {
-    this.refuse(question);
-  }
-  async askHidden(question) {
-    this.refuse(question);
-  }
-  async confirm() {
-    return this.assumeYes;
-  }
-  async select(question) {
-    this.refuse(question);
-  }
-};
-function createPrompter(options) {
-  if (options.yes || options.json || !isInteractive())
-    return new NonInteractivePrompter(options.yes);
-  return new TtyPrompter();
-}
-
-// src/commands/confirm.ts
-function cannotAsk(context) {
-  return context.flags.json || !isInteractive();
-}
-async function confirmOrAbort(context, question) {
-  if (context.flags.yes) return;
-  if (cannotAsk(context)) {
-    throw new NaroError(
-      "CONFIRMATION_REQUIRED",
-      `${question} Re-run with --yes to confirm.`
-    );
-  }
-  const confirmed = await context.prompter.confirm(question);
-  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
-}
-
-// src/commands/migration.ts
-var processStdin = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-function migrationsDir(context) {
-  return resolveMigrationsDir({
-    baseDir: context.cwd,
-    rootDirectory: context.flags.root,
-    dir: context.flags.dir
-  });
-}
-function relativeToCwd(context, path) {
-  const rel = relative10(context.cwd, path);
-  return rel === "" ? "." : rel;
-}
-async function appliedMigrations(client, projectId) {
-  try {
-    return await client.db.migrations(projectId);
-  } catch (error51) {
-    if (isNaroError(error51) && error51.code === "DATABASE_NOT_READY") return [];
-    throw error51;
-  }
-}
-var UNPRINTABLE2 = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable2(text3) {
-  return text3.replace(UNPRINTABLE2, "?");
-}
-function isPrintable(text3) {
-  return printable2(text3) === text3;
-}
-var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
-function warningLines(message) {
-  return message.split("\n").map(
-    (line, index) => index === 0 ? `\u26A0 ${printable2(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
-  );
-}
-function policyProblems(dir, names) {
-  return names.flatMap((name) => {
-    const split2 = splitStatements(readFileSync10(join31(dir, name), "utf8"));
-    if (!split2.ok) return [];
-    const planned = planPolicyMigration(
-      split2.statements.map((statement2) => statement2.text)
-    );
-    return planned.ok ? [] : [{ migration: name, message: planned.message }];
-  });
-}
-function warningLine(warning) {
-  if (warning === "out-of-order")
-    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
-  if (warning === "ledger-name-missing-extension")
-    return "  \u26A0 recorded without .sql in the ledger";
-  return null;
-}
-async function runMigrationNew(context, deps = processStdin) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration new <name>"
-  );
-  const dir = migrationsDir(context);
-  const fileName = nextMigrationFileName(
-    listMigrationFiles(dir),
-    name
-  );
-  mkdirSync3(dir, { recursive: true });
-  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
-  const fromStdin = piped.length > 0;
-  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
-` : `-- Migration: ${fileName}
-`;
-  const path = join31(dir, fileName);
-  writeFileSync3(path, body, { flag: "wx" });
-  const relPath = relativeToCwd(context, path);
-  context.output.result({ file: fileName, path: relPath, fromStdin }, [
-    `\u2705 Created ${relPath}`
-  ]);
-}
-async function runMigrationList(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const migrations = compareMigrations(local, ledger);
-  const relDir = relativeToCwd(context, dir);
-  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
-    `Migrations in ${relDir} (${String(migrations.length)}):`,
-    ...migrations.flatMap((row) => {
-      const line = `  ${row.status.padEnd(12)}${printable2(row.name)}${row.appliedAt ? `  ${printable2(row.appliedAt)}` : ""}`;
-      const warning = warningLine(row.warning);
-      return warning ? [line, warning] : [line];
-    })
-  ];
-  context.output.result({ projectId, dir: relDir, migrations }, lines);
-}
-async function applyMigrationFiles(context, client, projectId, dir, names) {
-  const applied = [];
-  const warnings = [];
-  for (const name of names) {
-    const sql = readFileSync10(join31(dir, name), "utf8");
-    let answer;
-    try {
-      answer = await client.db.applyMigration(projectId, { name, sql });
-    } catch (error51) {
-      if (!isNaroError(error51)) throw error51;
-      for (const message of serverWarnings(error51.details))
-        for (const line of warningLines(message)) context.output.warn(line);
-      const shown = context.output.json ? name : printable2(name);
-      throw new NaroError(error51.code, `${shown}: ${error51.message}`, {
-        ...error51.status === void 0 ? {} : { status: error51.status },
-        details: {
-          ...error51.details,
-          migration: name,
-          applied,
-          appliedWarnings: warnings
-        },
-        cause: error51
-      });
-    }
-    context.output.log(`\u2713 ${printable2(name)}`);
-    applied.push(name);
-    for (const message of answer.warnings) {
-      warnings.push({ migration: name, message });
-      for (const line of warningLines(message)) context.output.warn(line);
-    }
-  }
-  return { applied, warnings };
-}
-function serverWarnings(details) {
-  const warnings = details?.warnings;
-  return Array.isArray(warnings) ? warnings.filter(
-    (warning) => typeof warning === "string"
-  ) : [];
-}
-var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
-var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
-var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
-var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
-function withoutSuffix(key) {
-  return key.slice(0, -".sql".length);
-}
-async function runMigrationRepair(context) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration repair <name> --status applied|reverted"
-  );
-  const key = name;
-  if (!MIGRATION_NAME_RE.test(key))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "name must end with .sql and contain only letters, digits, _ . -"
-    );
-  const status = context.flags.status;
-  if (status !== "applied" && status !== "reverted")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Pass --status applied or --status reverted."
-    );
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const ledger = await appliedMigrations(client, projectId);
-  const recorded = ledger.some(
-    (row) => row.name === key || row.name === withoutSuffix(key)
-  );
-  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
-  if (status === "applied" ? recorded : !recorded) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  await confirmOrAbort(
-    context,
-    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
-  );
-  if (status === "applied" && ledger.length === 0)
-    await client.db.query(projectId, { sql: LEDGER_DDL });
-  const answer = await client.db.query(projectId, {
-    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
-    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
-  });
-  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
-  if (!changed) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  context.output.result({ name: key, status, changed: true }, [
-    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
-  ]);
-}
-async function runMigrationUp(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
-  if (pending.length === 0) {
-    context.output.result({ projectId, applied: [], pending: [] }, [
-      "No pending migrations."
-    ]);
-    return;
-  }
-  if (context.flags.dryRun) {
-    const problems2 = policyProblems(dir, pending);
-    context.output.result({ projectId, dryRun: true, pending, problems: problems2 }, [
-      `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable2(name)}`),
-      ...problems2.map(
-        (problem) => `${printable2(problem.migration)}: ${printable2(problem.message)}`
-      )
-    ]);
-    if (problems2.length > 0) process.exitCode = 1;
-    return;
-  }
-  context.output.log(`Pending migrations (${String(pending.length)}):`);
-  for (const name of pending) context.output.log(`  ${printable2(name)}`);
-  await confirmOrAbort(
-    context,
-    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
-  );
-  const { applied, warnings } = await applyMigrationFiles(
-    context,
-    client,
-    projectId,
-    dir,
-    pending
-  );
-  context.output.result({ projectId, applied, pending: [], warnings }, [
-    `\u2705 Applied ${String(applied.length)} migration(s).`
-  ]);
-}
-
 // src/functions/retry.ts
 var FUNCTION_RETRIES = 3;
 var FUNCTION_BUSY_WAIT_MS = 5e3;
@@ -34262,7 +34952,7 @@ async function deployFunctions(options) {
       if (!PER_FUNCTION_CODES.has(error51.code))
         throw withProgress(error51, deployed, failures);
       failures.push({ name, code: error51.code, message: error51.message });
-      io.log(`\u2717 ${name}: ${printable2(error51.message)}`);
+      io.log(`\u2717 ${name}: ${printable(error51.message)}`);
     }
   }
   if (failures.length > 0)
@@ -34557,7 +35247,7 @@ async function deployDirectory(sourceDir, options, log2) {
       const set2 = missing.filter((key) => isNaroSystemName(key));
       missing = missing.filter((key) => !isNaroSystemName(key));
       log2(
-        `\u25B8 naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
+        `\u25B8 Naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
       );
     }
   }
@@ -34708,10 +35398,14 @@ function deploymentUrl(detail, ctx, production) {
 
 export {
   parseDotenvDetailed,
+  FUNCTION_INVOKE_METHODS,
+  FUNCTION_INVOKE_MAX_RESPONSE_BYTES,
+  FUNCTION_INVOKE_TIMEOUT_MS,
   isFunctionName,
   parseGitHubRemote,
   schemaMigrationTitle,
   projectPath,
+  readCapped,
   ANALYTICS_FILTER_KEYS,
   NaroError,
   promoteTargetUnsupported,
@@ -34753,18 +35447,12 @@ export {
   parseCacheControl,
   STORAGE_OBJECTS_TABLE,
   dataError,
-  SCHEMA_SQL,
-  tableNames,
-  snapshotFromRows,
   quoteIdent,
   commentText,
   quotePolicyName,
   NAMED_POLICY_TABLE,
   NAMED_POLICY_SQL,
-  loadPolicy,
   parsePolicyNode,
-  INDEX_SQL,
-  indexesFromRows,
   parsePolicyStatement,
   splitPolicyStatements,
   STORAGE_SUBQUERIES_SQL,
@@ -34777,8 +35465,7 @@ export {
   writeProjectLink,
   removeProjectLink,
   ensureGitignoreHasNaro,
-  countLintedTables,
-  lintSchema,
+  lintDatabase,
   listMigrationFiles,
   nextMigrationFileName,
   pendingMigrationNames,
@@ -34800,9 +35487,6 @@ export {
   pullEnv,
   detectGitInfo,
   version2 as version,
-  BUNDLE_MESSAGES,
-  functionsFolder,
-  parseJsonc2 as parseJsonc,
   DATA_ENV_MESSAGES,
   dataEnvironment,
   dataClient,
@@ -34818,7 +35502,7 @@ export {
   migrationsDir,
   relativeToCwd,
   appliedMigrations,
-  printable2 as printable,
+  printable,
   isPrintable,
   UNSHOWN_WARNING_LINE,
   warningLines,
@@ -34828,6 +35512,10 @@ export {
   applyMigrationFiles,
   runMigrationRepair,
   runMigrationUp,
+  runDbLint,
+  BUNDLE_MESSAGES,
+  functionsFolder,
+  parseJsonc2 as parseJsonc,
   defaultSleep,
   retryAfterSeconds,
   withFunctionRetries,