naro-cli 0.11.0 → 0.13.0

package/dist/index.js

@@ -2,11 +2,20 @@
 import {
   BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
+  INDEX_SQL,
+  MAX_SINGLE_UPLOAD_BYTES,
+  NAMED_POLICY_SQL,
+  NAMED_POLICY_TABLE,
   NaroClient,
   NaroError,
   POLICY_ACTIONS,
   POLICY_RULES,
+  RESET_BACKEND_OUTDATED,
   RESTORE_OUTCOME_UNKNOWN_CODES,
+  SCHEMA_SQL,
+  SPEED_INSIGHTS_METRICS,
+  SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
+  STORAGE_OBJECTS_TABLE,
   buildResetPlan,
   cellText,
   clearSession,
@@ -15,11 +24,13 @@ import {
   controlPlaneUrl,
   countLintedTables,
   createAuthClient,
+  dataError,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
   formatRedirectEntry,
   generateTypes,
+  indexesFromRows,
   isBookmark,
   isExpired,
   isNaroError,
@@ -27,18 +38,22 @@ import {
   isTerminalStatus,
   lintSchema,
   listMigrationFiles,
+  loadPolicy,
   loadStoredSession,
   login,
   migrationNameMismatch,
   migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
+  parseCacheControl,
   parseGitHubRemote,
   parsePolicyNode,
   parsePolicyStatement,
   parseRedirectEntry,
   pendingMigrationNames,
+  planPolicyMigration,
   policiesForTypes,
+  policiesLostByReset,
   projectPath,
   promptForMissingEnv,
   quoteIdent,
@@ -47,18 +62,26 @@ import {
   refreshStoredSession,
   removeProjectLink,
   renderRows,
+  resetFileRefusedMessage,
+  resetPoliciesLostMessage,
+  resetPoliciesWithTablesMessage,
   resolveAuth,
   resolveMigrationsDir,
   saveSession,
   schemaMigrationTitle,
   serializeDotenv,
   slugify,
+  snapshotFromRows,
   splitPolicyStatements,
+  splitStatements,
+  storedPolicySql,
   summarizeStatement,
   systemTablePredicate,
+  tableNames,
   toNaroError,
+  unreadablePolicyComment,
   writeProjectLink
-} from "./chunk-L7JOGWP3.js";
+} from "./chunk-O4NJRDJE.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -91,7 +114,13 @@ var BOOLEAN_FLAGS = {
   "--allow-unindexed": "allowUnindexed",
   "--api-key-stdin": "apiKeyStdin",
   "--client-secret-stdin": "clientSecretStdin",
-  "--password-stdin": "passwordStdin"
+  "--password-stdin": "passwordStdin",
+  "--public": "public",
+  "--private": "private",
+  "--empty": "empty",
+  "--recursive": "recursive",
+  "-r": "recursive",
+  "--upsert": "upsert"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -107,6 +136,9 @@ var STRING_FLAGS = {
   "--type": "type",
   "--env": "env",
   "--level": "level",
+  "--metric": "metric",
+  "--range": "range",
+  "--route": "route",
   "--file": "file",
   "--output": "output",
   "--lang": "lang",
@@ -132,7 +164,11 @@ var STRING_FLAGS = {
   "--username": "username",
   "--email": "email",
   "--password": "password",
-  "--min-length": "minLength"
+  "--min-length": "minLength",
+  "--file-size-limit": "fileSizeLimit",
+  "--allowed-mime-types": "allowedMimeTypes",
+  "--content-type": "contentType",
+  "--cache-control": "cacheControl"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -318,7 +354,7 @@ var TtyPrompter = class {
     });
     try {
       return await new Promise(
-        (resolve5) => rl.question(question, resolve5)
+        (resolve6) => rl.question(question, resolve6)
       );
     } finally {
       rl.close();
@@ -339,7 +375,7 @@ var TtyPrompter = class {
     });
     try {
       const answer = new Promise(
-        (resolve5) => rl.question(question, resolve5)
+        (resolve6) => rl.question(question, resolve6)
       );
       muted = true;
       const value = await answer;
@@ -421,10 +457,10 @@ function createContext(flags, positionals = []) {
     positionals,
     output,
     prompter,
-    positionalOrThrow: (count, usage) => {
-      if (positionals.length < count)
+    positionalOrThrow: (count2, usage) => {
+      if (positionals.length < count2)
         throw new NaroError("VALIDATION_FAILED", usage);
-      return positionals.slice(0, count);
+      return positionals.slice(0, count2);
     },
     auth,
     client: async () => {
@@ -450,8 +486,8 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/commands/auth.ts
@@ -536,9 +572,12 @@ async function runToken(context) {
 }
 
 // src/commands/confirm.ts
+function cannotAsk(context) {
+  return context.flags.json || !isInteractive();
+}
 async function confirmOrAbort(context, question) {
   if (context.flags.yes) return;
-  if (context.flags.json || !isInteractive()) {
+  if (cannotAsk(context)) {
     throw new NaroError(
       "CONFIRMATION_REQUIRED",
       `${question} Re-run with --yes to confirm.`
@@ -574,18 +613,29 @@ async function appliedMigrations(client, projectId) {
     throw error;
   }
 }
+var UNPRINTABLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
 function printable(text) {
-  let out = "";
-  for (const char of text) {
-    const code = char.charCodeAt(0);
-    const control = code < 32 || code >= 127 && code <= 159;
-    out += control ? "?" : char;
-  }
-  return out;
+  return text.replace(UNPRINTABLE, "?");
 }
 function isPrintable(text) {
   return printable(text) === text;
 }
+var UNSHOWN_WARNING_LINE = "(a line of this warning has characters the terminal cannot show; run with --json to see it exactly)";
+function warningLines(message) {
+  return message.split("\n").map(
+    (line, index) => index === 0 ? `\u26A0 ${printable(line)}` : `  ${isPrintable(line) ? line : UNSHOWN_WARNING_LINE}`
+  );
+}
+function policyProblems(dir, names) {
+  return names.flatMap((name) => {
+    const split = splitStatements(readFileSync(join(dir, name), "utf8"));
+    if (!split.ok) return [];
+    const planned = planPolicyMigration(
+      split.statements.map((statement) => statement.text)
+    );
+    return planned.ok ? [] : [{ migration: name, message: planned.message }];
+  });
+}
 function warningLine(warning) {
   if (warning === "out-of-order")
     return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
@@ -636,23 +686,42 @@ async function runMigrationList(context) {
 }
 async function applyMigrationFiles(context, client, projectId, dir, names) {
   const applied = [];
+  const warnings = [];
   for (const name of names) {
     const sql = readFileSync(join(dir, name), "utf8");
+    let answer;
     try {
-      await client.db.applyMigration(projectId, { name, sql });
+      answer = await client.db.applyMigration(projectId, { name, sql });
     } catch (error) {
       if (!isNaroError(error)) throw error;
+      for (const message of serverWarnings(error.details))
+        for (const line of warningLines(message)) context.output.warn(line);
       const shown = context.output.json ? name : printable(name);
       throw new NaroError(error.code, `${shown}: ${error.message}`, {
         ...error.status === void 0 ? {} : { status: error.status },
-        details: { ...error.details, migration: name, applied },
+        details: {
+          ...error.details,
+          migration: name,
+          applied,
+          appliedWarnings: warnings
+        },
         cause: error
       });
     }
     context.output.log(`\u2713 ${printable(name)}`);
     applied.push(name);
+    for (const message of answer.warnings) {
+      warnings.push({ migration: name, message });
+      for (const line of warningLines(message)) context.output.warn(line);
+    }
   }
-  return applied;
+  return { applied, warnings };
+}
+function serverWarnings(details) {
+  const warnings = details?.warnings;
+  return Array.isArray(warnings) ? warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
 }
 var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
 var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
@@ -724,10 +793,15 @@ async function runMigrationUp(context) {
     return;
   }
   if (context.flags.dryRun) {
-    context.output.result({ projectId, dryRun: true, pending }, [
+    const problems = policyProblems(dir, pending);
+    context.output.result({ projectId, dryRun: true, pending, problems }, [
       `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable(name)}`)
+      ...pending.map((name) => `  ${printable(name)}`),
+      ...problems.map(
+        (problem) => `${printable(problem.migration)}: ${printable(problem.message)}`
+      )
     ]);
+    if (problems.length > 0) process.exitCode = 1;
     return;
   }
   context.output.log(`Pending migrations (${String(pending.length)}):`);
@@ -736,14 +810,14 @@ async function runMigrationUp(context) {
     context,
     `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
   );
-  const applied = await applyMigrationFiles(
+  const { applied, warnings } = await applyMigrationFiles(
     context,
     client,
     projectId,
     dir,
     pending
   );
-  context.output.result({ projectId, applied, pending: [] }, [
+  context.output.result({ projectId, applied, pending: [], warnings }, [
     `\u2705 Applied ${String(applied.length)} migration(s).`
   ]);
 }
@@ -1055,9 +1129,9 @@ function adviceLines2(auth) {
     "Redirect URIs to register with each provider \u2014 the one for the origin your app passes to createClient({ url }):"
   );
   for (const provider of ["google", "github"]) {
-    const label2 = `  ${LABELS[provider]}: `;
+    const label3 = `  ${LABELS[provider]}: `;
     callbacksOf(auth, provider).forEach(
-      (url, index) => lines.push(`${index === 0 ? label2 : " ".repeat(label2.length)}${url}`)
+      (url, index) => lines.push(`${index === 0 ? label3 : " ".repeat(label3.length)}${url}`)
     );
   }
   return lines;
@@ -1084,11 +1158,11 @@ async function readSecret(context, input, given, flag, what, usage) {
     throw new NaroError("VALIDATION_FAILED", `No ${what} came in on stdin.`);
   return secret;
 }
-async function change(context, send, done, after) {
+async function change(context, send2, done, after) {
   const projectId = await context.resolveProjectId();
   let answer;
   try {
-    answer = await send(projectId);
+    answer = await send2(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
@@ -1353,9 +1427,9 @@ var processStdin3 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
-async function usersCall(call) {
+async function usersCall(call2) {
   try {
-    return await call();
+    return await call2();
   } catch (error) {
     if (isNaroError(error) && error.code === "BACKEND_OUTDATED")
       throw new NaroError("BACKEND_OUTDATED", OUTDATED_MESSAGE, {
@@ -1658,6 +1732,8 @@ async function runDbQuery(context, deps = processStdin4) {
   });
   if (result.truncated) lines.push(ROW_CAP_NOTICE);
   context.output.result({ projectId, result }, lines);
+  for (const warning of result.warnings ?? [])
+    for (const line of warningLines(warning)) context.output.warn(line);
 }
 
 // src/commands/db-backup.ts
@@ -1910,7 +1986,7 @@ async function runDbRestore(context) {
     target = resolved.bookmark;
     at = resolved.timestamp ?? given.timestamp;
   }
-  const label2 = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
+  const label3 = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
   if (context.flags.dryRun) {
     context.output.result(
       {
@@ -1918,13 +1994,13 @@ async function runDbRestore(context) {
         bookmark: target,
         ...at === null ? {} : { timestamp: at }
       },
-      [`Would restore to ${label2}. Nothing was changed.`]
+      [`Would restore to ${label3}. Nothing was changed.`]
     );
     return;
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label2}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore the project database to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -1998,6 +2074,75 @@ var DIAGNOSTICS_SQL = [
   "SELECT * FROM pragma_foreign_key_check;"
 ].join("\n");
 var TRUNCATED_NOTICE = "\u26A0 The diagnostics were cut at 10,000 rows \u2014 there may be more broken rows than these.";
+var POLICIES_TRUNCATED_NOTICE = "\u26A0 The policies were cut at 10,000 rows, so they were not checked.";
+var POLICY_TABLE_PROBE = `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '${NAMED_POLICY_TABLE}'`;
+var POLICY_READ_SQL = [NAMED_POLICY_SQL.list, INDEX_SQL, ...SCHEMA_SQL].map((sql) => `${sql};`).join("\n");
+function objectsOf(statement) {
+  return statement.rows.map(
+    (row) => Object.fromEntries(
+      statement.columns.map((column, index) => [column, row[index]])
+    )
+  );
+}
+async function readPolicies(client, projectId, warn) {
+  let backend;
+  try {
+    backend = await client.backend.info(projectId);
+  } catch (error) {
+    if (error instanceof NaroError && error.code === "BACKEND_DISABLED")
+      return void 0;
+    throw error;
+  }
+  if (backend.status === "none") return void 0;
+  const probe = await client.db.query(projectId, {
+    sql: POLICY_TABLE_PROBE,
+    readOnly: true
+  });
+  if ((probe.statements[0]?.rows.length ?? 0) === 0) return void 0;
+  const answer = await client.db.query(projectId, { sql: POLICY_READ_SQL });
+  const [stored, indexes, ...schema] = answer.statements;
+  const expected = SCHEMA_SQL.length + 2;
+  if (stored === void 0 || indexes === void 0 || answer.statements.length !== expected)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The policies could not be read: the database answered with ${String(answer.statements.length)} result sets instead of ${String(expected)}.`
+    );
+  if (answer.truncated) {
+    warn(POLICIES_TRUNCATED_NOTICE);
+    return void 0;
+  }
+  const policies = [];
+  const unreadable = [];
+  for (const row of objectsOf(stored)) {
+    const policy = loadPolicy(row);
+    if (policy === void 0) continue;
+    if (policy.invalid !== null)
+      unreadable.push({
+        table: policy.table,
+        name: policy.name,
+        reason: policy.invalid
+      });
+    else
+      policies.push({
+        table: policy.table,
+        name: policy.name,
+        permissive: policy.permissive,
+        command: policy.command,
+        roles: policy.roles,
+        using: policy.using,
+        check: policy.check,
+        owner: policy.owner
+      });
+  }
+  const snapshot = snapshotFromRows(schema.flatMap(objectsOf));
+  return {
+    tables: tableNames(snapshot),
+    policies,
+    unreadable,
+    snapshot,
+    indexes: indexesFromRows(objectsOf(indexes))
+  };
+}
 function firstCell(row) {
   const value = row[0];
   return value === null || value === void 0 ? "" : String(value);
@@ -2025,17 +2170,17 @@ async function runDbLint(context) {
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
-  const [triggers, objects, quick, broken] = answer.statements;
-  if (triggers === void 0 || objects === void 0 || quick === void 0 || broken === void 0)
+  const [triggers, objects2, quick, broken] = answer.statements;
+  if (triggers === void 0 || objects2 === void 0 || quick === void 0 || broken === void 0)
     throw new NaroError(
       "DATABASE_QUERY_FAILED",
       `The diagnostics could not be read: the database answered with ${String(answer.statements.length)} result sets instead of 4.`
     );
   const virtualTables = [];
   const shadow = /* @__PURE__ */ new Set();
-  for (const row of objects.rows) {
-    const name = cellText(objects, row, "name");
-    if (cellText(objects, row, "type") === "shadow") shadow.add(name);
+  for (const row of objects2.rows) {
+    const name = cellText(objects2, row, "name");
+    if (cellText(objects2, row, "type") === "shadow") shadow.add(name);
     else virtualTables.push(name);
   }
   const foreignKeyCheck = broken.rows.map((row) => ({
@@ -2043,12 +2188,18 @@ async function runDbLint(context) {
     rowid: rowidOf(cellText(broken, row, "rowid")),
     parent: cellText(broken, row, "parent")
   }));
+  const policies = await readPolicies(
+    client,
+    projectId,
+    (message) => context.output.warn(message)
+  );
   const input = {
-    tables: tables.filter((table) => !shadow.has(table.name)),
+    tables: tables.filter((table2) => !shadow.has(table2.name)),
     foreignKeyCheck,
     quickCheck: quick.rows.map(firstCell),
     triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
-    virtualTables
+    virtualTables,
+    ...policies === void 0 ? {} : { policies }
   };
   const issues = lintSchema(input);
   const counted = countLintedTables(input);
@@ -2064,24 +2215,26 @@ async function runDbLint(context) {
 }
 
 // src/commands/db-reset.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
 var MAX_STATEMENTS = 50;
 var SCHEMA_FILTER = `${systemTablePredicate("name")} AND ${systemTablePredicate("tbl_name")}`;
-var SCHEMA_SQL = [
+var SCHEMA_SQL2 = [
   `SELECT type, name FROM sqlite_master WHERE type IN ('table', 'view', 'trigger') AND ${SCHEMA_FILTER} ORDER BY name;`,
   "SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'virtual';",
-  "SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('sqlite_sequence', 'd1_migrations');"
+  `SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('sqlite_sequence', 'd1_migrations', '${NAMED_POLICY_TABLE}', '${STORAGE_OBJECTS_TABLE}');`
 ].join("\n");
 function literal(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
-function chunk(items2, size) {
+function chunk(items3, size) {
   const pieces = [];
-  for (let index = 0; index < items2.length; index += size)
-    pieces.push(items2.slice(index, index + size));
+  for (let index = 0; index < items3.length; index += size)
+    pieces.push(items3.slice(index, index + size));
   return pieces;
 }
 async function readSchema(client, projectId) {
-  const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
+  const schema = await client.db.query(projectId, { sql: SCHEMA_SQL2 });
   const [listed, virtual, internal] = schema.statements;
   if (listed === void 0 || virtual === void 0 || internal === void 0)
     throw new NaroError(
@@ -2094,7 +2247,7 @@ async function readSchema(client, projectId) {
   const virtualNames = new Set(
     virtual.rows.map((row) => cellText(virtual, row, "name").toLowerCase())
   );
-  const objects = listed.rows.map((row) => {
+  const objects2 = listed.rows.map((row) => {
     const name = cellText(listed, row, "name");
     const type = cellText(listed, row, "type");
     if (type === "view" || type === "trigger") return { type, name };
@@ -2103,7 +2256,7 @@ async function readSchema(client, projectId) {
       name
     };
   });
-  const lookups = objects.filter((object) => object.type === "table" || object.type === "virtual").map(
+  const lookups = objects2.filter((object) => object.type === "table" || object.type === "virtual").map(
     (object) => `SELECT ${literal(object.name)} AS child, "table" AS parent FROM pragma_foreign_key_list(${literal(object.name)});`
   );
   const foreignKeys = [];
@@ -2122,12 +2275,63 @@ async function readSchema(client, projectId) {
         });
   }
   return {
-    objects,
+    objects: objects2,
     foreignKeys,
     internal: {
       sqliteSequence: internalNames.has("sqlite_sequence"),
       ledger: internalNames.has("d1_migrations")
-    }
+    },
+    policyTable: internalNames.has(NAMED_POLICY_TABLE),
+    storageTable: internalNames.has(STORAGE_OBJECTS_TABLE)
+  };
+}
+async function hasBackend(client, projectId) {
+  try {
+    return (await client.backend.info(projectId)).status !== "none";
+  } catch (error) {
+    if (isNaroError(error) && error.code === "BACKEND_DISABLED") return false;
+    throw error;
+  }
+}
+async function policyPlan(client, projectId, schema, dir, files) {
+  if (!schema.policyTable) {
+    if (await hasBackend(client, projectId))
+      throw new NaroError("BACKEND_OUTDATED", RESET_BACKEND_OUTDATED);
+    return { clearPolicies: false, lost: [], withTables: [] };
+  }
+  const answer = await client.db.query(projectId, {
+    sql: NAMED_POLICY_SQL.list
+  });
+  const stored = answer.statements[0];
+  if (stored === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      "The policies could not be read: the database answered with no result set."
+    );
+  if (answer.truncated)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      "The policies are too many to read in one pass: the list was cut at 10,000 rows, so the reset cannot tell which ones your migration files do not make."
+    );
+  const current = stored.rows.map((row) => ({
+    table: cellText(stored, row, "table_name"),
+    name: cellText(stored, row, "name"),
+    ...storedPolicySql(
+      Object.fromEntries(
+        stored.columns.map((column, index) => [column, row[index]])
+      )
+    )
+  }));
+  return {
+    clearPolicies: true,
+    ...policiesLostByReset({
+      current,
+      tables: schema.tables,
+      files: files.map((name) => readFileSync3(join3(dir, name), "utf8")),
+      // Storage's table stays; its policies are emptied with the rest (PR
+      // #85 리뷰).
+      storage: schema.storageTable
+    })
   };
 }
 function resetStopped(context, error, bookmark, lead, message) {
@@ -2149,16 +2353,75 @@ async function runDbReset(context) {
   const dir = migrationsDir(context);
   const shownDir = relativeToCwd(context, dir);
   const files = listMigrationFiles(dir);
+  const problems = policyProblems(dir, files);
+  const problemLines = problems.map(
+    (problem) => `${context.output.json ? problem.migration : printable(problem.migration)}: ${context.output.json ? problem.message : printable(problem.message)}`
+  );
+  if (problems.length > 0 && !context.flags.dryRun)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `The control plane would refuse these migration files, so the reset would stop at the first of them with the schema already dropped. Nothing was changed:
+${problemLines.join("\n")}`,
+      { details: { problems } }
+    );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
-  const plan = buildResetPlan(await readSchema(client, projectId));
+  const { policyTable: policyTable2, storageTable, ...input } = await readSchema(
+    client,
+    projectId
+  );
+  const plan = buildResetPlan(input, { clearPolicies: policyTable2 });
   const { tables, views, triggers } = plan.dropped;
   const counts = `${String(tables.length)} table(s), ${String(views.length)} view(s) and ${String(triggers.length)} trigger(s)`;
   const dropped = tables.length + views.length + triggers.length;
+  const policies = await policyPlan(
+    client,
+    projectId,
+    { policyTable: policyTable2, storageTable, tables },
+    dir,
+    files
+  );
+  const policiesNotInFiles = policies.lost.map((policy) => ({
+    name: `${policy.table}.${policy.name}`,
+    sql: policy.sql
+  }));
+  const policiesOfTablesNotInFiles = policies.withTables.map(
+    (policy) => `${policy.table}.${policy.name}`
+  );
+  const refused = policies.refused && {
+    migration: files[policies.refused.file] ?? "",
+    message: policies.refused.reason
+  };
+  if (refused && !problems.some((one) => one.migration === refused.migration))
+    context.output.warn(
+      `\u26A0 ${printable(resetFileRefusedMessage(refused.migration, refused.message))}`
+    );
+  if (policies.lost.length > 0) {
+    context.output.warn(
+      `\u26A0 ${printable(resetPoliciesLostMessage(policies.lost))}`
+    );
+    for (const policy of policies.lost)
+      for (const line of policy.statements.every(isPrintable) ? policy.statements : [UNSHOWN_WARNING_LINE])
+        context.output.warn(`  ${line}`);
+  }
+  if (policies.withTables.length > 0)
+    context.output.warn(
+      `\u26A0 ${printable(resetPoliciesWithTablesMessage(policies.withTables))}`
+    );
   if (context.flags.dryRun) {
     context.output.result(
-      { dryRun: true, tables, views, triggers, migrations: files },
+      {
+        dryRun: true,
+        tables,
+        views,
+        triggers,
+        migrations: files,
+        policiesNotInFiles,
+        policiesOfTablesNotInFiles,
+        problems,
+        ...refused ? { wouldBeRefused: refused } : {}
+      },
       [
         `Would drop ${counts}:`,
         ...views.map((name) => `  ${"view".padEnd(9)}${printable(name)}`),
@@ -2166,9 +2429,11 @@ async function runDbReset(context) {
         ...tables.map((name) => `  ${"table".padEnd(9)}${printable(name)}`),
         `Would re-apply ${String(files.length)} migration file(s) from ${shownDir}:`,
         ...files.map((name) => `  ${printable(name)}`),
-        "Nothing was changed."
+        "Nothing was changed.",
+        ...problemLines
       ]
     );
+    if (problems.length > 0 || refused) process.exitCode = 1;
     return;
   }
   if (bookmark !== null)
@@ -2200,15 +2465,16 @@ async function runDbReset(context) {
       `No migration files in ${shownDir} \u2014 the database is now empty.`
     );
   let reapplied = [];
+  let warnings = [];
   try {
     if (files.length > 0)
-      reapplied = await applyMigrationFiles(
+      ({ applied: reapplied, warnings } = await applyMigrationFiles(
         context,
         client,
         projectId,
         dir,
         files
-      );
+      ));
   } catch (error) {
     throw resetStopped(
       context,
@@ -2218,18 +2484,28 @@ async function runDbReset(context) {
       (underlying) => underlying
     );
   }
-  context.output.result({ dropped, reapplied: reapplied.length, bookmark }, [
-    `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
-    ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
-  ]);
+  context.output.result(
+    {
+      dropped,
+      reapplied: reapplied.length,
+      bookmark,
+      policiesNotInFiles,
+      policiesOfTablesNotInFiles,
+      warnings
+    },
+    [
+      `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+      ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
+    ]
+  );
 }
 
 // src/commands/db-schema.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve3 } from "path";
 
 // ../../packages/naro-sdk/src/query/filters.ts
@@ -2535,9 +2811,9 @@ function keyword(text, at) {
     `needs null, true or false after is at character ${String(at + 1)}`
   );
 }
-function attempt(parse) {
+function attempt(parse2) {
   try {
-    return { ok: true, node: parse() };
+    return { ok: true, node: parse2() };
   } catch (error) {
     if (error instanceof Refusal) return { ok: false, reason: error.message };
     throw error;
@@ -2644,10 +2920,10 @@ function conditionsFrom(flags) {
     );
   return conditions;
 }
-function patchFromFile(context, path, table) {
+function patchFromFile(context, path, table2) {
   let text;
   try {
-    text = readFileSync3(resolve3(context.cwd, path), "utf8");
+    text = readFileSync4(resolve3(context.cwd, path), "utf8");
   } catch {
     refuse2(`Could not read ${path}.`);
   }
@@ -2666,9 +2942,9 @@ function patchFromFile(context, path, table) {
   if (Object.hasOwn(body, "table")) {
     if (typeof named !== "string")
       refuse2(`${path}: table must be a string, the table's name.`);
-    if (table !== void 0 && asciiLower(named) !== asciiLower(table))
+    if (table2 !== void 0 && asciiLower(named) !== asciiLower(table2))
       refuse2(
-        `${path} is the policy of ${printable(named)}, not ${printable(table)}. Remove its "table" to set it on ${printable(table)}.`
+        `${path} is the policy of ${printable(named)}, not ${printable(table2)}. Remove its "table" to set it on ${printable(table2)}.`
       );
   }
   const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
@@ -2681,7 +2957,7 @@ function patchFromFile(context, path, table) {
 function asciiLower(text) {
   return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
 }
-function policyPatch(flags, context, table) {
+function policyPatch(flags, context, table2) {
   if (flags.fromFile !== void 0) {
     if (OTHER_FLAGS.some(
       (key) => flags[key] !== void 0 && flags[key] !== false
@@ -2690,7 +2966,7 @@ function policyPatch(flags, context, table) {
         "--from-file takes the whole policy: leave out the other policy options."
       );
     if (!context) refuse2(SET_USAGE);
-    return patchFromFile(context, flags.fromFile, table);
+    return patchFromFile(context, flags.fromFile, table2);
   }
   const patch = {};
   for (const action of POLICY_ACTIONS) {
@@ -2763,9 +3039,9 @@ function leafText(leaf, negated) {
   if (leaf.operator === "in" || short !== void 0) {
     if (!Array.isArray(leaf.value)) return void 0;
     const slot = short === void 0 ? "in" : "array";
-    const items2 = leaf.value.map((item) => valueText(item, slot));
-    if (items2.some((item) => item === void 0)) return void 0;
-    const list = items2.join(",");
+    const items3 = leaf.value.map((item) => valueText(item, slot));
+    if (items3.some((item) => item === void 0)) return void 0;
+    const list = items3.join(",");
     return slot === "in" ? `${prefix}in.(${list})` : `${prefix}${String(short)}.{${list}}`;
   }
   if (Array.isArray(leaf.value)) return void 0;
@@ -2829,7 +3105,7 @@ function policyTable(policies) {
   const widths = header.map(
     (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
   );
-  const table = [header, ...rows].map(
+  const table2 = [header, ...rows].map(
     (cells) => cells.map(
       (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
     ).join("  ").trimEnd()
@@ -2846,10 +3122,10 @@ function policyTable(policies) {
       }
     )
   );
-  if (lines.length === 0) return table;
+  if (lines.length === 0) return table2;
   const width = Math.max(...lines.map((line) => line.label.length));
   return [
-    ...table,
+    ...table2,
     "",
     ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
   ];
@@ -2858,43 +3134,47 @@ var UNSHOWN = "has characters that cannot be shown here";
 function statementLine(policy) {
   if (policy.invalid !== null)
     return printable(
-      `-- ${policyNamed(policy.name, policy.table)} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped or created again.`
+      unreadablePolicyComment({
+        name: policy.name,
+        table: policy.table,
+        invalid: policy.invalid
+      })
     );
   return shownStatement(policy, policy.table, "naro policy list --json");
 }
-function policyNamed(name, table) {
-  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table))}`;
+function policyNamed(name, table2) {
+  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table2))}`;
 }
-function shownStatement(statement, table, exact) {
+function shownStatement(statement, table2, exact) {
   if (isPrintable(statement.sql)) return statement.sql;
   return printable(
-    `-- ${policyNamed(statement.name, table)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
+    `-- ${policyNamed(statement.name, table2)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
   );
 }
 function policyStatements(policies) {
   const lines = [];
-  let table;
+  let table2;
   for (const policy of policies) {
-    if (table !== void 0 && policy.table !== table) lines.push("");
-    table = policy.table;
+    if (table2 !== void 0 && policy.table !== table2) lines.push("");
+    table2 = policy.table;
     lines.push(statementLine(policy));
   }
   return lines;
 }
 async function runPolicyList(context) {
-  const table = context.flags.table;
+  const table2 = context.flags.table;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
-    table === void 0 ? {} : { table }
+    table2 === void 0 ? {} : { table: table2 }
   );
   let lines;
   if (policies.length > 0)
     lines = [...policyStatements(policies), "", DEFAULT_DENY];
-  else if (table !== void 0)
+  else if (table2 !== void 0)
     lines = [
-      `No policies on ${printable(table)}: anon and signed-in requests to it are denied.`
+      `No policies on ${printable(table2)}: anon and signed-in requests to it are denied.`
     ];
   else
     lines = [
@@ -2911,7 +3191,7 @@ function statementText(context) {
   let text = positional;
   if (file !== void 0) {
     try {
-      text = readFileSync3(resolve3(context.cwd, file), "utf8");
+      text = readFileSync4(resolve3(context.cwd, file), "utf8");
     } catch {
       refuse2(`Could not read ${file}.`);
     }
@@ -2990,17 +3270,17 @@ async function runPolicyCreate(context) {
 }
 async function runPolicyDrop(context) {
   const [name] = context.positionalOrThrow(1, DROP_USAGE);
-  const table = context.flags.table;
-  if (table === void 0 || table === "") refuse2(DROP_USAGE);
+  const table2 = context.flags.table;
+  if (table2 === void 0 || table2 === "") refuse2(DROP_USAGE);
   await confirmOrAbort(
     context,
-    `Drop policy ${printable(name)} on ${printable(table)}? It stops applying within about 10 seconds.`
+    `Drop policy ${printable(name)} on ${printable(table2)}? It stops applying within about 10 seconds.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
-    table,
+    table2,
     name
   );
   context.output.result({ projectId, dropped }, [
@@ -3008,13 +3288,13 @@ async function runPolicyDrop(context) {
   ]);
 }
 async function runPolicySet(context) {
-  const [table] = context.positionalOrThrow(1, SET_USAGE);
-  const patch = policyPatch(context.flags, context, table);
+  const [table2] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table2);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
-    table,
+    table2,
     patch
   );
   let named;
@@ -3035,14 +3315,14 @@ async function runPolicySet(context) {
   );
 }
 async function runPolicyRemove(context) {
-  const [table] = context.positionalOrThrow(1, REMOVE_USAGE);
+  const [table2] = context.positionalOrThrow(1, REMOVE_USAGE);
   await confirmOrAbort(
     context,
-    `Remove every policy on ${printable(table)}? Anon and signed-in requests to it are denied from then on.`
+    `Remove every policy on ${printable(table2)}? Anon and signed-in requests to it are denied from then on.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policy = await client.backend.removePolicy(projectId, table);
+  const policy = await client.backend.removePolicy(projectId, table2);
   const names = policy.policies ?? [];
   context.output.result({ projectId, removed: true, policy }, [
     names.length === 0 ? `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.` : `\u2705 Removed ${names.length === 1 ? "policy" : "policies"} ${names.map(printable).join(", ")} on ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
@@ -3129,14 +3409,14 @@ function parseColumnSpec(spec) {
       column.default = defaultValue(value);
     else if (value !== void 0 && key === "references") {
       const dot = value.lastIndexOf(".");
-      const table = dot < 0 ? "" : value.slice(0, dot);
+      const table2 = dot < 0 ? "" : value.slice(0, dot);
       const target = dot < 0 ? "" : value.slice(dot + 1);
-      if (!table || !target)
+      if (!table2 || !target)
         throw new NaroError(
           "VALIDATION_FAILED",
           `${shown}: references needs <table>.<column>.`
         );
-      column.references = { table, column: target };
+      column.references = { table: table2, column: target };
     } else if (value !== void 0 && key === "ondelete") {
       onDelete = ON_DELETE[value.toLowerCase()];
       if (!onDelete)
@@ -3273,13 +3553,13 @@ async function runSchemaChange(context, operations, question) {
   let file = null;
   let fileWarning;
   const relDir = relativeToCwd(context, dir);
-  const rel = join3(relDir === "." ? "" : relDir, name);
+  const rel = join4(relDir === "." ? "" : relDir, name);
   if (context.flags.noWrite) {
     fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
   } else {
     try {
       mkdirSync3(dir, { recursive: true });
-      writeFileSync3(join3(dir, name), result.sql, { flag: "wx" });
+      writeFileSync3(join4(dir, name), result.sql, { flag: "wx" });
       file = rel;
     } catch (error) {
       const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
@@ -3315,16 +3595,16 @@ async function runDbIndexUsage() {
   throw new NaroError("VALIDATION_FAILED", USAGE2.index);
 }
 async function runDbTableCreate(context) {
-  const [table] = context.positionals;
+  const [table2] = context.positionals;
   const specs = columnsFlag(context);
-  if (!table || specs.length === 0)
+  if (!table2 || specs.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.create);
   const columns = specs.map(parseColumnSpec);
   const owner = context.flags.ownerColumn;
   await runSchemaChange(context, [
     {
       op: "createTable",
-      table,
+      table: table2,
       columns,
       ...context.flags.ifNotExists ? { ifNotExists: true } : {},
       ...owner === void 0 ? {} : { owner: { column: owner } }
@@ -3332,56 +3612,56 @@ async function runDbTableCreate(context) {
   ]);
 }
 async function runDbTableAddColumn(context) {
-  const [table] = context.positionals;
+  const [table2] = context.positionals;
   const specs = columnsFlag(context);
   const [spec] = specs;
-  if (!table || spec === void 0 || specs.length !== 1)
+  if (!table2 || spec === void 0 || specs.length !== 1)
     throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
   await runSchemaChange(context, [
-    { op: "addColumn", table, column: parseColumnSpec(spec) }
+    { op: "addColumn", table: table2, column: parseColumnSpec(spec) }
   ]);
 }
 async function runDbTableRenameColumn(context) {
-  const [table, column, to] = context.positionals;
-  if (!table || !column || !to)
+  const [table2, column, to] = context.positionals;
+  if (!table2 || !column || !to)
     throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
-  await runSchemaChange(context, [{ op: "renameColumn", table, column, to }]);
+  await runSchemaChange(context, [{ op: "renameColumn", table: table2, column, to }]);
 }
 async function runDbTableRename(context) {
-  const [table, to] = context.positionals;
-  if (!table || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
-  await runSchemaChange(context, [{ op: "renameTable", table, to }]);
+  const [table2, to] = context.positionals;
+  if (!table2 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table: table2, to }]);
 }
 async function runDbTableDropColumn(context) {
-  const [table, column] = context.positionals;
-  if (!table || !column)
+  const [table2, column] = context.positionals;
+  if (!table2 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
-  const target = `${table}.${column}`;
+  const target = `${table2}.${column}`;
   await runSchemaChange(
     context,
-    [{ op: "dropColumn", table, column, confirm: target }],
+    [{ op: "dropColumn", table: table2, column, confirm: target }],
     `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
-  const [table] = context.positionals;
-  if (!table) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const [table2] = context.positionals;
+  if (!table2) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
   await runSchemaChange(
     context,
-    [{ op: "dropTable", table, confirm: table }],
-    `Drop table ${printable(table)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    [{ op: "dropTable", table: table2, confirm: table2 }],
+    `Drop table ${printable(table2)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
-  const [table, list] = context.positionals;
+  const [table2, list] = context.positionals;
   const columns = listFlag(list);
-  if (!table || columns.length === 0)
+  if (!table2 || columns.length === 0)
     throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
   const name = context.flags.name;
   await runSchemaChange(context, [
     {
       op: "createIndex",
-      table,
+      table: table2,
       columns,
       ...context.flags.unique ? { unique: true } : {},
       ...name === void 0 ? {} : { name }
@@ -3398,7 +3678,7 @@ async function runDbIndexDrop(context) {
 var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+  sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -3468,7 +3748,7 @@ async function waitForInstall(context, projectId, fullName, deps) {
   if (teamSlug) {
     const attempts = deps.pollAttempts ?? 60;
     const interval = deps.pollIntervalMs ?? 3e3;
-    for (let attempt2 = 0; attempt2 < attempts; attempt2 += 1) {
+    for (let attempt3 = 0; attempt3 < attempts; attempt3 += 1) {
       await deps.sleep(interval);
       let reachable = false;
       try {
@@ -3595,9 +3875,9 @@ async function resolveTeam(context, teams, deps = {}) {
     );
   const account = deps.accountLabel ? await deps.accountLabel() : "this account";
   if (only) {
-    const label2 = only.isPersonal ? `${only.name} (personal)` : only.name;
+    const label3 = only.isPersonal ? `${only.name} (personal)` : only.name;
     context.output.log(`
-   ${account} \u2192 ${label2}`);
+   ${account} \u2192 ${label3}`);
     const ok = await context.prompter.confirm(
       "Deploy to this account and team?"
     );
@@ -3886,7 +4166,7 @@ async function runInspect(context) {
 
 // src/commands/domains.ts
 var defaults3 = {
-  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+  sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
   now: () => Date.now()
 };
 var FIRST_DELAY_MS = 5e3;
@@ -4130,7 +4410,7 @@ async function runDomainsRemove(context) {
 
 // src/commands/env.ts
 import { existsSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseTarget(value) {
@@ -4233,7 +4513,7 @@ async function runEnvPull(context) {
   const vars = Object.fromEntries(
     selected.map((row) => [row.key, row.value ?? ""])
   );
-  const path = join4(context.cwd, file);
+  const path = join5(context.cwd, file);
   if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
     const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
     if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
@@ -4267,7 +4547,7 @@ async function runGenTypes(context) {
     read.policies === void 0 ? {} : { policies: read.policies }
   );
   const undescribed = tables.flatMap(
-    (table) => table.error === void 0 ? [] : [{ name: table.name, error: table.error }]
+    (table2) => table2.error === void 0 ? [] : [{ name: table2.name, error: table2.error }]
   );
   for (const { name, error } of undescribed)
     context.output.warn(
@@ -4303,10 +4583,242 @@ async function runGenTypes(context) {
   ]);
 }
 
+// src/commands/insights-format.ts
+var OFF_LINE = "Speed Insights is off for this project. Turn it on: naro insights enable";
+var TURNED_ON = "Speed Insights is on. Measuring starts within about a minute; values arrive when visitors leave a page.";
+var TURNED_OFF = "Speed Insights is off. Measuring stops within about a minute; turning it back on shows past measurements again.";
+var RANGE_TEXT = {
+  "24h": "last 24 hours",
+  "7d": "last 7 days",
+  "30d": "last 30 days"
+};
+var PART_TEXT = {
+  ttfb: "TTFB",
+  loadDelay: "load delay",
+  loadDuration: "load duration",
+  renderDelay: "render delay",
+  inputDelay: "input delay",
+  processing: "processing",
+  presentation: "presentation"
+};
+function rangeText(range) {
+  const known = RANGE_TEXT;
+  return known[range] ?? printable(range);
+}
+function partText(name) {
+  const known = PART_TEXT;
+  return known[name] ?? printable(name);
+}
+var ATTRIBUTED = /* @__PURE__ */ new Set([
+  "lcp",
+  "inp",
+  "cls"
+]);
+var DEPLOYMENT_ROWS = 10;
+var SUBJECT_LENGTH = 50;
+function formatMs(ms) {
+  const rounded = Math.round(ms);
+  return rounded < 1e3 ? `${String(rounded)} ms` : `${(rounded / 1e3).toFixed(2)} s`;
+}
+function formatValue(metric, value) {
+  return metric === "cls" ? value.toFixed(2) : formatMs(value);
+}
+function formatChange(metric, change2) {
+  const size = formatValue(metric, Math.abs(change2));
+  if (Number.parseFloat(size) === 0) return "\xB10";
+  return change2 > 0 ? `\u25B2 +${size}` : `\u25BC \u2212${size}`;
+}
+function formatCount(count2) {
+  return Math.round(count2).toLocaleString("en-US");
+}
+function percent(part, total) {
+  return `${String(Math.round(part / total * 100))}%`;
+}
+function label2(metric) {
+  return metric.toUpperCase();
+}
+function environmentSuffix(environment) {
+  return environment === "preview" ? ", preview" : "";
+}
+function environmentWord(environment) {
+  return environment === "preview" ? "preview " : "";
+}
+function table(rows) {
+  const widths = [];
+  for (const row of rows)
+    row.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  return rows.map(
+    (row) => `  ${row.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ")}`.trimEnd()
+  );
+}
+function summaryLines(report) {
+  return table([
+    ["Metric", "p75", "Good", "Needs improvement", "Poor", "Visits"],
+    ...SPEED_INSIGHTS_METRICS.map((metric) => {
+      const summary = report.summary[metric];
+      if (summary.p75 === null || summary.samples <= 0)
+        return [label2(metric), "\u2014", "\u2014", "\u2014", "\u2014", "0"];
+      return [
+        label2(metric),
+        formatValue(metric, summary.p75),
+        percent(summary.good, summary.samples),
+        percent(summary.needsImprovement, summary.samples),
+        percent(summary.poor, summary.samples),
+        formatCount(summary.samples)
+      ];
+    })
+  ]);
+}
+function breakdownTable(heading, metric, rows) {
+  if (rows.length === 0) return ["  (none)"];
+  return table([
+    ["p75", "Visits", heading],
+    ...rows.map((row) => [
+      formatValue(metric, row.p75),
+      formatCount(row.samples),
+      printable(row.name)
+    ])
+  ]);
+}
+function elementLines(metric, elements) {
+  const lines = ["", `${label2(metric)} elements behind slow visits`];
+  if (elements.length === 0) return [...lines, "  (none)"];
+  for (const row of elements) {
+    lines.push(
+      `  ${printable(row.element)} on ${printable(row.route)}: ${formatCount(row.slow)} slow visits, average ${formatValue(metric, row.average)}`
+    );
+    if (row.parts && row.parts.length > 0)
+      lines.push(
+        `    ${row.parts.map((part) => `${partText(part.name)} ${formatMs(part.ms)}`).join(" \xB7 ")}`
+      );
+    if (row.url) lines.push(`    image ${printable(row.url)}`);
+  }
+  return lines;
+}
+function deploymentName(row) {
+  if (row.source === "cli" || !row.commitSha) return row.id.slice(0, 8);
+  const sha = printable(row.commitSha.slice(0, 7));
+  const subject = [
+    ...printable(row.commitMessage?.split("\n")[0]?.trim() ?? "")
+  ];
+  if (subject.length === 0) return sha;
+  return subject.length > SUBJECT_LENGTH ? `${sha} ${subject.slice(0, SUBJECT_LENGTH - 1).join("")}\u2026` : `${sha} ${subject.join("")}`;
+}
+function changeText(metric, row) {
+  if (row.samples < SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES)
+    return "too few visits";
+  if (row.change === null) return "\u2013";
+  return formatChange(metric, row.change);
+}
+function deploymentLines(metric, deployments, environment) {
+  if (deployments === null) return [];
+  const lines = [
+    "",
+    `${label2(metric)} by ${environmentWord(environment)}deployment, newest first`
+  ];
+  const measured = deployments.filter((row) => row.samples > 0).slice(0, DEPLOYMENT_ROWS);
+  if (measured.length === 0) return [...lines, "  (none)"];
+  return [
+    ...lines,
+    ...table([
+      ["", "p75", "Visits", "Change", "Deployment"],
+      ...measured.map((row) => [
+        row.liveUntil === null ? "Live" : "",
+        row.p75 === null ? "\u2014" : formatValue(metric, row.p75),
+        formatCount(row.samples),
+        changeText(metric, row),
+        deploymentName(row)
+      ])
+    ])
+  ];
+}
+function reportLines(report, deployments) {
+  if (!report.enabled) return [OFF_LINE];
+  const { metric, range, environment } = report;
+  const head = `Speed Insights \u2014 ${label2(metric)}, ${rangeText(range)}${environmentSuffix(environment)}`;
+  if (SPEED_INSIGHTS_METRICS.every((m) => report.summary[m].samples <= 0))
+    return [
+      head,
+      "",
+      `No ${environmentWord(environment)}measurements in the ${rangeText(range)} yet. Values arrive when visitors leave a page.`
+    ];
+  return [
+    head,
+    "",
+    ...summaryLines(report),
+    "",
+    `${label2(metric)} by page`,
+    ...breakdownTable("Page", metric, report.paths),
+    "",
+    `${label2(metric)} by device`,
+    ...breakdownTable("Device", metric, report.devices),
+    ...ATTRIBUTED.has(metric) ? elementLines(metric, report.elements) : [],
+    ...deploymentLines(metric, deployments, environment)
+  ];
+}
+function routePathsLines(result) {
+  return [
+    `${label2(result.metric)} p75 under ${printable(result.route)}, ${rangeText(result.range)}${environmentSuffix(result.environment)}`,
+    ...breakdownTable("Path", result.metric, result.paths)
+  ];
+}
+
+// src/commands/insights.ts
+function queryOf(flags) {
+  return {
+    ...flags.range !== void 0 ? { range: flags.range } : {},
+    ...flags.metric !== void 0 ? { metric: flags.metric } : {},
+    ...flags.env !== void 0 ? { environment: flags.env } : {}
+  };
+}
+async function runInsights(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const query = queryOf(context.flags);
+  if (context.flags.route !== void 0) {
+    const result = await client.insights.paths(projectId, {
+      ...query,
+      route: context.flags.route
+    });
+    context.output.result({ projectId, ...result }, routePathsLines(result));
+    return;
+  }
+  const overview = await client.insights.overview(projectId, query);
+  if (overview.deploymentsError)
+    context.output.warn(
+      `Deployments are unavailable right now: ${printable(overview.deploymentsError.message)}`
+    );
+  context.output.result(
+    { projectId, ...overview },
+    reportLines(overview.report, overview.deployments)
+  );
+}
+async function setInsights(context, enabled) {
+  if (context.flags.env !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Speed Insights has one switch for production and preview; drop --env."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const result = await client.insights.setEnabled(projectId, enabled);
+  context.output.result({ projectId, enabled: result.enabled }, [
+    result.enabled ? TURNED_ON : TURNED_OFF
+  ]);
+}
+function runInsightsEnable(context) {
+  return setInsights(context, true);
+}
+function runInsightsDisable(context) {
+  return setInsights(context, false);
+}
+
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -4554,80 +5066,3067 @@ async function runRollback(context) {
   await promoteAndWait(context, client, project, target, "rollback");
 }
 
-// src/router.ts
-var HELP = `naro \u2014 deploy Next.js apps to Naro (https://naro.sh)
-
-Usage:
-  naro login | logout | whoami
-  naro token                         Print an access token for CI (NARO_TOKEN)
-
-  naro link | init                   Link this directory to a Naro project
-  naro unlink                        Remove the link (.naro/)
-  naro projects [--team <slug>]      List projects
-  naro project inspect               Show the linked project
-
-  naro deploy [--prod]               Build locally and deploy (preview by default)
-       [--root <dir>] [--name <name>]  --root points at the app in a monorepo
-  naro deployments                   List deployments of the linked project
-  naro inspect <deployment-id>       Show one deployment + build logs
-  naro cancel <deployment-id>        Stop a build that is still running
-
-  naro git connect [owner/repo]      Deploy on every push (defaults to your origin remote)
-  naro git disconnect                Stop deploying on push
-
-  naro logs [deployment-id]          Runtime logs (or build logs of a deployment)
-       [--type build|runtime] [--env production|preview] [--level error] [--follow]
-
-  naro env list                      List env vars (secrets masked)
-  naro env add KEY [environment]     Add/update (value from prompt or stdin)
-  naro env remove KEY [environment]  Remove
-  naro env pull [file]               Write env vars to .env.local
+// src/commands/protection.ts
+var DISABLE_QUESTION2 = "Open this project's preview to anyone with the link? Visitors no longer need to be a member to see it.";
+var REPLACE_QUESTION = "Replace the bypass secret? The current one stops working, and automation still sending it can no longer open the preview.";
+var REMOVE_QUESTION = "Remove the bypass secret? Automation that sends it can no longer open the preview.";
+var EDGE = "The edge picks the change up within about a minute.";
+function statusLine(state) {
+  return `Preview protection: ${state.enabled ? "on" : "off"} \xB7 bypass secret: ${state.bypass ? "set" : "none"}`;
+}
+async function runProtection(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const state = await client.protection.get(projectId);
+  context.output.result({ projectId, ...state }, [statusLine(state)]);
+}
+async function setProtection(context, enabled) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const state = await client.protection.set(projectId, enabled);
+  context.output.result({ projectId, ...state }, [
+    state.enabled ? `Preview protection is on: only members of this project can open the preview. ${EDGE}` : `Preview protection is off: anyone with the link can open the preview. ${EDGE}`
+  ]);
+}
+function runProtectionEnable(context) {
+  return setProtection(context, true);
+}
+async function runProtectionDisable(context) {
+  await confirmOrAbort(context, DISABLE_QUESTION2);
+  return setProtection(context, false);
+}
+async function runProtectionBypass(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (!context.flags.yes && (await client.protection.get(projectId)).bypass)
+    await confirmOrAbort(context, REPLACE_QUESTION);
+  const result = await client.protection.createBypass(projectId);
+  context.output.result({ projectId, ...result }, [
+    `Bypass secret (shown once): ${result.secret}`,
+    "Send it as the x-naro-protection-bypass header."
+  ]);
+}
+async function runProtectionBypassRemove(context) {
+  await confirmOrAbort(context, REMOVE_QUESTION);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const state = await client.protection.removeBypass(projectId);
+  context.output.result({ projectId, ...state }, ["Bypass secret removed."]);
+}
 
-  naro domains list | add <host> [--no-www] | remove <host>
-       add example.com also connects www.example.com and redirects the apex to
-       it, because most registrars cannot put a CNAME on an apex; --no-www
-       registers the apex alone
-  naro domains verify [host] [--wait]  Re-check DNS and print what is missing
-       exits non-zero while a domain is not live yet
+// src/commands/storage-units.ts
+var SIZE_MESSAGE = "--file-size-limit takes a whole number of bytes, or a size like 5MB (1000s) or 5MiB (1024s), or none.";
+var UNITS = {
+  b: 1,
+  kb: 1e3,
+  mb: 1e6,
+  gb: 1e9,
+  kib: 1024,
+  mib: 1048576,
+  gib: 1073741824
+};
+function parseSize(text) {
+  const match = /^(\d{1,16})\s*([a-z]+)?$/i.exec(text.trim());
+  const unit = UNITS[(match?.[2] ?? "b").toLowerCase()];
+  const bytes = match?.[1] !== void 0 && unit !== void 0 ? Number(match[1]) * unit : Number.NaN;
+  if (!Number.isSafeInteger(bytes) || bytes < 1)
+    throw new NaroError("VALIDATION_FAILED", SIZE_MESSAGE);
+  return bytes;
+}
+function binarySize(bytes) {
+  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  const shown = unit === 0 ? String(value) : String(Number(value.toFixed(1)));
+  return `${shown} ${units[unit] ?? "B"}`;
+}
+function count(n, noun) {
+  return `${n.toLocaleString("en-US")} ${noun}${n === 1 ? "" : "s"}`;
+}
 
-  naro db enable                     Create the project's database (Cloudflare D1)
-  naro db info                       Database status, size, table count and limits
-       and today's writes against the daily write limit (UTC)
-  naro db query <sql> | --file <f>   Run SQL against it (reads stdin when piped)
-  naro db push [--dry-run]           Apply pending migrations from ./migrations (asks first; --yes to skip)
-  naro db dump [--output <f>]        Download a SQL dump of the database (stdout by default)
-       [--schema-only|--data-only] [--table a,b]  Cloudflare holds other queries until it finishes
-  naro db restore --bookmark <id>    Roll the database back (Time Travel, last 30 days; asks first)
-       | --timestamp <time> [--dry-run]  prints the command that undoes it
-  naro db pull [--dir <d>]           Write the remote schema as migrations/0001_remote_schema.sql
-                                     and record it as applied - a baseline (asks first)
-  naro db reset [--dir <d>]          Drop everything, clear the ledger, re-apply ./migrations
-       [--dry-run] [--yes]           (asks first; db restore --bookmark undoes it)
-  naro db lint [--strict]            Check the schema for what D1 actually trips on
-                                     (exits 1 on an error, --strict on a warning too)
-  naro db table create <name> --column <spec> [--column <spec>\u2026]
-       [--owner <column>] [--if-not-exists]  Create a table without SQL. <spec> is name:type[:modifier\u2026]:
-                                     types integer, real, text, blob, numeric, boolean, datetime, json;
-                                     modifiers pk, autoincrement, notnull, unique, default=<v>,
-                                     references=<table>.<column>, ondelete=cascade|set-null|\u2026
-                                     --owner adds that column (TEXT NOT NULL) and an owner policy
-  naro db table add-column <table> --column <spec>
-  naro db table rename-column <table> <column> <new-name>
-  naro db table rename <table> <new-name>
-  naro db table drop-column <table> <column>  Asks first (--yes to skip)
-  naro db table drop <table>         Asks first (--yes to skip)
-  naro db index create <table> <col[,col\u2026]> [--unique] [--name <name>]
-  naro db index drop <name>
-       Each runs as one migration in d1_migrations and is written to ./migrations
-       (--no-write skips the file; --dry-run prints the SQL and changes nothing)
-  naro migration new <name>          Create migrations/NNNN_<name>.sql (stdin becomes the body when piped)
-  naro migration list                Local vs applied migrations
-  naro migration up [--dry-run]      Same as db push
-  naro migration repair <name>       Fix the ledger alone: mark a migration applied or
-       --status applied|reverted [--yes]  remove its row. Its SQL is never run (asks first)
-  naro gen types [--lang typescript] [--output <file>]
-                                     TypeScript types for the schema, for createClient<Database>()
-                                     from naro-js (stdout by default)
+// src/commands/storage.ts
+var CREATE_USAGE2 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
+var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]";
+var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
+var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
+var ENABLE_FIRST = "Storage is not enabled yet; enabling it first.";
+var NO_BUCKETS = "No buckets yet. `naro storage bucket create <name>` makes one.";
+var IDLE_PAGES = 3;
+function bucketLine(bucket) {
+  const name = printable(bucket.name);
+  const cells = [
+    name.padEnd(20),
+    (bucket.public ? "public" : "private").padEnd(7),
+    count(bucket.objects, "object").padEnd(12),
+    binarySize(bucket.bytes).padEnd(10),
+    bucket.allowedMimeTypes === null ? "any type" : printable(bucket.allowedMimeTypes.join(",")),
+    bucket.fileSizeLimit === null ? "no size limit" : `up to ${binarySize(bucket.fileSizeLimit)}`
+  ];
+  const line = `  ${cells.join("  ")}`;
+  return bucket.deletingAt === null ? line : `${line}  (being removed: \`naro storage bucket remove ${name} --empty\` finishes it)`;
+}
+function storageLines(info) {
+  if (!info.enabled)
+    return [
+      "Storage:     off",
+      "Run `naro storage enable` to turn it on (the project's backend must be on first)."
+    ];
+  const { limits, usage } = info;
+  return [
+    `Storage:     on (R2 bucket ${printable(info.bucket ?? "unknown")})`,
+    `Limits:      ${binarySize(limits.bytes)} in all, ${binarySize(limits.objectBytes)} per object, ${binarySize(limits.singleUploadBytes)} per upload`,
+    usage === null ? "Used:        not known yet: the backend is not ready (`naro backend` shows where it got to)" : `Used:        ${binarySize(usage.bytes)} in ${count(usage.objects, "object")}`,
+    info.buckets.length === 0 ? "Buckets:     none yet (`naro storage bucket create <name>` makes one)" : `Buckets:     ${String(info.buckets.length)}`,
+    ...info.buckets.map(bucketLine)
+  ];
+}
+async function enableStorage(client, projectId) {
+  try {
+    return await client.storage.enable(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        "Turning Storage on did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage enable` again picks up where it stopped.",
+        { cause: error }
+      );
+    throw error;
+  }
+}
+function bucketName(context, usage) {
+  if (context.positionals.length !== 1)
+    throw new NaroError("VALIDATION_FAILED", usage);
+  return context.positionals[0];
+}
+function bucketFields(flags) {
+  if (flags.public === true && flags.private === true)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --public or --private, not both."
+    );
+  const fields = {};
+  if (flags.public === true) fields.public = true;
+  if (flags.private === true) fields.public = false;
+  if (flags.fileSizeLimit !== void 0)
+    fields.fileSizeLimit = flags.fileSizeLimit.trim().toLowerCase() === "none" ? null : parseSize(flags.fileSizeLimit);
+  if (flags.allowedMimeTypes !== void 0)
+    fields.allowedMimeTypes = flags.allowedMimeTypes.trim().toLowerCase() === "any" ? null : listFlag(flags.allowedMimeTypes);
+  return fields;
+}
+async function runStorageStatus(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const storage = await client.storage.info(projectId);
+  context.output.result({ projectId, storage }, storageLines(storage));
+}
+async function runStorageEnable(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const storage = await enableStorage(client, projectId);
+  context.output.result({ projectId, storage }, [
+    `\u2705 Storage is on: R2 bucket ${printable(storage.bucket ?? "unknown")}.`,
+    ...storage.usage === null ? ["\u23F3 The backend is still finishing; check `naro backend` in a minute."] : [],
+    ...storageLines(storage)
+  ]);
+}
+async function runStorageBucketList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const buckets = await client.storage.listBuckets(projectId);
+  context.output.result(
+    { projectId, buckets },
+    buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine)
+  );
+}
+async function runStorageBucketCreate(context) {
+  const name = bucketName(context, CREATE_USAGE2);
+  const input = { name, ...bucketFields(context.flags) };
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  let bucket;
+  try {
+    bucket = await client.storage.createBucket(projectId, input);
+  } catch (error) {
+    if (!isNaroError(error) || error.code !== "STORAGE_NOT_ENABLED")
+      throw error;
+    context.output.log(ENABLE_FIRST);
+    await enableStorage(client, projectId);
+    bucket = await client.storage.createBucket(projectId, input);
+  }
+  context.output.result({ projectId, bucket }, [
+    `\u2705 Created bucket ${printable(bucket.name)}.`,
+    bucketLine(bucket)
+  ]);
+}
+async function runStorageBucketUpdate(context) {
+  const name = bucketName(context, UPDATE_USAGE);
+  const patch = bucketFields(context.flags);
+  if (patch.public === true)
+    await confirmOrAbort(
+      context,
+      `Make bucket ${name} public? Anyone with an object's URL can download it.`
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const bucket = await client.storage.updateBucket(projectId, name, patch);
+  context.output.result({ projectId, bucket }, [
+    `\u2705 Updated bucket ${printable(bucket.name)}. It takes effect within about 10 seconds.`,
+    bucketLine(bucket)
+  ]);
+}
+async function untilDone(context, bucket, page) {
+  let deleted = 0;
+  let idle = 0;
+  for (; ; ) {
+    const result = await page();
+    deleted += result.deleted;
+    if (result.done) return deleted;
+    idle = result.deleted === 0 ? idle + 1 : 0;
+    if (idle >= IDLE_PAGES)
+      throw new NaroError(
+        "BUCKET_EMPTY_STALLED",
+        `Bucket ${bucket} is not empty yet, but the last calls deleted nothing. Run the same command again in a minute.`,
+        { details: { deleted } }
+      );
+    context.output.log(`\u2026 ${count(deleted, "object")} deleted so far`);
+  }
+}
+function objectsSentence(objects2) {
+  return `Its ${count(objects2, "object")} ${objects2 === 1 ? "is" : "are"} deleted and cannot be restored.`;
+}
+async function runStorageBucketEmpty(context) {
+  const name = bucketName(context, EMPTY_USAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const bucket = await client.storage.getBucket(projectId, name);
+  await confirmOrAbort(
+    context,
+    `Empty bucket ${name}? ${objectsSentence(bucket.objects)}`
+  );
+  const deleted = await untilDone(
+    context,
+    name,
+    () => client.storage.emptyBucket(projectId, name)
+  );
+  context.output.result({ projectId, bucket: name, deleted }, [
+    `\u2705 Emptied ${name}: ${count(deleted, "object")} deleted.`
+  ]);
+}
+async function runStorageBucketRemove(context) {
+  const name = bucketName(context, REMOVE_USAGE2);
+  const empty = context.flags.empty === true;
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  let question = `Remove bucket ${name}?`;
+  if (empty) {
+    const bucket = await client.storage.getBucket(projectId, name);
+    question += ` ${objectsSentence(bucket.objects)}`;
+  }
+  await confirmOrAbort(context, question);
+  await untilDone(context, name, async () => {
+    const removal = await client.storage.removeBucket(
+      projectId,
+      name,
+      empty ? { empty: true } : {}
+    );
+    return "ok" in removal ? { deleted: 0, done: true } : removal;
+  });
+  context.output.result({ projectId, bucket: name, removed: true }, [
+    `\u2705 Removed bucket ${name}.`
+  ]);
+}
+
+// src/commands/storage-objects.ts
+import { randomUUID } from "crypto";
+import { createWriteStream as createWriteStream2, openAsBlob, rmSync as rmSync2 } from "fs";
+import { rename, rm, stat } from "fs/promises";
+import { basename as basename2, dirname as dirname3, extname, join as join6, resolve as resolve5 } from "path";
+import { Readable } from "stream";
+import { pipeline as pipeline2 } from "stream/promises";
+
+// ../../packages/naro-sdk/dist/index.js
+var INVALID_QUERY_MESSAGE = "The query is not a valid Naro query.";
+var INVALID_SESSION_MESSAGE = "The session is expired or not valid. Sign in again.";
+function networkError(cause) {
+  return {
+    code: "NETWORK_ERROR",
+    message: "The request did not reach the Naro backend. Check the url and the network.",
+    details: { cause: describe(cause) }
+  };
+}
+function requestTimeout(ms) {
+  return {
+    code: "TIMEOUT",
+    message: `The Naro backend did not answer within ${String(Math.round(ms / 1e3))} seconds. Check the network and try again.`
+  };
+}
+function invalidResponse(status) {
+  return {
+    code: "INVALID_RESPONSE",
+    message: `The server did not answer like a Naro backend (HTTP ${String(status)}).`,
+    details: { status }
+  };
+}
+function invalidQuery(path, reason) {
+  return {
+    code: "INVALID_QUERY",
+    message: INVALID_QUERY_MESSAGE,
+    details: { path, reason }
+  };
+}
+function invalidSession() {
+  return { code: "INVALID_SESSION", message: INVALID_SESSION_MESSAGE };
+}
+function codeVerifierMissing() {
+  return {
+    code: "CODE_VERIFIER_MISSING",
+    message: "This browser did not start this sign-in, so it cannot finish it. Sign in again here."
+  };
+}
+function passwordRecoveryRequired() {
+  return {
+    code: "PASSWORD_RECOVERY_REQUIRED",
+    message: "updateUser({ password }) works in the password recovery flow: open the link resetPasswordForEmail sent, then call it on that page."
+  };
+}
+function invalidProvider() {
+  return {
+    code: "VALIDATION_ERROR",
+    message: "provider must be google or github."
+  };
+}
+function serviceKeyRequired() {
+  return {
+    code: "PERMISSION_DENIED",
+    message: "Only the service key can manage users."
+  };
+}
+function cryptoUnavailable() {
+  return {
+    code: "CRYPTO_UNAVAILABLE",
+    message: "This runtime has no crypto.subtle, which signing in with a provider needs (https or localhost)."
+  };
+}
+function describe(cause) {
+  if (cause instanceof Error) return `${cause.name}: ${cause.message}`;
+  return String(cause);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asError(value) {
+  if (!isRecord(value)) return null;
+  const { code, message } = value;
+  if (typeof code !== "string" || code === "") return null;
+  if (typeof message !== "string") return null;
+  const error = { code, message };
+  if (value.details !== void 0) error.details = value.details;
+  return error;
+}
+function errorFromBody(status, body) {
+  if (isRecord(body) && body.error !== void 0 && body.error !== null)
+    return asError(body.error) ?? invalidResponse(status);
+  if (status >= 200 && status < 300) return null;
+  return invalidResponse(status);
+}
+async function receive(config, options, init) {
+  const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
+  if (controller) init.signal = controller.signal;
+  const request = (async () => {
+    try {
+      const fetchImpl = config.fetch ?? globalThis.fetch;
+      const response = await fetchImpl(
+        `${config.baseUrl}/_naro/v1${options.path}`,
+        init
+      );
+      return {
+        status: response.status,
+        headers: response.headers,
+        text: await response.text()
+      };
+    } catch (error) {
+      return { error: networkError(error) };
+    }
+  })();
+  const { timeoutMs } = options;
+  if (timeoutMs === void 0) return request;
+  let timer;
+  const expired = new Promise((resolve6) => {
+    timer = setTimeout(() => {
+      controller?.abort();
+      resolve6({ error: requestTimeout(timeoutMs) });
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([request, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function call(config, options) {
+  let payload;
+  if (options.body !== void 0) {
+    try {
+      payload = JSON.stringify(options.body);
+    } catch {
+      return { error: invalidQuery("", "is not JSON"), answer: null };
+    }
+  }
+  const token = options.withToken ? await config.tokens.get() : null;
+  const headers = { apikey: config.apiKey };
+  if (token !== null) headers.Authorization = `Bearer ${token}`;
+  const init = {
+    method: options.method,
+    headers,
+    // Identity is the bearer token alone. The sign-in routes also set a
+    // session cookie (spec §13); a request that carried it would let any site
+    // act as the user. Workers accept the field (measured on workerd
+    // 1.20260815).
+    credentials: "omit"
+  };
+  if (payload !== void 0) {
+    headers["Content-Type"] = "application/json";
+    init.body = payload;
+  }
+  const received = await receive(config, options, init);
+  if ("error" in received) return { error: received.error, answer: null };
+  const { status, headers: responseHeaders, text } = received;
+  let body;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      return { error: invalidResponse(status), answer: null };
+    }
+  }
+  const answer = { status, headers: responseHeaders, body, token };
+  const error = errorFromBody(status, body);
+  if (error === null) return { error: null, answer };
+  return {
+    error: await settled(config, error, responseHeaders, token),
+    answer
+  };
+}
+async function settled(config, error, headers, token) {
+  if (error.code === "INVALID_SESSION" && token !== null)
+    await config.tokens.clearIf(token);
+  return RETRY_AFTER_CODES.has(error.code) ? withRetryAfter(error, headers) : error;
+}
+async function send(config, options) {
+  const token = options.withToken ? await config.tokens.get() : null;
+  const headers = {
+    ...options.headers,
+    apikey: config.apiKey
+  };
+  if (token !== null) headers.Authorization = `Bearer ${token}`;
+  const init = {
+    method: options.method,
+    headers,
+    credentials: "omit"
+  };
+  if (options.body !== void 0) init.body = options.body;
+  let response;
+  try {
+    const fetchImpl = config.fetch ?? globalThis.fetch;
+    response = await fetchImpl(
+      `${config.baseUrl}/_naro/v1${options.path}`,
+      init
+    );
+  } catch (error2) {
+    return { error: networkError(error2) };
+  }
+  if (response.status >= 200 && response.status < 300)
+    return { error: null, response };
+  let text;
+  try {
+    text = await response.text();
+  } catch (error2) {
+    return { error: networkError(error2) };
+  }
+  let body;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      return { error: invalidResponse(response.status) };
+    }
+  }
+  const error = errorFromBody(response.status, body) ?? invalidResponse(response.status);
+  return { error: await settled(config, error, response.headers, token) };
+}
+var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
+  "RATE_LIMITED",
+  "WRITE_QUOTA_EXCEEDED",
+  // Storage (original spec §13): one object written twice within a second
+  // (`x-retry-after: 1`), and the daily operation limit (3-1d).
+  "OBJECT_RATE_LIMITED",
+  "STORAGE_OPS_QUOTA_EXCEEDED"
+]);
+function withRetryAfter(error, headers) {
+  const header = headers.get("x-retry-after")?.trim() ?? "";
+  if (!/^\d{1,9}$/.test(header)) return error;
+  const { details } = error;
+  if (details !== void 0 && !isRecord(details)) return error;
+  return {
+    ...error,
+    details: { ...details, retryAfter: Number(header) }
+  };
+}
+function isBrowser(scope = globalThis) {
+  const g = scope;
+  return g.window !== void 0 && g.document !== void 0;
+}
+function isWorkerd(g) {
+  return g.navigator?.userAgent === "Cloudflare-Workers";
+}
+function hasServerSignal(g) {
+  return isWorkerd(g) || // Vercel's edge runtime and Next.js's edge (middleware, edge routes).
+  typeof g.EdgeRuntime === "string" || typeof g.Deno?.version?.deno === "string" || typeof g.Bun?.version === "string" || // Node, and so the Next.js server. Browser polyfills of `process` leave
+  // `versions.node` out.
+  typeof g.process?.versions?.node === "string";
+}
+function hasDeviceSignal(g) {
+  if (g.window !== void 0 || g.document !== void 0) return true;
+  if (g.navigator?.product === "ReactNative") return true;
+  return !isWorkerd(g) && (g.WorkerGlobalScope !== void 0 || g.ServiceWorkerGlobalScope !== void 0);
+}
+function isKnownServer(scope = globalThis) {
+  const g = scope;
+  return hasServerSignal(g) && !hasDeviceSignal(g);
+}
+var USERS_PATH = "/auth/admin/users";
+function dataOf(result) {
+  if (result.error !== null) return null;
+  const { body } = result.answer;
+  return isRecord(body) && isRecord(body.data) ? body.data : null;
+}
+function errorOf(result) {
+  if (result.error !== null) return result.error;
+  return invalidResponse(result.answer.status);
+}
+function userOf(value) {
+  return isRecord(value) && typeof value.id === "string" ? value : null;
+}
+var AuthAdminApi = class {
+  #http;
+  #serviceKey;
+  constructor(http, serviceKey) {
+    this.#http = http;
+    this.#serviceKey = serviceKey;
+  }
+  /**
+   * Creates a user with a password: an email, a username or both. It is
+   * made while sign-ups are closed too, and is confirmed unless
+   * `emailConfirm: false`. A username-only user answers `email: null` and
+   * signs in with `signIn({ username, password })`. Refusals come as the
+   * worker says them: USERNAME_TAKEN (409),
+   * USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL (422), PASSWORD_TOO_SHORT ("Use at
+   * least {n} characters."), VALIDATION_ERROR, WRITE_QUOTA_EXCEEDED (429).
+   */
+  async createUser(attributes) {
+    if (!this.#serviceKey)
+      return { data: { user: null }, error: serviceKeyRequired() };
+    const result = await call(this.#http, {
+      method: "POST",
+      path: USERS_PATH,
+      body: attributes,
+      withToken: false
+    });
+    const user = userOf(dataOf(result)?.user);
+    if (user === null) return { data: { user: null }, error: errorOf(result) };
+    return { data: { user }, error: null };
+  }
+  /** The project's users, newest first: page 1 and 50 a page unless given. */
+  async listUsers(params = {}) {
+    const none = { users: [], total: 0 };
+    if (!this.#serviceKey) return { data: none, error: serviceKeyRequired() };
+    const query = new URLSearchParams();
+    if (params.page !== void 0) query.set("page", String(params.page));
+    if (params.perPage !== void 0)
+      query.set("perPage", String(params.perPage));
+    const search = query.toString();
+    const result = await call(this.#http, {
+      method: "GET",
+      path: search === "" ? USERS_PATH : `${USERS_PATH}?${search}`,
+      withToken: false
+    });
+    const data = dataOf(result);
+    const users = Array.isArray(data?.users) ? data.users.map(userOf) : null;
+    if (!data || users === null || users.includes(null) || typeof data.total !== "number")
+      return { data: none, error: errorOf(result) };
+    return {
+      data: { users, total: data.total },
+      error: null
+    };
+  }
+  /**
+   * Deletes a user and its sign-in methods, and ends its sessions. Answers
+   * the user it was; USER_NOT_FOUND (404) for an id that is no user.
+   */
+  async deleteUser(id) {
+    if (!this.#serviceKey)
+      return { data: { user: null }, error: serviceKeyRequired() };
+    const result = await call(this.#http, {
+      method: "DELETE",
+      path: `${USERS_PATH}/${encodeURIComponent(String(id))}`,
+      withToken: false
+    });
+    const user = userOf(dataOf(result)?.user);
+    if (user === null) return { data: { user: null }, error: errorOf(result) };
+    return { data: { user }, error: null };
+  }
+};
+var CODE = /^[A-Z0-9_]{1,64}$/;
+var INVALID_CONFIRMATION = "The confirmation link is not valid. Ask for a new one.";
+var MESSAGES = {
+  INVALID_STATE: "This sign-in link is not valid or has expired. Start signing in again.",
+  OAUTH_BROWSER_MISMATCH: "This sign-in was started in another browser, or this browser did not keep its cookie. Start signing in again here.",
+  OAUTH_ACCESS_DENIED: "Signing in with the provider was cancelled.",
+  OAUTH_PROVIDER_EMAIL_NOT_VERIFIED: "Your email address is not verified with the provider. Verify it there, then sign in again.",
+  OAUTH_ACCOUNT_NOT_LINKED: "An account with this email already exists and is not linked to this provider. Sign in the way you signed up.",
+  PROVIDER_NOT_CONFIGURED: "Signing in with this provider is not set up for this project.",
+  RATE_LIMITED: "Too many sign-in attempts. Wait a few seconds and try again.",
+  // A first Google or GitHub sign-in while the project's sign-ups are
+  // closed (spec 2026-09-26 §2.1): the worker's own words.
+  SIGNUPS_DISABLED: "Sign-ups are closed for this project.",
+  INTERNAL_ERROR: "Something went wrong. Try again.",
+  PASSWORD_RESET_REQUIRED: "Your email is confirmed. Someone else also signed up with it before it was confirmed, so its password was cleared: choose a new one with a password reset.",
+  TOKEN_EXPIRED: "The confirmation link has expired. Ask for a new one.",
+  USER_NOT_FOUND: INVALID_CONFIRMATION
+};
+function flowError(type, raw) {
+  if (!CODE.test(raw))
+    return {
+      code: "AUTH_ERROR",
+      message: "Signing in did not finish. Try again."
+    };
+  if (raw === "INVALID_TOKEN")
+    return {
+      code: raw,
+      message: type === "recovery" ? "The password reset link is not valid, has expired or was already used. Ask for a new one." : INVALID_CONFIRMATION
+    };
+  const message = MESSAGES[raw];
+  if (message !== void 0) return { code: raw, message };
+  if (raw.startsWith("OAUTH_"))
+    return {
+      code: raw,
+      message: `Signing in with the provider did not finish (${raw}). Try again.`
+    };
+  return {
+    code: raw,
+    message: `Signing in did not finish (${raw}). Try again.`
+  };
+}
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function createPkcePair() {
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle === void 0) return null;
+  const verifier = base64url(
+    globalThis.crypto.getRandomValues(new Uint8Array(32))
+  );
+  const digest = await subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier)
+  );
+  return { verifier, challenge: base64url(new Uint8Array(digest)) };
+}
+var TOKEN_HEADER = "set-auth-token";
+var FRAGMENT_PREFIX = "naro_";
+var OAUTH_PROVIDERS = ["google", "github"];
+var FLOW_TYPES = [
+  "oauth",
+  "email_verification",
+  "recovery"
+];
+function defaultName(email) {
+  if (typeof email !== "string") return "";
+  const at = email.lastIndexOf("@");
+  return at > 0 ? email.slice(0, at) : email;
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function tokenFrom(answer) {
+  return nonEmpty(answer.headers.get(TOKEN_HEADER));
+}
+function userFrom(body) {
+  return isRecord(body) && isRecord(body.user) ? body.user : null;
+}
+function currentLocation() {
+  if (!isBrowser()) return null;
+  return globalThis.location ?? null;
+}
+function currentPage() {
+  const location = currentLocation();
+  if (!location) return void 0;
+  return `${location.origin}${location.pathname}${location.search}`;
+}
+function naroFragment() {
+  const hash = currentLocation()?.hash ?? "";
+  if (!hash.startsWith("#")) return null;
+  const params = new URLSearchParams(hash.slice(1));
+  const found = {};
+  for (const [key, value] of params)
+    if (key.startsWith(FRAGMENT_PREFIX)) found[key] = value;
+  return Object.keys(found).length > 0 ? found : null;
+}
+function clearFragment() {
+  const location = currentLocation();
+  const history = globalThis.history;
+  if (!location || !history?.replaceState) return;
+  try {
+    history.replaceState(
+      history.state,
+      "",
+      `${location.pathname}${location.search}`
+    );
+  } catch {
+  }
+}
+var EXCHANGE_TIMEOUT_MS = 15e3;
+var inFlight = /* @__PURE__ */ new WeakMap();
+function sharedInFlight(shared) {
+  return inFlight.get(shared.storage)?.get(shared.key) ?? null;
+}
+function share(shared, pending) {
+  let entries = inFlight.get(shared.storage);
+  if (!entries) {
+    entries = /* @__PURE__ */ new Map();
+    inFlight.set(shared.storage, entries);
+  }
+  entries.set(shared.key, pending);
+  void pending.finally(() => {
+    if (entries.get(shared.key) === pending) entries.delete(shared.key);
+  });
+}
+var AuthClient = class {
+  /**
+   * The service key's user management — createUser, listUsers, deleteUser,
+   * as in supabase-js (spec 2026-09-26 §2.2). Only on a client made with
+   * `serviceKey`, on a server.
+   */
+  admin;
+  #http;
+  #flow;
+  /** The last `getSessionFromUrl()`, for callers after detection ran it. */
+  #fromUrl = null;
+  constructor(http, flow) {
+    this.#http = http;
+    this.#flow = flow;
+    this.admin = new AuthAdminApi(http, flow.serviceKey);
+    if (flow.detectSessionInUrl) {
+      if (naroFragment() !== null) void this.getSessionFromUrl();
+      else this.#fromUrl = sharedInFlight(flow.shared);
+    }
+  }
+  /**
+   * Creates the account and signs in; the token is stored for later calls.
+   * When the project requires a confirmed email there is no session yet —
+   * `user` comes back, and after the confirmation link the user signs in.
+   * While the project's sign-ups are closed every sign-up answers 403
+   * SIGNUPS_DISABLED; while they are open, a taken `username` answers 409
+   * USERNAME_TAKEN.
+   */
+  async signUp(credentials) {
+    const { email, password, username } = credentials;
+    const name = credentials.name ?? username ?? defaultName(email);
+    const body = { email, password, name };
+    if (username !== void 0) body.username = username;
+    if (credentials.redirectTo !== void 0)
+      body.callbackURL = credentials.redirectTo;
+    return this.#signIn("/auth/sign-up/email", body, false);
+  }
+  /**
+   * Signs in with an email and password, or a username and password (spec
+   * 2026-09-26 §2.3); the token is stored for later calls. A wrong password
+   * answers 401 INVALID_EMAIL_OR_PASSWORD, or INVALID_USERNAME_OR_PASSWORD.
+   */
+  async signIn(credentials) {
+    const { password } = credentials;
+    if (credentials.username !== void 0)
+      return this.#signIn(
+        "/auth/sign-in/username",
+        { username: credentials.username, password },
+        true
+      );
+    return this.#signIn(
+      "/auth/sign-in/email",
+      { email: credentials.email, password },
+      true
+    );
+  }
+  /**
+   * Starts a Google or GitHub sign-in: sends the browser, with a top-level
+   * navigation, to the worker's `GET /_naro/v1/auth/authorize/<provider>`,
+   * which checks `redirectTo`, binds the flow to this browser with a cookie
+   * and goes on to the provider (adversarial review I1). The provider sends
+   * the browser back to `redirectTo`, where `getSessionFromUrl()` (run by
+   * `createClient` on its own) finishes the sign-in. No request is made
+   * here: anything that goes wrong comes back in that page's URL.
+   */
+  async signInWithOAuth(options) {
+    const { provider } = options;
+    const failed = (error) => ({
+      data: { provider, url: null },
+      error
+    });
+    if (!OAUTH_PROVIDERS.includes(provider)) return failed(invalidProvider());
+    await this.#flow.recovery.forget();
+    const pair = await createPkcePair();
+    if (!pair) return failed(cryptoUnavailable());
+    await this.#flow.verifiers.add(pair.challenge, pair.verifier);
+    const redirectTo = options.redirectTo ?? currentPage();
+    const url = new URL(
+      `${this.#http.baseUrl}/_naro/v1/auth/authorize/${provider}`
+    );
+    if (redirectTo !== void 0)
+      url.searchParams.set("redirectTo", redirectTo);
+    url.searchParams.set("code_challenge", pair.challenge);
+    const location = currentLocation();
+    if (location && !options.skipBrowserRedirect) location.assign(url.href);
+    return { data: { provider, url: url.href }, error: null };
+  }
+  /**
+   * Trades the one-time code a sign-in redirect brought for the session,
+   * with the verifier this browser kept when it began that flow — `flow` is
+   * the redirect's `naro_flow`; without it, the newest flow's. Most apps
+   * never call it: `getSessionFromUrl()` does.
+   */
+  async exchangeCodeForSession(code, flow) {
+    const signedOut = { session: null, user: null };
+    const verifier = await this.#flow.verifiers.take(flow);
+    if (verifier === null)
+      return { data: signedOut, error: codeVerifierMissing() };
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/exchange-code",
+      body: { code, codeVerifier: verifier },
+      withToken: false,
+      // The page's queries wait on this; they must not wait forever.
+      timeoutMs: EXCHANGE_TIMEOUT_MS
+    });
+    if (result.error !== null) return { data: signedOut, error: result.error };
+    const { body } = result.answer;
+    const token = tokenFrom(result.answer);
+    const user = userFrom(body);
+    if (token === null || user === null || !isRecord(body) || !isRecord(body.session))
+      return { data: signedOut, error: invalidResponse(result.answer.status) };
+    await this.#http.tokens.set(token);
+    await this.#flow.recovery.forget();
+    return { data: { session: body.session, user }, error: null };
+  }
+  /**
+   * Reads what a sign-in redirect left in this page's URL fragment, then
+   * clears it: a provider sign-in or a confirmation link hands over a
+   * session (traded here), a reset link a recovery token (kept for
+   * `updateUser`), and a failure its `code` and `message`. With nothing of
+   * Naro's in the URL, `type` is null — or, after `createClient` already
+   * read it, the answer it got.
+   */
+  getSessionFromUrl() {
+    const fragment = naroFragment();
+    if (fragment === null)
+      return this.#fromUrl ?? Promise.resolve({
+        data: { session: null, user: null, type: null },
+        error: null
+      });
+    clearFragment();
+    const answer = this.#answerOf(fragment);
+    this.#fromUrl = answer;
+    share(this.#flow.shared, answer);
+    return answer;
+  }
+  async #answerOf(fragment) {
+    const named = fragment.naro_type;
+    const type = named && FLOW_TYPES.includes(named) ? named : null;
+    const none = { session: null, user: null, type };
+    if (fragment.naro_error) {
+      if (fragment.naro_flow)
+        await this.#flow.verifiers.take(fragment.naro_flow);
+      return { data: none, error: flowError(type, fragment.naro_error) };
+    }
+    if (type === "recovery" && fragment.naro_token) {
+      await this.#http.tokens.clear();
+      await this.#flow.recovery.keep(fragment.naro_token);
+      return { data: none, error: null };
+    }
+    if (fragment.naro_code) {
+      const traded = await this.exchangeCodeForSession(
+        fragment.naro_code,
+        fragment.naro_flow
+      );
+      return { data: { ...traded.data, type }, error: traded.error };
+    }
+    return { data: none, error: null };
+  }
+  /**
+   * Emails a password reset link, when the address has an account. The
+   * answer is the same either way — it does not say whether it had one.
+   */
+  async resetPasswordForEmail(email, options = {}) {
+    const body = { email };
+    if (options.redirectTo !== void 0) body.redirectTo = options.redirectTo;
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/request-password-reset",
+      body,
+      withToken: false
+    });
+    return { data: null, error: result.error };
+  }
+  /**
+   * Sets a new password in the recovery flow: on the page the reset link
+   * opened, after `getSessionFromUrl()` read its token. Signing in with the
+   * new password comes after — a reset ends every session of the account.
+   * (Changing the password of a signed-in user is not offered: spec §14
+   * "(P1-2 리뷰 반영)".)
+   *
+   * Like supabase-js, it acts on the recovery link's account, which took the
+   * place of any signed-in session when the link was read — so the token is
+   * used only while no session is signed in on this browser, for 15 minutes
+   * after the link was opened, and never after a sign-in, sign-up or
+   * sign-out forgot it (PR #68 review 6). Otherwise PASSWORD_RECOVERY_REQUIRED,
+   * with no request.
+   */
+  async updateUser(attributes) {
+    await this.#pendingUrl();
+    if (await this.#http.tokens.get() !== null)
+      return { data: null, error: passwordRecoveryRequired() };
+    const token = await this.#flow.recovery.current();
+    if (token === null)
+      return { data: null, error: passwordRecoveryRequired() };
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/reset-password",
+      body: { newPassword: attributes.password, token },
+      withToken: false
+    });
+    if (result.error === null || result.error.code === "INVALID_TOKEN")
+      await this.#flow.recovery.forgetIf(token);
+    return { data: null, error: result.error };
+  }
+  /**
+   * Emails the confirmation link again, when the address has an account that
+   * is not confirmed yet. The answer does not say which.
+   */
+  async resendVerification(email, options = {}) {
+    const body = { email };
+    if (options.redirectTo !== void 0) body.callbackURL = options.redirectTo;
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/send-verification-email",
+      body,
+      withToken: false
+    });
+    return { data: null, error: result.error };
+  }
+  /**
+   * Ends the session on the worker and forgets the token. The token is
+   * forgotten even when the worker cannot be reached — the error still comes
+   * back, since the session then lives on until it expires.
+   */
+  async signOut() {
+    await this.#pendingUrl();
+    await this.#flow.recovery.forget();
+    const tokens = this.#http.tokens;
+    const token = await tokens.get();
+    if (token === null) return { data: null, error: null };
+    const result = await call(this.#http, {
+      method: "POST",
+      path: "/auth/sign-out",
+      withToken: true
+    });
+    await tokens.clearIf(result.answer?.token ?? token);
+    return { data: null, error: result.error };
+  }
+  /**
+   * The signed-in session and user. Signed out: both null, no request. A
+   * stored token the worker no longer accepts is forgotten and reported as
+   * INVALID_SESSION once (spec §11.1: a session never quietly turns anon).
+   * Waits for a sign-in the page URL carried, if `createClient` found one.
+   */
+  async getSession() {
+    await this.#pendingUrl();
+    const signedOut = { session: null, user: null };
+    const tokens = this.#http.tokens;
+    if (await tokens.get() === null) return { data: signedOut, error: null };
+    const result = await call(this.#http, {
+      method: "GET",
+      path: "/auth/get-session",
+      withToken: true
+    });
+    if (result.error !== null) return { data: signedOut, error: result.error };
+    const { body, token } = result.answer;
+    if (body === null) {
+      if (token !== null) await tokens.clearIf(token);
+      return { data: signedOut, error: invalidSession() };
+    }
+    const user = userFrom(body);
+    if (!isRecord(body) || !isRecord(body.session) || user === null)
+      return { data: signedOut, error: invalidResponse(result.answer.status) };
+    const renewed = tokenFrom(result.answer);
+    if (renewed !== null && token !== null && renewed !== token)
+      await tokens.replaceIf(token, renewed);
+    return { data: { session: body.session, user }, error: null };
+  }
+  /** `{ data: { user } }`; `user` is null when signed out. */
+  async getUser() {
+    const { data, error } = await this.getSession();
+    return { data: { user: data.user }, error };
+  }
+  /**
+   * Resolves once a sign-in the page URL carried has been traded for its
+   * session (or failed), with its error. Queries wait for it, so the first
+   * one after a provider's redirect goes out signed in rather than as anon.
+   * The exchange gives up after 15 seconds (TIMEOUT, PR #68 review 10):
+   * then the queries go out as anon rather than wait forever.
+   */
+  async ready() {
+    if (!this.#fromUrl) return { error: null };
+    return { error: (await this.#fromUrl).error };
+  }
+  /** Waits for a URL sign-in in flight; its outcome is not this call's. */
+  async #pendingUrl() {
+    if (this.#fromUrl) await this.#fromUrl;
+  }
+  async #signIn(path, body, needsToken) {
+    await this.#flow.recovery.forget();
+    const result = await call(this.#http, {
+      method: "POST",
+      path,
+      body,
+      withToken: false
+    });
+    if (result.error !== null)
+      return { data: { user: null }, error: result.error };
+    const { body: answerBody } = result.answer;
+    const user = userFrom(answerBody);
+    const token = tokenFrom(result.answer);
+    const opened = isRecord(answerBody) && nonEmpty(answerBody.token) !== null;
+    if (user === null || (needsToken || opened) && token === null)
+      return {
+        data: { user: null },
+        error: invalidResponse(result.answer.status)
+      };
+    if (token !== null) await this.#http.tokens.set(token);
+    return { data: { user }, error: null };
+  }
+};
+var FLOW_TTL_MS = 10 * 6e4;
+var MAX_FLOWS = 10;
+function isEntry(value) {
+  return typeof value === "object" && value !== null && typeof value.verifier === "string" && typeof value.expiresAt === "number";
+}
+function live(text, now) {
+  if (text === null) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return {};
+  }
+  if (typeof parsed !== "object" || parsed === null) return {};
+  const entries = {};
+  for (const [flow, entry] of Object.entries(parsed))
+    if (isEntry(entry) && entry.expiresAt > now) entries[flow] = entry;
+  return entries;
+}
+function pick(entries, oldest) {
+  let found;
+  for (const pair of Object.entries(entries))
+    if (found === void 0 || (oldest ? pair[1].expiresAt < found[1].expiresAt : pair[1].expiresAt > found[1].expiresAt))
+      found = pair;
+  return found?.[0];
+}
+function serialize(entries) {
+  return Object.keys(entries).length > 0 ? JSON.stringify(entries) : null;
+}
+var FlowVerifiers = class {
+  #store;
+  #now;
+  constructor(store, now = Date.now) {
+    this.#store = store;
+    this.#now = now;
+  }
+  /** Keeps `verifier` for the flow `flow`, for ten minutes. */
+  async add(flow, verifier) {
+    const now = this.#now();
+    await this.#store.update((text) => {
+      const entries = live(text, now);
+      entries[flow] = { verifier, expiresAt: now + FLOW_TTL_MS };
+      while (Object.keys(entries).length > MAX_FLOWS) {
+        const oldest = pick(entries, true);
+        if (oldest === void 0) break;
+        delete entries[oldest];
+      }
+      return serialize(entries);
+    });
+  }
+  /**
+   * The verifier of `flow`, taken — one flow, one use. Without a flow id
+   * (a code traded by hand), the newest one. Null when there is none, or it
+   * expired.
+   */
+  async take(flow) {
+    const now = this.#now();
+    let taken = null;
+    await this.#store.update((text) => {
+      const entries = live(text, now);
+      const id = flow ?? pick(entries, false);
+      if (id !== void 0 && Object.hasOwn(entries, id)) {
+        taken = entries[id]?.verifier ?? null;
+        delete entries[id];
+      }
+      return serialize(entries);
+    });
+    return taken;
+  }
+};
+var RECOVERY_TTL_MS = 15 * 6e4;
+function parse(text) {
+  if (text === null) return null;
+  try {
+    const value = JSON.parse(text);
+    if (typeof value === "object" && value !== null && typeof value.token === "string" && value.token !== "" && typeof value.expiresAt === "number")
+      return value;
+  } catch {
+  }
+  return null;
+}
+var RecoveryToken = class {
+  #store;
+  #now;
+  constructor(store, now = () => Date.now()) {
+    this.#store = store;
+    this.#now = now;
+  }
+  /** Keeps the token a recovery link brought, for 15 minutes. */
+  async keep(token) {
+    const kept = { token, expiresAt: this.#now() + RECOVERY_TTL_MS };
+    await this.#store.set(JSON.stringify(kept));
+  }
+  /** The token, while it lasts; an expired or unreadable one is cleared. */
+  async current() {
+    const now = this.#now();
+    let token = null;
+    await this.#store.update((text) => {
+      const kept = parse(text);
+      if (kept === null || kept.expiresAt <= now) return null;
+      token = kept.token;
+      return text;
+    });
+    return token;
+  }
+  /** Forgets it: a sign-in, a sign-up, a sign-out. */
+  async forget() {
+    await this.#store.clear();
+  }
+  /** Forgets it if it is still `token` — used, or refused as used. */
+  async forgetIf(token) {
+    await this.#store.update(
+      (text) => parse(text)?.token === token ? null : text
+    );
+  }
+};
+function memoryStorage() {
+  const items22 = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => items22.get(key) ?? null,
+    setItem: (key, value) => {
+      items22.set(key, value);
+    },
+    removeItem: (key) => {
+      items22.delete(key);
+    }
+  };
+}
+function defaultStorage() {
+  if (!isBrowser()) return memoryStorage();
+  try {
+    const storage = globalThis.localStorage;
+    if (storage === void 0 || storage === null) return memoryStorage();
+    const probe = "naro-storage-probe";
+    storage.setItem(probe, probe);
+    storage.removeItem(probe);
+    return storage;
+  } catch {
+    return memoryStorage();
+  }
+}
+function storageKey(baseUrl) {
+  return `naro-auth-token:${baseUrl}`;
+}
+function verifierKey(baseUrl) {
+  return `naro-auth-code-verifiers:${baseUrl}`;
+}
+function recoveryKey(baseUrl) {
+  return `naro-auth-recovery:${baseUrl}`;
+}
+var TokenStore = class {
+  #storage;
+  #key;
+  #fallback = null;
+  /** Settles when the last queued operation has finished. */
+  #queue = Promise.resolve();
+  constructor(storage, key) {
+    this.#storage = storage;
+    this.#key = key;
+  }
+  get() {
+    return this.#serial(() => this.#get());
+  }
+  set(token) {
+    return this.#serial(() => this.#set(token));
+  }
+  clear() {
+    return this.#serial(() => this.#clear());
+  }
+  /**
+   * Clears only if the stored token is still the one that was rejected. A
+   * request that left with an old token can come back after the user signed
+   * in again; its INVALID_SESSION must not sign the new session out. The
+   * read and the removal are one operation: with an async storage, a sign-in
+   * that lands between them would otherwise be the token removed.
+   */
+  clearIf(token) {
+    return this.#serial(async () => {
+      if (await this.#get() === token) await this.#clear();
+    });
+  }
+  /**
+   * Reads the value, hands it to `transform` and stores what that returns
+   * (null clears it), as one operation — the per-flow verifiers
+   * (`flows.ts`) change one entry of a JSON object this way.
+   */
+  update(transform) {
+    return this.#serial(async () => {
+      const next = transform(await this.#get());
+      if (next === null) await this.#clear();
+      else await this.#set(next);
+    });
+  }
+  /** Stores `next` only if `expected` is still stored, as one operation. */
+  replaceIf(expected, next) {
+    return this.#serial(async () => {
+      if (await this.#get() === expected) await this.#set(next);
+    });
+  }
+  /**
+   * Runs `operation` once every earlier one has finished. The operations
+   * below never reject, and none of them calls a public method (that would
+   * wait on itself).
+   */
+  #serial(operation) {
+    const result = this.#queue.then(operation);
+    this.#queue = result.catch(() => void 0);
+    return result;
+  }
+  async #get() {
+    if (this.#fallback) return this.#fallback.token;
+    try {
+      const token = await this.#storage.getItem(this.#key);
+      return typeof token === "string" && token !== "" ? token : null;
+    } catch {
+      await this.#fallBack(null, true);
+      return null;
+    }
+  }
+  async #set(token) {
+    if (this.#fallback) {
+      this.#fallback.token = token;
+      return;
+    }
+    try {
+      await this.#storage.setItem(this.#key, token);
+    } catch {
+      await this.#fallBack(token, true);
+    }
+  }
+  async #clear() {
+    if (this.#fallback) {
+      this.#fallback.token = null;
+      return;
+    }
+    try {
+      await this.#storage.removeItem(this.#key);
+    } catch {
+      await this.#fallBack(null, false);
+    }
+  }
+  /**
+   * Stops using the storage, keeping `token` in memory. The token the storage
+   * still holds is removed once, if it lets us: left there it comes back on
+   * the next load — after a sign-out that could not read it, or over a
+   * sign-in whose write failed (the previous user's session).
+   */
+  async #fallBack(token, removeStored) {
+    this.#fallback = { token };
+    if (!removeStored) return;
+    try {
+      await this.#storage.removeItem(this.#key);
+    } catch {
+    }
+  }
+};
+function isSpace2(char) {
+  return char.trim() === "";
+}
+function tokenize(input) {
+  const tokens = [];
+  let index = 0;
+  const at = () => input[index] ?? "";
+  for (; ; ) {
+    while (index < input.length && isSpace2(at())) index++;
+    let token;
+    if (at() === '"') {
+      index++;
+      let name = "";
+      for (; ; ) {
+        if (index >= input.length)
+          return `has an unclosed quote in column ${String(tokens.length + 1)}`;
+        const char = at();
+        index++;
+        if (char !== '"') name += char;
+        else if (at() === '"') {
+          name += '"';
+          index++;
+        } else break;
+      }
+      while (index < input.length && isSpace2(at())) index++;
+      if (index < input.length && at() !== ",")
+        return `has text after the closing quote of column ${String(tokens.length + 1)}`;
+      token = { name, quoted: true };
+    } else {
+      let name = "";
+      while (index < input.length && at() !== ",") {
+        if (at() === '"')
+          return `has a quote inside column ${String(tokens.length + 1)}; quote the whole name`;
+        name += at();
+        index++;
+      }
+      token = { name: name.trim(), quoted: false };
+    }
+    tokens.push(token);
+    if (index >= input.length) return tokens;
+    index++;
+  }
+}
+function parseColumns(input) {
+  if (input === void 0) return { ok: true, columns: "*" };
+  if (typeof input !== "string")
+    return { ok: false, reason: "must be a string of column names" };
+  const tokens = tokenize(input);
+  if (typeof tokens === "string") return { ok: false, reason: tokens };
+  const star = tokens.findIndex((token) => !token.quoted && token.name === "*");
+  if (star >= 0) {
+    if (tokens.length === 1) return { ok: true, columns: "*" };
+    return { ok: false, reason: '"*" cannot be combined with column names' };
+  }
+  const empty = tokens.findIndex((token) => token.name === "");
+  if (empty >= 0)
+    return {
+      ok: false,
+      reason: tokens.length === 1 ? "must name at least one column" : `has an empty column name at position ${String(empty + 1)}`
+    };
+  return { ok: true, columns: tokens.map((token) => token.name) };
+}
+var MAX_FILTER_DEPTH2 = 4;
+var OPERATORS2 = {
+  eq: "eq",
+  neq: "neq",
+  gt: "gt",
+  gte: "gte",
+  lt: "lt",
+  lte: "lte",
+  in: "in",
+  is: "is",
+  like: "like",
+  ilike: "ilike",
+  contains: "contains",
+  containedBy: "containedBy",
+  overlaps: "overlaps",
+  cs: "contains",
+  cd: "containedBy",
+  ov: "overlaps"
+};
+function operatorOf2(name) {
+  return typeof name === "string" && Object.hasOwn(OPERATORS2, name) ? OPERATORS2[name] : void 0;
+}
+var Refusal2 = class extends Error {
+};
+function refuse3(reason) {
+  throw new Refusal2(reason);
+}
+var LIST_HINT2 = {
+  in: ["(", ")", "needs a list in parentheses, like in.(a,b),"],
+  array: ["{", "}", "needs a list in braces, like cs.{a,b},"]
+};
+function isSpace22(char) {
+  return char !== "" && char.trim() === "";
+}
+function looseWord2(text) {
+  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "");
+}
+var Parser2 = class {
+  constructor(text, tokens = {}) {
+    this.text = text;
+    this.tokens = tokens;
+  }
+  index = 0;
+  /**
+   * A token at the next value, followed only by spaces and then one of
+   * `stops` or the end — `auth.uid()x` is text, not the token.
+   */
+  token(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    for (const [word, value] of Object.entries(this.tokens)) {
+      if (!this.text.startsWith(word, at)) continue;
+      let end = at + word.length;
+      while (isSpace22(this.text[end] ?? "")) end++;
+      const next = this.text[end] ?? "";
+      if (next !== "" && !stops.includes(next)) continue;
+      this.index = end;
+      return { value, word, at };
+    }
+    return void 0;
+  }
+  at() {
+    return this.text[this.index] ?? "";
+  }
+  /**
+   * An unquoted value that is one of the tokens misspelled — `auth.uid`,
+   * `AUTH.UID` — is refused: read as text it would compare with the words
+   * themselves (사용자 리뷰 반영). Quoted, it is the text.
+   */
+  notNearToken(value, at) {
+    const loose = looseWord2(value);
+    for (const word of Object.keys(this.tokens))
+      if (loose !== "" && loose === looseWord2(word))
+        refuse3(
+          `has ${JSON.stringify(value)} ${this.where(at)}: did you mean ${word}? Quote it to mean the text`
+        );
+  }
+  /** `scalar`, with an unquoted value held to notNearToken. */
+  bareOrQuoted(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    const quoted = this.at() === '"';
+    const text = this.scalar(stops);
+    if (!quoted) this.notNearToken(text, at);
+    return { text, quoted };
+  }
+  where(index = this.index) {
+    return `at character ${String(index + 1)}`;
+  }
+  skipSpaces() {
+    while (isSpace22(this.at())) this.index++;
+  }
+  /** `item ("," item)*`, up to a `)` or the end, inside `level` groups. */
+  list(level) {
+    const nodes = [];
+    for (; ; ) {
+      nodes.push(this.item(level));
+      this.skipSpaces();
+      const char = this.at();
+      if (char === ",") this.index++;
+      else if (char === ")" || char === "") return nodes;
+      else refuse3(`has unexpected text ${this.where()}`);
+    }
+  }
+  item(level) {
+    this.skipSpaces();
+    const start = this.index;
+    const char = this.at();
+    if (char === "" || char === "," || char === ")")
+      refuse3(`has an empty item ${this.where()}`);
+    const group = /^(not\.)?(and|or)\(/.exec(this.text.slice(start));
+    if (!group) return this.leaf(level);
+    const negated = group[1] !== void 0;
+    const inner = level + (negated ? 2 : 1);
+    if (inner > MAX_FILTER_DEPTH2)
+      refuse3(`nests deeper than ${String(MAX_FILTER_DEPTH2)} groups`);
+    const open = start + group[0].length - 1;
+    this.index = open + 1;
+    const children = this.list(inner);
+    if (this.at() !== ")") refuse3(`has an unclosed "(" ${this.where(open)}`);
+    this.index++;
+    const node = group[2] === "or" ? { or: children } : { and: children };
+    return negated ? { not: node } : node;
+  }
+  /** `column.[not.]operator.value`. */
+  leaf(level) {
+    const start = this.index;
+    const column = this.at() === '"' ? this.quoted() : this.word().trim();
+    if (column === "" || this.at() !== ".")
+      refuse3(`needs column.operator.value ${this.where(start)}`);
+    this.index++;
+    let nameAt = this.index;
+    let name = this.word();
+    let negated = false;
+    if (name === "not" && this.at() === ".") {
+      if (level + 1 > MAX_FILTER_DEPTH2)
+        refuse3(`nests deeper than ${String(MAX_FILTER_DEPTH2)} groups`);
+      negated = true;
+      this.index++;
+      nameAt = this.index;
+      name = this.word();
+    }
+    const operator = operatorOf2(name);
+    if (this.at() !== ".") {
+      if (name !== "" && operator === void 0)
+        refuse3(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+      refuse3(`needs column.operator.value ${this.where(start)}`);
+    }
+    if (operator === void 0)
+      refuse3(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+    this.index++;
+    const leaf = { operator, column, value: this.value(operator) };
+    return negated ? { not: leaf } : leaf;
+  }
+  /** Up to the next `.`, `,`, `(`, `)` or the end. */
+  word() {
+    const start = this.index;
+    while (this.index < this.text.length && !".,()".includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index);
+  }
+  /** `"…"`, with `\` making the next character literal. */
+  quoted() {
+    const start = this.index;
+    this.index++;
+    let text = "";
+    for (; ; ) {
+      if (this.index >= this.text.length)
+        refuse3(`has an unclosed quote ${this.where(start)}`);
+      const char = this.at();
+      this.index++;
+      if (char === '"') return text;
+      if (char === "\\" && this.index < this.text.length) {
+        text += this.at();
+        this.index++;
+      } else text += char;
+    }
+  }
+  /** A quoted value, or everything up to `stops`, trimmed. */
+  scalar(stops) {
+    this.skipSpaces();
+    if (this.at() === '"') {
+      const text = this.quoted();
+      this.skipSpaces();
+      if (this.at() !== "" && !stops.includes(this.at()))
+        refuse3(`has text after a closing quote ${this.where()}`);
+      return text;
+    }
+    const start = this.index;
+    while (this.index < this.text.length && !stops.includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index).trim();
+  }
+  /**
+   * `(a,b)` for `in`: text values, except that an unquoted `true` or `false`
+   * is a boolean (사용자 리뷰 반영, as in `eq`). `{a,b}` for the array
+   * operators: text, except that an unquoted exact decimal is a number
+   * (적대적 리뷰 반영, narrowed by 사용자 리뷰 반영) — json_each's values
+   * have no type affinity to turn the text "1" into 1, so as text `cs.{1}`
+   * matched no numeric array and `not.ov.{1}` matched every row. Quoted,
+   * `"1"` and `"true"` stay text.
+   */
+  listValue(kind) {
+    const [open, close, hint] = LIST_HINT2[kind];
+    this.skipSpaces();
+    const openAt = this.index;
+    if (this.at() !== open) refuse3(`${hint} ${this.where()}`);
+    this.index++;
+    this.skipSpaces();
+    const values = [];
+    if (this.at() === close) {
+      this.index++;
+      return values;
+    }
+    for (; ; ) {
+      this.skipSpaces();
+      const itemAt = this.index;
+      const token = this.token(`,${close}`);
+      if (token) values.push(token.value);
+      else {
+        const { text: value, quoted } = this.bareOrQuoted(`,${close}`);
+        if (!quoted && value === "") {
+          if (this.index >= this.text.length)
+            refuse3(`has an unclosed "${open}" ${this.where(openAt)}`);
+          refuse3(`has an empty item ${this.where(itemAt)}`);
+        }
+        values.push(
+          quoted ? value : kind === "array" ? exactNumber2(value) : truth2(value)
+        );
+      }
+      if (this.index >= this.text.length)
+        refuse3(`has an unclosed "${open}" ${this.where(openAt)}`);
+      const char = this.at();
+      this.index++;
+      if (char === close) return values;
+    }
+  }
+  /** The value after `operator.`. */
+  value(operator) {
+    const start = this.index;
+    switch (operator) {
+      case "in":
+        return this.listValue("in");
+      case "contains":
+      case "containedBy":
+      case "overlaps":
+        return this.listValue("array");
+      case "is":
+        return keyword2(this.scalar(",)"), start);
+      case "like":
+      case "ilike": {
+        const token = this.token(",)");
+        if (token)
+          refuse3(
+            `cannot use ${token.word} with ${operator} ${this.where(token.at)}`
+          );
+        return likePattern2(this.bareOrQuoted(",)").text);
+      }
+      case "eq":
+      case "neq": {
+        const token = this.token(",)");
+        if (token) return token.value;
+        const { text, quoted } = this.bareOrQuoted(",)");
+        return quoted ? text : truth2(text);
+      }
+      default: {
+        const token = this.token(",)");
+        return token ? token.value : this.bareOrQuoted(",)").text;
+      }
+    }
+  }
+};
+function likePattern2(pattern) {
+  return pattern.replaceAll("*", "%");
+}
+function truth2(text) {
+  const word = text.toLowerCase();
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return text;
+}
+var DECIMAL3 = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+function exactNumber2(text) {
+  if (!DECIMAL3.test(text)) return text;
+  const number = Number(text);
+  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
+  const trimmed = text.replace(/\.?0+$/, "");
+  return String(number) === trimmed ? number : text;
+}
+function keyword2(text, at) {
+  const word = text.toLowerCase();
+  if (word === "null") return null;
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return refuse3(
+    `needs null, true or false after is at character ${String(at + 1)}`
+  );
+}
+function attempt2(parse2) {
+  try {
+    return { ok: true, node: parse2() };
+  } catch (error) {
+    if (error instanceof Refusal2) return { ok: false, reason: error.message };
+    throw error;
+  }
+}
+function parseLogic2(text, kind, options = {}) {
+  if (typeof text !== "string")
+    return { ok: false, reason: "must be a filter string or a function" };
+  if (text.trim() === "") return { ok: false, reason: "must not be empty" };
+  return attempt2(() => {
+    if (options.group === false) {
+      const alone = items2(text, options.tokens, 0);
+      if (alone.length === 1 && alone[0]) return alone[0];
+    }
+    const nodes = items2(text, options.tokens, 1);
+    return kind === "or" ? { or: nodes } : { and: nodes };
+  });
+}
+function items2(text, tokens, level) {
+  const parser = new Parser2(text, tokens);
+  const nodes = parser.list(level);
+  if (parser.at() === ")") refuse3(`has an unmatched ")" ${parser.where()}`);
+  return nodes;
+}
+function conditionOf(column, name, value) {
+  const operator = operatorOf2(name);
+  if (operator === void 0)
+    return { ok: false, reason: `has an unknown operator "${String(name)}"` };
+  if (typeof value !== "string")
+    return {
+      ok: true,
+      node: {
+        operator,
+        column,
+        value: Array.isArray(value) ? [...value] : value
+      }
+    };
+  return attempt2(() => {
+    const parser = new Parser2(value);
+    let parsed = value;
+    if (["in", "contains", "containedBy", "overlaps", "is"].includes(operator)) {
+      parsed = parser.value(operator);
+      parser.skipSpaces();
+      if (parser.at() !== "") refuse3(`has unexpected text ${parser.where()}`);
+    } else if (operator === "like" || operator === "ilike")
+      parsed = likePattern2(value);
+    else if (operator === "eq" || operator === "neq") parsed = truth2(value);
+    return { operator, column, value: parsed };
+  });
+}
+function patternOf(pattern) {
+  return typeof pattern === "string" ? likePattern2(pattern) : pattern;
+}
+var MAX_LIMIT = 1e3;
+var CAP = `one select reads at most ${String(MAX_LIMIT)} rows, by limit() or range()`;
+function initialState(table2) {
+  return { table: table2, problem: null, filters: [], columns: "*", order: [] };
+}
+function copyRow(row) {
+  return { ...row };
+}
+var Builder = class {
+  run;
+  state;
+  constructor(run, state) {
+    this.run = run;
+    this.state = state;
+  }
+  /** A new builder of the same kind with `patch` applied. */
+  next(patch) {
+    const Next = this.constructor;
+    return new Next(this.run, { ...this.state, ...patch });
+  }
+  fail(path, reason) {
+    return this.failWith(invalidQuery(path, reason));
+  }
+  /** Keeps the first problem: it is the one the user has to fix first. */
+  failWith(problem) {
+    if (this.state.problem !== null) return this;
+    return this.next({ problem });
+  }
+  /**
+   * Runs the query. Every `await` sends a new request with the same AST.
+   * Never rejects: failures resolve as `{ data: null, error }`.
+   */
+  // oxlint-disable-next-line unicorn/no-thenable -- awaitable builders are the API (spec §15)
+  then(onfulfilled, onrejected) {
+    return this.execute().then(onfulfilled, onrejected);
+  }
+  async execute() {
+    if (this.state.problem !== null)
+      return { data: null, error: this.state.problem };
+    return await this.run(this.build());
+  }
+  /** A mutation's `.select()`: RETURNING these columns. */
+  withReturning(columns) {
+    const parsed = parseColumns(columns);
+    if (!parsed.ok) return this.fail("returning", parsed.reason);
+    return this.next({ returning: parsed.columns });
+  }
+};
+function copyList(values) {
+  return Array.isArray(values) ? [...values] : values;
+}
+var FilterBuilder = class _FilterBuilder extends Builder {
+  /** One more entry in the top-level list, which is an AND. */
+  add(node) {
+    return this.next({ filters: [...this.state.filters, node] });
+  }
+  condition(operator, column, value) {
+    return this.add({ operator, column, value });
+  }
+  eq(column, value) {
+    return this.condition("eq", column, value);
+  }
+  neq(column, value) {
+    return this.condition("neq", column, value);
+  }
+  gt(column, value) {
+    return this.condition("gt", column, value);
+  }
+  gte(column, value) {
+    return this.condition("gte", column, value);
+  }
+  lt(column, value) {
+    return this.condition("lt", column, value);
+  }
+  lte(column, value) {
+    return this.condition("lte", column, value);
+  }
+  /** An empty list matches nothing. */
+  in(column, values) {
+    return this.condition("in", column, copyList(values));
+  }
+  /** `IS NULL`, `IS TRUE` or `IS FALSE` — any non-zero number is true, NULL neither. */
+  is(column, value) {
+    return this.condition("is", column, value);
+  }
+  /**
+   * Case-sensitive, `%` and `_` as in SQL; `*` is `%` too, as in PostgREST,
+   * so a literal `*` cannot be matched.
+   */
+  like(column, pattern) {
+    return this.condition("like", column, patternOf(pattern));
+  }
+  /** Case-insensitive for ASCII letters; `%`, `_` and `*` as in `like`. */
+  ilike(column, pattern) {
+    return this.condition("ilike", column, patternOf(pattern));
+  }
+  /**
+   * The column — TEXT holding a JSON array — has every one of the values.
+   * A row that is not a JSON array is no match; NULL is neither.
+   */
+  contains(column, values) {
+    return this.condition("contains", column, copyList(values));
+  }
+  /** Every element of the column's JSON array is one of the values (`[]` is). */
+  containedBy(column, values) {
+    return this.condition("containedBy", column, copyList(values));
+  }
+  /** The column's JSON array has at least one of the values. */
+  overlaps(column, values) {
+    return this.condition("overlaps", column, copyList(values));
+  }
+  /** An `eq` for each key, in key order. */
+  match(query) {
+    const conditions = Object.entries(query).map(
+      ([column, value]) => ({
+        operator: "eq",
+        column,
+        value
+      })
+    );
+    return this.next({ filters: [...this.state.filters, ...conditions] });
+  }
+  /**
+   * Any operator by name, Supabase's escape hatch: `filter("id", "in",
+   * "(1,2)")`, `filter("tags", "cs", "{a}")`, `filter("n", "not.gte", 10)`.
+   * A string value is PostgREST syntax where the operator needs one, and text
+   * otherwise.
+   */
+  filter(column, operator, value) {
+    const name = operator;
+    const negated = typeof name === "string" && name.startsWith("not.");
+    const parsed = conditionOf(
+      column,
+      negated ? name.slice(4) : name,
+      value
+    );
+    if (!parsed.ok) return this.fail("filter", parsed.reason);
+    return this.add(negated ? { not: parsed.node } : parsed.node);
+  }
+  not(target, operator, value) {
+    if (typeof target === "function") {
+      const nodes = this.group("not", target);
+      if (!Array.isArray(nodes)) return this.failWith(nodes);
+      const [only] = nodes;
+      return this.add({
+        not: nodes.length === 1 && only ? only : { and: nodes }
+      });
+    }
+    const parsed = conditionOf(target, operator, value);
+    if (!parsed.ok) return this.fail("not", parsed.reason);
+    return this.add({ not: parsed.node });
+  }
+  /**
+   * Rows matching at least one of the conditions: a callback,
+   * `or((q) => q.eq("status", "draft").lt("price", 10))`, or Supabase's
+   * string, `or("status.eq.draft,price.lt.10")`, whose values are text.
+   */
+  or(filters) {
+    return this.logic("or", filters);
+  }
+  /** Rows matching all of the conditions, as a group: for use inside `or`. */
+  and(filters) {
+    return this.logic("and", filters);
+  }
+  logic(kind, filters) {
+    if (typeof filters === "function") {
+      const nodes = this.group(kind, filters);
+      if (!Array.isArray(nodes)) return this.failWith(nodes);
+      return this.add(kind === "or" ? { or: nodes } : { and: nodes });
+    }
+    const parsed = parseLogic2(filters, kind);
+    if (!parsed.ok) return this.fail(kind, parsed.reason);
+    return this.add(parsed.node);
+  }
+  /**
+   * The conditions `build` adds, or why there are none to use. `build` gets
+   * a builder of this kind with no filters; FilterGroup shows only its filter
+   * methods, and only its conditions and first problem are read back.
+   */
+  group(path, build) {
+    const built = build(this.next({ filters: [], problem: null }));
+    if (!(built instanceof _FilterBuilder))
+      return invalidQuery(path, "must return the filter builder it was given");
+    const { filters, problem } = built.state;
+    if (problem !== null) return problem;
+    if (filters.length === 0) return invalidQuery(path, "must not be empty");
+    return [...filters];
+  }
+  filtersPart() {
+    return this.state.filters.length === 0 ? {} : { filters: [...this.state.filters] };
+  }
+};
+var SelectBuilder = class extends FilterBuilder {
+  /** Call again to sort by more columns, in call order. */
+  order(column, options = {}) {
+    const term = { column, ascending: options.ascending ?? true };
+    if (options.nullsFirst !== void 0) term.nullsFirst = options.nullsFirst;
+    return this.next({ order: [...this.state.order, term] });
+  }
+  /** At most `count` rows (1–1,000; a select without one reads up to 1,000). */
+  limit(count2) {
+    if (!Number.isSafeInteger(count2) || count2 < 1 || count2 > MAX_LIMIT)
+      return this.fail(
+        "limit",
+        `must be an integer from 1 to ${String(MAX_LIMIT)}; ${CAP}`
+      );
+    return this.next({ limit: count2 });
+  }
+  offset(count2) {
+    return this.next({ offset: count2 });
+  }
+  /**
+   * Rows `from` to `to`, both inclusive and counted from 0 — at most 1,000
+   * of them. Sent as `offset` and `limit`, so it is checked here: past the
+   * cap the worker would name `limit`, which the app never called.
+   */
+  range(from, to) {
+    if (!Number.isSafeInteger(from) || !Number.isSafeInteger(to) || from < 0 || to < from)
+      return this.fail("range", "must be two integers with 0 <= from <= to");
+    const rows = to - from + 1;
+    if (rows > MAX_LIMIT)
+      return this.fail(
+        "range",
+        `spans ${String(rows)} rows (to - from + 1); ${CAP}`
+      );
+    return this.next({ offset: from, limit: rows });
+  }
+  /** Exactly one row, or NOT_SINGLE_ROW. */
+  single() {
+    return this.next({ single: "one" });
+  }
+  /** One row or null; more than one is NOT_SINGLE_ROW. */
+  maybeSingle() {
+    return this.next({ single: "maybe" });
+  }
+  build() {
+    const { table: table2, columns, order, limit, offset, single } = this.state;
+    return {
+      version: 1,
+      action: "select",
+      table: table2,
+      columns: columns === "*" ? "*" : [...columns],
+      ...this.filtersPart(),
+      ...order.length === 0 ? {} : { order: order.map((term) => ({ ...term })) },
+      ...limit === void 0 ? {} : { limit },
+      ...offset === void 0 ? {} : { offset },
+      ...single === void 0 ? {} : { single }
+    };
+  }
+};
+var InsertBuilder = class extends Builder {
+  /** Return the inserted rows (all columns, or the ones named). */
+  select(columns) {
+    return this.withReturning(columns);
+  }
+  build() {
+    const { table: table2, rows = [], returning } = this.state;
+    return {
+      version: 1,
+      action: "insert",
+      table: table2,
+      rows: rows.map(copyRow),
+      ...returning === void 0 ? {} : { returning }
+    };
+  }
+};
+var MutationBuilder = class extends FilterBuilder {
+  /** Return the changed rows (all columns, or the ones named). */
+  select(columns) {
+    return this.withReturning(columns);
+  }
+  /** Apply to every row with no filter at all. Service key only. */
+  all() {
+    return this.next({ allowUnfiltered: true });
+  }
+  build() {
+    const {
+      table: table2,
+      action,
+      values = {},
+      returning,
+      allowUnfiltered
+    } = this.state;
+    const tail = {
+      ...this.filtersPart(),
+      ...returning === void 0 ? {} : { returning },
+      ...allowUnfiltered === void 0 ? {} : { allowUnfiltered }
+    };
+    return action === "delete" ? { version: 1, action: "delete", table: table2, ...tail } : {
+      version: 1,
+      action: "update",
+      table: table2,
+      values: copyRow(values),
+      ...tail
+    };
+  }
+};
+var TableBuilder = class {
+  #run;
+  #table;
+  constructor(run, table2) {
+    this.#run = run;
+    this.#table = table2;
+  }
+  /** `"*"` (the default) or `"id, title"`. */
+  select(columns) {
+    const state = initialState(this.#table);
+    const parsed = parseColumns(columns);
+    return new SelectBuilder(
+      this.#run,
+      parsed.ok ? { ...state, columns: parsed.columns } : { ...state, problem: invalidQuery("columns", parsed.reason) }
+    );
+  }
+  /** One row or several; one request, one transaction. */
+  insert(rows) {
+    const list = Array.isArray(rows) ? rows : [rows];
+    return new InsertBuilder(this.#run, {
+      ...initialState(this.#table),
+      rows: list.map(copyRow)
+    });
+  }
+  update(values) {
+    return new MutationBuilder(this.#run, {
+      ...initialState(this.#table),
+      action: "update",
+      values: copyRow(values)
+    });
+  }
+  delete() {
+    return new MutationBuilder(this.#run, {
+      ...initialState(this.#table),
+      action: "delete"
+    });
+  }
+};
+var MAX_SINGLE_UPLOAD_BYTES2 = 52428800;
+var STORAGE_MESSAGES = {
+  bucket: "The bucket name is not valid.",
+  tooLarge: "Uploads over 50 MiB are not supported yet.",
+  request: "The storage request is not valid.",
+  body: "upload takes a Blob, File, ArrayBuffer, typed array or string."
+};
+var RESERVED_BUCKETS = /* @__PURE__ */ new Set([
+  "authenticated",
+  "copy",
+  "info",
+  "list",
+  "move",
+  "public",
+  "render",
+  "sign",
+  "upload"
+]);
+var DOWNLOAD_NAME_REASON = "must be a file name of up to 255 bytes";
+var LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var OCTET_STREAM = "application/octet-stream";
+var UTF8_TEXT = "text/plain;charset=utf-8";
+function invalidPath(reason) {
+  return {
+    code: "INVALID_PATH",
+    message: `The object path is not valid: it ${reason}.`
+  };
+}
+function objectTooLarge() {
+  return { code: "OBJECT_TOO_LARGE", message: STORAGE_MESSAGES.tooLarge };
+}
+function encodePath(path) {
+  if (typeof path !== "string" || path === "")
+    return { ok: false, error: invalidPath("is empty") };
+  if (LONE_SURROGATE.test(path))
+    return { ok: false, error: invalidPath("is not valid UTF-8") };
+  if (path.startsWith("/") || path.endsWith("/"))
+    return { ok: false, error: invalidPath("starts or ends with /") };
+  if (path.includes("//"))
+    return { ok: false, error: invalidPath("has an empty segment (//)") };
+  const segments2 = path.split("/");
+  if (segments2.some((segment) => segment === "." || segment === ".."))
+    return { ok: false, error: invalidPath("has a . or .. segment") };
+  return { ok: true, encoded: segments2.map(encodeURIComponent).join("/") };
+}
+function downloadQuery(download2) {
+  if (download2 === true) return { ok: true, encoded: "?download" };
+  if (typeof download2 !== "string") return { ok: true, encoded: "" };
+  if (LONE_SURROGATE.test(download2))
+    return {
+      ok: false,
+      error: {
+        code: "INVALID_REQUEST",
+        message: STORAGE_MESSAGES.request,
+        details: { path: "download", reason: DOWNLOAD_NAME_REASON }
+      }
+    };
+  return { ok: true, encoded: `?download=${encodeURIComponent(download2)}` };
+}
+function encodeBucket(bucket) {
+  if (typeof bucket !== "string" || bucket === "" || bucket === "." || bucket === ".." || LONE_SURROGATE.test(bucket) || RESERVED_BUCKETS.has(bucket))
+    return {
+      ok: false,
+      error: { code: "INVALID_PATH", message: STORAGE_MESSAGES.bucket }
+    };
+  return { ok: true, encoded: encodeURIComponent(bucket) };
+}
+var isArrayBuffer = (value) => Object.prototype.toString.call(value) === "[object ArrayBuffer]";
+function isDetached(buffer) {
+  if (!isArrayBuffer(buffer)) return false;
+  const flag = buffer.detached;
+  if (typeof flag === "boolean") return flag;
+  if (buffer.byteLength > 0) return false;
+  try {
+    buffer.slice(0);
+    return false;
+  } catch {
+    return true;
+  }
+}
+var CACHE_CONTROL_REASON = "must be max-age=<seconds> from 0 to 31536000";
+var MAX_TYPE_IN_MESSAGE = 256;
+function unsendable(value) {
+  return /[\0\r\n]|[^\0-\xff]/.test(
+    value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "")
+  );
+}
+function headerProblem(contentType, cacheControl) {
+  if (typeof contentType === "string" && unsendable(contentType)) {
+    let shown = contentType;
+    if (shown.length > MAX_TYPE_IN_MESSAGE) {
+      shown = shown.slice(0, MAX_TYPE_IN_MESSAGE);
+      if (/[\ud800-\udbff]$/.test(shown)) shown = shown.slice(0, -1);
+    }
+    return {
+      code: "INVALID_CONTENT_TYPE",
+      message: `Content-Type ${shown} is not a media type like image/png.`
+    };
+  }
+  if (unsendable(cacheControl))
+    return {
+      code: "INVALID_REQUEST",
+      message: STORAGE_MESSAGES.request,
+      details: { path: "cache-control", reason: CACHE_CONTROL_REASON }
+    };
+  return null;
+}
+function payloadOf(body, contentType) {
+  if (typeof body === "string") {
+    const bytes = new TextEncoder().encode(body);
+    return {
+      ok: true,
+      body: bytes,
+      size: bytes.byteLength,
+      type: contentType ?? UTF8_TEXT
+    };
+  }
+  if (typeof Blob === "function" && body instanceof Blob)
+    return {
+      ok: true,
+      body,
+      size: body.size,
+      type: contentType ?? (body.type === "" ? OCTET_STREAM : body.type)
+    };
+  if (isArrayBuffer(body) && !isDetached(body))
+    return {
+      ok: true,
+      body,
+      size: body.byteLength,
+      type: contentType ?? OCTET_STREAM
+    };
+  if (ArrayBuffer.isView(body) && !isDetached(body.buffer)) {
+    const { buffer, byteOffset, byteLength } = body;
+    const bytes = isArrayBuffer(buffer) ? new Uint8Array(buffer, byteOffset, byteLength) : Uint8Array.from(new Uint8Array(buffer, byteOffset, byteLength));
+    return {
+      ok: true,
+      body: bytes,
+      size: byteLength,
+      type: contentType ?? OCTET_STREAM
+    };
+  }
+  return {
+    ok: false,
+    error: { code: "INVALID_BODY", message: STORAGE_MESSAGES.body }
+  };
+}
+var SIGNED_PREFIX = "/_naro/v1/storage/object/sign/";
+function fail(error) {
+  return { data: null, error };
+}
+var isUploadResult = (value) => isRecord(value) && typeof value.id === "string" && typeof value.path === "string" && typeof value.fullPath === "string";
+var isFileObject = (value) => isRecord(value) && typeof value.id === "string" && typeof value.name === "string" && isRecord(value.metadata);
+var isEntry2 = (value) => isRecord(value) && typeof value.name === "string" && (value.id === null || isFileObject(value));
+var isSigned = (value) => isRecord(value) && typeof value.signedUrl === "string" && value.signedUrl.startsWith(SIGNED_PREFIX);
+function listOf(guard) {
+  return (value) => Array.isArray(value) && value.every(guard);
+}
+function dataOf2(status, body, guard) {
+  if (isRecord(body) && Object.hasOwn(body, "data") && guard(body.data))
+    return { data: body.data, error: null };
+  return fail(invalidResponse(status));
+}
+async function readJson(response, guard) {
+  let text;
+  try {
+    text = await response.text();
+  } catch (error) {
+    return fail(networkError(error));
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    return fail(invalidResponse(response.status));
+  }
+  return dataOf2(response.status, body, guard);
+}
+var StorageFileApi = class {
+  #http;
+  #auth;
+  #bucket;
+  constructor(http, auth, bucket) {
+    this.#http = http;
+    this.#auth = auth;
+    this.#bucket = bucket;
+  }
+  /** `/storage/object/<route><bucket>/<path>`, or the refusal no request needs. */
+  #objectPath(route2, path) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return bucket;
+    const name = encodePath(path);
+    if (!name.ok) return name;
+    return {
+      ok: true,
+      path: `/storage/object/${route2}${bucket.encoded}/${name.encoded}`
+    };
+  }
+  /** `/storage/object/<route><bucket>`, for the routes that take names in the body. */
+  #bucketPath(route2) {
+    const bucket = encodeBucket(this.#bucket);
+    if (!bucket.ok) return bucket;
+    return { ok: true, path: `/storage/object/${route2}${bucket.encoded}` };
+  }
+  async #json(request, guard) {
+    await this.#auth.ready();
+    const result = await call(this.#http, { ...request, withToken: true });
+    if (result.error !== null) return fail(result.error);
+    return dataOf2(result.answer.status, result.answer.body, guard);
+  }
+  async #write(method, path, body, options, upsert) {
+    const target = this.#objectPath("", path);
+    if (!target.ok) return fail(target.error);
+    const payload = payloadOf(body, options.contentType);
+    if (!payload.ok) return fail(payload.error);
+    const cache = `max-age=${options.cacheControl ?? "3600"}`;
+    const unreadable = headerProblem(options.contentType, cache);
+    if (unreadable !== null) return fail(unreadable);
+    if (payload.size > MAX_SINGLE_UPLOAD_BYTES2) return fail(objectTooLarge());
+    await this.#auth.ready();
+    const headers = {
+      "content-type": payload.type,
+      "cache-control": cache
+    };
+    if (upsert) headers["x-upsert"] = "true";
+    const sent = await send(this.#http, {
+      method,
+      path: target.path,
+      headers,
+      body: payload.body,
+      withToken: true
+    });
+    if (sent.error !== null) return fail(sent.error);
+    return readJson(sent.response, isUploadResult);
+  }
+  /**
+   * A new object; with `upsert: true`, one of the same name is replaced.
+   * `null` options, as a JS caller may pass, are no options.
+   */
+  upload(path, body, options = {}) {
+    const given = options ?? {};
+    return this.#write("POST", path, body, given, given.upsert === true);
+  }
+  /** Replaces an object that is there (`OBJECT_NOT_FOUND` otherwise). */
+  update(path, body, options = {}) {
+    return this.#write("PUT", path, body, options ?? {}, false);
+  }
+  /**
+   * The object's bytes, as a Blob of the type the worker serves it under:
+   * the stored type for the images, audio, video, PDF, plain text, CSV,
+   * JSON and SVG it serves as themselves, `application/octet-stream` for
+   * anything else (HTML, scripts, archives, unknown types — `info` and
+   * `list` hold the stored type).
+   */
+  async download(path) {
+    const target = this.#objectPath("", path);
+    if (!target.ok) return fail(target.error);
+    await this.#auth.ready();
+    const sent = await send(this.#http, {
+      method: "GET",
+      path: target.path,
+      withToken: true
+    });
+    if (sent.error !== null) return fail(sent.error);
+    try {
+      return { data: await sent.response.blob(), error: null };
+    } catch (error) {
+      return fail(networkError(error));
+    }
+  }
+  async info(path) {
+    const target = this.#objectPath("info/", path);
+    if (!target.ok) return fail(target.error);
+    return this.#json({ method: "GET", path: target.path }, isFileObject);
+  }
+  /**
+   * Whether the caller can see the object: `OBJECT_NOT_FOUND` is false,
+   * every other error comes back as it is (plan C1 — asked with `info`,
+   * not HEAD, whose answer has no body to tell a missing bucket from a
+   * missing object).
+   */
+  async exists(path) {
+    const found = await this.info(path);
+    if (found.error === null) return { data: true, error: null };
+    if (found.error.code === "OBJECT_NOT_FOUND")
+      return { data: false, error: null };
+    return fail(found.error);
+  }
+  /**
+   * What is directly below `prefix` (the whole bucket by default): folders
+   * first, then files. The options go to the worker as they are given.
+   */
+  async list(prefix, options = {}) {
+    const target = this.#bucketPath("list/");
+    if (!target.ok) return fail(target.error);
+    return this.#json(
+      {
+        method: "POST",
+        path: target.path,
+        body: { ...prefix === void 0 ? {} : { prefix }, ...options }
+      },
+      listOf(isEntry2)
+    );
+  }
+  /** Removes the objects named — 1 to 1,000 — and answers the ones it removed. */
+  async remove(paths) {
+    const target = this.#bucketPath("");
+    if (!target.ok) return fail(target.error);
+    return this.#json(
+      { method: "DELETE", path: target.path, body: { prefixes: paths } },
+      listOf(isFileObject)
+    );
+  }
+  /**
+   * A link to the object for `expiresIn` seconds (1–604,800). It stops
+   * working once the object is replaced or removed.
+   */
+  async createSignedUrl(path, expiresIn, options = {}) {
+    const target = this.#objectPath("sign/", path);
+    if (!target.ok) return fail(target.error);
+    const { download: download2 } = options ?? {};
+    const signed = await this.#json(
+      {
+        method: "POST",
+        path: target.path,
+        body: {
+          expiresIn,
+          ...download2 === void 0 || download2 === false ? {} : { download: download2 }
+        }
+      },
+      isSigned
+    );
+    if (signed.error !== null) return signed;
+    return {
+      data: { signedUrl: `${this.#http.baseUrl}${signed.data.signedUrl}` },
+      error: null
+    };
+  }
+  /**
+   * A public bucket's URL for the object. No request is made, so whether
+   * the bucket is public is not checked (as in supabase-js); a path no URL
+   * can carry is INVALID_PATH (plan C3), and a download name none can carry
+   * is the worker's INVALID_REQUEST for it.
+   */
+  getPublicUrl(path, options = {}) {
+    const target = this.#objectPath("public/", path);
+    if (!target.ok) return fail(target.error);
+    const { download: download2 } = options ?? {};
+    const query = downloadQuery(download2);
+    if (!query.ok) return fail(query.error);
+    return {
+      data: {
+        publicUrl: `${this.#http.baseUrl}/_naro/v1${target.path}${query.encoded}`
+      },
+      error: null
+    };
+  }
+};
+var StorageClient = class {
+  #http;
+  #auth;
+  constructor(http, auth) {
+    this.#http = http;
+    this.#auth = auth;
+  }
+  /** The objects of one bucket. */
+  from(bucket) {
+    return new StorageFileApi(this.#http, this.#auth, bucket);
+  }
+};
+var CONFIG_MESSAGES = {
+  url: "createClient needs the project url, like https://my-app.naro.sh.",
+  urlNotOrigin: "createClient needs the project url alone, like https://my-app.naro.sh: no path, no ? or #, no user:password@. Naro serves its API at /_naro/v1 on that origin.",
+  key: "createClient needs an anonKey (or, on a server, a serviceKey).",
+  bothKeys: "Pass createClient an anonKey or a serviceKey, not both.",
+  serviceKeyOffServer: "A Naro service key (naro_sk_\u2026) skips every policy, so createClient accepts it only on a server (Node, Deno, Bun, Cloudflare Workers, an edge runtime), never in a browser, a web worker or a React Native app. Use the anon key (naro_pk_\u2026) here and keep the service key on your server.",
+  fetch: "This runtime has no fetch. Pass one to createClient({ fetch })."
+};
+var SERVICE_KEY_PREFIX = "naro_sk_";
+function baseUrlOf(url) {
+  if (typeof url !== "string") throw new Error(CONFIG_MESSAGES.url);
+  const trimmed = url.trim();
+  let parsed;
+  try {
+    parsed = new URL(trimmed.replace(/\/+$/, ""));
+  } catch {
+    throw new Error(CONFIG_MESSAGES.url);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+    throw new Error(CONFIG_MESSAGES.url);
+  if (trimmed.includes("?") || trimmed.includes("#") || parsed.pathname !== "/" || parsed.username !== "" || parsed.password !== "")
+    throw new Error(CONFIG_MESSAGES.urlNotOrigin);
+  return parsed.origin;
+}
+function apiKeyOf(options) {
+  const { anonKey, serviceKey } = options;
+  const hasAnon = typeof anonKey === "string" && anonKey !== "";
+  const hasService = typeof serviceKey === "string" && serviceKey !== "";
+  if (hasAnon && hasService) throw new Error(CONFIG_MESSAGES.bothKeys);
+  const key = hasService ? serviceKey : hasAnon ? anonKey : void 0;
+  if (key === void 0) throw new Error(CONFIG_MESSAGES.key);
+  const service = hasService || key.startsWith(SERVICE_KEY_PREFIX);
+  if (service && !isKnownServer())
+    throw new Error(CONFIG_MESSAGES.serviceKeyOffServer);
+  return { key, service };
+}
+function queryRunner(http, auth) {
+  return async (query) => {
+    await auth.ready();
+    const result = await call(http, {
+      method: "POST",
+      path: "/data/query",
+      body: query,
+      withToken: true
+    });
+    if (result.error !== null) return { data: null, error: result.error };
+    const { body, status } = result.answer;
+    if (!isRecord(body) || !Object.hasOwn(body, "data"))
+      return { data: null, error: invalidResponse(status) };
+    return { data: body.data, error: null };
+  };
+}
+var NaroClient2 = class {
+  /**
+   * Sign-up, sign-in, sign-out and the current user (spec §13); with the
+   * service key, `auth.admin` manages users.
+   */
+  auth;
+  /**
+   * Files in the project's Naro Storage (first-release design 2026-10-06
+   * §8.1): `storage.from(bucket)` uploads, downloads, lists and removes
+   * them, as supabase-js does.
+   */
+  storage;
+  #run;
+  constructor(options) {
+    const baseUrl = baseUrlOf(options.url);
+    const { key: apiKey, service } = apiKeyOf(options);
+    if (options.fetch === void 0 && typeof globalThis.fetch !== "function")
+      throw new Error(CONFIG_MESSAGES.fetch);
+    const storage = options.auth?.storage ?? defaultStorage();
+    const http = {
+      baseUrl,
+      apiKey,
+      fetch: options.fetch,
+      tokens: new TokenStore(storage, storageKey(baseUrl))
+    };
+    this.auth = new AuthClient(http, {
+      verifiers: new FlowVerifiers(
+        new TokenStore(storage, verifierKey(baseUrl))
+      ),
+      recovery: new RecoveryToken(
+        new TokenStore(storage, recoveryKey(baseUrl))
+      ),
+      detectSessionInUrl: options.auth?.detectSessionInUrl ?? true,
+      shared: { storage, key: storageKey(baseUrl) },
+      serviceKey: service
+    });
+    this.#run = queryRunner(http, this.auth);
+    this.storage = new StorageClient(http, this.auth);
+  }
+  /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
+  from(table2) {
+    return new TableBuilder(this.#run, table2);
+  }
+};
+function createClient(options) {
+  return new NaroClient2(options);
+}
+
+// src/commands/storage-objects.ts
+var NARO_SCHEME = "naro://";
+var CP_USAGE = "Usage: naro storage cp <from> <to> (one side naro://<bucket>/<path>, the other a local file)";
+var RM_USAGE = "Usage: naro storage rm naro://<bucket>/<path>\u2026 [--recursive] [--yes]";
+var LS_USAGE = "Usage: naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]";
+var BACKEND_OFF_MESSAGE = "The backend is turned off for this project. Turn it on with `naro backend enable` first.";
+var PAGE = 1e3;
+var MAX_OFFSET = 1e5;
+var TRUNCATED_WARNING = `\u26A0 A folder's listing stopped at ${(MAX_OFFSET + PAGE).toLocaleString("en-US")} entries, as far as the API's offset reaches; there may be more.`;
+var REMOVE_BATCH = 1e3;
+var CACHE_CONTROL_RULE = "--cache-control takes whole seconds from 0 to 31536000 (a year), like 3600.";
+function isMaxAge(text) {
+  return parseCacheControl(`max-age=${text}`).ok;
+}
+var TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".pdf": "application/pdf",
+  ".json": "application/json",
+  ".txt": "text/plain",
+  ".csv": "text/csv",
+  ".md": "text/markdown",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".xml": "application/xml",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+  ".m4a": "audio/mp4",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf"
+};
+function parseStorageUrl(text) {
+  if (!text.startsWith(NARO_SCHEME)) return null;
+  const rest = text.slice(NARO_SCHEME.length);
+  const slash = rest.indexOf("/");
+  const bucket = slash < 0 ? rest : rest.slice(0, slash);
+  if (bucket === "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "A naro:// path needs a bucket: naro://<bucket>/<path>."
+    );
+  return { bucket, path: slash < 0 ? "" : rest.slice(slash + 1) };
+}
+function typeFor(file) {
+  return TYPES[extname(file).toLowerCase()];
+}
+function unwrap(result) {
+  if (result.error === null) return result.data;
+  const { code, message, details } = result.error;
+  let shown = typeof details === "object" && details !== null && !Array.isArray(details) ? details : void 0;
+  if (shown && code === "NETWORK_ERROR") {
+    const { cause: _cause, ...rest } = shown;
+    shown = Object.keys(rest).length > 0 ? rest : void 0;
+  }
+  throw new NaroError(code, message, shown ? { details: shown } : {});
+}
+var ONE_KEY = /^[\x21-\x7e]+$/;
+async function objects(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const backend = await client.backend.info(projectId);
+  if (backend.status === "none")
+    throw new NaroError(
+      "BACKEND_NOT_READY",
+      "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
+    );
+  if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
+  let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
+  if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "NARO_SERVICE_KEY is not a single key: set it to the service key alone."
+    );
+  if (serviceKey === "") {
+    serviceKey = await client.backend.revealServiceKey(projectId);
+    context.output.warn(SERVICE_KEY_WARNING);
+  }
+  let naro;
+  try {
+    naro = createClient({
+      url: backend.url,
+      serviceKey,
+      auth: { detectSessionInUrl: false }
+    });
+  } catch (error) {
+    throw new NaroError(
+      "BACKEND_NOT_READY",
+      `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+      { cause: error }
+    );
+  }
+  return { projectId, storage: naro.storage };
+}
+function isFolder(entry) {
+  return entry.id === null;
+}
+function fileEntry(path, object) {
+  const { size, mimetype } = object.metadata;
+  return {
+    path,
+    kind: "file",
+    size: typeof size === "number" ? size : null,
+    contentType: typeof mimetype === "string" ? mimetype : null,
+    updatedAt: object.updated_at
+  };
+}
+async function listAll(storage, bucket, prefix, recursive) {
+  const entries = [];
+  let truncated = false;
+  const folders = [prefix];
+  for (let folder = folders.shift(); folder !== void 0; folder = folders.shift()) {
+    for (let offset = 0; ; offset += PAGE) {
+      if (offset > MAX_OFFSET) {
+        truncated = true;
+        break;
+      }
+      const page = unwrap(
+        await storage.from(bucket).list(folder, { limit: PAGE, offset })
+      );
+      for (const entry of page) {
+        const path = folder === "" ? entry.name : `${folder}/${entry.name}`;
+        if (isFolder(entry)) {
+          if (recursive) folders.push(path);
+          else
+            entries.push({
+              path: `${path}/`,
+              kind: "folder",
+              size: null,
+              contentType: null,
+              updatedAt: null
+            });
+          continue;
+        }
+        entries.push(fileEntry(path, entry));
+      }
+      if (page.length < PAGE) break;
+    }
+  }
+  return { entries, truncated };
+}
+function entryLine(bucket, entry) {
+  const where = `${NARO_SCHEME}${bucket}/${printable(entry.path)}`;
+  if (entry.kind === "folder") return `${" ".repeat(38)}${where}`;
+  return `${(entry.size === null ? "?" : binarySize(entry.size)).padStart(10)}  ${printable(entry.updatedAt ?? "")}  ${where}`;
+}
+async function storageLs(context) {
+  const [target, ...extra] = context.positionals;
+  if (extra.length > 0) throw new NaroError("VALIDATION_FAILED", LS_USAGE);
+  if (target === void 0) {
+    const client = await context.client();
+    const projectId2 = await context.resolveProjectId();
+    const buckets = await client.storage.listBuckets(projectId2);
+    context.output.result(
+      { projectId: projectId2, buckets },
+      buckets.length === 0 ? [NO_BUCKETS] : buckets.map((bucket) => `${NARO_SCHEME}${printable(bucket.name)}/`)
+    );
+    return;
+  }
+  const url = parseStorageUrl(target);
+  if (url === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${printable(target)} is not a naro:// path. ${LS_USAGE}`
+    );
+  const prefix = url.path.replace(/\/+$/, "");
+  const { projectId, storage } = await objects(context);
+  const { entries, truncated } = await listAll(
+    storage,
+    url.bucket,
+    prefix,
+    context.flags.recursive === true
+  );
+  if (truncated) context.output.warn(TRUNCATED_WARNING);
+  if (entries.length === 0 && prefix !== "" && !url.path.endsWith("/")) {
+    const found = await storage.from(url.bucket).info(prefix);
+    if (found.error === null) entries.push(fileEntry(prefix, found.data));
+    else if (found.error.code !== "OBJECT_NOT_FOUND") unwrap(found);
+  }
+  context.output.result(
+    { projectId, bucket: url.bucket, prefix, entries, truncated },
+    entries.length === 0 ? [`Nothing under ${NARO_SCHEME}${url.bucket}/${printable(prefix)}.`] : entries.map((entry) => entryLine(url.bucket, entry))
+  );
+}
+var INTERRUPTS = ["SIGINT", "SIGTERM", "SIGHUP"];
+function removeOnInterrupt(partial) {
+  const stop = () => {
+    for (const signal of INTERRUPTS) process.off(signal, onSignal);
+  };
+  function onSignal(signal) {
+    stop();
+    try {
+      rmSync2(partial, { force: true });
+    } catch {
+    }
+    try {
+      process.kill(process.pid, signal);
+    } catch {
+      process.exit(1);
+    }
+  }
+  for (const signal of INTERRUPTS) process.on(signal, onSignal);
+  return stop;
+}
+async function writeAtomically(blob, destination) {
+  const partial = join6(dirname3(destination), `.${randomUUID()}.naro-partial`);
+  const stopListening = removeOnInterrupt(partial);
+  try {
+    await pipeline2(
+      Readable.fromWeb(blob.stream()),
+      createWriteStream2(partial, { flags: "wx" })
+    );
+    await rename(partial, destination);
+  } catch (error) {
+    await rm(partial, { force: true }).catch(() => void 0);
+    throw error;
+  } finally {
+    stopListening();
+  }
+}
+async function upload(context, local, target) {
+  const file = resolve5(context.cwd, local);
+  const info = await stat(file).catch(() => null);
+  if (info === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `No such file: ${printable(local)}.`
+    );
+  if (info.isDirectory())
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${printable(local)} is a directory. naro storage cp copies one file at a time.`
+    );
+  if (!info.isFile())
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${printable(local)} is not a regular file.`
+    );
+  if (info.size > MAX_SINGLE_UPLOAD_BYTES)
+    throw new NaroError(
+      "OBJECT_TOO_LARGE",
+      dataError("OBJECT_TOO_LARGE", { single: true }).message
+    );
+  const { cacheControl } = context.flags;
+  if (cacheControl !== void 0 && !isMaxAge(cacheControl))
+    throw new NaroError("VALIDATION_FAILED", CACHE_CONTROL_RULE);
+  const path = target.path === "" || target.path.endsWith("/") ? `${target.path}${basename2(file)}` : target.path;
+  const { projectId, storage } = await objects(context);
+  const body = await openAsBlob(file);
+  const contentType = context.flags.contentType ?? typeFor(file);
+  const result = unwrap(
+    await storage.from(target.bucket).upload(path, body, {
+      ...contentType === void 0 ? {} : { contentType },
+      ...cacheControl === void 0 ? {} : { cacheControl },
+      upsert: context.flags.upsert === true
+    })
+  );
+  const to = `${NARO_SCHEME}${target.bucket}/${path}`;
+  context.output.result(
+    { projectId, from: local, to, bytes: body.size, id: result.id },
+    [
+      `\u2705 Uploaded ${printable(local)} \u2192 ${printable(to)} (${binarySize(body.size)})`
+    ]
+  );
+}
+var WINDOWS_DEVICE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+var MAX_FILE_NAME_BYTES = 255;
+function savedAs(path) {
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  if (name === "." || name === ".." || name.includes("\\") || name.includes(":") || name.includes("\0") || WINDOWS_DEVICE.test(name) || Buffer.byteLength(name, "utf8") > MAX_FILE_NAME_BYTES)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `The object's name (${printable(name)}) cannot be used as a file name. Name the file: naro storage cp naro://<bucket>/<path> <file>.`
+    );
+  return name;
+}
+async function download(context, source, local) {
+  if (source.path === "" || source.path.endsWith("/"))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage cp downloads one object: name it, naro://<bucket>/<path>."
+    );
+  const resolved = resolve5(context.cwd, local);
+  const isDirectory = local.endsWith("/") || (await stat(resolved).catch(() => null))?.isDirectory() === true;
+  const destination = isDirectory ? join6(resolved, savedAs(source.path)) : resolved;
+  const folder = await stat(dirname3(destination)).catch(() => null);
+  if (folder === null || !folder.isDirectory())
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Cannot save to ${printable(local)}: its folder does not exist.`
+    );
+  const { projectId, storage } = await objects(context);
+  const blob = unwrap(await storage.from(source.bucket).download(source.path));
+  await writeAtomically(blob, destination);
+  const from = `${NARO_SCHEME}${source.bucket}/${source.path}`;
+  context.output.result(
+    { projectId, from, to: destination, bytes: blob.size },
+    [
+      `\u2705 Downloaded ${printable(from)} \u2192 ${printable(destination)} (${binarySize(blob.size)})`
+    ]
+  );
+}
+async function storageCp(context) {
+  const [from, to, ...extra] = context.positionals;
+  if (from === void 0 || to === void 0 || extra.length > 0)
+    throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+  const source = parseStorageUrl(from);
+  const target = parseStorageUrl(to);
+  if (source !== null && target !== null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "naro storage cp copies between this machine and Storage: one side is naro://<bucket>/<path>, the other a local file. Copying inside Storage is not supported yet."
+    );
+  if (target !== null) return upload(context, from, target);
+  if (source !== null) return download(context, source, to);
+  throw new NaroError("VALIDATION_FAILED", CP_USAGE);
+}
+async function namesUnder(storage, bucket, prefixes) {
+  const names = /* @__PURE__ */ new Set();
+  let truncated = false;
+  for (const written of prefixes) {
+    const prefix = written.replace(/\/+$/, "");
+    if (prefix !== "" && !written.endsWith("/") && unwrap(await storage.from(bucket).exists(prefix)))
+      names.add(prefix);
+    const found = await listAll(storage, bucket, prefix, true);
+    for (const entry of found.entries) names.add(entry.path);
+    truncated ||= found.truncated;
+  }
+  return { names: [...names], truncated };
+}
+async function storageRm(context) {
+  if (context.positionals.length === 0)
+    throw new NaroError("VALIDATION_FAILED", RM_USAGE);
+  const recursive = context.flags.recursive === true;
+  const byBucket = /* @__PURE__ */ new Map();
+  for (const arg of context.positionals) {
+    const url = parseStorageUrl(arg);
+    if (url === null)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${printable(arg)} is not a naro:// path. ${RM_USAGE}`
+      );
+    if (!recursive && (url.path === "" || url.path.endsWith("/")))
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${printable(arg)} is a folder: pass --recursive to remove what is under it.`
+      );
+    byBucket.set(url.bucket, [...byBucket.get(url.bucket) ?? [], url.path]);
+  }
+  if (!recursive)
+    for (const [bucket, paths] of byBucket)
+      await confirmOrAbort(
+        context,
+        `Remove ${count(new Set(paths).size, "object")} from ${bucket}?`
+      );
+  else if (!context.flags.yes && cannotAsk(context))
+    throw new NaroError(
+      "CONFIRMATION_REQUIRED",
+      `Remove everything under ${context.positionals.map((arg) => printable(arg)).join(", ")}? Re-run with --yes to confirm.`
+    );
+  const { projectId, storage } = await objects(context);
+  const results = [];
+  for (const [bucket, paths] of byBucket) {
+    let names;
+    if (recursive) {
+      const found = await namesUnder(storage, bucket, paths);
+      names = found.names;
+      if (found.truncated) context.output.warn(TRUNCATED_WARNING);
+    } else names = [...new Set(paths)];
+    if (names.length === 0) {
+      context.output.log(`Nothing to remove in ${bucket}.`);
+      results.push({ bucket, requested: 0, removed: [] });
+      continue;
+    }
+    if (recursive)
+      await confirmOrAbort(
+        context,
+        `Remove ${count(names.length, "object")} from ${bucket}?`
+      );
+    const removed = [];
+    try {
+      for (let at = 0; at < names.length; at += REMOVE_BATCH) {
+        const page = unwrap(
+          await storage.from(bucket).remove(names.slice(at, at + REMOVE_BATCH))
+        );
+        removed.push(...page.map((object) => object.name));
+      }
+    } catch (error) {
+      if (removed.length > 0)
+        context.output.warn(
+          `\u26A0 Removed ${removed.length.toLocaleString("en-US")} of ${count(names.length, "object")} from ${bucket} before the error.`
+        );
+      throw error;
+    }
+    if (removed.length < names.length)
+      context.output.warn(
+        `\u26A0 ${String(names.length - removed.length)} of ${String(names.length)} were not removed: they were not there, or another request was changing them.`
+      );
+    context.output.log(
+      removed.length === 0 ? `Nothing was removed from ${bucket}.` : `\u2705 Removed ${count(removed.length, "object")} from ${bucket}.`
+    );
+    results.push({ bucket, requested: names.length, removed });
+  }
+  context.output.result({ projectId, removed: results });
+}
+var ENV_KEY_REFUSED = "\u26A0 The service key came from NARO_SERVICE_KEY, which is used in every project: it may be another project's. Unset it to use this project's key.";
+async function explainingKey(context, run) {
+  try {
+    await run(context);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "INVALID_API_KEY" && (process.env.NARO_SERVICE_KEY?.trim() ?? "") !== "")
+      context.output.warn(ENV_KEY_REFUSED);
+    throw error;
+  }
+}
+function runStorageLs(context) {
+  return explainingKey(context, storageLs);
+}
+function runStorageCp(context) {
+  return explainingKey(context, storageCp);
+}
+function runStorageRm(context) {
+  return explainingKey(context, storageRm);
+}
+
+// src/router.ts
+var HELP = `naro \u2014 deploy Next.js apps to Naro (https://naro.sh)
+
+Usage:
+  naro login | logout | whoami
+  naro token                         Print an access token for CI (NARO_TOKEN)
+
+  naro link | init                   Link this directory to a Naro project
+  naro unlink                        Remove the link (.naro/)
+  naro projects [--team <slug>]      List projects
+  naro project inspect               Show the linked project
+
+  naro deploy [--prod]               Build locally and deploy (preview by default)
+       [--root <dir>] [--name <name>]  --root points at the app in a monorepo
+  naro deployments                   List deployments of the linked project
+  naro inspect <deployment-id>       Show one deployment + build logs
+  naro cancel <deployment-id>        Stop a build that is still running
+
+  naro git connect [owner/repo]      Deploy on every push (defaults to your origin remote)
+  naro git disconnect                Stop deploying on push
+
+  naro logs [deployment-id]          Runtime logs (or build logs of a deployment)
+       [--type build|runtime] [--env production|preview] [--level error] [--follow]
+
+  naro insights [--metric lcp] [--range 7d] [--env preview]
+                                     Speed Insights: Web Vitals p75 by page, device, the elements
+                                     behind slow visits and deployment (production by default)
+  naro insights --route '/posts/[id]'  The paths opened under one route
+  naro insights enable | disable     Turn measuring on or off (production pages get a
+                                     same-origin script, preview pages too; past measurements are kept)
+
+  naro protection                    Preview protection: on or off, and whether a bypass secret is set
+  naro protection enable | disable   Protect the preview URL (members only) or open it to anyone with the link (disable asks first; --yes in CI)
+  naro protection bypass [remove]    Create (shown once) or remove the secret automation sends as x-naro-protection-bypass (replacing or removing asks first; --yes in CI)
+
+  naro env list                      List env vars (secrets masked)
+  naro env add KEY [environment]     Add/update (value from prompt or stdin)
+  naro env remove KEY [environment]  Remove
+  naro env pull [file]               Write env vars to .env.local
+
+  naro domains list | add <host> [--no-www] | remove <host>
+       add example.com also connects www.example.com and redirects the apex to
+       it, because most registrars cannot put a CNAME on an apex; --no-www
+       registers the apex alone
+  naro domains verify [host] [--wait]  Re-check DNS and print what is missing
+       exits non-zero while a domain is not live yet
+
+  naro db enable                     Create the project's database (Cloudflare D1)
+  naro db info                       Database status, size, table count and limits
+       and today's writes against the daily write limit (UTC)
+  naro db query <sql> | --file <f>   Run SQL against it (reads stdin when piped)
+  naro db push [--dry-run]           Apply pending migrations from ./migrations (asks first; --yes to skip)
+                                     --dry-run checks their policy statements on this machine and
+                                     exits 1 on one the server would refuse
+  naro db dump [--output <f>]        Download a SQL dump of the database (stdout by default)
+       [--schema-only|--data-only] [--table a,b]  Cloudflare holds other queries until it finishes
+  naro db restore --bookmark <id>    Roll the database back (Time Travel, last 30 days; asks first)
+       | --timestamp <time> [--dry-run]  prints the command that undoes it
+  naro db pull [--dir <d>]           Write the remote schema as migrations/0001_remote_schema.sql
+                                     and record it as applied - a baseline (asks first)
+  naro db reset [--dir <d>]          Drop everything and clear the policies and the ledger, then re-apply
+       [--dry-run] [--yes]           ./migrations, which create the policies again. Refuses files the server
+                                     would refuse; lists first the policies the files do not make
+                                     (asks first; db restore --bookmark undoes it)
+  naro db lint [--strict]            Check the schema for what D1 actually trips on, and the RLS policies
+                                     (rls_no_policy, rls_policy_invalid, rls_policy_text_default,
+                                     rls_policy_unindexed; exits 1 on an error, --strict on a warning too)
+  naro db table create <name> --column <spec> [--column <spec>\u2026]
+       [--owner <column>] [--if-not-exists]  Create a table without SQL. <spec> is name:type[:modifier\u2026]:
+                                     types integer, real, text, blob, numeric, boolean, datetime, json;
+                                     modifiers pk, autoincrement, notnull, unique, default=<v>,
+                                     references=<table>.<column>, ondelete=cascade|set-null|\u2026
+                                     --owner adds that column (TEXT NOT NULL) and an owner policy
+  naro db table add-column <table> --column <spec>
+  naro db table rename-column <table> <column> <new-name>
+  naro db table rename <table> <new-name>
+  naro db table drop-column <table> <column>  Asks first (--yes to skip)
+  naro db table drop <table>         Asks first (--yes to skip)
+  naro db index create <table> <col[,col\u2026]> [--unique] [--name <name>]
+  naro db index drop <name>
+       Each runs as one migration in d1_migrations and is written to ./migrations
+       (--no-write skips the file; --dry-run prints the SQL and changes nothing)
+  naro migration new <name>          Create migrations/NNNN_<name>.sql (stdin becomes the body when piped)
+  naro migration list                Local vs applied migrations
+  naro migration up [--dry-run]      Same as db push
+  naro migration repair <name>       Fix the ledger alone: mark a migration applied or
+       --status applied|reverted [--yes]  remove its row. Its SQL is never run (asks first)
+  naro gen types [--lang typescript] [--output <file>]
+                                     TypeScript types for the schema, for createClient<Database>()
+                                     from naro-js (stdout by default)
 
   naro backend [status]              On or off, status, URL and anon key (the service key stays hidden)
   naro backend enable                Turn the backend on: D1, sign-in and the Data API (safe to re-run;
@@ -4686,6 +8185,27 @@ Usage:
                                      naro_insert, naro_update, naro_delete (shorthand for CREATE POLICY)
   naro policy remove <table>         Drop every policy on it: back to deny (asks first)
 
+  naro storage [status]              Naro Storage: on or off, limits, what is stored, the buckets
+  naro storage enable                Turn Storage on: the project's R2 bucket, bound to its backend
+                                     (safe to re-run; applies a plan change's limits)
+  naro storage bucket list           The buckets: public or private, objects, bytes, limits
+  naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]
+                                     <size>: bytes, 5MB (1000s) or 5MiB (1024s); turns Storage on first if needed
+  naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]
+                                     --public asks first: anyone with an object's URL can then download it
+  naro storage bucket empty <name>   Delete every object in it and keep the bucket (asks first)
+  naro storage bucket remove <name> [--empty]
+                                     Remove an empty bucket; --empty deletes its objects first (asks first)
+  naro storage ls [naro://<bucket>[/<prefix>]] [--recursive]
+                                     The buckets, or the folders and objects under a prefix
+  naro storage cp <from> <to> [--upsert] [--content-type <t>] [--cache-control <seconds>]
+                                     One file between this machine and naro://<bucket>/<path>, 50 MiB at most,
+                                     with the project's service key (NARO_SERVICE_KEY, or fetched with a warning).
+                                     A download replaces a local file of the same name
+  naro storage rm naro://<bucket>/<path>\u2026 [--recursive]
+                                     Remove objects; --recursive removes what is under a folder (asks first):
+                                     <path>/ is the folder alone, <path> also an object of that name
+
   naro promote <deployment-id>       Publish a build to production
   naro rollback [deployment-id]      Roll production back to the previous build
 
@@ -4700,6 +8220,10 @@ Global options:
   --cwd <dir>     Run as if started in <dir>
   --prod          Deploy/target production
   --wait          Poll until the domain goes live (naro domains verify)
+  --metric <m>    lcp, inp, cls, fcp or ttfb; lcp by default (naro insights)
+  --range <r>     24h, 7d or 30d; 7d by default (naro insights)
+  --route <pattern>  A route from the pages table, e.g. '/posts/[id]': the paths under it (naro insights)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull: preview by default)
   --no-www        Register the apex alone (naro domains add)
   --file <path>   SQL file to run (naro db query, naro policy create)
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
@@ -4726,6 +8250,14 @@ Global options:
   --password-stdin  Read the new user's password from stdin (a pipe, or a hidden prompt)
   --password <p>  The password in argv: works, but lands in shell history (naro backend users create)
   --min-length <n>  Fewest characters of a new password, 6-128 (naro backend auth password)
+  --public | --private  Who may download a bucket's objects by URL (naro storage bucket create, update)
+  --file-size-limit <size>  A bucket's largest object: bytes, 5MB or 5MiB; none clears it
+  --allowed-mime-types <t,\u2026>  The types a bucket takes, like image/png,image/*; any clears it
+  --empty         Delete the bucket's objects first (naro storage bucket remove)
+  --recursive, -r Everything under a folder (naro storage ls, naro storage rm)
+  --upsert        Replace an object that is there (naro storage cp)
+  --content-type <t>  The object's type; by default from the file's extension (naro storage cp)
+  --cache-control <seconds>  How long a browser may keep it; 3600 by default (naro storage cp)
   --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
   --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
   --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
@@ -4819,6 +8351,56 @@ function routeBackendUsers(words) {
       return null;
   }
 }
+function routeStorage(words) {
+  const [sub, action] = words;
+  switch (sub) {
+    case void 0:
+    case "status":
+      return words.length <= 1 ? { handler: runStorageStatus, positionals: [] } : null;
+    case "enable":
+      return words.length === 1 ? { handler: runStorageEnable, positionals: [] } : null;
+    case "bucket":
+    case "buckets":
+      switch (action) {
+        case void 0:
+        case "list":
+        case "ls":
+          return words.length <= 2 ? { handler: runStorageBucketList, positionals: [] } : null;
+        case "create":
+          return {
+            handler: runStorageBucketCreate,
+            positionals: words.slice(2)
+          };
+        case "update":
+          return {
+            handler: runStorageBucketUpdate,
+            positionals: words.slice(2)
+          };
+        case "empty":
+          return {
+            handler: runStorageBucketEmpty,
+            positionals: words.slice(2)
+          };
+        case "remove":
+        case "rm":
+        case "delete":
+          return {
+            handler: runStorageBucketRemove,
+            positionals: words.slice(2)
+          };
+        default:
+          return null;
+      }
+    case "ls":
+      return { handler: runStorageLs, positionals: words.slice(1) };
+    case "cp":
+      return { handler: runStorageCp, positionals: words.slice(1) };
+    case "rm":
+      return { handler: runStorageRm, positionals: words.slice(1) };
+    default:
+      return null;
+  }
+}
 function route(parsed) {
   const { command, positionals } = parsed;
   const sub = positionals[0];
@@ -4856,6 +8438,39 @@ function route(parsed) {
       return { handler: runCancel, positionals };
     case "logs":
       return { handler: runLogs, positionals };
+    // Spec 2026-10-08 §5.
+    case "insights": {
+      if (positionals.length > 1) return null;
+      switch (sub) {
+        case void 0:
+          return { handler: runInsights, positionals: [] };
+        case "enable":
+          return { handler: runInsightsEnable, positionals: [] };
+        case "disable":
+          return { handler: runInsightsDisable, positionals: [] };
+        default:
+          return null;
+      }
+    }
+    // Spec 2026-10-08-preview-protection §9.
+    case "protection": {
+      const [, second, third] = positionals;
+      if (third !== void 0) return null;
+      switch (sub) {
+        case void 0:
+          return { handler: runProtection, positionals: [] };
+        case "enable":
+          return second === void 0 ? { handler: runProtectionEnable, positionals: [] } : null;
+        case "disable":
+          return second === void 0 ? { handler: runProtectionDisable, positionals: [] } : null;
+        case "bypass":
+          if (second === void 0)
+            return { handler: runProtectionBypass, positionals: [] };
+          return second === "remove" ? { handler: runProtectionBypassRemove, positionals: [] } : null;
+        default:
+          return null;
+      }
+    }
     case "env":
       switch (sub) {
         case void 0:
@@ -4989,6 +8604,8 @@ function route(parsed) {
         default:
           return null;
       }
+    case "storage":
+      return routeStorage(positionals);
     case "policy":
       switch (sub) {
         case void 0:
@@ -5035,8 +8652,8 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync4(
-        join5(dirname3(fileURLToPath(import.meta.url)), "..", "package.json"),
+      readFileSync5(
+        join7(dirname4(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );