naro-cli 0.7.0 → 0.9.0

package/dist/{chunk-E2M6CQL7.js → chunk-Z757IOF3.js}

@@ -1,9 +1,7 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
+import {
+  __export
+} from "./chunk-K3NQKI34.js";
 
 // src/deploy.ts
 import { existsSync as existsSync7 } from "fs";
@@ -284,6 +282,33 @@ function pathnameOf(url2) {
 // ../../packages/core/src/internal-auth.ts
 import { Buffer as Buffer2 } from "buffer";
 
+// ../../packages/core/src/migration-names.ts
+function normalizeMigrationName(name) {
+  return name.trim().toLowerCase().replace(/\.sql$/, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function leadingMigrationNumber(name) {
+  const match = /^(\d+)/.exec(name);
+  return match ? BigInt(match[1] ?? "0") : null;
+}
+function highestMigrationNumber(names) {
+  let max = 0n;
+  for (const name of names) {
+    const number4 = leadingMigrationNumber(name);
+    if (number4 !== null && number4 > max) max = number4;
+  }
+  return max;
+}
+function numberedMigrationName(existing, title) {
+  const number4 = (highestMigrationNumber(existing) + 1n).toString().padStart(4, "0");
+  return `${number4}_${title}.sql`;
+}
+var MAX_SCHEMA_TITLE_LENGTH = 180;
+function schemaMigrationTitle(operation) {
+  const op = typeof operation.op === "string" ? operation.op.replace(/[A-Z]/g, (letter) => `_${letter}`) : "";
+  const target = typeof operation.table === "string" ? operation.table : typeof operation.name === "string" ? operation.name : "";
+  return normalizeMigrationName(`schema ${op} ${target}`).slice(0, MAX_SCHEMA_TITLE_LENGTH).replace(/_+$/, "");
+}
+
 // ../../packages/core/src/paths.ts
 function projectPath(teamSlug, projectSlug) {
   return `/${teamSlug}/projects/${projectSlug}`;
@@ -2474,9 +2499,9 @@ var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst,
     });
   };
 });
-function handleCheckPropertyResult(result, payload, property2) {
+function handleCheckPropertyResult(result, payload, property) {
   if (result.issues.length) {
-    payload.issues.push(...prefixIssues(property2, result.issues));
+    payload.issues.push(...prefixIssues(property, result.issues));
   }
 }
 var $ZodCheckProperty = /* @__PURE__ */ $constructor("$ZodCheckProperty", (inst, def) => {
@@ -11303,10 +11328,10 @@ function _endsWith(suffix, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _property(property2, schema, params) {
+function _property(property, schema, params) {
   return new $ZodCheckProperty({
     check: "property",
-    property: property2,
+    property,
     schema,
     ...normalizeParams(params)
   });
@@ -11403,28 +11428,28 @@ function _tuple(Class2, items, _paramsOrRest, _params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _record(Class2, keyType, valueType2, params) {
+function _record(Class2, keyType, valueType, params) {
   return new Class2({
     type: "record",
     keyType,
-    valueType: valueType2,
+    valueType,
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _map(Class2, keyType, valueType2, params) {
+function _map(Class2, keyType, valueType, params) {
   return new Class2({
     type: "map",
     keyType,
-    valueType: valueType2,
+    valueType,
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _set(Class2, valueType2, params) {
+function _set(Class2, valueType, params) {
   return new Class2({
     type: "set",
-    valueType: valueType2,
+    valueType,
     ...normalizeParams(params)
   });
 }
@@ -13790,37 +13815,37 @@ var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record(keyType, valueType2, params) {
-  if (!valueType2 || !valueType2._zod) {
+function record(keyType, valueType, params) {
+  if (!valueType || !valueType._zod) {
     return new ZodRecord({
       type: "record",
       keyType: string2(),
       valueType: keyType,
-      ...util_exports.normalizeParams(valueType2)
+      ...util_exports.normalizeParams(valueType)
     });
   }
   return new ZodRecord({
     type: "record",
     keyType,
-    valueType: valueType2,
+    valueType,
     ...util_exports.normalizeParams(params)
   });
 }
-function partialRecord(keyType, valueType2, params) {
+function partialRecord(keyType, valueType, params) {
   const k = clone(keyType);
   k._zod.values = void 0;
   return new ZodRecord({
     type: "record",
     keyType: k,
-    valueType: valueType2,
+    valueType,
     ...util_exports.normalizeParams(params)
   });
 }
-function looseRecord(keyType, valueType2, params) {
+function looseRecord(keyType, valueType, params) {
   return new ZodRecord({
     type: "record",
     keyType,
-    valueType: valueType2,
+    valueType,
     mode: "loose",
     ...util_exports.normalizeParams(params)
   });
@@ -13836,11 +13861,11 @@ var ZodMap = /* @__PURE__ */ $constructor("ZodMap", (inst, def) => {
   inst.max = (...args) => inst.check(_maxSize(...args));
   inst.size = (...args) => inst.check(_size(...args));
 });
-function map(keyType, valueType2, params) {
+function map(keyType, valueType, params) {
   return new ZodMap({
     type: "map",
     keyType,
-    valueType: valueType2,
+    valueType,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -13853,10 +13878,10 @@ var ZodSet = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
   inst.max = (...args) => inst.check(_maxSize(...args));
   inst.size = (...args) => inst.check(_size(...args));
 });
-function set(valueType2, params) {
+function set(valueType, params) {
   return new ZodSet({
     type: "set",
-    valueType: valueType2,
+    valueType,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -14828,12 +14853,15 @@ var RESERVED_SUBDOMAINS = [
   "support",
   "www"
 ];
+var BACKEND_WORKER_NAME_PREFIX = "naro-backend-";
 var SUBDOMAIN_PATTERN = /^[a-z0-9](-?[a-z0-9])*$/;
 var SUBDOMAIN_MAX_LENGTH = 54;
 function subdomainProblem(value) {
   if (value.length < 1 || value.length > SUBDOMAIN_MAX_LENGTH) return "invalid";
   if (!SUBDOMAIN_PATTERN.test(value)) return "invalid";
   if (value.endsWith("-preview")) return "reserved";
+  if (value === BACKEND_WORKER_NAME_PREFIX.slice(0, -1) || value.startsWith(BACKEND_WORKER_NAME_PREFIX))
+    return "reserved";
   if (RESERVED_SUBDOMAINS.includes(value))
     return "reserved";
   return null;
@@ -15663,6 +15691,67 @@ var FRAMEWORK_PRESETS = {
     spaFallback: false,
     cachePath: ".next/cache"
   },
+  // The presets below build a static site. Each framework can also render on
+  // a server; detectFramework refuses those setups by name instead of
+  // shipping half an app (see SERVER_ONLY and staticBuildProblem).
+  astro: {
+    id: "astro",
+    detectDependency: "astro",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "dist",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: "node_modules/.astro"
+  },
+  sveltekit: {
+    id: "sveltekit",
+    detectDependency: "@sveltejs/kit",
+    defaultBuildScript: "build",
+    // adapter-static's default `pages` directory.
+    defaultOutputDirectory: "build",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: null
+  },
+  nuxt: {
+    id: "nuxt",
+    detectDependency: "nuxt",
+    // `nuxt generate` prerenders every route; `nuxt build` would need Nitro.
+    defaultBuildScript: "generate",
+    defaultOutputDirectory: ".output/public",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: "node_modules/.cache"
+  },
+  angular: {
+    id: "angular",
+    detectDependency: "@angular/core",
+    defaultBuildScript: "build",
+    // Documentation only: the real path is read from angular.json by
+    // angularOutput, which never falls back to this string.
+    defaultOutputDirectory: "dist/<project>/browser",
+    needsServerRuntime: false,
+    spaFallback: true,
+    cachePath: ".angular/cache"
+  },
+  docusaurus: {
+    id: "docusaurus",
+    detectDependency: "@docusaurus/core",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "build",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: "node_modules/.cache"
+  },
+  gatsby: {
+    id: "gatsby",
+    detectDependency: "gatsby",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "public",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: ".cache"
+  },
   vite: {
     id: "vite",
     detectDependency: "vite",
@@ -15691,10 +15780,36 @@ var FRAMEWORK_PRESETS = {
     cachePath: null
   }
 };
-var DETECTION_ORDER = ["next", "vite", "cra"];
+var DETECTION_ORDER = [
+  "next",
+  "nuxt",
+  "astro",
+  "sveltekit",
+  "angular",
+  "docusaurus",
+  "gatsby",
+  "vite",
+  "cra"
+];
+var SERVER_ONLY = [
+  { dependency: "@tanstack/react-start", name: "TanStack Start" },
+  { dependency: "@tanstack/solid-start", name: "TanStack Start" },
+  { dependency: "@remix-run/dev", name: "Remix" },
+  { dependency: "@react-router/dev", name: "React Router (framework mode)" },
+  { dependency: "@solidjs/start", name: "SolidStart" },
+  { dependency: "@builder.io/qwik-city", name: "Qwik City" },
+  { dependency: "@analogjs/platform", name: "Analog" }
+];
+var SERVER_RUNTIME_HINT = "Naro deploys Next.js, static sites and single-page apps; server rendering for other frameworks is not supported yet.";
 var FRAMEWORK_LABELS = {
   next: "Next.js",
   "next-export": "Next.js static export",
+  astro: "Astro",
+  sveltekit: "SvelteKit",
+  nuxt: "Nuxt",
+  angular: "Angular",
+  docusaurus: "Docusaurus",
+  gatsby: "Gatsby",
   vite: "Vite",
   cra: "Create React App",
   static: "static files"
@@ -15705,8 +15820,7 @@ function dependencyVersion(packageJson, name) {
 }
 var STATIC_EXPORT = /(?:^|[\s,{;])output\s*:\s*(["'`])export\1/;
 function declaresStaticExport(source) {
-  const code = source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/.*$/gm, "$1");
-  return STATIC_EXPORT.test(code);
+  return STATIC_EXPORT.test(stripComments(source));
 }
 async function usesStaticExport(root) {
   for (const name of NEXT_CONFIG_FILES) {
@@ -15718,6 +15832,102 @@ async function usesStaticExport(root) {
   }
   return false;
 }
+var ASTRO_CONFIG_FILES = [
+  "astro.config.mjs",
+  "astro.config.js",
+  "astro.config.ts",
+  "astro.config.mts",
+  "astro.config.cjs"
+];
+var SVELTE_CONFIG_FILES = [
+  "svelte.config.js",
+  "svelte.config.mjs",
+  "svelte.config.ts"
+];
+var VITE_CONFIG_FILES = [
+  "vite.config.ts",
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.mts"
+];
+var ASTRO_ADAPTER = /^@astrojs\/(cloudflare|node|vercel|netlify|deno)$/;
+async function readFirst(root, names) {
+  for (const name of names) {
+    try {
+      return await readFile6(join7(root, name), "utf8");
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/.*$/gm, "$1");
+}
+async function staticBuildProblem(root, id, packageJson) {
+  const has = (name) => dependencyVersion(packageJson, name) !== null;
+  const dependencies = [
+    ...Object.keys(packageJson.dependencies ?? {}),
+    ...Object.keys(packageJson.devDependencies ?? {})
+  ];
+  switch (id) {
+    case "sveltekit": {
+      const configs = await Promise.all(
+        [...SVELTE_CONFIG_FILES, ...VITE_CONFIG_FILES].map(
+          (name) => readFirst(root, [name])
+        )
+      );
+      const usesStatic = configs.some(
+        (source) => source !== null && stripComments(source).includes("@sveltejs/adapter-static")
+      );
+      return usesStatic ? null : "SvelteKit deploys on Naro with @sveltejs/adapter-static only (install it, use it as the adapter in svelte.config.js or vite.config.ts, and prerender your pages).";
+    }
+    case "astro": {
+      const adapter = dependencies.find((name) => ASTRO_ADAPTER.test(name));
+      if (adapter)
+        return `This Astro project uses the ${adapter} adapter, which renders on a server. Remove it to deploy the static build.`;
+      const config2 = await readFirst(root, ASTRO_CONFIG_FILES);
+      if (config2 && /(?:^|[\s,{;])output\s*:\s*(["'`])server\1/.test(stripComments(config2)))
+        return 'This Astro project sets output: "server". Use the default static output to deploy on Naro.';
+      return null;
+    }
+    case "angular":
+      return has("@angular/ssr") ? "This Angular project uses @angular/ssr (server rendering). Remove it to deploy the browser build." : null;
+    default:
+      return null;
+  }
+}
+async function angularOutput(root) {
+  const source = await readFirst(root, ["angular.json"]);
+  let workspace = null;
+  try {
+    workspace = source ? JSON.parse(source) : null;
+  } catch {
+    workspace = null;
+  }
+  const project = Object.values(workspace?.projects ?? {}).find(
+    (entry) => entry.projectType === "application"
+  );
+  const build = project?.architect?.build;
+  const outputPath = build?.options?.outputPath;
+  const legacy = build?.builder?.endsWith(":browser") ?? false;
+  const clean = (path) => path.replace(/^\.?\/+/, "").replace(/\/+$/, "");
+  if (typeof outputPath === "string")
+    return legacy ? clean(outputPath) : `${clean(outputPath)}/browser`;
+  if (outputPath && typeof outputPath.base === "string")
+    return `${clean(outputPath.base)}/${outputPath.browser ?? "browser"}`.replace(
+      /\/$/,
+      ""
+    );
+  const name = Object.entries(workspace?.projects ?? {}).find(
+    ([, entry]) => entry === project
+  )?.[0];
+  if (name) return `dist/${name}/browser`;
+  throw new DeploymentError(
+    "FRAMEWORK_DETECTION_FAILED",
+    "Could not find the Angular application's output path in angular.json. Set the output directory in the project settings."
+  );
+}
 async function readPackageJson(root) {
   let source;
   try {
@@ -15754,6 +15964,14 @@ async function detectFramework(root, overrides = {}) {
   } else if (!packageJson) {
     preset = FRAMEWORK_PRESETS.static;
   } else {
+    const serverOnly = SERVER_ONLY.find(
+      ({ dependency }) => dependencyVersion(packageJson, dependency) !== null
+    );
+    if (serverOnly)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        `${serverOnly.name} needs a server runtime. ${SERVER_RUNTIME_HINT}`
+      );
     const detected = DETECTION_ORDER.map((id) => FRAMEWORK_PRESETS[id]).find(
       (candidate) => candidate.detectDependency !== null && dependencyVersion(packageJson, candidate.detectDependency) !== null
     );
@@ -15766,6 +15984,14 @@ async function detectFramework(root, overrides = {}) {
   }
   if (preset.id === "next" && await usesStaticExport(root))
     preset = FRAMEWORK_PRESETS["next-export"];
+  if (!overrides.framework && packageJson) {
+    const problem = await staticBuildProblem(root, preset.id, packageJson);
+    if (problem)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        `${problem} ${SERVER_RUNTIME_HINT}`
+      );
+  }
   const buildScript = overrides.buildCommand ?? preset.defaultBuildScript;
   if (buildScript !== null) {
     if (!packageJson)
@@ -15783,7 +16009,7 @@ async function detectFramework(root, overrides = {}) {
   return {
     preset,
     buildScript,
-    outputDirectory: overrides.outputDirectory ?? preset.defaultOutputDirectory,
+    outputDirectory: overrides.outputDirectory ?? (preset.id === "angular" ? await angularOutput(root) : preset.defaultOutputDirectory),
     description: version2 ? `${FRAMEWORK_LABELS[preset.id]} ${version2}` : FRAMEWORK_LABELS[preset.id],
     dependencyRange: version2
   };
@@ -17573,12 +17799,21 @@ var LocalBuildExecutor = class {
         checkout,
         input.rootDirectory
       );
+      const stacks = await import("./stack-PDV3NPWC.js");
+      const stack = await (this.dependencies.detectStack ?? stacks.detectStack)(
+        appRoot
+      ).catch(() => null);
+      if (stack) await observer.onMetadata?.({ framework: stack });
       const resolved = await this.dependencies.detectFramework(appRoot, {
         framework: input.framework ?? null,
         buildCommand: input.buildCommand ?? null,
         outputDirectory: input.outputDirectory ?? null
       });
       await info2(observer, "CLONING", `Detected ${resolved.description}`);
+      if (!stack)
+        await observer.onMetadata?.({
+          framework: stacks.stackForPreset(resolved.preset.id)
+        });
       const isNext = resolved.preset.id === "next";
       if (isNext && resolved.dependencyRange) {
         const declared = declaredNextMajor(resolved.dependencyRange);
@@ -17934,6 +18169,12 @@ async function errorFromResponse(response, context) {
   const serverMessage = typeof body?.error?.message === "string" ? body.error.message : null;
   const code = serverCode ?? (response.status === 401 ? "UNAUTHORIZED" : response.status === 404 ? "NOT_FOUND" : response.status === 429 ? "RATE_LIMITED" : "INTERNAL_ERROR");
   const details = {};
+  const serverDetails = body?.error?.details;
+  if (typeof serverDetails === "object" && serverDetails !== null && !Array.isArray(serverDetails))
+    Object.assign(details, serverDetails);
+  const retryAfter = response.headers.get("retry-after")?.trim() ?? "";
+  if (response.status === 429 && /^\d{1,9}$/.test(retryAfter))
+    details.retryAfter = Number(retryAfter);
   if (body?.error?.fields !== void 0) details.fields = body.error.fields;
   if (typeof body?.error?.installUrl === "string")
     details.installUrl = body.error.installUrl;
@@ -18357,6 +18598,21 @@ var TERMINAL_DEPLOYMENT_STATUSES = [
 function isTerminalStatus(status) {
   return TERMINAL_DEPLOYMENT_STATUSES.includes(status);
 }
+var STALLED_GRACE_MS = 2 * 6e4;
+function isStalledBackend(info3, now = Date.now()) {
+  if (typeof info3.stalled === "boolean") return info3.stalled;
+  if (info3.status !== "provisioning") return false;
+  if (info3.leaseExpiresAt === null) return true;
+  const until = Date.parse(info3.leaseExpiresAt);
+  return Number.isNaN(until) || until + STALLED_GRACE_MS <= now;
+}
+var POLICY_RULES = [
+  "none",
+  "public",
+  "authenticated",
+  "owner"
+];
+var POLICY_ACTIONS = ["select", "insert", "update", "delete"];
 function projectInfo(row) {
   return {
     id: row.id,
@@ -18414,6 +18670,7 @@ var NaroClient = class {
   domains;
   logs;
   db;
+  backend;
   constructor(options) {
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
@@ -18427,9 +18684,11 @@ var NaroClient = class {
     this.domains = new DomainsApi(this);
     this.logs = new LogsApi(this);
     this.db = new DbApi(this);
+    this.backend = new BackendApi(this);
   }
   async request(path, options) {
     const token = await this.getAccessToken();
+    const timeoutMs = options.timeoutMs ?? this.requestTimeoutMs;
     let response;
     try {
       response = await this.doFetch(`${this.baseUrl}${path}`, {
@@ -18439,13 +18698,13 @@ var NaroClient = class {
           ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
         },
         ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
-        signal: AbortSignal.timeout(this.requestTimeoutMs)
+        signal: AbortSignal.timeout(timeoutMs)
       });
     } catch (error51) {
       if (error51 instanceof Error && (error51.name === "TimeoutError" || error51.name === "AbortError")) {
         throw new NaroError(
           "TIMEOUT",
-          `${options.context} timed out after ${String(Math.round(this.requestTimeoutMs / 1e3))}s.`,
+          `${options.context} timed out after ${String(Math.round(timeoutMs / 1e3))}s.`,
           { cause: error51 }
         );
       }
@@ -18833,6 +19092,9 @@ var LogsApi = class {
     return body.entries;
   }
 };
+var EXPORT_FIRST_POLL_MS = 1e3;
+var EXPORT_MAX_POLL_MS = 5e3;
+var EXPORT_TIMEOUT_MS = 15 * 6e4;
 var DbApi = class {
   constructor(client) {
     this.client = client;
@@ -18903,9 +19165,381 @@ var DbApi = class {
       }
     );
   }
+  /**
+   * The current Time Travel bookmark, or the one `timestamp` (RFC 3339 with a
+   * timezone, or Unix seconds) names. The server checks the range - the last
+   * 30 days, not before the database existed - before asking Cloudflare.
+   */
+  async bookmark(projectId, options = {}) {
+    const query = options.timestamp === void 0 ? "" : `?timestamp=${encodeURIComponent(options.timestamp)}`;
+    const body = await this.client.request(
+      this.path(projectId, `/bookmark${query}`),
+      { context: "Read bookmark" }
+    );
+    return { bookmark: body.bookmark, timestamp: body.timestamp };
+  }
+  /**
+   * Rolls the database back to a bookmark or a timestamp - rows, schema and
+   * the migration ledger alike - and cancels queries in flight. Restoring to
+   * `previousBookmark` undoes it.
+   */
+  async restore(projectId, target) {
+    const given = target;
+    const body = await this.client.request(
+      this.path(projectId, "/restore"),
+      {
+        method: "POST",
+        body: {
+          ...given.bookmark !== void 0 ? { bookmark: given.bookmark } : {},
+          ...given.timestamp !== void 0 ? { timestamp: given.timestamp } : {}
+        },
+        context: "Restore database"
+      }
+    );
+    return { bookmark: body.bookmark, previousBookmark: body.previousBookmark };
+  }
+  /**
+   * One step of an export: starts it, or - with the first step's
+   * `atBookmark` as `currentBookmark` - polls it. See `export` for the loop.
+   */
+  async exportStep(projectId, options = {}) {
+    const body = await this.client.request(
+      this.path(projectId, "/export"),
+      {
+        method: "POST",
+        // Only the keys given: the server validates each one it sees.
+        body: {
+          ...options.schemaOnly !== void 0 ? { schemaOnly: options.schemaOnly } : {},
+          ...options.dataOnly !== void 0 ? { dataOnly: options.dataOnly } : {},
+          ...options.tables !== void 0 ? { tables: options.tables } : {},
+          ...options.currentBookmark !== void 0 ? { currentBookmark: options.currentBookmark } : {}
+        },
+        context: "Export database"
+      }
+    );
+    return body.export;
+  }
+  /**
+   * Exports the database and polls until the dump is ready. The server takes
+   * one Cloudflare step per call - a big database runs for minutes, longer
+   * than a Worker should wait - so the loop is here: 1 s, then 1.5x per poll
+   * up to 5 s. Cloudflare holds every other query to the database while the
+   * export runs.
+   *
+   * On TIMEOUT the export is still running at Cloudflare; nothing was
+   * cancelled.
+   */
+  async export(projectId, options = {}, wait = {}) {
+    const timeoutMs = wait.timeoutMs ?? EXPORT_TIMEOUT_MS;
+    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+    const given = wait.pollIntervalMs;
+    const firstPollMs = given !== void 0 && Number.isFinite(given) && given > 0 ? given : EXPORT_FIRST_POLL_MS;
+    const maxPollMs = Math.max(EXPORT_MAX_POLL_MS, firstPollMs);
+    const startedAt = Date.now();
+    let step = await this.exportStep(projectId, options);
+    wait.onProgress?.(step);
+    const currentBookmark = step.atBookmark;
+    const polled = {
+      ...options,
+      ...step.tables !== void 0 ? { tables: step.tables } : {}
+    };
+    let intervalMs = firstPollMs;
+    while (step.status !== "complete") {
+      if (Date.now() - startedAt >= timeoutMs) {
+        throw new NaroError(
+          "TIMEOUT",
+          `The export was still running after ${String(Math.round(timeoutMs / 6e4))} minutes. Cloudflare keeps it going; run naro db dump again later.`,
+          { details: { atBookmark: currentBookmark } }
+        );
+      }
+      await sleep2(intervalMs);
+      intervalMs = Math.min(intervalMs * 1.5, maxPollMs);
+      step = await this.exportStep(projectId, { ...polled, currentBookmark });
+      wait.onProgress?.(step);
+    }
+    return step;
+  }
+  /**
+   * Records the remote schema as the already-applied migration `name` and
+   * returns its SQL - a baseline for a database that has none. Refused with
+   * DATABASE_HAS_MIGRATIONS when the ledger has rows, DATABASE_EMPTY when
+   * there is no schema. The caller writes the file.
+   */
+  async pull(projectId, input) {
+    return this.client.request(this.path(projectId, "/pull"), {
+      method: "POST",
+      body: { name: input.name },
+      context: "Pull schema"
+    });
+  }
+  /**
+   * Changes the schema without SQL (spec 2026-09-24 P2-4): the server
+   * renders the DDL, checks it and applies it as ONE migration recorded in
+   * `d1_migrations` — all operations or none. `dryRun` returns the SQL and
+   * the name without applying anything. Save `sql` as `migrations/<name>` so
+   * `naro db reset` re-applies it; a refused operation's index is in
+   * `details.operation`.
+   */
+  async schema(projectId, operations, options = {}) {
+    return this.client.request(
+      this.path(projectId, "/schema"),
+      {
+        method: "POST",
+        // Only the keys given: the server validates each one it sees.
+        body: {
+          operations,
+          ...options.dryRun !== void 0 ? { dryRun: options.dryRun } : {},
+          ...options.name !== void 0 ? { name: options.name } : {}
+        },
+        context: "Change schema"
+      }
+    );
+  }
+};
+var PROVISION_TIMEOUT_MS = 12e4;
+function backendInfo(body) {
+  return {
+    status: body.status,
+    step: body.step,
+    error: body.error,
+    url: body.url,
+    anonKey: body.anonKey,
+    serviceKeyPrefix: body.serviceKeyPrefix,
+    leaseExpiresAt: body.leaseExpiresAt ?? null,
+    // Only a real verdict: without it `isStalledBackend` judges locally.
+    ...typeof body.stalled === "boolean" ? { stalled: body.stalled } : {},
+    // A control plane from before the toggle could not turn a backend off:
+    // whatever it has is on.
+    enabled: typeof body.enabled === "boolean" ? body.enabled : body.status !== "none",
+    disabledAt: body.disabledAt ?? null,
+    turningOff: body.turningOff === true
+  };
+}
+var BackendApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/backend${suffix}`;
+  }
+  /**
+   * `status: "none"` until the backend is first turned on; `enabled` says
+   * whether it is on now.
+   */
+  async info(projectId) {
+    const body = await this.client.request(this.path(projectId), {
+      context: "Read backend"
+    });
+    return backendInfo(body);
+  }
+  /**
+   * Turns the backend on (toggle spec §2.3): the first time it provisions
+   * the D1, the keys and the Naro worker; a backend that was turned off
+   * comes back with the same keys — its worker is uploaded again, nothing
+   * else is made anew. Safe to repeat, and a repair: a ready backend that
+   * is on has its routes written again and its worker checked (no upload),
+   * a failed run resumes at its step. A step that fails is not an
+   * HTTP error — the answer is 200 with `status: "error"`, `step` and
+   * `error`. While another run holds the project's lease this answers the
+   * row as it stands (`provisioning`).
+   */
+  async enable(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/enable"),
+      {
+        method: "POST",
+        context: "Enable backend",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return backendInfo(body);
+  }
+  /**
+   * Turns the backend off (toggle spec §2.2): the dispatcher's routes to
+   * the Naro worker go, so the app's sign-ins and data requests answer 404
+   * from `/_naro/*` — in up to about 90 seconds, as the dispatcher's cache
+   * ages out. The D1 with its data and users, the keys, the sign-in
+   * settings and the worker stay; `enable` brings it back as it was.
+   * Safe to repeat, and a repair: a backend already off has its routes
+   * removed again — what finishes a turn-off that stopped half-way
+   * (`turningOff`) — and keeps its first `disabledAt`. No backend at all
+   * answers as it stands. `BACKEND_BUSY` while another run holds the lease.
+   */
+  async disable(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/disable"),
+      { method: "POST", context: "Disable backend" }
+    );
+    return backendInfo(body);
+  }
+  /**
+   * `enable` under its first name: the control plane keeps
+   * `POST …/backend/provision` as the same call.
+   */
+  async provision(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/provision"),
+      {
+        method: "POST",
+        context: "Provision backend",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return backendInfo(body);
+  }
+  /** The anon key and the service key's prefix; BACKEND_NOT_READY before provisioning. */
+  async keys(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/keys"),
+      { context: "Read API keys" }
+    );
+    return { anonKey: body.anonKey, serviceKeyPrefix: body.serviceKeyPrefix };
+  }
+  /**
+   * The whole service key. It skips every policy — servers only. A role
+   * without `database.write` gets `FORBIDDEN` "Your role cannot reveal the
+   * service key."
+   */
+  async revealServiceKey(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/keys?reveal=service"),
+      { context: "Reveal service key" }
+    );
+    return body.serviceKey;
+  }
+  /**
+   * Replaces the live key of one kind, in two phases (spec §6 "(P1-3 리뷰
+   * 반영)" I3): the worker takes the new hash first, and only then does the
+   * database swap keys. There is no overlap — the old key stops working once
+   * both are done. Only a `ready` backend that is on rotates
+   * (`BACKEND_NOT_READY`, `BACKEND_BUSY`, or `BACKEND_OFF` while it is
+   * turned off).
+   *
+   * The database decides the outcome. Whenever the new key ends up live —
+   * even if a step after the swap failed — this resolves with the key and
+   * `backend.status` `error`. Otherwise it throws `BACKEND_ROTATION_FAILED`
+   * with no key; that usually leaves the old key working, but a 5xx, a
+   * timeout or a lost connection is not proof either way: `keys()` (and
+   * `revealServiceKey()`) show which key is live, and `enable` puts the
+   * stored keys back on the worker. For a few seconds during any rotation
+   * the worker can already refuse the old key.
+   */
+  async rotateKey(projectId, kind) {
+    const body = await this.client.request(this.path(projectId, "/keys/rotate"), {
+      method: "POST",
+      body: { kind },
+      context: "Rotate API key",
+      timeoutMs: PROVISION_TIMEOUT_MS
+    });
+    const backend = backendInfo(body);
+    const key = kind === "anon" ? backend.anonKey : body.serviceKey;
+    if (typeof key !== "string" || key === "")
+      throw new NaroError(
+        "INTERNAL_ERROR",
+        "The rotation answer carried no new key. `naro backend keys` shows the key stored now (--reveal for the service key).",
+        { details: { backend } }
+      );
+    return { backend, key };
+  }
+  /**
+   * The sign-in settings (spec P2-6 §12): email, Google and GitHub, the
+   * allowed redirect origins, whether sign-in waits for a confirmed email,
+   * and the callback URLs to register with the providers. Never a secret.
+   */
+  async auth(projectId) {
+    return this.client.request(
+      this.path(projectId, "/auth"),
+      {
+        context: "Read sign-in settings"
+      }
+    );
+  }
+  /**
+   * Changes the given settings and uploads the Naro worker again with them,
+   * under the provisioning lease: `BACKEND_BUSY` while another run holds it
+   * (nothing is saved), `BACKEND_NOT_READY` before the first provision,
+   * `BACKEND_OFF` while the backend is turned off (nothing is saved),
+   * `VERIFICATION_NEEDS_EMAIL` for a state where nobody could sign in. A
+   * failed upload is not an error — `backend.status` says `error` and the
+   * settings are saved; `enable` finishes. Two minutes, like enable.
+   */
+  async setAuth(projectId, patch) {
+    const answer = await this.client.request(
+      this.path(projectId, "/auth"),
+      {
+        method: "PUT",
+        body: patch,
+        context: "Change sign-in settings",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return { auth: answer.auth, backend: backendInfo(answer.backend) };
+  }
+  /** Removes email or one provider; the same answer as `setAuth`. */
+  async removeAuth(projectId, target) {
+    const answer = await this.client.request(
+      this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
+      {
+        method: "DELETE",
+        context: "Change sign-in settings",
+        timeoutMs: PROVISION_TIMEOUT_MS
+      }
+    );
+    return { auth: answer.auth, backend: backendInfo(answer.backend) };
+  }
+  /** Every stored policy, by table name. Tables without one deny anon and signed-in requests. */
+  async policies(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/policies"),
+      { context: "List policies" }
+    );
+    return body.policies;
+  }
+  /**
+   * Merges the given fields into the table's policy (what is left out keeps
+   * its stored value, or `none`) and returns the whole row as stored, under
+   * the table's own spelling. An `owner` rule needs `ownerColumn`.
+   */
+  async setPolicy(projectId, table, patch) {
+    const body = {};
+    for (const key of [...POLICY_ACTIONS, "ownerColumn"])
+      if (patch[key] !== void 0) body[key] = patch[key];
+    const answer = await this.client.request(
+      this.path(projectId, `/policies/${encodeURIComponent(table)}`),
+      { method: "PUT", body, context: "Set policy" }
+    );
+    return answer.policy;
+  }
+  /**
+   * Deletes the table's policy, so it denies anon and signed-in requests
+   * again. `POLICY_NOT_FOUND` when the table has none.
+   */
+  async removePolicy(projectId, table) {
+    const answer = await this.client.request(
+      this.path(projectId, `/policies/${encodeURIComponent(table)}`),
+      { method: "DELETE", context: "Remove policy" }
+    );
+    return answer.policy;
+  }
 };
 
 // ../../packages/sdk/src/database.ts
+var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
+var BOOKMARK_FORMAT_MESSAGE = "bookmark must look like 00000001-00000008-000050ed-272153b8520cfb93b49834d93a1a1ab3 (four hyphen-separated hex groups, 59 characters).";
+function isBookmark(value) {
+  return typeof value === "string" && BOOKMARK_RE.test(value);
+}
+var RESTORE_OUTCOME_UNKNOWN_CODES = /* @__PURE__ */ new Set([
+  "DATABASE_RESTORE_FAILED",
+  "DATABASE_UNAVAILABLE",
+  "TIMEOUT",
+  "NETWORK_ERROR"
+]);
+function cellText(statement, row, column) {
+  const index = statement.columns.indexOf(column);
+  const value = index < 0 ? void 0 : row[index];
+  return value === null || value === void 0 ? "" : String(value);
+}
 var MAX_CELL_CHARS = 60;
 function formatCell(value) {
   if (value === null || value === void 0) return "NULL";
@@ -19099,62 +19733,115 @@ function hasConfig(dir, base2, evidence) {
   }
   return false;
 }
+var SERVER_ONLY2 = [
+  ["@tanstack/react-start", "TanStack Start"],
+  ["@tanstack/solid-start", "TanStack Start"],
+  ["@remix-run/dev", "Remix"],
+  ["@react-router/dev", "React Router (framework mode)"],
+  ["@solidjs/start", "SolidStart"],
+  ["@builder.io/qwik-city", "Qwik City"],
+  ["@analogjs/platform", "Analog"]
+];
+var DETECTORS = [
+  {
+    framework: "nextjs",
+    name: "Next.js",
+    dependency: "next",
+    config: "next.config",
+    buildCommand: "next build",
+    outputDirectory: ".next"
+  },
+  {
+    framework: "nuxt",
+    name: "Nuxt",
+    dependency: "nuxt",
+    config: "nuxt.config",
+    buildCommand: "nuxt generate",
+    outputDirectory: ".output/public"
+  },
+  {
+    framework: "astro",
+    name: "Astro",
+    dependency: "astro",
+    config: "astro.config",
+    buildCommand: "astro build",
+    outputDirectory: "dist"
+  },
+  {
+    framework: "sveltekit",
+    name: "SvelteKit",
+    dependency: "@sveltejs/kit",
+    buildCommand: "vite build",
+    outputDirectory: "build"
+  },
+  {
+    framework: "angular",
+    name: "Angular",
+    dependency: "@angular/core",
+    buildCommand: "ng build",
+    outputDirectory: "dist/<project>/browser"
+  },
+  {
+    framework: "docusaurus",
+    name: "Docusaurus",
+    dependency: "@docusaurus/core",
+    buildCommand: "docusaurus build",
+    outputDirectory: "build"
+  },
+  {
+    framework: "gatsby",
+    name: "Gatsby",
+    dependency: "gatsby",
+    buildCommand: "gatsby build",
+    outputDirectory: "public"
+  },
+  {
+    framework: "vite",
+    name: "Vite",
+    dependency: "vite",
+    config: "vite.config",
+    buildCommand: "vite build",
+    outputDirectory: "dist"
+  },
+  {
+    framework: "react",
+    name: "Create React App",
+    dependency: "react-scripts",
+    buildCommand: "react-scripts build",
+    outputDirectory: "build"
+  }
+];
 function detectFramework2(dir) {
   const evidence = [];
   const pkg = readPackageJson2(dir);
-  if (hasDependency(pkg, "next") || hasConfig(dir, "next.config", evidence)) {
-    if (hasDependency(pkg, "next")) evidence.push("package.json: next");
-    if (existsSync3(join20(dir, "app"))) evidence.push("app/");
-    if (existsSync3(join20(dir, "pages"))) evidence.push("pages/");
-    return {
-      framework: "nextjs",
-      name: "Next.js",
-      buildCommand: "next build",
-      outputDirectory: ".next",
-      evidence,
-      deployable: true
-    };
-  }
-  if (hasDependency(pkg, "nuxt") || hasConfig(dir, "nuxt.config", evidence)) {
-    if (hasDependency(pkg, "nuxt")) evidence.push("package.json: nuxt");
-    return {
-      framework: "nuxt",
-      name: "Nuxt",
-      buildCommand: "nuxt build",
-      outputDirectory: ".output",
-      evidence,
-      deployable: false
-    };
-  }
-  if (hasDependency(pkg, "astro") || hasConfig(dir, "astro.config", evidence)) {
-    if (hasDependency(pkg, "astro")) evidence.push("package.json: astro");
+  const serverOnly = SERVER_ONLY2.find(
+    ([dependency]) => hasDependency(pkg, dependency)
+  );
+  if (serverOnly) {
+    evidence.push(`package.json: ${serverOnly[0]}`);
     return {
-      framework: "astro",
-      name: "Astro",
-      buildCommand: "astro build",
-      outputDirectory: "dist",
+      framework: "server-only",
+      name: serverOnly[1],
+      buildCommand: null,
+      outputDirectory: null,
       evidence,
       deployable: false
     };
   }
-  if (hasDependency(pkg, "vite") || hasConfig(dir, "vite.config", evidence)) {
-    if (hasDependency(pkg, "vite")) evidence.push("package.json: vite");
-    return {
-      framework: "vite",
-      name: "Vite",
-      buildCommand: "vite build",
-      outputDirectory: "dist",
-      evidence,
-      deployable: true
-    };
-  }
-  if (hasDependency(pkg, "react-scripts")) {
-    evidence.push("package.json: react-scripts");
+  for (const detector of DETECTORS) {
+    const byDependency = hasDependency(pkg, detector.dependency);
+    const byConfig = !byDependency && detector.config ? hasConfig(dir, detector.config, evidence) : false;
+    if (!byDependency && !byConfig) continue;
+    if (byDependency) evidence.push(`package.json: ${detector.dependency}`);
+    if (detector.framework === "nextjs") {
+      if (existsSync3(join20(dir, "app"))) evidence.push("app/");
+      if (existsSync3(join20(dir, "pages"))) evidence.push("pages/");
+    }
     return {
-      framework: "react",
-      name: "Create React App",
-      buildCommand: "react-scripts build",
-      outputDirectory: "build",
+      framework: detector.framework,
+      name: detector.name,
+      buildCommand: detector.buildCommand,
+      outputDirectory: detector.outputDirectory,
       evidence,
       deployable: true
     };
@@ -19180,27 +19867,455 @@ function detectFramework2(dir) {
   };
 }
 
+// ../../packages/data-core/src/system-tables.ts
+var SYSTEM_TABLE_PREFIXES = [
+  "_naro_",
+  "_cf_",
+  "sqlite_"
+];
+var SYSTEM_TABLE_NAMES = ["d1_migrations"];
+function asciiLower(text) {
+  return text.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+}
+function isSystemTable(name) {
+  const lower = asciiLower(name);
+  return SYSTEM_TABLE_PREFIXES.some((prefix) => lower.startsWith(prefix)) || SYSTEM_TABLE_NAMES.includes(lower);
+}
+function likeLiteral(text) {
+  return text.replace(/[\\%_]/g, (char) => `\\${char}`).replace(/'/g, "''");
+}
+var COLUMN_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$/;
+function systemTablePredicate(column = "name") {
+  if (!COLUMN_REFERENCE.test(column))
+    throw new Error(`Not a column reference: ${column}`);
+  return [
+    ...SYSTEM_TABLE_PREFIXES.map(
+      (prefix) => `${column} NOT LIKE '${likeLiteral(prefix)}%' ESCAPE '\\'`
+    ),
+    ...SYSTEM_TABLE_NAMES.map(
+      (name) => `${column} NOT LIKE '${likeLiteral(name)}' ESCAPE '\\'`
+    ),
+    `${column} NOT IN (SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'shadow')`
+  ].join(" AND ");
+}
+var SYSTEM_TABLE_SQL_PREDICATE = systemTablePredicate("name");
+
+// ../../packages/data-core/src/values.ts
+function isPlainObject2(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isValue(value) {
+  return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+
+// ../../packages/data-core/src/query.ts
+var FILTER_OPERATORS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "is",
+  "like",
+  "ilike",
+  // Phase 2-1: for a TEXT column holding a JSON array (spec P2-1 §2).
+  "contains",
+  "containedBy",
+  "overlaps"
+];
+function isAuthUid(value) {
+  return isPlainObject2(value) && Object.keys(value).length === 1 && Object.hasOwn(value, "auth") && value.auth === "uid";
+}
+var MAX_BODY_BYTES = 1024 * 1024;
+var MAX_FILTERS = 100;
+var MAX_FILTER_DEPTH = 4;
+var MAX_ARRAY_VALUES = 100;
+var MAX_ARRAY_CONDITIONS = 4;
+var ARRAY_OPERATORS = [
+  "contains",
+  "containedBy",
+  "overlaps"
+];
+var MAX_PATTERN_LENGTH = 1024;
+var MAX_IDENTIFIER_LENGTH = 128;
+var Invalid = class extends Error {
+  constructor(path, reason) {
+    super(reason);
+    this.path = path;
+    this.reason = reason;
+  }
+};
+function invalid(path, reason) {
+  throw new Invalid(path, reason);
+}
+function own(object2, key) {
+  return Object.hasOwn(object2, key) ? object2[key] : void 0;
+}
+function isOperator(value) {
+  return FILTER_OPERATORS.includes(value);
+}
+function readObject(value, path) {
+  if (!isPlainObject2(value)) invalid(path, "must be an object");
+  return value;
+}
+function checkKeys(object2, allowed, path) {
+  for (const key of Object.keys(object2)) {
+    if (allowed.includes(key)) continue;
+    if (longerThan(key, MAX_IDENTIFIER_LENGTH))
+      invalid(path, "has a field that is not a known field");
+    invalid(path ? `${path}.${key}` : key, "is not a known field");
+  }
+}
+function readName(value, path) {
+  if (typeof value !== "string" || value === "")
+    invalid(path, "must be a non-empty string");
+  if (longerThan(value, MAX_IDENTIFIER_LENGTH))
+    invalid(
+      path,
+      `must be at most ${String(MAX_IDENTIFIER_LENGTH)} characters`
+    );
+  return value;
+}
+function readValue(value, path, auth = false) {
+  if (auth && isAuthUid(value)) return { auth: "uid" };
+  if (!isValue(value))
+    invalid(
+      path,
+      auth ? 'must be a string, a finite number, a boolean, null or {"auth":"uid"}' : "must be a string, a finite number, a boolean or null"
+    );
+  return value;
+}
+function longerThan(text, max) {
+  if (text.length <= max) return false;
+  if (text.length > max * 2) return true;
+  let count = 0;
+  for (const _ of text) if (++count > max) return true;
+  return false;
+}
+function endsWithLoneEscape(pattern) {
+  let run = 0;
+  for (let index = pattern.length - 1; index >= 0; index--) {
+    if (pattern[index] !== "\\") break;
+    run++;
+  }
+  return run % 2 === 1;
+}
+function readFilter(value, path, auth) {
+  const object2 = readObject(value, path);
+  checkKeys(object2, ["operator", "column", "value"], path);
+  const operator = own(object2, "operator");
+  if (!isOperator(operator))
+    invalid(
+      `${path}.operator`,
+      `must be one of ${FILTER_OPERATORS.join(", ")}`
+    );
+  const column = readName(own(object2, "column"), `${path}.column`);
+  if (!Object.hasOwn(object2, "value")) invalid(`${path}.value`, "is required");
+  const raw = own(object2, "value");
+  const valuePath = `${path}.value`;
+  switch (operator) {
+    case "in": {
+      if (!Array.isArray(raw)) invalid(valuePath, "must be an array");
+      const values = raw.map(
+        (item, index) => readValue(item, `${valuePath}[${index}]`, auth)
+      );
+      return { operator, column, value: values };
+    }
+    case "is":
+      if (raw !== null && raw !== true && raw !== false)
+        invalid(valuePath, "must be null, true or false");
+      return { operator, column, value: raw };
+    case "like":
+    case "ilike":
+      if (typeof raw !== "string") invalid(valuePath, "must be a string");
+      if (longerThan(raw, MAX_PATTERN_LENGTH))
+        invalid(
+          valuePath,
+          `must be at most ${String(MAX_PATTERN_LENGTH)} characters`
+        );
+      if (raw.includes("\0"))
+        invalid(valuePath, "must not contain a NUL character");
+      if (endsWithLoneEscape(raw))
+        invalid(valuePath, "must not end with an unescaped backslash");
+      return { operator, column, value: raw };
+    case "contains":
+    case "containedBy":
+    case "overlaps":
+      if (!Array.isArray(raw) || raw.length === 0 || raw.length > MAX_ARRAY_VALUES || !raw.every(
+        (item) => typeof item === "string" || typeof item === "number" && Number.isFinite(item) || auth && isAuthUid(item)
+      ))
+        invalid(
+          valuePath,
+          auth ? `must be a non-empty array of strings, numbers and {"auth":"uid"} (at most ${String(MAX_ARRAY_VALUES)})` : `must be a non-empty array of strings and numbers (at most ${String(MAX_ARRAY_VALUES)})`
+        );
+      return {
+        operator,
+        column,
+        value: raw.map(
+          (item) => isAuthUid(item) ? { auth: "uid" } : item
+        )
+      };
+    default:
+      return { operator, column, value: readValue(raw, valuePath, auth) };
+  }
+}
+var NODE_KEYS = ["operator", "or", "and", "not"];
+function readNode(value, path, depth, budget) {
+  const object2 = readObject(value, path);
+  const kinds = NODE_KEYS.filter((key) => Object.hasOwn(object2, key));
+  const [kind] = kinds;
+  if (kinds.length !== 1 || kind === void 0)
+    invalid(path, `needs exactly one of ${NODE_KEYS.join(", ")}`);
+  if (kind === "operator") {
+    if (++budget.conditions > MAX_FILTERS)
+      invalid(budget.path, `has more than ${String(MAX_FILTERS)} conditions`);
+    const filter = readFilter(object2, path, budget.auth);
+    if (ARRAY_OPERATORS.includes(filter.operator) && ++budget.arrays > MAX_ARRAY_CONDITIONS)
+      invalid(
+        budget.path,
+        `has more than ${String(MAX_ARRAY_CONDITIONS)} ${ARRAY_OPERATORS.join("/")} conditions`
+      );
+    return filter;
+  }
+  if (depth >= MAX_FILTER_DEPTH)
+    invalid(path, `nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
+  checkKeys(object2, [kind], path);
+  const inner = own(object2, kind);
+  const innerPath = `${path}.${kind}`;
+  if (kind === "not")
+    return { not: readNode(inner, innerPath, depth + 1, budget) };
+  if (!Array.isArray(inner)) invalid(innerPath, "must be an array");
+  if (inner.length === 0) invalid(innerPath, "must not be empty");
+  const children = inner.map(
+    (child, index) => readNode(child, `${innerPath}[${index}]`, depth + 1, budget)
+  );
+  return kind === "or" ? { or: children } : { and: children };
+}
+function parsePolicyNode(value, path) {
+  try {
+    const budget = { path, conditions: 0, arrays: 0, auth: true };
+    return { ok: true, node: readNode(value, path, 0, budget) };
+  } catch (error51) {
+    if (error51 instanceof Invalid)
+      return { ok: false, path: error51.path, reason: error51.reason };
+    throw error51;
+  }
+}
+
+// ../../packages/data-core/src/schema.ts
+var SCHEMA_SQL = [
+  `SELECT t.name AS table_name, t.type AS table_type, c.cid AS cid, c.name AS column_name, c.type AS column_type, c."notnull" AS not_null, c.dflt_value AS default_value, c.pk AS pk, c.hidden AS hidden FROM pragma_table_list AS t JOIN pragma_table_xinfo(t.name, t.schema) AS c WHERE t.schema = 'main' AND t.type IN ('table', 'virtual') AND ${systemTablePredicate("t.name")} ORDER BY t.name, c.cid`,
+  // Phase 2-2 (적대적 리뷰 반영): each table's CREATE TABLE text, where
+  // alone a column's collation is written. A separate statement, so the
+  // text comes once per table rather than once per column. D1 answers
+  // `sqlite_master` reads (the database routes' `_tables.ts` reads it too).
+  `SELECT name AS table_name, sql AS table_sql FROM sqlite_master WHERE type = 'table' AND ${systemTablePredicate("name")}`
+];
+
+// ../../packages/data-core/src/condition.ts
+var MAX_CONDITION_BYTES = 16 * 1024;
+
+// ../../packages/data-core/src/redirect-origins.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+  "localhost",
+  "127.0.0.1",
+  "[::1]"
+]);
+function isSecureOrLoopback(url2) {
+  if (url2.protocol === "https:") return true;
+  return url2.protocol === "http:" && LOOPBACK_HOSTS.has(url2.hostname);
+}
+var MAX_ENTRY_LENGTH = 255;
+var TYPED_PATH = /^[a-z][a-z0-9+.-]*:\/\/[^/]*(\/.*)?$/i;
+var SEGMENT = /^[A-Za-z0-9._~-]+$/;
+function parseRedirectEntry(value) {
+  if (typeof value !== "string") return null;
+  const text = value.trim();
+  if (text === "" || text.length > MAX_ENTRY_LENGTH) return null;
+  if (/[\s?#*%\\]/.test(text)) return null;
+  let url2;
+  try {
+    url2 = new URL(text);
+  } catch {
+    return null;
+  }
+  if (url2.username !== "" || url2.password !== "") return null;
+  if (url2.search !== "" || url2.hash !== "") return null;
+  if (!isSecureOrLoopback(url2)) return null;
+  const typed = TYPED_PATH.exec(text)?.[1] ?? "/";
+  if (typed !== url2.pathname) return null;
+  const path = url2.pathname;
+  if (path !== "/") {
+    if (!path.endsWith("/")) return null;
+    const segments = path.slice(1, -1).split("/");
+    if (!segments.every(
+      (segment) => SEGMENT.test(segment) && segment !== "." && segment !== ".."
+    ))
+      return null;
+  }
+  return { origin: url2.origin, path };
+}
+function formatRedirectEntry(entry) {
+  return entry.path === "/" ? entry.origin : `${entry.origin}${entry.path}`;
+}
+
+// ../../packages/data-core/src/system-sql.ts
+var MIGRATIONS_TABLE = "CREATE TABLE IF NOT EXISTS _naro_migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL DEFAULT (datetime('now')))";
+var SYSTEM_MIGRATIONS = [
+  {
+    version: 1,
+    name: "system_tables",
+    statements: [
+      MIGRATIONS_TABLE,
+      "CREATE TABLE IF NOT EXISTS _naro_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')))",
+      // Spec §11.2, as written there.
+      "CREATE TABLE IF NOT EXISTS _naro_policies (table_name TEXT PRIMARY KEY, select_rule TEXT NOT NULL DEFAULT 'none', insert_rule TEXT NOT NULL DEFAULT 'none', update_rule TEXT NOT NULL DEFAULT 'none', delete_rule TEXT NOT NULL DEFAULT 'none', owner_column TEXT, updated_at TEXT NOT NULL DEFAULT (datetime('now')))"
+    ]
+  },
+  {
+    // Spec P2-2 §3.1: an action whose rule column says 'condition' reads its
+    // condition from these. A worker from before them reads 'condition' as
+    // an unknown rule — none.
+    version: 2,
+    name: "policy_conditions",
+    statements: [],
+    addColumns: ["select", "insert", "update", "delete"].map((action) => ({
+      table: "_naro_policies",
+      column: `${action}_condition`,
+      definition: "TEXT"
+    }))
+  },
+  {
+    // Spec P2-6 §11: the Naro worker's sign-in handoff. A provider sign-in's
+    // flow (state → the app's redirect and the browser's PKCE challenge), the
+    // one-time codes a redirect hands the app, the sends the per-address
+    // email limit counts, and (adversarial review I3) the unconfirmed
+    // accounts someone else also tried to sign up as. Times are epoch
+    // milliseconds.
+    version: 3,
+    name: "auth_handoff",
+    statements: [
+      "CREATE TABLE IF NOT EXISTS _naro_auth_flows (state TEXT PRIMARY KEY, provider TEXT NOT NULL, code_challenge TEXT NOT NULL, redirect_to TEXT NOT NULL, expires_at INTEGER NOT NULL)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_codes (code_hash TEXT PRIMARY KEY, code_challenge TEXT NOT NULL, session_token TEXT NOT NULL, sealed_token TEXT NOT NULL, expires_at INTEGER NOT NULL)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_email_log (address_hash TEXT NOT NULL, sent_at INTEGER NOT NULL)",
+      "CREATE INDEX IF NOT EXISTS _naro_auth_email_log_address ON _naro_auth_email_log (address_hash, sent_at)",
+      "CREATE TABLE IF NOT EXISTS _naro_auth_contested (user_id TEXT PRIMARY KEY, contested_at INTEGER NOT NULL)"
+    ]
+  }
+];
+
+// ../../packages/data-core/src/write-quota.ts
+var WRITE_QUOTA_KEY = "write_quota";
+var WRITE_QUOTA_SQL = {
+  read: `SELECT value FROM _naro_meta WHERE key = '${WRITE_QUOTA_KEY}'`,
+  upsert: `INSERT INTO _naro_meta (key, value, updated_at) VALUES ('${WRITE_QUOTA_KEY}', ?1, ?2) ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+};
+
 // ../../packages/sdk/src/generate-types.ts
 var HEADER = [
   "// Generated by `naro gen types`. Do not edit - re-run the command instead.",
   "// `D1Database` comes from @cloudflare/workers-types."
 ];
-function valueType(declared) {
+function affinity(declared, strict) {
   const type = declared.toUpperCase();
-  if (type.trim() === "") return "number | string | ArrayBuffer";
-  if (type.includes("INT")) return "number";
+  if (type.trim() === "") return "NONE";
+  if (strict && type.trim() === "ANY") return "ANY";
+  if (type.includes("INT")) return "INTEGER";
   if (type.includes("CHAR") || type.includes("CLOB") || type.includes("TEXT"))
-    return "string";
-  if (type.includes("BLOB")) return "ArrayBuffer";
+    return "TEXT";
+  if (type.includes("BLOB")) return "BLOB";
   if (type.includes("REAL") || type.includes("FLOA") || type.includes("DOUB"))
-    return "number";
-  return "number | string";
+    return "REAL";
+  if (type.includes("BOOL")) return "BOOLEAN";
+  if (type.includes("JSON")) return "JSON";
+  return "NUMERIC";
+}
+var READ = {
+  INTEGER: "number",
+  TEXT: "string",
+  BLOB: "number[]",
+  REAL: "number",
+  NONE: "number | string | number[]",
+  ANY: "number | string | number[]",
+  BOOLEAN: "number",
+  JSON: "number | string",
+  NUMERIC: "number | string"
+};
+var WRITE = {
+  INTEGER: "number",
+  TEXT: "string | Json",
+  BLOB: "never",
+  REAL: "number",
+  NONE: "number | string | Json",
+  ANY: "number | string | Json",
+  BOOLEAN: "number | boolean",
+  JSON: "number | string | Json",
+  NUMERIC: "number | string"
+};
+var JSON_TYPE = "export type Json = readonly unknown[] | { readonly [key: string]: unknown };";
+function withNull(type, nullable2) {
+  if (!nullable2) return type;
+  return type === "never" ? "null" : `${type} | null`;
 }
 function interfaceBase(tableName) {
   const pascal = tableName.split(/[^A-Za-z0-9$]+/).filter((word) => word.length > 0).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("").replace(/[^A-Za-z0-9_$]/g, "");
   return pascal === "" || /^[0-9]/.test(pascal) ? `_${pascal}` : pascal;
 }
+function sqlSkeleton(sql) {
+  let out = "";
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql[index] ?? "";
+    const pair = sql.slice(index, index + 2);
+    if (pair === "--") {
+      const end = sql.indexOf("\n", index);
+      index = end < 0 ? sql.length : end;
+      out += " ";
+    } else if (pair === "/*") {
+      const end = sql.indexOf("*/", index + 2);
+      index = end < 0 ? sql.length : end + 2;
+      out += " ";
+    } else if (char === "'" || char === '"' || char === "`" || char === "[") {
+      const close = char === "[" ? "]" : char;
+      let end = index + 1;
+      for (; ; ) {
+        const found = sql.indexOf(close, end);
+        if (found < 0) {
+          end = sql.length;
+          break;
+        }
+        if (close !== "]" && sql[found + 1] === close) {
+          end = found + 2;
+          continue;
+        }
+        end = found + 1;
+        break;
+      }
+      out += `${char}${close}`;
+      index = end;
+    } else {
+      out += char;
+      index += 1;
+    }
+  }
+  return out;
+}
+function tableOptions(sql) {
+  const skeleton = sql === null ? "" : sqlSkeleton(sql);
+  const close = skeleton.lastIndexOf(")");
+  const tail = close < 0 ? "" : skeleton.slice(close + 1);
+  return {
+    withoutRowid: /\bWITHOUT\s+ROWID\b/i.test(tail),
+    strict: /\bSTRICT\b/i.test(tail)
+  };
+}
 function rowidAlias(table) {
+  if (tableOptions(table.sql).withoutRowid) return null;
   const keys = table.columns.filter((column) => column.primaryKey);
   const only = keys.length === 1 ? keys[0] : void 0;
   return only && only.type.trim().toUpperCase() === "INTEGER" ? only.name : null;
@@ -19212,34 +20327,120 @@ function keyLiteral(name) {
     (unit) => `${UNICODE_ESCAPE}${unit.charCodeAt(0).toString(16).padStart(4, "0")}`
   );
 }
-function property(column, alias) {
-  const nullable2 = !column.notNull && column.name !== alias;
-  return `  ${keyLiteral(column.name)}: ${valueType(column.type)}${nullable2 ? " | null" : ""};`;
+function ownerFilledOnInsert(policies, table) {
+  const folded = asciiLower(table);
+  const matches = policies.filter(
+    (policy2) => asciiLower(policy2.table) === folded
+  );
+  const policy = policies.find((candidate) => candidate.table === table) ?? (matches.length === 1 ? matches[0] : void 0);
+  return policy?.insert === "owner" ? policy.ownerColumn : null;
+}
+async function policiesForTypes(client, projectId) {
+  try {
+    return { policies: await client.backend.policies(projectId) };
+  } catch (error51) {
+    return {
+      policies: void 0,
+      reason: isNaroError(error51) ? error51.code : "UNKNOWN_ERROR"
+    };
+  }
+}
+function isNullable(column, alias) {
+  return !column.notNull && column.name !== alias;
+}
+function rowProperty(column, { alias, strict }) {
+  const type = READ[affinity(column.type, strict)];
+  return `  ${keyLiteral(column.name)}: ${withNull(type, isNullable(column, alias))};`;
+}
+function writeProperty(column, { alias, strict }, optional2) {
+  const type = WRITE[affinity(column.type, strict)];
+  return `        ${keyLiteral(column.name)}${optional2 ? "?" : ""}: ${withNull(type, isNullable(column, alias))};`;
 }
 function block(name, lines) {
   return lines.length === 0 ? [`export interface ${name} {}`] : [`export interface ${name} {`, ...lines, "}"];
 }
-function generateTypes(tables) {
+function member(indent, name, lines) {
+  return lines.length === 0 ? [`${indent}${name}: {};`] : [`${indent}${name}: {`, ...lines, `${indent}};`];
+}
+function tableEntry(described) {
+  const { table, row, alias, owner } = described;
+  const writable = table.columns.filter((column) => column.generated !== true);
+  const optionalOnInsert = (column) => isNullable(column, alias) || column.defaultValue !== null || column.name === alias || asciiLower(column.name) === owner;
+  return [
+    `    ${keyLiteral(table.name)}: {`,
+    `      Row: ${row};`,
+    ...member(
+      "      ",
+      "Insert",
+      writable.map(
+        (column) => writeProperty(column, described, optionalOnInsert(column))
+      )
+    ),
+    ...member(
+      "      ",
+      "Update",
+      writable.map((column) => writeProperty(column, described, true))
+    ),
+    "    };"
+  ];
+}
+function viewEntry({ table, row }) {
+  return [`    ${keyLiteral(table.name)}: {`, `      Row: ${row};`, "    };"];
+}
+var ALIASES = [
+  'export type Tables<Name extends keyof Database["tables"] | keyof Database["views"]> =',
+  '  (Database["tables"] & Database["views"])[Name]["Row"];',
+  'export type TablesInsert<Name extends keyof Database["tables"]> =',
+  '  Database["tables"][Name]["Insert"];',
+  'export type TablesUpdate<Name extends keyof Database["tables"]> =',
+  '  Database["tables"][Name]["Update"];'
+];
+function generateTypes(tables, options = {}) {
   const used = /* @__PURE__ */ new Set();
   const out = [...HEADER];
-  const map2 = [];
+  const described = [];
   for (const table of tables) {
     const base2 = `${interfaceBase(table.name)}Row`;
-    let name = base2;
-    for (let suffix = 2; used.has(name); suffix += 1)
-      name = `${base2}_${String(suffix)}`;
-    used.add(name);
-    const alias = rowidAlias(table);
+    let row = base2;
+    for (let suffix = 2; used.has(row); suffix += 1)
+      row = `${base2}_${String(suffix)}`;
+    used.add(row);
+    const owner = ownerFilledOnInsert(options.policies ?? [], table.name);
+    const entry = {
+      table,
+      row,
+      alias: rowidAlias(table),
+      strict: tableOptions(table.sql).strict,
+      owner: owner === null ? null : asciiLower(owner)
+    };
+    described.push(entry);
     out.push(
       "",
       ...block(
-        name,
-        table.columns.map((column) => property(column, alias))
+        row,
+        table.columns.map((column) => rowProperty(column, entry))
       )
     );
-    map2.push(`  ${keyLiteral(table.name)}: ${name};`);
   }
-  out.push("", ...block("Database", map2));
+  out.push(
+    "",
+    JSON_TYPE,
+    "",
+    "export type Database = {",
+    ...member(
+      "  ",
+      "tables",
+      described.filter(({ table }) => table.type !== "view").flatMap(tableEntry)
+    ),
+    ...member(
+      "  ",
+      "views",
+      described.filter(({ table }) => table.type === "view").flatMap(viewEntry)
+    ),
+    "};",
+    "",
+    ...ALIASES
+  );
   out.push("", ...block("Env", ["  DB: D1Database;"]));
   return `${out.join("\n")}
 `;
@@ -19302,6 +20503,113 @@ function ensureGitignoreHasNaro(dir) {
   return true;
 }
 
+// ../../packages/sdk/src/lint.ts
+function byText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function lintedTables(input) {
+  const virtual = new Set(
+    input.virtualTables.map((name) => name.toLowerCase())
+  );
+  return input.tables.filter(
+    (table) => table.type === "table" && !isSystemTable(table.name) && !virtual.has(table.name.toLowerCase())
+  );
+}
+function countLintedTables(input) {
+  return lintedTables(input).length;
+}
+function brokenForeignKeys(input) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const violation of input.foreignKeyCheck) {
+    if (isSystemTable(violation.table)) continue;
+    const parents = groups.get(violation.table) ?? /* @__PURE__ */ new Map();
+    const group = parents.get(violation.parent) ?? {
+      rows: /* @__PURE__ */ new Set(),
+      loose: 0
+    };
+    if (violation.rowid === null) group.loose += 1;
+    else group.rows.add(violation.rowid);
+    parents.set(violation.parent, group);
+    groups.set(violation.table, parents);
+  }
+  return [...groups.entries()].toSorted(([left], [right]) => byText(left, right)).flatMap(
+    ([table, parents]) => [...parents.entries()].toSorted(([left], [right]) => byText(left, right)).map(([parent, group]) => ({
+      rule: "broken-foreign-key",
+      severity: "error",
+      object: table,
+      message: `${String(group.rows.size + group.loose)} row(s) point at a ${parent} row that is gone.`
+    }))
+  );
+}
+function integrity(input) {
+  return input.quickCheck.filter((line) => line.trim().toLowerCase() !== "ok").map((line) => ({
+    rule: "integrity",
+    severity: "error",
+    object: "database",
+    message: `The database failed SQLite's quick_check: ${line}`
+  }));
+}
+function tableIssues(input) {
+  const issues = [];
+  for (const table of lintedTables(input)) {
+    if (table.columns.length === 0) continue;
+    const leading = new Set(
+      table.indexes.flatMap(
+        (index) => index.columns[0] === void 0 ? [] : [index.columns[0].toLowerCase()]
+      )
+    );
+    const keyColumns = table.columns.filter((column) => column.primaryKey);
+    const declared = keyColumns.length === 1 && keyColumns[0]?.type.trim().toUpperCase() === "INTEGER" ? keyColumns[0]?.name.toLowerCase() ?? null : null;
+    const rowidColumn = declared !== null && !leading.has(declared) ? declared : null;
+    if (keyColumns.length === 0)
+      issues.push({
+        rule: "no-primary-key",
+        severity: "warn",
+        object: table.name,
+        message: "The table has no primary key, so its rows are identified by a rowid that changes after a VACUUM or a restore."
+      });
+    for (const column of keyColumns) {
+      if (rowidColumn !== null || column.notNull) continue;
+      issues.push({
+        rule: "nullable-primary-key",
+        severity: "warn",
+        object: `${table.name}.${column.name}`,
+        message: "The primary key column is not INTEGER and has no NOT NULL, so SQLite accepts NULL in it."
+      });
+    }
+    for (const foreignKey of table.foreignKeys) {
+      const from = foreignKey.from.toLowerCase();
+      if (leading.has(from) || from === rowidColumn) continue;
+      issues.push({
+        rule: "unindexed-foreign-key",
+        severity: "warn",
+        object: `${table.name}.${foreignKey.from}`,
+        message: `No index starts with this column, so a DELETE or UPDATE on ${foreignKey.table} scans the whole table.`
+      });
+    }
+  }
+  return issues;
+}
+function lintSchema(input) {
+  return [
+    ...brokenForeignKeys(input),
+    ...integrity(input),
+    ...tableIssues(input),
+    ...input.triggers.filter((name) => !isSystemTable(name)).map((name) => ({
+      rule: "trigger-not-reproducible",
+      severity: "warn",
+      object: name,
+      message: "Cloudflare's REST API cannot create a trigger, so db pull writes it out but db push cannot put it back."
+    })),
+    ...input.virtualTables.filter((name) => !isSystemTable(name)).map((name) => ({
+      rule: "virtual-table-blocks-export",
+      severity: "warn",
+      object: name,
+      message: "A virtual table makes db dump refuse the whole database; dump the other tables with --table."
+    }))
+  ];
+}
+
 // ../../packages/sdk/src/migrations.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
 import { resolve as resolve8 } from "path";
@@ -19309,29 +20617,17 @@ function resolveMigrationsDir(input) {
   if (input.dir) return resolve8(input.baseDir, input.dir);
   return resolve8(input.baseDir, input.rootDirectory ?? "", "migrations");
 }
-function normalizeMigrationName(name) {
-  return name.trim().toLowerCase().replace(/\.sql$/, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-function leadingNumber(name) {
-  const match = /^(\d+)/.exec(name);
-  return match ? Number(match[1]) : null;
-}
 function sortMigrationNames(names) {
   return names.toSorted((a, b) => {
-    const left = leadingNumber(a);
-    const right = leadingNumber(b);
-    if (left !== null && right !== null && left !== right) return left - right;
+    const left = leadingMigrationNumber(a);
+    const right = leadingMigrationNumber(b);
+    if (left !== null && right !== null && left !== right)
+      return left < right ? -1 : 1;
     if (left === null && right !== null) return 1;
     if (left !== null && right === null) return -1;
     return a < b ? -1 : a > b ? 1 : 0;
   });
 }
-function highestMigrationNumber(names) {
-  return names.reduce(
-    (max, name) => Math.max(max, leadingNumber(name) ?? 0),
-    0
-  );
-}
 function listMigrationFiles(dir) {
   if (!existsSync5(dir)) return [];
   return sortMigrationNames(
@@ -19345,8 +20641,7 @@ function nextMigrationFileName(existing, name) {
       "VALIDATION_FAILED",
       "Migration name must contain letters or digits."
     );
-  const number4 = String(highestMigrationNumber(existing) + 1).padStart(4, "0");
-  return `${number4}_${normalized}.sql`;
+  return numberedMigrationName(existing, normalized);
 }
 function compareMigrations(local, applied) {
   const ledger = new Map(applied.map((row) => [row.name, row]));
@@ -19370,7 +20665,7 @@ function compareMigrations(local, applied) {
       });
       continue;
     }
-    const number4 = leadingNumber(name);
+    const number4 = leadingMigrationNumber(name);
     rows.push({
       name,
       status: "pending",
@@ -19386,6 +20681,186 @@ function compareMigrations(local, applied) {
   const order = sortMigrationNames(rows.map((row) => row.name));
   return rows.toSorted((a, b) => order.indexOf(a.name) - order.indexOf(b.name));
 }
+function pendingMigrationNames(local, applied) {
+  return compareMigrations(local, applied).filter((row) => row.status === "pending").map((row) => row.name);
+}
+function migrationsPendingError(pending) {
+  return new NaroError(
+    "DATABASE_MIGRATIONS_PENDING",
+    `Run \`naro db push\` first; ${String(pending.length)} local migration(s) are not applied yet: ${pending.join(", ")}.`
+  );
+}
+function migrationNameMismatch(sent, recorded) {
+  return `The control plane recorded the migration as ${recorded}, but naro sent ${sent} and wrote the file under that name. Until the two match, naro migration list shows them apart and naro db push would apply the file again.`;
+}
+
+// ../../packages/sdk/src/reset-plan.ts
+var RESET_DEFER_FOREIGN_KEYS = "pragma defer_foreign_keys = true;";
+var RESET_BATCH_STATEMENTS = 50;
+function clearInternal(internal) {
+  return [
+    ...internal.sqliteSequence ? ["DELETE FROM sqlite_sequence;"] : [],
+    ...internal.ledger ? ["DELETE FROM d1_migrations;"] : []
+  ];
+}
+function quote(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function byName(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function sorted(names) {
+  return [...names].toSorted(byName);
+}
+function walk(start, adjacency, seen, onLeave) {
+  seen.add(start);
+  const stack = [{ node: start, next: 0 }];
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1];
+    if (frame === void 0) break;
+    const neighbours = adjacency.get(frame.node) ?? [];
+    const neighbour = neighbours[frame.next];
+    if (neighbour === void 0) {
+      onLeave(frame.node);
+      stack.pop();
+      continue;
+    }
+    frame.next += 1;
+    if (!seen.has(neighbour)) {
+      seen.add(neighbour);
+      stack.push({ node: neighbour, next: 0 });
+    }
+  }
+}
+function components(nodes, edges) {
+  const forward = /* @__PURE__ */ new Map();
+  const backward = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    forward.set(node, []);
+    backward.set(node, []);
+  }
+  for (const edge of edges) {
+    forward.get(edge.child)?.push(edge.parent);
+    backward.get(edge.parent)?.push(edge.child);
+  }
+  for (const [node, list] of forward) forward.set(node, list.toSorted(byName));
+  for (const [node, list] of backward)
+    backward.set(node, list.toSorted(byName));
+  const finished = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const node of nodes)
+    if (!seen.has(node))
+      walk(node, forward, seen, (left) => finished.push(left));
+  const assigned = /* @__PURE__ */ new Set();
+  const found = [];
+  for (let index = finished.length - 1; index >= 0; index--) {
+    const node = finished[index];
+    if (node === void 0 || assigned.has(node)) continue;
+    const members = [];
+    walk(node, backward, assigned, (left) => members.push(left));
+    found.push(sorted(members));
+  }
+  return found;
+}
+function tableGroups(names, edges) {
+  const groups = components(names, edges);
+  const indexOf = /* @__PURE__ */ new Map();
+  groups.forEach((group, index) => {
+    for (const member2 of group) indexOf.set(member2, index);
+  });
+  const waitingOn = groups.map(() => 0);
+  const parentsOf = groups.map(() => /* @__PURE__ */ new Set());
+  for (const edge of edges) {
+    const child = indexOf.get(edge.child);
+    const parent = indexOf.get(edge.parent);
+    if (child === void 0 || parent === void 0 || child === parent)
+      continue;
+    if (parentsOf[child]?.has(parent) === true) continue;
+    parentsOf[child]?.add(parent);
+    waitingOn[parent] = (waitingOn[parent] ?? 0) + 1;
+  }
+  const key = (index) => groups[index]?.[0] ?? "";
+  const ready = groups.map((_, index) => index).filter((index) => waitingOn[index] === 0);
+  const order = [];
+  while (ready.length > 0) {
+    ready.sort((left, right) => byName(key(left), key(right)));
+    const next = ready.shift();
+    if (next === void 0) break;
+    const group = groups[next];
+    if (group) order.push(group);
+    for (const parent of parentsOf[next] ?? []) {
+      waitingOn[parent] = (waitingOn[parent] ?? 1) - 1;
+      if (waitingOn[parent] === 0) ready.push(parent);
+    }
+  }
+  for (let index = 0; index < groups.length; index++) {
+    const group = groups[index];
+    if (group && (waitingOn[index] ?? 0) > 0) order.push(group);
+  }
+  return order;
+}
+function pack(groups) {
+  const batches = [];
+  let current = [RESET_DEFER_FOREIGN_KEYS];
+  for (const group of groups) {
+    if (current.length > 1 && current.length + group.length > RESET_BATCH_STATEMENTS) {
+      batches.push(current);
+      current = [RESET_DEFER_FOREIGN_KEYS];
+    }
+    current.push(...group);
+  }
+  if (current.length > 1) batches.push(current);
+  return batches;
+}
+function nameList(names) {
+  const shown = names.slice(0, 10).join(", ");
+  const rest = names.length - 10;
+  return rest > 0 ? `${shown} and ${String(rest)} more` : shown;
+}
+function refuseOversizedCycle(groups) {
+  const room = RESET_BATCH_STATEMENTS - 1;
+  const cycle = groups.find((group) => group.length > room);
+  if (cycle === void 0) return;
+  throw new NaroError(
+    "VALIDATION_FAILED",
+    `A foreign key cycle of ${String(cycle.length)} tables cannot be dropped in one request (the limit is ${String(room)}): ${nameList(cycle)}. Break the cycle or drop those tables by hand.`
+  );
+}
+function buildResetPlan(input) {
+  const objects = input.objects.filter((object2) => !isSystemTable(object2.name));
+  const views = sorted(
+    objects.filter((object2) => object2.type === "view").map((object2) => object2.name)
+  );
+  const triggers = sorted(
+    objects.filter((object2) => object2.type === "trigger").map((object2) => object2.name)
+  );
+  const tableNames = sorted(
+    objects.filter((object2) => object2.type === "table" || object2.type === "virtual").map((object2) => object2.name)
+  );
+  const canonical = new Map(tableNames.map((name) => [asciiLower(name), name]));
+  const edges = [];
+  for (const edge of input.foreignKeys) {
+    const child = canonical.get(asciiLower(edge.child));
+    const parent = canonical.get(asciiLower(edge.parent));
+    if (child !== void 0 && parent !== void 0 && child !== parent)
+      edges.push({ child, parent });
+  }
+  const ordered = tableGroups(tableNames, edges);
+  refuseOversizedCycle(ordered);
+  const clear = clearInternal(input.internal);
+  const groups = [
+    ...triggers.map((name) => [`DROP TRIGGER ${quote(name)};`]),
+    ...views.map((name) => [`DROP VIEW ${quote(name)};`]),
+    ...ordered.map(
+      (group) => group.map((name) => `DROP TABLE ${quote(name)};`)
+    ),
+    ...clear.length > 0 ? [clear] : []
+  ];
+  return {
+    batches: pack(groups),
+    dropped: { tables: ordered.flat(), views, triggers }
+  };
+}
 
 // src/env-consent.ts
 import { existsSync as existsSync6 } from "fs";
@@ -19743,7 +21218,7 @@ async function deployDirectory(sourceDir, options, log2) {
   if (!framework.deployable && !options.force) {
     throw new NaroError(
       "FRAMEWORK_UNSUPPORTED",
-      framework.framework === "unknown" ? `No supported framework detected in ${appRoot}. Naro deploys Next.js, Vite, Create React App, and static sites \u2014 run this inside one of those projects, or point at it with --root <dir>.` : `${framework.name} projects are not deployable on Naro yet.`,
+      framework.framework === "unknown" ? `No supported framework detected in ${appRoot}. Naro deploys Next.js, Vite, Create React App, static sites, and static builds of Astro, SvelteKit, Nuxt, Angular, Docusaurus and Gatsby \u2014 run this inside one of those projects, or point at it with --root <dir>.` : `${framework.name} needs a server runtime, which Naro does not deploy yet.`,
       { details: { framework: framework.framework } }
     );
   }
@@ -19889,6 +21364,7 @@ function deploymentUrl(detail, ctx, production) {
 
 export {
   parseGitHubRemote,
+  schemaMigrationTitle,
   projectPath,
   NaroError,
   isNaroError,
@@ -19904,19 +21380,37 @@ export {
   resolveAuth,
   openBrowser,
   isTerminalStatus,
+  isStalledBackend,
+  POLICY_RULES,
+  POLICY_ACTIONS,
   NaroClient,
+  BOOKMARK_FORMAT_MESSAGE,
+  isBookmark,
+  RESTORE_OUTCOME_UNKNOWN_CODES,
+  cellText,
   renderRows,
   summarizeStatement,
   serializeDotenv,
+  systemTablePredicate,
+  parsePolicyNode,
+  parseRedirectEntry,
+  formatRedirectEntry,
+  policiesForTypes,
   generateTypes,
   readProjectLink,
   writeProjectLink,
   removeProjectLink,
   ensureGitignoreHasNaro,
+  countLintedTables,
+  lintSchema,
   resolveMigrationsDir,
   listMigrationFiles,
   nextMigrationFileName,
   compareMigrations,
+  pendingMigrationNames,
+  migrationsPendingError,
+  migrationNameMismatch,
+  buildResetPlan,
   promptForMissingEnv,
   detectGitInfo,
   parseDotenv2 as parseDotenv,