naro-cli 0.20.0 → 0.22.0

package/dist/index.js

@@ -32,6 +32,8 @@ import {
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
+  environmentGuidance,
+  environmentSlugProblem,
   formatRedirectEntry,
   generateTypes,
   indexesFromRows,
@@ -97,7 +99,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-SAA66XLD.js";
+} from "./chunk-MBSO3K6L.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -543,6 +545,37 @@ import { readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
+// src/data-environment.ts
+var DATA_ENV_MESSAGES = {
+  name: "--env must be production or an environment name.",
+  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
+  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
+};
+function dataEnvironment(flags) {
+  const value = flags.env;
+  if (value === void 0 || value === "production") return null;
+  if (value === "preview")
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
+  if (environmentSlugProblem(value) !== null)
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
+  return value;
+}
+async function dataClient(context) {
+  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
+}
+function databaseName(environment) {
+  return environment === null ? "the project database" : `the ${environment} environment's database`;
+}
+function enableBackendCommand(environment) {
+  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
+}
+function envFlag(environment) {
+  return environment === null ? "" : ` --env ${environment}`;
+}
+function forEnvironment(text, environment) {
+  return environmentGuidance(text, environment);
+}
+
 // src/commands/migration.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join, relative } from "path";
@@ -641,7 +674,7 @@ async function runMigrationNew(context, deps = processStdin) {
   ]);
 }
 async function runMigrationList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -721,7 +754,7 @@ async function runMigrationRepair(context) {
       "VALIDATION_FAILED",
       "Pass --status applied or --status reverted."
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const ledger = await appliedMigrations(client, projectId);
   const recorded = ledger.some(
@@ -735,7 +768,7 @@ async function runMigrationRepair(context) {
   }
   await confirmOrAbort(
     context,
-    status === "applied" ? `Mark ${key} as applied in the project database's ledger? Its SQL is not run.` : `Remove ${key} from the project database's ledger? Its SQL is not rolled back.`
+    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
   );
   if (status === "applied" && ledger.length === 0)
     await client.db.query(projectId, { sql: LEDGER_DDL });
@@ -754,7 +787,7 @@ async function runMigrationRepair(context) {
   ]);
 }
 async function runMigrationUp(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -782,7 +815,7 @@ async function runMigrationUp(context) {
   for (const name of pending) context.output.log(`  ${printable(name)}`);
   await confirmOrAbort(
     context,
-    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
+    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
   );
   const { applied, warnings } = await applyMigrationFiles(
     context,
@@ -1187,16 +1220,16 @@ var DISABLE_QUESTION = "Turn the backend off? In up to about 90 seconds your app
 var OFF_ADVICE = "Turned off: your app's /_naro/* requests get 404. The data, users and keys are kept \u2014 `naro backend enable` turns it back on with the same keys.";
 var TURNING_OFF_ADVICE = "Turning it off did not finish: your app's /_naro/* requests may still be answered. Run `naro backend disable` again to finish it \u2014 the control plane also retries every few minutes.";
 var TURNING_OFF_NOW_ADVICE = "Turning off: another run is removing the routes right now. Check again in a minute with `naro backend`.";
-function leaseHeld(info, now) {
+function leaseHeld(info, now2) {
   if (info.leaseExpiresAt === null) return false;
   const until = Date.parse(info.leaseExpiresAt);
-  return !Number.isNaN(until) && until > now;
+  return !Number.isNaN(until) && until > now2;
 }
 function sentence(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
-function statusText(info, now) {
+function statusText(info, now2) {
   switch (info.status) {
     case "none":
       return "not provisioned";
@@ -1204,7 +1237,7 @@ function statusText(info, now) {
       return "ready";
     default: {
       const text = info.step ? `${info.status} (step: ${info.step})` : info.status;
-      return isStalledBackend(info, now) ? `${text}, stalled` : text;
+      return isStalledBackend(info, now2) ? `${text}, stalled` : text;
     }
   }
 }
@@ -1214,10 +1247,10 @@ function switchText(info) {
     return info.disabledAt ? `turning off (since ${printable(info.disabledAt)})` : "turning off";
   return info.disabledAt ? `off since ${printable(info.disabledAt)}` : "off";
 }
-function backendLines(info, now = Date.now()) {
+function backendLines(info, now2 = Date.now()) {
   const lines = [
     `Backend:     ${switchText(info)}`,
-    `Status:      ${statusText(info, now)}`,
+    `Status:      ${statusText(info, now2)}`,
     `URL:         ${info.url}`
   ];
   if (info.anonKey) lines.push(`Anon key:    ${info.anonKey}`);
@@ -1227,21 +1260,27 @@ function backendLines(info, now = Date.now()) {
     );
   return lines;
 }
-function adviceLines(info, now) {
+var ENVIRONMENT_TURNING_OFF_ADVICE = "Turning it off did not finish: your app's /_naro/* requests may still be answered. The control plane finishes it within a few minutes: the backend's switch is production's, and every environment follows it.";
+function adviceLines(info, now2, environment = null) {
   if (!info.enabled && info.status !== "none") {
     if (!info.turningOff) return [OFF_ADVICE];
-    return [leaseHeld(info, now) ? TURNING_OFF_NOW_ADVICE : TURNING_OFF_ADVICE];
+    if (leaseHeld(info, now2)) return [TURNING_OFF_NOW_ADVICE];
+    return [
+      environment === null ? TURNING_OFF_ADVICE : ENVIRONMENT_TURNING_OFF_ADVICE
+    ];
   }
   switch (info.status) {
     case "none":
-      return ["Run `naro backend enable` to turn it on."];
+      return [
+        environment === null ? "Run `naro backend enable` to turn it on." : `This environment has no backend yet: \`naro environments provision ${environment}\` makes it while production's backend is on \u2014 turn that on with \`naro backend enable\`.`
+      ];
     case "error":
       return [
         ...info.error ? [`Error:       ${printable(info.error)}`] : [],
         "Run `naro backend enable` again \u2014 it picks up where it stopped."
       ];
     case "provisioning":
-      return isStalledBackend(info, now) ? [
+      return isStalledBackend(info, now2) ? [
         "No run is working on it: the last one stopped part-way. Run `naro backend enable` to pick it up."
       ] : [
         "Provisioning is running. Check again in a minute with `naro backend`."
@@ -1255,17 +1294,21 @@ function stoppedAt(info) {
   return `stopped at ${step}${info.error ? `: ${sentence(info.error)}` : "."}`;
 }
 async function runBackendInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
-  const now = Date.now();
+  const now2 = Date.now();
+  const environment = dataEnvironment(context.flags);
   context.output.result(
-    { projectId, backend, stalled: isStalledBackend(backend, now) },
-    [...backendLines(backend, now), ...adviceLines(backend, now)]
+    { projectId, backend, stalled: isStalledBackend(backend, now2) },
+    [
+      ...backendLines(backend, now2),
+      ...adviceLines(backend, now2, environment)
+    ].map((line) => forEnvironment(line, environment))
   );
 }
 async function runBackendEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let backend;
   try {
@@ -1309,7 +1352,7 @@ async function runBackendEnable(context) {
 }
 async function runBackendDisable(context) {
   await confirmOrAbort(context, DISABLE_QUESTION);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.disable(projectId);
   if (backend.status === "none") {
@@ -1326,7 +1369,8 @@ async function runBackendDisable(context) {
   ]);
 }
 async function runBackendKeys(context) {
-  const client = await context.client();
+  const environment = dataEnvironment(context.flags);
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const keys = await client.backend.keys(projectId);
   if (!context.flags.reveal) {
@@ -1339,7 +1383,10 @@ async function runBackendKeys(context) {
       [
         `Anon key:    ${keys.anonKey}`,
         `Service key: ${keys.serviceKeyPrefix}\u2026 (hidden)`,
-        "`naro backend keys --reveal` prints the service key (needs database write access)."
+        forEnvironment(
+          "`naro backend keys --reveal` prints the service key (needs database write access).",
+          environment
+        )
       ]
     );
     return;
@@ -1359,19 +1406,19 @@ function rotateKind(context) {
 function keyLabel(kind) {
   return kind === "anon" ? "Anon key:    " : "Service key: ";
 }
-function rotationWarning(kind, backend) {
+function rotationWarning(kind, backend, environment = null) {
   if (backend.status === "error")
-    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`naro backend enable\` to finish.`;
+    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`${enableBackendCommand(environment)}\` to finish.`;
   if (backend.status !== "ready")
-    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend\`.`;
+    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend${envFlag(environment)}\`.`;
   return null;
 }
-function checkKeysSentence(kind) {
+function checkKeysSentence(kind, environment = null) {
   const keys = kind === "service" ? "naro backend keys --reveal" : "naro backend keys";
-  return `Run \`${keys}\` to see which key is live, then \`naro backend enable\`.`;
+  return `Run \`${keys}${envFlag(environment)}\` to see which key is live, then \`${enableBackendCommand(environment)}\`.`;
 }
-function rotationHint(kind) {
-  return `The rotation may have gone through anyway. ${checkKeysSentence(kind)}`;
+function rotationHint(kind, environment = null) {
+  return `The rotation may have gone through anyway. ${checkKeysSentence(kind, environment)}`;
 }
 function outcomeUnknown(error) {
   return error.code === "BACKEND_ROTATION_FAILED" || error.code === "INTERNAL_ERROR" || error.code === "NETWORK_ERROR" || error.status !== void 0 && error.status >= 500;
@@ -1382,18 +1429,19 @@ async function runBackendKeysRotate(context) {
     context,
     `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
+  const environment = dataEnvironment(context.flags);
   const projectId = await context.resolveProjectId();
   let rotated;
   try {
     rotated = await client.backend.rotateKey(projectId, kind);
   } catch (error) {
     if (!isNaroError(error)) throw error;
-    const hint = rotationHint(kind);
+    const hint = rotationHint(kind, environment);
     if (error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind)}`,
+        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind, environment)}`,
         { details: { hint }, cause: error }
       );
     if (!outcomeUnknown(error)) throw error;
@@ -1405,7 +1453,7 @@ async function runBackendKeysRotate(context) {
     });
   }
   const { backend, key } = rotated;
-  const warning = rotationWarning(kind, backend);
+  const warning = rotationWarning(kind, backend, environment);
   if (kind === "service") context.output.warn(SERVICE_KEY_WARNING);
   if (warning) context.output.warn(warning);
   context.output.result(
@@ -1442,14 +1490,21 @@ function sentence2(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
-function stoppedMessage(backend) {
+function stoppedMessage(backend, environment = null) {
+  const enable = enableBackendCommand(environment);
   const step = backend.step ?? "worker";
   const reason = backend.error?.trim() ? `: ${sentence2(backend.error)}` : ".";
   if (BACKEND_STEPS.indexOf(step) > BACKEND_STEPS.indexOf("worker"))
-    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`naro backend enable\` to finish.`;
-  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`naro backend enable\` puts the saved ones on it.`;
+    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`${enable}\` to finish.`;
+  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`${enable}\` puts the saved ones on it.`;
 }
 var NOT_APPLIED_WARNING = "\u26A0 These are the saved settings. The Naro worker's last update did not get past its upload, so it may still run older ones \u2014 run `naro backend enable` to put these on it.";
+function notAppliedWarning(environment) {
+  return environment === null ? NOT_APPLIED_WARNING : NOT_APPLIED_WARNING.replace(
+    "`naro backend enable`",
+    `\`${enableBackendCommand(environment)}\``
+  );
+}
 function authLines(auth) {
   const lines = [
     auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
@@ -1495,14 +1550,18 @@ function adviceLines2(auth) {
   return lines;
 }
 async function runBackendAuthStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
-  if (auth.applied === false) context.output.warn(NOT_APPLIED_WARNING);
-  context.output.result({ projectId, auth }, [
-    ...authLines(auth),
-    ...adviceLines2(auth)
-  ]);
+  const environment = dataEnvironment(context.flags);
+  if (auth.applied === false)
+    context.output.warn(notAppliedWarning(environment));
+  context.output.result(
+    { projectId, auth },
+    [...authLines(auth), ...adviceLines2(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
 async function readSecret(context, input, given, flag, what, usage) {
   if (!given)
@@ -1518,6 +1577,7 @@ async function readSecret(context, input, given, flag, what, usage) {
 }
 async function change(context, send2, done, after) {
   const projectId = await context.resolveProjectId();
+  const environment = dataEnvironment(context.flags);
   let answer;
   try {
     answer = await send2(projectId);
@@ -1525,13 +1585,13 @@ async function change(context, send2, done, after) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
+        `The change did not answer within 2 minutes. \`naro backend auth${envFlag(environment)}\` shows what is saved, and \`${enableBackendCommand(environment)}\` finishes putting it on the Naro worker.`,
         { cause: error }
       );
     const saved = isNaroError(error) ? error.details?.auth : void 0;
     if (isNaroError(error) && error.code === "BACKEND_PROVISION_FAILED" && typeof saved === "object" && saved !== null) {
       for (const line of authLines(saved))
-        context.output.log(line);
+        context.output.log(forEnvironment(line, environment));
       throw new NaroError(error.code, error.message, {
         details: { projectId, ...error.details }
       });
@@ -1540,20 +1600,29 @@ async function change(context, send2, done, after) {
   }
   const { auth, backend } = answer;
   if (backend.status === "error") {
-    for (const line of authLines(auth)) context.output.log(line);
-    throw new NaroError("BACKEND_PROVISION_FAILED", stoppedMessage(backend), {
-      details: { projectId, auth, backend }
-    });
+    for (const line of authLines(auth))
+      context.output.log(forEnvironment(line, environment));
+    throw new NaroError(
+      "BACKEND_PROVISION_FAILED",
+      stoppedMessage(backend, environment),
+      {
+        details: { projectId, auth, backend }
+      }
+    );
   }
   if (backend.status !== "ready")
     context.output.warn(
-      "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`."
+      forEnvironment(
+        "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`.",
+        environment
+      )
     );
-  context.output.result({ projectId, auth, backend }, [
-    ...done,
-    ...after ? after(auth) : [],
-    ...authLines(auth)
-  ]);
+  context.output.result(
+    { projectId, auth, backend },
+    [...done, ...after ? after(auth) : [], ...authLines(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
 async function runBackendAuthEmailSet(context, input = processStdin2) {
   const { provider, from } = context.flags;
@@ -1572,7 +1641,7 @@ async function runBackendAuthEmailSet(context, input = processStdin2) {
     "Resend API key",
     AUTH_USAGE.email
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1588,7 +1657,7 @@ async function runBackendAuthEmailRemove(context) {
     context,
     "Remove email? Confirmation and password reset emails stop at once."
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, "email"),
@@ -1614,7 +1683,7 @@ async function runBackendAuthOAuthSet(context, input = processStdin2) {
     `${LABELS[provider]} client secret`,
     AUTH_USAGE.oauth
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const patch = {
     oauth: { [provider]: { clientId, clientSecret } }
   };
@@ -1632,7 +1701,7 @@ async function runBackendAuthOAuthRemove(context) {
     context,
     `Remove ${LABELS[provider]} sign-in? Users who signed in with ${LABELS[provider]} cannot sign in with it until it is set up again.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, provider),
@@ -1640,7 +1709,7 @@ async function runBackendAuthOAuthRemove(context) {
   );
 }
 async function runBackendAuthRedirectsList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
   const production = productionOrigins(auth);
@@ -1657,7 +1726,10 @@ async function runBackendAuthRedirectsList(context) {
       ),
       ...auth.redirectOrigins,
       ...auth.redirectOrigins.length === 0 ? [
-        "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/."
+        forEnvironment(
+          "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/.",
+          dataEnvironment(context.flags)
+        )
       ] : []
     ]
   );
@@ -1670,7 +1742,7 @@ function originOf(context) {
 }
 async function runBackendAuthRedirectsAdd(context) {
   const origin = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1684,7 +1756,7 @@ function allowing(list, origin) {
 }
 async function runBackendAuthRedirectsRemove(context) {
   const given = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const parsed = parseRedirectEntry(given);
   if (parsed) {
@@ -1730,7 +1802,7 @@ async function runBackendAuthRequireVerification(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.verification);
   const on = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { requireEmailVerification: on }),
@@ -1744,7 +1816,7 @@ async function runBackendAuthSignups(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.signups);
   const open = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { signupsEnabled: open }),
@@ -1763,7 +1835,7 @@ async function runBackendAuthPassword(context) {
       "VALIDATION_FAILED",
       `--min-length must be a whole number from ${String(MIN_LENGTH_FLOOR)} to ${String(MIN_LENGTH_CEILING)}. ${AUTH_USAGE.password}`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { passwordMinLength: length }),
@@ -1835,13 +1907,16 @@ function userTable(users) {
   );
 }
 async function runBackendUsersList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users, total } = await allUsers(client, projectId);
   context.output.result(
     { projectId, users, total },
     users.length === 0 ? [
-      "No users yet. Create one with `naro backend users create --username <name> --password-stdin`."
+      forEnvironment(
+        "No users yet. Create one with `naro backend users create --username <name> --password-stdin`.",
+        dataEnvironment(context.flags)
+      )
     ] : [
       `${String(total)} ${total === 1 ? "user" : "users"}, newest first:`,
       ...userTable(users)
@@ -1885,7 +1960,7 @@ async function runBackendUsersCreate(context, input = processStdin3) {
   if (username === void 0 && email === void 0 || context.positionals.length > 0)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
   const password = await passwordOf(context, input);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const body = { password };
   if (username !== void 0) body.username = username;
@@ -1911,7 +1986,7 @@ async function runBackendUsersDelete(context) {
   const [given] = context.positionals;
   if (given === void 0 || context.positionals.length > 1)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.delete);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users } = await allUsers(client, projectId);
   const user = find(users, given);
@@ -2018,7 +2093,7 @@ function usageLines(info) {
   }
   return lines;
 }
-function describeLines(info) {
+function describeLines(info, environment = null) {
   const lines = [
     `Provider: ${info.provider}`,
     `Status:   ${info.status}`,
@@ -2039,17 +2114,22 @@ function describeLines(info) {
   );
   lines.push(...usageLines(info));
   if (info.provider === "none")
-    lines.push("Run `naro db enable` to create the database.");
+    lines.push(
+      environment === null ? "Run `naro db enable` to create the database." : `The ${environment} environment has no database yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
   return lines;
 }
 async function runDbInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.info(projectId);
-  context.output.result({ projectId, database }, describeLines(database));
+  context.output.result(
+    { projectId, database },
+    describeLines(database, dataEnvironment(context.flags))
+  );
 }
 async function runDbEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.enable(projectId);
   context.output.result({ projectId, database }, [
@@ -2080,7 +2160,7 @@ async function readSql(context, deps) {
 }
 async function runDbQuery(context, deps = processStdin4) {
   const sql = await readSql(context, deps);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const result = await client.db.query(projectId, { sql });
   const lines = [];
@@ -2115,14 +2195,16 @@ var defaults = {
     writeFileSync2(path, data, { flag: "wx" });
   }
 };
-var EXPORT_NOTICE = "Exporting the project database. Cloudflare holds other queries to this database until the export finishes.";
+function exportNotice(environment) {
+  return `Exporting ${databaseName(environment)}. Cloudflare holds other queries to this database until the export finishes.`;
+}
 function reasonOf(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function withoutUrl(text, url) {
   return text.split(url).join("the signed URL").replace(/\S*X-Amz-Signature=\S*/gi, "the signed URL");
 }
-function downloadFailed(url, reason, original) {
+function downloadFailed(url, reason, original, again = "naro db dump") {
   const scrubbed = withoutUrl(reason, url);
   let cause;
   if (original !== void 0) {
@@ -2135,7 +2217,7 @@ function downloadFailed(url, reason, original) {
   }
   return new NaroError(
     "DATABASE_UNAVAILABLE",
-    `Could not download the dump (${scrubbed}). Run naro db dump again.`,
+    `Could not download the dump (${scrubbed}). Run ${again} again.`,
     cause === void 0 ? {} : { cause }
   );
 }
@@ -2153,17 +2235,22 @@ var DownloadStreamError = class extends Error {
     this.name = "DownloadStreamError";
   }
 };
-async function openDownload(deps, url) {
+async function openDownload(deps, url, again) {
   let response;
   try {
     response = await deps.fetch(url);
   } catch (error) {
-    throw downloadFailed(url, reasonOf(error), error);
+    throw downloadFailed(url, reasonOf(error), error, again);
   }
   if (!response.ok || response.body === null) {
     await response.body?.cancel().catch(() => {
     });
-    throw downloadFailed(url, `HTTP ${String(response.status)}`);
+    throw downloadFailed(
+      url,
+      `HTTP ${String(response.status)}`,
+      void 0,
+      again
+    );
   }
   return response.body;
 }
@@ -2198,8 +2285,8 @@ async function streamInto(body, destination, end) {
   await pipeline(chunksOf(body), counter, destination, { end });
   return bytes;
 }
-function streamFailed(error, url, shown) {
-  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original) : writeFailed(shown, error);
+function streamFailed(error, url, shown, again) {
+  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original, again) : writeFailed(shown, error);
 }
 function refuseDirectory(path, shown) {
   let isDirectory = false;
@@ -2220,8 +2307,8 @@ function makeOutputDirectory(path, shown) {
     throw writeFailed(shown, error);
   }
 }
-async function downloadToFile(deps, url, path, shown) {
-  const body = await openDownload(deps, url);
+async function downloadToFile(deps, url, path, shown, again) {
+  const body = await openDownload(deps, url, again);
   const partial = join2(
     dirname(path),
     `.${basename(path)}.${String(process.pid)}.part`
@@ -2235,15 +2322,15 @@ async function downloadToFile(deps, url, path, shown) {
       rmSync(partial, { force: true });
     } catch {
     }
-    throw streamFailed(error, url, shown);
+    throw streamFailed(error, url, shown, again);
   }
 }
-async function downloadToStdout(deps, url) {
-  const body = await openDownload(deps, url);
+async function downloadToStdout(deps, url, again) {
+  const body = await openDownload(deps, url, again);
   try {
     return await streamInto(body, deps.stdout, false);
   } catch (error) {
-    throw streamFailed(error, url, "stdout");
+    throw streamFailed(error, url, "stdout", again);
   }
 }
 async function runDbDump(context, overrides = {}) {
@@ -2272,10 +2359,12 @@ async function runDbDump(context, overrides = {}) {
   };
   const output = flags.output === void 0 ? null : { path: resolve2(context.cwd, flags.output), shown: flags.output };
   if (output) refuseDirectory(output.path, output.shown);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   if (output) makeOutputDirectory(output.path, output.shown);
-  context.output.warn(EXPORT_NOTICE);
+  const environment = dataEnvironment(context.flags);
+  const again = `naro db dump${envFlag(environment)}`;
+  context.output.warn(exportNotice(environment));
   const step = await client.db.export(projectId, options, {
     sleep: deps.sleep
   });
@@ -2283,16 +2372,16 @@ async function runDbDump(context, overrides = {}) {
   if (file === null)
     throw new NaroError(
       "DATABASE_UNAVAILABLE",
-      "Could not download the dump (Cloudflare finished the export without a file). Run naro db dump again."
+      `Could not download the dump (Cloudflare finished the export without a file). Run ${again} again.`
     );
-  const bytes = output === null ? await downloadToStdout(deps, file.url) : await downloadToFile(deps, file.url, output.path, output.shown);
+  const bytes = output === null ? await downloadToStdout(deps, file.url, again) : await downloadToFile(deps, file.url, output.path, output.shown, again);
   const bookmark = step.atBookmark;
   if (!context.output.json) {
     context.output.warn(
       `\u2713 Wrote ${flags.output ?? "stdout"} (${humanSize(bytes)}) at bookmark ${bookmark}.`
     );
     context.output.warn(
-      `  naro db restore --bookmark ${bookmark} returns the database to this point.`
+      `  naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} returns the database to this point.`
     );
   }
   context.output.result({ output: flags.output, bytes, atBookmark: bookmark });
@@ -2313,7 +2402,7 @@ function withWayBack(context, error, before) {
     return error;
   if (!context.output.json)
     context.output.warn(
-      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before} undoes it.`
+      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before}${envFlag(dataEnvironment(context.flags))} undoes it.`
     );
   return new NaroError(error.code, error.message, {
     ...error.status === void 0 ? {} : { status: error.status },
@@ -2331,7 +2420,7 @@ async function runDbRestore(context) {
     );
   if ("bookmark" in given && !isBookmark(given.bookmark))
     throw new NaroError("VALIDATION_FAILED", BOOKMARK_FORMAT_MESSAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let target;
   let at = null;
@@ -2358,7 +2447,7 @@ async function runDbRestore(context) {
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore ${databaseName(dataEnvironment(context.flags))} to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -2373,8 +2462,8 @@ async function runDbRestore(context) {
       previousBookmark: restored.previousBookmark
     },
     [
-      `\u2713 Restored the project database to bookmark ${restored.bookmark}.`,
-      `  To undo: naro db restore --bookmark ${restored.previousBookmark}`
+      `\u2713 Restored ${databaseName(dataEnvironment(context.flags))} to bookmark ${restored.bookmark}.`,
+      `  To undo: naro db restore --bookmark ${restored.previousBookmark}${envFlag(dataEnvironment(context.flags))}`
     ]
   );
 }
@@ -2390,7 +2479,7 @@ async function runDbPull(context, overrides = {}) {
   const name = nextMigrationFileName(existing, "remote_schema");
   const path = join2(dir, name);
   const shown = relativeToCwd(context, path);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
@@ -2524,7 +2613,7 @@ function issueLines(issues, tables) {
   ];
 }
 async function runDbLint(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
@@ -2730,7 +2819,7 @@ function resetStopped(context, error, bookmark, lead, message) {
   const naroError = isNaroError(error) ? error : toNaroError(error);
   if (!context.output.json)
     context.output.warn(
-      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   return new NaroError(naroError.code, message(naroError.message), {
     ...naroError.status === void 0 ? {} : { status: naroError.status },
@@ -2757,7 +2846,7 @@ ${problemLines.join("\n")}`,
       { details: { problems } }
     );
   const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
   const { policyTable: policyTable2, storageTable, ...input } = await readSchema(
@@ -2831,11 +2920,11 @@ ${problemLines.join("\n")}`,
   }
   if (bookmark !== null)
     context.output.log(
-      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   await confirmOrAbort(
     context,
-    `Reset the project database? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
+    `Reset ${databaseName(dataEnvironment(context.flags))}? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
   );
   let done = 0;
   const total = plan.batches.length;
@@ -2887,8 +2976,10 @@ ${problemLines.join("\n")}`,
       warnings
     },
     [
-      `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
-      ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
+      `\u2713 Reset ${databaseName(dataEnvironment(context.flags))}: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+      ...bookmark === null ? [] : [
+        `  To undo: naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))}`
+      ]
     ]
   );
 }
@@ -3186,10 +3277,10 @@ function truth(text) {
 var DECIMAL = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
 function exactNumber(text) {
   if (!DECIMAL.test(text)) return text;
-  const number = Number(text);
-  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
+  const number2 = Number(text);
+  if (!text.includes(".")) return Number.isSafeInteger(number2) ? number2 : text;
   const trimmed = text.replace(/\.?0+$/, "");
-  return String(number) === trimmed ? number : text;
+  return String(number2) === trimmed ? number2 : text;
 }
 function quoteFilterValue(value) {
   const text = String(value);
@@ -3524,6 +3615,12 @@ function policyTable(policies) {
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
+function hintsFor(lines, environment) {
+  if (environment === null) return lines;
+  return lines.map(
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+  );
+}
 function statementLine(policy) {
   if (policy.invalid !== null)
     return printable(
@@ -3556,7 +3653,7 @@ function policyStatements(policies) {
 }
 async function runPolicyList(context) {
   const table3 = context.flags.table;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
@@ -3574,7 +3671,10 @@ async function runPolicyList(context) {
       "No policies yet: every table denies anon and signed-in requests.",
       'Add one with `naro policy create "CREATE POLICY \u2026"` or `naro policy set <table> --select public`.'
     ];
-  context.output.result({ projectId, policies }, lines);
+  context.output.result(
+    { projectId, policies },
+    hintsFor(lines, dataEnvironment(context.flags))
+  );
 }
 function statementText(context) {
   const [positional] = context.positionals;
@@ -3648,7 +3748,7 @@ async function runStatements(client, projectId, statements, allowUnindexed) {
 }
 async function runPolicyCreate(context) {
   const statements = policyStatementsOf(statementText(context));
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const applied = await runStatements(
     client,
@@ -3669,7 +3769,7 @@ async function runPolicyDrop(context) {
     context,
     `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
@@ -3683,7 +3783,7 @@ async function runPolicyDrop(context) {
 async function runPolicySet(context) {
   const [table3] = context.positionalOrThrow(1, SET_USAGE);
   const patch = policyPatch(context.flags, context, table3);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
@@ -3700,11 +3800,14 @@ async function runPolicySet(context) {
   }
   context.output.result(
     { projectId, policy, ...named === void 0 ? {} : { policies: named } },
-    [
-      `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-      ...policyTable([policy]),
-      ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
-    ]
+    hintsFor(
+      [
+        `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
+        ...policyTable([policy]),
+        ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
+      ],
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runPolicyRemove(context) {
@@ -3713,7 +3816,7 @@ async function runPolicyRemove(context) {
     context,
     `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
@@ -3846,7 +3949,7 @@ function ruleText(value) {
   return "invalid" in value ? "invalid" : "condition";
 }
 var SUGAR_NAME = /^naro_(?:select|insert|update|delete)$/;
-function removedLines(policy, dryRun) {
+function removedLines(policy, dryRun, environment) {
   const verb = dryRun ? "Would remove" : "\u2713 Removed";
   const names = policy.policies ?? [];
   let line;
@@ -3884,7 +3987,11 @@ function removedLines(policy, dryRun) {
     lines.push(
       `  As a command, for the owner ${one ? "rule" : "rules"} (${owners.map((owner) => printable(owner.name)).join(", ")}): CREATE POLICY has no owner column, so naro policy create cannot make ${one ? "it" : "them"} again.`,
       // The server's bytes, or not shown: a name may hold a line break.
-      typeof command !== "string" ? "  naro policy set <table> --<action> owner --owner <column> sets one." : isPrintable(command) ? command : "  The command has characters that cannot be shown here: --json has the exact text."
+      // Under --env, the command acts on the environment (PR #343 review 2).
+      typeof command !== "string" ? forEnvironment(
+        "  naro policy set <table> --<action> owner --owner <column> sets one.",
+        environment
+      ) : isPrintable(command) ? forEnvironment(command, environment) : "  The command has characters that cannot be shown here: --json has the exact text."
     );
   }
   return lines;
@@ -3893,13 +4000,13 @@ async function runSchemaChange(context, operations, question) {
   const dryRun = context.flags.dryRun === true;
   if (question !== void 0 && !dryRun)
     await confirmOrAbort(context, question);
-  const sent = dryRun ? operations.map((operation) => {
+  const sent2 = dryRun ? operations.map((operation) => {
     if (operation.op !== "dropTable" && operation.op !== "dropColumn")
       return operation;
     const { confirm: _confirm, ...rest } = operation;
     return rest;
   }) : operations;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -3911,7 +4018,7 @@ async function runSchemaChange(context, operations, question) {
     [...local, ...ledger.map((row) => row.name)],
     schemaMigrationTitle(operations[0] ?? {})
   );
-  const result = await client.db.schema(projectId, sent, {
+  const result = await client.db.schema(projectId, sent2, {
     ...dryRun ? { dryRun: true } : {},
     name
   });
@@ -3924,7 +4031,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
       ...result.policies.map((policy) => policyLine(policy, true)),
-      ...removed.flatMap((policy) => removedLines(policy, true))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, true, dataEnvironment(context.flags))
+      )
     ]);
     return;
   }
@@ -3946,7 +4055,10 @@ async function runSchemaChange(context, operations, question) {
     }
   }
   for (const warning of allWarnings)
-    context.output.warn(`\u26A0 ${printable(warning)}`);
+    context.output.warn(
+      `\u26A0 ${printable(forEnvironment(warning, dataEnvironment(context.flags)))}`
+    );
+  fileWarning &&= forEnvironment(fileWarning, dataEnvironment(context.flags));
   if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
   context.output.result(
     {
@@ -3960,7 +4072,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
       ...result.policies.map((policy) => policyLine(policy)),
-      ...removed.flatMap((policy) => removedLines(policy, false))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, false, dataEnvironment(context.flags))
+      )
     ]
   );
 }
@@ -4011,24 +4125,29 @@ async function runDbTableRename(context) {
   if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
   await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
+function inDatabase(environment) {
+  return environment === null ? "" : ` in ${databaseName(environment)}`;
+}
 async function runDbTableDropColumn(context) {
   const [table3, column] = context.positionals;
   if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
   const target = `${table3}.${column}`;
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropColumn", table: table3, column, confirm: target }],
-    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop column ${printable(target)}${inDatabase(env)} and its value in every row? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
   const [table3] = context.positionals;
   if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropTable", table: table3, confirm: table3 }],
-    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop table ${printable(table3)}${inDatabase(env)} and every row in it? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
@@ -5103,6 +5222,7 @@ ${serializeDotenv(vars)}`;
 var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
 var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
 var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var PROVISION_USAGE = "Usage: naro environments provision <slug>";
 var NO_BRANCH = "\u2014";
 function parseCopyEnv(value) {
   if (value === void 0) return void 0;
@@ -5137,14 +5257,26 @@ function table2(rows) {
     ).join("  ")
   );
 }
+function dataCell(environment) {
+  const status = environment.data?.status ?? "none";
+  return status === "none" ? NO_BRANCH : status;
+}
 function environmentRow(environment) {
   return [
     environment.slug,
     environment.url,
     environment.branch ?? NO_BRANCH,
-    environment.protectionEnabled ? "on" : "off"
+    environment.protectionEnabled ? "on" : "off",
+    dataCell(environment)
   ];
 }
+function dataErrorLines(environments) {
+  return environments.flatMap(
+    (environment) => environment.data?.status === "error" ? [
+      `\u26A0 ${environment.slug}: ${environment.data.error ?? "its data could not be made."} Run \`naro environments provision ${environment.slug}\` to try again.`
+    ] : []
+  );
+}
 async function runEnvironmentsList(context) {
   const projectId = await context.resolveProjectId();
   const client = await context.client();
@@ -5152,9 +5284,10 @@ async function runEnvironmentsList(context) {
   const count2 = String(environments.length);
   context.output.result({ projectId, environments, limit }, [
     ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
-      ["slug", "url", "branch", "protection"],
+      ["slug", "url", "branch", "protection", "data"],
       ...environments.map(environmentRow)
     ]),
+    ...dataErrorLines(environments),
     limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
   ]);
 }
@@ -5217,7 +5350,7 @@ async function runEnvironmentsDelete(context) {
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
-    `Delete environment ${slug}? Its worker and protection key are removed.`
+    `Delete environment ${slug}? Its worker, protection key and data \u2014 database, backend and Storage files \u2014 are removed.`
   );
   const client = await context.client();
   const found = await client.environments.get(projectId, slug);
@@ -5226,6 +5359,16 @@ async function runEnvironmentsDelete(context) {
     `\u2705 Deleted environment ${slug}`
   ]);
 }
+async function runEnvironmentsProvision(context) {
+  const [slug] = context.positionalOrThrow(1, PROVISION_USAGE);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.provision(projectId, found.id);
+  context.output.result({ projectId, environment }, [
+    (environment.data?.status ?? "none") === "none" ? `Environment ${slug} has no data to make: the project uses neither a Naro database nor a backend.` : `\u2705 Making environment ${slug}'s data \u2014 \`naro environments\` shows how it goes.`
+  ]);
+}
 
 // src/commands/gen.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
@@ -5235,7 +5378,7 @@ async function runGenTypes(context) {
   const { lang } = context.flags;
   if (lang !== void 0 && lang !== "typescript")
     throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const read = await policiesForTypes(client, projectId);
@@ -5722,6 +5865,127 @@ async function runProtectionBypassRemove(context) {
   context.output.result({ projectId, ...state }, ["Bypass secret removed."]);
 }
 
+// src/commands/realtime.ts
+var ADD_USAGE = "Usage: naro realtime tables add <table>\u2026";
+var REMOVE_USAGE2 = "Usage: naro realtime tables remove <table>\u2026 [--yes]";
+var DATA_API_NOTE = "Changes made through the Data API are published; writes your app makes with env.DB are not.";
+var number = (value) => value.toLocaleString("en-US");
+function tableName(table3) {
+  const name = printable(table3.name);
+  return table3.exists ? name : `${name} (dropped)`;
+}
+function linesFor(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
+function realtimeLines(info) {
+  if (!info.enabled)
+    return [
+      "Realtime: not enabled",
+      "Run `naro realtime enable` to turn it on (the project's backend must be on first)."
+    ];
+  const { live: live2 } = info;
+  return [
+    "Realtime: on (public channels: off)",
+    info.tables.length === 0 ? "Published tables: none \u2014 naro realtime tables add <table>" : `Published tables: ${info.tables.map(tableName).join(", ")}`,
+    live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`
+  ];
+}
+async function enableRealtime(client, projectId, environment) {
+  try {
+    return await client.realtime.enable(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        `Turning Realtime on did not answer within 2 minutes. \`naro realtime${envFlag(environment)}\` shows where it got to, and \`naro realtime enable${envFlag(environment)}\` again picks up where it stopped.`,
+        { cause: error }
+      );
+    throw error;
+  }
+}
+function tableNames2(context, usage) {
+  if (context.positionals.length === 0)
+    throw new NaroError("VALIDATION_FAILED", usage);
+  return context.positionals;
+}
+async function runRealtimeStatus(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const realtime = await client.realtime.info(projectId);
+  context.output.result(
+    { projectId, realtime },
+    linesFor(realtimeLines(realtime), dataEnvironment(context.flags))
+  );
+}
+async function runRealtimeEnable(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const environment = dataEnvironment(context.flags);
+  const realtime = await enableRealtime(client, projectId, environment);
+  context.output.result(
+    { projectId, realtime },
+    linesFor(
+      [
+        "\u2705 Realtime is on. Publish a table with naro realtime tables add <table>.",
+        ...realtimeLines(realtime)
+      ],
+      environment
+    )
+  );
+}
+async function runRealtimeTablesList(context) {
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const tables = await client.realtime.listTables(projectId);
+  context.output.result(
+    { projectId, tables },
+    tables.length === 0 ? [
+      forEnvironment(
+        "No published tables. `naro realtime tables add <table>` publishes one.",
+        dataEnvironment(context.flags)
+      )
+    ] : tables.map(
+      (table3) => table3.exists ? `  ${printable(table3.name)}` : `  ${printable(table3.name)}  (dropped: no such table now)`
+    )
+  );
+}
+async function runRealtimeTablesAdd(context) {
+  const names = tableNames2(context, ADD_USAGE);
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const tables = [];
+  for (const name of names) {
+    const published = await client.realtime.publishTable(projectId, name);
+    tables.push(published);
+    context.output.log(
+      `\u2705 ${printable(published.table)} now publishes its changes (within about 10 seconds).`
+    );
+    for (const warning of published.warnings)
+      if (warning !== DATA_API_NOTE)
+        context.output.log(`\u26A0 ${printable(warning)}`);
+  }
+  context.output.result({ projectId, tables }, [`\u26A0 ${DATA_API_NOTE}`]);
+}
+async function runRealtimeTablesRemove(context) {
+  const names = tableNames2(context, REMOVE_USAGE2);
+  const shown = names.map(printable).join(", ");
+  await confirmOrAbort(
+    context,
+    names.length === 1 ? `Stop publishing ${shown}? Subscribers stop receiving its changes within about 10 seconds.` : `Stop publishing ${shown}? Subscribers stop receiving their changes within about 10 seconds.`
+  );
+  const client = await dataClient(context);
+  const projectId = await context.resolveProjectId();
+  const tables = [];
+  for (const name of names) {
+    const unpublished = await client.realtime.unpublishTable(projectId, name);
+    tables.push(unpublished);
+    context.output.log(
+      `\u2705 ${printable(unpublished.table)} no longer publishes its changes.`
+    );
+  }
+  context.output.result({ projectId, tables });
+}
+
 // src/commands/storage-units.ts
 var SIZE_MESSAGE = "--file-size-limit takes a whole number of bytes, or a size like 5MB (1000s) or 5MiB (1024s), or none.";
 var UNITS = {
@@ -5760,7 +6024,7 @@ function count(n, noun) {
 var CREATE_USAGE3 = "Usage: naro storage bucket create <name> [--public] [--file-size-limit <size>] [--allowed-mime-types <t,\u2026>]";
 var UPDATE_USAGE = "Usage: naro storage bucket update <name> [--public | --private] [--file-size-limit <size> | none] [--allowed-mime-types <t,\u2026> | any]";
 var EMPTY_USAGE = "Usage: naro storage bucket empty <name> [--yes]";
-var REMOVE_USAGE2 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
+var REMOVE_USAGE3 = "Usage: naro storage bucket remove <name> [--empty] [--yes]";
 var ENABLE_FIRST = "Storage is not enabled yet; enabling it first.";
 var DISABLE_QUESTION3 = "Turn Storage off for this project? Its Storage calls and file URLs answer 404 until naro storage enable; buckets and files are kept.";
 var NO_BUCKETS = "No buckets yet. `naro storage bucket create <name>` makes one.";
@@ -5829,6 +6093,9 @@ function meterLines(info) {
     );
   return lines;
 }
+function linesFor2(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
 function storageLines(info) {
   if (info.disabledAt !== null)
     return [
@@ -5852,27 +6119,27 @@ function storageLines(info) {
     ...info.buckets.map(bucketLine)
   ];
 }
-async function enableStorage(client, projectId) {
+async function enableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.enable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage on did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage enable` again picks up where it stopped.",
+        `Turning Storage on did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage enable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
   }
 }
-async function disableStorage(client, projectId) {
+async function disableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.disable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage off did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage disable` again picks up where it stopped.",
+        `Turning Storage off did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage disable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
@@ -5899,23 +6166,34 @@ function bucketFields(flags) {
   return fields;
 }
 async function runStorageStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const storage = await client.storage.info(projectId);
-  context.output.result({ projectId, storage }, storageLines(storage));
+  context.output.result(
+    { projectId, storage },
+    linesFor2(storageLines(storage), dataEnvironment(context.flags))
+  );
 }
 async function runStorageEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
-  const storage = await enableStorage(client, projectId);
+  const environment = dataEnvironment(context.flags);
+  const storage = await enableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
     `\u2705 Storage is on: R2 bucket ${printable(storage.bucket ?? "unknown")}.`,
-    ...storage.usage === null ? ["\u23F3 The backend is still finishing; check `naro backend` in a minute."] : [],
-    ...storageLines(storage)
+    ...linesFor2(
+      [
+        ...storage.usage === null ? [
+          "\u23F3 The backend is still finishing; check `naro backend` in a minute."
+        ] : [],
+        ...storageLines(storage)
+      ],
+      environment
+    )
   ]);
 }
 async function runStorageDisable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const current = await client.storage.info(projectId);
   if (current.bucket === null) {
@@ -5924,27 +6202,34 @@ async function runStorageDisable(context) {
     ]);
     return;
   }
+  const environment = dataEnvironment(context.flags);
   if (current.disabledAt === null)
-    await confirmOrAbort(context, DISABLE_QUESTION3);
-  const storage = await disableStorage(client, projectId);
+    await confirmOrAbort(
+      context,
+      forEnvironment(DISABLE_QUESTION3, environment)
+    );
+  const storage = await disableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
-    "\u2705 Storage is off. Buckets and files are kept; naro storage enable turns it on again.",
-    ...storageLines(storage)
+    `\u2705 Storage is off. Buckets and files are kept; naro storage enable${envFlag(environment)} turns it on again.`,
+    ...linesFor2(storageLines(storage), environment)
   ]);
 }
 async function runStorageBucketList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const buckets = await client.storage.listBuckets(projectId);
   context.output.result(
     { projectId, buckets },
-    buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine)
+    linesFor2(
+      buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine),
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runStorageBucketCreate(context) {
   const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let bucket;
   try {
@@ -5953,12 +6238,12 @@ async function runStorageBucketCreate(context) {
     if (!isNaroError(error) || error.code !== "STORAGE_NOT_ENABLED")
       throw error;
     context.output.log(ENABLE_FIRST);
-    await enableStorage(client, projectId);
+    await enableStorage(client, projectId, dataEnvironment(context.flags));
     bucket = await client.storage.createBucket(projectId, input);
   }
   context.output.result({ projectId, bucket }, [
     `\u2705 Created bucket ${printable(bucket.name)}.`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 async function runStorageBucketUpdate(context) {
@@ -5969,13 +6254,13 @@ async function runStorageBucketUpdate(context) {
       context,
       `Make bucket ${name} public? Anyone with an object's URL can download it.`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.updateBucket(projectId, name, patch);
   const takesEffect = patch.public === false ? "It takes effect within about 10 seconds; copies Naro's edge already holds can be served for up to 5 minutes." : "It takes effect within about 10 seconds.";
   context.output.result({ projectId, bucket }, [
     `\u2705 Updated bucket ${printable(bucket.name)}. ${takesEffect}`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 function refuseSearch(context, why) {
@@ -6011,7 +6296,7 @@ async function runStorageBucketEmpty(context) {
     context,
     `bucket empty deletes every object in the bucket. ${EMPTY_USAGE}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.getBucket(projectId, name);
   await confirmOrAbort(
@@ -6028,13 +6313,13 @@ async function runStorageBucketEmpty(context) {
   ]);
 }
 async function runStorageBucketRemove(context) {
-  const name = bucketName(context, REMOVE_USAGE2);
+  const name = bucketName(context, REMOVE_USAGE3);
   const empty = context.flags.empty === true;
   refuseSearch(
     context,
-    empty ? `bucket remove --empty deletes every object in the bucket before it removes the bucket. ${REMOVE_USAGE2}` : `bucket remove removes the whole bucket. ${REMOVE_USAGE2}`
+    empty ? `bucket remove --empty deletes every object in the bucket before it removes the bucket. ${REMOVE_USAGE3}` : `bucket remove removes the whole bucket. ${REMOVE_USAGE3}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let question = `Remove bucket ${name}?`;
   if (empty) {
@@ -6132,6 +6417,105 @@ function cryptoUnavailable() {
     message: "This runtime has no crypto.subtle, which signing in with a provider needs (https or localhost)."
   };
 }
+var SERVICE_KEY_OFF_SERVER_MESSAGE = "A Naro service key (naro_sk_\u2026) skips every policy, so createClient accepts it only on a server (Node, Deno, Bun, Cloudflare Workers, an edge runtime), never in a browser, a web worker or a React Native app. Use the anon key (naro_pk_\u2026) here and keep the service key on your server.";
+function websocketUnavailable() {
+  return {
+    code: "WEBSOCKET_UNAVAILABLE",
+    message: "This runtime has no WebSocket. Pass one to createClient({ realtime: { WebSocket } })."
+  };
+}
+function realtimeTimedOut(ms) {
+  const seconds = Math.max(1, Math.round(ms / 1e3));
+  return {
+    code: "TIMED_OUT",
+    message: `The Naro realtime server did not answer within ${String(seconds)} seconds.`
+  };
+}
+function realtimeClosed(code) {
+  return {
+    code: "NETWORK_ERROR",
+    message: `The realtime connection to the Naro backend closed (${String(code)}). It reconnects on its own.`,
+    details: { code }
+  };
+}
+function realtimeDisconnected() {
+  return {
+    code: "ABORTED",
+    message: "The realtime connection was closed by the app (it removed its last channel) before the Naro realtime server answered."
+  };
+}
+function realtimeStopped(code, reason) {
+  return {
+    code: reason === "" ? "NETWORK_ERROR" : reason,
+    message: `The realtime connection to the Naro backend closed (${String(code)}) and does not reconnect.`,
+    details: { code }
+  };
+}
+function socketRefused(error) {
+  return {
+    code: "NETWORK_ERROR",
+    message: "The realtime connection to the Naro backend could not be opened.",
+    details: { cause: error instanceof Error ? error.name : typeof error }
+  };
+}
+function invalidChannel(reason) {
+  return {
+    code: "INVALID_CHANNEL",
+    message: `The channel name is not valid: it ${reason}.`
+  };
+}
+function invalidChannelConfig(path, reason) {
+  return {
+    code: "INVALID_CHANNEL_CONFIG",
+    message: "The channel settings are not valid.",
+    details: { path, reason }
+  };
+}
+function serviceKeyOffServer() {
+  return {
+    code: "SERVICE_KEY_OFF_SERVER",
+    message: SERVICE_KEY_OFF_SERVER_MESSAGE
+  };
+}
+function notJoined(channel) {
+  return {
+    code: "NOT_JOINED",
+    message: `Join ${channel} before sending to it.`
+  };
+}
+function invalidBroadcast() {
+  return {
+    code: "INVALID_MESSAGE",
+    message: "The message is not a valid Naro realtime frame.",
+    details: { reason: "needs type broadcast" }
+  };
+}
+function invalidPresence() {
+  return {
+    code: "INVALID_MESSAGE",
+    message: "The message is not a valid Naro realtime frame.",
+    details: { reason: "needs a presence payload object" }
+  };
+}
+function frameTooLarge(limit) {
+  return {
+    code: "INVALID_MESSAGE",
+    message: "The message is not a valid Naro realtime frame.",
+    details: { reason: `is larger than ${String(limit)} bytes` }
+  };
+}
+function clientFlooding(perSecond) {
+  return {
+    code: "CLIENT_FLOODING",
+    message: `This connection is sending messages faster than a connection may (${String(perSecond)} a second), so this one was not sent. Send less often.`
+  };
+}
+function channelClosed() {
+  return {
+    code: "CHANNEL_CLOSED",
+    message: "The Naro realtime server closed this channel."
+  };
+}
 function describe(cause) {
   if (cause instanceof Error) return `${cause.name}: ${cause.message}`;
   return String(cause);
@@ -6154,9 +6538,119 @@ function errorFromBody(status, body) {
   if (status >= 200 && status < 300) return null;
   return invalidResponse(status);
 }
-var AUTH_PREFIX = "/auth/";
+var SESSION_PREFIXES = ["/auth/", "/realtime/"];
 function storeFor(config, path) {
-  return path.startsWith(AUTH_PREFIX) ? config.tokens : config.accessJwt ?? null;
+  return SESSION_PREFIXES.some((prefix) => path.startsWith(prefix)) ? config.tokens : config.accessJwt ?? null;
+}
+var ACCESS_JWT_MARGIN_MS = 6e4;
+function timesOf(jwt) {
+  const payload = jwt.split(".")[1];
+  if (payload === void 0 || payload === "") return null;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const claims = JSON.parse(atob(padded));
+    if (!isRecord(claims)) return null;
+    const { exp, iat } = claims;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+    return {
+      exp: exp * 1e3,
+      iat: typeof iat === "number" && Number.isFinite(iat) ? iat * 1e3 : null
+    };
+  } catch {
+    return null;
+  }
+}
+function expiryOf(jwt) {
+  return timesOf(jwt)?.exp ?? null;
+}
+var skews = /* @__PURE__ */ new WeakMap();
+function localExpiry(config, jwt) {
+  const exp = expiryOf(jwt);
+  return exp === null ? null : exp - (skews.get(config.tokens) ?? 0);
+}
+var SESSION_GONE_CODES = /* @__PURE__ */ new Set([
+  "UNAUTHORIZED",
+  "INVALID_SESSION",
+  "FAILED_TO_GET_SESSION"
+]);
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewAccessJwt(config, jwtStore, session) {
+  const pending = renewing.get(config.tokens);
+  if (pending?.session === session) return pending.done;
+  const done = (async () => {
+    const result = await callWith(
+      config,
+      { method: "GET", path: "/auth/token", withToken: true },
+      void 0,
+      session
+    );
+    if (result.error !== null) {
+      if (result.answer?.status !== 401 || !SESSION_GONE_CODES.has(result.error.code))
+        return result.error;
+      await config.tokens.clearIf(session);
+      await config.tokens.whileIs(null, () => jwtStore.clear());
+      return invalidSession();
+    }
+    const { body, status } = result.answer;
+    const jwt = isRecord(body) ? body.token : void 0;
+    if (typeof jwt !== "string" || jwt === "") return invalidResponse(status);
+    const arrived = Date.now();
+    await config.tokens.whileIs(session, async () => {
+      const iat = timesOf(jwt)?.iat;
+      if (iat !== void 0 && iat !== null)
+        skews.set(config.tokens, iat - arrived);
+      await jwtStore.set(jwt);
+    });
+    return null;
+  })();
+  const entry = { session, done };
+  renewing.set(config.tokens, entry);
+  void done.finally(() => {
+    if (renewing.get(config.tokens) === entry) renewing.delete(config.tokens);
+  });
+  return done;
+}
+async function accessJwtFor(config, jwtStore) {
+  for (let round = 0; round < 2; round += 1) {
+    const session = await config.tokens.get();
+    const jwt = await jwtStore.get();
+    if (session === null || config.service) return { token: jwt, session };
+    const expiry = jwt === null ? null : localExpiry(config, jwt);
+    if (jwt !== null && (expiry === null || expiry - ACCESS_JWT_MARGIN_MS > Date.now()))
+      return { token: jwt, session };
+    const error = await renewAccessJwt(config, jwtStore, session);
+    const stored = await config.tokens.get();
+    if (stored !== session) {
+      if (stored === null) return error ? { error } : { token: null, session };
+      continue;
+    }
+    if (error === null) {
+      const renewed = await jwtStore.get();
+      return renewed === null ? { error: invalidSession() } : { token: renewed, session };
+    }
+    if (jwt !== null && expiry !== null && expiry > Date.now())
+      return { token: jwt, session };
+    return { error };
+  }
+  return { error: invalidSession() };
+}
+async function bearerFor(config, path, withToken) {
+  if (!withToken) return { token: null, session: null };
+  const store = storeFor(config, path);
+  if (store === null) return { token: null, session: null };
+  if (store === config.tokens) {
+    const token = await store.get();
+    return { token, session: token };
+  }
+  return accessJwtFor(config, store);
+}
+async function retryBearer(config, path, error, first) {
+  if (error?.code !== "INVALID_SESSION" || first.token === null || first.session === null || config.accessJwt === void 0 || storeFor(config, path) !== config.accessJwt || await config.tokens.get() !== first.session)
+    return null;
+  const renewed = await bearerFor(config, path, true);
+  if ("error" in renewed) return renewed;
+  return renewed.token === null || renewed.token === first.token || renewed.session !== first.session ? null : renewed;
 }
 async function receive(config, options, init) {
   const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
@@ -6201,8 +6695,16 @@ async function call(config, options) {
       return { error: invalidQuery("", "is not JSON"), answer: null };
     }
   }
+  const bearer = await bearerFor(config, options.path, options.withToken);
+  if ("error" in bearer) return { error: bearer.error, answer: null };
+  const result = await callWith(config, options, payload, bearer.token);
+  const again = await retryBearer(config, options.path, result.error, bearer);
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, answer: null };
+  return callWith(config, options, payload, again.token);
+}
+async function callWith(config, options, payload, token) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -6246,8 +6748,48 @@ async function settled(store, error, headers, token) {
   return RETRY_AFTER_CODES.has(error.code) ? withRetryAfter(error, headers) : error;
 }
 async function send(config, options) {
+  const bearer = await untilAborted(
+    bearerFor(config, options.path, options.withToken),
+    options.signal
+  );
+  if (bearer === ABORTED) return { error: uploadAborted(), status: null };
+  if ("error" in bearer) return { error: bearer.error, status: null };
+  const result = await sendWith(config, options, bearer.token);
+  if (result.error?.code !== "INVALID_SESSION" || isStream(options.body))
+    return result;
+  const again = await untilAborted(
+    retryBearer(config, options.path, result.error, bearer),
+    options.signal
+  );
+  if (again === ABORTED) return { error: uploadAborted(), status: null };
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, status: null };
+  return sendWith(config, options, again.token);
+}
+var ABORTED = Symbol("aborted");
+function untilAborted(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(ABORTED);
+  return new Promise((resolve7, reject) => {
+    const stop = () => resolve7(ABORTED);
+    signal.addEventListener("abort", stop, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", stop);
+        resolve7(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", stop);
+        reject(error);
+      }
+    );
+  });
+}
+function isStream(body) {
+  return typeof ReadableStream === "function" && body instanceof ReadableStream;
+}
+async function sendWith(config, options, token) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -6308,7 +6850,9 @@ var RETRY_AFTER_CODES = /* @__PURE__ */ new Set([
   // Storage (original spec §13): one object written twice within a second
   // (`x-retry-after: 1`), and the daily operation limit (3-1d).
   "OBJECT_RATE_LIMITED",
-  "STORAGE_OPS_QUOTA_EXCEEDED"
+  "STORAGE_OPS_QUOTA_EXCEEDED",
+  // Realtime's REST broadcast over the project's message budget (x-retry-after: 1).
+  "TOO_MANY_MESSAGES"
 ]);
 function withRetryAfter(error, headers) {
   const header = headers.get("x-retry-after")?.trim() ?? "";
@@ -6887,7 +7431,7 @@ var MAX_FLOWS = 10;
 function isEntry(value) {
   return typeof value === "object" && value !== null && typeof value.verifier === "string" && typeof value.expiresAt === "number";
 }
-function live(text, now) {
+function live(text, now2) {
   if (text === null) return {};
   let parsed;
   try {
@@ -6898,7 +7442,7 @@ function live(text, now) {
   if (typeof parsed !== "object" || parsed === null) return {};
   const entries = {};
   for (const [flow, entry] of Object.entries(parsed))
-    if (isEntry(entry) && entry.expiresAt > now) entries[flow] = entry;
+    if (isEntry(entry) && entry.expiresAt > now2) entries[flow] = entry;
   return entries;
 }
 function pick(entries, oldest) {
@@ -6914,16 +7458,16 @@ function serialize(entries) {
 var FlowVerifiers = class {
   #store;
   #now;
-  constructor(store, now = Date.now) {
+  constructor(store, now2 = Date.now) {
     this.#store = store;
-    this.#now = now;
+    this.#now = now2;
   }
   /** Keeps `verifier` for the flow `flow`, for ten minutes. */
   async add(flow, verifier) {
-    const now = this.#now();
+    const now2 = this.#now();
     await this.#store.update((text) => {
-      const entries = live(text, now);
-      entries[flow] = { verifier, expiresAt: now + FLOW_TTL_MS };
+      const entries = live(text, now2);
+      entries[flow] = { verifier, expiresAt: now2 + FLOW_TTL_MS };
       while (Object.keys(entries).length > MAX_FLOWS) {
         const oldest = pick(entries, true);
         if (oldest === void 0) break;
@@ -6938,10 +7482,10 @@ var FlowVerifiers = class {
    * expired.
    */
   async take(flow) {
-    const now = this.#now();
+    const now2 = this.#now();
     let taken = null;
     await this.#store.update((text) => {
-      const entries = live(text, now);
+      const entries = live(text, now2);
       const id = flow ?? pick(entries, false);
       if (id !== void 0 && Object.hasOwn(entries, id)) {
         taken = entries[id]?.verifier ?? null;
@@ -6966,9 +7510,9 @@ function parse(text) {
 var RecoveryToken = class {
   #store;
   #now;
-  constructor(store, now = () => Date.now()) {
+  constructor(store, now2 = () => Date.now()) {
     this.#store = store;
-    this.#now = now;
+    this.#now = now2;
   }
   /** Keeps the token a recovery link brought, for 15 minutes. */
   async keep(token) {
@@ -6977,11 +7521,11 @@ var RecoveryToken = class {
   }
   /** The token, while it lasts; an expired or unreadable one is cleared. */
   async current() {
-    const now = this.#now();
+    const now2 = this.#now();
     let token = null;
     await this.#store.update((text) => {
       const kept = parse(text);
-      if (kept === null || kept.expiresAt <= now) return null;
+      if (kept === null || kept.expiresAt <= now2) return null;
       token = kept.token;
       return text;
     });
@@ -7041,6 +7585,8 @@ var TokenStore = class {
   #fallback = null;
   /** Settles when the last queued operation has finished. */
   #queue = Promise.resolve();
+  /** Called after each write; see `subscribe`. */
+  #listeners = /* @__PURE__ */ new Set();
   constructor(storage, key) {
     this.#storage = storage;
     this.#key = key;
@@ -7049,21 +7595,31 @@ var TokenStore = class {
     return this.#serial(() => this.#get());
   }
   set(token) {
-    return this.#serial(() => this.#set(token));
+    return this.#serial(async () => {
+      await this.#set(token);
+      this.#changed();
+    });
   }
   clear() {
-    return this.#serial(() => this.#clear());
+    return this.#serial(async () => {
+      await this.#clear();
+      this.#changed();
+    });
   }
   /**
-   * Clears only if the stored token is still the one that was rejected. A
-   * request that left with an old token can come back after the user signed
-   * in again; its INVALID_SESSION must not sign the new session out. The
-   * read and the removal are one operation: with an async storage, a sign-in
-   * that lands between them would otherwise be the token removed.
+   * Clears only if the stored token is still the one that was rejected, and
+   * says whether it did. A request that left with an old token can come back
+   * after the user signed in again; its INVALID_SESSION must not sign the
+   * new session out. The read and the removal are one operation: with an
+   * async storage, a sign-in that lands between them would otherwise be the
+   * token removed.
    */
   clearIf(token) {
     return this.#serial(async () => {
-      if (await this.#get() === token) await this.#clear();
+      if (await this.#get() !== token) return false;
+      await this.#clear();
+      this.#changed();
+      return true;
     });
   }
   /**
@@ -7076,17 +7632,59 @@ var TokenStore = class {
       const next = transform(await this.#get());
       if (next === null) await this.#clear();
       else await this.#set(next);
+      this.#changed();
     });
   }
   /** Stores `next` only if `expected` is still stored, as one operation. */
   replaceIf(expected, next) {
     return this.#serial(async () => {
-      if (await this.#get() === expected) await this.#set(next);
+      if (await this.#get() !== expected) return;
+      await this.#set(next);
+      this.#changed();
     });
   }
   /**
-   * Runs `operation` once every earlier one has finished. The operations
-   * below never reject, and none of them calls a public method (that would
+   * Runs `operation` only while `expected` is the stored token (null: none
+   * is stored), inside this
+   * store's queue, and says whether it ran: no write to this store lands
+   * between the check and the end of the operation. A refreshed access JWT
+   * is kept this way (`http.ts`), so one minted for a session that a
+   * sign-in replaced meanwhile never lands on top of the new session's.
+   * `operation` must not call this store's public methods (it would wait
+   * on itself); another store's are fine.
+   */
+  whileIs(expected, operation) {
+    return this.#serial(async () => {
+      if (await this.#get() !== expected) return false;
+      await operation();
+      return true;
+    });
+  }
+  /**
+   * Calls `listener` after every write of the token — a sign-in, a
+   * sign-out, a renewed session, a cleared INVALID_SESSION — from inside the
+   * write's turn, so a `get()` it starts reads the value just written — or
+   * that of a write already queued behind it, which calls the listener
+   * again. The Realtime connection (Realtime 3-2d) uses it to tell the hub.
+   * What a listener throws is its own: the write has happened and stands.
+   */
+  subscribe(listener) {
+    this.#listeners.add(listener);
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+  #changed() {
+    for (const listener of Array.from(this.#listeners)) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  }
+  /**
+   * Runs `operation` once every earlier one has finished. The operations
+   * below never reject, and none of them awaits a public method (that would
    * wait on itself).
    */
   #serial(operation) {
@@ -7487,10 +8085,10 @@ function truth2(text) {
 var DECIMAL3 = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
 function exactNumber2(text) {
   if (!DECIMAL3.test(text)) return text;
-  const number = Number(text);
-  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
+  const number2 = Number(text);
+  if (!text.includes(".")) return Number.isSafeInteger(number2) ? number2 : text;
   const trimmed = text.replace(/\.?0+$/, "");
-  return String(number) === trimmed ? number : text;
+  return String(number2) === trimmed ? number2 : text;
 }
 function keyword2(text, at) {
   const word = text.toLowerCase();
@@ -7892,6 +8490,2059 @@ var TableBuilder = class {
     });
   }
 };
+var BACKOFF_STEPS_MS = [1e3, 2e3, 5e3, 1e4];
+var RATE_LIMITED_MIN_MS = 5e3;
+var IP_LIMIT_WAIT_MS = 6e4;
+var RESTART_JITTER_MS = 1e4;
+var UNOPENED_SLOWDOWN_AFTER = 6;
+var UNOPENED_DELAY_MS = 6e4;
+var STOP_CODES = /* @__PURE__ */ new Set([
+  1e3,
+  4e3,
+  4001,
+  4003,
+  4004,
+  4410
+]);
+function closeAction(code, reason) {
+  if (STOP_CODES.has(code)) return { kind: "stop" };
+  if (code === 4401) return { kind: "session" };
+  if (code === 4503) return { kind: "restart" };
+  if (code === 4029)
+    return reason === "IP_RATE_LIMITED" ? { kind: "wait", ms: IP_LIMIT_WAIT_MS } : { kind: "retry", minMs: RATE_LIMITED_MIN_MS };
+  return { kind: "retry", minMs: 0 };
+}
+function backoffMs(attempt22, random) {
+  const step = BACKOFF_STEPS_MS[Math.min(attempt22, BACKOFF_STEPS_MS.length - 1)] ?? 1e4;
+  return Math.round(step * (0.5 + random()));
+}
+function delayAfter(action, state, random) {
+  if (action.kind === "restart")
+    return Math.floor(random() * RESTART_JITTER_MS);
+  if (action.kind === "wait")
+    return action.ms + Math.floor(random() * RESTART_JITTER_MS);
+  const base = state.unopened >= UNOPENED_SLOWDOWN_AFTER ? Math.round(UNOPENED_DELAY_MS * (0.5 + random())) : backoffMs(state.attempt, random);
+  return Math.max(action.kind === "retry" ? action.minMs : 0, base);
+}
+function entryOf(meta) {
+  if (!isRecord(meta) || typeof meta.phx_ref !== "string") return null;
+  const { phx_ref: ref, naro_user_id: user, ...state } = meta;
+  return {
+    ...state,
+    presence_ref: ref,
+    naro_user_id: typeof user === "string" ? user : null
+  };
+}
+function entriesOf(value) {
+  const read = /* @__PURE__ */ new Map();
+  if (!isRecord(value)) return read;
+  for (const [key, item] of Object.entries(value)) {
+    if (!isRecord(item) || !Array.isArray(item.metas)) continue;
+    const entries = item.metas.map(entryOf).filter((entry) => entry !== null);
+    if (entries.length > 0) read.set(key, entries);
+  }
+  return read;
+}
+function without(entries, gone) {
+  return entries.filter(
+    (entry) => !gone.some((left) => left.presence_ref === entry.presence_ref)
+  );
+}
+function copies(entries) {
+  return entries.map((entry) => ({ ...entry }));
+}
+var Presence = class {
+  #state = /* @__PURE__ */ new Map();
+  /** A presence_state came for the current join: diffs apply only after it. */
+  #synced = false;
+  state() {
+    return Object.fromEntries(
+      [...this.#state].map(([key, entries]) => [key, copies(entries)])
+    );
+  }
+  /** A new join, or the connection dropped: what is here stays until its presence_state. */
+  unsync() {
+    this.#synced = false;
+  }
+  clear() {
+    this.#state = /* @__PURE__ */ new Map();
+    this.#synced = false;
+  }
+  /**
+   * No presence_state will say what is here any more (a join that may not
+   * read presence, one refused, the server's close, a stop — plan 정정
+   * (k)): each key leaves, then sync — said only when someone was here. A
+   * diff waits for the next presence_state.
+   */
+  leaveAll(emit) {
+    if (this.#state.size > 0) this.applyState({}, emit);
+    this.#synced = false;
+  }
+  applyState(payload, emit) {
+    const before = this.#state;
+    const next = entriesOf(payload);
+    this.#state = next;
+    this.#synced = true;
+    for (const [key, entries] of next) {
+      const held = before.get(key) ?? [];
+      const added = without(entries, held);
+      if (added.length > 0) emit.join(key, copies(added), copies(held));
+    }
+    for (const [key, entries] of before) {
+      const left = without(entries, next.get(key) ?? []);
+      if (left.length > 0)
+        emit.leave(key, copies(left), copies(next.get(key) ?? []));
+    }
+    emit.sync();
+  }
+  applyDiff(payload, emit) {
+    if (!this.#synced || !isRecord(payload)) return;
+    for (const [key, added] of entriesOf(payload.joins)) {
+      const held = this.#state.get(key) ?? [];
+      this.#state.set(key, [...without(held, added), ...added]);
+      emit.join(key, copies(added), copies(held));
+    }
+    for (const [key, left] of entriesOf(payload.leaves)) {
+      const current = without(this.#state.get(key) ?? [], left);
+      if (current.length > 0) this.#state.set(key, current);
+      else this.#state.delete(key);
+      emit.leave(key, copies(left), copies(current));
+    }
+    emit.sync();
+  }
+};
+var REALTIME_PROTOCOL_VERSION = "1.0.0";
+var PHOENIX_TOPIC = "phoenix";
+var REALTIME_TOPIC_PREFIX = "realtime:";
+var HEARTBEAT_REQUEST = '{"topic":"phoenix","event":"heartbeat","payload":{},"ref":"hb"}';
+var HEARTBEAT_REF = "hb";
+var MAX_CHANNEL_NAME_LENGTH = 128;
+var CONNECTION_FRAMES_PER_SECOND = 10;
+var CONNECTION_FRAME_BURST = 120;
+var WARNED_CODES = /* @__PURE__ */ new Set([
+  "TOO_MANY_JOINS",
+  "TOO_MANY_MESSAGES",
+  "TOO_MANY_PRESENCE_MESSAGES"
+]);
+var FLOOD_WINDOW_MS = 6e4;
+var MAX_CHANGE_CHANNELS_PER_TABLE = 4;
+var CHANGE_CHANNELS_REASON = `would put more than ${String(MAX_CHANGE_CHANNELS_PER_TABLE)} channels of this connection on one table's changes (* counts for every table): add the subscription to a channel it already has`;
+function readServerFrame(data) {
+  if (typeof data !== "string") return null;
+  let value;
+  try {
+    value = JSON.parse(data);
+  } catch {
+    return null;
+  }
+  if (!isRecord(value)) return null;
+  const { topic, event, payload, ref } = value;
+  const joinRef = value.join_ref;
+  if (typeof topic !== "string" || typeof event !== "string") return null;
+  if (!isRecord(payload)) return null;
+  return {
+    topic,
+    event,
+    payload,
+    ref: typeof ref === "string" ? ref : null,
+    joinRef: typeof joinRef === "string" ? joinRef : null
+  };
+}
+function frameLimitOf(reason) {
+  if (typeof reason !== "string") return null;
+  const match = /^is larger than (\d+) bytes$/.exec(reason);
+  return match === null ? null : Number(match[1]);
+}
+function utf8Length(text) {
+  let bytes = 0;
+  for (let index = 0; index < text.length; index++) {
+    const unit = text.charCodeAt(index);
+    if (unit < 128) bytes += 1;
+    else if (unit < 2048) bytes += 2;
+    else if (unit >= 55296 && unit <= 56319 && index + 1 < text.length) {
+      const next = text.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index++;
+      } else bytes += 3;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function clientFrame(topic, event, payload, ref, joinRef) {
+  return JSON.stringify(
+    joinRef === void 0 ? { topic, event, payload, ref } : { topic, event, payload, ref, join_ref: joinRef }
+  );
+}
+function atMostCodePoints(text, max) {
+  if (text.length <= max) return true;
+  return text.length <= max * 2 && [...text].length <= max;
+}
+function hasControlCharacter(text) {
+  for (let i = 0; i < text.length; i += 1) {
+    const code = text.charCodeAt(i);
+    if (code <= 31 || code >= 127 && code <= 159) return true;
+  }
+  return false;
+}
+function hasBidiControl(text) {
+  for (let i = 0; i < text.length; i += 1) {
+    const code = text.charCodeAt(i);
+    if (code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+function channelNameProblem(name) {
+  if (name === "") return "is empty";
+  if (!atMostCodePoints(name, MAX_CHANNEL_NAME_LENGTH))
+    return `is longer than ${String(MAX_CHANNEL_NAME_LENGTH)} characters`;
+  if (hasControlCharacter(name)) return "has a control character";
+  if (hasBidiControl(name)) return "has a bidirectional control character";
+  return void 0;
+}
+function socketUrl(baseUrl, apiKey) {
+  const url = new URL("/_naro/v1/realtime/websocket", baseUrl);
+  url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
+  return `${url.href}?apikey=${encodeURIComponent(apiKey)}&vsn=${REALTIME_PROTOCOL_VERSION}`;
+}
+var HEARTBEAT_MS = 25e3;
+var TIMEOUT_MS = 1e4;
+var PACED_BURST = CONNECTION_FRAME_BURST - 20;
+var SDK_WARNING_ROOM = 6;
+var ignore = () => void 0;
+function now() {
+  return typeof performance === "undefined" ? Date.now() : performance.now();
+}
+function detach(ws) {
+  ws.onopen = null;
+  ws.onmessage = null;
+  ws.onclose = null;
+  ws.onerror = ignore;
+}
+function closeQuietly(ws, code) {
+  try {
+    ws.close(code);
+  } catch {
+  }
+}
+function safely(callback) {
+  try {
+    callback();
+  } catch (error) {
+    queueMicrotask(() => {
+      throw error;
+    });
+  }
+}
+function replyOf(payload) {
+  if (payload.status === "ok") {
+    const { response } = payload;
+    return {
+      ok: true,
+      response: typeof response === "object" && response !== null && !Array.isArray(response) ? response : {}
+    };
+  }
+  return {
+    ok: false,
+    error: asError(payload.response) ?? invalidResponse(101),
+    lost: false
+  };
+}
+var RealtimeSocket = class {
+  #config;
+  #heartbeatMs;
+  #timeoutMs;
+  #ws = null;
+  #state = "idle";
+  #generation = 0;
+  /** Drops since the hub last answered: the next wait's step (결정 7). */
+  #attempt = 0;
+  /** Tries in a row that never opened (결정 9). */
+  #unopened = 0;
+  /** When the wait the last close or stop set ends: no connect() opens before it. */
+  #resumeAt = 0;
+  /**
+   * The last close was 4008 (CLIENT_FLOODING), and no heartbeat was
+   * answered since: a channel's word that the hub answered does not start
+   * the backoff over — a connection that floods again must not come back
+   * every second (PR #328 review).
+   */
+  #flooded = false;
+  /**
+   * The frames waiting their turn on this connection, in the order they
+   * go: the first `#ahead` before the app's (`#enqueue`).
+   */
+  #queue = [];
+  /** How many at the front of `#queue` go before the app's frames: the SDK's own and the identity's, and the app's an identity frame must not pass. */
+  #ahead = 0;
+  /** The app's frames in `#queue`: not in flight yet, so no room is kept for them (`#hasRoom`). */
+  #appQueued = 0;
+  /** The budget this connection has left (`PACED_BURST` at the open), as of `#tokensAt`. */
+  #tokens = 0;
+  #tokensAt = 0;
+  #paceTimer;
+  /** When the hub refused a frame on this connection with a warning (`WARNED_CODES`), oldest first. */
+  #warnings = [];
+  /** The SDK's own frames waiting for room, by who sends them, in the order they asked (`whenRoom()`). */
+  #roomWaiters = /* @__PURE__ */ new Map();
+  /** Due when the oldest warning leaves the window, while a frame waits for room. */
+  #roomTimer;
+  #draining = false;
+  #ref = 0;
+  #retryTimer;
+  #openTimer;
+  #heartbeat;
+  #heartbeatPending = false;
+  /** The connection-level `system` frame since the open: why it is about to close. */
+  #said = null;
+  /**
+   * The size limit the hub named when it refused a frame on this
+   * connection (`#refusedOverLimit`): a frame over it is answered so without
+   * being sent. Forgotten with the connection — the next hub's plan may
+   * differ.
+   */
+  #frameLimit = null;
+  #replies = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.#config = config;
+    this.#heartbeatMs = config.options.heartbeatIntervalMs ?? HEARTBEAT_MS;
+    this.#timeoutMs = config.options.timeoutMs ?? TIMEOUT_MS;
+  }
+  get generation() {
+    return this.#generation;
+  }
+  get timeoutMs() {
+    return this.#timeoutMs;
+  }
+  isOpen() {
+    return this.#state === "open";
+  }
+  nextRef() {
+    this.#ref += 1;
+    return String(this.#ref);
+  }
+  /**
+   * Opens unless a connection is open, opening or due — once the wait the
+   * last close or stop set is over. After the app's own close the counts
+   * start over; after a stop they go on, as after a drop.
+   */
+  connect() {
+    if (this.#state !== "idle" && this.#state !== "stopped") return;
+    if (this.#state === "idle") {
+      this.#attempt = 0;
+      this.#unopened = 0;
+    }
+    const wait = this.#resumeAt - now();
+    if (wait <= 0) return this.#open();
+    this.#state = "waiting";
+    this.#retryTimer = setTimeout(() => {
+      this.#retryTimer = void 0;
+      if (this.#state === "waiting") this.#open();
+    }, wait);
+  }
+  /** The last channel went: close for good, with no event. */
+  disconnect() {
+    const ws = this.#ws;
+    this.#ws = null;
+    this.#clearTimers();
+    this.#state = "idle";
+    this.#said = null;
+    this.#failReplies(realtimeDisconnected());
+    if (ws !== null) {
+      detach(ws);
+      closeQuietly(ws, 1e3);
+    }
+  }
+  /**
+   * Lets go of the open connection and comes back as after a drop (1006),
+   * the channels told: for a connection that holds an identity the app no
+   * longer means and cannot change (identity.ts). Nothing unless open.
+   */
+  reconnect() {
+    const ws = this.#ws;
+    if (ws === null || this.#state !== "open") return;
+    detach(ws);
+    closeQuietly(ws, 1e3);
+    this.#closed(ws, 1006, "", null);
+  }
+  /**
+   * The hub answered this connection: the next drop waits from the first
+   * step — unless the last close was 4008 and no heartbeat was answered
+   * since (`#flooded`).
+   */
+  served() {
+    if (!this.#flooded) this.#attempt = 0;
+  }
+  /**
+   * A frame, in its `turn` (the app's unless said), and the `phx_reply`
+   * with its `ref` within `timeoutMs` of when it went — or, for one over the
+   * size limit the hub named on this connection, that refusal at once and
+   * nothing sent; for an app's frame but a leave that would not go within
+   * `timeoutMs`, CLIENT_FLOODING at once and nothing sent.
+   */
+  request(topic, event, payload, options = {}) {
+    const ref = options.ref ?? this.nextRef();
+    const turn = options.turn ?? "app";
+    return new Promise((resolve7) => {
+      const lost = {
+        ok: false,
+        error: realtimeClosed(1006),
+        lost: true
+      };
+      if (!this.isOpen()) return resolve7(lost);
+      let text;
+      try {
+        text = clientFrame(topic, event, payload, ref, options.joinRef);
+      } catch {
+        return resolve7(lost);
+      }
+      const bytes = utf8Length(text);
+      const limit = this.#frameLimit;
+      if (limit !== null && bytes > limit)
+        return resolve7({ ok: false, error: frameTooLarge(limit), lost: false });
+      if (turn === "app" && event !== "phx_leave" && !this.#goesInTime())
+        return resolve7({
+          ok: false,
+          error: clientFlooding(CONNECTION_FRAMES_PER_SECOND),
+          lost: false
+        });
+      this.#replies.set(ref, { resolve: resolve7, timer: void 0, bytes, turn });
+      this.#enqueue({ text, bytes, ref, turn, presence: event === "presence" });
+    });
+  }
+  /**
+   * Whether an app's frame behind every frame waiting would go within
+   * `timeoutMs`: past the budget left, the hub takes
+   * `CONNECTION_FRAMES_PER_SECOND` a second. The SDK's own frames that come
+   * later go before it, a few at most (`whenRoom()`).
+   */
+  #goesInTime() {
+    this.#refill();
+    const over = this.#queue.length + 1 - this.#tokens;
+    return over <= CONNECTION_FRAMES_PER_SECOND * this.#timeoutMs / 1e3;
+  }
+  /**
+   * Runs `go` once a frame the SDK sends of its own accord may go: at once
+   * when nothing waits before it and there is room — the warnings of the
+   * last minute and the requests in flight fewer than `SDK_WARNING_ROOM`
+   * (the app's frames still waiting their turn are not in flight yet, and
+   * go after the SDK's), or the warnings fewer and none of the SDK's own
+   * unanswered — or else when there is, in the order asked. The
+   * frame itself is sent with `turn: "sdk"`. `key` names the sender:
+   * asked again before it ran, it keeps its place and runs the newer `go`,
+   * which reads its own state again then. Nothing while the connection is
+   * not open, and forgotten with it: the sender tries again when it is live.
+   */
+  whenRoom(key, go) {
+    if (this.#state !== "open") return;
+    if (this.#roomWaiters.size === 0 && this.#hasRoom()) return go();
+    this.#roomWaiters.set(key, go);
+    this.#armRoom();
+  }
+  /**
+   * Room for one more frame of the SDK's own (`whenRoom()`): the requests
+   * that count are those sent and not answered, and the SDK's own still to
+   * go — not the app's waiting their turn, which the SDK's go before (PR
+   * #328 re-review). And while none of the SDK's own is unanswered, one
+   * goes whatever the app has in flight, if the warnings leave room (PR #328
+   * re-review 2): an app sending 10 a second over a link of 0.7 s or more
+   * always has six in flight, and a second channel's join would wait,
+   * untold, for as long as it sends. A refusal of the app's is a warning
+   * when it comes, so the SDK adds one at most.
+   */
+  #hasRoom() {
+    if (this.#state !== "open") return false;
+    const since = now() - FLOOD_WINDOW_MS;
+    this.#warnings = this.#warnings.filter((at) => at > since);
+    const warnings = this.#warnings.length;
+    if (warnings >= SDK_WARNING_ROOM) return false;
+    const inFlight2 = this.#replies.size - this.#appQueued;
+    return warnings + inFlight2 < SDK_WARNING_ROOM || !this.#sdkUnanswered();
+  }
+  /** Whether a request of the SDK's own or the identity's waits for its answer, sent or still to go. */
+  #sdkUnanswered() {
+    for (const waiter of this.#replies.values())
+      if (waiter.turn !== "app") return true;
+    return false;
+  }
+  /** The frames waiting for room go while there is: after an answer, a time-out, and when a warning leaves the window. */
+  #drainRoom() {
+    if (this.#draining) return;
+    this.#draining = true;
+    try {
+      for (const [key, go] of this.#roomWaiters) {
+        if (!this.#hasRoom()) break;
+        this.#roomWaiters.delete(key);
+        safely(go);
+      }
+    } finally {
+      this.#draining = false;
+    }
+    this.#armRoom();
+  }
+  /** While a frame waits for room the warnings hold, look again when the oldest leaves the window. */
+  #armRoom() {
+    clearTimeout(this.#roomTimer);
+    this.#roomTimer = void 0;
+    const oldest = this.#warnings[0];
+    if (this.#roomWaiters.size === 0 || oldest === void 0) return;
+    this.#roomTimer = setTimeout(
+      () => {
+        this.#roomTimer = void 0;
+        this.#drainRoom();
+      },
+      Math.max(1, oldest + FLOOD_WINDOW_MS - now() + 1)
+    );
+  }
+  /**
+   * Puts `frame` in its turn and sends what may go. The app's go last; the
+   * SDK's own and the identity's after the others before the app's. An
+   * identity frame goes after the app's presence frames still to go, with
+   * whatever waits before them: the hub reads a presence as the user it
+   * holds when the frame comes, and would hold the last user's state for the
+   * new one.
+   */
+  #enqueue(frame) {
+    if (frame.turn === "app") {
+      this.#queue.push(frame);
+      this.#appQueued += 1;
+    } else {
+      if (frame.turn === "identity") this.#ahead = this.#pastPresence();
+      this.#queue.splice(this.#ahead, 0, frame);
+      this.#ahead += 1;
+    }
+    this.#flush();
+  }
+  /** Just past the app's last presence frame still to go — `#ahead` when none is. */
+  #pastPresence() {
+    for (let index = this.#queue.length - 1; index >= this.#ahead; index -= 1)
+      if (this.#queue[index]?.presence === true) return index + 1;
+    return this.#ahead;
+  }
+  /** The next frame to go, out of `#queue`. */
+  #next() {
+    const frame = this.#queue.shift();
+    if (frame === void 0) return void 0;
+    if (this.#ahead > 0) this.#ahead -= 1;
+    if (frame.turn === "app") this.#appQueued -= 1;
+    return frame;
+  }
+  /** `ref`'s frame out of `#queue`, if it is still there: answered before it went. */
+  #unqueue(ref) {
+    const index = this.#queue.findIndex((frame2) => frame2.ref === ref);
+    if (index === -1) return;
+    const [frame] = this.#queue.splice(index, 1);
+    if (index < this.#ahead) this.#ahead -= 1;
+    if (frame?.turn === "app") this.#appQueued -= 1;
+  }
+  /**
+   * Sends the frames waiting their turn while the budget has room, in their
+   * turn, and comes back when the next one is due. One whose frame the
+   * socket cannot send is lost now — its close event follows.
+   */
+  #flush() {
+    const ws = this.#ws;
+    if (ws === null || this.#state !== "open") return;
+    this.#refill();
+    while (this.#queue.length > 0 && this.#tokens >= 1) {
+      const frame = this.#next();
+      const waiter = this.#replies.get(frame.ref);
+      if (waiter === void 0) continue;
+      const limit = this.#frameLimit;
+      if (limit !== null && frame.bytes > limit) {
+        this.#answer(frame.ref, {
+          ok: false,
+          error: frameTooLarge(limit),
+          lost: false
+        });
+        continue;
+      }
+      try {
+        ws.send(frame.text);
+      } catch {
+        this.#answer(frame.ref, {
+          ok: false,
+          error: realtimeClosed(1006),
+          lost: true
+        });
+        continue;
+      }
+      this.#tokens -= 1;
+      waiter.timer = this.#timeOut(frame.ref, waiter);
+    }
+    if (this.#queue.length === 0 || this.#paceTimer !== void 0) return;
+    const due = Math.ceil(
+      (1 - this.#tokens) * 1e3 / CONNECTION_FRAMES_PER_SECOND
+    );
+    this.#paceTimer = setTimeout(
+      () => {
+        this.#paceTimer = void 0;
+        this.#flush();
+      },
+      Math.max(1, due)
+    );
+  }
+  /** The budget refilled for the time since it was last looked at, as the hub's bucket refills. */
+  #refill() {
+    const at = now();
+    if (at <= this.#tokensAt) return;
+    this.#tokens = Math.min(
+      PACED_BURST,
+      this.#tokens + (at - this.#tokensAt) / 1e3 * CONNECTION_FRAMES_PER_SECOND
+    );
+    this.#tokensAt = at;
+  }
+  /**
+   * `ref`'s request hears `reply`, now: one fewer in flight — or, answered
+   * before its frame went (over a size limit the hub named), one fewer to
+   * go, and nothing sent.
+   */
+  #answer(ref, reply) {
+    const waiter = this.#replies.get(ref);
+    if (waiter === void 0) return;
+    this.#replies.delete(ref);
+    clearTimeout(waiter.timer);
+    if (waiter.timer === void 0) this.#unqueue(ref);
+    waiter.resolve(reply);
+    this.#drainRoom();
+  }
+  /** TIMED_OUT for `ref`'s request `timeoutMs` after its frame went. */
+  #timeOut(ref, waiter) {
+    return setTimeout(() => {
+      if (this.#replies.get(ref) !== waiter) return;
+      this.#answer(ref, {
+        ok: false,
+        error: realtimeTimedOut(this.#timeoutMs),
+        lost: false
+      });
+    }, this.#timeoutMs);
+  }
+  #open() {
+    const Impl = this.#config.options.WebSocket ?? globalThis.WebSocket;
+    if (typeof Impl !== "function")
+      return this.#stop(websocketUnavailable(), true);
+    if (this.#config.service && !isKnownServer())
+      return this.#stop(serviceKeyOffServer(), true);
+    let ws;
+    try {
+      ws = new Impl(
+        socketUrl(this.#config.baseUrl, this.#config.apiKey)
+      );
+    } catch (error) {
+      return this.#stop(socketRefused(error), true);
+    }
+    this.#generation += 1;
+    this.#ws = ws;
+    this.#state = "connecting";
+    this.#said = null;
+    this.#frameLimit = null;
+    ws.onopen = () => this.#opened(ws);
+    ws.onmessage = (event) => this.#message(ws, event.data);
+    ws.onclose = (event) => this.#closed(ws, event.code, event.reason ?? "", null);
+    ws.onerror = ignore;
+    this.#openTimer = setTimeout(
+      () => this.#closed(ws, 1006, "", this.#timeoutMs),
+      this.#timeoutMs
+    );
+  }
+  #opened(ws) {
+    if (this.#ws !== ws || this.#state !== "connecting") return;
+    clearTimeout(this.#openTimer);
+    this.#openTimer = void 0;
+    this.#state = "open";
+    this.#unopened = 0;
+    this.#heartbeatPending = false;
+    this.#queue = [];
+    this.#ahead = 0;
+    this.#appQueued = 0;
+    this.#tokens = PACED_BURST;
+    this.#tokensAt = now();
+    this.#warnings = [];
+    this.#heartbeat = setInterval(() => this.#beat(ws), this.#heartbeatMs);
+    safely(() => this.#config.events.opened());
+  }
+  #beat(ws) {
+    if (this.#ws !== ws) return;
+    if (this.#heartbeatPending)
+      return this.#closed(ws, 1e3, "", this.#heartbeatMs);
+    this.#heartbeatPending = true;
+    try {
+      ws.send(HEARTBEAT_REQUEST);
+    } catch {
+    }
+  }
+  #message(ws, data) {
+    if (this.#ws !== ws) return;
+    const frame = readServerFrame(data);
+    if (frame === null) return;
+    if (frame.event === "phx_reply" && frame.ref !== null) {
+      if (frame.ref === HEARTBEAT_REF) {
+        this.#heartbeatPending = false;
+        this.#flooded = false;
+        this.#attempt = 0;
+        return;
+      }
+      const reply = replyOf(frame.payload);
+      if (!reply.ok && WARNED_CODES.has(reply.error.code))
+        this.#warnings.push(now());
+      if (this.#replies.has(frame.ref)) {
+        this.#answer(frame.ref, reply);
+        return;
+      }
+    }
+    if (frame.topic === PHOENIX_TOPIC) {
+      if (frame.event === "system") this.#said = asError(frame.payload);
+      else if (frame.event === "phx_reply" && frame.ref === null)
+        this.#refusedOverLimit(frame.payload);
+      return;
+    }
+    safely(() => this.#config.events.frame(frame));
+  }
+  /**
+   * The hub refused a frame over its size limit before reading it (final
+   * review A M3, plan 정정 (m)): it names no `ref`, so no request waits for
+   * it by name — it waited `timeoutMs` and answered TIMED_OUT. But the hub
+   * refuses every frame over the limit, and only those, before anything
+   * else: each request waiting whose frame is over it is one refused so, and
+   * hears it now. The limit stays for the connection.
+   */
+  #refusedOverLimit(payload) {
+    if (payload.status !== "error") return;
+    const error = asError(payload.response);
+    if (error?.code !== "INVALID_MESSAGE" || !isRecord(error.details)) return;
+    const limit = frameLimitOf(error.details.reason);
+    if (limit === null) return;
+    this.#frameLimit = limit;
+    for (const [ref, waiter] of this.#replies)
+      if (waiter.bytes > limit)
+        this.#answer(ref, {
+          ok: false,
+          error: frameTooLarge(limit),
+          lost: false
+        });
+  }
+  /**
+   * `ws` ended: its close event (`waitedMs` null), or a heartbeat or an open
+   * that had no answer in `waitedMs` — then it is let go at once, its
+   * handlers first, since a dead TCP connection can take minutes to report
+   * its close (결정 11).
+   */
+  #closed(ws, code, reason, waitedMs) {
+    if (this.#ws !== ws) return;
+    const wasOpen = this.#state === "open";
+    const timedOut = waitedMs !== null;
+    detach(ws);
+    this.#ws = null;
+    this.#clearTimers();
+    if (timedOut) closeQuietly(ws, 1e3);
+    if (!wasOpen) this.#unopened += 1;
+    const said = this.#said;
+    this.#said = null;
+    if (!timedOut && code === 4008) this.#flooded = true;
+    const action = timedOut ? { kind: "retry", minMs: 0 } : closeAction(code, said?.code ?? reason);
+    if (action.kind === "stop")
+      return this.#stop(said ?? realtimeStopped(code, reason));
+    const error = timedOut ? realtimeTimedOut(waitedMs) : said ?? realtimeClosed(code);
+    this.#failReplies(error);
+    this.#state = "waiting";
+    const delay = delayAfter(
+      action,
+      { attempt: this.#attempt, unopened: this.#unopened },
+      Math.random
+    );
+    if (action.kind !== "restart" && action.kind !== "wait") this.#attempt += 1;
+    this.#wait(action.kind === "session", delay);
+    safely(
+      () => this.#config.events.dropped(
+        error,
+        timedOut ? "TIMED_OUT" : "CHANNEL_ERROR"
+      )
+    );
+  }
+  /**
+   * The next try, `delay` from now — after a 4401, from when its
+   * conditional delete is done, or from `timeoutMs` on if it is not: an
+   * app's `auth.storage` that never answers must not keep the connection
+   * away for good.
+   */
+  #wait(session, delay) {
+    const generation = this.#generation;
+    this.#resumeAt = now() + delay;
+    let due = false;
+    const schedule = () => {
+      if (due || this.#state !== "waiting" || this.#generation !== generation)
+        return;
+      due = true;
+      this.#resumeAt = now() + delay;
+      clearTimeout(this.#retryTimer);
+      this.#retryTimer = setTimeout(() => {
+        this.#retryTimer = void 0;
+        if (this.#state === "waiting") this.#open();
+      }, delay);
+    };
+    if (!session) return schedule();
+    this.#retryTimer = setTimeout(schedule, this.#timeoutMs);
+    safely(() => {
+      void this.#config.events.sessionRefused().then(schedule, schedule);
+    });
+  }
+  /**
+   * Stopped until a connect(), which waits as after a drop: the stop counts
+   * as one (`unopened` when no socket was made — the runtime cannot open).
+   */
+  #stop(error, unopened = false) {
+    this.#clearTimers();
+    this.#state = "stopped";
+    this.#failReplies(error);
+    if (unopened) this.#unopened += 1;
+    this.#resumeAt = now() + delayAfter(
+      { kind: "retry", minMs: 0 },
+      { attempt: this.#attempt, unopened: this.#unopened },
+      Math.random
+    );
+    this.#attempt += 1;
+    safely(() => this.#config.events.stopped(error));
+  }
+  /** Every request still waiting hears `error`, as lost with the connection. */
+  #failReplies(error) {
+    const waiting = [...this.#replies.values()];
+    this.#replies.clear();
+    for (const waiter of waiting) {
+      clearTimeout(waiter.timer);
+      waiter.resolve({ ok: false, error, lost: true });
+    }
+  }
+  /** Every timer of the connection, and the frames still to go with it. */
+  #clearTimers() {
+    clearTimeout(this.#retryTimer);
+    clearTimeout(this.#openTimer);
+    clearInterval(this.#heartbeat);
+    clearTimeout(this.#paceTimer);
+    clearTimeout(this.#roomTimer);
+    this.#retryTimer = void 0;
+    this.#openTimer = void 0;
+    this.#heartbeat = void 0;
+    this.#paceTimer = void 0;
+    this.#roomTimer = void 0;
+    this.#queue = [];
+    this.#ahead = 0;
+    this.#appQueued = 0;
+    this.#roomWaiters.clear();
+  }
+};
+function sent(reply) {
+  return reply.ok ? { data: null, error: null, lost: false } : { data: null, error: reply.error, lost: reply.lost };
+}
+function unsent(error) {
+  return { data: null, error, lost: false };
+}
+function jsonObject(value) {
+  try {
+    const copy = JSON.parse(JSON.stringify(value));
+    return isRecord(copy) ? copy : null;
+  } catch {
+    return null;
+  }
+}
+function presenceReadDenied(response) {
+  const { access } = response;
+  return isRecord(access) && isRecord(access.presence) && access.presence.read === false;
+}
+function tablesOf(changes) {
+  return changes.map((binding) => binding.filter.table ?? "*");
+}
+var JOIN_RETRY_CODES = /* @__PURE__ */ new Set([
+  "TOO_MANY_JOINS",
+  "INTERNAL_ERROR",
+  "TIMED_OUT"
+]);
+var RETRACK_RETRY_CODES = /* @__PURE__ */ new Set([
+  "TOO_MANY_PRESENCE_MESSAGES",
+  "TOO_MANY_MESSAGES",
+  "TOO_MANY_JOINS",
+  "INTERNAL_ERROR",
+  "TIMED_OUT"
+]);
+var RETRACK_WARNED_RESENDS = 3;
+var LATE_LISTENER = "naro-js: postgres_changes and presence listeners added after subscribe() count from the channel's next join; call unsubscribe() and subscribe() again to add them now.";
+function isDevelopment() {
+  const env = globalThis.process?.env;
+  return env?.NODE_ENV !== "production";
+}
+function warnInDevelopment(message) {
+  if (isDevelopment()) console.warn(message);
+}
+function isJson(value) {
+  try {
+    JSON.stringify(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function changeSpec(filter) {
+  const {
+    event,
+    schema,
+    table: table3,
+    filter: text,
+    ...rest
+  } = filter;
+  return {
+    ...rest,
+    event,
+    ...schema === void 0 ? {} : { schema },
+    ...table3 === void 0 ? {} : { table: table3 },
+    ...text === void 0 || text === "" ? {} : { filter: text }
+  };
+}
+function changePayload(data) {
+  return {
+    schema: "public",
+    table: typeof data.table === "string" ? data.table : "",
+    commit_timestamp: typeof data.commit_timestamp === "string" ? data.commit_timestamp : "",
+    eventType: data.type,
+    new: isRecord(data.record) ? data.record : {},
+    old: isRecord(data.old_record) ? data.old_record : {},
+    errors: Array.isArray(data.errors) ? data.errors.filter((item) => typeof item === "string") : null
+  };
+}
+function systemMessage(payload) {
+  const { extension, code, message, channel } = payload;
+  return {
+    status: payload.status === "ok" ? "ok" : "error",
+    extension: typeof extension === "string" ? extension : "system",
+    code: typeof code === "string" ? code : "",
+    message: typeof message === "string" ? message : "",
+    channel: typeof channel === "string" ? channel : null
+  };
+}
+var RealtimeChannel = class {
+  name;
+  topic;
+  isPrivate;
+  options;
+  #context;
+  #bindings = [];
+  #presence = new Presence();
+  #state = "closed";
+  /** subscribe() was called and unsubscribe() was not: join it on every connection. */
+  #wanted = false;
+  /** The join sent and not left or replaced since — set when it is sent, before its answer. */
+  #joinRef = null;
+  /** The tables that join's row subscriptions are on (`*` for every table): its leave holds them. */
+  #joinTables = [];
+  /**
+   * The join was refused a cap a leave owed on the connection still holds
+   * a place under (`ChannelContext.owesLeaveOn`): it waits for that leave
+   * rather than knock again (PR #328 review). Null otherwise.
+   */
+  #capWait = null;
+  #onStatus = null;
+  /** The app already heard of this trouble; reset at SUBSCRIBED. */
+  #told = false;
+  #attempt = 0;
+  #retry;
+  /** The `system` error sent before a `phx_close` (protocol.ts `closeChannel`). */
+  #closeError = null;
+  /** The last state tracked, and the token the hub had then (결정 17). */
+  #tracked = null;
+  /** Bumped when what is tracked is let go of: a track answered after that does not bring it back. */
+  #letGo = 0;
+  /** Bumped by the app's track() and untrack(): one in the SUBSCRIBED callback says what the join holds. */
+  #presenceCalls = 0;
+  /** A track sent again and refused for now goes again when this is due (`#retrack`). */
+  #retrackTimer;
+  /**
+   * The app's presence calls and broadcasts waiting for the connection to
+   * be live, in the order it made them (`#inTurn`): each sends, or answers
+   * that its join went, when called.
+   */
+  #waiting = [];
+  /** Inside subscribe(): a stop is told a microtask later (`#toldStop`). */
+  #subscribing = false;
+  /** Who waits for room on the connection (`whenRoom()`): this channel's join, and its track sent again. */
+  #joinTurn = {};
+  #retrackTurn = {};
+  /**
+   * Frames of the join in flight that came before its answer was handled
+   * (final review A M1, plan 정정 (m)): Node's `ws` and undici hand over
+   * the frames of one read in one callback, while the answer's handler runs
+   * a microtask later — a change right behind the `ok` had no subscription
+   * id yet. They are heard once the `ok` is (after SUBSCRIBED, as in a
+   * browser, which runs a task per message), and dropped with a refusal.
+   */
+  #early = [];
+  /** @internal `naro.channel()` makes channels. */
+  constructor(name, options, context) {
+    this.name = name;
+    this.topic = `${REALTIME_TOPIC_PREFIX}${name}`;
+    this.isPrivate = options.config?.private === true;
+    this.options = options;
+    this.#context = context;
+  }
+  get state() {
+    return this.#state;
+  }
+  /** @internal The join sent and not left or replaced since (client.ts routes by it). */
+  get joinRef() {
+    return this.#joinRef;
+  }
+  on(type, filter, callback) {
+    const listener = callback;
+    const spec = isRecord(filter) ? filter : {};
+    if ((type === "postgres_changes" || type === "presence") && this.#wanted)
+      warnInDevelopment(LATE_LISTENER);
+    if (type === "postgres_changes")
+      this.#bindings.push({
+        type,
+        filter: spec,
+        callback: listener,
+        id: null
+      });
+    else if (type === "broadcast" || type === "presence")
+      this.#bindings.push({
+        type,
+        event: String(spec.event),
+        callback: listener
+      });
+    else if (type === "system")
+      this.#bindings.push({ type, callback: listener });
+    return this;
+  }
+  subscribe(callback) {
+    if (callback !== void 0) this.#onStatus = callback;
+    if (this.#wanted) return this;
+    const problem = this.#nameError();
+    if (problem !== null) {
+      this.#state = "errored";
+      queueMicrotask(() => this.#status("CHANNEL_ERROR", problem));
+      return this;
+    }
+    this.#wanted = true;
+    this.#state = "joining";
+    this.#attempt = 0;
+    this.#told = false;
+    this.#capWait = null;
+    this.#clearRetry();
+    this.#subscribing = true;
+    try {
+      this.#context.connect();
+      this.#joinIfDue();
+    } finally {
+      this.#subscribing = false;
+    }
+    return this;
+  }
+  async unsubscribe() {
+    const ref = this.#joinRef;
+    const held = this.#state === "joined" || this.#state === "joining";
+    this.#wanted = false;
+    this.#clearRetry();
+    this.#letGoOfTrack();
+    this.#joinRef = null;
+    this.#state = "leaving";
+    this.#releaseWaiting();
+    let error = null;
+    if (held && ref !== null) {
+      const reply = await this.#context.leave(this, ref, this.#joinTables);
+      if (!reply.ok && !reply.lost && reply.error.code !== "NOT_JOINED")
+        error = reply.error;
+    }
+    if (this.#state === "leaving") {
+      this.#state = "closed";
+      this.#presence.clear();
+      this.#status("CLOSED");
+    }
+    return { data: null, error };
+  }
+  /**
+   * Broadcasts `message` on the join, or over HTTP before it: the server's
+   * answer, `lost` when the connection went before it (RealtimeSendResult).
+   */
+  async send(message) {
+    if (!isRecord(message) || message.type !== "broadcast")
+      return unsent(invalidBroadcast());
+    const problem = this.#nameError();
+    if (problem !== null) return unsent(problem);
+    const { event, payload } = message;
+    if (!isJson({ event, payload }))
+      return unsent(invalidQuery("", "is not JSON"));
+    const joinRef = this.#joinRef;
+    if (this.#state === "joined" && joinRef !== null) {
+      const reply = await this.#inTurn(
+        joinRef,
+        !this.#context.live(),
+        () => this.#context.socket.request(
+          this.topic,
+          "broadcast",
+          { type: "broadcast", event, payload },
+          { joinRef }
+        )
+      );
+      if (reply !== null) return sent(reply);
+    }
+    await this.#context.auth.ready();
+    const result = await call(this.#context.http, {
+      method: "POST",
+      path: "/realtime/broadcast",
+      body: {
+        messages: [
+          { topic: this.topic, event, payload, private: this.isPrivate }
+        ]
+      },
+      withToken: true
+    });
+    return unsent(result.error);
+  }
+  /**
+   * Tracks `state` as this connection's presence here (original spec
+   * §11.1): the hub's answer. Only on a join — before it, NOT_JOINED, and
+   * nothing is kept for later (결정 18). It goes as its JSON reads back, and
+   * that copy, not the app's object, is what a later join sends again.
+   * While who the connection is is not settled (a new token in flight, a
+   * retry), it waits until it is (정정 (k)): the hub may yet refuse the new
+   * token for now and keep the last user, whose presence it would be.
+   */
+  async track(state) {
+    const problem = this.#nameError();
+    if (problem !== null) return unsent(problem);
+    const joinRef = this.#joinRef;
+    if (this.#state !== "joined" || joinRef === null)
+      return unsent(notJoined(this.name));
+    const payload = jsonObject(state);
+    if (payload === null) return unsent(invalidPresence());
+    this.#presenceCalls += 1;
+    this.#clearRetrack();
+    const letGo = this.#letGo;
+    const reply = await this.#inTurn(
+      joinRef,
+      !this.#context.live(),
+      () => this.#sendTrack(payload, joinRef, letGo, true)
+    );
+    if (reply === null) {
+      if (letGo === this.#letGo) this.#letGoOfTrack();
+      return unsent(notJoined(this.name));
+    }
+    return sent(reply);
+  }
+  /**
+   * Takes this connection's presence off the channel: the hub's answer, or
+   * none when not joined. After the app's tracks that wait, if any.
+   */
+  async untrack() {
+    this.#presenceCalls += 1;
+    this.#letGoOfTrack();
+    const joinRef = this.#joinRef;
+    if (this.#state !== "joined" || joinRef === null) return unsent(null);
+    const reply = await this.#inTurn(
+      joinRef,
+      false,
+      () => this.#context.socket.request(
+        this.topic,
+        "presence",
+        { type: "presence", event: "untrack" },
+        { joinRef }
+      )
+    );
+    return reply === null ? unsent(null) : sent(reply);
+  }
+  /** The presences of the channel, by key (결정 16): a copy. */
+  presenceState() {
+    return this.#presence.state();
+  }
+  /**
+   * @internal
+   * The connection is live, or a leave owed is done (client.ts): join if
+   * the app wants it and the channel holds no join and waits for no retry.
+   * Called whenever either happens, for every channel, so a channel joined
+   * or joining stays as it is.
+   */
+  rejoin() {
+    if (this.#context.live()) this.#releaseWaiting();
+    this.#joinIfDue();
+  }
+  /**
+   * @internal
+   * A leave of this name and privacy owed on the connection was refused, or
+   * not answered in time, and goes again (client.ts): a join waiting on it
+   * tells the app once a wait, as a refused join tried again does (결정 14,
+   * 정정 (j)), and waits on.
+   */
+  leaveRefused(error) {
+    if (this.#wanted && this.#joinRef === null)
+      this.#tell(
+        error.code === "TIMED_OUT" ? "TIMED_OUT" : "CHANNEL_ERROR",
+        error
+      );
+  }
+  /** @internal The connection dropped and comes back: tell the app once, rejoin when live. */
+  dropped(error, status) {
+    if (!this.#wanted) return;
+    this.#clearRetry();
+    this.#capWait = null;
+    this.#joinRef = null;
+    this.#state = "joining";
+    this.#releaseWaiting();
+    this.#presence.unsync();
+    this.#tell(status, error);
+  }
+  /** @internal The connection stopped for good: the app must subscribe() again. */
+  stopped(error) {
+    if (this.#wanted) this.#stop(error);
+  }
+  /** @internal A frame of this channel's join (client.ts routes by join_ref). */
+  receive(frame) {
+    if (this.#state === "joining") {
+      this.#early.push(frame);
+      return;
+    }
+    switch (frame.event) {
+      case "postgres_changes":
+        return this.#change(frame.payload);
+      case "broadcast":
+        return this.#broadcast(frame.payload);
+      case "presence_state":
+        return this.#presence.applyState(frame.payload, this.#presenceEmit);
+      case "presence_diff":
+        return this.#presence.applyDiff(frame.payload, this.#presenceEmit);
+      case "system":
+        return this.#system(frame.payload);
+      case "phx_close":
+        return this.#serverClosed();
+      default:
+        return;
+    }
+  }
+  /**
+   * INVALID_CHANNEL for a name the hub would refuse, before anything is
+   * sent — and before any error of ours quotes the name.
+   */
+  #nameError() {
+    const problem = channelNameProblem(this.name);
+    return problem === void 0 ? null : invalidChannel(problem);
+  }
+  #config(changes) {
+    const config = this.options.config ?? {};
+    const presence = config.presence ?? {};
+    const key = presence.key ?? "";
+    const listens = this.#bindings.some(
+      (binding) => binding.type === "presence"
+    );
+    return {
+      ...config,
+      // ack is always on the wire, so send() always ends in the hub's answer (결정 6).
+      broadcast: {
+        ...config.broadcast,
+        self: config.broadcast?.self ?? false,
+        ack: true
+      },
+      presence: {
+        ...presence,
+        key,
+        enabled: listens || presence.enabled === true || key !== ""
+      },
+      postgres_changes: changes.map((binding) => changeSpec(binding.filter)),
+      private: this.isPrivate
+    };
+  }
+  /**
+   * Joins when due — once there is room on the connection for a frame the
+   * SDK sends of its own accord (`whenRoom()`, PR #328 review), and still
+   * due then.
+   */
+  #joinIfDue() {
+    if (!this.#dueToJoin()) return;
+    this.#context.socket.whenRoom(this.#joinTurn, () => {
+      if (this.#dueToJoin()) this.#join();
+    });
+  }
+  #dueToJoin() {
+    return this.#wanted && this.#joinRef === null && this.#retry === void 0 && this.#context.live() && !this.#context.owesLeave(this) && !this.#heldByCap();
+  }
+  /** A cap refused the last join, and a leave owed still holds the place it needs. */
+  #heldByCap() {
+    const wait = this.#capWait;
+    if (wait === null) return false;
+    if (this.#context.owesLeaveOn(wait.table)) return true;
+    this.#capWait = null;
+    return false;
+  }
+  /**
+   * The cap `error` names, when a leave owed on the connection holds a place
+   * under it (PR #328 review): the hub still counts that join — 100
+   * channels a connection (TOO_MANY_CHANNELS), or 4 on one table's changes
+   * (INVALID_CHANNEL_CONFIG with the hub's `changeChannels` reason at
+   * `config.postgres_changes[<i>].table`, the table of `changes[i]`) — and
+   * lets go of it once the leave goes through. Null for any other refusal.
+   */
+  #capHeld(error, changes) {
+    if (error.code === "TOO_MANY_CHANNELS")
+      return this.#context.owesLeaveOn(null) ? { table: null } : null;
+    if (error.code !== "INVALID_CHANNEL_CONFIG" || !isRecord(error.details))
+      return null;
+    const { path, reason } = error.details;
+    if (reason !== CHANGE_CHANNELS_REASON || typeof path !== "string")
+      return null;
+    const index = /^config\.postgres_changes\[(\d+)\]\.table$/.exec(path)?.[1];
+    const binding = index === void 0 ? void 0 : changes[Number(index)];
+    if (binding === void 0) return null;
+    const table3 = binding.filter.table ?? "*";
+    return this.#context.owesLeaveOn(table3) ? { table: table3 } : null;
+  }
+  #join() {
+    const changes = this.#bindings.filter(
+      (b) => b.type === "postgres_changes"
+    );
+    const config = this.#config(changes);
+    if (!isJson(config))
+      return this.#stop(invalidChannelConfig("config", "is not JSON"));
+    const socket = this.#context.socket;
+    const ref = socket.nextRef();
+    this.#joinRef = ref;
+    this.#joinTables = tablesOf(changes);
+    this.#capWait = null;
+    this.#state = "joining";
+    this.#closeError = null;
+    this.#early = [];
+    this.#presence.unsync();
+    for (const binding of changes) binding.id = null;
+    void socket.request(
+      this.topic,
+      "phx_join",
+      { config },
+      { joinRef: ref, ref, turn: "sdk" }
+    ).then((reply) => this.#joined(ref, changes, reply));
+  }
+  #joined(ref, changes, reply) {
+    if (this.#joinRef !== ref) return;
+    const early = this.#early;
+    this.#early = [];
+    if (reply.ok) {
+      const ids = Array.isArray(reply.response.postgres_changes) ? reply.response.postgres_changes : [];
+      changes.forEach((binding, index) => {
+        const entry = ids[index];
+        binding.id = isRecord(entry) && typeof entry.id === "number" ? entry.id : null;
+      });
+      this.#state = "joined";
+      this.#attempt = 0;
+      this.#told = false;
+      this.#context.socket.served();
+      const calls = this.#presenceCalls;
+      this.#status("SUBSCRIBED");
+      if (this.#presenceCalls === calls) this.#retrack(ref);
+      if (this.#joinRef === ref && presenceReadDenied(reply.response))
+        this.#presence.leaveAll(this.#presenceEmit);
+      for (const frame of early) {
+        if (this.#joinRef !== ref || this.#state !== "joined") break;
+        this.receive(frame);
+      }
+      return;
+    }
+    if (reply.lost) {
+      this.#joinRef = null;
+      return;
+    }
+    const { error } = reply;
+    this.#joinRef = null;
+    const capHeld = this.#capHeld(error, changes);
+    if (capHeld !== null) {
+      this.#capWait = capHeld;
+      this.#state = "joining";
+      this.#tell("CHANNEL_ERROR", error);
+      return;
+    }
+    const meetsOld = error.code === "ALREADY_JOINED" && this.#context.owesLeave(this);
+    if (!JOIN_RETRY_CODES.has(error.code) && !meetsOld) {
+      this.#wanted = false;
+      this.#state = "errored";
+      this.#presence.leaveAll(this.#presenceEmit);
+      this.#status("CHANNEL_ERROR", error);
+      return;
+    }
+    if (error.code === "TIMED_OUT")
+      void this.#context.leave(this, ref, tablesOf(changes));
+    this.#tell(
+      error.code === "TIMED_OUT" ? "TIMED_OUT" : "CHANNEL_ERROR",
+      error
+    );
+    this.#state = "joining";
+    const delay = backoffMs(this.#attempt, Math.random);
+    this.#attempt += 1;
+    this.#retry = setTimeout(() => {
+      this.#retry = void 0;
+      this.#joinIfDue();
+    }, delay);
+  }
+  #change(payload) {
+    const ids = Array.isArray(payload.ids) ? payload.ids : [];
+    if (!isRecord(payload.data)) return;
+    const change2 = changePayload(payload.data);
+    for (const binding of this.#bindings)
+      if (binding.type === "postgres_changes" && binding.id !== null && ids.includes(binding.id))
+        safely(() => binding.callback(change2));
+  }
+  #broadcast(payload) {
+    const { event } = payload;
+    if (typeof event !== "string") return;
+    const message = {
+      type: "broadcast",
+      event,
+      payload: isRecord(payload.payload) ? payload.payload : {}
+    };
+    for (const binding of this.#bindings)
+      if (binding.type === "broadcast" && binding.event === event)
+        safely(() => binding.callback(message));
+  }
+  #system(payload) {
+    const message = systemMessage(payload);
+    if (message.status === "error" && message.extension === "system")
+      this.#closeError = asError(payload);
+    for (const binding of this.#bindings)
+      if (binding.type === "system") safely(() => binding.callback(message));
+  }
+  /** The hub closed this join (lost access, its state full): stop until subscribe(). */
+  #serverClosed() {
+    this.#clearRetry();
+    this.#joinRef = null;
+    this.#wanted = false;
+    this.#state = "errored";
+    this.#letGoOfTrack();
+    this.#releaseWaiting();
+    this.#presence.leaveAll(this.#presenceEmit);
+    this.#status("CHANNEL_ERROR", this.#closeError ?? channelClosed());
+  }
+  /** The listeners' payloads, as supabase-js's: each says which event it is (정정 (k)). */
+  #presenceEmit = {
+    join: (key, newPresences, currentPresences) => {
+      const payload = {
+        event: "join",
+        key,
+        newPresences,
+        currentPresences
+      };
+      this.#presenceCall("join", payload);
+    },
+    leave: (key, leftPresences, currentPresences) => {
+      const payload = {
+        event: "leave",
+        key,
+        leftPresences,
+        currentPresences
+      };
+      this.#presenceCall("leave", payload);
+    },
+    sync: () => this.#presenceCall("sync", void 0)
+  };
+  #presenceCall(event, value) {
+    for (const binding of this.#bindings)
+      if (binding.type === "presence" && binding.event === event)
+        safely(() => binding.callback(value));
+  }
+  /**
+   * One track frame on the join `joinRef`. Its `ok` makes `state` the one
+   * tracked, with the token the hub judged it for — the one it holds once
+   * the identity frames sent before it are handled (`heldToken()`, 정정 (j))
+   * — unless what was tracked was let go of since `letGo` (the app's call,
+   * or now): the hub had that untrack or leave after it. The app's own call
+   * (`app`) is kept as well when no answer came — the connection went with
+   * it, or none in time: the hub may hold it, and it is the state the app
+   * last asked for, so the next join sends it rather than the one before
+   * (PR #328 review). The app's call waits its turn behind the app's frames,
+   * and may be refused for it (CLIENT_FLOODING, nothing kept); one sent
+   * again goes in the SDK's (PR #328 re-review).
+   */
+  #sendTrack(state, joinRef, letGo = this.#letGo, app = false) {
+    const token = this.#context.identity.heldToken();
+    return this.#context.socket.request(
+      this.topic,
+      "presence",
+      { type: "presence", event: "track", payload: state },
+      { joinRef, turn: app ? "app" : "sdk" }
+    ).then((reply) => {
+      const kept = reply.ok || app && (reply.lost || reply.error.code === "TIMED_OUT");
+      if (kept && letGo === this.#letGo) this.#tracked = { state, token };
+      return reply;
+    });
+  }
+  /**
+   * After a join comes back, the last state goes again (original spec §11.1)
+   * — only as the same session: the hub drops a presence when its user
+   * changes (3-2a P10), and a new token here may be someone else (결정 17).
+   * Who the hub reads it as is the token it will hold when the frame comes
+   * (`heldToken()`): a sign-in whose token went after the join would make
+   * the last user's state the new one's. And while who the connection is
+   * is not settled (a store read, a retry), it is let go of (정정 (j)).
+   * A refusal for now (`RETRACK_RETRY_CODES`) sends it again on this join
+   * after the channel backoff, checked as above each time, until the app
+   * tracks or untracks, the channel leaves, or the join goes — after one
+   * the hub warned the connection for, three times at most, and then it
+   * waits for the next join (`WARNED_CODES`); any other refusal lets go of
+   * it; a connection lost before the answer keeps it for the next join.
+   * Each send, the first too, waits its turn for room in the connection's
+   * warnings (`whenRoom()`, PR #328 review).
+   */
+  #retrack(joinRef) {
+    const tracked = this.#tracked;
+    if (tracked === null) return;
+    const calls = this.#presenceCalls;
+    const current = () => this.#tracked === tracked && this.#joinRef === joinRef && this.#presenceCalls === calls;
+    const go = (attempt22, warned) => {
+      if (!current()) return;
+      this.#context.socket.whenRoom(this.#retrackTurn, () => {
+        send2(attempt22, warned);
+      });
+    };
+    const send2 = (attempt22, warned) => {
+      if (!current()) return;
+      if (!this.#context.live() || tracked.token !== this.#context.identity.heldToken())
+        return this.#letGoOfTrack();
+      void this.#sendTrack(tracked.state, joinRef).then((reply) => {
+        if (reply.ok || reply.lost || this.#tracked !== tracked) return;
+        const { code } = reply.error;
+        if (!RETRACK_RETRY_CODES.has(code)) {
+          this.#tracked = null;
+          return;
+        }
+        if (!current()) return;
+        const warning = WARNED_CODES.has(code) ? 1 : 0;
+        if (warned + warning > RETRACK_WARNED_RESENDS) return;
+        const delay = backoffMs(attempt22, Math.random);
+        this.#retrackTimer = setTimeout(() => {
+          this.#retrackTimer = void 0;
+          go(attempt22 + 1, warned + warning);
+        }, delay);
+      });
+    };
+    go(0, 0);
+  }
+  /**
+   * `send` now — or, when `wait` (a track or a broadcast while the
+   * connection is not live) or an earlier call of the app's waits, at
+   * `#releaseWaiting()`, in the order the app made them: the hub must have
+   * them in that order. Null when the join went before its turn: nothing
+   * was sent.
+   */
+  #inTurn(joinRef, wait, send2) {
+    if (!wait && this.#waiting.length === 0) return send2();
+    return new Promise((resolve7) => {
+      this.#waiting.push(
+        () => resolve7(this.#joinRef === joinRef ? send2() : null)
+      );
+    });
+  }
+  /**
+   * The calls that waited go now, in order and all in this turn — a call
+   * made after them must not go first. Called when the connection is live
+   * again, and when the join goes (they answer that it went).
+   */
+  #releaseWaiting() {
+    const waiting = this.#waiting;
+    this.#waiting = [];
+    for (const go of waiting) go();
+  }
+  /** Nothing is tracked from now on, whatever answer comes for a track sent before. */
+  #letGoOfTrack() {
+    this.#tracked = null;
+    this.#letGo += 1;
+    this.#clearRetrack();
+  }
+  #clearRetrack() {
+    clearTimeout(this.#retrackTimer);
+    this.#retrackTimer = void 0;
+  }
+  /**
+   * Stops until subscribe(): no join, no retry, and the app hears `error`.
+   * No presence_state comes until then, so what the app saw goes, as for a
+   * join refused or the server's close (정정 (k)); what was tracked stays,
+   * for a join of the same session after subscribe().
+   */
+  #stop(error) {
+    this.#clearRetry();
+    this.#joinRef = null;
+    this.#wanted = false;
+    this.#state = "errored";
+    this.#releaseWaiting();
+    this.#presence.leaveAll(this.#presenceEmit);
+    this.#toldStop(error);
+  }
+  /**
+   * CHANNEL_ERROR for a stop. Inside subscribe() it comes a microtask later,
+   * as for an invalid name: in `const ch = naro.channel(…).subscribe(cb)`,
+   * `cb` may read `ch`, which is not set until subscribe() returns.
+   */
+  #toldStop(error) {
+    if (this.#subscribing)
+      queueMicrotask(() => this.#status("CHANNEL_ERROR", error));
+    else this.#status("CHANNEL_ERROR", error);
+  }
+  #tell(status, error) {
+    if (this.#told) return;
+    this.#told = true;
+    this.#status(status, error);
+  }
+  #status(status, error) {
+    const callback = this.#onStatus;
+    if (callback !== null) safely(() => callback(status, error));
+  }
+  /** No join retry waits — nor a track sent again on a join that is going. */
+  #clearRetry() {
+    clearTimeout(this.#retry);
+    this.#retry = void 0;
+    this.#clearRetrack();
+  }
+};
+var RETRY_CODES = /* @__PURE__ */ new Set([
+  "TOO_MANY_JOINS",
+  "TIMED_OUT",
+  "INTERNAL_ERROR"
+]);
+function rejudgeWaitMs(privateChannels) {
+  return Math.max(1, Math.ceil(privateChannels / 2)) * 1e3;
+}
+var Identity = class {
+  #config;
+  /** The token the hub answered `ok` for on this connection; null is anon. */
+  #confirmed = null;
+  /**
+   * The last frame sent, until its own reply; null when none is in flight.
+   * Matched by the object, not the token: an older frame of the same token
+   * answered meanwhile is not this one.
+   */
+  #inFlight = null;
+  /**
+   * The frame the hub answered INVALID_SESSION: the 4401 that follows is
+   * about its token. An object, since that token is null when the frame was
+   * a sign-out — a refusal still, and not "nothing refused".
+   */
+  #refused = null;
+  /**
+   * A frame got no answer in time (TIMED_OUT), and no `ok` came since: the
+   * hub may have taken it late, so what it holds is not known, and a read
+   * with no frame in flight tells the stored token even when it is
+   * `heldToken()` (정정 (k)). An `ok` says what it holds — replies come in
+   * the order the frames went, so it is about a later frame.
+   */
+  #unsure = false;
+  /** Bumped when a connection ends: a reply about an earlier one changes nothing. */
+  #epoch = 0;
+  #attempt = 0;
+  #retry;
+  /** The socket's generation opened() was called for; null once it ended. */
+  #connection = null;
+  /** changed() calls of this connection still reading the store. */
+  #reading = 0;
+  /** onLive was called, and the connection has been live since. */
+  #announced = false;
+  constructor(config) {
+    this.#config = config;
+  }
+  /** The token the hub took on this connection; null for anon or before its answer. */
+  confirmed() {
+    return this.#confirmed;
+  }
+  /**
+   * The token the hub will hold once what was sent is handled — the last
+   * frame in flight, or else the one it took: the hub handles the
+   * connection's frames in order, so a frame sent now is judged for it.
+   * A frame in flight may yet be refused; the hub then keeps `confirmed()`.
+   */
+  heldToken() {
+    return this.#inFlight === null ? this.#confirmed : this.#inFlight.token;
+  }
+  /**
+   * Nothing about who the connection is is pending — no read, no frame in
+   * flight, no retry, no refusal: a join sent now is judged for the identity
+   * the hub settled on, the stored one unless it refused that for good on
+   * this connection (결정 24).
+   */
+  isLive() {
+    const socket = this.#config.socket();
+    return this.#connection === socket.generation && socket.isOpen() && this.#reading === 0 && this.#inFlight === null && this.#retry === void 0 && this.#refused === null;
+  }
+  /**
+   * A new connection: anon until told. Resolves once the stored token is
+   * sent, or found to need no frame; `onLive` says when the hub took it.
+   */
+  async opened() {
+    this.closed();
+    this.#connection = this.#config.socket().generation;
+    await this.changed();
+  }
+  /** The stored token may have changed: tell the open connection what is new. */
+  async changed() {
+    if (this.#config.service) return this.#settle();
+    const epoch = this.#epoch;
+    this.#reading += 1;
+    this.#announced = false;
+    try {
+      await this.#config.ready();
+    } catch {
+    }
+    const token = await this.#config.tokens.get();
+    if (epoch === this.#epoch) this.#reading -= 1;
+    if (this.#config.socket().isOpen()) {
+      const unknown = this.#unsure && this.#inFlight === null;
+      if (unknown || token !== this.heldToken()) this.#send(token);
+    }
+    this.#settle();
+  }
+  /**
+   * A 4401: forget the stored session only if the hub answered
+   * INVALID_SESSION to it by name, and it is still stored — a sign-in since
+   * then keeps its new token (결정 3). A 4401 with no such answer clears
+   * nothing (plan 2026-10-28 정정): the hub keeps the expiry it read when it
+   * took the token (known-issues #183) while the backend's sign-in slides
+   * the session's under the same token, so a tab open for days is closed
+   * with a session that is still good. The next connection tells the token
+   * again, and hears INVALID_SESSION — and clears it — if it really is
+   * dead. The access JWT goes with the session it was minted for, so only
+   * when that session went.
+   */
+  async refused() {
+    const epoch = this.#epoch;
+    const early = this.#refused;
+    await Promise.resolve();
+    const refusal = this.#epoch === epoch ? this.#refused : early;
+    this.closed();
+    if (refusal === null || refusal.token === null) return;
+    if (await this.#config.tokens.clearIf(refusal.token))
+      await this.#config.accessJwt?.clear();
+  }
+  /** The connection is gone: what it was told is forgotten. */
+  closed() {
+    clearTimeout(this.#retry);
+    this.#retry = void 0;
+    this.#epoch += 1;
+    this.#confirmed = null;
+    this.#inFlight = null;
+    this.#refused = null;
+    this.#unsure = false;
+    this.#attempt = 0;
+    this.#connection = null;
+    this.#reading = 0;
+    this.#announced = false;
+  }
+  /** Live, and not said yet since it last was not: say it. */
+  #settle() {
+    if (this.#announced || !this.isLive()) return;
+    this.#announced = true;
+    safely(() => this.#config.onLive());
+  }
+  #send(token) {
+    clearTimeout(this.#retry);
+    this.#retry = void 0;
+    const sent2 = { token };
+    this.#inFlight = sent2;
+    const epoch = this.#epoch;
+    void this.#config.socket().request(
+      PHOENIX_TOPIC,
+      "access_token",
+      { access_token: token },
+      { turn: "identity" }
+    ).then((reply) => {
+      if (epoch === this.#epoch) this.#heard(sent2, reply);
+    });
+  }
+  #heard(sent2, reply) {
+    if (this.#inFlight === sent2) this.#inFlight = null;
+    if (reply.ok) {
+      this.#confirmed = sent2.token;
+      this.#unsure = false;
+      this.#attempt = 0;
+      return this.#settle();
+    }
+    if (reply.lost) return;
+    if (reply.error.code === "TIMED_OUT") this.#unsure = true;
+    if (reply.error.code === "INVALID_SESSION") {
+      this.#refused = sent2;
+      return;
+    }
+    if (this.#inFlight !== null) return;
+    if (!RETRY_CODES.has(reply.error.code)) {
+      if (this.#confirmed !== null && sent2.token !== this.#confirmed) {
+        this.closed();
+        this.#config.socket().reconnect();
+        return;
+      }
+      return this.#settle();
+    }
+    this.#later(
+      reply.error.code === "TOO_MANY_JOINS" ? rejudgeWaitMs(this.#config.privateChannels()) : 0
+    );
+  }
+  /**
+   * Reads the store again after the backoff (at least `minMs`), once there
+   * is room on the connection for a frame the SDK sends of its own accord
+   * (`whenRoom()`, PR #328 review). `#retry` stays set until then: the
+   * connection is not live while it waits.
+   */
+  #later(minMs) {
+    clearTimeout(this.#retry);
+    const delay = Math.max(minMs, backoffMs(this.#attempt, Math.random));
+    this.#attempt += 1;
+    const epoch = this.#epoch;
+    this.#retry = setTimeout(() => {
+      this.#config.socket().whenRoom(this, () => {
+        if (epoch !== this.#epoch) return;
+        this.#retry = void 0;
+        void this.changed();
+      });
+    }, delay);
+  }
+};
+var LEAVE_RETRY_CODES = /* @__PURE__ */ new Set([
+  "TOO_MANY_JOINS",
+  "INTERNAL_ERROR",
+  "CONNECTION_STATE_TOO_LARGE",
+  "TIMED_OUT"
+]);
+function sameSettings(a, b) {
+  if (a === b) return true;
+  try {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } catch {
+    return false;
+  }
+}
+function sameJoin(a, b) {
+  return a.name === b.name && a.isPrivate === b.isPrivate;
+}
+function foldTable(table3) {
+  return table3.replaceAll(/[A-Z]/g, (letter) => letter.toLowerCase());
+}
+var RealtimeClient = class {
+  #http;
+  #socket;
+  #identity;
+  #context;
+  #channels = [];
+  /** The leaves owed on the open connection (정정 (i)); forgotten with it. */
+  #owed = /* @__PURE__ */ new Set();
+  #onStorage = null;
+  constructor(input) {
+    const { http, auth, service, options } = input;
+    this.#http = http;
+    this.#socket = new RealtimeSocket({
+      baseUrl: http.baseUrl,
+      apiKey: http.apiKey,
+      service,
+      options,
+      events: {
+        // Not awaited, and not live yet: onLive says when the hub took it.
+        opened: () => {
+          this.#watchStorage();
+          void this.#identity.opened();
+        },
+        frame: (frame) => this.#route(frame),
+        // Only the leaves and the channels: the identity is closed by the
+        // next opened() (the 4401's refused() reads it after this turn —
+        // 정정 (f)).
+        dropped: (error, status) => {
+          this.#forgetLeaves();
+          this.#each((channel) => channel.dropped(error, status));
+        },
+        stopped: (error) => this.#stopped(error),
+        sessionRefused: () => this.#identity.refused()
+      }
+    });
+    this.#identity = new Identity({
+      tokens: http.tokens,
+      accessJwt: http.accessJwt,
+      service,
+      socket: () => this.#socket,
+      privateChannels: () => this.#channels.filter(
+        (channel) => channel.isPrivate && channel.state === "joined"
+      ).length,
+      onLive: () => this.#each((channel) => channel.rejoin()),
+      // A sign-in the page URL carries goes before any join (final review A I1).
+      ready: () => auth.ready()
+    });
+    this.#context = {
+      socket: this.#socket,
+      identity: this.#identity,
+      http,
+      auth,
+      connect: () => this.#socket.connect(),
+      live: () => this.#identity.isLive(),
+      leave: (channel, joinRef, tables) => this.#leave(channel, joinRef, tables),
+      owesLeave: (channel) => this.#owesLeave(channel),
+      owesLeaveOn: (table3) => this.#owesLeaveOn(table3)
+    };
+    http.tokens.subscribe(() => void this.#identity.changed());
+  }
+  channel(name, options = {}) {
+    const settings = isRecord(options) ? options : {};
+    const isPrivate = settings.config?.private === true;
+    const found = this.#channels.find(
+      (c) => c.name === name && c.isPrivate === isPrivate
+    );
+    if (found !== void 0) {
+      if (!sameSettings(found.options, settings))
+        warnInDevelopment(
+          `naro-js: channel(${JSON.stringify(name)}) already exists with other settings; it keeps the first ones until removeChannel().`
+        );
+      return found;
+    }
+    const channel = new RealtimeChannel(
+      name,
+      settings,
+      this.#context
+    );
+    this.#channels.push(channel);
+    return channel;
+  }
+  getChannels() {
+    return [...this.#channels];
+  }
+  async removeChannel(channel) {
+    this.#channels = this.#channels.filter((c) => c !== channel);
+    return this.#closeIfLast(await channel.unsubscribe());
+  }
+  async removeAllChannels() {
+    const channels = this.#channels;
+    this.#channels = [];
+    const results = await Promise.all(
+      channels.map((channel) => channel.unsubscribe())
+    );
+    return this.#closeIfLast({
+      data: null,
+      error: results.find((result) => result.error !== null)?.error ?? null
+    });
+  }
+  /**
+   * No channel left (the app may have added one meanwhile): the connection
+   * closes. That is the strongest leave — the hub forgets every join with
+   * its connection — so a leave's refusal no longer stands (정정 (j)).
+   */
+  #closeIfLast(result) {
+    if (this.#channels.length > 0) return result;
+    this.#disconnect();
+    return { data: null, error: null };
+  }
+  /**
+   * Each channel in turn, over a copy (a callback may add or remove one);
+   * what one throws does not keep the next from hearing (결정 22).
+   */
+  #each(action) {
+    for (const channel of Array.from(this.#channels))
+      safely(() => action(channel));
+  }
+  #route(frame) {
+    if (frame.topic === PHOENIX_TOPIC || frame.joinRef === null) return;
+    const channel = this.#channels.find(
+      (c) => c.joinRef === frame.joinRef && c.topic === frame.topic
+    );
+    channel?.receive(frame);
+  }
+  #stopped(error) {
+    this.#identity.closed();
+    this.#forgetLeaves();
+    this.#unwatchStorage();
+    this.#each((channel) => channel.stopped(error));
+  }
+  #disconnect() {
+    this.#socket.disconnect();
+    this.#identity.closed();
+    this.#forgetLeaves();
+    this.#unwatchStorage();
+  }
+  #leave(channel, joinRef, tables) {
+    const owed = {
+      channel,
+      joinRef,
+      tables,
+      attempt: 0,
+      timer: void 0
+    };
+    this.#owed.add(owed);
+    return this.#sendLeave(owed, "app");
+  }
+  /**
+   * One `phx_leave` of `owed`; its answer decides whether it is done,
+   * whoever else awaits it. The first goes in the app's turn, after the
+   * frames the app sent on the join before it (and is never refused for
+   * it); one tried again, in the SDK's (PR #328 re-review).
+   */
+  #sendLeave(owed, turn) {
+    const { channel, joinRef } = owed;
+    const reply = this.#socket.request(
+      channel.topic,
+      "phx_leave",
+      {},
+      { joinRef, turn }
+    );
+    void reply.then((answer) => this.#leaveAnswered(owed, answer));
+    return reply;
+  }
+  #leaveAnswered(owed, reply) {
+    if (!this.#owed.has(owed)) return;
+    if (!reply.ok && !reply.lost && LEAVE_RETRY_CODES.has(reply.error.code)) {
+      const delay = backoffMs(owed.attempt, Math.random);
+      owed.attempt += 1;
+      owed.timer = setTimeout(() => {
+        owed.timer = void 0;
+        this.#socket.whenRoom(owed, () => {
+          if (this.#owed.has(owed)) void this.#sendLeave(owed, "sdk");
+        });
+      }, delay);
+      const { error } = reply;
+      this.#each((channel) => {
+        if (sameJoin(channel, owed.channel)) channel.leaveRefused(error);
+      });
+      return;
+    }
+    this.#owed.delete(owed);
+    this.#each((channel) => channel.rejoin());
+  }
+  #owesLeave(channel) {
+    for (const owed of this.#owed)
+      if (sameJoin(owed.channel, channel)) return true;
+    return false;
+  }
+  /** `ChannelContext.owesLeaveOn`: the hub's caps count the joins whose leaves are owed. */
+  #owesLeaveOn(table3) {
+    for (const owed of this.#owed) {
+      if (table3 === null) return true;
+      const key = foldTable(table3);
+      if (owed.tables.some(
+        (held) => held === "*" || key === "*" || foldTable(held) === key
+      ))
+        return true;
+    }
+    return false;
+  }
+  #forgetLeaves() {
+    for (const owed of this.#owed) clearTimeout(owed.timer);
+    this.#owed.clear();
+  }
+  /**
+   * Another tab signing in or out writes the same localStorage key: read the
+   * store again while the connection lives (결정 5) — from its first open to
+   * a stop or the last channel's removal, drops included. Reading again
+   * sends nothing unless the stored token is not what the hub has, so a
+   * storage of the app's own (`auth.storage`), whose writes this event
+   * never reports, costs a read at most.
+   */
+  #watchStorage() {
+    const target = globalThis;
+    if (this.#onStorage !== null || !isBrowser() || typeof target.addEventListener !== "function")
+      return;
+    const key = storageKey(this.#http.baseUrl);
+    this.#onStorage = (event) => {
+      if (event.key === key || event.key === null)
+        void this.#identity.changed();
+    };
+    target.addEventListener("storage", this.#onStorage);
+  }
+  #unwatchStorage() {
+    const target = globalThis;
+    if (this.#onStorage === null) return;
+    target.removeEventListener?.("storage", this.#onStorage);
+    this.#onStorage = null;
+  }
+};
 function fail(error) {
   return { data: null, error };
 }
@@ -8001,7 +10652,7 @@ async function uploadInParts(a) {
     failure.error ??= uploadAborted();
   };
   const tryPart = async (n, bytes) => {
-    const sent = await send(a.http, {
+    const sent2 = await send(a.http, {
       method: "PUT",
       path: `${base}/${String(n)}`,
       headers: { "content-type": "application/octet-stream", ...signed },
@@ -8009,10 +10660,10 @@ async function uploadInParts(a) {
       withToken,
       signal
     });
-    if (sent.error !== null) return sent;
-    const read = await readJson(sent.response, partAnswer(n));
+    if (sent2.error !== null) return sent2;
+    const read = await readJson(sent2.response, partAnswer(n));
     if (read.error !== null)
-      return { error: read.error, status: sent.response.status };
+      return { error: read.error, status: sent2.response.status };
     return { etag: read.data.etag };
   };
   const sendPart = async (n) => {
@@ -8299,7 +10950,7 @@ var StorageFileApi = class {
       "cache-control": cache
     };
     if (upsert) headers["x-upsert"] = "true";
-    const sent = await send(this.#http, {
+    const sent2 = await send(this.#http, {
       method,
       path: target.path,
       headers,
@@ -8308,8 +10959,8 @@ var StorageFileApi = class {
       // The fetch stops with the body: the worker undoes its claim at once.
       signal
     });
-    if (sent.error !== null) return fail(sent.error);
-    return readJson(sent.response, isUploadResult);
+    if (sent2.error !== null) return fail(sent2.error);
+    return readJson(sent2.response, isUploadResult);
   }
   /**
    * A new object; with `upsert: true`, one of the same name is replaced.
@@ -8334,14 +10985,14 @@ var StorageFileApi = class {
     const target = this.#objectPath("", path);
     if (!target.ok) return fail(target.error);
     await this.#auth.ready();
-    const sent = await send(this.#http, {
+    const sent2 = await send(this.#http, {
       method: "GET",
       path: target.path,
       withToken: true
     });
-    if (sent.error !== null) return fail(sent.error);
+    if (sent2.error !== null) return fail(sent2.error);
     try {
-      return { data: await sent.response.blob(), error: null };
+      return { data: await sent2.response.blob(), error: null };
     } catch (error) {
       return fail(networkError(error));
     }
@@ -8606,7 +11257,7 @@ var StorageFileApi = class {
    * is the permission. A failure's cause never carries the token.
    */
   async #putSigned(path, token, payload, cache, signal) {
-    const sent = await send(this.#http, {
+    const sent2 = await send(this.#http, {
       method: "PUT",
       path: `${path}?token=${encodeURIComponent(token)}`,
       headers: { "content-type": payload.type, "cache-control": cache },
@@ -8614,8 +11265,8 @@ var StorageFileApi = class {
       withToken: false,
       signal
     });
-    if (sent.error !== null) return fail(withoutToken(sent.error, token));
-    const read = await readJson(sent.response, isUploadResult);
+    if (sent2.error !== null) return fail(withoutToken(sent2.error, token));
+    const read = await readJson(sent2.response, isUploadResult);
     return read.error === null ? read : fail(withoutToken(read.error, token));
   }
   /**
@@ -8655,10 +11306,36 @@ var CONFIG_MESSAGES = {
   urlNotOrigin: "createClient needs the project url alone, like https://my-app.naro.sh: no path, no ? or #, no user:password@. Naro serves its API at /_naro/v1 on that origin.",
   key: "createClient needs an anonKey (or, on a server, a serviceKey).",
   bothKeys: "Pass createClient an anonKey or a serviceKey, not both.",
-  serviceKeyOffServer: "A Naro service key (naro_sk_\u2026) skips every policy, so createClient accepts it only on a server (Node, Deno, Bun, Cloudflare Workers, an edge runtime), never in a browser, a web worker or a React Native app. Use the anon key (naro_pk_\u2026) here and keep the service key on your server.",
-  fetch: "This runtime has no fetch. Pass one to createClient({ fetch })."
+  serviceKeyOffServer: SERVICE_KEY_OFF_SERVER_MESSAGE,
+  fetch: "This runtime has no fetch. Pass one to createClient({ fetch }).",
+  realtime: "createClient's realtime options take a WebSocket class, and heartbeatIntervalMs and timeoutMs in whole milliseconds from 1 to 2147483647."
 };
 var SERVICE_KEY_PREFIX = "naro_sk_";
+var MAX_TIMER_MS = 2147483647;
+function isMilliseconds(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_TIMER_MS;
+}
+function realtimeOptionsOf(value) {
+  if (value === void 0) return {};
+  if (!isRecord(value)) throw new Error(CONFIG_MESSAGES.realtime);
+  const { WebSocket, heartbeatIntervalMs, timeoutMs } = value;
+  const options = {};
+  if (WebSocket !== void 0) {
+    if (typeof WebSocket !== "function")
+      throw new Error(CONFIG_MESSAGES.realtime);
+    options.WebSocket = WebSocket;
+  }
+  if (heartbeatIntervalMs !== void 0) {
+    if (!isMilliseconds(heartbeatIntervalMs))
+      throw new Error(CONFIG_MESSAGES.realtime);
+    options.heartbeatIntervalMs = heartbeatIntervalMs;
+  }
+  if (timeoutMs !== void 0) {
+    if (!isMilliseconds(timeoutMs)) throw new Error(CONFIG_MESSAGES.realtime);
+    options.timeoutMs = timeoutMs;
+  }
+  return options;
+}
 function baseUrlOf(url) {
   if (typeof url !== "string") throw new Error(CONFIG_MESSAGES.url);
   const trimmed = url.trim();
@@ -8715,18 +11392,27 @@ var NaroClient2 = class {
    */
   storage;
   #run;
+  #newRealtime;
+  /**
+   * Made by the first channel(), not by the constructor: it listens to every
+   * write of the session token (to tell an open connection who signed in),
+   * which an app that never uses Realtime should not pay for.
+   */
+  #realtime;
   constructor(options) {
     const baseUrl = baseUrlOf(options.url);
     const { key: apiKey, service } = apiKeyOf(options);
     if (options.fetch === void 0 && typeof globalThis.fetch !== "function")
       throw new Error(CONFIG_MESSAGES.fetch);
+    const realtime = realtimeOptionsOf(options.realtime);
     const storage = options.auth?.storage ?? defaultStorage();
     const http = {
       baseUrl,
       apiKey,
       fetch: options.fetch,
       tokens: new TokenStore(storage, storageKey(baseUrl)),
-      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl))
+      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl)),
+      service
     };
     this.auth = new AuthClient(http, {
       verifiers: new FlowVerifiers(
@@ -8741,11 +11427,46 @@ var NaroClient2 = class {
     });
     this.#run = queryRunner(http, this.auth);
     this.storage = new StorageClient(http, this.auth);
+    this.#newRealtime = () => new RealtimeClient({
+      http,
+      auth: this.auth,
+      service,
+      options: realtime
+    });
   }
   /** Start a query on `table`: `.select()`, `.insert()`, `.update()` or `.delete()`. */
   from(table3) {
     return new TableBuilder(this.#run, table3);
   }
+  /**
+   * A Realtime channel (original spec §15): `.on()` listeners, then
+   * `.subscribe()`. The same name and privacy give the same channel until
+   * `removeChannel`. Nothing connects until the first `subscribe()`.
+   */
+  channel(name, options) {
+    return this.#client().channel(name, options);
+  }
+  /** The channels made with `channel()` and not yet removed. */
+  getChannels() {
+    return this.#realtime?.getChannels() ?? [];
+  }
+  /**
+   * Leaves the channel and forgets it, so `channel()` of its name makes a new
+   * one; the connection closes with the last channel.
+   */
+  removeChannel(channel) {
+    return this.#client().removeChannel(channel);
+  }
+  /** `removeChannel()` for every channel; the connection closes. */
+  removeAllChannels() {
+    if (this.#realtime === void 0)
+      return Promise.resolve({ data: null, error: null });
+    return this.#realtime.removeAllChannels();
+  }
+  #client() {
+    this.#realtime ??= this.#newRealtime();
+    return this.#realtime;
+  }
 };
 function createClient(options) {
   return new NaroClient2(options);
@@ -8842,18 +11563,27 @@ function unwrap(result) {
 }
 var ONE_KEY = /^[\x21-\x7e]+$/;
 async function objects(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
-  if (backend.status === "none")
+  const environment = dataEnvironment(context.flags);
+  if (backend.status === "none") {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
+      environment === null ? "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`." : `The ${environment} environment has no backend yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
+  }
+  if (!backend.enabled)
+    throw new NaroError(
+      "BACKEND_OFF",
+      forEnvironment(BACKEND_OFF_MESSAGE, environment)
     );
-  if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
   const state = await client.storage.info(projectId);
   if (state.disabledAt !== null)
-    throw new NaroError("STORAGE_OFF", STORAGE_OFF_MESSAGE);
+    throw new NaroError(
+      "STORAGE_OFF",
+      forEnvironment(STORAGE_OFF_MESSAGE, environment)
+    );
   let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
   if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
     throw new NaroError(
@@ -8874,7 +11604,10 @@ async function objects(context) {
   } catch (error) {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+      forEnvironment(
+        `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+        environment
+      ),
       { cause: error }
     );
   }
@@ -8948,7 +11681,7 @@ async function storageLs(context) {
         "VALIDATION_FAILED",
         `--search needs a naro:// path. ${LS_USAGE}`
       );
-    const client = await context.client();
+    const client = await dataClient(context);
     const projectId2 = await context.resolveProjectId();
     const buckets = await client.storage.listBuckets(projectId2);
     context.output.result(
@@ -9058,17 +11791,17 @@ function progressReporter(output, total) {
   let lastLength = 0;
   let open = false;
   return {
-    report(sent) {
-      const percent2 = Math.floor(sent / total * 100);
-      const line = `\u2191 ${binarySize(sent)} / ${binarySize(total)} (${String(percent2)}%)`;
+    report(sent2) {
+      const percent2 = Math.floor(sent2 / total * 100);
+      const line = `\u2191 ${binarySize(sent2)} / ${binarySize(total)} (${String(percent2)}%)`;
       if (tty) {
-        open = sent !== total;
+        open = sent2 !== total;
         output.progress(`\r${line.padEnd(lastLength)}${open ? "" : "\n"}`);
         lastLength = line.length;
         return;
       }
       const tenth = Math.floor(percent2 / 10);
-      if (tenth === lastTenth && sent !== total) return;
+      if (tenth === lastTenth && sent2 !== total) return;
       lastTenth = tenth;
       output.progress(`${line}
 `);
@@ -9605,12 +12338,14 @@ Usage:
   naro env pull [file]               Write env vars to .env.local
        target is production, preview, all or an environment name; add and import use all when none is given
 
-  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments                  List the project's environments: address, branch, protection, data, and how many the plan allows
   naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
                                      A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
   naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
                                      Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
-  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker, protection key and data (asks first; --yes in CI)
+  naro environments provision <slug>
+                                     Make its data \u2014 database, backend, Storage \u2014 or go on after a stop
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -9619,6 +12354,9 @@ Usage:
   naro domains verify [host] [--wait]  Re-check DNS and print what is missing
        exits non-zero while a domain is not live yet
 
+  The data commands below (db, migration, gen, backend, policy, storage, realtime) take --env <name>:
+       a named environment's data instead of production's, which preview shares
+       (naro-cli 0.21.0 and older ignore --env on them and act on production)
   naro db enable                     Create the project's database (Cloudflare D1)
   naro db info                       Database status, size, table count and limits
        and today's writes against the daily write limit (UTC)
@@ -9749,6 +12487,13 @@ Usage:
                                      Remove objects; --recursive removes what is under a folder (asks first):
                                      <path>/ is the folder alone, <path> also an object of that name
 
+  naro realtime [status]             Naro Realtime: on or not, published tables, connections now
+  naro realtime enable               Turn Realtime on: the project's hub, bound to its backend
+  naro realtime tables [list]        The tables whose Data API writes reach subscribers
+  naro realtime tables add <table>\u2026  Publish tables' changes (within about 10 seconds)
+  naro realtime tables remove <table>\u2026 [--yes]
+                                     Stop publishing tables' changes (asks first)
+
   naro promote <deployment-id> [--to <environment>]
                                      Publish a build to production, or to an environment with --to; it says what it will do, then asks.
                                      A build moving between an environment and another surface is built again from its commit with the
@@ -9777,7 +12522,8 @@ Global options:
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
   --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name);
+                  production or an environment name for the data commands (naro db, migration, gen, backend, policy, storage, realtime: production by default)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
                   branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
   --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
@@ -9967,13 +12713,94 @@ function routeStorage(words) {
       return null;
   }
 }
+function routeRealtime(words) {
+  const [sub, action] = words;
+  switch (sub) {
+    case void 0:
+    case "status":
+      return words.length <= 1 ? { handler: runRealtimeStatus, positionals: [] } : null;
+    case "enable":
+      return words.length === 1 ? { handler: runRealtimeEnable, positionals: [] } : null;
+    case "tables":
+      switch (action) {
+        case void 0:
+        case "list":
+        case "ls":
+          return words.length <= 2 ? { handler: runRealtimeTablesList, positionals: [] } : null;
+        case "add":
+          return {
+            handler: runRealtimeTablesAdd,
+            positionals: words.slice(2)
+          };
+        case "remove":
+        case "rm":
+          return {
+            handler: runRealtimeTablesRemove,
+            positionals: words.slice(2)
+          };
+        default:
+          return null;
+      }
+    default:
+      return null;
+  }
+}
 async function refuseTo() {
   throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
 }
+var DATA_COMMANDS = /* @__PURE__ */ new Set([
+  "db",
+  "migration",
+  "gen",
+  "backend",
+  "policy",
+  "storage",
+  "realtime"
+]);
+var PROJECT_WIDE_BACKEND = /* @__PURE__ */ new Set(["enable", "provision", "disable"]);
+function dataEnvRefusal(parsed) {
+  if (parsed.flags.env === void 0 || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return null;
+  const sub = parsed.positionals[0];
+  if (parsed.command === "backend" && sub !== void 0 && PROJECT_WIDE_BACKEND.has(sub) && parsed.flags.env !== "production")
+    return new NaroError(
+      "VALIDATION_FAILED",
+      DATA_ENV_MESSAGES.projectWide(`naro backend ${sub}`)
+    );
+  try {
+    dataEnvironment(parsed.flags);
+    return null;
+  } catch (error) {
+    return error;
+  }
+}
+function guidedError(error, parsed) {
+  if (!isNaroError(error) || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return error;
+  if (dataEnvRefusal(parsed) !== null) return error;
+  let environment;
+  try {
+    environment = dataEnvironment(parsed.flags);
+  } catch {
+    return error;
+  }
+  if (environment === null) return error;
+  const usage = error.message.indexOf("Usage: ");
+  error.message = usage === -1 ? forEnvironment(error.message, environment) : `${forEnvironment(error.message.slice(0, usage), environment)}${error.message.slice(usage)}`;
+  return error;
+}
 function route(parsed) {
   const routed = routeCommand(parsed);
   if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
     return { handler: refuseTo, positionals: routed.positionals };
+  const refusal = routed ? dataEnvRefusal(parsed) : null;
+  if (routed && refusal)
+    return {
+      handler: async () => {
+        throw refusal;
+      },
+      positionals: routed.positionals
+    };
   return routed;
 }
 function routeCommand(parsed) {
@@ -10095,6 +12922,11 @@ function routeCommand(parsed) {
             handler: runEnvironmentsDelete,
             positionals: positionals.slice(1)
           };
+        case "provision":
+          return {
+            handler: runEnvironmentsProvision,
+            positionals: positionals.slice(1)
+          };
         default:
           return null;
       }
@@ -10217,6 +13049,8 @@ function routeCommand(parsed) {
       }
     case "storage":
       return routeStorage(positionals);
+    case "realtime":
+      return routeRealtime(positionals);
     case "policy":
       switch (sub) {
         case void 0:
@@ -10319,7 +13153,7 @@ async function main(argv = process.argv.slice(2)) {
   try {
     await routed.handler(context);
   } catch (error) {
-    context.output.fail(error);
+    context.output.fail(guidedError(error, parsed));
   }
 }
 void main();