naro-cli 0.12.0 → 0.14.0

package/dist/{chunk-GFCG5C7D.js → chunk-U7AZSAFS.js}

@@ -320,8 +320,8 @@ function numberedMigrationName(existing, title) {
 var MAX_SCHEMA_TITLE_LENGTH = 180;
 function schemaMigrationTitle(operation) {
   const op = typeof operation.op === "string" ? operation.op.replace(/[A-Z]/g, (letter) => `_${letter}`) : "";
-  const target = typeof operation.table === "string" ? operation.table : typeof operation.name === "string" ? operation.name : "";
-  return normalizeMigrationName(`schema ${op} ${target}`).slice(0, MAX_SCHEMA_TITLE_LENGTH).replace(/_+$/, "");
+  const target2 = typeof operation.table === "string" ? operation.table : typeof operation.name === "string" ? operation.name : "";
+  return normalizeMigrationName(`schema ${op} ${target2}`).slice(0, MAX_SCHEMA_TITLE_LENGTH).replace(/_+$/, "");
 }
 
 // ../../packages/core/src/paths.ts
@@ -1076,8 +1076,8 @@ function defineLazy(object2, key, getter) {
 function objectClone(obj) {
   return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
 }
-function assignProp(target, prop, value) {
-  Object.defineProperty(target, prop, {
+function assignProp(target2, prop, value) {
+  Object.defineProperty(target2, prop, {
     value,
     writable: true,
     enumerable: true,
@@ -1260,35 +1260,35 @@ function normalizeParams(_params) {
   return params;
 }
 function createTransparentProxy(getter) {
-  let target;
+  let target2;
   return new Proxy({}, {
     get(_, prop, receiver) {
-      target ?? (target = getter());
-      return Reflect.get(target, prop, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.get(target2, prop, receiver);
     },
     set(_, prop, value, receiver) {
-      target ?? (target = getter());
-      return Reflect.set(target, prop, value, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.set(target2, prop, value, receiver);
     },
     has(_, prop) {
-      target ?? (target = getter());
-      return Reflect.has(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.has(target2, prop);
     },
     deleteProperty(_, prop) {
-      target ?? (target = getter());
-      return Reflect.deleteProperty(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.deleteProperty(target2, prop);
     },
     ownKeys(_) {
-      target ?? (target = getter());
-      return Reflect.ownKeys(target);
+      target2 ?? (target2 = getter());
+      return Reflect.ownKeys(target2);
     },
     getOwnPropertyDescriptor(_, prop) {
-      target ?? (target = getter());
-      return Reflect.getOwnPropertyDescriptor(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.getOwnPropertyDescriptor(target2, prop);
     },
     defineProperty(_, prop, descriptor) {
-      target ?? (target = getter());
-      return Reflect.defineProperty(target, prop, descriptor);
+      target2 ?? (target2 = getter());
+      return Reflect.defineProperty(target2, prop, descriptor);
     }
   });
 }
@@ -11740,15 +11740,15 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/to-json-schema.js
 function initializeContext(params) {
-  let target = params?.target ?? "draft-2020-12";
-  if (target === "draft-4")
-    target = "draft-04";
-  if (target === "draft-7")
-    target = "draft-07";
+  let target2 = params?.target ?? "draft-2020-12";
+  if (target2 === "draft-4")
+    target2 = "draft-04";
+  if (target2 === "draft-7")
+    target2 = "draft-07";
   return {
     processors: params.processors ?? {},
     metadataRegistry: params?.metadata ?? globalRegistry,
-    target,
+    target: target2,
     unrepresentable: params?.unrepresentable ?? "throw",
     override: params?.override ?? (() => {
     }),
@@ -12090,8 +12090,8 @@ var createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
   return finalize(ctx, schema);
 };
 var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
-  const { libraryOptions, target } = params ?? {};
-  const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
+  const { libraryOptions, target: target2 } = params ?? {};
+  const ctx = initializeContext({ ...libraryOptions ?? {}, target: target2, io, processors });
   process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
@@ -13150,8 +13150,8 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     catch(params) {
       return _catch2(this, params);
     },
-    pipe(target) {
-      return pipe(this, target);
+    pipe(target2) {
+      return pipe(this, target2);
     },
     readonly() {
       return readonly(this);
@@ -17057,14 +17057,14 @@ function createSmokeTester(options = {}) {
   const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
   const allocatePort = options.allocatePort ?? allocateLoopbackPort;
   const pollIntervalMs = options.pollIntervalMs ?? 1e3;
-  async function runOnce(request, observer) {
-    const stage = request.stage ?? "BUILDING";
-    const errorCode2 = request.errorCode ?? "BUILD_FAILED";
-    const bootTimeoutMs = request.bootTimeoutMs ?? 9e4;
-    const probeTimeoutMs = request.probeTimeoutMs ?? 15e3;
+  async function runOnce(request2, observer) {
+    const stage = request2.stage ?? "BUILDING";
+    const errorCode2 = request2.errorCode ?? "BUILD_FAILED";
+    const bootTimeoutMs = request2.bootTimeoutMs ?? 9e4;
+    const probeTimeoutMs = request2.probeTimeoutMs ?? 15e3;
     const port = await allocatePort();
     const origin = `http://127.0.0.1:${String(port)}`;
-    const boot = request.boot(port);
+    const boot = request2.boot(port);
     const recent = [];
     const server = start(
       { ...boot, stage, errorCode: errorCode2 },
@@ -17130,7 +17130,7 @@ function createSmokeTester(options = {}) {
           probes: probes2
         };
       }
-      for (const probe of request.probes) {
+      for (const probe of request2.probes) {
         const answer = await fetchStatus(
           fetchImpl,
           `${origin}${probe.path}`,
@@ -17160,15 +17160,15 @@ function createSmokeTester(options = {}) {
     }
   }
   return {
-    async run(request, observer) {
-      const first = await runOnce(request, observer);
+    async run(request2, observer) {
+      const first = await runOnce(request2, observer);
       if (first.ok || !first.portTaken) return first;
       await observer.onLog({
         level: "WARN",
-        stage: request.stage ?? "BUILDING",
+        stage: request2.stage ?? "BUILDING",
         message: "Smoke port was taken before the server bound it; retrying on a fresh port."
       });
-      return runOnce(request, observer);
+      return runOnce(request2, observer);
     }
   };
 }
@@ -17906,9 +17906,9 @@ function shouldCopy(path) {
   if (SKIPPED_ANYWHERE.has(name)) return false;
   return !name.startsWith(".next-deploy-");
 }
-async function copyCheckout(source, target) {
+async function copyCheckout(source, target2) {
   const origin = resolve6(source);
-  await cp(origin, target, {
+  await cp(origin, target2, {
     recursive: true,
     verbatimSymlinks: true,
     filter: (path) => resolve6(path) === origin || shouldCopy(path)
@@ -18287,16 +18287,16 @@ var LocalBuildExecutor = class {
           await fork(checkout, pristine);
           let forks = 0;
           const forkWorkspace = async (label2) => {
-            const target = join17(
+            const target2 = join17(
               workspace,
               "forks",
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
             );
-            await fork(pristine, target);
-            await install(target);
+            await fork(pristine, target2);
+            await install(target2);
             return {
-              checkout: target,
-              appRoot: forkedAppRoot(checkout, appRoot, target)
+              checkout: target2,
+              appRoot: forkedAppRoot(checkout, appRoot, target2)
             };
           };
           const vinextCommand = this.dependencies.vinextCommand;
@@ -18488,6 +18488,16 @@ function createLogSender(ports) {
   };
 }
 
+// ../../packages/sdk/src/analytics.ts
+var ANALYTICS_FILTER_KEYS = [
+  "path",
+  "referrer",
+  "country",
+  "device",
+  "browser",
+  "os"
+];
+
 // ../../packages/sdk/src/auth.ts
 import { homedir as homedir2 } from "os";
 
@@ -18917,6 +18927,7 @@ async function resolveAuth(options = {}) {
       saveSession(session, home);
     }
   }
+  let refreshing = null;
   const auth = {
     source: "session",
     user: session.user,
@@ -18929,9 +18940,19 @@ async function resolveAuth(options = {}) {
         );
       }
       if (!isExpired(current)) return current.access_token;
-      const refreshed = await refresh(current.refresh_token);
-      saveSession(refreshed, home);
-      return refreshed.access_token;
+      const token = current.refresh_token;
+      let flight = refreshing;
+      if (!flight || flight.token !== token) {
+        const promise2 = Promise.resolve(token).then(refresh).then((refreshed) => {
+          saveSession(refreshed, home);
+          return refreshed.access_token;
+        }).finally(() => {
+          if (refreshing?.token === token) refreshing = null;
+        });
+        flight = { token, promise: promise2 };
+        refreshing = flight;
+      }
+      return flight.promise;
     }
   };
   return auth;
@@ -18949,6 +18970,23 @@ function openBrowser(url2) {
   child.unref();
 }
 
+// ../../packages/sdk/src/insights.ts
+var SPEED_INSIGHTS_METRICS = [
+  "lcp",
+  "inp",
+  "cls",
+  "fcp",
+  "ttfb"
+];
+var SPEED_INSIGHTS_FILTER_KEYS = [
+  "path",
+  "country",
+  "device",
+  "browser",
+  "os"
+];
+var SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES = 20;
+
 // ../../packages/sdk/src/types.ts
 var TERMINAL_DEPLOYMENT_STATUSES = [
   "READY",
@@ -19039,6 +19077,10 @@ var NaroClient = class {
   logs;
   db;
   backend;
+  storage;
+  insights;
+  analytics;
+  protection;
   constructor(options) {
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
@@ -19053,6 +19095,10 @@ var NaroClient = class {
     this.logs = new LogsApi(this);
     this.db = new DbApi(this);
     this.backend = new BackendApi(this);
+    this.storage = new StorageApi(this);
+    this.insights = new InsightsApi(this);
+    this.analytics = new AnalyticsApi(this);
+    this.protection = new ProtectionApi(this);
   }
   async request(path, options) {
     const token = await this.getAccessToken();
@@ -19323,16 +19369,16 @@ var EnvApi = class {
     );
   }
   /** Removes every row for a key (optionally narrowed to one target). */
-  async remove(projectId, key, target) {
+  async remove(projectId, key, target2) {
     const rows = await this.list(projectId);
     const matches = rows.filter(
-      (row) => row.key === key && (target === void 0 || row.target === target)
+      (row) => row.key === key && (target2 === void 0 || row.target === target2)
     );
     if (matches.length === 0) {
       throw new NaroError(
         "ENV_NOT_FOUND",
-        target ? `No ${key} variable found for the ${target} environment.` : `No ${key} variable found.`,
-        { details: { key, ...target ? { target } : {} } }
+        target2 ? `No ${key} variable found for the ${target2} environment.` : `No ${key} variable found.`,
+        { details: { key, ...target2 ? { target: target2 } : {} } }
       );
     }
     for (const row of matches) await this.removeById(projectId, row.id);
@@ -19460,6 +19506,140 @@ var LogsApi = class {
     return body.entries;
   }
 };
+function appendFilters(params, keys, filters) {
+  if (!filters) return;
+  for (const key of keys) {
+    const value = filters[key];
+    if (value) params.set(key, value);
+  }
+}
+function insightsQuery(options) {
+  const params = new URLSearchParams();
+  if (options.range !== void 0) params.set("range", options.range);
+  if (options.metric !== void 0) params.set("metric", options.metric);
+  if (options.environment !== void 0) params.set("env", options.environment);
+  if (options.route !== void 0) params.set("route", options.route);
+  appendFilters(params, SPEED_INSIGHTS_FILTER_KEYS, options.filters);
+  const text2 = params.toString();
+  return text2 ? `?${text2}` : "";
+}
+var InsightsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(projectId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/speed-insights`;
+  }
+  /** The five metrics' summary, and the trend, pages, devices, browsers, operating systems, countries and elements of one. */
+  async report(projectId, options = {}) {
+    return this.client.request(
+      `${this.base(projectId)}${insightsQuery(options)}`,
+      { context: "Read Speed Insights" }
+    );
+  }
+  /** The paths opened under one route, such as /posts/[id]. */
+  async paths(projectId, options) {
+    return this.client.request(
+      `${this.base(projectId)}/paths${insightsQuery(options)}`,
+      { context: "Read Speed Insights paths" }
+    );
+  }
+  /**
+   * The selected metric for each deployment of the chosen environment
+   * (`options.environment`, production by default), newest first.
+   */
+  async deployments(projectId, options = {}) {
+    return this.client.request(
+      `${this.base(projectId)}/deployments${insightsQuery(options)}`,
+      { context: "Read Speed Insights deployments" }
+    );
+  }
+  /**
+   * The report and the deployments, read side by side. Only the report's
+   * failure fails it: deployments that could not be read come back null,
+   * with the reason, as the dashboard keeps the rest of the panel.
+   */
+  async overview(projectId, options = {}) {
+    const [report, deployments] = await Promise.allSettled([
+      this.report(projectId, options),
+      this.deployments(projectId, options)
+    ]);
+    if (report.status === "rejected") throw report.reason;
+    if (deployments.status === "fulfilled" && Array.isArray(deployments.value.deployments))
+      return {
+        report: report.value,
+        deployments: deployments.value.deployments,
+        deploymentsError: null
+      };
+    const error51 = deployments.status === "fulfilled" ? new NaroError(
+      "INTERNAL_ERROR",
+      "Read Speed Insights deployments failed: the control plane answered without a list of deployments."
+    ) : isNaroError(deployments.reason) ? deployments.reason : toNaroError(deployments.reason);
+    return {
+      report: report.value,
+      deployments: null,
+      deploymentsError: { code: error51.code, message: error51.message }
+    };
+  }
+  /** On or off. The answer is what the row says after the write. */
+  async setEnabled(projectId, enabled) {
+    return this.client.request(this.base(projectId), {
+      method: "PUT",
+      body: { enabled },
+      context: enabled ? "Turn on Speed Insights" : "Turn off Speed Insights"
+    });
+  }
+};
+var AnalyticsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** Visitors, page views, the trend, and the pages, referrers, countries, devices, browsers and operating systems behind them. */
+  async report(projectId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.range !== void 0) params.set("range", options.range);
+    appendFilters(params, ANALYTICS_FILTER_KEYS, options.filters);
+    const text2 = params.toString();
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/analytics${text2 ? `?${text2}` : ""}`,
+      { context: "Read Analytics" }
+    );
+  }
+};
+var ProtectionApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(projectId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/preview-protection`;
+  }
+  async get(projectId) {
+    return this.client.request(this.base(projectId), {
+      context: "Read preview protection"
+    });
+  }
+  /** On or off. The edge picks it up within about a minute. */
+  async set(projectId, enabled) {
+    return this.client.request(this.base(projectId), {
+      method: "PUT",
+      body: { enabled },
+      context: enabled ? "Turn on preview protection" : "Turn off preview protection"
+    });
+  }
+  /** A new bypass secret, replacing any earlier one. Shown once. */
+  async createBypass(projectId) {
+    return this.client.request(
+      `${this.base(projectId)}/bypass`,
+      { method: "POST", context: "Create a preview bypass secret" }
+    );
+  }
+  async removeBypass(projectId) {
+    return this.client.request(
+      `${this.base(projectId)}/bypass`,
+      { method: "DELETE", context: "Remove the preview bypass secret" }
+    );
+  }
+};
 var EXPORT_FIRST_POLL_MS = 1e3;
 var EXPORT_MAX_POLL_MS = 5e3;
 var EXPORT_TIMEOUT_MS = 15 * 6e4;
@@ -19549,8 +19729,8 @@ var DbApi = class {
    * the migration ledger alike - and cancels queries in flight. Restoring to
    * `previousBookmark` undoes it.
    */
-  async restore(projectId, target) {
-    const given = target;
+  async restore(projectId, target2) {
+    const given = target2;
     const body = await this.client.request(
       this.path(projectId, "/restore"),
       {
@@ -19716,6 +19896,39 @@ async function authChange(answer) {
   }
   return { auth: authConfig(body.auth), backend: backendInfo(body.backend) };
 }
+function storageBucket(body) {
+  return {
+    name: body.name,
+    public: body.public,
+    fileSizeLimit: body.fileSizeLimit ?? null,
+    allowedMimeTypes: body.allowedMimeTypes ?? null,
+    objects: body.objects,
+    bytes: body.bytes,
+    createdAt: body.createdAt,
+    updatedAt: body.updatedAt,
+    deletingAt: body.deletingAt ?? null
+  };
+}
+function storageInfo(body) {
+  return {
+    enabled: body.enabled,
+    bucket: body.bucket ?? null,
+    limits: {
+      bytes: body.limits.bytes,
+      objectBytes: body.limits.objectBytes,
+      singleUploadBytes: body.limits.singleUploadBytes,
+      dailyOps: body.limits.dailyOps ?? null
+    },
+    usage: body.usage ? { bytes: body.usage.bytes, objects: body.usage.objects } : null,
+    today: body.today ?? null,
+    buckets: (body.buckets ?? []).map(storageBucket)
+  };
+}
+function bucketFields(fields, into = {}) {
+  for (const key of ["public", "fileSizeLimit", "allowedMimeTypes"])
+    if (fields[key] !== void 0) into[key] = fields[key];
+  return into;
+}
 var BackendApi = class {
   constructor(client) {
     this.client = client;
@@ -19880,10 +20093,10 @@ var BackendApi = class {
     );
   }
   /** Removes email or one provider; the same answer as `setAuth`. */
-  async removeAuth(projectId, target) {
+  async removeAuth(projectId, target2) {
     return authChange(
       this.client.request(
-        this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
+        this.path(projectId, `/auth?target=${encodeURIComponent(target2)}`),
         {
           method: "DELETE",
           context: "Change sign-in settings",
@@ -20054,6 +20267,193 @@ var BackendApi = class {
     return `/rls/policies/${encodeURIComponent(table)}/${encodeURIComponent(name)}`;
   }
 };
+var LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var StorageApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/backend/storage${suffix}`;
+  }
+  /**
+   * `encodeURIComponent` leaves `.` and `..` as they are and URL parsing
+   * folds them (`/buckets/..` is `…/backend/storage` itself), an empty
+   * name is the collection, and `encodeURIComponent` throws on a lone
+   * surrogate ("URI malformed", which surfaced as INTERNAL_ERROR — PR #90
+   * review 1): refused here, in naro-js's words for a name no URL can carry
+   * (its `encodeBucket`). No bucket can have one of them.
+   */
+  bucketPath(projectId, bucket, suffix = "") {
+    if (bucket === "" || bucket === "." || bucket === ".." || LONE_SURROGATE.test(bucket))
+      throw new NaroError("INVALID_PATH", "The bucket name is not valid.");
+    return this.path(
+      projectId,
+      `/buckets/${encodeURIComponent(bucket)}${suffix}`
+    );
+  }
+  /**
+   * Whether Storage is on, its R2 bucket, the limits its worker enforces,
+   * what is stored and the buckets. A project that never turned it on answers
+   * `enabled: false` with no buckets.
+   */
+  async info(projectId) {
+    const body = await this.client.request(
+      this.path(projectId),
+      { context: "Read storage" }
+    );
+    return storageInfo(body.storage);
+  }
+  /**
+   * Turns Storage on: the project's R2 bucket (named after the project, so
+   * a repeat finds it), the Naro worker uploaded again with its binding,
+   * the plan's limits recorded and bound with it — again after a plan
+   * change. Safe to repeat, and a repair. The project must have a backend,
+   * turned on, with its database. A backend in `error` or with a run that
+   * stalled is not refused: its provisioning is resumed on the way (with
+   * the bucket's binding). Two minutes, like `backend.enable`.
+   *
+   * Refusals, in the order they are checked: `BACKEND_DISABLED` (the
+   * control plane's backend switch, before the role), `FORBIDDEN`,
+   * `STORAGE_DISABLED` (the control plane's Storage switch),
+   * `DATABASE_NOT_ENABLED` (the project's database is external),
+   * `BACKEND_NOT_READY` (409, only when the project has no backend at all),
+   * `BACKEND_OFF`, `BACKEND_BUSY`, `STORAGE_ENABLE_FAILED` (502: the R2
+   * bucket could not be made — or, on a project that has Storage already, a
+   * plan change's new limits could not be saved; nothing changed), and
+   * `BACKEND_PROVISION_FAILED` (502) when Storage is recorded as on but the
+   * worker's upload stopped. The last one's `details` hold a
+   * `StorageProvisionFailure` — `{ storage: { applied: false, enabled: true
+   * }, backend }`, the backend read like `backend.info` — and `enable`
+   * again finishes.
+   *
+   * A 200 can come back while the backend is still `provisioning` — when
+   * another run (the stall sweep) took the work over before this one
+   * finished. Then `usage` is `null` (it is summed only on a ready backend);
+   * `backend.info` says how far the run got.
+   */
+  async enable(projectId) {
+    let body;
+    try {
+      body = await this.client.request(
+        this.path(projectId),
+        {
+          method: "POST",
+          context: "Turn on Storage",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      );
+    } catch (error51) {
+      const details = isNaroError(error51) ? error51.details : void 0;
+      if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
+        throw new NaroError(error51.code, error51.message, {
+          ...error51.status !== void 0 ? { status: error51.status } : {},
+          details: {
+            ...details,
+            backend: backendInfo(details.backend)
+          }
+        });
+      throw error51;
+    }
+    return storageInfo(body.storage);
+  }
+  /** Every bucket, by name. `[]` where there can be none (Storage not on). */
+  async listBuckets(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/buckets"),
+      { context: "List buckets" }
+    );
+    return (body.buckets ?? []).map(storageBucket);
+  }
+  /**
+   * Makes a bucket. `BUCKET_EXISTS` (409) for a taken name, `BUCKET_LIMIT`
+   * (400) past 100 buckets, `STORAGE_NOT_ENABLED` (409) before `enable`; a
+   * name, limit or type list the control plane does not accept is
+   * `VALIDATION_FAILED` with its reason.
+   */
+  async createBucket(projectId, input) {
+    const body = await this.client.request(
+      this.path(projectId, "/buckets"),
+      {
+        method: "POST",
+        body: bucketFields(input, { name: input.name }),
+        context: "Create a bucket"
+      }
+    );
+    return storageBucket(body.bucket);
+  }
+  /** One bucket; `BUCKET_NOT_FOUND` (404) when there is none of that name. */
+  async getBucket(projectId, bucket) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket),
+      { context: "Read a bucket" }
+    );
+    return storageBucket(body.bucket);
+  }
+  /**
+   * Changes the fields given and returns the bucket as stored. `{}` is
+   * `VALIDATION_FAILED` "Set at least one of public, fileSizeLimit or
+   * allowedMimeTypes." A bucket cannot be renamed.
+   */
+  async updateBucket(projectId, bucket, patch) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket),
+      {
+        method: "PATCH",
+        body: bucketFields(patch),
+        context: "Change a bucket"
+      }
+    );
+    return storageBucket(body.bucket);
+  }
+  /**
+   * Removes a bucket. Without `empty` only an empty one goes
+   * (`BUCKET_NOT_EMPTY`, 409 — its message names the `empty: true` form:
+   * a row whose bytes never reached R2, like a dead upload's, outlives
+   * `emptyBucket`, and only this removal clears it), and that works while
+   * the backend is off. With
+   * `empty: true` the bucket is closed to new objects, emptied through the
+   * project's Naro worker and then removed (the backend must be on and
+   * ready; `BACKEND_UNAVAILABLE` if the worker cannot be reached): `{ ok:
+   * true }` once it is gone, or, for a bucket too big for one call
+   * (answered 202), where it stopped — the same call again goes on. The
+   * emptying form waits two minutes like `enable`: the control plane stops
+   * starting pages after 20 s, but a last one can run 25 s more, plus the
+   * calls that mark and delete the bucket, which would not fit 45 s.
+   */
+  async removeBucket(projectId, bucket, options = {}) {
+    const body = await this.client.request(
+      this.bucketPath(
+        projectId,
+        bucket,
+        options.empty === true ? "?empty=true" : ""
+      ),
+      {
+        method: "DELETE",
+        context: "Remove a bucket",
+        ...options.empty === true ? { timeoutMs: PROVISION_TIMEOUT_MS } : {}
+      }
+    );
+    if (body.done === false)
+      return {
+        deleted: body.deleted ?? 0,
+        done: false,
+        ...typeof body.message === "string" ? { message: body.message } : {}
+      };
+    return { ok: true };
+  }
+  /**
+   * Deletes up to 1,000 of the bucket's objects through the project's Naro
+   * worker, which must be reachable (the backend on and ready). Ask again
+   * until `done`.
+   */
+  async emptyBucket(projectId, bucket) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/empty"),
+      { method: "POST", context: "Empty a bucket" }
+    );
+    return { deleted: body.deleted, done: body.done };
+  }
+};
 
 // ../../packages/sdk/src/database.ts
 var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
@@ -20399,6 +20799,105 @@ function detectFramework2(dir) {
   };
 }
 
+// ../../packages/data-core/src/storage-path.ts
+var MAX_SINGLE_UPLOAD_BYTES = 52428800;
+var STORAGE_RESERVED_WORDS = [
+  "authenticated",
+  "copy",
+  "info",
+  "list",
+  "move",
+  "public",
+  "render",
+  "sign",
+  "upload"
+];
+var RESERVED = new Set(STORAGE_RESERVED_WORDS);
+var ENCODER = new TextEncoder();
+var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var LONE_SURROGATES = new RegExp(LONE_SURROGATE2.source, "g");
+function objectParent(name) {
+  const slash = name.lastIndexOf("/");
+  return slash < 0 ? "" : name.slice(0, slash);
+}
+var TOKEN_CHARACTERS = "[!#$%&'*+\\-.^_`|~0-9A-Za-z]";
+var TOKEN = new RegExp(`^${TOKEN_CHARACTERS}+$`);
+var MEDIA_TYPE = new RegExp(`^${TOKEN_CHARACTERS}+/${TOKEN_CHARACTERS}+$`);
+var DEFAULT_MAX_AGE = 3600;
+var MAX_MAX_AGE = 31536e3;
+function parseCacheControl(header) {
+  if (header === null) return { ok: true, maxAge: DEFAULT_MAX_AGE };
+  const match = /^[ \t]*max-age=(\d{1,8})[ \t]*$/i.exec(header);
+  if (match?.[1] === void 0) return { ok: false };
+  const maxAge = Number(match[1]);
+  return maxAge <= MAX_MAX_AGE ? { ok: true, maxAge } : { ok: false };
+}
+var MAX_NAME_IN_MESSAGE = 256;
+function storageName(text2) {
+  if (text2.length <= MAX_NAME_IN_MESSAGE) return text2;
+  const cut = text2.slice(0, MAX_NAME_IN_MESSAGE);
+  const last = cut.charCodeAt(MAX_NAME_IN_MESSAGE - 1);
+  return last >= 55296 && last <= 56319 ? cut.slice(0, MAX_NAME_IN_MESSAGE - 1) : cut;
+}
+
+// ../../packages/data-core/src/storage-table.ts
+var STORAGE_OBJECTS = "storage.objects";
+var STORAGE_OBJECTS_TABLE = "_naro_storage_objects";
+var STORAGE_OBJECTS_QUALIFIER = "objects";
+var STORAGE_UNAVAILABLE_MESSAGE = "storage.objects is not available on this backend yet. Run `naro backend enable` to update it.";
+var STORAGE_BUCKETS_TABLE = "_naro_storage_buckets";
+var STORAGE_POLICY_COLUMNS = [
+  "id",
+  "bucket_id",
+  "name",
+  "owner",
+  "owner_id",
+  "metadata",
+  "version",
+  "created_at",
+  "updated_at"
+];
+var STORAGE_TABLES_SQL = [
+  `CREATE TABLE IF NOT EXISTS _naro_storage_buckets (
+  id                 TEXT PRIMARY KEY,
+  public             INTEGER NOT NULL DEFAULT 0 CHECK (public IN (0, 1)),
+  file_size_limit    INTEGER CHECK (file_size_limit IS NULL OR file_size_limit > 0),
+  allowed_mime_types TEXT,
+  object_count       INTEGER NOT NULL DEFAULT 0,
+  total_bytes        INTEGER NOT NULL DEFAULT 0,
+  created_at         TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at         TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+)`,
+  `CREATE TABLE IF NOT EXISTS _naro_storage_objects (
+  id              TEXT PRIMARY KEY,
+  bucket_id       TEXT NOT NULL REFERENCES _naro_storage_buckets (id),
+  name            TEXT NOT NULL,
+  owner           TEXT,
+  owner_id        TEXT,
+  metadata        TEXT,
+  version         TEXT,
+  created_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  parent          TEXT NOT NULL,
+  size            INTEGER NOT NULL,
+  status          TEXT NOT NULL CHECK (status IN ('uploading', 'ready', 'deleting')),
+  lock_id         TEXT,
+  lock_expires_at TEXT,
+  pending         TEXT,
+  UNIQUE (bucket_id, name)
+)`,
+  "CREATE INDEX IF NOT EXISTS _naro_storage_objects_parent ON _naro_storage_objects (bucket_id, parent, name)",
+  "CREATE INDEX IF NOT EXISTS _naro_storage_objects_lock ON _naro_storage_objects (lock_expires_at) WHERE lock_expires_at IS NOT NULL",
+  "CREATE TRIGGER IF NOT EXISTS _naro_storage_objects_count_insert AFTER INSERT ON _naro_storage_objects BEGIN UPDATE _naro_storage_buckets SET object_count = object_count + 1, total_bytes = total_bytes + NEW.size WHERE id = NEW.bucket_id; END",
+  "CREATE TRIGGER IF NOT EXISTS _naro_storage_objects_count_delete AFTER DELETE ON _naro_storage_objects BEGIN UPDATE _naro_storage_buckets SET object_count = object_count - 1, total_bytes = total_bytes - OLD.size WHERE id = OLD.bucket_id; END",
+  "CREATE TRIGGER IF NOT EXISTS _naro_storage_objects_count_size AFTER UPDATE OF size ON _naro_storage_objects BEGIN UPDATE _naro_storage_buckets SET total_bytes = total_bytes + NEW.size - OLD.size WHERE id = NEW.bucket_id; END"
+];
+var STORAGE_BUCKET_DELETING_COLUMN = {
+  table: STORAGE_BUCKETS_TABLE,
+  column: "deleting_at",
+  definition: "TEXT"
+};
+
 // ../../packages/data-core/src/system-tables.ts
 var SYSTEM_TABLE_PREFIXES = [
   "_naro_",
@@ -20434,6 +20933,7 @@ var SYSTEM_TABLE_SQL_PREDICATE = systemTablePredicate("name");
 
 // ../../packages/data-core/src/errors.ts
 var DATABASE_FULL_MESSAGE = "The database has reached D1's 10 GB limit, which cannot be raised. Delete data to free space; writes fail until it is under the limit.";
+var STORAGE_MIGRATION_PENDING_MESSAGE = "The project backend is partway through an update. Run `naro backend enable` to finish it, then try again.";
 var CATALOG = {
   INVALID_API_KEY: {
     status: 401,
@@ -20517,9 +21017,9 @@ var CATALOG = {
       if (recursion)
         return `Infinite recursion detected in policy for relation ${table}.`;
       if (values)
-        return `The policies of ${table} bind more than 50 values in one statement.`;
+        return `The policies of ${table} bind more than ${values === true ? "50" : String(values)} values in one statement.`;
       if (bytes)
-        return `The policies of ${table} write more than 50000 bytes of SQL into one statement.`;
+        return `The policies of ${table} write more than ${bytes === true ? "50000" : String(bytes)} bytes of SQL into one statement.`;
       if (policy !== void 0)
         return `Policy ${policy} on ${table} cannot be applied.`;
       return condition ? `The ${action} policy of ${table} has a condition that cannot be applied.` : `The ${action} policy of ${table} is owner but has no valid owner column.`;
@@ -20539,6 +21039,87 @@ var CATALOG = {
   DATABASE_FULL: {
     status: 507,
     message: () => DATABASE_FULL_MESSAGE
+  },
+  // Naro Storage (3-1a, first-release design §10). A path, a bucket or a type
+  // is the caller's own text, so each is cut to 256 characters in the message
+  // (storageName); nothing is shortened in `details`.
+  INVALID_PATH: {
+    status: 400,
+    message: (vars) => "bucket" in vars ? "The bucket name is not valid." : `The object path is not valid: it ${vars.reason}.`
+  },
+  STORAGE_NOT_ENABLED: {
+    status: 404,
+    message: () => "Storage is not enabled for this project."
+  },
+  BUCKET_NOT_FOUND: {
+    status: 404,
+    message: ({ bucket }) => `Bucket ${storageName(bucket)} was not found.`
+  },
+  OBJECT_NOT_FOUND: {
+    status: 404,
+    message: ({ bucket, path }) => `Object ${storageName(path)} was not found in bucket ${storageName(bucket)}.`
+  },
+  INVALID_CONTENT_TYPE: {
+    status: 400,
+    message: ({ type }) => `Content-Type ${storageName(type)} is not a media type like image/png.`
+  },
+  INVALID_REQUEST: {
+    status: 400,
+    message: () => "The storage request is not valid."
+  },
+  LENGTH_REQUIRED: {
+    status: 411,
+    message: () => "Uploads need a Content-Length header."
+  },
+  OBJECT_TOO_LARGE: {
+    status: 413,
+    message: (vars) => "single" in vars ? "Uploads over 50 MiB are not supported yet." : `The object is ${String(vars.size)} bytes; bucket ${storageName(vars.bucket)} takes objects up to ${String(vars.max)} bytes.`
+  },
+  MIME_TYPE_NOT_ALLOWED: {
+    status: 415,
+    message: ({ bucket, type }) => `Bucket ${storageName(bucket)} does not take ${storageName(type)} objects.`
+  },
+  RANGE_NOT_SATISFIABLE: {
+    status: 416,
+    message: ({ size }) => `The range is outside the object's ${String(size)} bytes.`
+  },
+  OBJECT_EXISTS: {
+    status: 409,
+    message: ({ bucket, path }) => `Object ${storageName(path)} already exists in bucket ${storageName(bucket)}. Upload with upsert to replace it.`
+  },
+  OBJECT_BUSY: {
+    status: 409,
+    message: ({ bucket, path }) => `Object ${storageName(path)} in bucket ${storageName(bucket)} is being changed by another request. Try again shortly.`
+  },
+  INVALID_SIGNATURE: {
+    status: 400,
+    message: () => "The signed URL is not valid."
+  },
+  SIGNED_URL_EXPIRED: {
+    status: 400,
+    message: () => "The signed URL has expired."
+  },
+  OBJECT_RATE_LIMITED: {
+    status: 429,
+    message: ({ path }) => `Object ${storageName(path)} was written less than a second ago. Try again in a second.`
+  },
+  // 507 like DATABASE_FULL: no retry helps until objects are deleted. Reads
+  // and deletes still work.
+  STORAGE_QUOTA_EXCEEDED: {
+    status: 507,
+    message: () => "This project has used all of its storage. Delete objects to free space; uploads fail until then."
+  },
+  // R2 or its binding did not answer; the original error is logged, never sent.
+  STORAGE_UNAVAILABLE: {
+    status: 503,
+    message: () => "The storage backend did not answer. Try again."
+  },
+  // Storage 3-1c (known-issues #114): see ErrorVars. 409 like the control
+  // plane's BACKEND_OUTDATED: nothing the caller sent is wrong, and it
+  // clears once the run finishes.
+  BACKEND_OUTDATED: {
+    status: 409,
+    message: () => STORAGE_MIGRATION_PENDING_MESSAGE
   }
 };
 function dataError(code, ...args) {
@@ -20555,6 +21136,9 @@ function dataError(code, ...args) {
 function invalidQuery(path, reason) {
   return dataError("INVALID_QUERY", void 0, { path, reason });
 }
+var STORAGE_MIGRATION_PENDING = new RegExp(
+  `^no such column: (?:b\\.|${STORAGE_BUCKET_DELETING_COLUMN.table}\\.)?${STORAGE_BUCKET_DELETING_COLUMN.column}\\b`
+);
 
 // ../../packages/data-core/src/d1.ts
 function rowsOf(result) {
@@ -20958,7 +21542,8 @@ var SCHEMA_SQL = [
   // alone a column's collation is written. A separate statement, so the
   // text comes once per table rather than once per column. D1 answers
   // `sqlite_master` reads (the database routes' `_tables.ts` reads it too).
-  `SELECT name AS table_name, sql AS table_sql FROM sqlite_master WHERE type = 'table' AND ${systemTablePredicate("name")}`
+  `SELECT name AS table_name, sql AS table_sql FROM sqlite_master WHERE type = 'table' AND ${systemTablePredicate("name")}`,
+  `SELECT c.cid AS storage_cid, c.name AS storage_column, c.type AS storage_type, c."notnull" AS storage_not_null, c.dflt_value AS storage_default, c.pk AS storage_pk, CASE WHEN c.cid = 0 THEN (SELECT sql FROM sqlite_master WHERE type = 'table' AND name = '${STORAGE_OBJECTS_TABLE}') END AS storage_sql FROM pragma_table_xinfo('${STORAGE_OBJECTS_TABLE}') AS c ORDER BY c.cid`
 ];
 var TABLE_NAMES_SQL = `SELECT name AS table_name FROM pragma_table_list WHERE schema = 'main' AND type IN ('table', 'virtual') AND ${systemTablePredicate("name")}`;
 function tableNamesFromRows(rows) {
@@ -20987,7 +21572,8 @@ function snapshotFromRows(rows) {
     if (Object.hasOwn(row, "table_sql") && typeof row.table_name === "string")
       ddl.set(row.table_name, row.table_sql);
   for (const row of rows) {
-    if (Object.hasOwn(row, "table_sql")) continue;
+    if (Object.hasOwn(row, "table_sql") || Object.hasOwn(row, "storage_column"))
+      continue;
     const tableName = text(row.table_name);
     const kind = row.table_type;
     if (tableName === "" || kind !== "table" && kind !== "virtual") continue;
@@ -21038,11 +21624,54 @@ function snapshotFromRows(rows) {
       sql: table.kind === "table" && typeof sql === "string" ? sql : null
     });
   }
-  return { tables };
+  const storage = storageFromRows(rows);
+  return storage ? { tables, storage } : { tables };
+}
+var STORAGE_POLICY_COLUMN_SET = new Set(
+  STORAGE_POLICY_COLUMNS
+);
+function storageFromRows(rows) {
+  const storageRows = rows.filter(
+    (row) => Object.hasOwn(row, "storage_column")
+  );
+  const columns = [];
+  for (const row of storageRows) {
+    const name = text(row.storage_column);
+    if (!STORAGE_POLICY_COLUMN_SET.has(name)) continue;
+    const defaultValue = row.storage_default;
+    columns.push({
+      name,
+      cid: integer2(row.storage_cid),
+      type: text(row.storage_type),
+      notNull: integer2(row.storage_not_null) === 1,
+      primaryKey: integer2(row.storage_pk),
+      defaultValue: defaultValue === null || defaultValue === void 0 ? null : String(defaultValue),
+      generated: false,
+      collation: "BINARY"
+    });
+  }
+  if (columns.length === 0) return void 0;
+  const sorted2 = columns.toSorted((left, right) => left.cid - right.cid);
+  const sql = storageRows.find(
+    (row) => integer2(row.storage_cid) === 0
+  )?.storage_sql;
+  return {
+    name: STORAGE_OBJECTS_TABLE,
+    kind: "table",
+    columns: sorted2,
+    byName: new Map(sorted2.map((column2) => [asciiLower(column2.name), column2])),
+    sql: typeof sql === "string" ? sql : null
+  };
 }
 function resolveTable(snapshot, name) {
   if (isSystemTable(name)) return void 0;
-  return snapshot.tables.get(asciiLower(name));
+  const folded = asciiLower(name);
+  if (folded === STORAGE_OBJECTS) return void 0;
+  return snapshot.tables.get(folded);
+}
+function resolvePolicyTable(snapshot, name) {
+  if (asciiLower(name) === STORAGE_OBJECTS) return snapshot.storage;
+  return resolveTable(snapshot, name);
 }
 async function readTableNames(db) {
   return tableNamesFromRows(rowsOf(await db.prepare(TABLE_NAMES_SQL).all()));
@@ -21119,15 +21748,15 @@ function patternTooLong(pattern, caseInsensitive) {
   if (pattern.length > MAX_PATTERN_BYTES * 2) return true;
   return utf8ByteLength(boundPattern(pattern, caseInsensitive)) > MAX_PATTERN_BYTES;
 }
-function isBoolean(target, value) {
-  return `coalesce(CAST(${target} AS NUMERIC) ${value ? "<>" : "="} 0, 0)`;
+function isBoolean(target2, value) {
+  return `coalesce(CAST(${target2} AS NUMERIC) ${value ? "<>" : "="} 0, 0)`;
 }
-var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+var LONE_SURROGATE3 = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 function distinctArrayValues(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const item of values) {
-    const bound = typeof item === "string" ? item.replace(LONE_SURROGATE, "\uFFFD") : item;
+    const bound = typeof item === "string" ? item.replace(LONE_SURROGATE3, "\uFFFD") : item;
     const key = `${typeof bound}:${String(bound)}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -21137,12 +21766,12 @@ function distinctArrayValues(values) {
 }
 var MAX_ARRAY_TEXT_LENGTH = 65536;
 var ELEMENT = "_naro_j";
-function arraySql(target, operator, count2, bind2, nullElement = false) {
-  const isNull = target();
-  const length = target();
-  const valid = target();
-  const type = target();
-  const each = () => `json_each(${target()}) AS ${ELEMENT}`;
+function arraySql(target2, operator, count2, bind2, nullElement = false) {
+  const isNull = target2();
+  const length = target2();
+  const valid = target2();
+  const type = target2();
+  const each = () => `json_each(${target2()}) AS ${ELEMENT}`;
   const element = `${ELEMENT}.value`;
   const list = () => `(${Array.from({ length: count2 }, bind2).join(", ")})`;
   let test;
@@ -21253,13 +21882,16 @@ var POLICY_FUNCTIONS = [
   "coalesce",
   "now"
 ];
+var STORAGE_HELPERS = ["foldername", "filename", "extension"];
+var MAX_FOLDERNAME_INDEX = 16;
 var VALUE_KINDS = /* @__PURE__ */ new Set([
   "literal",
   "column",
   "auth",
   "jwt",
   "func",
-  "cast"
+  "cast",
+  "storage"
 ]);
 function isValueExpr(expr) {
   return VALUE_KINDS.has(expr.kind);
@@ -21269,7 +21901,7 @@ function isConditionExpr(expr) {
   if (expr.kind === "column") return true;
   return expr.kind === "literal" && (expr.value === null || typeof expr.value === "boolean");
 }
-var RESERVED = /* @__PURE__ */ new Set([
+var RESERVED2 = /* @__PURE__ */ new Set([
   "all",
   "and",
   "array",
@@ -21309,12 +21941,20 @@ var CLAUSE_WORDS = /* @__PURE__ */ new Set([
   "cross"
 ]);
 var SPECIAL_WORDS = /* @__PURE__ */ new Set([
-  ...RESERVED,
+  ...RESERVED2,
   ...CLAUSE_WORDS,
   "symmetric",
   "auth"
 ]);
 var TEXT_TYPES = /* @__PURE__ */ new Set(["text", "varchar", "uuid"]);
+var STORAGE_SUBQUERY_PROBLEM = "A policy cannot read storage.objects in a subquery yet";
+var FOLDERNAME_INDEX_PROBLEM = `storage.foldername(name) is available only as (storage.foldername(name))[n] with n from 1 to ${String(MAX_FOLDERNAME_INDEX)}`;
+function storageHelperColumnProblem(fn) {
+  return `storage.${fn}() takes the name column of storage.objects`;
+}
+function quotedStorageObjectsProblem(written) {
+  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Storage: write storage.objects, without quotes, for Storage's objects`;
+}
 function count(state, token) {
   if (++state.nodes > MAX_EXPRESSION_NODES)
     throw new PolicySyntaxError(
@@ -21361,6 +22001,10 @@ function truthProblem(operand) {
         case "now":
           return "now() is a time: compare it, created_at < now()";
       }
+    case "storage": {
+      const call = operand.fn === "foldername" ? "(storage.foldername(\u2026))[n]" : `storage.${operand.fn}(\u2026)`;
+      return `${call} ${text2}: compare it with text, ${call} = 'true'`;
+    }
   }
 }
 function truthTestProblem(operand) {
@@ -21380,6 +22024,7 @@ function isTextValue(value) {
     case "auth":
     case "jwt":
     case "cast":
+    case "storage":
       return true;
     case "func":
       return value.name !== "length" && value.name !== "coalesce";
@@ -21724,7 +22369,7 @@ function readSubquery(state, start, kind) {
   }
 }
 function isReservedWord(token) {
-  return token.kind === "ident" && !token.quoted && (RESERVED.has(asciiLower(token.value)) || CLAUSE_WORDS.has(asciiLower(token.value)));
+  return token.kind === "ident" && !token.quoted && (RESERVED2.has(asciiLower(token.value)) || CLAUSE_WORDS.has(asciiLower(token.value)));
 }
 function readIdentifier(stream, what) {
   const token = stream.peek();
@@ -21736,16 +22381,40 @@ function readIdentifier(stream, what) {
   stream.next();
   return token.value;
 }
+function isName(token, word) {
+  return token.kind === "ident" && (token.quoted ? token.value === word : asciiLower(token.value) === word);
+}
+function atStorageObjects(stream) {
+  return isName(stream.peek(), "storage") && isOperator(stream.peek(1), ".") && isName(stream.peek(2), "objects");
+}
 function readTableName(stream) {
   const first = stream.peek();
-  const name = readIdentifier(stream, "a table name");
-  if (!stream.acceptOperator(".")) return name;
-  if (first.quoted ? name !== "public" : asciiLower(name) !== "public")
+  if (atStorageObjects(stream))
+    throw new PolicySyntaxError(STORAGE_SUBQUERY_PROBLEM, first.position);
+  let token = first;
+  let name = readIdentifier(stream, "a table name");
+  if (stream.acceptOperator(".")) {
+    if (first.quoted ? name !== "public" : asciiLower(name) !== "public")
+      throw new PolicySyntaxError(
+        `schema ${name} does not exist: naro's tables are in public`,
+        first.position
+      );
+    token = stream.peek();
+    name = readIdentifier(stream, "a table name");
+  }
+  if (asciiLower(name) === STORAGE_OBJECTS)
     throw new PolicySyntaxError(
-      `schema ${name} does not exist: naro's tables are in public`,
-      first.position
+      quotedStorageObjectsProblem(name),
+      token.position
     );
-  return readIdentifier(stream, "a table name");
+  return name;
+}
+function readPolicyTarget(stream) {
+  if (!atStorageObjects(stream)) return readTableName(stream);
+  stream.next();
+  stream.next();
+  stream.next();
+  return STORAGE_OBJECTS;
 }
 function readNumber(token, negative) {
   const value = Number(token.value) * (negative ? -1 : 1);
@@ -21883,11 +22552,18 @@ function readPrimary(state) {
         }
         const inner = readOr(state);
         stream.expectOperator(")");
+        if (!isOperator(stream.peek(), "[")) return inner;
+        if (inner.kind !== "storage" || inner.fn !== "foldername" || inner.index !== null)
+          return stream.unexpected();
+        inner.index = readFolderIndex(state);
+        if (isOperator(stream.peek(), "[")) return stream.unexpected();
         return inner;
       }
       return stream.unexpected(token);
     }
     case "ident": {
+      if (isName(token, "storage") && isOperator(stream.peek(), ".") && stream.peek(1).kind === "ident" && isOperator(stream.peek(2), "("))
+        return readStorageCall(state, token);
       if (!token.quoted) {
         const word = asciiLower(token.value);
         if (word === "true") return { kind: "literal", value: true };
@@ -21902,7 +22578,7 @@ function readPrimary(state) {
           return auth;
         }
         if (isOperator(stream.peek(), "(")) return readCall(state, token);
-        if (RESERVED.has(word)) return stream.unexpected(token);
+        if (RESERVED2.has(word)) return stream.unexpected(token);
       }
       if (isOperator(stream.peek(), ".")) {
         stream.next();
@@ -21923,14 +22599,72 @@ function readPrimary(state) {
       return stream.unexpected(token);
   }
 }
+function readStorageCall(state, start) {
+  const { stream } = state;
+  stream.next();
+  const name = stream.next();
+  const fn = STORAGE_HELPERS.find((helper) => isName(name, helper));
+  if (fn === void 0)
+    throw new PolicySyntaxError(
+      `function storage.${name.value} is not available in policies: use storage.foldername, storage.filename or storage.extension`,
+      start.position
+    );
+  stream.expectOperator("(");
+  const node = {
+    kind: "storage",
+    fn,
+    column: readNameColumn(state, fn),
+    index: null
+  };
+  if (fn === "foldername") state.foldernames.push({ node, token: start });
+  return node;
+}
+function readNameColumn(state, fn) {
+  const { stream } = state;
+  const first = stream.peek();
+  const identifier = (token) => token.kind === "ident" && (token.quoted || !isReservedWord(token));
+  const qualified = isOperator(stream.peek(1), ".");
+  const column2 = qualified ? stream.peek(2) : first;
+  const after = stream.peek(qualified ? 3 : 1);
+  const isColumn = identifier(first) && identifier(column2) && isName(column2, "name");
+  if (isColumn && after.kind === "eof") {
+    for (let index = qualified ? 3 : 1; index > 0; index--) stream.next();
+    stream.expectOperator(")");
+  }
+  if (!isColumn || !isOperator(after, ")"))
+    throw new PolicySyntaxError(storageHelperColumnProblem(fn), first.position);
+  count(state, first);
+  for (let index = qualified ? 4 : 2; index > 0; index--) stream.next();
+  return {
+    kind: "column",
+    qualifier: qualified ? first.value : null,
+    name: "name"
+  };
+}
+function readFolderIndex(state) {
+  const { stream } = state;
+  stream.next();
+  const token = stream.peek();
+  const index = token.kind === "number" && /^[0-9]+$/.test(token.value) ? Number(token.value) : Number.NaN;
+  if (!(index >= 1 && index <= MAX_FOLDERNAME_INDEX))
+    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, token.position);
+  stream.next();
+  count(state, token);
+  stream.expectOperator("]");
+  return index;
+}
 function readCall(state, name) {
   const { stream } = state;
   const word = asciiLower(name.value);
-  if (!POLICY_FUNCTIONS.includes(word))
+  if (!POLICY_FUNCTIONS.includes(word)) {
+    const first = stream.peek(1);
+    if (isName(first, "storage") && isOperator(stream.peek(2), ".") && isName(stream.peek(3), "foldername") && isOperator(stream.peek(4), "("))
+      throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, first.position);
     throw new PolicySyntaxError(
       `function ${name.value} is not available in policies: use lower, upper, coalesce, length or now`,
       name.position
     );
+  }
   stream.expectOperator("(");
   const args = [];
   if (!isOperator(stream.peek(), ")"))
@@ -21961,12 +22695,17 @@ function newState(stream) {
     depth: 0,
     subqueries: 0,
     subqueryDepth: 0,
-    arrays: 0
+    arrays: 0,
+    foldernames: []
   };
 }
 function readCondition(stream) {
   const token = stream.peek();
-  const expr = readOr(newState(stream));
+  const state = newState(stream);
+  const expr = readOr(state);
+  const bare = state.foldernames.find(({ node }) => node.index === null);
+  if (bare)
+    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, bare.token.position);
   return requireCondition(expr, token);
 }
 function checkExpressionSize(expr, position) {
@@ -22032,6 +22771,10 @@ function printValue(expr) {
       return expr.name === "now" ? "now()" : `${expr.name}(${expr.args.map(printValue).join(", ")})`;
     case "cast":
       return `(${printValue(expr.operand)})::text`;
+    case "storage": {
+      const call = `storage.${expr.fn}(${printValue(expr.column)})`;
+      return expr.index === null ? call : `(${call})[${String(expr.index)}]`;
+    }
   }
 }
 function printSubquery(subquery) {
@@ -22086,6 +22829,9 @@ function unqualifiedInSubquery(expr) {
       case "cast":
         value(node.operand, inside);
         return;
+      case "storage":
+        value(node.column, inside);
+        return;
       default:
         return;
     }
@@ -22220,9 +22966,12 @@ function policyShapeProblem(policy) {
     return `${command === "all" ? "An ALL" : "An UPDATE"} policy needs USING (\u2026), WITH CHECK (\u2026) or both.`;
   return void 0;
 }
+function policyTableSql(table) {
+  return asciiLower(table) === STORAGE_OBJECTS ? STORAGE_OBJECTS : quoteIdent(table);
+}
 function policySql(policy) {
   const parts = [
-    `CREATE POLICY ${quotePolicyName(policy.name)} ON ${quoteIdent(policy.table)}`
+    `CREATE POLICY ${quotePolicyName(policy.name)} ON ${policyTableSql(policy.table)}`
   ];
   if (!policy.permissive) parts.push("AS RESTRICTIVE");
   if (policy.command !== "all")
@@ -22991,6 +23740,9 @@ function storedSource(table, names, alias) {
     })
   };
 }
+function tableLabel(table) {
+  return table.name === STORAGE_OBJECTS_TABLE ? STORAGE_OBJECTS : table.name;
+}
 function missingColumnReason(name, tables) {
   return `column ${name} does not exist on ${tables.join(" or ")}`;
 }
@@ -23008,7 +23760,7 @@ function resolveColumn(env, ref) {
       if (!column2)
         return blamed(
           env,
-          `column ${ref.qualifier}.${ref.name} does not exist: ${source.table.name} has no column ${ref.name}`
+          `column ${ref.qualifier}.${ref.name} does not exist: ${tableLabel(source.table)} has no column ${ref.name}`
         );
       return { source, column: column2 };
     }
@@ -23028,7 +23780,7 @@ function resolveColumn(env, ref) {
     env,
     missingColumnReason(
       ref.name,
-      env.scopes.map((source) => source.table.name)
+      env.scopes.map((source) => tableLabel(source.table))
     )
   );
 }
@@ -23068,7 +23820,47 @@ function valueSql(env, expr, textual = null) {
     }
     case "cast":
       return `CAST(${valueSql(env, expr.operand, "textual")} AS TEXT)`;
-  }
+    case "storage":
+      return storageCallSql(env, expr);
+  }
+}
+function pathArray(operand) {
+  return `('["' || replace(replace(${operand()}, '"', '\\"'), '/', '","') || '"]')`;
+}
+function storageHelperSql(fn, index, operand) {
+  switch (fn) {
+    case "foldername": {
+      if (index === null || !Number.isInteger(index) || index < 1 || index > MAX_FOLDERNAME_INDEX)
+        throw new RangeError(FOLDERNAME_INDEX_PROBLEM);
+      const n = String(index);
+      return `(CASE WHEN ${n} < json_array_length(${pathArray(operand)}) THEN json_extract(${pathArray(operand)}, '$[${String(index - 1)}]') END)`;
+    }
+    case "filename":
+      return `json_extract(${pathArray(operand)}, '$[#-1]')`;
+    case "extension": {
+      const filename = () => storageHelperSql("filename", null, operand);
+      return `substr(${filename()}, length(rtrim(${filename()}, replace(${filename()}, '.', ''))) + 1)`;
+    }
+  }
+}
+function storageCallSql(env, expr) {
+  const problem = storageHelperColumnProblem(expr.fn);
+  if (asciiLower(env.blame.policy.table) !== STORAGE_OBJECTS)
+    return blamed(env, problem);
+  const { source, column: column2 } = resolveColumn(env, expr.column);
+  if (source !== env.scopes[0] || source.table.name !== STORAGE_OBJECTS_TABLE || column2.name !== "name")
+    return blamed(env, problem);
+  const index = expr.fn === "foldername" ? expr.index : null;
+  if (expr.fn === "foldername" ? index === null || !Number.isInteger(index) || index < 1 || index > MAX_FOLDERNAME_INDEX : expr.index !== null)
+    return blamed(env, FOLDERNAME_INDEX_PROBLEM);
+  return storageHelperSql(
+    expr.fn,
+    index,
+    () => source.read(column2, env, {
+      qualified: env.scopes.length > 1,
+      textual: "textual"
+    })
+  );
 }
 function operandSide(env, expr) {
   if (expr.kind === "cast") return operandSide(env, expr.operand);
@@ -23149,10 +23941,10 @@ function conditionSql(env, expr) {
       if (untestable !== void 0) return blamed(env, untestable);
       const known = knownNullTest(env, expr);
       if (known !== void 0) return known;
-      const target = valueSql(env, expr.operand);
+      const target2 = valueSql(env, expr.operand);
       if (expr.value === null)
-        return `(${target} IS ${expr.not ? "NOT " : ""}NULL)`;
-      const test = isBoolean(target, expr.value);
+        return `(${target2} IS ${expr.not ? "NOT " : ""}NULL)`;
+      const test = isBoolean(target2, expr.value);
       return expr.not ? `(NOT (${test}))` : `(${test})`;
     }
     case "in": {
@@ -23171,10 +23963,10 @@ function conditionSql(env, expr) {
     case "like": {
       const problem = policyPatternProblem(expr.pattern, expr.ci);
       if (problem !== void 0) return blamed(env, problem);
-      const target = valueSql(env, expr.operand, "pattern");
+      const target2 = valueSql(env, expr.operand, "pattern");
       const not = expr.not ? "NOT " : "";
       const pattern = bind(env, boundPattern(expr.pattern, expr.ci));
-      return expr.ci ? `(${target} ${not}LIKE ${pattern} ESCAPE '\\')` : `(${target} ${not}GLOB ${pattern})`;
+      return expr.ci ? `(${target2} ${not}LIKE ${pattern} ESCAPE '\\')` : `(${target2} ${not}GLOB ${pattern})`;
     }
     case "between": {
       if (env.check) {
@@ -23183,10 +23975,10 @@ function conditionSql(env, expr) {
         const both = `(${low2} AND ${high2})`;
         return expr.not ? `(NOT ${both})` : both;
       }
-      const target = valueSql(env, expr.operand);
+      const target2 = valueSql(env, expr.operand);
       const low = valueSql(env, expr.low);
       const high = valueSql(env, expr.high);
-      return `(${target} ${expr.not ? "NOT " : ""}BETWEEN ${low} AND ${high})`;
+      return `(${target2} ${expr.not ? "NOT " : ""}BETWEEN ${low} AND ${high})`;
     }
     case "array": {
       const values = distinctArrayValues(
@@ -23285,7 +24077,7 @@ function groupTerms(env, sources, action, permissive, restrictive, pick2) {
       expr
     );
     const [source] = sources;
-    const problem = source === void 0 ? void 0 : textTruthProblem(env.snapshot, source.table, expr);
+    const problem = source === void 0 ? void 0 : textTruthProblem(env.snapshot, source.table, expr, source.names);
     if (problem !== void 0) fail(policyInvalid(policy, action), problem);
     return { sql, params };
   };
@@ -23375,6 +24167,9 @@ function outerColumns(table, expr) {
       case "cast":
         visitValue(value.operand);
         return;
+      case "storage":
+        visitValue(value.column);
+        return;
       default:
         return;
     }
@@ -23457,6 +24252,9 @@ function columnsReadOn(snapshot, table, expr, written) {
       case "cast":
         visitValue(value.operand, scopes);
         return;
+      case "storage":
+        visitValue(value.column, scopes);
+        return;
       default:
         return;
     }
@@ -23510,19 +24308,20 @@ function columnsReadOn(snapshot, table, expr, written) {
   visit(expr, [{ names: [asciiLower(table.name)], table }]);
   return found;
 }
-function truthColumns(snapshot, table, expr) {
-  return comparedColumns(snapshot, table, expr, isBooleanConstant, true);
+function truthColumns(snapshot, table, expr, names = [asciiLower(table.name)]) {
+  return comparedColumns(snapshot, table, expr, isBooleanConstant, true, names);
 }
-function numberComparedColumns(snapshot, table, expr) {
+function numberComparedColumns(snapshot, table, expr, names = [asciiLower(table.name)]) {
   return comparedColumns(
     snapshot,
     table,
     expr,
     (value) => value.kind === "literal" && typeof value.value === "number",
-    false
+    false,
+    names
   );
 }
-function comparedColumns(snapshot, table, expr, constant, truth) {
+function comparedColumns(snapshot, table, expr, constant, truth, names = [asciiLower(table.name)]) {
   const found = [];
   const read = (ref, scopes) => {
     const resolved = resolveRef2(ref, scopes);
@@ -23568,11 +24367,11 @@ function comparedColumns(snapshot, table, expr, constant, truth) {
         return;
     }
   };
-  visit(expr, [{ names: [asciiLower(table.name)], table }]);
+  visit(expr, [{ names, table }]);
   return found;
 }
-function textTruthProblem(snapshot, table, expr) {
-  for (const { written, column: column2 } of truthColumns(snapshot, table, expr))
+function textTruthProblem(snapshot, table, expr, names = [asciiLower(table.name)]) {
+  for (const { written, column: column2 } of truthColumns(snapshot, table, expr, names))
     if (!isNumeric(column2))
       return `${written} is a ${columnAffinity(column2)} column, whose truth value is not what its text says ('true' reads as false): compare it, ${written} = 'true'`;
   return void 0;
@@ -23695,7 +24494,7 @@ function arrayValues(value, path) {
 }
 function filterSql(table, filter, params, path) {
   const resolved = column(table, filter.column);
-  const target = quoteIdentifier(resolved.name);
+  const target2 = quoteIdentifier(resolved.name);
   const valuePath = `${path}.value`;
   switch (filter.operator) {
     case "eq":
@@ -23713,7 +24512,7 @@ function filterSql(table, filter, params, path) {
         lte: "<="
       }[filter.operator];
       params.push(toBoundValue(scalar(filter.value, valuePath)));
-      return `${target} ${operator} ?`;
+      return `${target2} ${operator} ?`;
     }
     case "in": {
       if (!Array.isArray(filter.value))
@@ -23721,7 +24520,7 @@ function filterSql(table, filter, params, path) {
       if (filter.value.length === 0) return "0 = 1";
       for (const [index, item] of filter.value.entries())
         params.push(toBoundValue(scalar(item, `${valuePath}[${index}]`)));
-      return `${target} IN (${filter.value.map(() => "?").join(", ")})`;
+      return `${target2} IN (${filter.value.map(() => "?").join(", ")})`;
     }
     case "is": {
       const value = filter.value;
@@ -23729,9 +24528,9 @@ function filterSql(table, filter, params, path) {
         fail(invalidQuery(valuePath, "must be null, true or false"));
       if (value === null) {
         params.push(null);
-        return `${target} IS ?`;
+        return `${target2} IS ?`;
       }
-      return isBoolean(target, value);
+      return isBoolean(target2, value);
     }
     case "ilike":
     case "like": {
@@ -23741,13 +24540,13 @@ function filterSql(table, filter, params, path) {
       if (problem !== void 0) fail(invalidQuery(valuePath, problem));
       const ilike = filter.operator === "ilike";
       params.push(boundPattern(filter.value, ilike));
-      return ilike ? `${target} LIKE ? ESCAPE '\\'` : `${target} GLOB ?`;
+      return ilike ? `${target2} LIKE ? ESCAPE '\\'` : `${target2} GLOB ?`;
     }
     case "contains":
     case "containedBy":
     case "overlaps": {
       const values = arrayValues(filter.value, valuePath);
-      const qualified = `${quoteIdentifier(table.name)}.${target}`;
+      const qualified = `${quoteIdentifier(table.name)}.${target2}`;
       let next = 0;
       return arraySql(
         () => qualified,
@@ -23808,22 +24607,22 @@ function statement(sql, params) {
 function assignments(table, row, path) {
   const resolved = /* @__PURE__ */ new Map();
   for (const [key, value] of Object.entries(row)) {
-    const target = column(table, key);
-    if (target.generated)
+    const target2 = column(table, key);
+    if (target2.generated)
       fail(
         invalidQuery(
           `${path}.${key}`,
-          `Column ${target.name} is generated and cannot be written.`
+          `Column ${target2.name} is generated and cannot be written.`
         )
       );
-    if (resolved.has(target.name))
+    if (resolved.has(target2.name))
       fail(
         invalidQuery(
           `${path}.${key}`,
-          `Column ${target.name} is given more than once.`
+          `Column ${target2.name} is given more than once.`
         )
       );
-    resolved.set(target.name, { column: target, value });
+    resolved.set(target2.name, { column: target2, value });
   }
   return resolved;
 }
@@ -23944,13 +24743,21 @@ function checkProblemReason(column2, problem) {
 function isTrue(term) {
   return term.sql === "1" && term.params.length === 0;
 }
+function targetNames(target2) {
+  return asciiLower(target2.name) === STORAGE_OBJECTS ? [STORAGE_OBJECTS_QUALIFIER] : [asciiLower(target2.name)];
+}
 var Rls = class {
-  constructor(req, snapshot, table, nonce, commands) {
+  constructor(req, snapshot, table, nonce, commands, scope = {
+    policyTable: table.name,
+    names: [asciiLower(table.name)],
+    alias: null
+  }) {
     this.req = req;
     this.snapshot = snapshot;
     this.table = table;
     this.nonce = nonce;
-    this.outer = storedSource(table, [asciiLower(table.name)], null);
+    this.policyTable = scope.policyTable;
+    this.outer = storedSource(table, scope.names, scope.alias);
     const all = commands.flatMap((command) => {
       const found = this.found(command);
       return [...found.permissive, ...found.restrictive];
@@ -23964,7 +24771,7 @@ var Rls = class {
         if (!owner || owner.generated)
           fail(
             policyInvalid(policy, command),
-            owner ? `the owner column ${owner.name} is a generated column` : `the owner column ${policy.owner} is not on ${table.name}`
+            owner ? `the owner column ${owner.name} is a generated column` : `the owner column ${policy.owner} is not on ${tableLabel(table)}`
           );
       }
     }
@@ -23973,6 +24780,8 @@ var Rls = class {
   /** Restrictive policies named by the checks' markers. */
   restrictive = [];
   outer;
+  /** The name the table's policies are stored under. */
+  policyTable;
   /**
    * A new statement of the same query — an insert's next group of rows:
    * MAX_STATEMENT_SUBQUERIES is a cap on one statement's SQL, so its count
@@ -23986,7 +24795,7 @@ var Rls = class {
   found(command) {
     const found = applicablePolicies(
       this.req.policies,
-      this.table.name,
+      this.policyTable,
       command,
       this.req.role
     );
@@ -24037,7 +24846,14 @@ var Rls = class {
   }
   /** WHERE's policy part (spec §5): the command's USING, and SELECT's. */
   where(action) {
-    const commands = action === "select" ? ["select"] : [action, "select"];
+    return this.using(action === "select" ? ["select"] : [action, "select"]);
+  }
+  /**
+   * The USING of exactly these commands, ANDed: per command its permissive
+   * policies ORed — `0` when there is none, nothing passes — and each of its
+   * restrictive ones. Null when every term is true.
+   */
+  using(commands) {
     const terms = [];
     for (const command of commands) {
       const found = this.found(command);
@@ -24192,10 +25008,10 @@ var Rls = class {
    * writes there itself and the owner condition compares as text (spec
    * §10 — owner policies are left out of the refusal above too).
    */
-  refuseText(action, path, target, value) {
+  refuseText(action, path, target2, value) {
     if (typeof value !== "string") return;
     const { numbers, truths } = this.textReaders ??= this.readersOfText();
-    const reader = refusesText(target, value) ? numbers.get(target.name) : truths.get(target.name);
+    const reader = refusesText(target2, value) ? numbers.get(target2.name) : truths.get(target2.name);
     if (reader)
       fail(
         invalidQuery(
@@ -24203,13 +25019,13 @@ var Rls = class {
           mustBeNumber(reader.command === "all" ? action : reader.command)
         )
       );
-    if (numberClass(target.type) === "number" && !storesAsNumber(value) && !this.ownId(target, value))
-      fail(invalidQuery(path, mustBeNumberFor(target.type)));
+    if (numberClass(target2.type) === "number" && !storesAsNumber(value) && !this.ownId(target2, value))
+      fail(invalidQuery(path, mustBeNumberFor(target2.type)));
   }
   /** The caller's id, in a column an owner policy of this table names. */
-  ownId(target, value) {
+  ownId(target2, value) {
     return value === this.req.uid && this.req.policies.some(
-      (policy) => policy.owner !== null && asciiLower(policy.owner) === asciiLower(target.name) && resolveTable(this.snapshot, policy.table) === this.table
+      (policy) => policy.owner !== null && asciiLower(policy.owner) === asciiLower(target2.name) && resolveTable(this.snapshot, policy.table) === this.table
     );
   }
   /**
@@ -24224,19 +25040,19 @@ var Rls = class {
    * text, and a blob `x'…'` — never stored as a number — is refused as text
    * that is no number (P2-7b 최종 리뷰 후속 2).
    */
-  refuseOmittedText(path, target) {
-    const stored = stringDefault(target);
+  refuseOmittedText(path, target2) {
+    const stored = stringDefault(target2);
     if (stored === void 0) return;
     if (stored.kind === "text" && storesAsNumber(stored.text)) return;
     const { numbers, truths } = this.textReaders ??= this.readersOfText();
-    const refused = stored.kind === "text" ? refusesText(target, stored.text) : numberClass(target.type) === "number";
-    const reader = refused ? numbers.get(target.name) : truths.get(target.name);
+    const refused = stored.kind === "text" ? refusesText(target2, stored.text) : numberClass(target2.type) === "number";
+    const reader = refused ? numbers.get(target2.name) : truths.get(target2.name);
     if (reader)
       fail(
         invalidQuery(
           path,
           mustIncludeFor(
-            target.name,
+            target2.name,
             reader.command === "all" ? "insert" : reader.command
           )
         )
@@ -24272,7 +25088,7 @@ var Rls = class {
       fail(
         dataError("POLICY_INVALID", {
           action: "select",
-          table: this.table.name,
+          table: this.policyTable,
           values: true
         }),
         `they bind ${String(count2)}`
@@ -24285,7 +25101,7 @@ var Rls = class {
       fail(
         dataError("POLICY_INVALID", {
           action: "select",
-          table: this.table.name,
+          table: this.policyTable,
           bytes: true
         }),
         `they write ${String(bytes)}`
@@ -24294,13 +25110,7 @@ var Rls = class {
 };
 function checkCase(table, terms, guard, pass, action, nonce) {
   if (terms.length === 0) return pass;
-  let sql = pass.sql;
-  let params = pass.params;
-  for (const term of terms.toReversed()) {
-    sql = `CASE WHEN ${term.sql} THEN ${sql} ELSE ${term.marker} END`;
-    params = [...term.params, ...params];
-  }
-  if (!guard) return { sql, params };
+  if (!guard) return nestedChecks(terms, pass);
   if (table.sql === null) {
     const first = terms.find((term) => term.policy !== void 0);
     if (first?.kind === "select" || !first?.policy)
@@ -24312,11 +25122,134 @@ function checkCase(table, terms, guard, pass, action, nonce) {
       );
     fail(policyInvalid(first.policy, action));
   }
+  return nestedChecks(
+    [schemaGuard(table.name, table.sql, action, nonce), ...terms],
+    pass
+  );
+}
+function schemaGuard(name, sql, kind, nonce) {
   return {
-    sql: `CASE WHEN (SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?) = ? THEN ${sql} ELSE ${schemaMarker(nonce)} END`,
-    params: [table.name, table.sql, ...params]
+    sql: "(SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?) = ?",
+    params: [name, sql],
+    marker: schemaMarker(nonce),
+    kind,
+    policy: void 0
   };
 }
+function nestedChecks(terms, pass) {
+  let sql = pass.sql;
+  let params = pass.params;
+  for (const term of terms.toReversed()) {
+    sql = `CASE WHEN ${term.sql} THEN ${sql} ELSE ${term.marker} END`;
+    params = [...term.params, ...params];
+  }
+  return { sql, params };
+}
+function assertFragmentAlias(alias, caller) {
+  if (/^_naro_/i.test(alias))
+    throw new Error(
+      `${caller}: the alias ${alias} is one the compiler gives its subqueries (_naro_\u2026): name the table otherwise`
+    );
+}
+function checkNonceOf(nonce, caller) {
+  if (!/^[0-9a-f]{1,64}$/.test(nonce))
+    throw new Error(`${caller}: checkNonce must be 1 to 64 hex digits`);
+  return nonce;
+}
+function usingFragment(target2, req, snapshot, commands, alias) {
+  assertFragmentAlias(alias, "usingFragment");
+  const rls = new Rls(req, snapshot, target2.table, "0", commands, {
+    policyTable: target2.name,
+    names: targetNames(target2),
+    alias
+  });
+  return rls.using(commands) ?? { sql: "1", params: [] };
+}
+function rowSource(target2, row, action, stored) {
+  const { table } = target2;
+  const kept = new Set(stored?.columns ?? []);
+  const storedRow = stored ? storedSource(table, targetNames(target2), stored.alias) : void 0;
+  const source = {
+    table,
+    names: targetNames(target2),
+    used: false,
+    storedRead: false,
+    read: (item, env, how) => {
+      const check2 = env.check;
+      if (!check2) return fail(dataError("INTERNAL_ERROR"));
+      source.used = true;
+      if (item.generated)
+        check2.problem(item.name, "generated", env.blame.policy);
+      if (storedRow && kept.has(item.name)) {
+        source.storedRead = true;
+        return storedRow.read(item, env, how);
+      }
+      if (how.textual && isNumeric(item))
+        check2.problem(item.name, how.textual, env.blame.policy);
+      if (!Object.hasOwn(row, item.name))
+        fail(
+          dataError("INTERNAL_ERROR"),
+          `the new row of ${target2.name} has no value for ${item.name}`
+        );
+      const bound = row[item.name] ?? null;
+      if (typeof bound === "string" && refusesText(item, bound))
+        fail(invalidQuery(`row.${item.name}`, mustBeNumber(action)));
+      env.params.push(bound);
+      return readsAsIs(item, bound) ? "?" : asStored(item, "?");
+    },
+    // A stored column is the statement's own table's: SQLite compares it
+    // with its own collation, the snapshot's — which the guard holds to.
+    operand: (item) => kept.has(item.name) ? { stable: true, newColumnish: true, newCollation: item.collation } : { stable: false, newColumnish: false, newCollation: null }
+  };
+  return source;
+}
+function storedColumnsOf(target2, command, row, stored) {
+  if (stored === void 0) return void 0;
+  if (command !== "update")
+    throw new Error("checkFragment: only an update keeps stored columns");
+  assertFragmentAlias(stored.alias, "checkFragment");
+  for (const name of stored.columns) {
+    if (target2.table.byName.get(asciiLower(name))?.name !== name)
+      throw new Error(`checkFragment: ${name} is no column of ${target2.name}`);
+    if (Object.hasOwn(row, name))
+      throw new Error(
+        `checkFragment: ${name} is both a new value and a stored column`
+      );
+  }
+  return stored;
+}
+function checkFragment(target2, req, snapshot, command, row, nonce, stored, withSelect = false) {
+  const checked = checkNonceOf(nonce, "checkFragment");
+  const source = rowSource(
+    target2,
+    row,
+    command,
+    storedColumnsOf(target2, command, row, stored)
+  );
+  const commands = withSelect ? [command, "select"] : [command];
+  const rls = new Rls(req, snapshot, target2.table, checked, commands, {
+    policyTable: target2.name,
+    names: targetNames(target2),
+    alias: null
+  });
+  const terms = rls.checks(
+    command,
+    source,
+    withSelect,
+    () => false,
+    () => false
+  );
+  if (!source.storedRead || terms.length === 0) return terms;
+  const { name, sql } = target2.table;
+  if (sql === null) {
+    const first = terms.find((term) => term.policy !== void 0)?.policy;
+    return fail(
+      first ? policyInvalid(first, command) : dataError("INTERNAL_ERROR"),
+      `naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
+    );
+  }
+  return [schemaGuard(name, sql, command, checked), ...terms];
+}
 function compileSelect(query, table, rls) {
   if (query.columns !== "*" && query.columns.length === 0)
     fail(invalidQuery("columns", "must name at least one column"));
@@ -24531,9 +25464,10 @@ function compileDelete(query, table, context, rls) {
   ];
 }
 function compile(query, snapshot, decision, context, options = {}) {
-  const nonce = options.checkNonce ?? DEFAULT_CHECK_NONCE;
-  if (!/^[0-9a-f]{1,64}$/.test(nonce))
-    throw new Error("compile: checkNonce must be 1 to 64 hex digits");
+  const nonce = checkNonceOf(
+    options.checkNonce ?? DEFAULT_CHECK_NONCE,
+    "compile"
+  );
   if (!decision.allow)
     return decision.reason === void 0 ? { ok: false, error: decision.error } : { ok: false, error: decision.error, reason: decision.reason };
   const table = resolveTable(snapshot, query.table);
@@ -24609,6 +25543,8 @@ function valueScopes(scopes, value) {
       return value.args.flatMap((arg) => valueScopes(scopes, arg));
     case "cast":
       return valueScopes(scopes, value.operand);
+    case "storage":
+      return valueScopes(scopes, value.column);
     default:
       return [];
   }
@@ -24741,7 +25677,7 @@ function blocked(table, indexes, way) {
   return void 0;
 }
 function problemMessage(policy, outer, table, ways, why) {
-  const start = `Policy ${policy.name} on ${outer.name}: its subquery on ${table.name} runs once for every row of ${outer.name} it looks at`;
+  const start = `Policy ${policy.name} on ${tableLabel(outer)}: its subquery on ${table.name} runs once for every row of ${tableLabel(outer)} it looks at`;
   const override = "or send it with allow_unindexed=1 (naro policy create --allow-unindexed) to accept a scan of every row";
   const [way] = ways;
   if (!way)
@@ -24758,8 +25694,9 @@ function unindexedSubqueries(snapshot, indexes, policies) {
   const found = [];
   for (const policy of policies) {
     if (policy.invalid !== null) continue;
-    const outer = resolveTable(snapshot, policy.table);
+    const outer = resolvePolicyTable(snapshot, policy.table);
     if (!outer) continue;
+    const outerName = asciiLower(policy.table) === STORAGE_OBJECTS ? STORAGE_OBJECTS_QUALIFIER : asciiLower(outer.name);
     const visit = (scopes, expr) => {
       if (expr === null || isValueExpr(expr)) return;
       switch (expr.kind) {
@@ -24804,13 +25741,319 @@ function unindexedSubqueries(snapshot, indexes, policies) {
           return;
       }
     };
-    const root = [{ table: outer, names: [asciiLower(outer.name)] }];
+    const root = [{ table: outer, names: [outerName] }];
     visit(root, policy.usingExpr);
     visit(root, policy.checkExpr);
   }
   return found;
 }
 
+// ../../packages/data-core/src/storage-sql.ts
+var STORAGE_NONCE_MAX_DIGITS = 64;
+function nonceOf(nonce) {
+  if (!/^[0-9a-f]+$/.test(nonce) || nonce.length > STORAGE_NONCE_MAX_DIGITS)
+    throw new Error(
+      `storage-sql: the nonce must be 1 to ${String(STORAGE_NONCE_MAX_DIGITS)} hex digits`
+    );
+  return nonce;
+}
+function marker(guard, nonce) {
+  return `json_extract('{}', 'naro:storage:${guard}:${nonce}')`;
+}
+var STORAGE_STATEMENT_PARAM_LIMIT = 100;
+var STORAGE_STATEMENT_BYTE_LIMIT = 1e5;
+function storageStatementProblem(statement2, action) {
+  if (statement2.params.length > STORAGE_STATEMENT_PARAM_LIMIT)
+    return {
+      error: dataError("POLICY_INVALID", {
+        action,
+        table: STORAGE_OBJECTS,
+        values: STORAGE_STATEMENT_PARAM_LIMIT
+      }),
+      reason: `the ${STORAGE_OBJECTS} policies need more than ${String(STORAGE_STATEMENT_PARAM_LIMIT)} values in one statement`
+    };
+  const bytes = utf8ByteLength(statement2.sql);
+  if (bytes > STORAGE_STATEMENT_BYTE_LIMIT)
+    return {
+      error: dataError("POLICY_INVALID", {
+        action,
+        table: STORAGE_OBJECTS,
+        bytes: STORAGE_STATEMENT_BYTE_LIMIT
+      }),
+      reason: `the ${STORAGE_OBJECTS} policies make one statement ${String(bytes)} bytes long, more than ${String(STORAGE_STATEMENT_BYTE_LIMIT)}`
+    };
+  return void 0;
+}
+var OBJECT_COLUMNS = "o.id, o.bucket_id, o.name, o.owner, o.owner_id, o.version, o.created_at, o.updated_at, o.metadata";
+var PROJECT_BYTES = `(SELECT coalesce(sum(total_bytes), 0) FROM ${STORAGE_BUCKETS_TABLE})`;
+var LIVE_BUCKET = `${STORAGE_BUCKET_DELETING_COLUMN.column} IS NULL`;
+function compose(parts, values) {
+  let sql = "";
+  const params = [];
+  let next = 0;
+  for (const part of parts) {
+    if (typeof part === "string") {
+      sql += part;
+      const count2 = part.split("?").length - 1;
+      const bound = count2 === 0 ? [] : values[next++] ?? [];
+      if (bound.length !== count2)
+        throw new Error(
+          `storage-sql: ${String(count2)} placeholders, ${String(bound.length)} values`
+        );
+      params.push(...bound);
+    } else {
+      sql += part.sql;
+      params.push(...part.params);
+    }
+  }
+  if (next !== values.length) throw new Error("storage-sql: values left over");
+  return { sql, params };
+}
+function claimUpload(i) {
+  const nonce = nonceOf(i.nonce);
+  return compose(
+    [
+      `INSERT INTO ${STORAGE_OBJECTS_TABLE} (id, bucket_id, name, owner, owner_id, metadata, version, parent, size, status, lock_id, lock_expires_at) SELECT ?, ?, ?, ?, ?, ?, NULL, ?, ?, 'uploading', ?, ? WHERE CASE WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} WHERE id = ? AND ${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN (`,
+      i.check,
+      `) <> 1 THEN 0 WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} WHERE bucket_id = ? AND name = ? AND status = 'ready') THEN ${marker("exists", nonce)} WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} WHERE bucket_id = ? AND name = ?) THEN ${marker("busy", nonce)} WHEN ${PROJECT_BYTES} + ? > ? THEN ${marker("quota", nonce)} ELSE 1 END RETURNING id`
+    ],
+    [
+      [
+        i.id,
+        i.bucket,
+        i.name,
+        i.owner,
+        i.owner,
+        i.metadata,
+        objectParent(i.name),
+        i.size,
+        i.lockId,
+        i.expiresAt,
+        i.bucket
+      ],
+      [i.bucket, i.name, i.bucket, i.name, i.size, i.limitBytes]
+    ]
+  );
+}
+var STORAGE_OBJECT_ALIAS = "o";
+var OVERWRITE_KEPT_COLUMNS = [
+  "id",
+  "bucket_id",
+  "name",
+  "owner",
+  "owner_id",
+  "created_at"
+];
+function overwriteCheckRow(i) {
+  return {
+    row: { metadata: i.metadata, version: i.version, updated_at: i.now },
+    stored: { alias: STORAGE_OBJECT_ALIAS, columns: OVERWRITE_KEPT_COLUMNS }
+  };
+}
+function claimOverwrite(i) {
+  const nonce = nonceOf(i.nonce);
+  return compose(
+    [
+      `UPDATE ${STORAGE_OBJECTS_TABLE} AS o SET lock_id = ?, lock_expires_at = ?, pending = ? WHERE o.bucket_id = ? AND o.name = ? AND CASE WHEN NOT (`,
+      i.selectUsing,
+      // The row's own bucket (`o.bucket_id`), so no value is bound for it.
+      `) THEN ${marker("hidden", nonce)} WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} AS b WHERE b.id = o.bucket_id AND b.${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN o.status <> 'ready' OR o.lock_id IS NOT NULL THEN ${marker("busy", nonce)} WHEN NOT (`,
+      i.updateUsing,
+      `) THEN ${marker("denied", nonce)} WHEN ? > o.size AND ${PROJECT_BYTES} + ? - o.size > ? THEN ${marker("quota", nonce)} ELSE (`,
+      i.check,
+      // RETURNING names the columns bare: it does not see the UPDATE's
+      // alias (SQLite 3.53: `no such column: o.id`), and the table is the
+      // only one there.
+      ") END RETURNING id, version, size, owner, owner_id, created_at"
+    ],
+    [
+      [i.lockId, i.expiresAt, i.pending, i.bucket, i.name],
+      [i.size, i.size, i.limitBytes]
+    ]
+  );
+}
+function claimDelete(i) {
+  return compose(
+    [
+      `UPDATE ${STORAGE_OBJECTS_TABLE} AS o SET status = 'deleting', lock_id = ?, lock_expires_at = ? WHERE o.bucket_id = ? AND o.name IN (SELECT value FROM json_each(?)) AND o.status = 'ready' AND o.lock_id IS NULL AND (`,
+      i.using,
+      // Bare, as in claimOverwrite: RETURNING does not see the alias.
+      ") RETURNING id, bucket_id, name, owner, owner_id, version, created_at, updated_at, metadata"
+    ],
+    [[i.lockId, i.expiresAt, i.bucket, JSON.stringify(i.names)]]
+  );
+}
+function readObject2(i) {
+  return compose(
+    [
+      `SELECT ${OBJECT_COLUMNS} FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.name = ? AND (`,
+      i.using,
+      ")"
+    ],
+    [[i.bucket, i.name]]
+  );
+}
+var SORT_COLUMNS = {
+  name: "name",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+var SORT_ORDERS = { asc: "ASC", desc: "DESC" };
+var WIDEST_LIST_SORT = {
+  column: "updated_at",
+  order: "desc"
+};
+function listObjects(i) {
+  const column2 = Object.hasOwn(SORT_COLUMNS, i.sort.column) ? SORT_COLUMNS[i.sort.column] : void 0;
+  const order = Object.hasOwn(SORT_ORDERS, i.sort.order) ? SORT_ORDERS[i.sort.order] : void 0;
+  if (column2 === void 0 || order === void 0)
+    throw new Error("listObjects: not a sort it knows");
+  const root = i.prefix === "";
+  const p = i.prefix;
+  const rest = root ? "o.name" : "substr(o.name, length(?) + 2)";
+  const restValues = root ? [] : [p];
+  const under = root ? "1" : "o.name >= ? || '/' AND o.name < ? || '0'";
+  const underValues = root ? [] : [p, p];
+  return compose(
+    [
+      `SELECT * FROM (SELECT 0 AS kind, substr(${rest}, 1, instr(${rest}, '/') - 1) AS name, NULL AS id, NULL AS bucket_id, NULL AS owner, NULL AS owner_id, NULL AS version, NULL AS created_at, NULL AS updated_at, NULL AS metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND ${under} AND instr(${rest}, '/') > 0 AND (`,
+      i.using,
+      `) GROUP BY 2 UNION ALL SELECT 1, ${rest}, o.id, o.bucket_id, o.owner, o.owner_id, o.version, o.created_at, o.updated_at, o.metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.parent = ? AND (`,
+      i.using,
+      `)) ORDER BY kind, CASE WHEN kind = 0 THEN name END ASC, ${column2} ${order}, name LIMIT ? OFFSET ?`
+    ],
+    [
+      [...restValues, ...restValues, i.bucket, ...underValues, ...restValues],
+      [...restValues, i.bucket, p],
+      [i.limit, i.offset]
+    ]
+  );
+}
+
+// ../../packages/data-core/src/storage-policy.ts
+function refusal(error51) {
+  if (!(error51 instanceof Failure)) throw error51;
+  return error51.reason === void 0 ? { ok: false, error: error51.error } : { ok: false, error: error51.error, reason: error51.reason };
+}
+function request(context, policies) {
+  return { ...rlsIdentity(context), policies: policies ?? [] };
+}
+function budgetProblem(fragment, action) {
+  if (fragment.params.length > STORAGE_STATEMENT_PARAM_LIMIT)
+    return {
+      ok: false,
+      error: dataError("POLICY_INVALID", {
+        action,
+        table: STORAGE_OBJECTS,
+        values: STORAGE_STATEMENT_PARAM_LIMIT
+      }),
+      reason: `the ${STORAGE_OBJECTS} policies need more than ${String(STORAGE_STATEMENT_PARAM_LIMIT)} values in one statement`
+    };
+  const bytes = utf8ByteLength(fragment.sql);
+  if (bytes > MAX_POLICY_STATEMENT_BYTES)
+    return {
+      ok: false,
+      error: dataError("POLICY_INVALID", {
+        action,
+        table: STORAGE_OBJECTS,
+        bytes: true
+      }),
+      reason: `they write ${String(bytes)}`
+    };
+  return void 0;
+}
+function target(snapshot) {
+  return snapshot.storage ? { name: STORAGE_OBJECTS, table: snapshot.storage } : { ok: false, error: dataError("STORAGE_NOT_ENABLED") };
+}
+function storageUsing(input) {
+  const { snapshot, context, commands, alias } = input;
+  if (commands.length === 0)
+    throw new Error("storageUsing: name at least one command");
+  assertFragmentAlias(alias, "storageUsing");
+  const on = target(snapshot);
+  if ("ok" in on) return on;
+  const status = `(${quoteIdentifier(alias)}.${quoteIdentifier("status")} = 'ready')`;
+  if (context.role === "service")
+    return { ok: true, fragment: { sql: status, params: [] } };
+  try {
+    const policy = usingFragment(
+      on,
+      request(context, input.policies),
+      snapshot,
+      commands,
+      alias
+    );
+    const fragment = {
+      sql: `(CASE WHEN ${status} AND (${policy.sql}) THEN 1 ELSE 0 END)`,
+      params: policy.params
+    };
+    return budgetProblem(fragment, commands[0] ?? "select") ?? {
+      ok: true,
+      fragment
+    };
+  } catch (error51) {
+    return refusal(error51);
+  }
+}
+function storageCheck(input) {
+  const { snapshot, context, command, row, stored, nonce } = input;
+  const on = target(snapshot);
+  if ("ok" in on) return on;
+  if (context.role === "service")
+    return { ok: true, terms: [], restrictive: [] };
+  const req = request(context, input.policies);
+  const found = applicablePolicies(
+    req.policies,
+    STORAGE_OBJECTS,
+    command,
+    req.role
+  );
+  if (found.invalid)
+    return {
+      ok: false,
+      error: policyInvalid(found.invalid, command),
+      reason: found.invalid.invalid ?? "it cannot be read"
+    };
+  if (found.permissive.length === 0)
+    return {
+      ok: false,
+      error: dataError("PERMISSION_DENIED", {
+        action: command,
+        table: STORAGE_OBJECTS,
+        check: false
+      })
+    };
+  try {
+    const terms = checkFragment(
+      on,
+      req,
+      snapshot,
+      command,
+      row,
+      nonce,
+      stored,
+      input.withSelect === true
+    );
+    const problem = budgetProblem(
+      {
+        sql: terms.map((term) => term.sql).join(""),
+        params: terms.flatMap((term) => term.params)
+      },
+      command
+    );
+    if (problem) return problem;
+    const restrictive = terms.flatMap(
+      (term) => term.policy !== void 0 && !term.policy.permissive ? [term.policy.name] : []
+    );
+    return { ok: true, terms, restrictive };
+  } catch (error51) {
+    return refusal(error51);
+  }
+}
+function storageCheckCase(terms) {
+  return nestedChecks(terms, { sql: "1", params: [] });
+}
+
 // ../../packages/data-core/src/policy-check.ts
 var CONTEXTS = [
   { role: "anon" },
@@ -24853,6 +26096,134 @@ function probes(table, context, owners) {
     });
   return queries;
 }
+var STORAGE_PROBE_ALIAS = "o";
+var STORAGE_PROBE_NONCE = "f".repeat(STORAGE_NONCE_MAX_DIGITS);
+var STORAGE_CONTEXTS = [
+  ...CONTEXTS,
+  { role: "authenticated", userId: "naro-policy-check" }
+];
+function storageRefusals(snapshot, table, policies) {
+  const refusals = [];
+  const row = Object.fromEntries(
+    table.columns.map((column2) => [column2.name, ""])
+  );
+  for (const context of STORAGE_CONTEXTS) {
+    const using = (commands) => {
+      const result = storageUsing({
+        snapshot,
+        context,
+        policies,
+        commands,
+        alias: STORAGE_PROBE_ALIAS
+      });
+      if (!result.ok) refusals.push(result);
+      return result.ok ? result.fragment : void 0;
+    };
+    const check2 = (command, newRow, withSelect) => {
+      const result = storageCheck({
+        snapshot,
+        context,
+        policies,
+        command,
+        ...newRow,
+        withSelect,
+        nonce: STORAGE_PROBE_NONCE
+      });
+      if (!result.ok) refusals.push(result);
+      return result.ok ? storageCheckCase(result.terms) : void 0;
+    };
+    const select = using(["select"]);
+    const update = using(["update"]);
+    using(["delete"]);
+    const remove = using(["select", "delete"]);
+    const insertCheck = check2("insert", { row }, false);
+    const upsertCheck = check2("insert", { row }, true);
+    const updateCheck = check2(
+      "update",
+      overwriteCheckRow({ metadata: "", now: "", version: "" }),
+      true
+    );
+    for (const statement2 of storageStatements(
+      select,
+      update,
+      remove,
+      [insertCheck, upsertCheck],
+      updateCheck
+    )) {
+      const problem = storageStatementProblem(statement2, "select");
+      if (problem) refusals.push(problem);
+    }
+  }
+  return refusals;
+}
+function storageStatements(select, update, remove, insertChecks, updateCheck) {
+  const statements = [];
+  const value = "";
+  for (const insertCheck of insertChecks)
+    if (insertCheck)
+      statements.push(
+        claimUpload({
+          id: value,
+          bucket: value,
+          name: value,
+          owner: value,
+          metadata: value,
+          size: 0,
+          lockId: value,
+          expiresAt: value,
+          limitBytes: 0,
+          check: insertCheck,
+          nonce: STORAGE_PROBE_NONCE
+        })
+      );
+  if (select && update && updateCheck)
+    statements.push(
+      claimOverwrite({
+        bucket: value,
+        name: value,
+        size: 0,
+        pending: value,
+        lockId: value,
+        expiresAt: value,
+        limitBytes: 0,
+        selectUsing: select,
+        updateUsing: update,
+        check: updateCheck,
+        nonce: STORAGE_PROBE_NONCE
+      })
+    );
+  if (remove)
+    statements.push(
+      claimDelete({
+        bucket: value,
+        names: [],
+        using: remove,
+        lockId: value,
+        expiresAt: value
+      })
+    );
+  if (select)
+    statements.push(
+      readObject2({ bucket: value, name: value, using: select }),
+      listObjects({
+        bucket: value,
+        prefix: "p",
+        limit: 0,
+        offset: 0,
+        sort: WIDEST_LIST_SORT,
+        using: select
+      })
+    );
+  return statements;
+}
+function policyOn(snapshot, name) {
+  const table = resolvePolicyTable(snapshot, name);
+  if (!table) return void 0;
+  return asciiLower(name) === STORAGE_OBJECTS ? { table, label: STORAGE_OBJECTS, names: [STORAGE_OBJECTS_QUALIFIER] } : { table, label: table.name, names: [asciiLower(table.name)] };
+}
+function tableLabelOf(snapshot, name) {
+  return asciiLower(name) === STORAGE_OBJECTS ? STORAGE_OBJECTS : resolveTable(snapshot, name)?.name ?? name;
+}
 function namedInRefusal(message, policies) {
   let found;
   for (const policy of policies) {
@@ -24883,16 +26254,21 @@ function problems(snapshot, policies, options) {
     if (table) tables.set(table.name, table);
   }
   for (const policy of loaded) {
-    const table = resolveTable(snapshot, policy.table);
-    if (!table || policy.invalid !== null) continue;
+    const on = policyOn(snapshot, policy.table);
+    if (!on || policy.invalid !== null) continue;
     for (const expr of [policy.usingExpr, policy.checkExpr]) {
       if (expr === null) continue;
-      for (const { written, column: column2 } of truthColumns(snapshot, table, expr)) {
+      for (const { written, column: column2 } of truthColumns(
+        snapshot,
+        on.table,
+        expr,
+        on.names
+      )) {
         if (isNumeric(column2)) continue;
         const message = `Policy ${policy.name} on ${policy.table} cannot be applied: ${written} is a ${columnAffinity(column2)} column, whose truth value is not what its text says ('true' reads as false): compare it, ${written} = 'true'.`;
-        found.set(`${table.name}:${message}`, {
+        found.set(`${on.label}:${message}`, {
           problem: {
-            table: table.name,
+            table: on.label,
             message,
             policy: policy.name,
             kind: "compile"
@@ -24903,16 +26279,16 @@ function problems(snapshot, policies, options) {
     }
   }
   for (const policy of loaded) {
-    const table = resolveTable(snapshot, policy.table);
-    if (!table || policy.invalid !== null) continue;
-    for (const { written, column: column2 } of numberReadsOf(snapshot, table, policy)) {
+    const on = policyOn(snapshot, policy.table);
+    if (!on || policy.invalid !== null) continue;
+    for (const { written, column: column2 } of numberReadsOf(snapshot, on, policy)) {
       const stored = stringDefault(column2);
       if (stored === void 0) continue;
       if (stored.kind === "text" && storesAsNumber(stored.text)) continue;
       const kept = stored.kind === "text" ? "text" : "a blob";
-      found.set(`default:${table.name}:${policy.name}:${written}`, {
+      found.set(`default:${on.label}:${policy.name}:${written}`, {
         problem: {
-          table: table.name,
+          table: on.label,
           message: `Policy ${policy.name} on ${policy.table} reads ${written} as a boolean or a number, but its DEFAULT ${String(column2.defaultValue)} is stored as ${kept}, which the policy does not read as it says ('true' reads as false): the rows that took it \u2014 every row there when the column was added, and each service-key insert that leaves it out \u2014 hold that value. Write the default as a number (1, 0, TRUE or FALSE) and update those rows.`,
           policy: policy.name,
           kind: "default"
@@ -24934,6 +26310,23 @@ function problems(snapshot, policies, options) {
     }))
   );
   const compiled = [...loaded, ...probe];
+  const refused = (probed, error51, reason) => {
+    if (error51.code !== "POLICY_INVALID") return;
+    const message = reason === void 0 ? error51.message : `${error51.message.replace(/\.$/, "")}: ${reason}.`;
+    const named = namedInRefusal(error51.message, loaded);
+    const blamed2 = named === void 0 ? probed : tableLabelOf(snapshot, named.table);
+    const key = `${blamed2}:${message}`;
+    if (!found.has(key))
+      found.set(key, {
+        problem: {
+          table: blamed2,
+          message,
+          ...named === void 0 ? {} : { policy: named.name },
+          kind: "compile"
+        },
+        policy: ""
+      });
+  };
   for (const table of tables.values()) {
     const owners = new Set(
       policiesOn(loaded, table.name).flatMap(
@@ -24948,23 +26341,27 @@ function problems(snapshot, policies, options) {
           error: decision.error,
           reason: decision.reason
         };
-        if (result.ok || result.error.code !== "POLICY_INVALID") continue;
-        const message = result.reason === void 0 ? result.error.message : `${result.error.message.replace(/\.$/, "")}: ${result.reason}.`;
-        const named = namedInRefusal(result.error.message, loaded);
-        const blamed2 = named === void 0 ? table.name : resolveTable(snapshot, named.table)?.name ?? named.table;
-        const key = `${blamed2}:${message}`;
-        if (!found.has(key))
-          found.set(key, {
-            problem: {
-              table: blamed2,
-              message,
-              ...named === void 0 ? {} : { policy: named.name },
-              kind: "compile"
-            },
-            policy: ""
-          });
+        if (!result.ok) refused(table.name, result.error, result.reason);
       }
   }
+  if (policiesOn(loaded, STORAGE_OBJECTS).length > 0) {
+    if (snapshot.storage)
+      for (const { error: error51, reason } of storageRefusals(
+        snapshot,
+        snapshot.storage,
+        loaded
+      ))
+        refused(STORAGE_OBJECTS, error51, reason);
+    else
+      found.set(`${STORAGE_OBJECTS}:${STORAGE_UNAVAILABLE_MESSAGE}`, {
+        problem: {
+          table: STORAGE_OBJECTS,
+          message: STORAGE_UNAVAILABLE_MESSAGE,
+          kind: "compile"
+        },
+        policy: ""
+      });
+  }
   if (options.indexes && options.allowUnindexed !== true)
     for (const problem of unindexedSubqueries(
       snapshot,
@@ -24993,13 +26390,13 @@ function policySetProblems(snapshot, policies, options = {}) {
     (a, b) => byText(a.problem.table, b.problem.table) || byText(a.policy, b.policy) || byText(a.problem.message, b.problem.message)
   ).map(({ problem }) => problem);
 }
-function numberReadsOf(snapshot, table, policy) {
+function numberReadsOf(snapshot, on, policy) {
   const reads = /* @__PURE__ */ new Map();
   for (const expr of [policy.usingExpr, policy.checkExpr]) {
     if (expr === null) continue;
     for (const read of [
-      ...truthColumns(snapshot, table, expr),
-      ...numberComparedColumns(snapshot, table, expr)
+      ...truthColumns(snapshot, on.table, expr, on.names),
+      ...numberComparedColumns(snapshot, on.table, expr, on.names)
     ]) {
       const key = JSON.stringify([read.table.name, read.column.name]);
       if (isNumeric(read.column) && !reads.has(key)) reads.set(key, read);
@@ -25053,7 +26450,7 @@ function readCreate(stream, start) {
   stream.expectKeyword("policy");
   const name = readPolicyName(stream);
   stream.expectKeyword("on");
-  const table = readTableName(stream);
+  const table = readPolicyTarget(stream);
   let permissive = true;
   if (stream.acceptKeyword("as")) {
     const token = stream.next();
@@ -25118,7 +26515,7 @@ function readDrop(stream) {
   }
   const name = readPolicyName(stream);
   stream.expectKeyword("on");
-  const table = readTableName(stream);
+  const table = readPolicyTarget(stream);
   if (!stream.acceptKeyword("cascade")) stream.acceptKeyword("restrict");
   readEnd(stream);
   return { kind: "drop", name, table, ifExists };
@@ -25213,7 +26610,7 @@ function readComment(stream) {
   stream.expectKeyword("policy");
   const name = readPolicyName(stream);
   stream.expectKeyword("on");
-  const table = readTableName(stream);
+  const table = readPolicyTarget(stream);
   stream.expectKeyword("is");
   const token = stream.next();
   if (isKeyword(token, "null"))
@@ -25229,7 +26626,7 @@ function readComment(stream) {
 function readRowLevelSecurity(stream) {
   if (stream.acceptKeyword("if")) stream.expectKeyword("exists");
   stream.acceptKeyword("only");
-  const table = readTableName(stream);
+  const table = readPolicyTarget(stream);
   const token = stream.next();
   let action;
   if (isKeyword(token, "enable")) action = "enable";
@@ -25468,7 +26865,10 @@ function readSqlHead(text2) {
 // ../../packages/data-core/src/policy-migration.ts
 var GRANT_REFUSAL = "naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
 function disableRefusal(table) {
-  return `naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${quoteIdent(table)} USING (true) WITH CHECK (true);`;
+  return `naro keeps row-level security on for every table. To let everyone through, create a policy: CREATE POLICY "open" ON ${policyTableSql(table)} USING (true) WITH CHECK (true);`;
+}
+function isStorageObjects(table) {
+  return asciiLower(table) === STORAGE_OBJECTS;
 }
 function relationMissing(table) {
   return `relation "${table}" does not exist`;
@@ -25549,7 +26949,8 @@ function planPolicyMigration(statements) {
       );
     const statement2 = parsed.statement;
     const table = statement2.kind === "create" ? statement2.policy.table : statement2.table;
-    if (isSystemTable(table)) return refuse(`${relationMissing(table)}.`);
+    if (!isStorageObjects(table) && isSystemTable(table))
+      return refuse(`${relationMissing(table)}.`);
     switch (statement2.kind) {
       case "create":
         if (readsBareSubqueryColumn(statement2.policy) && changedAfter(index, tablesInScope(statement2.policy)))
@@ -25595,12 +26996,13 @@ function policyMigrationSql(policy) {
   const create = policySql({ ...policy, owner: null });
   if (policy.owner === null) return create;
   return `${create}
-COMMENT ON POLICY ${quotePolicyName(policy.name)} ON ${quoteIdent(policy.table)} IS ${sqlStringLiteral(`naro:owner ${quoteIdent(policy.owner)}`)};`;
+COMMENT ON POLICY ${quotePolicyName(policy.name)} ON ${policyTableSql(policy.table)} IS ${sqlStringLiteral(`naro:owner ${quoteIdent(policy.owner)}`)};`;
 }
 function unreadablePolicyComment(policy) {
-  return `-- Policy ${commentText(quotePolicyName(policy.name))} on ${commentText(quoteIdent(policy.table))} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped and created again.`;
+  return `-- Policy ${commentText(quotePolicyName(policy.name))} on ${commentText(policyTableSql(policy.table))} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped and created again.`;
 }
 var SYSTEM_PREDICATE = systemTablePredicate("name");
+var STORAGE_EXISTS = `EXISTS (SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ${sqlStringLiteral(STORAGE_OBJECTS_TABLE)})`;
 
 // ../../packages/data-core/src/redirect-origins.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
@@ -25725,6 +27127,25 @@ var SYSTEM_MIGRATIONS = [
     name: "named_policies",
     statements: [NAMED_POLICY_TABLE_SQL],
     compute: convertLegacyPolicies
+  },
+  {
+    // Storage (first-release design §6): the buckets and the objects' index
+    // with their counter triggers. Every backend gets them, Storage on or
+    // not — what turns it on is the worker's R2 binding. A worker from
+    // before them never reads them.
+    version: 5,
+    name: "storage",
+    statements: [...STORAGE_TABLES_SQL]
+  },
+  {
+    // Storage 3-1b (known-issues #107, first-release design §14): the mark
+    // a bucket's removal sets before it empties the bucket. The claims and
+    // the worker's bucket reads take a marked bucket as not there. A worker
+    // from before it never reads the column.
+    version: 6,
+    name: "storage_bucket_deleting",
+    statements: [],
+    addColumns: [STORAGE_BUCKET_DELETING_COLUMN]
   }
 ];
 
@@ -26120,7 +27541,10 @@ var POLICY_WARNING_RULES = [
   "rls_policy_unindexed"
 ];
 function policyIssues(input) {
-  const present = new Set(input.tables.map(asciiLower));
+  const present = /* @__PURE__ */ new Set([
+    ...input.tables.map(asciiLower),
+    ...input.snapshot.storage ? [STORAGE_OBJECTS] : []
+  ]);
   const found = [
     ...policySetProblems(
       input.snapshot,
@@ -26454,6 +27878,7 @@ function policiesFromFiles(files) {
   let policies = [];
   const tables = /* @__PURE__ */ new Set();
   const forget = (table) => {
+    if (sameTable(table, STORAGE_OBJECTS)) return;
     policies = policies.filter((policy) => !sameTable(policy.table, table));
   };
   for (const [file2, sql] of files.entries()) {
@@ -26501,18 +27926,19 @@ function policiesFromFiles(files) {
 }
 function policiesLostByReset(input) {
   const present = new Set(input.tables.map(asciiLower));
+  if (input.storage === true) present.add(STORAGE_OBJECTS);
   const made = policiesFromFiles(input.files);
   if (made.refused) return { lost: [], withTables: [], refused: made.refused };
+  const remade = new Set(made.tables);
+  if (input.storage === true) remade.add(STORAGE_OBJECTS);
   const gone = input.current.filter(
     (policy) => present.has(asciiLower(policy.table)) && !made.policies.some(
       (other) => sameTable(other.table, policy.table) && other.name === policy.name
     )
   );
   return {
-    lost: gone.filter((policy) => made.tables.has(asciiLower(policy.table))),
-    withTables: gone.filter(
-      (policy) => !made.tables.has(asciiLower(policy.table))
-    )
+    lost: gone.filter((policy) => remade.has(asciiLower(policy.table))),
+    withTables: gone.filter((policy) => !remade.has(asciiLower(policy.table)))
   };
 }
 function resetPoliciesLostMessage(lost) {
@@ -27081,6 +28507,7 @@ export {
   schemaMigrationTitle,
   projectPath,
   splitStatements,
+  ANALYTICS_FILTER_KEYS,
   NaroError,
   isNaroError,
   toNaroError,
@@ -27094,6 +28521,9 @@ export {
   login,
   resolveAuth,
   openBrowser,
+  SPEED_INSIGHTS_METRICS,
+  SPEED_INSIGHTS_FILTER_KEYS,
+  SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
   isTerminalStatus,
   BACKEND_STEPS,
   isStalledBackend,
@@ -27107,7 +28537,11 @@ export {
   renderRows,
   summarizeStatement,
   serializeDotenv,
+  MAX_SINGLE_UPLOAD_BYTES,
+  parseCacheControl,
+  STORAGE_OBJECTS_TABLE,
   systemTablePredicate,
+  dataError,
   SCHEMA_SQL,
   tableNames,
   snapshotFromRows,