naro-cli 0.20.0 → 0.22.0

package/dist/{chunk-SAA66XLD.js → chunk-MBSO3K6L.js}

@@ -326,6 +326,162 @@ var STALL_WINDOW_MS = 10 * 6e4;
 // ../../packages/core/src/deployment-strategy.ts
 var MIN_SUPPORTED_NEXT_MAJOR = 15;
 
+// ../../packages/core/src/environment-guidance.ts
+var DATA_COMMANDS = /* @__PURE__ */ new Set([
+  "db",
+  "migration",
+  "gen",
+  "backend",
+  "policy",
+  "storage",
+  "realtime"
+]);
+var BACKEND_SWITCHES = /* @__PURE__ */ new Set([
+  "enable",
+  "provision",
+  "disable"
+]);
+var PRODUCTION_SWITCH_NOTE = "production's switch, which every environment follows";
+var SWITCH_CONTEXT = /\bturned off\b|\bturn(?:s|ing)? (?:it|them) (?:back )?on\b|\bbackend is on\b/i;
+var SUBCOMMANDS = {
+  db: /* @__PURE__ */ new Set([
+    "info",
+    "enable",
+    "query",
+    "push",
+    "dump",
+    "restore",
+    "pull",
+    "reset",
+    "lint",
+    "table",
+    "index",
+    "create",
+    "add-column",
+    "rename-column",
+    "rename",
+    "drop-column",
+    "drop"
+  ]),
+  migration: /* @__PURE__ */ new Set(["list", "ls", "new", "up", "repair"]),
+  gen: /* @__PURE__ */ new Set(["types"]),
+  backend: /* @__PURE__ */ new Set([
+    "info",
+    "status",
+    "enable",
+    "provision",
+    "disable",
+    "keys",
+    "rotate",
+    "auth",
+    "email",
+    "oauth",
+    "redirects",
+    "require-verification",
+    "signups",
+    "password",
+    "set",
+    "add",
+    "remove",
+    "users",
+    "create",
+    "delete"
+  ]),
+  policy: /* @__PURE__ */ new Set(["list", "ls", "set", "create", "drop", "remove", "rm"]),
+  storage: /* @__PURE__ */ new Set([
+    "enable",
+    "disable",
+    "bucket",
+    "list",
+    "create",
+    "update",
+    "empty",
+    "remove",
+    "cp",
+    "mv",
+    "ls",
+    "rm"
+  ]),
+  realtime: /* @__PURE__ */ new Set(["enable", "disable", "tables", "add", "remove"])
+};
+function kindOf(words) {
+  const command = words[1] ?? "";
+  if (!DATA_COMMANDS.has(command)) return "leave";
+  if (words.some((word) => word === "--env" || word.startsWith("--env=")))
+    return "leave";
+  if (command === "migration" && words[2] === "new") return "leave";
+  if (command === "backend" && BACKEND_SWITCHES.has(words[2] ?? ""))
+    return words.length === 3 ? "switch" : "leave";
+  return "env";
+}
+function quoted(span, slug, switchContext) {
+  const words = span.split(" ");
+  switch (kindOf(words)) {
+    case "env":
+      return `\`${span} --env ${slug}\``;
+    case "switch":
+      return words[2] !== "disable" && !switchContext ? `\`naro environments provision ${slug}\`` : `\`${span}\` (${PRODUCTION_SWITCH_NOTE})`;
+    default:
+      return `\`${span}\``;
+  }
+}
+var QUOTED = /`(naro [^`\n]+)`/g;
+var BARE = /(?<![`\w/-])naro ([a-z]+)((?: [a-z][a-z-]*)*)/g;
+function bare(match, command, rest, after, slug, switchContext) {
+  const vocabulary = SUBCOMMANDS[command];
+  if (vocabulary === void 0) return match;
+  const words = rest.split(" ").filter((word) => word !== "");
+  let count2 = 0;
+  while (count2 < words.length && vocabulary.has(words[count2] ?? "")) count2++;
+  if (count2 === 0) return match;
+  const head = ["naro", command, ...words.slice(0, count2)];
+  const tail = words.slice(count2);
+  const following = after.split(/\n|[.;,)](?:\s|$)/, 1)[0] ?? "";
+  if (/(?:^|\s)--env[\s=]/.test(following) || after.startsWith(` \u2014 ${PRODUCTION_SWITCH_NOTE}`))
+    return match;
+  const shown = head.join(" ");
+  const remainder = tail.length > 0 ? ` ${tail.join(" ")}` : "";
+  switch (kindOf(head)) {
+    case "env":
+      return `${shown} --env ${slug}${remainder}`;
+    case "switch":
+      return head[2] !== "disable" && !switchContext ? `naro environments provision ${slug}${remainder}` : `${shown} \u2014 ${PRODUCTION_SWITCH_NOTE}${remainder}`;
+    default:
+      return match;
+  }
+}
+function environmentGuidance(text2, slug) {
+  if (slug === null || !text2.includes("naro ")) return text2;
+  const switchContext = SWITCH_CONTEXT.test(text2);
+  const spans = [];
+  const marked = text2.replaceAll(
+    QUOTED,
+    (match, span, offset) => {
+      const noted = text2.startsWith(
+        ` (${PRODUCTION_SWITCH_NOTE})`,
+        offset + match.length
+      );
+      spans.push(noted ? match : quoted(span, slug, switchContext));
+      return `\uE000${String(spans.length - 1)}\uE000`;
+    }
+  );
+  const rewritten = marked.replaceAll(
+    BARE,
+    (match, command, rest, offset) => bare(
+      match,
+      command,
+      rest,
+      marked.slice(offset + match.length),
+      slug,
+      switchContext
+    )
+  );
+  return rewritten.replaceAll(
+    /\uE000(\d+)\uE000/g,
+    (_match, index) => spans[Number(index)] ?? ""
+  );
+}
+
 // ../../packages/core/src/errors.ts
 var DEPLOYMENT_ERROR_CODES = [
   "CLONE_FAILED",
@@ -436,7 +592,11 @@ var DEPLOYMENT_ERROR_CODES = [
   "ENVIRONMENT_BRANCH_IS_PRODUCTION",
   /** The plan's environment count is full. */
   "ENVIRONMENT_LIMIT_REACHED",
-  /** The project uses a Naro database, which environments do not support yet (stages 1 and 2 only). */
+  /**
+   * The project uses a Naro database, which environments did not yet support
+   * (stages 1 and 2 only). No route answers it since named environments 3c;
+   * kept for clients of a control plane from before.
+   */
   "ENVIRONMENT_DATABASE_UNSUPPORTED",
   "ENVIRONMENT_NOT_FOUND",
   /** The project's new default branch is the one an environment deploys. */
@@ -460,6 +620,9 @@ var DeploymentError = class extends Error {
   }
 };
 
+// ../../packages/core/src/functions.ts
+var FUNCTION_WORKER_NAME_PREFIX = "naro-fn-";
+
 // ../../packages/core/src/git-remote.ts
 var SCP_LIKE = /^[^@\s/]+@([^:\s/]+):(.+)$/;
 function parseGitHubRemote(url2) {
@@ -15064,6 +15227,8 @@ function subdomainProblem(value) {
   if (value.endsWith("-preview")) return "reserved";
   if (value === BACKEND_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(BACKEND_WORKER_NAME_PREFIX))
     return "reserved";
+  if (value === FUNCTION_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(FUNCTION_WORKER_NAME_PREFIX))
+    return "reserved";
   if (RESERVED_SUBDOMAINS.includes(value))
     return "reserved";
   return null;
@@ -15399,6 +15564,72 @@ function workerNameForSurface(subdomain, surface) {
   }
 }
 
+// ../../packages/core/src/usage-alert-mail.ts
+var REQUESTS = {
+  en: {
+    subject80: (team) => `${team} has used 80% of its monthly requests`,
+    subject100: (team) => `${team} has reached its monthly request limit`,
+    usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} requests the Hobby plan includes for ${month}.`,
+    warning: "When it reaches the limit, requests past it may be blocked until the month ends (UTC).",
+    blocked: "Sites on this team answer 503 until the month ends (UTC).",
+    running: "Sites keep running for now.",
+    button: "View usage",
+    footer: (team) => `You're receiving this because you're an owner or billing member of ${team} on naro.`
+  },
+  ko: {
+    subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
+    subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uC694\uCCAD \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
+    usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uC694\uCCAD ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
+    warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uADF8 \uB4A4 \uC694\uCCAD\uC774 \uB9C9\uD790 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0AC\uC774\uD2B8\uB294 503\uC73C\uB85C \uC751\uB2F5\uD569\uB2C8\uB2E4.",
+    running: "\uC9C0\uAE08\uC740 \uC0AC\uC774\uD2B8\uAC00 \uACC4\uC18D \uB3D9\uC791\uD569\uB2C8\uB2E4.",
+    button: "\uC0AC\uC6A9\uB7C9 \uBCF4\uAE30",
+    footer: (team) => `naro\uC5D0\uC11C ${team} \uD300\uC758 owner \uB610\uB294 billing \uC5ED\uD560\uC774\uB77C \uC774 \uBA54\uC77C\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4.`
+  },
+  ja: {
+    subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
+    subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
+    usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
+    warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u4EE5\u964D\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30D6\u30ED\u30C3\u30AF\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u30B5\u30A4\u30C8\u306F503\u3092\u8FD4\u3057\u307E\u3059\u3002",
+    running: "\u73FE\u5728\u3001\u30B5\u30A4\u30C8\u306F\u5F15\u304D\u7D9A\u304D\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059\u3002",
+    button: "\u4F7F\u7528\u91CF\u3092\u898B\u308B",
+    footer: (team) => `naro \u3067 ${team} \u30C1\u30FC\u30E0\u306E owner \u307E\u305F\u306F billing \u30ED\u30FC\u30EB\u306E\u305F\u3081\u3001\u3053\u306E\u30E1\u30FC\u30EB\u3092\u304A\u9001\u308A\u3057\u3066\u3044\u307E\u3059\u3002`
+  }
+};
+var BUILDS = {
+  en: {
+    subject80: (team) => `${team} has used 80% of its monthly builds`,
+    subject100: (team) => `${team} has reached its monthly build limit`,
+    usage: (team, used, limit, month) => `${team} has used ${used} of the ${limit} builds the Hobby plan includes for ${month}.`,
+    warning: "When it reaches the limit, new deploys may be refused until the month ends (UTC).",
+    blocked: "New deploys on this team are refused until the month ends (UTC).",
+    running: "Deploys keep working for now.",
+    button: REQUESTS.en.button,
+    footer: REQUESTS.en.footer
+  },
+  ko: {
+    subject80: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uBE4C\uB4DC \uD55C\uB3C4\uC758 80%\uB97C \uC37C\uC2B5\uB2C8\uB2E4`,
+    subject100: (team) => `${team} \uD300\uC774 \uC774\uBC88 \uB2EC \uBE4C\uB4DC \uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD588\uC2B5\uB2C8\uB2E4`,
+    usage: (team, used, limit, month) => `${team} \uD300\uC774 ${month} Hobby \uD50C\uB79C\uC5D0 \uD3EC\uD568\uB41C \uBE4C\uB4DC ${limit}\uAC74 \uC911 ${used}\uAC74\uC744 \uC37C\uC2B5\uB2C8\uB2E4.`,
+    warning: "\uD55C\uB3C4\uC5D0 \uB3C4\uB2EC\uD558\uBA74 \uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC0C8 \uBC30\uD3EC\uAC00 \uAC70\uC808\uB420 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+    blocked: "\uC774\uBC88 \uB2EC\uC774 \uB05D\uB0A0 \uB54C\uAE4C\uC9C0(UTC) \uC774 \uD300\uC758 \uC0C8 \uBC30\uD3EC\uB294 \uAC70\uC808\uB429\uB2C8\uB2E4.",
+    running: "\uC9C0\uAE08\uC740 \uBC30\uD3EC\uAC00 \uACC4\uC18D \uB429\uB2C8\uB2E4.",
+    button: REQUESTS.ko.button,
+    footer: REQUESTS.ko.footer
+  },
+  ja: {
+    subject80: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30D3\u30EB\u30C9\u4E0A\u9650\u306E80%\u3092\u4F7F\u7528\u3057\u307E\u3057\u305F`,
+    subject100: (team) => `${team} \u30C1\u30FC\u30E0\u304C\u4ECA\u6708\u306E\u30D3\u30EB\u30C9\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F`,
+    usage: (team, used, limit, month) => `${team} \u30C1\u30FC\u30E0\u306F ${month} \u306E Hobby \u30D7\u30E9\u30F3\u306B\u542B\u307E\u308C\u308B ${limit} \u30D3\u30EB\u30C9\u306E\u3046\u3061 ${used} \u3092\u4F7F\u7528\u3057\u307E\u3057\u305F\u3002`,
+    warning: "\u4E0A\u9650\u306B\u9054\u3059\u308B\u3068\u3001\u6708\u672B(UTC)\u307E\u3067\u65B0\u3057\u3044\u30C7\u30D7\u30ED\u30A4\u304C\u62D2\u5426\u3055\u308C\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
+    blocked: "\u6708\u672B(UTC)\u307E\u3067\u3001\u3053\u306E\u30C1\u30FC\u30E0\u306E\u65B0\u3057\u3044\u30C7\u30D7\u30ED\u30A4\u306F\u62D2\u5426\u3055\u308C\u307E\u3059\u3002",
+    running: "\u73FE\u5728\u3001\u30C7\u30D7\u30ED\u30A4\u306F\u5F15\u304D\u7D9A\u304D\u884C\u3048\u307E\u3059\u3002",
+    button: REQUESTS.ja.button,
+    footer: REQUESTS.ja.footer
+  }
+};
+
 // ../../packages/build/src/next-version.ts
 var NEXT_RELEASE_DATES = {
   16: "2025-10-21",
@@ -19244,7 +19475,7 @@ async function errorFromResponse(response, context) {
   if (typeof serverDetails === "object" && serverDetails !== null && !Array.isArray(serverDetails))
     Object.assign(details, serverDetails);
   const retryAfter = response.headers.get("retry-after")?.trim() ?? "";
-  if (response.status === 429 && /^\d{1,9}$/.test(retryAfter))
+  if ((response.status === 429 || response.status === 503) && /^\d{1,9}$/.test(retryAfter))
     details.retryAfter = Number(retryAfter);
   if (body?.error?.fields !== void 0) details.fields = body.error.fields;
   if (typeof body?.error?.installUrl === "string")
@@ -19712,6 +19943,16 @@ function isReservedEnvTarget(value) {
 function isEnvTargetName(value) {
   return environmentSlugProblem(value) !== "invalid";
 }
+var NARO_SYSTEM_ENV_NAMES = [
+  "NARO_URL",
+  "NEXT_PUBLIC_NARO_URL",
+  "VITE_NARO_URL",
+  "PUBLIC_NARO_URL",
+  "NARO_ANON_KEY",
+  "NEXT_PUBLIC_NARO_ANON_KEY",
+  "VITE_NARO_ANON_KEY",
+  "PUBLIC_NARO_ANON_KEY"
+];
 
 // ../../packages/sdk/src/insights.ts
 var SPEED_INSIGHTS_METRICS = [
@@ -19745,6 +19986,7 @@ var BACKEND_STEPS = [
   "worker",
   "routes",
   "migrate",
+  "schema",
   "health"
 ];
 var STALLED_GRACE_MS = 2 * 6e4;
@@ -19808,9 +20050,17 @@ function buildLogEntry(row) {
 }
 
 // ../../packages/sdk/src/client.ts
+var DATA_PATH = /^\/api\/projects\/[^/?]+\/(?:database|backend(?!\/functions))(?:[/?]|$)/;
+function withDataEnvironment(path, environment) {
+  if (environment === null || !DATA_PATH.test(path)) return path;
+  return `${path}${path.includes("?") ? "&" : "?"}environment=${encodeURIComponent(environment)}`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 45e3;
-var NaroClient = class {
+var NaroClient = class _NaroClient {
   baseUrl;
+  /** The environment whose data the data calls act on; null: production. */
+  environment;
+  options;
   getAccessToken;
   doFetch;
   requestTimeoutMs;
@@ -19824,11 +20074,15 @@ var NaroClient = class {
   db;
   backend;
   storage;
+  realtime;
+  functions;
   insights;
   analytics;
   protection;
   environments;
   constructor(options) {
+    this.options = options;
+    this.environment = options.environment ?? null;
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
     this.doFetch = options.fetch ?? fetch;
@@ -19843,25 +20097,42 @@ var NaroClient = class {
     this.db = new DbApi(this);
     this.backend = new BackendApi(this);
     this.storage = new StorageApi(this);
+    this.realtime = new RealtimeApi(this);
+    this.functions = new FunctionsApi(this);
     this.insights = new InsightsApi(this);
     this.analytics = new AnalyticsApi(this);
     this.protection = new ProtectionApi(this);
     this.environments = new EnvironmentsApi(this);
   }
+  /**
+   * The same client acting on `environment`'s data — or production's, for
+   * null. Every other call is the same: the scope is only the
+   * `?environment=` on database and backend paths.
+   */
+  inEnvironment(environment) {
+    if (environment === this.environment) return this;
+    const options = { ...this.options };
+    delete options.environment;
+    if (environment !== null) options.environment = environment;
+    return new _NaroClient(options);
+  }
   async request(path, options) {
     const token = await this.getAccessToken();
     const timeoutMs = options.timeoutMs ?? this.requestTimeoutMs;
     let response;
     try {
-      response = await this.doFetch(`${this.baseUrl}${path}`, {
-        method: options.method ?? "GET",
-        headers: {
-          Authorization: `Bearer ${token}`,
-          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
-        signal: AbortSignal.timeout(timeoutMs)
-      });
+      response = await this.doFetch(
+        `${this.baseUrl}${withDataEnvironment(path, this.environment)}`,
+        {
+          method: options.method ?? "GET",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+          },
+          ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
     } catch (error51) {
       if (error51 instanceof Error && (error51.name === "TimeoutError" || error51.name === "AbortError")) {
         throw new NaroError(
@@ -20059,17 +20330,23 @@ var DeploymentsApi = class {
    * `PROMOTE_TARGET_UNSUPPORTED` before anything is promoted. The target is
    * trimmed once, as the control plane trims it, so `" production"` is
    * production and asks no preview.
+   *
+   * `check: true` asks the preview for production too, for a caller that
+   * cannot show it first and returns it instead (MCP's `promote_deployment`):
+   * a 405 there means a control plane from before previews, and production
+   * is promoted unchecked as before. The preview asked is the result's
+   * `check`, so its migration warnings reach the caller (spec §9.4).
    */
   async promote(projectId, deploymentId, options = {}) {
     const target2 = options.target?.trim();
-    if (target2 !== void 0 && target2 !== "production") {
+    const toEnvironment = target2 !== void 0 && target2 !== "production";
+    let check2;
+    if (toEnvironment || options.check === true) {
       try {
-        await this.promoteCheck(projectId, deploymentId, target2);
+        check2 = await this.promoteCheck(projectId, deploymentId, target2);
       } catch (error51) {
-        if (isNaroError(error51) && error51.status === 405) {
-          throw promoteTargetUnsupported(error51);
-        }
-        throw error51;
+        if (!isNaroError(error51) || error51.status !== 405) throw error51;
+        if (toEnvironment) throw promoteTargetUnsupported(error51);
       }
     }
     const body = await this.client.request(this.promotePath(projectId, deploymentId), {
@@ -20079,7 +20356,8 @@ var DeploymentsApi = class {
     });
     return {
       ...deploymentInfo(body.deployment),
-      mode: body.mode ?? "reupload"
+      mode: body.mode ?? "reupload",
+      ...check2 === void 0 ? {} : { check: check2 }
     };
   }
   /**
@@ -20580,6 +20858,19 @@ var EnvironmentsApi = class {
       { method: "DELETE", context: "Delete environment" }
     );
   }
+  /**
+   * Makes or continues the environment's data — its D1, Naro backend and
+   * Storage bucket (spec §11.2): the run goes on after the answer, which
+   * says `data.status` `provisioning`. A run that stopped (`error`) starts
+   * again from where it stopped; `none` when the project uses neither.
+   */
+  async provision(projectId, environmentId) {
+    const body = await this.client.request(
+      `${this.base(projectId)}/${encodeURIComponent(environmentId)}/provision`,
+      { method: "POST", context: "Provision environment" }
+    );
+    return body.environment;
+  }
 };
 var EXPORT_FIRST_POLL_MS = 1e3;
 var EXPORT_MAX_POLL_MS = 5e3;
@@ -20868,9 +21159,9 @@ function storageInfo(body) {
     buckets: (body.buckets ?? []).map(storageBucket)
   };
 }
-function storageRunFailure(error51) {
+function provisionFailure(error51, feature) {
   const details = isNaroError(error51) ? error51.details : void 0;
-  if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.storage) && isRecord(details.backend))
+  if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.[feature]) && isRecord(details.backend))
     return new NaroError(error51.code, error51.message, {
       ...error51.status !== void 0 ? { status: error51.status } : {},
       details: {
@@ -21308,7 +21599,7 @@ var StorageApi = class {
         }
       );
     } catch (error51) {
-      throw storageRunFailure(error51);
+      throw provisionFailure(error51, "storage");
     }
     return storageInfo(body.storage);
   }
@@ -21346,7 +21637,7 @@ var StorageApi = class {
         }
       );
     } catch (error51) {
-      throw storageRunFailure(error51);
+      throw provisionFailure(error51, "storage");
     }
     return storageInfo(body.storage);
   }
@@ -21505,6 +21796,310 @@ var StorageApi = class {
     return body.objects;
   }
 };
+var RealtimeApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/backend/realtime${suffix}`;
+  }
+  /**
+   * Like `StorageApi.bucketPath`: URL parsing folds `.` and `..`, an empty
+   * name is the collection, and `encodeURIComponent` throws on a lone
+   * surrogate — so a name no URL can carry is refused here, before a
+   * request. SQLite does make tables named `.` and `..`, and one with the
+   * empty name (`CREATE TABLE "" (a)`); such a table cannot be published
+   * or unpublished through this API.
+   */
+  tablePath(projectId, table) {
+    if (table === "" || table === "." || table === ".." || LONE_SURROGATE.test(table))
+      throw new NaroError("INVALID_PATH", "The table name is not valid.");
+    return this.path(projectId, `/tables/${encodeURIComponent(table)}`);
+  }
+  /**
+   * Whether Realtime is on, the limits the hub enforces, the published
+   * tables and the hub's own numbers. A project that never turned it on
+   * answers `enabled: false` with no tables.
+   */
+  async info(projectId) {
+    const body = await this.client.request(
+      this.path(projectId),
+      { context: "Read realtime" }
+    );
+    return body.realtime;
+  }
+  /**
+   * Turns Realtime on: the request and the plan's limits are recorded, and
+   * the Naro worker is uploaded again with its hub (a Durable Object). Safe
+   * to repeat, and a repair — also after a plan change. The project must have
+   * a backend, turned on, with its database. A backend in `error` or with a
+   * run that stalled is not refused: its provisioning is resumed on the way.
+   * Two minutes, like `backend.enable`.
+   *
+   * Refusals, in the order they are checked: `BACKEND_DISABLED` (the control
+   * plane's backend switch), `FORBIDDEN` (`database.write`),
+   * `REALTIME_DISABLED` (the control plane's Realtime switch),
+   * `DATABASE_NOT_ENABLED` (the project's database is external),
+   * `BACKEND_NOT_READY` (409, only when the project has no backend at all),
+   * `BACKEND_OFF`, `BACKEND_BUSY`, `REALTIME_ENABLE_FAILED` (502: the request
+   * could not be recorded; nothing changed), and `BACKEND_PROVISION_FAILED`
+   * (502) when Realtime is recorded as on but the worker's upload stopped.
+   * The last one's `details` hold a `RealtimeProvisionFailure` — `{ realtime:
+   * { applied: false, enabled: true }, backend }`, the backend read like
+   * `backend.info` — and `enable` again finishes.
+   */
+  async enable(projectId) {
+    let body;
+    try {
+      body = await this.client.request(
+        this.path(projectId),
+        {
+          method: "POST",
+          context: "Turn on Realtime",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      );
+    } catch (error51) {
+      throw provisionFailure(error51, "realtime");
+    }
+    return body.realtime;
+  }
+  /**
+   * The tables whose Data API writes are published, in the order they were
+   * published. `exists: false` is a published name whose table was dropped.
+   * `REALTIME_NOT_ENABLED` (409) before `enable`; it answers while the
+   * backend is off, since the list is in the project's database.
+   */
+  async listTables(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/tables"),
+      { context: "List realtime tables" }
+    );
+    return body.tables;
+  }
+  /**
+   * Publishes a table's changes to the subscribers of its channel. Safe to
+   * repeat. Only changes made through the Data API are published — writes
+   * the app makes with `env.DB` are not (`warnings` says so).
+   * `TABLE_NOT_FOUND` (404) for a table that does not exist;
+   * `VALIDATION_FAILED` (400) for a Naro system table, a virtual table, a
+   * name over 256 characters, or the 100-table cap; `REALTIME_NOT_ENABLED`
+   * (409) before `enable`.
+   */
+  async publishTable(projectId, table) {
+    return this.client.request(
+      this.tablePath(projectId, table),
+      { method: "PUT", context: "Publish a realtime table" }
+    );
+  }
+  /**
+   * Stops publishing a table's changes; a table dropped since can still be
+   * unpublished. `TABLE_NOT_PUBLISHED` (404) for a table that does not
+   * publish, `REALTIME_NOT_ENABLED` (409) before `enable`.
+   */
+  async unpublishTable(projectId, table) {
+    return this.client.request(
+      this.tablePath(projectId, table),
+      { method: "DELETE", context: "Stop publishing a realtime table" }
+    );
+  }
+};
+var FunctionsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/backend/functions${suffix}`;
+  }
+  /**
+   * A segment no URL can carry is refused before a request, like
+   * `StorageApi.bucketPath`: URL parsing folds `/`, `.` and `..` into the
+   * path, an empty one is the collection, and `encodeURIComponent` throws on
+   * a lone surrogate. The server checks the name's own rule.
+   */
+  segment(value, what) {
+    if (value === "" || value === "." || value === ".." || value.includes("/") || LONE_SURROGATE.test(value))
+      throw new NaroError("INVALID_PATH", `The ${what} is not valid.`);
+    return encodeURIComponent(value);
+  }
+  functionPath(projectId, name, suffix = "") {
+    return this.path(
+      projectId,
+      `/${this.segment(name, "function name")}${suffix}`
+    );
+  }
+  /** The project's functions, the plan's limits, and (3-3e) this month's usage. */
+  async list(projectId) {
+    return this.client.request(this.path(projectId), {
+      context: "List functions"
+    });
+  }
+  /** One function and its newest 20 versions. `FUNCTION_NOT_FOUND` (404). */
+  async get(projectId, name) {
+    return this.client.request(
+      this.functionPath(projectId, name),
+      { context: "Read a function" }
+    );
+  }
+  /**
+   * A new version — the function too, the first time — and where to PUT its
+   * bundle: `upload.url` with `upload.headers` (the checksum header is
+   * signed). Refusals in the order they are checked: `BACKEND_DISABLED`,
+   * `UNAUTHORIZED`, `NOT_FOUND`, `FORBIDDEN` (`deployment.create`),
+   * `FUNCTIONS_DISABLED`, `FORBIDDEN` (a suspended project),
+   * `VALIDATION_FAILED` (the name or the request), `BUNDLE_TOO_LARGE`,
+   * `DATABASE_NOT_ENABLED`, `BACKEND_NOT_READY`, `BACKEND_OFF`,
+   * `BACKEND_BUSY` (the project's Naro worker is not the current version and
+   * could not be brought up to date just now), `FUNCTION_LIMIT` (a new name
+   * over the plan's cap) and `FUNCTION_BUSY` (the function is being deleted).
+   * It never turns the backend on. Two minutes.
+   */
+  async createVersion(projectId, name, request2) {
+    return this.client.request(
+      this.functionPath(projectId, name, "/versions"),
+      {
+        method: "POST",
+        body: request2,
+        context: "Create a function version",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+  }
+  /**
+   * Uploads a version whose bundle is in R2 and makes it live. `versionId` is
+   * `CreatedFunctionVersion.version.id`. The refusals before anything is
+   * uploaded leave the function as it was: `FUNCTION_NOT_FOUND`,
+   * `VERSION_NOT_FOUND`, `VERSION_NOT_DEPLOYABLE` (pruned),
+   * `BACKEND_NOT_READY`, `BACKEND_OFF`, `FUNCTION_BUSY`, `BUNDLE_MISSING`,
+   * `BUNDLE_MISMATCH`. Then `FUNCTION_DEPLOY_FAILED` (Cloudflare refused or
+   * could not be reached; the version that was live still runs),
+   * `FUNCTIONS_RATE_LIMITED` (503, `retry-after`),
+   * `FUNCTION_DEPLOY_INCOMPLETE` (the code runs but the function list did
+   * not take it, so callers may still get the previous `verifyJwt` setting
+   * or 404 — deploy again) and `BACKEND_OUTDATED` (the project's
+   * database predates the function list — `backend.enable` updates it).
+   * Two minutes.
+   */
+  async deploy(projectId, name, versionId) {
+    const body = await this.client.request(
+      this.functionPath(
+        projectId,
+        name,
+        `/versions/${this.segment(versionId, "version id")}/deploy`
+      ),
+      {
+        method: "POST",
+        context: "Deploy a function",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return body.function;
+  }
+  /**
+   * Puts a stored version live again: the one numbered `version`, which must
+   * have been live before (`VERSION_NOT_FOUND` otherwise — put a version that
+   * never went live up with `deploy`), or without it the deployed version
+   * before the live one. The code comes back, not the old keys or secrets:
+   * the bindings are the project's now. The refusals are `deploy`'s, and
+   * `VERSION_NOT_FOUND` also says there is no earlier deployed version.
+   * Two minutes.
+   */
+  async rollback(projectId, name, version2) {
+    const body = await this.client.request(
+      this.functionPath(projectId, name, "/rollback"),
+      {
+        method: "POST",
+        body: version2 === void 0 ? {} : { version: version2 },
+        context: "Roll back a function",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return body.function;
+  }
+  /**
+   * `verifyJwt` without an upload, live within seconds; the next deploy sets
+   * it again from the version it puts live. `FUNCTION_NOT_FOUND`,
+   * `FUNCTION_BUSY`, `FUNCTION_UPDATE_FAILED` (502: the function list in the
+   * project's database could not be written — nothing changed, send it again)
+   * and `BACKEND_OUTDATED`.
+   */
+  async update(projectId, name, patch) {
+    const body = await this.client.request(
+      this.functionPath(projectId, name),
+      { method: "PATCH", body: patch, context: "Update a function" }
+    );
+    return body.function;
+  }
+  /**
+   * Its URL stops working within seconds; its stored versions are removed by
+   * the control plane's sweep. `FUNCTION_NOT_FOUND`, `FUNCTION_BUSY`.
+   */
+  async remove(projectId, name) {
+    await this.client.request(
+      this.functionPath(projectId, name),
+      {
+        method: "DELETE",
+        context: "Delete a function"
+      }
+    );
+  }
+  /**
+   * The function's newest 200 log lines, optionally of one level (`log`,
+   * `info`, `warn`, `error` or `debug`; anything else is `400
+   * VALIDATION_FAILED`). `LOGS_DISABLED` (503) while the control plane has no
+   * log tail.
+   */
+  async logs(projectId, name, options = {}) {
+    const query = options.level ? `?${new URLSearchParams({ level: options.level }).toString()}` : "";
+    const body = await this.client.request(
+      this.functionPath(projectId, name, `/logs${query}`),
+      { context: "Read function logs" }
+    );
+    return body.entries;
+  }
+  /** The project's function secrets: names, digests and when — never a value. `env.read`. */
+  async secrets(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "-secrets"),
+      { context: "List function secrets" }
+    );
+    return body.secrets;
+  }
+  /**
+   * Sets and unsets function secrets in one change (`env.write.production`;
+   * a suspended project is refused). `VALIDATION_FAILED` names the first
+   * problem — a name, a reserved name (`NARO_*`, `ASSETS`, `DB`) or
+   * `__proto__`, a value over 5,120 bytes, more than 100 secrets. Live
+   * functions carry the change once synced: `pending` says how many. The
+   * control plane starts two at once and its five-minute sweep goes on with
+   * the rest, 20 a run; `sync` brings them up now — call it until `pending`
+   * is 0 to be sure, as a change racing another can leave a function only
+   * `sync` finds (known-issues #322).
+   */
+  async setSecrets(projectId, change) {
+    return this.client.request(
+      this.path(projectId, "-secrets"),
+      { method: "PUT", body: change, context: "Change function secrets" }
+    );
+  }
+  /**
+   * Uploads stale functions again — `limit` of them — and with `registry`
+   * writes the function list in the project's database again. Call it
+   * again while `pending` is above 0 and the call made progress.
+   * `FUNCTIONS_RATE_LIMITED` (503) carries `details.retryAfter`. Two minutes.
+   */
+  async sync(projectId, options = {}) {
+    return this.client.request(
+      this.path(projectId, "-sync"),
+      {
+        method: "POST",
+        body: options,
+        context: "Sync functions",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+  }
+};
 
 // ../../packages/sdk/src/database.ts
 var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
@@ -21527,8 +22122,8 @@ var MAX_CELL_CHARS = 60;
 function formatCell(value) {
   if (value === null || value === void 0) return "NULL";
   const text2 = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
-  const oneLine = text2.replace(/\s+/g, " ");
-  return oneLine.length > MAX_CELL_CHARS ? `${oneLine.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine;
+  const oneLine2 = text2.replace(/\s+/g, " ");
+  return oneLine2.length > MAX_CELL_CHARS ? `${oneLine2.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine2;
 }
 function renderRows(statement2) {
   if (statement2.columns.length === 0) return [];
@@ -21902,56 +22497,235 @@ function detectFramework2(dir) {
   };
 }
 
-// ../../packages/data-core/src/unicode-controls.ts
-function hasControlCharacter(text2) {
-  for (let i = 0; i < text2.length; i += 1) {
-    const code = text2.charCodeAt(i);
-    if (code <= 31 || code >= 127 && code <= 159) return true;
-  }
-  return false;
-}
-function hasBidiControl(text2) {
-  for (let i = 0; i < text2.length; i += 1) {
-    const code = text2.charCodeAt(i);
-    if (code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)
-      return true;
-  }
-  return false;
-}
-
-// ../../packages/data-core/src/storage-path.ts
-var MAX_SINGLE_UPLOAD_BYTES = 52428800;
-var MAX_OBJECT_NAME_BYTES = 900;
-var STORAGE_RESERVED_WORDS = [
-  "authenticated",
-  "copy",
-  "info",
-  "list",
-  "move",
-  "public",
-  "render",
-  "sign",
-  "upload"
+// ../../packages/data-core/src/system-tables.ts
+var SYSTEM_TABLE_PREFIXES = [
+  "_naro_",
+  "_cf_",
+  "sqlite_"
 ];
-var RESERVED = new Set(STORAGE_RESERVED_WORDS);
-var ENCODER = new TextEncoder();
-var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
-var LONE_SURROGATES = new RegExp(LONE_SURROGATE2.source, "g");
-function hasLoneSurrogate(text2) {
-  return LONE_SURROGATE2.test(text2);
+var SYSTEM_TABLE_NAMES = ["d1_migrations"];
+function asciiLower(text2) {
+  return text2.replace(/[A-Z]+/g, (run) => run.toLowerCase());
 }
-function refuse(reason) {
-  return { ok: false, reason };
+function isSystemTable(name) {
+  const lower = asciiLower(name);
+  return SYSTEM_TABLE_PREFIXES.some((prefix) => lower.startsWith(prefix)) || SYSTEM_TABLE_NAMES.includes(lower);
 }
-function checkWellFormed(name) {
-  if (name === "") return refuse("is empty");
-  if (name.length > MAX_OBJECT_NAME_BYTES || ENCODER.encode(name).length > MAX_OBJECT_NAME_BYTES)
-    return refuse(`is longer than ${String(MAX_OBJECT_NAME_BYTES)} bytes`);
-  if (name.startsWith("/") || name.endsWith("/"))
-    return refuse("starts or ends with /");
-  if (name.includes("//")) return refuse("has an empty segment (//)");
-  for (const segment of name.split("/"))
-    if (segment === "." || segment === "..")
+function likeLiteral(text2) {
+  return text2.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
+}
+var COLUMN_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$/;
+function systemTablePredicate(column2 = "name") {
+  if (!COLUMN_REFERENCE.test(column2))
+    throw new Error(`Not a column reference: ${column2}`);
+  return [
+    ...SYSTEM_TABLE_PREFIXES.map(
+      (prefix) => `${column2} NOT LIKE '${likeLiteral(prefix)}%' ESCAPE '\\'`
+    ),
+    ...SYSTEM_TABLE_NAMES.map(
+      (name) => `${column2} NOT LIKE '${likeLiteral(name)}' ESCAPE '\\'`
+    ),
+    `${column2} NOT IN (SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'shadow')`
+  ].join(" AND ");
+}
+var SYSTEM_TABLE_SQL_PREDICATE = systemTablePredicate("name");
+
+// ../../packages/data-core/src/collation.ts
+var COLLATIONS = ["BINARY", "NOCASE", "RTRIM"];
+function isSpace(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
+}
+function isWordChar(char) {
+  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function asciiUpper2(text2) {
+  return text2.replace(/[a-z]/g, (letter) => letter.toUpperCase());
+}
+function quoted2(sql, start, close, doubles) {
+  let value = "";
+  for (let index = start + 1; index < sql.length; index++) {
+    const char = sql.charAt(index);
+    if (char !== close) {
+      value += char;
+      continue;
+    }
+    if (doubles && sql.charAt(index + 1) === close) {
+      value += close;
+      index++;
+      continue;
+    }
+    return { value, end: index + 1 };
+  }
+  return void 0;
+}
+function tokenize(sql) {
+  const tokens = [];
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql.charAt(index);
+    if (isSpace(char)) {
+      index++;
+    } else if (char === "-" && sql.charAt(index + 1) === "-") {
+      const end = sql.indexOf("\n", index);
+      index = end < 0 ? sql.length : end + 1;
+    } else if (char === "/" && sql.charAt(index + 1) === "*") {
+      const end = sql.indexOf("*/", index + 2);
+      if (end < 0) return void 0;
+      index = end + 2;
+    } else if (char === '"' || char === "`" || char === "[" || char === "'") {
+      const close = char === "[" ? "]" : char;
+      const read = quoted2(sql, index, close, char !== "[");
+      if (!read) return void 0;
+      tokens.push({
+        kind: char === "'" ? "string" : "name",
+        value: read.value
+      });
+      index = read.end;
+    } else if (char === "(" || char === ")" || char === ",") {
+      tokens.push({ kind: "punct", value: char });
+      index++;
+    } else if (isWordChar(char)) {
+      let end = index;
+      while (end < sql.length && isWordChar(sql.charAt(end))) end++;
+      tokens.push({ kind: "word", value: sql.slice(index, end) });
+      index = end;
+    } else {
+      tokens.push({ kind: "other", value: char });
+      index++;
+    }
+  }
+  return tokens;
+}
+function isWord2(token, word) {
+  return token?.kind === "word" && asciiLower(token.value) === word;
+}
+function definitions(tokens) {
+  const open = tokens.findIndex(
+    (token) => token.kind === "punct" && token.value === "("
+  );
+  if (open < 0) return void 0;
+  const found = [[]];
+  let depth = 0;
+  for (const token of tokens.slice(open + 1)) {
+    if (token.kind === "punct" && token.value === "(") depth++;
+    if (token.kind === "punct" && token.value === ")") {
+      if (depth === 0) return found;
+      depth--;
+    }
+    if (depth === 0 && token.kind === "punct" && token.value === ",") {
+      found.push([]);
+      continue;
+    }
+    found.at(-1)?.push(token);
+  }
+  return void 0;
+}
+function collationOf(definition) {
+  const named = [];
+  let depth = 0;
+  for (const [index, token] of definition.entries()) {
+    if (token.kind === "punct" && token.value === "(") depth++;
+    else if (token.kind === "punct" && token.value === ")") depth--;
+    else if (depth === 0 && index > 0 && isWord2(token, "collate")) {
+      const name = definition[index + 1];
+      if (!name || name.kind === "punct" || name.kind === "other") return null;
+      named.push(asciiUpper2(name.value));
+    }
+  }
+  if (named.length === 0) return "BINARY";
+  const [first] = named;
+  if (named.some((name) => name !== first)) return null;
+  return COLLATIONS.includes(first ?? "") ? first : null;
+}
+function declaresStrict(sql) {
+  if (typeof sql !== "string") return void 0;
+  const tokens = tokenize(sql);
+  if (!tokens || !isWord2(tokens[0], "create")) return void 0;
+  const kind = isWord2(tokens[1], "temp") || isWord2(tokens[1], "temporary") ? tokens[2] : tokens[1];
+  if (!isWord2(kind, "table")) return void 0;
+  const open = tokens.findIndex(
+    (token) => token.kind === "punct" && token.value === "("
+  );
+  if (open < 0) return void 0;
+  let depth = 0;
+  for (const [index, token] of tokens.entries()) {
+    if (index < open || token.kind !== "punct") continue;
+    if (token.value === "(") depth++;
+    else if (token.value === ")" && --depth === 0)
+      return tokens.slice(index + 1).some((option) => isWord2(option, "strict"));
+  }
+  return void 0;
+}
+function declaredCollations(sql, columns) {
+  const unknown2 = columns.map(() => null);
+  if (typeof sql !== "string") return unknown2;
+  const tokens = tokenize(sql);
+  if (!tokens || !isWord2(tokens[0], "create")) return unknown2;
+  const kind = isWord2(tokens[1], "temp") || isWord2(tokens[1], "temporary") ? tokens[2] : tokens[1];
+  if (!isWord2(kind, "table")) return unknown2;
+  const found = definitions(tokens);
+  if (!found || found.length < columns.length) return unknown2;
+  const collations = [];
+  for (const [index, column2] of columns.entries()) {
+    const definition = found[index] ?? [];
+    const name = definition[0];
+    if (!name || name.kind === "punct" || name.kind === "other" || asciiLower(name.value) !== asciiLower(column2))
+      return unknown2;
+    collations.push(collationOf(definition));
+  }
+  return collations;
+}
+
+// ../../packages/data-core/src/unicode-controls.ts
+function hasControlCharacter(text2) {
+  for (let i = 0; i < text2.length; i += 1) {
+    const code = text2.charCodeAt(i);
+    if (code <= 31 || code >= 127 && code <= 159) return true;
+  }
+  return false;
+}
+function hasBidiControl(text2) {
+  for (let i = 0; i < text2.length; i += 1) {
+    const code = text2.charCodeAt(i);
+    if (code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+
+// ../../packages/data-core/src/storage-path.ts
+var MAX_SINGLE_UPLOAD_BYTES = 52428800;
+var MAX_OBJECT_NAME_BYTES = 900;
+var STORAGE_RESERVED_WORDS = [
+  "authenticated",
+  "copy",
+  "info",
+  "list",
+  "move",
+  "public",
+  "render",
+  "sign",
+  "upload"
+];
+var RESERVED = new Set(STORAGE_RESERVED_WORDS);
+var ENCODER = new TextEncoder();
+var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var LONE_SURROGATES = new RegExp(LONE_SURROGATE2.source, "g");
+function hasLoneSurrogate(text2) {
+  return LONE_SURROGATE2.test(text2);
+}
+function refuse(reason) {
+  return { ok: false, reason };
+}
+function checkWellFormed(name) {
+  if (name === "") return refuse("is empty");
+  if (name.length > MAX_OBJECT_NAME_BYTES || ENCODER.encode(name).length > MAX_OBJECT_NAME_BYTES)
+    return refuse(`is longer than ${String(MAX_OBJECT_NAME_BYTES)} bytes`);
+  if (name.startsWith("/") || name.endsWith("/"))
+    return refuse("starts or ends with /");
+  if (name.includes("//")) return refuse("has an empty segment (//)");
+  for (const segment of name.split("/"))
+    if (segment === "." || segment === "..")
       return refuse("has a . or .. segment");
   if (hasControlCharacter(name)) return refuse("has a control character");
   if (name.includes("\\")) return refuse("has a backslash");
@@ -22046,39 +22820,6 @@ var STORAGE_BUCKET_DELETING_COLUMN = {
   definition: "TEXT"
 };
 
-// ../../packages/data-core/src/system-tables.ts
-var SYSTEM_TABLE_PREFIXES = [
-  "_naro_",
-  "_cf_",
-  "sqlite_"
-];
-var SYSTEM_TABLE_NAMES = ["d1_migrations"];
-function asciiLower(text2) {
-  return text2.replace(/[A-Z]+/g, (run) => run.toLowerCase());
-}
-function isSystemTable(name) {
-  const lower = asciiLower(name);
-  return SYSTEM_TABLE_PREFIXES.some((prefix) => lower.startsWith(prefix)) || SYSTEM_TABLE_NAMES.includes(lower);
-}
-function likeLiteral(text2) {
-  return text2.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
-}
-var COLUMN_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$/;
-function systemTablePredicate(column2 = "name") {
-  if (!COLUMN_REFERENCE.test(column2))
-    throw new Error(`Not a column reference: ${column2}`);
-  return [
-    ...SYSTEM_TABLE_PREFIXES.map(
-      (prefix) => `${column2} NOT LIKE '${likeLiteral(prefix)}%' ESCAPE '\\'`
-    ),
-    ...SYSTEM_TABLE_NAMES.map(
-      (name) => `${column2} NOT LIKE '${likeLiteral(name)}' ESCAPE '\\'`
-    ),
-    `${column2} NOT IN (SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'shadow')`
-  ].join(" AND ");
-}
-var SYSTEM_TABLE_SQL_PREDICATE = systemTablePredicate("name");
-
 // ../../packages/data-core/src/errors.ts
 var DATABASE_FULL_MESSAGE = "The database has reached D1's 10 GB limit, which cannot be raised. Delete data to free space; writes fail until it is under the limit.";
 var STORAGE_MIGRATION_PENDING_MESSAGE = "The project backend is partway through an update. Run `naro backend enable` to finish it, then try again.";
@@ -22356,7 +23097,7 @@ var OPERATORS = [
   "*",
   "-"
 ];
-function isSpace(char) {
+function isSpace2(char) {
   return char === " " || char === "	" || char === "\n" || char === "\r" || char === "\f";
 }
 function isIdentStart(char) {
@@ -22369,7 +23110,7 @@ function isDigit(char) {
   return char >= "0" && char <= "9";
 }
 var NUMBER = /^(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?/;
-function tokenize(text2) {
+function tokenize2(text2) {
   const tokens = [];
   let index = 0;
   const at = (offset = 0) => text2.charAt(index + offset);
@@ -22378,7 +23119,7 @@ function tokenize(text2) {
     const position = index + 1;
     if (char === "\0")
       throw new PolicySyntaxError("NUL characters are not allowed", position);
-    if (isSpace(char)) {
+    if (isSpace2(char)) {
       index++;
       continue;
     }
@@ -22563,133 +23304,6 @@ var TokenStream = class {
   }
 };
 
-// ../../packages/data-core/src/collation.ts
-var COLLATIONS = ["BINARY", "NOCASE", "RTRIM"];
-function isSpace2(char) {
-  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
-}
-function isWordChar(char) {
-  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
-}
-function asciiUpper2(text2) {
-  return text2.replace(/[a-z]/g, (letter) => letter.toUpperCase());
-}
-function quoted(sql, start, close, doubles) {
-  let value = "";
-  for (let index = start + 1; index < sql.length; index++) {
-    const char = sql.charAt(index);
-    if (char !== close) {
-      value += char;
-      continue;
-    }
-    if (doubles && sql.charAt(index + 1) === close) {
-      value += close;
-      index++;
-      continue;
-    }
-    return { value, end: index + 1 };
-  }
-  return void 0;
-}
-function tokenize2(sql) {
-  const tokens = [];
-  let index = 0;
-  while (index < sql.length) {
-    const char = sql.charAt(index);
-    if (isSpace2(char)) {
-      index++;
-    } else if (char === "-" && sql.charAt(index + 1) === "-") {
-      const end = sql.indexOf("\n", index);
-      index = end < 0 ? sql.length : end + 1;
-    } else if (char === "/" && sql.charAt(index + 1) === "*") {
-      const end = sql.indexOf("*/", index + 2);
-      if (end < 0) return void 0;
-      index = end + 2;
-    } else if (char === '"' || char === "`" || char === "[" || char === "'") {
-      const close = char === "[" ? "]" : char;
-      const read = quoted(sql, index, close, char !== "[");
-      if (!read) return void 0;
-      tokens.push({
-        kind: char === "'" ? "string" : "name",
-        value: read.value
-      });
-      index = read.end;
-    } else if (char === "(" || char === ")" || char === ",") {
-      tokens.push({ kind: "punct", value: char });
-      index++;
-    } else if (isWordChar(char)) {
-      let end = index;
-      while (end < sql.length && isWordChar(sql.charAt(end))) end++;
-      tokens.push({ kind: "word", value: sql.slice(index, end) });
-      index = end;
-    } else {
-      tokens.push({ kind: "other", value: char });
-      index++;
-    }
-  }
-  return tokens;
-}
-function isWord2(token, word) {
-  return token?.kind === "word" && asciiLower(token.value) === word;
-}
-function definitions(tokens) {
-  const open = tokens.findIndex(
-    (token) => token.kind === "punct" && token.value === "("
-  );
-  if (open < 0) return void 0;
-  const found = [[]];
-  let depth = 0;
-  for (const token of tokens.slice(open + 1)) {
-    if (token.kind === "punct" && token.value === "(") depth++;
-    if (token.kind === "punct" && token.value === ")") {
-      if (depth === 0) return found;
-      depth--;
-    }
-    if (depth === 0 && token.kind === "punct" && token.value === ",") {
-      found.push([]);
-      continue;
-    }
-    found.at(-1)?.push(token);
-  }
-  return void 0;
-}
-function collationOf(definition) {
-  const named = [];
-  let depth = 0;
-  for (const [index, token] of definition.entries()) {
-    if (token.kind === "punct" && token.value === "(") depth++;
-    else if (token.kind === "punct" && token.value === ")") depth--;
-    else if (depth === 0 && index > 0 && isWord2(token, "collate")) {
-      const name = definition[index + 1];
-      if (!name || name.kind === "punct" || name.kind === "other") return null;
-      named.push(asciiUpper2(name.value));
-    }
-  }
-  if (named.length === 0) return "BINARY";
-  const [first] = named;
-  if (named.some((name) => name !== first)) return null;
-  return COLLATIONS.includes(first ?? "") ? first : null;
-}
-function declaredCollations(sql, columns) {
-  const unknown2 = columns.map(() => null);
-  if (typeof sql !== "string") return unknown2;
-  const tokens = tokenize2(sql);
-  if (!tokens || !isWord2(tokens[0], "create")) return unknown2;
-  const kind = isWord2(tokens[1], "temp") || isWord2(tokens[1], "temporary") ? tokens[2] : tokens[1];
-  if (!isWord2(kind, "table")) return unknown2;
-  const found = definitions(tokens);
-  if (!found || found.length < columns.length) return unknown2;
-  const collations = [];
-  for (const [index, column2] of columns.entries()) {
-    const definition = found[index] ?? [];
-    const name = definition[0];
-    if (!name || name.kind === "punct" || name.kind === "other" || asciiLower(name.value) !== asciiLower(column2))
-      return unknown2;
-    collations.push(collationOf(definition));
-  }
-  return collations;
-}
-
 // ../../packages/data-core/src/realtime-table.ts
 var REALTIME_MESSAGES = "realtime.messages";
 var REALTIME_MESSAGES_NAMES = ["messages", REALTIME_MESSAGES];
@@ -22767,6 +23381,9 @@ function columnAffinity(column2) {
     return "REAL";
   return "NUMERIC";
 }
+function isAnyType(type) {
+  return asciiLower(type.trim()) === "any";
+}
 function numberClass(type) {
   const affinity2 = columnAffinity({ type });
   if (affinity2 === "TEXT" || affinity2 === "BLOB") return void 0;
@@ -22968,6 +23585,9 @@ function utf8ByteLength(text2) {
 function quoteIdentifier(name) {
   return `"${name.replaceAll('"', '""')}"`;
 }
+function qualifiedColumn(table, column2) {
+  return `${quoteIdentifier(table)}.${quoteIdentifier(column2)}`;
+}
 var SIDE_BY_SIDE = 8;
 function joinConditions(terms, op) {
   if (terms.length <= SIDE_BY_SIDE) return `(${terms.join(` ${op} `)})`;
@@ -23059,6 +23679,11 @@ function refusesText(item, text2) {
 function readsAsIs(item, value) {
   return typeof value === "string" && numberClass(item.type) === "fallback" && !storesAsNumber(value);
 }
+function heldAsInteger(item, value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) return false;
+  const affinity2 = columnAffinity(item);
+  return affinity2 === "INTEGER" || affinity2 === "NUMERIC";
+}
 function asStored(item, sql) {
   switch (columnAffinity(item)) {
     case "INTEGER":
@@ -23125,6 +23750,9 @@ function checkMarker(action, nonce, restrictive) {
 function schemaMarker(nonce) {
   return `json_extract('{}', 'naro:schema:${nonce}')`;
 }
+function captureMarker(nonce) {
+  return `json_extract('{}', 'naro:capture:${nonce}')`;
+}
 
 // ../../packages/data-core/src/policy-expr.ts
 var MAX_EXPRESSION_BYTES = 3 * 16384;
@@ -24036,9 +24664,9 @@ function readCondition(stream) {
   const token = stream.peek();
   const state = newState(stream);
   const expr = readOr(state);
-  const bare = state.foldernames.find(({ node }) => node.index === null);
-  if (bare)
-    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, bare.token.position);
+  const bare2 = state.foldernames.find(({ node }) => node.index === null);
+  if (bare2)
+    throw new PolicySyntaxError(FOLDERNAME_INDEX_PROBLEM, bare2.token.position);
   return requireCondition(expr, token);
 }
 function checkExpressionSize(expr, position) {
@@ -24052,7 +24680,7 @@ function checkExpressionSize(expr, position) {
 }
 function parseExpression(text2) {
   try {
-    const stream = new TokenStream(tokenize(text2));
+    const stream = new TokenStream(tokenize2(text2));
     if (stream.peek().kind === "eof")
       throw new PolicySyntaxError("the expression is empty", 1);
     const expr = readCondition(stream);
@@ -24446,8 +25074,8 @@ function policiesOn(policies, table) {
   const folded = asciiLower(table);
   return policies.filter((policy) => asciiLower(policy.table) === folded);
 }
-function foldPolicyName(name, quoted2) {
-  return quoted2 ? name : asciiLower(name);
+function foldPolicyName(name, quoted3) {
+  return quoted3 ? name : asciiLower(name);
 }
 function sqlStringLiteral(text2) {
   return text2 === null ? "NULL" : quoteString(text2);
@@ -25064,8 +25692,36 @@ function policyInvalid(policy, action) {
     policy: policy.name
   });
 }
+var ROWID_NAMES = /* @__PURE__ */ new Set(["rowid", "oid", "_rowid_"]);
+function isRowidName(name) {
+  return ROWID_NAMES.has(asciiLower(name));
+}
+function noteRowidColumn(state, table, column2) {
+  const seen = state.rowidColumns.some(
+    (item) => asciiLower(item.table) === asciiLower(table) && asciiLower(item.column) === asciiLower(column2)
+  );
+  if (!seen) state.rowidColumns.push({ table, column: column2 });
+}
+function rowidColumnsGuard(columns) {
+  if (columns.length === 0) return null;
+  const terms = columns.map(
+    (item) => `EXISTS (SELECT 1 FROM pragma_table_xinfo(${quoteString(item.table)}) WHERE name = ${quoteString(item.column)} COLLATE NOCASE)`
+  );
+  return {
+    sql: terms.length === 1 ? terms[0] ?? "" : joinConditions(terms, "AND"),
+    params: []
+  };
+}
+function rowidGuarded(columns, fragment) {
+  const guard = rowidColumnsGuard(columns);
+  if (!guard) return fragment;
+  return {
+    sql: `(CASE WHEN ${guard.sql} THEN ${fragment.sql} ELSE 0 END)`,
+    params: [...guard.params, ...fragment.params]
+  };
+}
 function newState2() {
-  return { aliases: 0, subqueries: 0, depth: 0, active: [] };
+  return { aliases: 0, subqueries: 0, depth: 0, active: [], rowidColumns: [] };
 }
 function bind(env, value) {
   env.params.push(value);
@@ -25075,10 +25731,15 @@ function blamed(env, reason) {
   return fail(policyInvalid(env.blame.policy, env.blame.action), reason);
 }
 function storedSource(table, names, alias) {
+  const qualifier = alias ?? table.name;
   return {
     table,
     names,
-    read: (column2, _env, how) => alias !== null ? `${quoteIdentifier(alias)}.${quoteIdentifier(column2.name)}` : how.qualified ? `${quoteIdentifier(table.name)}.${quoteIdentifier(column2.name)}` : quoteIdentifier(column2.name),
+    read: (column2, env) => {
+      if (isRowidName(column2.name))
+        noteRowidColumn(env.state, table.name, column2.name);
+      return qualifiedColumn(qualifier, column2.name);
+    },
     operand: (column2) => ({
       stable: true,
       newColumnish: true,
@@ -25147,7 +25808,7 @@ function jwtValue(env, expr) {
   if (expr.op === "->") return bind(env, JSON.stringify(value));
   return bind(env, typeof value === "boolean" ? String(value) : value);
 }
-function valueSql(env, expr, textual = null) {
+function valueSql(env, expr, textual = null, exact = false, ordered = false) {
   switch (expr.kind) {
     case "literal":
       if (expr.value === null) return "NULL";
@@ -25157,8 +25818,9 @@ function valueSql(env, expr, textual = null) {
     case "realtime": {
       const { source, column: column2 } = columnOf(env, expr);
       return source.read(column2, env, {
-        qualified: env.scopes.length > 1,
-        textual
+        textual,
+        exact: textual === null && exact,
+        ...textual === null && ordered ? { ordered: true } : {}
       });
     }
     case "auth":
@@ -25169,7 +25831,10 @@ function valueSql(env, expr, textual = null) {
     case "func": {
       if (expr.name === "now") return "CURRENT_TIMESTAMP";
       if (expr.name === "coalesce") {
-        const args = expr.args.map((arg2) => valueSql(env, arg2, textual));
+        const one = expr.args.length === 1;
+        const args = expr.args.map(
+          (arg2) => valueSql(env, arg2, textual, exact, one && ordered)
+        );
         return args.length === 1 ? `(${String(args[0])})` : `coalesce(${args.join(", ")})`;
       }
       const [arg] = expr.args;
@@ -25193,7 +25858,7 @@ function columnOf(env, expr) {
   return expr.kind === "column" ? resolveColumn(env, expr) : realtimeTopic(env);
 }
 function pathArray(operand) {
-  return `('["' || replace(replace(${operand()}, '"', '\\"'), '/', '","') || '"]')`;
+  return `('[' || replace(json_quote(${operand()} || ''), '/', '","') || ']')`;
 }
 function storageHelperSql(fn, index, operand) {
   switch (fn) {
@@ -25224,10 +25889,7 @@ function storageCallSql(env, expr) {
   return storageHelperSql(
     expr.fn,
     index,
-    () => source.read(column2, env, {
-      qualified: env.scopes.length > 1,
-      textual: "textual"
-    })
+    () => source.read(column2, env, { textual: "textual" })
   );
 }
 function operandSide(env, value) {
@@ -25265,10 +25927,73 @@ var ARRAY_OPERATORS3 = {
   "<@": "containedBy",
   "&&": "overlaps"
 };
+function readsBack(env) {
+  return env.scopes.some((scope) => scope.readBack === true);
+}
+function textAffinity(env, value) {
+  const expr = comparedValue(value);
+  if (expr.kind === "cast") return true;
+  if (expr.kind !== "column" && expr.kind !== "realtime") return false;
+  try {
+    return columnAffinity(columnOf(env, expr).column) === "TEXT";
+  } catch {
+    return true;
+  }
+}
+function selectedTextAffinity(env, subquery) {
+  if (subquery.select === "*") return true;
+  const table = resolveSubqueryTable(env.snapshot, subquery.table);
+  if (!table) return true;
+  const source = storedSource(
+    table,
+    [asciiLower(subqueryName(subquery))],
+    null
+  );
+  return textAffinity(
+    { ...env, scopes: [...env.scopes, source] },
+    subquery.select
+  );
+}
+var ORDERING = /* @__PURE__ */ new Set(["<", "<=", ">", ">="]);
+function orderSafe(env, value) {
+  const expr = comparedValue(value);
+  switch (expr.kind) {
+    case "literal":
+      return typeof expr.value !== "string" || !storesAsNumber(expr.value);
+    case "func":
+      return expr.name === "now";
+    case "column": {
+      let column2;
+      try {
+        column2 = columnOf(env, expr).column;
+      } catch {
+        return false;
+      }
+      const kind = numberClass(column2.type);
+      return kind === "number" || kind === "fallback" && !isAnyType(column2.type);
+    }
+    default:
+      return false;
+  }
+}
 function comparison(env, left, op, right) {
-  const l = valueSql(env, left);
+  const back = readsBack(env);
+  const ordered = back && ORDERING.has(op);
+  const l = valueSql(
+    env,
+    left,
+    null,
+    back && !textAffinity(env, right),
+    ordered && !orderSafe(env, right)
+  );
   const collate = env.check ? checkCollation(env, operandSide(env, left), operandSide(env, right)) : "";
-  const r = valueSql(env, right);
+  const r = valueSql(
+    env,
+    right,
+    null,
+    back && !textAffinity(env, left),
+    ordered && !orderSafe(env, left)
+  );
   return `(${l}${collate} ${op} ${r})`;
 }
 function knownNullTest(env, expr) {
@@ -25313,22 +26038,36 @@ function conditionSql(env, expr) {
       if (untestable !== void 0) return blamed(env, untestable);
       const known = knownNullTest(env, expr);
       if (known !== void 0) return known;
-      const target2 = valueSql(env, expr.operand);
+      const target2 = valueSql(env, expr.operand, null, true);
       if (expr.value === null)
         return `(${target2} IS ${expr.not ? "NOT " : ""}NULL)`;
       const test = isBoolean(target2, expr.value);
       return expr.not ? `(NOT (${test}))` : `(${test})`;
     }
     case "in": {
-      const left = valueSql(env, expr.operand);
+      const left = valueSql(env, expr.operand, null, true);
       const collate = env.check ? checkCollation(env, operandSide(env, expr.operand), null) : "";
-      const list = expr.list.map((item) => valueSql(env, item));
+      const itemsExact = readsBack(env) && !textAffinity(env, expr.operand);
+      const list = expr.list.map(
+        (item) => valueSql(env, item, null, itemsExact)
+      );
       return `(${left}${collate} ${expr.not ? "NOT " : ""}IN (${list.join(", ")}))`;
     }
     case "inSelect": {
-      const left = valueSql(env, expr.operand);
+      const back = readsBack(env);
+      const left = valueSql(
+        env,
+        expr.operand,
+        null,
+        back && !selectedTextAffinity(env, expr.subquery)
+      );
       const leftSide = env.check ? operandSide(env, expr.operand) : null;
-      const sub = subquerySql(env, expr.subquery, "value");
+      const sub = subquerySql(
+        env,
+        expr.subquery,
+        "value",
+        back && !textAffinity(env, expr.operand)
+      );
       const collate = leftSide && sub.item ? checkCollation(env, leftSide, sub.item) : "";
       return `(${left}${collate} ${expr.not ? "NOT " : ""}IN (${sub.sql}))`;
     }
@@ -25365,7 +26104,7 @@ function conditionSql(env, expr) {
       return arraySql(
         () => (() => {
           const { source, column: column2 } = resolveColumn(env, expr.operand);
-          return source.read(column2, env, { qualified: true, textual: null });
+          return source.read(column2, env, { textual: null });
         })(),
         ARRAY_OPERATORS3[expr.op],
         values.length,
@@ -25377,7 +26116,7 @@ function conditionSql(env, expr) {
       return `(EXISTS (${subquerySql(env, expr.subquery, "one").sql}))`;
   }
 }
-function subquerySql(env, subquery, select) {
+function subquerySql(env, subquery, select, selectExact = false) {
   const table = resolveSubqueryTable(env.snapshot, subquery.table);
   if (!table) return blamed(env, unresolvedSubqueryReason(subquery.table));
   const { state } = env;
@@ -25402,7 +26141,7 @@ function subquerySql(env, subquery, select) {
     if (select === "value") {
       if (subquery.select === "*")
         return blamed(env, "IN (SELECT \u2026) selects one value, not *");
-      selected = valueSql(inner, subquery.select);
+      selected = valueSql(inner, subquery.select, null, selectExact);
       if (env.check) item = operandSide(inner, subquery.select);
     }
     const own2 = storedSource(table, ownNames(table), alias);
@@ -25755,7 +26494,9 @@ function selectCheckRefusal(path, column2, problem) {
     generated: `is not available: the select policy reads the generated column ${column2}, which a new row cannot be checked against`,
     collation: `is not available: the select policy reads ${column2}, whose collation naro cannot read, so a new row cannot be checked against it`,
     pattern: `is not available: the select policy compares the number column ${column2} with like or ilike, which a new row cannot be checked against`,
-    textual: `is not available: the select policy turns the number column ${column2} into text, which a new row cannot be checked against`
+    textual: `is not available: the select policy turns the number column ${column2} into text, which a new row cannot be checked against`,
+    readBack: `is not available: the select policy reads ${column2}, a number in a column that declares no number type, as text, which a new row cannot be checked against`,
+    orderedText: `is not available: the select policy orders ${column2}, text in a column of NUMERIC affinity, against what may read as a number, which a new row cannot be checked against`
   }[problem];
   return invalidQuery(path, reason);
 }
@@ -25817,6 +26558,15 @@ function decideQuery(context, query, policies, table) {
 var MAX_PARAMETERS = 100;
 var MAX_STATEMENT_BYTES = 1e5;
 var MAX_INSERT_STATEMENTS = 100;
+var MAX_CAPTURE_ROWS = 1e3;
+var MAX_CAPTURE_BYTES = 8388608;
+function triggersRead(table) {
+  const name = table.name;
+  return statement(
+    "SELECT sql, tbl_name = ? COLLATE NOCASE AS own FROM sqlite_master WHERE type = 'trigger' AND (tbl_name = ? COLLATE NOCASE OR instr(lower(sql), lower(?)) > 0 OR instr(lower(sql), lower(?)) > 0 OR instr(lower(sql), lower(?)) > 0)",
+    [name, name, name, name.replaceAll('"', '""'), name.replaceAll("`", "``")]
+  );
+}
 var OR_ABORT = "OR ABORT";
 function column(table, name) {
   return table.byName.get(asciiLower(name)) ?? fail(dataError("COLUMN_NOT_FOUND", { column: name, table: table.name }));
@@ -25832,7 +26582,13 @@ function columnList(table, names) {
   }
   return columns;
 }
-function selectList(columns) {
+function columnSql(table, item) {
+  return qualifiedColumn(table.name, item.name);
+}
+function outputList(table, columns) {
+  return columns.map((item) => columnSql(table, item)).join(", ");
+}
+function columnNames(columns) {
   return columns.map((item) => quoteIdentifier(item.name)).join(", ");
 }
 function returningClause(table, returning, action) {
@@ -25847,7 +26603,31 @@ function returningClause(table, returning, action) {
       )
     );
   const columns = returning === "*" ? table.columns : columnList(table, returning);
-  return ` RETURNING ${selectList(columns)}`;
+  return ` RETURNING ${outputList(table, columns)}`;
+}
+function writeReturning(table, returning, action, capture) {
+  const own2 = returningClause(table, returning, action);
+  return capture ? ` RETURNING ${outputList(table, table.columns)}` : own2;
+}
+function balancedSum(terms) {
+  if (terms.length === 0) return "0";
+  if (terms.length === 1) return terms[0] ?? "0";
+  const half = Math.ceil(terms.length / 2);
+  return `(${balancedSum(terms.slice(0, half))} + ${balancedSum(terms.slice(half))})`;
+}
+function boundBytes(value) {
+  return typeof value === "string" ? utf8ByteLength(value) : 8;
+}
+function captureGuard(table, where, params, nonce, set2) {
+  const bytes = balancedSum(
+    table.columns.map(
+      (item) => set2.has(item.name) ? String(boundBytes(set2.get(item.name) ?? null)) : `coalesce(length(CAST(${qualifiedColumn(table.name, item.name)} AS BLOB)), 8)`
+    )
+  );
+  return statement(
+    `SELECT CASE WHEN n > ${String(MAX_CAPTURE_ROWS)} OR b > ${String(MAX_CAPTURE_BYTES)} THEN ${captureMarker(nonce)} ELSE 1 END AS ok FROM (SELECT count(*) AS n, coalesce(sum(r), 0) AS b FROM (SELECT ${bytes} AS r FROM ${quoteIdentifier(table.name)}${where} LIMIT ${String(MAX_CAPTURE_ROWS + 1)}))`,
+    params
+  );
 }
 function scalar(value, path) {
   if (Array.isArray(value) || !isValue(value))
@@ -25868,7 +26648,7 @@ function arrayValues(value, path) {
 }
 function filterSql(table, filter, params, path) {
   const resolved = column(table, filter.column);
-  const target2 = quoteIdentifier(resolved.name);
+  const target2 = columnSql(table, resolved);
   const valuePath = `${path}.value`;
   switch (filter.operator) {
     case "eq":
@@ -25920,10 +26700,9 @@ function filterSql(table, filter, params, path) {
     case "containedBy":
     case "overlaps": {
       const values = arrayValues(filter.value, valuePath);
-      const qualified = `${quoteIdentifier(table.name)}.${target2}`;
       let next = 0;
       return arraySql(
-        () => qualified,
+        () => target2,
         filter.operator,
         values.length,
         () => {
@@ -25946,8 +26725,12 @@ function nodeSql(table, node, params, path) {
   );
   return joinConditions(terms, key === "or" ? "OR" : "AND");
 }
-function whereClause(table, filters, policy, params) {
+function whereClause(table, filters, policy, params, guard = null) {
   const parts = [];
+  if (guard) {
+    parts.push(guard.sql);
+    params.push(...guard.params);
+  }
   if (policy) {
     parts.push(policy.sql);
     params.push(...policy.params);
@@ -25963,7 +26746,7 @@ function orderClause(table, order) {
   const terms = order.map((term) => {
     const direction = term.ascending ? "ASC" : "DESC";
     const nulls = term.nullsFirst === void 0 ? "" : term.nullsFirst ? " NULLS FIRST" : " NULLS LAST";
-    return `${quoteIdentifier(column(table, term.column).name)} ${direction}${nulls}`;
+    return `${columnSql(table, column(table, term.column))} ${direction}${nulls}`;
   });
   return ` ORDER BY ${terms.join(", ")}`;
 }
@@ -26112,6 +26895,10 @@ function checkProblemReason(column2, problem) {
       return `${column2} is a number column, which a WITH CHECK cannot compare with LIKE or ILIKE`;
     case "textual":
       return `${column2} is a number column, which a WITH CHECK cannot turn into text (lower, upper, length, ::text)`;
+    case "readBack":
+      return `${column2} holds a number in a column that declares no number type, which a WITH CHECK cannot read as text (lower, upper, length, ::text, LIKE, or beside text)`;
+    case "orderedText":
+      return `${column2} holds text in a column of NUMERIC affinity (a date, uuid or json type), which a WITH CHECK cannot order against anything but a number, a number column or text that reads as no number (<, <=, >, >=, BETWEEN)`;
   }
 }
 function usingProblemReason(name, problem) {
@@ -26124,6 +26911,10 @@ function usingProblemReason(name, problem) {
       return `${name} is a number column, which a USING judged on a row's values cannot compare with LIKE or ILIKE`;
     case "textual":
       return `${name} is a number column, which a USING judged on a row's values cannot turn into text (lower, upper, length, ::text)`;
+    case "readBack":
+      return `${name} holds a number in a column that declares no number type, which a USING judged on a row's values cannot read as text (lower, upper, length, ::text, LIKE, or beside text)`;
+    case "orderedText":
+      return `${name} holds text in a column of NUMERIC affinity (a date, uuid or json type), which a USING judged on a row's values cannot order against anything but a number, a number column or text that reads as no number (<, <=, >, >=, BETWEEN)`;
   }
 }
 function isTrue(term) {
@@ -26532,6 +27323,19 @@ function schemaGuard(name, sql, kind, nonce) {
     policy: void 0
   };
 }
+function rowidTerm(table, state, nonce, kind) {
+  const own2 = newState2();
+  for (const item of table.columns)
+    if (isRowidName(item.name)) noteRowidColumn(own2, table.name, item.name);
+  for (const read of state.rowidColumns)
+    noteRowidColumn(own2, read.table, read.column);
+  const guard = rowidColumnsGuard(own2.rowidColumns);
+  return guard ? { ...guard, marker: schemaMarker(nonce), kind, policy: void 0 } : void 0;
+}
+function rowidWhere(table, state, nonce, kind) {
+  const term = rowidTerm(table, state, nonce, kind);
+  return term ? nestedChecks([term], { sql: "1", params: [] }) : null;
+}
 function nestedChecks(terms, pass) {
   let sql = pass.sql;
   let params = pass.params;
@@ -26559,11 +27363,15 @@ function usingFragment(target2, req, snapshot, commands, alias) {
     names: targetNames(target2),
     alias
   });
-  return rls.using(commands) ?? { sql: "1", params: [] };
+  return rowidGuarded(
+    rls.state.rowidColumns,
+    rls.using(commands) ?? { sql: "1", params: [] }
+  );
 }
-function rowSource(target2, row, action, stored) {
+function rowSource(target2, row, action, stored, readBack = false) {
   const { table } = target2;
   const kept = new Set(stored?.columns ?? []);
+  const strict = readBack ? declaresStrict(table.sql) : false;
   const storedRow = stored ? storedSource(table, targetNames(target2), stored.alias) : void 0;
   const source = {
     table,
@@ -26588,14 +27396,21 @@ function rowSource(target2, row, action, stored) {
           `the new row of ${target2.name} has no value for ${item.name}`
         );
       const bound = row[item.name] ?? null;
-      if (typeof bound === "string" && refusesText(item, bound))
+      const anyStrict = readBack && isAnyType(item.type) ? strict : false;
+      if (anyStrict !== true && typeof bound === "string" && refusesText(item, bound))
         fail(invalidQuery(`row.${item.name}`, mustBeNumber(action)));
+      if (readBack && typeof bound === "number" && (anyStrict === void 0 || (!isNumeric(item) || anyStrict) && how.exact !== true))
+        check2.problem(item.name, "readBack", env.blame.policy);
+      if (readBack && anyStrict !== true && how.ordered === true && readsAsIs(item, bound))
+        check2.problem(item.name, "orderedText", env.blame.policy);
       env.params.push(bound);
-      return readsAsIs(item, bound) ? "?" : asStored(item, "?");
+      if (anyStrict === true || readsAsIs(item, bound)) return "?";
+      return readBack && heldAsInteger(item, bound) ? "CAST(? AS INTEGER)" : asStored(item, "?");
     },
     // A stored column is the statement's own table's: SQLite compares it
     // with its own collation, the snapshot's — which the guard holds to.
-    operand: (item) => kept.has(item.name) ? { stable: true, newColumnish: true, newCollation: item.collation } : { stable: false, newColumnish: false, newCollation: null }
+    operand: (item) => kept.has(item.name) ? { stable: true, newColumnish: true, newCollation: item.collation } : { stable: false, newColumnish: false, newCollation: null },
+    ...readBack ? { readBack } : {}
   };
   return source;
 }
@@ -26635,7 +27450,17 @@ function checkFragment(target2, req, snapshot, command, row, nonce, stored, with
     () => false,
     () => false
   );
-  if (!source.storedRead || terms.length === 0) return terms;
+  if (terms.length === 0) return terms;
+  const rowid = rowidColumnsGuard(rls.state.rowidColumns);
+  const guards = rowid ? [
+    {
+      ...rowid,
+      marker: schemaMarker(checked),
+      kind: command,
+      policy: void 0
+    }
+  ] : [];
+  if (!source.storedRead) return [...guards, ...terms];
   const { name, sql } = target2.table;
   if (sql === null) {
     const first = terms.find((term) => term.policy !== void 0)?.policy;
@@ -26644,7 +27469,7 @@ function checkFragment(target2, req, snapshot, command, row, nonce, stored, with
       `naro cannot read the schema of ${target2.name}, so a check of the stored row cannot be guarded`
     );
   }
-  return [schemaGuard(name, sql, command, checked), ...terms];
+  return [schemaGuard(name, sql, command, checked), ...guards, ...terms];
 }
 var Unsupported = class extends Error {
   constructor(columnName, problem, policy) {
@@ -26654,9 +27479,15 @@ var Unsupported = class extends Error {
     this.policy = policy;
   }
 };
-function policyValue(target2, req, snapshot, command, row, nonce, state = newState2()) {
+function policyValue(target2, req, snapshot, command, row, nonce, state = newState2(), options = {}) {
   const checked = checkNonceOf(nonce, "policyValue");
-  const source = rowSource(target2, row, "insert", void 0);
+  const source = rowSource(
+    target2,
+    row,
+    "insert",
+    void 0,
+    options.readBack === true
+  );
   const rls = new Rls(
     req,
     snapshot,
@@ -26703,34 +27534,42 @@ function policyValue(target2, req, snapshot, command, row, nonce, state = newSta
   ].filter((term) => !isTrue(term));
   const [only] = kept;
   if (!only) return { ok: true, fragment: { sql: "1", params: [] } };
-  if (kept.length === 1) return { ok: true, fragment: only };
+  const read = state.rowidColumns;
+  if (kept.length === 1)
+    return { ok: true, fragment: rowidGuarded(read, only) };
   return {
     ok: true,
-    fragment: {
+    fragment: rowidGuarded(read, {
       sql: `(${kept.map((term) => term.sql).join(" AND ")})`,
       params: kept.flatMap((term) => term.params)
-    }
+    })
   };
 }
-function compileSelect(query, table, rls) {
+function compileSelect(query, table, rls, { state, nonce }) {
   if (query.columns !== "*" && query.columns.length === 0)
     fail(invalidQuery("columns", "must name at least one column"));
   const columns = query.columns === "*" ? table.columns : columnList(table, query.columns);
   const params = [];
   const policy = rls?.where("select") ?? null;
   if (rls && policy) rls.budget([policy]);
-  const where = whereClause(table, query.filters ?? [], policy, params);
+  const where = whereClause(
+    table,
+    query.filters ?? [],
+    policy,
+    params,
+    rowidWhere(table, state, nonce, "select")
+  );
   const order = orderClause(table, query.order ?? []);
   const limit = query.limit ?? MAX_LIMIT;
   params.push(query.single ? Math.min(limit, 2) : limit, query.offset ?? 0);
   return [
     statement(
-      `SELECT ${selectList(columns)} FROM ${quoteIdentifier(table.name)}${where}${order} LIMIT ? OFFSET ?`,
+      `SELECT ${outputList(table, columns)} FROM ${quoteIdentifier(table.name)}${where}${order} LIMIT ? OFFSET ?`,
       params
     )
   ];
 }
-function compileInsert(query, table, rls, nonce) {
+function compileInsert(query, table, rls, { state, nonce }, capture) {
   const uid = rls?.req.uid ?? null;
   const ownerInsert = rls?.ownerOnly("insert");
   const ownerRead = rls && query.returning !== void 0 ? rls.ownerOnly("select") : void 0;
@@ -26799,6 +27638,12 @@ function compileInsert(query, table, rls, nonce) {
         ]);
       }
     }
+    const rowid = rowidTerm(table, state, nonce, "insert");
+    if (rowid)
+      where = nestedChecks(
+        [rowid],
+        where ?? { sql: width === 0 ? "0" : "1", params: [] }
+      );
     const checkParams = where?.params ?? [];
     const room = MAX_PARAMETERS - checkParams.length;
     if (width > 0 && room < width) fail(dataError("TOO_MANY_PARAMETERS"));
@@ -26815,7 +27660,7 @@ function compileInsert(query, table, rls, nonce) {
       )
     );
   const into = `INSERT ${OR_ABORT} INTO ${quoteIdentifier(table.name)}`;
-  const returning = returningClause(table, query.returning, "insert");
+  const returning = writeReturning(table, query.returning, "insert", capture);
   if (rls) {
     for (const { group } of plans)
       for (const [row, values] of group.rows.entries())
@@ -26841,7 +27686,7 @@ function compileInsert(query, table, rls, nonce) {
       continue;
     }
     const tuple2 = `(${group.columns.map(() => "?").join(", ")})`;
-    const names = selectList(group.columns);
+    const names = columnNames(group.columns);
     for (let start = 0; start < group.rows.length; start += perStatement) {
       const chunk = group.rows.slice(start, start + perStatement);
       const values = chunk.map(() => tuple2).join(", ");
@@ -26858,7 +27703,7 @@ function compileInsert(query, table, rls, nonce) {
   }
   return statements;
 }
-function compileUpdate(query, table, context, rls, nonce) {
+function compileUpdate(query, table, context, rls, { state, nonce }, capture) {
   requireFilter(query, context);
   const values = assignments(table, query.values, "values");
   if (values.size === 0)
@@ -26896,8 +27741,9 @@ function compileUpdate(query, table, context, rls, nonce) {
     { sql: checkSql, params: terms.flatMap((term) => term.params) },
     ...policy ? [policy] : []
   ]);
-  const where = whereClause(table, query.filters ?? [], policy, params);
-  const returning = returningClause(table, query.returning, "update");
+  const rowid = rowidWhere(table, state, nonce, "update");
+  const where = whereClause(table, query.filters ?? [], policy, params, rowid);
+  const returning = writeReturning(table, query.returning, "update", capture);
   for (const item of values.values())
     rls?.refuseText(
       "update",
@@ -26905,63 +27751,170 @@ function compileUpdate(query, table, context, rls, nonce) {
       item.column,
       toBoundValue(item.value)
     );
-  return [
-    statement(
-      `UPDATE ${OR_ABORT} ${quoteIdentifier(table.name)} SET ${assigned.join(", ")}${where}${returning}`,
-      params
-    )
-  ];
+  const write = statement(
+    `UPDATE ${OR_ABORT} ${quoteIdentifier(table.name)} SET ${assigned.join(", ")}${where}${returning}`,
+    params
+  );
+  if (!capture) return { statements: [write], guard: null };
+  const guardParams = [];
+  const guardWhere = whereClause(
+    table,
+    query.filters ?? [],
+    policy,
+    guardParams,
+    rowid
+  );
+  const sent = new Map(
+    [...values.values()].map((item) => [
+      item.column.name,
+      toBoundValue(item.value)
+    ])
+  );
+  return {
+    statements: [write],
+    guard: captureGuard(table, guardWhere, guardParams, nonce, sent)
+  };
 }
-function compileDelete(query, table, context, rls) {
+function compileDelete(query, table, context, rls, { state, nonce }, capture) {
   requireFilter(query, context);
   const params = [];
   const policy = rls?.where("delete") ?? null;
   if (rls && policy) rls.budget([policy]);
-  const where = whereClause(table, query.filters ?? [], policy, params);
-  return [
-    statement(
-      `DELETE FROM ${quoteIdentifier(table.name)}${where}${returningClause(table, query.returning, "delete")}`,
-      params
-    )
-  ];
-}
-function compile(query, snapshot, decision, context, options = {}) {
-  const nonce = checkNonceOf(
-    options.checkNonce ?? DEFAULT_CHECK_NONCE,
-    "compile"
+  const rowid = rowidWhere(table, state, nonce, "select");
+  const where = whereClause(table, query.filters ?? [], policy, params, rowid);
+  const write = statement(
+    `DELETE FROM ${quoteIdentifier(table.name)}${where}${writeReturning(table, query.returning, "delete", capture)}`,
+    params
   );
-  if (!decision.allow)
-    return decision.reason === void 0 ? { ok: false, error: decision.error } : { ok: false, error: decision.error, reason: decision.reason };
-  const table = resolveTable(snapshot, query.table);
-  if (!table)
-    return {
-      ok: false,
-      error: dataError("TABLE_NOT_FOUND", { table: query.table })
-    };
+  if (!capture) return { statements: [write], guard: null };
+  const guardParams = [];
+  const guardWhere = whereClause(
+    table,
+    query.filters ?? [],
+    policy,
+    guardParams,
+    rowid
+  );
+  return {
+    statements: [write],
+    guard: captureGuard(table, guardWhere, guardParams, nonce, /* @__PURE__ */ new Map())
+  };
+}
+function ownReturning(table, query) {
+  if (query.action === "select" || query.returning === void 0) return null;
+  if (query.returning === "*") return table.columns.map((item) => item.name);
+  return columnList(table, query.returning).map((item) => item.name);
+}
+function bulkPlan(table) {
+  return {
+    columns: table.columns,
+    guard: null,
+    triggers: null,
+    returning: null,
+    bulk: true
+  };
+}
+function compileWith(query, snapshot, decision, context, table, nonce, capture) {
   try {
-    const rls = decision.rls ? new Rls(decision.rls, snapshot, table, nonce, commandsOf(query)) : void 0;
+    const state = newState2();
+    const rls = decision.rls ? new Rls(
+      decision.rls,
+      snapshot,
+      table,
+      nonce,
+      commandsOf(query),
+      void 0,
+      state
+    ) : void 0;
+    const statementContext = { state, nonce };
     let statements;
+    let guard = null;
     switch (query.action) {
       case "select":
-        statements = compileSelect(query, table, rls);
+        statements = compileSelect(query, table, rls, statementContext);
         break;
       case "insert":
-        statements = compileInsert(query, table, rls, nonce);
+        statements = compileInsert(
+          query,
+          table,
+          rls,
+          statementContext,
+          capture
+        );
         break;
       case "update":
-        statements = compileUpdate(query, table, context, rls, nonce);
+        ({ statements, guard } = compileUpdate(
+          query,
+          table,
+          context,
+          rls,
+          statementContext,
+          capture
+        ));
         break;
       case "delete":
-        statements = compileDelete(query, table, context, rls);
+        ({ statements, guard } = compileDelete(
+          query,
+          table,
+          context,
+          rls,
+          statementContext,
+          capture
+        ));
         break;
     }
-    return { ok: true, statements, restrictive: rls?.restrictive ?? [] };
+    const compiled = {
+      ok: true,
+      statements,
+      restrictive: rls?.restrictive ?? []
+    };
+    if (!capture) return compiled;
+    return {
+      ...compiled,
+      capture: {
+        columns: table.columns,
+        guard,
+        // A DELETE is judged on the row as it was before the write
+        // (original spec §8.5), which its RETURNING is.
+        triggers: query.action === "insert" || query.action === "update" ? triggersRead(table) : null,
+        returning: ownReturning(table, query),
+        bulk: false
+      }
+    };
   } catch (error51) {
     if (error51 instanceof Failure)
       return error51.reason === void 0 ? { ok: false, error: error51.error } : { ok: false, error: error51.error, reason: error51.reason };
     throw error51;
   }
 }
+function compile(query, snapshot, decision, context, options = {}) {
+  const nonce = checkNonceOf(
+    options.checkNonce ?? DEFAULT_CHECK_NONCE,
+    "compile"
+  );
+  if (!decision.allow)
+    return decision.reason === void 0 ? { ok: false, error: decision.error } : { ok: false, error: decision.error, reason: decision.reason };
+  const table = resolveTable(snapshot, query.table);
+  if (!table)
+    return {
+      ok: false,
+      error: dataError("TABLE_NOT_FOUND", { table: query.table })
+    };
+  if (options.capture !== true || query.action === "select")
+    return compileWith(query, snapshot, decision, context, table, nonce, false);
+  const captured = table.kind === "virtual" && query.action !== "insert" ? void 0 : compileWith(query, snapshot, decision, context, table, nonce, true);
+  if (captured?.ok) return captured;
+  const plain = compileWith(
+    query,
+    snapshot,
+    decision,
+    context,
+    table,
+    nonce,
+    false
+  );
+  return plain.ok ? { ...plain, capture: bulkPlan(table) } : plain;
+}
 
 // ../../packages/data-core/src/sql-depth.ts
 var D1_EXPRESSION_DEPTH = 100;
@@ -27735,6 +28688,238 @@ function expressionDepth(sql, { planner = true } = {}) {
   }
 }
 
+// ../../packages/data-core/src/sql-head.ts
+var HEAD_TOKENS = 12;
+var BOM2 = 65279;
+function isBlankStart(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
+}
+function isBlank(char) {
+  return isBlankStart(char) || char === "\v";
+}
+function isWordStart2(char) {
+  return /[A-Za-z_]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function isWordPart2(char) {
+  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
+}
+function skipBlanks(text2, from) {
+  let index = from;
+  for (; ; ) {
+    const char = text2.charAt(index);
+    if (isBlankStart(char)) {
+      index++;
+      while (index < text2.length && isBlank(text2.charAt(index))) index++;
+    } else if (text2.charCodeAt(index) === BOM2) index++;
+    else if (char === "-" && text2.charAt(index + 1) === "-") {
+      const end = text2.indexOf("\n", index + 2);
+      index = end < 0 ? text2.length : end;
+    } else if (char === "/" && text2.charAt(index + 1) === "*") {
+      const end = text2.indexOf("*/", index + 2);
+      index = end < 0 ? text2.length : end + 2;
+    } else return index;
+  }
+}
+function readQuoted(text2, start, delimiter) {
+  let value = "";
+  let index = start + 1;
+  for (; ; ) {
+    const close = text2.indexOf(delimiter, index);
+    if (close < 0) return void 0;
+    value += text2.slice(index, close);
+    if (text2.charAt(close + 1) === delimiter) {
+      value += delimiter;
+      index = close + 2;
+      continue;
+    }
+    return { text: value, end: close + 1 };
+  }
+}
+function headTokens(text2) {
+  const tokens = [];
+  let index = 0;
+  while (tokens.length < HEAD_TOKENS) {
+    index = skipBlanks(text2, index);
+    const char = text2.charAt(index);
+    if (index >= text2.length) break;
+    if (char === '"' || char === "`" || char === "'") {
+      const quoted3 = readQuoted(text2, index, char);
+      if (!quoted3) break;
+      tokens.push({ kind: "name", text: quoted3.text });
+      index = quoted3.end;
+    } else if (char === "[") {
+      const close = text2.indexOf("]", index + 1);
+      if (close < 0) break;
+      tokens.push({ kind: "name", text: text2.slice(index + 1, close) });
+      index = close + 1;
+    } else if ((char === "x" || char === "X") && text2.charAt(index + 1) === "'") {
+      break;
+    } else if (isWordStart2(char)) {
+      let end = index + 1;
+      while (end < text2.length && isWordPart2(text2.charAt(end))) end++;
+      tokens.push({ kind: "word", text: text2.slice(index, end) });
+      index = end;
+    } else if (char === "." && !/[0-9]/.test(text2.charAt(index + 1))) {
+      tokens.push({ kind: "dot" });
+      index++;
+    } else break;
+  }
+  tokens.push({ kind: "stop" });
+  return tokens;
+}
+var OTHER = { kind: "other" };
+var NO_NAME = {
+  kind: "unreadable",
+  reason: "the table name could not be read"
+};
+var NO_COLUMN = {
+  kind: "unreadable",
+  reason: "the column name could not be read"
+};
+var OTHER_SCHEMA = {
+  kind: "unreadable",
+  reason: "a table in another schema"
+};
+var PUBLIC_SCHEMA = {
+  kind: "unreadable",
+  reason: 'SQLite has no schema "public": write the table name without "public."'
+};
+var Head = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  token(at) {
+    return this.tokens[Math.min(at, this.tokens.length - 1)] ?? { kind: "stop" };
+  }
+  /** The bare word `word` (lower case), in any ASCII case. */
+  is(at, word) {
+    const token = this.token(at);
+    return token.kind === "word" && asciiLower(token.text) === word;
+  }
+  nameAt(at) {
+    const token = this.token(at);
+    return token.kind === "word" || token.kind === "name" ? token.text : void 0;
+  }
+  /**
+   * SQLite's `fullname`. `main.` is the database a migration writes: the
+   * name goes without it, and `main` says it was written (known-issues
+   * #226); `temp.` (in any case, quoted or not, as sqlite3FindDbName
+   * matches it) is a table that goes with the connection; `public.` is
+   * what a Postgres migration writes, said in its own words; any other
+   * schema is one D1 does not have.
+   */
+  table(at) {
+    const first = this.nameAt(at);
+    if (first === void 0) return { ok: false, head: NO_NAME };
+    if (this.token(at + 1).kind !== "dot")
+      return { ok: true, name: first, next: at + 1, main: false };
+    const second = this.nameAt(at + 2);
+    if (second === void 0) return { ok: false, head: NO_NAME };
+    const schema = asciiLower(first);
+    if (schema === "main")
+      return { ok: true, name: second, next: at + 3, main: true };
+    let head = OTHER_SCHEMA;
+    if (schema === "temp") head = OTHER;
+    else if (schema === "public") head = PUBLIC_SCHEMA;
+    return { ok: false, head, next: at + 3 };
+  }
+};
+function inMain(read) {
+  return read.main ? { main: true } : {};
+}
+function readCreate(head) {
+  if (head.is(1, "policy")) return { kind: "create-policy" };
+  if (head.is(1, "temp") || head.is(1, "temporary")) return OTHER;
+  let at;
+  if (head.is(1, "table")) at = 2;
+  else if (head.is(1, "virtual") && head.is(2, "table")) at = 3;
+  else return OTHER;
+  if (head.is(at, "if")) {
+    if (!head.is(at + 1, "not") || !head.is(at + 2, "exists")) return NO_NAME;
+    at += 3;
+  }
+  const table = head.table(at);
+  return table.ok ? { kind: "create-table", table: table.name } : table.head;
+}
+function readDrop(head) {
+  if (head.is(1, "policy")) return { kind: "drop-policy" };
+  if (!head.is(1, "table")) return OTHER;
+  let at = 2;
+  if (head.is(at, "if")) {
+    if (!head.is(at + 1, "exists")) return NO_NAME;
+    at += 2;
+  }
+  const table = head.table(at);
+  return table.ok ? { kind: "drop-table", table: table.name, ...inMain(table) } : table.head;
+}
+var RLS_ACTIONS = ["enable", "disable", "force", "no"];
+function readRenameColumn(head, table, at) {
+  let from = at;
+  if (head.is(from, "column") && head.nameAt(from + 1) !== void 0 && head.is(from + 2, "to"))
+    from += 1;
+  const column2 = head.nameAt(from);
+  if (column2 === void 0 || !head.is(from + 1, "to")) return NO_COLUMN;
+  const to = head.nameAt(from + 2);
+  return to === void 0 ? NO_COLUMN : {
+    kind: "rename-column",
+    table: table.name,
+    column: column2,
+    to,
+    ...inMain(table)
+  };
+}
+function readAlter(head) {
+  if (head.is(1, "policy")) return { kind: "alter-policy" };
+  if (!head.is(1, "table")) return OTHER;
+  const sqlite = head.table(2);
+  const action = sqlite.next;
+  if (action !== void 0) {
+    if (head.is(action, "rename") && head.is(action + 1, "to")) {
+      if (!sqlite.ok) return sqlite.head;
+      const to = head.table(action + 2);
+      return to.ok ? {
+        kind: "rename-table",
+        table: sqlite.name,
+        to: to.name,
+        ...inMain(sqlite)
+      } : to.head;
+    }
+    if (head.is(action, "rename")) {
+      if (!sqlite.ok) return sqlite.head;
+      return readRenameColumn(head, sqlite, action + 1);
+    }
+    if (head.is(action, "add") || head.is(action, "drop"))
+      return sqlite.ok ? { kind: "alter-table", table: sqlite.name } : sqlite.head;
+  }
+  let at = 2;
+  if (head.is(at, "if") && head.is(at + 1, "exists")) at += 2;
+  if (head.is(at, "only")) at++;
+  const next = head.table(at).next;
+  if (next !== void 0 && RLS_ACTIONS.some((word) => head.is(next, word)))
+    return { kind: "rls" };
+  return sqlite.ok ? OTHER : sqlite.head;
+}
+function readSqlHead(text2) {
+  if (text2.includes("\0"))
+    return { kind: "unreadable", reason: "the statement has a NUL character" };
+  const head = new Head(headTokens(text2));
+  if (head.is(0, "create")) return readCreate(head);
+  if (head.is(0, "drop")) return readDrop(head);
+  if (head.is(0, "alter")) return readAlter(head);
+  if (head.is(0, "comment") && head.is(1, "on") && head.is(2, "policy"))
+    return { kind: "comment-policy" };
+  if (head.is(0, "grant")) return { kind: "grant" };
+  if (head.is(0, "revoke")) return { kind: "revoke" };
+  return OTHER;
+}
+
+// ../../packages/data-core/src/functions-registry.ts
+var FUNCTIONS_TABLE = "_naro_functions";
+var FUNCTIONS_REGISTRY_VERSION = 9;
+var FUNCTIONS_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ${FUNCTIONS_TABLE} (name TEXT NOT NULL PRIMARY KEY CHECK (name GLOB '[a-z]*' AND length(name) BETWEEN 1 AND 64), verify_jwt INTEGER NOT NULL DEFAULT 1 CHECK (verify_jwt IN (0, 1)), updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')))`;
+var MAX_REGISTERED_FUNCTIONS = 2e3;
+var FUNCTIONS_REGISTRY_SQL = `SELECT name, verify_jwt FROM ${FUNCTIONS_TABLE} ORDER BY name LIMIT ${String(MAX_REGISTERED_FUNCTIONS)}`;
+
 // ../../packages/data-core/src/policy-index.ts
 var INDEX_SQL = `SELECT t.name AS table_name, il.name AS index_name, il."partial" AS partial, ix.name AS column_name, ix.coll AS collation FROM pragma_table_list AS t JOIN pragma_index_list(t.name, t.schema) AS il JOIN pragma_index_xinfo(il.name, t.schema) AS ix WHERE t.schema = 'main' AND t.type = 'table' AND ${systemTablePredicate("t.name")} AND ix.seqno = 0`;
 function indexesFromRows(rows) {
@@ -28011,8 +29196,34 @@ function unindexedSubqueries(snapshot, indexes, policies) {
   return found;
 }
 
+// ../../packages/data-core/src/realtime-filter.ts
+var FILTER_REASONS = {
+  bytes: "must be a string of up to 1024 bytes in UTF-8",
+  control: "must have no control character",
+  syntax: "supports eq, neq, lt, lte, gt, gte and in, one condition",
+  list: "needs in.(a,b) with 1 to 100 values"
+};
+
 // ../../packages/data-core/src/realtime-protocol.ts
 var REALTIME_PROTOCOL_VERSION = "1.0.0";
+var MAX_CHANGE_CHANNELS_PER_TABLE = 4;
+var JOIN_CONFIG_REASONS = {
+  object: "must be an object",
+  unsupported: "is not supported",
+  boolean: "must be true or false",
+  presenceKey: "must be 1 to 128 characters",
+  changes: "must be an array of up to 16 subscriptions",
+  changeEvent: "must be *, INSERT, UPDATE or DELETE",
+  schema: "must be public",
+  table: "must be a table name of 1 to 128 characters, or *",
+  filter: FILTER_REASONS.bytes,
+  filterControl: FILTER_REASONS.control,
+  filterSyntax: FILTER_REASONS.syntax,
+  filterList: FILTER_REASONS.list,
+  filterTable: "needs a table: a filter cannot go with *",
+  /** The hub's, after `config.postgres_changes[<i>].table` (3-2c-1): `MAX_CHANGE_CHANNELS_PER_TABLE` against the connection's joins. */
+  changeChannels: `would put more than ${String(MAX_CHANGE_CHANNELS_PER_TABLE)} channels of this connection on one table's changes (* counts for every table): add the subscription to a channel it already has`
+};
 var REALTIME_CLOSE = {
   UNSUPPORTED_PROTOCOL: {
     code: 4e3,
@@ -29203,7 +30414,7 @@ function readClause(stream) {
   checkExpressionSize(expr, open.position);
   return { text: printExpr(expr), position: open.position };
 }
-function readCreate(stream, start) {
+function readCreate2(stream, start) {
   stream.expectKeyword("policy");
   const name = readPolicyName(stream);
   stream.expectKeyword("on");
@@ -29263,7 +30474,7 @@ function readCreate(stream, start) {
     throw new PolicySyntaxError(problem.replace(/\.$/, ""), position);
   return { kind: "create", policy };
 }
-function readDrop(stream) {
+function readDrop2(stream) {
   stream.expectKeyword("policy");
   let ifExists = false;
   if (stream.acceptKeyword("if")) {
@@ -29294,11 +30505,11 @@ function parsePolicyStatement(text2) {
       position: 1
     };
   try {
-    const stream = new TokenStream(tokenize(text2));
+    const stream = new TokenStream(tokenize2(text2));
     const start = stream.next();
     let statement2;
-    if (isKeyword(start, "create")) statement2 = readCreate(stream, start);
-    else if (isKeyword(start, "drop")) statement2 = readDrop(stream);
+    if (isKeyword(start, "create")) statement2 = readCreate2(stream, start);
+    else if (isKeyword(start, "drop")) statement2 = readDrop2(stream);
     else if (isKeyword(start, "alter"))
       throw new PolicySyntaxError(
         "ALTER POLICY is not supported here yet: DROP POLICY and CREATE POLICY again",
@@ -29321,7 +30532,7 @@ function parsePolicyStatement(text2) {
 function splitPolicyStatements(text2) {
   let tokens;
   try {
-    tokens = tokenize(text2);
+    tokens = tokenize2(text2);
   } catch (error51) {
     if (error51 instanceof PolicySyntaxError)
       return { ok: false, reason: error51.reason, position: error51.position };
@@ -29350,13 +30561,13 @@ function ownerComment(text2, position) {
   if (rest !== "" && !/^[ \t]/.test(rest)) return void 0;
   let column2 = rest.replace(/^[ \t]+|[ \t]+$/g, "");
   if (column2.startsWith('"')) {
-    const quoted2 = /^"((?:[^"]|"")*)"$/.exec(column2);
-    if (!quoted2)
+    const quoted3 = /^"((?:[^"]|"")*)"$/.exec(column2);
+    if (!quoted3)
       throw new PolicySyntaxError(
         "naro:owner needs one column name, bare or in double quotes",
         position
       );
-    column2 = (quoted2[1] ?? "").replaceAll('""', '"');
+    column2 = (quoted3[1] ?? "").replaceAll('""', '"');
   }
   if (column2 === "")
     throw new PolicySyntaxError("naro:owner needs a column name", position);
@@ -29410,7 +30621,7 @@ function parseMigrationPolicyStatement(text2) {
       position: 1
     };
   try {
-    const stream = new TokenStream(tokenize(text2));
+    const stream = new TokenStream(tokenize2(text2));
     let statement2;
     if (stream.acceptKeyword("comment")) statement2 = readComment(stream);
     else if (isKeyword(stream.peek(), "alter") && isKeyword(stream.peek(1), "table")) {
@@ -29427,230 +30638,11 @@ function parseMigrationPolicyStatement(text2) {
   }
 }
 
-// ../../packages/data-core/src/sql-head.ts
-var HEAD_TOKENS = 12;
-var BOM2 = 65279;
-function isBlankStart(char) {
-  return char === " " || char === "	" || char === "\n" || char === "\f" || char === "\r";
-}
-function isBlank(char) {
-  return isBlankStart(char) || char === "\v";
-}
-function isWordStart2(char) {
-  return /[A-Za-z_]/.test(char) || char.charCodeAt(0) >= 128;
-}
-function isWordPart2(char) {
-  return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 128;
-}
-function skipBlanks(text2, from) {
-  let index = from;
-  for (; ; ) {
-    const char = text2.charAt(index);
-    if (isBlankStart(char)) {
-      index++;
-      while (index < text2.length && isBlank(text2.charAt(index))) index++;
-    } else if (text2.charCodeAt(index) === BOM2) index++;
-    else if (char === "-" && text2.charAt(index + 1) === "-") {
-      const end = text2.indexOf("\n", index + 2);
-      index = end < 0 ? text2.length : end;
-    } else if (char === "/" && text2.charAt(index + 1) === "*") {
-      const end = text2.indexOf("*/", index + 2);
-      index = end < 0 ? text2.length : end + 2;
-    } else return index;
-  }
-}
-function readQuoted(text2, start, delimiter) {
-  let value = "";
-  let index = start + 1;
-  for (; ; ) {
-    const close = text2.indexOf(delimiter, index);
-    if (close < 0) return void 0;
-    value += text2.slice(index, close);
-    if (text2.charAt(close + 1) === delimiter) {
-      value += delimiter;
-      index = close + 2;
-      continue;
-    }
-    return { text: value, end: close + 1 };
-  }
-}
-function headTokens(text2) {
-  const tokens = [];
-  let index = 0;
-  while (tokens.length < HEAD_TOKENS) {
-    index = skipBlanks(text2, index);
-    const char = text2.charAt(index);
-    if (index >= text2.length) break;
-    if (char === '"' || char === "`" || char === "'") {
-      const quoted2 = readQuoted(text2, index, char);
-      if (!quoted2) break;
-      tokens.push({ kind: "name", text: quoted2.text });
-      index = quoted2.end;
-    } else if (char === "[") {
-      const close = text2.indexOf("]", index + 1);
-      if (close < 0) break;
-      tokens.push({ kind: "name", text: text2.slice(index + 1, close) });
-      index = close + 1;
-    } else if ((char === "x" || char === "X") && text2.charAt(index + 1) === "'") {
-      break;
-    } else if (isWordStart2(char)) {
-      let end = index + 1;
-      while (end < text2.length && isWordPart2(text2.charAt(end))) end++;
-      tokens.push({ kind: "word", text: text2.slice(index, end) });
-      index = end;
-    } else if (char === "." && !/[0-9]/.test(text2.charAt(index + 1))) {
-      tokens.push({ kind: "dot" });
-      index++;
-    } else break;
-  }
-  tokens.push({ kind: "stop" });
-  return tokens;
-}
-var OTHER = { kind: "other" };
-var NO_NAME = {
-  kind: "unreadable",
-  reason: "the table name could not be read"
-};
-var NO_COLUMN = {
-  kind: "unreadable",
-  reason: "the column name could not be read"
-};
-var OTHER_SCHEMA = {
-  kind: "unreadable",
-  reason: "a table in another schema"
-};
-var PUBLIC_SCHEMA = {
-  kind: "unreadable",
-  reason: 'SQLite has no schema "public": write the table name without "public."'
-};
-var Head = class {
-  constructor(tokens) {
-    this.tokens = tokens;
-  }
-  token(at) {
-    return this.tokens[Math.min(at, this.tokens.length - 1)] ?? { kind: "stop" };
-  }
-  /** The bare word `word` (lower case), in any ASCII case. */
-  is(at, word) {
-    const token = this.token(at);
-    return token.kind === "word" && asciiLower(token.text) === word;
-  }
-  nameAt(at) {
-    const token = this.token(at);
-    return token.kind === "word" || token.kind === "name" ? token.text : void 0;
-  }
-  /**
-   * SQLite's `fullname`. `main.` is the database a migration writes: the
-   * name goes without it, and `main` says it was written (known-issues
-   * #226); `temp.` (in any case, quoted or not, as sqlite3FindDbName
-   * matches it) is a table that goes with the connection; `public.` is
-   * what a Postgres migration writes, said in its own words; any other
-   * schema is one D1 does not have.
-   */
-  table(at) {
-    const first = this.nameAt(at);
-    if (first === void 0) return { ok: false, head: NO_NAME };
-    if (this.token(at + 1).kind !== "dot")
-      return { ok: true, name: first, next: at + 1, main: false };
-    const second = this.nameAt(at + 2);
-    if (second === void 0) return { ok: false, head: NO_NAME };
-    const schema = asciiLower(first);
-    if (schema === "main")
-      return { ok: true, name: second, next: at + 3, main: true };
-    let head = OTHER_SCHEMA;
-    if (schema === "temp") head = OTHER;
-    else if (schema === "public") head = PUBLIC_SCHEMA;
-    return { ok: false, head, next: at + 3 };
-  }
-};
-function inMain(read) {
-  return read.main ? { main: true } : {};
-}
-function readCreate2(head) {
-  if (head.is(1, "policy")) return { kind: "create-policy" };
-  if (head.is(1, "temp") || head.is(1, "temporary")) return OTHER;
-  let at;
-  if (head.is(1, "table")) at = 2;
-  else if (head.is(1, "virtual") && head.is(2, "table")) at = 3;
-  else return OTHER;
-  if (head.is(at, "if")) {
-    if (!head.is(at + 1, "not") || !head.is(at + 2, "exists")) return NO_NAME;
-    at += 3;
-  }
-  const table = head.table(at);
-  return table.ok ? { kind: "create-table", table: table.name } : table.head;
-}
-function readDrop2(head) {
-  if (head.is(1, "policy")) return { kind: "drop-policy" };
-  if (!head.is(1, "table")) return OTHER;
-  let at = 2;
-  if (head.is(at, "if")) {
-    if (!head.is(at + 1, "exists")) return NO_NAME;
-    at += 2;
-  }
-  const table = head.table(at);
-  return table.ok ? { kind: "drop-table", table: table.name, ...inMain(table) } : table.head;
-}
-var RLS_ACTIONS = ["enable", "disable", "force", "no"];
-function readRenameColumn(head, table, at) {
-  let from = at;
-  if (head.is(from, "column") && head.nameAt(from + 1) !== void 0 && head.is(from + 2, "to"))
-    from += 1;
-  const column2 = head.nameAt(from);
-  if (column2 === void 0 || !head.is(from + 1, "to")) return NO_COLUMN;
-  const to = head.nameAt(from + 2);
-  return to === void 0 ? NO_COLUMN : {
-    kind: "rename-column",
-    table: table.name,
-    column: column2,
-    to,
-    ...inMain(table)
-  };
-}
-function readAlter(head) {
-  if (head.is(1, "policy")) return { kind: "alter-policy" };
-  if (!head.is(1, "table")) return OTHER;
-  const sqlite = head.table(2);
-  const action = sqlite.next;
-  if (action !== void 0) {
-    if (head.is(action, "rename") && head.is(action + 1, "to")) {
-      if (!sqlite.ok) return sqlite.head;
-      const to = head.table(action + 2);
-      return to.ok ? {
-        kind: "rename-table",
-        table: sqlite.name,
-        to: to.name,
-        ...inMain(sqlite)
-      } : to.head;
-    }
-    if (head.is(action, "rename")) {
-      if (!sqlite.ok) return sqlite.head;
-      return readRenameColumn(head, sqlite, action + 1);
-    }
-    if (head.is(action, "add") || head.is(action, "drop"))
-      return sqlite.ok ? { kind: "alter-table", table: sqlite.name } : sqlite.head;
-  }
-  let at = 2;
-  if (head.is(at, "if") && head.is(at + 1, "exists")) at += 2;
-  if (head.is(at, "only")) at++;
-  const next = head.table(at).next;
-  if (next !== void 0 && RLS_ACTIONS.some((word) => head.is(next, word)))
-    return { kind: "rls" };
-  return sqlite.ok ? OTHER : sqlite.head;
-}
-function readSqlHead(text2) {
-  if (text2.includes("\0"))
-    return { kind: "unreadable", reason: "the statement has a NUL character" };
-  const head = new Head(headTokens(text2));
-  if (head.is(0, "create")) return readCreate2(head);
-  if (head.is(0, "drop")) return readDrop2(head);
-  if (head.is(0, "alter")) return readAlter(head);
-  if (head.is(0, "comment") && head.is(1, "on") && head.is(2, "policy"))
-    return { kind: "comment-policy" };
-  if (head.is(0, "grant")) return { kind: "grant" };
-  if (head.is(0, "revoke")) return { kind: "revoke" };
-  return OTHER;
-}
+// ../../packages/data-core/src/realtime-publication.ts
+var REALTIME_TABLES = "_naro_realtime_tables";
+var REALTIME_TABLES_SQL = `CREATE TABLE IF NOT EXISTS ${REALTIME_TABLES} (table_name TEXT NOT NULL PRIMARY KEY COLLATE NOCASE, created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')))`;
+var MAX_PUBLISHED_TABLES = 100;
+var PUBLISHED_TABLES_SQL = `SELECT table_name FROM ${REALTIME_TABLES} ORDER BY rowid LIMIT ${String(MAX_PUBLISHED_TABLES)}`;
 
 // ../../packages/data-core/src/system-sql.ts
 async function convertLegacyPolicies(db, found) {
@@ -29685,6 +30677,7 @@ var MIGRATIONS_TABLE = "CREATE TABLE IF NOT EXISTS _naro_migrations (version INT
 var STORAGE_SUBQUERIES_VERSION = 7;
 var STORAGE_SUBQUERIES_NAME = "storage_subquery_policies";
 var STORAGE_SUBQUERIES_SQL = `SELECT version FROM _naro_migrations WHERE version = ${String(STORAGE_SUBQUERIES_VERSION)} AND name = '${STORAGE_SUBQUERIES_NAME}'`;
+var REALTIME_TABLES_VERSION = 8;
 var SYSTEM_MIGRATIONS = [
   {
     version: 1,
@@ -29773,6 +30766,23 @@ var SYSTEM_MIGRATIONS = [
     version: STORAGE_SUBQUERIES_VERSION,
     name: STORAGE_SUBQUERIES_NAME,
     statements: []
+  },
+  {
+    // Realtime 3-2b (original spec §9.1, design §7.1): the tables whose
+    // Data API writes reach the hub. Empty until the publish API (3-2c)
+    // writes it. A worker from before it never reads it.
+    version: REALTIME_TABLES_VERSION,
+    name: "realtime",
+    statements: [REALTIME_TABLES_SQL]
+  },
+  {
+    // Functions 3-3a (design 2026-10-29 §6.3): the function registry the
+    // gate reads. Every backend gets it, Functions on or not; the control
+    // plane (3-3b) writes it. A worker from before it never reads it, and a
+    // worker that reads it on a D1 without it answers 409 BACKEND_OUTDATED.
+    version: FUNCTIONS_REGISTRY_VERSION,
+    name: "functions",
+    statements: [FUNCTIONS_TABLE_SQL]
   }
 ];
 
@@ -29972,6 +30982,10 @@ var ENTERPRISE_REALTIME_LIMITS = Object.freeze({
   restRequestsPerSecond: 100
 });
 
+// ../../packages/data-core/src/realtime-changes.ts
+var CHANGE_TYPES = Object.freeze({ insert: "INSERT", update: "UPDATE", delete: "DELETE" });
+var CHANGE_EVENT_CODES = Object.freeze({ "*": 0, INSERT: 1, UPDATE: 2, DELETE: 3 });
+
 // ../../packages/data-core/src/redirect-origins.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
   "localhost",
@@ -30540,13 +31554,13 @@ function compareMigrations(local, applied) {
       rows.push({ name, status: "applied", appliedAt: exact.appliedAt });
       continue;
     }
-    const bare = ledger.get(name.replace(/\.sql$/, ""));
-    if (bare) {
-      ledger.delete(bare.name);
+    const bare2 = ledger.get(name.replace(/\.sql$/, ""));
+    if (bare2) {
+      ledger.delete(bare2.name);
       rows.push({
         name,
         status: "applied",
-        appliedAt: bare.appliedAt,
+        appliedAt: bare2.appliedAt,
         warning: "ledger-name-missing-extension"
       });
       continue;
@@ -31489,6 +32503,10 @@ function failureCode(error51, fallback) {
   const code = error51 && typeof error51 === "object" ? error51.code : void 0;
   return typeof code === "string" && DEPLOYMENT_CODES.has(code) ? code : fallback;
 }
+var SYSTEM_NAMES = new Set(NARO_SYSTEM_ENV_NAMES);
+function isNaroSystemName(key) {
+  return SYSTEM_NAMES.has(key);
+}
 function slugify2(value) {
   const slug = value.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 54);
   return slug || "app";
@@ -31671,6 +32689,16 @@ async function deployDirectory(sourceDir, options, log2) {
     const provided = options.env ?? {};
     missing = scanned.filter((key) => !existing.has(key) && !(key in provided));
   }
+  if (environment !== void 0 && options.projectId && missing.some((key) => isNaroSystemName(key))) {
+    const backend = await client.backend.info(options.projectId).catch(() => null);
+    if (backend !== null && backend.status !== "none") {
+      const set2 = missing.filter((key) => isNaroSystemName(key));
+      missing = missing.filter((key) => !isNaroSystemName(key));
+      log2(
+        `\u25B8 naro sets ${set2.join(", ")} for ${environment} to its own backend's: not asked for`
+      );
+    }
+  }
   let collected = {};
   if (missing.length > 0) {
     log2(
@@ -31716,7 +32744,16 @@ async function deployDirectory(sourceDir, options, log2) {
         repositoryUrl: sourceDir,
         branch: ctx.branch,
         rootDirectory: options.rootDirectory ?? null,
-        env: { ...ctx.env, ...envToSend },
+        // An environment's deploy: the control plane saved what this sent for
+        // that environment and then chose its values, so a key sent and a key
+        // chosen usually hold the same value — except the names naro sets for
+        // an environment with a backend (named environments spec §8.3), which
+        // must win here too, or this build would call another backend than
+        // the worker's bindings, and a key the server failed to save
+        // (`envSkipped`), whose stored value the worker gets and so this build
+        // takes too. Production and preview keep a value sent over the stored
+        // one, as before.
+        env: ctx.environment ? { ...envToSend, ...ctx.env } : { ...ctx.env, ...envToSend },
         strategy: ctx.strategy ?? null,
         ...ctx.vinextEnabled === void 0 ? {} : { vinextEnabled: ctx.vinextEnabled }
       },
@@ -31807,10 +32844,12 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  environmentGuidance,
   parseGitHubRemote,
   schemaMigrationTitle,
   projectPath,
   splitStatements,
+  environmentSlugProblem,
   ANALYTICS_FILTER_KEYS,
   NaroError,
   promoteTargetUnsupported,
@@ -31847,11 +32886,11 @@ export {
   summarizeStatement,
   parseDotenvDetailed,
   serializeDotenv,
+  systemTablePredicate,
   MAX_SINGLE_UPLOAD_BYTES,
   checkObjectName,
   parseCacheControl,
   STORAGE_OBJECTS_TABLE,
-  systemTablePredicate,
   dataError,
   SCHEMA_SQL,
   tableNames,