naro-cli 0.15.0 → 0.17.0

package/dist/{chunk-6WJ3QQ5Y.js → chunk-PYRN5XR6.js}

@@ -5,9 +5,9 @@ import {
 
 // src/deploy.ts
 import { existsSync as existsSync7 } from "fs";
-import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm3 } from "fs/promises";
+import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm4 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname4, join as join24, resolve as resolve10 } from "path";
+import { basename as basename3, dirname as dirname5, join as join24, resolve as resolve10 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -26,6 +26,7 @@ function artifactUrlKey(kind, name) {
   return `${kind}/${name}`;
 }
 var ARTIFACT_URL_BATCH_SIZE = 100;
+var ARTIFACT_UPLOAD_CONCURRENCY = 8;
 function parseArtifactPutUrls(payload) {
   if (typeof payload !== "object" || payload === null) return null;
   const { urls, disabled } = payload;
@@ -37,28 +38,55 @@ function parseArtifactPutUrls(payload) {
   }
   return resolved;
 }
+async function eachWithLimit(items, limit, work) {
+  let next = 0;
+  const lanes = Array.from(
+    { length: Math.min(limit, items.length) },
+    async () => {
+      while (next < items.length) {
+        const item = items[next];
+        next += 1;
+        await work(item);
+      }
+    }
+  );
+  await Promise.all(lanes);
+}
 async function uploadArtifactFiles(artifact, ports) {
   const entries = artifactUploadEntries(artifact);
   let proxied = 0;
   for (let index = 0; index < entries.length; index += ARTIFACT_URL_BATCH_SIZE) {
     const batch = entries.slice(index, index + ARTIFACT_URL_BATCH_SIZE);
     const urls = await ports.resolvePutUrls(batch);
-    for (const entry of batch) {
+    const viaProxy = [];
+    await eachWithLimit(batch, ARTIFACT_UPLOAD_CONCURRENCY, async (entry) => {
       const url2 = urls?.get(artifactUrlKey(entry.kind, entry.file.name));
       if (!url2) {
-        proxied += 1;
-        await ports.putProxied(entry);
-        continue;
+        viaProxy.push(entry);
+        return;
       }
       try {
         await ports.putSigned(url2, entry);
       } catch {
-        proxied += 1;
-        await ports.putProxied(entry);
+        viaProxy.push(entry);
       }
+    });
+    for (const entry of viaProxy) {
+      proxied += 1;
+      await ports.putProxied(entry);
     }
   }
-  return { proxied, total: entries.length };
+  const bytes = entries.reduce(
+    (total, entry) => total + entry.file.data.byteLength,
+    0
+  );
+  return { proxied, total: entries.length, bytes };
+}
+function artifactUploadSummary(report, elapsedMs) {
+  const kilobytes = Math.ceil(report.bytes / 1e3);
+  const size = kilobytes >= 1e3 ? `${(report.bytes / 1e6).toFixed(1)} MB` : `${String(kilobytes)} kB`;
+  const files = report.total === 1 ? "file" : "files";
+  return `Uploaded ${String(report.total)} artifact ${files} (${size}) in ${(elapsedMs / 1e3).toFixed(1)} s.`;
 }
 
 // ../../packages/build/src/cache.ts
@@ -74,7 +102,7 @@ var ERROR_CODE = {
   deps: "INSTALL_FAILED",
   next: "BUILD_FAILED"
 };
-async function computeDepsCacheKey(checkoutDir, packageManager) {
+async function computeDepsCacheKey(checkoutDir, packageManager, extra = []) {
   for (const name of LOCKFILES) {
     let content;
     try {
@@ -82,7 +110,10 @@ async function computeDepsCacheKey(checkoutDir, packageManager) {
     } catch {
       continue;
     }
-    const hash2 = createHash("sha256").update(name).update("\n").update(content).digest("hex");
+    const hasher = createHash("sha256").update(name).update("\n").update(content);
+    if (extra.length > 0) hasher.update(`
+${extra.join("\n")}`);
+    const hash2 = hasher.digest("hex");
     return `${packageManager}-${hash2}`;
   }
   return null;
@@ -100,6 +131,7 @@ async function reportUnavailable(scope, ports, observer) {
     "Build cache is unavailable - this build runs uncached and saves nothing for the next one."
   );
 }
+var UNKNOWN_PAX_KEYWORD = /^tar: Ignoring unknown extended header keyword /;
 async function restoreCache(args) {
   const { scope, key, targetDir, ports, observer } = args;
   const urls = await ports.transport.resolveUrls(scope, key);
@@ -132,7 +164,9 @@ async function restoreCache(args) {
       stage: STAGE[scope],
       errorCode: ERROR_CODE[scope]
     },
-    observer
+    {
+      onLog: (entry) => UNKNOWN_PAX_KEYWORD.test(entry.message) ? void 0 : observer.onLog(entry)
+    }
   );
   await log(observer, scope, "INFO", `Restored ${scope} cache (${key}).`);
   return true;
@@ -160,7 +194,14 @@ async function saveCache(args) {
   await ports.runCommand(
     {
       command: "tar",
-      args: ["--zstd", "-cf", archive, "-C", sourceDir, "."],
+      // --no-xattrs: macOS bsdtar would store extended attributes that the
+      // build container's GNU tar warns about per file (UNKNOWN_PAX_KEYWORD).
+      // GNU tar 1.27+ and bsdtar 3.x both take it.
+      args: ["--no-xattrs", "--zstd", "-cf", archive, "-C", sourceDir, "."],
+      // macOS can also write the same metadata as AppleDouble `._name` files,
+      // which GNU tar restores as ordinary files (PR #114 review; not seen on
+      // bsdtar 3.5.3 here). GNU tar ignores the variable.
+      env: { COPYFILE_DISABLE: "1" },
       cwd: sourceDir,
       timeoutMs: 12e4,
       stage: STAGE[scope],
@@ -224,9 +265,9 @@ function hashAsset(data, contentType2) {
 }
 
 // ../../packages/build/src/local-build-executor.ts
-import { access as access8, mkdtemp, readFile as readFile12, rm as rm2 } from "fs/promises";
+import { access as access8, mkdtemp, readFile as readFile12, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join17, resolve as resolve7 } from "path";
+import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/route-patterns.ts
 var ROUTE_PATTERN = /^\/[A-Za-z0-9\-._~%!$&()*+,;=:@/[\]]*$/;
@@ -257,6 +298,9 @@ var PHASES = [
 ];
 var ACTIVE_STATUSES = new Set(PHASES);
 
+// ../../packages/core/src/deployment-stall.ts
+var STALL_WINDOW_MS = 10 * 6e4;
+
 // ../../packages/core/src/deployment-strategy.ts
 var MIN_SUPPORTED_NEXT_MAJOR = 15;
 
@@ -15254,13 +15298,18 @@ function cacheEnv(dir) {
   return {
     npm_config_store_dir: dir,
     npm_config_cache: dir,
-    YARN_CACHE_FOLDER: dir
+    YARN_CACHE_FOLDER: dir,
+    YARN_ENABLE_GLOBAL_CACHE: "0"
   };
 }
 function withSharedCache(spec, dir) {
   return {
     ...spec,
-    addArgs: (specs) => [...spec.addArgs(specs), ...spec.cacheArgs(dir)],
+    addArgs: (specs) => [
+      ...spec.addArgs(specs),
+      ...spec.sharedCacheAddArgs ?? [],
+      ...spec.cacheArgs(dir)
+    ],
     addEnv: { ...spec.addEnv, ...cacheEnv(dir) }
   };
 }
@@ -15301,7 +15350,24 @@ async function detectPackageManager(root) {
       install: ["npm", "ci"],
       cacheArgs: (dir) => ["--cache", dir],
       // --no-save keeps package.json and the lockfile untouched.
-      addArgs: (specs) => ["npm", "install", "--no-save", ...specs]
+      addArgs: (specs) => ["npm", "install", "--no-save", ...specs],
+      // --prefer-offline takes package metadata from the restored cache instead
+      // of asking the registry again for each of the toolchain's ~160 packages
+      // (npm keeps metadata in the same cache, which the deps cache saves).
+      // Measured on one vCPU like the build container: 8.8 s → 7.9 s locally,
+      // and the live add took 17 s against 8.8 s here — the gap is registry
+      // round trips.
+      //
+      // npm trusts cached metadata outright: a cached packument that lacks the
+      // asked-for version fails with ETARGET instead of being fetched again
+      // (pacote leaves that revalidation as a TODO). That cannot happen in the
+      // build's own cache because its key carries the toolchain
+      // (computeDepsCacheKey): a toolchain bump starts from an empty cache, and
+      // the cache restored under a key was filled by this same add over the
+      // same lockfile. A machine's default cache has no such key, so without
+      // the build cache (no zstd, no transport — mostly the CLI) the add stays
+      // online (PR #134 review).
+      sharedCacheAddArgs: ["--prefer-offline"]
     };
   }
   if (await exists(join2(root, "yarn.lock"))) {
@@ -15313,7 +15379,8 @@ async function detectPackageManager(root) {
         "install",
         modern ? "--immutable" : "--frozen-lockfile"
       ],
-      // Berry takes no install-time cache flag; YARN_CACHE_FOLDER covers it.
+      // Berry takes no install-time cache flag; cacheEnv covers it
+      // (YARN_CACHE_FOLDER with the global cache switched off).
       cacheArgs: (dir) => modern ? [] : ["--cache-folder", dir],
       addArgs: (specs) => ["yarn", "add", ...specs]
     };
@@ -15648,14 +15715,18 @@ async function pathExists(path) {
     return false;
   }
 }
+var BUILD_NPMRC = [
+  "# Host package-manager credentials are intentionally unavailable.",
+  "audit=false",
+  "fund=false",
+  "update-notifier=false",
+  ""
+].join("\n");
 async function createPackageManagerConfig(appRoot, writer = async (path, contents) => {
   await writeFile3(path, contents, "utf8");
 }) {
   const packageManagerConfigPath = join5(appRoot, ".next-deploy-user.npmrc");
-  await writer(
-    packageManagerConfigPath,
-    "# Host package-manager credentials are intentionally unavailable.\n"
-  );
+  await writer(packageManagerConfigPath, BUILD_NPMRC);
   return packageManagerConfigPath;
 }
 async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
@@ -17921,8 +17992,11 @@ function createVinextCloudflareStrategy(options) {
 }
 
 // ../../packages/build/src/strategy/workspace.ts
-import { cp } from "fs/promises";
-import { basename as basename2, join as join16, relative as relative5, resolve as resolve6 } from "path";
+import { execFile } from "child_process";
+import { cp, mkdir as mkdir2, readdir as readdir4, rm as rm2 } from "fs/promises";
+import { basename as basename2, dirname as dirname3, join as join16, relative as relative5, resolve as resolve6 } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
 var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
 function shouldCopy(path) {
   const name = basename2(path);
@@ -17937,6 +18011,33 @@ async function copyCheckout(source, target2) {
     filter: (path) => resolve6(path) === origin || shouldCopy(path)
   });
 }
+async function copyInstalledPackages(source, target2) {
+  const origin = resolve6(source);
+  const installs = [];
+  const walk2 = async (dir) => {
+    for (const entry of await readdir4(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name === ".git") continue;
+      const path = join16(dir, entry.name);
+      if (entry.name === "node_modules") installs.push(path);
+      else await walk2(path);
+    }
+  };
+  await walk2(origin);
+  for (const install of installs)
+    await copyTree(install, join16(target2, relative5(origin, install)));
+}
+async function copyTree(from, to) {
+  await mkdir2(dirname3(to), { recursive: true });
+  if (process.platform !== "win32") {
+    try {
+      await execFileAsync("cp", ["-a", from, to]);
+      return;
+    } catch {
+      await rm2(to, { recursive: true, force: true });
+    }
+  }
+  await cp(from, to, { recursive: true, verbatimSymlinks: true });
+}
 function forkedAppRoot(checkout, appRoot, forkCheckout) {
   return join16(forkCheckout, relative5(checkout, appRoot));
 }
@@ -17961,7 +18062,7 @@ async function withRouteList(artifact, list, appRoot, observer) {
 }
 var defaultLocalBuildDependencies = {
   createWorkspace: () => mkdtemp(join17(tmpdir(), "next-deploy-build-")),
-  removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
+  removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
   resolveAppRoot,
@@ -17981,6 +18082,7 @@ var defaultLocalBuildDependencies = {
   readVinextArtifact,
   vinextCommand: "vinext",
   forkWorkspace: copyCheckout,
+  copyInstalledPackages,
   collectProjectFacts,
   listNextRoutes,
   hashFingerprintInputs: hashStrategyInputs,
@@ -18002,7 +18104,7 @@ async function readInstalledNextVersion(appRoot, checkout) {
     } catch {
     }
     if (dir === stop) return null;
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -18220,7 +18322,11 @@ var LocalBuildExecutor = class {
         let depsKey = null;
         let depsRestored = false;
         if (cachePorts) {
-          depsKey = await computeDepsCacheKey(checkout, packageManager.name);
+          depsKey = await computeDepsCacheKey(
+            checkout,
+            packageManager.name,
+            isNext ? VINEXT_TOOLCHAIN : []
+          );
           if (depsKey) {
             depsRestored = await tryRestore(
               "deps",
@@ -18305,6 +18411,7 @@ var LocalBuildExecutor = class {
           const fork = this.dependencies.forkWorkspace ?? defaultFork;
           await fork(checkout, pristine);
           let forks = 0;
+          const resolverConcurrency = this.dependencies.resolverConcurrency ?? 1;
           const forkWorkspace = async (label2) => {
             const target2 = join17(
               workspace,
@@ -18312,7 +18419,9 @@ var LocalBuildExecutor = class {
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
             );
             await fork(pristine, target2);
-            await install(target2);
+            if (packageManager.name === "npm" && resolverConcurrency === 1)
+              await (this.dependencies.copyInstalledPackages ?? copyInstalledPackages)(checkout, target2);
+            else await install(target2);
             return {
               checkout: target2,
               appRoot: forkedAppRoot(checkout, appRoot, target2)
@@ -18355,7 +18464,7 @@ var LocalBuildExecutor = class {
             {
               pinned: input.strategy ?? null,
               fingerprint: fingerprint.hash,
-              concurrency: this.dependencies.resolverConcurrency ?? 1,
+              concurrency: resolverConcurrency,
               ...this.dependencies.now ? { now: this.dependencies.now } : {}
             }
           );
@@ -18446,22 +18555,31 @@ function createLogBatcher(options) {
   let buffer = [];
   let timer = null;
   let pending = null;
+  let sending = Promise.resolve();
   function disarm() {
     if (timer === null) return;
     clearTimeout(timer);
     timer = null;
   }
+  function surfacePending() {
+    if (pending === null) return;
+    const { error: error51 } = pending;
+    pending = null;
+    throw error51;
+  }
   async function flush() {
     disarm();
-    if (pending !== null) {
-      const { error: error51 } = pending;
-      pending = null;
-      throw error51;
+    surfacePending();
+    if (buffer.length === 0) {
+      await sending;
+      surfacePending();
+      return;
     }
-    if (buffer.length === 0) return;
     const batch = buffer;
     buffer = [];
-    await options.send(batch);
+    const send = sending.then(() => options.send(batch));
+    sending = send.catch(() => void 0);
+    await send;
   }
   function arm() {
     if (timer !== null || !options.intervalMs) return;
@@ -19481,6 +19599,31 @@ var DomainsApi = class {
     const match = await this.findByHostname(projectId, hostname3);
     return this.verify(projectId, match.id, options);
   }
+  /**
+   * Ownership checks the project opened for domains another project holds
+   * (known-issues #156). Adding such a domain fails with
+   * DOMAIN_VERIFICATION_REQUIRED and its check in `details.claim`.
+   */
+  async listClaims(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims`,
+      { context: "List ownership checks" }
+    );
+    return body.claims;
+  }
+  /** Reads the TXT record; when it matches, the domain moves to this project. */
+  async verifyClaim(projectId, claimId) {
+    return this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims/${encodeURIComponent(claimId)}/verify`,
+      { method: "POST", body: {}, context: "Verify domain ownership" }
+    );
+  }
+  async removeClaim(projectId, claimId) {
+    await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domain-claims/${encodeURIComponent(claimId)}`,
+      { method: "DELETE", context: "Remove ownership check" }
+    );
+  }
   async removeById(projectId, domainId) {
     await this.client.request(
       `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
@@ -19950,6 +20093,14 @@ function bucketFields(fields, into = {}) {
     if (fields[key] !== void 0) into[key] = fields[key];
   return into;
 }
+function listFields(options) {
+  const body = {};
+  if (options.prefix !== void 0) body.prefix = options.prefix;
+  if (options.limit !== void 0) body.limit = options.limit;
+  if (options.offset !== void 0) body.offset = options.offset;
+  if (options.sortBy !== void 0) body.sortBy = options.sortBy;
+  return body;
+}
 var BackendApi = class {
   constructor(client) {
     this.client = client;
@@ -20474,6 +20625,60 @@ var StorageApi = class {
     );
     return { deleted: body.deleted, done: body.done };
   }
+  /**
+   * What is directly below a folder of a bucket — its folders first, by
+   * name, then its files — through the control plane's object proxy
+   * (Storage 3-1e): the project's Naro worker lists it with the stored
+   * service key, so every object is listed whatever the policies say. There
+   * is no search. Needs `storage.manage`, Storage on and the backend on and
+   * ready (`STORAGE_NOT_ENABLED`, `BACKEND_OFF`, `BACKEND_NOT_READY`, 409);
+   * the worker's refusals — `BUCKET_NOT_FOUND`, `INVALID_REQUEST` with
+   * `details.path` and `details.reason` — come through as they are.
+   */
+  async listObjects(projectId, bucket, options = {}) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/list"),
+      { method: "POST", body: listFields(options), context: "List objects" }
+    );
+    return body.objects;
+  }
+  /**
+   * A link that downloads one object without a key, for `expiresIn` seconds
+   * (1–3600 through the control plane; `VALIDATION_FAILED` past it), on the
+   * project's URL. Replacing or deleting the object ends it. The path is
+   * held to the object name rules (`INVALID_PATH`); one not there is the
+   * worker's `OBJECT_NOT_FOUND`.
+   */
+  async signObject(projectId, bucket, path, options) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects/sign"),
+      {
+        method: "POST",
+        body: {
+          path,
+          expiresIn: options.expiresIn,
+          // false is no download (supabase-js): left out, since the worker
+          // answers it 400 INVALID_REQUEST — it is not a file name.
+          ...options.download === void 0 || options.download === false ? {} : { download: options.download }
+        },
+        context: "Sign an object URL"
+      }
+    );
+    return { signedUrl: body.signedUrl };
+  }
+  /**
+   * Deletes up to 1,000 objects by their full paths and answers the ones it
+   * deleted, in the order asked: a path not there, or being written, is left
+   * out — not an error (supabase-js's `remove`). A folder is not deleted by
+   * its name; list it and delete what is in it.
+   */
+  async removeObjects(projectId, bucket, prefixes) {
+    const body = await this.client.request(
+      this.bucketPath(projectId, bucket, "/objects"),
+      { method: "DELETE", body: { prefixes }, context: "Remove objects" }
+    );
+    return body.objects;
+  }
 };
 
 // ../../packages/sdk/src/database.ts
@@ -21080,6 +21285,10 @@ var CATALOG = {
     status: 404,
     message: ({ bucket, path }) => `Object ${storageName(path)} was not found in bucket ${storageName(bucket)}.`
   },
+  UPLOAD_NOT_FOUND: {
+    status: 404,
+    message: ({ upload }) => `Upload ${storageName(upload)} was not found or has expired.`
+  },
   INVALID_CONTENT_TYPE: {
     status: 400,
     message: ({ type }) => `Content-Type ${storageName(type)} is not a media type like image/png.`
@@ -21094,7 +21303,7 @@ var CATALOG = {
   },
   OBJECT_TOO_LARGE: {
     status: 413,
-    message: (vars) => "single" in vars ? "Uploads over 50 MiB are not supported yet." : `The object is ${String(vars.size)} bytes; bucket ${storageName(vars.bucket)} takes objects up to ${String(vars.max)} bytes.`
+    message: (vars) => "single" in vars ? "Uploads over 50 MiB go in parts: use the multipart upload." : `The object is ${String(vars.size)} bytes; bucket ${storageName(vars.bucket)} takes objects up to ${String(vars.max)} bytes.`
   },
   MIME_TYPE_NOT_ALLOWED: {
     status: 415,
@@ -25840,7 +26049,7 @@ function claimUpload(i) {
   const nonce = nonceOf(i.nonce);
   return compose(
     [
-      `INSERT INTO ${STORAGE_OBJECTS_TABLE} (id, bucket_id, name, owner, owner_id, metadata, version, parent, size, status, lock_id, lock_expires_at) SELECT ?, ?, ?, ?, ?, ?, NULL, ?, ?, 'uploading', ?, ? WHERE CASE WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} WHERE id = ? AND ${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN (`,
+      `INSERT INTO ${STORAGE_OBJECTS_TABLE} (id, bucket_id, name, owner, owner_id, metadata, version, parent, size, status, lock_id, lock_expires_at, pending) SELECT ?, ?, ?, ?, ?, ?, NULL, ?, ?, 'uploading', ?, ?, ? WHERE CASE WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} WHERE id = ? AND ${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN (`,
       i.check,
       `) <> 1 THEN 0 WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} WHERE bucket_id = ? AND name = ? AND status = 'ready') THEN ${marker("exists", nonce)} WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} WHERE bucket_id = ? AND name = ?) THEN ${marker("busy", nonce)} WHEN ${PROJECT_BYTES} + ? > ? THEN ${marker("quota", nonce)} ELSE 1 END RETURNING id`
     ],
@@ -25856,6 +26065,7 @@ function claimUpload(i) {
         i.size,
         i.lockId,
         i.expiresAt,
+        i.pending ?? null,
         i.bucket
       ],
       [i.bucket, i.name, i.bucket, i.name, i.size, i.limitBytes]
@@ -25879,6 +26089,13 @@ function overwriteCheckRow(i) {
 }
 function claimOverwrite(i) {
   const nonce = nonceOf(i.nonce);
+  const room = i.inParts ? {
+    sql: `${PROJECT_BYTES} + ? > ?`,
+    values: [i.size, i.limitBytes]
+  } : {
+    sql: `? > o.size AND ${PROJECT_BYTES} + ? - o.size > ?`,
+    values: [i.size, i.size, i.limitBytes]
+  };
   return compose(
     [
       `UPDATE ${STORAGE_OBJECTS_TABLE} AS o SET lock_id = ?, lock_expires_at = ?, pending = ? WHERE o.bucket_id = ? AND o.name = ? AND CASE WHEN NOT (`,
@@ -25886,17 +26103,14 @@ function claimOverwrite(i) {
       // The row's own bucket (`o.bucket_id`), so no value is bound for it.
       `) THEN ${marker("hidden", nonce)} WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} AS b WHERE b.id = o.bucket_id AND b.${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN o.status <> 'ready' OR o.lock_id IS NOT NULL THEN ${marker("busy", nonce)} WHEN NOT (`,
       i.updateUsing,
-      `) THEN ${marker("denied", nonce)} WHEN ? > o.size AND ${PROJECT_BYTES} + ? - o.size > ? THEN ${marker("quota", nonce)} ELSE (`,
+      `) THEN ${marker("denied", nonce)} WHEN ${room.sql} THEN ${marker("quota", nonce)} ELSE (`,
       i.check,
       // RETURNING names the columns bare: it does not see the UPDATE's
       // alias (SQLite 3.53: `no such column: o.id`), and the table is the
       // only one there.
       ") END RETURNING id, version, size, owner, owner_id, created_at"
     ],
-    [
-      [i.lockId, i.expiresAt, i.pending, i.bucket, i.name],
-      [i.size, i.size, i.limitBytes]
-    ]
+    [[i.lockId, i.expiresAt, i.pending, i.bucket, i.name], room.values]
   );
 }
 function claimDelete(i) {
@@ -27075,6 +27289,17 @@ function formatRedirectEntry(entry) {
   return entry.path === "/" ? entry.origin : `${entry.origin}${entry.path}`;
 }
 
+// ../../packages/data-core/src/storage-multipart.ts
+var MiB = 1024 * 1024;
+var MULTIPART_PART_SIZES = [16 * MiB, 32 * MiB, 64 * MiB];
+var MAX_MULTIPART_PARTS = 1e4;
+var MAX_MULTIPART_BYTES = 64 * MiB * MAX_MULTIPART_PARTS;
+var MULTIPART_LOCK_MS = 60 * 60 * 1e3;
+var MULTIPART_PART_EXTEND_BELOW_MS = 30 * 60 * 1e3;
+var MULTIPART_COMPLETE_LOCK_MS = 15 * 60 * 1e3;
+var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var UPLOAD_ID = new RegExp(`^(${UUID})\\.(${UUID})$`);
+
 // ../../packages/data-core/src/system-sql.ts
 async function convertLegacyPolicies(db, found) {
   const rows = rowsOf(await db.prepare(POLICY_SQL.list).all());
@@ -28063,14 +28288,14 @@ async function promptForMissingEnv(ctx, keys) {
 }
 
 // src/git-info.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 var SUPPORTED_REMOTE = [
   /^https:\/\/[^\s]+$/,
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
 var defaultExec = (args, cwd) => new Promise((resolve11, reject) => {
-  execFile("git", args, { cwd }, (error51, stdout) => {
+  execFile2("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
     else resolve11(stdout);
   });
@@ -28203,7 +28428,9 @@ function manifest(artifact) {
   };
 }
 async function uploadArtifact(artifact, opts) {
-  await uploadArtifactFiles(artifact, uploadPorts(opts));
+  const started = Date.now();
+  const report = await uploadArtifactFiles(artifact, uploadPorts(opts));
+  const uploadSummary = artifactUploadSummary(report, Date.now() - started);
   const response = await authed(opts, "/artifacts/complete", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -28214,7 +28441,8 @@ async function uploadArtifact(artifact, opts) {
     throw new Error("Control plane did not return an artifact key.");
   return {
     artifactKey: payload.artifactKey,
-    previewUrl: typeof payload.previewUrl === "string" ? payload.previewUrl : null
+    previewUrl: typeof payload.previewUrl === "string" ? payload.previewUrl : null,
+    uploadSummary
   };
 }
 
@@ -28290,7 +28518,8 @@ function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUr
       await flushLogs();
       await post({ type: "metadata", metadata: rest }).catch(() => {
       });
-    }
+    },
+    flush: flushLogs
   };
 }
 function slugify2(value) {
@@ -28309,11 +28538,11 @@ async function projectName(sourceDir) {
 }
 var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 function resolveBin(name) {
-  let dir = dirname4(fileURLToPath(import.meta.url));
+  let dir = dirname5(fileURLToPath(import.meta.url));
   for (; ; ) {
     const candidate = join24(dir, "node_modules", ".bin", name);
     if (existsSync7(candidate)) return candidate;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return name;
     dir = parent;
   }
@@ -28339,7 +28568,7 @@ async function detectPackageManagerLenient(root) {
 function localDependencies(sourceDir) {
   return {
     createWorkspace: () => mkdtemp2(join24(tmpdir2(), "naro-build-")),
-    removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
+    removeWorkspace: (path) => rm4(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
         const checkout = spec.args.at(-1);
@@ -28485,12 +28714,19 @@ async function deployDirectory(sourceDir, options, log2) {
       { details: { deploymentId: ctx.deploymentId }, cause: error51 }
     );
   }
-  await uploadArtifact(artifact, {
+  const { uploadSummary } = await uploadArtifact(artifact, {
     controlPlaneUrl: cpUrl,
     deploymentId: ctx.deploymentId,
     callbackToken: ctx.callbackToken,
     ...options.fetch ? { fetch: options.fetch } : {}
   });
+  log2(`\u25B8 ${uploadSummary}`);
+  await observer.onLog({
+    level: "INFO",
+    stage: "DEPLOYING",
+    message: uploadSummary
+  });
+  await observer.flush();
   log2("\u25B8 publishing worker");
   const detail = await waitForFinish(client, ctx, log2);
   const url2 = deploymentUrl(detail, ctx, production);
@@ -28568,7 +28804,6 @@ export {
   parseCacheControl,
   STORAGE_OBJECTS_TABLE,
   systemTablePredicate,
-  dataError,
   SCHEMA_SQL,
   tableNames,
   snapshotFromRows,