naro-cli 0.24.0 → 0.26.0

package/dist/{chunk-XJIWWZ2T.js → chunk-RQJTCRKY.js}

@@ -7,7 +7,7 @@ import {
 import { existsSync as existsSync10 } from "fs";
 import { mkdtemp as mkdtemp2, readFile as readFile15, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename5, dirname as dirname10, join as join32, resolve as resolve14 } from "path";
+import { basename as basename5, dirname as dirname10, join as join31, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -289,7 +289,7 @@ function hashAsset(data, contentType2) {
 // ../../packages/build/src/local-build-executor.ts
 import { access as access8, mkdtemp, readFile as readFile13, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join18, resolve as resolve7 } from "path";
+import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/route-patterns.ts
 var ROUTE_PATTERN = /^\/[A-Za-z0-9\-._~%!$&()*+,;=:@/[\]]*$/;
@@ -310,6 +310,1925 @@ function sanitizeRoutes(value) {
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
 
+// ../../packages/core/src/brand-case.ts
+var CLI_WORDS = "analytics|auth|backend|cancel|confirm|db|deploy|deployments|domains|env|environments|filters|functions|gen|git|insights|inspect|link|login|logout|logs|migration|policy|project|projects|promote|protection|realtime|secrets|storage|token|unlink|usage|whoami|dev|init|help|version|rollback";
+var IDENTIFIER = new RegExp(
+  `(?:[@_\\-/.:$]naro\\b|\\bnaro[_\\-/:]|\\bnaro\\.\\w|\\bnaro (?:${CLI_WORDS}) (?:[a-z][a-z-]*|--)|\\bnaro --|\\bnaro (?:\u2026|\\.\\.\\.)|\\bnaro [a-z][a-z-]*:)`,
+  "g"
+);
+
+// ../../packages/core/src/capabilities.ts
+var REASON_CODES = {
+  "secret-value": {
+    clients: ["mcp"],
+    why: "\uC2DC\uD06C\uB9BF \uAC12\uC744 \uBC1B\uAC70\uB098 \uB3CC\uB824\uC900\uB2E4. \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4 (apps/mcp/src/function-tools.ts:34)."
+  },
+  irreversible: {
+    clients: ["mcp"],
+    why: "\uB418\uB3CC\uB9B4 \uC218 \uC5C6\uACE0 \uD655\uC778\uC73C\uB85C\uB9CC \uB9C9\uC744 \uC218 \uC788\uB2E4 (project_cli_mcp_backlog #6)."
+  },
+  "privilege-escalation": {
+    clients: ["mcp"],
+    why: "\uAD8C\uD55C\xB7\uC5ED\uD560\xB7\uBA64\uBC84\uC2ED\uC744 \uBC14\uAFBC\uB2E4."
+  },
+  "payment-flow": {
+    clients: ["cli", "mcp"],
+    why: "\uCE74\uB4DC \uC815\uBCF4\uAC00 \uC9C0\uB098\uAC04\uB2E4. \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4."
+  },
+  "browser-required": {
+    clients: ["cli", "mcp"],
+    why: "OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uAC00 \uD544\uC694\uD558\uB2E4."
+  },
+  "local-filesystem": {
+    clients: ["ui"],
+    why: "\uB85C\uCEEC \uD30C\uC77C\uC744 \uC77D\uAC70\uB098 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+  },
+  "ui-affordance": {
+    clients: ["cli", "mcp"],
+    why: "\uD654\uBA74 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4."
+  },
+  "agent-native": {
+    clients: ["mcp"],
+    // "naro CLI로 할 수 있다"는 사유가 아니다 — 그러면 CLI에 있는 모든 기능을
+    // 이 코드로 뺄 수 있다(PR #423 리뷰). 컨트롤 플레인에 닿는 일이면 planned다.
+    why: "\uC774 \uCEF4\uD4E8\uD130\uC758 \uD30C\uC77C\uB9CC \uC4F0\uB294 \uC77C\uC774\uB2E4. \uC5D0\uC774\uC804\uD2B8\uB294 \uC81C \uB3C4\uAD6C\uB85C \uD30C\uC77C\uC744 \uC4F4\uB2E4 \u2014 MCP \uD234\uB85C \uAC10\uC2F8\uBA74 \uC4F0\uAE30 \uACBD\uB85C \uAC80\uC0AC\uB9CC \uB294\uB2E4."
+  },
+  "user-session": {
+    clients: ["mcp"],
+    why: "\uC0AC\uC6A9\uC790 \uC790\uC2E0\uC758 \uB85C\uADF8\uC778 \uC138\uC158\uC744 \uBC14\uAFBC\uB2E4. \uC0AC\uB78C\uC774 \uD130\uBBF8\uB110\uC5D0\uC11C \uD55C\uB2E4."
+  },
+  "dashboard-itself": {
+    clients: ["ui"],
+    why: "\uB300\uC2DC\uBCF4\uB4DC\uB85C \uAC00\uB294 \uAE38\uC744 \uC54C\uB824 \uC8FC\uB294 \uAE30\uB2A5\uC774\uB2E4. \uB300\uC2DC\uBCF4\uB4DC \uC548\uC5D0\uC11C\uB294 \uB73B\uC774 \uC5C6\uB2E4."
+  }
+};
+var CAPABILITIES = [
+  {
+    id: "auth-whoami",
+    domain: "auth",
+    title: "\uB0B4 \uACC4\uC815 \uD655\uC778",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro whoami"] },
+    mcp: { kind: "built", tools: ["whoami"] }
+  },
+  {
+    id: "auth-ci-token",
+    domain: "auth",
+    title: "CI \uD1A0\uD070 \uBC1C\uAE09",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "naro login\uC774 \uC774 \uCEF4\uD4E8\uD130\uC5D0 \uB0A8\uAE34 \uC138\uC158(~/.naro/credentials.json)\uC5D0\uC11C \uD1A0\uD070\uC744 \uAEBC\uB0B8\uB2E4. \uBE0C\uB77C\uC6B0\uC800 \uC138\uC158\uC5D0\uB294 \uADF8 \uD30C\uC77C\uC774 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro token"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uD1A0\uD070 \uC790\uCCB4\uAC00 \uC2DC\uD06C\uB9BF\uC774\uB77C \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "auth-login",
+    domain: "auth",
+    title: "\uB85C\uADF8\uC778",
+    dashboard: "/login",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro login"] },
+    mcp: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "apps/mcp/src/tools.ts \u2014 \uC774 \uC11C\uBC84\uB294 \uBE0C\uB77C\uC6B0\uC800\uB97C \uC5F4 \uC218 \uC5C6\uB2E4. \uC0AC\uC6A9\uC790\uAC00 \uD130\uBBF8\uB110\uC5D0\uC11C naro login\uC744 \uB3CC\uB9AC\uAC8C \uD55C\uB2E4."
+    }
+  },
+  {
+    id: "auth-logout",
+    domain: "auth",
+    title: "\uB85C\uADF8\uC544\uC6C3",
+    dashboard: null,
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro logout"] },
+    mcp: {
+      kind: "excluded",
+      reason: "user-session",
+      note: "naro login \uC138\uC158\uC740 \uC0AC\uB78C\uC774 \uB2E4\uB8EC\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "team-list",
+    domain: "teams",
+    title: "\uD300 \uBAA9\uB85D",
+    routes: ["GET teams"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro teams"] },
+    mcp: { kind: "built", tools: ["list_teams"] }
+  },
+  {
+    id: "team-member-list",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/members"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members"] },
+    mcp: { kind: "built", tools: ["list_team_members"] }
+  },
+  {
+    id: "team-create",
+    domain: "teams",
+    title: "\uD300 \uC0DD\uC131",
+    routes: ["POST teams"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team create"] },
+    mcp: { kind: "built", tools: ["create_team"] }
+  },
+  {
+    id: "team-update",
+    domain: "teams",
+    title: "\uD300 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PATCH teams/[teamSlug]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team set"] },
+    mcp: { kind: "built", tools: ["update_team"] }
+  },
+  {
+    id: "team-delete",
+    domain: "teams",
+    title: "\uD300 \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uD300\uC758 \uD504\uB85C\uC81D\uD2B8\xB7\uB370\uC774\uD130\uAC00 \uD568\uAED8 \uC0AC\uB77C\uC9C4\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-member-update",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uC5ED\uD560 \uBCC0\uACBD",
+    routes: ["PATCH teams/[teamSlug]/members/[userId]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members set"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uC5ED\uD560\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-member-remove",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uC81C\uAC70",
+    routes: ["DELETE teams/[teamSlug]/members/[userId]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members remove"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC2ED\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-invite-list",
+    domain: "teams",
+    title: "\uCD08\uB300 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/invites"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites"] },
+    mcp: { kind: "built", tools: ["list_team_invites"] }
+  },
+  {
+    id: "team-invite-create",
+    domain: "teams",
+    title: "\uCD08\uB300 \uBCF4\uB0B4\uAE30",
+    routes: ["POST teams/[teamSlug]/invites"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites create"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uD300\uC5D0 \uC0AC\uB78C\uC744 \uB4E4\uC778\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-invite-revoke",
+    domain: "teams",
+    title: "\uCD08\uB300 \uCDE8\uC18C",
+    routes: ["DELETE teams/[teamSlug]/invites/[inviteId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites revoke"] },
+    mcp: { kind: "built", tools: ["revoke_team_invite"] }
+  },
+  {
+    id: "team-usage",
+    domain: "teams",
+    title: "\uD300 \uC0AC\uC6A9\uB7C9",
+    routes: ["GET teams/[teamSlug]/usage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro usage"] },
+    mcp: { kind: "built", tools: ["get_team_usage"] }
+  },
+  {
+    id: "billing-view",
+    domain: "billing",
+    title: "\uD50C\uB79C\xB7\uAD6C\uB3C5 \uC870\uD68C",
+    routes: ["GET teams/[teamSlug]/billing"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro billing"] },
+    mcp: { kind: "built", tools: ["get_team_billing"] }
+  },
+  {
+    id: "billing-checkout",
+    domain: "billing",
+    title: "\uCCB4\uD06C\uC544\uC6C3",
+    routes: ["POST teams/[teamSlug]/billing/checkout"],
+    dashboard: "/[teamSlug]/usage",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uCE74\uB4DC \uC815\uBCF4\uB294 Paddle\uC758 \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uCE74\uB4DC \uC815\uBCF4\uB294 Paddle\uC758 \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "billing-portal",
+    domain: "billing",
+    title: "\uACB0\uC81C \uD3EC\uD138",
+    routes: ["POST teams/[teamSlug]/billing/portal"],
+    dashboard: "/[teamSlug]/usage",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uACB0\uC81C \uC218\uB2E8 \uBCC0\uACBD\uC740 Paddle \uD3EC\uD138\uC5D0\uC11C \uD55C\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uACB0\uC81C \uC218\uB2E8 \uBCC0\uACBD\uC740 Paddle \uD3EC\uD138\uC5D0\uC11C \uD55C\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "project-list",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uBAA9\uB85D",
+    routes: ["GET projects"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro projects"] },
+    mcp: { kind: "built", tools: ["list_projects"] }
+  },
+  {
+    id: "project-create",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC0DD\uC131",
+    routes: ["POST projects"],
+    ui: { kind: "built" },
+    // naro deploy가 링크가 없을 때 만든다(POST cli/deployments).
+    cli: { kind: "built" },
+    // deploy가 링크가 없을 때 만든다(POST cli/deployments).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "project-get",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC870\uD68C",
+    routes: ["GET projects/[projectId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project inspect"] },
+    mcp: { kind: "built", tools: ["get_project"] }
+  },
+  {
+    id: "project-link",
+    domain: "projects",
+    title: "\uB514\uB809\uD130\uB9AC\uB97C \uD504\uB85C\uC81D\uD2B8\uC5D0 \uB9C1\uD06C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".naro/project.json\uC5D0 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro link", "naro init"] },
+    mcp: { kind: "built", tools: ["link_project"] }
+  },
+  {
+    id: "project-unlink",
+    domain: "projects",
+    title: "\uB9C1\uD06C \uD574\uC81C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".naro/\uB97C \uC9C0\uC6B4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro unlink"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: ".naro/\uB97C \uC9C0\uC6B0\uB294 \uC77C\uC774\uB2E4. \uC9DD\uC778 link_project\uAC00 \uD234\uC778 \uAC83\uC740 \uD504\uB85C\uC81D\uD2B8\uB97C \uACE0\uB974\uB824\uBA74 \uCEE8\uD2B8\uB864 \uD50C\uB808\uC778\uC744 \uC77D\uC5B4\uC57C \uD574\uC11C\uB2E4 \u2014 unlink\uB294 \uD30C\uC77C\uB9CC \uC9C0\uC6B4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "project-update",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC124\uC815 \uBCC0\uACBD(\uD504\uB808\uC784\uC6CC\uD06C\xB7\uC11C\uBE0C\uB3C4\uBA54\uC778)",
+    routes: ["PATCH projects/[projectId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project set"] },
+    // 서브도메인은 빼고(PR #433 리뷰): 옛 이름이 바로 비어 누구나 가져갈 수 있어
+    // 북마크·OAuth 리다이렉트가 남의 앱으로 간다. 대시보드와 CLI(먼저 묻는다)만.
+    mcp: { kind: "built", tools: ["update_project"] }
+  },
+  {
+    id: "project-delete",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC6CC\uCEE4\xB7D1\xB7R2\xB7\uB3C4\uBA54\uC778\xB7\uBC30\uD3EC \uC774\uB825\uC774 cascade\uB85C \uB0A0\uC544\uAC04\uB2E4. \uC5D0\uC774\uC804\uD2B8\uB294 \uD504\uB86C\uD504\uD2B8 \uC778\uC81D\uC158\uC5D0 \uB178\uCD9C\uB418\uBBC0\uB85C \uD655\uC778\uC73C\uB85C \uB9C9\uC744 \uC218 \uC5C6\uB2E4(project_cli_mcp_backlog #6)."
+    }
+  },
+  {
+    id: "project-subdomain-check",
+    domain: "projects",
+    title: "\uC11C\uBE0C\uB3C4\uBA54\uC778 \uC0AC\uC6A9 \uAC00\uB2A5 \uC5EC\uBD80",
+    routes: ["GET subdomains/availability"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project check"] },
+    mcp: { kind: "built", tools: ["check_subdomain"] }
+  },
+  {
+    id: "project-access-list",
+    domain: "projects",
+    title: "\uBA64\uBC84\uBCC4 \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uC870\uD68C",
+    routes: ["GET projects/[projectId]/access"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access"] },
+    mcp: { kind: "built", tools: ["list_project_access"] }
+  },
+  {
+    id: "project-access-grant",
+    domain: "projects",
+    title: "\uBA64\uBC84\uC5D0\uAC8C \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uBD80\uC5EC",
+    routes: ["PUT projects/[projectId]/access"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/access",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access grant"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uAD8C\uD55C\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "project-access-revoke",
+    domain: "projects",
+    title: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uD68C\uC218",
+    routes: ["DELETE projects/[projectId]/access"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/access",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access revoke"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uAD8C\uD55C\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "deployment-list",
+    domain: "deployments",
+    title: "\uBC30\uD3EC \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/deployments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro deployments"] },
+    mcp: { kind: "built", tools: ["list_deployments"] }
+  },
+  {
+    id: "deployment-create",
+    domain: "deployments",
+    title: "\uBE0C\uB79C\uCE58\uC5D0\uC11C \uC0C8\uB85C \uBC30\uD3EC",
+    routes: ["POST projects/[projectId]/deployments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro deployments create"] },
+    mcp: { kind: "built", tools: ["deploy_from_git"] }
+  },
+  {
+    id: "deployment-local",
+    domain: "deployments",
+    title: "\uB85C\uCEEC\uC5D0\uC11C \uBE4C\uB4DC\uD574 \uBC30\uD3EC",
+    routes: ["POST cli/deployments"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uB85C\uCEEC \uC791\uC5C5 \uD2B8\uB9AC\uC5D0\uC11C \uBE4C\uB4DC\uD55C \uC0B0\uCD9C\uBB3C\uC744 \uC62C\uB9B0\uB2E4. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uB294 \uBE4C\uB4DC\uD560 \uC791\uC5C5 \uD2B8\uB9AC\uAC00 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro deploy"] },
+    mcp: { kind: "built", tools: ["deploy"] }
+  },
+  {
+    id: "deployment-get",
+    domain: "deployments",
+    title: "\uBC30\uD3EC \uC0C1\uC138",
+    routes: ["GET deployments/[deploymentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro inspect"] },
+    mcp: { kind: "built", tools: ["get_deployment", "get_build_logs"] }
+  },
+  {
+    id: "deployment-cancel",
+    domain: "deployments",
+    title: "\uBE4C\uB4DC \uCDE8\uC18C",
+    routes: ["POST projects/[projectId]/deployments/[deploymentId]/cancel"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro cancel"] },
+    mcp: { kind: "built", tools: ["cancel_deployment"] }
+  },
+  {
+    id: "deployment-promote-preview",
+    domain: "deployments",
+    title: "\uC2B9\uACA9 \uBBF8\uB9AC\uBCF4\uAE30",
+    routes: ["GET projects/[projectId]/deployments/[deploymentId]/promote"],
+    ui: { kind: "built" },
+    // naro promote가 묻기 전에 무엇을 할지 보여 준다(client.deployments.promoteCheck).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["check_promotion"] }
+  },
+  {
+    id: "deployment-promote",
+    domain: "deployments",
+    title: "\uD504\uB85C\uB355\uC158\xB7\uD658\uACBD\uC73C\uB85C \uC2B9\uACA9(\uB864\uBC31 \uD3EC\uD568)",
+    routes: ["POST projects/[projectId]/deployments/[deploymentId]/promote"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro promote", "naro rollback"] },
+    mcp: {
+      kind: "built",
+      tools: ["promote_deployment", "rollback_deployment"]
+    }
+  },
+  {
+    id: "git-app-install",
+    domain: "git",
+    title: "GitHub App \uC124\uCE58",
+    routes: ["GET github/authorize", "GET github/install", "GET github/setup"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "GitHub App \uC124\uCE58\uB294 OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uB85C \uB05D\uB09C\uB2E4. naro git connect\uAC00 \uC124\uCE58 URL\uC744 \uCC0D\uC5B4 \uC900\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "apps/mcp/src/tools.ts\uC758 connect_git_repository \u2014 \uC124\uCE58 URL\uC744 \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC8FC\uACE0 \uBE0C\uB77C\uC6B0\uC800\uB294 \uC9C1\uC811 \uC5F4\uC9C0 \uC54A\uB294\uB2E4."
+    }
+  },
+  {
+    id: "git-repository-list",
+    domain: "git",
+    title: "GitHub \uC800\uC7A5\uC18C \uBAA9\uB85D",
+    routes: ["GET github/repositories"],
+    ui: { kind: "built" },
+    // naro git connect가 저장소를 고를 때 읽는다(client.github.listRepositories).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["list_git_repositories"] }
+  },
+  {
+    id: "git-connect",
+    domain: "git",
+    title: "\uC800\uC7A5\uC18C \uC5F0\uACB0",
+    routes: ["POST projects/[projectId]/git"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro git connect"] },
+    mcp: { kind: "built", tools: ["connect_git_repository"] }
+  },
+  {
+    id: "git-disconnect",
+    domain: "git",
+    title: "\uC800\uC7A5\uC18C \uC5F0\uACB0 \uD574\uC81C",
+    routes: ["DELETE projects/[projectId]/git"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro git disconnect"] },
+    mcp: { kind: "built", tools: ["disconnect_git_repository"] }
+  },
+  {
+    id: "env-list",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/env"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env list"] },
+    mcp: { kind: "built", tools: ["list_environment_variables"] }
+  },
+  {
+    id: "env-set",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uCD94\uAC00\xB7\uC218\uC815",
+    routes: ["POST projects/[projectId]/env"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env add", "naro env import"] },
+    mcp: { kind: "built", tools: ["set_environment_variable"] }
+  },
+  {
+    id: "env-remove",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/env/[envVarId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env remove"] },
+    mcp: { kind: "built", tools: ["remove_environment_variable"] }
+  },
+  // 앱 메일의 Resend 연결(spec 2026-11-04 resend-email-integration). 연결은
+  // env 두 행이라 env 도메인에 둔다. CLI·MCP는 그 스펙의 PR 2다.
+  {
+    id: "email-status",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0 \uBCF4\uAE30",
+    routes: ["GET projects/[projectId]/email"],
+    ui: { kind: "built" },
+    cli: { kind: "planned", note: "naro email status \u2014 \uC2A4\uD399 \xA713 PR 2." },
+    mcp: { kind: "planned", note: "get_email \u2014 \uC2A4\uD399 \xA713 PR 2." }
+  },
+  {
+    id: "email-connect",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0\xB7\uBC14\uAFB8\uAE30",
+    routes: ["PUT projects/[projectId]/email"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/email",
+    ui: { kind: "built" },
+    cli: {
+      kind: "planned",
+      note: "naro email connect --api-key-stdin \u2014 \uC2A4\uD399 \xA713 PR 2."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "Resend API \uD0A4\uB97C \uBC1B\uB294\uB2E4. \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4 \u2014 get_email\uC774 naro email connect\uB098 \uB300\uC2DC\uBCF4\uB4DC\uB97C \uC548\uB0B4\uD55C\uB2E4(\uC2A4\uD399 \xA73-8)."
+    }
+  },
+  {
+    id: "email-disconnect",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0 \uB04A\uAE30",
+    routes: ["DELETE projects/[projectId]/email"],
+    ui: { kind: "built" },
+    cli: { kind: "planned", note: "naro email disconnect \u2014 \uC2A4\uD399 \xA713 PR 2." },
+    mcp: { kind: "planned", note: "disconnect_email \u2014 \uC2A4\uD399 \xA713 PR 2." }
+  },
+  {
+    id: "env-pull",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218\uB97C \uB85C\uCEEC\uB85C \uB0B4\uB9AC\uAE30",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".env.local\uC5D0 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro env pull"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uBCF5\uD638\uD654\uD55C \uAC12\uC744 .env.local\uC5D0 \uC4F4\uB2E4. list_environment_variables\uB294 \uAC12\uC744 \uAC00\uB9B0\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "supabase-connect",
+    domain: "env",
+    title: "\uAE30\uC874 Supabase \uD504\uB85C\uC81D\uD2B8 \uC5F0\uACB0\xB7\uD0A4 \uB2E4\uC2DC \uBC1B\uAE30",
+    routes: [
+      "GET supabase/authorize",
+      "GET supabase/callback",
+      "GET projects/[projectId]/supabase/projects",
+      "PUT projects/[projectId]/supabase"
+    ],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "Supabase OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uB85C \uB05D\uB09C\uB2E4. \uD1A0\uD070\uC740 10\uBD84 \uCFE0\uD0A4\uC5D0\uB9CC \uC788\uB2E4(\uC124\uACC4 2026-11-04 \xA72.1)."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "Supabase OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uB85C \uB05D\uB09C\uB2E4. \uB300\uC2DC\uBCF4\uB4DC\uC758 \uD504\uB85C\uC81D\uD2B8 \uC124\uC815 \uD0ED\uC5D0\uC11C \uC5F0\uACB0\uD55C\uB2E4."
+    }
+  },
+  {
+    id: "supabase-link-list",
+    domain: "env",
+    title: "Supabase \uC5F0\uACB0 \uBCF4\uAE30",
+    routes: ["GET projects/[projectId]/supabase"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro supabase"] },
+    mcp: { kind: "built", tools: ["list_supabase_links"] }
+  },
+  {
+    id: "supabase-disconnect",
+    domain: "env",
+    title: "Supabase \uC5F0\uACB0 \uD574\uC81C",
+    routes: ["DELETE projects/[projectId]/supabase"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro supabase disconnect"] },
+    mcp: { kind: "built", tools: ["disconnect_supabase"] }
+  },
+  {
+    id: "environment-list",
+    domain: "environments",
+    title: "\uD658\uACBD \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/environments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments"] },
+    mcp: { kind: "built", tools: ["list_environments"] }
+  },
+  {
+    id: "environment-create",
+    domain: "environments",
+    title: "\uD658\uACBD \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/environments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments create"] },
+    mcp: { kind: "built", tools: ["create_environment"] }
+  },
+  {
+    id: "environment-update",
+    domain: "environments",
+    title: "\uD658\uACBD \uC124\uC815 \uBCC0\uACBD(\uBE0C\uB79C\uCE58\xB7\uBCF4\uD638)",
+    routes: ["PATCH projects/[projectId]/environments/[environmentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments set"] },
+    mcp: { kind: "built", tools: ["update_environment"] }
+  },
+  {
+    id: "environment-delete",
+    domain: "environments",
+    title: "\uD658\uACBD \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/environments/[environmentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments delete"] },
+    mcp: { kind: "built", tools: ["delete_environment"] }
+  },
+  {
+    id: "environment-provision",
+    domain: "environments",
+    title: "\uD658\uACBD \uB370\uC774\uD130 \uD504\uB85C\uBE44\uC800\uB2DD",
+    routes: [
+      "POST projects/[projectId]/environments/[environmentId]/provision"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments provision"] },
+    mcp: { kind: "built", tools: ["provision_environment"] }
+  },
+  {
+    id: "domain-list",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/domains"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains list"] },
+    mcp: { kind: "built", tools: ["list_domains"] }
+  },
+  {
+    id: "domain-add",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/domains"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains add"] },
+    mcp: { kind: "built", tools: ["add_domain"] }
+  },
+  {
+    id: "domain-refresh",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC0C1\uD0DC \uC0C8\uB85C\uACE0\uCE68",
+    routes: ["PATCH projects/[projectId]/domains/[domainId]"],
+    ui: { kind: "built" },
+    // naro domains verify가 Cloudflare 재확인까지 해서 refresh(저장된 상태 다시 읽기)의
+    // 상위다. 같은 PATCH는 부르지 않는다.
+    cli: { kind: "built" },
+    // verify_domain이 같은 일을 더 한다(재확인 + DNS 점검).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-remove",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/domains/[domainId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains remove"] },
+    mcp: { kind: "built", tools: ["remove_domain"] }
+  },
+  {
+    id: "domain-verify",
+    domain: "domains",
+    title: "DNS \uC7AC\uAC80\uC99D",
+    routes: ["POST projects/[projectId]/domains/[domainId]/verify"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains verify"] },
+    mcp: { kind: "built", tools: ["verify_domain"] }
+  },
+  {
+    id: "domain-claim-list",
+    domain: "domains",
+    title: "\uB2E4\uB978 \uD504\uB85C\uC81D\uD2B8\uAC00 \uAC00\uC9C4 \uB3C4\uBA54\uC778\uC758 \uC18C\uC720\uAD8C \uD655\uC778 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/domain-claims"],
+    ui: { kind: "built" },
+    // naro domains verify가 소유권 확인을 함께 읽는다(client.domains.listClaims).
+    cli: { kind: "built" },
+    // verify_domain이 소유권 확인을 함께 읽는다(client.domains.listClaims).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-claim-verify",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC18C\uC720\uAD8C \uD655\uC778",
+    routes: ["POST projects/[projectId]/domain-claims/[claimId]/verify"],
+    ui: { kind: "built" },
+    // naro domains verify가 소유권 확인을 함께 다시 본다(client.domains.verifyClaim).
+    cli: { kind: "built" },
+    // verify_domain이 소유권 확인을 함께 다시 본다(client.domains.verifyClaim).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-claim-cancel",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC18C\uC720\uAD8C \uD655\uC778 \uCDE8\uC18C",
+    routes: ["DELETE projects/[projectId]/domain-claims/[claimId]"],
+    ui: { kind: "built" },
+    // naro domains remove가 붙어 있지 않은 호스트의 소유권 확인을 취소한다.
+    cli: { kind: "built" },
+    // remove_domain이 붙어 있지 않은 호스트의 소유권 확인을 취소한다(claimCancelled).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "dns-zone-list",
+    domain: "dns",
+    title: "DNS \uC874 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/dns-zones"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns"] },
+    mcp: { kind: "built", tools: ["get_dns"] }
+  },
+  {
+    id: "dns-zone-add",
+    domain: "dns",
+    title: "DNS \uC874 \uCD94\uAC00",
+    routes: ["POST teams/[teamSlug]/dns-zones"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns add"] },
+    mcp: { kind: "built", tools: ["add_dns_zone"] }
+  },
+  {
+    id: "dns-zone-remove",
+    domain: "dns",
+    title: "DNS \uC874 \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]/dns-zones/[zoneId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns remove"] },
+    mcp: { kind: "built", tools: ["remove_dns_zone"] }
+  },
+  {
+    id: "dns-zone-check",
+    domain: "dns",
+    title: "\uB124\uC784\uC11C\uBC84 \uC774\uAD00 \uD655\uC778",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/check"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns check"] },
+    mcp: { kind: "built", tools: ["check_dns_zone"] }
+  },
+  {
+    id: "dns-zone-precheck",
+    domain: "dns",
+    title: "\uC774\uAD00 \uC804 \uBA54\uC77C \uD655\uC778",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/precheck"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns mail"] },
+    mcp: { kind: "built", tools: ["check_dns_mail"] }
+  },
+  {
+    id: "dns-zone-scan",
+    domain: "dns",
+    title: "\uAE30\uC874 DNS \uB808\uCF54\uB4DC \uC2A4\uCE94 \uACB0\uACFC",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/scan"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns scan"] },
+    mcp: { kind: "built", tools: ["get_dns_scan"] }
+  },
+  {
+    id: "dns-zone-scan-import",
+    domain: "dns",
+    title: "\uC2A4\uCE94\uD55C \uB808\uCF54\uB4DC \uC77C\uAD04 \uAC00\uC838\uC624\uAE30",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/scan"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns import"] },
+    mcp: { kind: "built", tools: ["import_dns_scan"] }
+  },
+  {
+    id: "dns-record-list",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/records"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records"] },
+    mcp: { kind: "built", tools: ["list_dns_records"] }
+  },
+  {
+    id: "dns-record-add",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uCD94\uAC00",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/records"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records add"] },
+    mcp: { kind: "built", tools: ["add_dns_record"] }
+  },
+  {
+    id: "dns-record-update",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uC218\uC815",
+    routes: ["PATCH teams/[teamSlug]/dns-zones/[zoneId]/records/[recordId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records update"] },
+    mcp: { kind: "built", tools: ["update_dns_record"] }
+  },
+  {
+    id: "dns-record-remove",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]/dns-zones/[zoneId]/records/[recordId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records remove"] },
+    mcp: { kind: "built", tools: ["remove_dns_record"] }
+  },
+  {
+    id: "protection-get",
+    domain: "protection",
+    title: "\uD504\uB9AC\uBDF0 \uBCF4\uD638 \uC0C1\uD0DC",
+    routes: ["GET projects/[projectId]/preview-protection"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection"] },
+    mcp: { kind: "built", tools: ["get_preview_protection"] }
+  },
+  {
+    id: "protection-set",
+    domain: "protection",
+    title: "\uD504\uB9AC\uBDF0 \uBCF4\uD638 \uCF1C\uAE30\xB7\uB044\uAE30",
+    routes: ["PUT projects/[projectId]/preview-protection"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro protection enable", "naro protection disable"]
+    },
+    mcp: { kind: "built", tools: ["set_preview_protection"] }
+  },
+  {
+    id: "protection-bypass-create",
+    domain: "protection",
+    title: "\uC6B0\uD68C \uC2DC\uD06C\uB9BF \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/preview-protection/bypass"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection bypass"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "apps/mcp/src/protection-tools.ts \u2014 \uC6B0\uD68C \uC2DC\uD06C\uB9BF\uC740 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. \uB300\uC2DC\uBCF4\uB4DC\uB098 naro protection bypass\uB85C \uB9CC\uB4E0\uB2E4."
+    }
+  },
+  {
+    id: "protection-bypass-remove",
+    domain: "protection",
+    title: "\uC6B0\uD68C \uC2DC\uD06C\uB9BF \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/preview-protection/bypass"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection bypass remove"] },
+    mcp: { kind: "built", tools: ["remove_preview_protection_bypass"] }
+  },
+  {
+    id: "database-info",
+    domain: "database",
+    title: "\uB370\uC774\uD130\uBCA0\uC774\uC2A4 \uC0C1\uD0DC\xB7\uC6A9\uB7C9\xB7\uD55C\uB3C4",
+    routes: ["GET projects/[projectId]/database"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db info"] },
+    mcp: { kind: "built", tools: ["get_database"] }
+  },
+  {
+    id: "database-enable",
+    domain: "database",
+    title: "\uB370\uC774\uD130\uBCA0\uC774\uC2A4 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/database"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db enable"] },
+    mcp: { kind: "built", tools: ["enable_database"] }
+  },
+  {
+    id: "database-query",
+    domain: "database",
+    title: "SQL \uC2E4\uD589",
+    routes: ["POST projects/[projectId]/database/query"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db query"] },
+    mcp: { kind: "built", tools: ["execute_sql"] }
+  },
+  {
+    id: "database-tables",
+    domain: "database",
+    title: "\uD14C\uC774\uBE14 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/tables"],
+    ui: { kind: "built" },
+    // naro db 명령들이 테이블 목록을 읽는다(client.db.tables).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["list_tables"] }
+  },
+  {
+    id: "database-schema-change",
+    domain: "database",
+    title: "\uD14C\uC774\uBE14\xB7\uC778\uB371\uC2A4 \uBC14\uAFB8\uAE30",
+    routes: ["POST projects/[projectId]/database/schema"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro db table create",
+        "naro db table add-column",
+        "naro db table rename-column",
+        "naro db table rename",
+        "naro db table drop-column",
+        "naro db table drop",
+        "naro db index create",
+        "naro db index drop"
+      ]
+    },
+    mcp: {
+      kind: "built",
+      tools: [
+        "create_table",
+        "alter_table",
+        "drop_table",
+        "create_index",
+        "drop_index"
+      ]
+    }
+  },
+  {
+    id: "database-migration-list",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/migrations"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro migration list"] },
+    mcp: { kind: "built", tools: ["list_migrations"] }
+  },
+  {
+    id: "database-migration-apply",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uC801\uC6A9",
+    routes: ["POST projects/[projectId]/database/migrations"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db push", "naro migration up"] },
+    mcp: { kind: "built", tools: ["apply_migration"] }
+  },
+  {
+    id: "database-export",
+    domain: "database",
+    title: "\uB364\uD504 \uB0B4\uB824\uBC1B\uAE30",
+    routes: ["POST projects/[projectId]/database/export"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db dump"] },
+    mcp: { kind: "built", tools: ["export_database"] }
+  },
+  {
+    id: "database-restore",
+    domain: "database",
+    title: "Time Travel \uBCF5\uAD6C",
+    routes: ["POST projects/[projectId]/database/restore"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db restore"] },
+    mcp: { kind: "built", tools: ["restore_database"] }
+  },
+  {
+    id: "database-bookmark",
+    domain: "database",
+    title: "\uBCF5\uAD6C \uC9C0\uC810(\uBD81\uB9C8\uD06C) \uC870\uD68C",
+    routes: ["GET projects/[projectId]/database/bookmark"],
+    ui: { kind: "built" },
+    // naro db restore가 되돌릴 북마크를 먼저 읽는다(client.db.bookmark).
+    cli: { kind: "built" },
+    // restore_database가 되돌릴 북마크를 먼저 읽는다(client.db.bookmark).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "database-pull",
+    domain: "database",
+    title: "\uC6D0\uACA9 \uC2A4\uD0A4\uB9C8\uB97C \uBCA0\uC774\uC2A4\uB77C\uC778 \uB9C8\uC774\uADF8\uB808\uC774\uC158\uC73C\uB85C",
+    routes: ["POST projects/[projectId]/database/pull"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uC6D0\uACA9 \uC2A4\uD0A4\uB9C8\uB97C ./migrations\uC758 \uCCAB \uD30C\uC77C\uB85C \uC4F4\uB2E4 \u2014 \uB0B4 \uCEF4\uD4E8\uD130\uC758 \uD3F4\uB354\uAC00 \uC788\uC5B4\uC57C \uD558\uB294 \uC77C\uC774\uB77C \uD654\uBA74\uC5D0\uC11C\uB294 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro db pull"] },
+    mcp: { kind: "built", tools: ["pull_database_schema"] }
+  },
+  {
+    id: "database-reset",
+    domain: "database",
+    title: "\uC804\uCCB4 \uB9AC\uC14B \uD6C4 \uB9C8\uC774\uADF8\uB808\uC774\uC158 \uB2E4\uC2DC \uC801\uC6A9",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "./migrations\uB97C \uCC98\uC74C\uBD80\uD130 \uB2E4\uC2DC \uC801\uC6A9\uD55C\uB2E4 \u2014 \uB0B4 \uCEF4\uD4E8\uD130\uC758 \uD3F4\uB354\uAC00 \uC788\uC5B4\uC57C \uD558\uB294 \uC77C\uC774\uB77C \uD654\uBA74\uC5D0\uC11C\uB294 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro db reset"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uBAA8\uB4E0 \uD14C\uC774\uBE14\uACFC \uC815\uCC45\uC744 \uC9C0\uC6B0\uACE0 \uB2E4\uC2DC \uB9CC\uB4E0\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-lint",
+    domain: "database",
+    title: "\uC2A4\uD0A4\uB9C8\xB7RLS \uC815\uCC45 \uB9B0\uD2B8",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db lint"] },
+    mcp: { kind: "built", tools: ["lint_database"] }
+  },
+  {
+    id: "database-gen-types",
+    domain: "database",
+    title: "\uC2A4\uD0A4\uB9C8\uC5D0\uC11C TypeScript \uD0C0\uC785 \uC0DD\uC131",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro gen types"] },
+    mcp: { kind: "built", tools: ["generate_typescript_types"] }
+  },
+  {
+    id: "database-migration-new",
+    domain: "database",
+    title: "\uC0C8 \uB9C8\uC774\uADF8\uB808\uC774\uC158 \uD30C\uC77C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "./migrations\uC5D0 \uD30C\uC77C\uC744 \uB9CC\uB4E0\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro migration new"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: "./migrations\uC5D0 \uD30C\uC77C \uD558\uB098\uB97C \uB9CC\uB4E0\uB2E4. apply_migration\uC740 \uC801\uC6A9\uD558\uBA74\uC11C \uD30C\uC77C\uC744 \uC4F4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "database-migration-repair",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uC6D0\uC7A5 \uC218\uB9AC",
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/migrations",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro migration repair"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC6D0\uC7A5\uB9CC \uACE0\uCCD0 \uC801\uC6A9 \uAE30\uB85D\uACFC \uC2E4\uC81C \uC2A4\uD0A4\uB9C8\uAC00 \uC5B4\uAE0B\uB0A0 \uC218 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-list",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/saved-queries"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-create",
+    domain: "database",
+    title: "\uCFFC\uB9AC \uC800\uC7A5",
+    routes: ["POST projects/[projectId]/database/saved-queries"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-update",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uC218\uC815",
+    routes: [
+      "PATCH projects/[projectId]/database/saved-queries/[savedQueryId]"
+    ],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-delete",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uC0AD\uC81C",
+    routes: [
+      "DELETE projects/[projectId]/database/saved-queries/[savedQueryId]"
+    ],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    // 대시보드 정책 화면(백엔드 메뉴 Policies)은 2026-11-04에 생겼다.
+    id: "rls-table-policy-list",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uBCC4 \uC815\uCC45 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy rules"] },
+    mcp: { kind: "built", tools: ["list_policy_rules"] }
+  },
+  {
+    id: "rls-table-policy-set",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uC758 \uC561\uC158\uBCC4 \uADDC\uCE59 \uC124\uC815",
+    routes: ["PUT projects/[projectId]/backend/policies/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy set"] },
+    // 규칙은 CREATE POLICY로, owner 규칙은 COMMENT ON POLICY p ON t IS 'naro:owner <column>'로 apply_migration에 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-table-policy-remove",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uC758 \uC815\uCC45 \uC804\uBD80 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/backend/policies/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy remove"] },
+    // apply_migration에 그 테이블의 DROP POLICY를 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-list",
+    domain: "rls",
+    title: "\uC815\uCC45 \uBAA9\uB85D(CREATE POLICY \uAF34)",
+    routes: ["GET projects/[projectId]/backend/rls/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy list"] },
+    mcp: { kind: "built", tools: ["list_policies"] }
+  },
+  {
+    id: "rls-policy-create",
+    domain: "rls",
+    title: "\uC815\uCC45 \uB9CC\uB4E4\uAE30(CREATE POLICY)",
+    routes: ["POST projects/[projectId]/backend/rls/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy create"] },
+    // apply_migration·execute_sql이 CREATE POLICY를 받는다. 테이블과 같은 마이그레이션에 쓰라고 apply_migration이 안내한다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-replace",
+    domain: "rls",
+    title: "\uC815\uCC45 \uBC14\uAFB8\uAE30",
+    routes: ["PUT projects/[projectId]/backend/rls/policies/[table]/[name]"],
+    ui: { kind: "built" },
+    // naro migration up·db push(client.db.applyMigration)나 naro db query
+    // (client.db.query) 한 번에 DROP POLICY와 CREATE POLICY를 함께 쓴다.
+    // MCP와 같은 경로다(PR #414 리뷰).
+    cli: { kind: "built" },
+    // apply_migration 한 번에 DROP POLICY와 CREATE POLICY를 함께 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-drop",
+    domain: "rls",
+    title: "\uC815\uCC45 \uC0AD\uC81C(DROP POLICY)",
+    routes: ["DELETE projects/[projectId]/backend/rls/policies/[table]/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy drop"] },
+    // apply_migration·execute_sql이 DROP POLICY를 받는다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "storage-info",
+    domain: "storage",
+    title: "Storage \uC0C1\uD0DC",
+    routes: ["GET projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage"] },
+    mcp: { kind: "built", tools: ["get_storage"] }
+  },
+  {
+    id: "storage-enable",
+    domain: "storage",
+    title: "Storage \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage enable"] },
+    mcp: { kind: "built", tools: ["enable_storage"] }
+  },
+  {
+    id: "storage-disable",
+    domain: "storage",
+    title: "Storage \uB044\uAE30",
+    routes: ["DELETE projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage disable"] },
+    mcp: { kind: "built", tools: ["disable_storage"] }
+  },
+  {
+    id: "storage-bucket-list",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/storage/buckets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket list"] },
+    mcp: { kind: "built", tools: ["list_storage_buckets"] }
+  },
+  {
+    id: "storage-bucket-create",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/backend/storage/buckets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket create"] },
+    mcp: { kind: "built", tools: ["create_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-get",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    // naro storage bucket update가 바꾸기 전에 읽는다(client.storage.getBucket).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["get_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-update",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PATCH projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket update"] },
+    mcp: { kind: "built", tools: ["update_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-remove",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket remove"] },
+    mcp: { kind: "built", tools: ["delete_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-empty",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uBE44\uC6B0\uAE30",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/empty"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket empty"] },
+    mcp: { kind: "built", tools: ["empty_storage_bucket"] }
+  },
+  {
+    id: "storage-object-list",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uBAA9\uB85D",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/list"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage ls"] },
+    mcp: { kind: "built", tools: ["list_storage_objects"] }
+  },
+  {
+    id: "storage-object-remove",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uC0AD\uC81C",
+    routes: [
+      "DELETE projects/[projectId]/backend/storage/buckets/[bucket]/objects"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage rm"] },
+    mcp: { kind: "built", tools: ["delete_storage_objects"] }
+  },
+  {
+    id: "storage-object-sign",
+    domain: "storage",
+    title: "\uB2E4\uC6B4\uB85C\uB4DC \uC11C\uBA85 URL",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/sign"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage sign"] },
+    mcp: { kind: "built", tools: ["create_storage_signed_url"] }
+  },
+  {
+    id: "storage-object-upload",
+    domain: "storage",
+    title: "\uC5C5\uB85C\uB4DC URL \uBC1C\uAE09",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/upload-url"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage cp"] },
+    mcp: { kind: "built", tools: ["create_storage_upload_url"] }
+  },
+  {
+    id: "storage-object-move",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uC774\uB3D9",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/move"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage mv"] },
+    mcp: { kind: "built", tools: ["move_storage_object"] }
+  },
+  {
+    id: "realtime-info",
+    domain: "realtime",
+    title: "Realtime \uC0C1\uD0DC\xB7\uC5F0\uACB0 \uC218",
+    routes: ["GET projects/[projectId]/backend/realtime"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime"] },
+    mcp: { kind: "built", tools: ["get_realtime"] }
+  },
+  {
+    id: "realtime-enable",
+    domain: "realtime",
+    title: "Realtime \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/realtime"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime enable"] },
+    mcp: { kind: "built", tools: ["enable_realtime"] }
+  },
+  {
+    id: "realtime-table-list",
+    domain: "realtime",
+    title: "\uACF5\uAC1C \uD14C\uC774\uBE14 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/realtime/tables"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables"] },
+    // get_realtime이 공개 테이블을 상태와 함께 돌려준다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "realtime-table-add",
+    domain: "realtime",
+    title: "\uD14C\uC774\uBE14 \uBCC0\uACBD \uACF5\uAC1C",
+    routes: ["PUT projects/[projectId]/backend/realtime/tables/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables add"] },
+    mcp: { kind: "built", tools: ["publish_realtime_table"] }
+  },
+  {
+    id: "realtime-table-remove",
+    domain: "realtime",
+    title: "\uD14C\uC774\uBE14 \uBCC0\uACBD \uACF5\uAC1C \uC911\uC9C0",
+    routes: ["DELETE projects/[projectId]/backend/realtime/tables/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables remove"] },
+    mcp: { kind: "built", tools: ["unpublish_realtime_table"] }
+  },
+  {
+    // 대시보드 Functions 화면은 2026-11-04에 생겼다. 그 전의 built는 틀렸다.
+    id: "function-list",
+    domain: "functions",
+    title: "\uD568\uC218 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/functions"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions"] },
+    mcp: { kind: "built", tools: ["list_functions"] }
+  },
+  {
+    id: "function-scaffold",
+    domain: "functions",
+    title: "\uD568\uC218 \uBF08\uB300 \uB9CC\uB4E4\uAE30",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "naro/functions/<name>/index.ts\uB97C \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro functions new"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: "naro/functions/<name>/index.ts\uB97C \uC4F4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "function-get",
+    domain: "functions",
+    title: "\uD568\uC218 \uC0C1\uC138",
+    routes: ["GET projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions versions"] },
+    mcp: { kind: "built", tools: ["get_function"] }
+  },
+  {
+    id: "function-update",
+    domain: "functions",
+    title: "\uD568\uC218 verify_jwt \uC124\uC815",
+    routes: ["PATCH projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions update"] },
+    mcp: { kind: "built", tools: ["update_function"] }
+  },
+  {
+    id: "function-delete",
+    domain: "functions",
+    title: "\uD568\uC218 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions delete"] },
+    mcp: { kind: "built", tools: ["delete_function"] }
+  },
+  {
+    id: "function-version-upload",
+    domain: "functions",
+    title: "\uBC88\uB4E4\uD55C \uCF54\uB4DC\uB97C \uC0C8 \uBC84\uC804\uC73C\uB85C \uC62C\uB9AC\uAE30",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/versions"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uB85C\uCEEC\uC5D0\uC11C \uBC88\uB4E4\uD558\uACE0 workerd\uB85C \uBD80\uD305 \uD655\uC778\uD55C \uCF54\uB4DC\uB97C \uC62C\uB9B0\uB2E4. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uB294 \uBC88\uB4E4\uD560 \uC18C\uC2A4\uAC00 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro functions deploy"] },
+    mcp: { kind: "built", tools: ["deploy_function"] }
+  },
+  {
+    id: "function-version-deploy",
+    domain: "functions",
+    title: "\uC800\uC7A5\uB41C \uBC84\uC804 \uBC30\uD3EC",
+    routes: [
+      "POST projects/[projectId]/backend/functions/[name]/versions/[versionId]/deploy"
+    ],
+    ui: { kind: "built" },
+    // naro functions deploy가 올린 버전을 배포한다(client.functions.deploy).
+    cli: { kind: "built" },
+    // deploy_function이 naro-cli의 deployFunctions로 올린 버전을 배포한다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "function-rollback",
+    domain: "functions",
+    title: "\uC774\uC804 \uBC84\uC804\uC73C\uB85C \uB864\uBC31",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/rollback"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions rollback"] },
+    mcp: { kind: "built", tools: ["rollback_function"] }
+  },
+  {
+    id: "function-logs",
+    domain: "functions",
+    title: "\uD568\uC218 \uB85C\uADF8",
+    routes: ["GET projects/[projectId]/backend/functions/[name]/logs"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions logs"] },
+    mcp: { kind: "built", tools: ["get_function_logs"] }
+  },
+  {
+    id: "function-invoke",
+    domain: "functions",
+    title: "\uD568\uC218 \uD638\uCD9C",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/invoke"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions invoke"] },
+    mcp: { kind: "built", tools: ["invoke_function"] }
+  },
+  {
+    id: "function-secret-list",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/functions-secrets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets"] },
+    mcp: { kind: "built", tools: ["list_function_secrets"] }
+  },
+  {
+    id: "function-secret-set",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uC124\uC815",
+    routes: ["PUT projects/[projectId]/backend/functions-secrets"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/functions/secrets",
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro functions secrets set", "naro functions secrets import"]
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "apps/mcp/src/function-tools.ts\uC758 NO_SECRET_VALUES \u2014 \uAC12\uC774 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. \uC0AC\uC6A9\uC790\uAC00 naro functions secrets set\uC744 \uB3CC\uB9AC\uAC8C \uD55C\uB2E4."
+    }
+  },
+  // 라우트는 function-secret-set과 같은 PUT functions-secrets다. 한 라우트는
+  // 한 기능에만 걸리므로 여기에는 적지 않는다.
+  {
+    id: "function-secret-unset",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uD574\uC81C",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets unset"] },
+    mcp: { kind: "built", tools: ["unset_function_secret"] }
+  },
+  {
+    id: "function-sync",
+    domain: "functions",
+    title: "\uD568\uC218 \uC7AC\uB3D9\uAE30\uD654",
+    routes: ["POST projects/[projectId]/backend/functions-sync"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets sync"] },
+    mcp: { kind: "built", tools: ["sync_functions"] }
+  },
+  {
+    id: "backend-info",
+    domain: "backend",
+    title: "Backend \uC0C1\uD0DC\xB7URL\xB7anon \uD0A4",
+    routes: ["GET projects/[projectId]/backend"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend"] },
+    mcp: { kind: "built", tools: ["get_backend"] }
+  },
+  {
+    id: "backend-enable",
+    domain: "backend",
+    title: "Backend \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/enable"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend enable"] },
+    mcp: { kind: "built", tools: ["enable_backend"] }
+  },
+  {
+    id: "backend-provision",
+    domain: "backend",
+    title: "Backend \uD504\uB85C\uBE44\uC800\uB2DD \uC774\uC5B4\uAC00\uAE30",
+    routes: ["POST projects/[projectId]/backend/provision"],
+    ui: { kind: "built" },
+    // naro backend enable이 멈춘 프로비저닝을 이어 간다.
+    cli: { kind: "built" },
+    // enable_backend가 같은 호출이다(client.backend.enable — 라우트 provision은 그 옛 이름).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "backend-disable",
+    domain: "backend",
+    title: "Backend \uB044\uAE30",
+    routes: ["POST projects/[projectId]/backend/disable"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend disable"] },
+    mcp: { kind: "built", tools: ["disable_backend"] }
+  },
+  {
+    id: "backend-keys",
+    domain: "backend",
+    title: "API \uD0A4 \uC870\uD68C(service \uD0A4 \uD3EC\uD568)",
+    routes: ["GET projects/[projectId]/backend/keys"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend keys"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "service \uD0A4\uAC00 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-keys-rotate",
+    domain: "backend",
+    title: "API \uD0A4 \uAD50\uCCB4",
+    routes: ["POST projects/[projectId]/backend/keys/rotate"],
+    // 2026-11-04 전에는 화면이 없었는데 built로 적혀 있었다.
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend keys rotate"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC61B \uD0A4\uAC00 \uBC14\uB85C \uC8FD\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-signing-key-rotate",
+    domain: "backend",
+    title: "\uC11C\uBA85 \uD0A4 \uAD50\uCCB4",
+    routes: ["POST projects/[projectId]/backend/signing-key/rotate"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend signing-key rotate"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uBC1C\uAE09\uD55C \uD1A0\uD070\uC774 15\uBD84 \uC548\uC5D0 \uBAA8\uB450 \uC8FD\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-auth-get",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uC124\uC815 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro backend auth", "naro backend auth redirects"]
+    },
+    mcp: { kind: "built", tools: ["get_backend_auth"] }
+  },
+  {
+    id: "backend-auth-update",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PUT projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro backend auth signups",
+        "naro backend auth password",
+        "naro backend auth email set",
+        "naro backend auth oauth set",
+        "naro backend auth redirects add",
+        "naro backend auth redirects remove",
+        "naro backend auth require-verification"
+      ]
+    },
+    // 리다이렉트 제거·가입·확인 메일·비밀번호 길이만. 메일 API 키와
+    // OAuth client secret은 대화에 남고(secret-value), 리다이렉트 추가는 재설정 토큰이
+    // 그 origin으로 가므로(PR #434 리뷰) 대시보드와 CLI만 한다.
+    mcp: { kind: "built", tools: ["update_backend_auth"] }
+  },
+  {
+    id: "backend-auth-remove",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uACF5\uAE09\uC790\xB7\uBA54\uC77C \uC124\uC815 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro backend auth email remove",
+        "naro backend auth oauth remove"
+      ]
+    },
+    mcp: { kind: "built", tools: ["remove_backend_auth"] }
+  },
+  {
+    id: "backend-user-list",
+    domain: "backend",
+    title: "\uC720\uC800 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/users"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users"] },
+    mcp: { kind: "built", tools: ["list_backend_users"] }
+  },
+  {
+    id: "backend-user-create",
+    domain: "backend",
+    title: "\uC720\uC800 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/backend/users"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/auth",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users create"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uBE44\uBC00\uBC88\uD638\uAC00 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-user-delete",
+    domain: "backend",
+    title: "\uC720\uC800 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/users/[userId]"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/auth",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC720\uC800\uC640 \uC138\uC158\uC774 \uC0AC\uB77C\uC9C4\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "logs-runtime",
+    domain: "logs",
+    title: "\uB7F0\uD0C0\uC784 \uB85C\uADF8",
+    routes: ["GET projects/[projectId]/logs"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro logs"] },
+    mcp: { kind: "built", tools: ["get_runtime_logs"] }
+  },
+  {
+    id: "analytics",
+    domain: "measurement",
+    title: "Web Analytics",
+    routes: ["GET projects/[projectId]/analytics"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro analytics"] },
+    mcp: { kind: "built", tools: ["get_analytics"] }
+  },
+  {
+    id: "insights",
+    domain: "measurement",
+    title: "Speed Insights",
+    routes: ["GET projects/[projectId]/speed-insights"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro insights"] },
+    mcp: { kind: "built", tools: ["get_speed_insights"] }
+  },
+  {
+    id: "insights-toggle",
+    domain: "measurement",
+    title: "Speed Insights \uCE21\uC815 \uCF1C\uAE30\xB7\uB044\uAE30",
+    routes: ["PUT projects/[projectId]/speed-insights"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro insights enable", "naro insights disable"]
+    },
+    mcp: { kind: "built", tools: ["set_speed_insights"] }
+  },
+  {
+    id: "insights-deployments",
+    domain: "measurement",
+    title: "Speed Insights \uBC30\uD3EC\uBCC4 \uBE44\uAD50",
+    routes: ["GET projects/[projectId]/speed-insights/deployments"],
+    ui: { kind: "built" },
+    // naro insights가 배포별 표를 같이 읽는다(client.insights.overview).
+    cli: { kind: "built" },
+    // get_speed_insights가 route 없이 배포별 표를 같이 돌려준다(client.insights.overview).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "insights-paths",
+    domain: "measurement",
+    title: "Speed Insights \uB77C\uC6B0\uD2B8\uBCC4 \uACBD\uB85C",
+    routes: ["GET projects/[projectId]/speed-insights/paths"],
+    ui: { kind: "built" },
+    // naro insights --route가 읽는다(client.insights.paths).
+    cli: { kind: "built" },
+    // get_speed_insights에 route를 주면 경로를 돌려준다(client.insights.paths).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "observability",
+    domain: "measurement",
+    title: "Observability",
+    routes: ["GET projects/[projectId]/observability"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro observability"] },
+    mcp: { kind: "built", tools: ["get_observability"] }
+  },
+  {
+    id: "firewall-list",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/firewall"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall"] },
+    mcp: { kind: "built", tools: ["list_firewall_rules"] }
+  },
+  {
+    id: "firewall-add",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/firewall"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall add"] },
+    mcp: { kind: "built", tools: ["add_firewall_rule"] }
+  },
+  {
+    id: "firewall-update",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uC218\uC815",
+    routes: ["PATCH projects/[projectId]/firewall/[ruleId]"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro firewall enable", "naro firewall disable"]
+    },
+    mcp: { kind: "built", tools: ["set_firewall_rule_enabled"] }
+  },
+  {
+    id: "firewall-remove",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/firewall/[ruleId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall remove"] },
+    mcp: { kind: "built", tools: ["remove_firewall_rule"] }
+  },
+  {
+    id: "flag-list",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/flags"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags"] },
+    mcp: { kind: "built", tools: ["list_flags"] }
+  },
+  {
+    id: "flag-add",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/flags"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags add"] },
+    mcp: { kind: "built", tools: ["add_flag"] }
+  },
+  {
+    id: "flag-update",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uC218\uC815",
+    routes: ["PATCH projects/[projectId]/flags/[flagId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags on", "naro flags off"] },
+    mcp: { kind: "built", tools: ["set_flag"] }
+  },
+  {
+    id: "flag-remove",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/flags/[flagId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags remove"] },
+    mcp: { kind: "built", tools: ["remove_flag"] }
+  },
+  {
+    id: "dashboard-link",
+    domain: "guidance",
+    title: "CLI\xB7MCP\uB85C \uBABB \uD558\uB294 \uAE30\uB2A5\uC758 \uB300\uC2DC\uBCF4\uB4DC \uB9C1\uD06C",
+    ui: {
+      kind: "excluded",
+      reason: "dashboard-itself",
+      note: "\uC0AC\uC6A9\uC790\uAC00 \uC774\uBBF8 \uB300\uC2DC\uBCF4\uB4DC\uC5D0 \uC788\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro dashboard"] },
+    mcp: { kind: "built", tools: ["dashboard_link"] }
+  }
+];
+function dashboardNeeds(path) {
+  return {
+    team: path.includes("[teamSlug]"),
+    project: path.includes("[projectSlug]")
+  };
+}
+function dashboardUrl(baseUrl, path, slugs) {
+  const filled2 = path.replace("[teamSlug]", () => {
+    if (!slugs.teamSlug) throw new Error(`${path} needs a team slug`);
+    return encodeURIComponent(slugs.teamSlug);
+  }).replace("[projectSlug]", () => {
+    if (!slugs.projectSlug) throw new Error(`${path} needs a project slug`);
+    return encodeURIComponent(slugs.projectSlug);
+  });
+  return `${baseUrl.replace(/\/+$/, "")}${filled2}`;
+}
+
 // ../../packages/core/src/deployment.ts
 var PHASES = [
   "QUEUED",
@@ -453,7 +2372,7 @@ function quoted(span, slug, switchContext) {
   }
 }
 var QUOTED = /`(naro [^`\n]+)`/g;
-var BARE = /(?<![`\w/-])naro ([a-z]+)((?: [a-z][a-z-]*)*)/g;
+var BARE = /(?<![`\w/-])naro ([a-z]+)((?: (?!naro\b)[a-z][a-z-]*)*)/g;
 function bare(match, command, rest, after, slug, switchContext) {
   const vocabulary = SUBCOMMANDS[command];
   if (vocabulary === void 0) return match;
@@ -463,7 +2382,7 @@ function bare(match, command, rest, after, slug, switchContext) {
   if (count2 === 0) return match;
   const head = ["naro", command, ...words.slice(0, count2)];
   const tail = words.slice(count2);
-  const following = after.split(/\n|[.;,)](?:\s|$)/, 1)[0] ?? "";
+  const following = after.split(/\n|[.;,)](?:\s|$)|\uE000/, 1)[0] ?? "";
   if (/(?:^|\s)--env[\s=]/.test(following) || after.startsWith(` \u2014 ${PRODUCTION_SWITCH_NOTE}`))
     return match;
   const shown = head.join(" ");
@@ -633,7 +2552,13 @@ var DEPLOYMENT_ERROR_CODES = [
   /** A deployment failure: the environment was deleted before its deployment finished. */
   "ENVIRONMENT_DELETED",
   /** The edge refused the environment's protection change; the database change is rolled back. */
-  "ENVIRONMENT_PROTECTION_PUBLISH_FAILED"
+  "ENVIRONMENT_PROTECTION_PUBLISH_FAILED",
+  /** The variable came from the Supabase connection; only its card changes it (spec 2026-11-04 §6.3). */
+  "ENV_MANAGED",
+  /** The 10-minute Supabase sign-in cookie is gone or expired (spec 2026-11-04 §6.4). */
+  "SUPABASE_SESSION_EXPIRED",
+  /** The Supabase Management API refused or did not answer (spec 2026-11-04 §6.4). */
+  "SUPABASE_API_FAILED"
 ];
 var DeploymentError = class extends Error {
   code;
@@ -650,6 +2575,15 @@ var DeploymentError = class extends Error {
 // ../../packages/core/src/functions.ts
 var FUNCTION_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
 var FUNCTION_WORKER_NAME_PREFIX = "naro-fn-";
+var FUNCTION_INVOKE_METHODS = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+];
+var FUNCTION_INVOKE_MAX_RESPONSE_BYTES = 65536;
+var FUNCTION_INVOKE_TIMEOUT_MS = 12e4;
 function isFunctionName(name) {
   return FUNCTION_NAME_RE.test(name);
 }
@@ -710,6 +2644,38 @@ function projectPath(teamSlug, projectSlug) {
 // ../../packages/core/src/platform-mail.ts
 var encoder = new TextEncoder();
 
+// ../../packages/core/src/read-capped.ts
+async function readCapped(response, limit, signal) {
+  const reader = response.body?.getReader();
+  if (!reader) return { text: "", truncated: false };
+  signal?.addEventListener(
+    "abort",
+    () => void reader.cancel().catch(() => void 0),
+    { once: true }
+  );
+  const chunks = [];
+  let size = 0;
+  while (size <= limit) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    size += value.byteLength;
+  }
+  if (size > limit) await reader.cancel().catch(() => void 0);
+  const all = new Uint8Array(Math.min(size, limit));
+  let offset = 0;
+  for (const chunk of chunks) {
+    const part = chunk.subarray(
+      0,
+      Math.min(chunk.byteLength, all.byteLength - offset)
+    );
+    all.set(part, offset);
+    offset += part.byteLength;
+    if (offset >= all.byteLength) break;
+  }
+  return { text: new TextDecoder().decode(all), truncated: size > limit };
+}
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15614,7 +17580,7 @@ var REQUESTS = {
     blocked: "Sites on this team answer 503 until the month ends (UTC).",
     running: "Sites keep running for now.",
     button: "View usage",
-    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on naro.`
+    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on Naro.`
   },
   ko: {
     subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
@@ -15624,7 +17590,7 @@ var REQUESTS = {
     blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
     running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
     button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
-    footer: (team) => `naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
+    footer: (team) => `Naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
   },
   ja: {
     subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
@@ -15634,7 +17600,7 @@ var REQUESTS = {
     blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
     running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
     button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
-    footer: (team) => `naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
+    footer: (team) => `Naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
   }
 };
 var BUILDS = {
@@ -16315,10 +18281,13 @@ export default {
   },
 };
 `;
-var OUTPUT_DIR = "dist";
+var VINEXT_OUTPUT_DIR = "dist";
 var SERVER_DIR = "server";
 var CLIENT_DIR = "client";
 var WRANGLER_OUTPUT_NAME = "wrangler.json";
+function vinextWranglerConfigPath(appRoot) {
+  return join6(appRoot, VINEXT_OUTPUT_DIR, SERVER_DIR, WRANGLER_OUTPUT_NAME);
+}
 async function exists3(path) {
   try {
     await access5(path);
@@ -16342,7 +18311,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
   if (await exists3(workerEntryPath)) {
     throw new DeploymentError(
       "ARTIFACT_INVALID",
-      `The project already has a ${GENERATED_WORKER_ENTRY}. naro writes its vinext Worker entry under that name and will not overwrite a file of the project's.`
+      `The project already has a ${GENERATED_WORKER_ENTRY}. Naro writes its vinext Worker entry under that name and will not overwrite a file of the project's.`
     );
   }
   const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
@@ -16374,7 +18343,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
         compatibility_flags: ["nodejs_compat"],
         main: `./${GENERATED_WORKER_ENTRY}`,
         assets: {
-          directory: `${OUTPUT_DIR}/${CLIENT_DIR}`,
+          directory: `${VINEXT_OUTPUT_DIR}/${CLIENT_DIR}`,
           binding: "ASSETS"
         }
       },
@@ -16395,7 +18364,7 @@ function parseVinextCheckReport(output) {
   const plain = output.replace(ANSI_ESCAPE, "");
   const match = SUMMARY_LINE.exec(plain);
   if (!match) return null;
-  const issueLines = [
+  const issueLines2 = [
     ...new Set(
       plain.split("\n").map((line) => ISSUE_LINE.exec(line)?.[1]?.trim()).filter((line) => Boolean(line))
     )
@@ -16410,7 +18379,7 @@ function parseVinextCheckReport(output) {
     supported: Number(match[2]),
     partial: Number(match[3]),
     issues: Number(match[4]),
-    issueLines,
+    issueLines: issueLines2,
     partialLines
   };
 }
@@ -16473,14 +18442,14 @@ function moduleMatchers(rules) {
 }
 async function readVinextArtifact(appRoot, identity) {
   try {
-    const outputRoot = resolve2(appRoot, OUTPUT_DIR);
+    const outputRoot = resolve2(appRoot, VINEXT_OUTPUT_DIR);
     const serverRoot = join6(outputRoot, SERVER_DIR);
     const clientRoot = join6(outputRoot, CLIENT_DIR);
     const configPath = join6(serverRoot, WRANGLER_OUTPUT_NAME);
     if (!await exists3(configPath)) {
       throw new DeploymentError(
         "ARTIFACT_INVALID",
-        `vinext build produced no ${OUTPUT_DIR}/${SERVER_DIR}/${WRANGLER_OUTPUT_NAME}.`
+        `vinext build produced no ${VINEXT_OUTPUT_DIR}/${SERVER_DIR}/${WRANGLER_OUTPUT_NAME}.`
       );
     }
     const metadata = JSON.parse(
@@ -16762,10 +18731,10 @@ async function angularOutput(root) {
   } catch {
     workspace = null;
   }
-  const project = Object.values(workspace?.projects ?? {}).find(
+  const project2 = Object.values(workspace?.projects ?? {}).find(
     (entry) => entry.projectType === "application"
   );
-  const build = project?.architect?.build;
+  const build = project2?.architect?.build;
   const outputPath = build?.options?.outputPath;
   const legacy = build?.builder?.endsWith(":browser") ?? false;
   const clean = (path) => path.replace(/^\.?\/+/, "").replace(/\/+$/, "");
@@ -16777,7 +18746,7 @@ async function angularOutput(root) {
       ""
     );
   const name = Object.entries(workspace?.projects ?? {}).find(
-    ([, entry]) => entry === project
+    ([, entry]) => entry === project2
   )?.[0];
   if (name) return `dist/${name}/browser`;
   throw new DeploymentError(
@@ -18552,13 +20521,8 @@ function createAwsMiddlewareCloudflareAppStrategy() {
 }
 
 // ../../packages/build/src/strategy/strategies/vinext-cloudflare.ts
-import { join as join16 } from "path";
 var VINEXT_MIN_NEXT_MAJOR = 16;
 var VINEXT_BUILD_SCRIPTS = ["esbuild", "workerd"];
-var VINEXT_OUTPUT = {
-  outputRoot: "dist",
-  bundleDir: "dist/.naro-bundle"
-};
 async function runCheck(context, observer) {
   if (!context.toolchain.vinext) return null;
   const held = [];
@@ -18708,13 +20672,8 @@ function createVinextCloudflareStrategy(options) {
         context,
         {
           appRoot: fork.appRoot,
-          wranglerConfigPath: join16(
-            fork.appRoot,
-            "dist",
-            "server",
-            "wrangler.json"
-          ),
-          ...VINEXT_OUTPUT
+          wranglerConfigPath: vinextWranglerConfigPath(fork.appRoot),
+          outputRoot: VINEXT_OUTPUT_DIR
         },
         observer
       );
@@ -18733,7 +20692,7 @@ function createVinextCloudflareStrategy(options) {
 // ../../packages/build/src/strategy/workspace.ts
 import { execFile } from "child_process";
 import { cp, mkdir as mkdir2, readdir as readdir4, rm as rm2 } from "fs/promises";
-import { basename as basename2, dirname as dirname3, join as join17, relative as relative5, resolve as resolve6 } from "path";
+import { basename as basename2, dirname as dirname3, join as join16, relative as relative5, resolve as resolve6 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
@@ -18756,14 +20715,14 @@ async function copyInstalledPackages(source, target2) {
   const walk2 = async (dir) => {
     for (const entry of await readdir4(dir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name === ".git") continue;
-      const path = join17(dir, entry.name);
+      const path = join16(dir, entry.name);
       if (entry.name === "node_modules") installs.push(path);
       else await walk2(path);
     }
   };
   await walk2(origin);
   for (const install of installs)
-    await copyTree(install, join17(target2, relative5(origin, install)));
+    await copyTree(install, join16(target2, relative5(origin, install)));
 }
 async function copyTree(from, to) {
   await mkdir2(dirname3(to), { recursive: true });
@@ -18778,7 +20737,7 @@ async function copyTree(from, to) {
   await cp(from, to, { recursive: true, verbatimSymlinks: true });
 }
 function forkedAppRoot(checkout, appRoot, forkCheckout) {
-  return join17(forkCheckout, relative5(checkout, appRoot));
+  return join16(forkCheckout, relative5(checkout, appRoot));
 }
 
 // ../../packages/build/src/local-build-executor.ts
@@ -18801,7 +20760,7 @@ async function withRouteList(artifact, list, appRoot, observer) {
   }
 }
 var defaultLocalBuildDependencies = {
-  createWorkspace: () => mkdtemp(join18(tmpdir(), "next-deploy-build-")),
+  createWorkspace: () => mkdtemp(join17(tmpdir(), "next-deploy-build-")),
   removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
@@ -18836,7 +20795,7 @@ async function readInstalledNextVersion(appRoot, checkout) {
   for (; ; ) {
     try {
       const source = await readFile13(
-        join18(dir, "node_modules", "next", "package.json"),
+        join17(dir, "node_modules", "next", "package.json"),
         "utf8"
       );
       const version3 = JSON.parse(source).version;
@@ -18991,8 +20950,8 @@ var LocalBuildExecutor = class {
   }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
-    const checkout = join18(workspace, "checkout");
-    const pmCacheDir = join18(workspace, ".pm-store");
+    const checkout = join17(workspace, "checkout");
+    const pmCacheDir = join17(workspace, ".pm-store");
     let cacheSeq = 0;
     const commandAvailable = this.dependencies.commandAvailable ?? hasCommand;
     const compressor = "zstd";
@@ -19001,7 +20960,7 @@ var LocalBuildExecutor = class {
       transport: cache,
       fetch: this.dependencies.cacheFetch ?? ((url2, init) => fetch(url2, init)),
       runCommand: this.dependencies.runCommand,
-      tmpFile: (suffix) => join18(workspace, `cache-${String(cacheSeq++)}${suffix}`),
+      tmpFile: (suffix) => join17(workspace, `cache-${String(cacheSeq++)}${suffix}`),
       // One latch for the whole build so a disabled cache warns once.
       report: { unavailable: false }
     } : null;
@@ -19209,7 +21168,7 @@ var LocalBuildExecutor = class {
           }
         }
         await notifyStatus(observer, "BUILDING");
-        const buildCacheDir = resolved.preset.cachePath ? join18(appRoot, resolved.preset.cachePath) : null;
+        const buildCacheDir = resolved.preset.cachePath ? join17(appRoot, resolved.preset.cachePath) : null;
         const buildCacheKey = sanitizeCacheKey(input.branch);
         if (cachePorts && buildCacheDir) {
           await tryRestore(
@@ -19233,13 +21192,13 @@ var LocalBuildExecutor = class {
             entries: fingerprintEntries,
             nextVersion: nextVersion ? `${String(nextVersion.major)}.${String(nextVersion.minor)}.${String(nextVersion.patch)}` : "unknown"
           });
-          const pristine = join18(workspace, "pristine");
+          const pristine = join17(workspace, "pristine");
           const fork = this.dependencies.forkWorkspace ?? defaultFork;
           await fork(checkout, pristine);
           let forks = 0;
           const resolverConcurrency = this.dependencies.resolverConcurrency ?? 1;
           const forkWorkspace = async (label2) => {
-            const target2 = join18(
+            const target2 = join17(
               workspace,
               "forks",
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
@@ -19535,12 +21494,12 @@ async function errorFromResponse(response, context) {
 // ../../packages/sdk/src/session.ts
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join19 } from "path";
+import { join as join18 } from "path";
 function credentialsDir(home = homedir()) {
-  return join19(home, ".naro");
+  return join18(home, ".naro");
 }
 function credentialsFile(home = homedir()) {
-  return join19(credentialsDir(home), "credentials.json");
+  return join18(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
   mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
@@ -19681,13 +21640,13 @@ function page(options) {
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${title} \xB7 naro</title>
+<title>${title} \xB7 Naro</title>
 <link rel="icon" href="${FAVICON}">
 <style>:root{--tone:${tone.color};--tone-soft:${tone.soft};--tone-edge:${tone.edge};--glow:${tone.glow}}${STYLES}</style>
 </head>
 <body>
 <main class="card">
-  <span class="brand"><span class="brand-mark">n</span>naro</span>
+  <span class="brand"><span class="brand-mark">n</span>Naro</span>
   <div class="glyph">${tone.icon}</div>
   <h1>${title}</h1>
   <p>${escapeHtml(options.message)}</p>
@@ -19976,6 +21935,233 @@ function openBrowser(url2) {
   child.unref();
 }
 
+// ../../packages/sdk/src/dns.ts
+var DnsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(teamSlug, suffix = "") {
+    return `/api/teams/${encodeURIComponent(teamSlug)}/dns-zones${suffix}`;
+  }
+  zone(teamSlug, zoneId, suffix = "") {
+    return this.base(teamSlug, `/${encodeURIComponent(zoneId)}${suffix}`);
+  }
+  /** The team's zones and the project domains each one could carry. */
+  async state(teamSlug) {
+    return this.client.request(this.base(teamSlug), {
+      context: "Read naro DNS"
+    });
+  }
+  /** Starts moving a domain onto naro DNS; the zone answers its name servers. */
+  async addZone(teamSlug, name) {
+    const body = await this.client.request(
+      this.base(teamSlug),
+      { method: "POST", body: { name }, context: "Start a DNS move" }
+    );
+    return body.zone;
+  }
+  /** Cancels a move, or takes an active zone off naro DNS. */
+  async removeZone(teamSlug, zoneId) {
+    await this.client.request(this.zone(teamSlug, zoneId), {
+      method: "DELETE",
+      context: "Remove a DNS zone"
+    });
+  }
+  /** Reads the zone's status and asks Cloudflare for an activation check. */
+  async check(teamSlug, zoneId) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/check"),
+      { method: "POST", context: "Check a DNS zone" }
+    );
+    return body.zone;
+  }
+  /** The mail records (MX, SPF, DMARC, DKIM) to keep before the move. */
+  async mailCheck(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/precheck"),
+      { context: "Check mail records" }
+    );
+  }
+  /** The records Cloudflare's scan of the current DNS found. */
+  async scan(teamSlug, zoneId) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/scan"),
+      { context: "Read the DNS scan" }
+    );
+    return body.records;
+  }
+  /** Adds every scanned record to the zone. */
+  async importScan(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/scan"),
+      { method: "POST", context: "Import the DNS scan" }
+    );
+  }
+  async records(teamSlug, zoneId) {
+    return this.client.request(
+      this.zone(teamSlug, zoneId, "/records"),
+      { context: "List DNS records" }
+    );
+  }
+  /** Adds a record, always DNS only. */
+  async addRecord(teamSlug, zoneId, input) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, "/records"),
+      { method: "POST", body: input, context: "Add a DNS record" }
+    );
+    return body.record;
+  }
+  /** Overwrites the whole record; its type cannot change. */
+  async replaceRecord(teamSlug, zoneId, recordId, input) {
+    const body = await this.client.request(
+      this.zone(teamSlug, zoneId, `/records/${encodeURIComponent(recordId)}`),
+      { method: "PATCH", body: input, context: "Change a DNS record" }
+    );
+    return body.record;
+  }
+  async removeRecord(teamSlug, zoneId, recordId) {
+    await this.client.request(
+      this.zone(teamSlug, zoneId, `/records/${encodeURIComponent(recordId)}`),
+      { method: "DELETE", context: "Remove a DNS record" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/edge-config.ts
+var project = (projectId, suffix) => `/api/projects/${encodeURIComponent(projectId)}${suffix}`;
+var FirewallApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      project(projectId, "/firewall"),
+      { context: "List firewall rules" }
+    );
+    return body.rules;
+  }
+  /** `VALIDATION_FAILED` for a bad kind or value, `RULE_LIMIT` past the cap. */
+  async add(projectId, input) {
+    const body = {
+      kind: input.kind,
+      value: input.value
+    };
+    if (input.rateLimit !== void 0) body.rate_limit = input.rateLimit;
+    if (input.periodSeconds !== void 0)
+      body.period_seconds = input.periodSeconds;
+    if (input.enabled !== void 0) body.enabled = input.enabled;
+    const answer = await this.client.request(
+      project(projectId, "/firewall"),
+      { method: "POST", body, context: "Add firewall rule" }
+    );
+    return answer.rule;
+  }
+  async setEnabled(projectId, ruleId, enabled) {
+    const answer = await this.client.request(
+      project(projectId, `/firewall/${encodeURIComponent(ruleId)}`),
+      { method: "PATCH", body: { enabled }, context: "Change firewall rule" }
+    );
+    return answer.rule;
+  }
+  async remove(projectId, ruleId) {
+    await this.client.request(
+      project(projectId, `/firewall/${encodeURIComponent(ruleId)}`),
+      { method: "DELETE", context: "Remove firewall rule" }
+    );
+  }
+};
+var FlagsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(projectId) {
+    const body = await this.client.request(
+      project(projectId, "/flags"),
+      { context: "List flags" }
+    );
+    return body.flags;
+  }
+  /** Off unless `enabled`. `FLAG_LIMIT` past 32. */
+  async add(projectId, name, enabled = false) {
+    const answer = await this.client.request(
+      project(projectId, "/flags"),
+      { method: "POST", body: { name, enabled }, context: "Add flag" }
+    );
+    return answer.flag;
+  }
+  async setEnabled(projectId, flagId, enabled) {
+    const answer = await this.client.request(
+      project(projectId, `/flags/${encodeURIComponent(flagId)}`),
+      { method: "PATCH", body: { enabled }, context: "Change flag" }
+    );
+    return answer.flag;
+  }
+  async remove(projectId, flagId) {
+    await this.client.request(
+      project(projectId, `/flags/${encodeURIComponent(flagId)}`),
+      { method: "DELETE", context: "Remove flag" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/ops.ts
+var BillingApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** `usage.read`: `403 FORBIDDEN "Your role cannot read this team's billing."` otherwise. */
+  async get(teamSlug) {
+    const body = await this.client.request(`/api/teams/${encodeURIComponent(teamSlug)}/billing`, {
+      context: "Read billing"
+    });
+    return {
+      team: body.team,
+      subscription: body.subscription,
+      canManage: body.canManage,
+      overage: body.overage
+    };
+  }
+};
+var ObservabilityApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** 7d unless given; `400 VALIDATION_FAILED "range must be 24h, 7d or 30d."` otherwise. */
+  async report(projectId, options = {}) {
+    const query = options.range === void 0 ? "" : `?range=${encodeURIComponent(options.range)}`;
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/observability${query}`,
+      { context: "Read observability" }
+    );
+  }
+};
+
+// ../../packages/sdk/src/supabase-links.ts
+var SupabaseApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async links(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/supabase`,
+      { context: "Read Supabase links" }
+    );
+    return body.links;
+  }
+  /**
+   * Removes the link of one target (production, preview or an environment's
+   * slug), or every link the role may write when `target` is left out, with
+   * the env rows they hold. Answers how many went.
+   */
+  async disconnect(projectId, options = {}) {
+    const query = options.target === void 0 ? "" : `?target=${encodeURIComponent(options.target)}`;
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/supabase${query}`,
+      { method: "DELETE", context: "Disconnect Supabase" }
+    );
+  }
+};
+
 // ../../packages/sdk/src/environments.ts
 function isReservedEnvTarget(value) {
   return RESERVED_ENVIRONMENT_SLUGS.includes(value);
@@ -20110,6 +22296,12 @@ var NaroClient = class _NaroClient {
   deployments;
   env;
   domains;
+  dns;
+  firewall;
+  flags;
+  billing;
+  observability;
+  supabase;
   logs;
   db;
   backend;
@@ -20133,6 +22325,12 @@ var NaroClient = class _NaroClient {
     this.deployments = new DeploymentsApi(this);
     this.env = new EnvApi(this);
     this.domains = new DomainsApi(this);
+    this.dns = new DnsApi(this);
+    this.firewall = new FirewallApi(this);
+    this.flags = new FlagsApi(this);
+    this.billing = new BillingApi(this);
+    this.observability = new ObservabilityApi(this);
+    this.supabase = new SupabaseApi(this);
     this.logs = new LogsApi(this);
     this.db = new DbApi(this);
     this.backend = new BackendApi(this);
@@ -20217,7 +22415,93 @@ var TeamsApi = class {
       { context: "Read team usage" }
     );
   }
+  path(teamSlug, suffix = "") {
+    return `/api/teams/${encodeURIComponent(teamSlug)}${suffix}`;
+  }
+  /** A new team, owned by the caller. `TEAM_SLUG_TAKEN` (409) for a slug in use. */
+  async create(slug, name) {
+    const body = await this.client.request("/api/teams", {
+      method: "POST",
+      body: { slug, name },
+      context: "Create team"
+    });
+    return teamSummary(body.team);
+  }
+  /** Renames the team or changes its slug (`team.update`); only the fields given. */
+  async update(teamSlug, patch) {
+    const body = await this.client.request(
+      this.path(teamSlug),
+      { method: "PATCH", body: patch, context: "Update team" }
+    );
+    return teamSummary(body.team);
+  }
+  /**
+   * Deletes the team with its projects and their data. Owner only;
+   * `PERSONAL_TEAM` and `SUBSCRIPTION_ACTIVE` (cancel the subscription first)
+   * refuse it. The route tears every project down before it answers, so this
+   * waits two minutes, like `projects.delete`.
+   */
+  async delete(teamSlug) {
+    await this.client.request(this.path(teamSlug), {
+      method: "DELETE",
+      context: "Delete team",
+      timeoutMs: PROVISION_TIMEOUT_MS
+    });
+  }
+  /** The members the caller may see: all of them with `team.read`, else only themselves. */
+  async members(teamSlug) {
+    const body = await this.client.request(
+      this.path(teamSlug, "/members"),
+      { context: "List team members" }
+    );
+    return body.members;
+  }
+  /** `team.members.manage`; `LAST_OWNER` (409) keeps the team's last owner. */
+  async setMemberRole(teamSlug, userId, role) {
+    await this.client.request(
+      this.path(teamSlug, `/members/${encodeURIComponent(userId)}`),
+      { method: "PATCH", body: { role }, context: "Change member role" }
+    );
+  }
+  /** Removes a member, or leaves the team when it is the caller. */
+  async removeMember(teamSlug, userId) {
+    await this.client.request(
+      this.path(teamSlug, `/members/${encodeURIComponent(userId)}`),
+      { method: "DELETE", context: "Remove member" }
+    );
+  }
+  async invites(teamSlug) {
+    const body = await this.client.request(
+      this.path(teamSlug, "/invites"),
+      { context: "List invites" }
+    );
+    return body.invites;
+  }
+  /**
+   * A new invite link; with `email` the control plane also mails it.
+   * `PERSONAL_TEAM` refuses a personal team, `INVALID_EMAIL` a bad address.
+   */
+  async createInvite(teamSlug, options = {}) {
+    return this.client.request(
+      this.path(teamSlug, "/invites"),
+      { method: "POST", body: options, context: "Create invite" }
+    );
+  }
+  async revokeInvite(teamSlug, inviteId) {
+    await this.client.request(
+      this.path(teamSlug, `/invites/${encodeURIComponent(inviteId)}`),
+      { method: "DELETE", context: "Revoke invite" }
+    );
+  }
 };
+function teamSummary(row) {
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    isPersonal: row.is_personal
+  };
+}
 var ProjectsApi = class {
   constructor(client) {
     this.client = client;
@@ -20236,6 +22520,28 @@ var ProjectsApi = class {
     );
     return projectInfo(body.project);
   }
+  /**
+   * Deletes the project and everything under it: its workers, its D1 and
+   * Storage, its domains, environments and deployment history. It cannot be
+   * undone. `project.delete` (owner and admin); a suspended project is `403
+   * FORBIDDEN`, one that is gone or out of sight `404 NOT_FOUND`. Only the
+   * CLI calls it, behind typing the name — naro-mcp has no tool for it
+   * (project_cli_mcp_backlog #6).
+   *
+   * Two minutes, like `backend.enable`: the route answers only after it has
+   * torn down the workers, D1s, backends and environments one after another
+   * (PR #420 review). A TIMEOUT does not mean the project is still there.
+   */
+  async delete(projectId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      {
+        method: "DELETE",
+        context: "Delete project",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+  }
   /**
    * Connects a project to a GitHub repository, turning `git push` into a
    * deployment.
@@ -20269,6 +22575,52 @@ var ProjectsApi = class {
     );
     return projectInfo(body.project);
   }
+  /**
+   * The dashboard's General settings: only the fields given are sent, and the
+   * control plane checks them (`400 VALIDATION_FAILED "Check the project
+   * settings."`, `SUBDOMAIN_INVALID`, `SUBDOMAIN_RESERVED`, `409
+   * SUBDOMAIN_TAKEN`). A new subdomain moves the project's URL at once: the
+   * old `{subdomain}.naro.sh` stops answering. Build settings need
+   * `project.update`.
+   */
+  async update(projectId, patch) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}`,
+      { method: "PATCH", body: patch, context: "Update project" }
+    );
+    return projectInfo(body.project);
+  }
+  /** Whether a subdomain is free: `reason` is `taken`, `reserved` or the format problem. */
+  async subdomainAvailability(name) {
+    return this.client.request(
+      `/api/subdomains/availability?name=${encodeURIComponent(name)}`,
+      { context: "Check subdomain" }
+    );
+  }
+  /** The project roles given to the team's contributors. */
+  async access(projectId) {
+    const body = await this.client.request(`/api/projects/${encodeURIComponent(projectId)}/access`, {
+      context: "List project access"
+    });
+    return body.assignments;
+  }
+  /** Gives a contributor a project role (`project.update`); a member of another role is refused. */
+  async grantAccess(projectId, userId, role) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/access`,
+      {
+        method: "PUT",
+        body: { userId, role },
+        context: "Grant project access"
+      }
+    );
+  }
+  async revokeAccess(projectId, userId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/access?userId=${encodeURIComponent(userId)}`,
+      { method: "DELETE", context: "Revoke project access" }
+    );
+  }
 };
 var GithubApi = class {
   constructor(client) {
@@ -20500,9 +22852,10 @@ var EnvApi = class {
   /**
    * The names the env route refuses as a key — `409 VALIDATION_FAILED`
    * `<KEY> is already used by a storage binding.` — read the way it reads
-   * them: `ASSETS` (the static files), every binding of the project's storage
-   * and, on a project using the managed database (`database_provider` is
-   * `d1`), `DB`, which may not be a storage row yet. For a caller that sends
+   * them: `ASSETS` (the static files) and, on a project using the managed
+   * database (`database_provider` is `d1`), `DB`. The bindings a user
+   * declared (R2·KV·D1) are gone since 2026-11-04, and so is the route that
+   * listed them. For a caller that sends
    * many entries in several requests (`naro env import`) and has to refuse
    * before the first one is saved. A control plane whose project row has no
    * `database_provider` reads as having no managed database, so `DB` is only
@@ -20510,21 +22863,9 @@ var EnvApi = class {
    */
   async takenBindingNames(projectId) {
     const base2 = `/api/projects/${encodeURIComponent(projectId)}`;
-    const [storage, project] = await Promise.all([
-      this.client.request(
-        `${base2}/storage`,
-        { context: "List storage" }
-      ),
-      this.client.request(
-        base2,
-        { context: "Read project" }
-      )
-    ]);
-    const names = /* @__PURE__ */ new Set([
-      STATIC_ASSETS_BINDING,
-      ...storage.storage.map((row) => row.bindingName)
-    ]);
-    if (project.project.database_provider === "d1")
+    const project2 = await this.client.request(base2, { context: "Read project" });
+    const names = /* @__PURE__ */ new Set([STATIC_ASSETS_BINDING]);
+    if (project2.project.database_provider === "d1")
       names.add(MANAGED_DATABASE_BINDING);
     return [...names];
   }
@@ -21816,6 +24157,41 @@ var StorageApi = class {
     );
     return body.objects;
   }
+  /**
+   * One object under another name in its bucket (Storage 3-1i), moved by the
+   * project's Naro worker with the stored service key. It never replaces an
+   * object (`409 OBJECT_EXISTS`); both names are held to the name rules
+   * (`INVALID_PATH`). An old worker answers `NOT_FOUND` until
+   * `naro backend enable` updates it.
+   */
+  async moveObject(projectId, bucket, from, to) {
+    return this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/move"),
+      { method: "POST", body: { from, to }, context: "Move an object" }
+    );
+  }
+  /**
+   * A token that lets whoever holds it upload `path` once, for two hours,
+   * without a key (Storage 3-1e §4.5) — the bytes go straight to the
+   * project's worker, never through the control plane. `upsert` lets it
+   * replace a file that is there (`409 OBJECT_EXISTS` otherwise, at upload).
+   * `signedUrl` is built the worker's way: each path segment encoded.
+   */
+  async createUploadUrl(projectId, bucket, path, options = {}) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/upload-url"),
+      {
+        method: "POST",
+        body: { path, ...options.upsert === true && { upsert: true } },
+        context: "Create an upload URL"
+      }
+    );
+    const encoded = body.path.split("/").map(encodeURIComponent).join("/");
+    return {
+      ...body,
+      signedUrl: `${body.url}/_naro/v1/storage/object/upload/sign/${encodeURIComponent(bucket)}/${encoded}?token=${encodeURIComponent(body.token)}`
+    };
+  }
   /**
    * A link that downloads one object without a key, for `expiresIn` seconds
    * (1–3600 through the control plane; `VALIDATION_FAILED` past it), on the
@@ -22164,6 +24540,54 @@ var FunctionsApi = class {
   }
 };
 
+// ../../packages/sdk/src/dashboard.ts
+function dashboardCapability(id) {
+  const found = CAPABILITIES.find((capability) => capability.id === id);
+  if (!found || typeof found.dashboard !== "string")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `No dashboard page for "${id}". Run without a capability to list the ones that have one.`
+    );
+  return found;
+}
+async function dashboardLink(client, capability, target2, options) {
+  const needs = dashboardNeeds(capability.dashboard);
+  let teamSlug = target2.teamSlug;
+  let projectSlug;
+  if (needs.project) {
+    if (!target2.projectId)
+      throw new NaroError(
+        "PROJECT_NOT_LINKED",
+        "This page belongs to a project: pass its id, or link the directory first."
+      );
+    const [project2, teams] = await Promise.all([
+      client.projects.get(target2.projectId),
+      client.teams.list()
+    ]);
+    const team = teams.find((candidate) => candidate.id === project2.teamId);
+    if (!team)
+      throw new NaroError(
+        "NOT_FOUND",
+        `The team of project ${project2.slug} is not one of yours.`
+      );
+    teamSlug = team.slug;
+    projectSlug = project2.slug;
+  } else if (needs.team && !teamSlug) {
+    throw new NaroError("TEAM_REQUIRED", "This page belongs to a team.");
+  }
+  const support = capability[options.client];
+  return {
+    capability: capability.id,
+    title: capability.title,
+    url: dashboardUrl(options.baseUrl, capability.dashboard, {
+      teamSlug,
+      projectSlug
+    }),
+    reason: support.kind === "excluded" ? { code: support.reason, why: REASON_CODES[support.reason].why } : null,
+    cli: capability.cli.kind === "built" ? capability.cli.commands ?? [] : []
+  };
+}
+
 // ../../packages/sdk/src/database.ts
 var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
 var BOOKMARK_FORMAT_MESSAGE = "bookmark must look like 00000001-00000008-000050ed-272153b8520cfb93b49834d93a1a1ab3 (four hyphen-separated hex groups, 59 characters).";
@@ -22214,14 +24638,14 @@ function summarizeStatement(statement2) {
 
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join as join20 } from "path";
+import { join as join19 } from "path";
 var QUOTES2 = /* @__PURE__ */ new Set(["'", '"', "`"]);
 function parseDotenv(text3) {
   return parseDotenvDetailed(text3).vars;
 }
 function readProjectEnv(dir) {
   for (const name of [".env.local", ".env.production", ".env"]) {
-    const path = join20(dir, name);
+    const path = join19(dir, name);
     if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
   }
   return {};
@@ -22275,7 +24699,7 @@ function serializeDotenv(vars) {
 
 // ../../packages/sdk/src/env-scan.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
-import { join as join21 } from "path";
+import { join as join20 } from "path";
 var SOURCE_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -22330,7 +24754,7 @@ function collect(dir, out) {
   for (const entry of entries) {
     if (out.length >= MAX_FILES) return;
     if (entry.isSymbolicLink()) continue;
-    const path = join21(dir, entry.name);
+    const path = join20(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRECTORIES.has(entry.name))
         continue;
@@ -22362,7 +24786,7 @@ function scanEnvReferences(dir) {
     }
   }
   for (const name of EXAMPLE_FILES) {
-    const path = join21(dir, name);
+    const path = join20(dir, name);
     if (!existsSync2(path)) continue;
     let parsed;
     try {
@@ -22380,11 +24804,11 @@ function scanEnvReferences(dir) {
 
 // ../../packages/sdk/src/framework.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 function readPackageJson2(dir) {
   try {
     return JSON.parse(
-      readFileSync4(join22(dir, "package.json"), "utf8")
+      readFileSync4(join21(dir, "package.json"), "utf8")
     );
   } catch {
     return null;
@@ -22395,7 +24819,7 @@ function hasDependency(pkg, name) {
 }
 function hasConfig(dir, base2, evidence) {
   for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
-    if (existsSync3(join22(dir, `${base2}.${ext}`))) {
+    if (existsSync3(join21(dir, `${base2}.${ext}`))) {
       evidence.push(`${base2}.${ext}`);
       return true;
     }
@@ -22503,8 +24927,8 @@ function detectFramework2(dir) {
     if (!byDependency && !byConfig) continue;
     if (byDependency) evidence.push(`package.json: ${detector.dependency}`);
     if (detector.framework === "nextjs") {
-      if (existsSync3(join22(dir, "app"))) evidence.push("app/");
-      if (existsSync3(join22(dir, "pages"))) evidence.push("pages/");
+      if (existsSync3(join21(dir, "app"))) evidence.push("app/");
+      if (existsSync3(join21(dir, "pages"))) evidence.push("pages/");
     }
     return {
       framework: detector.framework,
@@ -22515,7 +24939,7 @@ function detectFramework2(dir) {
       deployable: true
     };
   }
-  if (!pkg && existsSync3(join22(dir, "index.html"))) {
+  if (!pkg && existsSync3(join21(dir, "index.html"))) {
     evidence.push("index.html (no package.json)");
     return {
       framework: "static",
@@ -23400,10 +25824,10 @@ var REALTIME_COMMAND_PROBLEM = "realtime.messages takes SELECT, INSERT and ALL p
 var REALTIME_COLUMNS_PROBLEM = "realtime.messages policies are checked once per join, so they can read topic, extension and private only";
 var REALTIME_TOPIC_PROBLEM = "realtime.topic() is available only in policies of realtime.messages";
 function quotedRealtimeMessagesProblem(written) {
-  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Realtime: write realtime.messages, without quotes, for Realtime's messages`;
+  return `a table named "${written}" cannot be used in policies, as Naro keeps the name for Realtime: write realtime.messages, without quotes, for Realtime's messages`;
 }
 function quotedRealtimeAliasProblem(written) {
-  return `an alias named "${written}" cannot be used in policies, as naro keeps the name for Realtime: give the subquery another alias`;
+  return `an alias named "${written}" cannot be used in policies, as Naro keeps the name for Realtime: give the subquery another alias`;
 }
 function realtimeFunctionProblem(name) {
   return `function realtime.${name} is not available in policies: use realtime.topic()`;
@@ -23888,7 +26312,7 @@ function storageHelperColumnProblem(fn) {
   return `storage.${fn}() takes the name column of storage.objects`;
 }
 function quotedStorageObjectsProblem(written) {
-  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Storage: write storage.objects, without quotes, for Storage's objects`;
+  return `a table named "${written}" cannot be used in policies, as Naro keeps the name for Storage: write storage.objects, without quotes, for Storage's objects`;
 }
 function count(state, token) {
   if (++state.nodes > MAX_EXPRESSION_NODES)
@@ -24346,7 +26770,7 @@ function readTableName(stream) {
   if (stream.acceptOperator(".")) {
     if (first.quoted ? name !== "public" : asciiLower(name) !== "public")
       throw new PolicySyntaxError(
-        `schema ${name} does not exist: naro's tables are in public`,
+        `schema ${name} does not exist: Naro's tables are in public`,
         first.position
       );
     token = stream.peek();
@@ -24457,7 +26881,7 @@ function readJwtAccess(stream) {
   const next = stream.peek();
   if (isOperator(next, "->") || isOperator(next, "->>"))
     throw new PolicySyntaxError(
-      "naro's auth.jwt() claims are not nested",
+      "Naro's auth.jwt() claims are not nested",
       next.position
     );
   return {
@@ -24556,7 +26980,7 @@ function readPrimary(state) {
         stream.next();
         if (isOperator(stream.peek(), "(") || isOperator(stream.peek(), "."))
           throw new PolicySyntaxError(
-            `${token.value}.${name.value} is not a column: naro reads column or table.column`,
+            `${token.value}.${name.value} is not a column: Naro reads column or table.column`,
             token.position
           );
         return { kind: "column", qualifier: token.value, name: name.value };
@@ -24609,7 +27033,7 @@ function readRealtimeColumn(state) {
   const next = stream.peek();
   if (isOperator(next, "(") || isOperator(next, "."))
     throw new PolicySyntaxError(
-      `realtime.messages.${name} is not a column: naro reads realtime.messages.column`,
+      `realtime.messages.${name} is not a column: Naro reads realtime.messages.column`,
       next.position
     );
   return { kind: "column", qualifier: REALTIME_MESSAGES, name };
@@ -26531,7 +28955,7 @@ function textTruthProblem(snapshot, table, expr, names = [asciiLower(table.name)
 function selectCheckRefusal(path, column2, problem) {
   const reason = {
     generated: `is not available: the select policy reads the generated column ${column2}, which a new row cannot be checked against`,
-    collation: `is not available: the select policy reads ${column2}, whose collation naro cannot read, so a new row cannot be checked against it`,
+    collation: `is not available: the select policy reads ${column2}, whose collation Naro cannot read, so a new row cannot be checked against it`,
     pattern: `is not available: the select policy compares the number column ${column2} with like or ilike, which a new row cannot be checked against`,
     textual: `is not available: the select policy turns the number column ${column2} into text, which a new row cannot be checked against`,
     readBack: `is not available: the select policy reads ${column2}, a number in a column that declares no number type, as text, which a new row cannot be checked against`,
@@ -26929,7 +29353,7 @@ function checkProblemReason(column2, problem) {
     case "generated":
       return `${column2} is a generated column, which a WITH CHECK cannot read (an update policy without WITH CHECK checks its USING)`;
     case "collation":
-      return `${column2} has a collation naro cannot read, which a WITH CHECK needs to compare it`;
+      return `${column2} has a collation Naro cannot read, which a WITH CHECK needs to compare it`;
     case "pattern":
       return `${column2} is a number column, which a WITH CHECK cannot compare with LIKE or ILIKE`;
     case "textual":
@@ -26945,7 +29369,7 @@ function usingProblemReason(name, problem) {
     case "generated":
       return `${name} is a generated column, which a USING judged on a row's values cannot read`;
     case "collation":
-      return `${name} has a collation naro cannot read, which a USING judged on a row's values needs to compare it`;
+      return `${name} has a collation Naro cannot read, which a USING judged on a row's values needs to compare it`;
     case "pattern":
       return `${name} is a number column, which a USING judged on a row's values cannot compare with LIKE or ILIKE`;
     case "textual":
@@ -27343,7 +29767,7 @@ function checkCase(table, terms, guard, pass, action, nonce) {
       fail(
         invalidQuery(
           action === "insert" ? "returning" : "values",
-          `is not available: naro cannot read the schema of ${table.name}, so a new row cannot be checked against its select policy`
+          `is not available: Naro cannot read the schema of ${table.name}, so a new row cannot be checked against its select policy`
         )
       );
     fail(policyInvalid(first.policy, action));
@@ -27505,7 +29929,7 @@ function checkFragment(target2, req, snapshot, command, row, nonce, stored, with
     const first = terms.find((term) => term.policy !== void 0)?.policy;
     return fail(
       first ? policyInvalid(first, command) : dataError("INTERNAL_ERROR"),
-      `naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
+      `Naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
     );
   }
   return [schemaGuard(name, sql, command, checked), ...guards, ...terms];
@@ -28686,7 +31110,7 @@ var Reader = class {
       }
       if (this.takeWord("WHERE")) top.resolved.push(this.where());
       this.returning(top.resolved);
-    } else throw new Unreadable("not a statement naro compiles");
+    } else throw new Unreadable("not a statement Naro compiles");
     return top;
   }
 };
@@ -30826,9 +33250,9 @@ var SYSTEM_MIGRATIONS = [
 ];
 
 // ../../packages/data-core/src/policy-migration.ts
-var GRANT_REFUSAL = "naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
+var GRANT_REFUSAL = "Naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
 function disableRefusal(table) {
-  return `naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${policyTableSql(table)} USING (true) WITH CHECK (true);`;
+  return `Naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${policyTableSql(table)} USING (true) WITH CHECK (true);`;
 }
 function isStorageObjects(table) {
   return asciiLower(table) === STORAGE_OBJECTS;
@@ -31325,12 +33749,12 @@ import {
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 function linkDir(dir) {
-  return join23(dir, ".naro");
+  return join22(dir, ".naro");
 }
 function linkFile(dir) {
-  return join23(linkDir(dir), "project.json");
+  return join22(linkDir(dir), "project.json");
 }
 function readProjectLink(dir) {
   try {
@@ -31352,7 +33776,7 @@ function writeProjectLink(dir, link) {
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
   writeFileSync2(
-    join23(linkDir(dir), "README.txt"),
+    join22(linkDir(dir), "README.txt"),
     "This directory links the project to Naro and should not be committed.\n"
   );
 }
@@ -31362,9 +33786,9 @@ function removeProjectLink(dir) {
   return true;
 }
 function ensureGitignoreHasNaro(dir) {
-  const gitignorePath = join23(dir, ".gitignore");
+  const gitignorePath = join22(dir, ".gitignore");
   const hasGitignore = existsSync4(gitignorePath);
-  if (!hasGitignore && !existsSync4(join23(dir, ".git"))) return false;
+  if (!hasGitignore && !existsSync4(join22(dir, ".git"))) return false;
   const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
   const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
   if (covered) return false;
@@ -31549,6 +33973,159 @@ function lintSchema(input) {
   ];
 }
 
+// ../../packages/sdk/src/lint-database.ts
+function hasCode(error51, code) {
+  return typeof error51 === "object" && error51 !== null && error51.code === code;
+}
+var DIAGNOSTICS_SQL = [
+  `SELECT name FROM sqlite_master WHERE type = 'trigger' AND ${systemTablePredicate("name")} ORDER BY name;`,
+  "SELECT name, type FROM pragma_table_list WHERE schema = 'main' AND type IN ('virtual', 'shadow') ORDER BY name;",
+  "SELECT * FROM pragma_quick_check;",
+  "SELECT * FROM pragma_foreign_key_check;"
+].join("\n");
+var POLICIES_TRUNCATED_NOTICE = "\u26A0 The policies were cut at 10,000 rows, so they were not checked.";
+var POLICY_TABLE_PROBE = `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '${NAMED_POLICY_TABLE}'`;
+var POLICY_READ_SQL = [NAMED_POLICY_SQL.list, INDEX_SQL, ...SCHEMA_SQL].map((sql) => `${sql};`).join("\n");
+function objectsOf(statement2) {
+  return statement2.rows.map(
+    (row) => Object.fromEntries(
+      statement2.columns.map((column2, index) => [column2, row[index]])
+    )
+  );
+}
+async function readPolicies(client, projectId, warn2) {
+  let backend;
+  try {
+    backend = await client.backend.info(projectId);
+  } catch (error51) {
+    if (hasCode(error51, "BACKEND_DISABLED")) return void 0;
+    throw error51;
+  }
+  if (backend.status === "none") return void 0;
+  const probe = await client.db.query(projectId, {
+    sql: POLICY_TABLE_PROBE,
+    readOnly: true
+  });
+  if ((probe.statements[0]?.rows.length ?? 0) === 0) return void 0;
+  const answer = await client.db.query(projectId, { sql: POLICY_READ_SQL });
+  const [stored, indexes, ...schema] = answer.statements;
+  const expected = SCHEMA_SQL.length + 2;
+  if (stored === void 0 || indexes === void 0 || answer.statements.length !== expected)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The policies could not be read: the database answered with ${String(answer.statements.length)} result sets instead of ${String(expected)}.`
+    );
+  if (answer.truncated) {
+    warn2(POLICIES_TRUNCATED_NOTICE);
+    return void 0;
+  }
+  const policies = [];
+  const unreadable = [];
+  for (const row of objectsOf(stored)) {
+    const policy = loadPolicy(row);
+    if (policy === void 0) continue;
+    if (policy.invalid !== null)
+      unreadable.push({
+        table: policy.table,
+        name: policy.name,
+        reason: policy.invalid
+      });
+    else
+      policies.push({
+        table: policy.table,
+        name: policy.name,
+        permissive: policy.permissive,
+        command: policy.command,
+        roles: policy.roles,
+        using: policy.using,
+        check: policy.check,
+        owner: policy.owner
+      });
+  }
+  const snapshot = snapshotFromRows(schema.flatMap(objectsOf));
+  return {
+    tables: tableNames(snapshot),
+    policies,
+    unreadable,
+    snapshot,
+    indexes: indexesFromRows(objectsOf(indexes))
+  };
+}
+function firstCell(row) {
+  const value = row[0];
+  return value === null || value === void 0 ? "" : String(value);
+}
+function rowidOf(text3) {
+  if (text3 === "") return null;
+  const value = Number(text3);
+  return Number.isFinite(value) ? value : null;
+}
+async function lintDatabase(client, projectId, warn2) {
+  const tables = await client.db.tables(projectId);
+  const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
+  const [triggers, objects, quick, broken] = answer.statements;
+  if (triggers === void 0 || objects === void 0 || quick === void 0 || broken === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The diagnostics could not be read: the database answered with ${String(answer.statements.length)} result sets instead of 4.`
+    );
+  const virtualTables = [];
+  const shadow = /* @__PURE__ */ new Set();
+  for (const row of objects.rows) {
+    const name = cellText(objects, row, "name");
+    if (cellText(objects, row, "type") === "shadow") shadow.add(name);
+    else virtualTables.push(name);
+  }
+  const foreignKeyCheck = broken.rows.map((row) => ({
+    table: cellText(broken, row, "table"),
+    rowid: rowidOf(cellText(broken, row, "rowid")),
+    parent: cellText(broken, row, "parent")
+  }));
+  const policies = await readPolicies(client, projectId, warn2);
+  const input = {
+    tables: tables.filter((table) => !shadow.has(table.name)),
+    foreignKeyCheck,
+    quickCheck: quick.rows.map(firstCell),
+    triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
+    virtualTables,
+    ...policies === void 0 ? {} : { policies }
+  };
+  const issues = lintSchema(input);
+  const errors = issues.filter((issue2) => issue2.severity === "error").length;
+  return {
+    issues,
+    errors,
+    warnings: issues.length - errors,
+    tables: countLintedTables(input),
+    truncated: answer.truncated
+  };
+}
+
+// ../../packages/sdk/src/migration-repair.ts
+var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
+var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
+var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
+var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
+function withoutSuffix(key) {
+  return key.endsWith(".sql") ? key.slice(0, -".sql".length) : key;
+}
+var MIGRATION_NAME_MESSAGE = "name must end with .sql and contain only letters, digits, _ . -";
+function repairIsNoop(ledger, key, status) {
+  const recorded = ledger.some(
+    (row) => row.name === key || row.name === withoutSuffix(key)
+  );
+  return status === "applied" ? recorded : !recorded;
+}
+async function repairLedger(client, projectId, key, status, ledgerIsEmpty) {
+  if (status === "applied" && ledgerIsEmpty)
+    await client.db.query(projectId, { sql: LEDGER_DDL });
+  const answer = await client.db.query(projectId, {
+    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
+    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
+  });
+  return (answer.statements[0]?.meta.changes ?? 0) > 0;
+}
+
 // ../../packages/sdk/src/migrations.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
 import { resolve as resolve9 } from "path";
@@ -31630,7 +34207,7 @@ function migrationsPendingError(pending) {
   );
 }
 function migrationNameMismatch(sent, recorded) {
-  return `The control plane recorded the migration as ${recorded}, but naro sent ${sent} and wrote the file under that name. Until the two match, naro migration list shows them apart and naro db push would apply the file again.`;
+  return `The control plane recorded the migration as ${recorded}, but Naro sent ${sent} and wrote the file under that name. Until the two match, naro migration list shows them apart and naro db push would apply the file again.`;
 }
 
 // ../../packages/sdk/src/reset-plan.ts
@@ -31996,7 +34573,7 @@ function usageStatus(report, currentMonth, requests) {
 
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join24 } from "path";
+import { join as join23 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
 var PUBLIC_PREFIX = "NEXT_PUBLIC_";
 function maskSecretValue(value) {
@@ -32008,7 +34585,7 @@ function maskEnvValue(key, value) {
   return maskSecretValue(value);
 }
 function findDotenvFile(dir) {
-  for (const name of DOTENV_FILES) if (existsSync6(join24(dir, name))) return name;
+  for (const name of DOTENV_FILES) if (existsSync6(join23(dir, name))) return name;
   return null;
 }
 function envAddGuidance(keys, environment) {
@@ -32272,13 +34849,13 @@ async function uploadArtifact(artifact, opts) {
 
 // src/version.ts
 import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname5, join as join25 } from "path";
+import { dirname as dirname5, join as join24 } from "path";
 import { fileURLToPath } from "url";
 function version2() {
   try {
     const pkg = JSON.parse(
       readFileSync6(
-        join25(dirname5(fileURLToPath(import.meta.url)), "..", "package.json"),
+        join24(dirname5(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );
@@ -32307,7 +34884,7 @@ import {
   basename as basename3,
   dirname as dirname6,
   isAbsolute as isAbsolute4,
-  join as join26,
+  join as join25,
   relative as relative6,
   resolve as resolve10,
   sep as sep5
@@ -32434,12 +35011,12 @@ async function copyWorkingTree(source, checkout) {
     keptLinks,
     async ({ path, text: text3 }) => {
       try {
-        return inside(await realpath3(join26(checkout, path)), root);
+        return inside(await realpath3(join25(checkout, path)), root);
       } catch (error51) {
         return error51.code === "ENOENT" && climbsOnlyFirst(text3);
       }
     },
-    ({ path }) => unlink(join26(checkout, path))
+    ({ path }) => unlink(join25(checkout, path))
   );
   linksElsewhere.push(...strays.map(({ path }) => path));
   const committed = await committedEnvFiles(sourceDir);
@@ -32453,7 +35030,7 @@ async function copyWorkingTree(source, checkout) {
       outsideProject.push(path);
       continue;
     }
-    const target2 = join26(checkout, path);
+    const target2 = join25(checkout, path);
     if (!inside(await realAncestor(dirname6(target2)), root)) {
       outsideProject.push(path);
       continue;
@@ -32478,16 +35055,16 @@ async function copyWorkingTree(source, checkout) {
       continue;
     }
     await writeFile7(target2, content, { flag: "wx" });
-    const local = await readLocal(join26(sourceDir, path));
+    const local = await readLocal(join25(sourceDir, path));
     if (!local || !sameText(local, content)) committedVersion.push(path);
   }
   const envStrays = await keptOnly(
     envLinks,
     async (path) => {
-      const real = await realpath3(join26(checkout, path)).catch(() => null);
+      const real = await realpath3(join25(checkout, path)).catch(() => null);
       return real !== null && inside(real, root);
     },
-    (path) => unlink(join26(checkout, path))
+    (path) => unlink(join25(checkout, path))
   );
   outsideProject.push(...envStrays);
   const inCommit = new Set(
@@ -32507,6 +35084,427 @@ async function copyWorkingTree(source, checkout) {
   };
 }
 
+// src/data-environment.ts
+var DATA_ENV_MESSAGES = {
+  name: "--env must be production or an environment name.",
+  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
+  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
+};
+function dataEnvironment(flags) {
+  const value = flags.env;
+  if (value === void 0 || value === "production") return null;
+  if (value === "preview")
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
+  if (environmentSlugProblem(value) !== null)
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
+  return value;
+}
+async function dataClient(context) {
+  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
+}
+function databaseName(environment) {
+  return environment === null ? "the project database" : `the ${environment} environment's database`;
+}
+function enableBackendCommand(environment) {
+  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
+}
+function envFlag(environment) {
+  return environment === null ? "" : ` --env ${environment}`;
+}
+function forEnvironment(text3, environment) {
+  return environmentGuidance(text3, environment);
+}
+
+// src/commands/migration.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { join as join26, relative as relative7 } from "path";
+
+// src/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+import { Writable } from "stream";
+function confirmHint(defaultYes) {
+  return defaultYes ? "(Y/n)" : "(y/N)";
+}
+function readConfirmAnswer(answer, defaultYes) {
+  const normalized2 = answer.trim().toLowerCase();
+  if (normalized2 === "") return defaultYes;
+  if (normalized2 === "y" || normalized2 === "yes") return true;
+  if (!defaultYes) return false;
+  if (normalized2 === "n" || normalized2 === "no") return false;
+  return null;
+}
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += String(chunk);
+  return data.replace(/\r?\n$/, "");
+}
+var TtyPrompter = class {
+  async ask(question) {
+    const rl = createInterface2({
+      input: process.stdin,
+      output: process.stdout
+    });
+    try {
+      return await new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+    } finally {
+      rl.close();
+    }
+  }
+  async askHidden(question) {
+    let muted = false;
+    const output = new Writable({
+      write(chunk, _enc, done) {
+        if (!muted) process.stdout.write(chunk);
+        done();
+      }
+    });
+    const rl = createInterface2({
+      input: process.stdin,
+      output,
+      terminal: true
+    });
+    try {
+      const answer = new Promise(
+        (resolve15) => rl.question(question, resolve15)
+      );
+      muted = true;
+      const value = await answer;
+      process.stdout.write("\n");
+      return value;
+    } finally {
+      rl.close();
+    }
+  }
+  async confirm(question, options = {}) {
+    const defaultYes = options.defaultYes ?? false;
+    for (; ; ) {
+      const read = readConfirmAnswer(
+        await this.ask(`${question} ${confirmHint(defaultYes)} `),
+        defaultYes
+      );
+      if (read !== null) return read;
+    }
+  }
+  async select(question, options) {
+    process.stdout.write(`${question}
+`);
+    options.forEach((option, index) => {
+      process.stdout.write(`  ${String(index + 1)}. ${option}
+`);
+    });
+    for (; ; ) {
+      const answer = Number.parseInt(
+        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
+        10
+      );
+      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
+        return answer - 1;
+    }
+  }
+};
+var NonInteractivePrompter = class {
+  constructor(assumeYes) {
+    this.assumeYes = assumeYes;
+  }
+  refuse(question) {
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
+    );
+  }
+  async ask(question) {
+    this.refuse(question);
+  }
+  async askHidden(question) {
+    this.refuse(question);
+  }
+  async confirm() {
+    return this.assumeYes;
+  }
+  async select(question) {
+    this.refuse(question);
+  }
+};
+function createPrompter(options) {
+  if (options.yes || options.json || !isInteractive())
+    return new NonInteractivePrompter(options.yes);
+  return new TtyPrompter();
+}
+
+// src/commands/confirm.ts
+function cannotAsk(context) {
+  return context.flags.json || !isInteractive();
+}
+async function confirmOrAbort(context, question) {
+  if (context.flags.yes) return;
+  if (cannotAsk(context)) {
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `${question} Re-run with --yes to confirm.`
+    );
+  }
+  const confirmed = await context.prompter.confirm(question);
+  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+}
+
+// src/commands/migration.ts
+var processStdin = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+function migrationsDir(context) {
+  return resolveMigrationsDir({
+    baseDir: context.cwd,
+    rootDirectory: context.flags.root,
+    dir: context.flags.dir
+  });
+}
+function relativeToCwd(context, path) {
+  const rel = relative7(context.cwd, path);
+  return rel === "" ? "." : rel;
+}
+async function appliedMigrations(client, projectId) {
+  try {
+    return await client.db.migrations(projectId);
+  } catch (error51) {
+    if (isNaroError(error51) && error51.code === "DATABASE_NOT_READY") return [];
+    throw error51;
+  }
+}
+var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable(text3) {
+  return text3.replace(UNPRINTABLE, "?");
+}
+function isPrintable(text3) {
+  return printable(text3) === text3;
+}
+var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
+function warningLines(message) {
+  return message.split("\n").map(
+    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
+  );
+}
+function policyProblems(dir, names) {
+  return names.flatMap((name) => {
+    const split2 = splitStatements(readFileSync7(join26(dir, name), "utf8"));
+    if (!split2.ok) return [];
+    const planned = planPolicyMigration(
+      split2.statements.map((statement2) => statement2.text)
+    );
+    return planned.ok ? [] : [{ migration: name, message: planned.message }];
+  });
+}
+function warningLine(warning) {
+  if (warning === "out-of-order")
+    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
+  if (warning === "ledger-name-missing-extension")
+    return "  \u26A0 recorded without .sql in the ledger";
+  return null;
+}
+async function runMigrationNew(context, deps = processStdin) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration new <name>"
+  );
+  const dir = migrationsDir(context);
+  const fileName = nextMigrationFileName(
+    listMigrationFiles(dir),
+    name
+  );
+  mkdirSync3(dir, { recursive: true });
+  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
+  const fromStdin = piped.length > 0;
+  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
+` : `-- Migration: ${fileName}
+`;
+  const path = join26(dir, fileName);
+  writeFileSync3(path, body, { flag: "wx" });
+  const relPath = relativeToCwd(context, path);
+  context.output.result({ file: fileName, path: relPath, fromStdin }, [
+    `\u2705 Created ${relPath}`
+  ]);
+}
+async function runMigrationList(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const migrations = compareMigrations(local, ledger);
+  const relDir = relativeToCwd(context, dir);
+  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
+    `Migrations in ${relDir} (${String(migrations.length)}):`,
+    ...migrations.flatMap((row) => {
+      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
+      const warning = warningLine(row.warning);
+      return warning ? [line, warning] : [line];
+    })
+  ];
+  context.output.result({ projectId, dir: relDir, migrations }, lines);
+}
+async function applyMigrationFiles(context, client, projectId, dir, names) {
+  const applied = [];
+  const warnings = [];
+  for (const name of names) {
+    const sql = readFileSync7(join26(dir, name), "utf8");
+    let answer;
+    try {
+      answer = await client.db.applyMigration(projectId, { name, sql });
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      for (const message of serverWarnings(error51.details))
+        for (const line of warningLines(message)) context.output.warn(line);
+      const shown = context.output.json ? name : printable(name);
+      throw new NaroError(error51.code, `${shown}: ${error51.message}`, {
+        ...error51.status === void 0 ? {} : { status: error51.status },
+        details: {
+          ...error51.details,
+          migration: name,
+          applied,
+          appliedWarnings: warnings
+        },
+        cause: error51
+      });
+    }
+    context.output.log(`\u2713 ${printable(name)}`);
+    applied.push(name);
+    for (const message of answer.warnings) {
+      warnings.push({ migration: name, message });
+      for (const line of warningLines(message)) context.output.warn(line);
+    }
+  }
+  return { applied, warnings };
+}
+function serverWarnings(details) {
+  const warnings = details?.warnings;
+  return Array.isArray(warnings) ? warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
+}
+async function runMigrationRepair(context) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration repair <name> --status applied|reverted"
+  );
+  const key = name;
+  if (!MIGRATION_NAME_RE.test(key))
+    throw new NaroError("VALIDATION_FAILED", MIGRATION_NAME_MESSAGE);
+  const status = context.flags.status;
+  if (status !== "applied" && status !== "reverted")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --status applied or --status reverted."
+    );
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const ledger = await appliedMigrations(client, projectId);
+  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
+  if (repairIsNoop(ledger, key, status)) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
+  );
+  const changed = await repairLedger(
+    client,
+    projectId,
+    key,
+    status,
+    ledger.length === 0
+  );
+  if (!changed) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  context.output.result({ name: key, status, changed: true }, [
+    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
+  ]);
+}
+async function runMigrationUp(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
+  if (pending.length === 0) {
+    context.output.result({ projectId, applied: [], pending: [] }, [
+      "No pending migrations."
+    ]);
+    return;
+  }
+  if (context.flags.dryRun) {
+    const problems2 = policyProblems(dir, pending);
+    context.output.result({ projectId, dryRun: true, pending, problems: problems2 }, [
+      `Pending migrations (${String(pending.length)}):`,
+      ...pending.map((name) => `  ${printable(name)}`),
+      ...problems2.map(
+        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
+      )
+    ]);
+    if (problems2.length > 0) process.exitCode = 1;
+    return;
+  }
+  context.output.log(`Pending migrations (${String(pending.length)}):`);
+  for (const name of pending) context.output.log(`  ${printable(name)}`);
+  await confirmOrAbort(
+    context,
+    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
+  );
+  const { applied, warnings } = await applyMigrationFiles(
+    context,
+    client,
+    projectId,
+    dir,
+    pending
+  );
+  context.output.result({ projectId, applied, pending: [], warnings }, [
+    `\u2705 Applied ${String(applied.length)} migration(s).`
+  ]);
+}
+
+// src/commands/db-lint.ts
+var TRUNCATED_NOTICE = "\u26A0 The diagnostics were cut at 10,000 rows \u2014 there may be more broken rows than these.";
+function issueLines(issues, tables) {
+  const errors = issues.filter((issue2) => issue2.severity === "error").length;
+  if (issues.length === 0)
+    return [`\u2713 No issues found in ${String(tables)} table(s).`];
+  return [
+    ...issues.map(
+      (issue2) => printable(
+        `${issue2.severity.padEnd(5)}  ${issue2.rule}  ${issue2.object}: ${issue2.message}`
+      )
+    ),
+    `${String(errors)} error(s), ${String(issues.length - errors)} warning(s) in ${String(tables)} table(s).`
+  ];
+}
+async function runDbLint(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const linted = await lintDatabase(
+    client,
+    projectId,
+    (message) => context.output.warn(message)
+  );
+  const { issues, errors, warnings, tables: counted } = linted;
+  if (linted.truncated) context.output.warn(TRUNCATED_NOTICE);
+  context.output.result(
+    { issues, errors, warnings, tables: counted },
+    issueLines(issues, counted)
+  );
+  if (errors > 0 || context.flags.strict === true && warnings > 0)
+    process.exitCode = 1;
+}
+
 // src/functions/deploy.ts
 import { relative as relative11, resolve as resolve13, sep as sep10 } from "path";
 
@@ -32564,8 +35562,8 @@ var BUNDLE_MESSAGES = {
 };
 
 // ../../packages/functions-bundler/src/discover.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { join as join27, relative as relative7, resolve as resolve11, sep as sep6 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { join as join27, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
 
 // ../../packages/functions-bundler/src/limits.ts
 var FUNCTION_BUNDLE_MAX_BYTES = 67108864;
@@ -32590,7 +35588,7 @@ function functionsFolder(options) {
   const root = resolve11(options.cwd, options.root ?? ".");
   const explicit = options.dir !== void 0;
   const dir = explicit ? resolve11(options.cwd, options.dir) : join27(root, "naro", "functions");
-  const label2 = relative7(options.cwd, dir).split(sep6).join("/") || ".";
+  const label2 = relative8(options.cwd, dir).split(sep6).join("/") || ".";
   return { dir, label: label2, root, explicit };
 }
 function listFunctionNames(folder) {
@@ -32623,7 +35621,7 @@ function readFunctionJson(dir, name) {
   if (!existsSync7(file2)) return { verifyJwt: void 0, entrypoint: void 0 };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync7(file2, "utf8"));
+    parsed = JSON.parse(readFileSync8(file2, "utf8"));
   } catch {
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -32699,7 +35697,7 @@ function configTomlWarning(folder) {
   if (!folder.dir.endsWith(join27("supabase", "functions"))) return null;
   const file2 = join27(folder.dir, "..", "config.toml");
   if (!existsSync7(file2)) return null;
-  return /^\s*verify_jwt\s*=/m.test(readFileSync7(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
+  return /^\s*verify_jwt\s*=/m.test(readFileSync8(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
 }
 
 // ../../packages/functions-bundler/src/jsonc.ts
@@ -32902,22 +35900,22 @@ ${injects.map(
 }
 
 // ../../packages/functions-bundler/src/deno-imports.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join29, relative as relative8, sep as sep8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join29, relative as relative9, sep as sep8 } from "path";
 
 // ../../packages/functions-bundler/src/import-map.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, realpathSync } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9, realpathSync } from "fs";
 import { basename as basename4, dirname as dirname8, join as join28, resolve as resolve12, sep as sep7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // ../../packages/functions-bundler/src/printable.ts
-var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable(text3) {
-  return text3.replace(UNPRINTABLE, "?");
+var UNPRINTABLE2 = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function printable2(text3) {
+  return text3.replace(UNPRINTABLE2, "?");
 }
 function causeLine(error51) {
   const text3 = error51 instanceof Error ? error51.message : String(error51);
-  return printable(
+  return printable2(
     text3.split("\n").map((line) => line.trim()).find((line) => line.length > 0) ?? "unknown error"
   );
 }
@@ -32941,7 +35939,7 @@ function expandBareKeys(imports) {
 function load(file2, label2) {
   let parsed;
   try {
-    parsed = parseJsonc2(readFileSync8(file2, "utf8"));
+    parsed = parseJsonc2(readFileSync9(file2, "utf8"));
   } catch {
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -32961,7 +35959,7 @@ function load(file2, label2) {
     if (key.endsWith("/") && !value.endsWith("/"))
       throw new FunctionBundleError(
         "VALIDATION_FAILED",
-        printable(BUNDLE_MESSAGES.importMapPrefix(label2, key, value))
+        printable2(BUNDLE_MESSAGES.importMapPrefix(label2, key, value))
       );
   return {
     imports: DENO_CONFIGS.has(basename4(file2)) ? expandBareKeys(written) : written,
@@ -33104,7 +36102,7 @@ function parseNpm(text3) {
 }
 var afterScheme = (specifier) => specifier.slice(4).replace(/^\//, "");
 var isPackageName = (pkg) => pkg.startsWith("@") ? /^@[^/]+\/[^/]+$/.test(pkg) : /^[^/]+$/.test(pkg);
-var refuse2 = (text3) => ({ errors: [{ text: printable(text3) }] });
+var refuse2 = (text3) => ({ errors: [{ text: printable2(text3) }] });
 var installOf = (pkg, range) => range ? `${pkg}@${range}` : pkg;
 function realPath2(path) {
   try {
@@ -33113,9 +36111,9 @@ function realPath2(path) {
     return path;
   }
 }
-var fromRoot = (projectRoot, path) => relative8(projectRoot, path).split(sep8).join("/");
+var fromRoot = (projectRoot, path) => relative9(projectRoot, path).split(sep8).join("/");
 function isInside(path, projectRoot) {
-  const rel = relative8(projectRoot, path);
+  const rel = relative9(projectRoot, path);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep8}`) && !isAbsolute5(rel);
 }
 function packageDir(from, projectRoot) {
@@ -33147,7 +36145,7 @@ function installedVersion(resolved, pkg) {
     const file2 = join29(current, "package.json");
     if (existsSync9(file2)) {
       try {
-        const manifest2 = JSON.parse(readFileSync9(file2, "utf8"));
+        const manifest2 = JSON.parse(readFileSync10(file2, "utf8"));
         if (manifest2.name === pkg && typeof manifest2.version === "string")
           return manifest2.version;
       } catch {
@@ -33160,7 +36158,7 @@ function installedVersion(resolved, pkg) {
 }
 var byCodePoint = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 function missingPackagesMessage(unsorted) {
-  return printable(installSentence(unsorted));
+  return printable2(installSentence(unsorted));
 }
 function installSentence(unsorted) {
   const missing = [...unsorted].sort(
@@ -33241,7 +36239,7 @@ function denoImportsPlugin(options) {
         if (spec.range) {
           const version3 = installedVersion(result.path, pkgName);
           if (version3 !== null && inRange(version3, spec.range) === false) {
-            const warning = printable(
+            const warning = printable2(
               BUNDLE_MESSAGES.outOfRange(
                 pkgName,
                 version3,
@@ -33328,7 +36326,7 @@ function denoImportsPlugin(options) {
 
 // ../../packages/functions-bundler/src/bundle.ts
 import { createHash as createHash4 } from "crypto";
-import { join as join30, relative as relative9, sep as sep9 } from "path";
+import { join as join30, relative as relative10, sep as sep9 } from "path";
 import { gzipSync } from "zlib";
 
 // ../../packages/functions-runtime/dist/index.js
@@ -33349,7 +36347,7 @@ function runtimeCompressedBytes() {
   return runtimeGzip;
 }
 function relativeLabel(root, file2) {
-  return relative9(root, file2).split(sep9).join("/");
+  return relative10(root, file2).split(sep9).join("/");
 }
 function location(message) {
   return message.location ? `${message.location.file}:${String(message.location.line)}` : null;
@@ -33496,7 +36494,7 @@ function bootErrorLine(logs, error51) {
   const logged = logs.find((line2) => line2.includes("Uncaught")) ?? logs.find((line2) => line2.includes("Error"));
   const raw = logged ?? (error51 instanceof Error ? error51.message : String(error51));
   const line = raw.split("\n").map((part) => part.trim()).find((part) => part.length > 0) ?? "unknown error";
-  return printable(line.replace(WORKERD_SERVICE_HEAD, ""));
+  return printable2(line.replace(WORKERD_SERVICE_HEAD, ""));
 }
 async function bootCheck(name, code, options = {}) {
   const timeoutMs = options.timeoutMs ?? BOOT_TIMEOUT_MS;
@@ -33577,407 +36575,6 @@ async function bootCheck(name, code, options = {}) {
   }
 }
 
-// src/commands/migration.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
-import { join as join31, relative as relative10 } from "path";
-
-// src/data-environment.ts
-var DATA_ENV_MESSAGES = {
-  name: "--env must be production or an environment name.",
-  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
-  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
-};
-function dataEnvironment(flags) {
-  const value = flags.env;
-  if (value === void 0 || value === "production") return null;
-  if (value === "preview")
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
-  if (environmentSlugProblem(value) !== null)
-    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
-  return value;
-}
-async function dataClient(context) {
-  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
-}
-function databaseName(environment) {
-  return environment === null ? "the project database" : `the ${environment} environment's database`;
-}
-function enableBackendCommand(environment) {
-  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
-}
-function envFlag(environment) {
-  return environment === null ? "" : ` --env ${environment}`;
-}
-function forEnvironment(text3, environment) {
-  return environmentGuidance(text3, environment);
-}
-
-// src/prompt.ts
-import { createInterface as createInterface2 } from "readline";
-import { Writable } from "stream";
-function confirmHint(defaultYes) {
-  return defaultYes ? "(Y/n)" : "(y/N)";
-}
-function readConfirmAnswer(answer, defaultYes) {
-  const normalized2 = answer.trim().toLowerCase();
-  if (normalized2 === "") return defaultYes;
-  if (normalized2 === "y" || normalized2 === "yes") return true;
-  if (!defaultYes) return false;
-  if (normalized2 === "n" || normalized2 === "no") return false;
-  return null;
-}
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-async function readStdin() {
-  let data = "";
-  for await (const chunk of process.stdin) data += String(chunk);
-  return data.replace(/\r?\n$/, "");
-}
-var TtyPrompter = class {
-  async ask(question) {
-    const rl = createInterface2({
-      input: process.stdin,
-      output: process.stdout
-    });
-    try {
-      return await new Promise(
-        (resolve15) => rl.question(question, resolve15)
-      );
-    } finally {
-      rl.close();
-    }
-  }
-  async askHidden(question) {
-    let muted = false;
-    const output = new Writable({
-      write(chunk, _enc, done) {
-        if (!muted) process.stdout.write(chunk);
-        done();
-      }
-    });
-    const rl = createInterface2({
-      input: process.stdin,
-      output,
-      terminal: true
-    });
-    try {
-      const answer = new Promise(
-        (resolve15) => rl.question(question, resolve15)
-      );
-      muted = true;
-      const value = await answer;
-      process.stdout.write("\n");
-      return value;
-    } finally {
-      rl.close();
-    }
-  }
-  async confirm(question, options = {}) {
-    const defaultYes = options.defaultYes ?? false;
-    for (; ; ) {
-      const read = readConfirmAnswer(
-        await this.ask(`${question} ${confirmHint(defaultYes)} `),
-        defaultYes
-      );
-      if (read !== null) return read;
-    }
-  }
-  async select(question, options) {
-    process.stdout.write(`${question}
-`);
-    options.forEach((option, index) => {
-      process.stdout.write(`  ${String(index + 1)}. ${option}
-`);
-    });
-    for (; ; ) {
-      const answer = Number.parseInt(
-        (await this.ask(`Choose 1-${String(options.length)}: `)).trim(),
-        10
-      );
-      if (Number.isInteger(answer) && answer >= 1 && answer <= options.length)
-        return answer - 1;
-    }
-  }
-};
-var NonInteractivePrompter = class {
-  constructor(assumeYes) {
-    this.assumeYes = assumeYes;
-  }
-  refuse(question) {
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `Interactive input required (${question.trim()}). Pass the value via flags/stdin or run without --json in a terminal.`
-    );
-  }
-  async ask(question) {
-    this.refuse(question);
-  }
-  async askHidden(question) {
-    this.refuse(question);
-  }
-  async confirm() {
-    return this.assumeYes;
-  }
-  async select(question) {
-    this.refuse(question);
-  }
-};
-function createPrompter(options) {
-  if (options.yes || options.json || !isInteractive())
-    return new NonInteractivePrompter(options.yes);
-  return new TtyPrompter();
-}
-
-// src/commands/confirm.ts
-function cannotAsk(context) {
-  return context.flags.json || !isInteractive();
-}
-async function confirmOrAbort(context, question) {
-  if (context.flags.yes) return;
-  if (cannotAsk(context)) {
-    throw new NaroError(
-      "CONFIRMATION_REQUIRED",
-      `${question} Re-run with --yes to confirm.`
-    );
-  }
-  const confirmed = await context.prompter.confirm(question);
-  if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
-}
-
-// src/commands/migration.ts
-var processStdin = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-function migrationsDir(context) {
-  return resolveMigrationsDir({
-    baseDir: context.cwd,
-    rootDirectory: context.flags.root,
-    dir: context.flags.dir
-  });
-}
-function relativeToCwd(context, path) {
-  const rel = relative10(context.cwd, path);
-  return rel === "" ? "." : rel;
-}
-async function appliedMigrations(client, projectId) {
-  try {
-    return await client.db.migrations(projectId);
-  } catch (error51) {
-    if (isNaroError(error51) && error51.code === "DATABASE_NOT_READY") return [];
-    throw error51;
-  }
-}
-var UNPRINTABLE2 = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
-function printable2(text3) {
-  return text3.replace(UNPRINTABLE2, "?");
-}
-function isPrintable(text3) {
-  return printable2(text3) === text3;
-}
-var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
-function warningLines(message) {
-  return message.split("\n").map(
-    (line, index) => index === 0 ? `\u26A0 ${printable2(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
-  );
-}
-function policyProblems(dir, names) {
-  return names.flatMap((name) => {
-    const split2 = splitStatements(readFileSync10(join31(dir, name), "utf8"));
-    if (!split2.ok) return [];
-    const planned = planPolicyMigration(
-      split2.statements.map((statement2) => statement2.text)
-    );
-    return planned.ok ? [] : [{ migration: name, message: planned.message }];
-  });
-}
-function warningLine(warning) {
-  if (warning === "out-of-order")
-    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
-  if (warning === "ledger-name-missing-extension")
-    return "  \u26A0 recorded without .sql in the ledger";
-  return null;
-}
-async function runMigrationNew(context, deps = processStdin) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration new <name>"
-  );
-  const dir = migrationsDir(context);
-  const fileName = nextMigrationFileName(
-    listMigrationFiles(dir),
-    name
-  );
-  mkdirSync3(dir, { recursive: true });
-  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
-  const fromStdin = piped.length > 0;
-  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
-` : `-- Migration: ${fileName}
-`;
-  const path = join31(dir, fileName);
-  writeFileSync3(path, body, { flag: "wx" });
-  const relPath = relativeToCwd(context, path);
-  context.output.result({ file: fileName, path: relPath, fromStdin }, [
-    `\u2705 Created ${relPath}`
-  ]);
-}
-async function runMigrationList(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const migrations = compareMigrations(local, ledger);
-  const relDir = relativeToCwd(context, dir);
-  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
-    `Migrations in ${relDir} (${String(migrations.length)}):`,
-    ...migrations.flatMap((row) => {
-      const line = `  ${row.status.padEnd(12)}${printable2(row.name)}${row.appliedAt ? `  ${printable2(row.appliedAt)}` : ""}`;
-      const warning = warningLine(row.warning);
-      return warning ? [line, warning] : [line];
-    })
-  ];
-  context.output.result({ projectId, dir: relDir, migrations }, lines);
-}
-async function applyMigrationFiles(context, client, projectId, dir, names) {
-  const applied = [];
-  const warnings = [];
-  for (const name of names) {
-    const sql = readFileSync10(join31(dir, name), "utf8");
-    let answer;
-    try {
-      answer = await client.db.applyMigration(projectId, { name, sql });
-    } catch (error51) {
-      if (!isNaroError(error51)) throw error51;
-      for (const message of serverWarnings(error51.details))
-        for (const line of warningLines(message)) context.output.warn(line);
-      const shown = context.output.json ? name : printable2(name);
-      throw new NaroError(error51.code, `${shown}: ${error51.message}`, {
-        ...error51.status === void 0 ? {} : { status: error51.status },
-        details: {
-          ...error51.details,
-          migration: name,
-          applied,
-          appliedWarnings: warnings
-        },
-        cause: error51
-      });
-    }
-    context.output.log(`\u2713 ${printable2(name)}`);
-    applied.push(name);
-    for (const message of answer.warnings) {
-      warnings.push({ migration: name, message });
-      for (const line of warningLines(message)) context.output.warn(line);
-    }
-  }
-  return { applied, warnings };
-}
-function serverWarnings(details) {
-  const warnings = details?.warnings;
-  return Array.isArray(warnings) ? warnings.filter(
-    (warning) => typeof warning === "string"
-  ) : [];
-}
-var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
-var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
-var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
-var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
-function withoutSuffix(key) {
-  return key.slice(0, -".sql".length);
-}
-async function runMigrationRepair(context) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration repair <name> --status applied|reverted"
-  );
-  const key = name;
-  if (!MIGRATION_NAME_RE.test(key))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "name must end with .sql and contain only letters, digits, _ . -"
-    );
-  const status = context.flags.status;
-  if (status !== "applied" && status !== "reverted")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Pass --status applied or --status reverted."
-    );
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const ledger = await appliedMigrations(client, projectId);
-  const recorded = ledger.some(
-    (row) => row.name === key || row.name === withoutSuffix(key)
-  );
-  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
-  if (status === "applied" ? recorded : !recorded) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  await confirmOrAbort(
-    context,
-    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
-  );
-  if (status === "applied" && ledger.length === 0)
-    await client.db.query(projectId, { sql: LEDGER_DDL });
-  const answer = await client.db.query(projectId, {
-    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
-    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
-  });
-  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
-  if (!changed) {
-    context.output.warn(nothingToDo);
-    context.output.result({ name: key, status, changed: false });
-    return;
-  }
-  context.output.result({ name: key, status, changed: true }, [
-    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
-  ]);
-}
-async function runMigrationUp(context) {
-  const client = await dataClient(context);
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
-  if (pending.length === 0) {
-    context.output.result({ projectId, applied: [], pending: [] }, [
-      "No pending migrations."
-    ]);
-    return;
-  }
-  if (context.flags.dryRun) {
-    const problems2 = policyProblems(dir, pending);
-    context.output.result({ projectId, dryRun: true, pending, problems: problems2 }, [
-      `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable2(name)}`),
-      ...problems2.map(
-        (problem) => `${printable2(problem.migration)}: ${printable2(problem.message)}`
-      )
-    ]);
-    if (problems2.length > 0) process.exitCode = 1;
-    return;
-  }
-  context.output.log(`Pending migrations (${String(pending.length)}):`);
-  for (const name of pending) context.output.log(`  ${printable2(name)}`);
-  await confirmOrAbort(
-    context,
-    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
-  );
-  const { applied, warnings } = await applyMigrationFiles(
-    context,
-    client,
-    projectId,
-    dir,
-    pending
-  );
-  context.output.result({ projectId, applied, pending: [], warnings }, [
-    `\u2705 Applied ${String(applied.length)} migration(s).`
-  ]);
-}
-
 // src/functions/retry.ts
 var FUNCTION_RETRIES = 3;
 var FUNCTION_BUSY_WAIT_MS = 5e3;
@@ -34262,7 +36859,7 @@ async function deployFunctions(options) {
       if (!PER_FUNCTION_CODES.has(error51.code))
         throw withProgress(error51, deployed, failures);
       failures.push({ name, code: error51.code, message: error51.message });
-      io.log(`\u2717 ${name}: ${printable2(error51.message)}`);
+      io.log(`\u2717 ${name}: ${printable(error51.message)}`);
     }
   }
   if (failures.length > 0)
@@ -34375,7 +36972,7 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile15(join32(sourceDir, "package.json"), "utf8")
+      await readFile15(join31(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
@@ -34385,7 +36982,7 @@ async function projectName(sourceDir) {
 function resolveBin(name) {
   let dir = dirname10(fileURLToPath4(import.meta.url));
   for (; ; ) {
-    const candidate = join32(dir, "node_modules", ".bin", name);
+    const candidate = join31(dir, "node_modules", ".bin", name);
     if (existsSync10(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return name;
@@ -34452,7 +37049,7 @@ function workingTreeNotices(copy) {
 }
 function localDependencies(sourceDir, say = () => void 0) {
   return {
-    createWorkspace: () => mkdtemp2(join32(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join31(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm5(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -34557,7 +37154,7 @@ async function deployDirectory(sourceDir, options, log2) {
       const set2 = missing.filter((key) => isNaroSystemName(key));
       missing = missing.filter((key) => !isNaroSystemName(key));
       log2(
-        `\u25B8 naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
+        `\u25B8 Naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
       );
     }
   }
@@ -34707,11 +37304,17 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  CAPABILITIES,
+  dashboardNeeds,
   parseDotenvDetailed,
+  FUNCTION_INVOKE_METHODS,
+  FUNCTION_INVOKE_MAX_RESPONSE_BYTES,
+  FUNCTION_INVOKE_TIMEOUT_MS,
   isFunctionName,
   parseGitHubRemote,
   schemaMigrationTitle,
   projectPath,
+  readCapped,
   ANALYTICS_FILTER_KEYS,
   NaroError,
   promoteTargetUnsupported,
@@ -34740,6 +37343,8 @@ export {
   POLICY_RULES,
   POLICY_ACTIONS,
   NaroClient,
+  dashboardCapability,
+  dashboardLink,
   BOOKMARK_FORMAT_MESSAGE,
   isBookmark,
   RESTORE_OUTCOME_UNKNOWN_CODES,
@@ -34753,18 +37358,12 @@ export {
   parseCacheControl,
   STORAGE_OBJECTS_TABLE,
   dataError,
-  SCHEMA_SQL,
-  tableNames,
-  snapshotFromRows,
   quoteIdent,
   commentText,
   quotePolicyName,
   NAMED_POLICY_TABLE,
   NAMED_POLICY_SQL,
-  loadPolicy,
   parsePolicyNode,
-  INDEX_SQL,
-  indexesFromRows,
   parsePolicyStatement,
   splitPolicyStatements,
   STORAGE_SUBQUERIES_SQL,
@@ -34777,8 +37376,7 @@ export {
   writeProjectLink,
   removeProjectLink,
   ensureGitignoreHasNaro,
-  countLintedTables,
-  lintSchema,
+  lintDatabase,
   listMigrationFiles,
   nextMigrationFileName,
   pendingMigrationNames,
@@ -34800,9 +37398,6 @@ export {
   pullEnv,
   detectGitInfo,
   version2 as version,
-  BUNDLE_MESSAGES,
-  functionsFolder,
-  parseJsonc2 as parseJsonc,
   DATA_ENV_MESSAGES,
   dataEnvironment,
   dataClient,
@@ -34818,7 +37413,7 @@ export {
   migrationsDir,
   relativeToCwd,
   appliedMigrations,
-  printable2 as printable,
+  printable,
   isPrintable,
   UNSHOWN_WARNING_LINE,
   warningLines,
@@ -34828,6 +37423,10 @@ export {
   applyMigrationFiles,
   runMigrationRepair,
   runMigrationUp,
+  runDbLint,
+  BUNDLE_MESSAGES,
+  functionsFolder,
+  parseJsonc2 as parseJsonc,
   defaultSleep,
   retryAfterSeconds,
   withFunctionRetries,