naro-cli 0.25.0 → 0.27.0

package/dist/{chunk-X5TUBMEU.js → chunk-UGJFIEH7.js}

@@ -7,7 +7,7 @@ import {
 import { existsSync as existsSync10 } from "fs";
 import { mkdtemp as mkdtemp2, readFile as readFile15, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename5, dirname as dirname10, join as join32, resolve as resolve14 } from "path";
+import { basename as basename5, dirname as dirname10, join as join31, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -289,7 +289,7 @@ function hashAsset(data, contentType2) {
 // ../../packages/build/src/local-build-executor.ts
 import { access as access8, mkdtemp, readFile as readFile13, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join18, resolve as resolve7 } from "path";
+import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/route-patterns.ts
 var ROUTE_PATTERN = /^\/[A-Za-z0-9\-._~%!$&()*+,;=:@/[\]]*$/;
@@ -317,6 +317,1896 @@ var IDENTIFIER = new RegExp(
   "g"
 );
 
+// ../../packages/core/src/capabilities.ts
+var REASON_CODES = {
+  "secret-value": {
+    clients: ["mcp"],
+    why: "\uC2DC\uD06C\uB9BF \uAC12\uC744 \uBC1B\uAC70\uB098 \uB3CC\uB824\uC900\uB2E4. \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4 (apps/mcp/src/function-tools.ts:34)."
+  },
+  irreversible: {
+    clients: ["mcp"],
+    why: "\uB418\uB3CC\uB9B4 \uC218 \uC5C6\uACE0 \uD655\uC778\uC73C\uB85C\uB9CC \uB9C9\uC744 \uC218 \uC788\uB2E4 (project_cli_mcp_backlog #6)."
+  },
+  "privilege-escalation": {
+    clients: ["mcp"],
+    why: "\uAD8C\uD55C\xB7\uC5ED\uD560\xB7\uBA64\uBC84\uC2ED\uC744 \uBC14\uAFBC\uB2E4."
+  },
+  "payment-flow": {
+    clients: ["cli", "mcp"],
+    why: "\uCE74\uB4DC \uC815\uBCF4\uAC00 \uC9C0\uB098\uAC04\uB2E4. \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4."
+  },
+  "browser-required": {
+    clients: ["cli", "mcp"],
+    why: "OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uAC00 \uD544\uC694\uD558\uB2E4."
+  },
+  "local-filesystem": {
+    clients: ["ui"],
+    why: "\uB85C\uCEEC \uD30C\uC77C\uC744 \uC77D\uAC70\uB098 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+  },
+  "ui-affordance": {
+    clients: ["cli", "mcp"],
+    why: "\uD654\uBA74 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4."
+  },
+  "agent-native": {
+    clients: ["mcp"],
+    // "naro CLI로 할 수 있다"는 사유가 아니다 — 그러면 CLI에 있는 모든 기능을
+    // 이 코드로 뺄 수 있다(PR #423 리뷰). 컨트롤 플레인에 닿는 일이면 planned다.
+    why: "\uC774 \uCEF4\uD4E8\uD130\uC758 \uD30C\uC77C\uB9CC \uC4F0\uB294 \uC77C\uC774\uB2E4. \uC5D0\uC774\uC804\uD2B8\uB294 \uC81C \uB3C4\uAD6C\uB85C \uD30C\uC77C\uC744 \uC4F4\uB2E4 \u2014 MCP \uD234\uB85C \uAC10\uC2F8\uBA74 \uC4F0\uAE30 \uACBD\uB85C \uAC80\uC0AC\uB9CC \uB294\uB2E4."
+  },
+  "user-session": {
+    clients: ["mcp"],
+    why: "\uC0AC\uC6A9\uC790 \uC790\uC2E0\uC758 \uB85C\uADF8\uC778 \uC138\uC158\uC744 \uBC14\uAFBC\uB2E4. \uC0AC\uB78C\uC774 \uD130\uBBF8\uB110\uC5D0\uC11C \uD55C\uB2E4."
+  },
+  "dashboard-itself": {
+    clients: ["ui"],
+    why: "\uB300\uC2DC\uBCF4\uB4DC\uB85C \uAC00\uB294 \uAE38\uC744 \uC54C\uB824 \uC8FC\uB294 \uAE30\uB2A5\uC774\uB2E4. \uB300\uC2DC\uBCF4\uB4DC \uC548\uC5D0\uC11C\uB294 \uB73B\uC774 \uC5C6\uB2E4."
+  }
+};
+var CAPABILITIES = [
+  {
+    id: "auth-whoami",
+    domain: "auth",
+    title: "\uB0B4 \uACC4\uC815 \uD655\uC778",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro whoami"] },
+    mcp: { kind: "built", tools: ["whoami"] }
+  },
+  {
+    id: "auth-ci-token",
+    domain: "auth",
+    title: "CI \uD1A0\uD070 \uBC1C\uAE09",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "naro login\uC774 \uC774 \uCEF4\uD4E8\uD130\uC5D0 \uB0A8\uAE34 \uC138\uC158(~/.naro/credentials.json)\uC5D0\uC11C \uD1A0\uD070\uC744 \uAEBC\uB0B8\uB2E4. \uBE0C\uB77C\uC6B0\uC800 \uC138\uC158\uC5D0\uB294 \uADF8 \uD30C\uC77C\uC774 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro token"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uD1A0\uD070 \uC790\uCCB4\uAC00 \uC2DC\uD06C\uB9BF\uC774\uB77C \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "auth-login",
+    domain: "auth",
+    title: "\uB85C\uADF8\uC778",
+    dashboard: "/login",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro login"] },
+    mcp: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "apps/mcp/src/tools.ts \u2014 \uC774 \uC11C\uBC84\uB294 \uBE0C\uB77C\uC6B0\uC800\uB97C \uC5F4 \uC218 \uC5C6\uB2E4. \uC0AC\uC6A9\uC790\uAC00 \uD130\uBBF8\uB110\uC5D0\uC11C naro login\uC744 \uB3CC\uB9AC\uAC8C \uD55C\uB2E4."
+    }
+  },
+  {
+    id: "auth-logout",
+    domain: "auth",
+    title: "\uB85C\uADF8\uC544\uC6C3",
+    dashboard: null,
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro logout"] },
+    mcp: {
+      kind: "excluded",
+      reason: "user-session",
+      note: "naro login \uC138\uC158\uC740 \uC0AC\uB78C\uC774 \uB2E4\uB8EC\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "team-list",
+    domain: "teams",
+    title: "\uD300 \uBAA9\uB85D",
+    routes: ["GET teams"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro teams"] },
+    mcp: { kind: "built", tools: ["list_teams"] }
+  },
+  {
+    id: "team-member-list",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/members"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members"] },
+    mcp: { kind: "built", tools: ["list_team_members"] }
+  },
+  {
+    id: "team-create",
+    domain: "teams",
+    title: "\uD300 \uC0DD\uC131",
+    routes: ["POST teams"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team create"] },
+    mcp: { kind: "built", tools: ["create_team"] }
+  },
+  {
+    id: "team-update",
+    domain: "teams",
+    title: "\uD300 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PATCH teams/[teamSlug]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team set"] },
+    mcp: { kind: "built", tools: ["update_team"] }
+  },
+  {
+    id: "team-delete",
+    domain: "teams",
+    title: "\uD300 \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uD300\uC758 \uD504\uB85C\uC81D\uD2B8\xB7\uB370\uC774\uD130\uAC00 \uD568\uAED8 \uC0AC\uB77C\uC9C4\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-member-update",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uC5ED\uD560 \uBCC0\uACBD",
+    routes: ["PATCH teams/[teamSlug]/members/[userId]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members set"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uC5ED\uD560\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-member-remove",
+    domain: "teams",
+    title: "\uBA64\uBC84 \uC81C\uAC70",
+    routes: ["DELETE teams/[teamSlug]/members/[userId]"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team members remove"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC2ED\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-invite-list",
+    domain: "teams",
+    title: "\uCD08\uB300 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/invites"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites"] },
+    mcp: { kind: "built", tools: ["list_team_invites"] }
+  },
+  {
+    id: "team-invite-create",
+    domain: "teams",
+    title: "\uCD08\uB300 \uBCF4\uB0B4\uAE30",
+    routes: ["POST teams/[teamSlug]/invites"],
+    dashboard: "/[teamSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites create"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uD300\uC5D0 \uC0AC\uB78C\uC744 \uB4E4\uC778\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "team-invite-revoke",
+    domain: "teams",
+    title: "\uCD08\uB300 \uCDE8\uC18C",
+    routes: ["DELETE teams/[teamSlug]/invites/[inviteId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro team invites revoke"] },
+    mcp: { kind: "built", tools: ["revoke_team_invite"] }
+  },
+  {
+    id: "team-usage",
+    domain: "teams",
+    title: "\uD300 \uC0AC\uC6A9\uB7C9",
+    routes: ["GET teams/[teamSlug]/usage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro usage"] },
+    mcp: { kind: "built", tools: ["get_team_usage"] }
+  },
+  {
+    id: "team-backend-usage",
+    domain: "teams",
+    title: "\uD300 \uBC31\uC5D4\uB4DC \uC0AC\uC6A9\uB7C9\xB7\uC77C\uBCC4 \uCC28\uD2B8(\uD568\uC218 CPU\xB7DB\xB7\uC2A4\uD1A0\uB9AC\uC9C0\xB7\uB9AC\uC5BC\uD0C0\uC784)",
+    routes: [
+      "GET teams/[teamSlug]/backend-usage",
+      "GET teams/[teamSlug]/usage/series"
+    ],
+    dashboard: "/[teamSlug]/projects",
+    ui: { kind: "built" },
+    cli: {
+      kind: "planned",
+      note: "\uD300 \uAC1C\uC694 \uCE74\uB4DC\uB85C \uBA3C\uC800 \uB0C8\uB2E4. naro usage\uC5D0 \uBC31\uC5D4\uB4DC \uC904\uC744 \uB354\uD558\uB294 \uAC83\uC774 \uB2E4\uC74C\uC774\uB2E4."
+    },
+    mcp: {
+      kind: "planned",
+      note: "get_team_usage\uC5D0 \uBC31\uC5D4\uB4DC \uC0AC\uC6A9\uB7C9\uC744 \uB354\uD558\uB294 \uAC83\uC774 \uB2E4\uC74C\uC774\uB2E4."
+    }
+  },
+  {
+    id: "billing-view",
+    domain: "billing",
+    title: "\uD50C\uB79C\xB7\uAD6C\uB3C5 \uC870\uD68C",
+    routes: ["GET teams/[teamSlug]/billing"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro billing"] },
+    mcp: { kind: "built", tools: ["get_team_billing"] }
+  },
+  {
+    id: "billing-checkout",
+    domain: "billing",
+    title: "\uCCB4\uD06C\uC544\uC6C3",
+    routes: ["POST teams/[teamSlug]/billing/checkout"],
+    dashboard: "/[teamSlug]/usage",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uCE74\uB4DC \uC815\uBCF4\uB294 Paddle\uC758 \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uCE74\uB4DC \uC815\uBCF4\uB294 Paddle\uC758 \uD638\uC2A4\uD305 \uACB0\uC81C\uCC3D\uC774 \uBC1B\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "billing-portal",
+    domain: "billing",
+    title: "\uACB0\uC81C \uD3EC\uD138",
+    routes: ["POST teams/[teamSlug]/billing/portal"],
+    dashboard: "/[teamSlug]/usage",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uACB0\uC81C \uC218\uB2E8 \uBCC0\uACBD\uC740 Paddle \uD3EC\uD138\uC5D0\uC11C \uD55C\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "payment-flow",
+      note: "\uACB0\uC81C \uC218\uB2E8 \uBCC0\uACBD\uC740 Paddle \uD3EC\uD138\uC5D0\uC11C \uD55C\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "project-list",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uBAA9\uB85D",
+    routes: ["GET projects"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro projects"] },
+    mcp: { kind: "built", tools: ["list_projects"] }
+  },
+  {
+    id: "project-create",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC0DD\uC131",
+    routes: ["POST projects"],
+    ui: { kind: "built" },
+    // naro deploy가 링크가 없을 때 만든다(POST cli/deployments).
+    cli: { kind: "built" },
+    // deploy가 링크가 없을 때 만든다(POST cli/deployments).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "project-get",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC870\uD68C",
+    routes: ["GET projects/[projectId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project inspect"] },
+    mcp: { kind: "built", tools: ["get_project"] }
+  },
+  {
+    id: "project-link",
+    domain: "projects",
+    title: "\uB514\uB809\uD130\uB9AC\uB97C \uD504\uB85C\uC81D\uD2B8\uC5D0 \uB9C1\uD06C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".naro/project.json\uC5D0 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro link", "naro init"] },
+    mcp: { kind: "built", tools: ["link_project"] }
+  },
+  {
+    id: "project-unlink",
+    domain: "projects",
+    title: "\uB9C1\uD06C \uD574\uC81C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".naro/\uB97C \uC9C0\uC6B4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro unlink"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: ".naro/\uB97C \uC9C0\uC6B0\uB294 \uC77C\uC774\uB2E4. \uC9DD\uC778 link_project\uAC00 \uD234\uC778 \uAC83\uC740 \uD504\uB85C\uC81D\uD2B8\uB97C \uACE0\uB974\uB824\uBA74 \uCEE8\uD2B8\uB864 \uD50C\uB808\uC778\uC744 \uC77D\uC5B4\uC57C \uD574\uC11C\uB2E4 \u2014 unlink\uB294 \uD30C\uC77C\uB9CC \uC9C0\uC6B4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "project-update",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC124\uC815 \uBCC0\uACBD(\uD504\uB808\uC784\uC6CC\uD06C\xB7\uC11C\uBE0C\uB3C4\uBA54\uC778)",
+    routes: ["PATCH projects/[projectId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project set"] },
+    // 서브도메인은 빼고(PR #433 리뷰): 옛 이름이 바로 비어 누구나 가져갈 수 있어
+    // 북마크·OAuth 리다이렉트가 남의 앱으로 간다. 대시보드와 CLI(먼저 묻는다)만.
+    mcp: { kind: "built", tools: ["update_project"] }
+  },
+  {
+    id: "project-delete",
+    domain: "projects",
+    title: "\uD504\uB85C\uC81D\uD2B8 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC6CC\uCEE4\xB7D1\xB7R2\xB7\uB3C4\uBA54\uC778\xB7\uBC30\uD3EC \uC774\uB825\uC774 cascade\uB85C \uB0A0\uC544\uAC04\uB2E4. \uC5D0\uC774\uC804\uD2B8\uB294 \uD504\uB86C\uD504\uD2B8 \uC778\uC81D\uC158\uC5D0 \uB178\uCD9C\uB418\uBBC0\uB85C \uD655\uC778\uC73C\uB85C \uB9C9\uC744 \uC218 \uC5C6\uB2E4(project_cli_mcp_backlog #6)."
+    }
+  },
+  {
+    id: "project-subdomain-check",
+    domain: "projects",
+    title: "\uC11C\uBE0C\uB3C4\uBA54\uC778 \uC0AC\uC6A9 \uAC00\uB2A5 \uC5EC\uBD80",
+    routes: ["GET subdomains/availability"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project check"] },
+    mcp: { kind: "built", tools: ["check_subdomain"] }
+  },
+  {
+    id: "project-access-list",
+    domain: "projects",
+    title: "\uBA64\uBC84\uBCC4 \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uC870\uD68C",
+    routes: ["GET projects/[projectId]/access"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access"] },
+    mcp: { kind: "built", tools: ["list_project_access"] }
+  },
+  {
+    id: "project-access-grant",
+    domain: "projects",
+    title: "\uBA64\uBC84\uC5D0\uAC8C \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uBD80\uC5EC",
+    routes: ["PUT projects/[projectId]/access"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/access",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access grant"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uAD8C\uD55C\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "project-access-revoke",
+    domain: "projects",
+    title: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uC811\uADFC \uD68C\uC218",
+    routes: ["DELETE projects/[projectId]/access"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/access",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro project access revoke"] },
+    mcp: {
+      kind: "excluded",
+      reason: "privilege-escalation",
+      note: "\uBA64\uBC84\uC758 \uD504\uB85C\uC81D\uD2B8 \uAD8C\uD55C\uC744 \uBC14\uAFBC\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "deployment-list",
+    domain: "deployments",
+    title: "\uBC30\uD3EC \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/deployments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro deployments"] },
+    mcp: { kind: "built", tools: ["list_deployments"] }
+  },
+  {
+    id: "deployment-create",
+    domain: "deployments",
+    title: "\uBE0C\uB79C\uCE58\uC5D0\uC11C \uC0C8\uB85C \uBC30\uD3EC",
+    routes: ["POST projects/[projectId]/deployments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro deployments create"] },
+    mcp: { kind: "built", tools: ["deploy_from_git"] }
+  },
+  {
+    id: "deployment-local",
+    domain: "deployments",
+    title: "\uB85C\uCEEC\uC5D0\uC11C \uBE4C\uB4DC\uD574 \uBC30\uD3EC",
+    routes: ["POST cli/deployments"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uB85C\uCEEC \uC791\uC5C5 \uD2B8\uB9AC\uC5D0\uC11C \uBE4C\uB4DC\uD55C \uC0B0\uCD9C\uBB3C\uC744 \uC62C\uB9B0\uB2E4. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uB294 \uBE4C\uB4DC\uD560 \uC791\uC5C5 \uD2B8\uB9AC\uAC00 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro deploy"] },
+    mcp: { kind: "built", tools: ["deploy"] }
+  },
+  {
+    id: "deployment-get",
+    domain: "deployments",
+    title: "\uBC30\uD3EC \uC0C1\uC138",
+    routes: ["GET deployments/[deploymentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro inspect"] },
+    mcp: { kind: "built", tools: ["get_deployment", "get_build_logs"] }
+  },
+  {
+    id: "deployment-cancel",
+    domain: "deployments",
+    title: "\uBE4C\uB4DC \uCDE8\uC18C",
+    routes: ["POST projects/[projectId]/deployments/[deploymentId]/cancel"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro cancel"] },
+    mcp: { kind: "built", tools: ["cancel_deployment"] }
+  },
+  {
+    id: "deployment-promote-preview",
+    domain: "deployments",
+    title: "\uC2B9\uACA9 \uBBF8\uB9AC\uBCF4\uAE30",
+    routes: ["GET projects/[projectId]/deployments/[deploymentId]/promote"],
+    ui: { kind: "built" },
+    // naro promote가 묻기 전에 무엇을 할지 보여 준다(client.deployments.promoteCheck).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["check_promotion"] }
+  },
+  {
+    id: "deployment-promote",
+    domain: "deployments",
+    title: "\uD504\uB85C\uB355\uC158\xB7\uD658\uACBD\uC73C\uB85C \uC2B9\uACA9(\uB864\uBC31 \uD3EC\uD568)",
+    routes: ["POST projects/[projectId]/deployments/[deploymentId]/promote"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro promote", "naro rollback"] },
+    mcp: {
+      kind: "built",
+      tools: ["promote_deployment", "rollback_deployment"]
+    }
+  },
+  {
+    id: "git-app-install",
+    domain: "git",
+    title: "GitHub App \uC124\uCE58",
+    routes: ["GET github/authorize", "GET github/install", "GET github/setup"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "GitHub App \uC124\uCE58\uB294 OAuth \uB9AC\uB2E4\uC774\uB809\uD2B8\uB85C \uB05D\uB09C\uB2E4. naro git connect\uAC00 \uC124\uCE58 URL\uC744 \uCC0D\uC5B4 \uC900\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "browser-required",
+      note: "apps/mcp/src/tools.ts\uC758 connect_git_repository \u2014 \uC124\uCE58 URL\uC744 \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC8FC\uACE0 \uBE0C\uB77C\uC6B0\uC800\uB294 \uC9C1\uC811 \uC5F4\uC9C0 \uC54A\uB294\uB2E4."
+    }
+  },
+  {
+    id: "git-repository-list",
+    domain: "git",
+    title: "GitHub \uC800\uC7A5\uC18C \uBAA9\uB85D",
+    routes: ["GET github/repositories"],
+    ui: { kind: "built" },
+    // naro git connect가 저장소를 고를 때 읽는다(client.github.listRepositories).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["list_git_repositories"] }
+  },
+  {
+    id: "git-connect",
+    domain: "git",
+    title: "\uC800\uC7A5\uC18C \uC5F0\uACB0",
+    routes: ["POST projects/[projectId]/git"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro git connect"] },
+    mcp: { kind: "built", tools: ["connect_git_repository"] }
+  },
+  {
+    id: "git-disconnect",
+    domain: "git",
+    title: "\uC800\uC7A5\uC18C \uC5F0\uACB0 \uD574\uC81C",
+    routes: ["DELETE projects/[projectId]/git"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro git disconnect"] },
+    mcp: { kind: "built", tools: ["disconnect_git_repository"] }
+  },
+  {
+    id: "env-list",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/env"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env list"] },
+    mcp: { kind: "built", tools: ["list_environment_variables"] }
+  },
+  {
+    id: "env-set",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uCD94\uAC00\xB7\uC218\uC815",
+    routes: ["POST projects/[projectId]/env"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env add", "naro env import"] },
+    mcp: { kind: "built", tools: ["set_environment_variable"] }
+  },
+  {
+    id: "env-remove",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/env/[envVarId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro env remove"] },
+    mcp: { kind: "built", tools: ["remove_environment_variable"] }
+  },
+  // 앱 메일의 Resend 연결(spec 2026-11-04 resend-email-integration). 연결은
+  // env 두 행이라 env 도메인에 둔다. CLI·MCP는 그 스펙의 PR 2다.
+  {
+    id: "email-status",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0 \uBCF4\uAE30",
+    routes: ["GET projects/[projectId]/email"],
+    ui: { kind: "built" },
+    cli: { kind: "planned", note: "naro email status \u2014 \uC2A4\uD399 \xA713 PR 2." },
+    mcp: { kind: "planned", note: "get_email \u2014 \uC2A4\uD399 \xA713 PR 2." }
+  },
+  {
+    id: "email-connect",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0\xB7\uBC14\uAFB8\uAE30",
+    routes: ["PUT projects/[projectId]/email"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/email",
+    ui: { kind: "built" },
+    cli: {
+      kind: "planned",
+      note: "naro email connect --api-key-stdin \u2014 \uC2A4\uD399 \xA713 PR 2."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "Resend API \uD0A4\uB97C \uBC1B\uB294\uB2E4. \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4 \u2014 get_email\uC774 naro email connect\uB098 \uB300\uC2DC\uBCF4\uB4DC\uB97C \uC548\uB0B4\uD55C\uB2E4(\uC2A4\uD399 \xA73-8)."
+    }
+  },
+  {
+    id: "email-disconnect",
+    domain: "env",
+    title: "Resend \uC5F0\uACB0 \uB04A\uAE30",
+    routes: ["DELETE projects/[projectId]/email"],
+    ui: { kind: "built" },
+    cli: { kind: "planned", note: "naro email disconnect \u2014 \uC2A4\uD399 \xA713 PR 2." },
+    mcp: { kind: "planned", note: "disconnect_email \u2014 \uC2A4\uD399 \xA713 PR 2." }
+  },
+  {
+    id: "env-pull",
+    domain: "env",
+    title: "\uD658\uACBD\uBCC0\uC218\uB97C \uB85C\uCEEC\uB85C \uB0B4\uB9AC\uAE30",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: ".env.local\uC5D0 \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro env pull"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uBCF5\uD638\uD654\uD55C \uAC12\uC744 .env.local\uC5D0 \uC4F4\uB2E4. list_environment_variables\uB294 \uAC12\uC744 \uAC00\uB9B0\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "environment-list",
+    domain: "environments",
+    title: "\uD658\uACBD \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/environments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments"] },
+    mcp: { kind: "built", tools: ["list_environments"] }
+  },
+  {
+    id: "environment-create",
+    domain: "environments",
+    title: "\uD658\uACBD \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/environments"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments create"] },
+    mcp: { kind: "built", tools: ["create_environment"] }
+  },
+  {
+    id: "environment-update",
+    domain: "environments",
+    title: "\uD658\uACBD \uC124\uC815 \uBCC0\uACBD(\uBE0C\uB79C\uCE58\xB7\uBCF4\uD638)",
+    routes: ["PATCH projects/[projectId]/environments/[environmentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments set"] },
+    mcp: { kind: "built", tools: ["update_environment"] }
+  },
+  {
+    id: "environment-delete",
+    domain: "environments",
+    title: "\uD658\uACBD \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/environments/[environmentId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments delete"] },
+    mcp: { kind: "built", tools: ["delete_environment"] }
+  },
+  {
+    id: "environment-provision",
+    domain: "environments",
+    title: "\uD658\uACBD \uB370\uC774\uD130 \uD504\uB85C\uBE44\uC800\uB2DD",
+    routes: [
+      "POST projects/[projectId]/environments/[environmentId]/provision"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro environments provision"] },
+    mcp: { kind: "built", tools: ["provision_environment"] }
+  },
+  {
+    id: "domain-list",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/domains"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains list"] },
+    mcp: { kind: "built", tools: ["list_domains"] }
+  },
+  {
+    id: "domain-add",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/domains"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains add"] },
+    mcp: { kind: "built", tools: ["add_domain"] }
+  },
+  {
+    id: "domain-refresh",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC0C1\uD0DC \uC0C8\uB85C\uACE0\uCE68",
+    routes: ["PATCH projects/[projectId]/domains/[domainId]"],
+    ui: { kind: "built" },
+    // naro domains verify가 Cloudflare 재확인까지 해서 refresh(저장된 상태 다시 읽기)의
+    // 상위다. 같은 PATCH는 부르지 않는다.
+    cli: { kind: "built" },
+    // verify_domain이 같은 일을 더 한다(재확인 + DNS 점검).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-remove",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/domains/[domainId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains remove"] },
+    mcp: { kind: "built", tools: ["remove_domain"] }
+  },
+  {
+    id: "domain-verify",
+    domain: "domains",
+    title: "DNS \uC7AC\uAC80\uC99D",
+    routes: ["POST projects/[projectId]/domains/[domainId]/verify"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro domains verify"] },
+    mcp: { kind: "built", tools: ["verify_domain"] }
+  },
+  {
+    id: "domain-claim-list",
+    domain: "domains",
+    title: "\uB2E4\uB978 \uD504\uB85C\uC81D\uD2B8\uAC00 \uAC00\uC9C4 \uB3C4\uBA54\uC778\uC758 \uC18C\uC720\uAD8C \uD655\uC778 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/domain-claims"],
+    ui: { kind: "built" },
+    // naro domains verify가 소유권 확인을 함께 읽는다(client.domains.listClaims).
+    cli: { kind: "built" },
+    // verify_domain이 소유권 확인을 함께 읽는다(client.domains.listClaims).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-claim-verify",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC18C\uC720\uAD8C \uD655\uC778",
+    routes: ["POST projects/[projectId]/domain-claims/[claimId]/verify"],
+    ui: { kind: "built" },
+    // naro domains verify가 소유권 확인을 함께 다시 본다(client.domains.verifyClaim).
+    cli: { kind: "built" },
+    // verify_domain이 소유권 확인을 함께 다시 본다(client.domains.verifyClaim).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "domain-claim-cancel",
+    domain: "domains",
+    title: "\uB3C4\uBA54\uC778 \uC18C\uC720\uAD8C \uD655\uC778 \uCDE8\uC18C",
+    routes: ["DELETE projects/[projectId]/domain-claims/[claimId]"],
+    ui: { kind: "built" },
+    // naro domains remove가 붙어 있지 않은 호스트의 소유권 확인을 취소한다.
+    cli: { kind: "built" },
+    // remove_domain이 붙어 있지 않은 호스트의 소유권 확인을 취소한다(claimCancelled).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "dns-zone-list",
+    domain: "dns",
+    title: "DNS \uC874 \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/dns-zones"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns"] },
+    mcp: { kind: "built", tools: ["get_dns"] }
+  },
+  {
+    id: "dns-zone-add",
+    domain: "dns",
+    title: "DNS \uC874 \uCD94\uAC00",
+    routes: ["POST teams/[teamSlug]/dns-zones"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns add"] },
+    mcp: { kind: "built", tools: ["add_dns_zone"] }
+  },
+  {
+    id: "dns-zone-remove",
+    domain: "dns",
+    title: "DNS \uC874 \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]/dns-zones/[zoneId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns remove"] },
+    mcp: { kind: "built", tools: ["remove_dns_zone"] }
+  },
+  {
+    id: "dns-zone-check",
+    domain: "dns",
+    title: "\uB124\uC784\uC11C\uBC84 \uC774\uAD00 \uD655\uC778",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/check"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns check"] },
+    mcp: { kind: "built", tools: ["check_dns_zone"] }
+  },
+  {
+    id: "dns-zone-precheck",
+    domain: "dns",
+    title: "\uC774\uAD00 \uC804 \uBA54\uC77C \uD655\uC778",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/precheck"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns mail"] },
+    mcp: { kind: "built", tools: ["check_dns_mail"] }
+  },
+  {
+    id: "dns-zone-scan",
+    domain: "dns",
+    title: "\uAE30\uC874 DNS \uB808\uCF54\uB4DC \uC2A4\uCE94 \uACB0\uACFC",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/scan"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns scan"] },
+    mcp: { kind: "built", tools: ["get_dns_scan"] }
+  },
+  {
+    id: "dns-zone-scan-import",
+    domain: "dns",
+    title: "\uC2A4\uCE94\uD55C \uB808\uCF54\uB4DC \uC77C\uAD04 \uAC00\uC838\uC624\uAE30",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/scan"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns import"] },
+    mcp: { kind: "built", tools: ["import_dns_scan"] }
+  },
+  {
+    id: "dns-record-list",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uBAA9\uB85D",
+    routes: ["GET teams/[teamSlug]/dns-zones/[zoneId]/records"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records"] },
+    mcp: { kind: "built", tools: ["list_dns_records"] }
+  },
+  {
+    id: "dns-record-add",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uCD94\uAC00",
+    routes: ["POST teams/[teamSlug]/dns-zones/[zoneId]/records"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records add"] },
+    mcp: { kind: "built", tools: ["add_dns_record"] }
+  },
+  {
+    id: "dns-record-update",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uC218\uC815",
+    routes: ["PATCH teams/[teamSlug]/dns-zones/[zoneId]/records/[recordId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records update"] },
+    mcp: { kind: "built", tools: ["update_dns_record"] }
+  },
+  {
+    id: "dns-record-remove",
+    domain: "dns",
+    title: "DNS \uB808\uCF54\uB4DC \uC0AD\uC81C",
+    routes: ["DELETE teams/[teamSlug]/dns-zones/[zoneId]/records/[recordId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro dns records remove"] },
+    mcp: { kind: "built", tools: ["remove_dns_record"] }
+  },
+  {
+    id: "protection-get",
+    domain: "protection",
+    title: "\uD504\uB9AC\uBDF0 \uBCF4\uD638 \uC0C1\uD0DC",
+    routes: ["GET projects/[projectId]/preview-protection"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection"] },
+    mcp: { kind: "built", tools: ["get_preview_protection"] }
+  },
+  {
+    id: "protection-set",
+    domain: "protection",
+    title: "\uD504\uB9AC\uBDF0 \uBCF4\uD638 \uCF1C\uAE30\xB7\uB044\uAE30",
+    routes: ["PUT projects/[projectId]/preview-protection"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro protection enable", "naro protection disable"]
+    },
+    mcp: { kind: "built", tools: ["set_preview_protection"] }
+  },
+  {
+    id: "protection-bypass-create",
+    domain: "protection",
+    title: "\uC6B0\uD68C \uC2DC\uD06C\uB9BF \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/preview-protection/bypass"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection bypass"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "apps/mcp/src/protection-tools.ts \u2014 \uC6B0\uD68C \uC2DC\uD06C\uB9BF\uC740 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. \uB300\uC2DC\uBCF4\uB4DC\uB098 naro protection bypass\uB85C \uB9CC\uB4E0\uB2E4."
+    }
+  },
+  {
+    id: "protection-bypass-remove",
+    domain: "protection",
+    title: "\uC6B0\uD68C \uC2DC\uD06C\uB9BF \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/preview-protection/bypass"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro protection bypass remove"] },
+    mcp: { kind: "built", tools: ["remove_preview_protection_bypass"] }
+  },
+  {
+    id: "database-info",
+    domain: "database",
+    title: "\uB370\uC774\uD130\uBCA0\uC774\uC2A4 \uC0C1\uD0DC\xB7\uC6A9\uB7C9\xB7\uD55C\uB3C4",
+    routes: ["GET projects/[projectId]/database"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db info"] },
+    mcp: { kind: "built", tools: ["get_database"] }
+  },
+  {
+    id: "database-enable",
+    domain: "database",
+    title: "\uB370\uC774\uD130\uBCA0\uC774\uC2A4 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/database"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db enable"] },
+    mcp: { kind: "built", tools: ["enable_database"] }
+  },
+  {
+    id: "database-query",
+    domain: "database",
+    title: "SQL \uC2E4\uD589",
+    routes: ["POST projects/[projectId]/database/query"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db query"] },
+    mcp: { kind: "built", tools: ["execute_sql"] }
+  },
+  {
+    id: "database-tables",
+    domain: "database",
+    title: "\uD14C\uC774\uBE14 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/tables"],
+    ui: { kind: "built" },
+    // naro db 명령들이 테이블 목록을 읽는다(client.db.tables).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["list_tables"] }
+  },
+  {
+    id: "database-schema-change",
+    domain: "database",
+    title: "\uD14C\uC774\uBE14\xB7\uC778\uB371\uC2A4 \uBC14\uAFB8\uAE30",
+    routes: ["POST projects/[projectId]/database/schema"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro db table create",
+        "naro db table add-column",
+        "naro db table rename-column",
+        "naro db table rename",
+        "naro db table drop-column",
+        "naro db table drop",
+        "naro db index create",
+        "naro db index drop"
+      ]
+    },
+    mcp: {
+      kind: "built",
+      tools: [
+        "create_table",
+        "alter_table",
+        "drop_table",
+        "create_index",
+        "drop_index"
+      ]
+    }
+  },
+  {
+    id: "database-migration-list",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/migrations"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro migration list"] },
+    mcp: { kind: "built", tools: ["list_migrations"] }
+  },
+  {
+    id: "database-migration-apply",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uC801\uC6A9",
+    routes: ["POST projects/[projectId]/database/migrations"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db push", "naro migration up"] },
+    mcp: { kind: "built", tools: ["apply_migration"] }
+  },
+  {
+    id: "database-export",
+    domain: "database",
+    title: "\uB364\uD504 \uB0B4\uB824\uBC1B\uAE30",
+    routes: ["POST projects/[projectId]/database/export"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db dump"] },
+    mcp: { kind: "built", tools: ["export_database"] }
+  },
+  {
+    id: "database-restore",
+    domain: "database",
+    title: "Time Travel \uBCF5\uAD6C",
+    routes: ["POST projects/[projectId]/database/restore"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db restore"] },
+    mcp: { kind: "built", tools: ["restore_database"] }
+  },
+  {
+    id: "database-bookmark",
+    domain: "database",
+    title: "\uBCF5\uAD6C \uC9C0\uC810(\uBD81\uB9C8\uD06C) \uC870\uD68C",
+    routes: ["GET projects/[projectId]/database/bookmark"],
+    ui: { kind: "built" },
+    // naro db restore가 되돌릴 북마크를 먼저 읽는다(client.db.bookmark).
+    cli: { kind: "built" },
+    // restore_database가 되돌릴 북마크를 먼저 읽는다(client.db.bookmark).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "database-pull",
+    domain: "database",
+    title: "\uC6D0\uACA9 \uC2A4\uD0A4\uB9C8\uB97C \uBCA0\uC774\uC2A4\uB77C\uC778 \uB9C8\uC774\uADF8\uB808\uC774\uC158\uC73C\uB85C",
+    routes: ["POST projects/[projectId]/database/pull"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uC6D0\uACA9 \uC2A4\uD0A4\uB9C8\uB97C ./migrations\uC758 \uCCAB \uD30C\uC77C\uB85C \uC4F4\uB2E4 \u2014 \uB0B4 \uCEF4\uD4E8\uD130\uC758 \uD3F4\uB354\uAC00 \uC788\uC5B4\uC57C \uD558\uB294 \uC77C\uC774\uB77C \uD654\uBA74\uC5D0\uC11C\uB294 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro db pull"] },
+    mcp: { kind: "built", tools: ["pull_database_schema"] }
+  },
+  {
+    id: "database-reset",
+    domain: "database",
+    title: "\uC804\uCCB4 \uB9AC\uC14B \uD6C4 \uB9C8\uC774\uADF8\uB808\uC774\uC158 \uB2E4\uC2DC \uC801\uC6A9",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "./migrations\uB97C \uCC98\uC74C\uBD80\uD130 \uB2E4\uC2DC \uC801\uC6A9\uD55C\uB2E4 \u2014 \uB0B4 \uCEF4\uD4E8\uD130\uC758 \uD3F4\uB354\uAC00 \uC788\uC5B4\uC57C \uD558\uB294 \uC77C\uC774\uB77C \uD654\uBA74\uC5D0\uC11C\uB294 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro db reset"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uBAA8\uB4E0 \uD14C\uC774\uBE14\uACFC \uC815\uCC45\uC744 \uC9C0\uC6B0\uACE0 \uB2E4\uC2DC \uB9CC\uB4E0\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-lint",
+    domain: "database",
+    title: "\uC2A4\uD0A4\uB9C8\xB7RLS \uC815\uCC45 \uB9B0\uD2B8",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro db lint"] },
+    mcp: { kind: "built", tools: ["lint_database"] }
+  },
+  {
+    id: "database-gen-types",
+    domain: "database",
+    title: "\uC2A4\uD0A4\uB9C8\uC5D0\uC11C TypeScript \uD0C0\uC785 \uC0DD\uC131",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro gen types"] },
+    mcp: { kind: "built", tools: ["generate_typescript_types"] }
+  },
+  {
+    id: "database-migration-new",
+    domain: "database",
+    title: "\uC0C8 \uB9C8\uC774\uADF8\uB808\uC774\uC158 \uD30C\uC77C",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "./migrations\uC5D0 \uD30C\uC77C\uC744 \uB9CC\uB4E0\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro migration new"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: "./migrations\uC5D0 \uD30C\uC77C \uD558\uB098\uB97C \uB9CC\uB4E0\uB2E4. apply_migration\uC740 \uC801\uC6A9\uD558\uBA74\uC11C \uD30C\uC77C\uC744 \uC4F4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "database-migration-repair",
+    domain: "database",
+    title: "\uB9C8\uC774\uADF8\uB808\uC774\uC158 \uC6D0\uC7A5 \uC218\uB9AC",
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/migrations",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro migration repair"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC6D0\uC7A5\uB9CC \uACE0\uCCD0 \uC801\uC6A9 \uAE30\uB85D\uACFC \uC2E4\uC81C \uC2A4\uD0A4\uB9C8\uAC00 \uC5B4\uAE0B\uB0A0 \uC218 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-list",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/database/saved-queries"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-create",
+    domain: "database",
+    title: "\uCFFC\uB9AC \uC800\uC7A5",
+    routes: ["POST projects/[projectId]/database/saved-queries"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-update",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uC218\uC815",
+    routes: [
+      "PATCH projects/[projectId]/database/saved-queries/[savedQueryId]"
+    ],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "database-saved-query-delete",
+    domain: "database",
+    title: "\uC800\uC7A5\uD55C \uCFFC\uB9AC \uC0AD\uC81C",
+    routes: [
+      "DELETE projects/[projectId]/database/saved-queries/[savedQueryId]"
+    ],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/database/sql",
+    ui: { kind: "built" },
+    cli: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. CLI\uB294 \uCFFC\uB9AC\uB97C \uD30C\uC77C\uC5D0 \uB450\uACE0 naro db query --file\uB85C \uB3CC\uB9B0\uB2E4."
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "ui-affordance",
+      note: "SQL \uD3B8\uC9D1\uAE30 \uC548\uC5D0\uC11C\uB9CC \uB73B\uC774 \uC788\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    // 대시보드 정책 화면(백엔드 메뉴 Policies)은 2026-11-04에 생겼다.
+    id: "rls-table-policy-list",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uBCC4 \uC815\uCC45 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy rules"] },
+    mcp: { kind: "built", tools: ["list_policy_rules"] }
+  },
+  {
+    id: "rls-table-policy-set",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uC758 \uC561\uC158\uBCC4 \uADDC\uCE59 \uC124\uC815",
+    routes: ["PUT projects/[projectId]/backend/policies/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy set"] },
+    // 규칙은 CREATE POLICY로, owner 규칙은 COMMENT ON POLICY p ON t IS 'naro:owner <column>'로 apply_migration에 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-table-policy-remove",
+    domain: "rls",
+    title: "\uD14C\uC774\uBE14\uC758 \uC815\uCC45 \uC804\uBD80 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/backend/policies/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy remove"] },
+    // apply_migration에 그 테이블의 DROP POLICY를 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-list",
+    domain: "rls",
+    title: "\uC815\uCC45 \uBAA9\uB85D(CREATE POLICY \uAF34)",
+    routes: ["GET projects/[projectId]/backend/rls/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy list"] },
+    mcp: { kind: "built", tools: ["list_policies"] }
+  },
+  {
+    id: "rls-policy-create",
+    domain: "rls",
+    title: "\uC815\uCC45 \uB9CC\uB4E4\uAE30(CREATE POLICY)",
+    routes: ["POST projects/[projectId]/backend/rls/policies"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy create"] },
+    // apply_migration·execute_sql이 CREATE POLICY를 받는다. 테이블과 같은 마이그레이션에 쓰라고 apply_migration이 안내한다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-replace",
+    domain: "rls",
+    title: "\uC815\uCC45 \uBC14\uAFB8\uAE30",
+    routes: ["PUT projects/[projectId]/backend/rls/policies/[table]/[name]"],
+    ui: { kind: "built" },
+    // naro migration up·db push(client.db.applyMigration)나 naro db query
+    // (client.db.query) 한 번에 DROP POLICY와 CREATE POLICY를 함께 쓴다.
+    // MCP와 같은 경로다(PR #414 리뷰).
+    cli: { kind: "built" },
+    // apply_migration 한 번에 DROP POLICY와 CREATE POLICY를 함께 쓴다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "rls-policy-drop",
+    domain: "rls",
+    title: "\uC815\uCC45 \uC0AD\uC81C(DROP POLICY)",
+    routes: ["DELETE projects/[projectId]/backend/rls/policies/[table]/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro policy drop"] },
+    // apply_migration·execute_sql이 DROP POLICY를 받는다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "storage-info",
+    domain: "storage",
+    title: "Storage \uC0C1\uD0DC",
+    routes: ["GET projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage"] },
+    mcp: { kind: "built", tools: ["get_storage"] }
+  },
+  {
+    id: "storage-enable",
+    domain: "storage",
+    title: "Storage \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage enable"] },
+    mcp: { kind: "built", tools: ["enable_storage"] }
+  },
+  {
+    id: "storage-disable",
+    domain: "storage",
+    title: "Storage \uB044\uAE30",
+    routes: ["DELETE projects/[projectId]/backend/storage"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage disable"] },
+    mcp: { kind: "built", tools: ["disable_storage"] }
+  },
+  {
+    id: "storage-bucket-list",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/storage/buckets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket list"] },
+    mcp: { kind: "built", tools: ["list_storage_buckets"] }
+  },
+  {
+    id: "storage-bucket-create",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/backend/storage/buckets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket create"] },
+    mcp: { kind: "built", tools: ["create_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-get",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    // naro storage bucket update가 바꾸기 전에 읽는다(client.storage.getBucket).
+    cli: { kind: "built" },
+    mcp: { kind: "built", tools: ["get_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-update",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PATCH projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket update"] },
+    mcp: { kind: "built", tools: ["update_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-remove",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/storage/buckets/[bucket]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket remove"] },
+    mcp: { kind: "built", tools: ["delete_storage_bucket"] }
+  },
+  {
+    id: "storage-bucket-empty",
+    domain: "storage",
+    title: "\uBC84\uD0B7 \uBE44\uC6B0\uAE30",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/empty"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage bucket empty"] },
+    mcp: { kind: "built", tools: ["empty_storage_bucket"] }
+  },
+  {
+    id: "storage-object-list",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uBAA9\uB85D",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/list"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage ls"] },
+    mcp: { kind: "built", tools: ["list_storage_objects"] }
+  },
+  {
+    id: "storage-object-remove",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uC0AD\uC81C",
+    routes: [
+      "DELETE projects/[projectId]/backend/storage/buckets/[bucket]/objects"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage rm"] },
+    mcp: { kind: "built", tools: ["delete_storage_objects"] }
+  },
+  {
+    id: "storage-object-sign",
+    domain: "storage",
+    title: "\uB2E4\uC6B4\uB85C\uB4DC \uC11C\uBA85 URL",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/sign"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage sign"] },
+    mcp: { kind: "built", tools: ["create_storage_signed_url"] }
+  },
+  {
+    id: "storage-object-upload",
+    domain: "storage",
+    title: "\uC5C5\uB85C\uB4DC URL \uBC1C\uAE09",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/upload-url"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage cp"] },
+    mcp: { kind: "built", tools: ["create_storage_upload_url"] }
+  },
+  {
+    id: "storage-object-move",
+    domain: "storage",
+    title: "\uAC1D\uCCB4 \uC774\uB3D9",
+    routes: [
+      "POST projects/[projectId]/backend/storage/buckets/[bucket]/objects/move"
+    ],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro storage mv"] },
+    mcp: { kind: "built", tools: ["move_storage_object"] }
+  },
+  {
+    id: "realtime-info",
+    domain: "realtime",
+    title: "Realtime \uC0C1\uD0DC\xB7\uC5F0\uACB0 \uC218",
+    routes: ["GET projects/[projectId]/backend/realtime"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime"] },
+    mcp: { kind: "built", tools: ["get_realtime"] }
+  },
+  {
+    id: "realtime-enable",
+    domain: "realtime",
+    title: "Realtime \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/realtime"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime enable"] },
+    mcp: { kind: "built", tools: ["enable_realtime"] }
+  },
+  {
+    id: "realtime-table-list",
+    domain: "realtime",
+    title: "\uACF5\uAC1C \uD14C\uC774\uBE14 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/realtime/tables"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables"] },
+    // get_realtime이 공개 테이블을 상태와 함께 돌려준다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "realtime-table-add",
+    domain: "realtime",
+    title: "\uD14C\uC774\uBE14 \uBCC0\uACBD \uACF5\uAC1C",
+    routes: ["PUT projects/[projectId]/backend/realtime/tables/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables add"] },
+    mcp: { kind: "built", tools: ["publish_realtime_table"] }
+  },
+  {
+    id: "realtime-table-remove",
+    domain: "realtime",
+    title: "\uD14C\uC774\uBE14 \uBCC0\uACBD \uACF5\uAC1C \uC911\uC9C0",
+    routes: ["DELETE projects/[projectId]/backend/realtime/tables/[table]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro realtime tables remove"] },
+    mcp: { kind: "built", tools: ["unpublish_realtime_table"] }
+  },
+  {
+    // 대시보드 Functions 화면은 2026-11-04에 생겼다. 그 전의 built는 틀렸다.
+    id: "function-list",
+    domain: "functions",
+    title: "\uD568\uC218 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/functions"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions"] },
+    mcp: { kind: "built", tools: ["list_functions"] }
+  },
+  {
+    id: "function-scaffold",
+    domain: "functions",
+    title: "\uD568\uC218 \uBF08\uB300 \uB9CC\uB4E4\uAE30",
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "naro/functions/<name>/index.ts\uB97C \uC4F4\uB2E4. \uC11C\uBC84\uAC00 \uD560 \uC218 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro functions new"] },
+    mcp: {
+      kind: "excluded",
+      reason: "agent-native",
+      note: "naro/functions/<name>/index.ts\uB97C \uC4F4\uB2E4. 2026-11-03 \uACB0\uC815."
+    }
+  },
+  {
+    id: "function-get",
+    domain: "functions",
+    title: "\uD568\uC218 \uC0C1\uC138",
+    routes: ["GET projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions versions"] },
+    mcp: { kind: "built", tools: ["get_function"] }
+  },
+  {
+    id: "function-update",
+    domain: "functions",
+    title: "\uD568\uC218 verify_jwt \uC124\uC815",
+    routes: ["PATCH projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions update"] },
+    mcp: { kind: "built", tools: ["update_function"] }
+  },
+  {
+    id: "function-delete",
+    domain: "functions",
+    title: "\uD568\uC218 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/functions/[name]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions delete"] },
+    mcp: { kind: "built", tools: ["delete_function"] }
+  },
+  {
+    id: "function-version-upload",
+    domain: "functions",
+    title: "\uBC88\uB4E4\uD55C \uCF54\uB4DC\uB97C \uC0C8 \uBC84\uC804\uC73C\uB85C \uC62C\uB9AC\uAE30",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/versions"],
+    ui: {
+      kind: "excluded",
+      reason: "local-filesystem",
+      note: "\uB85C\uCEEC\uC5D0\uC11C \uBC88\uB4E4\uD558\uACE0 workerd\uB85C \uBD80\uD305 \uD655\uC778\uD55C \uCF54\uB4DC\uB97C \uC62C\uB9B0\uB2E4. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uB294 \uBC88\uB4E4\uD560 \uC18C\uC2A4\uAC00 \uC5C6\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro functions deploy"] },
+    mcp: { kind: "built", tools: ["deploy_function"] }
+  },
+  {
+    id: "function-version-deploy",
+    domain: "functions",
+    title: "\uC800\uC7A5\uB41C \uBC84\uC804 \uBC30\uD3EC",
+    routes: [
+      "POST projects/[projectId]/backend/functions/[name]/versions/[versionId]/deploy"
+    ],
+    ui: { kind: "built" },
+    // naro functions deploy가 올린 버전을 배포한다(client.functions.deploy).
+    cli: { kind: "built" },
+    // deploy_function이 naro-cli의 deployFunctions로 올린 버전을 배포한다.
+    mcp: { kind: "built" }
+  },
+  {
+    id: "function-rollback",
+    domain: "functions",
+    title: "\uC774\uC804 \uBC84\uC804\uC73C\uB85C \uB864\uBC31",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/rollback"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions rollback"] },
+    mcp: { kind: "built", tools: ["rollback_function"] }
+  },
+  {
+    id: "function-logs",
+    domain: "functions",
+    title: "\uD568\uC218 \uB85C\uADF8",
+    routes: ["GET projects/[projectId]/backend/functions/[name]/logs"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions logs"] },
+    mcp: { kind: "built", tools: ["get_function_logs"] }
+  },
+  {
+    id: "function-invoke",
+    domain: "functions",
+    title: "\uD568\uC218 \uD638\uCD9C",
+    routes: ["POST projects/[projectId]/backend/functions/[name]/invoke"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions invoke"] },
+    mcp: { kind: "built", tools: ["invoke_function"] }
+  },
+  {
+    id: "function-secret-list",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/functions-secrets"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets"] },
+    mcp: { kind: "built", tools: ["list_function_secrets"] }
+  },
+  {
+    id: "function-secret-set",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uC124\uC815",
+    routes: ["PUT projects/[projectId]/backend/functions-secrets"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/functions/secrets",
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro functions secrets set", "naro functions secrets import"]
+    },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "apps/mcp/src/function-tools.ts\uC758 NO_SECRET_VALUES \u2014 \uAC12\uC774 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. \uC0AC\uC6A9\uC790\uAC00 naro functions secrets set\uC744 \uB3CC\uB9AC\uAC8C \uD55C\uB2E4."
+    }
+  },
+  // 라우트는 function-secret-set과 같은 PUT functions-secrets다. 한 라우트는
+  // 한 기능에만 걸리므로 여기에는 적지 않는다.
+  {
+    id: "function-secret-unset",
+    domain: "functions",
+    title: "\uD568\uC218 \uC2DC\uD06C\uB9BF \uD574\uC81C",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets unset"] },
+    mcp: { kind: "built", tools: ["unset_function_secret"] }
+  },
+  {
+    id: "function-sync",
+    domain: "functions",
+    title: "\uD568\uC218 \uC7AC\uB3D9\uAE30\uD654",
+    routes: ["POST projects/[projectId]/backend/functions-sync"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro functions secrets sync"] },
+    mcp: { kind: "built", tools: ["sync_functions"] }
+  },
+  {
+    id: "backend-info",
+    domain: "backend",
+    title: "Backend \uC0C1\uD0DC\xB7URL\xB7anon \uD0A4",
+    routes: ["GET projects/[projectId]/backend"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend"] },
+    mcp: { kind: "built", tools: ["get_backend"] }
+  },
+  {
+    id: "backend-enable",
+    domain: "backend",
+    title: "Backend \uCF1C\uAE30",
+    routes: ["POST projects/[projectId]/backend/enable"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend enable"] },
+    mcp: { kind: "built", tools: ["enable_backend"] }
+  },
+  {
+    id: "backend-provision",
+    domain: "backend",
+    title: "Backend \uD504\uB85C\uBE44\uC800\uB2DD \uC774\uC5B4\uAC00\uAE30",
+    routes: ["POST projects/[projectId]/backend/provision"],
+    ui: { kind: "built" },
+    // naro backend enable이 멈춘 프로비저닝을 이어 간다.
+    cli: { kind: "built" },
+    // enable_backend가 같은 호출이다(client.backend.enable — 라우트 provision은 그 옛 이름).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "backend-disable",
+    domain: "backend",
+    title: "Backend \uB044\uAE30",
+    routes: ["POST projects/[projectId]/backend/disable"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend disable"] },
+    mcp: { kind: "built", tools: ["disable_backend"] }
+  },
+  {
+    id: "backend-keys",
+    domain: "backend",
+    title: "API \uD0A4 \uC870\uD68C(service \uD0A4 \uD3EC\uD568)",
+    routes: ["GET projects/[projectId]/backend/keys"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend keys"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "service \uD0A4\uAC00 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-keys-rotate",
+    domain: "backend",
+    title: "API \uD0A4 \uAD50\uCCB4",
+    routes: ["POST projects/[projectId]/backend/keys/rotate"],
+    // 2026-11-04 전에는 화면이 없었는데 built로 적혀 있었다.
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend keys rotate"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC61B \uD0A4\uAC00 \uBC14\uB85C \uC8FD\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-signing-key-rotate",
+    domain: "backend",
+    title: "\uC11C\uBA85 \uD0A4 \uAD50\uCCB4",
+    routes: ["POST projects/[projectId]/backend/signing-key/rotate"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/settings",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend signing-key rotate"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uBC1C\uAE09\uD55C \uD1A0\uD070\uC774 15\uBD84 \uC548\uC5D0 \uBAA8\uB450 \uC8FD\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-auth-get",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uC124\uC815 \uC870\uD68C",
+    routes: ["GET projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro backend auth", "naro backend auth redirects"]
+    },
+    mcp: { kind: "built", tools: ["get_backend_auth"] }
+  },
+  {
+    id: "backend-auth-update",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uC124\uC815 \uBCC0\uACBD",
+    routes: ["PUT projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro backend auth signups",
+        "naro backend auth password",
+        "naro backend auth email set",
+        "naro backend auth oauth set",
+        "naro backend auth redirects add",
+        "naro backend auth redirects remove",
+        "naro backend auth require-verification"
+      ]
+    },
+    // 리다이렉트 제거·가입·확인 메일·비밀번호 길이만. 메일 API 키와
+    // OAuth client secret은 대화에 남고(secret-value), 리다이렉트 추가는 재설정 토큰이
+    // 그 origin으로 가므로(PR #434 리뷰) 대시보드와 CLI만 한다.
+    mcp: { kind: "built", tools: ["update_backend_auth"] }
+  },
+  {
+    id: "backend-auth-remove",
+    domain: "backend",
+    title: "\uB85C\uADF8\uC778 \uACF5\uAE09\uC790\xB7\uBA54\uC77C \uC124\uC815 \uC81C\uAC70",
+    routes: ["DELETE projects/[projectId]/backend/auth"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: [
+        "naro backend auth email remove",
+        "naro backend auth oauth remove"
+      ]
+    },
+    mcp: { kind: "built", tools: ["remove_backend_auth"] }
+  },
+  {
+    id: "backend-user-list",
+    domain: "backend",
+    title: "\uC720\uC800 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/backend/users"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users"] },
+    mcp: { kind: "built", tools: ["list_backend_users"] }
+  },
+  {
+    id: "backend-user-create",
+    domain: "backend",
+    title: "\uC720\uC800 \uB9CC\uB4E4\uAE30",
+    routes: ["POST projects/[projectId]/backend/users"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/auth",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users create"] },
+    mcp: {
+      kind: "excluded",
+      reason: "secret-value",
+      note: "\uBE44\uBC00\uBC88\uD638\uAC00 \uB300\uD654\uC5D0 \uB0A8\uB294\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "backend-user-delete",
+    domain: "backend",
+    title: "\uC720\uC800 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/backend/users/[userId]"],
+    dashboard: "/[teamSlug]/projects/[projectSlug]/auth",
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro backend users delete"] },
+    mcp: {
+      kind: "excluded",
+      reason: "irreversible",
+      note: "\uC720\uC800\uC640 \uC138\uC158\uC774 \uC0AC\uB77C\uC9C4\uB2E4. 2026-11-03 \uACB0\uC815(\uAD8C\uACE0\uB300\uB85C)."
+    }
+  },
+  {
+    id: "logs-runtime",
+    domain: "logs",
+    title: "\uB7F0\uD0C0\uC784 \uB85C\uADF8",
+    routes: ["GET projects/[projectId]/logs"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro logs"] },
+    mcp: { kind: "built", tools: ["get_runtime_logs"] }
+  },
+  {
+    id: "analytics",
+    domain: "measurement",
+    title: "Web Analytics",
+    routes: ["GET projects/[projectId]/analytics"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro analytics"] },
+    mcp: { kind: "built", tools: ["get_analytics"] }
+  },
+  {
+    id: "insights",
+    domain: "measurement",
+    title: "Speed Insights",
+    routes: ["GET projects/[projectId]/speed-insights"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro insights"] },
+    mcp: { kind: "built", tools: ["get_speed_insights"] }
+  },
+  {
+    id: "insights-toggle",
+    domain: "measurement",
+    title: "Speed Insights \uCE21\uC815 \uCF1C\uAE30\xB7\uB044\uAE30",
+    routes: ["PUT projects/[projectId]/speed-insights"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro insights enable", "naro insights disable"]
+    },
+    mcp: { kind: "built", tools: ["set_speed_insights"] }
+  },
+  {
+    id: "insights-deployments",
+    domain: "measurement",
+    title: "Speed Insights \uBC30\uD3EC\uBCC4 \uBE44\uAD50",
+    routes: ["GET projects/[projectId]/speed-insights/deployments"],
+    ui: { kind: "built" },
+    // naro insights가 배포별 표를 같이 읽는다(client.insights.overview).
+    cli: { kind: "built" },
+    // get_speed_insights가 route 없이 배포별 표를 같이 돌려준다(client.insights.overview).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "insights-paths",
+    domain: "measurement",
+    title: "Speed Insights \uB77C\uC6B0\uD2B8\uBCC4 \uACBD\uB85C",
+    routes: ["GET projects/[projectId]/speed-insights/paths"],
+    ui: { kind: "built" },
+    // naro insights --route가 읽는다(client.insights.paths).
+    cli: { kind: "built" },
+    // get_speed_insights에 route를 주면 경로를 돌려준다(client.insights.paths).
+    mcp: { kind: "built" }
+  },
+  {
+    id: "observability",
+    domain: "measurement",
+    title: "Observability",
+    routes: ["GET projects/[projectId]/observability"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro observability"] },
+    mcp: { kind: "built", tools: ["get_observability"] }
+  },
+  {
+    id: "firewall-list",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/firewall"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall"] },
+    mcp: { kind: "built", tools: ["list_firewall_rules"] }
+  },
+  {
+    id: "firewall-add",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/firewall"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall add"] },
+    mcp: { kind: "built", tools: ["add_firewall_rule"] }
+  },
+  {
+    id: "firewall-update",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uC218\uC815",
+    routes: ["PATCH projects/[projectId]/firewall/[ruleId]"],
+    ui: { kind: "built" },
+    cli: {
+      kind: "built",
+      commands: ["naro firewall enable", "naro firewall disable"]
+    },
+    mcp: { kind: "built", tools: ["set_firewall_rule_enabled"] }
+  },
+  {
+    id: "firewall-remove",
+    domain: "firewall",
+    title: "\uBC29\uD654\uBCBD \uADDC\uCE59 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/firewall/[ruleId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro firewall remove"] },
+    mcp: { kind: "built", tools: ["remove_firewall_rule"] }
+  },
+  {
+    id: "flag-list",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uBAA9\uB85D",
+    routes: ["GET projects/[projectId]/flags"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags"] },
+    mcp: { kind: "built", tools: ["list_flags"] }
+  },
+  {
+    id: "flag-add",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uCD94\uAC00",
+    routes: ["POST projects/[projectId]/flags"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags add"] },
+    mcp: { kind: "built", tools: ["add_flag"] }
+  },
+  {
+    id: "flag-update",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uC218\uC815",
+    routes: ["PATCH projects/[projectId]/flags/[flagId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags on", "naro flags off"] },
+    mcp: { kind: "built", tools: ["set_flag"] }
+  },
+  {
+    id: "flag-remove",
+    domain: "flags",
+    title: "\uAE30\uB2A5 \uD50C\uB798\uADF8 \uC0AD\uC81C",
+    routes: ["DELETE projects/[projectId]/flags/[flagId]"],
+    ui: { kind: "built" },
+    cli: { kind: "built", commands: ["naro flags remove"] },
+    mcp: { kind: "built", tools: ["remove_flag"] }
+  },
+  {
+    id: "dashboard-link",
+    domain: "guidance",
+    title: "CLI\xB7MCP\uB85C \uBABB \uD558\uB294 \uAE30\uB2A5\uC758 \uB300\uC2DC\uBCF4\uB4DC \uB9C1\uD06C",
+    ui: {
+      kind: "excluded",
+      reason: "dashboard-itself",
+      note: "\uC0AC\uC6A9\uC790\uAC00 \uC774\uBBF8 \uB300\uC2DC\uBCF4\uB4DC\uC5D0 \uC788\uB2E4."
+    },
+    cli: { kind: "built", commands: ["naro dashboard"] },
+    mcp: { kind: "built", tools: ["dashboard_link"] }
+  }
+];
+function dashboardNeeds(path) {
+  return {
+    team: path.includes("[teamSlug]"),
+    project: path.includes("[projectSlug]")
+  };
+}
+function dashboardUrl(baseUrl, path, slugs) {
+  const filled2 = path.replace("[teamSlug]", () => {
+    if (!slugs.teamSlug) throw new Error(`${path} needs a team slug`);
+    return encodeURIComponent(slugs.teamSlug);
+  }).replace("[projectSlug]", () => {
+    if (!slugs.projectSlug) throw new Error(`${path} needs a project slug`);
+    return encodeURIComponent(slugs.projectSlug);
+  });
+  return `${baseUrl.replace(/\/+$/, "")}${filled2}`;
+}
+
 // ../../packages/core/src/deployment.ts
 var PHASES = [
   "QUEUED",
@@ -641,12 +2531,8 @@ var DEPLOYMENT_ERROR_CODES = [
   "ENVIRONMENT_DELETED",
   /** The edge refused the environment's protection change; the database change is rolled back. */
   "ENVIRONMENT_PROTECTION_PUBLISH_FAILED",
-  /** The variable came from the Supabase connection; only its card changes it (spec 2026-11-04 §6.3). */
-  "ENV_MANAGED",
-  /** The 10-minute Supabase sign-in cookie is gone or expired (spec 2026-11-04 §6.4). */
-  "SUPABASE_SESSION_EXPIRED",
-  /** The Supabase Management API refused or did not answer (spec 2026-11-04 §6.4). */
-  "SUPABASE_API_FAILED"
+  /** The variable is owned by the Resend connection; only it changes it (spec 2026-11-04 resend §6.4). */
+  "ENV_MANAGED"
 ];
 var DeploymentError = class extends Error {
   code;
@@ -16369,10 +18255,13 @@ export default {
   },
 };
 `;
-var OUTPUT_DIR = "dist";
+var VINEXT_OUTPUT_DIR = "dist";
 var SERVER_DIR = "server";
 var CLIENT_DIR = "client";
 var WRANGLER_OUTPUT_NAME = "wrangler.json";
+function vinextWranglerConfigPath(appRoot) {
+  return join6(appRoot, VINEXT_OUTPUT_DIR, SERVER_DIR, WRANGLER_OUTPUT_NAME);
+}
 async function exists3(path) {
   try {
     await access5(path);
@@ -16428,7 +18317,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
         compatibility_flags: ["nodejs_compat"],
         main: `./${GENERATED_WORKER_ENTRY}`,
         assets: {
-          directory: `${OUTPUT_DIR}/${CLIENT_DIR}`,
+          directory: `${VINEXT_OUTPUT_DIR}/${CLIENT_DIR}`,
           binding: "ASSETS"
         }
       },
@@ -16527,14 +18416,14 @@ function moduleMatchers(rules) {
 }
 async function readVinextArtifact(appRoot, identity) {
   try {
-    const outputRoot = resolve2(appRoot, OUTPUT_DIR);
+    const outputRoot = resolve2(appRoot, VINEXT_OUTPUT_DIR);
     const serverRoot = join6(outputRoot, SERVER_DIR);
     const clientRoot = join6(outputRoot, CLIENT_DIR);
     const configPath = join6(serverRoot, WRANGLER_OUTPUT_NAME);
     if (!await exists3(configPath)) {
       throw new DeploymentError(
         "ARTIFACT_INVALID",
-        `vinext build produced no ${OUTPUT_DIR}/${SERVER_DIR}/${WRANGLER_OUTPUT_NAME}.`
+        `vinext build produced no ${VINEXT_OUTPUT_DIR}/${SERVER_DIR}/${WRANGLER_OUTPUT_NAME}.`
       );
     }
     const metadata = JSON.parse(
@@ -18606,13 +20495,8 @@ function createAwsMiddlewareCloudflareAppStrategy() {
 }
 
 // ../../packages/build/src/strategy/strategies/vinext-cloudflare.ts
-import { join as join16 } from "path";
 var VINEXT_MIN_NEXT_MAJOR = 16;
 var VINEXT_BUILD_SCRIPTS = ["esbuild", "workerd"];
-var VINEXT_OUTPUT = {
-  outputRoot: "dist",
-  bundleDir: "dist/.naro-bundle"
-};
 async function runCheck(context, observer) {
   if (!context.toolchain.vinext) return null;
   const held = [];
@@ -18762,13 +20646,8 @@ function createVinextCloudflareStrategy(options) {
         context,
         {
           appRoot: fork.appRoot,
-          wranglerConfigPath: join16(
-            fork.appRoot,
-            "dist",
-            "server",
-            "wrangler.json"
-          ),
-          ...VINEXT_OUTPUT
+          wranglerConfigPath: vinextWranglerConfigPath(fork.appRoot),
+          outputRoot: VINEXT_OUTPUT_DIR
         },
         observer
       );
@@ -18787,7 +20666,7 @@ function createVinextCloudflareStrategy(options) {
 // ../../packages/build/src/strategy/workspace.ts
 import { execFile } from "child_process";
 import { cp, mkdir as mkdir2, readdir as readdir4, rm as rm2 } from "fs/promises";
-import { basename as basename2, dirname as dirname3, join as join17, relative as relative5, resolve as resolve6 } from "path";
+import { basename as basename2, dirname as dirname3, join as join16, relative as relative5, resolve as resolve6 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
@@ -18810,14 +20689,14 @@ async function copyInstalledPackages(source, target2) {
   const walk2 = async (dir) => {
     for (const entry of await readdir4(dir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name === ".git") continue;
-      const path = join17(dir, entry.name);
+      const path = join16(dir, entry.name);
       if (entry.name === "node_modules") installs.push(path);
       else await walk2(path);
     }
   };
   await walk2(origin);
   for (const install of installs)
-    await copyTree(install, join17(target2, relative5(origin, install)));
+    await copyTree(install, join16(target2, relative5(origin, install)));
 }
 async function copyTree(from, to) {
   await mkdir2(dirname3(to), { recursive: true });
@@ -18832,7 +20711,7 @@ async function copyTree(from, to) {
   await cp(from, to, { recursive: true, verbatimSymlinks: true });
 }
 function forkedAppRoot(checkout, appRoot, forkCheckout) {
-  return join17(forkCheckout, relative5(checkout, appRoot));
+  return join16(forkCheckout, relative5(checkout, appRoot));
 }
 
 // ../../packages/build/src/local-build-executor.ts
@@ -18855,7 +20734,7 @@ async function withRouteList(artifact, list, appRoot, observer) {
   }
 }
 var defaultLocalBuildDependencies = {
-  createWorkspace: () => mkdtemp(join18(tmpdir(), "next-deploy-build-")),
+  createWorkspace: () => mkdtemp(join17(tmpdir(), "next-deploy-build-")),
   removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
@@ -18890,7 +20769,7 @@ async function readInstalledNextVersion(appRoot, checkout) {
   for (; ; ) {
     try {
       const source = await readFile13(
-        join18(dir, "node_modules", "next", "package.json"),
+        join17(dir, "node_modules", "next", "package.json"),
         "utf8"
       );
       const version3 = JSON.parse(source).version;
@@ -19045,8 +20924,8 @@ var LocalBuildExecutor = class {
   }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
-    const checkout = join18(workspace, "checkout");
-    const pmCacheDir = join18(workspace, ".pm-store");
+    const checkout = join17(workspace, "checkout");
+    const pmCacheDir = join17(workspace, ".pm-store");
     let cacheSeq = 0;
     const commandAvailable = this.dependencies.commandAvailable ?? hasCommand;
     const compressor = "zstd";
@@ -19055,7 +20934,7 @@ var LocalBuildExecutor = class {
       transport: cache,
       fetch: this.dependencies.cacheFetch ?? ((url2, init) => fetch(url2, init)),
       runCommand: this.dependencies.runCommand,
-      tmpFile: (suffix) => join18(workspace, `cache-${String(cacheSeq++)}${suffix}`),
+      tmpFile: (suffix) => join17(workspace, `cache-${String(cacheSeq++)}${suffix}`),
       // One latch for the whole build so a disabled cache warns once.
       report: { unavailable: false }
     } : null;
@@ -19263,7 +21142,7 @@ var LocalBuildExecutor = class {
           }
         }
         await notifyStatus(observer, "BUILDING");
-        const buildCacheDir = resolved.preset.cachePath ? join18(appRoot, resolved.preset.cachePath) : null;
+        const buildCacheDir = resolved.preset.cachePath ? join17(appRoot, resolved.preset.cachePath) : null;
         const buildCacheKey = sanitizeCacheKey(input.branch);
         if (cachePorts && buildCacheDir) {
           await tryRestore(
@@ -19287,13 +21166,13 @@ var LocalBuildExecutor = class {
             entries: fingerprintEntries,
             nextVersion: nextVersion ? `${String(nextVersion.major)}.${String(nextVersion.minor)}.${String(nextVersion.patch)}` : "unknown"
           });
-          const pristine = join18(workspace, "pristine");
+          const pristine = join17(workspace, "pristine");
           const fork = this.dependencies.forkWorkspace ?? defaultFork;
           await fork(checkout, pristine);
           let forks = 0;
           const resolverConcurrency = this.dependencies.resolverConcurrency ?? 1;
           const forkWorkspace = async (label2) => {
-            const target2 = join18(
+            const target2 = join17(
               workspace,
               "forks",
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
@@ -19589,12 +21468,12 @@ async function errorFromResponse(response, context) {
 // ../../packages/sdk/src/session.ts
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join19 } from "path";
+import { join as join18 } from "path";
 function credentialsDir(home = homedir()) {
-  return join19(home, ".naro");
+  return join18(home, ".naro");
 }
 function credentialsFile(home = homedir()) {
-  return join19(credentialsDir(home), "credentials.json");
+  return join18(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
   mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
@@ -20198,44 +22077,6 @@ var FlagsApi = class {
     );
   }
 };
-var BindingsApi = class {
-  constructor(client) {
-    this.client = client;
-  }
-  async list(projectId) {
-    const body = await this.client.request(
-      project(projectId, "/storage"),
-      { context: "List storage bindings" }
-    );
-    return body.storage;
-  }
-  /**
-   * Makes the Cloudflare resource and binds it at the next deploy.
-   * `VALIDATION_FAILED` for a bad type or binding name (ASSETS and DB are
-   * reserved), `STORAGE_PROVISION_FAILED` (502) when Cloudflare refused.
-   */
-  async add(projectId, type, bindingName) {
-    const answer = await this.client.request(
-      project(projectId, "/storage"),
-      {
-        method: "POST",
-        body: { type, bindingName },
-        context: "Add storage binding"
-      }
-    );
-    return answer.storage;
-  }
-  /**
-   * Deletes the Cloudflare resource and what it holds — it cannot be undone.
-   * `STORAGE_MANAGED` refuses the Naro database.
-   */
-  async remove(projectId, bindingId) {
-    await this.client.request(
-      project(projectId, `/storage/${encodeURIComponent(bindingId)}`),
-      { method: "DELETE", context: "Remove storage binding" }
-    );
-  }
-};
 
 // ../../packages/sdk/src/ops.ts
 var BillingApi = class {
@@ -20269,32 +22110,6 @@ var ObservabilityApi = class {
   }
 };
 
-// ../../packages/sdk/src/supabase-links.ts
-var SupabaseApi = class {
-  constructor(client) {
-    this.client = client;
-  }
-  async links(projectId) {
-    const body = await this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/supabase`,
-      { context: "Read Supabase links" }
-    );
-    return body.links;
-  }
-  /**
-   * Removes the link of one target (production, preview or an environment's
-   * slug), or every link the role may write when `target` is left out, with
-   * the env rows they hold. Answers how many went.
-   */
-  async disconnect(projectId, options = {}) {
-    const query = options.target === void 0 ? "" : `?target=${encodeURIComponent(options.target)}`;
-    return this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/supabase${query}`,
-      { method: "DELETE", context: "Disconnect Supabase" }
-    );
-  }
-};
-
 // ../../packages/sdk/src/environments.ts
 function isReservedEnvTarget(value) {
   return RESERVED_ENVIRONMENT_SLUGS.includes(value);
@@ -20432,10 +22247,8 @@ var NaroClient = class _NaroClient {
   dns;
   firewall;
   flags;
-  bindings;
   billing;
   observability;
-  supabase;
   logs;
   db;
   backend;
@@ -20462,10 +22275,8 @@ var NaroClient = class _NaroClient {
     this.dns = new DnsApi(this);
     this.firewall = new FirewallApi(this);
     this.flags = new FlagsApi(this);
-    this.bindings = new BindingsApi(this);
     this.billing = new BillingApi(this);
     this.observability = new ObservabilityApi(this);
-    this.supabase = new SupabaseApi(this);
     this.logs = new LogsApi(this);
     this.db = new DbApi(this);
     this.backend = new BackendApi(this);
@@ -20987,9 +22798,10 @@ var EnvApi = class {
   /**
    * The names the env route refuses as a key — `409 VALIDATION_FAILED`
    * `<KEY> is already used by a storage binding.` — read the way it reads
-   * them: `ASSETS` (the static files), every binding of the project's storage
-   * and, on a project using the managed database (`database_provider` is
-   * `d1`), `DB`, which may not be a storage row yet. For a caller that sends
+   * them: `ASSETS` (the static files) and, on a project using the managed
+   * database (`database_provider` is `d1`), `DB`. The bindings a user
+   * declared (R2·KV·D1) are gone since 2026-11-04, and so is the route that
+   * listed them. For a caller that sends
    * many entries in several requests (`naro env import`) and has to refuse
    * before the first one is saved. A control plane whose project row has no
    * `database_provider` reads as having no managed database, so `DB` is only
@@ -20997,20 +22809,8 @@ var EnvApi = class {
    */
   async takenBindingNames(projectId) {
     const base2 = `/api/projects/${encodeURIComponent(projectId)}`;
-    const [storage, project2] = await Promise.all([
-      this.client.request(
-        `${base2}/storage`,
-        { context: "List storage" }
-      ),
-      this.client.request(
-        base2,
-        { context: "Read project" }
-      )
-    ]);
-    const names = /* @__PURE__ */ new Set([
-      STATIC_ASSETS_BINDING,
-      ...storage.storage.map((row) => row.bindingName)
-    ]);
+    const project2 = await this.client.request(base2, { context: "Read project" });
+    const names = /* @__PURE__ */ new Set([STATIC_ASSETS_BINDING]);
     if (project2.project.database_provider === "d1")
       names.add(MANAGED_DATABASE_BINDING);
     return [...names];
@@ -22686,6 +24486,54 @@ var FunctionsApi = class {
   }
 };
 
+// ../../packages/sdk/src/dashboard.ts
+function dashboardCapability(id) {
+  const found = CAPABILITIES.find((capability) => capability.id === id);
+  if (!found || typeof found.dashboard !== "string")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `No dashboard page for "${id}". Run without a capability to list the ones that have one.`
+    );
+  return found;
+}
+async function dashboardLink(client, capability, target2, options) {
+  const needs = dashboardNeeds(capability.dashboard);
+  let teamSlug = target2.teamSlug;
+  let projectSlug;
+  if (needs.project) {
+    if (!target2.projectId)
+      throw new NaroError(
+        "PROJECT_NOT_LINKED",
+        "This page belongs to a project: pass its id, or link the directory first."
+      );
+    const [project2, teams] = await Promise.all([
+      client.projects.get(target2.projectId),
+      client.teams.list()
+    ]);
+    const team = teams.find((candidate) => candidate.id === project2.teamId);
+    if (!team)
+      throw new NaroError(
+        "NOT_FOUND",
+        `The team of project ${project2.slug} is not one of yours.`
+      );
+    teamSlug = team.slug;
+    projectSlug = project2.slug;
+  } else if (needs.team && !teamSlug) {
+    throw new NaroError("TEAM_REQUIRED", "This page belongs to a team.");
+  }
+  const support = capability[options.client];
+  return {
+    capability: capability.id,
+    title: capability.title,
+    url: dashboardUrl(options.baseUrl, capability.dashboard, {
+      teamSlug,
+      projectSlug
+    }),
+    reason: support.kind === "excluded" ? { code: support.reason, why: REASON_CODES[support.reason].why } : null,
+    cli: capability.cli.kind === "built" ? capability.cli.commands ?? [] : []
+  };
+}
+
 // ../../packages/sdk/src/database.ts
 var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
 var BOOKMARK_FORMAT_MESSAGE = "bookmark must look like 00000001-00000008-000050ed-272153b8520cfb93b49834d93a1a1ab3 (four hyphen-separated hex groups, 59 characters).";
@@ -22736,14 +24584,14 @@ function summarizeStatement(statement2) {
 
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join as join20 } from "path";
+import { join as join19 } from "path";
 var QUOTES2 = /* @__PURE__ */ new Set(["'", '"', "`"]);
 function parseDotenv(text3) {
   return parseDotenvDetailed(text3).vars;
 }
 function readProjectEnv(dir) {
   for (const name of [".env.local", ".env.production", ".env"]) {
-    const path = join20(dir, name);
+    const path = join19(dir, name);
     if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
   }
   return {};
@@ -22797,7 +24645,7 @@ function serializeDotenv(vars) {
 
 // ../../packages/sdk/src/env-scan.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
-import { join as join21 } from "path";
+import { join as join20 } from "path";
 var SOURCE_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -22852,7 +24700,7 @@ function collect(dir, out) {
   for (const entry of entries) {
     if (out.length >= MAX_FILES) return;
     if (entry.isSymbolicLink()) continue;
-    const path = join21(dir, entry.name);
+    const path = join20(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRECTORIES.has(entry.name))
         continue;
@@ -22884,7 +24732,7 @@ function scanEnvReferences(dir) {
     }
   }
   for (const name of EXAMPLE_FILES) {
-    const path = join21(dir, name);
+    const path = join20(dir, name);
     if (!existsSync2(path)) continue;
     let parsed;
     try {
@@ -22902,11 +24750,11 @@ function scanEnvReferences(dir) {
 
 // ../../packages/sdk/src/framework.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 function readPackageJson2(dir) {
   try {
     return JSON.parse(
-      readFileSync4(join22(dir, "package.json"), "utf8")
+      readFileSync4(join21(dir, "package.json"), "utf8")
     );
   } catch {
     return null;
@@ -22917,7 +24765,7 @@ function hasDependency(pkg, name) {
 }
 function hasConfig(dir, base2, evidence) {
   for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
-    if (existsSync3(join22(dir, `${base2}.${ext}`))) {
+    if (existsSync3(join21(dir, `${base2}.${ext}`))) {
       evidence.push(`${base2}.${ext}`);
       return true;
     }
@@ -23025,8 +24873,8 @@ function detectFramework2(dir) {
     if (!byDependency && !byConfig) continue;
     if (byDependency) evidence.push(`package.json: ${detector.dependency}`);
     if (detector.framework === "nextjs") {
-      if (existsSync3(join22(dir, "app"))) evidence.push("app/");
-      if (existsSync3(join22(dir, "pages"))) evidence.push("pages/");
+      if (existsSync3(join21(dir, "app"))) evidence.push("app/");
+      if (existsSync3(join21(dir, "pages"))) evidence.push("pages/");
     }
     return {
       framework: detector.framework,
@@ -23037,7 +24885,7 @@ function detectFramework2(dir) {
       deployable: true
     };
   }
-  if (!pkg && existsSync3(join22(dir, "index.html"))) {
+  if (!pkg && existsSync3(join21(dir, "index.html"))) {
     evidence.push("index.html (no package.json)");
     return {
       framework: "static",
@@ -31847,12 +33695,12 @@ import {
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 function linkDir(dir) {
-  return join23(dir, ".naro");
+  return join22(dir, ".naro");
 }
 function linkFile(dir) {
-  return join23(linkDir(dir), "project.json");
+  return join22(linkDir(dir), "project.json");
 }
 function readProjectLink(dir) {
   try {
@@ -31874,7 +33722,7 @@ function writeProjectLink(dir, link) {
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
   writeFileSync2(
-    join23(linkDir(dir), "README.txt"),
+    join22(linkDir(dir), "README.txt"),
     "This directory links the project to Naro and should not be committed.\n"
   );
 }
@@ -31884,9 +33732,9 @@ function removeProjectLink(dir) {
   return true;
 }
 function ensureGitignoreHasNaro(dir) {
-  const gitignorePath = join23(dir, ".gitignore");
+  const gitignorePath = join22(dir, ".gitignore");
   const hasGitignore = existsSync4(gitignorePath);
-  if (!hasGitignore && !existsSync4(join23(dir, ".git"))) return false;
+  if (!hasGitignore && !existsSync4(join22(dir, ".git"))) return false;
   const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
   const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
   if (covered) return false;
@@ -32671,7 +34519,7 @@ function usageStatus(report, currentMonth, requests) {
 
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join24 } from "path";
+import { join as join23 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
 var PUBLIC_PREFIX = "NEXT_PUBLIC_";
 function maskSecretValue(value) {
@@ -32683,7 +34531,7 @@ function maskEnvValue(key, value) {
   return maskSecretValue(value);
 }
 function findDotenvFile(dir) {
-  for (const name of DOTENV_FILES) if (existsSync6(join24(dir, name))) return name;
+  for (const name of DOTENV_FILES) if (existsSync6(join23(dir, name))) return name;
   return null;
 }
 function envAddGuidance(keys, environment) {
@@ -32947,13 +34795,13 @@ async function uploadArtifact(artifact, opts) {
 
 // src/version.ts
 import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname5, join as join25 } from "path";
+import { dirname as dirname5, join as join24 } from "path";
 import { fileURLToPath } from "url";
 function version2() {
   try {
     const pkg = JSON.parse(
       readFileSync6(
-        join25(dirname5(fileURLToPath(import.meta.url)), "..", "package.json"),
+        join24(dirname5(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );
@@ -32982,7 +34830,7 @@ import {
   basename as basename3,
   dirname as dirname6,
   isAbsolute as isAbsolute4,
-  join as join26,
+  join as join25,
   relative as relative6,
   resolve as resolve10,
   sep as sep5
@@ -33109,12 +34957,12 @@ async function copyWorkingTree(source, checkout) {
     keptLinks,
     async ({ path, text: text3 }) => {
       try {
-        return inside(await realpath3(join26(checkout, path)), root);
+        return inside(await realpath3(join25(checkout, path)), root);
       } catch (error51) {
         return error51.code === "ENOENT" && climbsOnlyFirst(text3);
       }
     },
-    ({ path }) => unlink(join26(checkout, path))
+    ({ path }) => unlink(join25(checkout, path))
   );
   linksElsewhere.push(...strays.map(({ path }) => path));
   const committed = await committedEnvFiles(sourceDir);
@@ -33128,7 +34976,7 @@ async function copyWorkingTree(source, checkout) {
       outsideProject.push(path);
       continue;
     }
-    const target2 = join26(checkout, path);
+    const target2 = join25(checkout, path);
     if (!inside(await realAncestor(dirname6(target2)), root)) {
       outsideProject.push(path);
       continue;
@@ -33153,16 +35001,16 @@ async function copyWorkingTree(source, checkout) {
       continue;
     }
     await writeFile7(target2, content, { flag: "wx" });
-    const local = await readLocal(join26(sourceDir, path));
+    const local = await readLocal(join25(sourceDir, path));
     if (!local || !sameText(local, content)) committedVersion.push(path);
   }
   const envStrays = await keptOnly(
     envLinks,
     async (path) => {
-      const real = await realpath3(join26(checkout, path)).catch(() => null);
+      const real = await realpath3(join25(checkout, path)).catch(() => null);
       return real !== null && inside(real, root);
     },
-    (path) => unlink(join26(checkout, path))
+    (path) => unlink(join25(checkout, path))
   );
   outsideProject.push(...envStrays);
   const inCommit = new Set(
@@ -33215,7 +35063,7 @@ function forEnvironment(text3, environment) {
 
 // src/commands/migration.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
-import { join as join27, relative as relative7 } from "path";
+import { join as join26, relative as relative7 } from "path";
 
 // src/prompt.ts
 import { createInterface as createInterface2 } from "readline";
@@ -33389,7 +35237,7 @@ function warningLines(message) {
 }
 function policyProblems(dir, names) {
   return names.flatMap((name) => {
-    const split2 = splitStatements(readFileSync7(join27(dir, name), "utf8"));
+    const split2 = splitStatements(readFileSync7(join26(dir, name), "utf8"));
     if (!split2.ok) return [];
     const planned = planPolicyMigration(
       split2.statements.map((statement2) => statement2.text)
@@ -33420,7 +35268,7 @@ async function runMigrationNew(context, deps = processStdin) {
   const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
 ` : `-- Migration: ${fileName}
 `;
-  const path = join27(dir, fileName);
+  const path = join26(dir, fileName);
   writeFileSync3(path, body, { flag: "wx" });
   const relPath = relativeToCwd(context, path);
   context.output.result({ file: fileName, path: relPath, fromStdin }, [
@@ -33449,7 +35297,7 @@ async function applyMigrationFiles(context, client, projectId, dir, names) {
   const applied = [];
   const warnings = [];
   for (const name of names) {
-    const sql = readFileSync7(join27(dir, name), "utf8");
+    const sql = readFileSync7(join26(dir, name), "utf8");
     let answer;
     try {
       answer = await client.db.applyMigration(projectId, { name, sql });
@@ -33661,7 +35509,7 @@ var BUNDLE_MESSAGES = {
 
 // ../../packages/functions-bundler/src/discover.ts
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { join as join28, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
+import { join as join27, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
 
 // ../../packages/functions-bundler/src/limits.ts
 var FUNCTION_BUNDLE_MAX_BYTES = 67108864;
@@ -33685,7 +35533,7 @@ function isEntrypoint(value) {
 function functionsFolder(options) {
   const root = resolve11(options.cwd, options.root ?? ".");
   const explicit = options.dir !== void 0;
-  const dir = explicit ? resolve11(options.cwd, options.dir) : join28(root, "naro", "functions");
+  const dir = explicit ? resolve11(options.cwd, options.dir) : join27(root, "naro", "functions");
   const label2 = relative8(options.cwd, dir).split(sep6).join("/") || ".";
   return { dir, label: label2, root, explicit };
 }
@@ -33694,7 +35542,7 @@ function listFunctionNames(folder) {
   try {
     entries = readdirSync3(folder.dir, { withFileTypes: true });
   } catch {
-    if (!folder.explicit && existsSync7(join28(folder.root, "supabase", "functions")))
+    if (!folder.explicit && existsSync7(join27(folder.root, "supabase", "functions")))
       throw new FunctionBundleError(
         "VALIDATION_FAILED",
         BUNDLE_MESSAGES.supabaseFound
@@ -33715,7 +35563,7 @@ function listFunctionNames(folder) {
   return names;
 }
 function readFunctionJson(dir, name) {
-  const file2 = join28(dir, "function.json");
+  const file2 = join27(dir, "function.json");
   if (!existsSync7(file2)) return { verifyJwt: void 0, entrypoint: void 0 };
   let parsed;
   try {
@@ -33759,7 +35607,7 @@ function readFunctionSource(folder, name) {
       "VALIDATION_FAILED",
       BUNDLE_MESSAGES.badName(name)
     );
-  const dir = join28(folder.dir, name);
+  const dir = join27(folder.dir, name);
   if (!statSync2(dir, { throwIfNoEntry: false })?.isDirectory())
     throw new FunctionBundleError(
       "VALIDATION_FAILED",
@@ -33768,14 +35616,14 @@ function readFunctionSource(folder, name) {
   const config2 = readFunctionJson(dir, name);
   let entrypoint;
   if (config2.entrypoint !== void 0) {
-    if (!existsSync7(join28(dir, ...config2.entrypoint.split("/"))))
+    if (!existsSync7(join27(dir, ...config2.entrypoint.split("/"))))
       throw new FunctionBundleError(
         "FUNCTION_BUNDLE_FAILED",
         BUNDLE_MESSAGES.entryMissing(name, config2.entrypoint)
       );
     entrypoint = config2.entrypoint;
   } else {
-    const found = ENTRY_FILES.find((file2) => existsSync7(join28(dir, file2)));
+    const found = ENTRY_FILES.find((file2) => existsSync7(join27(dir, file2)));
     if (found === void 0)
       throw new FunctionBundleError(
         "FUNCTION_BUNDLE_FAILED",
@@ -33786,14 +35634,14 @@ function readFunctionSource(folder, name) {
   return {
     name,
     dir,
-    entry: join28(dir, ...entrypoint.split("/")),
+    entry: join27(dir, ...entrypoint.split("/")),
     entrypoint,
     verifyJwt: config2.verifyJwt
   };
 }
 function configTomlWarning(folder) {
-  if (!folder.dir.endsWith(join28("supabase", "functions"))) return null;
-  const file2 = join28(folder.dir, "..", "config.toml");
+  if (!folder.dir.endsWith(join27("supabase", "functions"))) return null;
+  const file2 = join27(folder.dir, "..", "config.toml");
   if (!existsSync7(file2)) return null;
   return /^\s*verify_jwt\s*=/m.test(readFileSync8(file2, "utf8")) ? BUNDLE_MESSAGES.supabaseVerifyJwt(folder.label) : null;
 }
@@ -33999,11 +35847,11 @@ ${injects.map(
 
 // ../../packages/functions-bundler/src/deno-imports.ts
 import { existsSync as existsSync9, readFileSync as readFileSync10, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join30, relative as relative9, sep as sep8 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join29, relative as relative9, sep as sep8 } from "path";
 
 // ../../packages/functions-bundler/src/import-map.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9, realpathSync } from "fs";
-import { basename as basename4, dirname as dirname8, join as join29, resolve as resolve12, sep as sep7 } from "path";
+import { basename as basename4, dirname as dirname8, join as join28, resolve as resolve12, sep as sep7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // ../../packages/functions-bundler/src/printable.ts
@@ -34075,7 +35923,7 @@ function readImportMapFile(file2, label2) {
 }
 function readImportMap(functionDir, fallback, labelOf) {
   for (const name of FILES) {
-    const file2 = join29(functionDir, name);
+    const file2 = join28(functionDir, name);
     if (!existsSync8(file2)) continue;
     const map2 = load(file2, labelOf(file2));
     if (map2 !== null) return map2;
@@ -34218,7 +36066,7 @@ function packageDir(from, projectRoot) {
   let current = from;
   while (isInside(current, projectRoot)) {
     const inNodeModules = fromRoot(projectRoot, current).split("/").includes("node_modules");
-    if (!inNodeModules && existsSync9(join30(current, "package.json")))
+    if (!inNodeModules && existsSync9(join29(current, "package.json")))
       return fromRoot(projectRoot, current) || ".";
     const up = dirname9(current);
     if (up === current) break;
@@ -34230,7 +36078,7 @@ function isInstalled(from, pkg) {
   if (pkg === "") return false;
   let current = from;
   for (; ; ) {
-    if (existsSync9(join30(current, "node_modules", pkg))) return true;
+    if (existsSync9(join29(current, "node_modules", pkg))) return true;
     const up = dirname9(current);
     if (up === current) return false;
     current = up;
@@ -34240,7 +36088,7 @@ var NODE_MODULES = /[\\/]node_modules[\\/]/;
 function installedVersion(resolved, pkg) {
   let current = dirname9(resolved);
   for (; ; ) {
-    const file2 = join30(current, "package.json");
+    const file2 = join29(current, "package.json");
     if (existsSync9(file2)) {
       try {
         const manifest2 = JSON.parse(readFileSync10(file2, "utf8"));
@@ -34424,7 +36272,7 @@ function denoImportsPlugin(options) {
 
 // ../../packages/functions-bundler/src/bundle.ts
 import { createHash as createHash4 } from "crypto";
-import { join as join31, relative as relative10, sep as sep9 } from "path";
+import { join as join30, relative as relative10, sep as sep9 } from "path";
 import { gzipSync } from "zlib";
 
 // ../../packages/functions-runtime/dist/index.js
@@ -34500,7 +36348,7 @@ async function bundleFunction(source, folder, options = {}) {
     result = await build({
       absWorkingDir: folder.root,
       entryPoints: [source.entry],
-      outfile: join31(source.dir, NARO_USER_MODULE),
+      outfile: join30(source.dir, NARO_USER_MODULE),
       bundle: true,
       write: false,
       format: "esm",
@@ -35070,7 +36918,7 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile15(join32(sourceDir, "package.json"), "utf8")
+      await readFile15(join31(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
@@ -35080,7 +36928,7 @@ async function projectName(sourceDir) {
 function resolveBin(name) {
   let dir = dirname10(fileURLToPath4(import.meta.url));
   for (; ; ) {
-    const candidate = join32(dir, "node_modules", ".bin", name);
+    const candidate = join31(dir, "node_modules", ".bin", name);
     if (existsSync10(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return name;
@@ -35147,7 +36995,7 @@ function workingTreeNotices(copy) {
 }
 function localDependencies(sourceDir, say = () => void 0) {
   return {
-    createWorkspace: () => mkdtemp2(join32(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join31(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm5(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -35402,6 +37250,8 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  CAPABILITIES,
+  dashboardNeeds,
   parseDotenvDetailed,
   FUNCTION_INVOKE_METHODS,
   FUNCTION_INVOKE_MAX_RESPONSE_BYTES,
@@ -35439,6 +37289,8 @@ export {
   POLICY_RULES,
   POLICY_ACTIONS,
   NaroClient,
+  dashboardCapability,
+  dashboardLink,
   BOOKMARK_FORMAT_MESSAGE,
   isBookmark,
   RESTORE_OUTCOME_UNKNOWN_CODES,