naro-cli 0.28.0 → 0.30.0

package/dist/{chunk-UJGDKNDM.js → chunk-ITTYPT3A.js}

@@ -306,6 +306,9 @@ function sanitizeRoutes(value) {
   return JSON.stringify(routes).length > MAX_ROUTE_LIST_BYTES ? void 0 : routes;
 }
 
+// ../../packages/core/src/static-assets.ts
+var IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+
 // ../../packages/core/src/artifact-manifest.ts
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
@@ -1746,7 +1749,12 @@ var CAPABILITIES = [
     id: "function-get",
     domain: "functions",
     title: "\uD568\uC218 \uC0C1\uC138",
-    routes: ["GET projects/[projectId]/backend/functions/[name]"],
+    // `deploy` is a name the rule allows; the batch deploy's static segment
+    // answers that one path for it (functions/deploy/route.ts).
+    routes: [
+      "GET projects/[projectId]/backend/functions/[name]",
+      "GET projects/[projectId]/backend/functions/deploy"
+    ],
     ui: { kind: "built" },
     cli: { kind: "built", commands: ["naro functions versions"] },
     mcp: { kind: "built", tools: ["get_function"] }
@@ -1755,7 +1763,10 @@ var CAPABILITIES = [
     id: "function-update",
     domain: "functions",
     title: "\uD568\uC218 verify_jwt \uC124\uC815",
-    routes: ["PATCH projects/[projectId]/backend/functions/[name]"],
+    routes: [
+      "PATCH projects/[projectId]/backend/functions/[name]",
+      "PATCH projects/[projectId]/backend/functions/deploy"
+    ],
     ui: { kind: "built" },
     cli: { kind: "built", commands: ["naro functions update"] },
     mcp: { kind: "built", tools: ["update_function"] }
@@ -1764,7 +1775,10 @@ var CAPABILITIES = [
     id: "function-delete",
     domain: "functions",
     title: "\uD568\uC218 \uC0AD\uC81C",
-    routes: ["DELETE projects/[projectId]/backend/functions/[name]"],
+    routes: [
+      "DELETE projects/[projectId]/backend/functions/[name]",
+      "DELETE projects/[projectId]/backend/functions/deploy"
+    ],
     ui: { kind: "built" },
     cli: { kind: "built", commands: ["naro functions delete"] },
     mcp: { kind: "built", tools: ["delete_function"] }
@@ -1787,10 +1801,14 @@ var CAPABILITIES = [
     domain: "functions",
     title: "\uC800\uC7A5\uB41C \uBC84\uC804 \uBC30\uD3EC",
     routes: [
-      "POST projects/[projectId]/backend/functions/[name]/versions/[versionId]/deploy"
+      "POST projects/[projectId]/backend/functions/[name]/versions/[versionId]/deploy",
+      // Many functions' versions in one upload of the project's worker
+      // (design 2026-11-08 G4): naro functions deploy with several names,
+      // deploy_function with `names` (Task 8).
+      "POST projects/[projectId]/backend/functions/deploy"
     ],
     ui: { kind: "built" },
-    // naro functions deploy가 올린 버전을 배포한다(client.functions.deploy).
+    // naro functions deploy가 올린 버전을 배포한다(client.functions.deploy, 여럿이면 deployMany).
     cli: { kind: "built" },
     // deploy_function이 naro-cli의 deployFunctions로 올린 버전을 배포한다.
     mcp: { kind: "built" }
@@ -2511,12 +2529,22 @@ var DEPLOYMENT_ERROR_CODES = [
   "DATABASE_FULL",
   /** Usage limits spec 2026-10-18 §6: a hobby team created its 100 deployments this UTC month. */
   "USAGE_LIMIT_REACHED",
-  /** A hobby team has its 3 projects; no project can be added. */
+  /** Hobby: another limit (requests, D1, Storage, Functions, Realtime) is reached, so new builds wait (spec 2026-11-07-hobby-any-limit-blocks-build). */
+  "BUILDS_PAUSED",
+  /** A hobby team has its 20 projects; no project can be added. */
   "PROJECT_LIMIT_REACHED",
   /** A hobby team has its 1 member; no member or invite can be added. */
   "MEMBER_LIMIT_REACHED",
-  /** Custom domains are not part of the Hobby plan. */
+  /**
+   * Custom domains were not part of the Hobby plan. No longer answered since
+   * 202611070030 (one domain per hobby project); kept so an older client
+   * still names it.
+   */
   "PLAN_DOMAINS_NOT_INCLUDED",
+  /** A hobby project has its 1 custom domain (with its www form); no other can be added. */
+  "PLAN_DOMAIN_LIMIT_REACHED",
+  /** A hobby team has its 5 projects with a database; no other project can turn its database or backend on. */
+  "BACKEND_LIMIT_REACHED",
   /** Named environments (spec 2026-10-18-named-environments §15): the name is not lowercase letters, digits and single hyphens, or is over 20 characters. */
   "ENVIRONMENT_NAME_INVALID",
   /** `production` and `preview` are reserved names. */
@@ -17567,7 +17595,7 @@ var REQUESTS = {
     subject100: (team) => `${team} has reached its monthly request limit`,
     usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} requests the Hobby plan includes for ${month}.`,
     warning: "When it reaches the limit, requests past it may be blocked until the month ends (UTC).",
-    blocked: "Sites on this team answer 503 until the month ends (UTC).",
+    blocked: "Sites on this team are blocked (HTTP 403 or 503) until the month ends (UTC).",
     running: "Sites keep running for now.",
     button: "View usage",
     footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on Naro.`
@@ -17577,7 +17605,7 @@ var REQUESTS = {
     subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
     usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uC694\uCCAD ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
     warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uADF8 \uB4A4 \uC694\uCCAD\uC774 \uB9C9\uD790 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
-    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 \uC694\uCCAD\uC744 \uB9C9\uC2B5\uB2C8\uB2E4(HTTP 403 \uB610\uB294 503).",
     running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
     button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
     footer: (team) => `Naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
@@ -17587,7 +17615,7 @@ var REQUESTS = {
     subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
     usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
     warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u4EE5\u964D\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30D6\u30ED\u30C3\u30AF\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
-    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u62D2\u5426\u3057\u307E\u3059(HTTP 403 \u307E\u305F\u306F 503)\u3002",
     running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
     button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
     footer: (team) => `Naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
@@ -17739,6 +17767,63 @@ async function wrapNextConfig(appRoot, file2) {
   );
   return { wrapper: plan.wrapper, project: project2 };
 }
+function assetPrefixWrapperSource(projectSpecifier, typescript) {
+  return `${typescript ? "// @ts-nocheck\n" : ""}// Written by Naro for this build only. The project's own next.config is
+// ${projectSpecifier}, unchanged; this wrapper serves _next/static from
+// Naro's CDN unless the project sets its own assetPrefix.
+import projectConfig from ${JSON.stringify(projectSpecifier)};
+
+export default async function naroNextConfig(phase, context) {
+  const config =
+    typeof projectConfig === "function"
+      ? await projectConfig(phase, context)
+      : await projectConfig;
+  const rest = { ...(config ?? {}) };
+  return {
+    ...rest,
+    assetPrefix: rest.assetPrefix || process.env.NARO_STATIC_ASSET_PREFIX,
+  };
+}
+`;
+}
+var ASSET_PREFIX_ONLY_CONFIG = `// Written by Naro for this build only: the project has no next.config.
+export default { assetPrefix: process.env.NARO_STATIC_ASSET_PREFIX };
+`;
+var CONFIG_LOOKUP = [
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.ts",
+  "next.config.mts",
+  "next.config.cjs"
+];
+async function wrapNextConfigForAssetPrefix(appRoot, prefix) {
+  if (!prefix) return "skipped";
+  let file2;
+  for (const name of CONFIG_LOOKUP)
+    if (await exists(join2(appRoot, name))) {
+      file2 = name;
+      break;
+    }
+  if (!file2) {
+    await writeFile2(join2(appRoot, "next.config.mjs"), ASSET_PREFIX_ONLY_CONFIG);
+    return "created";
+  }
+  const plan = WRAPPABLE[file2];
+  if (!plan) return "skipped";
+  const project2 = `${PROJECT_CONFIG_BASENAME}.${file2.slice("next.config.".length)}`;
+  if (await exists(join2(appRoot, project2))) return "skipped";
+  await rename(join2(appRoot, file2), join2(appRoot, project2));
+  try {
+    await writeFile2(
+      join2(appRoot, plan.wrapper),
+      assetPrefixWrapperSource(plan.specifier, plan.typescript)
+    );
+  } catch (error51) {
+    await rename(join2(appRoot, project2), join2(appRoot, file2));
+    throw error51;
+  }
+  return "wrapped";
+}
 
 // ../../packages/next-adapter/src/index.ts
 function nextAdapterPath(base2 = import.meta.url) {
@@ -19201,6 +19286,54 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
   };
 }
 
+// ../../packages/build/src/static-cdn.ts
+var STATIC_ASSET_PREFIX_ENV = "NARO_STATIC_ASSET_PREFIX";
+var STATIC_ASSETS_ON_CDN_NOTE = "Static assets (_next/static) are served from static.naro.sh.";
+var STATIC_ASSETS_ON_WORKER_NOTE = "Static assets stay on the Worker: the build did not use Naro's asset prefix (the project sets its own assetPrefix or a basePath, or it is not a Next.js build).";
+function buildEnvWithStaticPrefix(env, prefix) {
+  const result = { ...env };
+  delete result[STATIC_ASSET_PREFIX_ENV];
+  if (prefix) result[STATIC_ASSET_PREFIX_ENV] = prefix;
+  return result;
+}
+function contains(file2, needle) {
+  return Buffer.from(
+    file2.data.buffer,
+    file2.data.byteOffset,
+    file2.data.byteLength
+  ).includes(needle);
+}
+function withStaticAssetPrefix(artifact, prefix) {
+  if (!prefix) return { artifact, note: null };
+  const needle = Buffer.from(prefix, "utf8");
+  const files = [artifact.entrypoint, ...artifact.modules, ...artifact.assets];
+  if (!files.some((file2) => contains(file2, needle)))
+    return { artifact, note: STATIC_ASSETS_ON_WORKER_NOTE };
+  return {
+    artifact: { ...artifact, staticAssetPrefix: prefix },
+    note: STATIC_ASSETS_ON_CDN_NOTE
+  };
+}
+var IMMUTABLE_HEADERS_FILE = "_headers";
+var IMMUTABLE_HEADERS = `/_next/static/*
+  Cache-Control: ${IMMUTABLE_CACHE_CONTROL}
+`;
+function withImmutableHeaders(artifact) {
+  if (artifact.assets.some((asset) => asset.name === IMMUTABLE_HEADERS_FILE))
+    return artifact;
+  return {
+    ...artifact,
+    assets: [
+      ...artifact.assets,
+      {
+        name: IMMUTABLE_HEADERS_FILE,
+        data: new TextEncoder().encode(IMMUTABLE_HEADERS),
+        contentType: "text/plain"
+      }
+    ]
+  };
+}
+
 // ../../packages/build/src/strategy/fingerprint.ts
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile9 } from "fs/promises";
@@ -20352,6 +20485,17 @@ function createVinextCloudflareStrategy(options) {
         );
         if (!added.ok) return failed("prepare", describeFailure(added));
       }
+      try {
+        await wrapNextConfigForAssetPrefix(
+          fork.appRoot,
+          context.env[STATIC_ASSET_PREFIX_ENV]
+        );
+      } catch (error51) {
+        await warn(
+          observer,
+          `Could not point static assets at static.naro.sh: ${describeError(error51)}`
+        );
+      }
       const projectBin = adopt ? null : await findProjectBin(fork.appRoot, fork.checkout, "vinext");
       const build = await runStep(
         context,
@@ -20760,7 +20904,7 @@ var LocalBuildExecutor = class {
         input.rootDirectory
       );
       await assertAppRootInsideCheckout(checkout, appRoot);
-      const stacks = await import("./stack-PDV3NPWC.js");
+      const stacks = await import("./stack-DFLT7AVX.js");
       const stack = await (this.dependencies.detectStack ?? stacks.detectStack)(
         appRoot
       ).catch(() => null);
@@ -20920,7 +21064,7 @@ var LocalBuildExecutor = class {
           const context = {
             identity,
             branch: input.branch,
-            env: input.env ?? {},
+            env: buildEnvWithStaticPrefix(input.env, input.staticAssetPrefix),
             // The toolchain add has to use the store the install linked
             // node_modules from (withSharedCache).
             packageManager: cachePorts ? withSharedCache(packageManager, pmCacheDir) : packageManager,
@@ -20976,7 +21120,10 @@ var LocalBuildExecutor = class {
               args: ["run", resolved.buildScript],
               cwd: appRoot,
               env: {
-                ...input.env,
+                // Static presets never get the asset prefix (spec
+                // 2026-11-07-static-asset-cdn §3): a Vite base or CRA
+                // PUBLIC_URL also moves the router and public/ files.
+                ...buildEnvWithStaticPrefix(input.env, void 0),
                 NPM_CONFIG_USERCONFIG: packageManagerConfigPath
               },
               timeoutMs: 15 * 6e4,
@@ -21010,6 +21157,14 @@ var LocalBuildExecutor = class {
           appRoot,
           observer
         );
+      const cdn = withStaticAssetPrefix(artifact, input.staticAssetPrefix);
+      if (cdn.note)
+        await observer.onLog({
+          level: "INFO",
+          stage: "DEPLOYING",
+          message: cdn.note
+        });
+      artifact = withImmutableHeaders(cdn.artifact);
       return {
         gitCommitSha,
         artifact,
@@ -21194,7 +21349,16 @@ async function errorFromResponse(response, context) {
 }
 
 // ../../packages/sdk/src/session.ts
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+import {
+  chmodSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
 import { homedir } from "os";
 import { join as join18 } from "path";
 function credentialsDir(home = homedir()) {
@@ -21204,10 +21368,18 @@ function credentialsFile(home = homedir()) {
   return join18(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
-  mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
-  writeFileSync(credentialsFile(home), JSON.stringify(session, null, 2), {
-    mode: 384
-  });
+  const dir = credentialsDir(home);
+  const file2 = credentialsFile(home);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const tmp = `${file2}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 384 });
+    renameSync(tmp, file2);
+  } catch (error51) {
+    rmSync(tmp, { force: true });
+    throw error51;
+  }
 }
 function loadStoredSession(home = homedir()) {
   try {
@@ -21219,7 +21391,19 @@ function loadStoredSession(home = homedir()) {
   }
 }
 function clearSession(home = homedir()) {
+  const dir = credentialsDir(home);
   rmSync(credentialsFile(home), { force: true });
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (/^credentials\.json\.[0-9a-f]+\.tmp$/.test(name)) {
+      rmSync(join18(dir, name), { force: true });
+    }
+  }
 }
 function isExpired(session, skewSeconds = 60) {
   return session.expires_at * 1e3 <= Date.now() + skewSeconds * 1e3;
@@ -21394,7 +21578,20 @@ async function startCallbackServer() {
     resolveCode = resolve16;
     rejectCode = reject;
   });
+  let port = 0;
+  let settled = false;
   const server = createServer2((req, res) => {
+    const host = (req.headers.host ?? "").toLowerCase();
+    if (host !== `localhost:${String(port)}` && host !== `127.0.0.1:${String(port)}`) {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    if (settled) {
+      res.statusCode = 410;
+      res.end("Gone");
+      return;
+    }
     const url2 = new URL(req.url ?? "/", "http://localhost");
     if (url2.pathname !== "/callback") {
       res.statusCode = 404;
@@ -21405,6 +21602,7 @@ async function startCallbackServer() {
     const code = url2.searchParams.get("code");
     if (error51) {
       const description = url2.searchParams.get("error_description");
+      settled = true;
       sendPage(res, 200, failurePage(description ?? error51));
       rejectCode(new Error(`GitHub authorization failed: ${error51}`));
       return;
@@ -21417,11 +21615,12 @@ async function startCallbackServer() {
       );
       return;
     }
+    settled = true;
     sendPage(res, 200, successPage());
     resolveCode(code);
   });
   await new Promise((resolve16) => server.listen(0, "127.0.0.1", resolve16));
-  const port = server.address().port;
+  port = server.address().port;
   return {
     port,
     waitForCode(timeoutMs) {
@@ -21627,10 +21826,15 @@ async function resolveAuth(options = {}) {
 
 // ../../packages/sdk/src/browser.ts
 import { spawn as spawn2 } from "child_process";
+function browserCommand(url2, platform = process.platform) {
+  if (platform === "darwin") return { command: "open", args: [url2] };
+  if (platform === "win32") {
+    return { command: "rundll32", args: ["url.dll,FileProtocolHandler", url2] };
+  }
+  return { command: "xdg-open", args: [url2] };
+}
 function openBrowser(url2) {
-  const platform = process.platform;
-  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url2] : [url2];
+  const { command, args } = browserCommand(url2);
   const child = spawn2(command, args, { stdio: "ignore", detached: true });
   child.on("error", () => {
   });
@@ -24119,6 +24323,28 @@ var FunctionsApi = class {
     );
     return body.function;
   }
+  /**
+   * Puts several functions' versions live in one upload of the project's
+   * worker (design 2026-11-08 G4): 1 to 100 `{ name, versionId }`, each
+   * function once. One refusal refuses them all and nothing goes live —
+   * `deploy`'s refusals, `VALIDATION_FAILED` for the list itself (`Send 1 to
+   * 100 versions.`, a name listed twice), and `FUNCTIONS_TOO_LARGE` (413:
+   * the project's live bundles together past 64 MiB). The answer is each
+   * function's new version, in the order asked. Two minutes, or
+   * `options.timeoutMs`; a timeout here does not say whether they went
+   * live — `list` does.
+   */
+  async deployMany(projectId, versions, options = {}) {
+    return this.client.request(
+      this.path(projectId, "/deploy"),
+      {
+        method: "POST",
+        body: { versions },
+        context: "Deploy functions",
+        timeoutMs: options.timeoutMs ?? PROVISION_TIMEOUT_MS
+      }
+    );
+  }
   /**
    * Puts a stored version live again: the one numbered `version`, which must
    * have been live before (`VERSION_NOT_FOUND` otherwise — put a version that
@@ -24386,7 +24612,7 @@ function serializeDotenv(vars) {
 }
 
 // ../../packages/sdk/src/env-scan.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync } from "fs";
 import { join as join20 } from "path";
 var SOURCE_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".ts",
@@ -24435,7 +24661,7 @@ function collect(dir, out) {
   if (out.length >= MAX_FILES) return;
   let entries;
   try {
-    entries = readdirSync(dir, { withFileTypes: true });
+    entries = readdirSync2(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -33432,12 +33658,32 @@ function generateTypes(tables, options = {}) {
 // ../../packages/sdk/src/link.ts
 import {
   existsSync as existsSync4,
+  lstatSync,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync5,
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { join as join22 } from "path";
+function isSymbolicLink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function refuseLink(path, shown, before) {
+  if (isSymbolicLink(path))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${shown} is a symbolic link. Remove it before ${before}.`
+    );
+}
+function assertProjectLinkWritable(dir, before = "linking the project") {
+  refuseLink(linkDir(dir), ".naro", before);
+  refuseLink(linkFile(dir), ".naro/project.json", before);
+  refuseLink(join22(linkDir(dir), "README.txt"), ".naro/README.txt", before);
+}
 function linkDir(dir) {
   return join22(dir, ".naro");
 }
@@ -33460,6 +33706,7 @@ function readProjectLink(dir) {
   }
 }
 function writeProjectLink(dir, link) {
+  assertProjectLinkWritable(dir);
   mkdirSync2(linkDir(dir), { recursive: true });
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
@@ -33475,6 +33722,7 @@ function removeProjectLink(dir) {
 }
 function ensureGitignoreHasNaro(dir) {
   const gitignorePath = join22(dir, ".gitignore");
+  if (isSymbolicLink(gitignorePath)) return false;
   const hasGitignore = existsSync4(gitignorePath);
   if (!hasGitignore && !existsSync4(join22(dir, ".git"))) return false;
   const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
@@ -33815,7 +34063,7 @@ async function repairLedger(client, projectId, key, status, ledgerIsEmpty) {
 }
 
 // ../../packages/sdk/src/migrations.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync3 } from "fs";
 import { resolve as resolve9 } from "path";
 function resolveMigrationsDir(input) {
   if (input.dir) return resolve9(input.baseDir, input.dir);
@@ -33835,7 +34083,7 @@ function sortMigrationNames(names) {
 function listMigrationFiles(dir) {
   if (!existsSync5(dir)) return [];
   return sortMigrationNames(
-    readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name)
+    readdirSync3(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name)
   );
 }
 function nextMigrationFileName(existing, name) {
@@ -34236,11 +34484,13 @@ function summarizeTeamUsage(report, currentMonth) {
   };
   const meters = USAGE_METRICS.map((metric) => {
     const limit = report.limits?.[metric] ?? null;
+    const perProject = metric === "domains" ? report.limits?.domainsPerProject ?? null : null;
     return {
       metric,
       used: used[metric],
       limit,
-      percent: limit ? Math.floor(used[metric] * 100 / limit) : null
+      percent: limit ? Math.floor(used[metric] * 100 / limit) : null,
+      perProject
     };
   });
   return {
@@ -35276,8 +35526,6 @@ var BUNDLE_MESSAGES = {
   wasm: (file2) => `WebAssembly modules are not supported in functions yet: ${file2}.`,
   naroJsMissing: 'Cannot find "naro-js/functions". Install naro-js 0.7.0 or later: npm install naro-js@latest.',
   tooLarge: (name, size, inputs) => `Function ${name} bundles to ${bytes(size)} bytes; the limit is 67,108,864 (64 MiB). The biggest inputs: ${inputs}.`,
-  // Rounded up: a size over the limit never reads as the limit (10.0 MB).
-  tooLargeCompressed: (name, size) => `Function ${name} is ${(Math.ceil(size / 1048576 * 10) / 10).toFixed(1)} MB after compression; Cloudflare accepts 10 MB.`,
   otherBundle: (name, text3, location2) => `Function ${name} did not bundle: ${text3}${location2 ? ` (${location2})` : ""}`,
   noHandler: (name) => `Function ${name} did not register a handler. Call Deno.serve(handler) or export default { fetch }.`,
   failedToStart: (name, line) => `Function ${name} failed to start: ${line}`,
@@ -35287,12 +35535,11 @@ var BUNDLE_MESSAGES = {
 };
 
 // ../../packages/functions-bundler/src/discover.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
 import { join as join27, relative as relative8, resolve as resolve12, sep as sep6 } from "path";
 
 // ../../packages/functions-bundler/src/limits.ts
 var FUNCTION_BUNDLE_MAX_BYTES = 67108864;
-var FUNCTION_COMPRESSED_BUNDLE_MAX_BYTES = 10485760;
 var ENTRY_FILES = [
   "index.ts",
   "index.js",
@@ -35319,7 +35566,7 @@ function functionsFolder(options) {
 function listFunctionNames(folder) {
   let entries;
   try {
-    entries = readdirSync3(folder.dir, { withFileTypes: true });
+    entries = readdirSync4(folder.dir, { withFileTypes: true });
   } catch {
     if (!folder.explicit && existsSync7(join27(folder.root, "supabase", "functions")))
       throw new FunctionBundleError(
@@ -36052,25 +36299,18 @@ function denoImportsPlugin(options) {
 // ../../packages/functions-bundler/src/bundle.ts
 import { createHash as createHash4 } from "crypto";
 import { join as join30, relative as relative10, sep as sep9 } from "path";
-import { gzipSync } from "zlib";
 
 // ../../packages/functions-runtime/dist/index.js
 var NARO_SHIM_MODULE = "naro-shim.js";
 var NARO_USER_MODULE = "user.js";
 var NARO_BOOT_MODULE = "naro-boot.js";
-var NARO_ENTRY_SOURCE = '// src/naro-entry.ts\nimport "./naro-shim.js";\nimport * as user from "./user.js";\n\n// src/context.ts\nvar CONTEXT_HEADER = "x-naro-context";\nvar MAX_CONTEXT_LENGTH = 4096;\nvar BASE64URL = /^[A-Za-z0-9_-]+$/;\nvar TRACE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;\nvar MAX_HOP = 1e3;\nvar ROLES = /* @__PURE__ */ new Set([\n  "anon",\n  "authenticated",\n  "service"\n]);\nfunction fieldsOf(value) {\n  if (typeof value !== "object" || value === null || Array.isArray(value))\n    return null;\n  return value;\n}\nfunction own(fields, key) {\n  return Object.hasOwn(fields, key) ? fields[key] : void 0;\n}\nfunction nonEmptyText(value) {\n  return typeof value === "string" && value !== "";\n}\nvar MAX_USER_ID_LENGTH = 256;\nfunction headerSafeId(value) {\n  if (!nonEmptyText(value) || value.length > MAX_USER_ID_LENGTH) return false;\n  if (value.trim() !== value) return false;\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code < 32 || code >= 127 && code <= 159) return false;\n    if (code >= 55296 && code <= 57343) {\n      const next = value.charCodeAt(index + 1);\n      if (code >= 56320 || !(next >= 56320 && next <= 57343)) return false;\n      index += 1;\n    }\n  }\n  return true;\n}\nfunction userOf(value) {\n  const fields = fieldsOf(value);\n  if (fields === null) return null;\n  const id = own(fields, "id");\n  const email = own(fields, "email");\n  const emailVerified = own(fields, "emailVerified");\n  if (!headerSafeId(id)) return null;\n  if (email !== null && typeof email !== "string") return null;\n  if (typeof emailVerified !== "boolean") return null;\n  return { id, email, emailVerified };\n}\nfunction contextOf(value, projectId, name) {\n  const fields = fieldsOf(value);\n  if (fields === null) return null;\n  if (own(fields, "v") !== 1) return null;\n  if (own(fields, "projectId") !== projectId) return null;\n  if (own(fields, "function") !== name) return null;\n  const traceId = own(fields, "traceId");\n  if (typeof traceId !== "string" || !TRACE_ID_RE.test(traceId)) return null;\n  const hop = own(fields, "hop");\n  if (typeof hop !== "number" || !Number.isInteger(hop) || hop < 0 || hop > MAX_HOP)\n    return null;\n  const role = own(fields, "role");\n  if (role !== null && !ROLES.has(role)) return null;\n  const sentUser = own(fields, "user");\n  let user2 = null;\n  if (role === "authenticated") {\n    user2 = userOf(sentUser);\n    if (user2 === null) return null;\n  } else if (sentUser !== null) return null;\n  return {\n    v: 1,\n    projectId,\n    function: name,\n    role,\n    user: user2,\n    traceId,\n    hop\n  };\n}\nfunction bytesOf(value) {\n  if (!BASE64URL.test(value) || value.length % 4 === 1) return null;\n  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");\n  let binary;\n  try {\n    binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));\n  } catch {\n    return null;\n  }\n  const again = btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");\n  if (again !== value) return null;\n  return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n}\nfunction decodeContext(value, bindings) {\n  const projectId = bindings.NARO_PROJECT_ID;\n  const name = bindings.NARO_FUNCTION_NAME;\n  if (!nonEmptyText(projectId) || !nonEmptyText(name)) return null;\n  if (typeof value !== "string" || value.length > MAX_CONTEXT_LENGTH)\n    return null;\n  const bytes = bytesOf(value);\n  if (bytes === null) return null;\n  let parsed;\n  try {\n    parsed = JSON.parse(\n      new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)\n    );\n  } catch {\n    return null;\n  }\n  return contextOf(parsed, projectId, name);\n}\n\n// src/rejections.ts\nfunction loggedRejection(promise, name) {\n  return Promise.resolve(promise).then(\n    () => void 0,\n    (error) => {\n      console.error(`naro functions: ${name} waitUntil rejected`, error);\n    }\n  );\n}\n\n// src/respond.ts\nvar FUNCTION_EXPOSE_HEADERS = [\n  "x-relay-error",\n  "x-naro-trace-id",\n  "retry-after",\n  "x-retry-after"\n];\nvar WRAPPER_ERRORS = {\n  FUNCTION_ERROR: "The function threw an error. See `naro functions logs {name}`.",\n  FUNCTION_NO_HANDLER: "The function has no handler. Call Deno.serve(handler) or export default { fetch }.",\n  FUNCTION_MISROUTED: "This function was reached without the Naro gateway."\n};\nfunction appendExposeHeaders(value) {\n  const listed = (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "");\n  const seen = new Set(listed.map((part) => part.toLowerCase()));\n  for (const name of FUNCTION_EXPOSE_HEADERS)\n    if (!seen.has(name)) listed.push(name);\n  return listed.join(", ");\n}\nfunction wrapperError(code, name, traceId) {\n  const headers = new Headers({\n    "access-control-allow-origin": "*",\n    "access-control-expose-headers": appendExposeHeaders(null),\n    "cache-control": "no-store"\n  });\n  if (traceId !== null) headers.set("x-naro-trace-id", traceId);\n  return Response.json(\n    {\n      data: null,\n      error: {\n        code,\n        // A function, not a string: `$&` in a name stays as it is.\n        message: WRAPPER_ERRORS[code].replace("{name}", () => name)\n      }\n    },\n    { status: 500, headers }\n  );\n}\nfunction withFunctionHeaders(response, traceId) {\n  if (response.status === 101) return response;\n  const out = new Response(response.body, response);\n  const headers = out.headers;\n  headers.delete("x-relay-error");\n  if (!headers.has("access-control-allow-origin"))\n    headers.set("access-control-allow-origin", "*");\n  headers.set(\n    "access-control-expose-headers",\n    appendExposeHeaders(headers.get("access-control-expose-headers"))\n  );\n  headers.set("x-naro-trace-id", traceId);\n  return out;\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar CONTEXT_KEY = /* @__PURE__ */ Symbol.for("naro.functions.context");\nvar SHIM_FIRST = "The Naro functions shim must be imported before the wrapper.";\nfunction globals() {\n  return globalThis;\n}\nfunction runtimeState() {\n  const state2 = globals()[RUNTIME_KEY];\n  if (state2 === void 0) throw new Error(SHIM_FIRST);\n  return state2;\n}\nfunction callContexts() {\n  const contexts2 = globals()[CONTEXT_KEY];\n  if (contexts2 === void 0) throw new Error(SHIM_FIRST);\n  return contexts2;\n}\n\n// src/naro-entry.ts\nvar state = runtimeState();\nvar contexts = callContexts();\nasync function serveWithInfo(registered, request) {\n  let complete;\n  const info = {\n    remoteAddr: {\n      transport: "tcp",\n      hostname: request.headers.get("cf-connecting-ip") ?? "0.0.0.0",\n      port: 0\n    },\n    completed: new Promise((resolve) => {\n      complete = resolve;\n    })\n  };\n  try {\n    return await registered(request, info);\n  } finally {\n    complete();\n  }\n}\nfunction chooseHandler() {\n  const registered = state.handler;\n  if (registered !== null)\n    return {\n      handler: async (request) => serveWithInfo(registered, request),\n      onError: state.onError\n    };\n  const exported = user.default;\n  if (typeof exported === "object" && exported !== null) {\n    const fetchHandler = exported.fetch;\n    if (typeof fetchHandler === "function")\n      return {\n        handler: async (request, env, ctx) => fetchHandler.call(exported, request, env, ctx),\n        onError: null\n      };\n  }\n  if (typeof exported === "function") {\n    const prototype = exported.prototype;\n    if (typeof prototype === "object" && prototype !== null && typeof prototype.fetch === "function")\n      return {\n        handler: async (request, env, ctx) => new exported(ctx, env).fetch(request),\n        onError: null\n      };\n    return {\n      handler: async (request, env, ctx) => exported(request, env, ctx),\n      onError: null\n    };\n  }\n  return null;\n}\nfunction callerRequest(request, context) {\n  const headers = new Headers();\n  for (const [name, value] of request.headers)\n    if (!name.startsWith("x-naro-")) headers.append(name, value);\n  if (context.role !== null) headers.set("x-naro-role", context.role);\n  if (context.user !== null) headers.set("x-naro-user-id", context.user.id);\n  headers.set("x-naro-trace-id", context.traceId);\n  return new Request(request, { headers });\n}\nfunction logWaitUntilRejections(ctx, name) {\n  const waitUntil = ctx.waitUntil.bind(ctx);\n  try {\n    Object.defineProperty(ctx, "waitUntil", {\n      configurable: true,\n      writable: true,\n      value: (promise) => waitUntil(loggedRejection(promise, name))\n    });\n  } catch {\n  }\n}\nfunction textOf(value) {\n  return typeof value === "string" ? value : "";\n}\nfunction responseOf(value, what) {\n  if (value instanceof Response) return value;\n  throw new TypeError(`${what} did not return a Response.`);\n}\nasync function answerOf(chosen, name, request, env, ctx) {\n  try {\n    return responseOf(await chosen.handler(request, env, ctx), "The handler");\n  } catch (error) {\n    if (chosen.onError === null) {\n      console.error(`naro functions: ${name} threw`, error);\n      return null;\n    }\n    try {\n      return responseOf(await chosen.onError(error), "onError");\n    } catch (failed) {\n      console.error(`naro functions: ${name} threw`, error, failed);\n      return null;\n    }\n  }\n}\nasync function answerCall(request, env, ctx, seen) {\n  const name = textOf(env.NARO_FUNCTION_NAME);\n  const context = decodeContext(request.headers.get(CONTEXT_HEADER), env);\n  if (context === null) return wrapperError("FUNCTION_MISROUTED", name, null);\n  let forwarded;\n  try {\n    forwarded = callerRequest(request, context);\n  } catch (error) {\n    console.error(`naro functions: ${name} misrouted`, error);\n    return wrapperError("FUNCTION_MISROUTED", name, null);\n  }\n  seen.traceId = context.traceId;\n  const call = {\n    role: context.role,\n    user: context.user,\n    traceId: context.traceId\n  };\n  contexts.set(forwarded, call);\n  const chosen = chooseHandler();\n  if (chosen === null)\n    return wrapperError("FUNCTION_NO_HANDLER", name, context.traceId);\n  logWaitUntilRejections(ctx, name);\n  const answer = await state.requests.run(\n    { ctx, hop: context.hop, traceId: context.traceId, call },\n    () => answerOf(chosen, name, forwarded, env, ctx)\n  );\n  if (answer === null)\n    return wrapperError("FUNCTION_ERROR", name, context.traceId);\n  try {\n    return withFunctionHeaders(answer, context.traceId);\n  } catch (error) {\n    console.error(\n      `naro functions: ${name} answered with a response that cannot be sent`,\n      error\n    );\n    return wrapperError("FUNCTION_ERROR", name, context.traceId);\n  }\n}\nvar naro_entry_default = {\n  async fetch(request, env, ctx) {\n    const seen = { traceId: null };\n    let answer;\n    try {\n      answer = await answerCall(request, env, ctx, seen);\n    } catch (error) {\n      return state.lastResort(error, seen.traceId);\n    }\n    if (state.isResponse(answer)) return answer;\n    return state.lastResort(\n      new TypeError("The wrapper\'s answer is not a Response."),\n      seen.traceId\n    );\n  }\n};\nexport {\n  naro_entry_default as default\n};\n';
-var NARO_SHIM_SOURCE = '// src/naro-shim.ts\nimport { AsyncLocalStorage } from "node:async_hooks";\nimport { env } from "cloudflare:workers";\n\n// src/hosts.ts\nfunction bareHost(host) {\n  return host.toLowerCase().replace(/\\.+$/, "");\n}\nfunction isNaroHost(hostname, rootDomain2, naroUrl2) {\n  const host = bareHost(hostname);\n  if (host === "") return false;\n  const root = rootDomain2.toLowerCase().replace(/^\\.+|\\.+$/g, "");\n  if (root !== "" && host.endsWith(`.${root}`)) return true;\n  if (naroUrl2 === "") return false;\n  try {\n    return bareHost(new URL(naroUrl2).hostname) === host;\n  } catch {\n    return false;\n  }\n}\n\n// src/redact.ts\nvar MIN_REDACTED_LENGTH = 8;\nvar REDACTED = "[redacted]";\nfunction isSecretBinding(name) {\n  return name === "NARO_SERVICE_KEY" || !name.startsWith("NARO_") && name !== "DB";\n}\nfunction secretValues(bindings2) {\n  const values = /* @__PURE__ */ new Set();\n  for (const [name, value] of Object.entries(bindings2)) {\n    if (typeof value !== "string" || value.length < MIN_REDACTED_LENGTH)\n      continue;\n    if (!isSecretBinding(name)) continue;\n    values.add(value);\n    values.add(JSON.stringify(value).slice(1, -1));\n  }\n  return [...values].toSorted(\n    (left, right) => right.length - left.length || (left < right ? -1 : left > right ? 1 : 0)\n  );\n}\nfunction redactText(text, secrets2) {\n  const spans = [];\n  for (const secret of secrets2) {\n    if (secret === "") continue;\n    let last;\n    for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1)) {\n      if (last !== void 0 && at <= last[1]) last[1] = at + secret.length;\n      else spans.push(last = [at, at + secret.length]);\n    }\n  }\n  if (spans.length === 0) return text;\n  const ordered = spans.toSorted((left, right) => left[0] - right[0]);\n  let out = "";\n  let kept = 0;\n  let [start, end] = ordered[0];\n  for (const [nextStart, nextEnd] of ordered) {\n    if (nextStart <= end) {\n      end = Math.max(end, nextEnd);\n      continue;\n    }\n    out += text.slice(kept, start) + REDACTED;\n    kept = end;\n    start = nextStart;\n    end = nextEnd;\n  }\n  return out + text.slice(kept, start) + REDACTED + text.slice(end);\n}\nfunction stringOf(value) {\n  try {\n    return String(value);\n  } catch {\n    return void 0;\n  }\n}\nfunction withHead(stack, head) {\n  if (stack === head || stack.startsWith(`${head}\n`)) return stack;\n  const frames = stack.indexOf("\\n    at ");\n  return frames === -1 ? `${head}\n${stack}` : `${head}${stack.slice(frames)}`;\n}\nfunction redactError(error, secrets2) {\n  const stack = typeof error.stack === "string" ? error.stack : `${error.name}: ${error.message}`;\n  const head = stringOf(error);\n  let json;\n  try {\n    json = JSON.stringify(error);\n  } catch {\n    json = void 0;\n  }\n  const cleanStack = redactText(stack, secrets2);\n  const cleanHead = head === void 0 ? void 0 : redactText(head, secrets2);\n  const cleanJson = json === void 0 ? void 0 : redactText(json, secrets2);\n  if (cleanStack === stack && head !== void 0 && cleanHead === head && json !== void 0 && cleanJson === json)\n    return error;\n  const text = cleanHead === void 0 ? cleanStack : withHead(cleanStack, cleanHead);\n  return cleanJson === void 0 || cleanJson === "{}" ? text : `${text}\n${cleanJson}`;\n}\nfunction isPlain(value) {\n  if (Array.isArray(value)) return true;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\nfunction redactArg(arg, secrets2) {\n  if (typeof arg === "string") return redactText(arg, secrets2);\n  if (arg === null || typeof arg !== "object" && typeof arg !== "function")\n    return arg;\n  try {\n    if (arg instanceof Error) return redactError(arg, secrets2);\n    let json;\n    try {\n      json = JSON.stringify(arg);\n    } catch {\n      return redactText(String(arg), secrets2);\n    }\n    if (json !== void 0) {\n      const clean2 = redactText(json, secrets2);\n      if (clean2 !== json) return clean2;\n    }\n    if (isPlain(arg)) return arg;\n    const text = stringOf(arg);\n    if (text === void 0) return arg;\n    const clean = redactText(text, secrets2);\n    return clean === text ? arg : clean;\n  } catch {\n    return REDACTED;\n  }\n}\nfunction redactArgs(args, secrets2) {\n  if (secrets2.length === 0) return [...args];\n  return args.map((arg) => redactArg(arg, secrets2));\n}\n\n// src/rejections.ts\nfunction loggedRejection(promise, name) {\n  return Promise.resolve(promise).then(\n    () => void 0,\n    (error) => {\n      console.error(`naro functions: ${name} waitUntil rejected`, error);\n    }\n  );\n}\n\n// src/respond.ts\nvar FUNCTION_EXPOSE_HEADERS = [\n  "x-relay-error",\n  "x-naro-trace-id",\n  "retry-after",\n  "x-retry-after"\n];\nvar WRAPPER_ERRORS = {\n  FUNCTION_ERROR: "The function threw an error. See `naro functions logs {name}`.",\n  FUNCTION_NO_HANDLER: "The function has no handler. Call Deno.serve(handler) or export default { fetch }.",\n  FUNCTION_MISROUTED: "This function was reached without the Naro gateway."\n};\nfunction appendExposeHeaders(value) {\n  const listed = (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "");\n  const seen = new Set(listed.map((part) => part.toLowerCase()));\n  for (const name of FUNCTION_EXPOSE_HEADERS)\n    if (!seen.has(name)) listed.push(name);\n  return listed.join(", ");\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar CONTEXT_KEY = /* @__PURE__ */ Symbol.for("naro.functions.context");\n\n// src/naro-shim.ts\nvar bindings = env;\nvar globals = globalThis;\nvar functionName = typeof bindings.NARO_FUNCTION_NAME === "string" ? bindings.NARO_FUNCTION_NAME : "";\nvar secrets = secretValues(bindings);\nfor (const level of ["log", "info", "warn", "error", "debug"]) {\n  const original = console[level].bind(console);\n  console[level] = (...args) => {\n    original(...redactArgs(args, secrets));\n  };\n}\nvar logError = console.error;\nvar NativeResponse = Response;\nvar bareRecord = Object.create;\nvar failedBody = JSON.stringify({\n  data: null,\n  error: {\n    code: "FUNCTION_ERROR",\n    message: WRAPPER_ERRORS.FUNCTION_ERROR.replace(\n      "{name}",\n      () => functionName\n    )\n  }\n});\nvar exposedHeaders = appendExposeHeaders(null);\nfunction lastResort(error, traceId) {\n  try {\n    logError(`naro functions: ${functionName} threw`, error);\n  } catch {\n  }\n  const headers = bareRecord(null);\n  headers["content-type"] = "application/json";\n  headers["access-control-allow-origin"] = "*";\n  headers["access-control-expose-headers"] = exposedHeaders;\n  headers["cache-control"] = "no-store";\n  if (traceId !== null) headers["x-naro-trace-id"] = traceId;\n  const init = bareRecord(null);\n  init.status = 500;\n  init.headers = headers;\n  return new NativeResponse(failedBody, init);\n}\nvar reflectApply = Reflect.apply;\nvar responseStatus = Object.getOwnPropertyDescriptor(\n  NativeResponse.prototype,\n  "status"\n)?.get;\nfunction isResponse(value) {\n  if (typeof value !== "object" || value === null) return false;\n  try {\n    if (responseStatus === void 0) return value instanceof NativeResponse;\n    reflectApply(responseStatus, value, []);\n    return true;\n  } catch {\n    return false;\n  }\n}\nvar state = {\n  handler: null,\n  onError: null,\n  requests: new AsyncLocalStorage(),\n  lastResort,\n  isResponse\n};\nglobals[RUNTIME_KEY] = state;\nglobals[CONTEXT_KEY] = /* @__PURE__ */ new WeakMap();\nvar rootDomain = typeof bindings.NARO_ROOT_DOMAIN === "string" ? bindings.NARO_ROOT_DOMAIN : "";\nvar naroUrl = typeof bindings.NARO_URL === "string" ? bindings.NARO_URL : "";\nvar originalFetch = globalThis.fetch.bind(globalThis);\nasync function naroFetch(input, init) {\n  const store = state.requests.getStore();\n  if (store === void 0) return originalFetch(input, init);\n  let host;\n  try {\n    host = new URL(input instanceof Request ? input.url : String(input)).hostname;\n  } catch {\n    return originalFetch(input, init);\n  }\n  if (!isNaroHost(host, rootDomain, naroUrl)) return originalFetch(input, init);\n  const request = new Request(input, init);\n  const headers = new Headers(request.headers);\n  headers.set("x-naro-fn-hop", String(store.hop + 1));\n  headers.set("x-naro-trace-id", store.traceId);\n  return originalFetch(new Request(request, { headers }));\n}\nglobalThis.fetch = naroFetch;\nvar addListener = EventTarget.prototype.addEventListener;\nvar removeListener = EventTarget.prototype.removeEventListener;\nvar standIns = /* @__PURE__ */ new WeakMap();\nfunction standInFor(socket, listener, store) {\n  let listeners = standIns.get(socket);\n  if (listeners === void 0)\n    standIns.set(socket, listeners = /* @__PURE__ */ new WeakMap());\n  let standIn = listeners.get(listener);\n  if (standIn === void 0) {\n    standIn = function(event) {\n      state.requests.run(\n        store,\n        () => typeof listener === "function" ? Reflect.apply(listener, this, [event]) : listener.handleEvent(event)\n      );\n    };\n    listeners.set(listener, standIn);\n  }\n  return standIn;\n}\nObject.defineProperties(WebSocket.prototype, {\n  addEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const store = state.requests.getStore();\n      const runs = store !== void 0 && listener !== null && (typeof listener === "function" || typeof listener === "object");\n      return Reflect.apply(addListener, this, [\n        type,\n        runs ? standInFor(this, listener, store) : listener,\n        ...rest\n      ]);\n    }\n  },\n  removeEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const standIn = typeof listener === "function" || typeof listener === "object" && listener !== null ? standIns.get(this)?.get(listener) : void 0;\n      return Reflect.apply(removeListener, this, [\n        type,\n        standIn ?? listener,\n        ...rest\n      ]);\n    }\n  }\n});\nvar ON_EVENTS = ["onopen", "onmessage", "onclose", "onerror"];\nvar onHandlers = /* @__PURE__ */ new WeakMap();\nfunction nativeAccessor(target, name) {\n  for (let at = target; at !== null; at = Object.getPrototypeOf(at)) {\n    const descriptor = Object.getOwnPropertyDescriptor(at, name);\n    if (descriptor === void 0) continue;\n    return descriptor.get !== void 0 && descriptor.set !== void 0 ? { get: descriptor.get, set: descriptor.set } : void 0;\n  }\n  return void 0;\n}\nfor (const name of ON_EVENTS) {\n  const native = nativeAccessor(WebSocket.prototype, name);\n  Object.defineProperty(WebSocket.prototype, name, {\n    configurable: true,\n    enumerable: true,\n    get() {\n      const set = onHandlers.get(this)?.get(name);\n      if (set === void 0)\n        return native === void 0 ? void 0 : Reflect.apply(native.get, this, []);\n      return state.requests.getStore() === void 0 ? set.standIn : set.handler;\n    },\n    set(handler) {\n      const store = state.requests.getStore();\n      const standIn = store !== void 0 && typeof handler === "function" ? standInFor(this, handler, store) : handler;\n      let handlers = onHandlers.get(this);\n      if (handlers === void 0) onHandlers.set(this, handlers = /* @__PURE__ */ new Map());\n      handlers.set(name, { handler, standIn });\n      if (native !== void 0) Reflect.apply(native.set, this, [standIn]);\n    }\n  });\n}\nfunction serve(first, second) {\n  const options = typeof first === "function" ? {} : first ?? {};\n  const handler = typeof first === "function" ? first : second ?? options.handler;\n  if (typeof handler !== "function")\n    throw new TypeError("Deno.serve needs a handler.");\n  state.handler = handler;\n  state.onError = typeof options.onError === "function" ? options.onError : null;\n  return {\n    finished: new Promise(() => {\n    }),\n    shutdown: () => Promise.resolve()\n  };\n}\nfunction textBindings() {\n  const out = {};\n  for (const [name, value] of Object.entries(bindings))\n    if (typeof value === "string") out[name] = value;\n  return out;\n}\nvar build = Object.freeze({\n  os: "linux",\n  arch: "x86_64",\n  target: "x86_64-unknown-linux-gnu",\n  vendor: "unknown",\n  env: "gnu"\n});\nvar version = Object.freeze({\n  deno: "2.1.4",\n  v8: "13.0.245.12",\n  typescript: "5.6.2"\n});\nvar DENO_ERROR_NAMES = [\n  "NotFound",\n  "PermissionDenied",\n  "ConnectionRefused",\n  "ConnectionReset",\n  "ConnectionAborted",\n  "NotConnected",\n  "AddrInUse",\n  "AddrNotAvailable",\n  "BrokenPipe",\n  "AlreadyExists",\n  "InvalidData",\n  "TimedOut",\n  "Interrupted",\n  "WriteZero",\n  "WouldBlock",\n  "UnexpectedEof",\n  "BadResource",\n  "Http",\n  "Busy",\n  "NotSupported",\n  "FilesystemLoop",\n  "IsADirectory",\n  "NetworkUnreachable",\n  "NotADirectory",\n  "NotCapable"\n];\nfunction denoError(name) {\n  const made = { [name]: class extends Error {\n  } }[name];\n  Object.defineProperty(made.prototype, "name", {\n    configurable: true,\n    writable: true,\n    value: name\n  });\n  return made;\n}\nvar errors = Object.freeze(\n  Object.fromEntries(DENO_ERROR_NAMES.map((name) => [name, denoError(name)]))\n);\nvar deno = {\n  serve,\n  env: {\n    get: (name) => {\n      const value = bindings[name];\n      return typeof value === "string" ? value : void 0;\n    },\n    has: (name) => typeof bindings[name] === "string",\n    toObject: () => textBindings(),\n    set: () => {\n      throw new Error("Deno.env.set is not available on Naro Functions.");\n    },\n    delete: () => {\n      throw new Error("Deno.env.delete is not available on Naro Functions.");\n    }\n  },\n  build,\n  version,\n  errors\n};\nvar PROBES = /* @__PURE__ */ new Set(["then", "toJSON"]);\nglobals.Deno = new Proxy(deno, {\n  get(target, property) {\n    if (typeof property === "symbol" || PROBES.has(property)) return void 0;\n    if (Object.hasOwn(target, property)) return target[property];\n    return () => {\n      throw new Error(`Deno.${property} is not available on Naro Functions.`);\n    };\n  }\n});\nglobals.EdgeRuntime = {\n  waitUntil(promise) {\n    const logged = loggedRejection(promise, functionName);\n    state.requests.getStore()?.ctx.waitUntil(logged);\n    return promise;\n  }\n};\naddEventListener("unhandledrejection", (event) => {\n  event.preventDefault();\n  console.error(\n    `naro functions: ${functionName} unhandled rejection`,\n    event.reason\n  );\n});\n';
-var NARO_BOOT_SOURCE = '// src/naro-boot.ts\nimport "./naro-shim.js";\nimport * as user from "./user.js";\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar SHIM_FIRST = "The Naro functions shim must be imported before the wrapper.";\nfunction globals() {\n  return globalThis;\n}\nfunction runtimeState() {\n  const state2 = globals()[RUNTIME_KEY];\n  if (state2 === void 0) throw new Error(SHIM_FIRST);\n  return state2;\n}\n\n// src/naro-boot.ts\nvar BOOT_PATH = "/__naro/boot";\nvar state = runtimeState();\nfunction hasHandler(exported) {\n  if (state.handler !== null) return true;\n  if (typeof exported === "function") return true;\n  return typeof exported === "object" && exported !== null && typeof exported.fetch === "function";\n}\nvar naro_boot_default = {\n  fetch(request) {\n    if (new URL(request.url).pathname !== BOOT_PATH)\n      return new Response("Not found", { status: 404 });\n    return Response.json({ handler: hasHandler(user.default) });\n  }\n};\nexport {\n  naro_boot_default as default\n};\n';
+var NARO_SHIM_SOURCE = '// src/naro-shim.ts\nimport { AsyncLocalStorage } from "node:async_hooks";\nimport { env } from "cloudflare:workers";\n\n// src/hosts.ts\nfunction bareHost(host) {\n  return host.toLowerCase().replace(/\\.+$/, "");\n}\nfunction isNaroHost(hostname, rootDomain2, naroUrl2) {\n  const host = bareHost(hostname);\n  if (host === "") return false;\n  const root = rootDomain2.toLowerCase().replace(/^\\.+|\\.+$/g, "");\n  if (root !== "" && host.endsWith(`.${root}`)) return true;\n  if (naroUrl2 === "") return false;\n  try {\n    return bareHost(new URL(naroUrl2).hostname) === host;\n  } catch {\n    return false;\n  }\n}\n\n// src/redact.ts\nvar MIN_REDACTED_LENGTH = 8;\nvar REDACTED = "[redacted]";\nfunction isSecretBinding(name) {\n  return name === "NARO_SERVICE_KEY" || !name.startsWith("NARO_") && name !== "DB";\n}\nfunction secretValues(bindings2) {\n  const values = /* @__PURE__ */ new Set();\n  for (const [name, value] of Object.entries(bindings2)) {\n    if (typeof value !== "string" || value.length < MIN_REDACTED_LENGTH)\n      continue;\n    if (!isSecretBinding(name)) continue;\n    values.add(value);\n    values.add(JSON.stringify(value).slice(1, -1));\n  }\n  return [...values].toSorted(\n    (left, right) => right.length - left.length || (left < right ? -1 : left > right ? 1 : 0)\n  );\n}\nfunction redactText(text, secrets2) {\n  const spans = [];\n  for (const secret of secrets2) {\n    if (secret === "") continue;\n    let last;\n    for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1)) {\n      if (last !== void 0 && at <= last[1]) last[1] = at + secret.length;\n      else spans.push(last = [at, at + secret.length]);\n    }\n  }\n  if (spans.length === 0) return text;\n  const ordered = spans.toSorted((left, right) => left[0] - right[0]);\n  let out = "";\n  let kept = 0;\n  let [start, end] = ordered[0];\n  for (const [nextStart, nextEnd] of ordered) {\n    if (nextStart <= end) {\n      end = Math.max(end, nextEnd);\n      continue;\n    }\n    out += text.slice(kept, start) + REDACTED;\n    kept = end;\n    start = nextStart;\n    end = nextEnd;\n  }\n  return out + text.slice(kept, start) + REDACTED + text.slice(end);\n}\nfunction stringOf(value) {\n  try {\n    return String(value);\n  } catch {\n    return void 0;\n  }\n}\nfunction withHead(stack, head) {\n  if (stack === head || stack.startsWith(`${head}\n`)) return stack;\n  const frames = stack.indexOf("\\n    at ");\n  return frames === -1 ? `${head}\n${stack}` : `${head}${stack.slice(frames)}`;\n}\nfunction redactError(error, secrets2) {\n  const stack = typeof error.stack === "string" ? error.stack : `${error.name}: ${error.message}`;\n  const head = stringOf(error);\n  let json;\n  try {\n    json = JSON.stringify(error);\n  } catch {\n    json = void 0;\n  }\n  const cleanStack = redactText(stack, secrets2);\n  const cleanHead = head === void 0 ? void 0 : redactText(head, secrets2);\n  const cleanJson = json === void 0 ? void 0 : redactText(json, secrets2);\n  if (cleanStack === stack && head !== void 0 && cleanHead === head && json !== void 0 && cleanJson === json)\n    return error;\n  const text = cleanHead === void 0 ? cleanStack : withHead(cleanStack, cleanHead);\n  return cleanJson === void 0 || cleanJson === "{}" ? text : `${text}\n${cleanJson}`;\n}\nfunction isPlain(value) {\n  if (Array.isArray(value)) return true;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\nfunction redactArg(arg, secrets2) {\n  if (typeof arg === "string") return redactText(arg, secrets2);\n  if (arg === null || typeof arg !== "object" && typeof arg !== "function")\n    return arg;\n  try {\n    if (arg instanceof Error) return redactError(arg, secrets2);\n    let json;\n    try {\n      json = JSON.stringify(arg);\n    } catch {\n      return redactText(String(arg), secrets2);\n    }\n    if (json !== void 0) {\n      const clean2 = redactText(json, secrets2);\n      if (clean2 !== json) return clean2;\n    }\n    if (isPlain(arg)) return arg;\n    const text = stringOf(arg);\n    if (text === void 0) return arg;\n    const clean = redactText(text, secrets2);\n    return clean === text ? arg : clean;\n  } catch {\n    return REDACTED;\n  }\n}\nfunction redactArgs(args, secrets2) {\n  if (secrets2.length === 0) return [...args];\n  return args.map((arg) => redactArg(arg, secrets2));\n}\n\n// src/rejections.ts\nfunction loggedRejection(promise, name) {\n  return Promise.resolve(promise).then(\n    () => void 0,\n    (error) => {\n      console.error(`naro functions: ${name} waitUntil rejected`, error);\n    }\n  );\n}\n\n// src/respond.ts\nvar FUNCTION_EXPOSE_HEADERS = [\n  "x-relay-error",\n  "x-naro-trace-id",\n  "retry-after",\n  "x-retry-after"\n];\nvar WRAPPER_ERRORS = {\n  FUNCTION_ERROR: "The function threw an error. See `naro functions logs {name}`.",\n  FUNCTION_NO_HANDLER: "The function has no handler. Call Deno.serve(handler) or export default { fetch }.",\n  FUNCTION_MISROUTED: "This function was reached without the Naro gateway.",\n  FUNCTION_NOT_FOUND: "Function {name} was not found."\n};\nfunction appendExposeHeaders(value) {\n  const listed = (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "");\n  const seen = new Set(listed.map((part) => part.toLowerCase()));\n  for (const name of FUNCTION_EXPOSE_HEADERS)\n    if (!seen.has(name)) listed.push(name);\n  return listed.join(", ");\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar CONTEXT_KEY = /* @__PURE__ */ Symbol.for("naro.functions.context");\n\n// src/naro-shim.ts\nvar bindings = env;\nvar globals = globalThis;\nfunction callName() {\n  return state.requests.getStore()?.name ?? "";\n}\nvar secrets = secretValues(bindings);\nfor (const level of ["log", "info", "warn", "error", "debug"]) {\n  const original = console[level].bind(console);\n  console[level] = (...args) => {\n    original(...redactArgs(args, secrets));\n  };\n}\nvar logError = console.error;\nvar NativeResponse = Response;\nvar bareRecord = Object.create;\nvar NAME_SLOT = "\\0";\nvar [failedHead = "", failedTail = ""] = JSON.stringify({\n  data: null,\n  error: {\n    code: "FUNCTION_ERROR",\n    message: WRAPPER_ERRORS.FUNCTION_ERROR.replace("{name}", () => NAME_SLOT)\n  }\n}).split(JSON.stringify(NAME_SLOT).slice(1, -1));\nvar exposedHeaders = appendExposeHeaders(null);\nfunction lastResort(error, traceId, name) {\n  try {\n    logError(`naro functions: ${name} threw`, error);\n  } catch {\n  }\n  const headers = bareRecord(null);\n  headers["content-type"] = "application/json";\n  headers["access-control-allow-origin"] = "*";\n  headers["access-control-expose-headers"] = exposedHeaders;\n  headers["cache-control"] = "no-store";\n  if (traceId !== null) headers["x-naro-trace-id"] = traceId;\n  const init = bareRecord(null);\n  init.status = 500;\n  init.headers = headers;\n  return new NativeResponse(\n    failedHead + name + failedTail,\n    init\n  );\n}\nvar reflectApply = Reflect.apply;\nvar responseStatus = Object.getOwnPropertyDescriptor(\n  NativeResponse.prototype,\n  "status"\n)?.get;\nfunction isResponse(value) {\n  if (typeof value !== "object" || value === null) return false;\n  try {\n    if (responseStatus === void 0) return value instanceof NativeResponse;\n    reflectApply(responseStatus, value, []);\n    return true;\n  } catch {\n    return false;\n  }\n}\nvar state = {\n  router: null,\n  registered: null,\n  requests: new AsyncLocalStorage(),\n  lastResort,\n  isResponse\n};\nglobals[RUNTIME_KEY] = state;\nglobals[CONTEXT_KEY] = /* @__PURE__ */ new WeakMap();\nvar rootDomain = typeof bindings.NARO_ROOT_DOMAIN === "string" ? bindings.NARO_ROOT_DOMAIN : "";\nvar naroUrl = typeof bindings.NARO_URL === "string" ? bindings.NARO_URL : "";\nvar originalFetch = globalThis.fetch.bind(globalThis);\nasync function naroFetch(input, init) {\n  const store = state.requests.getStore();\n  if (store === void 0) return originalFetch(input, init);\n  let host;\n  try {\n    host = new URL(input instanceof Request ? input.url : String(input)).hostname;\n  } catch {\n    return originalFetch(input, init);\n  }\n  if (!isNaroHost(host, rootDomain, naroUrl)) return originalFetch(input, init);\n  const request = new Request(input, init);\n  const headers = new Headers(request.headers);\n  headers.set("x-naro-fn-hop", String(store.hop + 1));\n  headers.set("x-naro-trace-id", store.traceId);\n  return originalFetch(new Request(request, { headers }));\n}\nglobalThis.fetch = naroFetch;\nvar addListener = EventTarget.prototype.addEventListener;\nvar removeListener = EventTarget.prototype.removeEventListener;\nvar standIns = /* @__PURE__ */ new WeakMap();\nfunction standInFor(socket, listener, store) {\n  let listeners = standIns.get(socket);\n  if (listeners === void 0)\n    standIns.set(socket, listeners = /* @__PURE__ */ new WeakMap());\n  let standIn = listeners.get(listener);\n  if (standIn === void 0) {\n    standIn = function(event) {\n      state.requests.run(\n        store,\n        () => typeof listener === "function" ? Reflect.apply(listener, this, [event]) : listener.handleEvent(event)\n      );\n    };\n    listeners.set(listener, standIn);\n  }\n  return standIn;\n}\nObject.defineProperties(WebSocket.prototype, {\n  addEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const store = state.requests.getStore();\n      const runs = store !== void 0 && listener !== null && (typeof listener === "function" || typeof listener === "object");\n      return Reflect.apply(addListener, this, [\n        type,\n        runs ? standInFor(this, listener, store) : listener,\n        ...rest\n      ]);\n    }\n  },\n  removeEventListener: {\n    configurable: true,\n    writable: true,\n    value(type, listener, ...rest) {\n      const standIn = typeof listener === "function" || typeof listener === "object" && listener !== null ? standIns.get(this)?.get(listener) : void 0;\n      return Reflect.apply(removeListener, this, [\n        type,\n        standIn ?? listener,\n        ...rest\n      ]);\n    }\n  }\n});\nvar ON_EVENTS = ["onopen", "onmessage", "onclose", "onerror"];\nvar onHandlers = /* @__PURE__ */ new WeakMap();\nfunction nativeAccessor(target, name) {\n  for (let at = target; at !== null; at = Object.getPrototypeOf(at)) {\n    const descriptor = Object.getOwnPropertyDescriptor(at, name);\n    if (descriptor === void 0) continue;\n    return descriptor.get !== void 0 && descriptor.set !== void 0 ? { get: descriptor.get, set: descriptor.set } : void 0;\n  }\n  return void 0;\n}\nfor (const name of ON_EVENTS) {\n  const native = nativeAccessor(WebSocket.prototype, name);\n  Object.defineProperty(WebSocket.prototype, name, {\n    configurable: true,\n    enumerable: true,\n    get() {\n      const set = onHandlers.get(this)?.get(name);\n      if (set === void 0)\n        return native === void 0 ? void 0 : Reflect.apply(native.get, this, []);\n      return state.requests.getStore() === void 0 ? set.standIn : set.handler;\n    },\n    set(handler) {\n      const store = state.requests.getStore();\n      const standIn = store !== void 0 && typeof handler === "function" ? standInFor(this, handler, store) : handler;\n      let handlers = onHandlers.get(this);\n      if (handlers === void 0) onHandlers.set(this, handlers = /* @__PURE__ */ new Map());\n      handlers.set(name, { handler, standIn });\n      if (native !== void 0) Reflect.apply(native.set, this, [standIn]);\n    }\n  });\n}\nfunction serve(first, second) {\n  const options = typeof first === "function" ? {} : first ?? {};\n  const handler = typeof first === "function" ? first : second ?? options.handler;\n  if (typeof handler !== "function")\n    throw new TypeError("Deno.serve needs a handler.");\n  const onError = typeof options.onError === "function" ? options.onError : null;\n  if (state.requests.getStore() === void 0) {\n    if (state.router !== null) state.router.register(handler, onError);\n    else state.registered = { handler, onError };\n  }\n  return {\n    finished: new Promise(() => {\n    }),\n    shutdown: () => Promise.resolve()\n  };\n}\nfunction textBindings() {\n  const out = {};\n  for (const [name, value] of Object.entries(bindings))\n    if (typeof value === "string") out[name] = value;\n  return out;\n}\nvar build = Object.freeze({\n  os: "linux",\n  arch: "x86_64",\n  target: "x86_64-unknown-linux-gnu",\n  vendor: "unknown",\n  env: "gnu"\n});\nvar version = Object.freeze({\n  deno: "2.1.4",\n  v8: "13.0.245.12",\n  typescript: "5.6.2"\n});\nvar DENO_ERROR_NAMES = [\n  "NotFound",\n  "PermissionDenied",\n  "ConnectionRefused",\n  "ConnectionReset",\n  "ConnectionAborted",\n  "NotConnected",\n  "AddrInUse",\n  "AddrNotAvailable",\n  "BrokenPipe",\n  "AlreadyExists",\n  "InvalidData",\n  "TimedOut",\n  "Interrupted",\n  "WriteZero",\n  "WouldBlock",\n  "UnexpectedEof",\n  "BadResource",\n  "Http",\n  "Busy",\n  "NotSupported",\n  "FilesystemLoop",\n  "IsADirectory",\n  "NetworkUnreachable",\n  "NotADirectory",\n  "NotCapable"\n];\nfunction denoError(name) {\n  const made = { [name]: class extends Error {\n  } }[name];\n  Object.defineProperty(made.prototype, "name", {\n    configurable: true,\n    writable: true,\n    value: name\n  });\n  return made;\n}\nvar errors = Object.freeze(\n  Object.fromEntries(DENO_ERROR_NAMES.map((name) => [name, denoError(name)]))\n);\nvar deno = {\n  serve,\n  env: {\n    get: (name) => {\n      const value = bindings[name];\n      return typeof value === "string" ? value : void 0;\n    },\n    has: (name) => typeof bindings[name] === "string",\n    toObject: () => textBindings(),\n    set: () => {\n      throw new Error("Deno.env.set is not available on Naro Functions.");\n    },\n    delete: () => {\n      throw new Error("Deno.env.delete is not available on Naro Functions.");\n    }\n  },\n  build,\n  version,\n  errors\n};\nvar PROBES = /* @__PURE__ */ new Set(["then", "toJSON"]);\nglobals.Deno = new Proxy(deno, {\n  get(target, property) {\n    if (typeof property === "symbol" || PROBES.has(property)) return void 0;\n    if (Object.hasOwn(target, property)) return target[property];\n    return () => {\n      throw new Error(`Deno.${property} is not available on Naro Functions.`);\n    };\n  }\n});\nglobals.EdgeRuntime = {\n  waitUntil(promise) {\n    const logged = loggedRejection(promise, callName());\n    state.requests.getStore()?.ctx.waitUntil(logged);\n    return promise;\n  }\n};\naddEventListener("unhandledrejection", (event) => {\n  event.preventDefault();\n  console.error(\n    `naro functions: ${callName()} unhandled rejection`,\n    event.reason\n  );\n});\n';
+var NARO_BOOT_SOURCE = '// src/naro-boot.ts\nimport "./naro-shim.js";\nimport * as user from "./user.js";\n\n// src/choose.ts\nasync function serveWithInfo(registered, request) {\n  let complete;\n  const info = {\n    remoteAddr: {\n      transport: "tcp",\n      hostname: request.headers.get("cf-connecting-ip") ?? "0.0.0.0",\n      port: 0\n    },\n    completed: new Promise((resolve) => {\n      complete = resolve;\n    })\n  };\n  try {\n    return await registered(request, info);\n  } finally {\n    complete();\n  }\n}\nfunction chosenOf(registered, module) {\n  if (registered !== null) {\n    const handler = registered.handler;\n    return {\n      handler: async (request) => serveWithInfo(handler, request),\n      onError: registered.onError\n    };\n  }\n  const exported = module.default;\n  if (typeof exported === "object" && exported !== null) {\n    const fetchHandler = exported.fetch;\n    if (typeof fetchHandler === "function")\n      return {\n        handler: async (request, env, ctx) => fetchHandler.call(exported, request, env, ctx),\n        onError: null\n      };\n  }\n  if (typeof exported === "function") {\n    const prototype = exported.prototype;\n    if (typeof prototype === "object" && prototype !== null && typeof prototype.fetch === "function")\n      return {\n        handler: async (request, env, ctx) => new exported(ctx, env).fetch(request),\n        onError: null\n      };\n    return {\n      handler: async (request, env, ctx) => exported(request, env, ctx),\n      onError: null\n    };\n  }\n  return null;\n}\n\n// src/runtime-state.ts\nvar RUNTIME_KEY = /* @__PURE__ */ Symbol.for("naro.functions.runtime");\nvar SHIM_FIRST = "The Naro functions shim must be imported before the wrapper.";\nfunction globals() {\n  return globalThis;\n}\nfunction runtimeState() {\n  const state2 = globals()[RUNTIME_KEY];\n  if (state2 === void 0) throw new Error(SHIM_FIRST);\n  return state2;\n}\n\n// src/naro-boot.ts\nvar BOOT_PATH = "/__naro/boot";\nvar state = runtimeState();\nvar naro_boot_default = {\n  fetch(request) {\n    if (new URL(request.url).pathname !== BOOT_PATH)\n      return new Response("Not found", { status: 404 });\n    const module = user;\n    return Response.json({\n      handler: chosenOf(state.registered, module) !== null\n    });\n  }\n};\nexport {\n  naro_boot_default as default\n};\n';
 var FUNCTIONS_COMPATIBILITY_DATE = "2026-08-19";
 var FUNCTIONS_COMPATIBILITY_FLAGS = Object.freeze(["nodejs_compat", "global_fetch_strictly_public"]);
 
 // ../../packages/functions-bundler/src/bundle.ts
 var NARO_JS_FUNCTIONS = /Could not resolve "naro-js\/functions"/;
-var runtimeGzip;
-function runtimeCompressedBytes() {
-  runtimeGzip ??= gzipSync(NARO_ENTRY_SOURCE).byteLength + gzipSync(NARO_SHIM_SOURCE).byteLength;
-  return runtimeGzip;
-}
 function relativeLabel(root, file2) {
   return relative10(root, file2).split(sep9).join("/");
 }
@@ -36177,18 +36417,11 @@ async function bundleFunction(source, folder, options = {}) {
       BUNDLE_MESSAGES.tooLarge(source.name, bytes2, biggest)
     );
   }
-  const compressedBytes = gzipSync(output.contents).byteLength + runtimeCompressedBytes();
-  if (compressedBytes > (options.maxCompressedBytes ?? FUNCTION_COMPRESSED_BUNDLE_MAX_BYTES))
-    throw new FunctionBundleError(
-      "FUNCTION_BUNDLE_FAILED",
-      BUNDLE_MESSAGES.tooLargeCompressed(source.name, compressedBytes)
-    );
   return {
     name: source.name,
     code: output.text,
     contents: output.contents,
     bytes: bytes2,
-    compressedBytes,
     sha256: createHash4("sha256").update(output.contents).digest("hex"),
     warnings: [...state.warnings]
   };
@@ -36312,7 +36545,16 @@ function retryAfterSeconds(error51) {
   const value = error51.details?.retryAfter;
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.min(Math.ceil(value), FUNCTION_RATE_LIMIT_MAX_SECONDS) : FUNCTION_RATE_LIMIT_DEFAULT_SECONDS;
 }
+var functionWords = (name) => ({
+  rateLimited: (seconds, attempt, of) => `\u23F3 Cloudflare is rate limiting function uploads; trying ${name} again in ${String(seconds)} seconds (${String(attempt)}/${String(of)}).`,
+  busy: (attempt, of) => `\u23F3 ${name} is being changed right now; trying again in ${String(FUNCTION_BUSY_WAIT_MS / 1e3)} seconds (${String(attempt)}/${String(of)}).`
+});
+var batchRetryWords = (count2) => ({
+  rateLimited: (seconds, attempt, of) => `\u23F3 Cloudflare is rate limiting function uploads; trying the ${String(count2)} functions again in ${String(seconds)} seconds (${String(attempt)}/${String(of)}).`,
+  busy: (attempt, of) => `\u23F3 Functions in this project are being changed right now; trying again in ${String(FUNCTION_BUSY_WAIT_MS / 1e3)} seconds (${String(attempt)}/${String(of)}).`
+});
 async function withFunctionRetries(op, name, io) {
+  const words = typeof name === "string" ? functionWords(name) : name;
   const rateRetries = io.rateLimitRetries ?? FUNCTION_RETRIES;
   const busyRetries = io.busyRetries ?? FUNCTION_RETRIES;
   let rate = 0;
@@ -36325,17 +36567,13 @@ async function withFunctionRetries(op, name, io) {
       if (error51.code === "FUNCTIONS_RATE_LIMITED" && rate < rateRetries) {
         rate += 1;
         const seconds = retryAfterSeconds(error51);
-        io.log(
-          `\u23F3 Cloudflare is rate limiting function uploads; trying ${name} again in ${String(seconds)} seconds (${String(rate)}/${String(rateRetries)}).`
-        );
+        io.log(words.rateLimited(seconds, rate, rateRetries));
         await io.sleep(seconds * 1e3);
         continue;
       }
       if (error51.code === "FUNCTION_BUSY" && busy < busyRetries) {
         busy += 1;
-        io.log(
-          `\u23F3 ${name} is being changed right now; trying again in ${String(FUNCTION_BUSY_WAIT_MS / 1e3)} seconds (${String(busy)}/${String(busyRetries)}).`
-        );
+        io.log(words.busy(busy, busyRetries));
         await io.sleep(FUNCTION_BUSY_WAIT_MS);
         continue;
       }
@@ -36354,7 +36592,6 @@ var PER_FUNCTION_CODES = /* @__PURE__ */ new Set([
   "BUNDLE_MISSING",
   "BUNDLE_MISMATCH",
   "FUNCTION_LIMIT",
-  "FUNCTION_BUSY",
   "FUNCTION_NOT_FOUND",
   "VERSION_NOT_FOUND",
   "VERSION_NOT_DEPLOYABLE",
@@ -36384,16 +36621,20 @@ function uploadTimeoutMs(upload, now = Date.now()) {
 var SECRETS_LIST_TIMEOUT_MS = 45e3;
 var FUNCTION_CALL_TIMEOUT_MS = 12e4;
 var deadlineReached = (name, deadlineMs) => `Deploying ${name} reached the ${String(deadlineMs / 1e3)}-second limit before it went live; the live version did not change. Try again.`;
+var batchDeadlineReached = (count2, deadlineMs) => `Deploying ${String(count2)} functions reached the ${String(deadlineMs / 1e3)}-second limit before they went live; the live versions did not change. Try again.`;
 function budgetOf(options) {
   const { deadlineMs } = options;
   if (deadlineMs === void 0) return null;
   const now = options.now ?? Date.now;
   const end = now() + deadlineMs;
   return {
-    left(name, cap) {
+    left(name, cap, message) {
       const left = end - now();
       if (left <= 0)
-        throw new NaroError("TIMEOUT", deadlineReached(name, deadlineMs));
+        throw new NaroError(
+          "TIMEOUT",
+          message ?? deadlineReached(name, deadlineMs)
+        );
       return Math.min(cap, left);
     }
   };
@@ -36438,58 +36679,79 @@ async function projectSecretNames(client, projectId, timeoutMs) {
     return [];
   }
 }
-async function deployOne(options, folder, name, importMap, secretNames, io, budget) {
+function callLimit(budget, name, message) {
+  return budget ? { timeoutMs: budget.left(name, FUNCTION_CALL_TIMEOUT_MS, message) } : null;
+}
+async function prepareOne(options, folder, name, importMap, secretNames, io, budget) {
   const steps = options.steps ?? { bundle: bundleFunction, boot: bootCheck };
   const { client, projectId } = options;
-  const call = () => budget ? { timeoutMs: budget.left(name, FUNCTION_CALL_TIMEOUT_MS) } : null;
   io.log(`\u23F3 Deploying ${name}\u2026`);
-  try {
-    const source = readFunctionSource(folder, name);
-    const bundle = await steps.bundle(source, folder, { importMap });
-    for (const warning of bundle.warnings) io.log(warning);
-    if (!options.skipCheck)
-      await steps.boot(
-        name,
-        bundle.code,
-        budget ? {
-          secretNames,
-          timeoutMs: bootSeconds(budget.left(name, BOOT_TIMEOUT_MS))
-        } : { secretNames }
-      );
-    const verifyJwt = options.verifyJwt ?? source.verifyJwt ?? true;
-    const request2 = {
-      size: bundle.bytes,
-      sha256: bundle.sha256,
-      verifyJwt,
-      entrypoint: source.entrypoint,
-      ...options.cliVersion ? { cliVersion: options.cliVersion } : {}
-    };
-    const created = await withFunctionRetries(
-      () => {
-        const limit = call();
-        return limit ? client.functions.createVersion(projectId, name, request2, limit) : client.functions.createVersion(projectId, name, request2);
-      },
+  const source = readFunctionSource(folder, name);
+  const bundle = await steps.bundle(source, folder, { importMap });
+  for (const warning of bundle.warnings) io.log(warning);
+  if (!options.skipCheck)
+    await steps.boot(
       name,
-      io
-    );
-    const urlLife = uploadTimeoutMs(created.upload);
-    await putBundle(
-      options.fetch ?? fetch,
+      bundle.code,
+      budget ? {
+        secretNames,
+        timeoutMs: bootSeconds(budget.left(name, BOOT_TIMEOUT_MS))
+      } : { secretNames }
+    );
+  const verifyJwt = options.verifyJwt ?? source.verifyJwt ?? true;
+  const request2 = {
+    size: bundle.bytes,
+    sha256: bundle.sha256,
+    verifyJwt,
+    entrypoint: source.entrypoint,
+    ...options.cliVersion ? { cliVersion: options.cliVersion } : {}
+  };
+  const created = await withFunctionRetries(
+    () => {
+      const limit = callLimit(budget, name);
+      return limit ? client.functions.createVersion(projectId, name, request2, limit) : client.functions.createVersion(projectId, name, request2);
+    },
+    name,
+    io
+  );
+  const urlLife = uploadTimeoutMs(created.upload);
+  await putBundle(
+    options.fetch ?? fetch,
+    name,
+    created.upload,
+    bundle.contents,
+    budget ? budget.left(name, urlLife) : urlLife
+  );
+  return {
+    name,
+    versionId: created.version.id,
+    number: created.version.number,
+    url: created.function.url,
+    verifyJwt: created.version.verifyJwt
+  };
+}
+async function deployOne(options, folder, name, importMap, secretNames, io, budget) {
+  const { client, projectId } = options;
+  try {
+    const ready = await prepareOne(
+      options,
+      folder,
       name,
-      created.upload,
-      bundle.contents,
-      budget ? budget.left(name, urlLife) : urlLife
+      importMap,
+      secretNames,
+      io,
+      budget
     );
     const live = await withFunctionRetries(
       () => {
-        const limit = call();
-        return limit ? client.functions.deploy(projectId, name, created.version.id, limit) : client.functions.deploy(projectId, name, created.version.id);
+        const limit = callLimit(budget, name);
+        return limit ? client.functions.deploy(projectId, name, ready.versionId, limit) : client.functions.deploy(projectId, name, ready.versionId);
       },
       name,
       io
     );
     io.log(
-      `\u2705 Deployed ${name} (v${String(live.version ?? created.version.number)}) \u2014 ${live.url}`
+      `\u2705 Deployed ${name} (v${String(live.version ?? ready.number)}) \u2014 ${live.url}`
     );
     return {
       name,
@@ -36501,6 +36763,30 @@ async function deployOne(options, folder, name, importMap, secretNames, io, budg
     throw asNaroError(error51);
   }
 }
+async function deployReady(options, ready, io, budget) {
+  const { client, projectId, deadlineMs } = options;
+  const versions = ready.map(({ name, versionId }) => ({ name, versionId }));
+  const [only] = ready;
+  const one = ready.length === 1 && only !== void 0 ? only.name : null;
+  const late = deadlineMs === void 0 ? void 0 : one === null ? batchDeadlineReached(ready.length, deadlineMs) : deadlineReached(one, deadlineMs);
+  io.log(
+    one === null ? `\u23F3 Putting ${String(ready.length)} functions live in one upload\u2026` : `\u23F3 Putting ${one} live\u2026`
+  );
+  const { functions } = await withFunctionRetries(
+    () => {
+      const limit = callLimit(budget, one ?? "", late);
+      return limit ? client.functions.deployMany(projectId, versions, limit) : client.functions.deployMany(projectId, versions);
+    },
+    one ?? batchRetryWords(ready.length),
+    io
+  );
+  const live = new Map(functions.map((fn) => [fn.name, fn.version]));
+  return ready.map((fn) => {
+    const version3 = live.get(fn.name) ?? fn.number;
+    io.log(`\u2705 Deployed ${fn.name} (v${String(version3)}) \u2014 ${fn.url}`);
+    return { name: fn.name, version: version3, url: fn.url, verifyJwt: fn.verifyJwt };
+  });
+}
 function readFlagImportMap(options, folder) {
   if (options.importMap === void 0) return void 0;
   const file2 = resolve14(options.cwd, options.importMap);
@@ -36564,12 +36850,12 @@ async function deployFunctions(options) {
         )
       ]
     };
-  const deployed = [];
+  const ready = [];
   const failures = [];
   for (const name of names) {
     try {
-      deployed.push(
-        await deployOne(
+      ready.push(
+        await prepareOne(
           options,
           folder,
           name,
@@ -36579,14 +36865,23 @@ async function deployFunctions(options) {
           budget
         )
       );
-    } catch (error51) {
+    } catch (caught) {
+      const error51 = asNaroError(caught);
       if (!isNaroError(error51)) throw error51;
       if (!PER_FUNCTION_CODES.has(error51.code))
-        throw withProgress(error51, deployed, failures);
+        throw withProgress(error51, [], failures);
       failures.push({ name, code: error51.code, message: error51.message });
       io.log(`\u2717 ${name}: ${printable(error51.message)}`);
     }
   }
+  let deployed = [];
+  if (ready.length > 0)
+    try {
+      deployed = await deployReady(options, ready, io, budget);
+    } catch (error51) {
+      if (!isNaroError(error51)) throw error51;
+      throw withProgress(error51, [], failures);
+    }
   if (failures.length > 0)
     throw new NaroError(
       "FUNCTIONS_DEPLOY_PARTIAL",
@@ -37108,6 +37403,8 @@ export {
   formatRedirectEntry,
   policiesForTypes,
   generateTypes,
+  isSymbolicLink,
+  assertProjectLinkWritable,
   readProjectLink,
   writeProjectLink,
   removeProjectLink,