naro-cli 0.17.0 → 0.19.0

package/dist/{chunk-PYRN5XR6.js → chunk-DEEFHVDZ.js}

@@ -5,9 +5,9 @@ import {
 
 // src/deploy.ts
 import { existsSync as existsSync7 } from "fs";
-import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm4 } from "fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile14, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname5, join as join24, resolve as resolve10 } from "path";
+import { basename as basename4, dirname as dirname6, join as join25, resolve as resolve11 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -26,7 +26,8 @@ function artifactUrlKey(kind, name) {
   return `${kind}/${name}`;
 }
 var ARTIFACT_URL_BATCH_SIZE = 100;
-var ARTIFACT_UPLOAD_CONCURRENCY = 8;
+var ARTIFACT_UPLOAD_CONCURRENCY = 24;
+var ARTIFACT_UPLOAD_BYTE_BUDGET = 16 * 1024 * 1024;
 function parseArtifactPutUrls(payload) {
   if (typeof payload !== "object" || payload === null) return null;
   const { urls, disabled } = payload;
@@ -38,39 +39,60 @@ function parseArtifactPutUrls(payload) {
   }
   return resolved;
 }
-async function eachWithLimit(items, limit, work) {
-  let next = 0;
-  const lanes = Array.from(
-    { length: Math.min(limit, items.length) },
-    async () => {
-      while (next < items.length) {
+async function eachWithinBudget(items, limit, budget, weigh, work) {
+  if (items.length === 0) return;
+  await new Promise((resolve12, reject) => {
+    let next = 0;
+    let running = 0;
+    let weight = 0;
+    let finished = 0;
+    const pump = () => {
+      while (next < items.length && running < limit) {
         const item = items[next];
+        const itemWeight = weigh(item);
+        if (running > 0 && weight + itemWeight > budget) return;
         next += 1;
-        await work(item);
+        running += 1;
+        weight += itemWeight;
+        work(item).then(() => {
+          running -= 1;
+          weight -= itemWeight;
+          finished += 1;
+          if (finished === items.length) resolve12();
+          else pump();
+        }, reject);
       }
-    }
-  );
-  await Promise.all(lanes);
+    };
+    pump();
+  });
 }
-async function uploadArtifactFiles(artifact, ports) {
+async function uploadArtifactFiles(artifact, ports, limits = {}) {
+  const concurrency = limits.concurrency ?? ARTIFACT_UPLOAD_CONCURRENCY;
+  const byteBudget = limits.byteBudget ?? ARTIFACT_UPLOAD_BYTE_BUDGET;
   const entries = artifactUploadEntries(artifact);
   let proxied = 0;
   for (let index = 0; index < entries.length; index += ARTIFACT_URL_BATCH_SIZE) {
     const batch = entries.slice(index, index + ARTIFACT_URL_BATCH_SIZE);
     const urls = await ports.resolvePutUrls(batch);
     const viaProxy = [];
-    await eachWithLimit(batch, ARTIFACT_UPLOAD_CONCURRENCY, async (entry) => {
-      const url2 = urls?.get(artifactUrlKey(entry.kind, entry.file.name));
-      if (!url2) {
-        viaProxy.push(entry);
-        return;
-      }
-      try {
-        await ports.putSigned(url2, entry);
-      } catch {
-        viaProxy.push(entry);
+    await eachWithinBudget(
+      batch,
+      concurrency,
+      byteBudget,
+      (entry) => entry.file.data.byteLength,
+      async (entry) => {
+        const url2 = urls?.get(artifactUrlKey(entry.kind, entry.file.name));
+        if (!url2) {
+          viaProxy.push(entry);
+          return;
+        }
+        try {
+          await ports.putSigned(url2, entry);
+        } catch {
+          viaProxy.push(entry);
+        }
       }
-    });
+    );
     for (const entry of viaProxy) {
       proxied += 1;
       await ports.putProxied(entry);
@@ -305,6 +327,125 @@ var STALL_WINDOW_MS = 10 * 6e4;
 var MIN_SUPPORTED_NEXT_MAJOR = 15;
 
 // ../../packages/core/src/errors.ts
+var DEPLOYMENT_ERROR_CODES = [
+  "CLONE_FAILED",
+  "UNSUPPORTED_PACKAGE_MANAGER",
+  "INSTALL_FAILED",
+  "FRAMEWORK_DETECTION_FAILED",
+  "BUILD_FAILED",
+  "OPENNEXT_FAILED",
+  "NEXT_VERSION_UNSUPPORTED",
+  "NO_DEPLOYMENT_STRATEGY",
+  "ARTIFACT_INVALID",
+  "DEPLOY_FAILED",
+  "QUEUE_PUBLISH_FAILED",
+  "GIT_NOT_CONNECTED",
+  "UNAUTHORIZED",
+  /** Signed in, but the role does not carry the permission for this write. */
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "DEPLOYMENT_NOT_PROMOTABLE",
+  "DEPLOYMENT_NOT_CANCELABLE",
+  "SUBDOMAIN_TAKEN",
+  "FLAG_EXISTS",
+  "DOMAIN_EXISTS",
+  /** known-issues #127: the project already has the most custom domains it can have (20). */
+  "DOMAIN_LIMIT_REACHED",
+  /** known-issues #127: the project's serving domains would not fit in its Naro worker's NARO_PRODUCTION_ORIGINS. */
+  "DOMAIN_NAMES_TOO_LONG",
+  /** The server has no Cloudflare credentials for custom domains, so no domain can be added, checked or removed. */
+  "DOMAINS_NOT_CONFIGURED",
+  /** Another project holds the hostname; a TXT ownership check was opened (known-issues #156). */
+  "DOMAIN_VERIFICATION_REQUIRED",
+  /** The ownership check ran past its seven days; adding the domain again opens a new one. */
+  "DOMAIN_CLAIM_EXPIRED",
+  "DNS_ZONE_EXISTS",
+  "DNS_DELEGATION_NOT_ENABLED",
+  /** naro DNS record editor (spec 2026-10-17-dns-delegation-stage2 §3): a record a naro project or Cloudflare answers on. */
+  "DNS_RECORD_PROTECTED",
+  /** The zone holds as many records as Cloudflare allows it. */
+  "DNS_RECORD_QUOTA",
+  /** Cloudflare refused the record; the message carries its reason. */
+  "DNS_RECORD_REJECTED",
+  "RULE_EXISTS",
+  "STORAGE_EXISTS",
+  /** The project's Cloudflare D1 could not be provisioned or reused. */
+  "DATABASE_PROVISION_FAILED",
+  /**
+   * A stored env value no longer decrypts: ENV_ENCRYPTION_KEY is missing or
+   * is not the key it was saved with (known-issues #5).
+   */
+  "ENV_DECRYPT_FAILED",
+  /** naro db tooling (spec §11). The kill switch DATABASE_TOOLING_ENABLED is unset. */
+  "DATABASE_TOOLING_DISABLED",
+  /** The project uses an external database naro does not manage. */
+  "DATABASE_NOT_ENABLED",
+  /** No provisioned D1 yet and the caller may not auto-provision one. */
+  "DATABASE_NOT_READY",
+  /** A migration by that name is already in the ledger (B1b). */
+  "DATABASE_MIGRATION_EXISTS",
+  /** SQLite or Cloudflare rejected the statement; the message is Cloudflare's, sanitized. */
+  "DATABASE_QUERY_FAILED",
+  /** A write was sent in read-only mode, or the read-only paranoia scan refused it. */
+  "DATABASE_READ_ONLY",
+  "DATABASE_STATEMENT_TOO_LARGE",
+  "DATABASE_TOO_MANY_PARAMS",
+  "DATABASE_TOO_MANY_STATEMENTS",
+  /** The D1 response passed the byte cap before it was parsed. */
+  "DATABASE_RESULT_TOO_LARGE",
+  /** D1 reported a timeout or overload — retry with a narrower query. */
+  "DATABASE_OVERLOADED",
+  /** Cloudflare 5xx or transport failure. */
+  "DATABASE_UNAVAILABLE",
+  /** Cloudflare refused the export — `result.status: "error"` inside a 200, or a 4xx (spec §16.5). */
+  "DATABASE_EXPORT_FAILED",
+  /** Cloudflare answered a Time Travel restore with a 5xx — live, an unknown bookmark. */
+  "DATABASE_RESTORE_FAILED",
+  /** `db pull`: the d1_migrations ledger is not empty, so there is no baseline to record. */
+  "DATABASE_HAS_MIGRATIONS",
+  /** `db pull`: no tables, views, indexes or triggers to record. */
+  "DATABASE_EMPTY",
+  /** PR C: the project's D1 wrote more rows today (UTC) than its daily limit; writes wait for 00:00 UTC. */
+  "DATABASE_WRITE_QUOTA_EXCEEDED",
+  /** PR C: the meter job could not read Cloudflare's D1 analytics, so it changed nothing. */
+  "DATABASE_METERING_FAILED",
+  /** PR D: D1 refused a write because the database reached its 10 GB limit, which cannot be raised. */
+  "DATABASE_FULL",
+  /** Usage limits spec 2026-10-18 §6: a hobby team created its 100 deployments this UTC month. */
+  "USAGE_LIMIT_REACHED",
+  /** A hobby team has its 3 projects; no project can be added. */
+  "PROJECT_LIMIT_REACHED",
+  /** A hobby team has its 1 member; no member or invite can be added. */
+  "MEMBER_LIMIT_REACHED",
+  /** Custom domains are not part of the Hobby plan. */
+  "PLAN_DOMAINS_NOT_INCLUDED",
+  /** Named environments (spec 2026-10-18-named-environments §15): the name is not lowercase letters, digits and single hyphens, or is over 20 characters. */
+  "ENVIRONMENT_NAME_INVALID",
+  /** `production` and `preview` are reserved names. */
+  "ENVIRONMENT_NAME_RESERVED",
+  /** `<subdomain>--<name>` would be longer than the 63-character DNS label limit. */
+  "ENVIRONMENT_NAME_TOO_LONG",
+  /** The project's subdomain cannot carry environments (it is `xn`). */
+  "ENVIRONMENT_HOST_INVALID",
+  "ENVIRONMENT_EXISTS",
+  /** Another environment of the project already deploys this branch. */
+  "ENVIRONMENT_BRANCH_TAKEN",
+  /** The branch deploys to production. */
+  "ENVIRONMENT_BRANCH_IS_PRODUCTION",
+  /** The plan's environment count is full. */
+  "ENVIRONMENT_LIMIT_REACHED",
+  /** The project uses a Naro database, which environments do not support yet (stages 1 and 2 only). */
+  "ENVIRONMENT_DATABASE_UNSUPPORTED",
+  "ENVIRONMENT_NOT_FOUND",
+  /** The project's new default branch is the one an environment deploys. */
+  "BRANCH_USED_BY_ENVIRONMENT",
+  /** A new subdomain would push an environment's label past 63 characters. */
+  "SUBDOMAIN_TOO_LONG_FOR_ENVIRONMENT",
+  /** A deployment failure: the environment was deleted before its deployment finished. */
+  "ENVIRONMENT_DELETED",
+  /** The edge refused the environment's protection change; the database change is rolled back. */
+  "ENVIRONMENT_PROTECTION_PUBLISH_FAILED"
+];
 var DeploymentError = class extends Error {
   code;
   /** HTTP status from the upstream response that caused this error, when known. */
@@ -14950,7 +15091,13 @@ var createProjectSchema = external_exports.object({
   rootDirectory: optionalRootDirectory
 });
 var createDeploymentSchema = external_exports.object({
-  branch: external_exports.string().trim().max(240).optional().transform((value) => value || null)
+  branch: external_exports.string().trim().max(240).optional().transform((value) => value || null),
+  /**
+   * The surface to deploy to: `production`, `preview`, or the slug of one of
+   * the project's environments. Whether the name exists is the route's to say;
+   * 63 is the DNS label a worker name has to fit in.
+   */
+  environment: external_exports.string().trim().min(1).max(63).optional()
 });
 var connectRepositorySchema = external_exports.object({
   // Web-only route context: the only consumer is apps/web's
@@ -15213,6 +15360,40 @@ function splitStatements(sql) {
   };
 }
 
+// ../../packages/core/src/surface.ts
+var PRODUCTION_SURFACE = { kind: "production" };
+var PREVIEW_SURFACE = { kind: "preview" };
+var ENVIRONMENT_SLUG_MAX_LENGTH = 20;
+var RESERVED_ENVIRONMENT_SLUGS = [
+  "production",
+  "preview",
+  "all"
+];
+var SLUG_PATTERN = /^[a-z0-9](-?[a-z0-9])*$/;
+var ENVIRONMENT_SEPARATOR = "--";
+var PREVIEW_SUFFIX = "-preview";
+function environmentSlugProblem(value) {
+  if (value.length < 1 || value.length > ENVIRONMENT_SLUG_MAX_LENGTH)
+    return "invalid";
+  if (!SLUG_PATTERN.test(value)) return "invalid";
+  if (RESERVED_ENVIRONMENT_SLUGS.includes(value))
+    return "reserved";
+  return null;
+}
+function environmentWorkerName(subdomain, slug) {
+  return `${subdomain}${ENVIRONMENT_SEPARATOR}${slug}`;
+}
+function workerNameForSurface(subdomain, surface) {
+  switch (surface.kind) {
+    case "production":
+      return subdomain;
+    case "preview":
+      return `${subdomain}${PREVIEW_SUFFIX}`;
+    case "environment":
+      return environmentWorkerName(subdomain, surface.slug);
+  }
+}
+
 // ../../packages/build/src/next-version.ts
 var NEXT_RELEASE_DATES = {
   16: "2025-10-21",
@@ -15222,8 +15403,8 @@ var NEXT_RELEASE_DATES = {
   12: "2021-10-26"
 };
 var SUPPORT_WINDOW_YEARS = 2;
-var PEER_LOWER = { major: 15, minor: 5, patch: 21 };
-var PEER_16_FLOOR = { major: 16, minor: 2, patch: 11 };
+var VERIFIED_15_FLOOR = { major: 15, minor: 5, patch: 21 };
+var VERIFIED_16_FLOOR = { major: 16, minor: 2, patch: 11 };
 function parseNextVersion(raw) {
   const match = /^\s*(\d+)\.(\d+)\.(\d+)/.exec(raw);
   if (!match) return null;
@@ -15249,9 +15430,9 @@ function supportEndsAt(major) {
 function compare(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
 }
-function withinPeerRange(version2) {
-  if (version2.major === 15) return compare(version2, PEER_LOWER) >= 0;
-  if (version2.major === 16) return compare(version2, PEER_16_FLOOR) >= 0;
+function withinVerifiedRange(version2) {
+  if (version2.major === 15) return compare(version2, VERIFIED_15_FLOOR) >= 0;
+  if (version2.major === 16) return compare(version2, VERIFIED_16_FLOOR) >= 0;
   return version2.major > 16;
 }
 function formatDate(date5) {
@@ -15267,11 +15448,11 @@ function classifyNextVersion(raw, now) {
     };
   }
   const windowEnd = supportEndsAt(version2.major);
-  if (!windowEnd || version2.major < PEER_LOWER.major) {
+  if (!windowEnd || version2.major < VERIFIED_15_FLOOR.major) {
     return {
       status: "too-old",
       version: version2,
-      reason: `Next.js ${raw} is too old to deploy. @opennextjs/cloudflare supports Next.js 15.5.21 and newer. Upgrade to Next.js 16.`
+      reason: `Next.js ${raw} is too old to deploy. Naro deploys Next.js 15 or newer. Upgrade to Next.js 16.`
     };
   }
   if (now > windowEnd) {
@@ -15281,11 +15462,11 @@ function classifyNextVersion(raw, now) {
       reason: `Next.js ${version2.major} left its support window on ${formatDate(windowEnd)}. The build continues, but unsupported releases stop receiving security patches \u2014 upgrade to Next.js 16. See https://nextjs.org/support-policy`
     };
   }
-  if (!withinPeerRange(version2)) {
+  if (!withinVerifiedRange(version2)) {
     return {
       status: "outside-peer-range",
       version: version2,
-      reason: `Next.js ${raw} is outside the range @opennextjs/cloudflare declares support for (>=15.5.21 <16 || >=16.2.11). The build may fail in ways naro cannot explain.`
+      reason: `Next.js ${raw} is outside the range Naro verifies deploys on (>=15.5.21 <16 || >=16.2.11). The build may fail in ways Naro cannot explain.`
     };
   }
   return { status: "supported", version: version2, reason: "" };
@@ -15294,9 +15475,9 @@ function classifyNextVersion(raw, now) {
 // ../../packages/build/src/package-manager.ts
 import { access, readFile as readFile2 } from "fs/promises";
 import { join as join2 } from "path";
-function cacheEnv(dir) {
+function cacheEnv(dir, manager) {
   return {
-    npm_config_store_dir: dir,
+    ...manager === "pnpm" ? { npm_config_store_dir: dir } : {},
     npm_config_cache: dir,
     YARN_CACHE_FOLDER: dir,
     YARN_ENABLE_GLOBAL_CACHE: "0"
@@ -15310,7 +15491,7 @@ function withSharedCache(spec, dir) {
       ...spec.sharedCacheAddArgs ?? [],
       ...spec.cacheArgs(dir)
     ],
-    addEnv: { ...spec.addEnv, ...cacheEnv(dir) }
+    addEnv: { ...spec.addEnv, ...cacheEnv(dir, spec.name) }
   };
 }
 async function exists(path) {
@@ -15805,6 +15986,32 @@ var VITE_CONFIG_NAMES = [
   "vite.config.cts"
 ];
 var GENERATED_VITE_CONFIG = "vite.config.js";
+var GENERATED_WORKER_ENTRY = "naro-worker.js";
+var VINEXT_WORKER_ENTRY_SOURCE = `// Written by naro: vinext's Worker, with getCloudflareContext() given its env.
+import { AsyncLocalStorage } from "node:async_hooks";
+import handler from "vinext/server/fetch-handler";
+
+export * from "vinext/server/fetch-handler";
+
+const requests = new AsyncLocalStorage();
+
+Object.defineProperty(globalThis, Symbol.for("__cloudflare-context__"), {
+  configurable: false,
+  get() {
+    return requests.getStore();
+  },
+  set: undefined,
+});
+
+export default {
+  ...handler,
+  fetch(request, env, ctx) {
+    return requests.run({ env, ctx, cf: request.cf }, () =>
+      handler.fetch(request, env, ctx),
+    );
+  },
+};
+`;
 var OUTPUT_DIR = "dist";
 var SERVER_DIR = "server";
 var CLIENT_DIR = "client";
@@ -15828,6 +16035,13 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
       );
     }
   }
+  const workerEntryPath = join6(appRoot, GENERATED_WORKER_ENTRY);
+  if (await exists3(workerEntryPath)) {
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      `The project already has a ${GENERATED_WORKER_ENTRY}. naro writes its vinext Worker entry under that name and will not overwrite a file of the project's.`
+    );
+  }
   const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
   const viteConfigPath = join6(appRoot, GENERATED_VITE_CONFIG);
   const wranglerConfigPath = join6(appRoot, "wrangler.jsonc");
@@ -15847,6 +16061,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
       ""
     ].join("\n")
   );
+  await writer(workerEntryPath, VINEXT_WORKER_ENTRY_SOURCE);
   await writer(
     wranglerConfigPath,
     `${JSON.stringify(
@@ -15854,7 +16069,7 @@ async function createVinextBuildConfig(appRoot, deploymentId, writer = async (pa
         name: `naro-vinext-${safeDeploymentId}`,
         compatibility_date: VINEXT_COMPATIBILITY_DATE,
         compatibility_flags: ["nodejs_compat"],
-        main: "vinext/server/fetch-handler",
+        main: `./${GENERATED_WORKER_ENTRY}`,
         assets: {
           directory: `${OUTPUT_DIR}/${CLIENT_DIR}`,
           binding: "ASSETS"
@@ -16456,9 +16671,17 @@ function formatLogLine(raw) {
 }
 
 // ../../packages/build/src/redact.ts
-var SECRET_ASSIGNMENT = /\b(CLOUDFLARE_API_TOKEN|SUPABASE_SERVICE_ROLE_KEY|BUILD_CALLBACK_SECRET)=([^\s]+)/gi;
+var KNOWN_SECRET_ASSIGNMENT = /\b(CLOUDFLARE_API_TOKEN|SUPABASE_SERVICE_ROLE_KEY|BUILD_CALLBACK_SECRET)=([^\s]+)/gi;
+var SECRET_NAME_ASSIGNMENT = /\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|_KEY))(\s*[:=]\s*)(["']?)([^\s"']+)/g;
+var AUTHORIZATION = /\b(authorization["']?\s*[:=]\s*["']?)(?:([A-Za-z][\w-]*)\s+)?[^\r\n]+/gi;
+var GITHUB_TOKEN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/g;
+var JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g;
+var PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
 function redactLog(message) {
-  return message.replace(/\bBearer\s+[^\s]+/gi, "Bearer [REDACTED]").replace(/(https?:\/\/)[^/@\s]+@/gi, "$1[REDACTED]@").replace(SECRET_ASSIGNMENT, "$1=[REDACTED]");
+  return message.replace(PRIVATE_KEY, "[REDACTED PRIVATE KEY]").replace(
+    AUTHORIZATION,
+    (_match, prefix, scheme) => scheme ? `${prefix}${scheme} [REDACTED]` : `${prefix}[REDACTED]`
+  ).replace(/\bBearer\s+[^\s]+/gi, "Bearer [REDACTED]").replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1[REDACTED]@").replace(KNOWN_SECRET_ASSIGNMENT, "$1=[REDACTED]").replace(SECRET_NAME_ASSIGNMENT, "$1$2$3[REDACTED]").replace(GITHUB_TOKEN, "[REDACTED]").replace(JWT, "[REDACTED]");
 }
 
 // ../../packages/build/src/process.ts
@@ -16851,10 +17074,10 @@ async function exists4(path) {
     return false;
   }
 }
-async function findSourceFile(appRoot, basename4) {
+async function findSourceFile(appRoot, basename5) {
   for (const dir of SOURCE_DIRECTORIES) {
     for (const ext of SOURCE_EXTENSIONS2) {
-      const rel = dir ? `${dir}/${basename4}.${ext}` : `${basename4}.${ext}`;
+      const rel = dir ? `${dir}/${basename5}.${ext}` : `${basename5}.${ext}`;
       if (await exists4(join11(appRoot, rel))) return rel;
     }
   }
@@ -16921,6 +17144,12 @@ async function collectProjectFacts(appRoot) {
 function label(strategy) {
   return `P${String(strategy.priority)} ${strategy.id}`;
 }
+function clause(text2) {
+  return text2.endsWith(".") && !text2.endsWith("..") ? text2.slice(0, -1) : text2;
+}
+function sentence(text2) {
+  return text2.endsWith(".") ? text2 : `${text2}.`;
+}
 function describeOutcome(outcome) {
   switch (outcome.status) {
     case "success":
@@ -16945,7 +17174,7 @@ async function evaluateOne(strategy, context, observer) {
   await observer.onLog({
     level: outcome.status === "success" ? "INFO" : "WARN",
     stage: "BUILDING",
-    message: `${label(strategy)} ${describeOutcome(outcome)}.`
+    message: sentence(`${label(strategy)} ${describeOutcome(outcome)}`)
   });
   return { id: strategy.id, priority: strategy.priority, outcome };
 }
@@ -17043,10 +17272,13 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
           attempts
         };
       }
+      const othersLeft = candidates.some(
+        (candidate) => candidate.id !== pinnedStrategy.id
+      );
       await observer.onLog({
         level: "WARN",
         stage: "BUILDING",
-        message: `Stored strategy ${label(pinnedStrategy)} no longer works; resolving again with the remaining candidates.`
+        message: othersLeft ? `Stored strategy ${label(pinnedStrategy)} no longer works; resolving again with the remaining candidates.` : `Stored strategy ${label(pinnedStrategy)} no longer works, and no other deployment strategy is left to try for Next.js ${context.nextVersion}.`
       });
     }
   } else if (options.pinned) {
@@ -17059,13 +17291,14 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
   const remaining = candidates.filter(
     (candidate) => !attempts.some((attempt) => attempt.id === candidate.id)
   );
-  await observer.onLog({
-    level: "INFO",
-    stage: "BUILDING",
-    message: `Resolving deployment strategy for Next.js ${context.nextVersion}: ${remaining.map(label).join(
-      ", "
-    )}${options.concurrency > 1 && remaining.length > 1 ? " (in parallel)" : ""}.`
-  });
+  if (remaining.length > 0)
+    await observer.onLog({
+      level: "INFO",
+      stage: "BUILDING",
+      message: `Resolving deployment strategy for Next.js ${context.nextVersion}: ${remaining.map(label).join(
+        ", "
+      )}${options.concurrency > 1 && remaining.length > 1 ? " (in parallel)" : ""}.`
+    });
   if (options.concurrency > 1) {
     const results = await runPool(
       remaining.map(
@@ -17083,11 +17316,25 @@ async function resolveDeploymentStrategy(strategies, context, observer, options)
   }
   const best = pickBest(candidates, attempts);
   if (!best) {
+    const summary = attempts.map(
+      (attempt) => clause(
+        `P${String(attempt.priority)} ${attempt.id} ${describeOutcome(attempt.outcome)}`
+      )
+    ).join("; ");
+    if (attempts.some(
+      (attempt) => attempt.outcome.status === "failed" && attempt.outcome.appBuild
+    ))
+      throw new DeploymentError(
+        "BUILD_FAILED",
+        sentence(
+          `The app's own build failed for Next.js ${context.nextVersion}: ${summary}`
+        )
+      );
     throw new DeploymentError(
       "NO_DEPLOYMENT_STRATEGY",
-      `No deployment strategy succeeded for Next.js ${context.nextVersion}: ${attempts.map(
-        (attempt) => `P${String(attempt.priority)} ${attempt.id} ${describeOutcome(attempt.outcome)}`
-      ).join("; ")}.`
+      sentence(
+        `No deployment strategy succeeded for Next.js ${context.nextVersion}: ${summary}`
+      )
     );
   }
   await observer.onLog({
@@ -17299,7 +17546,8 @@ async function runStep(context, spec, observer) {
   try {
     return {
       ok: true,
-      result: await context.ports.runCommand(spec, capture.observer)
+      result: await context.ports.runCommand(spec, capture.observer),
+      output: capture.lines
     };
   } catch (error51) {
     return { ok: false, error: error51, output: capture.lines };
@@ -17315,6 +17563,9 @@ function describeFailure(step) {
 function failed(stage, reason) {
   return { status: "failed", stage, reason };
 }
+function appBuildFailed(reason) {
+  return { status: "failed", stage: "build", reason, appBuild: true };
+}
 async function info(observer, message) {
   await observer.onLog({ level: "INFO", stage: "BUILDING", message });
 }
@@ -17597,6 +17848,8 @@ import { readFile as readFile11 } from "fs/promises";
 import { join as join14 } from "path";
 var PROXY_TO_MIDDLEWARE_VARIANT = "proxy-to-middleware";
 var NODE_MIDDLEWARE_REFUSAL = /Node\.js middleware is not (?:currently )?supported/i;
+var NODE_MIDDLEWARE_EXPERIMENTAL = /Node\.js middleware support is experimental/i;
+var NODE_MIDDLEWARE_NOT_DEPLOYED = 'Node.js-runtime middleware (runtime: "nodejs") is only an experiment in OpenNext Cloudflare, and Naro does not deploy it. Remove runtime: "nodejs" to build it as Edge middleware';
 async function buildDeclaresNodeMiddleware(appRoot) {
   try {
     const manifest2 = JSON.parse(
@@ -17611,7 +17864,7 @@ async function buildDeclaresNodeMiddleware(appRoot) {
   }
 }
 function createOpenNextCloudflareStrategy(options) {
-  async function attempt(context, roots, observer) {
+  async function attempt(context, roots, observer, ownBuild) {
     let platform;
     try {
       platform = await options.createPlatformBuildConfig(
@@ -17621,7 +17874,7 @@ function createOpenNextCloudflareStrategy(options) {
     } catch (error51) {
       return {
         ok: false,
-        nodeMiddleware: false,
+        nodeMiddleware: null,
         outcome: failed("prepare", describeError(error51))
       };
     }
@@ -17645,8 +17898,15 @@ function createOpenNextCloudflareStrategy(options) {
     if (!nextBuild.ok) {
       return {
         ok: false,
-        nodeMiddleware: false,
-        outcome: failed("build", describeFailure(nextBuild))
+        nodeMiddleware: null,
+        outcome: ownBuild ? appBuildFailed(describeFailure(nextBuild)) : failed("build", describeFailure(nextBuild))
+      };
+    }
+    if (await buildDeclaresNodeMiddleware(roots.appRoot)) {
+      return {
+        ok: false,
+        nodeMiddleware: "experimental",
+        outcome: failed("build", NODE_MIDDLEWARE_NOT_DEPLOYED)
       };
     }
     const openNext = await runStep(
@@ -17670,16 +17930,25 @@ function createOpenNextCloudflareStrategy(options) {
       observer
     );
     if (!openNext.ok) {
-      const nodeMiddleware = openNext.output.some((line) => NODE_MIDDLEWARE_REFUSAL.test(line)) || await buildDeclaresNodeMiddleware(roots.appRoot);
+      const refused = openNext.output.some(
+        (line) => NODE_MIDDLEWARE_REFUSAL.test(line)
+      );
       return {
         ok: false,
-        nodeMiddleware,
+        nodeMiddleware: refused ? "refused" : null,
         outcome: failed(
           "build",
-          nodeMiddleware ? "OpenNext Cloudflare does not support Node.js middleware (Next.js 16 proxy.ts)." : describeFailure(openNext)
+          refused ? NODE_MIDDLEWARE_NOT_DEPLOYED : describeFailure(openNext)
         )
       };
     }
+    if (openNext.output.some((line) => NODE_MIDDLEWARE_EXPERIMENTAL.test(line))) {
+      return {
+        ok: false,
+        nodeMiddleware: "experimental",
+        outcome: failed("build", NODE_MIDDLEWARE_NOT_DEPLOYED)
+      };
+    }
     const layout = {
       appRoot: roots.appRoot,
       wranglerConfigPath: platform.wranglerConfigPath,
@@ -17694,7 +17963,7 @@ function createOpenNextCloudflareStrategy(options) {
     if (!bundle.ok) {
       return {
         ok: false,
-        nodeMiddleware: false,
+        nodeMiddleware: null,
         outcome: failed("bundle", describeFailure(bundle))
       };
     }
@@ -17708,7 +17977,7 @@ function createOpenNextCloudflareStrategy(options) {
     } catch (error51) {
       return {
         ok: false,
-        nodeMiddleware: false,
+        nodeMiddleware: null,
         outcome: failed("bundle", describeError(error51))
       };
     }
@@ -17716,7 +17985,7 @@ function createOpenNextCloudflareStrategy(options) {
     if (!smoke.ok) {
       return {
         ok: false,
-        nodeMiddleware: false,
+        nodeMiddleware: null,
         outcome: failed("smoke", smoke.reason)
       };
     }
@@ -17739,7 +18008,7 @@ function createOpenNextCloudflareStrategy(options) {
           observer,
           "P2 opennext-cloudflare: building the project as written."
         );
-        const first = await attempt(context, context.workspace, observer);
+        const first = await attempt(context, context.workspace, observer, true);
         if (first.ok) {
           return {
             status: "success",
@@ -17751,7 +18020,7 @@ function createOpenNextCloudflareStrategy(options) {
           return first.outcome;
         await warn(
           observer,
-          `P2 opennext-cloudflare: OpenNext refused the Node.js middleware compiled from ${context.facts.proxyFile}. Retrying in a temporary workspace with it rewritten to Edge middleware.`
+          first.nodeMiddleware === "experimental" ? `P2 opennext-cloudflare: OpenNext supports the Node.js middleware compiled from ${context.facts.proxyFile} only as an experiment it does not maintain. Retrying in a temporary workspace with it rewritten to Edge middleware.` : `P2 opennext-cloudflare: OpenNext refused the Node.js middleware compiled from ${context.facts.proxyFile}. Retrying in a temporary workspace with it rewritten to Edge middleware.`
         );
       }
       let fork;
@@ -17771,8 +18040,47 @@ function createOpenNextCloudflareStrategy(options) {
         observer,
         `Converted ${conversion.file ?? context.facts.proxyFile} to edge middleware for this build only. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable. Your repository is unchanged.`
       );
-      const second = await attempt(context, fork, observer);
-      if (!second.ok) return second.outcome;
+      const second = await attempt(context, fork, observer, rememberedRewrite);
+      if (!second.ok) {
+        if (!rememberedRewrite || second.outcome.status !== "failed" || !second.outcome.appBuild)
+          return second.outcome;
+        await info(
+          observer,
+          `P2 opennext-cloudflare: the rewritten copy did not build; building the project as written once to tell the app's own error from the rewrite's.`
+        );
+        const asWritten = await attempt(
+          context,
+          context.workspace,
+          observer,
+          true
+        );
+        if (asWritten.ok) {
+          await info(
+            observer,
+            "P2 opennext-cloudflare: the project as written builds and ships as it is; the rewrite is no longer needed."
+          );
+          return {
+            status: "success",
+            artifact: {
+              kind: "cloudflare-worker",
+              artifact: asWritten.artifact
+            },
+            notes: []
+          };
+        }
+        if (asWritten.outcome.status === "failed" && asWritten.outcome.appBuild) {
+          await warn(
+            observer,
+            "P2 opennext-cloudflare: the project as written does not build either, so the error is the app's own."
+          );
+          return asWritten.outcome;
+        }
+        await warn(
+          observer,
+          "P2 opennext-cloudflare: the project as written builds, so the rewritten copy's error is the Edge rewrite's (a Node-only API reached from proxy.ts), not the app's code."
+        );
+        return failed("build", second.outcome.reason);
+      }
       return {
         status: "success",
         artifact: { kind: "cloudflare-worker", artifact: second.artifact },
@@ -18244,13 +18552,20 @@ var LocalBuildExecutor = class {
         },
         observer
       );
-      const gitCommitSha = revision.stdout.at(-1)?.trim() ?? "";
-      if (!/^[a-f\d]{40,64}$/i.test(gitCommitSha)) {
+      const gitCommitSha = (revision.stdout.at(-1)?.trim() ?? "").toLowerCase();
+      if (!/^(?:[a-f\d]{40}|[a-f\d]{64})$/.test(gitCommitSha)) {
         throw new DeploymentError(
           "CLONE_FAILED",
           "Git returned an invalid commit SHA."
         );
       }
+      const reportedSha = gitCommitSha.length === 40 ? gitCommitSha : null;
+      if (!reportedSha)
+        await info2(
+          observer,
+          "CLONING",
+          "This repository uses SHA-256 commit ids; Naro records SHA-1 commits only, so this deployment shows no commit."
+        );
       const subject = await this.dependencies.runCommand(
         {
           command: "git",
@@ -18264,7 +18579,7 @@ var LocalBuildExecutor = class {
       );
       const gitCommitMessage = [...subject.stdout.at(-1)?.trim() ?? ""].slice(0, 300).join("");
       await observer.onMetadata?.({
-        gitCommitSha,
+        ...reportedSha ? { gitCommitSha: reportedSha } : {},
         ...gitCommitMessage ? { gitCommitMessage } : {}
       });
       const appRoot = this.dependencies.resolveAppRoot(
@@ -18346,7 +18661,7 @@ var LocalBuildExecutor = class {
               env: {
                 NODE_ENV: "development",
                 NPM_CONFIG_USERCONFIG: packageManagerConfigPath,
-                ...cachePorts ? cacheEnv(pmCacheDir) : {}
+                ...cachePorts ? cacheEnv(pmCacheDir, packageManager.name) : {}
               },
               timeoutMs: 10 * 6e4,
               stage: "INSTALLING",
@@ -18732,7 +19047,8 @@ function isExpired(session, skewSeconds = 60) {
 
 // ../../packages/sdk/src/supabase-auth.ts
 import {
-  createClient
+  createClient,
+  isAuthRetryableFetchError
 } from "@supabase/supabase-js";
 
 // ../../packages/sdk/src/config.ts
@@ -18894,8 +19210,8 @@ function sendPage(res, status, html) {
 async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
-  const codePromise = new Promise((resolve11, reject) => {
-    resolveCode = resolve11;
+  const codePromise = new Promise((resolve12, reject) => {
+    resolveCode = resolve12;
     rejectCode = reject;
   });
   const server = createServer2((req, res) => {
@@ -18924,7 +19240,7 @@ async function startCallbackServer() {
     sendPage(res, 200, successPage());
     resolveCode(code);
   });
-  await new Promise((resolve11) => server.listen(0, "127.0.0.1", resolve11));
+  await new Promise((resolve12) => server.listen(0, "127.0.0.1", resolve12));
   const port = server.address().port;
   return {
     port,
@@ -18932,7 +19248,12 @@ async function startCallbackServer() {
       let timer;
       const timeout = new Promise((_, reject) => {
         timer = setTimeout(
-          () => reject(new Error("Timed out waiting for GitHub callback.")),
+          () => reject(
+            new NaroError(
+              "TIMEOUT",
+              `Sign-in timed out after ${String(Math.round(timeoutMs / 1e3))}s waiting for the browser. Run \`naro login\` again, or set NARO_TOKEN.`
+            )
+          ),
           timeoutMs
         );
         timer.unref?.();
@@ -18970,20 +19291,44 @@ function createAuthClient(env = process.env) {
     }
   });
 }
-function toStoredSession(session) {
-  const meta3 = session.user.user_metadata ?? {};
+function toSessionUser(user) {
+  const meta3 = user.user_metadata ?? {};
   const github = meta3.user_name ?? meta3.preferred_username ?? null;
+  return { id: user.id, email: user.email ?? null, github };
+}
+function toStoredSession(session) {
   return {
     access_token: session.access_token,
     refresh_token: session.refresh_token,
     expires_at: session.expires_at ?? 0,
-    user: {
-      id: session.user.id,
-      email: session.user.email ?? null,
-      github
-    }
+    user: toSessionUser(session.user)
   };
 }
+async function userForAccessToken(accessToken, client = createAuthClient()) {
+  const { data, error: error51 } = await client.auth.getUser(accessToken);
+  if (error51?.status === 429) {
+    throw new NaroError(
+      "RATE_LIMITED",
+      "Checking the access token failed: Naro's sign-in service is rate limiting this machine. Try again shortly.",
+      { cause: error51 }
+    );
+  }
+  if (error51 && (isAuthRetryableFetchError(error51) || (error51.status ?? 0) >= 500)) {
+    throw new NaroError(
+      "NETWORK_ERROR",
+      "Checking the access token failed: could not reach Naro's sign-in service.",
+      { cause: error51 }
+    );
+  }
+  if (error51 || !data?.user) {
+    throw new NaroError(
+      "NOT_LOGGED_IN",
+      "The access token is invalid or has expired. Generate a new one with `naro token`, or run `naro login`.",
+      { cause: error51 ?? void 0 }
+    );
+  }
+  return toSessionUser(data.user);
+}
 async function refreshStoredSession(refreshToken, client = createAuthClient()) {
   const { data, error: error51 } = await client.auth.refreshSession({
     refresh_token: refreshToken
@@ -19024,16 +19369,19 @@ async function login(deps) {
 }
 
 // ../../packages/sdk/src/auth.ts
+function suppliedToken(options = {}) {
+  if (options.explicitToken)
+    return { token: options.explicitToken, source: "flag" };
+  const fromEnv = (options.env ?? process.env).NARO_TOKEN;
+  return fromEnv ? { token: fromEnv, source: "env" } : null;
+}
 async function resolveAuth(options = {}) {
   const env = options.env ?? process.env;
   const home = options.home ?? homedir2();
-  if (options.explicitToken) {
-    const token = options.explicitToken;
-    return { getAccessToken: async () => token, source: "flag" };
-  }
-  if (env.NARO_TOKEN) {
-    const token = env.NARO_TOKEN;
-    return { getAccessToken: async () => token, source: "env" };
+  const supplied = suppliedToken({ explicitToken: options.explicitToken, env });
+  if (supplied) {
+    const { token, source } = supplied;
+    return { getAccessToken: async () => token, source };
   }
   const refresh = options.refresh ?? refreshStoredSession;
   let session = loadStoredSession(home);
@@ -19109,6 +19457,14 @@ function openBrowser(url2) {
   child.unref();
 }
 
+// ../../packages/sdk/src/environments.ts
+function isReservedEnvTarget(value) {
+  return RESERVED_ENVIRONMENT_SLUGS.includes(value);
+}
+function isEnvTargetName(value) {
+  return environmentSlugProblem(value) !== "invalid";
+}
+
 // ../../packages/sdk/src/insights.ts
 var SPEED_INSIGHTS_METRICS = [
   "lcp",
@@ -19179,6 +19535,7 @@ function deploymentInfo(row) {
     projectId: row.project_id,
     status: row.status,
     branch: row.branch,
+    environment: row.environment_slug ?? null,
     url: row.preview_url,
     artifactKey: row.artifact_key ?? null,
     errorCode: row.error_code,
@@ -19220,6 +19577,7 @@ var NaroClient = class {
   insights;
   analytics;
   protection;
+  environments;
   constructor(options) {
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
@@ -19238,6 +19596,7 @@ var NaroClient = class {
     this.insights = new InsightsApi(this);
     this.analytics = new AnalyticsApi(this);
     this.protection = new ProtectionApi(this);
+    this.environments = new EnvironmentsApi(this);
   }
   async request(path, options) {
     const token = await this.getAccessToken();
@@ -19282,6 +19641,20 @@ var TeamsApi = class {
     );
     return body.teams;
   }
+  /**
+   * The team's usage for a UTC month, the current one without `month`
+   * (spec 2026-10-18-usage-cli-mcp). The month goes as given: the server
+   * checks it and answers 400 VALIDATION_FAILED otherwise.
+   */
+  async usage(teamSlug, query = {}) {
+    const params = new URLSearchParams();
+    if (query.month !== void 0) params.set("month", query.month);
+    const text2 = params.toString();
+    return this.client.request(
+      `/api/teams/${encodeURIComponent(teamSlug)}/usage${text2 ? `?${text2}` : ""}`,
+      { context: "Read team usage" }
+    );
+  }
 };
 var ProjectsApi = class {
   constructor(client) {
@@ -19388,7 +19761,10 @@ var DeploymentsApi = class {
       {
         method: "POST",
         // createDeploymentSchema accepts string | undefined — never null.
-        body: options.branch ? { branch: options.branch } : {},
+        body: {
+          ...options.branch ? { branch: options.branch } : {},
+          ...options.environment ? { environment: options.environment } : {}
+        },
         context: "Create deployment"
       }
     );
@@ -19404,7 +19780,7 @@ var DeploymentsApi = class {
   async rollbackTarget(projectId, defaultBranch) {
     const deployments = await this.list(projectId);
     const production = deployments.filter(
-      (deployment) => deployment.status === "READY" && deployment.branch === defaultBranch
+      (deployment) => deployment.status === "READY" && deployment.environment === null && deployment.branch === defaultBranch
     );
     const current = production[0];
     if (!current) {
@@ -19444,7 +19820,7 @@ var DeploymentsApi = class {
   async wait(deploymentId, options = {}) {
     const intervalMs = options.intervalMs ?? 2500;
     const timeoutMs = options.timeoutMs ?? 15 * 6e4;
-    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
     const startedAt = Date.now();
     let lastStatus = null;
     let lastSequence = -1;
@@ -19507,11 +19883,16 @@ var EnvApi = class {
       { method: "DELETE", context: "Remove environment variable" }
     );
   }
-  /** Removes every row for a key (optionally narrowed to one target). */
+  /**
+   * Removes a key's rows: the one `target` names, or, with no target, the
+   * `production`, `preview` and `all` rows. An environment's value goes only
+   * when its slug is the target, so removing a key everywhere else does not
+   * take a QA or staging value with it.
+   */
   async remove(projectId, key, target2) {
     const rows = await this.list(projectId);
     const matches = rows.filter(
-      (row) => row.key === key && (target2 === void 0 || row.target === target2)
+      (row) => row.key === key && (target2 === void 0 ? isReservedEnvTarget(row.target) : row.target === target2)
     );
     if (matches.length === 0) {
       throw new NaroError(
@@ -19804,6 +20185,55 @@ var ProtectionApi = class {
     );
   }
 };
+var EnvironmentsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  base(projectId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/environments`;
+  }
+  /** The project's environments and how many its plan allows (null: no limit). */
+  async list(projectId) {
+    return this.client.request(this.base(projectId), {
+      context: "List environments"
+    });
+  }
+  /** One environment by its slug, from the list: the routes address it by id. */
+  async get(projectId, slug) {
+    const { environments } = await this.list(projectId);
+    const environment = environments.find((entry) => entry.slug === slug);
+    if (!environment)
+      throw new NaroError("ENVIRONMENT_NOT_FOUND", "Environment not found.");
+    return environment;
+  }
+  async create(projectId, input) {
+    const body = await this.client.request(
+      this.base(projectId),
+      {
+        method: "POST",
+        // JSON drops a key that is undefined and keeps a null, which is what
+        // the route reads: no copyEnvFrom is "preview", null copies nothing.
+        body: input,
+        context: "Create environment"
+      }
+    );
+    return body.environment;
+  }
+  async update(projectId, environmentId, patch) {
+    const body = await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}`,
+      { method: "PATCH", body: patch, context: "Update environment" }
+    );
+    return body.environment;
+  }
+  /** Removes the environment, its worker and its protection. */
+  async delete(projectId, environmentId) {
+    await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}`,
+      { method: "DELETE", context: "Delete environment" }
+    );
+  }
+};
 var EXPORT_FIRST_POLL_MS = 1e3;
 var EXPORT_MAX_POLL_MS = 5e3;
 var EXPORT_TIMEOUT_MS = 15 * 6e4;
@@ -19941,7 +20371,7 @@ var DbApi = class {
    */
   async export(projectId, options = {}, wait = {}) {
     const timeoutMs = wait.timeoutMs ?? EXPORT_TIMEOUT_MS;
-    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
     const given = wait.pollIntervalMs;
     const firstPollMs = given !== void 0 && Number.isFinite(given) && given > 0 ? given : EXPORT_FIRST_POLL_MS;
     const maxPollMs = Math.max(EXPORT_MAX_POLL_MS, firstPollMs);
@@ -19988,10 +20418,12 @@ var DbApi = class {
    * `d1_migrations` — all operations or none. `dryRun` returns the SQL and
    * the name without applying anything. Save `sql` as `migrations/<name>` so
    * `naro db reset` re-applies it; a refused operation's index is in
-   * `details.operation`. Policies left under a name the change gives to a
-   * table are removed before it runs and stay removed if it then fails:
-   * that refusal carries them in `details.removedPolicies`, shaped as the
-   * result's `removedPolicies`.
+   * `details.operation`, or — refused by the policy translation, or failed
+   * in SQLite — in `statementIndex` (one statement per operation). The Data API policies go in the same migration: a
+   * rename carries the table's and rewrites the others that read it, a
+   * dropped table's go with it, and what an earlier table left under a name
+   * the change gives is removed — `removedPolicies` lists what went. A change
+   * that fails changes none of them.
    */
   async schema(projectId, operations, options = {}) {
     return this.client.request(
@@ -20099,6 +20531,7 @@ function listFields(options) {
   if (options.limit !== void 0) body.limit = options.limit;
   if (options.offset !== void 0) body.offset = options.offset;
   if (options.sortBy !== void 0) body.sortBy = options.sortBy;
+  if (options.search !== void 0) body.search = options.search;
   return body;
 }
 var BackendApi = class {
@@ -20629,10 +21062,13 @@ var StorageApi = class {
    * What is directly below a folder of a bucket — its folders first, by
    * name, then its files — through the control plane's object proxy
    * (Storage 3-1e): the project's Naro worker lists it with the stored
-   * service key, so every object is listed whatever the policies say. There
-   * is no search. Needs `storage.manage`, Storage on and the backend on and
-   * ready (`STORAGE_NOT_ENABLED`, `BACKEND_OFF`, `BACKEND_NOT_READY`, 409);
-   * the worker's refusals — `BUCKET_NOT_FOUND`, `INVALID_REQUEST` with
+   * service key, so every object is listed whatever the policies say.
+   * `search` keeps the names below the folder that start with it (Storage
+   * 3-1g); a backend from before it answers `INVALID_REQUEST` with
+   * `details.path` `search` until `naro backend enable` updates it. Needs
+   * `storage.manage`, Storage on and the backend on and ready
+   * (`STORAGE_NOT_ENABLED`, `BACKEND_OFF`, `BACKEND_NOT_READY`, 409); the
+   * worker's refusals — `BUCKET_NOT_FOUND`, `INVALID_REQUEST` with
    * `details.path` and `details.reason` — come through as they are.
    */
   async listObjects(projectId, bucket, options = {}) {
@@ -20735,7 +21171,7 @@ import { join as join19 } from "path";
 function parseDotenv(text2) {
   const out = {};
   for (const line of text2.split(/\r?\n/)) {
-    const trimmed = line.trim();
+    const trimmed = line.trim().replace(/^export\s+(?=[^=\s])/, "");
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
     if (eq <= 0) continue;
@@ -21295,7 +21731,7 @@ var CATALOG = {
   },
   INVALID_REQUEST: {
     status: 400,
-    message: () => "The storage request is not valid."
+    message: (vars) => vars?.subject === "broadcast" ? "The broadcast request is not valid." : vars?.subject === "realtime" ? "The realtime request is not valid." : "The storage request is not valid."
   },
   LENGTH_REQUIRED: {
     status: 411,
@@ -21356,6 +21792,21 @@ var CATALOG = {
   BACKEND_OUTDATED: {
     status: 409,
     message: () => STORAGE_MIGRATION_PENDING_MESSAGE
+  },
+  // Realtime 3-2a (design §6.4): see ErrorVars. 426 carries `Upgrade:
+  // websocket` (the worker adds it); RATE_LIMITED is 429 like
+  // OBJECT_RATE_LIMITED, and the worker adds both retry headers.
+  UPGRADE_REQUIRED: {
+    status: 426,
+    message: () => "This endpoint takes WebSocket connections only."
+  },
+  REALTIME_NOT_ENABLED: {
+    status: 404,
+    message: () => "Realtime is not enabled for this project."
+  },
+  RATE_LIMITED: {
+    status: 429,
+    message: () => "Too many broadcast requests to this project right now. Try again in a second."
   }
 };
 function dataError(code, ...args) {
@@ -21750,6 +22201,72 @@ function declaredCollations(sql, columns) {
   return collations;
 }
 
+// ../../packages/data-core/src/realtime-table.ts
+var REALTIME_MESSAGES = "realtime.messages";
+var REALTIME_MESSAGES_NAMES = ["messages", REALTIME_MESSAGES];
+var REALTIME_POLICY_COLUMNS = [
+  "topic",
+  "extension",
+  "private"
+];
+var REALTIME_COLUMN_TYPES = {
+  topic: "TEXT",
+  extension: "TEXT",
+  private: "BOOLEAN"
+};
+var realtimeColumns = REALTIME_POLICY_COLUMNS.map(
+  (name, cid) => ({
+    name,
+    cid,
+    type: REALTIME_COLUMN_TYPES[name],
+    notNull: true,
+    primaryKey: 0,
+    defaultValue: null,
+    generated: false,
+    collation: "BINARY"
+  })
+);
+var FIXED_COLUMNS = "REALTIME_MESSAGES_TABLE is shared by every project: its columns cannot change";
+var FixedColumns = class extends Map {
+  constructor(columns) {
+    super();
+    for (const column2 of columns) super.set(column2.name, column2);
+  }
+  set() {
+    throw new TypeError(FIXED_COLUMNS);
+  }
+  delete() {
+    throw new TypeError(FIXED_COLUMNS);
+  }
+  clear() {
+    throw new TypeError(FIXED_COLUMNS);
+  }
+};
+var REALTIME_MESSAGES_TABLE = (() => {
+  for (const column2 of realtimeColumns) Object.freeze(column2);
+  Object.freeze(realtimeColumns);
+  return Object.freeze({
+    name: REALTIME_MESSAGES,
+    kind: "table",
+    columns: realtimeColumns,
+    byName: Object.freeze(new FixedColumns(realtimeColumns)),
+    sql: null
+  });
+})();
+var REALTIME_SUBQUERY_PROBLEM = "realtime.messages has no rows to read; it can only be the target of a policy";
+var REALTIME_COMMAND_PROBLEM = "realtime.messages takes SELECT, INSERT and ALL policies only.";
+var REALTIME_COLUMNS_PROBLEM = "realtime.messages policies are checked once per join, so they can read topic, extension and private only";
+var REALTIME_TOPIC_PROBLEM = "realtime.topic() is available only in policies of realtime.messages";
+function quotedRealtimeMessagesProblem(written) {
+  return `a table named "${written}" cannot be used in policies, as naro keeps the name for Realtime: write realtime.messages, without quotes, for Realtime's messages`;
+}
+function quotedRealtimeAliasProblem(written) {
+  return `an alias named "${written}" cannot be used in policies, as naro keeps the name for Realtime: give the subquery another alias`;
+}
+function realtimeFunctionProblem(name) {
+  return `function realtime.${name} is not available in policies: use realtime.topic()`;
+}
+
 // ../../packages/data-core/src/schema.ts
 function columnAffinity(column2) {
   const type = asciiLower(column2.type);
@@ -21902,11 +22419,14 @@ function storageFromRows(rows) {
 function resolveTable(snapshot, name) {
   if (isSystemTable(name)) return void 0;
   const folded = asciiLower(name);
-  if (folded === STORAGE_OBJECTS) return void 0;
+  if (folded === STORAGE_OBJECTS || folded === REALTIME_MESSAGES)
+    return void 0;
   return snapshot.tables.get(folded);
 }
 function resolvePolicyTable(snapshot, name) {
-  if (asciiLower(name) === STORAGE_OBJECTS) return snapshot.storage;
+  const folded = asciiLower(name);
+  if (folded === STORAGE_OBJECTS) return snapshot.storage;
+  if (folded === REALTIME_MESSAGES) return REALTIME_MESSAGES_TABLE;
   return resolveTable(snapshot, name);
 }
 async function readTableNames(db) {
@@ -22127,7 +22647,8 @@ var VALUE_KINDS = /* @__PURE__ */ new Set([
   "jwt",
   "func",
   "cast",
-  "storage"
+  "storage",
+  "realtime"
 ]);
 function isValueExpr(expr) {
   return VALUE_KINDS.has(expr.kind);
@@ -22241,6 +22762,8 @@ function truthProblem(operand) {
       const call = operand.fn === "foldername" ? "(storage.foldername(\u2026))[n]" : `storage.${operand.fn}(\u2026)`;
       return `${call} ${text2}: compare it with text, ${call} = 'true'`;
     }
+    case "realtime":
+      return `realtime.topic() ${text2}: compare it with text, realtime.topic() = 'room:1'`;
   }
 }
 function truthTestProblem(operand) {
@@ -22261,6 +22784,7 @@ function isTextValue(value) {
     case "jwt":
     case "cast":
     case "storage":
+    case "realtime":
       return true;
     case "func":
       return value.name !== "length" && value.name !== "coalesce";
@@ -22578,12 +23102,15 @@ function readSubquery(state, start, kind) {
     stream.expectKeyword(`from`);
     const table = readTableName(stream);
     let alias = null;
-    if (stream.acceptKeyword("as")) alias = readIdentifier(stream, "an alias");
-    else {
-      const next = stream.peek();
-      if (next.kind === "ident" && (next.quoted || !isReservedWord(next)))
-        alias = readIdentifier(stream, "an alias");
-    }
+    const as = stream.acceptKeyword("as");
+    const named = stream.peek();
+    if (as || named.kind === "ident" && (named.quoted || !isReservedWord(named)))
+      alias = readIdentifier(stream, "an alias");
+    if (alias !== null && asciiLower(alias) === REALTIME_MESSAGES)
+      throw new PolicySyntaxError(
+        quotedRealtimeAliasProblem(alias),
+        named.position
+      );
     let where = null;
     if (stream.acceptKeyword("where")) {
       const token = stream.peek();
@@ -22623,10 +23150,15 @@ function isName(token, word) {
 function atStorageObjects(stream) {
   return isName(stream.peek(), "storage") && isOperator(stream.peek(1), ".") && isName(stream.peek(2), "objects");
 }
+function atRealtimeMessages(stream) {
+  return isName(stream.peek(), "realtime") && isOperator(stream.peek(1), ".") && isName(stream.peek(2), "messages");
+}
 function readTableName(stream) {
   const first = stream.peek();
   if (atStorageObjects(stream))
     throw new PolicySyntaxError(STORAGE_SUBQUERY_PROBLEM, first.position);
+  if (atRealtimeMessages(stream))
+    throw new PolicySyntaxError(REALTIME_SUBQUERY_PROBLEM, first.position);
   let token = first;
   let name = readIdentifier(stream, "a table name");
   if (stream.acceptOperator(".")) {
@@ -22643,14 +23175,27 @@ function readTableName(stream) {
       quotedStorageObjectsProblem(name),
       token.position
     );
+  if (asciiLower(name) === REALTIME_MESSAGES)
+    throw new PolicySyntaxError(
+      quotedRealtimeMessagesProblem(name),
+      token.position
+    );
   return name;
 }
 function readPolicyTarget(stream) {
-  if (!atStorageObjects(stream)) return readTableName(stream);
-  stream.next();
-  stream.next();
-  stream.next();
-  return STORAGE_OBJECTS;
+  if (atStorageObjects(stream)) {
+    stream.next();
+    stream.next();
+    stream.next();
+    return STORAGE_OBJECTS;
+  }
+  if (atRealtimeMessages(stream)) {
+    stream.next();
+    stream.next();
+    stream.next();
+    return REALTIME_MESSAGES;
+  }
+  return readTableName(stream);
 }
 function readNumber(token, negative) {
   const value = Number(token.value) * (negative ? -1 : 1);
@@ -22798,6 +23343,12 @@ function readPrimary(state) {
       return stream.unexpected(token);
     }
     case "ident": {
+      if (isName(token, "realtime") && isOperator(stream.peek(), ".") && stream.peek(1).kind === "ident") {
+        if (isOperator(stream.peek(2), "("))
+          return readRealtimeCall(state, token);
+        if (isName(stream.peek(1), "messages") && isOperator(stream.peek(2), "."))
+          return readRealtimeColumn(state);
+      }
       if (isName(token, "storage") && isOperator(stream.peek(), ".") && stream.peek(1).kind === "ident" && isOperator(stream.peek(2), "("))
         return readStorageCall(state, token);
       if (!token.quoted) {
@@ -22817,6 +23368,11 @@ function readPrimary(state) {
         if (RESERVED2.has(word)) return stream.unexpected(token);
       }
       if (isOperator(stream.peek(), ".")) {
+        if (asciiLower(token.value) === REALTIME_MESSAGES)
+          throw new PolicySyntaxError(
+            quotedRealtimeMessagesProblem(token.value),
+            token.position
+          );
         stream.next();
         const name = stream.peek();
         if (name.kind !== "ident" || !name.quoted && isReservedWord(name))
@@ -22855,6 +23411,33 @@ function readStorageCall(state, start) {
   if (fn === "foldername") state.foldernames.push({ node, token: start });
   return node;
 }
+function readRealtimeCall(state, start) {
+  const { stream } = state;
+  stream.next();
+  const name = stream.next();
+  if (!isName(name, "topic"))
+    throw new PolicySyntaxError(
+      realtimeFunctionProblem(name.value),
+      start.position
+    );
+  stream.expectOperator("(");
+  stream.expectOperator(")");
+  return { kind: "realtime", fn: "topic" };
+}
+function readRealtimeColumn(state) {
+  const { stream } = state;
+  stream.next();
+  stream.next();
+  stream.next();
+  const name = readIdentifier(stream, "a column name");
+  const next = stream.peek();
+  if (isOperator(next, "(") || isOperator(next, "."))
+    throw new PolicySyntaxError(
+      `realtime.messages.${name} is not a column: naro reads realtime.messages.column`,
+      next.position
+    );
+  return { kind: "column", qualifier: REALTIME_MESSAGES, name };
+}
 function readNameColumn(state, fn) {
   const { stream } = state;
   const first = stream.peek();
@@ -22869,6 +23452,11 @@ function readNameColumn(state, fn) {
   }
   if (!isColumn || !isOperator(after, ")"))
     throw new PolicySyntaxError(storageHelperColumnProblem(fn), first.position);
+  if (qualified && asciiLower(first.value) === REALTIME_MESSAGES)
+    throw new PolicySyntaxError(
+      quotedRealtimeMessagesProblem(first.value),
+      first.position
+    );
   count(state, first);
   for (let index = qualified ? 4 : 2; index > 0; index--) stream.next();
   return {
@@ -22998,7 +23586,10 @@ function printValue(expr) {
     case "literal":
       return printLiteral(expr.value);
     case "column":
-      return expr.qualifier === null ? quoteIdent(expr.name) : `${quoteIdent(expr.qualifier)}.${quoteIdent(expr.name)}`;
+      if (expr.qualifier === null) return quoteIdent(expr.name);
+      if (asciiLower(expr.qualifier) === REALTIME_MESSAGES)
+        return `${REALTIME_MESSAGES}.${quoteIdent(expr.name)}`;
+      return `${quoteIdent(expr.qualifier)}.${quoteIdent(expr.name)}`;
     case "auth":
       return `auth.${expr.fn}()`;
     case "jwt":
@@ -23011,6 +23602,8 @@ function printValue(expr) {
       const call = `storage.${expr.fn}(${printValue(expr.column)})`;
       return expr.index === null ? call : `(${call})[${String(expr.index)}]`;
     }
+    case "realtime":
+      return "realtime.topic()";
   }
 }
 function printSubquery(subquery) {
@@ -23053,20 +23646,20 @@ function printExpr(expr) {
 }
 function unqualifiedInSubquery(expr) {
   let found;
-  function value(node, inside) {
+  function value(node, inside2) {
     if (found !== void 0) return;
     switch (node.kind) {
       case "column":
-        if (inside && node.qualifier === null) found = node;
+        if (inside2 && node.qualifier === null) found = node;
         return;
       case "func":
-        for (const arg of node.args) value(arg, inside);
+        for (const arg of node.args) value(arg, inside2);
         return;
       case "cast":
-        value(node.operand, inside);
+        value(node.operand, inside2);
         return;
       case "storage":
-        value(node.column, inside);
+        value(node.column, inside2);
         return;
       default:
         return;
@@ -23076,40 +23669,40 @@ function unqualifiedInSubquery(expr) {
     if (node.select !== "*") value(node.select, true);
     if (node.where !== null) visit(node.where, true);
   }
-  function visit(node, inside) {
+  function visit(node, inside2) {
     if (found !== void 0) return;
     if (isValueExpr(node)) {
-      value(node, inside);
+      value(node, inside2);
       return;
     }
     switch (node.kind) {
       case "and":
       case "or":
-        for (const arg of node.args) visit(arg, inside);
+        for (const arg of node.args) visit(arg, inside2);
         return;
       case "not":
-        visit(node.arg, inside);
+        visit(node.arg, inside2);
         return;
       case "compare":
       case "distinct":
-        value(node.left, inside);
-        value(node.right, inside);
+        value(node.left, inside2);
+        value(node.right, inside2);
         return;
       case "is":
       case "like":
       case "array":
-        value(node.operand, inside);
+        value(node.operand, inside2);
         return;
       case "in":
-        value(node.operand, inside);
-        for (const item of node.list) value(item, inside);
+        value(node.operand, inside2);
+        for (const item of node.list) value(item, inside2);
         return;
       case "between":
         for (const item of [node.operand, node.low, node.high])
-          value(item, inside);
+          value(item, inside2);
         return;
       case "inSelect":
-        value(node.operand, inside);
+        value(node.operand, inside2);
         subquery(node.subquery);
         return;
       case "exists":
@@ -23186,9 +23779,11 @@ function quotePolicyName(name) {
   return /^[a-z_][a-z0-9_]*$/.test(name) && quoteIdent(name) === name ? name : `"${name.replaceAll('"', '""')}"`;
 }
 function policyShapeProblem(policy) {
-  const { name, command, using, check: check2 } = policy;
+  const { table, name, command, using, check: check2 } = policy;
   if (name === "" || [...name].length > MAX_POLICY_NAME_LENGTH || name.includes("\0"))
     return `Policy names are 1 to ${String(MAX_POLICY_NAME_LENGTH)} characters.`;
+  if (asciiLower(table) === REALTIME_MESSAGES && (command === "update" || command === "delete"))
+    return REALTIME_COMMAND_PROBLEM;
   const upper = command.toUpperCase();
   if ((command === "select" || command === "delete") && check2 !== null)
     return "WITH CHECK cannot be applied to SELECT or DELETE.";
@@ -23203,7 +23798,8 @@ function policyShapeProblem(policy) {
   return void 0;
 }
 function policyTableSql(table) {
-  return asciiLower(table) === STORAGE_OBJECTS ? STORAGE_OBJECTS : quoteIdent(table);
+  const folded = asciiLower(table);
+  return folded === STORAGE_OBJECTS || folded === REALTIME_MESSAGES ? folded : quoteIdent(table);
 }
 function policySql(policy) {
   const parts = [
@@ -23945,6 +24541,7 @@ function unreadableConversions(policy) {
 // ../../packages/data-core/src/rls-compile.ts
 var MAX_INLINE_DEPTH = 4;
 var MAX_STATEMENT_SUBQUERIES = 16;
+var STATEMENT_SUBQUERIES_REASON = `the policies read more than ${String(MAX_STATEMENT_SUBQUERIES)} subqueries in one statement, counting the policies of the tables they read`;
 var MAX_POLICY_VALUES = 50;
 var MAX_POLICY_STATEMENT_BYTES = 5e4;
 function policyInvalid(policy, action) {
@@ -23996,7 +24593,7 @@ function resolveColumn(env, ref) {
       if (!column2)
         return blamed(
           env,
-          `column ${ref.qualifier}.${ref.name} does not exist: ${tableLabel(source.table)} has no column ${ref.name}`
+          source.table.name === REALTIME_MESSAGES ? REALTIME_COLUMNS_PROBLEM : `column ${ref.qualifier}.${ref.name} does not exist: ${tableLabel(source.table)} has no column ${ref.name}`
         );
       return { source, column: column2 };
     }
@@ -24012,6 +24609,8 @@ function resolveColumn(env, ref) {
     if (env.scopes.length > 1) return blamed(env, unqualifiedProblem(ref));
     return { source, column: column2 };
   }
+  if (env.scopes.length === 1 && env.scopes[0]?.table.name === REALTIME_MESSAGES)
+    return blamed(env, REALTIME_COLUMNS_PROBLEM);
   return blamed(
     env,
     missingColumnReason(
@@ -24032,8 +24631,9 @@ function valueSql(env, expr, textual = null) {
       if (expr.value === null) return "NULL";
       if (typeof expr.value === "boolean") return expr.value ? "1" : "0";
       return bind(env, expr.value);
-    case "column": {
-      const { source, column: column2 } = resolveColumn(env, expr);
+    case "column":
+    case "realtime": {
+      const { source, column: column2 } = columnOf(env, expr);
       return source.read(column2, env, {
         qualified: env.scopes.length > 1,
         textual
@@ -24060,6 +24660,16 @@ function valueSql(env, expr, textual = null) {
       return storageCallSql(env, expr);
   }
 }
+function realtimeTopic(env) {
+  const [source] = env.scopes;
+  const topic = source?.table.byName.get("topic");
+  if (asciiLower(env.blame.policy.table) !== REALTIME_MESSAGES || source?.table.name !== REALTIME_MESSAGES || !topic)
+    return blamed(env, REALTIME_TOPIC_PROBLEM);
+  return { source, column: topic };
+}
+function columnOf(env, expr) {
+  return expr.kind === "column" ? resolveColumn(env, expr) : realtimeTopic(env);
+}
 function pathArray(operand) {
   return `('["' || replace(replace(${operand()}, '"', '\\"'), '/', '","') || '"]')`;
 }
@@ -24100,14 +24710,14 @@ function storageCallSql(env, expr) {
 }
 function operandSide(env, expr) {
   if (expr.kind === "cast") return operandSide(env, expr.operand);
-  if (expr.kind !== "column")
+  if (expr.kind !== "column" && expr.kind !== "realtime")
     return {
       stored: null,
       stable: true,
       newColumnish: false,
       newCollation: null
     };
-  const { source, column: column2 } = resolveColumn(env, expr);
+  const { source, column: column2 } = columnOf(env, expr);
   const operand = source.operand(column2);
   return {
     stored: column2,
@@ -24246,10 +24856,7 @@ function subquerySql(env, subquery, select) {
   if (!table) return blamed(env, missingRelationReason(subquery.table));
   const { state } = env;
   if (++state.subqueries > MAX_STATEMENT_SUBQUERIES)
-    return blamed(
-      env,
-      `the policies read more than ${String(MAX_STATEMENT_SUBQUERIES)} subqueries in one statement, counting the policies of the tables they read`
-    );
+    return blamed(env, STATEMENT_SUBQUERIES_REASON);
   if (state.depth + 1 > MAX_INLINE_DEPTH)
     return blamed(
       env,
@@ -24976,29 +25583,52 @@ function checkProblemReason(column2, problem) {
       return `${column2} is a number column, which a WITH CHECK cannot turn into text (lower, upper, length, ::text)`;
   }
 }
+function usingProblemReason(name, problem) {
+  switch (problem) {
+    case "generated":
+      return `${name} is a generated column, which a USING judged on a row's values cannot read`;
+    case "collation":
+      return `${name} has a collation naro cannot read, which a USING judged on a row's values needs to compare it`;
+    case "pattern":
+      return `${name} is a number column, which a USING judged on a row's values cannot compare with LIKE or ILIKE`;
+    case "textual":
+      return `${name} is a number column, which a USING judged on a row's values cannot turn into text (lower, upper, length, ::text)`;
+  }
+}
 function isTrue(term) {
   return term.sql === "1" && term.params.length === 0;
 }
 function targetNames(target2) {
-  return asciiLower(target2.name) === STORAGE_OBJECTS ? [STORAGE_OBJECTS_QUALIFIER] : [asciiLower(target2.name)];
+  const folded = asciiLower(target2.name);
+  if (folded === STORAGE_OBJECTS) return [STORAGE_OBJECTS_QUALIFIER];
+  if (folded === REALTIME_MESSAGES) return [...REALTIME_MESSAGES_NAMES];
+  return [folded];
 }
 var Rls = class {
+  /**
+   * `state`: the statement's — a new one, or one the policy parts of the
+   * same statement share, so the cap on its subqueries counts them all
+   * (`policyValue`).
+   */
   constructor(req, snapshot, table, nonce, commands, scope = {
     policyTable: table.name,
     names: [asciiLower(table.name)],
     alias: null
-  }) {
+  }, state = newState2()) {
     this.req = req;
     this.snapshot = snapshot;
     this.table = table;
     this.nonce = nonce;
+    this.state = state;
     this.policyTable = scope.policyTable;
     this.outer = storedSource(table, scope.names, scope.alias);
     const all = commands.flatMap((command) => {
       const found = this.found(command);
       return [...found.permissive, ...found.restrictive];
     });
-    if (hasSubqueries(all)) this.state.active.push(asciiLower(table.name));
+    const key = asciiLower(table.name);
+    if (hasSubqueries(all) && !this.state.active.includes(key))
+      this.state.active.push(key);
     for (const command of commands) {
       const found = this.found(command);
       for (const policy of [...found.permissive, ...found.restrictive]) {
@@ -25012,7 +25642,6 @@ var Rls = class {
       }
     }
   }
-  state = newState2();
   /** Restrictive policies named by the checks' markers. */
   restrictive = [];
   outer;
@@ -25486,6 +26115,72 @@ function checkFragment(target2, req, snapshot, command, row, nonce, stored, with
   }
   return [schemaGuard(name, sql, command, checked), ...terms];
 }
+var Unsupported = class extends Error {
+  constructor(columnName, problem, policy) {
+    super(problem);
+    this.columnName = columnName;
+    this.problem = problem;
+    this.policy = policy;
+  }
+};
+function policyValue(target2, req, snapshot, command, row, nonce, state = newState2()) {
+  const checked = checkNonceOf(nonce, "policyValue");
+  const source = rowSource(target2, row, "insert", void 0);
+  const rls = new Rls(
+    req,
+    snapshot,
+    target2.table,
+    checked,
+    [command],
+    {
+      policyTable: target2.name,
+      names: targetNames(target2),
+      alias: null
+    },
+    state
+  );
+  const found = rls.found(command);
+  const first = found.permissive[0];
+  if (!first) return { ok: true, fragment: { sql: "0", params: [] } };
+  const mode = {
+    action: command,
+    problem: (name, problem, policy) => {
+      throw new Unsupported(name, problem, policy);
+    }
+  };
+  let group;
+  try {
+    group = groupTerms(
+      { ...rls.env(mode, first, command), scopes: [source] },
+      [source],
+      command,
+      found.permissive,
+      found.restrictive,
+      command === "select" ? (policy) => policy.usingExpr : (policy) => policy.checkExpr ?? policy.usingExpr
+    );
+  } catch (error51) {
+    if (!(error51 instanceof Unsupported)) throw error51;
+    return {
+      ok: false,
+      unsupported: command === "select" ? usingProblemReason(error51.columnName, error51.problem) : checkProblemReason(error51.columnName, error51.problem),
+      policy: error51.policy.name
+    };
+  }
+  const kept = [
+    group.permissive,
+    ...group.restrictive.map((entry) => entry.term)
+  ].filter((term) => !isTrue(term));
+  const [only] = kept;
+  if (!only) return { ok: true, fragment: { sql: "1", params: [] } };
+  if (kept.length === 1) return { ok: true, fragment: only };
+  return {
+    ok: true,
+    fragment: {
+      sql: `(${kept.map((term) => term.sql).join(" AND ")})`,
+      params: kept.flatMap((term) => term.params)
+    }
+  };
+}
 function compileSelect(query, table, rls) {
   if (query.columns !== "*" && query.columns.length === 0)
     fail(invalidQuery("columns", "must name at least one column"));
@@ -25769,6 +26464,12 @@ function resolve8(scopes, qualifier, name) {
   }
   return void 0;
 }
+function realtimeTopic2(scopes) {
+  const [root] = scopes;
+  if (root?.table.name !== REALTIME_MESSAGES) return void 0;
+  const column2 = root.table.byName.get("topic");
+  return column2 ? { column: column2, scope: 0 } : void 0;
+}
 function valueScopes(scopes, value) {
   switch (value.kind) {
     case "column": {
@@ -25781,6 +26482,10 @@ function valueScopes(scopes, value) {
       return valueScopes(scopes, value.operand);
     case "storage":
       return valueScopes(scopes, value.column);
+    case "realtime": {
+      const found = realtimeTopic2(scopes);
+      return found ? [found.scope] : [];
+    }
     default:
       return [];
   }
@@ -25841,16 +26546,19 @@ function columnAffinityOf(column2) {
   if (affinity2 === "BLOB") return "blob";
   return "numeric";
 }
+function operandColumn(scopes, value) {
+  if (value.kind === "realtime") return realtimeTopic2(scopes);
+  if (value.kind !== "column") return void 0;
+  return resolve8(scopes, value.qualifier, value.name);
+}
 function valueAffinity(scopes, value) {
   if (value.kind === "cast") return "text";
-  if (value.kind !== "column") return "none";
-  const found = resolve8(scopes, value.qualifier, value.name);
+  const found = operandColumn(scopes, value);
   return found ? columnAffinityOf(found.column) : "none";
 }
 function valueCollation(scopes, value) {
   if (value.kind === "cast") return valueCollation(scopes, value.operand);
-  if (value.kind !== "column") return void 0;
-  const found = resolve8(scopes, value.qualifier, value.name);
+  const found = operandColumn(scopes, value);
   return found ? found.column.collation : void 0;
 }
 function waysIn(scopes, where) {
@@ -25913,7 +26621,8 @@ function blocked(table, indexes, way) {
   return void 0;
 }
 function problemMessage(policy, outer, table, ways, why) {
-  const start = `Policy ${policy.name} on ${tableLabel(outer)}: its subquery on ${table.name} runs once for every row of ${tableLabel(outer)} it looks at`;
+  const runs = outer.name === REALTIME_MESSAGES ? "runs once for every channel join it checks" : `runs once for every row of ${tableLabel(outer)} it looks at`;
+  const start = `Policy ${policy.name} on ${tableLabel(outer)}: its subquery on ${table.name} ${runs}`;
   const override = "or send it with allow_unindexed=1 (naro policy create --allow-unindexed) to accept a scan of every row";
   const [way] = ways;
   if (!way)
@@ -25932,7 +26641,8 @@ function unindexedSubqueries(snapshot, indexes, policies) {
     if (policy.invalid !== null) continue;
     const outer = resolvePolicyTable(snapshot, policy.table);
     if (!outer) continue;
-    const outerName = asciiLower(policy.table) === STORAGE_OBJECTS ? STORAGE_OBJECTS_QUALIFIER : asciiLower(outer.name);
+    const folded = asciiLower(policy.table);
+    const outerNames = folded === STORAGE_OBJECTS ? [STORAGE_OBJECTS_QUALIFIER] : folded === REALTIME_MESSAGES ? REALTIME_MESSAGES_NAMES : [asciiLower(outer.name)];
     const visit = (scopes, expr) => {
       if (expr === null || isValueExpr(expr)) return;
       switch (expr.kind) {
@@ -25977,13 +26687,182 @@ function unindexedSubqueries(snapshot, indexes, policies) {
           return;
       }
     };
-    const root = [{ table: outer, names: [outerName] }];
+    const root = [{ table: outer, names: outerNames }];
     visit(root, policy.usingExpr);
     visit(root, policy.checkExpr);
   }
   return found;
 }
 
+// ../../packages/data-core/src/realtime-protocol.ts
+var REALTIME_PROTOCOL_VERSION = "1.0.0";
+var REALTIME_CLOSE = {
+  UNSUPPORTED_PROTOCOL: {
+    code: 4e3,
+    message: `This server speaks the Naro realtime protocol ${REALTIME_PROTOCOL_VERSION}. Update naro-js.`
+  },
+  INVALID_API_KEY: {
+    code: 4001,
+    message: "The API key is missing or not valid for this project."
+  },
+  REALTIME_NOT_ENABLED: {
+    code: 4004,
+    message: "Realtime is not enabled for this project."
+  },
+  CLIENT_FLOODING: {
+    code: 4008,
+    message: "This connection sent messages faster than a connection may."
+  },
+  TOO_MANY_CONNECTIONS: {
+    code: 4029,
+    message: "This project has reached its limit of concurrent realtime connections. Try again later."
+  },
+  CONNECTION_RATE_LIMITED: {
+    code: 4029,
+    message: "Too many new realtime connections to this project right now. Try again in a few seconds."
+  },
+  INVALID_SESSION: {
+    code: 4401,
+    message: "The session is expired or not valid. Sign in again."
+  },
+  HEARTBEAT_TIMEOUT: {
+    code: 4408,
+    message: "No heartbeat arrived for 75 seconds."
+  },
+  BACKEND_OFF: {
+    code: 4410,
+    message: "The project backend was turned off or deleted. Realtime stopped."
+  },
+  INTERNAL_ERROR: {
+    code: 4500,
+    message: "Something went wrong. Try again."
+  },
+  REALTIME_RESTARTING: {
+    code: 4503,
+    message: "Realtime is restarting to apply a change to this project."
+  }
+};
+
+// ../../packages/data-core/src/realtime-attachment.ts
+var ACCESS = {
+  BROADCAST_READ: 1,
+  BROADCAST_WRITE: 2,
+  PRESENCE_READ: 4,
+  PRESENCE_WRITE: 8
+};
+var MAX_ACCESS_BITS = ACCESS.BROADCAST_READ | ACCESS.BROADCAST_WRITE | ACCESS.PRESENCE_READ | ACCESS.PRESENCE_WRITE;
+
+// ../../packages/data-core/src/realtime-policy.ts
+var FULL_ACCESS = Object.freeze({
+  broadcastRead: true,
+  broadcastWrite: true,
+  presenceRead: true,
+  presenceWrite: true
+});
+var NO_ACCESS = Object.freeze({
+  broadcastRead: false,
+  broadcastWrite: false,
+  presenceRead: false,
+  presenceWrite: false
+});
+var PUBLIC_READ = Object.freeze({
+  broadcastRead: true,
+  broadcastWrite: false,
+  presenceRead: true,
+  presenceWrite: false
+});
+var ALL_BITS = ACCESS.BROADCAST_READ | ACCESS.BROADCAST_WRITE | ACCESS.PRESENCE_READ | ACCESS.PRESENCE_WRITE;
+var VALUES = [
+  { column: "sb", command: "select", extension: "broadcast" },
+  { column: "ib", command: "insert", extension: "broadcast" },
+  { column: "sp", command: "select", extension: "presence" },
+  { column: "ip", command: "insert", extension: "presence" }
+];
+var TARGET = {
+  name: REALTIME_MESSAGES,
+  table: REALTIME_MESSAGES_TABLE
+};
+var REALTIME_VALUES_REASON = `the realtime.messages policies need more than ${String(MAX_PARAMETERS)} values in one statement`;
+var REALTIME_BYTES_REASON = `the realtime.messages policies need more than ${String(MAX_STATEMENT_BYTES)} bytes of SQL in one statement`;
+function constantOf(fragment) {
+  if (fragment.params.length > 0) return void 0;
+  if (fragment.sql === "1") return true;
+  if (fragment.sql === "0") return false;
+  return void 0;
+}
+function privateChannelAccess(input) {
+  const { snapshot, context, policies, channel, nonce } = input;
+  if (context.role === "service") return { ok: true, access: FULL_ACCESS };
+  const req = { ...rlsIdentity(context), policies: policies ?? [] };
+  const state = newState2();
+  const fragments = [];
+  for (const { command, extension } of VALUES) {
+    let value;
+    try {
+      value = policyValue(
+        TARGET,
+        req,
+        snapshot,
+        command,
+        { topic: channel, extension, private: 1 },
+        nonce,
+        state
+      );
+    } catch (error51) {
+      if (!(error51 instanceof Failure)) throw error51;
+      return error51.reason === void 0 ? { ok: false, error: error51.error } : { ok: false, error: error51.error, reason: error51.reason };
+    }
+    if (!value.ok)
+      return {
+        ok: false,
+        error: dataError("POLICY_INVALID", {
+          action: command,
+          table: REALTIME_MESSAGES,
+          policy: value.policy
+        }),
+        reason: value.unsupported
+      };
+    fragments.push(value.fragment);
+  }
+  const constants = fragments.map(constantOf);
+  const [sb, ib, sp, ip] = constants;
+  if (sb !== void 0 && ib !== void 0 && sp !== void 0 && ip !== void 0)
+    return {
+      ok: true,
+      access: {
+        broadcastRead: sb,
+        broadcastWrite: ib,
+        presenceRead: sp,
+        presenceWrite: ip
+      }
+    };
+  const sql = `SELECT ${VALUES.map(
+    ({ column: column2 }, index) => `(CASE WHEN ${String(fragments[index]?.sql)} THEN 1 ELSE 0 END) AS ${column2}`
+  ).join(", ")}`;
+  const params = fragments.flatMap((fragment) => fragment.params);
+  if (params.length > MAX_PARAMETERS)
+    return {
+      ok: false,
+      error: dataError("POLICY_INVALID", {
+        action: "select",
+        table: REALTIME_MESSAGES,
+        values: MAX_PARAMETERS
+      }),
+      reason: REALTIME_VALUES_REASON
+    };
+  if (utf8ByteLength(sql) > MAX_STATEMENT_BYTES)
+    return {
+      ok: false,
+      error: dataError("POLICY_INVALID", {
+        action: "select",
+        table: REALTIME_MESSAGES,
+        bytes: MAX_STATEMENT_BYTES
+      }),
+      reason: REALTIME_BYTES_REASON
+    };
+  return { ok: true, statement: { sql, params } };
+}
+
 // ../../packages/data-core/src/storage-sql.ts
 var STORAGE_NONCE_MAX_DIGITS = 64;
 function nonceOf(nonce) {
@@ -26134,6 +27013,16 @@ function readObject2(i) {
     [[i.bucket, i.name]]
   );
 }
+function readObjects(i) {
+  return compose(
+    [
+      `SELECT ${OBJECT_COLUMNS} FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.name IN (SELECT value FROM json_each(?)) AND (`,
+      i.using,
+      ")"
+    ],
+    [[i.bucket, JSON.stringify([...new Set(i.names)])]]
+  );
+}
 var SORT_COLUMNS = {
   name: "name",
   created_at: "created_at",
@@ -26144,6 +27033,8 @@ var WIDEST_LIST_SORT = {
   column: "updated_at",
   order: "desc"
 };
+var WIDEST_LIST_SEARCH = "s";
+var SEARCH_CLAUSE = " AND instr(lower(o.name), lower(?)) = 1";
 function listObjects(i) {
   const column2 = Object.hasOwn(SORT_COLUMNS, i.sort.column) ? SORT_COLUMNS[i.sort.column] : void 0;
   const order = Object.hasOwn(SORT_ORDERS, i.sort.order) ? SORT_ORDERS[i.sort.order] : void 0;
@@ -26155,17 +27046,27 @@ function listObjects(i) {
   const restValues = root ? [] : [p];
   const under = root ? "1" : "o.name >= ? || '/' AND o.name < ? || '0'";
   const underValues = root ? [] : [p, p];
+  const searching = i.search !== "";
+  const search = searching ? SEARCH_CLAUSE : "";
+  const searchValues = searching ? [`${root ? "" : `${p}/`}${i.search}`] : [];
   return compose(
     [
-      `SELECT * FROM (SELECT 0 AS kind, substr(${rest}, 1, instr(${rest}, '/') - 1) AS name, NULL AS id, NULL AS bucket_id, NULL AS owner, NULL AS owner_id, NULL AS version, NULL AS created_at, NULL AS updated_at, NULL AS metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND ${under} AND instr(${rest}, '/') > 0 AND (`,
+      `SELECT * FROM (SELECT 0 AS kind, substr(${rest}, 1, instr(${rest}, '/') - 1) AS name, NULL AS id, NULL AS bucket_id, NULL AS owner, NULL AS owner_id, NULL AS version, NULL AS created_at, NULL AS updated_at, NULL AS metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND ${under} AND instr(${rest}, '/') > 0${search} AND (`,
       i.using,
-      `) GROUP BY 2 UNION ALL SELECT 1, ${rest}, o.id, o.bucket_id, o.owner, o.owner_id, o.version, o.created_at, o.updated_at, o.metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.parent = ? AND (`,
+      `) GROUP BY 2 UNION ALL SELECT 1, ${rest}, o.id, o.bucket_id, o.owner, o.owner_id, o.version, o.created_at, o.updated_at, o.metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.parent = ?${search} AND (`,
       i.using,
       `)) ORDER BY kind, CASE WHEN kind = 0 THEN name END ASC, ${column2} ${order}, name LIMIT ? OFFSET ?`
     ],
     [
-      [...restValues, ...restValues, i.bucket, ...underValues, ...restValues],
-      [...restValues, i.bucket, p],
+      [
+        ...restValues,
+        ...restValues,
+        i.bucket,
+        ...underValues,
+        ...restValues,
+        ...searchValues
+      ],
+      [...restValues, i.bucket, p, ...searchValues],
       [i.limit, i.offset]
     ]
   );
@@ -26446,24 +27347,77 @@ function storageStatements(select, update, remove, insertChecks, updateCheck) {
   if (select)
     statements.push(
       readObject2({ bucket: value, name: value, using: select }),
+      // Several names at once (3-1g): as many values as readObject's, 32
+      // bytes more — the listing below is always wider, but the worker
+      // builds this one too.
+      readObjects({ bucket: value, names: [], using: select }),
       listObjects({
         bucket: value,
         prefix: "p",
         limit: 0,
         offset: 0,
         sort: WIDEST_LIST_SORT,
+        search: WIDEST_LIST_SEARCH,
         using: select
       })
     );
   return statements;
 }
+var REALTIME_PROBE_CHANNEL = "naro-policy-check";
+var REALTIME_PROBE_NONCE = "f".repeat(64);
+var JOIN_STATEMENT = "a join checks the SELECT and INSERT policies of realtime.messages in one statement, for broadcast and again for presence";
+function joinReason(reason) {
+  if (reason === STATEMENT_SUBQUERIES_REASON)
+    return `the SELECT and INSERT policies of realtime.messages share one budget of ${String(MAX_STATEMENT_SUBQUERIES)} subqueries per join, counting the policies of the tables they read \u2014 a join checks them in one statement, for broadcast and again for presence`;
+  if (reason === REALTIME_VALUES_REASON || reason === REALTIME_BYTES_REASON)
+    return JOIN_STATEMENT;
+  return reason;
+}
+function realtimeRefusals(snapshot, policies) {
+  const refusals = [];
+  const applying = (command) => policies.filter(
+    (policy) => asciiLower(policy.table) !== REALTIME_MESSAGES || policy.command === command || policy.command === "all"
+  );
+  for (const set2 of [policies, applying("select"), applying("insert")])
+    for (const context of STORAGE_CONTEXTS) {
+      const plan = privateChannelAccess({
+        snapshot,
+        context,
+        policies: set2,
+        channel: REALTIME_PROBE_CHANNEL,
+        nonce: REALTIME_PROBE_NONCE
+      });
+      if (plan.ok) continue;
+      const reason = joinReason(plan.reason);
+      refusals.push(
+        reason === void 0 ? { error: plan.error } : { error: plan.error, reason }
+      );
+    }
+  return refusals;
+}
 function policyOn(snapshot, name) {
   const table = resolvePolicyTable(snapshot, name);
   if (!table) return void 0;
-  return asciiLower(name) === STORAGE_OBJECTS ? { table, label: STORAGE_OBJECTS, names: [STORAGE_OBJECTS_QUALIFIER] } : { table, label: table.name, names: [asciiLower(table.name)] };
+  const folded = asciiLower(name);
+  if (folded === STORAGE_OBJECTS)
+    return {
+      table,
+      label: STORAGE_OBJECTS,
+      names: [STORAGE_OBJECTS_QUALIFIER]
+    };
+  if (folded === REALTIME_MESSAGES)
+    return {
+      table,
+      label: REALTIME_MESSAGES,
+      names: REALTIME_MESSAGES_NAMES
+    };
+  return { table, label: table.name, names: [asciiLower(table.name)] };
 }
 function tableLabelOf(snapshot, name) {
-  return asciiLower(name) === STORAGE_OBJECTS ? STORAGE_OBJECTS : resolveTable(snapshot, name)?.name ?? name;
+  const folded = asciiLower(name);
+  if (folded === STORAGE_OBJECTS) return STORAGE_OBJECTS;
+  if (folded === REALTIME_MESSAGES) return REALTIME_MESSAGES;
+  return resolveTable(snapshot, name)?.name ?? name;
 }
 function namedInRefusal(message, policies) {
   let found;
@@ -26603,6 +27557,9 @@ function problems(snapshot, policies, options) {
         policy: ""
       });
   }
+  if (policiesOn(loaded, REALTIME_MESSAGES).length > 0)
+    for (const { error: error51, reason } of realtimeRefusals(snapshot, loaded))
+      refused(REALTIME_MESSAGES, error51, reason);
   if (options.indexes && options.allowUnindexed !== true)
     for (const problem of unindexedSubqueries(
       snapshot,
@@ -26719,16 +27676,16 @@ function readCreate(stream, start) {
   let check2 = null;
   let position = start.position;
   if (stream.acceptKeyword("using")) {
-    const clause = readClause(stream);
-    using = clause.text;
-    position = clause.position;
+    const clause2 = readClause(stream);
+    using = clause2.text;
+    position = clause2.position;
   }
   if (isKeyword(stream.peek(), "with")) {
     stream.next();
     stream.expectKeyword("check");
-    const clause = readClause(stream);
-    check2 = clause.text;
-    position = clause.position;
+    const clause2 = readClause(stream);
+    check2 = clause2.text;
+    position = clause2.position;
   }
   if (!roles.ok) throw new Error("unreachable");
   readEnd(stream);
@@ -27242,9 +28199,42 @@ COMMENT ON POLICY ${quotePolicyName(policy.name)} ON ${policyTableSql(policy.tab
 function unreadablePolicyComment(policy) {
   return `-- Policy ${commentText(quotePolicyName(policy.name))} on ${commentText(policyTableSql(policy.table))} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped and created again.`;
 }
+var STORED_POLICIES_SQL = `SELECT table_name, name, kind, command, roles, using_expr, check_expr, owner_column, updated_at FROM ${NAMED_POLICY_TABLE} ORDER BY table_name, name`;
 var SYSTEM_PREDICATE = systemTablePredicate("name");
 var STORAGE_EXISTS = `EXISTS (SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ${sqlStringLiteral(STORAGE_OBJECTS_TABLE)})`;
 
+// ../../packages/data-core/src/realtime-limits.ts
+var HOBBY_REALTIME_LIMITS = Object.freeze({
+  connections: 200,
+  newConnectionsPerSecond: 10,
+  messagesPerSecond: 100,
+  joinsPerSecond: 100,
+  presencePerSecond: 20,
+  broadcastPayloadBytes: 262144,
+  policyChecksPerSecond: 100,
+  restRequestsPerSecond: 10
+});
+var PRO_REALTIME_LIMITS = Object.freeze({
+  connections: 500,
+  newConnectionsPerSecond: 25,
+  messagesPerSecond: 500,
+  joinsPerSecond: 500,
+  presencePerSecond: 50,
+  broadcastPayloadBytes: 3072e3,
+  policyChecksPerSecond: 250,
+  restRequestsPerSecond: 25
+});
+var ENTERPRISE_REALTIME_LIMITS = Object.freeze({
+  connections: 2e3,
+  newConnectionsPerSecond: 100,
+  messagesPerSecond: 1e3,
+  joinsPerSecond: 1e3,
+  presencePerSecond: 1e3,
+  broadcastPayloadBytes: 3072e3,
+  policyChecksPerSecond: 500,
+  restRequestsPerSecond: 100
+});
+
 // ../../packages/data-core/src/redirect-origins.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
   "localhost",
@@ -27795,7 +28785,10 @@ var POLICY_WARNING_RULES = [
 function policyIssues(input) {
   const present = /* @__PURE__ */ new Set([
     ...input.tables.map(asciiLower),
-    ...input.snapshot.storage ? [STORAGE_OBJECTS] : []
+    ...input.snapshot.storage ? [STORAGE_OBJECTS] : [],
+    // Realtime's messages are on every backend (Storage 3-1a Task 5와 같은
+    // 자리, Realtime 3-2a).
+    REALTIME_MESSAGES
   ]);
   const found = [
     ...policySetProblems(
@@ -28131,6 +29124,7 @@ function policiesFromFiles(files) {
   const tables = /* @__PURE__ */ new Set();
   const forget = (table) => {
     if (sameTable(table, STORAGE_OBJECTS)) return;
+    if (sameTable(table, REALTIME_MESSAGES)) return;
     policies = policies.filter((policy) => !sameTable(policy.table, table));
   };
   for (const [file2, sql] of files.entries()) {
@@ -28150,9 +29144,20 @@ function policiesFromFiles(files) {
         tables,
         refused: { file: file2, reason: planned.message }
       };
-    for (const statement2 of planned.plan.statements) {
+    for (const [index, statement2] of planned.plan.statements.entries()) {
       if (statement2.kind === "create-policy") {
         const { table, name } = statement2.policy;
+        if (policies.some(
+          (policy) => sameTable(policy.table, table) && policy.name === name
+        ))
+          return {
+            policies,
+            tables,
+            refused: {
+              file: file2,
+              reason: `statement ${String(index + 1)} of ${String(planned.plan.statements.length)} failed and the migration was rolled back: policy "${name}" for table "${table}" already exists`
+            }
+          };
         policies.push({ table, name });
       } else if (statement2.kind === "drop-policy") {
         policies = policies.filter(
@@ -28170,6 +29175,10 @@ function policiesFromFiles(files) {
           if (!tables.has(asciiLower(head.to))) forget(head.to);
           tables.delete(asciiLower(head.table));
           tables.add(asciiLower(head.to));
+          if (!sameTable(head.table, STORAGE_OBJECTS) && !sameTable(head.table, REALTIME_MESSAGES))
+            policies = policies.map(
+              (policy) => sameTable(policy.table, head.table) ? { ...policy, table: head.to } : policy
+            );
         }
       }
     }
@@ -28179,10 +29188,12 @@ function policiesFromFiles(files) {
 function policiesLostByReset(input) {
   const present = new Set(input.tables.map(asciiLower));
   if (input.storage === true) present.add(STORAGE_OBJECTS);
+  present.add(REALTIME_MESSAGES);
   const made = policiesFromFiles(input.files);
   if (made.refused) return { lost: [], withTables: [], refused: made.refused };
   const remade = new Set(made.tables);
   if (input.storage === true) remade.add(STORAGE_OBJECTS);
+  remade.add(REALTIME_MESSAGES);
   const gone = input.current.filter(
     (policy) => present.has(asciiLower(policy.table)) && !made.policies.some(
       (other) => sameTable(other.table, policy.table) && other.name === policy.name
@@ -28226,30 +29237,78 @@ function storedPolicySql(row) {
   return { sql, statements: [create, sql.slice(create.length + 1)] };
 }
 
+// ../../packages/sdk/src/usage.ts
+var USAGE_METRICS = ["requests", "builds", "domains"];
+var USAGE_NEAR_PERCENT = 80;
+function usageMonthOf(now) {
+  return `${String(now.getUTCFullYear()).padStart(4, "0")}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+function summarizeTeamUsage(report, currentMonth) {
+  let requests = 0;
+  let builds = 0;
+  for (const entry of report.days) {
+    requests += entry.requests;
+    builds += entry.builds;
+  }
+  const used = {
+    requests,
+    builds,
+    domains: report.days.at(-1)?.domains ?? 0
+  };
+  const meters = USAGE_METRICS.map((metric) => {
+    const limit = report.limits?.[metric] ?? null;
+    return {
+      metric,
+      used: used[metric],
+      limit,
+      percent: limit ? Math.floor(used[metric] * 100 / limit) : null
+    };
+  });
+  return {
+    limitsKnown: report.limits !== void 0,
+    meters,
+    status: usageStatus(report, currentMonth, requests)
+  };
+}
+function usageStatus(report, currentMonth, requests) {
+  const { mode, limitedThisMonth } = report.enforcement;
+  if (mode === "off" || report.team.plan !== "hobby" || report.month !== currentMonth)
+    return null;
+  if (limitedThisMonth) return mode === "enforce" ? "paused" : "over";
+  const limit = report.limits?.requests ?? null;
+  if (limit === null) return null;
+  return requests * 100 >= limit * USAGE_NEAR_PERCENT ? "near" : null;
+}
+
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
 import { join as join23 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
-var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_"];
+var PUBLIC_PREFIX = "NEXT_PUBLIC_";
+function maskSecretValue(value) {
+  return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
+}
 function maskEnvValue(key, value) {
-  if (PUBLIC_PREFIXES.some((prefix) => key.startsWith(prefix)))
+  if (key.startsWith(PUBLIC_PREFIX))
     return value.length > 60 ? `${value.slice(0, 60)}\u2026` : value;
-  return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
+  return maskSecretValue(value);
 }
 function findDotenvFile(dir) {
   for (const name of DOTENV_FILES) if (existsSync6(join23(dir, name))) return name;
   return null;
 }
-function envAddGuidance(keys) {
+function envAddGuidance(keys, environment) {
+  const suffix = environment === void 0 ? "" : ` ${environment}`;
   return [
     "  Set them yourself:",
-    ...keys.map((key) => `    npx naro-cli env add ${key}`),
+    ...keys.map((key) => `    npx naro-cli env add ${key}${suffix}`),
     "  (values come from a hidden prompt or stdin, never from argv)"
   ];
 }
 async function promptForMissingEnv(ctx, keys) {
   const guide = (remaining2) => {
-    for (const line of envAddGuidance(remaining2)) ctx.output.log(line);
+    for (const line of envAddGuidance(remaining2, ctx.environment))
+      ctx.output.log(line);
   };
   const file2 = findDotenvFile(ctx.cwd);
   if (!file2) {
@@ -28287,6 +29346,20 @@ async function promptForMissingEnv(ctx, keys) {
   return collected;
 }
 
+// src/env-surface.ts
+function pullEnv(rows, surface) {
+  const chosen = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    if (row.target !== "all" && row.target !== surface) continue;
+    const held = chosen.get(row.key);
+    if (!held || held.target === "all" && row.target !== "all")
+      chosen.set(row.key, row);
+  }
+  return Object.fromEntries(
+    [...chosen.values()].map((row) => [row.key, row.value ?? ""])
+  );
+}
+
 // src/git-info.ts
 import { execFile as execFile2 } from "child_process";
 var SUPPORTED_REMOTE = [
@@ -28294,10 +29367,10 @@ var SUPPORTED_REMOTE = [
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
-var defaultExec = (args, cwd) => new Promise((resolve11, reject) => {
+var defaultExec = (args, cwd) => new Promise((resolve12, reject) => {
   execFile2("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
-    else resolve11(stdout);
+    else resolve12(stdout);
   });
 });
 async function tryExec(exec, args, cwd) {
@@ -28446,6 +29519,225 @@ async function uploadArtifact(artifact, opts) {
   };
 }
 
+// src/working-tree.ts
+import { execFile as execFile3 } from "child_process";
+import {
+  cp as cp2,
+  lstat,
+  mkdir as mkdir3,
+  readFile as readFile13,
+  readlink,
+  realpath,
+  rm as rm4,
+  stat as stat3,
+  symlink,
+  unlink,
+  writeFile as writeFile7
+} from "fs/promises";
+import {
+  basename as basename3,
+  dirname as dirname5,
+  isAbsolute as isAbsolute4,
+  join as join24,
+  relative as relative6,
+  resolve as resolve10,
+  sep as sep4
+} from "path";
+var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
+var ENV_FILE = /^\.env(\.(?!(?:example|sample|template)$)[^\\/]+)?$/i;
+function git(cwd, args) {
+  return new Promise((done, fail2) => {
+    execFile3(
+      "git",
+      args,
+      { cwd, encoding: "buffer", maxBuffer: 64 * 1024 * 1024 },
+      (error51, stdout) => {
+        if (error51) fail2(error51);
+        else done(stdout);
+      }
+    );
+  });
+}
+async function committedEnvFiles(sourceDir) {
+  let listing;
+  try {
+    listing = await git(sourceDir, ["ls-tree", "-r", "-z", "HEAD"]);
+  } catch (error51) {
+    return error51.code === "ENOENT" ? null : [];
+  }
+  return listing.toString("utf8").split("\0").flatMap((entry) => {
+    const tab = entry.indexOf("	");
+    if (tab < 0) return [];
+    const [mode] = entry.slice(0, tab).split(" ");
+    const path = entry.slice(tab + 1);
+    if (!ENV_FILE.test(basename3(path)) || COPY_SKIP.test(path)) return [];
+    if (mode === "100644" || mode === "100755")
+      return [{ path, symlink: false }];
+    if (mode === "120000") return [{ path, symlink: true }];
+    return [];
+  });
+}
+async function staysInside(link, text2, root) {
+  try {
+    return inside(await realpath(link), root);
+  } catch (error51) {
+    return error51.code === "ENOENT" && !text2.split(/[\\/]/).includes("..");
+  }
+}
+function climbsOnlyFirst(text2) {
+  const segments = text2.split(/[\\/]/).filter((s) => s !== "" && s !== ".");
+  const down = segments.findIndex((segment) => segment !== "..");
+  return down < 0 || !segments.slice(down).includes("..");
+}
+function inside(path, root) {
+  const rel = relative6(root, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+}
+async function keptOnly(items, keep, remove) {
+  const verdicts = await Promise.all(items.map(keep));
+  const removed = items.filter((_, index) => !verdicts[index]);
+  for (const item of removed) await remove(item);
+  return removed;
+}
+async function readLocal(path) {
+  const found = await stat3(path).catch(() => null);
+  if (!found?.isFile()) return null;
+  return readFile13(path).catch(() => null);
+}
+async function realAncestor(dir) {
+  for (let current = dir; ; current = dirname5(current)) {
+    try {
+      return await realpath(current);
+    } catch {
+      if (dirname5(current) === current)
+        throw new Error(`No ancestor of ${dir}`);
+    }
+  }
+}
+function sameText(a, b) {
+  return a.equals(b) || a.toString("utf8").replace(/\r\n/g, "\n") === b.toString("utf8").replace(/\r\n/g, "\n");
+}
+async function copyWorkingTree(source, checkout) {
+  const sourceDir = await realpath(source);
+  const inWorkingTree = [];
+  const absoluteLinks = [];
+  const linksOutside = [];
+  const linksElsewhere = [];
+  const keptLinks = [];
+  await cp2(sourceDir, checkout, {
+    recursive: true,
+    // Relative symlinks must stay relative: resolved, they would point
+    // back into the developer's real tree, and a strategy's temporary
+    // rewrite (proxy -> middleware, vinext toolchain) would land there.
+    verbatimSymlinks: true,
+    filter: async (src) => {
+      if (COPY_SKIP.test(src)) return false;
+      if (src === sourceDir) return true;
+      const entry = await lstat(src);
+      if (entry.isFIFO() || entry.isSocket() || entry.isCharacterDevice() || entry.isBlockDevice())
+        return false;
+      if (ENV_FILE.test(basename3(src)) && !entry.isDirectory()) {
+        inWorkingTree.push(relative6(sourceDir, src).split(sep4).join("/"));
+        return false;
+      }
+      if (entry.isSymbolicLink()) {
+        const target2 = await readlink(src);
+        const path = relative6(sourceDir, src).split(sep4).join("/");
+        if (isAbsolute4(target2)) {
+          absoluteLinks.push(path);
+          return false;
+        }
+        if (!inside(resolve10(dirname5(src), target2), sourceDir)) {
+          linksOutside.push(path);
+          return false;
+        }
+        if (!await staysInside(src, target2, sourceDir)) {
+          linksElsewhere.push(path);
+          return false;
+        }
+        keptLinks.push({ path, text: target2 });
+      }
+      return true;
+    }
+  });
+  const root = await realpath(checkout);
+  const strays = await keptOnly(
+    keptLinks,
+    async ({ path, text: text2 }) => {
+      try {
+        return inside(await realpath(join24(checkout, path)), root);
+      } catch (error51) {
+        return error51.code === "ENOENT" && climbsOnlyFirst(text2);
+      }
+    },
+    ({ path }) => unlink(join24(checkout, path))
+  );
+  linksElsewhere.push(...strays.map(({ path }) => path));
+  const committed = await committedEnvFiles(sourceDir);
+  const committedVersion = [];
+  const outsideProject = [];
+  const envLinks = [];
+  for (const { path, symlink: isLink } of committed ?? []) {
+    if ([...absoluteLinks, ...linksOutside, ...linksElsewhere].some(
+      (link) => path.startsWith(`${link}/`)
+    )) {
+      outsideProject.push(path);
+      continue;
+    }
+    const target2 = join24(checkout, path);
+    if (!inside(await realAncestor(dirname5(target2)), root)) {
+      outsideProject.push(path);
+      continue;
+    }
+    try {
+      await mkdir3(dirname5(target2), { recursive: true });
+    } catch {
+      outsideProject.push(path);
+      continue;
+    }
+    await rm4(target2, { recursive: true, force: true });
+    const content = await git(sourceDir, ["show", `HEAD:./${path}`]);
+    if (isLink) {
+      const linkTarget = content.toString("utf8");
+      const pointsAt = resolve10(dirname5(target2), linkTarget);
+      if (isAbsolute4(linkTarget) || !inside(pointsAt, checkout)) {
+        outsideProject.push(path);
+        continue;
+      }
+      await symlink(linkTarget, target2);
+      envLinks.push(path);
+      continue;
+    }
+    await writeFile7(target2, content, { flag: "wx" });
+    const local = await readLocal(join24(sourceDir, path));
+    if (!local || !sameText(local, content)) committedVersion.push(path);
+  }
+  const envStrays = await keptOnly(
+    envLinks,
+    async (path) => {
+      const real = await realpath(join24(checkout, path)).catch(() => null);
+      return real !== null && inside(real, root);
+    },
+    (path) => unlink(join24(checkout, path))
+  );
+  outsideProject.push(...envStrays);
+  const inCommit = new Set(
+    (committed ?? []).map(({ path }) => path.normalize("NFC"))
+  );
+  const leftOut = inWorkingTree.filter(
+    (path) => !inCommit.has(path.normalize("NFC"))
+  );
+  return {
+    leftOut,
+    committedVersion,
+    outsideProject,
+    absoluteLinks,
+    linksOutside,
+    linksElsewhere,
+    gitUnavailable: committed === null
+  };
+}
+
 // src/deploy.ts
 function parseDotenv2(text2) {
   return parseDotenv(text2);
@@ -28471,7 +29763,7 @@ function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUr
       } catch (error51) {
         lastError = error51;
         await new Promise(
-          (resolve11) => setTimeout(resolve11, 500 * (attempt + 1))
+          (resolve12) => setTimeout(resolve12, 500 * (attempt + 1))
         );
       }
     }
@@ -28519,9 +29811,23 @@ function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUr
       await post({ type: "metadata", metadata: rest }).catch(() => {
       });
     },
-    flush: flushLogs
+    flush: flushLogs,
+    fail: async (code, message) => {
+      await flushLogs();
+      await postStatus({
+        type: "status",
+        status: "FAILED",
+        error: { code, message }
+      }).catch(() => {
+      });
+    }
   };
 }
+var DEPLOYMENT_CODES = new Set(DEPLOYMENT_ERROR_CODES);
+function failureCode(error51, fallback) {
+  const code = error51 && typeof error51 === "object" ? error51.code : void 0;
+  return typeof code === "string" && DEPLOYMENT_CODES.has(code) ? code : fallback;
+}
 function slugify2(value) {
   const slug = value.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 54);
   return slug || "app";
@@ -28529,20 +29835,19 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile13(join24(sourceDir, "package.json"), "utf8")
+      await readFile14(join25(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
   }
-  return basename3(sourceDir);
+  return basename4(sourceDir);
 }
-var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 function resolveBin(name) {
-  let dir = dirname5(fileURLToPath(import.meta.url));
+  let dir = dirname6(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = join24(dir, "node_modules", ".bin", name);
+    const candidate = join25(dir, "node_modules", ".bin", name);
     if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir) return name;
     dir = parent;
   }
@@ -28565,22 +29870,59 @@ async function detectPackageManagerLenient(root) {
     };
   }
 }
-function localDependencies(sourceDir) {
+function workingTreeNotices(copy) {
+  const notices = [];
+  const how = "Local values reach a build only through the env prompt or `naro env add`.";
+  if (copy.gitUnavailable && copy.leftOut.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because git could not be run to read the commit: ${copy.leftOut.join(", ")}. Install git to build with the committed ones. ${how}`
+    });
+  else if (copy.leftOut.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because they are not committed: ${copy.leftOut.join(", ")}. ${how}`
+    });
+  if (copy.outsideProject.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because they would land outside the project or in a place that could not be found: ${copy.outsideProject.join(", ")}.`
+    });
+  if (copy.absoluteLinks.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because they are symbolic links to an absolute path: ${copy.absoluteLinks.join(", ")}. A git deploy of this commit cannot follow them either; copy what the build needs into the project.`
+    });
+  if (copy.linksOutside.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because they are symbolic links to outside this folder: ${copy.linksOutside.join(", ")}. To keep links between a repository's folders, deploy from the repository root with --root <app folder>.`
+    });
+  if (copy.linksElsewhere.length > 0)
+    notices.push({
+      level: "WARN",
+      message: `Left out of the build because they are symbolic links that lead out of this folder on disk, or to a place that could not be found: ${copy.linksElsewhere.join(", ")}. Copy what the build needs into the project.`
+    });
+  if (copy.committedVersion.length > 0)
+    notices.push({
+      level: "INFO",
+      message: `Built with the committed version of ${copy.committedVersion.join(", ")}; the local edits stay on this machine.`
+    });
+  return notices;
+}
+function localDependencies(sourceDir, say = () => void 0) {
   return {
-    createWorkspace: () => mkdtemp2(join24(tmpdir2(), "naro-build-")),
-    removeWorkspace: (path) => rm4(path, { recursive: true, force: true }),
+    createWorkspace: () => mkdtemp2(join25(tmpdir2(), "naro-build-")),
+    removeWorkspace: (path) => rm5(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
         const checkout = spec.args.at(-1);
         if (!checkout) throw new Error("Missing checkout path.");
-        await cp2(sourceDir, checkout, {
-          recursive: true,
-          // Relative symlinks must stay relative: resolved, they would point
-          // back into the developer's real tree, and a strategy's temporary
-          // rewrite (proxy -> middleware, vinext toolchain) would land there.
-          verbatimSymlinks: true,
-          filter: (src) => !COPY_SKIP.test(src)
-        });
+        const copy = await copyWorkingTree(sourceDir, checkout);
+        for (const notice of workingTreeNotices(copy)) {
+          say(`${notice.level === "WARN" ? "\u26A0" : "\u25B8"} ${notice.message}`);
+          await observer.onLog({ ...notice, stage: spec.stage });
+        }
         return { stdout: [], stderr: [] };
       }
       if (spec.command === "git" && spec.args[0] === "rev-parse") {
@@ -28608,7 +29950,14 @@ function localDependencies(sourceDir) {
 async function deployDirectory(sourceDir, options, log2) {
   const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
-  const appRoot = options.rootDirectory ? resolve10(sourceDir, options.rootDirectory) : sourceDir;
+  const environment = production ? void 0 : options.environment;
+  if (environment === "production" || environment === "preview")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass production: true for production; preview is the default."
+    );
+  const surface = production ? "production" : environment ?? "preview";
+  const appRoot = options.rootDirectory ? resolve11(sourceDir, options.rootDirectory) : sourceDir;
   const framework = detectFramework2(appRoot);
   if (!framework.deployable && !options.force) {
     throw new NaroError(
@@ -28630,12 +29979,14 @@ async function deployDirectory(sourceDir, options, log2) {
     getAccessToken: () => auth.getAccessToken(),
     ...options.fetch ? { fetch: options.fetch } : {}
   });
+  if (environment !== void 0 && options.projectId)
+    await client.environments.get(options.projectId, environment);
   const name = slugify2(options.name ?? await projectName(appRoot));
-  const git = await (options.gitInfo ?? detectGitInfo)(sourceDir);
-  const branch = options.branch ?? git.branch;
-  const repositoryRoot = [git.prefix, options.rootDirectory].filter(Boolean).join("/") || null;
+  const git2 = await (options.gitInfo ?? detectGitInfo)(sourceDir);
+  const branch = options.branch ?? git2.branch;
+  const repositoryRoot = [git2.prefix, options.rootDirectory].filter(Boolean).join("/") || null;
   if (options.projectId) log2(`\u25B8 linked project ${options.projectId}`);
-  else if (git.repositoryUrl) log2(`\u25B8 linking ${git.repositoryUrl}`);
+  else if (git2.repositoryUrl) log2(`\u25B8 linking ${git2.repositoryUrl}`);
   if (options.env && Object.keys(options.env).length > 0)
     log2(`\u25B8 syncing ${String(Object.keys(options.env).length)} env var(s)`);
   const scanned = scanEnvReferences(sourceDir).map(
@@ -28647,7 +29998,7 @@ async function deployDirectory(sourceDir, options, log2) {
     if (options.projectId) {
       try {
         const rows = await client.env.list(options.projectId);
-        existing = new Set(rows.map((row) => row.key));
+        existing = new Set(Object.keys(pullEnv(rows, surface)));
       } catch {
       }
     }
@@ -28659,8 +30010,10 @@ async function deployDirectory(sourceDir, options, log2) {
     log2(
       `\u25B8 ${String(missing.length)} env var(s) needed, not set on this project: ${missing.join(", ")}`
     );
-    if (options.onMissingEnv) collected = await options.onMissingEnv(missing);
-    else for (const line of envAddGuidance(missing)) log2(line);
+    const canCollect = environment === void 0 || options.projectId;
+    if (options.onMissingEnv && canCollect)
+      collected = await options.onMissingEnv(missing);
+    else for (const line of envAddGuidance(missing, environment)) log2(line);
   }
   const missingEnvKeys = missing.filter((key) => !(key in collected));
   const envToSend = { ...options.env, ...collected };
@@ -28669,15 +30022,18 @@ async function deployDirectory(sourceDir, options, log2) {
     ...options.projectId ? { projectId: options.projectId } : { name },
     ...options.teamSlug ? { teamSlug: options.teamSlug } : {},
     production,
-    ...git.repositoryUrl != null && { repositoryUrl: git.repositoryUrl },
+    ...options.environment !== void 0 && {
+      environment: options.environment
+    },
+    ...git2.repositoryUrl != null && { repositoryUrl: git2.repositoryUrl },
     ...branch != null && { branch },
     ...repositoryRoot != null && { rootDirectory: repositoryRoot },
     ...Object.keys(envToSend).length > 0 && { env: envToSend },
-    ...git.commit != null && { commit: git.commit }
+    ...git2.commit != null && { commit: git2.commit }
   });
   if (ctx.envSkipped?.length)
     log2(`\u26A0 skipped env: ${ctx.envSkipped.join(", ")}`);
-  const executor = options.executor ?? new LocalBuildExecutor(localDependencies(sourceDir));
+  const executor = options.executor ?? new LocalBuildExecutor(localDependencies(sourceDir, log2));
   const observer = eventsObserver(
     cpUrl,
     ctx.deploymentId,
@@ -28708,18 +30064,29 @@ async function deployDirectory(sourceDir, options, log2) {
     );
     artifact = result.artifact;
   } catch (error51) {
-    throw new NaroError(
-      "BUILD_FAILED",
-      error51 instanceof Error ? error51.message : "The local build failed.",
-      { details: { deploymentId: ctx.deploymentId }, cause: error51 }
+    const message = error51 instanceof Error ? error51.message : "The local build failed.";
+    const buildCode = failureCode(error51, "BUILD_FAILED");
+    await observer.fail(buildCode, message);
+    throw new NaroError("BUILD_FAILED", message, {
+      details: { deploymentId: ctx.deploymentId, buildCode },
+      cause: error51
+    });
+  }
+  let uploadSummary;
+  try {
+    ({ uploadSummary } = await uploadArtifact(artifact, {
+      controlPlaneUrl: cpUrl,
+      deploymentId: ctx.deploymentId,
+      callbackToken: ctx.callbackToken,
+      ...options.fetch ? { fetch: options.fetch } : {}
+    }));
+  } catch (error51) {
+    await observer.fail(
+      failureCode(error51, "DEPLOY_FAILED"),
+      error51 instanceof Error ? error51.message : "The upload failed."
     );
+    throw error51;
   }
-  const { uploadSummary } = await uploadArtifact(artifact, {
-    controlPlaneUrl: cpUrl,
-    deploymentId: ctx.deploymentId,
-    callbackToken: ctx.callbackToken,
-    ...options.fetch ? { fetch: options.fetch } : {}
-  });
   log2(`\u25B8 ${uploadSummary}`);
   await observer.onLog({
     level: "INFO",
@@ -28728,7 +30095,12 @@ async function deployDirectory(sourceDir, options, log2) {
   });
   await observer.flush();
   log2("\u25B8 publishing worker");
-  const detail = await waitForFinish(client, ctx, log2);
+  const detail = await waitForFinish(
+    client,
+    ctx,
+    log2,
+    options.pollIntervalMs ?? 2500
+  );
   const url2 = deploymentUrl(detail, ctx, production);
   if (detail.deployment.status === "FAILED") {
     throw new NaroError(
@@ -28743,15 +30115,17 @@ async function deployDirectory(sourceDir, options, log2) {
     status: detail.deployment.status,
     url: url2,
     production,
+    // A control plane from before named environments sends no environment.
+    environment: ctx.environment ?? null,
     missingEnvKeys,
     teamSlug: ctx.teamSlug,
     projectSlug: ctx.projectSlug,
     gitConnection: ctx.gitConnection
   };
 }
-async function waitForFinish(client, ctx, log2) {
+async function waitForFinish(client, ctx, log2, intervalMs) {
   return client.deployments.wait(ctx.deploymentId, {
-    intervalMs: 2500,
+    intervalMs,
     timeoutMs: 10 * 6e4,
     onStatus: (status) => {
       if (status === "READY") log2("\u2713 worker deployed");
@@ -28760,9 +30134,10 @@ async function waitForFinish(client, ctx, log2) {
 }
 function deploymentUrl(detail, ctx, production) {
   if (detail.deployment.url) return detail.deployment.url;
-  const surface = ctx.subdomain ?? ctx.projectId;
+  const surface = ctx.environment ? { kind: "environment", slug: ctx.environment, environmentId: null } : production ? PRODUCTION_SURFACE : PREVIEW_SURFACE;
+  const worker = workerNameForSurface(ctx.subdomain ?? ctx.projectId, surface);
   const host = new URL(ctx.controlPlaneUrl || controlPlaneUrl()).hostname;
-  return `https://${surface}${production ? "" : "-preview"}.${host}`;
+  return `https://${worker}.${host}`;
 }
 
 export {
@@ -28780,10 +30155,14 @@ export {
   isExpired,
   controlPlaneUrl,
   createAuthClient,
+  userForAccessToken,
   refreshStoredSession,
   login,
+  suppliedToken,
   resolveAuth,
   openBrowser,
+  isReservedEnvTarget,
+  isEnvTargetName,
   SPEED_INSIGHTS_METRICS,
   SPEED_INSIGHTS_FILTER_KEYS,
   SPEED_INSIGHTS_MIN_DEPLOYMENT_SAMPLES,
@@ -28799,6 +30178,7 @@ export {
   cellText,
   renderRows,
   summarizeStatement,
+  parseDotenv,
   serializeDotenv,
   MAX_SINGLE_UPLOAD_BYTES,
   parseCacheControl,
@@ -28844,11 +30224,17 @@ export {
   resetPoliciesWithTablesMessage,
   resetFileRefusedMessage,
   storedPolicySql,
+  usageMonthOf,
+  summarizeTeamUsage,
+  maskEnvValue,
   promptForMissingEnv,
+  pullEnv,
   detectGitInfo,
-  parseDotenv2 as parseDotenv,
+  parseDotenv2,
   readProjectEnv2 as readProjectEnv,
   eventsObserver,
   slugify2 as slugify,
+  workingTreeNotices,
+  localDependencies,
   deployDirectory
 };