naro-cli 0.11.0 → 0.12.0

package/dist/{chunk-L7JOGWP3.js → chunk-GFCG5C7D.js}

@@ -7,7 +7,7 @@ import {
 import { existsSync as existsSync7 } from "fs";
 import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm3 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname4, join as join24, resolve as resolve9 } from "path";
+import { basename as basename3, dirname as dirname4, join as join24, resolve as resolve10 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -6730,13 +6730,13 @@ var error17 = () => {
           return `${sizing?.longLabel ?? "\u05D0\u05E8\u05D5\u05DA"} \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DB\u05D4 \u05DC\u05D4\u05DB\u05D9\u05DC ${issue2.maximum.toString()} ${sizing?.unit ?? ""} ${issue2.inclusive ? "\u05D0\u05D5 \u05E4\u05D7\u05D5\u05EA" : "\u05DC\u05DB\u05DC \u05D4\u05D9\u05D5\u05EA\u05E8"}`.trim();
         }
         if (issue2.origin === "number") {
-          const comparison = issue2.inclusive ? `\u05E7\u05D8\u05DF \u05D0\u05D5 \u05E9\u05D5\u05D5\u05D4 \u05DC-${issue2.maximum}` : `\u05E7\u05D8\u05DF \u05DE-${issue2.maximum}`;
-          return `\u05D2\u05D3\u05D5\u05DC \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D9\u05D5\u05EA ${comparison}`;
+          const comparison2 = issue2.inclusive ? `\u05E7\u05D8\u05DF \u05D0\u05D5 \u05E9\u05D5\u05D5\u05D4 \u05DC-${issue2.maximum}` : `\u05E7\u05D8\u05DF \u05DE-${issue2.maximum}`;
+          return `\u05D2\u05D3\u05D5\u05DC \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D9\u05D5\u05EA ${comparison2}`;
         }
         if (issue2.origin === "array" || issue2.origin === "set") {
           const verb = issue2.origin === "set" ? "\u05E6\u05E8\u05D9\u05DB\u05D4" : "\u05E6\u05E8\u05D9\u05DA";
-          const comparison = issue2.inclusive ? `${issue2.maximum} ${sizing?.unit ?? ""} \u05D0\u05D5 \u05E4\u05D7\u05D5\u05EA` : `\u05E4\u05D7\u05D5\u05EA \u05DE-${issue2.maximum} ${sizing?.unit ?? ""}`;
-          return `\u05D2\u05D3\u05D5\u05DC \u05DE\u05D3\u05D9: ${subject} ${verb} \u05DC\u05D4\u05DB\u05D9\u05DC ${comparison}`.trim();
+          const comparison2 = issue2.inclusive ? `${issue2.maximum} ${sizing?.unit ?? ""} \u05D0\u05D5 \u05E4\u05D7\u05D5\u05EA` : `\u05E4\u05D7\u05D5\u05EA \u05DE-${issue2.maximum} ${sizing?.unit ?? ""}`;
+          return `\u05D2\u05D3\u05D5\u05DC \u05DE\u05D3\u05D9: ${subject} ${verb} \u05DC\u05D4\u05DB\u05D9\u05DC ${comparison2}`.trim();
         }
         const adj = issue2.inclusive ? "<=" : "<";
         const be = verbFor(issue2.origin ?? "value");
@@ -6752,8 +6752,8 @@ var error17 = () => {
           return `${sizing?.shortLabel ?? "\u05E7\u05E6\u05E8"} \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DB\u05D4 \u05DC\u05D4\u05DB\u05D9\u05DC ${issue2.minimum.toString()} ${sizing?.unit ?? ""} ${issue2.inclusive ? "\u05D0\u05D5 \u05D9\u05D5\u05EA\u05E8" : "\u05DC\u05E4\u05D7\u05D5\u05EA"}`.trim();
         }
         if (issue2.origin === "number") {
-          const comparison = issue2.inclusive ? `\u05D2\u05D3\u05D5\u05DC \u05D0\u05D5 \u05E9\u05D5\u05D5\u05D4 \u05DC-${issue2.minimum}` : `\u05D2\u05D3\u05D5\u05DC \u05DE-${issue2.minimum}`;
-          return `\u05E7\u05D8\u05DF \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D9\u05D5\u05EA ${comparison}`;
+          const comparison2 = issue2.inclusive ? `\u05D2\u05D3\u05D5\u05DC \u05D0\u05D5 \u05E9\u05D5\u05D5\u05D4 \u05DC-${issue2.minimum}` : `\u05D2\u05D3\u05D5\u05DC \u05DE-${issue2.minimum}`;
+          return `\u05E7\u05D8\u05DF \u05DE\u05D3\u05D9: ${subject} \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D9\u05D5\u05EA ${comparison2}`;
         }
         if (issue2.origin === "array" || issue2.origin === "set") {
           const verb = issue2.origin === "set" ? "\u05E6\u05E8\u05D9\u05DB\u05D4" : "\u05E6\u05E8\u05D9\u05DA";
@@ -6761,8 +6761,8 @@ var error17 = () => {
             const singularPhrase = issue2.origin === "set" ? "\u05DC\u05E4\u05D7\u05D5\u05EA \u05E4\u05E8\u05D9\u05D8 \u05D0\u05D7\u05D3" : "\u05DC\u05E4\u05D7\u05D5\u05EA \u05E4\u05E8\u05D9\u05D8 \u05D0\u05D7\u05D3";
             return `\u05E7\u05D8\u05DF \u05DE\u05D3\u05D9: ${subject} ${verb} \u05DC\u05D4\u05DB\u05D9\u05DC ${singularPhrase}`;
           }
-          const comparison = issue2.inclusive ? `${issue2.minimum} ${sizing?.unit ?? ""} \u05D0\u05D5 \u05D9\u05D5\u05EA\u05E8` : `\u05D9\u05D5\u05EA\u05E8 \u05DE-${issue2.minimum} ${sizing?.unit ?? ""}`;
-          return `\u05E7\u05D8\u05DF \u05DE\u05D3\u05D9: ${subject} ${verb} \u05DC\u05D4\u05DB\u05D9\u05DC ${comparison}`.trim();
+          const comparison2 = issue2.inclusive ? `${issue2.minimum} ${sizing?.unit ?? ""} \u05D0\u05D5 \u05D9\u05D5\u05EA\u05E8` : `\u05D9\u05D5\u05EA\u05E8 \u05DE-${issue2.minimum} ${sizing?.unit ?? ""}`;
+          return `\u05E7\u05D8\u05DF \u05DE\u05D3\u05D9: ${subject} ${verb} \u05DC\u05D4\u05DB\u05D9\u05DC ${comparison2}`.trim();
         }
         const adj = issue2.inclusive ? ">=" : ">";
         const be = verbFor(issue2.origin ?? "value");
@@ -7967,8 +7967,8 @@ function ko_default() {
 }
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/locales/lt.js
-var capitalizeFirstCharacter = (text) => {
-  return text.charAt(0).toUpperCase() + text.slice(1);
+var capitalizeFirstCharacter = (text2) => {
+  return text2.charAt(0).toUpperCase() + text2.slice(1);
 };
 function getUnitTypeFromNumber(number4) {
   const abs = Math.abs(number4);
@@ -14939,7 +14939,238 @@ var connectRepositorySchema = external_exports.object({
 });
 
 // ../../packages/core/src/sql-classifier.ts
+var WORD_START = /[A-Za-z_\u0080-\uffff]/;
+var WORD_PART = /[A-Za-z0-9_$\u0080-\uffff]/;
+var DIGIT = /[0-9]/;
+var HEX = /[0-9A-Fa-f]/;
+var NUMBER_PART = /[0-9A-Za-z_.]/;
+var SPACE = /[ \t\n\r\f]/;
+var ISSPACE = /[ \t\n\r\f\v]/;
 var NUL = String.fromCharCode(0);
+var BOM = 65279;
+var PRAGMA_PREFIX = "PRAGMA_";
+function asciiUpper(text2) {
+  return text2.replace(/[a-z]+/g, (run) => run.toUpperCase());
+}
+function pragmaCandidate(sql, start, end, doubled) {
+  const prefix = sql.slice(start + 1, start + 1 + PRAGMA_PREFIX.length);
+  if (asciiUpper(prefix) !== PRAGMA_PREFIX) return "";
+  const inner = sql.slice(start + 1, end - 1);
+  return asciiUpper(
+    doubled === null ? inner : inner.split(doubled + doubled).join(doubled)
+  );
+}
+function readDoubled(sql, start, delimiter) {
+  let i = start;
+  for (; ; ) {
+    const close = sql.indexOf(delimiter, i);
+    if (close < 0) return -1;
+    if (sql.charAt(close + 1) === delimiter) {
+      i = close + 2;
+      continue;
+    }
+    return close + 1;
+  }
+}
+function withoutExplain(tokens) {
+  if (!isWord(tokens[0], "EXPLAIN")) return tokens;
+  return tokens.slice(
+    isWord(tokens[1], "QUERY") && isWord(tokens[2], "PLAN") ? 3 : 1
+  );
+}
+function isCreateTrigger(tokens) {
+  const rest = withoutExplain(tokens);
+  if (!isWord(rest[0], "CREATE")) return false;
+  const second = rest[1];
+  if (isWord(second, "TRIGGER")) return true;
+  return (isWord(second, "TEMP") || isWord(second, "TEMPORARY")) && isWord(rest[2], "TRIGGER");
+}
+function lex(sql, names = false) {
+  const statements = [];
+  const spans = [];
+  let current = [];
+  let tokenStart = 0;
+  let currentStart = 0;
+  const push = (token) => {
+    if (current.length === 0) currentStart = tokenStart;
+    current.push(token);
+  };
+  let triggerBody = false;
+  let afterBodySemicolon = -1;
+  const fail2 = (reason) => ({
+    ok: false,
+    reason,
+    statements: statements.length + 1
+  });
+  if (sql.includes(NUL)) return fail2("NUL byte in SQL");
+  let i = 0;
+  while (i < sql.length) {
+    tokenStart = i;
+    const c = sql.charAt(i);
+    const next = sql.charAt(i + 1);
+    if (c === "\v") return fail2("illegal control character");
+    if (SPACE.test(c)) {
+      i += 1;
+      while (i < sql.length && ISSPACE.test(sql.charAt(i))) i += 1;
+      continue;
+    }
+    if (sql.charCodeAt(i) === BOM) {
+      i += 1;
+      continue;
+    }
+    if (c === "-" && next === "-") {
+      const end = sql.indexOf("\n", i + 2);
+      i = end < 0 ? sql.length : end;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      if (end < 0) return fail2("unterminated block comment");
+      i = end + 2;
+      continue;
+    }
+    if ((c === "x" || c === "X") && next === "'") {
+      let end = i + 2;
+      while (end < sql.length && HEX.test(sql.charAt(end))) end += 1;
+      if (sql.charAt(end) !== "'") return fail2("malformed blob literal");
+      push({ type: "blob" });
+      i = end + 1;
+      continue;
+    }
+    if (c === "'") {
+      const end = readDoubled(sql, i + 1, "'");
+      if (end < 0) return fail2("unterminated string literal");
+      push({
+        type: "string",
+        value: pragmaCandidate(sql, i, end, "'")
+      });
+      i = end;
+      continue;
+    }
+    if (c === '"' || c === "`") {
+      const end = readDoubled(sql, i + 1, c);
+      if (end < 0) return fail2("unterminated quoted identifier");
+      push({
+        type: "quoted",
+        value: pragmaCandidate(sql, i, end, c),
+        ...names ? {
+          name: sql.slice(i + 1, end - 1).split(c + c).join(c)
+        } : {}
+      });
+      i = end;
+      continue;
+    }
+    if (c === "[") {
+      const end = sql.indexOf("]", i + 1);
+      if (end < 0) return fail2("unterminated bracketed identifier");
+      push({
+        type: "quoted",
+        // No doubling inside brackets: the first `]` closes.
+        value: pragmaCandidate(sql, i, end + 1, null),
+        ...names ? { name: sql.slice(i + 1, end) } : {}
+      });
+      i = end + 1;
+      continue;
+    }
+    if (c === ";") {
+      if (triggerBody) {
+        afterBodySemicolon = current.length;
+      } else {
+        if (current.length > 0) {
+          statements.push(current);
+          spans.push({ start: currentStart, end: i });
+        }
+        current = [];
+      }
+      i += 1;
+      continue;
+    }
+    if (c === "(" || c === ")" || c === ",") {
+      push({ type: "punct", value: c });
+      i += 1;
+      continue;
+    }
+    if (WORD_START.test(c)) {
+      let end = i + 1;
+      while (end < sql.length && WORD_PART.test(sql.charAt(end))) end += 1;
+      const value = asciiUpper(sql.slice(i, end));
+      push({ type: "word", value });
+      if (triggerBody) {
+        if (value === "END" && current.length - 1 === afterBodySemicolon)
+          triggerBody = false;
+      } else if (value === "BEGIN" && isCreateTrigger(current)) {
+        triggerBody = true;
+        afterBodySemicolon = -1;
+      }
+      i = end;
+      continue;
+    }
+    if (DIGIT.test(c) || c === "." && DIGIT.test(next)) {
+      let end = i + 1;
+      while (end < sql.length && NUMBER_PART.test(sql.charAt(end))) end += 1;
+      push({ type: "number" });
+      i = end;
+      continue;
+    }
+    if (c === "?") {
+      let end = i + 1;
+      while (end < sql.length && DIGIT.test(sql.charAt(end))) end += 1;
+      push({ type: "other" });
+      i = end;
+      continue;
+    }
+    if (c === ":" || c === "@" || c === "$" || c === "#") {
+      let end = i + 1;
+      let nameChars = 0;
+      for (; ; ) {
+        const ch = sql.charAt(end);
+        if (ch !== "" && WORD_PART.test(ch)) {
+          nameChars += 1;
+          end += 1;
+          continue;
+        }
+        if (ch === ":" && sql.charAt(end + 1) === ":") {
+          end += 2;
+          continue;
+        }
+        if (ch === "(" && nameChars > 0) {
+          let close = end + 1;
+          while (close < sql.length && sql.charAt(close) !== ")" && !ISSPACE.test(sql.charAt(close)))
+            close += 1;
+          if (sql.charAt(close) !== ")")
+            return fail2("malformed bound-parameter suffix");
+          end = close + 1;
+        }
+        break;
+      }
+      push({ type: "other" });
+      i = end;
+      continue;
+    }
+    push(names ? { type: "other", char: c } : { type: "other" });
+    i += 1;
+  }
+  if (current.length > 0) {
+    statements.push(current);
+    spans.push({ start: currentStart, end: sql.length });
+  }
+  return { ok: true, statements, spans };
+}
+function isWord(token, value) {
+  return token?.type === "word" && (value === void 0 || token.value === value);
+}
+function splitStatements(sql) {
+  const lexed = lex(sql);
+  if (!lexed.ok) return { ok: false, reason: lexed.reason };
+  return {
+    ok: true,
+    statements: lexed.spans.map(({ start, end }) => ({
+      text: sql.slice(start, end),
+      start,
+      end
+    }))
+  };
+}
 
 // ../../packages/build/src/next-version.ts
 var NEXT_RELEASE_DATES = {
@@ -16853,7 +17084,7 @@ function createSmokeTester(options = {}) {
         }
       }
     );
-    const probes = [];
+    const probes2 = [];
     const withOutput = (reason) => recent.length > 0 ? `${reason} Last output: ${recent.join(" | ")}` : reason;
     try {
       const deadline = Date.now() + bootTimeoutMs;
@@ -16870,7 +17101,7 @@ function createSmokeTester(options = {}) {
             reason: withOutput(
               `The server exited with code ${String(exit.exited)} before answering a request.`
             ),
-            probes,
+            probes: probes2,
             // The port was free when allocated and taken by the time the
             // server bound it — a race, not a broken build.
             portTaken: recent.some(
@@ -16896,7 +17127,7 @@ function createSmokeTester(options = {}) {
           reason: withOutput(
             `The server did not answer within ${String(bootTimeoutMs)}ms (${lastError}).`
           ),
-          probes
+          probes: probes2
         };
       }
       for (const probe of request.probes) {
@@ -16906,24 +17137,24 @@ function createSmokeTester(options = {}) {
           probeTimeoutMs
         );
         const result = "status" in answer ? { ...probe, status: answer.status, ok: probeOk(answer.status) } : { ...probe, status: null, ok: false, detail: answer.error };
-        probes.push(result);
+        probes2.push(result);
         await observer.onLog({
           level: result.ok ? "INFO" : "ERROR",
           stage,
           message: `Smoke ${probe.label}: GET ${probe.path} -> ${result.status === null ? result.detail ?? "no response" : String(result.status)}`
         });
       }
-      const failed2 = probes.filter((probe) => !probe.ok);
+      const failed2 = probes2.filter((probe) => !probe.ok);
       if (failed2.length > 0) {
         return {
           ok: false,
-          reason: `${String(failed2.length)} of ${String(probes.length)} smoke probes failed: ${failed2.map(
+          reason: `${String(failed2.length)} of ${String(probes2.length)} smoke probes failed: ${failed2.map(
             (probe) => `${probe.path} (${probe.status === null ? probe.detail ?? "no response" : String(probe.status)})`
           ).join(", ")}.`,
-          probes
+          probes: probes2
         };
       }
-      return { ok: true, probes };
+      return { ok: true, probes: probes2 };
     } finally {
       await server.stop();
     }
@@ -16942,12 +17173,12 @@ function createSmokeTester(options = {}) {
   };
 }
 function defaultSmokeProbes(matcherRoutes) {
-  const probes = [{ path: "/", label: "root" }];
+  const probes2 = [{ path: "/", label: "root" }];
   for (const route of matcherRoutes) {
     if (route === "/") continue;
-    probes.push({ path: route, label: "middleware matcher" });
+    probes2.push({ path: route, label: "middleware matcher" });
   }
-  return probes;
+  return probes2;
 }
 
 // ../../packages/build/src/strategy/strategies/opennext-aws.ts
@@ -18514,8 +18745,8 @@ function sendPage(res, status, html) {
 async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
-  const codePromise = new Promise((resolve10, reject) => {
-    resolveCode = resolve10;
+  const codePromise = new Promise((resolve11, reject) => {
+    resolveCode = resolve11;
     rejectCode = reject;
   });
   const server = createServer2((req, res) => {
@@ -18544,7 +18775,7 @@ async function startCallbackServer() {
     sendPage(res, 200, successPage());
     resolveCode(code);
   });
-  await new Promise((resolve10) => server.listen(0, "127.0.0.1", resolve10));
+  await new Promise((resolve11) => server.listen(0, "127.0.0.1", resolve11));
   const port = server.address().port;
   return {
     port,
@@ -19028,7 +19259,7 @@ var DeploymentsApi = class {
   async wait(deploymentId, options = {}) {
     const intervalMs = options.intervalMs ?? 2500;
     const timeoutMs = options.timeoutMs ?? 15 * 6e4;
-    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
     const startedAt = Date.now();
     let lastStatus = null;
     let lastSequence = -1;
@@ -19293,14 +19524,12 @@ var DbApi = class {
    * retrying rather than re-running the file blind.
    */
   async applyMigration(projectId, input) {
-    return this.client.request(
-      this.path(projectId, "/migrations"),
-      {
-        method: "POST",
-        body: { name: input.name, sql: input.sql },
-        context: "Apply migration"
-      }
-    );
+    const body = await this.client.request(this.path(projectId, "/migrations"), {
+      method: "POST",
+      body: { name: input.name, sql: input.sql },
+      context: "Apply migration"
+    });
+    return { ...body, warnings: body.warnings ?? [] };
   }
   /**
    * The current Time Travel bookmark, or the one `timestamp` (RFC 3339 with a
@@ -19368,7 +19597,7 @@ var DbApi = class {
    */
   async export(projectId, options = {}, wait = {}) {
     const timeoutMs = wait.timeoutMs ?? EXPORT_TIMEOUT_MS;
-    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
     const given = wait.pollIntervalMs;
     const firstPollMs = given !== void 0 && Number.isFinite(given) && given > 0 ? given : EXPORT_FIRST_POLL_MS;
     const maxPollMs = Math.max(EXPORT_MAX_POLL_MS, firstPollMs);
@@ -19838,29 +20067,29 @@ var RESTORE_OUTCOME_UNKNOWN_CODES = /* @__PURE__ */ new Set([
   "TIMEOUT",
   "NETWORK_ERROR"
 ]);
-function cellText(statement, row, column) {
-  const index = statement.columns.indexOf(column);
+function cellText(statement2, row, column2) {
+  const index = statement2.columns.indexOf(column2);
   const value = index < 0 ? void 0 : row[index];
   return value === null || value === void 0 ? "" : String(value);
 }
 var MAX_CELL_CHARS = 60;
 function formatCell(value) {
   if (value === null || value === void 0) return "NULL";
-  const text = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
-  const oneLine = text.replace(/\s+/g, " ");
+  const text2 = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+  const oneLine = text2.replace(/\s+/g, " ");
   return oneLine.length > MAX_CELL_CHARS ? `${oneLine.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine;
 }
-function renderRows(statement) {
-  if (statement.columns.length === 0) return [];
-  const cells = statement.rows.map(
-    (row) => statement.columns.map((_, index) => formatCell(row[index]))
+function renderRows(statement2) {
+  if (statement2.columns.length === 0) return [];
+  const cells = statement2.rows.map(
+    (row) => statement2.columns.map((_, index) => formatCell(row[index]))
   );
-  const widths = statement.columns.map(
-    (column, index) => Math.max(column.length, ...cells.map((row) => row[index]?.length ?? 0))
+  const widths = statement2.columns.map(
+    (column2, index) => Math.max(column2.length, ...cells.map((row) => row[index]?.length ?? 0))
   );
   const line = (values) => values.map((value, index) => value.padEnd(widths[index] ?? 0)).join("  ").trimEnd();
   return [
-    line(statement.columns),
+    line(statement2.columns),
     widths.map((width) => "-".repeat(width)).join("  "),
     ...cells.map(line)
   ];
@@ -19868,18 +20097,18 @@ function renderRows(statement) {
 function formatMs(ms) {
   return ms >= 100 ? String(Math.round(ms)) : ms.toFixed(1);
 }
-function summarizeStatement(statement) {
-  const rows = statement.rows.length;
-  const { meta: meta3 } = statement;
+function summarizeStatement(statement2) {
+  const rows = statement2.rows.length;
+  const { meta: meta3 } = statement2;
   return `\u21B3 ${String(rows)} row${rows === 1 ? "" : "s"} \xB7 ${String(meta3.rowsRead)} read \xB7 ${String(meta3.rowsWritten)} written \xB7 ${formatMs(meta3.durationMs)} ms`;
 }
 
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { join as join19 } from "path";
-function parseDotenv(text) {
+function parseDotenv(text2) {
   const out = {};
-  for (const line of text.split(/\r?\n/)) {
+  for (const line of text2.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -19982,14 +20211,14 @@ function scanEnvReferences(dir) {
   const files = [];
   collect(dir, files);
   for (const file2 of files) {
-    let text;
+    let text2;
     try {
       if (statSync(file2).size > MAX_FILE_BYTES2) continue;
-      text = readFileSync3(file2, "utf8");
+      text2 = readFileSync3(file2, "utf8");
     } catch {
       continue;
     }
-    for (const match of text.matchAll(REFERENCE)) {
+    for (const match of text2.matchAll(REFERENCE)) {
       const key = match[1] ?? match[2];
       if (!key || ignored(key)) continue;
       found.set(key, "code");
@@ -20177,32 +20406,156 @@ var SYSTEM_TABLE_PREFIXES = [
   "sqlite_"
 ];
 var SYSTEM_TABLE_NAMES = ["d1_migrations"];
-function asciiLower(text) {
-  return text.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+function asciiLower(text2) {
+  return text2.replace(/[A-Z]+/g, (run) => run.toLowerCase());
 }
 function isSystemTable(name) {
   const lower = asciiLower(name);
   return SYSTEM_TABLE_PREFIXES.some((prefix) => lower.startsWith(prefix)) || SYSTEM_TABLE_NAMES.includes(lower);
 }
-function likeLiteral(text) {
-  return text.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
+function likeLiteral(text2) {
+  return text2.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
 }
 var COLUMN_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$/;
-function systemTablePredicate(column = "name") {
-  if (!COLUMN_REFERENCE.test(column))
-    throw new Error(`Not a column reference: ${column}`);
+function systemTablePredicate(column2 = "name") {
+  if (!COLUMN_REFERENCE.test(column2))
+    throw new Error(`Not a column reference: ${column2}`);
   return [
     ...SYSTEM_TABLE_PREFIXES.map(
-      (prefix) => `${column} NOT LIKE '${likeLiteral(prefix)}%' ESCAPE '\\'`
+      (prefix) => `${column2} NOT LIKE '${likeLiteral(prefix)}%' ESCAPE '\\'`
     ),
     ...SYSTEM_TABLE_NAMES.map(
-      (name) => `${column} NOT LIKE '${likeLiteral(name)}' ESCAPE '\\'`
+      (name) => `${column2} NOT LIKE '${likeLiteral(name)}' ESCAPE '\\'`
     ),
-    `${column} NOT IN (SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'shadow')`
+    `${column2} NOT IN (SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'shadow')`
   ].join(" AND ");
 }
 var SYSTEM_TABLE_SQL_PREDICATE = systemTablePredicate("name");
 
+// ../../packages/data-core/src/errors.ts
+var DATABASE_FULL_MESSAGE = "The database has reached D1's 10 GB limit, which cannot be raised. Delete data to free space; writes fail until it is under the limit.";
+var CATALOG = {
+  INVALID_API_KEY: {
+    status: 401,
+    message: () => "The API key is missing or not valid for this project."
+  },
+  INVALID_SESSION: {
+    status: 401,
+    message: () => "The session is expired or not valid. Sign in again."
+  },
+  INVALID_QUERY: {
+    status: 400,
+    message: () => "The query is not a valid Naro query."
+  },
+  TABLE_NOT_FOUND: {
+    status: 404,
+    message: ({ table }) => `Table ${table} was not found.`
+  },
+  COLUMN_NOT_FOUND: {
+    status: 400,
+    message: ({ column: column2, table }) => `Column ${column2} was not found on ${table}.`
+  },
+  PERMISSION_DENIED: {
+    status: 403,
+    // P2-7 §6: Postgres's words for a WITH CHECK that fails —
+    // `new row violates row-level security policy ["p"] for table t`, the
+    // restrictive policy's name in double quotes as Postgres writes it.
+    message: ({ action, table, check: check2, policy }) => check2 ? `New row violates row-level security policy ${policy === void 0 ? "" : `"${policy}" `}for table ${table}.` : `This request is not allowed by the ${action} policy of ${table}.`
+  },
+  POLICY_VIOLATION: {
+    status: 403,
+    message: ({ column: column2 }) => `${column2} must be the signed-in user's id.`
+  },
+  FILTER_REQUIRED: {
+    status: 400,
+    message: () => "update and delete need at least one filter."
+  },
+  TOO_MANY_PARAMETERS: {
+    status: 400,
+    message: () => "The query needs more than 100 values in one statement."
+  },
+  NOT_SINGLE_ROW: {
+    status: 406,
+    message: ({ count: count2 }) => `Expected exactly one row, got ${String(count2)}.`
+  },
+  CONFLICT: {
+    status: 409,
+    message: ({ column: column2 }) => `A row with the same ${column2} already exists.`
+  },
+  CONSTRAINT_VIOLATION: {
+    status: 400,
+    message: ({ kind, column: column2 }) => `The row breaks a ${kind} constraint on ${column2}.`
+  },
+  PAYLOAD_TOO_LARGE: {
+    status: 413,
+    message: () => "The request body is larger than 1 MiB."
+  },
+  INTERNAL_ERROR: {
+    status: 500,
+    message: () => "Something went wrong. Try again."
+  },
+  // Not in spec §14: an `owner` rule whose owner column is unset or no longer
+  // on the table. The control plane refuses to write one, but `_naro_policies`
+  // is an ordinary table an operator can edit by hand, and a column can be
+  // dropped after the policy was set. It is the project's configuration that
+  // is broken, not the request, hence 500 — and never an allow.
+  //
+  // P2-7 §6: a named policy that cannot be applied (it cannot be read, or
+  // names a column, table or problem the schema does not allow), policies
+  // that read each other (Postgres 42P17's words), or too many values.
+  POLICY_INVALID: {
+    status: 500,
+    message: ({
+      action,
+      table,
+      condition,
+      policy,
+      recursion,
+      values,
+      bytes
+    }) => {
+      if (recursion)
+        return `Infinite recursion detected in policy for relation ${table}.`;
+      if (values)
+        return `The policies of ${table} bind more than 50 values in one statement.`;
+      if (bytes)
+        return `The policies of ${table} write more than 50000 bytes of SQL into one statement.`;
+      if (policy !== void 0)
+        return `Policy ${policy} on ${table} cannot be applied.`;
+      return condition ? `The ${action} policy of ${table} has a condition that cannot be applied.` : `The ${action} policy of ${table} is owner but has no valid owner column.`;
+    }
+  },
+  // PR C (2026-09-23-d1-write-quota-design.md §5.2, §8): the project's D1
+  // wrote more rows today (UTC) than its daily limit. Refuses Data API writes
+  // and sign-up; the worker adds `x-retry-after`. No numbers — this answer
+  // goes to anyone on the internet holding the anon key.
+  WRITE_QUOTA_EXCEEDED: {
+    status: 429,
+    message: () => "This project has reached its daily database write limit. Reads still work; writes resume at 00:00 UTC."
+  },
+  // PR D: D1 refused a write because the database is at its size limit,
+  // which Cloudflare does not raise. 507 Insufficient Storage: no retry
+  // helps until rows are deleted. Reads still work.
+  DATABASE_FULL: {
+    status: 507,
+    message: () => DATABASE_FULL_MESSAGE
+  }
+};
+function dataError(code, ...args) {
+  const [vars, details] = args;
+  const entry = CATALOG[code];
+  const error51 = {
+    code,
+    message: entry.message(vars),
+    status: entry.status
+  };
+  if (details !== void 0) error51.details = details;
+  return error51;
+}
+function invalidQuery(path, reason) {
+  return dataError("INVALID_QUERY", void 0, { path, reason });
+}
+
 // ../../packages/data-core/src/d1.ts
 function rowsOf(result) {
   const rows = result?.results ?? [];
@@ -20256,11 +20609,11 @@ function isDigit(char) {
   return char >= "0" && char <= "9";
 }
 var NUMBER = /^(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?/;
-function tokenize(text) {
+function tokenize(text2) {
   const tokens = [];
   let index = 0;
-  const at = (offset = 0) => text.charAt(index + offset);
-  while (index < text.length) {
+  const at = (offset = 0) => text2.charAt(index + offset);
+  while (index < text2.length) {
     const char = at();
     const position = index + 1;
     if (char === "\0")
@@ -20270,12 +20623,12 @@ function tokenize(text) {
       continue;
     }
     if (char === "-" && at(1) === "-") {
-      while (index < text.length && at() !== "\n" && at() !== "\r") index++;
+      while (index < text2.length && at() !== "\n" && at() !== "\r") index++;
       continue;
     }
     if (char === "/" && at(1) === "*") {
       let depth = 0;
-      while (index < text.length) {
+      while (index < text2.length) {
         if (at() === "/" && at(1) === "*") {
           depth++;
           index += 2;
@@ -20293,7 +20646,7 @@ function tokenize(text) {
       let value = "";
       index++;
       for (; ; ) {
-        if (index >= text.length)
+        if (index >= text2.length)
           throw new PolicySyntaxError("unterminated quoted string", position);
         if (at() === "'") {
           if (at(1) === "'") {
@@ -20314,7 +20667,7 @@ function tokenize(text) {
       let value = "";
       index++;
       for (; ; ) {
-        if (index >= text.length)
+        if (index >= text2.length)
           throw new PolicySyntaxError(
             "unterminated quoted identifier",
             position
@@ -20342,10 +20695,10 @@ function tokenize(text) {
         position
       );
     if (isDigit(char) || char === "." && isDigit(at(1))) {
-      const match = NUMBER.exec(text.slice(index));
+      const match = NUMBER.exec(text2.slice(index));
       const value = match?.[0] ?? char;
       index += value.length;
-      if (index < text.length && isIdentChar(at()))
+      if (index < text2.length && isIdentChar(at()))
         throw new PolicySyntaxError(
           `trailing junk after numeric literal ${value}`,
           position
@@ -20355,9 +20708,9 @@ function tokenize(text) {
     }
     if (isIdentStart(char)) {
       let end = index + 1;
-      while (end < text.length && isIdentChar(text.charAt(end))) end++;
-      const value = text.slice(index, end);
-      if (text.charAt(end) === "'")
+      while (end < text2.length && isIdentChar(text2.charAt(end))) end++;
+      const value = text2.slice(index, end);
+      if (text2.charAt(end) === "'")
         throw new PolicySyntaxError(
           `${value}'\u2026' strings are not supported: use a plain '\u2026' string`,
           position
@@ -20367,7 +20720,7 @@ function tokenize(text) {
       continue;
     }
     const operator = OPERATORS.find(
-      (candidate) => text.startsWith(candidate, index)
+      (candidate) => text2.startsWith(candidate, index)
     );
     if (!operator)
       throw new PolicySyntaxError(
@@ -20381,7 +20734,7 @@ function tokenize(text) {
     kind: "eof",
     value: "",
     quoted: false,
-    position: text.length + 1
+    position: text2.length + 1
   });
   return tokens;
 }
@@ -20450,7 +20803,155 @@ var TokenStream = class {
   }
 };
 
+// ../../packages/data-core/src/collation.ts
+var COLLATIONS = ["BINARY", "NOCASE", "RTRIM"];
+function isSpace2(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
+}
+function isWordChar(char) {
+  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function asciiUpper2(text2) {
+  return text2.replace(/[a-z]/g, (letter) => letter.toUpperCase());
+}
+function quoted(sql, start, close, doubles) {
+  let value = "";
+  for (let index = start + 1; index < sql.length; index++) {
+    const char = sql.charAt(index);
+    if (char !== close) {
+      value += char;
+      continue;
+    }
+    if (doubles && sql.charAt(index + 1) === close) {
+      value += close;
+      index++;
+      continue;
+    }
+    return { value, end: index + 1 };
+  }
+  return void 0;
+}
+function tokenize2(sql) {
+  const tokens = [];
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql.charAt(index);
+    if (isSpace2(char)) {
+      index++;
+    } else if (char === "-" && sql.charAt(index + 1) === "-") {
+      const end = sql.indexOf("\n", index);
+      index = end < 0 ? sql.length : end + 1;
+    } else if (char === "/" && sql.charAt(index + 1) === "*") {
+      const end = sql.indexOf("*/", index + 2);
+      if (end < 0) return void 0;
+      index = end + 2;
+    } else if (char === '"' || char === "`" || char === "[" || char === "'") {
+      const close = char === "[" ? "]" : char;
+      const read = quoted(sql, index, close, char !== "[");
+      if (!read) return void 0;
+      tokens.push({
+        kind: char === "'" ? "string" : "name",
+        value: read.value
+      });
+      index = read.end;
+    } else if (char === "(" || char === ")" || char === ",") {
+      tokens.push({ kind: "punct", value: char });
+      index++;
+    } else if (isWordChar(char)) {
+      let end = index;
+      while (end < sql.length && isWordChar(sql.charAt(end))) end++;
+      tokens.push({ kind: "word", value: sql.slice(index, end) });
+      index = end;
+    } else {
+      tokens.push({ kind: "other", value: char });
+      index++;
+    }
+  }
+  return tokens;
+}
+function isWord2(token, word) {
+  return token?.kind === "word" && asciiLower(token.value) === word;
+}
+function definitions(tokens) {
+  const open = tokens.findIndex(
+    (token) => token.kind === "punct" && token.value === "("
+  );
+  if (open < 0) return void 0;
+  const found = [[]];
+  let depth = 0;
+  for (const token of tokens.slice(open + 1)) {
+    if (token.kind === "punct" && token.value === "(") depth++;
+    if (token.kind === "punct" && token.value === ")") {
+      if (depth === 0) return found;
+      depth--;
+    }
+    if (depth === 0 && token.kind === "punct" && token.value === ",") {
+      found.push([]);
+      continue;
+    }
+    found.at(-1)?.push(token);
+  }
+  return void 0;
+}
+function collationOf(definition) {
+  const named = [];
+  let depth = 0;
+  for (const [index, token] of definition.entries()) {
+    if (token.kind === "punct" && token.value === "(") depth++;
+    else if (token.kind === "punct" && token.value === ")") depth--;
+    else if (depth === 0 && index > 0 && isWord2(token, "collate")) {
+      const name = definition[index + 1];
+      if (!name || name.kind === "punct" || name.kind === "other") return null;
+      named.push(asciiUpper2(name.value));
+    }
+  }
+  if (named.length === 0) return "BINARY";
+  const [first] = named;
+  if (named.some((name) => name !== first)) return null;
+  return COLLATIONS.includes(first ?? "") ? first : null;
+}
+function declaredCollations(sql, columns) {
+  const unknown2 = columns.map(() => null);
+  if (typeof sql !== "string") return unknown2;
+  const tokens = tokenize2(sql);
+  if (!tokens || !isWord2(tokens[0], "create")) return unknown2;
+  const kind = isWord2(tokens[1], "temp") || isWord2(tokens[1], "temporary") ? tokens[2] : tokens[1];
+  if (!isWord2(kind, "table")) return unknown2;
+  const found = definitions(tokens);
+  if (!found || found.length < columns.length) return unknown2;
+  const collations = [];
+  for (const [index, column2] of columns.entries()) {
+    const definition = found[index] ?? [];
+    const name = definition[0];
+    if (!name || name.kind === "punct" || name.kind === "other" || asciiLower(name.value) !== asciiLower(column2))
+      return unknown2;
+    collations.push(collationOf(definition));
+  }
+  return collations;
+}
+
 // ../../packages/data-core/src/schema.ts
+function columnAffinity(column2) {
+  const type = asciiLower(column2.type);
+  if (type.includes("int")) return "INTEGER";
+  if (type.includes("char") || type.includes("clob") || type.includes("text"))
+    return "TEXT";
+  if (type.includes("blob") || type.trim() === "") return "BLOB";
+  if (type.includes("real") || type.includes("floa") || type.includes("doub"))
+    return "REAL";
+  return "NUMERIC";
+}
+function numberClass(type) {
+  const affinity2 = columnAffinity({ type });
+  if (affinity2 === "TEXT" || affinity2 === "BLOB") return void 0;
+  if (affinity2 !== "NUMERIC") return "number";
+  const lower = asciiLower(type);
+  return ["num", "dec", "bool", "bit"].some((word) => lower.includes(word)) ? "number" : "fallback";
+}
+var NUMBER_TEXT = /^[ \t\n\v\f\r]*[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?[ \t\n\v\f\r]*$/;
+function storesAsNumber(value) {
+  return value.includes("\0") || NUMBER_TEXT.test(value);
+}
 var SCHEMA_SQL = [
   `SELECT t.name AS table_name, t.type AS table_type, c.cid AS cid, c.name AS column_name, c.type AS column_type, c."notnull" AS not_null, c.dflt_value AS default_value, c.pk AS pk, c.hidden AS hidden FROM pragma_table_list AS t JOIN pragma_table_xinfo(t.name, t.schema) AS c WHERE t.schema = 'main' AND t.type IN ('table', 'virtual') AND ${systemTablePredicate("t.name")} ORDER BY t.name, c.cid`,
   // Phase 2-2 (적대적 리뷰 반영): each table's CREATE TABLE text, where
@@ -20469,6 +20970,80 @@ function tableNamesFromRows(rows) {
   }
   return names;
 }
+function tableNames(snapshot) {
+  return [...snapshot.tables.values()].map((table) => table.name);
+}
+function text(value) {
+  return typeof value === "string" ? value : "";
+}
+function integer2(value) {
+  const number4 = Number(value);
+  return Number.isFinite(number4) ? number4 : 0;
+}
+function snapshotFromRows(rows) {
+  const building = /* @__PURE__ */ new Map();
+  const ddl = /* @__PURE__ */ new Map();
+  for (const row of rows)
+    if (Object.hasOwn(row, "table_sql") && typeof row.table_name === "string")
+      ddl.set(row.table_name, row.table_sql);
+  for (const row of rows) {
+    if (Object.hasOwn(row, "table_sql")) continue;
+    const tableName = text(row.table_name);
+    const kind = row.table_type;
+    if (tableName === "" || kind !== "table" && kind !== "virtual") continue;
+    if (isSystemTable(tableName)) continue;
+    const hidden = integer2(row.hidden);
+    if (hidden === 1) continue;
+    const columnName = text(row.column_name);
+    if (columnName === "") continue;
+    const key = asciiLower(tableName);
+    let table = building.get(key);
+    if (!table) {
+      table = { name: tableName, kind, columns: [] };
+      building.set(key, table);
+    }
+    const defaultValue = row.default_value;
+    table.columns.push({
+      name: columnName,
+      cid: integer2(row.cid),
+      type: text(row.column_type),
+      notNull: integer2(row.not_null) === 1,
+      primaryKey: integer2(row.pk),
+      defaultValue: defaultValue === null || defaultValue === void 0 ? null : String(defaultValue),
+      generated: hidden === 2 || hidden === 3,
+      collation: null
+    });
+  }
+  const tables = /* @__PURE__ */ new Map();
+  for (const [key, table] of building) {
+    const sorted2 = table.columns.toSorted(
+      (left, right) => left.cid - right.cid
+    );
+    const collations = table.kind === "table" ? declaredCollations(
+      ddl.get(table.name),
+      sorted2.map((column2) => column2.name)
+    ) : sorted2.map(() => null);
+    const columns = sorted2.map((column2, index) => ({
+      ...column2,
+      collation: collations[index] ?? null
+    }));
+    const sql = ddl.get(table.name);
+    tables.set(key, {
+      name: table.name,
+      kind: table.kind,
+      columns,
+      byName: new Map(
+        columns.map((column2) => [asciiLower(column2.name), column2])
+      ),
+      sql: table.kind === "table" && typeof sql === "string" ? sql : null
+    });
+  }
+  return { tables };
+}
+function resolveTable(snapshot, name) {
+  if (isSystemTable(name)) return void 0;
+  return snapshot.tables.get(asciiLower(name));
+}
 async function readTableNames(db) {
   return tableNamesFromRows(rowsOf(await db.prepare(TABLE_NAMES_SQL).all()));
 }
@@ -20483,14 +21058,20 @@ function isPlainObject2(value) {
 function isValue(value) {
   return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 }
-function utf8ByteLength(text) {
+function toBoundValue(value) {
+  if (value === null) return null;
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (typeof value === "string" || typeof value === "number") return value;
+  return JSON.stringify(value);
+}
+function utf8ByteLength(text2) {
   let bytes = 0;
-  for (let index = 0; index < text.length; index++) {
-    const unit = text.charCodeAt(index);
+  for (let index = 0; index < text2.length; index++) {
+    const unit = text2.charCodeAt(index);
     if (unit < 128) bytes += 1;
     else if (unit < 2048) bytes += 2;
-    else if (unit >= 55296 && unit <= 56319 && index + 1 < text.length) {
-      const next = text.charCodeAt(index + 1);
+    else if (unit >= 55296 && unit <= 56319 && index + 1 < text2.length) {
+      const next = text2.charCodeAt(index + 1);
       if (next >= 56320 && next <= 57343) {
         bytes += 4;
         index++;
@@ -20501,6 +21082,19 @@ function utf8ByteLength(text) {
 }
 
 // ../../packages/data-core/src/sql-fragments.ts
+function quoteIdentifier(name) {
+  return `"${name.replaceAll('"', '""')}"`;
+}
+var Failure = class extends Error {
+  constructor(error51, reason) {
+    super(error51.code);
+    this.error = error51;
+    this.reason = reason;
+  }
+};
+function fail(error51, reason) {
+  throw new Failure(error51, reason);
+}
 function globLiteral(char) {
   return char === "*" || char === "?" || char === "[" ? `[${char}]` : char;
 }
@@ -20525,6 +21119,121 @@ function patternTooLong(pattern, caseInsensitive) {
   if (pattern.length > MAX_PATTERN_BYTES * 2) return true;
   return utf8ByteLength(boundPattern(pattern, caseInsensitive)) > MAX_PATTERN_BYTES;
 }
+function isBoolean(target, value) {
+  return `coalesce(CAST(${target} AS NUMERIC) ${value ? "<>" : "="} 0, 0)`;
+}
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+function distinctArrayValues(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const item of values) {
+    const bound = typeof item === "string" ? item.replace(LONE_SURROGATE, "\uFFFD") : item;
+    const key = `${typeof bound}:${String(bound)}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(bound);
+  }
+  return out;
+}
+var MAX_ARRAY_TEXT_LENGTH = 65536;
+var ELEMENT = "_naro_j";
+function arraySql(target, operator, count2, bind2, nullElement = false) {
+  const isNull = target();
+  const length = target();
+  const valid = target();
+  const type = target();
+  const each = () => `json_each(${target()}) AS ${ELEMENT}`;
+  const element = `${ELEMENT}.value`;
+  const list = () => `(${Array.from({ length: count2 }, bind2).join(", ")})`;
+  let test;
+  if (operator === "contains" && nullElement) test = "0";
+  else if (count2 === 0)
+    test = operator === "containedBy" ? `NOT EXISTS (SELECT 1 FROM ${each()})` : "0";
+  else if (operator === "contains")
+    test = `(SELECT COUNT(DISTINCT ${element}) FROM ${each()} WHERE ${element} IN ${list()}) = ${String(count2)}`;
+  else if (operator === "overlaps")
+    test = `EXISTS (SELECT 1 FROM ${each()} WHERE ${element} IN ${list()})`;
+  else
+    test = `NOT EXISTS (SELECT 1 FROM ${each()} WHERE ${element} IS NULL OR ${element} NOT IN ${list()})`;
+  return `(CASE WHEN ${isNull} IS NULL OR length(${length}) > ${String(MAX_ARRAY_TEXT_LENGTH)} THEN NULL WHEN json_valid(${valid}) THEN json_type(${type}) = 'array' AND ${test} ELSE 0 END)`;
+}
+function isNumeric(item) {
+  const affinity2 = columnAffinity(item);
+  return affinity2 !== "TEXT" && affinity2 !== "BLOB";
+}
+function refusesText(item, text2) {
+  const kind = numberClass(item.type);
+  return kind === "number" || kind === "fallback" && storesAsNumber(text2);
+}
+function readsAsIs(item, value) {
+  return typeof value === "string" && numberClass(item.type) === "fallback" && !storesAsNumber(value);
+}
+function asStored(item, sql) {
+  switch (columnAffinity(item)) {
+    case "INTEGER":
+    case "NUMERIC":
+      return `CAST(${sql} AS NUMERIC)`;
+    case "REAL":
+      return `CAST(${sql} AS REAL)`;
+    case "TEXT":
+      return `CAST(${sql} AS TEXT)`;
+    case "BLOB":
+      return sql;
+  }
+}
+var LITERAL_DEFAULT = /^(?:null|true|false|[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|'(?:[^']|'')*')$/i;
+function omittedSql(item) {
+  if (item.primaryKey > 0) return void 0;
+  const text2 = item.defaultValue;
+  if (text2 === null) return "NULL";
+  if (!LITERAL_DEFAULT.test(text2)) return void 0;
+  const word = asciiLower(text2);
+  if (word === "null") return "NULL";
+  if (word === "true" || word === "false")
+    return asStored(item, word === "true" ? "1" : "0");
+  if (text2.startsWith("'") && isNumeric(item)) return void 0;
+  return asStored(item, text2);
+}
+var DEFAULT_KEYWORDS = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "current_date",
+  "current_time",
+  "current_timestamp"
+]);
+var BARE_WORD = /^[A-Za-z_\u0080-￿][A-Za-z0-9_$\u0080-￿]*$/;
+function quotedName(text2) {
+  const double = /^"((?:[^"]|"")*)"$/.exec(text2);
+  if (double) return (double[1] ?? "").replaceAll('""', '"');
+  const tick = /^`((?:[^`]|``)*)`$/.exec(text2);
+  if (tick) return (tick[1] ?? "").replaceAll("``", "`");
+  const bracket = /^\[([^\]]*)\]$/.exec(text2);
+  return bracket ? bracket[1] ?? "" : void 0;
+}
+function stringDefault(item) {
+  let text2 = item.defaultValue?.trim();
+  if (text2 === void 0) return void 0;
+  while (text2.startsWith("(") && text2.endsWith(")"))
+    text2 = text2.slice(1, -1).trim();
+  if (/^\+\s*(?:'|x')/i.test(text2)) text2 = text2.slice(1).trim();
+  if (/^'(?:[^']|'')*'$/.test(text2))
+    return { kind: "text", text: text2.slice(1, -1).replaceAll("''", "'") };
+  if (/^x'[0-9a-f]*'$/i.test(text2)) return { kind: "blob" };
+  const name = quotedName(text2);
+  if (name !== void 0) return { kind: "text", text: name };
+  if (BARE_WORD.test(text2) && !DEFAULT_KEYWORDS.has(asciiLower(text2)))
+    return { kind: "text", text: text2 };
+  return void 0;
+}
+var DEFAULT_CHECK_NONCE = "0";
+function checkMarker(action, nonce, restrictive) {
+  const index = restrictive === void 0 ? "" : `:${String(restrictive)}`;
+  return `json_extract('{}', 'naro:check:${action}:${nonce}${index}')`;
+}
+function schemaMarker(nonce) {
+  return `json_extract('{}', 'naro:schema:${nonce}')`;
+}
 
 // ../../packages/data-core/src/policy-expr.ts
 var MAX_EXPRESSION_BYTES = 3 * 16384;
@@ -20626,25 +21335,25 @@ function nested(state, token, read) {
   }
 }
 function truthProblem(operand) {
-  const text = "is text, where 'true' reads as false";
+  const text2 = "is text, where 'true' reads as false";
   switch (operand.kind) {
     case "column":
       return void 0;
     case "literal":
-      return typeof operand.value === "string" ? `a '\u2026' string ${text}: write TRUE or FALSE, or compare the string with =` : void 0;
+      return typeof operand.value === "string" ? `a '\u2026' string ${text2}: write TRUE or FALSE, or compare the string with =` : void 0;
     case "jwt": {
       const claim = printValue(operand);
-      return `${claim} ${text}: compare it with text, ${claim} = 'true'`;
+      return `${claim} ${text2}: compare it with text, ${claim} = 'true'`;
     }
     case "auth":
       return operand.fn === "uid" ? "auth.uid() is text: compare it, auth.uid() = user_id, or test auth.uid() IS NOT NULL" : "auth.role() is text: compare it, auth.role() = 'authenticated'";
     case "cast":
-      return `a ::text cast ${text}: compare it with text, (\u2026)::text = 'true'`;
+      return `a ::text cast ${text2}: compare it with text, (\u2026)::text = 'true'`;
     case "func":
       switch (operand.name) {
         case "lower":
         case "upper":
-          return `${operand.name}(\u2026) ${text}: compare it with text, ${operand.name}(\u2026) = 'true'`;
+          return `${operand.name}(\u2026) ${text2}: compare it with text, ${operand.name}(\u2026) = 'true'`;
         case "coalesce":
           return "coalesce(\u2026) is not a boolean: compare it, coalesce(\u2026) = 'true'";
         case "length":
@@ -20703,9 +21412,9 @@ function booleanComparisonProblem(expr) {
     const met = [...operandValues(left), ...operandValues(right)];
     if (!met.some(isBooleanConstant)) continue;
     const texts = met.filter(isTextValue);
-    const text = texts.find((value) => value.kind !== "literal") ?? texts[0];
-    if (text === void 0) continue;
-    const problem = text.kind === "literal" ? "a '\u2026' string is text, where 'true' reads as false: write TRUE or FALSE on both sides, or a '\u2026' string on both" : truthProblem(text);
+    const text2 = texts.find((value) => value.kind !== "literal") ?? texts[0];
+    if (text2 === void 0) continue;
+    const problem = text2.kind === "literal" ? "a '\u2026' string is text, where 'true' reads as false: write TRUE or FALSE on both sides, or a '\u2026' string on both" : truthProblem(text2);
     return `a comparison with TRUE or FALSE compares a boolean, and ${String(problem)}`;
   }
   return void 0;
@@ -21261,17 +21970,17 @@ function readCondition(stream) {
   return requireCondition(expr, token);
 }
 function checkExpressionSize(expr, position) {
-  const text = printExpr(expr);
-  if (utf8ByteLength(text) > MAX_EXPRESSION_BYTES)
+  const text2 = printExpr(expr);
+  if (utf8ByteLength(text2) > MAX_EXPRESSION_BYTES)
     throw new PolicySyntaxError(
       `the expression is longer than ${String(MAX_EXPRESSION_BYTES)} bytes`,
       position
     );
-  return text;
+  return text2;
 }
-function parseExpression(text) {
+function parseExpression(text2) {
   try {
-    const stream = new TokenStream(tokenize(text));
+    const stream = new TokenStream(tokenize(text2));
     if (stream.peek().kind === "eof")
       throw new PolicySyntaxError("the expression is empty", 1);
     const expr = readCondition(stream);
@@ -21286,22 +21995,22 @@ function parseExpression(text) {
 function quoteIdent(name) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !SPECIAL_WORDS.has(asciiLower(name)) ? name : `"${name.replaceAll('"', '""')}"`;
 }
-function commentText(text) {
+function commentText(text2) {
   let out = "";
-  for (const char of text) {
+  for (const char of text2) {
     const code = char.charCodeAt(0);
     const control = code < 32 || code >= 127 && code <= 159 || code === 8232 || code === 8233;
     out += control ? `\\u${code.toString(16).padStart(4, "0")}` : char;
   }
   return out;
 }
-function quoteString(text) {
-  return `'${text.replaceAll("'", "''")}'`;
+function quoteString(text2) {
+  return `'${text2.replaceAll("'", "''")}'`;
 }
 function printNumber(value) {
   if (Object.is(value, -0)) return "-0.0";
-  const text = String(value);
-  return Number.isSafeInteger(value) || /[.e]/.test(text) ? text : `${text}.0`;
+  const text2 = String(value);
+  return Number.isSafeInteger(value) || /[.e]/.test(text2) ? text2 : `${text2}.0`;
 }
 function printLiteral(value) {
   if (value === null) return "NULL";
@@ -21433,6 +22142,30 @@ function unqualifiedProblem(ref) {
   const name = quoteIdent(ref.name);
   return `column ${name} has no table or alias in front of it inside a subquery: naro policy create writes one on every column there, so that a column added to a table later cannot change which table the policy reads it from \u2014 drop the policy and create it again`;
 }
+function subqueriesOf(expr) {
+  const found = [];
+  const visit = (node) => {
+    if (isValueExpr(node)) return;
+    switch (node.kind) {
+      case "and":
+      case "or":
+        node.args.forEach(visit);
+        return;
+      case "not":
+        visit(node.arg);
+        return;
+      case "exists":
+      case "inSelect":
+        found.push(node.subquery);
+        if (node.subquery.where) visit(node.subquery.where);
+        return;
+      default:
+        return;
+    }
+  };
+  visit(expr);
+  return found;
+}
 
 // ../../packages/data-core/src/named-policy.ts
 var POLICY_COMMANDS = [
@@ -21487,17 +22220,33 @@ function policyShapeProblem(policy) {
     return `${command === "all" ? "An ALL" : "An UPDATE"} policy needs USING (\u2026), WITH CHECK (\u2026) or both.`;
   return void 0;
 }
-function ownerExpression(column) {
+function policySql(policy) {
+  const parts = [
+    `CREATE POLICY ${quotePolicyName(policy.name)} ON ${quoteIdent(policy.table)}`
+  ];
+  if (!policy.permissive) parts.push("AS RESTRICTIVE");
+  if (policy.command !== "all")
+    parts.push(`FOR ${policy.command.toUpperCase()}`);
+  const roles = rolesText(policy.roles);
+  if (roles !== "public") parts.push(`TO ${roles}`);
+  if (policy.using !== null) parts.push(`USING (${policy.using})`);
+  if (policy.check !== null) parts.push(`WITH CHECK (${policy.check})`);
+  const sql = `${parts.join(" ")};`;
+  if (policy.owner === null) return sql;
+  const owner = commentText(quoteIdent(policy.owner));
+  return `${sql} -- naro: owner ${owner}${policy.command === "insert" || policy.command === "all" ? ` (an insert that leaves ${owner} out gets auth.uid())` : ""}`;
+}
+function ownerExpression(column2) {
   return printExpr({
     kind: "compare",
     op: "=",
-    left: { kind: "column", qualifier: null, name: column },
+    left: { kind: "column", qualifier: null, name: column2 },
     right: { kind: "auth", fn: "uid" }
   });
 }
-function ownerClauses(column, command) {
-  const text = ownerExpression(column);
-  return command === "insert" ? { using: null, check: text } : { using: text, check: null };
+function ownerClauses(column2, command) {
+  const text2 = ownerExpression(column2);
+  return command === "insert" ? { using: null, check: text2 } : { using: text2, check: null };
 }
 var NAMED_POLICY_TABLE = "_naro_policies_v2";
 var NAMED_POLICY_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ${NAMED_POLICY_TABLE} (table_name TEXT NOT NULL, name TEXT NOT NULL, kind TEXT NOT NULL DEFAULT 'permissive', command TEXT NOT NULL DEFAULT 'all', roles TEXT NOT NULL DEFAULT 'public', using_expr TEXT, check_expr TEXT, owner_column TEXT, created_at TEXT NOT NULL DEFAULT (datetime('now')), updated_at TEXT NOT NULL DEFAULT (datetime('now')), PRIMARY KEY (table_name, name))`;
@@ -21543,21 +22292,21 @@ function storedExpression(value, field) {
 function loadPolicy(row, log2) {
   const table = row.table_name;
   if (typeof table !== "string" || table === "") return void 0;
-  const problems = [];
+  const problems2 = [];
   const name = typeof row.name === "string" && row.name !== "" ? row.name : "(unnamed)";
-  if (name === "(unnamed)") problems.push("the name is missing");
+  if (name === "(unnamed)") problems2.push("the name is missing");
   const kind = row.kind;
   if (kind !== "permissive" && kind !== "restrictive")
-    problems.push("kind is not permissive or restrictive");
+    problems2.push("kind is not permissive or restrictive");
   const command = POLICY_COMMANDS.includes(row.command) ? row.command : void 0;
   if (!command)
-    problems.push("command is not one of all, select, insert, update, delete");
+    problems2.push("command is not one of all, select, insert, update, delete");
   const roles = typeof row.roles === "string" && ["public", "anon", "authenticated"].includes(row.roles) ? readRoles([row.roles]) : void 0;
-  if (!roles?.ok) problems.push("roles is not public, anon or authenticated");
+  if (!roles?.ok) problems2.push("roles is not public, anon or authenticated");
   const using = storedExpression(row.using_expr, "using");
   const check2 = storedExpression(row.check_expr, "check");
-  if (using.problem) problems.push(using.problem);
-  if (check2.problem) problems.push(check2.problem);
+  if (using.problem) problems2.push(using.problem);
+  if (check2.problem) problems2.push(check2.problem);
   const owner = row.owner_column;
   const policy = {
     table,
@@ -21573,30 +22322,47 @@ function loadPolicy(row, log2) {
     usingExpr: using.expr,
     checkExpr: check2.expr
   };
-  if (command && problems.length === 0) {
+  if (command && problems2.length === 0) {
     const shape = policyShapeProblem(policy);
-    if (shape) problems.push(shape);
+    if (shape) problems2.push(shape);
   }
-  if (policy.owner !== null && policy.owner !== "" && command && problems.length === 0) {
+  if (policy.owner !== null && policy.owner !== "" && command && problems2.length === 0) {
     const expected = ownerClauses(policy.owner, command);
     if (policy.using !== expected.using || policy.check !== expected.check)
-      problems.push(
+      problems2.push(
         "an owner policy's expressions are not its owner condition"
       );
   }
-  if (problems.length > 0) {
-    policy.invalid = problems.join("; ");
+  if (problems2.length > 0) {
+    policy.invalid = problems2.join("; ");
     log2?.(
       `naro data-core: policy ${name} on ${table} cannot be read: ${policy.invalid}`
     );
   }
   return policy;
 }
-function foldPolicyName(name, quoted) {
-  return quoted ? name : asciiLower(name);
+function applicablePolicies(policies, table, command, role) {
+  const found = policiesOn(policies, table).filter(
+    (policy) => (policy.command === "all" || policy.command === command) && policy.roles.includes(role)
+  );
+  return {
+    permissive: found.filter((policy) => policy.permissive),
+    restrictive: found.filter((policy) => !policy.permissive),
+    invalid: found.find((policy) => policy.invalid !== null)
+  };
+}
+function policiesOn(policies, table) {
+  const folded = asciiLower(table);
+  return policies.filter((policy) => asciiLower(policy.table) === folded);
+}
+function foldPolicyName(name, quoted2) {
+  return quoted2 ? name : asciiLower(name);
+}
+function sqlStringLiteral(text2) {
+  return text2 === null ? "NULL" : quoteString(text2);
 }
-function policySqlTooLong(text) {
-  return utf8ByteLength(text) > MAX_POLICY_SQL_BYTES;
+function policySqlTooLong(text2) {
+  return utf8ByteLength(text2) > MAX_POLICY_SQL_BYTES;
 }
 
 // ../../packages/data-core/src/query.ts
@@ -21620,6 +22386,7 @@ function isAuthUid(value) {
   return isPlainObject2(value) && Object.keys(value).length === 1 && Object.hasOwn(value, "auth") && value.auth === "uid";
 }
 var MAX_BODY_BYTES = 1024 * 1024;
+var MAX_LIMIT = 1e3;
 var MAX_FILTERS = 100;
 var MAX_FILTER_DEPTH = 4;
 var MAX_ARRAY_VALUES = 100;
@@ -21682,11 +22449,11 @@ function readValue2(value, path, auth = false) {
     );
   return value;
 }
-function longerThan(text, max) {
-  if (text.length <= max) return false;
-  if (text.length > max * 2) return true;
+function longerThan(text2, max) {
+  if (text2.length <= max) return false;
+  if (text2.length > max * 2) return true;
   let count2 = 0;
-  for (const _ of text) if (++count2 > max) return true;
+  for (const _ of text2) if (++count2 > max) return true;
   return false;
 }
 function endsWithLoneEscape(pattern) {
@@ -21706,7 +22473,7 @@ function readFilter(value, path, auth) {
       `${path}.operator`,
       `must be one of ${FILTER_OPERATORS.join(", ")}`
     );
-  const column = readName(own(object2, "column"), `${path}.column`);
+  const column2 = readName(own(object2, "column"), `${path}.column`);
   if (!Object.hasOwn(object2, "value")) invalid(`${path}.value`, "is required");
   const raw = own(object2, "value");
   const valuePath = `${path}.value`;
@@ -21716,12 +22483,12 @@ function readFilter(value, path, auth) {
       const values = raw.map(
         (item, index) => readValue2(item, `${valuePath}[${index}]`, auth)
       );
-      return { operator, column, value: values };
+      return { operator, column: column2, value: values };
     }
     case "is":
       if (raw !== null && raw !== true && raw !== false)
         invalid(valuePath, "must be null, true or false");
-      return { operator, column, value: raw };
+      return { operator, column: column2, value: raw };
     case "like":
     case "ilike": {
       if (typeof raw !== "string") invalid(valuePath, "must be a string");
@@ -21731,7 +22498,7 @@ function readFilter(value, path, auth) {
         invalid(valuePath, "must not contain a NUL character");
       if (endsWithLoneEscape(raw))
         invalid(valuePath, "must not end with an unescaped backslash");
-      return { operator, column, value: raw };
+      return { operator, column: column2, value: raw };
     }
     case "contains":
     case "containedBy":
@@ -21745,13 +22512,13 @@ function readFilter(value, path, auth) {
         );
       return {
         operator,
-        column,
+        column: column2,
         value: raw.map(
           (item) => isAuthUid(item) ? { auth: "uid" } : item
         )
       };
     default:
-      return { operator, column, value: readValue2(raw, valuePath, auth) };
+      return { operator, column: column2, value: readValue2(raw, valuePath, auth) };
   }
 }
 var NODE_KEYS = ["operator", "or", "and", "not"];
@@ -21843,8 +22610,8 @@ function parseCondition(action, value) {
 }
 function conditionsTooLarge(texts) {
   let total = 0;
-  for (const text of texts)
-    if (typeof text === "string") total += utf8ByteLength(text);
+  for (const text2 of texts)
+    if (typeof text2 === "string") total += utf8ByteLength(text2);
   return total > MAX_CONDITION_BYTES;
 }
 function isInvalidCondition(value) {
@@ -21904,8 +22671,8 @@ var LEGACY_ROW_COLUMNS = [
 ];
 function legacyRowAsRead(row) {
   const values = [];
-  for (const column of LEGACY_ROW_COLUMNS) {
-    const value = row[column];
+  for (const column2 of LEGACY_ROW_COLUMNS) {
+    const value = row[column2];
     if (value === null || value === void 0) values.push(null);
     else if (typeof value === "string") values.push(value);
     else return void 0;
@@ -21930,14 +22697,14 @@ var POLICY_SQL = {
    */
   insertConverted: `INSERT OR IGNORE INTO _naro_policies_v2 (table_name, name, kind, command, roles, using_expr, check_expr, owner_column) SELECT ?, ?, ?, ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM _naro_policies WHERE ${ROW_AS_READ})`
 };
-function readStoredCondition(action, text, tooLarge) {
-  if (text === void 0 || text === null) return "is missing";
-  if (typeof text !== "string") return "is not JSON";
+function readStoredCondition(action, text2, tooLarge) {
+  if (text2 === void 0 || text2 === null) return "is missing";
+  if (typeof text2 !== "string") return "is not JSON";
   if (tooLarge)
     return `the conditions of the policy are larger than ${String(MAX_CONDITION_BYTES)} bytes`;
   let value;
   try {
-    value = JSON.parse(text);
+    value = JSON.parse(text2);
   } catch {
     return "is not JSON";
   }
@@ -21952,7 +22719,7 @@ function policyFromRow(row, log2) {
     (action) => row[`${action}_rule`] === CONDITION_RULE ? row[`${action}_condition`] : void 0
   );
   const tooLarge = conditionsTooLarge(
-    texts.filter((text) => typeof text === "string")
+    texts.filter((text2) => typeof text2 === "string")
   );
   const read = POLICY_ACTIONS2.map(
     (action, index) => {
@@ -22042,7 +22809,7 @@ function filterNodeToExpr(node, negated = false) {
   return negated ? { kind: "or", args: [leaf, uidIsNull(false)] } : { kind: "and", args: [leaf, uidIsNull(true)] };
 }
 function leafToExpr(node) {
-  const column = {
+  const column2 = {
     kind: "column",
     qualifier: null,
     name: node.column
@@ -22058,7 +22825,7 @@ function leafToExpr(node) {
       return {
         kind: "compare",
         op: COMPARISONS[node.operator],
-        left: column,
+        left: column2,
         right: valueExpr(Array.isArray(value) ? null : value)
       };
     case "in": {
@@ -22067,7 +22834,7 @@ function leafToExpr(node) {
       return {
         kind: "in",
         not: false,
-        operand: column,
+        operand: column2,
         list: list.map(valueExpr)
       };
     }
@@ -22075,7 +22842,7 @@ function leafToExpr(node) {
       return {
         kind: "is",
         not: false,
-        operand: column,
+        operand: column2,
         value: value === true || value === false ? value : null
       };
     case "like":
@@ -22084,7 +22851,7 @@ function leafToExpr(node) {
         kind: "like",
         not: false,
         ci: node.operator === "ilike",
-        operand: column,
+        operand: column2,
         pattern: typeof value === "string" ? value : ""
       };
     case "contains":
@@ -22123,12 +22890,12 @@ function namedFromRule(table, action, rule, ownerColumn) {
       check: action === "insert" ? TRUE_TEXT : null
     };
   if (rule === "owner") {
-    const column = ownerColumn ?? "";
+    const column2 = ownerColumn ?? "";
     return {
       ...base2,
       roles: ["authenticated"],
-      ...column === "" ? { using: null, check: null } : ownerClauses(column, action),
-      owner: column
+      ...column2 === "" ? { using: null, check: null } : ownerClauses(column2, action),
+      owner: column2
     };
   }
   if (isInvalidCondition(rule) || (action === "insert" ? rule.check : rule.using) === void 0)
@@ -22166,7 +22933,7 @@ function loadNamed(policies, log2) {
     const values = policyValues(policy);
     const loaded = loadPolicy(
       Object.fromEntries(
-        columns.map((column, index) => [column, values[index]])
+        columns.map((column2, index) => [column2, values[index]])
       ),
       log2
     );
@@ -22190,64 +22957,2112 @@ function unreadableConversions(policy) {
   return found;
 }
 
-// ../../packages/data-core/src/policy-index.ts
-var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
-
-// ../../packages/data-core/src/policy-statement.ts
-function readPolicyName(stream) {
-  const token = stream.peek();
-  if (token.kind !== "ident")
-    throw new PolicySyntaxError(
-      `expected a policy name, found ${describeToken(token)}`,
-      token.position
-    );
-  stream.next();
-  return foldPolicyName(token.value, token.quoted);
+// ../../packages/data-core/src/rls-compile.ts
+var MAX_INLINE_DEPTH = 4;
+var MAX_STATEMENT_SUBQUERIES = 16;
+var MAX_POLICY_VALUES = 50;
+var MAX_POLICY_STATEMENT_BYTES = 5e4;
+function policyInvalid(policy, action) {
+  return policy.owner !== null ? dataError("POLICY_INVALID", { action, table: policy.table }) : dataError("POLICY_INVALID", {
+    action,
+    table: policy.table,
+    policy: policy.name
+  });
 }
-function readRoleName(token) {
-  if (token.kind !== "ident")
-    throw new PolicySyntaxError(
-      `expected a role, found ${describeToken(token)}`,
-      token.position
-    );
-  return token.quoted ? token.value : asciiLower(token.value);
+function newState2() {
+  return { aliases: 0, subqueries: 0, depth: 0, active: [] };
 }
-function readCommand(stream) {
-  const token = stream.next();
-  for (const command of [
-    "all",
-    "select",
-    "insert",
-    "update",
-    "delete"
-  ])
-    if (isKeyword(token, command)) return command;
-  throw new PolicySyntaxError(
-    `expected ALL, SELECT, INSERT, UPDATE or DELETE, found ${describeToken(token)}`,
-    token.position
-  );
+function bind(env, value) {
+  env.params.push(value);
+  return "?";
 }
-function readClause(stream) {
-  const open = stream.expectOperator("(");
-  const expr = readCondition(stream);
-  stream.expectOperator(")");
-  checkExpressionSize(expr, open.position);
-  return { text: printExpr(expr), position: open.position };
+function blamed(env, reason) {
+  return fail(policyInvalid(env.blame.policy, env.blame.action), reason);
 }
-function readCreate(stream, start) {
-  stream.expectKeyword("policy");
-  const name = readPolicyName(stream);
-  stream.expectKeyword("on");
-  const table = readTableName(stream);
-  let permissive = true;
-  if (stream.acceptKeyword("as")) {
-    const token = stream.next();
-    if (isKeyword(token, "restrictive")) permissive = false;
-    else if (!isKeyword(token, "permissive"))
-      throw new PolicySyntaxError(
-        `expected PERMISSIVE or RESTRICTIVE, found ${describeToken(token)}`,
-        token.position
-      );
+function storedSource(table, names, alias) {
+  return {
+    table,
+    names,
+    read: (column2, _env, how) => alias !== null ? `${quoteIdentifier(alias)}.${quoteIdentifier(column2.name)}` : how.qualified ? `${quoteIdentifier(table.name)}.${quoteIdentifier(column2.name)}` : quoteIdentifier(column2.name),
+    operand: (column2) => ({
+      stable: true,
+      newColumnish: true,
+      newCollation: alias === null ? column2.collation : null
+    })
+  };
+}
+function missingColumnReason(name, tables) {
+  return `column ${name} does not exist on ${tables.join(" or ")}`;
+}
+function missingRelationReason(table) {
+  return `relation ${table} does not exist (a system table cannot be read either)`;
+}
+function resolveColumn(env, ref) {
+  const name = asciiLower(ref.name);
+  if (ref.qualifier !== null) {
+    const qualifier = asciiLower(ref.qualifier);
+    for (let index = env.scopes.length - 1; index >= 0; index--) {
+      const source = env.scopes[index];
+      if (!source?.names.includes(qualifier)) continue;
+      const column2 = source.table.byName.get(name);
+      if (!column2)
+        return blamed(
+          env,
+          `column ${ref.qualifier}.${ref.name} does not exist: ${source.table.name} has no column ${ref.name}`
+        );
+      return { source, column: column2 };
+    }
+    return blamed(
+      env,
+      `${ref.qualifier}.${ref.name} names no table here: use the policy's table or a subquery's table or alias`
+    );
+  }
+  for (let index = env.scopes.length - 1; index >= 0; index--) {
+    const source = env.scopes[index];
+    const column2 = source?.table.byName.get(name);
+    if (!source || !column2) continue;
+    if (env.scopes.length > 1) return blamed(env, unqualifiedProblem(ref));
+    return { source, column: column2 };
+  }
+  return blamed(
+    env,
+    missingColumnReason(
+      ref.name,
+      env.scopes.map((source) => source.table.name)
+    )
+  );
+}
+function jwtValue(env, expr) {
+  const value = env.req.claims[expr.claim];
+  if (value === null) return "NULL";
+  if (expr.op === "->") return bind(env, JSON.stringify(value));
+  return bind(env, typeof value === "boolean" ? String(value) : value);
+}
+function valueSql(env, expr, textual = null) {
+  switch (expr.kind) {
+    case "literal":
+      if (expr.value === null) return "NULL";
+      if (typeof expr.value === "boolean") return expr.value ? "1" : "0";
+      return bind(env, expr.value);
+    case "column": {
+      const { source, column: column2 } = resolveColumn(env, expr);
+      return source.read(column2, env, {
+        qualified: env.scopes.length > 1,
+        textual
+      });
+    }
+    case "auth":
+      if (expr.fn === "role") return bind(env, env.req.role);
+      return env.req.uid === null ? "NULL" : bind(env, env.req.uid);
+    case "jwt":
+      return jwtValue(env, expr);
+    case "func": {
+      if (expr.name === "now") return "CURRENT_TIMESTAMP";
+      if (expr.name === "coalesce") {
+        const args = expr.args.map((arg2) => valueSql(env, arg2, textual));
+        return args.length === 1 ? `(${String(args[0])})` : `coalesce(${args.join(", ")})`;
+      }
+      const [arg] = expr.args;
+      if (!arg) return blamed(env, `${expr.name}() needs an argument`);
+      return `${expr.name}(${valueSql(env, arg, "textual")})`;
+    }
+    case "cast":
+      return `CAST(${valueSql(env, expr.operand, "textual")} AS TEXT)`;
+  }
+}
+function operandSide(env, expr) {
+  if (expr.kind === "cast") return operandSide(env, expr.operand);
+  if (expr.kind !== "column")
+    return {
+      stored: null,
+      stable: true,
+      newColumnish: false,
+      newCollation: null
+    };
+  const { source, column: column2 } = resolveColumn(env, expr);
+  const operand = source.operand(column2);
+  return {
+    stored: column2,
+    stable: operand.stable,
+    newColumnish: operand.newColumnish,
+    newCollation: operand.newCollation
+  };
+}
+function checkCollation(env, left, right) {
+  if (!env.check) return "";
+  const sides = right === null ? [left] : [left, right];
+  const stored = sides.find((side) => side.stored !== null);
+  const fresh = sides.find((side) => side.newColumnish);
+  if (stored && stored === fresh && stored.stable) return "";
+  if (!stored && !fresh) return "";
+  const want = stored?.stored ? stored.stored.collation ?? env.check.problem(stored.stored.name, "collation", env.blame.policy) : "BINARY";
+  const have = fresh ? fresh.newCollation : "BINARY";
+  return have === want ? "" : ` COLLATE ${want}`;
+}
+var ARRAY_OPERATORS3 = {
+  "@>": "contains",
+  "<@": "containedBy",
+  "&&": "overlaps"
+};
+function comparison(env, left, op, right) {
+  const l = valueSql(env, left);
+  const collate = env.check ? checkCollation(env, operandSide(env, left), operandSide(env, right)) : "";
+  const r = valueSql(env, right);
+  return `(${l}${collate} ${op} ${r})`;
+}
+function knownNullTest(env, expr) {
+  if (expr.value !== null) return void 0;
+  const { operand } = expr;
+  let value;
+  if (operand.kind === "auth" && operand.fn === "uid") value = env.req.uid;
+  else if (operand.kind === "jwt") {
+    const claim = env.req.claims[operand.claim];
+    value = claim === null ? null : String(claim);
+  } else return void 0;
+  return value === null !== expr.not ? "1" : "0";
+}
+function conditionSql(env, expr) {
+  if (isValueExpr(expr)) {
+    if (expr.kind === "literal")
+      return expr.value === null ? "NULL" : expr.value === true ? "1" : "0";
+    if (expr.kind === "column") return `(${valueSql(env, expr)})`;
+    return blamed(env, "a value alone is not a condition");
+  }
+  switch (expr.kind) {
+    case "and":
+    case "or":
+      return `(${expr.args.map((arg) => conditionSql(env, arg)).join(expr.kind === "and" ? " AND " : " OR ")})`;
+    case "not":
+      return `(NOT ${conditionSql(env, expr.arg)})`;
+    default:
+      break;
+  }
+  const mismatched = booleanComparisonProblem(expr);
+  if (mismatched !== void 0) return blamed(env, mismatched);
+  switch (expr.kind) {
+    case "compare":
+      return comparison(env, expr.left, expr.op, expr.right);
+    case "distinct":
+      return comparison(env, expr.left, expr.not ? "IS" : "IS NOT", expr.right);
+    case "is": {
+      const untestable = expr.value === null ? void 0 : truthTestProblem(expr.operand);
+      if (untestable !== void 0) return blamed(env, untestable);
+      const known = knownNullTest(env, expr);
+      if (known !== void 0) return known;
+      const target = valueSql(env, expr.operand);
+      if (expr.value === null)
+        return `(${target} IS ${expr.not ? "NOT " : ""}NULL)`;
+      const test = isBoolean(target, expr.value);
+      return expr.not ? `(NOT (${test}))` : `(${test})`;
+    }
+    case "in": {
+      const left = valueSql(env, expr.operand);
+      const collate = env.check ? checkCollation(env, operandSide(env, expr.operand), null) : "";
+      const list = expr.list.map((item) => valueSql(env, item));
+      return `(${left}${collate} ${expr.not ? "NOT " : ""}IN (${list.join(", ")}))`;
+    }
+    case "inSelect": {
+      const left = valueSql(env, expr.operand);
+      const leftSide = env.check ? operandSide(env, expr.operand) : null;
+      const sub = subquerySql(env, expr.subquery, "value");
+      const collate = leftSide && sub.item ? checkCollation(env, leftSide, sub.item) : "";
+      return `(${left}${collate} ${expr.not ? "NOT " : ""}IN (${sub.sql}))`;
+    }
+    case "like": {
+      const problem = policyPatternProblem(expr.pattern, expr.ci);
+      if (problem !== void 0) return blamed(env, problem);
+      const target = valueSql(env, expr.operand, "pattern");
+      const not = expr.not ? "NOT " : "";
+      const pattern = bind(env, boundPattern(expr.pattern, expr.ci));
+      return expr.ci ? `(${target} ${not}LIKE ${pattern} ESCAPE '\\')` : `(${target} ${not}GLOB ${pattern})`;
+    }
+    case "between": {
+      if (env.check) {
+        const low2 = comparison(env, expr.operand, ">=", expr.low);
+        const high2 = comparison(env, expr.operand, "<=", expr.high);
+        const both = `(${low2} AND ${high2})`;
+        return expr.not ? `(NOT ${both})` : both;
+      }
+      const target = valueSql(env, expr.operand);
+      const low = valueSql(env, expr.low);
+      const high = valueSql(env, expr.high);
+      return `(${target} ${expr.not ? "NOT " : ""}BETWEEN ${low} AND ${high})`;
+    }
+    case "array": {
+      const values = distinctArrayValues(
+        expr.values.flatMap(
+          (value) => typeof value !== "object" ? [value] : env.req.uid === null ? [] : [env.req.uid]
+        )
+      );
+      const nullElement = expr.values.some(
+        (value) => typeof value === "object" && env.req.uid === null
+      );
+      let next = 0;
+      return arraySql(
+        () => (() => {
+          const { source, column: column2 } = resolveColumn(env, expr.operand);
+          return source.read(column2, env, { qualified: true, textual: null });
+        })(),
+        ARRAY_OPERATORS3[expr.op],
+        values.length,
+        () => bind(env, values[next++] ?? null),
+        nullElement
+      );
+    }
+    case "exists":
+      return `(EXISTS (${subquerySql(env, expr.subquery, "one").sql}))`;
+  }
+}
+function subquerySql(env, subquery, select) {
+  const table = resolveTable(env.snapshot, subquery.table);
+  if (!table) return blamed(env, missingRelationReason(subquery.table));
+  const { state } = env;
+  if (++state.subqueries > MAX_STATEMENT_SUBQUERIES)
+    return blamed(
+      env,
+      `the policies read more than ${String(MAX_STATEMENT_SUBQUERIES)} subqueries in one statement, counting the policies of the tables they read`
+    );
+  if (state.depth + 1 > MAX_INLINE_DEPTH)
+    return blamed(
+      env,
+      `subqueries nest more than ${String(MAX_INLINE_DEPTH)} deep, counting the policies of the tables they read`
+    );
+  state.depth++;
+  try {
+    const alias = `_naro_s${String(++state.aliases)}`;
+    const source = storedSource(
+      table,
+      [asciiLower(subquery.alias ?? table.name)],
+      alias
+    );
+    const inner = { ...env, scopes: [...env.scopes, source] };
+    let item = null;
+    let selected = "1";
+    if (select === "value") {
+      if (subquery.select === "*")
+        return blamed(env, "IN (SELECT \u2026) selects one value, not *");
+      selected = valueSql(inner, subquery.select);
+      if (env.check) item = operandSide(inner, subquery.select);
+    }
+    const own2 = storedSource(table, [asciiLower(table.name)], alias);
+    const rls = inlinedPolicies(env, table, own2);
+    const where = subquery.where === null ? "" : ` AND ${conditionSql(inner, subquery.where)}`;
+    return {
+      sql: `SELECT ${selected} FROM ${quoteIdentifier(table.name)} AS ${quoteIdentifier(alias)} WHERE ${rls}${where}`,
+      item
+    };
+  } finally {
+    state.depth--;
+  }
+}
+function hasSubqueries(policies) {
+  return policies.some(
+    (policy) => [policy.usingExpr, policy.checkExpr].some(
+      (expr) => expr !== null && subqueriesOf(expr).length > 0
+    )
+  );
+}
+function withTableActive(state, table, policies, compile2) {
+  if (!hasSubqueries(policies)) return compile2();
+  const key = asciiLower(table);
+  if (state.active.includes(key))
+    fail(
+      dataError("POLICY_INVALID", { action: "select", table, recursion: true }),
+      `a policy's subquery reads ${table}, whose own policies are still being expanded`
+    );
+  state.active.push(key);
+  try {
+    return compile2();
+  } finally {
+    state.active.pop();
+  }
+}
+function groupTerms(env, sources, action, permissive, restrictive, pick2) {
+  const compileOne = (policy, expr) => {
+    const params = [];
+    const sql = conditionSql(
+      { ...env, scopes: sources, params, blame: { policy, action } },
+      expr
+    );
+    const [source] = sources;
+    const problem = source === void 0 ? void 0 : textTruthProblem(env.snapshot, source.table, expr);
+    if (problem !== void 0) fail(policyInvalid(policy, action), problem);
+    return { sql, params };
+  };
+  const terms = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of permissive) {
+    const expr = pick2(policy);
+    if (expr === null) continue;
+    const term = compileOne(policy, expr);
+    const key = JSON.stringify([term.sql, term.params]);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    terms.push(term);
+  }
+  const group = terms.length === 0 ? { sql: "0", params: [] } : terms.length === 1 ? terms[0] : {
+    sql: `(${terms.map((term) => term.sql).join(" OR ")})`,
+    params: terms.flatMap((term) => term.params)
+  };
+  const restricted = restrictive.flatMap((policy) => {
+    const expr = pick2(policy);
+    return expr === null ? [] : [{ policy, term: compileOne(policy, expr) }];
+  });
+  return { permissive: group, restrictive: restricted };
+}
+function inlinedPolicies(env, table, source) {
+  const found = applicablePolicies(
+    env.req.policies,
+    table.name,
+    "select",
+    env.req.role
+  );
+  if (found.invalid)
+    fail(
+      policyInvalid(found.invalid, "select"),
+      found.invalid.invalid ?? void 0
+    );
+  if (found.permissive.length === 0) return "0";
+  return withTableActive(
+    env.state,
+    table.name,
+    [...found.permissive, ...found.restrictive],
+    () => {
+      const inner = { ...env, check: null, params: [] };
+      const terms = groupTerms(
+        inner,
+        [source],
+        "select",
+        found.permissive,
+        found.restrictive,
+        (policy) => policy.usingExpr
+      );
+      const parts = uniqueTerms([
+        terms.permissive,
+        ...terms.restrictive.map((entry) => entry.term)
+      ]);
+      for (const part of parts) env.params.push(...part.params);
+      const [only] = parts;
+      if (parts.length === 1 && only) return only.sql;
+      return `(${parts.map((part) => part.sql).join(" AND ")})`;
+    }
+  );
+}
+function uniqueTerms(terms) {
+  const seen = /* @__PURE__ */ new Set();
+  return terms.filter((term) => {
+    const key = JSON.stringify([term.sql, term.params]);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function outerColumns(table, expr) {
+  if (subqueriesOf(expr).length > 0) return void 0;
+  const found = [];
+  let missing = false;
+  const visitValue = (value) => {
+    switch (value.kind) {
+      case "column": {
+        const column2 = table.byName.get(asciiLower(value.name));
+        if (!column2) missing = true;
+        else found.push(column2);
+        return;
+      }
+      case "func":
+        value.args.forEach(visitValue);
+        return;
+      case "cast":
+        visitValue(value.operand);
+        return;
+      default:
+        return;
+    }
+  };
+  const visit = (node) => {
+    if (isValueExpr(node)) {
+      visitValue(node);
+      return;
+    }
+    switch (node.kind) {
+      case "and":
+      case "or":
+        node.args.forEach(visit);
+        return;
+      case "not":
+        visit(node.arg);
+        return;
+      case "compare":
+      case "distinct":
+        visitValue(node.left);
+        visitValue(node.right);
+        return;
+      case "is":
+      case "like":
+        visitValue(node.operand);
+        return;
+      case "in":
+        visitValue(node.operand);
+        node.list.forEach(visitValue);
+        return;
+      case "between":
+        [node.operand, node.low, node.high].forEach(visitValue);
+        return;
+      case "array":
+        visitValue(node.operand);
+        return;
+      default:
+        missing = true;
+    }
+  };
+  visit(expr);
+  return missing ? void 0 : found;
+}
+function resolveRef2(ref, scopes) {
+  const name = asciiLower(ref.name);
+  const qualifier = ref.qualifier === null ? null : asciiLower(ref.qualifier);
+  for (const scope of scopes.toReversed()) {
+    if (qualifier !== null) {
+      if (!scope.names.includes(qualifier)) continue;
+      const column3 = scope.table.byName.get(name);
+      return column3 ? { table: scope.table, column: column3 } : void 0;
+    }
+    const column2 = scope.table.byName.get(name);
+    if (column2) return { table: scope.table, column: column2 };
+  }
+  return void 0;
+}
+function scopedValues(operand, scopes) {
+  return operandValues(operand).map((value) => ({ value, scopes }));
+}
+function subqueryScopes(snapshot, subquery, scopes) {
+  const inner = resolveTable(snapshot, subquery.table);
+  return inner ? [
+    ...scopes,
+    { names: [asciiLower(subquery.alias ?? inner.name)], table: inner }
+  ] : void 0;
+}
+function columnsReadOn(snapshot, table, expr, written) {
+  const found = [];
+  const visitValue = (value, scopes) => {
+    switch (value.kind) {
+      case "column": {
+        const resolved = resolveRef2(value, scopes);
+        if (resolved?.table === written) found.push(resolved.column);
+        return;
+      }
+      case "func":
+        for (const arg of value.args) visitValue(arg, scopes);
+        return;
+      case "cast":
+        visitValue(value.operand, scopes);
+        return;
+      default:
+        return;
+    }
+  };
+  const visitSubquery = (subquery, scopes) => {
+    const within = subqueryScopes(snapshot, subquery, scopes);
+    if (!within) return;
+    if (subquery.select !== "*") visitValue(subquery.select, within);
+    if (subquery.where) visit(subquery.where, within);
+  };
+  const visit = (node, scopes) => {
+    if (isValueExpr(node)) {
+      visitValue(node, scopes);
+      return;
+    }
+    switch (node.kind) {
+      case "and":
+      case "or":
+        for (const arg of node.args) visit(arg, scopes);
+        return;
+      case "not":
+        visit(node.arg, scopes);
+        return;
+      case "compare":
+      case "distinct":
+        visitValue(node.left, scopes);
+        visitValue(node.right, scopes);
+        return;
+      case "is":
+      case "like":
+      case "array":
+        visitValue(node.operand, scopes);
+        return;
+      case "in":
+        visitValue(node.operand, scopes);
+        for (const item of node.list) visitValue(item, scopes);
+        return;
+      case "between":
+        for (const item of [node.operand, node.low, node.high])
+          visitValue(item, scopes);
+        return;
+      case "exists":
+        visitSubquery(node.subquery, scopes);
+        return;
+      case "inSelect":
+        visitValue(node.operand, scopes);
+        visitSubquery(node.subquery, scopes);
+        return;
+    }
+  };
+  visit(expr, [{ names: [asciiLower(table.name)], table }]);
+  return found;
+}
+function truthColumns(snapshot, table, expr) {
+  return comparedColumns(snapshot, table, expr, isBooleanConstant, true);
+}
+function numberComparedColumns(snapshot, table, expr) {
+  return comparedColumns(
+    snapshot,
+    table,
+    expr,
+    (value) => value.kind === "literal" && typeof value.value === "number",
+    false
+  );
+}
+function comparedColumns(snapshot, table, expr, constant, truth) {
+  const found = [];
+  const read = (ref, scopes) => {
+    const resolved = resolveRef2(ref, scopes);
+    if (resolved) found.push({ written: printExpr(ref), ...resolved });
+  };
+  const compared = (node, scopes) => {
+    for (const { left, right, inner } of comparedPairs(node)) {
+      const within = inner && node.kind === "inSelect" ? subqueryScopes(snapshot, node.subquery, scopes) : scopes;
+      const met = [
+        ...scopedValues(left, scopes),
+        ...within ? scopedValues(right, within) : []
+      ];
+      if (!met.some(({ value }) => constant(value))) continue;
+      for (const { value, scopes: where } of met)
+        if (value.kind === "column") read(value, where);
+    }
+  };
+  const visit = (node, scopes) => {
+    if (isValueExpr(node)) {
+      if (truth && node.kind === "column") read(node, scopes);
+      return;
+    }
+    compared(node, scopes);
+    switch (node.kind) {
+      case "and":
+      case "or":
+        for (const arg of node.args) visit(arg, scopes);
+        return;
+      case "not":
+        visit(node.arg, scopes);
+        return;
+      case "is":
+        if (truth && node.value !== null && node.operand.kind === "column")
+          read(node.operand, scopes);
+        return;
+      case "exists":
+      case "inSelect": {
+        const within = subqueryScopes(snapshot, node.subquery, scopes);
+        if (within && node.subquery.where) visit(node.subquery.where, within);
+        return;
+      }
+      default:
+        return;
+    }
+  };
+  visit(expr, [{ names: [asciiLower(table.name)], table }]);
+  return found;
+}
+function textTruthProblem(snapshot, table, expr) {
+  for (const { written, column: column2 } of truthColumns(snapshot, table, expr))
+    if (!isNumeric(column2))
+      return `${written} is a ${columnAffinity(column2)} column, whose truth value is not what its text says ('true' reads as false): compare it, ${written} = 'true'`;
+  return void 0;
+}
+function selectCheckRefusal(path, column2, problem) {
+  const reason = {
+    generated: `is not available: the select policy reads the generated column ${column2}, which a new row cannot be checked against`,
+    collation: `is not available: the select policy reads ${column2}, whose collation naro cannot read, so a new row cannot be checked against it`,
+    pattern: `is not available: the select policy compares the number column ${column2} with like or ilike, which a new row cannot be checked against`,
+    textual: `is not available: the select policy turns the number column ${column2} into text, which a new row cannot be checked against`
+  }[problem];
+  return invalidQuery(path, reason);
+}
+
+// ../../packages/data-core/src/policy.ts
+function commandsOf(query) {
+  switch (query.action) {
+    case "select":
+      return ["select"];
+    case "insert":
+      return query.returning === void 0 ? ["insert"] : ["insert", "select"];
+    default:
+      return [query.action, "select"];
+  }
+}
+var ANON_CLAIMS = {
+  sub: null,
+  role: "anon",
+  email: null,
+  email_verified: null
+};
+function rlsIdentity(context) {
+  if (context.role !== "authenticated" || context.userId === "")
+    return { role: "anon", uid: null, claims: ANON_CLAIMS };
+  const verified = context.emailVerified === true;
+  return {
+    role: "authenticated",
+    uid: context.userId,
+    claims: {
+      sub: context.userId,
+      role: "authenticated",
+      email: verified ? context.email ?? null : null,
+      email_verified: context.emailVerified ?? null
+    }
+  };
+}
+function decideQuery(context, query, policies, table) {
+  if (context.role === "service") return { allow: true };
+  const identity = rlsIdentity(context);
+  const all = policies ?? [];
+  for (const command of commandsOf(query)) {
+    const found = applicablePolicies(all, table, command, identity.role);
+    if (found.invalid)
+      return {
+        allow: false,
+        error: policyInvalid(found.invalid, command),
+        reason: found.invalid.invalid ?? "it cannot be read"
+      };
+    if (found.permissive.length === 0)
+      return {
+        allow: false,
+        error: dataError("PERMISSION_DENIED", { action: command, table })
+      };
+  }
+  return { allow: true, rls: { ...identity, policies: all } };
+}
+
+// ../../packages/data-core/src/compiler.ts
+var MAX_PARAMETERS = 100;
+var MAX_STATEMENT_BYTES = 1e5;
+var MAX_INSERT_STATEMENTS = 100;
+var OR_ABORT = "OR ABORT";
+function column(table, name) {
+  return table.byName.get(asciiLower(name)) ?? fail(dataError("COLUMN_NOT_FOUND", { column: name, table: table.name }));
+}
+function columnList(table, names) {
+  const seen = /* @__PURE__ */ new Set();
+  const columns = [];
+  for (const name of names) {
+    const resolved = column(table, name);
+    if (seen.has(resolved.name)) continue;
+    seen.add(resolved.name);
+    columns.push(resolved);
+  }
+  return columns;
+}
+function selectList(columns) {
+  return columns.map((item) => quoteIdentifier(item.name)).join(", ");
+}
+function returningClause(table, returning, action) {
+  if (returning === void 0) return "";
+  if (returning !== "*" && returning.length === 0)
+    fail(invalidQuery("returning", "must name at least one column"));
+  if (table.kind === "virtual" && action !== "insert")
+    fail(
+      invalidQuery(
+        "returning",
+        `is not available for ${action} on the virtual table ${table.name}`
+      )
+    );
+  const columns = returning === "*" ? table.columns : columnList(table, returning);
+  return ` RETURNING ${selectList(columns)}`;
+}
+function scalar(value, path) {
+  if (Array.isArray(value) || !isValue(value))
+    fail(invalidQuery(path, "must be a single value"));
+  return value;
+}
+function arrayValues(value, path) {
+  const reason = `must be a non-empty array of strings and numbers (at most ${String(MAX_ARRAY_VALUES)})`;
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ARRAY_VALUES)
+    fail(invalidQuery(path, reason));
+  const items = [];
+  for (const item of value) {
+    if (typeof item !== "string" && !(typeof item === "number" && Number.isFinite(item)))
+      fail(invalidQuery(path, reason));
+    items.push(item);
+  }
+  return distinctArrayValues(items);
+}
+function filterSql(table, filter, params, path) {
+  const resolved = column(table, filter.column);
+  const target = quoteIdentifier(resolved.name);
+  const valuePath = `${path}.value`;
+  switch (filter.operator) {
+    case "eq":
+    case "neq":
+    case "gt":
+    case "gte":
+    case "lt":
+    case "lte": {
+      const operator = {
+        eq: "=",
+        neq: "<>",
+        gt: ">",
+        gte: ">=",
+        lt: "<",
+        lte: "<="
+      }[filter.operator];
+      params.push(toBoundValue(scalar(filter.value, valuePath)));
+      return `${target} ${operator} ?`;
+    }
+    case "in": {
+      if (!Array.isArray(filter.value))
+        fail(invalidQuery(valuePath, "must be an array"));
+      if (filter.value.length === 0) return "0 = 1";
+      for (const [index, item] of filter.value.entries())
+        params.push(toBoundValue(scalar(item, `${valuePath}[${index}]`)));
+      return `${target} IN (${filter.value.map(() => "?").join(", ")})`;
+    }
+    case "is": {
+      const value = filter.value;
+      if (value !== null && value !== true && value !== false)
+        fail(invalidQuery(valuePath, "must be null, true or false"));
+      if (value === null) {
+        params.push(null);
+        return `${target} IS ?`;
+      }
+      return isBoolean(target, value);
+    }
+    case "ilike":
+    case "like": {
+      if (typeof filter.value !== "string")
+        fail(invalidQuery(valuePath, "must be a string"));
+      const problem = patternProblem(filter.operator, filter.value);
+      if (problem !== void 0) fail(invalidQuery(valuePath, problem));
+      const ilike = filter.operator === "ilike";
+      params.push(boundPattern(filter.value, ilike));
+      return ilike ? `${target} LIKE ? ESCAPE '\\'` : `${target} GLOB ?`;
+    }
+    case "contains":
+    case "containedBy":
+    case "overlaps": {
+      const values = arrayValues(filter.value, valuePath);
+      const qualified = `${quoteIdentifier(table.name)}.${target}`;
+      let next = 0;
+      return arraySql(
+        () => qualified,
+        filter.operator,
+        values.length,
+        () => {
+          params.push(values[next++] ?? null);
+          return "?";
+        }
+      );
+    }
+  }
+}
+function nodeSql(table, node, params, path) {
+  if ("operator" in node) return filterSql(table, node, params, path);
+  if ("not" in node)
+    return `NOT (${nodeSql(table, node.not, params, `${path}.not`)})`;
+  const [key, children] = "or" in node ? ["or", node.or] : ["and", node.and];
+  if (children.length === 0)
+    fail(invalidQuery(`${path}.${key}`, "must not be empty"));
+  const terms = children.map(
+    (child, index) => nodeSql(table, child, params, `${path}.${key}[${index}]`)
+  );
+  return `(${terms.join(key === "or" ? " OR " : " AND ")})`;
+}
+function whereClause(table, filters, policy, params) {
+  const parts = [];
+  if (policy) {
+    parts.push(policy.sql);
+    params.push(...policy.params);
+  }
+  const client = filters.map(
+    (node, index) => nodeSql(table, node, params, `filters[${index}]`)
+  );
+  if (client.length > 0) parts.push(`(${client.join(" AND ")})`);
+  return parts.length === 0 ? "" : ` WHERE ${parts.join(" AND ")}`;
+}
+function orderClause(table, order) {
+  if (order.length === 0) return "";
+  const terms = order.map((term) => {
+    const direction = term.ascending ? "ASC" : "DESC";
+    const nulls = term.nullsFirst === void 0 ? "" : term.nullsFirst ? " NULLS FIRST" : " NULLS LAST";
+    return `${quoteIdentifier(column(table, term.column).name)} ${direction}${nulls}`;
+  });
+  return ` ORDER BY ${terms.join(", ")}`;
+}
+function statement(sql, params) {
+  if (params.length > MAX_PARAMETERS) fail(dataError("TOO_MANY_PARAMETERS"));
+  if (utf8ByteLength(sql) > MAX_STATEMENT_BYTES)
+    fail(
+      invalidQuery(
+        "",
+        `compiles to more than ${String(MAX_STATEMENT_BYTES)} bytes of SQL, D1's limit for one statement`
+      )
+    );
+  return { sql, params };
+}
+function assignments(table, row, path) {
+  const resolved = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(row)) {
+    const target = column(table, key);
+    if (target.generated)
+      fail(
+        invalidQuery(
+          `${path}.${key}`,
+          `Column ${target.name} is generated and cannot be written.`
+        )
+      );
+    if (resolved.has(target.name))
+      fail(
+        invalidQuery(
+          `${path}.${key}`,
+          `Column ${target.name} is given more than once.`
+        )
+      );
+    resolved.set(target.name, { column: target, value });
+  }
+  return resolved;
+}
+function hasCondition(nodes) {
+  return (nodes ?? []).some((node) => {
+    if ("operator" in node) return true;
+    if ("not" in node) return hasCondition([node.not]);
+    return hasCondition("or" in node ? node.or : node.and);
+  });
+}
+function requireFilter(query, context) {
+  if (hasCondition(query.filters)) return;
+  if (query.allowUnfiltered === true && context.role === "service") return;
+  fail(dataError("FILTER_REQUIRED"));
+}
+function mustBeNumber(action) {
+  return `must be a number, a boolean or null, since the ${action} policy checks it`;
+}
+function mustBeNumberFor(type) {
+  return `must be a number, a boolean or null, since the column is declared ${type}`;
+}
+function mustIncludeFor(name, command) {
+  return `must include ${name}, which the ${command} policy checks`;
+}
+function mustInclude(name, action) {
+  return action === "select" ? `${mustIncludeFor(name, action)} before a row is returned` : mustIncludeFor(name, action);
+}
+function mustNotBeNull(action) {
+  return action === "select" ? "must not be null, since the select policy checks this key column before a row is returned" : `must not be null, since the ${action} policy checks this key column`;
+}
+function keepFirst(map2, item, policy) {
+  if (isNumeric(item) && !map2.has(item.name)) map2.set(item.name, policy);
+}
+function insertSource(table, group) {
+  const checked = /* @__PURE__ */ new Set();
+  const source = {
+    table,
+    names: [asciiLower(table.name)],
+    used: false,
+    read: (item, env, how) => {
+      const check2 = env.check;
+      if (!check2) return fail(dataError("INTERNAL_ERROR"));
+      source.used = true;
+      if (item.generated)
+        check2.problem(item.name, "generated", env.blame.policy);
+      if (how.textual && isNumeric(item))
+        check2.problem(item.name, how.textual, env.blame.policy);
+      const index = group.columns.indexOf(item);
+      if (index < 0) {
+        const omitted = omittedSql(item);
+        if (omitted === void 0)
+          fail(
+            invalidQuery(
+              `rows[${String(group.indexes[0] ?? 0)}]`,
+              mustInclude(item.name, check2.action)
+            )
+          );
+        return omitted;
+      }
+      if (!checked.has(item.name)) {
+        checked.add(item.name);
+        for (const [row, values] of group.rows.entries()) {
+          const path = `rows[${String(group.indexes[row] ?? row)}].${item.name}`;
+          if (item.primaryKey > 0 && values[index] === null)
+            fail(invalidQuery(path, mustNotBeNull(check2.action)));
+          const value2 = values[index];
+          if (typeof value2 === "string" && refusesText(item, value2))
+            fail(invalidQuery(path, mustBeNumber(check2.action)));
+        }
+      }
+      const value = `_naro_new.column${String(index + 1)}`;
+      return group.rows.every(
+        (values) => readsAsIs(item, values[index] ?? null)
+      ) ? value : asStored(item, value);
+    },
+    operand: (item) => group.columns.includes(item) ? { stable: false, newColumnish: true, newCollation: "BINARY" } : { stable: false, newColumnish: false, newCollation: null }
+  };
+  return source;
+}
+function updateSource(table, values) {
+  const plain = storedSource(table, [asciiLower(table.name)], null);
+  const source = {
+    table,
+    names: [asciiLower(table.name)],
+    used: false,
+    read: (item, env, how) => {
+      const check2 = env.check;
+      if (!check2) return fail(dataError("INTERNAL_ERROR"));
+      source.used = true;
+      if (item.generated)
+        check2.problem(item.name, "generated", env.blame.policy);
+      const set2 = values.get(item.name);
+      if (!set2) return plain.read(item, env, how);
+      if (how.textual && isNumeric(item))
+        check2.problem(item.name, how.textual, env.blame.policy);
+      const bound = toBoundValue(set2.value);
+      if (typeof bound === "string" && refusesText(item, bound))
+        fail(invalidQuery(`values.${item.name}`, mustBeNumber(check2.action)));
+      env.params.push(bound);
+      return readsAsIs(item, bound) ? "?" : asStored(item, "?");
+    },
+    operand: (item) => values.has(item.name) ? { stable: false, newColumnish: false, newCollation: null } : { stable: true, newColumnish: true, newCollation: item.collation }
+  };
+  return source;
+}
+function checkProblemReason(column2, problem) {
+  switch (problem) {
+    case "generated":
+      return `${column2} is a generated column, which a WITH CHECK cannot read (an update policy without WITH CHECK checks its USING)`;
+    case "collation":
+      return `${column2} has a collation naro cannot read, which a WITH CHECK needs to compare it`;
+    case "pattern":
+      return `${column2} is a number column, which a WITH CHECK cannot compare with LIKE or ILIKE`;
+    case "textual":
+      return `${column2} is a number column, which a WITH CHECK cannot turn into text (lower, upper, length, ::text)`;
+  }
+}
+function isTrue(term) {
+  return term.sql === "1" && term.params.length === 0;
+}
+var Rls = class {
+  constructor(req, snapshot, table, nonce, commands) {
+    this.req = req;
+    this.snapshot = snapshot;
+    this.table = table;
+    this.nonce = nonce;
+    this.outer = storedSource(table, [asciiLower(table.name)], null);
+    const all = commands.flatMap((command) => {
+      const found = this.found(command);
+      return [...found.permissive, ...found.restrictive];
+    });
+    if (hasSubqueries(all)) this.state.active.push(asciiLower(table.name));
+    for (const command of commands) {
+      const found = this.found(command);
+      for (const policy of [...found.permissive, ...found.restrictive]) {
+        if (policy.owner === null) continue;
+        const owner = table.byName.get(asciiLower(policy.owner));
+        if (!owner || owner.generated)
+          fail(
+            policyInvalid(policy, command),
+            owner ? `the owner column ${owner.name} is a generated column` : `the owner column ${policy.owner} is not on ${table.name}`
+          );
+      }
+    }
+  }
+  state = newState2();
+  /** Restrictive policies named by the checks' markers. */
+  restrictive = [];
+  outer;
+  /**
+   * A new statement of the same query — an insert's next group of rows:
+   * MAX_STATEMENT_SUBQUERIES is a cap on one statement's SQL, so its count
+   * starts again (P2-7 적대적 리뷰 반영: counted across an insert's groups,
+   * rows naming different columns let any caller get the owner's 500).
+   */
+  nextStatement() {
+    this.state.subqueries = 0;
+    this.state.aliases = 0;
+  }
+  found(command) {
+    const found = applicablePolicies(
+      this.req.policies,
+      this.table.name,
+      command,
+      this.req.role
+    );
+    if (found.invalid)
+      fail(
+        policyInvalid(found.invalid, command),
+        found.invalid.invalid ?? void 0
+      );
+    return found;
+  }
+  env(check2, blame, action) {
+    return {
+      req: this.req,
+      snapshot: this.snapshot,
+      scopes: [this.outer],
+      params: [],
+      state: this.state,
+      blame: { policy: blame, action },
+      check: check2
+    };
+  }
+  /**
+   * The owner column when every permissive policy of the command is an
+   * owner policy of that one column (spec §10) — then a row that does not
+   * hold the caller's id there fails the policy anyway, and is refused with
+   * P1's POLICY_VIOLATION.
+   */
+  ownerOnly(command) {
+    const { permissive } = this.found(command);
+    const owners = new Set(
+      permissive.map(
+        (policy) => policy.owner === null ? null : asciiLower(policy.owner)
+      )
+    );
+    if (owners.size !== 1) return void 0;
+    const [owner] = owners;
+    return owner ? this.table.byName.get(owner) : void 0;
+  }
+  /** The columns an insert fills with the caller's id (spec §10). */
+  fills() {
+    const columns = /* @__PURE__ */ new Map();
+    for (const policy of this.found("insert").permissive) {
+      if (policy.owner === null) continue;
+      const owner = this.table.byName.get(asciiLower(policy.owner));
+      if (owner) columns.set(owner.name, owner);
+    }
+    return [...columns.values()];
+  }
+  /** WHERE's policy part (spec §5): the command's USING, and SELECT's. */
+  where(action) {
+    const commands = action === "select" ? ["select"] : [action, "select"];
+    const terms = [];
+    for (const command of commands) {
+      const found = this.found(command);
+      const first = found.permissive[0];
+      if (!first) {
+        terms.push({ sql: "0", params: [] });
+        continue;
+      }
+      const group = groupTerms(
+        this.env(null, first, command),
+        [this.outer],
+        command,
+        found.permissive,
+        found.restrictive,
+        (policy) => policy.usingExpr
+      );
+      terms.push(group.permissive, ...group.restrictive.map((e) => e.term));
+    }
+    const kept = uniqueTerms(terms).filter((term) => !isTrue(term));
+    const [only] = kept;
+    if (!only) return null;
+    if (kept.length === 1) return only;
+    return {
+      sql: `(${kept.map((term) => term.sql).join(" AND ")})`,
+      params: kept.flatMap((term) => term.params)
+    };
+  }
+  /**
+   * The checks on a new row (spec §5, §8.2), in Postgres's order: the
+   * command's permissive policies together, its restrictive ones each, then
+   * — for an insert with `returning`, and every update — SELECT's. `skip`
+   * leaves out a group a WHERE already guarantees (§8.5).
+   */
+  checks(action, source, withSelect, skip, holdsCaller) {
+    const groups = [
+      {
+        command: action,
+        kind: action,
+        pick: (policy) => policy.checkExpr ?? policy.usingExpr
+      }
+    ];
+    if (withSelect)
+      groups.push({
+        command: "select",
+        kind: "select",
+        pick: (policy) => policy.usingExpr
+      });
+    const terms = [];
+    for (const { command, kind, pick: pick2 } of groups) {
+      const found = this.found(command);
+      const first = found.permissive[0];
+      if (!first) {
+        terms.push({
+          sql: "0",
+          params: [],
+          marker: checkMarker(kind, this.nonce),
+          kind,
+          policy: void 0
+        });
+        continue;
+      }
+      if (skip(command, [...found.permissive, ...found.restrictive])) continue;
+      const mode = {
+        action: kind,
+        problem: (name, problem, policy) => kind === "select" ? fail(
+          selectCheckRefusal(
+            action === "insert" ? "returning" : "values",
+            name,
+            problem
+          )
+        ) : fail(
+          policyInvalid(policy, action),
+          checkProblemReason(name, problem)
+        )
+      };
+      const ownerColumn = this.ownerOnly(command);
+      const owned = this.req.uid !== null && ownerColumn !== void 0 && holdsCaller(ownerColumn);
+      const group = groupTerms(
+        { ...this.env(mode, first, command), scopes: [source] },
+        [source],
+        command,
+        owned ? [] : found.permissive,
+        found.restrictive,
+        pick2
+      );
+      if (!owned && !isTrue(group.permissive))
+        terms.push({
+          ...group.permissive,
+          marker: checkMarker(kind, this.nonce),
+          kind,
+          policy: first
+        });
+      for (const { policy, term } of group.restrictive) {
+        if (isTrue(term)) continue;
+        const index = this.restrictive.push(policy.name) - 1;
+        terms.push({
+          ...term,
+          marker: checkMarker(kind, this.nonce, index),
+          kind,
+          policy
+        });
+      }
+    }
+    return terms;
+  }
+  /**
+   * Whether an update's check group is guaranteed by its WHERE (spec §8.5):
+   * no subquery, no generated column, no column the update sets, and — for
+   * UPDATE's own — every policy's check the same as its USING.
+   */
+  implied(command, policies, set2) {
+    for (const policy of policies) {
+      if (command === "update") {
+        if (policy.usingExpr === null) return false;
+        if (policy.check !== null && policy.check !== policy.using)
+          return false;
+      }
+      const expr = policy.usingExpr;
+      if (expr === null) continue;
+      const read = outerColumns(this.table, expr);
+      if (!read) return false;
+      if (read.some((item) => item.generated || set2.has(item.name)))
+        return false;
+    }
+    return true;
+  }
+  /**
+   * The number columns policies read, and those they read as true or false
+   * or compare with a number, each with the first policy that does; read
+   * once, on the first string.
+   */
+  textReaders;
+  /**
+   * Refuses text written to a number column that a policy reads — any
+   * table's policy, whatever its command or role, and whether or not this
+   * statement's checks read it (known-issues #88). Stored, `'true'` is
+   * false to `NOT is_private` and turns the policy inside out; Postgres
+   * would read it as a boolean. A uuid-like column (`numberClass`
+   * "fallback") keeps text that is no number, so only text it would store
+   * as a number is refused — unless a policy reads it as true or false
+   * (`truthColumns`) or compares it with a number (`numberComparedColumns`,
+   * PR #80 리뷰: `hidden <> 1` let the text 'true' through): then it takes
+   * no text at all. The refusal is named after the first policy that reads
+   * the column, in the order they are read (table, then name), `all` after
+   * the statement.
+   *
+   * And text a number or boolean column (INT, REAL, FLOA, DOUB, NUM, DEC,
+   * BOOL, BIT) would keep as text, whether or not a policy reads it now
+   * (PR #80 리뷰): a policy written later reads what is already stored.
+   * Text it stores as a number ("7") is that number, and kept; so is the
+   * caller's own id in an owner policy's column, which an owner insert
+   * writes there itself and the owner condition compares as text (spec
+   * §10 — owner policies are left out of the refusal above too).
+   */
+  refuseText(action, path, target, value) {
+    if (typeof value !== "string") return;
+    const { numbers, truths } = this.textReaders ??= this.readersOfText();
+    const reader = refusesText(target, value) ? numbers.get(target.name) : truths.get(target.name);
+    if (reader)
+      fail(
+        invalidQuery(
+          path,
+          mustBeNumber(reader.command === "all" ? action : reader.command)
+        )
+      );
+    if (numberClass(target.type) === "number" && !storesAsNumber(value) && !this.ownId(target, value))
+      fail(invalidQuery(path, mustBeNumberFor(target.type)));
+  }
+  /** The caller's id, in a column an owner policy of this table names. */
+  ownId(target, value) {
+    return value === this.req.uid && this.req.policies.some(
+      (policy) => policy.owner !== null && asciiLower(policy.owner) === asciiLower(target.name) && resolveTable(this.snapshot, policy.table) === this.table
+    );
+  }
+  /**
+   * The same refusal for a column an insert leaves out, whose DEFAULT is a
+   * string (P2-7b 최종 리뷰 I2): SQLite stores it as it would store that
+   * string sent, so `is_private BOOLEAN DEFAULT 'true'` holds the text
+   * `'true'`, which `NOT is_private` reads as false. Only text SQLite keeps
+   * as text — a DEFAULT `'0'` is stored as 0 — and then by the rule for a
+   * sent string: a number or boolean column any policy reads, a fallback
+   * one a policy reads as true or false. The client must send the value.
+   * A name SQLite makes a string (`DEFAULT "true"`, `DEFAULT yes`) is that
+   * text, and a blob `x'…'` — never stored as a number — is refused as text
+   * that is no number (P2-7b 최종 리뷰 후속 2).
+   */
+  refuseOmittedText(path, target) {
+    const stored = stringDefault(target);
+    if (stored === void 0) return;
+    if (stored.kind === "text" && storesAsNumber(stored.text)) return;
+    const { numbers, truths } = this.textReaders ??= this.readersOfText();
+    const refused = stored.kind === "text" ? refusesText(target, stored.text) : numberClass(target.type) === "number";
+    const reader = refused ? numbers.get(target.name) : truths.get(target.name);
+    if (reader)
+      fail(
+        invalidQuery(
+          path,
+          mustIncludeFor(
+            target.name,
+            reader.command === "all" ? "insert" : reader.command
+          )
+        )
+      );
+  }
+  readersOfText() {
+    const numbers = /* @__PURE__ */ new Map();
+    const truths = /* @__PURE__ */ new Map();
+    for (const policy of this.req.policies) {
+      if (policy.owner !== null) continue;
+      const on = resolveTable(this.snapshot, policy.table);
+      if (!on) continue;
+      for (const expr of [policy.usingExpr, policy.checkExpr]) {
+        if (expr === null) continue;
+        for (const read of columnsReadOn(this.snapshot, on, expr, this.table))
+          keepFirst(numbers, read, policy);
+        for (const read of [
+          ...truthColumns(this.snapshot, on, expr),
+          ...numberComparedColumns(this.snapshot, on, expr)
+        ])
+          if (read.table === this.table) keepFirst(truths, read.column, policy);
+      }
+    }
+    return { numbers, truths };
+  }
+  /**
+   * The policy part's values and SQL must leave D1's other half of each to
+   * the request: 50 of 100 values, 50,000 of 100,000 bytes.
+   */
+  budget(parts) {
+    const count2 = parts.reduce((sum, part) => sum + part.params.length, 0);
+    if (count2 > MAX_POLICY_VALUES)
+      fail(
+        dataError("POLICY_INVALID", {
+          action: "select",
+          table: this.table.name,
+          values: true
+        }),
+        `they bind ${String(count2)}`
+      );
+    const bytes = parts.reduce(
+      (sum, part) => sum + utf8ByteLength(part.sql),
+      0
+    );
+    if (bytes > MAX_POLICY_STATEMENT_BYTES)
+      fail(
+        dataError("POLICY_INVALID", {
+          action: "select",
+          table: this.table.name,
+          bytes: true
+        }),
+        `they write ${String(bytes)}`
+      );
+  }
+};
+function checkCase(table, terms, guard, pass, action, nonce) {
+  if (terms.length === 0) return pass;
+  let sql = pass.sql;
+  let params = pass.params;
+  for (const term of terms.toReversed()) {
+    sql = `CASE WHEN ${term.sql} THEN ${sql} ELSE ${term.marker} END`;
+    params = [...term.params, ...params];
+  }
+  if (!guard) return { sql, params };
+  if (table.sql === null) {
+    const first = terms.find((term) => term.policy !== void 0);
+    if (first?.kind === "select" || !first?.policy)
+      fail(
+        invalidQuery(
+          action === "insert" ? "returning" : "values",
+          `is not available: naro cannot read the schema of ${table.name}, so a new row cannot be checked against its select policy`
+        )
+      );
+    fail(policyInvalid(first.policy, action));
+  }
+  return {
+    sql: `CASE WHEN (SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?) = ? THEN ${sql} ELSE ${schemaMarker(nonce)} END`,
+    params: [table.name, table.sql, ...params]
+  };
+}
+function compileSelect(query, table, rls) {
+  if (query.columns !== "*" && query.columns.length === 0)
+    fail(invalidQuery("columns", "must name at least one column"));
+  const columns = query.columns === "*" ? table.columns : columnList(table, query.columns);
+  const params = [];
+  const policy = rls?.where("select") ?? null;
+  if (rls && policy) rls.budget([policy]);
+  const where = whereClause(table, query.filters ?? [], policy, params);
+  const order = orderClause(table, query.order ?? []);
+  const limit = query.limit ?? MAX_LIMIT;
+  params.push(query.single ? Math.min(limit, 2) : limit, query.offset ?? 0);
+  return [
+    statement(
+      `SELECT ${selectList(columns)} FROM ${quoteIdentifier(table.name)}${where}${order} LIMIT ? OFFSET ?`,
+      params
+    )
+  ];
+}
+function compileInsert(query, table, rls, nonce) {
+  const uid = rls?.req.uid ?? null;
+  const ownerInsert = rls?.ownerOnly("insert");
+  const ownerRead = rls && query.returning !== void 0 ? rls.ownerOnly("select") : void 0;
+  const fills = rls && uid !== null ? rls.fills() : [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const [index, row] of query.rows.entries()) {
+    const values = assignments(table, row, `rows[${index}]`);
+    if (ownerInsert) {
+      const given = values.get(ownerInsert.name);
+      if (given && given.value !== uid)
+        fail(dataError("POLICY_VIOLATION", { column: ownerInsert.name }));
+    }
+    for (const owner of fills)
+      if (!values.has(owner.name) && uid !== null)
+        values.set(owner.name, { column: owner, value: uid });
+    if (ownerRead && values.get(ownerRead.name)?.value !== uid)
+      fail(dataError("POLICY_VIOLATION", { column: ownerRead.name }));
+    const ordered = [...values.values()].toSorted(
+      (left, right) => left.column.cid - right.column.cid
+    );
+    const bound = ordered.map((item) => toBoundValue(item.value));
+    const key = ordered.map(
+      (item, at) => rls && readsAsIs(item.column, bound[at] ?? null) ? `${String(item.column.cid)}t` : String(item.column.cid)
+    ).join(",");
+    let group = groups.get(key);
+    if (!group) {
+      group = {
+        columns: ordered.map((item) => item.column),
+        rows: [],
+        indexes: []
+      };
+      groups.set(key, group);
+    }
+    group.rows.push(bound);
+    group.indexes.push(index);
+  }
+  const plans = [...groups.values()].map((group) => {
+    const width = group.columns.length;
+    if (width > MAX_PARAMETERS) fail(dataError("TOO_MANY_PARAMETERS"));
+    let where;
+    if (rls) {
+      rls.nextStatement();
+      const source = insertSource(table, group);
+      const terms = rls.checks(
+        "insert",
+        source,
+        query.returning !== void 0,
+        () => false,
+        // Every row sends the caller's id there (filled in or checked).
+        (owner) => {
+          const index = group.columns.indexOf(owner);
+          return index >= 0 && group.rows.every((row) => row[index] === uid);
+        }
+      );
+      if (terms.length > 0) {
+        where = checkCase(
+          table,
+          terms,
+          source.used,
+          { sql: width === 0 ? "0" : "1", params: [] },
+          "insert",
+          nonce
+        );
+        rls.budget([
+          { sql: where.sql, params: terms.flatMap((term) => term.params) }
+        ]);
+      }
+    }
+    const checkParams = where?.params ?? [];
+    const room = MAX_PARAMETERS - checkParams.length;
+    if (width > 0 && room < width) fail(dataError("TOO_MANY_PARAMETERS"));
+    const perStatement = width === 0 ? 1 : Math.floor(room / width);
+    const needed2 = width === 0 ? group.rows.length + (where === void 0 ? 0 : 1) : Math.ceil(group.rows.length / perStatement);
+    return { group, width, where, perStatement, needed: needed2 };
+  });
+  const needed = plans.reduce((sum, plan) => sum + plan.needed, 0);
+  if (needed > MAX_INSERT_STATEMENTS)
+    fail(
+      invalidQuery(
+        "rows",
+        `would take ${String(needed)} statements; one insert may take at most ${String(MAX_INSERT_STATEMENTS)} (each binds at most ${String(MAX_PARAMETERS)} values, and a row with no values takes one of its own)`
+      )
+    );
+  const into = `INSERT ${OR_ABORT} INTO ${quoteIdentifier(table.name)}`;
+  const returning = returningClause(table, query.returning, "insert");
+  if (rls) {
+    for (const { group } of plans)
+      for (const [row, values] of group.rows.entries())
+        for (const [index, item] of group.columns.entries())
+          rls.refuseText(
+            "insert",
+            `rows[${String(group.indexes[row] ?? row)}].${item.name}`,
+            item,
+            values[index] ?? null
+          );
+    for (const { group } of plans)
+      for (const item of table.columns)
+        if (!item.generated && !group.columns.includes(item))
+          rls.refuseOmittedText(`rows[${String(group.indexes[0] ?? 0)}]`, item);
+  }
+  const statements = [];
+  for (const { group, width, where, perStatement } of plans) {
+    if (width === 0) {
+      if (where !== void 0)
+        statements.push(statement(`SELECT 1 WHERE ${where.sql}`, where.params));
+      for (let count2 = 0; count2 < group.rows.length; count2++)
+        statements.push(statement(`${into} DEFAULT VALUES${returning}`, []));
+      continue;
+    }
+    const tuple2 = `(${group.columns.map(() => "?").join(", ")})`;
+    const names = selectList(group.columns);
+    for (let start = 0; start < group.rows.length; start += perStatement) {
+      const chunk = group.rows.slice(start, start + perStatement);
+      const values = chunk.map(() => tuple2).join(", ");
+      statements.push(
+        where === void 0 ? statement(
+          `${into} (${names}) VALUES ${values}${returning}`,
+          chunk.flat()
+        ) : statement(
+          `${into} (${names}) SELECT ${group.columns.map((_, index) => `_naro_new.column${String(index + 1)}`).join(", ")} FROM (VALUES ${values}) AS _naro_new WHERE ${where.sql}${returning}`,
+          [...chunk.flat(), ...where.params]
+        )
+      );
+    }
+  }
+  return statements;
+}
+function compileUpdate(query, table, context, rls, nonce) {
+  requireFilter(query, context);
+  const values = assignments(table, query.values, "values");
+  if (values.size === 0)
+    fail(invalidQuery("values", "must set at least one column"));
+  const ownerUpdate = rls?.ownerOnly("update");
+  if (ownerUpdate) {
+    const given = values.get(ownerUpdate.name);
+    if (given && given.value !== rls?.req.uid)
+      fail(dataError("POLICY_VIOLATION", { column: ownerUpdate.name }));
+  }
+  const set2 = new Set(values.keys());
+  const policy = rls?.where("update") ?? null;
+  const source = rls ? updateSource(table, values) : void 0;
+  const terms = rls && source ? rls.checks(
+    "update",
+    source,
+    true,
+    (command, policies) => rls.implied(command, policies, set2),
+    // Kept as WHERE found it, or set to the caller's id.
+    (owner) => {
+      const given = values.get(owner.name);
+      return !given || given.value === rls.req.uid;
+    }
+  ) : [];
+  const params = [];
+  let checkSql = "";
+  const assigned = [...values.values()].map((item, index) => {
+    const value = { sql: "?", params: [toBoundValue(item.value)] };
+    const expression = index === 0 && terms.length > 0 ? checkCase(table, terms, source?.used ?? false, value, "update", nonce) : value;
+    if (expression !== value) checkSql = expression.sql;
+    params.push(...expression.params);
+    return `${quoteIdentifier(item.column.name)} = ${expression.sql}`;
+  });
+  rls?.budget([
+    { sql: checkSql, params: terms.flatMap((term) => term.params) },
+    ...policy ? [policy] : []
+  ]);
+  const where = whereClause(table, query.filters ?? [], policy, params);
+  const returning = returningClause(table, query.returning, "update");
+  for (const item of values.values())
+    rls?.refuseText(
+      "update",
+      `values.${item.column.name}`,
+      item.column,
+      toBoundValue(item.value)
+    );
+  return [
+    statement(
+      `UPDATE ${OR_ABORT} ${quoteIdentifier(table.name)} SET ${assigned.join(", ")}${where}${returning}`,
+      params
+    )
+  ];
+}
+function compileDelete(query, table, context, rls) {
+  requireFilter(query, context);
+  const params = [];
+  const policy = rls?.where("delete") ?? null;
+  if (rls && policy) rls.budget([policy]);
+  const where = whereClause(table, query.filters ?? [], policy, params);
+  return [
+    statement(
+      `DELETE FROM ${quoteIdentifier(table.name)}${where}${returningClause(table, query.returning, "delete")}`,
+      params
+    )
+  ];
+}
+function compile(query, snapshot, decision, context, options = {}) {
+  const nonce = options.checkNonce ?? DEFAULT_CHECK_NONCE;
+  if (!/^[0-9a-f]{1,64}$/.test(nonce))
+    throw new Error("compile: checkNonce must be 1 to 64 hex digits");
+  if (!decision.allow)
+    return decision.reason === void 0 ? { ok: false, error: decision.error } : { ok: false, error: decision.error, reason: decision.reason };
+  const table = resolveTable(snapshot, query.table);
+  if (!table)
+    return {
+      ok: false,
+      error: dataError("TABLE_NOT_FOUND", { table: query.table })
+    };
+  try {
+    const rls = decision.rls ? new Rls(decision.rls, snapshot, table, nonce, commandsOf(query)) : void 0;
+    let statements;
+    switch (query.action) {
+      case "select":
+        statements = compileSelect(query, table, rls);
+        break;
+      case "insert":
+        statements = compileInsert(query, table, rls, nonce);
+        break;
+      case "update":
+        statements = compileUpdate(query, table, context, rls, nonce);
+        break;
+      case "delete":
+        statements = compileDelete(query, table, context, rls);
+        break;
+    }
+    return { ok: true, statements, restrictive: rls?.restrictive ?? [] };
+  } catch (error51) {
+    if (error51 instanceof Failure)
+      return error51.reason === void 0 ? { ok: false, error: error51.error } : { ok: false, error: error51.error, reason: error51.reason };
+    throw error51;
+  }
+}
+
+// ../../packages/data-core/src/policy-index.ts
+var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
+function indexesFromRows(rows) {
+  const tables = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const table = row.table_name;
+    const column2 = row.column_name;
+    if (typeof table !== "string" || typeof column2 !== "string") continue;
+    if (Number(row.partial) !== 0) continue;
+    const key = asciiLower(table);
+    const columns = tables.get(key) ?? /* @__PURE__ */ new Map();
+    tables.set(key, columns);
+    const collations = columns.get(asciiLower(column2)) ?? [];
+    collations.push(
+      typeof row.collation === "string" ? row.collation.toUpperCase() : "BINARY"
+    );
+    columns.set(asciiLower(column2), collations);
+  }
+  return tables;
+}
+function resolve8(scopes, qualifier, name) {
+  const column2 = asciiLower(name);
+  for (let index = scopes.length - 1; index >= 0; index--) {
+    const scope = scopes[index];
+    if (qualifier !== null && !scope.names.includes(asciiLower(qualifier)))
+      continue;
+    const found = scope.table.byName.get(column2);
+    if (found) return { column: found, scope: index };
+    if (qualifier !== null) return void 0;
+  }
+  return void 0;
+}
+function valueScopes(scopes, value) {
+  switch (value.kind) {
+    case "column": {
+      const found = resolve8(scopes, value.qualifier, value.name);
+      return found ? [found.scope] : [];
+    }
+    case "func":
+      return value.args.flatMap((arg) => valueScopes(scopes, arg));
+    case "cast":
+      return valueScopes(scopes, value.operand);
+    default:
+      return [];
+  }
+}
+function readsOutside(scopes, expr, depth, snapshot) {
+  if (expr === null) return false;
+  if (isValueExpr(expr))
+    return valueScopes(scopes, expr).some((scope) => scope < depth);
+  const values = (...items) => items.some(
+    (item) => valueScopes(scopes, item).some((scope) => scope < depth)
+  );
+  switch (expr.kind) {
+    case "and":
+    case "or":
+      return expr.args.some(
+        (arg) => readsOutside(scopes, arg, depth, snapshot)
+      );
+    case "not":
+      return readsOutside(scopes, expr.arg, depth, snapshot);
+    case "compare":
+    case "distinct":
+      return values(expr.left, expr.right);
+    case "is":
+    case "like":
+      return values(expr.operand);
+    case "in":
+      return values(expr.operand, ...expr.list);
+    case "between":
+      return values(expr.operand, expr.low, expr.high);
+    case "array":
+      return values(expr.operand);
+    case "exists":
+    case "inSelect": {
+      if (expr.kind === "inSelect" && values(expr.operand)) return true;
+      const inner = subqueryScopes2(scopes, expr.subquery, snapshot);
+      if (!inner) return false;
+      return expr.subquery.select !== "*" && readsOutside(inner, expr.subquery.select, depth, snapshot) || readsOutside(inner, expr.subquery.where, depth, snapshot);
+    }
+  }
+}
+function subqueryScopes2(scopes, subquery, snapshot) {
+  const table = resolveTable(snapshot, subquery.table);
+  if (!table) return void 0;
+  return [
+    ...scopes,
+    { table, names: [asciiLower(subquery.alias ?? table.name)] }
+  ];
+}
+function conjuncts(expr) {
+  if (expr === null) return [];
+  if (!isValueExpr(expr) && expr.kind === "and")
+    return expr.args.flatMap(conjuncts);
+  return [expr];
+}
+function columnAffinityOf(column2) {
+  const affinity2 = columnAffinity(column2);
+  if (affinity2 === "TEXT") return "text";
+  if (affinity2 === "BLOB") return "blob";
+  return "numeric";
+}
+function valueAffinity(scopes, value) {
+  if (value.kind === "cast") return "text";
+  if (value.kind !== "column") return "none";
+  const found = resolve8(scopes, value.qualifier, value.name);
+  return found ? columnAffinityOf(found.column) : "none";
+}
+function valueCollation(scopes, value) {
+  if (value.kind === "cast") return valueCollation(scopes, value.operand);
+  if (value.kind !== "column") return void 0;
+  const found = resolve8(scopes, value.qualifier, value.name);
+  return found ? found.column.collation : void 0;
+}
+function waysIn(scopes, where) {
+  const inner = scopes.length - 1;
+  const own2 = (value) => {
+    if (value.kind !== "column") return void 0;
+    const found = resolve8(scopes, value.qualifier, value.name);
+    return found?.scope === inner ? found.column : void 0;
+  };
+  const outside = (value) => valueScopes(scopes, value).every((scope) => scope < inner);
+  const ways = [];
+  const pair2 = (left, right) => {
+    for (const [mine, other, mineLeft] of [
+      [left, right, true],
+      [right, left, false]
+    ]) {
+      const column2 = own2(mine);
+      if (!column2 || !outside(other)) continue;
+      const first = mineLeft ? mine : other;
+      const second = mineLeft ? other : mine;
+      const collation = valueCollation(scopes, first) !== void 0 ? valueCollation(scopes, first) : valueCollation(scopes, second);
+      const mineAffinity = columnAffinityOf(column2);
+      const otherAffinity = valueAffinity(scopes, other);
+      const affinity2 = otherAffinity === "none" ? mineAffinity : mineAffinity === "numeric" || otherAffinity === "numeric" ? "numeric" : "blob";
+      ways.push({ column: column2, collation, affinity: affinity2 });
+    }
+  };
+  for (const condition of conjuncts(where)) {
+    if (isValueExpr(condition)) continue;
+    if (condition.kind === "compare" && condition.op === "=")
+      pair2(condition.left, condition.right);
+    else if (condition.kind === "distinct" && condition.not)
+      pair2(condition.left, condition.right);
+    else if (condition.kind === "in" && !condition.not) {
+      const column2 = own2(condition.operand);
+      if (column2 && condition.list.every(outside))
+        ways.push({
+          column: column2,
+          collation: column2.collation,
+          affinity: columnAffinityOf(column2)
+        });
+    }
+  }
+  return ways;
+}
+function isRowid(table, column2) {
+  const keys = table.columns.filter((item) => item.primaryKey > 0);
+  return keys.length === 1 && keys[0] === column2 && asciiLower(column2.type.trim()) === "integer";
+}
+function blocked(table, indexes, way) {
+  if (isRowid(table, way.column))
+    return way.affinity === "text" ? "affinity" : void 0;
+  const collations = indexes.get(asciiLower(table.name))?.get(asciiLower(way.column.name));
+  if (!collations || collations.length === 0) return "none";
+  const wanted = way.collation === void 0 ? way.column.collation : way.collation;
+  if (wanted !== null && !collations.includes(wanted)) return "collation";
+  const own2 = columnAffinityOf(way.column);
+  if (way.affinity === "text" && own2 !== "text") return "affinity";
+  if (way.affinity === "numeric" && own2 !== "numeric") return "affinity";
+  return void 0;
+}
+function problemMessage(policy, outer, table, ways, why) {
+  const start = `Policy ${policy.name} on ${outer.name}: its subquery on ${table.name} runs once for every row of ${outer.name} it looks at`;
+  const override = "or send it with allow_unindexed=1 (naro policy create --allow-unindexed) to accept a scan of every row";
+  const [way] = ways;
+  if (!way)
+    return `${start}, and no condition of its WHERE compares a column of ${table.name} with = to a value from outside it, so each run reads all of ${table.name}. Compare a column of ${table.name} with = (or IN) and index that column \u2014 ${override}.`;
+  const column2 = way.column.name;
+  if (why === "affinity")
+    return `${start}, and it compares ${table.name}.${column2} with a value of another type (a number and text), which no index can search, so each run reads all of ${table.name}. Compare it with a value of its own type \u2014 ${override}.`;
+  const wanted = way.collation === void 0 || way.collation === null ? null : way.collation;
+  const collate = why === "collation" && wanted !== null && wanted !== way.column.collation ? ` COLLATE ${wanted}` : "";
+  const index = quoteIdent(`${table.name}_${column2}_idx`);
+  return `${start}, and no index starts with ${table.name}.${column2}${collate === "" ? "" : ` in collation ${String(wanted)}`}, so each run reads all of ${table.name}. Create one first: CREATE INDEX ${index} ON ${quoteIdent(table.name)} (${quoteIdent(column2)}${collate}); \u2014 ${override}.`;
+}
+function unindexedSubqueries(snapshot, indexes, policies) {
+  const found = [];
+  for (const policy of policies) {
+    if (policy.invalid !== null) continue;
+    const outer = resolveTable(snapshot, policy.table);
+    if (!outer) continue;
+    const visit = (scopes, expr) => {
+      if (expr === null || isValueExpr(expr)) return;
+      switch (expr.kind) {
+        case "and":
+        case "or":
+          expr.args.forEach((arg) => visit(scopes, arg));
+          return;
+        case "not":
+          visit(scopes, expr.arg);
+          return;
+        case "exists":
+        case "inSelect": {
+          const inner = subqueryScopes2(scopes, expr.subquery, snapshot);
+          if (!inner) return;
+          const depth = inner.length - 1;
+          const correlated = expr.subquery.select !== "*" && readsOutside(inner, expr.subquery.select, depth, snapshot) || readsOutside(inner, expr.subquery.where, depth, snapshot);
+          if (correlated) {
+            const table = inner[depth].table;
+            const ways = waysIn(inner, expr.subquery.where);
+            const reasons = ways.map((way) => blocked(table, indexes, way));
+            if (!reasons.includes(void 0)) {
+              const order = ["none", "collation", "affinity"];
+              const best = order.map((reason) => reasons.indexOf(reason)).find((index) => index >= 0);
+              const way = best === void 0 ? void 0 : ways[best];
+              found.push({
+                policy,
+                table: table.name,
+                message: problemMessage(
+                  policy,
+                  outer,
+                  table,
+                  way ? [way] : [],
+                  best === void 0 ? void 0 : reasons[best]
+                )
+              });
+            }
+          }
+          visit(inner, expr.subquery.where);
+          return;
+        }
+        default:
+          return;
+      }
+    };
+    const root = [{ table: outer, names: [asciiLower(outer.name)] }];
+    visit(root, policy.usingExpr);
+    visit(root, policy.checkExpr);
+  }
+  return found;
+}
+
+// ../../packages/data-core/src/policy-check.ts
+var CONTEXTS = [
+  { role: "anon" },
+  {
+    role: "authenticated",
+    userId: "naro-policy-check",
+    email: "check@naro.invalid",
+    emailVerified: true
+  }
+];
+function probes(table, context, owners) {
+  const writable = table.columns.filter((column2) => !column2.generated);
+  const [first] = table.columns;
+  const filters = first ? [{ operator: "is", column: first.name, value: null }] : [];
+  const row = Object.fromEntries(
+    writable.map((column2) => [
+      column2.name,
+      context.role === "authenticated" && owners.has(asciiLower(column2.name)) ? context.userId : isNumeric(column2) ? 0 : "naro-policy-check"
+    ])
+  );
+  const queries = [
+    { version: 1, action: "select", table: table.name, columns: "*" },
+    { version: 1, action: "insert", table: table.name, rows: [row] },
+    {
+      version: 1,
+      action: "insert",
+      table: table.name,
+      rows: [row],
+      returning: "*"
+    },
+    { version: 1, action: "delete", table: table.name, filters }
+  ];
+  if (writable.length > 0)
+    queries.push({
+      version: 1,
+      action: "update",
+      table: table.name,
+      values: row,
+      filters
+    });
+  return queries;
+}
+function namedInRefusal(message, policies) {
+  let found;
+  for (const policy of policies) {
+    if (!message.startsWith(`Policy ${policy.name} on ${policy.table} cannot be`))
+      continue;
+    if (found === void 0 || policy.name.length > found.name.length)
+      found = policy;
+  }
+  return found;
+}
+function problems(snapshot, policies, options) {
+  const found = /* @__PURE__ */ new Map();
+  const loaded = loadNamed(policies);
+  for (const policy of loaded)
+    if (policy.invalid !== null)
+      found.set(`read:${policy.table}:${policy.name}`, {
+        problem: {
+          table: policy.table,
+          message: `Policy ${policy.name} on ${policy.table} cannot be read: ${policy.invalid}.`,
+          policy: policy.name,
+          kind: "read"
+        },
+        policy: policy.name
+      });
+  const tables = /* @__PURE__ */ new Map();
+  for (const policy of loaded) {
+    const table = resolveTable(snapshot, policy.table);
+    if (table) tables.set(table.name, table);
+  }
+  for (const policy of loaded) {
+    const table = resolveTable(snapshot, policy.table);
+    if (!table || policy.invalid !== null) continue;
+    for (const expr of [policy.usingExpr, policy.checkExpr]) {
+      if (expr === null) continue;
+      for (const { written, column: column2 } of truthColumns(snapshot, table, expr)) {
+        if (isNumeric(column2)) continue;
+        const message = `Policy ${policy.name} on ${policy.table} cannot be applied: ${written} is a ${columnAffinity(column2)} column, whose truth value is not what its text says ('true' reads as false): compare it, ${written} = 'true'.`;
+        found.set(`${table.name}:${message}`, {
+          problem: {
+            table: table.name,
+            message,
+            policy: policy.name,
+            kind: "compile"
+          },
+          policy: policy.name
+        });
+      }
+    }
+  }
+  for (const policy of loaded) {
+    const table = resolveTable(snapshot, policy.table);
+    if (!table || policy.invalid !== null) continue;
+    for (const { written, column: column2 } of numberReadsOf(snapshot, table, policy)) {
+      const stored = stringDefault(column2);
+      if (stored === void 0) continue;
+      if (stored.kind === "text" && storesAsNumber(stored.text)) continue;
+      const kept = stored.kind === "text" ? "text" : "a blob";
+      found.set(`default:${table.name}:${policy.name}:${written}`, {
+        problem: {
+          table: table.name,
+          message: `Policy ${policy.name} on ${policy.table} reads ${written} as a boolean or a number, but its DEFAULT ${String(column2.defaultValue)} is stored as ${kept}, which the policy does not read as it says ('true' reads as false): the rows that took it \u2014 every row there when the column was added, and each service-key insert that leaves it out \u2014 hold that value. Write the default as a number (1, 0, TRUE or FALSE) and update those rows.`,
+          policy: policy.name,
+          kind: "default"
+        },
+        policy: policy.name
+      });
+    }
+  }
+  const probe = loadNamed(
+    [...tables.values()].map((table) => ({
+      table: table.name,
+      name: "naro_policy_check",
+      permissive: true,
+      command: "select",
+      roles: ["anon", "authenticated"],
+      using: "true",
+      check: null,
+      owner: null
+    }))
+  );
+  const compiled = [...loaded, ...probe];
+  for (const table of tables.values()) {
+    const owners = new Set(
+      policiesOn(loaded, table.name).flatMap(
+        (policy) => policy.owner ? [asciiLower(policy.owner)] : []
+      )
+    );
+    for (const context of CONTEXTS)
+      for (const query of probes(table, context, owners)) {
+        const decision = decideQuery(context, query, compiled, table.name);
+        const result = decision.allow ? compile(query, snapshot, decision, context) : {
+          ok: false,
+          error: decision.error,
+          reason: decision.reason
+        };
+        if (result.ok || result.error.code !== "POLICY_INVALID") continue;
+        const message = result.reason === void 0 ? result.error.message : `${result.error.message.replace(/\.$/, "")}: ${result.reason}.`;
+        const named = namedInRefusal(result.error.message, loaded);
+        const blamed2 = named === void 0 ? table.name : resolveTable(snapshot, named.table)?.name ?? named.table;
+        const key = `${blamed2}:${message}`;
+        if (!found.has(key))
+          found.set(key, {
+            problem: {
+              table: blamed2,
+              message,
+              ...named === void 0 ? {} : { policy: named.name },
+              kind: "compile"
+            },
+            policy: ""
+          });
+      }
+  }
+  if (options.indexes && options.allowUnindexed !== true)
+    for (const problem of unindexedSubqueries(
+      snapshot,
+      options.indexes,
+      loaded
+    )) {
+      const key = `index:${problem.policy.table}:${problem.message}`;
+      if (!found.has(key))
+        found.set(key, {
+          problem: {
+            table: problem.policy.table,
+            message: problem.message,
+            policy: problem.policy.name,
+            kind: "unindexed"
+          },
+          policy: problem.policy.name
+        });
+    }
+  return found;
+}
+function byText(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function policySetProblems(snapshot, policies, options = {}) {
+  return [...problems(snapshot, policies, options).values()].toSorted(
+    (a, b) => byText(a.problem.table, b.problem.table) || byText(a.policy, b.policy) || byText(a.problem.message, b.problem.message)
+  ).map(({ problem }) => problem);
+}
+function numberReadsOf(snapshot, table, policy) {
+  const reads = /* @__PURE__ */ new Map();
+  for (const expr of [policy.usingExpr, policy.checkExpr]) {
+    if (expr === null) continue;
+    for (const read of [
+      ...truthColumns(snapshot, table, expr),
+      ...numberComparedColumns(snapshot, table, expr)
+    ]) {
+      const key = JSON.stringify([read.table.name, read.column.name]);
+      if (isNumeric(read.column) && !reads.has(key)) reads.set(key, read);
+    }
+  }
+  return [...reads.values()];
+}
+
+// ../../packages/data-core/src/policy-statement.ts
+function readPolicyName(stream) {
+  const token = stream.peek();
+  if (token.kind !== "ident")
+    throw new PolicySyntaxError(
+      `expected a policy name, found ${describeToken(token)}`,
+      token.position
+    );
+  stream.next();
+  return foldPolicyName(token.value, token.quoted);
+}
+function readRoleName(token) {
+  if (token.kind !== "ident")
+    throw new PolicySyntaxError(
+      `expected a role, found ${describeToken(token)}`,
+      token.position
+    );
+  return token.quoted ? token.value : asciiLower(token.value);
+}
+function readCommand(stream) {
+  const token = stream.next();
+  for (const command of [
+    "all",
+    "select",
+    "insert",
+    "update",
+    "delete"
+  ])
+    if (isKeyword(token, command)) return command;
+  throw new PolicySyntaxError(
+    `expected ALL, SELECT, INSERT, UPDATE or DELETE, found ${describeToken(token)}`,
+    token.position
+  );
+}
+function readClause(stream) {
+  const open = stream.expectOperator("(");
+  const expr = readCondition(stream);
+  stream.expectOperator(")");
+  checkExpressionSize(expr, open.position);
+  return { text: printExpr(expr), position: open.position };
+}
+function readCreate(stream, start) {
+  stream.expectKeyword("policy");
+  const name = readPolicyName(stream);
+  stream.expectKeyword("on");
+  const table = readTableName(stream);
+  let permissive = true;
+  if (stream.acceptKeyword("as")) {
+    const token = stream.next();
+    if (isKeyword(token, "restrictive")) permissive = false;
+    else if (!isKeyword(token, "permissive"))
+      throw new PolicySyntaxError(
+        `expected PERMISSIVE or RESTRICTIVE, found ${describeToken(token)}`,
+        token.position
+      );
   }
   let command = "all";
   if (stream.acceptKeyword("for")) command = readCommand(stream);
@@ -22278,6 +25093,7 @@ function readCreate(stream, start) {
     position = clause.position;
   }
   if (!roles.ok) throw new Error("unreachable");
+  readEnd(stream);
   const policy = {
     table,
     name,
@@ -22304,21 +25120,31 @@ function readDrop(stream) {
   stream.expectKeyword("on");
   const table = readTableName(stream);
   if (!stream.acceptKeyword("cascade")) stream.acceptKeyword("restrict");
+  readEnd(stream);
   return { kind: "drop", name, table, ifExists };
 }
-function parsePolicyStatement(text) {
-  if (policySqlTooLong(text))
+function readEnd(stream) {
+  stream.acceptOperator(";");
+  const rest = stream.peek();
+  if (rest.kind !== "eof")
+    throw new PolicySyntaxError(
+      isKeyword(rest, "create") || isKeyword(rest, "drop") ? "one statement at a time" : `syntax error at or near ${describeToken(rest)}`,
+      rest.position
+    );
+}
+function parsePolicyStatement(text2) {
+  if (policySqlTooLong(text2))
     return {
       ok: false,
       reason: `the statement is longer than ${String(MAX_POLICY_SQL_BYTES)} bytes`,
       position: 1
     };
   try {
-    const stream = new TokenStream(tokenize(text));
+    const stream = new TokenStream(tokenize(text2));
     const start = stream.next();
-    let statement;
-    if (isKeyword(start, "create")) statement = readCreate(stream, start);
-    else if (isKeyword(start, "drop")) statement = readDrop(stream);
+    let statement2;
+    if (isKeyword(start, "create")) statement2 = readCreate(stream, start);
+    else if (isKeyword(start, "drop")) statement2 = readDrop(stream);
     else if (isKeyword(start, "alter"))
       throw new PolicySyntaxError(
         "ALTER POLICY is not supported here yet: DROP POLICY and CREATE POLICY again",
@@ -22331,24 +25157,17 @@ function parsePolicyStatement(text) {
         "only CREATE POLICY and DROP POLICY are accepted here",
         start.position
       );
-    stream.acceptOperator(";");
-    const rest = stream.peek();
-    if (rest.kind !== "eof")
-      throw new PolicySyntaxError(
-        isKeyword(rest, "create") || isKeyword(rest, "drop") ? "one statement at a time" : `syntax error at or near ${describeToken(rest)}`,
-        rest.position
-      );
-    return { ok: true, statement };
+    return { ok: true, statement: statement2 };
   } catch (error51) {
     if (error51 instanceof PolicySyntaxError)
       return { ok: false, reason: error51.reason, position: error51.position };
     throw error51;
   }
 }
-function splitPolicyStatements(text) {
+function splitPolicyStatements(text2) {
   let tokens;
   try {
-    tokens = tokenize(text);
+    tokens = tokenize(text2);
   } catch (error51) {
     if (error51 instanceof PolicySyntaxError)
       return { ok: false, reason: error51.reason, position: error51.position };
@@ -22360,16 +25179,428 @@ function splitPolicyStatements(text) {
     if (token.kind === "eof") break;
     start ??= token.position - 1;
     if (token.kind === "op" && token.value === ";") {
-      statements.push(text.slice(start, token.position).trim());
+      statements.push(text2.slice(start, token.position).trim());
       start = void 0;
     }
   }
   if (start !== void 0) {
-    const last = text.slice(start).trim();
+    const last = text2.slice(start).trim();
     if (last !== "") statements.push(last);
   }
   return { ok: true, statements };
 }
+var OWNER_PREFIX = "naro:owner";
+function ownerComment(text2, position) {
+  if (!text2.startsWith(OWNER_PREFIX)) return void 0;
+  const rest = text2.slice(OWNER_PREFIX.length);
+  if (rest !== "" && !/^[ \t]/.test(rest)) return void 0;
+  let column2 = rest.replace(/^[ \t]+|[ \t]+$/g, "");
+  if (column2.startsWith('"')) {
+    const quoted2 = /^"((?:[^"]|"")*)"$/.exec(column2);
+    if (!quoted2)
+      throw new PolicySyntaxError(
+        "naro:owner needs one column name, bare or in double quotes",
+        position
+      );
+    column2 = (quoted2[1] ?? "").replaceAll('""', '"');
+  }
+  if (column2 === "")
+    throw new PolicySyntaxError("naro:owner needs a column name", position);
+  return column2;
+}
+function readComment(stream) {
+  stream.expectKeyword("on");
+  stream.expectKeyword("policy");
+  const name = readPolicyName(stream);
+  stream.expectKeyword("on");
+  const table = readTableName(stream);
+  stream.expectKeyword("is");
+  const token = stream.next();
+  if (isKeyword(token, "null"))
+    return { kind: "comment", name, table, owner: null, isOwner: true };
+  if (token.kind !== "string")
+    throw new PolicySyntaxError(
+      `expected a string or NULL, found ${describeToken(token)}`,
+      token.position
+    );
+  const owner = ownerComment(token.value, token.position);
+  return owner === void 0 ? { kind: "comment", name, table, owner: null, isOwner: false } : { kind: "comment", name, table, owner, isOwner: true };
+}
+function readRowLevelSecurity(stream) {
+  if (stream.acceptKeyword("if")) stream.expectKeyword("exists");
+  stream.acceptKeyword("only");
+  const table = readTableName(stream);
+  const token = stream.next();
+  let action;
+  if (isKeyword(token, "enable")) action = "enable";
+  else if (isKeyword(token, "disable")) action = "disable";
+  else if (isKeyword(token, "force")) action = "force";
+  else if (isKeyword(token, "no")) {
+    stream.expectKeyword("force");
+    action = "no-force";
+  } else
+    throw new PolicySyntaxError(
+      `expected ENABLE, DISABLE, FORCE or NO FORCE, found ${describeToken(token)}`,
+      token.position
+    );
+  stream.expectKeyword("row");
+  stream.expectKeyword("level");
+  stream.expectKeyword("security");
+  return { kind: "rls", table, action };
+}
+function parseMigrationPolicyStatement(text2) {
+  if (policySqlTooLong(text2))
+    return {
+      ok: false,
+      reason: `the statement is longer than ${String(MAX_POLICY_SQL_BYTES)} bytes`,
+      position: 1
+    };
+  try {
+    const stream = new TokenStream(tokenize(text2));
+    let statement2;
+    if (stream.acceptKeyword("comment")) statement2 = readComment(stream);
+    else if (isKeyword(stream.peek(), "alter") && isKeyword(stream.peek(1), "table")) {
+      stream.next();
+      stream.next();
+      statement2 = readRowLevelSecurity(stream);
+    } else return parsePolicyStatement(text2);
+    readEnd(stream);
+    return { ok: true, statement: statement2 };
+  } catch (error51) {
+    if (error51 instanceof PolicySyntaxError)
+      return { ok: false, reason: error51.reason, position: error51.position };
+    throw error51;
+  }
+}
+
+// ../../packages/data-core/src/sql-head.ts
+var HEAD_TOKENS = 12;
+var BOM2 = 65279;
+function isBlankStart(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
+}
+function isBlank(char) {
+  return isBlankStart(char) || char === "\v";
+}
+function isWordStart(char) {
+  return /[A-Za-z_]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function isWordPart(char) {
+  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function skipBlanks(text2, from) {
+  let index = from;
+  for (; ; ) {
+    const char = text2.charAt(index);
+    if (isBlankStart(char)) {
+      index++;
+      while (index < text2.length && isBlank(text2.charAt(index))) index++;
+    } else if (text2.charCodeAt(index) === BOM2) index++;
+    else if (char === "-" && text2.charAt(index + 1) === "-") {
+      const end = text2.indexOf("\n", index + 2);
+      index = end < 0 ? text2.length : end;
+    } else if (char === "/" && text2.charAt(index + 1) === "*") {
+      const end = text2.indexOf("*/", index + 2);
+      index = end < 0 ? text2.length : end + 2;
+    } else return index;
+  }
+}
+function readQuoted(text2, start, delimiter) {
+  let value = "";
+  let index = start + 1;
+  for (; ; ) {
+    const close = text2.indexOf(delimiter, index);
+    if (close < 0) return void 0;
+    value += text2.slice(index, close);
+    if (text2.charAt(close + 1) === delimiter) {
+      value += delimiter;
+      index = close + 2;
+      continue;
+    }
+    return { text: value, end: close + 1 };
+  }
+}
+function headTokens(text2) {
+  const tokens = [];
+  let index = 0;
+  while (tokens.length < HEAD_TOKENS) {
+    index = skipBlanks(text2, index);
+    const char = text2.charAt(index);
+    if (index >= text2.length) break;
+    if (char === '"' || char === "`" || char === "'") {
+      const quoted2 = readQuoted(text2, index, char);
+      if (!quoted2) break;
+      tokens.push({ kind: "name", text: quoted2.text });
+      index = quoted2.end;
+    } else if (char === "[") {
+      const close = text2.indexOf("]", index + 1);
+      if (close < 0) break;
+      tokens.push({ kind: "name", text: text2.slice(index + 1, close) });
+      index = close + 1;
+    } else if ((char === "x" || char === "X") && text2.charAt(index + 1) === "'") {
+      break;
+    } else if (isWordStart(char)) {
+      let end = index + 1;
+      while (end < text2.length && isWordPart(text2.charAt(end))) end++;
+      tokens.push({ kind: "word", text: text2.slice(index, end) });
+      index = end;
+    } else if (char === "." && !/[0-9]/.test(text2.charAt(index + 1))) {
+      tokens.push({ kind: "dot" });
+      index++;
+    } else break;
+  }
+  tokens.push({ kind: "stop" });
+  return tokens;
+}
+var OTHER = { kind: "other" };
+var NO_NAME = {
+  kind: "unreadable",
+  reason: "the table name could not be read"
+};
+var OTHER_SCHEMA = {
+  kind: "unreadable",
+  reason: "a table in another schema"
+};
+var PUBLIC_SCHEMA = {
+  kind: "unreadable",
+  reason: 'SQLite has no schema "public": write the table name without "public."'
+};
+var Head = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  token(at) {
+    return this.tokens[Math.min(at, this.tokens.length - 1)] ?? { kind: "stop" };
+  }
+  /** The bare word `word` (lower case), in any ASCII case. */
+  is(at, word) {
+    const token = this.token(at);
+    return token.kind === "word" && asciiLower(token.text) === word;
+  }
+  nameAt(at) {
+    const token = this.token(at);
+    return token.kind === "word" || token.kind === "name" ? token.text : void 0;
+  }
+  /**
+   * SQLite's `fullname`. `main.` is the database a migration writes and is
+   * dropped; `temp.` (in any case, quoted or not, as sqlite3FindDbName
+   * matches it) is a table that goes with the connection; `public.` is
+   * what a Postgres migration writes, said in its own words; any other
+   * schema is one D1 does not have.
+   */
+  table(at) {
+    const first = this.nameAt(at);
+    if (first === void 0) return { ok: false, head: NO_NAME };
+    if (this.token(at + 1).kind !== "dot")
+      return { ok: true, name: first, next: at + 1 };
+    const second = this.nameAt(at + 2);
+    if (second === void 0) return { ok: false, head: NO_NAME };
+    const schema = asciiLower(first);
+    if (schema === "main") return { ok: true, name: second, next: at + 3 };
+    let head = OTHER_SCHEMA;
+    if (schema === "temp") head = OTHER;
+    else if (schema === "public") head = PUBLIC_SCHEMA;
+    return { ok: false, head, next: at + 3 };
+  }
+};
+function readCreate2(head) {
+  if (head.is(1, "policy")) return { kind: "create-policy" };
+  if (head.is(1, "temp") || head.is(1, "temporary")) return OTHER;
+  let at;
+  if (head.is(1, "table")) at = 2;
+  else if (head.is(1, "virtual") && head.is(2, "table")) at = 3;
+  else return OTHER;
+  if (head.is(at, "if")) {
+    if (!head.is(at + 1, "not") || !head.is(at + 2, "exists")) return NO_NAME;
+    at += 3;
+  }
+  const table = head.table(at);
+  return table.ok ? { kind: "create-table", table: table.name } : table.head;
+}
+function readDrop2(head) {
+  if (head.is(1, "policy")) return { kind: "drop-policy" };
+  if (!head.is(1, "table")) return OTHER;
+  let at = 2;
+  if (head.is(at, "if")) {
+    if (!head.is(at + 1, "exists")) return NO_NAME;
+    at += 2;
+  }
+  const table = head.table(at);
+  return table.ok ? { kind: "drop-table", table: table.name } : table.head;
+}
+var RLS_ACTIONS = ["enable", "disable", "force", "no"];
+function readAlter(head) {
+  if (head.is(1, "policy")) return { kind: "alter-policy" };
+  if (!head.is(1, "table")) return OTHER;
+  const sqlite = head.table(2);
+  const action = sqlite.next;
+  if (action !== void 0) {
+    if (head.is(action, "rename") && head.is(action + 1, "to")) {
+      if (!sqlite.ok) return sqlite.head;
+      const to = head.table(action + 2);
+      return to.ok ? { kind: "rename-table", table: sqlite.name, to: to.name } : to.head;
+    }
+    if (head.is(action, "rename") || head.is(action, "add") || head.is(action, "drop"))
+      return sqlite.ok ? { kind: "alter-table", table: sqlite.name } : sqlite.head;
+  }
+  let at = 2;
+  if (head.is(at, "if") && head.is(at + 1, "exists")) at += 2;
+  if (head.is(at, "only")) at++;
+  const next = head.table(at).next;
+  if (next !== void 0 && RLS_ACTIONS.some((word) => head.is(next, word)))
+    return { kind: "rls" };
+  return sqlite.ok ? OTHER : sqlite.head;
+}
+function readSqlHead(text2) {
+  if (text2.includes("\0"))
+    return { kind: "unreadable", reason: "the statement has a NUL character" };
+  const head = new Head(headTokens(text2));
+  if (head.is(0, "create")) return readCreate2(head);
+  if (head.is(0, "drop")) return readDrop2(head);
+  if (head.is(0, "alter")) return readAlter(head);
+  if (head.is(0, "comment") && head.is(1, "on") && head.is(2, "policy"))
+    return { kind: "comment-policy" };
+  if (head.is(0, "grant")) return { kind: "grant" };
+  if (head.is(0, "revoke")) return { kind: "revoke" };
+  return OTHER;
+}
+
+// ../../packages/data-core/src/policy-migration.ts
+var GRANT_REFUSAL = "naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
+function disableRefusal(table) {
+  return `naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${quoteIdent(table)} USING (true) WITH CHECK (true);`;
+}
+function relationMissing(table) {
+  return `relation "${table}" does not exist`;
+}
+var LATER_TABLE_CHANGE = "a later statement changes a table, so name the table of every column inside this policy's subqueries (for example members.user_id).";
+function tablesChanged(head) {
+  switch (head.kind) {
+    case "create-table":
+    case "drop-table":
+    case "alter-table":
+      return [asciiLower(head.table)];
+    case "rename-table":
+      return [asciiLower(head.table), asciiLower(head.to)];
+    case "unreadable":
+      return "any";
+    default:
+      return [];
+  }
+}
+function readsBareSubqueryColumn(policy) {
+  return [policy.using, policy.check].some((text2) => {
+    if (text2 === null) return false;
+    const parsed = parseExpression(text2);
+    return parsed.ok && unqualifiedInSubquery(parsed.expr) !== void 0;
+  });
+}
+function tablesInScope(policy) {
+  const tables = /* @__PURE__ */ new Set([asciiLower(policy.table)]);
+  for (const text2 of [policy.using, policy.check]) {
+    if (text2 === null) continue;
+    const parsed = parseExpression(text2);
+    if (!parsed.ok) continue;
+    for (const subquery of subqueriesOf(parsed.expr))
+      tables.add(asciiLower(subquery.table));
+  }
+  return tables;
+}
+function planPolicyMigration(statements) {
+  const count2 = statements.length;
+  const planned = [];
+  let hasPolicyStatements = false;
+  let touchesTables = false;
+  const heads = statements.map((text2) => readSqlHead(text2));
+  const changes = heads.map(tablesChanged);
+  const changedAfter = (index, tables) => changes.slice(index + 1).some(
+    (changed) => changed === "any" || changed.some((table) => tables.has(table))
+  );
+  for (const [index, text2] of statements.entries()) {
+    const refuse = (message) => ({
+      ok: false,
+      index,
+      message: `Statement ${String(index + 1)} of ${String(count2)}: ${message}`
+    });
+    const head = heads[index] ?? readSqlHead(text2);
+    switch (head.kind) {
+      case "grant":
+      case "revoke":
+        return refuse(GRANT_REFUSAL);
+      case "unreadable":
+        return refuse(`${head.reason}.`);
+      case "create-table":
+      case "drop-table":
+      case "rename-table":
+        touchesTables = true;
+        planned.push({ kind: "verbatim", text: text2, head });
+        continue;
+      case "alter-table":
+      case "other":
+        planned.push({ kind: "verbatim", text: text2, head });
+        continue;
+      default:
+        break;
+    }
+    const parsed = parseMigrationPolicyStatement(text2);
+    if (!parsed.ok)
+      return refuse(
+        `${parsed.reason} at character ${String(parsed.position)}.`
+      );
+    const statement2 = parsed.statement;
+    const table = statement2.kind === "create" ? statement2.policy.table : statement2.table;
+    if (isSystemTable(table)) return refuse(`${relationMissing(table)}.`);
+    switch (statement2.kind) {
+      case "create":
+        if (readsBareSubqueryColumn(statement2.policy) && changedAfter(index, tablesInScope(statement2.policy)))
+          return refuse(LATER_TABLE_CHANGE);
+        hasPolicyStatements = true;
+        planned.push({ kind: "create-policy", policy: statement2.policy });
+        break;
+      case "drop":
+        hasPolicyStatements = true;
+        planned.push({
+          kind: "drop-policy",
+          name: statement2.name,
+          table,
+          ifExists: statement2.ifExists
+        });
+        break;
+      case "comment":
+        if (!statement2.isOwner) {
+          planned.push({ kind: "noop" });
+          break;
+        }
+        hasPolicyStatements = true;
+        planned.push({
+          kind: "owner",
+          name: statement2.name,
+          table,
+          column: statement2.owner
+        });
+        break;
+      case "rls":
+        if (statement2.action === "disable")
+          return refuse(disableRefusal(table));
+        planned.push({ kind: "noop" });
+        break;
+    }
+  }
+  return {
+    ok: true,
+    plan: { statements: planned, hasPolicyStatements, touchesTables }
+  };
+}
+function policyMigrationSql(policy) {
+  const create = policySql({ ...policy, owner: null });
+  if (policy.owner === null) return create;
+  return `${create}
+COMMENT ON POLICY ${quotePolicyName(policy.name)} ON ${quoteIdent(policy.table)} IS ${sqlStringLiteral(`naro:owner ${quoteIdent(policy.owner)}`)};`;
+}
+function unreadablePolicyComment(policy) {
+  return `-- Policy ${commentText(quotePolicyName(policy.name))} on ${commentText(quoteIdent(policy.table))} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped and created again.`;
+}
+var SYSTEM_PREDICATE = systemTablePredicate("name");
 
 // ../../packages/data-core/src/redirect-origins.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
@@ -22386,19 +25617,19 @@ var TYPED_PATH = /^[a-z][a-z0-9+.-]*:\/\/[^/]*(\/.*)?$/i;
 var SEGMENT = /^[A-Za-z0-9._~-]+$/;
 function parseRedirectEntry(value) {
   if (typeof value !== "string") return null;
-  const text = value.trim();
-  if (text === "" || text.length > MAX_ENTRY_LENGTH) return null;
-  if (/[\s?#*%\\]/.test(text)) return null;
+  const text2 = value.trim();
+  if (text2 === "" || text2.length > MAX_ENTRY_LENGTH) return null;
+  if (/[\s?#*%\\]/.test(text2)) return null;
   let url2;
   try {
-    url2 = new URL(text);
+    url2 = new URL(text2);
   } catch {
     return null;
   }
   if (url2.username !== "" || url2.password !== "") return null;
   if (url2.search !== "" || url2.hash !== "") return null;
   if (!isSecureOrLoopback(url2)) return null;
-  const typed = TYPED_PATH.exec(text)?.[1] ?? "/";
+  const typed = TYPED_PATH.exec(text2)?.[1] ?? "/";
   if (typed !== url2.pathname) return null;
   const path = url2.pathname;
   if (path !== "/") {
@@ -22604,7 +25835,7 @@ function tableOptions(sql) {
 }
 function rowidAlias(table) {
   if (tableOptions(table.sql).withoutRowid) return null;
-  const keys = table.columns.filter((column) => column.primaryKey);
+  const keys = table.columns.filter((column2) => column2.primaryKey);
   const only = keys.length === 1 ? keys[0] : void 0;
   return only && only.type.trim().toUpperCase() === "INTEGER" ? only.name : null;
 }
@@ -22633,16 +25864,16 @@ async function policiesForTypes(client, projectId) {
     };
   }
 }
-function isNullable(column, alias) {
-  return !column.notNull && column.name !== alias;
+function isNullable(column2, alias) {
+  return !column2.notNull && column2.name !== alias;
 }
-function rowProperty(column, { alias, strict }) {
-  const type = READ[affinity(column.type, strict)];
-  return `  ${keyLiteral(column.name)}: ${withNull(type, isNullable(column, alias))};`;
+function rowProperty(column2, { alias, strict }) {
+  const type = READ[affinity(column2.type, strict)];
+  return `  ${keyLiteral(column2.name)}: ${withNull(type, isNullable(column2, alias))};`;
 }
-function writeProperty(column, { alias, strict }, optional2) {
-  const type = WRITE[affinity(column.type, strict)];
-  return `        ${keyLiteral(column.name)}${optional2 ? "?" : ""}: ${withNull(type, isNullable(column, alias))};`;
+function writeProperty(column2, { alias, strict }, optional2) {
+  const type = WRITE[affinity(column2.type, strict)];
+  return `        ${keyLiteral(column2.name)}${optional2 ? "?" : ""}: ${withNull(type, isNullable(column2, alias))};`;
 }
 function block(name, lines) {
   return lines.length === 0 ? [`export interface ${name} {}`] : [`export interface ${name} {`, ...lines, "}"];
@@ -22652,8 +25883,8 @@ function member(indent, name, lines) {
 }
 function tableEntry(described) {
   const { table, row, alias, owner } = described;
-  const writable = table.columns.filter((column) => column.generated !== true);
-  const optionalOnInsert = (column) => isNullable(column, alias) || column.defaultValue !== null || column.name === alias || asciiLower(column.name) === owner;
+  const writable = table.columns.filter((column2) => column2.generated !== true);
+  const optionalOnInsert = (column2) => isNullable(column2, alias) || column2.defaultValue !== null || column2.name === alias || asciiLower(column2.name) === owner;
   return [
     `    ${keyLiteral(table.name)}: {`,
     `      Row: ${row};`,
@@ -22661,13 +25892,13 @@ function tableEntry(described) {
       "      ",
       "Insert",
       writable.map(
-        (column) => writeProperty(column, described, optionalOnInsert(column))
+        (column2) => writeProperty(column2, described, optionalOnInsert(column2))
       )
     ),
     ...member(
       "      ",
       "Update",
-      writable.map((column) => writeProperty(column, described, true))
+      writable.map((column2) => writeProperty(column2, described, true))
     ),
     "    };"
   ];
@@ -22706,7 +25937,7 @@ function generateTypes(tables, options = {}) {
       "",
       ...block(
         row,
-        table.columns.map((column) => rowProperty(column, entry))
+        table.columns.map((column2) => rowProperty(column2, entry))
       )
     );
   }
@@ -22792,7 +26023,7 @@ function ensureGitignoreHasNaro(dir) {
 }
 
 // ../../packages/sdk/src/lint.ts
-function byText(left, right) {
+function byText2(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function lintedTables(input) {
@@ -22820,8 +26051,8 @@ function brokenForeignKeys(input) {
     parents.set(violation.parent, group);
     groups.set(violation.table, parents);
   }
-  return [...groups.entries()].toSorted(([left], [right]) => byText(left, right)).flatMap(
-    ([table, parents]) => [...parents.entries()].toSorted(([left], [right]) => byText(left, right)).map(([parent, group]) => ({
+  return [...groups.entries()].toSorted(([left], [right]) => byText2(left, right)).flatMap(
+    ([table, parents]) => [...parents.entries()].toSorted(([left], [right]) => byText2(left, right)).map(([parent, group]) => ({
       rule: "broken-foreign-key",
       severity: "error",
       object: table,
@@ -22846,7 +26077,7 @@ function tableIssues(input) {
         (index) => index.columns[0] === void 0 ? [] : [index.columns[0].toLowerCase()]
       )
     );
-    const keyColumns = table.columns.filter((column) => column.primaryKey);
+    const keyColumns = table.columns.filter((column2) => column2.primaryKey);
     const declared = keyColumns.length === 1 && keyColumns[0]?.type.trim().toUpperCase() === "INTEGER" ? keyColumns[0]?.name.toLowerCase() ?? null : null;
     const rowidColumn = declared !== null && !leading.has(declared) ? declared : null;
     if (keyColumns.length === 0)
@@ -22856,12 +26087,12 @@ function tableIssues(input) {
         object: table.name,
         message: "The table has no primary key, so its rows are identified by a rowid that changes after a VACUUM or a restore."
       });
-    for (const column of keyColumns) {
-      if (rowidColumn !== null || column.notNull) continue;
+    for (const column2 of keyColumns) {
+      if (rowidColumn !== null || column2.notNull) continue;
       issues.push({
         rule: "nullable-primary-key",
         severity: "warn",
-        object: `${table.name}.${column.name}`,
+        object: `${table.name}.${column2.name}`,
         message: "The primary key column is not INTEGER and has no NOT NULL, so SQLite accepts NULL in it."
       });
     }
@@ -22878,11 +26109,73 @@ function tableIssues(input) {
   }
   return issues;
 }
+var RULE_OF_KIND = {
+  read: "rls_policy_invalid",
+  compile: "rls_policy_invalid",
+  default: "rls_policy_text_default",
+  unindexed: "rls_policy_unindexed"
+};
+var POLICY_WARNING_RULES = [
+  "rls_policy_text_default",
+  "rls_policy_unindexed"
+];
+function policyIssues(input) {
+  const present = new Set(input.tables.map(asciiLower));
+  const found = [
+    ...policySetProblems(
+      input.snapshot,
+      input.policies,
+      input.indexes === void 0 ? {} : { indexes: input.indexes }
+    ).map((problem) => ({
+      rule: RULE_OF_KIND[problem.kind],
+      table: problem.table,
+      policy: problem.policy ?? null,
+      message: problem.message
+    })),
+    ...input.unreadable.filter((row) => present.has(asciiLower(row.table))).map((row) => ({
+      rule: "rls_policy_invalid",
+      table: row.table,
+      policy: row.name,
+      message: `Policy ${row.name} on ${row.table} cannot be read (${row.reason}); the requests it applies to are refused until it is dropped and created again.`
+    }))
+  ];
+  const issues = found.toSorted(
+    (left, right) => byText2(left.table, right.table) || byText2(left.policy ?? "", right.policy ?? "") || byText2(left.message, right.message)
+  ).map((entry) => ({
+    rule: entry.rule,
+    severity: entry.rule === "rls_policy_invalid" ? "error" : "warn",
+    object: entry.policy === null ? entry.table : `${entry.table}.${entry.policy}`,
+    message: entry.message
+  }));
+  return {
+    errors: issues.filter((issue2) => issue2.severity === "error"),
+    warnings: issues.filter((issue2) => issue2.severity === "warn").toSorted(
+      (left, right) => POLICY_WARNING_RULES.indexOf(left.rule) - POLICY_WARNING_RULES.indexOf(right.rule)
+    )
+  };
+}
+function tablesWithoutPolicy(input) {
+  const covered = new Set(
+    [...input.policies, ...input.unreadable].map(
+      (policy) => asciiLower(policy.table)
+    )
+  );
+  return input.tables.filter((name) => !isSystemTable(name) && !covered.has(asciiLower(name))).toSorted(byText2).map((name) => ({
+    rule: "rls_no_policy",
+    severity: "warn",
+    object: name,
+    message: `Table ${name} has no policy, so the Data API refuses every request to it. Add one in a migration: CREATE POLICY \u2026`
+  }));
+}
 function lintSchema(input) {
+  const policies = input.policies === void 0 ? void 0 : policyIssues(input.policies);
   return [
     ...brokenForeignKeys(input),
     ...integrity(input),
+    ...policies?.errors ?? [],
     ...tableIssues(input),
+    ...input.policies === void 0 ? [] : tablesWithoutPolicy(input.policies),
+    ...policies?.warnings ?? [],
     ...input.triggers.filter((name) => !isSystemTable(name)).map((name) => ({
       rule: "trigger-not-reproducible",
       severity: "warn",
@@ -22900,10 +26193,10 @@ function lintSchema(input) {
 
 // ../../packages/sdk/src/migrations.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 function resolveMigrationsDir(input) {
-  if (input.dir) return resolve8(input.baseDir, input.dir);
-  return resolve8(input.baseDir, input.rootDirectory ?? "", "migrations");
+  if (input.dir) return resolve9(input.baseDir, input.dir);
+  return resolve9(input.baseDir, input.rootDirectory ?? "", "migrations");
 }
 function sortMigrationNames(names) {
   return names.toSorted((a, b) => {
@@ -22985,6 +26278,8 @@ function migrationNameMismatch(sent, recorded) {
 // ../../packages/sdk/src/reset-plan.ts
 var RESET_DEFER_FOREIGN_KEYS = "pragma defer_foreign_keys = true;";
 var RESET_BATCH_STATEMENTS = 50;
+var RESET_CLEAR_POLICIES = `DELETE FROM ${NAMED_POLICY_TABLE};`;
+var RESET_BACKEND_OUTDATED = "The project backend is older than named policies. Run `naro backend enable` to update it, then try again.";
 function clearInternal(internal) {
   return [
     ...internal.sqliteSequence ? ["DELETE FROM sqlite_sequence;"] : [],
@@ -23087,9 +26382,9 @@ function tableGroups(names, edges) {
   }
   return order;
 }
-function pack(groups) {
+function pack(groups, first) {
   const batches = [];
-  let current = [RESET_DEFER_FOREIGN_KEYS];
+  let current = [RESET_DEFER_FOREIGN_KEYS, ...first];
   for (const group of groups) {
     if (current.length > 1 && current.length + group.length > RESET_BATCH_STATEMENTS) {
       batches.push(current);
@@ -23114,7 +26409,7 @@ function refuseOversizedCycle(groups) {
     `A foreign key cycle of ${String(cycle.length)} tables cannot be dropped in one request (the limit is ${String(room)}): ${nameList(cycle)}. Break the cycle or drop those tables by hand.`
   );
 }
-function buildResetPlan(input) {
+function buildResetPlan(input, options = {}) {
   const objects = input.objects.filter((object2) => !isSystemTable(object2.name));
   const views = sorted(
     objects.filter((object2) => object2.type === "view").map((object2) => object2.name)
@@ -23145,10 +26440,113 @@ function buildResetPlan(input) {
     ...clear.length > 0 ? [clear] : []
   ];
   return {
-    batches: pack(groups),
+    batches: pack(
+      groups,
+      options.clearPolicies === true ? [RESET_CLEAR_POLICIES] : []
+    ),
     dropped: { tables: ordered.flat(), views, triggers }
   };
 }
+function sameTable(left, right) {
+  return asciiLower(left) === asciiLower(right);
+}
+function policiesFromFiles(files) {
+  let policies = [];
+  const tables = /* @__PURE__ */ new Set();
+  const forget = (table) => {
+    policies = policies.filter((policy) => !sameTable(policy.table, table));
+  };
+  for (const [file2, sql] of files.entries()) {
+    const split = splitStatements(sql);
+    if (!split.ok)
+      return {
+        policies,
+        tables,
+        refused: { file: file2, reason: `sql could not be parsed: ${split.reason}.` }
+      };
+    const planned = planPolicyMigration(
+      split.statements.map((statement2) => statement2.text)
+    );
+    if (!planned.ok)
+      return {
+        policies,
+        tables,
+        refused: { file: file2, reason: planned.message }
+      };
+    for (const statement2 of planned.plan.statements) {
+      if (statement2.kind === "create-policy") {
+        const { table, name } = statement2.policy;
+        policies.push({ table, name });
+      } else if (statement2.kind === "drop-policy") {
+        policies = policies.filter(
+          (policy) => !(sameTable(policy.table, statement2.table) && policy.name === statement2.name)
+        );
+      } else if (statement2.kind === "verbatim") {
+        const head = statement2.head;
+        if (head.kind === "create-table") {
+          if (!tables.has(asciiLower(head.table))) forget(head.table);
+          tables.add(asciiLower(head.table));
+        } else if (head.kind === "drop-table") {
+          forget(head.table);
+          tables.delete(asciiLower(head.table));
+        } else if (head.kind === "rename-table") {
+          if (!tables.has(asciiLower(head.to))) forget(head.to);
+          tables.delete(asciiLower(head.table));
+          tables.add(asciiLower(head.to));
+        }
+      }
+    }
+  }
+  return { policies, tables };
+}
+function policiesLostByReset(input) {
+  const present = new Set(input.tables.map(asciiLower));
+  const made = policiesFromFiles(input.files);
+  if (made.refused) return { lost: [], withTables: [], refused: made.refused };
+  const gone = input.current.filter(
+    (policy) => present.has(asciiLower(policy.table)) && !made.policies.some(
+      (other) => sameTable(other.table, policy.table) && other.name === policy.name
+    )
+  );
+  return {
+    lost: gone.filter((policy) => made.tables.has(asciiLower(policy.table))),
+    withTables: gone.filter(
+      (policy) => !made.tables.has(asciiLower(policy.table))
+    )
+  };
+}
+function resetPoliciesLostMessage(lost) {
+  return `These ${String(lost.length)} policies are not in your migration files and will be gone after the reset: ${lost.map((policy) => `${policy.table}.${policy.name}`).join(", ")}. To keep them, add this to a migration first:`;
+}
+function resetPoliciesWithTablesMessage(policies) {
+  return `Policies of tables your migration files do not create: ${policies.map((policy) => `${policy.table}.${policy.name}`).join(", ")} (they go with their tables).`;
+}
+function resetFileRefusedMessage(file2, reason) {
+  return `${file2} would be refused: ${reason}`;
+}
+function storedPolicySql(row) {
+  const policy = loadPolicy(row);
+  if (policy === void 0) {
+    const comment = unreadablePolicyComment({
+      name: typeof row.name === "string" ? row.name : "(unnamed)",
+      table: typeof row.table_name === "string" ? row.table_name : "",
+      invalid: "the table name is missing"
+    });
+    return { sql: comment, statements: [comment] };
+  }
+  if (policy.invalid !== null) {
+    const comment = unreadablePolicyComment({
+      name: policy.name,
+      table: policy.table,
+      invalid: policy.invalid
+    });
+    return { sql: comment, statements: [comment] };
+  }
+  const sql = policyMigrationSql(policy);
+  if (policy.owner === null) return { sql, statements: [sql] };
+  const create = policyMigrationSql({ ...policy, owner: null });
+  return { sql, statements: [create, sql.slice(create.length + 1)] };
+}
 
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
@@ -23218,10 +26616,10 @@ var SUPPORTED_REMOTE = [
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
-var defaultExec = (args, cwd) => new Promise((resolve10, reject) => {
+var defaultExec = (args, cwd) => new Promise((resolve11, reject) => {
   execFile("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
-    else resolve10(stdout);
+    else resolve11(stdout);
   });
 });
 async function tryExec(exec, args, cwd) {
@@ -23368,8 +26766,8 @@ async function uploadArtifact(artifact, opts) {
 }
 
 // src/deploy.ts
-function parseDotenv2(text) {
-  return parseDotenv(text);
+function parseDotenv2(text2) {
+  return parseDotenv(text2);
 }
 function readProjectEnv2(dir) {
   return readProjectEnv(dir);
@@ -23392,7 +26790,7 @@ function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUr
       } catch (error51) {
         lastError = error51;
         await new Promise(
-          (resolve10) => setTimeout(resolve10, 500 * (attempt + 1))
+          (resolve11) => setTimeout(resolve11, 500 * (attempt + 1))
         );
       }
     }
@@ -23528,7 +26926,7 @@ function localDependencies(sourceDir) {
 async function deployDirectory(sourceDir, options, log2) {
   const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
-  const appRoot = options.rootDirectory ? resolve9(sourceDir, options.rootDirectory) : sourceDir;
+  const appRoot = options.rootDirectory ? resolve10(sourceDir, options.rootDirectory) : sourceDir;
   const framework = detectFramework2(appRoot);
   if (!framework.deployable && !options.force) {
     throw new NaroError(
@@ -23682,6 +27080,7 @@ export {
   parseGitHubRemote,
   schemaMigrationTitle,
   projectPath,
+  splitStatements,
   NaroError,
   isNaroError,
   toNaroError,
@@ -23709,12 +27108,22 @@ export {
   summarizeStatement,
   serializeDotenv,
   systemTablePredicate,
+  SCHEMA_SQL,
+  tableNames,
+  snapshotFromRows,
   quoteIdent,
   commentText,
   quotePolicyName,
+  NAMED_POLICY_TABLE,
+  NAMED_POLICY_SQL,
+  loadPolicy,
   parsePolicyNode,
+  INDEX_SQL,
+  indexesFromRows,
   parsePolicyStatement,
   splitPolicyStatements,
+  planPolicyMigration,
+  unreadablePolicyComment,
   parseRedirectEntry,
   formatRedirectEntry,
   policiesForTypes,
@@ -23732,7 +27141,13 @@ export {
   pendingMigrationNames,
   migrationsPendingError,
   migrationNameMismatch,
+  RESET_BACKEND_OUTDATED,
   buildResetPlan,
+  policiesLostByReset,
+  resetPoliciesLostMessage,
+  resetPoliciesWithTablesMessage,
+  resetFileRefusedMessage,
+  storedPolicySql,
   promptForMissingEnv,
   detectGitInfo,
   parseDotenv2 as parseDotenv,