naro-cli 0.19.0 → 0.20.0

package/dist/{chunk-DEEFHVDZ.js → chunk-SAA66XLD.js}

@@ -5,9 +5,9 @@ import {
 
 // src/deploy.ts
 import { existsSync as existsSync7 } from "fs";
-import { mkdtemp as mkdtemp2, readFile as readFile14, rm as rm5 } from "fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile15, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename4, dirname as dirname6, join as join25, resolve as resolve11 } from "path";
+import { basename as basename4, dirname as dirname6, join as join26, resolve as resolve11 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -287,9 +287,9 @@ function hashAsset(data, contentType2) {
 }
 
 // ../../packages/build/src/local-build-executor.ts
-import { access as access8, mkdtemp, readFile as readFile12, rm as rm3 } from "fs/promises";
+import { access as access8, mkdtemp, readFile as readFile13, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
+import { dirname as dirname4, join as join18, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/route-patterns.ts
 var ROUTE_PATTERN = /^\/[A-Za-z0-9\-._~%!$&()*+,;=:@/[\]]*$/;
@@ -345,6 +345,8 @@ var DEPLOYMENT_ERROR_CODES = [
   "FORBIDDEN",
   "NOT_FOUND",
   "DEPLOYMENT_NOT_PROMOTABLE",
+  /** A promotion to another surface rebuilds the commit, and the source was not built from Git (spec 2026-10-18-named-environments §9.1). */
+  "PROMOTE_NEEDS_GIT_SOURCE",
   "DEPLOYMENT_NOT_CANCELABLE",
   "SUBDOMAIN_TAKEN",
   "FLAG_EXISTS",
@@ -511,6 +513,9 @@ function projectPath(teamSlug, projectSlug) {
   return `/${teamSlug}/projects/${projectSlug}`;
 }
 
+// ../../packages/core/src/platform-mail.ts
+var encoder = new TextEncoder();
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15613,7 +15618,7 @@ import { access as access5, readFile as readFile5, writeFile as writeFile4 } fro
 import { join as join6, resolve as resolve2 } from "path";
 
 // ../../packages/build/src/open-next.ts
-import { access as access3, readdir, readFile as readFile4 } from "fs/promises";
+import { access as access3, readdir, readFile as readFile4, realpath } from "fs/promises";
 import {
   basename,
   dirname,
@@ -15729,7 +15734,33 @@ function contentType(path) {
       return "application/octet-stream";
   }
 }
-async function listArtifactFiles(root, label2 = "OpenNext") {
+async function assertInsideOnDisk(appRoot, directory, label2) {
+  let realRoot;
+  let realDirectory;
+  try {
+    [realRoot, realDirectory] = await Promise.all([
+      realpath(appRoot),
+      realpath(directory)
+    ]);
+  } catch {
+    return;
+  }
+  const relation = relative(realRoot, realDirectory);
+  if (relation === ".." || relation.startsWith(`..${sep}`) || isAbsolute(relation)) {
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      `${label2} output leads out of the application root through a symbolic link.`
+    );
+  }
+  if (relation.split(sep).includes(".git")) {
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      `${label2} output leads into .git through a symbolic link.`
+    );
+  }
+}
+async function listArtifactFiles(root, label2 = "OpenNext", appRoot) {
+  if (appRoot !== void 0) await assertInsideOnDisk(appRoot, root, label2);
   const files = [];
   async function visit(directory) {
     const entries = await readdir(directory, { withFileTypes: true });
@@ -15786,7 +15817,6 @@ var OPEN_NEXT_LAYOUT = {
   outputRoot: ".open-next",
   bundleDir: ".open-next/worker-bundle"
 };
-var listFiles = (root) => listArtifactFiles(root);
 async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
   const configPath = await findWranglerConfig(appRoot, wranglerConfigPath);
   return readWorkerArtifact(appRoot, identity, {
@@ -15795,6 +15825,7 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
   });
 }
 async function readWorkerArtifact(appRoot, identity, layout) {
+  const listFiles = (root) => listArtifactFiles(root, "OpenNext", appRoot);
   try {
     const configPath = await findWranglerConfig(
       appRoot,
@@ -15839,12 +15870,13 @@ async function readWorkerArtifact(appRoot, identity, layout) {
       );
     }
     const bundleRoot = confinedPath(appRoot, layout.bundleDir, "Bundle dir");
-    let bundleFiles = null;
+    let bundleExists = true;
     try {
       await access3(bundleRoot);
-      bundleFiles = await listFiles(bundleRoot);
     } catch {
+      bundleExists = false;
     }
+    const bundleFiles = bundleExists ? await listFiles(bundleRoot) : null;
     const outputFiles = bundleFiles ?? await listFiles(outputRoot);
     const entrypointName = bundleFiles ? basename(entrypointPath) : relative(outputRoot, entrypointPath).split(sep).join("/");
     const assetsPrefix = `${relative(outputRoot, configuredAssets).split(sep).join("/")}/`;
@@ -16192,7 +16224,7 @@ async function readVinextArtifact(appRoot, identity) {
     const entrypointName = metadata.main.split(/[\\/]/).join("/");
     const matchers = moduleMatchers(metadata.rules);
     const isModule = (name) => matchers.length === 0 || matchers.some((matcher) => matcher.test(name));
-    const serverFiles = await listArtifactFiles(serverRoot, "vinext");
+    const serverFiles = await listArtifactFiles(serverRoot, "vinext", appRoot);
     const entrypoint = serverFiles.find((file2) => file2.name === entrypointName);
     if (!entrypoint) {
       throw new DeploymentError(
@@ -16206,7 +16238,7 @@ async function readVinextArtifact(appRoot, identity) {
       modules: serverFiles.filter(
         (file2) => file2.name !== entrypointName && file2.name !== WRANGLER_OUTPUT_NAME && !file2.name.endsWith(".map") && isModule(file2.name)
       ),
-      assets: await listArtifactFiles(clientRoot, "vinext"),
+      assets: await listArtifactFiles(clientRoot, "vinext", appRoot),
       compatibilityDate: metadata.compatibility_date,
       compatibilityFlags: Array.isArray(metadata.compatibility_flags) ? metadata.compatibility_flags.filter(
         (flag) => typeof flag === "string"
@@ -16879,7 +16911,8 @@ async function runCommand(spec, observer) {
 }
 
 // ../../packages/build/src/repository.ts
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "path";
+import { realpath as realpath2 } from "fs/promises";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
 function resolveAppRoot(checkout, configuredRoot) {
   const checkoutRoot = resolve3(checkout);
   if (!configuredRoot) return checkoutRoot;
@@ -16891,12 +16924,34 @@ function resolveAppRoot(checkout, configuredRoot) {
   if (relativeRoot === ".." || relativeRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute2(relativeRoot)) {
     throw new Error("Configured root directory escapes repository");
   }
+  if (relativeRoot.split(/[\\/]/).includes(".git")) {
+    throw new Error("Configured root directory cannot be inside .git");
+  }
   return appRoot;
 }
+async function assertAppRootInsideCheckout(checkout, appRoot) {
+  let realCheckout;
+  let realApp;
+  try {
+    [realCheckout, realApp] = await Promise.all([
+      realpath2(checkout),
+      realpath2(appRoot)
+    ]);
+  } catch {
+    return;
+  }
+  const relation = relative2(realCheckout, realApp);
+  if (relation === ".." || relation.startsWith(`..${sep2}`) || isAbsolute2(relation)) {
+    throw new Error("Configured root directory escapes repository");
+  }
+  if (relation.split(sep2).includes(".git")) {
+    throw new Error("Configured root directory cannot be inside .git");
+  }
+}
 
 // ../../packages/build/src/static-artifact.ts
 import { readdir as readdir3, readFile as readFile7 } from "fs/promises";
-import { isAbsolute as isAbsolute3, join as join9, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+import { isAbsolute as isAbsolute3, join as join9, relative as relative3, resolve as resolve4, sep as sep3 } from "path";
 var SHIM_WORKER_SOURCE = "export default { fetch: (request, env) => env.ASSETS.fetch(request) };\n";
 var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules"]);
 var ALLOWED_DOTFILE = ".well-known";
@@ -16912,11 +16967,16 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
     );
   const outputRoot = resolve4(appRoot, outputDirectory);
   const relation = relative3(appRoot, outputRoot);
-  if (relation === ".." || relation.startsWith(`..${sep2}`) || isAbsolute3(relation))
+  if (relation === ".." || relation.startsWith(`..${sep3}`) || isAbsolute3(relation))
     throw new DeploymentError(
       "ARTIFACT_INVALID",
       "Output directory escapes the application root."
     );
+  if (relation.split(sep3).includes(".git"))
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      "Output directory cannot be inside .git."
+    );
   const assets = [];
   async function visit(directory) {
     const entries = await readdir3(directory, { withFileTypes: true });
@@ -16933,7 +16993,7 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
       if (entry.isDirectory()) await visit(path);
       else if (entry.isFile()) {
         assets.push({
-          name: relative3(outputRoot, path).split(sep2).join("/"),
+          name: relative3(outputRoot, path).split(sep3).join("/"),
           data: await readFile7(path),
           contentType: contentType(path)
         });
@@ -16941,6 +17001,7 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
     }
   }
   try {
+    await assertInsideOnDisk(appRoot, outputRoot, "Static");
     await visit(outputRoot);
   } catch (error51) {
     if (error51 instanceof DeploymentError) throw error51;
@@ -16980,7 +17041,7 @@ async function readStaticArtifact(appRoot, outputDirectory, identity, options, o
 // ../../packages/build/src/strategy/fingerprint.ts
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile8 } from "fs/promises";
-import { join as join10, relative as relative4, sep as sep3 } from "path";
+import { join as join10, relative as relative4, sep as sep4 } from "path";
 var APP_ROOT_FILES = [
   "package.json",
   "next.config.js",
@@ -17035,7 +17096,7 @@ async function hashStrategyInputs(checkout, appRoot) {
   for (const path of candidates) {
     const digest = await hashFile(path);
     if (digest === null) continue;
-    entries.push([relative4(checkout, path).split(sep3).join("/"), digest]);
+    entries.push([relative4(checkout, path).split(sep4).join("/"), digest]);
   }
   return entries.toSorted(
     ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
@@ -17056,8 +17117,76 @@ async function computeStrategyFingerprint(input) {
 }
 
 // ../../packages/build/src/strategy/project-facts.ts
-import { access as access6, readFile as readFile9 } from "fs/promises";
+import { access as access6, readFile as readFile10 } from "fs/promises";
+import { join as join12 } from "path";
+
+// ../../packages/build/src/strategy/user-adapter.ts
+import { readFile as readFile9 } from "fs/promises";
 import { join as join11 } from "path";
+var ADAPTER_PATH = /\badapterPath\b/;
+var EXPERIMENTAL_ADAPTER_PATH = /\bexperimental\s*:\s*\{[^{}]*\badapterPath\b/;
+function adapterKeyFromConfigSource(source) {
+  const code = stripComments(source);
+  if (!ADAPTER_PATH.test(code)) return null;
+  return EXPERIMENTAL_ADAPTER_PATH.test(code) ? "experimental.adapterPath" : "adapterPath";
+}
+function keysNextReads(nextVersion) {
+  const version2 = parseNextVersion(nextVersion);
+  if (!version2) return ["adapterPath", "experimental.adapterPath"];
+  if (version2.major < 15 || version2.major === 15 && version2.minor < 4)
+    return [];
+  if (version2.major > 16 || version2.major === 16 && version2.minor >= 2)
+    return ["adapterPath", "experimental.adapterPath"];
+  return ["experimental.adapterPath"];
+}
+function userAdapterOf(input) {
+  const keys = keysNextReads(input.nextVersion);
+  if (keys.length === 0) return null;
+  const config2 = input.facts.adapterConfig;
+  if (config2 && keys.includes(config2.key))
+    return { source: "next-config", file: config2.file, key: config2.key };
+  if (input.env.NEXT_ADAPTER_PATH) return { source: "env" };
+  return null;
+}
+async function adapterInBuildOutput(appRoot, nextVersion) {
+  const keys = keysNextReads(nextVersion);
+  if (keys.length === 0) return null;
+  let manifest2;
+  try {
+    const parsed = JSON.parse(
+      await readFile9(
+        join11(appRoot, ".next", "required-server-files.json"),
+        "utf8"
+      )
+    );
+    if (typeof parsed !== "object" || parsed === null) return null;
+    manifest2 = parsed;
+  } catch {
+    return null;
+  }
+  const topLevel = manifest2.config?.adapterPath;
+  if (keys.includes("adapterPath") && typeof topLevel === "string" && topLevel)
+    return { source: "build-output", key: "adapterPath" };
+  const experimental = manifest2.config?.experimental?.adapterPath;
+  if (keys.includes("experimental.adapterPath") && typeof experimental === "string" && experimental)
+    return { source: "build-output", key: "experimental.adapterPath" };
+  return null;
+}
+function describeUserAdapter(adapter) {
+  switch (adapter.source) {
+    case "next-config":
+      return `${adapter.file} ${adapter.key}`;
+    case "env":
+      return "NEXT_ADAPTER_PATH";
+    case "build-output":
+      return `${adapter.key} in the Next.js build output`;
+  }
+}
+function openNextAdapterWarning(adapter) {
+  return `P2 opennext-cloudflare: The project sets its own Next.js adapter (${describeUserAdapter(adapter)}); its modifyConfig and onBuildComplete also run in the OpenNext build.`;
+}
+
+// ../../packages/build/src/strategy/project-facts.ts
 var SOURCE_EXTENSIONS2 = ["ts", "tsx", "js", "jsx", "mjs", "mts"];
 var SOURCE_DIRECTORIES = ["", "src"];
 var VITE_CONFIGS = [
@@ -17078,7 +17207,7 @@ async function findSourceFile(appRoot, basename5) {
   for (const dir of SOURCE_DIRECTORIES) {
     for (const ext of SOURCE_EXTENSIONS2) {
       const rel = dir ? `${dir}/${basename5}.${ext}` : `${basename5}.${ext}`;
-      if (await exists4(join11(appRoot, rel))) return rel;
+      if (await exists4(join12(appRoot, rel))) return rel;
     }
   }
   return null;
@@ -17098,19 +17227,28 @@ function matcherRoutesFromSource(source) {
 }
 async function readIfExists(path) {
   try {
-    return await readFile9(path, "utf8");
+    return await readFile10(path, "utf8");
   } catch {
     return null;
   }
 }
+async function findAdapterConfig(appRoot) {
+  for (const file2 of NEXT_CONFIG_FILES) {
+    const source = await readIfExists(join12(appRoot, file2));
+    if (source === null) continue;
+    const key = adapterKeyFromConfigSource(source);
+    return key ? { file: file2, key } : null;
+  }
+  return null;
+}
 async function collectProjectFacts(appRoot) {
   const proxyFile = await findSourceFile(appRoot, "proxy");
   const middlewareFile = await findSourceFile(appRoot, "middleware");
   const routeSourceFile = middlewareFile ?? proxyFile;
-  const routeSource = routeSourceFile ? await readIfExists(join11(appRoot, routeSourceFile)) : null;
+  const routeSource = routeSourceFile ? await readIfExists(join12(appRoot, routeSourceFile)) : null;
   let usesVinext = false;
   let nextSpec = null;
-  const packageJsonSource = await readIfExists(join11(appRoot, "package.json"));
+  const packageJsonSource = await readIfExists(join12(appRoot, "package.json"));
   if (packageJsonSource) {
     try {
       const packageJson = JSON.parse(packageJsonSource);
@@ -17121,7 +17259,7 @@ async function collectProjectFacts(appRoot) {
       nextSpec = dependency("next");
       if (dependency("vinext") !== null) {
         for (const name of VITE_CONFIGS) {
-          const config2 = await readIfExists(join11(appRoot, name));
+          const config2 = await readIfExists(join12(appRoot, name));
           if (config2 && /\bvinext\s*\(/.test(config2) && /@cloudflare\/vite-plugin/.test(config2)) {
             usesVinext = true;
             break;
@@ -17136,7 +17274,8 @@ async function collectProjectFacts(appRoot) {
     middlewareFile,
     matcherRoutes: routeSource ? matcherRoutesFromSource(routeSource) : [],
     usesVinext,
-    nextSpec
+    nextSpec,
+    adapterConfig: await findAdapterConfig(appRoot)
   };
 }
 
@@ -17523,11 +17662,11 @@ function defaultSmokeProbes(matcherRoutes) {
 
 // ../../packages/build/src/strategy/strategies/opennext-aws.ts
 import { writeFile as writeFile6 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // ../../packages/build/src/strategy/strategies/shared.ts
-import { access as access7, readFile as readFile10, rm, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname2, join as join12, resolve as resolve5 } from "path";
+import { access as access7, readFile as readFile11, rm, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname2, join as join13, resolve as resolve5 } from "path";
 function capturingObserver(observer) {
   const lines = [];
   return {
@@ -17584,7 +17723,7 @@ async function findProjectBin(appRoot, checkout, name) {
   let dir = resolve5(appRoot);
   const stop = resolve5(checkout);
   for (; ; ) {
-    const candidate = join12(dir, "node_modules", ".bin", name);
+    const candidate = join13(dir, "node_modules", ".bin", name);
     if (await pathExists2(candidate)) return candidate;
     if (dir === stop) return null;
     const parent = dirname2(dir);
@@ -17598,7 +17737,7 @@ function dotenvQuote(value) {
   return `"${value.replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r")}"`;
 }
 async function withDevVars(wranglerConfigPath, env, run) {
-  const path = join12(dirname2(wranglerConfigPath), ".dev.vars");
+  const path = join13(dirname2(wranglerConfigPath), ".dev.vars");
   const keys = Object.keys(env).filter(
     (key) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)
   );
@@ -17631,7 +17770,7 @@ async function bundleWorker(context, layout, observer, errorCode2) {
       cwd: layout.appRoot,
       env: {
         CI: "1",
-        WRANGLER_LOG_PATH: join12(
+        WRANGLER_LOG_PATH: join13(
           layout.appRoot,
           layout.outputRoot,
           "wrangler.log"
@@ -17664,12 +17803,12 @@ async function smokeWorker(context, layout, observer) {
             "--show-interactive-dev-session=false",
             "--log-level=warn",
             "--persist-to",
-            join12(layout.appRoot, layout.outputRoot, ".naro-smoke-state")
+            join13(layout.appRoot, layout.outputRoot, ".naro-smoke-state")
           ],
           cwd: layout.appRoot,
           env: {
             CI: "1",
-            WRANGLER_LOG_PATH: join12(
+            WRANGLER_LOG_PATH: join13(
               layout.appRoot,
               layout.outputRoot,
               "wrangler-dev.log"
@@ -17685,10 +17824,10 @@ async function smokeWorker(context, layout, observer) {
   );
 }
 async function approvePnpmBuilds(checkout, packages) {
-  const path = join12(checkout, "pnpm-workspace.yaml");
+  const path = join13(checkout, "pnpm-workspace.yaml");
   let source = "";
   try {
-    source = await readFile10(path, "utf8");
+    source = await readFile11(path, "utf8");
   } catch {
   }
   let next = source;
@@ -17781,7 +17920,7 @@ function createOpenNextAwsStrategy() {
       } catch (error51) {
         return failed("prepare", describeError(error51));
       }
-      const configPath = join13(fork.appRoot, CONFIG_NAME);
+      const configPath = join14(fork.appRoot, CONFIG_NAME);
       try {
         await writeFile6(
           configPath,
@@ -17810,7 +17949,7 @@ function createOpenNextAwsStrategy() {
         observer
       );
       if (!build.ok) return failed("build", describeFailure(build));
-      const serverFunction = join13(fork.appRoot, SERVER_FUNCTION);
+      const serverFunction = join14(fork.appRoot, SERVER_FUNCTION);
       if (!await pathExists2(serverFunction))
         return failed("bundle", `OpenNext AWS produced no ${SERVER_FUNCTION}.`);
       const smoke = await context.ports.smoke.run(
@@ -17832,7 +17971,7 @@ function createOpenNextAwsStrategy() {
         status: "success",
         artifact: {
           kind: "opennext-aws",
-          outputRoot: join13(fork.appRoot, ".open-next"),
+          outputRoot: join14(fork.appRoot, ".open-next"),
           serverFunction
         },
         notes: [
@@ -17844,8 +17983,8 @@ function createOpenNextAwsStrategy() {
 }
 
 // ../../packages/build/src/strategy/strategies/opennext-cloudflare.ts
-import { readFile as readFile11 } from "fs/promises";
-import { join as join14 } from "path";
+import { readFile as readFile12 } from "fs/promises";
+import { join as join15 } from "path";
 var PROXY_TO_MIDDLEWARE_VARIANT = "proxy-to-middleware";
 var NODE_MIDDLEWARE_REFUSAL = /Node\.js middleware is not (?:currently )?supported/i;
 var NODE_MIDDLEWARE_EXPERIMENTAL = /Node\.js middleware support is experimental/i;
@@ -17853,8 +17992,8 @@ var NODE_MIDDLEWARE_NOT_DEPLOYED = 'Node.js-runtime middleware (runtime: "nodejs
 async function buildDeclaresNodeMiddleware(appRoot) {
   try {
     const manifest2 = JSON.parse(
-      await readFile11(
-        join14(appRoot, ".next", "server", "functions-config-manifest.json"),
+      await readFile12(
+        join15(appRoot, ".next", "server", "functions-config-manifest.json"),
         "utf8"
       )
     );
@@ -17864,7 +18003,7 @@ async function buildDeclaresNodeMiddleware(appRoot) {
   }
 }
 function createOpenNextCloudflareStrategy(options) {
-  async function attempt(context, roots, observer, ownBuild) {
+  async function attempt(context, roots, observer, ownBuild, adapterNotice) {
     let platform;
     try {
       platform = await options.createPlatformBuildConfig(
@@ -17902,6 +18041,13 @@ function createOpenNextCloudflareStrategy(options) {
         outcome: ownBuild ? appBuildFailed(describeFailure(nextBuild)) : failed("build", describeFailure(nextBuild))
       };
     }
+    if (!adapterNotice.warned) {
+      const adapter = userAdapterOf(context) ?? await adapterInBuildOutput(roots.appRoot, context.nextVersion);
+      if (adapter) {
+        adapterNotice.warned = true;
+        await warn(observer, openNextAdapterWarning(adapter));
+      }
+    }
     if (await buildDeclaresNodeMiddleware(roots.appRoot)) {
       return {
         ok: false,
@@ -17997,6 +18143,7 @@ function createOpenNextCloudflareStrategy(options) {
     target: "cloudflare",
     supports: () => ({ supported: true }),
     async evaluate(context, observer) {
+      const adapterNotice = { warned: false };
       const rememberedRewrite = context.pinnedVariant === PROXY_TO_MIDDLEWARE_VARIANT && context.facts.proxyFile !== null;
       if (rememberedRewrite) {
         await info(
@@ -18008,7 +18155,13 @@ function createOpenNextCloudflareStrategy(options) {
           observer,
           "P2 opennext-cloudflare: building the project as written."
         );
-        const first = await attempt(context, context.workspace, observer, true);
+        const first = await attempt(
+          context,
+          context.workspace,
+          observer,
+          true,
+          adapterNotice
+        );
         if (first.ok) {
           return {
             status: "success",
@@ -18040,7 +18193,13 @@ function createOpenNextCloudflareStrategy(options) {
         observer,
         `Converted ${conversion.file ?? context.facts.proxyFile} to edge middleware for this build only. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable. Your repository is unchanged.`
       );
-      const second = await attempt(context, fork, observer, rememberedRewrite);
+      const second = await attempt(
+        context,
+        fork,
+        observer,
+        rememberedRewrite,
+        adapterNotice
+      );
       if (!second.ok) {
         if (!rememberedRewrite || second.outcome.status !== "failed" || !second.outcome.appBuild)
           return second.outcome;
@@ -18052,7 +18211,8 @@ function createOpenNextCloudflareStrategy(options) {
           context,
           context.workspace,
           observer,
-          true
+          true,
+          adapterNotice
         );
         if (asWritten.ok) {
           await info(
@@ -18121,7 +18281,7 @@ function createAwsMiddlewareCloudflareAppStrategy() {
 }
 
 // ../../packages/build/src/strategy/strategies/vinext-cloudflare.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var VINEXT_MIN_NEXT_MAJOR = 16;
 var VINEXT_BUILD_SCRIPTS = ["esbuild", "workerd"];
 var VINEXT_OUTPUT = {
@@ -18277,7 +18437,7 @@ function createVinextCloudflareStrategy(options) {
         context,
         {
           appRoot: fork.appRoot,
-          wranglerConfigPath: join15(
+          wranglerConfigPath: join16(
             fork.appRoot,
             "dist",
             "server",
@@ -18302,7 +18462,7 @@ function createVinextCloudflareStrategy(options) {
 // ../../packages/build/src/strategy/workspace.ts
 import { execFile } from "child_process";
 import { cp, mkdir as mkdir2, readdir as readdir4, rm as rm2 } from "fs/promises";
-import { basename as basename2, dirname as dirname3, join as join16, relative as relative5, resolve as resolve6 } from "path";
+import { basename as basename2, dirname as dirname3, join as join17, relative as relative5, resolve as resolve6 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
@@ -18325,14 +18485,14 @@ async function copyInstalledPackages(source, target2) {
   const walk2 = async (dir) => {
     for (const entry of await readdir4(dir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name === ".git") continue;
-      const path = join16(dir, entry.name);
+      const path = join17(dir, entry.name);
       if (entry.name === "node_modules") installs.push(path);
       else await walk2(path);
     }
   };
   await walk2(origin);
   for (const install of installs)
-    await copyTree(install, join16(target2, relative5(origin, install)));
+    await copyTree(install, join17(target2, relative5(origin, install)));
 }
 async function copyTree(from, to) {
   await mkdir2(dirname3(to), { recursive: true });
@@ -18347,10 +18507,11 @@ async function copyTree(from, to) {
   await cp(from, to, { recursive: true, verbatimSymlinks: true });
 }
 function forkedAppRoot(checkout, appRoot, forkCheckout) {
-  return join16(forkCheckout, relative5(checkout, appRoot));
+  return join17(forkCheckout, relative5(checkout, appRoot));
 }
 
 // ../../packages/build/src/local-build-executor.ts
+var PINNED_COMMIT_SHA = /^[0-9a-f]{40}$/;
 function concurrencyFromEnvironment() {
   const raw = Number(process.env.NARO_RESOLVER_CONCURRENCY ?? "1");
   return Number.isInteger(raw) && raw > 0 ? raw : 1;
@@ -18369,7 +18530,7 @@ async function withRouteList(artifact, list, appRoot, observer) {
   }
 }
 var defaultLocalBuildDependencies = {
-  createWorkspace: () => mkdtemp(join17(tmpdir(), "next-deploy-build-")),
+  createWorkspace: () => mkdtemp(join18(tmpdir(), "next-deploy-build-")),
   removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
@@ -18403,8 +18564,8 @@ async function readInstalledNextVersion(appRoot, checkout) {
   const stop = resolve7(checkout);
   for (; ; ) {
     try {
-      const source = await readFile12(
-        join17(dir, "node_modules", "next", "package.json"),
+      const source = await readFile13(
+        join18(dir, "node_modules", "next", "package.json"),
         "utf8"
       );
       const version2 = JSON.parse(source).version;
@@ -18495,10 +18656,72 @@ var LocalBuildExecutor = class {
   constructor(dependencies = defaultLocalBuildDependencies) {
     this.dependencies = dependencies;
   }
+  /**
+   * Checks out one commit, whichever ref reaches it: GitHub serves any
+   * reachable commit by SHA, which `clone --branch` cannot ask for. The URL
+   * carries the installation token and is only ever an argument — runCommand
+   * logs a command's output (redacted), never the command line, and a failed
+   * command's message names the command, not its arguments.
+   *
+   * The commit is an argument of `git fetch`, so it is checked before any git
+   * command runs: a value git could read as an option (`--upload-pack=…`) or a
+   * ref name must not get that far. The build container checks it on the way
+   * in; the local runner passes claim's input straight through, so this is the
+   * check that covers it.
+   */
+  async checkoutPinnedCommit(commitSha, repositoryUrl, workspace, checkout, observer) {
+    if (!PINNED_COMMIT_SHA.test(commitSha)) {
+      throw new DeploymentError(
+        "CLONE_FAILED",
+        "The pinned commit is not a 40-character lowercase hex SHA."
+      );
+    }
+    const git2 = (args) => this.dependencies.runCommand(
+      {
+        command: "git",
+        args,
+        cwd: workspace,
+        timeoutMs: 12e4,
+        stage: "CLONING",
+        errorCode: "CLONE_FAILED"
+      },
+      observer
+    );
+    await git2(["init", "--quiet", checkout]);
+    await git2(["-C", checkout, "remote", "add", "origin", "--", repositoryUrl]);
+    try {
+      await git2([
+        "-C",
+        checkout,
+        "fetch",
+        "--quiet",
+        "--depth",
+        "1",
+        "origin",
+        commitSha
+      ]);
+    } catch (error51) {
+      if (!(error51 instanceof CommandExecutionError)) throw error51;
+      if (error51.timedOut) throw error51;
+      throw new DeploymentError(
+        "CLONE_FAILED",
+        `Could not fetch commit ${commitSha.slice(0, 7)}. It may have been removed from the repository.`,
+        { cause: error51 }
+      );
+    }
+    await git2([
+      "-C",
+      checkout,
+      "checkout",
+      "--quiet",
+      "--detach",
+      "FETCH_HEAD"
+    ]);
+  }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
-    const checkout = join17(workspace, "checkout");
-    const pmCacheDir = join17(workspace, ".pm-store");
+    const checkout = join18(workspace, "checkout");
+    const pmCacheDir = join18(workspace, ".pm-store");
     let cacheSeq = 0;
     const commandAvailable = this.dependencies.commandAvailable ?? hasCommand;
     const compressor = "zstd";
@@ -18507,7 +18730,7 @@ var LocalBuildExecutor = class {
       transport: cache,
       fetch: this.dependencies.cacheFetch ?? ((url2, init) => fetch(url2, init)),
       runCommand: this.dependencies.runCommand,
-      tmpFile: (suffix) => join17(workspace, `cache-${String(cacheSeq++)}${suffix}`),
+      tmpFile: (suffix) => join18(workspace, `cache-${String(cacheSeq++)}${suffix}`),
       // One latch for the whole build so a disabled cache warns once.
       report: { unavailable: false }
     } : null;
@@ -18520,27 +18743,37 @@ var LocalBuildExecutor = class {
           message: `Build cache disabled: ${compressor} is not installed. Install it to reuse dependencies between deploys.`
         });
       }
-      await this.dependencies.runCommand(
-        {
-          command: "git",
-          args: [
-            "clone",
-            "--depth",
-            "1",
-            "--branch",
-            input.branch,
-            "--single-branch",
-            "--",
-            input.repositoryUrl,
-            checkout
-          ],
-          cwd: workspace,
-          timeoutMs: 12e4,
-          stage: "CLONING",
-          errorCode: "CLONE_FAILED"
-        },
-        observer
-      );
+      if (input.commitSha !== void 0) {
+        await this.checkoutPinnedCommit(
+          input.commitSha,
+          input.repositoryUrl,
+          workspace,
+          checkout,
+          observer
+        );
+      } else {
+        await this.dependencies.runCommand(
+          {
+            command: "git",
+            args: [
+              "clone",
+              "--depth",
+              "1",
+              "--branch",
+              input.branch,
+              "--single-branch",
+              "--",
+              input.repositoryUrl,
+              checkout
+            ],
+            cwd: workspace,
+            timeoutMs: 12e4,
+            stage: "CLONING",
+            errorCode: "CLONE_FAILED"
+          },
+          observer
+        );
+      }
       const revision = await this.dependencies.runCommand(
         {
           command: "git",
@@ -18559,6 +18792,12 @@ var LocalBuildExecutor = class {
           "Git returned an invalid commit SHA."
         );
       }
+      if (input.commitSha !== void 0 && gitCommitSha !== input.commitSha) {
+        throw new DeploymentError(
+          "CLONE_FAILED",
+          `Checked out ${gitCommitSha.slice(0, 7)} instead of the pinned commit ${input.commitSha.slice(0, 7)}.`
+        );
+      }
       const reportedSha = gitCommitSha.length === 40 ? gitCommitSha : null;
       if (!reportedSha)
         await info2(
@@ -18586,6 +18825,7 @@ var LocalBuildExecutor = class {
         checkout,
         input.rootDirectory
       );
+      await assertAppRootInsideCheckout(checkout, appRoot);
       const stacks = await import("./stack-PDV3NPWC.js");
       const stack = await (this.dependencies.detectStack ?? stacks.detectStack)(
         appRoot
@@ -18698,7 +18938,7 @@ var LocalBuildExecutor = class {
           }
         }
         await notifyStatus(observer, "BUILDING");
-        const buildCacheDir = resolved.preset.cachePath ? join17(appRoot, resolved.preset.cachePath) : null;
+        const buildCacheDir = resolved.preset.cachePath ? join18(appRoot, resolved.preset.cachePath) : null;
         const buildCacheKey = sanitizeCacheKey(input.branch);
         if (cachePorts && buildCacheDir) {
           await tryRestore(
@@ -18722,13 +18962,13 @@ var LocalBuildExecutor = class {
             entries: fingerprintEntries,
             nextVersion: nextVersion ? `${String(nextVersion.major)}.${String(nextVersion.minor)}.${String(nextVersion.patch)}` : "unknown"
           });
-          const pristine = join17(workspace, "pristine");
+          const pristine = join18(workspace, "pristine");
           const fork = this.dependencies.forkWorkspace ?? defaultFork;
           await fork(checkout, pristine);
           let forks = 0;
           const resolverConcurrency = this.dependencies.resolverConcurrency ?? 1;
           const forkWorkspace = async (label2) => {
-            const target2 = join17(
+            const target2 = join18(
               workspace,
               "forks",
               `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
@@ -18973,6 +19213,14 @@ var NaroError = class extends Error {
     if (options?.details !== void 0) this.details = options.details;
   }
 };
+var PROMOTE_TARGET_UNSUPPORTED_MESSAGE = "This control plane cannot promote to an environment yet. Deploy the latest web first, then try again.";
+function promoteTargetUnsupported(cause) {
+  return new NaroError(
+    "PROMOTE_TARGET_UNSUPPORTED",
+    PROMOTE_TARGET_UNSUPPORTED_MESSAGE,
+    cause !== void 0 ? { cause } : void 0
+  );
+}
 function isNaroError(error51) {
   return error51 instanceof NaroError || error51 instanceof Error && error51.name === "NaroError" && typeof error51.code === "string";
 }
@@ -19016,12 +19264,12 @@ async function errorFromResponse(response, context) {
 // ../../packages/sdk/src/session.ts
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function credentialsDir(home = homedir()) {
-  return join18(home, ".naro");
+  return join19(home, ".naro");
 }
 function credentialsFile(home = homedir()) {
-  return join18(credentialsDir(home), "credentials.json");
+  return join19(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
   mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
@@ -19078,7 +19326,7 @@ var STYLES = `
   *{box-sizing:border-box}
   :root{
     --bg:#000;--surface:#0a0a0a;--surface-2:#111;--border:#232323;
-    --text:#ededed;--muted:#a1a1a1;--faint:#6f6f6f;
+    --text:#ededed;--muted:#a1a1a1;--faint:#808080;
     --sans:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;
     --mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
   }
@@ -19542,6 +19790,8 @@ function deploymentInfo(row) {
     errorMessage: row.error_message,
     gitCommitSha: row.git_commit_sha,
     gitCommitMessage: row.git_commit_message,
+    pinnedCommitSha: row.pinned_commit_sha ?? null,
+    rebuiltFromDeploymentId: row.rebuilt_from_deployment_id ?? null,
     createdAt: row.created_at,
     startedAt: row.started_at,
     finishedAt: row.finished_at
@@ -19793,16 +20043,65 @@ var DeploymentsApi = class {
     return { current, target: production.slice(1).find(differs) ?? null };
   }
   /**
-   * Redeploys an existing READY deployment's artifact to production.
-   * Used by both `naro promote` (preview → production) and `naro rollback`
-   * (older production build → production).
+   * Promotes an existing READY deployment: with no `target` (or
+   * `production`) it goes to production — `naro promote` (preview →
+   * production) and `naro rollback` (older production build → production).
+   * A deployment from an environment is rebuilt from its commit with
+   * production's variables (`mode: "rebuild"`); any other is published as
+   * stored (`mode: "reupload"`). With an environment `target` the control
+   * plane likewise rebuilds the deployment's commit with that environment's
+   * variables or publishes the stored build.
+   *
+   * No `target` sends no body, exactly as clients before targets did. A
+   * control plane from before targets ignores `target` and promotes to
+   * production, so an environment target is first checked with
+   * `promoteCheck`: a 405 there (no such route) stops with
+   * `PROMOTE_TARGET_UNSUPPORTED` before anything is promoted. The target is
+   * trimmed once, as the control plane trims it, so `" production"` is
+   * production and asks no preview.
+   */
+  async promote(projectId, deploymentId, options = {}) {
+    const target2 = options.target?.trim();
+    if (target2 !== void 0 && target2 !== "production") {
+      try {
+        await this.promoteCheck(projectId, deploymentId, target2);
+      } catch (error51) {
+        if (isNaroError(error51) && error51.status === 405) {
+          throw promoteTargetUnsupported(error51);
+        }
+        throw error51;
+      }
+    }
+    const body = await this.client.request(this.promotePath(projectId, deploymentId), {
+      method: "POST",
+      ...target2 !== void 0 ? { body: { target: target2 } } : {},
+      context: "Promote deployment"
+    });
+    return {
+      ...deploymentInfo(body.deployment),
+      mode: body.mode ?? "reupload"
+    };
+  }
+  /**
+   * What promoting to `target` would do, changing nothing: how it gets its
+   * build, the migrations the target's database has not applied (null when
+   * they cannot be compared) and the warnings to show first. Answers 405 from
+   * a control plane that predates promote targets.
    */
-  async promote(projectId, deploymentId) {
+  async promoteCheck(projectId, deploymentId, target2) {
+    const query = target2 !== void 0 ? `?target=${encodeURIComponent(target2)}` : "";
     const body = await this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`,
-      { method: "POST", context: "Promote deployment" }
+      `${this.promotePath(projectId, deploymentId)}${query}`,
+      { context: "Check promotion" }
     );
-    return deploymentInfo(body.deployment);
+    return {
+      mode: body.mode ?? "reupload",
+      pendingMigrations: body.pendingMigrations ?? null,
+      warnings: body.warnings ?? []
+    };
+  }
+  promotePath(projectId, deploymentId) {
+    return `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/promote`;
   }
   /**
    * Stops an in-flight build (QUEUED through BUILDING) and marks the row
@@ -19848,6 +20147,8 @@ var DeploymentsApi = class {
     }
   }
 };
+var STATIC_ASSETS_BINDING = "ASSETS";
+var MANAGED_DATABASE_BINDING = "DB";
 var EnvApi = class {
   constructor(client) {
     this.client = client;
@@ -19877,6 +20178,37 @@ var EnvApi = class {
       }
     );
   }
+  /**
+   * The names the env route refuses as a key — `409 VALIDATION_FAILED`
+   * `<KEY> is already used by a storage binding.` — read the way it reads
+   * them: `ASSETS` (the static files), every binding of the project's storage
+   * and, on a project using the managed database (`database_provider` is
+   * `d1`), `DB`, which may not be a storage row yet. For a caller that sends
+   * many entries in several requests (`naro env import`) and has to refuse
+   * before the first one is saved. A control plane whose project row has no
+   * `database_provider` reads as having no managed database, so `DB` is only
+   * left out there.
+   */
+  async takenBindingNames(projectId) {
+    const base2 = `/api/projects/${encodeURIComponent(projectId)}`;
+    const [storage, project] = await Promise.all([
+      this.client.request(
+        `${base2}/storage`,
+        { context: "List storage" }
+      ),
+      this.client.request(
+        base2,
+        { context: "Read project" }
+      )
+    ]);
+    const names = /* @__PURE__ */ new Set([
+      STATIC_ASSETS_BINDING,
+      ...storage.storage.map((row) => row.bindingName)
+    ]);
+    if (project.project.database_provider === "d1")
+      names.add(MANAGED_DATABASE_BINDING);
+    return [...names];
+  }
   async removeById(projectId, envVarId) {
     await this.client.request(
       `/api/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(envVarId)}`,
@@ -19887,13 +20219,28 @@ var EnvApi = class {
    * Removes a key's rows: the one `target` names, or, with no target, the
    * `production`, `preview` and `all` rows. An environment's value goes only
    * when its slug is the target, so removing a key everywhere else does not
-   * take a QA or staging value with it.
+   * take a QA or staging value with it. A key only environments hold fails
+   * ENV_NOT_FOUND naming them (`details.environments`), not as if there were
+   * none.
    */
   async remove(projectId, key, target2) {
     const rows = await this.list(projectId);
     const matches = rows.filter(
       (row) => row.key === key && (target2 === void 0 ? isReservedEnvTarget(row.target) : row.target === target2)
     );
+    if (matches.length === 0 && target2 === void 0) {
+      const environments = [
+        ...new Set(
+          rows.filter((row) => row.key === key).map((row) => row.target).filter((slug) => !isReservedEnvTarget(slug))
+        )
+      ].toSorted();
+      if (environments.length > 0)
+        throw new NaroError(
+          "ENV_NOT_FOUND",
+          `No ${key} variable found outside named environments. Pass the environment to remove it: ${environments.join(", ")}.`,
+          { details: { key, environments } }
+        );
+    }
     if (matches.length === 0) {
       throw new NaroError(
         "ENV_NOT_FOUND",
@@ -20509,6 +20856,7 @@ function storageInfo(body) {
   return {
     enabled: body.enabled,
     bucket: body.bucket ?? null,
+    disabledAt: body.disabledAt ?? null,
     limits: {
       bytes: body.limits.bytes,
       objectBytes: body.limits.objectBytes,
@@ -20520,6 +20868,18 @@ function storageInfo(body) {
     buckets: (body.buckets ?? []).map(storageBucket)
   };
 }
+function storageRunFailure(error51) {
+  const details = isNaroError(error51) ? error51.details : void 0;
+  if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
+    return new NaroError(error51.code, error51.message, {
+      ...error51.status !== void 0 ? { status: error51.status } : {},
+      details: {
+        ...details,
+        backend: backendInfo(details.backend)
+      }
+    });
+  return error51;
+}
 function bucketFields(fields, into = {}) {
   for (const key of ["public", "fileSizeLimit", "allowedMimeTypes"])
     if (fields[key] !== void 0) into[key] = fields[key];
@@ -20948,16 +21308,45 @@ var StorageApi = class {
         }
       );
     } catch (error51) {
-      const details = isNaroError(error51) ? error51.details : void 0;
-      if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
-        throw new NaroError(error51.code, error51.message, {
-          ...error51.status !== void 0 ? { status: error51.status } : {},
-          details: {
-            ...details,
-            backend: backendInfo(details.backend)
-          }
-        });
-      throw error51;
+      throw storageRunFailure(error51);
+    }
+    return storageInfo(body.storage);
+  }
+  /**
+   * Turns Storage off and keeps its files (Storage 3-1k): the Naro worker is
+   * uploaded again without the bucket, so the app's Storage calls and file
+   * URLs answer `404 STORAGE_NOT_ENABLED` until `enable` binds the same
+   * bucket again. The bucket, its files and their storage cost stay; while
+   * it is off, bucket writes and the object routes answer `409
+   * STORAGE_OFF`, and reads go on. Safe to repeat: Storage never on, or
+   * already off, comes back as it is, and a turn-off that stopped is
+   * finished. Two minutes, like `enable`.
+   *
+   * Refusals, in the order they are checked: `BACKEND_DISABLED`,
+   * `FORBIDDEN` (`storage.manage`), `DATABASE_NOT_ENABLED`,
+   * `BACKEND_NOT_READY` (no backend), `BACKEND_OFF`, `BACKEND_BUSY` (another
+   * change holds the backend — or turning Storage on again took this
+   * turn-off over, and Storage is on), `STORAGE_DISABLE_FAILED` (502: the
+   * turn-off could not be recorded; nothing changed), and
+   * `BACKEND_PROVISION_FAILED` (502) when it is
+   * recorded but the worker's upload — or a step after it — stopped:
+   * `details` holds `{ storage: { applied: false, enabled: false }, backend
+   * }`, and `disable` again finishes. Never `STORAGE_DISABLED`: the control
+   * plane's Storage switch does not hold a removal back.
+   */
+  async disable(projectId) {
+    let body;
+    try {
+      body = await this.client.request(
+        this.path(projectId),
+        {
+          method: "DELETE",
+          context: "Turn off Storage",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      );
+    } catch (error51) {
+      throw storageRunFailure(error51);
     }
     return storageInfo(body.storage);
   }
@@ -21167,40 +21556,92 @@ function summarizeStatement(statement2) {
 
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
+var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/dgm;
+var QUOTES = /* @__PURE__ */ new Set(["'", '"', "`"]);
+function parseDotenvDetailed(text2) {
+  const vars = {};
+  const unclosedQuotes = [];
+  const lines = text2.replace(/\r\n?/g, "\n");
+  let line = 1;
+  let counted = 0;
+  for (const match of lines.matchAll(LINE)) {
+    const key = match[1];
+    const raw = match[2] ?? "";
+    let value = raw.trim();
+    const maybeQuote = value[0];
+    if (maybeQuote !== void 0 && QUOTES.has(maybeQuote) && !value.includes(maybeQuote, 1)) {
+      const at = (match.indices?.[2]?.[0] ?? match.index) + (raw.length - raw.trimStart().length);
+      for (; counted < at; counted += 1) if (lines[counted] === "\n") line += 1;
+      unclosedQuotes.push(line);
+    }
+    value = value.replace(/^(['"`])([\s\S]*)\1$/gm, "$2");
+    if (maybeQuote === '"')
+      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+    vars[key] = value;
+  }
+  return { vars, unclosedQuotes };
+}
 function parseDotenv(text2) {
-  const out = {};
-  for (const line of text2.split(/\r?\n/)) {
-    const trimmed = line.trim().replace(/^export\s+(?=[^=\s])/, "");
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
-      value = value.slice(1, -1);
-    out[key] = value;
-  }
-  return out;
+  return parseDotenvDetailed(text2).vars;
 }
 function readProjectEnv(dir) {
   for (const name of [".env.local", ".env.production", ".env"]) {
-    const path = join19(dir, name);
+    const path = join20(dir, name);
     if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
   }
   return {};
 }
+var PLAIN = /^[^\s"'#$`\\]*$/;
+function bareReadsBack(value) {
+  return !/[#\r\n\u2028\u2029]/.test(value) && value.trim() === value && !QUOTES.has(value[0] ?? "");
+}
+function dotenvValue(value) {
+  if (PLAIN.test(value)) return value;
+  const endsInBackslash = value.endsWith("\\");
+  if (!value.includes("\r") && !endsInBackslash) {
+    if (!value.includes("'")) return `'${value}'`;
+    if (!value.includes("`")) return `\`${value}\``;
+  }
+  if (!value.includes('"') && !/\\[nr]/.test(value) && !endsInBackslash)
+    return `"${value.replaceAll("\r", "\\r")}"`;
+  if (bareReadsBack(value)) return value;
+  return void 0;
+}
+var UNWRITABLE_HINT = "Store them without carriage returns or one of the quote characters (for a file: tr -d '\\r' < sa.json | naro env add KEY), or read them with naro env list --reveal.";
 function serializeDotenv(vars) {
-  const needsQuotes = /[\s"'#$`\\]/;
-  return `${Object.entries(vars).map(
-    ([key, value]) => needsQuotes.test(value) ? `${key}="${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"` : `${key}=${value}`
-  ).join("\n")}
+  const lines = [];
+  const allQuotes = [];
+  const other = [];
+  for (const [key, value] of Object.entries(vars)) {
+    const written = dotenvValue(value);
+    if (written !== void 0) lines.push(`${key}=${written}`);
+    else if (value.includes("'") && value.includes('"') && value.includes("`"))
+      allQuotes.push(key);
+    else other.push(key);
+  }
+  const problems2 = [];
+  if (allQuotes.length > 0)
+    problems2.push(
+      `Cannot write ${allQuotes.join(", ")} to a dotenv file: their values hold ', " and \` together.`
+    );
+  if (other.length > 0)
+    problems2.push(
+      `Cannot write ${other.join(", ")} to a dotenv file: dotenv would not read their values back unchanged.`
+    );
+  if (problems2.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${problems2.join(" ")} ${UNWRITABLE_HINT}`,
+      { details: { keys: [...allQuotes, ...other] } }
+    );
+  return `${lines.join("\n")}
 `;
 }
 
 // ../../packages/sdk/src/env-scan.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var SOURCE_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -21255,7 +21696,7 @@ function collect(dir, out) {
   for (const entry of entries) {
     if (out.length >= MAX_FILES) return;
     if (entry.isSymbolicLink()) continue;
-    const path = join20(dir, entry.name);
+    const path = join21(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRECTORIES.has(entry.name))
         continue;
@@ -21287,7 +21728,7 @@ function scanEnvReferences(dir) {
     }
   }
   for (const name of EXAMPLE_FILES) {
-    const path = join20(dir, name);
+    const path = join21(dir, name);
     if (!existsSync2(path)) continue;
     let parsed;
     try {
@@ -21305,11 +21746,11 @@ function scanEnvReferences(dir) {
 
 // ../../packages/sdk/src/framework.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function readPackageJson2(dir) {
   try {
     return JSON.parse(
-      readFileSync4(join21(dir, "package.json"), "utf8")
+      readFileSync4(join22(dir, "package.json"), "utf8")
     );
   } catch {
     return null;
@@ -21320,7 +21761,7 @@ function hasDependency(pkg, name) {
 }
 function hasConfig(dir, base2, evidence) {
   for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
-    if (existsSync3(join21(dir, `${base2}.${ext}`))) {
+    if (existsSync3(join22(dir, `${base2}.${ext}`))) {
       evidence.push(`${base2}.${ext}`);
       return true;
     }
@@ -21428,8 +21869,8 @@ function detectFramework2(dir) {
     if (!byDependency && !byConfig) continue;
     if (byDependency) evidence.push(`package.json: ${detector.dependency}`);
     if (detector.framework === "nextjs") {
-      if (existsSync3(join21(dir, "app"))) evidence.push("app/");
-      if (existsSync3(join21(dir, "pages"))) evidence.push("pages/");
+      if (existsSync3(join22(dir, "app"))) evidence.push("app/");
+      if (existsSync3(join22(dir, "pages"))) evidence.push("pages/");
     }
     return {
       framework: detector.framework,
@@ -21440,7 +21881,7 @@ function detectFramework2(dir) {
       deployable: true
     };
   }
-  if (!pkg && existsSync3(join21(dir, "index.html"))) {
+  if (!pkg && existsSync3(join22(dir, "index.html"))) {
     evidence.push("index.html (no package.json)");
     return {
       framework: "static",
@@ -21461,8 +21902,26 @@ function detectFramework2(dir) {
   };
 }
 
+// ../../packages/data-core/src/unicode-controls.ts
+function hasControlCharacter(text2) {
+  for (let i = 0; i < text2.length; i += 1) {
+    const code = text2.charCodeAt(i);
+    if (code <= 31 || code >= 127 && code <= 159) return true;
+  }
+  return false;
+}
+function hasBidiControl(text2) {
+  for (let i = 0; i < text2.length; i += 1) {
+    const code = text2.charCodeAt(i);
+    if (code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+
 // ../../packages/data-core/src/storage-path.ts
 var MAX_SINGLE_UPLOAD_BYTES = 52428800;
+var MAX_OBJECT_NAME_BYTES = 900;
 var STORAGE_RESERVED_WORDS = [
   "authenticated",
   "copy",
@@ -21478,6 +21937,32 @@ var RESERVED = new Set(STORAGE_RESERVED_WORDS);
 var ENCODER = new TextEncoder();
 var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
 var LONE_SURROGATES = new RegExp(LONE_SURROGATE2.source, "g");
+function hasLoneSurrogate(text2) {
+  return LONE_SURROGATE2.test(text2);
+}
+function refuse(reason) {
+  return { ok: false, reason };
+}
+function checkWellFormed(name) {
+  if (name === "") return refuse("is empty");
+  if (name.length > MAX_OBJECT_NAME_BYTES || ENCODER.encode(name).length > MAX_OBJECT_NAME_BYTES)
+    return refuse(`is longer than ${String(MAX_OBJECT_NAME_BYTES)} bytes`);
+  if (name.startsWith("/") || name.endsWith("/"))
+    return refuse("starts or ends with /");
+  if (name.includes("//")) return refuse("has an empty segment (//)");
+  for (const segment of name.split("/"))
+    if (segment === "." || segment === "..")
+      return refuse("has a . or .. segment");
+  if (hasControlCharacter(name)) return refuse("has a control character");
+  if (name.includes("\\")) return refuse("has a backslash");
+  if (hasBidiControl(name))
+    return refuse("has a bidirectional control character");
+  return { ok: true, name };
+}
+function checkObjectName(name) {
+  if (hasLoneSurrogate(name)) return refuse("is not valid UTF-8");
+  return checkWellFormed(name);
+}
 function objectParent(name) {
   const slash = name.lastIndexOf("/");
   return slash < 0 ? "" : name.slice(0, slash);
@@ -21507,6 +21992,7 @@ var STORAGE_OBJECTS = "storage.objects";
 var STORAGE_OBJECTS_TABLE = "_naro_storage_objects";
 var STORAGE_OBJECTS_QUALIFIER = "objects";
 var STORAGE_UNAVAILABLE_MESSAGE = "storage.objects is not available on this backend yet. Run `naro backend enable` to update it.";
+var STORAGE_UNAVAILABLE_REASON = `${STORAGE_OBJECTS} is not available on this backend yet`;
 var STORAGE_BUCKETS_TABLE = "_naro_storage_buckets";
 var STORAGE_POLICY_COLUMNS = [
   "id",
@@ -21674,7 +22160,8 @@ var CATALOG = {
       policy,
       recursion,
       values,
-      bytes
+      bytes,
+      depth
     }) => {
       if (recursion)
         return `Infinite recursion detected in policy for relation ${table}.`;
@@ -21682,6 +22169,8 @@ var CATALOG = {
         return `The policies of ${table} bind more than ${values === true ? "50" : String(values)} values in one statement.`;
       if (bytes)
         return `The policies of ${table} write more than ${bytes === true ? "50000" : String(bytes)} bytes of SQL into one statement.`;
+      if (depth)
+        return `The policies of ${table} nest an expression more than 100 deep into one statement.`;
       if (policy !== void 0)
         return `Policy ${policy} on ${table} cannot be applied.`;
       return condition ? `The ${action} policy of ${table} has a condition that cannot be applied.` : `The ${action} policy of ${table} is owner but has no valid owner column.`;
@@ -21739,7 +22228,7 @@ var CATALOG = {
   },
   OBJECT_TOO_LARGE: {
     status: 413,
-    message: (vars) => "single" in vars ? "Uploads over 50 MiB go in parts: use the multipart upload." : `The object is ${String(vars.size)} bytes; bucket ${storageName(vars.bucket)} takes objects up to ${String(vars.max)} bytes.`
+    message: (vars) => "single" in vars ? "Uploads over 50 MiB go in parts: use the multipart upload." : "transfer" in vars ? "Objects over 5,363,466,240 bytes (5 GiB \u2212 5 MiB) cannot be copied or moved." : `The object is ${String(vars.size)} bytes; bucket ${storageName(vars.bucket)} takes objects up to ${String(vars.max)} bytes.`
   },
   MIME_TYPE_NOT_ALLOWED: {
     status: 415,
@@ -21751,7 +22240,7 @@ var CATALOG = {
   },
   OBJECT_EXISTS: {
     status: 409,
-    message: ({ bucket, path }) => `Object ${storageName(path)} already exists in bucket ${storageName(bucket)}. Upload with upsert to replace it.`
+    message: ({ bucket, path, move }) => `Object ${storageName(path)} already exists in bucket ${storageName(bucket)}. ${move === true ? "A move never replaces an object: remove it or choose another name." : "Upload with upsert to replace it."}`
   },
   OBJECT_BUSY: {
     status: 409,
@@ -22429,6 +22918,15 @@ function resolvePolicyTable(snapshot, name) {
   if (folded === REALTIME_MESSAGES) return REALTIME_MESSAGES_TABLE;
   return resolveTable(snapshot, name);
 }
+function resolveSubqueryTable(snapshot, name) {
+  if (asciiLower(name) === STORAGE_OBJECTS)
+    return snapshot.storageSubqueries === false ? void 0 : snapshot.storage;
+  return resolveTable(snapshot, name);
+}
+function subqueryName(subquery) {
+  if (subquery.alias !== null) return subquery.alias;
+  return asciiLower(subquery.table) === STORAGE_OBJECTS ? STORAGE_OBJECTS_QUALIFIER : subquery.table;
+}
 async function readTableNames(db) {
   return tableNamesFromRows(rowsOf(await db.prepare(TABLE_NAMES_SQL).all()));
 }
@@ -22470,6 +22968,14 @@ function utf8ByteLength(text2) {
 function quoteIdentifier(name) {
   return `"${name.replaceAll('"', '""')}"`;
 }
+var SIDE_BY_SIDE = 8;
+function joinConditions(terms, op) {
+  if (terms.length <= SIDE_BY_SIDE) return `(${terms.join(` ${op} `)})`;
+  const groups = [];
+  for (let at = 0; at < terms.length; at += SIDE_BY_SIDE)
+    groups.push(joinConditions(terms.slice(at, at + SIDE_BY_SIDE), op));
+  return joinConditions(groups, op);
+}
 var Failure = class extends Error {
   constructor(error51, reason) {
     super(error51.code);
@@ -22653,6 +23159,12 @@ var VALUE_KINDS = /* @__PURE__ */ new Set([
 function isValueExpr(expr) {
   return VALUE_KINDS.has(expr.kind);
 }
+function comparedValue(value) {
+  let current = value;
+  while (current.kind === "func" && current.name === "coalesce" && current.args.length === 1 && current.args[0] !== void 0)
+    current = current.args[0];
+  return current;
+}
 function isConditionExpr(expr) {
   if (!isValueExpr(expr)) return true;
   if (expr.kind === "column") return true;
@@ -22704,7 +23216,6 @@ var SPECIAL_WORDS = /* @__PURE__ */ new Set([
   "auth"
 ]);
 var TEXT_TYPES = /* @__PURE__ */ new Set(["text", "varchar", "uuid"]);
-var STORAGE_SUBQUERY_PROBLEM = "A policy cannot read storage.objects in a subquery yet";
 var FOLDERNAME_INDEX_PROBLEM = `storage.foldername(name) is available only as (storage.foldername(name))[n] with n from 1 to ${String(MAX_FOLDERNAME_INDEX)}`;
 function storageHelperColumnProblem(fn) {
   return `storage.${fn}() takes the name column of storage.objects`;
@@ -23155,8 +23666,12 @@ function atRealtimeMessages(stream) {
 }
 function readTableName(stream) {
   const first = stream.peek();
-  if (atStorageObjects(stream))
-    throw new PolicySyntaxError(STORAGE_SUBQUERY_PROBLEM, first.position);
+  if (atStorageObjects(stream)) {
+    stream.next();
+    stream.next();
+    stream.next();
+    return STORAGE_OBJECTS;
+  }
   if (atRealtimeMessages(stream))
     throw new PolicySyntaxError(REALTIME_SUBQUERY_PROBLEM, first.position);
   let token = first;
@@ -23183,12 +23698,6 @@ function readTableName(stream) {
   return name;
 }
 function readPolicyTarget(stream) {
-  if (atStorageObjects(stream)) {
-    stream.next();
-    stream.next();
-    stream.next();
-    return STORAGE_OBJECTS;
-  }
   if (atRealtimeMessages(stream)) {
     stream.next();
     stream.next();
@@ -23608,9 +24117,10 @@ function printValue(expr) {
 }
 function printSubquery(subquery) {
   const select = subquery.select === "*" ? "*" : printValue(subquery.select);
+  const table = asciiLower(subquery.table) === STORAGE_OBJECTS ? STORAGE_OBJECTS : quoteIdent(subquery.table);
   const alias = subquery.alias === null ? "" : ` ${quoteIdent(subquery.alias)}`;
   const where = subquery.where === null ? "" : ` WHERE ${printExpr(subquery.where)}`;
-  return `SELECT ${select} FROM ${quoteIdent(subquery.table)}${alias}${where}`;
+  return `SELECT ${select} FROM ${table}${alias}${where}`;
 }
 function printElement(element) {
   if (typeof element === "object") return printValue(element);
@@ -23963,6 +24473,9 @@ var FILTER_OPERATORS = [
   "containedBy",
   "overlaps"
 ];
+function leastFilters(firstColumn) {
+  return firstColumn === void 0 ? [] : [{ operator: "is", column: firstColumn, value: null }];
+}
 function isAuthUid(value) {
   return isPlainObject2(value) && Object.keys(value).length === 1 && Object.hasOwn(value, "auth") && value.auth === "uid";
 }
@@ -24576,12 +25089,21 @@ function storedSource(table, names, alias) {
 function tableLabel(table) {
   return table.name === STORAGE_OBJECTS_TABLE ? STORAGE_OBJECTS : table.name;
 }
+function storageReadySql(alias) {
+  return `(${quoteIdentifier(alias)}.${quoteIdentifier("status")} = 'ready')`;
+}
+function ownNames(table) {
+  return table.name === STORAGE_OBJECTS_TABLE ? [STORAGE_OBJECTS_QUALIFIER] : [asciiLower(table.name)];
+}
 function missingColumnReason(name, tables) {
   return `column ${name} does not exist on ${tables.join(" or ")}`;
 }
 function missingRelationReason(table) {
   return `relation ${table} does not exist (a system table cannot be read either)`;
 }
+function unresolvedSubqueryReason(table) {
+  return asciiLower(table) === STORAGE_OBJECTS ? STORAGE_UNAVAILABLE_REASON : missingRelationReason(table);
+}
 function resolveColumn(env, ref) {
   const name = asciiLower(ref.name);
   if (ref.qualifier !== null) {
@@ -24691,10 +25213,10 @@ function storageHelperSql(fn, index, operand) {
 }
 function storageCallSql(env, expr) {
   const problem = storageHelperColumnProblem(expr.fn);
-  if (asciiLower(env.blame.policy.table) !== STORAGE_OBJECTS)
+  if (!env.scopes.some((scope) => scope.table.name === STORAGE_OBJECTS_TABLE))
     return blamed(env, problem);
   const { source, column: column2 } = resolveColumn(env, expr.column);
-  if (source !== env.scopes[0] || source.table.name !== STORAGE_OBJECTS_TABLE || column2.name !== "name")
+  if (source.table.name !== STORAGE_OBJECTS_TABLE || column2.name !== "name")
     return blamed(env, problem);
   const index = expr.fn === "foldername" ? expr.index : null;
   if (expr.fn === "foldername" ? index === null || !Number.isInteger(index) || index < 1 || index > MAX_FOLDERNAME_INDEX : expr.index !== null)
@@ -24708,7 +25230,8 @@ function storageCallSql(env, expr) {
     })
   );
 }
-function operandSide(env, expr) {
+function operandSide(env, value) {
+  const expr = comparedValue(value);
   if (expr.kind === "cast") return operandSide(env, expr.operand);
   if (expr.kind !== "column" && expr.kind !== "realtime")
     return {
@@ -24769,7 +25292,10 @@ function conditionSql(env, expr) {
   switch (expr.kind) {
     case "and":
     case "or":
-      return `(${expr.args.map((arg) => conditionSql(env, arg)).join(expr.kind === "and" ? " AND " : " OR ")})`;
+      return joinConditions(
+        expr.args.map((arg) => conditionSql(env, arg)),
+        expr.kind === "and" ? "AND" : "OR"
+      );
     case "not":
       return `(NOT ${conditionSql(env, expr.arg)})`;
     default:
@@ -24852,8 +25378,8 @@ function conditionSql(env, expr) {
   }
 }
 function subquerySql(env, subquery, select) {
-  const table = resolveTable(env.snapshot, subquery.table);
-  if (!table) return blamed(env, missingRelationReason(subquery.table));
+  const table = resolveSubqueryTable(env.snapshot, subquery.table);
+  if (!table) return blamed(env, unresolvedSubqueryReason(subquery.table));
   const { state } = env;
   if (++state.subqueries > MAX_STATEMENT_SUBQUERIES)
     return blamed(env, STATEMENT_SUBQUERIES_REASON);
@@ -24867,7 +25393,7 @@ function subquerySql(env, subquery, select) {
     const alias = `_naro_s${String(++state.aliases)}`;
     const source = storedSource(
       table,
-      [asciiLower(subquery.alias ?? table.name)],
+      [asciiLower(subqueryName(subquery))],
       alias
     );
     const inner = { ...env, scopes: [...env.scopes, source] };
@@ -24879,11 +25405,12 @@ function subquerySql(env, subquery, select) {
       selected = valueSql(inner, subquery.select);
       if (env.check) item = operandSide(inner, subquery.select);
     }
-    const own2 = storedSource(table, [asciiLower(table.name)], alias);
+    const own2 = storedSource(table, ownNames(table), alias);
     const rls = inlinedPolicies(env, table, own2);
+    const ready = table.name === STORAGE_OBJECTS_TABLE ? `${storageReadySql(alias)} AND ` : "";
     const where = subquery.where === null ? "" : ` AND ${conditionSql(inner, subquery.where)}`;
     return {
-      sql: `SELECT ${selected} FROM ${quoteIdentifier(table.name)} AS ${quoteIdentifier(alias)} WHERE ${rls}${where}`,
+      sql: `SELECT ${selected} FROM ${quoteIdentifier(table.name)} AS ${quoteIdentifier(alias)} WHERE ${ready}${rls}${where}`,
       item
     };
   } finally {
@@ -24936,7 +25463,10 @@ function groupTerms(env, sources, action, permissive, restrictive, pick2) {
     terms.push(term);
   }
   const group = terms.length === 0 ? { sql: "0", params: [] } : terms.length === 1 ? terms[0] : {
-    sql: `(${terms.map((term) => term.sql).join(" OR ")})`,
+    sql: joinConditions(
+      terms.map((term) => term.sql),
+      "OR"
+    ),
     params: terms.flatMap((term) => term.params)
   };
   const restricted = restrictive.flatMap((policy) => {
@@ -24946,9 +25476,10 @@ function groupTerms(env, sources, action, permissive, restrictive, pick2) {
   return { permissive: group, restrictive: restricted };
 }
 function inlinedPolicies(env, table, source) {
+  const label2 = tableLabel(table);
   const found = applicablePolicies(
     env.req.policies,
-    table.name,
+    label2,
     "select",
     env.req.role
   );
@@ -24960,7 +25491,7 @@ function inlinedPolicies(env, table, source) {
   if (found.permissive.length === 0) return "0";
   return withTableActive(
     env.state,
-    table.name,
+    label2,
     [...found.permissive, ...found.restrictive],
     () => {
       const inner = { ...env, check: null, params: [] };
@@ -24979,7 +25510,10 @@ function inlinedPolicies(env, table, source) {
       for (const part of parts) env.params.push(...part.params);
       const [only] = parts;
       if (parts.length === 1 && only) return only.sql;
-      return `(${parts.map((part) => part.sql).join(" AND ")})`;
+      return joinConditions(
+        parts.map((part) => part.sql),
+        "AND"
+      );
     }
   );
 }
@@ -25074,11 +25608,8 @@ function scopedValues(operand, scopes) {
   return operandValues(operand).map((value) => ({ value, scopes }));
 }
 function subqueryScopes(snapshot, subquery, scopes) {
-  const inner = resolveTable(snapshot, subquery.table);
-  return inner ? [
-    ...scopes,
-    { names: [asciiLower(subquery.alias ?? inner.name)], table: inner }
-  ] : void 0;
+  const inner = resolveSubqueryTable(snapshot, subquery.table);
+  return inner ? [...scopes, { names: [asciiLower(subqueryName(subquery))], table: inner }] : void 0;
 }
 function columnsReadOn(snapshot, table, expr, written) {
   const found = [];
@@ -25413,7 +25944,7 @@ function nodeSql(table, node, params, path) {
   const terms = children.map(
     (child, index) => nodeSql(table, child, params, `${path}.${key}[${index}]`)
   );
-  return `(${terms.join(key === "or" ? " OR " : " AND ")})`;
+  return joinConditions(terms, key === "or" ? "OR" : "AND");
 }
 function whereClause(table, filters, policy, params) {
   const parts = [];
@@ -25424,7 +25955,7 @@ function whereClause(table, filters, policy, params) {
   const client = filters.map(
     (node, index) => nodeSql(table, node, params, `filters[${index}]`)
   );
-  if (client.length > 0) parts.push(`(${client.join(" AND ")})`);
+  if (client.length > 0) parts.push(joinConditions(client, "AND"));
   return parts.length === 0 ? "" : ` WHERE ${parts.join(" AND ")}`;
 }
 function orderClause(table, order) {
@@ -25626,7 +26157,7 @@ var Rls = class {
       const found = this.found(command);
       return [...found.permissive, ...found.restrictive];
     });
-    const key = asciiLower(table.name);
+    const key = asciiLower(this.policyTable);
     if (hasSubqueries(all) && !this.state.active.includes(key))
       this.state.active.push(key);
     for (const command of commands) {
@@ -26432,41 +26963,819 @@ function compile(query, snapshot, decision, context, options = {}) {
   }
 }
 
-// ../../packages/data-core/src/policy-index.ts
-var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
-function indexesFromRows(rows) {
-  const tables = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const table = row.table_name;
-    const column2 = row.column_name;
-    if (typeof table !== "string" || typeof column2 !== "string") continue;
-    if (Number(row.partial) !== 0) continue;
-    const key = asciiLower(table);
-    const columns = tables.get(key) ?? /* @__PURE__ */ new Map();
-    tables.set(key, columns);
-    const collations = columns.get(asciiLower(column2)) ?? [];
-    collations.push(
-      typeof row.collation === "string" ? row.collation.toUpperCase() : "BINARY"
-    );
-    columns.set(asciiLower(column2), collations);
-  }
-  return tables;
+// ../../packages/data-core/src/sql-depth.ts
+var D1_EXPRESSION_DEPTH = 100;
+var Unreadable = class extends Error {
+};
+function isWordStart(code) {
+  return code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95 || code >= 128;
 }
-function resolve8(scopes, qualifier, name) {
-  const column2 = asciiLower(name);
-  for (let index = scopes.length - 1; index >= 0; index--) {
-    const scope = scopes[index];
-    if (qualifier !== null && !scope.names.includes(asciiLower(qualifier)))
-      continue;
-    const found = scope.table.byName.get(column2);
-    if (found) return { column: found, scope: index };
-    if (qualifier !== null) return void 0;
-  }
-  return void 0;
+function isDigit2(code) {
+  return code >= 48 && code <= 57;
 }
-function realtimeTopic2(scopes) {
-  const [root] = scopes;
-  if (root?.table.name !== REALTIME_MESSAGES) return void 0;
+function isWordPart(code) {
+  return isWordStart(code) || isDigit2(code) || code === 36;
+}
+function isSpace3(code) {
+  return code === 32 || code >= 9 && code <= 13;
+}
+var OPERATORS_2 = /* @__PURE__ */ new Set([
+  "->",
+  "||",
+  "<=",
+  ">=",
+  "<>",
+  "!=",
+  "==",
+  "<<",
+  ">>"
+]);
+var OPERATORS_1 = "=<>+-*/%&|~(),.;";
+var NUMBER2 = /^(?:0[xX][0-9A-Fa-f_]+|[0-9_]*\.?[0-9_]*(?:[eE][+-]?[0-9_]+)?)/;
+function tokenize3(sql) {
+  const tokens = [];
+  const length = sql.length;
+  let at = 0;
+  const closing = (close) => {
+    let from = at + 1;
+    for (; ; ) {
+      const found = sql.indexOf(close, from);
+      if (found < 0) throw new Unreadable("an unclosed quote");
+      if (close === "]" || sql[found + 1] !== close) return found;
+      from = found + 2;
+    }
+  };
+  while (at < length) {
+    const code = sql.charCodeAt(at);
+    const next = sql.charCodeAt(at + 1);
+    if (isSpace3(code)) {
+      at++;
+    } else if (code === 45 && next === 45) {
+      const end = sql.indexOf("\n", at);
+      at = end < 0 ? length : end + 1;
+    } else if (code === 47 && next === 42) {
+      const end = sql.indexOf("*/", at + 2);
+      at = end < 0 ? length : end + 2;
+    } else if (code === 39) {
+      at = closing("'") + 1;
+      tokens.push({ kind: "literal" });
+    } else if (code === 34 || code === 96 || code === 91) {
+      at = closing(code === 91 ? "]" : String.fromCharCode(code)) + 1;
+      tokens.push({ kind: "name" });
+    } else if ((code === 88 || code === 120) && next === 39) {
+      at++;
+      at = closing("'") + 1;
+      tokens.push({ kind: "literal" });
+    } else if (isDigit2(code) || code === 46 && isDigit2(next)) {
+      const text2 = NUMBER2.exec(sql.slice(at, at + 64))?.[0] || sql[at] || "";
+      tokens.push(
+        /^[0-9]+$/.test(text2) ? { kind: "literal", integer: Number(text2) } : { kind: "literal" }
+      );
+      at += text2.length;
+    } else if (code === 63 || code === 58 || code === 64 || code === 36) {
+      at++;
+      while (at < length && isWordPart(sql.charCodeAt(at))) at++;
+      tokens.push({ kind: "param" });
+    } else if (isWordStart(code)) {
+      const start = at;
+      while (at < length && isWordPart(sql.charCodeAt(at))) at++;
+      const text2 = sql.slice(start, at);
+      tokens.push({ kind: "word", text: text2, upper: text2.toUpperCase() });
+    } else if (sql.startsWith("->>", at)) {
+      tokens.push({ kind: "op", text: "->>" });
+      at += 3;
+    } else if (OPERATORS_2.has(sql.slice(at, at + 2))) {
+      tokens.push({ kind: "op", text: sql.slice(at, at + 2) });
+      at += 2;
+    } else if (OPERATORS_1.includes(sql[at] ?? "")) {
+      tokens.push({ kind: "op", text: sql[at] ?? "" });
+      at++;
+    } else throw new Unreadable(`an unexpected ${sql[at] ?? ""}`);
+  }
+  tokens.push({ kind: "end" });
+  return tokens;
+}
+var CLAUSE_WORDS2 = /* @__PURE__ */ new Set([
+  "AS",
+  "CROSS",
+  "DEFAULT",
+  "DO",
+  "EXCEPT",
+  "FROM",
+  "FULL",
+  "GROUP",
+  "HAVING",
+  "INDEXED",
+  "INNER",
+  "INTERSECT",
+  "JOIN",
+  "LEFT",
+  "LIMIT",
+  "NATURAL",
+  "NOT",
+  "OFFSET",
+  "ON",
+  "ORDER",
+  "OUTER",
+  "RETURNING",
+  "RIGHT",
+  "SET",
+  "UNION",
+  "USING",
+  "VALUES",
+  "WHERE",
+  "WINDOW"
+]);
+var NOT_CONSTANT = /* @__PURE__ */ new Set([
+  "avg",
+  "changes",
+  "count",
+  "group_concat",
+  "json_group_array",
+  "json_group_object",
+  "jsonb_group_array",
+  "jsonb_group_object",
+  "last_insert_rowid",
+  "random",
+  "randomblob",
+  "sqlite_offset",
+  "string_agg",
+  "sum",
+  "total",
+  "total_changes"
+]);
+var OR = 1;
+var AND = 2;
+var NOT = 3;
+var COMPARE = 4;
+var ORDER = 5;
+var ESCAPE = 6;
+var BITS = 7;
+var SUM = 8;
+var PRODUCT = 9;
+var CONCAT = 10;
+var COLLATE = 11;
+var UNARY = 12;
+var BINARY = {
+  "=": COMPARE,
+  "==": COMPARE,
+  "!=": COMPARE,
+  "<>": COMPARE,
+  "<": ORDER,
+  "<=": ORDER,
+  ">": ORDER,
+  ">=": ORDER,
+  "&": BITS,
+  "|": BITS,
+  "<<": BITS,
+  ">>": BITS,
+  "+": SUM,
+  "-": SUM,
+  "*": PRODUCT,
+  "/": PRODUCT,
+  "%": PRODUCT,
+  "||": CONCAT,
+  "->": CONCAT,
+  "->>": CONCAT
+};
+var LIKE_WORDS = /* @__PURE__ */ new Set(["LIKE", "GLOB", "REGEXP", "MATCH"]);
+var USABLE_OPERATORS = /* @__PURE__ */ new Set(["=", "==", "<", "<=", ">", ">="]);
+var Reader = class {
+  constructor(tokens, planner) {
+    this.tokens = tokens;
+    this.planner = planner;
+  }
+  at = 0;
+  /** The deepest node built, kept or not: each is checked as it is built. */
+  deepest = 0;
+  peek(offset = 0) {
+    return this.tokens[this.at + offset] ?? { kind: "end" };
+  }
+  isWord(word, offset = 0) {
+    const token = this.peek(offset);
+    return token.kind === "word" && token.upper === word;
+  }
+  isOp(op, offset = 0) {
+    const token = this.peek(offset);
+    return token.kind === "op" && token.text === op;
+  }
+  isName(offset = 0) {
+    const kind = this.peek(offset).kind;
+    return kind === "word" || kind === "name";
+  }
+  takeWord(word) {
+    if (!this.isWord(word)) return false;
+    this.at++;
+    return true;
+  }
+  takeOp(op) {
+    if (!this.isOp(op)) return false;
+    this.at++;
+    return true;
+  }
+  expectWord(word) {
+    if (!this.takeWord(word)) throw new Unreadable(`no ${word}`);
+  }
+  expectOp(op) {
+    if (!this.takeOp(op)) throw new Unreadable(`no ${op}`);
+  }
+  name() {
+    if (!this.isName()) throw new Unreadable("no name");
+    this.at++;
+  }
+  /** `name` or `schema.name`. */
+  qualifiedName() {
+    this.name();
+    if (this.isOp(".") && this.isName(1)) this.at += 2;
+  }
+  atEnd() {
+    this.takeOp(";");
+    return this.peek().kind === "end";
+  }
+  // --- nodes, as expr.c builds them ---
+  made(node) {
+    this.deepest = Math.max(this.deepest, node.height);
+    return node;
+  }
+  leaf(extra = {}) {
+    return this.made({ height: 1, constant: true, subqueries: [], ...extra });
+  }
+  /** sqlite3PExpr, exprSetHeight: one deeper than the deepest part. */
+  over(parts, extra = {}) {
+    return this.made(this.unchecked(parts, extra));
+  }
+  /**
+   * sqlite3ExprAttachSubtrees alone, as for a CAST: its height is set and
+   * not checked, so it counts only through what holds it.
+   */
+  unchecked(parts, extra = {}) {
+    let height = 0;
+    let constant = true;
+    let hasFunc = false;
+    let hasSubquery = false;
+    let subqueries = [];
+    for (const part of parts) {
+      if (part.height > height) height = part.height;
+      if (!part.constant) constant = false;
+      if (part.hasFunc) hasFunc = true;
+      if (part.hasSubquery) hasSubquery = true;
+      if (part.subqueries.length > 0)
+        subqueries = subqueries.length === 0 ? part.subqueries : [...subqueries, ...part.subqueries];
+    }
+    const node = { height: height + 1, constant, subqueries, ...extra };
+    if (hasFunc) node.hasFunc ??= true;
+    if (hasSubquery) node.hasSubquery ??= true;
+    return node;
+  }
+  /** A node holding a SELECT: EXISTS, `(SELECT …)`, `x IN (SELECT …)`. */
+  holding(left, select) {
+    const node = {
+      height: Math.max(select.height, left?.height ?? 0) + 1,
+      constant: false,
+      subqueries: [...left?.subqueries ?? [], select],
+      hasSubquery: true
+    };
+    if (left?.hasFunc) node.hasFunc = true;
+    if (left?.column) node.usable = true;
+    return this.made(node);
+  }
+  // --- expressions, by parse.y's precedence ---
+  expr(min = OR) {
+    let left = this.prefix();
+    for (; ; ) {
+      const token = this.peek();
+      if (token.kind === "op") {
+        const level = BINARY[token.text];
+        if (level === void 0 || level < min) return left;
+        this.at++;
+        const right = this.expr(level + 1);
+        if (token.text === "->" || token.text === "->>") {
+          left = this.over([left, right], { hasFunc: true });
+          continue;
+        }
+        const compared = USABLE_OPERATORS.has(token.text);
+        left = this.over(
+          [left, right],
+          compared && (left.column || right.column) ? { usable: true } : {}
+        );
+        continue;
+      }
+      if (token.kind !== "word") return left;
+      const word = token.upper;
+      if (word === "OR" || word === "AND") {
+        if ((word === "OR" ? OR : AND) < min) return left;
+        this.at++;
+        const right = this.expr((word === "OR" ? OR : AND) + 1);
+        if (word === "OR")
+          left = this.over([left, right], { or: [left, right] });
+        else if ((left.isFalse || right.isFalse) && !left.hasFunc && !right.hasFunc)
+          left = this.leaf({ isFalse: true, literal: true });
+        else left = this.over([left, right], { and: [left, right] });
+        continue;
+      }
+      if (word === "COLLATE") {
+        if (COLLATE < min) return left;
+        this.at++;
+        this.name();
+        left = this.made({
+          height: 1,
+          constant: left.constant,
+          subqueries: left.subqueries,
+          ...left.column ? { column: true } : {}
+        });
+        continue;
+      }
+      if (COMPARE < min) return left;
+      const negated = word === "NOT" ? 1 : 0;
+      const after = this.peek(negated);
+      const verb = after.kind === "word" ? after.upper : "";
+      if (word === "IS") {
+        this.at++;
+        let not = this.takeWord("NOT");
+        if (this.takeWord("DISTINCT")) {
+          this.expectWord("FROM");
+          not = !not;
+        }
+        const right = this.expr(COMPARE + 1);
+        left = right.isNull ? this.nullTest(left, !not) : this.over(
+          [left, right],
+          !not && (left.column || right.column) ? { usable: true } : {}
+        );
+      } else if (word === "ISNULL" || word === "NOTNULL") {
+        this.at++;
+        left = this.nullTest(left, word === "ISNULL");
+      } else if (negated && verb === "NULL") {
+        this.at += 2;
+        left = this.nullTest(left, false);
+      } else if (LIKE_WORDS.has(verb)) {
+        this.at += negated + 1;
+        const args = [this.expr(COMPARE + 1), left];
+        if (this.takeWord("ESCAPE")) args.push(this.expr(ESCAPE + 1));
+        left = this.over(args, { hasFunc: true });
+        if (negated) left = this.over([left]);
+      } else if (verb === "BETWEEN") {
+        this.at += negated + 1;
+        const low = this.expr(NOT);
+        this.expectWord("AND");
+        const high = this.expr(COMPARE + 1);
+        left = this.over([left, low, high]);
+        if (negated) left = this.over([left]);
+      } else if (verb === "IN") {
+        this.at += negated + 1;
+        left = this.inList(left, negated === 1);
+      } else return left;
+    }
+  }
+  /**
+   * IS NULL (`isNull`) or IS NOT NULL: on a literal, the answer itself; on
+   * a column, a term the planner can use when it is IS NULL.
+   */
+  nullTest(left, isNull) {
+    if (left.literal)
+      return this.leaf(
+        isNull ? { isFalse: true, literal: true } : { literal: true }
+      );
+    return this.over([left], isNull && left.column ? { usable: true } : {});
+  }
+  inList(left, negated) {
+    this.expectOp("(");
+    if (this.takeOp(")"))
+      return left.hasFunc ? this.over([left]) : this.leaf(negated ? {} : { isFalse: true });
+    let node;
+    if (this.startsSelect()) {
+      node = this.holding(left, this.select());
+    } else {
+      const items = this.list();
+      const [only] = items;
+      const usable = left.column ? { usable: true } : {};
+      if (items.length === 1 && only?.select)
+        node = this.holding(left, only.select);
+      else if (items.length === 1 && only?.constant)
+        node = this.over([left, this.over([only])], usable);
+      else node = this.over([left, ...items], usable);
+    }
+    this.expectOp(")");
+    return negated ? this.over([node]) : node;
+  }
+  list() {
+    const items = [this.expr()];
+    while (this.takeOp(",")) items.push(this.expr());
+    return items;
+  }
+  prefix() {
+    const token = this.peek();
+    this.at++;
+    switch (token.kind) {
+      case "literal":
+        return this.leaf(
+          token.integer === 0 ? { isFalse: true, literal: true } : { literal: true }
+        );
+      case "param":
+        return this.leaf();
+      case "name":
+        return this.column();
+      case "end":
+        throw new Unreadable("no expression");
+      case "op":
+        if (token.text === "(") {
+          if (this.startsSelect()) {
+            const select = this.select();
+            this.expectOp(")");
+            return { ...this.holding(null, select), select };
+          }
+          const items = this.list();
+          this.expectOp(")");
+          if (items.length === 1 && items[0]) return items[0];
+          throw new Unreadable("a row value");
+        }
+        if (token.text === "-" || token.text === "+") {
+          const operand = this.expr(UNARY);
+          return this.over([operand], operand.literal ? { literal: true } : {});
+        }
+        if (token.text === "~") return this.over([this.expr(UNARY)]);
+        throw new Unreadable(`an unexpected ${token.text}`);
+      case "word":
+        break;
+    }
+    switch (token.upper) {
+      case "NULL":
+        return this.leaf({ isNull: true });
+      case "TRUE":
+      case "FALSE":
+        return this.leaf();
+      case "NOT":
+        return this.over([this.expr(NOT)]);
+      case "EXISTS": {
+        this.expectOp("(");
+        const select = this.select();
+        this.expectOp(")");
+        return this.holding(null, select);
+      }
+      case "CAST": {
+        this.expectOp("(");
+        const value = this.expr();
+        this.expectWord("AS");
+        this.typeName();
+        this.expectOp(")");
+        return this.unchecked([value]);
+      }
+      case "CASE": {
+        const parts = [];
+        if (!this.isWord("WHEN")) parts.push(this.expr());
+        while (this.takeWord("WHEN")) {
+          parts.push(this.expr());
+          this.expectWord("THEN");
+          parts.push(this.expr());
+        }
+        if (this.takeWord("ELSE")) parts.push(this.expr());
+        this.expectWord("END");
+        return this.over(parts);
+      }
+      default:
+        break;
+    }
+    if (!this.takeOp("(")) return this.column();
+    let args = [];
+    if (!this.takeOp("*") && !this.isOp(")")) {
+      if (!this.takeWord("DISTINCT")) this.takeWord("ALL");
+      args = this.list();
+    }
+    this.expectOp(")");
+    if (this.isWord("FILTER") || this.isWord("OVER"))
+      throw new Unreadable("a window function");
+    return this.over(args, {
+      hasFunc: true,
+      constant: !NOT_CONSTANT.has(token.text.toLowerCase()) && args.every((arg) => arg.constant)
+    });
+  }
+  /**
+   * `a`, `a.b` or `a.b.c`, its first name just read: TK_ID, and a TK_DOT a
+   * dot — a.b.c is DOT(a, DOT(b, c)).
+   */
+  column() {
+    let node = this.leaf({ constant: false, column: true });
+    while (this.isOp(".") && this.isName(1)) {
+      this.at += 2;
+      node = this.over([this.leaf({ constant: false }), node], {
+        column: true
+      });
+    }
+    return node;
+  }
+  typeName() {
+    do
+      this.name();
+    while (this.isName());
+    if (this.takeOp("(")) {
+      while (!this.takeOp(")")) {
+        if (this.peek().kind === "end") throw new Unreadable("no )");
+        this.at++;
+      }
+    }
+  }
+  /**
+   * A WHERE, and the chain an OR in it may bring when each of its branches
+   * could be read through an index — a column compared, or an AND holding
+   * one (exprAnalyzeOrTerm) — whether or not the table has that index: the
+   * other terms the planner can use, without a subquery, ANDed one by one
+   * from the first, under one more AND (wherecode.c, WHERE_MULTI_OR).
+   */
+  where() {
+    const where = this.expr();
+    if (!this.planner) return where;
+    const terms = split(where, "and");
+    for (const or of terms) {
+      if (!or.or || !split(or, "or").every(
+        (branch) => branch.usable || split(branch, "and").some((term) => term.usable)
+      ))
+        continue;
+      let chain = 0;
+      for (const term of terms)
+        if (term !== or && (term.usable || term.or) && !term.hasSubquery)
+          chain = chain === 0 ? term.height : Math.max(chain, term.height) + 1;
+      if (chain > 0) this.deepest = Math.max(this.deepest, chain + 1);
+    }
+    return where;
+  }
+  // --- statements ---
+  startsSelect() {
+    return this.isWord("SELECT") || this.isWord("VALUES") || this.isWord("WITH");
+  }
+  /** A SELECT, compound or not, with its ORDER BY and LIMIT. */
+  select() {
+    if (this.isWord("WITH")) throw new Unreadable("WITH");
+    const whole = { height: 0, resolved: [], from: [] };
+    const counted = (node) => {
+      whole.height = Math.max(whole.height, node.height);
+      whole.resolved.push(node);
+    };
+    do {
+      if (this.takeWord("VALUES")) {
+        do {
+          this.expectOp("(");
+          for (const item of this.list()) counted(item);
+          this.expectOp(")");
+        } while (this.takeOp(","));
+        continue;
+      }
+      this.expectWord("SELECT");
+      if (!this.takeWord("DISTINCT")) this.takeWord("ALL");
+      const stars = [];
+      do {
+        if (this.takeOp("*")) stars.push(this.leaf());
+        else if (this.isName() && this.isOp(".", 1) && this.isOp("*", 2)) {
+          this.at += 3;
+          stars.push(this.over([this.leaf(), this.leaf()]));
+        } else {
+          counted(this.expr());
+          this.alias();
+        }
+      } while (this.takeOp(","));
+      const sources = this.takeWord("FROM") ? this.from(whole) : 0;
+      for (const star of stars) {
+        whole.height = Math.max(whole.height, star.height);
+        whole.resolved.push(
+          sources > 1 ? this.made({ height: 3, constant: false, subqueries: [] }) : star
+        );
+      }
+      if (this.takeWord("WHERE")) counted(this.where());
+      if (this.takeWord("GROUP")) {
+        this.expectWord("BY");
+        for (const item of this.list()) counted(item);
+        if (this.takeWord("HAVING")) counted(this.expr());
+      }
+    } while (this.compound());
+    if (this.takeWord("ORDER")) {
+      this.expectWord("BY");
+      do {
+        counted(this.expr());
+        if (!this.takeWord("ASC")) this.takeWord("DESC");
+        if (this.takeWord("NULLS") && !this.takeWord("FIRST"))
+          this.expectWord("LAST");
+      } while (this.takeOp(","));
+    }
+    if (this.takeWord("LIMIT")) {
+      const parts = [this.expr()];
+      if (this.takeWord("OFFSET") || this.takeOp(",")) parts.push(this.expr());
+      counted(this.over(parts));
+    }
+    return whole;
+  }
+  compound() {
+    if (this.takeWord("UNION")) {
+      this.takeWord("ALL");
+      return true;
+    }
+    return this.takeWord("INTERSECT") || this.takeWord("EXCEPT");
+  }
+  alias() {
+    if (this.takeWord("AS")) {
+      this.name();
+      return;
+    }
+    const token = this.peek();
+    if (token.kind === "name" || token.kind === "word" && !CLAUSE_WORDS2.has(token.upper))
+      this.at++;
+  }
+  /** The FROM items, into `into`; how many there are. */
+  from(into) {
+    let sources = 0;
+    do {
+      sources++;
+      if (this.takeOp("(")) {
+        if (!this.startsSelect()) throw new Unreadable("a parenthesized join");
+        into.from.push(this.select());
+        this.expectOp(")");
+      } else {
+        this.qualifiedName();
+        if (this.takeOp("(")) {
+          if (!this.isOp(")"))
+            for (const arg of this.list()) {
+              into.resolved.push(arg);
+              this.deepest = Math.max(this.deepest, arg.height + 2);
+            }
+          this.expectOp(")");
+        }
+      }
+      this.alias();
+      if (this.takeWord("INDEXED")) {
+        this.expectWord("BY");
+        this.name();
+      } else if (this.isWord("NOT") && this.isWord("INDEXED", 1)) this.at += 2;
+      if (this.isWord("ON") || this.isWord("USING"))
+        throw new Unreadable("a join constraint");
+    } while (this.join());
+    return sources;
+  }
+  join() {
+    if (this.takeOp(",")) return true;
+    const start = this.at;
+    this.takeWord("NATURAL");
+    if (this.takeWord("LEFT") || this.takeWord("RIGHT") || this.takeWord("FULL"))
+      this.takeWord("OUTER");
+    else if (!this.takeWord("INNER")) this.takeWord("CROSS");
+    if (this.takeWord("JOIN")) return true;
+    this.at = start;
+    return false;
+  }
+  names() {
+    this.expectOp("(");
+    do
+      this.name();
+    while (this.takeOp(","));
+    this.expectOp(")");
+  }
+  returning(into) {
+    if (!this.takeWord("RETURNING")) return;
+    do {
+      if (this.takeOp("*")) into.push(this.leaf());
+      else {
+        into.push(this.expr());
+        this.alias();
+      }
+    } while (this.takeOp(","));
+  }
+  assignments(into) {
+    do {
+      if (this.isOp("(")) this.names();
+      else this.name();
+      this.expectOp("=");
+      into.push(this.expr());
+    } while (this.takeOp(","));
+  }
+  /** The statement: each of its expressions resolved from 0. */
+  statement() {
+    const top = { height: 0, resolved: [], from: [] };
+    if (this.startsSelect()) {
+      top.from.push(this.select());
+    } else if (this.takeWord("INSERT") || this.takeWord("REPLACE")) {
+      if (this.takeWord("OR")) this.name();
+      this.expectWord("INTO");
+      this.qualifiedName();
+      if (this.takeWord("AS")) this.name();
+      if (this.isOp("(")) this.names();
+      if (this.takeWord("DEFAULT")) this.expectWord("VALUES");
+      else top.from.push(this.select());
+      while (this.takeWord("ON")) {
+        this.expectWord("CONFLICT");
+        if (this.takeOp("(")) {
+          top.resolved.push(...this.list());
+          this.expectOp(")");
+          if (this.takeWord("WHERE")) top.resolved.push(this.expr());
+        }
+        this.expectWord("DO");
+        if (this.takeWord("NOTHING")) continue;
+        this.expectWord("UPDATE");
+        this.expectWord("SET");
+        this.assignments(top.resolved);
+        if (this.takeWord("WHERE")) top.resolved.push(this.expr());
+      }
+      this.returning(top.resolved);
+    } else if (this.takeWord("UPDATE")) {
+      if (this.takeWord("OR")) this.name();
+      this.qualifiedName();
+      this.alias();
+      if (this.takeWord("INDEXED")) {
+        this.expectWord("BY");
+        this.name();
+      }
+      this.expectWord("SET");
+      this.assignments(top.resolved);
+      if (this.isWord("FROM")) throw new Unreadable("UPDATE \u2026 FROM");
+      if (this.takeWord("WHERE")) top.resolved.push(this.where());
+      this.returning(top.resolved);
+    } else if (this.takeWord("DELETE")) {
+      this.expectWord("FROM");
+      this.qualifiedName();
+      this.alias();
+      if (this.takeWord("INDEXED")) {
+        this.expectWord("BY");
+        this.name();
+      }
+      if (this.takeWord("WHERE")) top.resolved.push(this.where());
+      this.returning(top.resolved);
+    } else throw new Unreadable("not a statement naro compiles");
+    return top;
+  }
+};
+function split(node, at) {
+  const found = [];
+  const pending = [node];
+  for (let next = pending.pop(); next; next = pending.pop()) {
+    const sides = next[at];
+    if (sides) pending.push(sides[1], sides[0]);
+    else found.push(next);
+  }
+  return found;
+}
+function nodeNeed(node, base2) {
+  const at = base2 + node.height;
+  let need = at;
+  for (const select of node.subqueries)
+    need = Math.max(need, selectNeed(select, at));
+  return need;
+}
+function selectNeed(select, base2) {
+  let need = base2;
+  for (const node of select.resolved)
+    need = Math.max(need, nodeNeed(node, base2));
+  for (const inner of select.from)
+    need = Math.max(need, selectNeed(inner, base2));
+  return need;
+}
+function expressionDepth(sql, { planner = true } = {}) {
+  try {
+    const reader = new Reader(tokenize3(sql), planner);
+    const top = reader.statement();
+    if (!reader.atEnd()) return void 0;
+    return Math.max(reader.deepest, selectNeed(top, 0));
+  } catch (error51) {
+    if (error51 instanceof Unreadable) return void 0;
+    throw error51;
+  }
+}
+
+// ../../packages/data-core/src/policy-index.ts
+var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
+function indexesFromRows(rows) {
+  const tables = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const table = row.table_name;
+    const column2 = row.column_name;
+    if (typeof table !== "string" || typeof column2 !== "string") continue;
+    if (Number(row.partial) !== 0) continue;
+    const key = asciiLower(table);
+    const columns = tables.get(key) ?? /* @__PURE__ */ new Map();
+    tables.set(key, columns);
+    const collations = columns.get(asciiLower(column2)) ?? [];
+    collations.push(
+      typeof row.collation === "string" ? row.collation.toUpperCase() : "BINARY"
+    );
+    columns.set(asciiLower(column2), collations);
+  }
+  return tables;
+}
+var STORAGE_OBJECTS_INDEXES = /* @__PURE__ */ new Map(
+  [
+    ["id", ["BINARY"]],
+    ["bucket_id", ["BINARY"]]
+  ]
+);
+function resolve8(scopes, qualifier, name) {
+  const column2 = asciiLower(name);
+  for (let index = scopes.length - 1; index >= 0; index--) {
+    const scope = scopes[index];
+    if (qualifier !== null && !scope.names.includes(asciiLower(qualifier)))
+      continue;
+    const found = scope.table.byName.get(column2);
+    if (found) return { column: found, scope: index };
+    if (qualifier !== null) return void 0;
+  }
+  return void 0;
+}
+function realtimeTopic2(scopes) {
+  const [root] = scopes;
+  if (root?.table.name !== REALTIME_MESSAGES) return void 0;
   const column2 = root.table.byName.get("topic");
   return column2 ? { column: column2, scope: 0 } : void 0;
 }
@@ -26527,12 +27836,9 @@ function readsOutside(scopes, expr, depth, snapshot) {
   }
 }
 function subqueryScopes2(scopes, subquery, snapshot) {
-  const table = resolveTable(snapshot, subquery.table);
+  const table = resolveSubqueryTable(snapshot, subquery.table);
   if (!table) return void 0;
-  return [
-    ...scopes,
-    { table, names: [asciiLower(subquery.alias ?? table.name)] }
-  ];
+  return [...scopes, { table, names: [asciiLower(subqueryName(subquery))] }];
 }
 function conjuncts(expr) {
   if (expr === null) return [];
@@ -26546,24 +27852,27 @@ function columnAffinityOf(column2) {
   if (affinity2 === "BLOB") return "blob";
   return "numeric";
 }
-function operandColumn(scopes, value) {
+function operandColumn(scopes, operand) {
+  const value = comparedValue(operand);
   if (value.kind === "realtime") return realtimeTopic2(scopes);
   if (value.kind !== "column") return void 0;
   return resolve8(scopes, value.qualifier, value.name);
 }
 function valueAffinity(scopes, value) {
-  if (value.kind === "cast") return "text";
+  if (comparedValue(value).kind === "cast") return "text";
   const found = operandColumn(scopes, value);
   return found ? columnAffinityOf(found.column) : "none";
 }
 function valueCollation(scopes, value) {
-  if (value.kind === "cast") return valueCollation(scopes, value.operand);
+  const compared = comparedValue(value);
+  if (compared.kind === "cast") return valueCollation(scopes, compared.operand);
   const found = operandColumn(scopes, value);
   return found ? found.column.collation : void 0;
 }
 function waysIn(scopes, where) {
   const inner = scopes.length - 1;
-  const own2 = (value) => {
+  const own2 = (operand) => {
+    const value = comparedValue(operand);
     if (value.kind !== "column") return void 0;
     const found = resolve8(scopes, value.qualifier, value.name);
     return found?.scope === inner ? found.column : void 0;
@@ -26611,7 +27920,7 @@ function isRowid(table, column2) {
 function blocked(table, indexes, way) {
   if (isRowid(table, way.column))
     return way.affinity === "text" ? "affinity" : void 0;
-  const collations = indexes.get(asciiLower(table.name))?.get(asciiLower(way.column.name));
+  const collations = (table.name === STORAGE_OBJECTS_TABLE ? STORAGE_OBJECTS_INDEXES : indexes.get(asciiLower(table.name)))?.get(asciiLower(way.column.name));
   if (!collations || collations.length === 0) return "none";
   const wanted = way.collation === void 0 ? way.column.collation : way.collation;
   if (wanted !== null && !collations.includes(wanted)) return "collation";
@@ -26622,9 +27931,17 @@ function blocked(table, indexes, way) {
 }
 function problemMessage(policy, outer, table, ways, why) {
   const runs = outer.name === REALTIME_MESSAGES ? "runs once for every channel join it checks" : `runs once for every row of ${tableLabel(outer)} it looks at`;
-  const start = `Policy ${policy.name} on ${tableLabel(outer)}: its subquery on ${table.name} ${runs}`;
+  const start = `Policy ${policy.name} on ${tableLabel(outer)}: its subquery on ${tableLabel(table)} ${runs}`;
   const override = "or send it with allow_unindexed=1 (naro policy create --allow-unindexed) to accept a scan of every row";
   const [way] = ways;
+  if (table.name === STORAGE_OBJECTS_TABLE) {
+    const column3 = way ? `${STORAGE_OBJECTS}.${way.column.name}` : "";
+    if (way && why === "collation")
+      return `${start}, and it compares ${column3} in collation ${String(way.collation ?? way.column.collation)}, which its index (BINARY) cannot search, so each run reads all of ${STORAGE_OBJECTS}. Write ${column3} on the left of = so that the comparison is BINARY \u2014 ${override}.`;
+    if (way && why === "affinity")
+      return `${start}, and it compares ${column3} with a number, which its index (text) cannot search, so each run reads all of ${STORAGE_OBJECTS}. Compare it with text, as in <value>::text \u2014 ${override}.`;
+    return `${start}, and no condition of its WHERE compares ${STORAGE_OBJECTS}.bucket_id or ${STORAGE_OBJECTS}.id with = to a value from outside it, so each run reads all of ${STORAGE_OBJECTS}. Add bucket_id = '<bucket>' to it \u2014 ${override}.`;
+  }
   if (!way)
     return `${start}, and no condition of its WHERE compares a column of ${table.name} with = to a value from outside it, so each run reads all of ${table.name}. Compare a column of ${table.name} with = (or IN) and index that column \u2014 ${override}.`;
   const column2 = way.column.name;
@@ -26664,12 +27981,12 @@ function unindexedSubqueries(snapshot, indexes, policies) {
             const ways = waysIn(inner, expr.subquery.where);
             const reasons = ways.map((way) => blocked(table, indexes, way));
             if (!reasons.includes(void 0)) {
-              const order = ["none", "collation", "affinity"];
+              const order = table.name === STORAGE_OBJECTS_TABLE ? ["collation", "affinity", "none"] : ["none", "collation", "affinity"];
               const best = order.map((reason) => reasons.indexOf(reason)).find((index) => index >= 0);
               const way = best === void 0 ? void 0 : ways[best];
               found.push({
                 policy,
-                table: table.name,
+                table: tableLabel(table),
                 message: problemMessage(
                   policy,
                   outer,
@@ -26863,6 +28180,14 @@ function privateChannelAccess(input) {
   return { ok: true, statement: { sql, params } };
 }
 
+// ../../packages/data-core/src/storage-transfer.ts
+function moveToPending(to) {
+  return JSON.stringify({ moveTo: to });
+}
+function moveFromPending(from) {
+  return JSON.stringify({ moveFrom: from });
+}
+
 // ../../packages/data-core/src/storage-sql.ts
 var STORAGE_NONCE_MAX_DIGITS = 64;
 function nonceOf(nonce) {
@@ -26992,6 +28317,73 @@ function claimOverwrite(i) {
     [[i.lockId, i.expiresAt, i.pending, i.bucket, i.name], room.values]
   );
 }
+var MOVE_KEPT_COLUMNS = [
+  "id",
+  "bucket_id",
+  "owner",
+  "owner_id",
+  "version",
+  "created_at",
+  "updated_at",
+  "metadata"
+];
+function moveCheckRow(i) {
+  return {
+    row: { name: i.to },
+    stored: { alias: STORAGE_OBJECT_ALIAS, columns: MOVE_KEPT_COLUMNS }
+  };
+}
+function claimMove(i) {
+  const nonce = nonceOf(i.nonce);
+  const slotNonce = nonceOf(i.slotNonce);
+  const source = compose(
+    [
+      `UPDATE ${STORAGE_OBJECTS_TABLE} AS o SET lock_id = ?, lock_expires_at = ?, pending = ? WHERE o.id = ? AND o.name = ? AND CASE WHEN NOT (`,
+      i.selectUsing,
+      `) THEN ${marker("hidden", nonce)} WHEN NOT EXISTS (SELECT 1 FROM ${STORAGE_BUCKETS_TABLE} AS b WHERE b.id = o.bucket_id AND b.${LIVE_BUCKET}) THEN ${marker("bucket", nonce)} WHEN o.lock_id IS NOT NULL OR o.version IS NOT ? THEN ${marker("busy", nonce)} WHEN NOT (`,
+      i.updateUsing,
+      `) THEN ${marker("denied", nonce)} WHEN (`,
+      i.check,
+      // The check is 1 or fails with its marker; anything else is no
+      // check that held — refused as the update policy refuses.
+      `) <> 1 THEN ${marker("denied", nonce)} WHEN ${PROJECT_BYTES} + o.size > ? THEN ${marker("quota", nonce)} ELSE 1 END RETURNING id, size`
+    ],
+    [
+      [i.lockId, i.expiresAt, moveToPending(i.to), i.id, i.from],
+      [i.version],
+      [i.limitBytes]
+    ]
+  );
+  const slot = compose(
+    [
+      `INSERT INTO ${STORAGE_OBJECTS_TABLE} (id, bucket_id, name, owner, owner_id, metadata, version, parent, size, status, lock_id, lock_expires_at, pending) SELECT ?, s.bucket_id, ?, NULL, NULL, '{}', NULL, ?, s.size, 'uploading', s.lock_id, s.lock_expires_at, ? FROM ${STORAGE_OBJECTS_TABLE} AS s WHERE s.id = ? AND s.lock_id = ? AND CASE WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} AS d WHERE d.bucket_id = s.bucket_id AND d.name = ? AND d.status = 'ready') THEN ${marker("exists", slotNonce)} WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} AS d WHERE d.bucket_id = s.bucket_id AND d.name = ?) THEN ${marker("busy", slotNonce)} ELSE 1 END RETURNING id`
+    ],
+    [
+      [
+        i.slotId,
+        i.to,
+        objectParent(i.to),
+        moveFromPending(i.from),
+        i.id,
+        i.lockId,
+        i.to,
+        i.to
+      ]
+    ]
+  );
+  return [source, slot];
+}
+function copySourceGuard(i) {
+  const nonce = nonceOf(i.nonce);
+  return compose(
+    [
+      `SELECT CASE WHEN EXISTS (SELECT 1 FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.id = ? AND o.name = ? AND (`,
+      i.using,
+      `)) THEN 1 ELSE ${marker("source", nonce)} END AS ok`
+    ],
+    [[i.id, i.name]]
+  );
+}
 function claimDelete(i) {
   return compose(
     [
@@ -27023,6 +28415,16 @@ function readObjects(i) {
     [[i.bucket, JSON.stringify([...new Set(i.names)])]]
   );
 }
+function readTransferSource(i) {
+  return compose(
+    [
+      `SELECT o.id, o.version, o.size, o.metadata FROM ${STORAGE_OBJECTS_TABLE} AS o WHERE o.bucket_id = ? AND o.name = ? AND (`,
+      i.using,
+      ")"
+    ],
+    [[i.bucket, i.name]]
+  );
+}
 var SORT_COLUMNS = {
   name: "name",
   created_at: "created_at",
@@ -27114,7 +28516,7 @@ function storageUsing(input) {
   assertFragmentAlias(alias, "storageUsing");
   const on = target(snapshot);
   if ("ok" in on) return on;
-  const status = `(${quoteIdentifier(alias)}.${quoteIdentifier("status")} = 'ready')`;
+  const status = storageReadySql(alias);
   if (context.role === "service")
     return { ok: true, fragment: { sql: status, params: [] } };
   try {
@@ -27204,12 +28606,12 @@ var CONTEXTS = [
     userId: "naro-policy-check",
     email: "check@naro.invalid",
     emailVerified: true
-  }
+  },
+  { role: "authenticated", userId: "naro-policy-check" }
 ];
 function probes(table, context, owners) {
   const writable = table.columns.filter((column2) => !column2.generated);
-  const [first] = table.columns;
-  const filters = first ? [{ operator: "is", column: first.name, value: null }] : [];
+  const filters = leastFilters(table.columns[0]?.name);
   const row = Object.fromEntries(
     writable.map((column2) => [
       column2.name,
@@ -27217,7 +28619,7 @@ function probes(table, context, owners) {
     ])
   );
   const queries = [
-    { version: 1, action: "select", table: table.name, columns: "*" },
+    { version: 1, action: "select", table: table.name, columns: "*", filters },
     { version: 1, action: "insert", table: table.name, rows: [row] },
     {
       version: 1,
@@ -27240,16 +28642,35 @@ function probes(table, context, owners) {
 }
 var STORAGE_PROBE_ALIAS = "o";
 var STORAGE_PROBE_NONCE = "f".repeat(STORAGE_NONCE_MAX_DIGITS);
-var STORAGE_CONTEXTS = [
-  ...CONTEXTS,
-  { role: "authenticated", userId: "naro-policy-check" }
-];
-function storageRefusals(snapshot, table, policies) {
+var UNVERIFIED = {
+  role: "authenticated",
+  userId: "naro-policy-check",
+  emailVerified: false
+};
+function depthContexts(contexts, claims) {
+  if (claims) return [...contexts, UNVERIFIED];
+  return contexts.filter(
+    (context) => context.role !== "authenticated" || context.emailVerified === true
+  );
+}
+function readsClaims(policies) {
+  return policies.some(
+    (policy) => [policy.using, policy.check].some(
+      (text2) => text2 !== null && /auth\s*\.\s*jwt\s*\(/i.test(text2)
+    )
+  );
+}
+function callerName(context) {
+  if (context.role !== "authenticated") return context.role;
+  if (context.emailVerified === true) return "authenticated";
+  return context.emailVerified === false ? "authenticated with no verified email" : "authenticated with no email claims";
+}
+function storageRefusals(snapshot, table, policies, measuring, measured) {
   const refusals = [];
   const row = Object.fromEntries(
     table.columns.map((column2) => [column2.name, ""])
   );
-  for (const context of STORAGE_CONTEXTS) {
+  for (const context of /* @__PURE__ */ new Set([...CONTEXTS, ...measuring])) {
     const using = (commands) => {
       const result = storageUsing({
         snapshot,
@@ -27285,25 +28706,33 @@ function storageRefusals(snapshot, table, policies) {
       overwriteCheckRow({ metadata: "", now: "", version: "" }),
       true
     );
-    for (const statement2 of storageStatements(
+    const moveCheck = check2("update", moveCheckRow({ to: "" }), true);
+    for (const { label: label2, statement: statement2 } of storageStatements(
       select,
       update,
       remove,
       [insertCheck, upsertCheck],
-      updateCheck
+      updateCheck,
+      moveCheck
     )) {
       const problem = storageStatementProblem(statement2, "select");
       if (problem) refusals.push(problem);
+      else if (measuring.includes(context))
+        measured(label2, statement2.sql, callerName(context));
     }
   }
   return refusals;
 }
-function storageStatements(select, update, remove, insertChecks, updateCheck) {
+function storageStatements(select, update, remove, insertChecks, updateCheck, moveCheck) {
   const statements = [];
+  const add = (label2, ...made) => {
+    for (const statement2 of made) statements.push({ label: label2, statement: statement2 });
+  };
   const value = "";
-  for (const insertCheck of insertChecks)
+  for (const [index, insertCheck] of insertChecks.entries())
     if (insertCheck)
-      statements.push(
+      add(
+        index === 0 ? "an upload's claim" : "an upsert's claim",
         claimUpload({
           id: value,
           bucket: value,
@@ -27319,7 +28748,8 @@ function storageStatements(select, update, remove, insertChecks, updateCheck) {
         })
       );
   if (select && update && updateCheck)
-    statements.push(
+    add(
+      "an overwrite's claim",
       claimOverwrite({
         bucket: value,
         name: value,
@@ -27334,8 +28764,28 @@ function storageStatements(select, update, remove, insertChecks, updateCheck) {
         nonce: STORAGE_PROBE_NONCE
       })
     );
+  if (select && update && moveCheck)
+    add(
+      "a move's claim",
+      ...claimMove({
+        id: value,
+        version: value,
+        from: value,
+        to: value,
+        slotId: value,
+        lockId: value,
+        expiresAt: value,
+        limitBytes: 0,
+        selectUsing: select,
+        updateUsing: update,
+        check: moveCheck,
+        nonce: STORAGE_PROBE_NONCE,
+        slotNonce: STORAGE_PROBE_NONCE
+      })
+    );
   if (remove)
-    statements.push(
+    add(
+      "a delete's claim",
       claimDelete({
         bucket: value,
         names: [],
@@ -27344,13 +28794,27 @@ function storageStatements(select, update, remove, insertChecks, updateCheck) {
         expiresAt: value
       })
     );
-  if (select)
-    statements.push(
-      readObject2({ bucket: value, name: value, using: select }),
-      // Several names at once (3-1g): as many values as readObject's, 32
-      // bytes more — the listing below is always wider, but the worker
-      // builds this one too.
-      readObjects({ bucket: value, names: [], using: select }),
+  if (select) {
+    add("a read", readObject2({ bucket: value, name: value, using: select }));
+    add(
+      "a read of several objects",
+      readObjects({ bucket: value, names: [], using: select })
+    );
+    add(
+      "a move's or a copy's read",
+      readTransferSource({ bucket: value, name: value, using: select })
+    );
+    add(
+      "a copy's guard",
+      copySourceGuard({
+        id: value,
+        name: value,
+        using: select,
+        nonce: STORAGE_PROBE_NONCE
+      })
+    );
+    add(
+      "a listing",
       listObjects({
         bucket: value,
         prefix: "p",
@@ -27361,6 +28825,7 @@ function storageStatements(select, update, remove, insertChecks, updateCheck) {
         using: select
       })
     );
+  }
   return statements;
 }
 var REALTIME_PROBE_CHANNEL = "naro-policy-check";
@@ -27373,13 +28838,13 @@ function joinReason(reason) {
     return JOIN_STATEMENT;
   return reason;
 }
-function realtimeRefusals(snapshot, policies) {
+function realtimeRefusals(snapshot, policies, measuring, measured) {
   const refusals = [];
   const applying = (command) => policies.filter(
     (policy) => asciiLower(policy.table) !== REALTIME_MESSAGES || policy.command === command || policy.command === "all"
   );
   for (const set2 of [policies, applying("select"), applying("insert")])
-    for (const context of STORAGE_CONTEXTS) {
+    for (const context of /* @__PURE__ */ new Set([...CONTEXTS, ...measuring])) {
       const plan = privateChannelAccess({
         snapshot,
         context,
@@ -27387,7 +28852,11 @@ function realtimeRefusals(snapshot, policies) {
         channel: REALTIME_PROBE_CHANNEL,
         nonce: REALTIME_PROBE_NONCE
       });
-      if (plan.ok) continue;
+      if (plan.ok) {
+        if ("statement" in plan && measuring.includes(context))
+          measured("a join", plan.statement.sql, callerName(context));
+        continue;
+      }
       const reason = joinReason(plan.reason);
       refusals.push(
         reason === void 0 ? { error: plan.error } : { error: plan.error, reason }
@@ -27429,9 +28898,48 @@ function namedInRefusal(message, policies) {
   }
   return found;
 }
-function problems(snapshot, policies, options) {
+function probeLabel(query) {
+  switch (query.action) {
+    case "select":
+      return "a select";
+    case "insert":
+      return query.returning === void 0 ? "an insert" : "an insert with returning";
+    case "update":
+      return "an update";
+    case "delete":
+      return "a delete";
+  }
+}
+function inlinedTables(sql, probed) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [, written] of sql.matchAll(
+    /FROM ("(?:[^"]|"")*"|[A-Za-z_][A-Za-z0-9_$]*) AS "?_naro_s\d+"?/g
+  )) {
+    if (written === void 0) continue;
+    const name = written.startsWith('"') ? written.slice(1, -1).replaceAll('""', '"') : written;
+    const label2 = name === STORAGE_OBJECTS_TABLE ? STORAGE_OBJECTS : name;
+    if (label2 !== probed) names.add(label2);
+  }
+  return [...names];
+}
+function listed(names) {
+  if (names.length < 2) return names.join("");
+  return `${names.slice(0, -1).join(", ")} and ${names.at(-1) ?? ""}`;
+}
+function tooDeepMessage({
+  table,
+  label: label2,
+  caller,
+  depth,
+  inlined
+}) {
+  const others = inlined.length === 0 ? "" : `, with those of ${listed(inlined)} that they read,`;
+  return `The policies of ${table}${others} nest an expression more than ${String(D1_EXPRESSION_DEPTH)} deep into one statement: ${label2} as ${caller} is ${String(depth)} deep.`;
+}
+function problems(snapshot, policies, options, claims) {
   const found = /* @__PURE__ */ new Map();
   const loaded = loadNamed(policies);
+  const measuring = depthContexts(CONTEXTS, claims ?? readsClaims(loaded));
   for (const policy of loaded)
     if (policy.invalid !== null)
       found.set(`read:${policy.table}:${policy.name}`, {
@@ -27493,24 +29001,30 @@ function problems(snapshot, policies, options) {
     }
   }
   const probe = loadNamed(
-    [...tables.values()].map((table) => ({
-      table: table.name,
-      name: "naro_policy_check",
-      permissive: true,
-      command: "select",
-      roles: ["anon", "authenticated"],
-      using: "true",
-      check: null,
-      owner: null
-    }))
+    [...tables.values()].flatMap((table) => {
+      const roles = POLICY_ROLES.filter(
+        (role) => applicablePolicies(loaded, table.name, "select", role).permissive.length === 0
+      );
+      return roles.length === 0 ? [] : [
+        {
+          table: table.name,
+          name: "naro_policy_check",
+          permissive: true,
+          command: "select",
+          roles,
+          using: "true",
+          check: null,
+          owner: null
+        }
+      ];
+    })
   );
-  const compiled = [...loaded, ...probe];
   const refused = (probed, error51, reason) => {
     if (error51.code !== "POLICY_INVALID") return;
-    const message = reason === void 0 ? error51.message : `${error51.message.replace(/\.$/, "")}: ${reason}.`;
+    const message = reason === STORAGE_UNAVAILABLE_REASON ? STORAGE_UNAVAILABLE_MESSAGE : reason === void 0 ? error51.message : `${error51.message.replace(/\.$/, "")}: ${reason}.`;
     const named = namedInRefusal(error51.message, loaded);
     const blamed2 = named === void 0 ? probed : tableLabelOf(snapshot, named.table);
-    const key = `${blamed2}:${message}`;
+    const key = reason === STORAGE_UNAVAILABLE_REASON ? `${blamed2}:${named?.name ?? ""}:${message}` : `${blamed2}:${message}`;
     if (!found.has(key))
       found.set(key, {
         problem: {
@@ -27522,12 +29036,29 @@ function problems(snapshot, policies, options) {
         policy: ""
       });
   };
+  const deepest = /* @__PURE__ */ new Map();
+  const measured = (table) => (label2, sql, caller) => {
+    const depth = expressionDepth(sql);
+    const key = `depth:${table}:${label2}:${caller}`;
+    if (depth !== void 0 && depth > (deepest.get(key)?.depth ?? D1_EXPRESSION_DEPTH))
+      deepest.set(key, {
+        table,
+        label: label2,
+        caller,
+        depth,
+        inlined: inlinedTables(sql, table)
+      });
+  };
   for (const table of tables.values()) {
     const owners = new Set(
       policiesOn(loaded, table.name).flatMap(
         (policy) => policy.owner ? [asciiLower(policy.owner)] : []
       )
     );
+    const compiled = [
+      ...loaded,
+      ...probe.filter((policy) => policy.table === table.name)
+    ];
     for (const context of CONTEXTS)
       for (const query of probes(table, context, owners)) {
         const decision = decideQuery(context, query, compiled, table.name);
@@ -27538,13 +29069,27 @@ function problems(snapshot, policies, options) {
         };
         if (!result.ok) refused(table.name, result.error, result.reason);
       }
+    for (const context of measuring)
+      for (const query of probes(table, context, owners)) {
+        const real = decideQuery(context, query, loaded, table.name);
+        const made = real.allow ? compile(query, snapshot, real, context) : void 0;
+        if (made?.ok)
+          for (const statement2 of made.statements)
+            measured(table.name)(
+              probeLabel(query),
+              statement2.sql,
+              callerName(context)
+            );
+      }
   }
   if (policiesOn(loaded, STORAGE_OBJECTS).length > 0) {
     if (snapshot.storage)
       for (const { error: error51, reason } of storageRefusals(
         snapshot,
         snapshot.storage,
-        loaded
+        loaded,
+        measuring,
+        measured(STORAGE_OBJECTS)
       ))
         refused(STORAGE_OBJECTS, error51, reason);
     else
@@ -27558,8 +29103,22 @@ function problems(snapshot, policies, options) {
       });
   }
   if (policiesOn(loaded, REALTIME_MESSAGES).length > 0)
-    for (const { error: error51, reason } of realtimeRefusals(snapshot, loaded))
+    for (const { error: error51, reason } of realtimeRefusals(
+      snapshot,
+      loaded,
+      measuring,
+      measured(REALTIME_MESSAGES)
+    ))
       refused(REALTIME_MESSAGES, error51, reason);
+  for (const [key, tooDeep] of deepest)
+    found.set(key, {
+      problem: {
+        table: tooDeep.table,
+        message: tooDeepMessage(tooDeep),
+        kind: "compile"
+      },
+      policy: ""
+    });
   if (options.indexes && options.allowUnindexed !== true)
     for (const problem of unindexedSubqueries(
       snapshot,
@@ -27877,10 +29436,10 @@ function isBlankStart(char) {
 function isBlank(char) {
   return isBlankStart(char) || char === "\v";
 }
-function isWordStart(char) {
+function isWordStart2(char) {
   return /[A-Za-z_]/.test(char) || char.charCodeAt(0) >= 128;
 }
-function isWordPart(char) {
+function isWordPart2(char) {
   return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
 }
 function skipBlanks(text2, from) {
@@ -27934,9 +29493,9 @@ function headTokens(text2) {
       index = close + 1;
     } else if ((char === "x" || char === "X") && text2.charAt(index + 1) === "'") {
       break;
-    } else if (isWordStart(char)) {
+    } else if (isWordStart2(char)) {
       let end = index + 1;
-      while (end < text2.length && isWordPart(text2.charAt(end))) end++;
+      while (end < text2.length && isWordPart2(text2.charAt(end))) end++;
       tokens.push({ kind: "word", text: text2.slice(index, end) });
       index = end;
     } else if (char === "." && !/[0-9]/.test(text2.charAt(index + 1))) {
@@ -27952,6 +29511,10 @@ var NO_NAME = {
   kind: "unreadable",
   reason: "the table name could not be read"
 };
+var NO_COLUMN = {
+  kind: "unreadable",
+  reason: "the column name could not be read"
+};
 var OTHER_SCHEMA = {
   kind: "unreadable",
   reason: "a table in another schema"
@@ -27977,8 +29540,9 @@ var Head = class {
     return token.kind === "word" || token.kind === "name" ? token.text : void 0;
   }
   /**
-   * SQLite's `fullname`. `main.` is the database a migration writes and is
-   * dropped; `temp.` (in any case, quoted or not, as sqlite3FindDbName
+   * SQLite's `fullname`. `main.` is the database a migration writes: the
+   * name goes without it, and `main` says it was written (known-issues
+   * #226); `temp.` (in any case, quoted or not, as sqlite3FindDbName
    * matches it) is a table that goes with the connection; `public.` is
    * what a Postgres migration writes, said in its own words; any other
    * schema is one D1 does not have.
@@ -27987,17 +29551,21 @@ var Head = class {
     const first = this.nameAt(at);
     if (first === void 0) return { ok: false, head: NO_NAME };
     if (this.token(at + 1).kind !== "dot")
-      return { ok: true, name: first, next: at + 1 };
+      return { ok: true, name: first, next: at + 1, main: false };
     const second = this.nameAt(at + 2);
     if (second === void 0) return { ok: false, head: NO_NAME };
     const schema = asciiLower(first);
-    if (schema === "main") return { ok: true, name: second, next: at + 3 };
+    if (schema === "main")
+      return { ok: true, name: second, next: at + 3, main: true };
     let head = OTHER_SCHEMA;
     if (schema === "temp") head = OTHER;
     else if (schema === "public") head = PUBLIC_SCHEMA;
     return { ok: false, head, next: at + 3 };
   }
 };
+function inMain(read) {
+  return read.main ? { main: true } : {};
+}
 function readCreate2(head) {
   if (head.is(1, "policy")) return { kind: "create-policy" };
   if (head.is(1, "temp") || head.is(1, "temporary")) return OTHER;
@@ -28021,9 +29589,24 @@ function readDrop2(head) {
     at += 2;
   }
   const table = head.table(at);
-  return table.ok ? { kind: "drop-table", table: table.name } : table.head;
+  return table.ok ? { kind: "drop-table", table: table.name, ...inMain(table) } : table.head;
 }
 var RLS_ACTIONS = ["enable", "disable", "force", "no"];
+function readRenameColumn(head, table, at) {
+  let from = at;
+  if (head.is(from, "column") && head.nameAt(from + 1) !== void 0 && head.is(from + 2, "to"))
+    from += 1;
+  const column2 = head.nameAt(from);
+  if (column2 === void 0 || !head.is(from + 1, "to")) return NO_COLUMN;
+  const to = head.nameAt(from + 2);
+  return to === void 0 ? NO_COLUMN : {
+    kind: "rename-column",
+    table: table.name,
+    column: column2,
+    to,
+    ...inMain(table)
+  };
+}
 function readAlter(head) {
   if (head.is(1, "policy")) return { kind: "alter-policy" };
   if (!head.is(1, "table")) return OTHER;
@@ -28033,9 +29616,18 @@ function readAlter(head) {
     if (head.is(action, "rename") && head.is(action + 1, "to")) {
       if (!sqlite.ok) return sqlite.head;
       const to = head.table(action + 2);
-      return to.ok ? { kind: "rename-table", table: sqlite.name, to: to.name } : to.head;
+      return to.ok ? {
+        kind: "rename-table",
+        table: sqlite.name,
+        to: to.name,
+        ...inMain(sqlite)
+      } : to.head;
+    }
+    if (head.is(action, "rename")) {
+      if (!sqlite.ok) return sqlite.head;
+      return readRenameColumn(head, sqlite, action + 1);
     }
-    if (head.is(action, "rename") || head.is(action, "add") || head.is(action, "drop"))
+    if (head.is(action, "add") || head.is(action, "drop"))
       return sqlite.ok ? { kind: "alter-table", table: sqlite.name } : sqlite.head;
   }
   let at = 2;
@@ -28060,6 +29652,130 @@ function readSqlHead(text2) {
   return OTHER;
 }
 
+// ../../packages/data-core/src/system-sql.ts
+async function convertLegacyPolicies(db, found) {
+  const rows = rowsOf(await db.prepare(POLICY_SQL.list).all());
+  if (rows.length === 0) return [];
+  const read = rows.map((row) => ({
+    policy: policyFromRow(row),
+    asRead: legacyRowAsRead(row)
+  }));
+  const inForce = new Set(
+    legacyInForce(
+      read.flatMap(({ policy }) => policy ? [policy] : []),
+      await readTableNames(db)
+    )
+  );
+  const statements = [];
+  for (const { policy, asRead } of read) {
+    if (!policy || !asRead) continue;
+    if (inForce.has(policy)) {
+      for (const named of namedFromLegacy(policy))
+        statements.push({
+          sql: POLICY_SQL.insertConverted,
+          params: [...policyValues(named), ...asRead]
+        });
+      found.unreadable.push(...unreadableConversions(policy));
+    }
+    statements.push({ sql: POLICY_SQL.markConverted, params: asRead });
+  }
+  return statements;
+}
+var MIGRATIONS_TABLE = "CREATE TABLE IF NOT EXISTS _naro_migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL DEFAULT (datetime('now')))";
+var STORAGE_SUBQUERIES_VERSION = 7;
+var STORAGE_SUBQUERIES_NAME = "storage_subquery_policies";
+var STORAGE_SUBQUERIES_SQL = `SELECT version FROM _naro_migrations WHERE version = ${String(STORAGE_SUBQUERIES_VERSION)} AND name = '${STORAGE_SUBQUERIES_NAME}'`;
+var SYSTEM_MIGRATIONS = [
+  {
+    version: 1,
+    name: "system_tables",
+    statements: [
+      MIGRATIONS_TABLE,
+      "CREATE TABLE IF NOT EXISTS _naro_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')))",
+      // Spec §11.2, as written there.
+      "CREATE TABLE IF NOT EXISTS _naro_policies (table_name TEXT PRIMARY KEY, select_rule TEXT NOT NULL DEFAULT 'none', insert_rule TEXT NOT NULL DEFAULT 'none', update_rule TEXT NOT NULL DEFAULT 'none', delete_rule TEXT NOT NULL DEFAULT 'none', owner_column TEXT, updated_at TEXT NOT NULL DEFAULT (datetime('now')))"
+    ]
+  },
+  {
+    // Spec P2-2 §3.1: an action whose rule column says 'condition' reads its
+    // condition from these. A worker from before them reads 'condition' as
+    // an unknown rule — none.
+    version: 2,
+    name: "policy_conditions",
+    statements: [],
+    addColumns: ["select", "insert", "update", "delete"].map((action) => ({
+      table: "_naro_policies",
+      column: `${action}_condition`,
+      definition: "TEXT"
+    }))
+  },
+  {
+    // Spec P2-6 §11: the Naro worker's sign-in handoff. A provider sign-in's
+    // flow (state → the app's redirect and the browser's PKCE challenge), the
+    // one-time codes a redirect hands the app, the sends the per-address
+    // email limit counts, and (adversarial review I3) the unconfirmed
+    // accounts someone else also tried to sign up as. Times are epoch
+    // milliseconds.
+    version: 3,
+    name: "auth_handoff",
+    statements: [
+      "CREATE TABLE IF NOT EXISTS _naro_auth_flows (state TEXT PRIMARY KEY, provider TEXT NOT NULL, code_challenge TEXT NOT NULL, redirect_to TEXT NOT NULL, expires_at INTEGER NOT NULL)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_codes (code_hash TEXT PRIMARY KEY, code_challenge TEXT NOT NULL, session_token TEXT NOT NULL, sealed_token TEXT NOT NULL, expires_at INTEGER NOT NULL)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_email_log (address_hash TEXT NOT NULL, sent_at INTEGER NOT NULL)",
+      "CREATE INDEX IF NOT EXISTS _naro_auth_email_log_address ON _naro_auth_email_log (address_hash, sent_at)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_contested (user_id TEXT PRIMARY KEY, contested_at INTEGER NOT NULL)"
+    ]
+  },
+  {
+    // P2-7 §9: named policies, many per table. The old rows are converted
+    // in the same batch and their rules set to a word old workers read as
+    // `none`.
+    version: 4,
+    name: "named_policies",
+    statements: [NAMED_POLICY_TABLE_SQL],
+    compute: convertLegacyPolicies
+  },
+  {
+    // Storage (first-release design §6): the buckets and the objects' index
+    // with their counter triggers. Every backend gets them, Storage on or
+    // not — what turns it on is the worker's R2 binding. A worker from
+    // before them never reads them.
+    version: 5,
+    name: "storage",
+    statements: [...STORAGE_TABLES_SQL]
+  },
+  {
+    // Storage 3-1b (known-issues #107, first-release design §14): the mark
+    // a bucket's removal sets before it empties the bucket. The claims and
+    // the worker's bucket reads take a marked bucket as not there. A worker
+    // from before it never reads the column.
+    version: 6,
+    name: "storage_bucket_deleting",
+    statements: [],
+    addColumns: [STORAGE_BUCKET_DELETING_COLUMN]
+  },
+  {
+    // Storage 3-1j (plan correction (p)): no schema — the mark that a worker
+    // which reads storage.objects in a policy's subquery has migrated this
+    // database. Only the Naro worker's own `internal/migrate` applies system
+    // migrations, so the row is there once such a worker has run, and stays:
+    // every later worker reads them too — as long as the worker bundle does
+    // not go back. Deploying web from before 3-1j makes the next upgrade
+    // put an older worker back, and a run that lost its lease may upload
+    // one late; such a policy then answers 500 POLICY_INVALID (closed, no
+    // rows) until it is dropped or the newer worker is uploaded again
+    // (3-1j 최종 리뷰). Migration 5 alone cannot tell —
+    // backends migrated by 3-1a to 3-1i have it, and their worker refuses
+    // such a policy ("A policy cannot read storage.objects in a subquery
+    // yet") and answers every request of its table 500 POLICY_INVALID until
+    // the next upgrade. The control plane takes one only where this row is
+    // (`STORAGE_SUBQUERIES_SQL`, `buildPolicyBatch`).
+    version: STORAGE_SUBQUERIES_VERSION,
+    name: STORAGE_SUBQUERIES_NAME,
+    statements: []
+  }
+];
+
 // ../../packages/data-core/src/policy-migration.ts
 var GRANT_REFUSAL = "naro has no GRANT or REVOKE: every table is behind row-level security, so write a policy instead (CREATE POLICY \u2026).";
 function disableRefusal(table) {
@@ -28077,6 +29793,7 @@ function tablesChanged(head) {
     case "create-table":
     case "drop-table":
     case "alter-table":
+    case "rename-column":
       return [asciiLower(head.table)];
     case "rename-table":
       return [asciiLower(head.table), asciiLower(head.to)];
@@ -28104,18 +29821,28 @@ function tablesInScope(policy) {
   }
   return tables;
 }
+function readsStorageObjects(policy) {
+  return [policy.using, policy.check].some((text2) => {
+    if (text2 === null) return false;
+    const parsed = parseExpression(text2);
+    return parsed.ok && subqueriesOf(parsed.expr).some(
+      (subquery) => isStorageObjects(subquery.table)
+    );
+  });
+}
 function planPolicyMigration(statements) {
   const count2 = statements.length;
   const planned = [];
   let hasPolicyStatements = false;
   let touchesTables = false;
+  let renamesColumns = false;
   const heads = statements.map((text2) => readSqlHead(text2));
   const changes = heads.map(tablesChanged);
   const changedAfter = (index, tables) => changes.slice(index + 1).some(
     (changed) => changed === "any" || changed.some((table) => tables.has(table))
   );
   for (const [index, text2] of statements.entries()) {
-    const refuse = (message) => ({
+    const refuse2 = (message) => ({
       ok: false,
       index,
       message: `Statement ${String(index + 1)} of ${String(count2)}: ${message}`
@@ -28124,15 +29851,19 @@ function planPolicyMigration(statements) {
     switch (head.kind) {
       case "grant":
       case "revoke":
-        return refuse(GRANT_REFUSAL);
+        return refuse2(GRANT_REFUSAL);
       case "unreadable":
-        return refuse(`${head.reason}.`);
+        return refuse2(`${head.reason}.`);
       case "create-table":
       case "drop-table":
       case "rename-table":
         touchesTables = true;
         planned.push({ kind: "verbatim", text: text2, head });
         continue;
+      case "rename-column":
+        renamesColumns = true;
+        planned.push({ kind: "verbatim", text: text2, head });
+        continue;
       case "alter-table":
       case "other":
         planned.push({ kind: "verbatim", text: text2, head });
@@ -28142,17 +29873,17 @@ function planPolicyMigration(statements) {
     }
     const parsed = parseMigrationPolicyStatement(text2);
     if (!parsed.ok)
-      return refuse(
+      return refuse2(
         `${parsed.reason} at character ${String(parsed.position)}.`
       );
     const statement2 = parsed.statement;
     const table = statement2.kind === "create" ? statement2.policy.table : statement2.table;
     if (!isStorageObjects(table) && isSystemTable(table))
-      return refuse(`${relationMissing(table)}.`);
+      return refuse2(`${relationMissing(table)}.`);
     switch (statement2.kind) {
       case "create":
         if (readsBareSubqueryColumn(statement2.policy) && changedAfter(index, tablesInScope(statement2.policy)))
-          return refuse(LATER_TABLE_CHANGE);
+          return refuse2(LATER_TABLE_CHANGE);
         hasPolicyStatements = true;
         planned.push({ kind: "create-policy", policy: statement2.policy });
         break;
@@ -28180,14 +29911,19 @@ function planPolicyMigration(statements) {
         break;
       case "rls":
         if (statement2.action === "disable")
-          return refuse(disableRefusal(table));
+          return refuse2(disableRefusal(table));
         planned.push({ kind: "noop" });
         break;
     }
   }
   return {
     ok: true,
-    plan: { statements: planned, hasPolicyStatements, touchesTables }
+    plan: {
+      statements: planned,
+      hasPolicyStatements,
+      touchesTables,
+      renamesColumns
+    }
   };
 }
 function policyMigrationSql(policy) {
@@ -28202,6 +29938,7 @@ function unreadablePolicyComment(policy) {
 var STORED_POLICIES_SQL = `SELECT table_name, name, kind, command, roles, using_expr, check_expr, owner_column, updated_at FROM ${NAMED_POLICY_TABLE} ORDER BY table_name, name`;
 var SYSTEM_PREDICATE = systemTablePredicate("name");
 var STORAGE_EXISTS = `EXISTS (SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ${sqlStringLiteral(STORAGE_OBJECTS_TABLE)})`;
+var STORAGE_SUBQUERIES_READY = `EXISTS (${STORAGE_SUBQUERIES_SQL})`;
 
 // ../../packages/data-core/src/realtime-limits.ts
 var HOBBY_REALTIME_LIMITS = Object.freeze({
@@ -28290,107 +30027,6 @@ var MULTIPART_COMPLETE_LOCK_MS = 15 * 60 * 1e3;
 var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var UPLOAD_ID = new RegExp(`^(${UUID})\\.(${UUID})$`);
 
-// ../../packages/data-core/src/system-sql.ts
-async function convertLegacyPolicies(db, found) {
-  const rows = rowsOf(await db.prepare(POLICY_SQL.list).all());
-  if (rows.length === 0) return [];
-  const read = rows.map((row) => ({
-    policy: policyFromRow(row),
-    asRead: legacyRowAsRead(row)
-  }));
-  const inForce = new Set(
-    legacyInForce(
-      read.flatMap(({ policy }) => policy ? [policy] : []),
-      await readTableNames(db)
-    )
-  );
-  const statements = [];
-  for (const { policy, asRead } of read) {
-    if (!policy || !asRead) continue;
-    if (inForce.has(policy)) {
-      for (const named of namedFromLegacy(policy))
-        statements.push({
-          sql: POLICY_SQL.insertConverted,
-          params: [...policyValues(named), ...asRead]
-        });
-      found.unreadable.push(...unreadableConversions(policy));
-    }
-    statements.push({ sql: POLICY_SQL.markConverted, params: asRead });
-  }
-  return statements;
-}
-var MIGRATIONS_TABLE = "CREATE TABLE IF NOT EXISTS _naro_migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL DEFAULT (datetime('now')))";
-var SYSTEM_MIGRATIONS = [
-  {
-    version: 1,
-    name: "system_tables",
-    statements: [
-      MIGRATIONS_TABLE,
-      "CREATE TABLE IF NOT EXISTS _naro_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')))",
-      // Spec §11.2, as written there.
-      "CREATE TABLE IF NOT EXISTS _naro_policies (table_name TEXT PRIMARY KEY, select_rule TEXT NOT NULL DEFAULT 'none', insert_rule TEXT NOT NULL DEFAULT 'none', update_rule TEXT NOT NULL DEFAULT 'none', delete_rule TEXT NOT NULL DEFAULT 'none', owner_column TEXT, updated_at TEXT NOT NULL DEFAULT (datetime('now')))"
-    ]
-  },
-  {
-    // Spec P2-2 §3.1: an action whose rule column says 'condition' reads its
-    // condition from these. A worker from before them reads 'condition' as
-    // an unknown rule — none.
-    version: 2,
-    name: "policy_conditions",
-    statements: [],
-    addColumns: ["select", "insert", "update", "delete"].map((action) => ({
-      table: "_naro_policies",
-      column: `${action}_condition`,
-      definition: "TEXT"
-    }))
-  },
-  {
-    // Spec P2-6 §11: the Naro worker's sign-in handoff. A provider sign-in's
-    // flow (state → the app's redirect and the browser's PKCE challenge), the
-    // one-time codes a redirect hands the app, the sends the per-address
-    // email limit counts, and (adversarial review I3) the unconfirmed
-    // accounts someone else also tried to sign up as. Times are epoch
-    // milliseconds.
-    version: 3,
-    name: "auth_handoff",
-    statements: [
-      "CREATE TABLE IF NOT EXISTS _naro_auth_flows (state TEXT PRIMARY KEY, provider TEXT NOT NULL, code_challenge TEXT NOT NULL, redirect_to TEXT NOT NULL, expires_at INTEGER NOT NULL)",
-      "CREATE TABLE IF NOT EXISTS _naro_auth_codes (code_hash TEXT PRIMARY KEY, code_challenge TEXT NOT NULL, session_token TEXT NOT NULL, sealed_token TEXT NOT NULL, expires_at INTEGER NOT NULL)",
-      "CREATE TABLE IF NOT EXISTS _naro_auth_email_log (address_hash TEXT NOT NULL, sent_at INTEGER NOT NULL)",
-      "CREATE INDEX IF NOT EXISTS _naro_auth_email_log_address ON _naro_auth_email_log (address_hash, sent_at)",
-      "CREATE TABLE IF NOT EXISTS _naro_auth_contested (user_id TEXT PRIMARY KEY, contested_at INTEGER NOT NULL)"
-    ]
-  },
-  {
-    // P2-7 §9: named policies, many per table. The old rows are converted
-    // in the same batch and their rules set to a word old workers read as
-    // `none`.
-    version: 4,
-    name: "named_policies",
-    statements: [NAMED_POLICY_TABLE_SQL],
-    compute: convertLegacyPolicies
-  },
-  {
-    // Storage (first-release design §6): the buckets and the objects' index
-    // with their counter triggers. Every backend gets them, Storage on or
-    // not — what turns it on is the worker's R2 binding. A worker from
-    // before them never reads them.
-    version: 5,
-    name: "storage",
-    statements: [...STORAGE_TABLES_SQL]
-  },
-  {
-    // Storage 3-1b (known-issues #107, first-release design §14): the mark
-    // a bucket's removal sets before it empties the bucket. The claims and
-    // the worker's bucket reads take a marked bucket as not there. A worker
-    // from before it never reads the column.
-    version: 6,
-    name: "storage_bucket_deleting",
-    statements: [],
-    addColumns: [STORAGE_BUCKET_DELETING_COLUMN]
-  }
-];
-
 // ../../packages/data-core/src/write-quota.ts
 var WRITE_QUOTA_KEY = "write_quota";
 var WRITE_QUOTA_SQL = {
@@ -28636,12 +30272,12 @@ import {
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function linkDir(dir) {
-  return join22(dir, ".naro");
+  return join23(dir, ".naro");
 }
 function linkFile(dir) {
-  return join22(linkDir(dir), "project.json");
+  return join23(linkDir(dir), "project.json");
 }
 function readProjectLink(dir) {
   try {
@@ -28663,7 +30299,7 @@ function writeProjectLink(dir, link) {
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
   writeFileSync2(
-    join22(linkDir(dir), "README.txt"),
+    join23(linkDir(dir), "README.txt"),
     "This directory links the project to Naro and should not be committed.\n"
   );
 }
@@ -28673,9 +30309,9 @@ function removeProjectLink(dir) {
   return true;
 }
 function ensureGitignoreHasNaro(dir) {
-  const gitignorePath = join22(dir, ".gitignore");
+  const gitignorePath = join23(dir, ".gitignore");
   const hasGitignore = existsSync4(gitignorePath);
-  if (!hasGitignore && !existsSync4(join22(dir, ".git"))) return false;
+  if (!hasGitignore && !existsSync4(join23(dir, ".git"))) return false;
   const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
   const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
   if (covered) return false;
@@ -29128,15 +30764,15 @@ function policiesFromFiles(files) {
     policies = policies.filter((policy) => !sameTable(policy.table, table));
   };
   for (const [file2, sql] of files.entries()) {
-    const split = splitStatements(sql);
-    if (!split.ok)
+    const split2 = splitStatements(sql);
+    if (!split2.ok)
       return {
         policies,
         tables,
-        refused: { file: file2, reason: `sql could not be parsed: ${split.reason}.` }
+        refused: { file: file2, reason: `sql could not be parsed: ${split2.reason}.` }
       };
     const planned = planPolicyMigration(
-      split.statements.map((statement2) => statement2.text)
+      split2.statements.map((statement2) => statement2.text)
     );
     if (!planned.ok)
       return {
@@ -29204,6 +30840,31 @@ function policiesLostByReset(input) {
     withTables: gone.filter((policy) => !remade.has(asciiLower(policy.table)))
   };
 }
+function storageRefusalOfFiles(files, backend) {
+  for (const [file2, sql] of files.entries()) {
+    const split2 = splitStatements(sql);
+    if (!split2.ok) return void 0;
+    const planned = planPolicyMigration(
+      split2.statements.map((statement2) => statement2.text)
+    );
+    if (!planned.ok) return void 0;
+    const count2 = planned.plan.statements.length;
+    for (const [index, statement2] of planned.plan.statements.entries()) {
+      let needs;
+      if (statement2.kind === "create-policy")
+        needs = readsStorageObjects(statement2.policy) ? "subqueries" : sameTable(statement2.policy.table, STORAGE_OBJECTS) ? "storage" : void 0;
+      else if (statement2.kind === "drop-policy" && !statement2.ifExists || statement2.kind === "owner")
+        needs = sameTable(statement2.table, STORAGE_OBJECTS) ? "storage" : void 0;
+      const missing = needs === "subqueries" ? !backend.storage || !backend.storageSubqueries : needs === "storage" && !backend.storage;
+      if (needs !== void 0 && missing)
+        return { file: file2, statement: index + 1, count: count2, needs };
+    }
+  }
+  return void 0;
+}
+function resetStorageOutdatedMessage(file2, at) {
+  return `${file2} needs storage.objects (statement ${String(at.statement)} of ${String(at.count)}), which is not available on this backend yet, so the reset would stop there with the schema already dropped. Nothing was changed. Run \`naro backend enable\` to update it, then try again.`;
+}
 function resetPoliciesLostMessage(lost) {
   return `These ${String(lost.length)} policies are not in your migration files and will be gone after the reset: ${lost.map((policy) => `${policy.table}.${policy.name}`).join(", ")}. To keep them, add this to a migration first:`;
 }
@@ -29282,7 +30943,7 @@ function usageStatus(report, currentMonth, requests) {
 
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
 var PUBLIC_PREFIX = "NEXT_PUBLIC_";
 function maskSecretValue(value) {
@@ -29294,7 +30955,7 @@ function maskEnvValue(key, value) {
   return maskSecretValue(value);
 }
 function findDotenvFile(dir) {
-  for (const name of DOTENV_FILES) if (existsSync6(join23(dir, name))) return name;
+  for (const name of DOTENV_FILES) if (existsSync6(join24(dir, name))) return name;
   return null;
 }
 function envAddGuidance(keys, environment) {
@@ -29525,9 +31186,9 @@ import {
   cp as cp2,
   lstat,
   mkdir as mkdir3,
-  readFile as readFile13,
+  readFile as readFile14,
   readlink,
-  realpath,
+  realpath as realpath3,
   rm as rm4,
   stat as stat3,
   symlink,
@@ -29538,10 +31199,10 @@ import {
   basename as basename3,
   dirname as dirname5,
   isAbsolute as isAbsolute4,
-  join as join24,
+  join as join25,
   relative as relative6,
   resolve as resolve10,
-  sep as sep4
+  sep as sep5
 } from "path";
 var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 var ENV_FILE = /^\.env(\.(?!(?:example|sample|template)$)[^\\/]+)?$/i;
@@ -29579,7 +31240,7 @@ async function committedEnvFiles(sourceDir) {
 }
 async function staysInside(link, text2, root) {
   try {
-    return inside(await realpath(link), root);
+    return inside(await realpath3(link), root);
   } catch (error51) {
     return error51.code === "ENOENT" && !text2.split(/[\\/]/).includes("..");
   }
@@ -29602,12 +31263,12 @@ async function keptOnly(items, keep, remove) {
 async function readLocal(path) {
   const found = await stat3(path).catch(() => null);
   if (!found?.isFile()) return null;
-  return readFile13(path).catch(() => null);
+  return readFile14(path).catch(() => null);
 }
 async function realAncestor(dir) {
   for (let current = dir; ; current = dirname5(current)) {
     try {
-      return await realpath(current);
+      return await realpath3(current);
     } catch {
       if (dirname5(current) === current)
         throw new Error(`No ancestor of ${dir}`);
@@ -29618,7 +31279,7 @@ function sameText(a, b) {
   return a.equals(b) || a.toString("utf8").replace(/\r\n/g, "\n") === b.toString("utf8").replace(/\r\n/g, "\n");
 }
 async function copyWorkingTree(source, checkout) {
-  const sourceDir = await realpath(source);
+  const sourceDir = await realpath3(source);
   const inWorkingTree = [];
   const absoluteLinks = [];
   const linksOutside = [];
@@ -29637,12 +31298,12 @@ async function copyWorkingTree(source, checkout) {
       if (entry.isFIFO() || entry.isSocket() || entry.isCharacterDevice() || entry.isBlockDevice())
         return false;
       if (ENV_FILE.test(basename3(src)) && !entry.isDirectory()) {
-        inWorkingTree.push(relative6(sourceDir, src).split(sep4).join("/"));
+        inWorkingTree.push(relative6(sourceDir, src).split(sep5).join("/"));
         return false;
       }
       if (entry.isSymbolicLink()) {
         const target2 = await readlink(src);
-        const path = relative6(sourceDir, src).split(sep4).join("/");
+        const path = relative6(sourceDir, src).split(sep5).join("/");
         if (isAbsolute4(target2)) {
           absoluteLinks.push(path);
           return false;
@@ -29660,17 +31321,17 @@ async function copyWorkingTree(source, checkout) {
       return true;
     }
   });
-  const root = await realpath(checkout);
+  const root = await realpath3(checkout);
   const strays = await keptOnly(
     keptLinks,
     async ({ path, text: text2 }) => {
       try {
-        return inside(await realpath(join24(checkout, path)), root);
+        return inside(await realpath3(join25(checkout, path)), root);
       } catch (error51) {
         return error51.code === "ENOENT" && climbsOnlyFirst(text2);
       }
     },
-    ({ path }) => unlink(join24(checkout, path))
+    ({ path }) => unlink(join25(checkout, path))
   );
   linksElsewhere.push(...strays.map(({ path }) => path));
   const committed = await committedEnvFiles(sourceDir);
@@ -29684,7 +31345,7 @@ async function copyWorkingTree(source, checkout) {
       outsideProject.push(path);
       continue;
     }
-    const target2 = join24(checkout, path);
+    const target2 = join25(checkout, path);
     if (!inside(await realAncestor(dirname5(target2)), root)) {
       outsideProject.push(path);
       continue;
@@ -29709,16 +31370,16 @@ async function copyWorkingTree(source, checkout) {
       continue;
     }
     await writeFile7(target2, content, { flag: "wx" });
-    const local = await readLocal(join24(sourceDir, path));
+    const local = await readLocal(join25(sourceDir, path));
     if (!local || !sameText(local, content)) committedVersion.push(path);
   }
   const envStrays = await keptOnly(
     envLinks,
     async (path) => {
-      const real = await realpath(join24(checkout, path)).catch(() => null);
+      const real = await realpath3(join25(checkout, path)).catch(() => null);
       return real !== null && inside(real, root);
     },
-    (path) => unlink(join24(checkout, path))
+    (path) => unlink(join25(checkout, path))
   );
   outsideProject.push(...envStrays);
   const inCommit = new Set(
@@ -29835,7 +31496,7 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile14(join25(sourceDir, "package.json"), "utf8")
+      await readFile15(join26(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
@@ -29845,7 +31506,7 @@ async function projectName(sourceDir) {
 function resolveBin(name) {
   let dir = dirname6(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = join25(dir, "node_modules", ".bin", name);
+    const candidate = join26(dir, "node_modules", ".bin", name);
     if (existsSync7(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) return name;
@@ -29912,7 +31573,7 @@ function workingTreeNotices(copy) {
 }
 function localDependencies(sourceDir, say = () => void 0) {
   return {
-    createWorkspace: () => mkdtemp2(join25(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join26(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm5(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -29950,7 +31611,12 @@ function localDependencies(sourceDir, say = () => void 0) {
 async function deployDirectory(sourceDir, options, log2) {
   const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
-  const environment = production ? void 0 : options.environment;
+  if (production && options.environment !== void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "environment and production cannot be used together."
+    );
+  const environment = options.environment;
   if (environment === "production" || environment === "preview")
     throw new NaroError(
       "VALIDATION_FAILED",
@@ -30147,6 +31813,7 @@ export {
   splitStatements,
   ANALYTICS_FILTER_KEYS,
   NaroError,
+  promoteTargetUnsupported,
   isNaroError,
   toNaroError,
   saveSession,
@@ -30178,12 +31845,14 @@ export {
   cellText,
   renderRows,
   summarizeStatement,
-  parseDotenv,
+  parseDotenvDetailed,
   serializeDotenv,
   MAX_SINGLE_UPLOAD_BYTES,
+  checkObjectName,
   parseCacheControl,
   STORAGE_OBJECTS_TABLE,
   systemTablePredicate,
+  dataError,
   SCHEMA_SQL,
   tableNames,
   snapshotFromRows,
@@ -30198,6 +31867,7 @@ export {
   indexesFromRows,
   parsePolicyStatement,
   splitPolicyStatements,
+  STORAGE_SUBQUERIES_SQL,
   planPolicyMigration,
   unreadablePolicyComment,
   parseRedirectEntry,
@@ -30220,6 +31890,8 @@ export {
   RESET_BACKEND_OUTDATED,
   buildResetPlan,
   policiesLostByReset,
+  storageRefusalOfFiles,
+  resetStorageOutdatedMessage,
   resetPoliciesLostMessage,
   resetPoliciesWithTablesMessage,
   resetFileRefusedMessage,
@@ -30230,7 +31902,7 @@ export {
   promptForMissingEnv,
   pullEnv,
   detectGitInfo,
-  parseDotenv2,
+  parseDotenv2 as parseDotenv,
   readProjectEnv2 as readProjectEnv,
   eventsObserver,
   slugify2 as slugify,