naro-cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -1,24 +1,41 @@
 #!/usr/bin/env node
 import {
+  BOOKMARK_FORMAT_MESSAGE,
   NaroClient,
   NaroError,
+  POLICY_ACTIONS,
+  POLICY_RULES,
+  RESTORE_OUTCOME_UNKNOWN_CODES,
+  buildResetPlan,
+  cellText,
   clearSession,
   compareMigrations,
   controlPlaneUrl,
+  countLintedTables,
   createAuthClient,
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
+  formatRedirectEntry,
   generateTypes,
+  isBookmark,
   isExpired,
   isNaroError,
+  isStalledBackend,
   isTerminalStatus,
+  lintSchema,
   listMigrationFiles,
   loadStoredSession,
   login,
+  migrationNameMismatch,
+  migrationsPendingError,
   nextMigrationFileName,
   openBrowser,
   parseGitHubRemote,
+  parsePolicyNode,
+  parseRedirectEntry,
+  pendingMigrationNames,
+  policiesForTypes,
   projectPath,
   promptForMissingEnv,
   readProjectLink,
@@ -28,12 +45,15 @@ import {
   resolveAuth,
   resolveMigrationsDir,
   saveSession,
+  schemaMigrationTitle,
   serializeDotenv,
   slugify,
   summarizeStatement,
+  systemTablePredicate,
   toNaroError,
   writeProjectLink
-} from "./chunk-E2M6CQL7.js";
+} from "./chunk-Z757IOF3.js";
+import "./chunk-K3NQKI34.js";
 
 // src/args.ts
 var BOOLEAN_FLAGS = {
@@ -52,7 +72,21 @@ var BOOLEAN_FLAGS = {
   "--reveal": "reveal",
   "--wait": "wait",
   "--no-www": "noWww",
-  "--dry-run": "dryRun"
+  "--dry-run": "dryRun",
+  "--strict": "strict",
+  "--schema-only": "schemaOnly",
+  "--data-only": "dataOnly",
+  "--anon": "anon",
+  "--service": "service",
+  "--if-not-exists": "ifNotExists",
+  "--unique": "unique",
+  "--no-write": "noWrite",
+  "--signed-in": "signedIn",
+  "--api-key-stdin": "apiKeyStdin",
+  "--client-secret-stdin": "clientSecretStdin"
+};
+var REPEATED_FLAGS = {
+  "--column": "columns"
 };
 var STRING_FLAGS = {
   "--token": "token",
@@ -67,8 +101,44 @@ var STRING_FLAGS = {
   "--level": "level",
   "--file": "file",
   "--output": "output",
-  "--dir": "dir"
+  "--lang": "lang",
+  "--dir": "dir",
+  "--table": "table",
+  "--timestamp": "timestamp",
+  "--bookmark": "bookmark",
+  "--status": "status",
+  "--select": "selectRule",
+  "--insert": "insertRule",
+  "--update": "updateRule",
+  "--delete": "deleteRule",
+  "--owner": "ownerColumn",
+  "--select-when": "selectWhen",
+  "--insert-when": "insertWhen",
+  "--update-when": "updateWhen",
+  "--update-check": "updateCheck",
+  "--delete-when": "deleteWhen",
+  "--from-file": "fromFile",
+  "--provider": "provider",
+  "--from": "from",
+  "--client-id": "clientId"
+};
+var SECRET_FLAGS = {
+  "--api-key": "--api-key-stdin",
+  "--client-secret": "--client-secret-stdin"
 };
+function secretFlagProblem(unknown) {
+  for (const flag of unknown) {
+    const name = flag.split("=")[0]?.split(" ")[0] ?? "";
+    const instead = SECRET_FLAGS[name];
+    if (instead)
+      return `Secrets are read from stdin, never from the command line: pass ${instead} and pipe the value in.`;
+  }
+  return null;
+}
+function listFlag(value) {
+  if (value === void 0) return [];
+  return value.split(",").map((piece) => piece.trim()).filter((piece) => piece.length > 0);
+}
 function parseArgs(argv) {
   const flags = {
     json: false,
@@ -93,6 +163,22 @@ function parseArgs(argv) {
       continue;
     }
     const eq = arg.indexOf("=");
+    const repeatedKey = REPEATED_FLAGS[arg] ?? (eq > 0 ? REPEATED_FLAGS[arg.slice(0, eq)] : void 0);
+    if (repeatedKey) {
+      let value;
+      if (eq > 0 && REPEATED_FLAGS[arg.slice(0, eq)]) value = arg.slice(eq + 1);
+      else {
+        const next = argv[i + 1];
+        if (next === void 0 || next.startsWith("-") && next !== "-") {
+          unknown.push(`${arg} (missing value)`);
+          continue;
+        }
+        i += 1;
+        value = next;
+      }
+      flags[repeatedKey] = [...flags[repeatedKey] ?? [], value];
+      continue;
+    }
     const stringKey = STRING_FLAGS[arg] ?? (eq > 0 ? STRING_FLAGS[arg.slice(0, eq)] : void 0);
     if (stringKey) {
       if (eq > 0 && STRING_FLAGS[arg.slice(0, eq)]) {
@@ -209,7 +295,7 @@ function isInteractive() {
 }
 async function readStdin() {
   let data = "";
-  for await (const chunk of process.stdin) data += String(chunk);
+  for await (const chunk2 of process.stdin) data += String(chunk2);
   return data.replace(/\r?\n$/, "");
 }
 var TtyPrompter = class {
@@ -220,7 +306,7 @@ var TtyPrompter = class {
     });
     try {
       return await new Promise(
-        (resolve3) => rl.question(question, resolve3)
+        (resolve5) => rl.question(question, resolve5)
       );
     } finally {
       rl.close();
@@ -229,8 +315,8 @@ var TtyPrompter = class {
   async askHidden(question) {
     let muted = false;
     const output = new Writable({
-      write(chunk, _enc, done) {
-        if (!muted) process.stdout.write(chunk);
+      write(chunk2, _enc, done) {
+        if (!muted) process.stdout.write(chunk2);
         done();
       }
     });
@@ -241,7 +327,7 @@ var TtyPrompter = class {
     });
     try {
       const answer = new Promise(
-        (resolve3) => rl.question(question, resolve3)
+        (resolve5) => rl.question(question, resolve5)
       );
       muted = true;
       const value = await answer;
@@ -352,8 +438,8 @@ function createContext(flags, positionals = []) {
 }
 
 // src/router.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/commands/auth.ts
@@ -450,127 +536,1761 @@ async function confirmOrAbort(context, question) {
   if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
 }
 
-// src/commands/cancel.ts
-async function runCancel(context) {
-  const [deploymentId] = context.positionalOrThrow(
+// src/commands/migration.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join, relative } from "path";
+var processStdin = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+function migrationsDir(context) {
+  return resolveMigrationsDir({
+    baseDir: context.cwd,
+    rootDirectory: context.flags.root,
+    dir: context.flags.dir
+  });
+}
+function relativeToCwd(context, path) {
+  const rel = relative(context.cwd, path);
+  return rel === "" ? "." : rel;
+}
+async function appliedMigrations(client, projectId) {
+  try {
+    return await client.db.migrations(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "DATABASE_NOT_READY") return [];
+    throw error;
+  }
+}
+function printable(text) {
+  let out = "";
+  for (const char of text) {
+    const code = char.charCodeAt(0);
+    const control = code < 32 || code >= 127 && code <= 159;
+    out += control ? "?" : char;
+  }
+  return out;
+}
+function warningLine(warning) {
+  if (warning === "out-of-order")
+    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
+  if (warning === "ledger-name-missing-extension")
+    return "  \u26A0 recorded without .sql in the ledger";
+  return null;
+}
+async function runMigrationNew(context, deps = processStdin) {
+  const [name] = context.positionalOrThrow(
     1,
-    "Usage: naro cancel <deployment-id>"
+    "Usage: naro migration new <name>"
   );
+  const dir = migrationsDir(context);
+  const fileName = nextMigrationFileName(
+    listMigrationFiles(dir),
+    name
+  );
+  mkdirSync(dir, { recursive: true });
+  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
+  const fromStdin = piped.length > 0;
+  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
+` : `-- Migration: ${fileName}
+`;
+  const path = join(dir, fileName);
+  writeFileSync(path, body, { flag: "wx" });
+  const relPath = relativeToCwd(context, path);
+  context.output.result({ file: fileName, path: relPath, fromStdin }, [
+    `\u2705 Created ${relPath}`
+  ]);
+}
+async function runMigrationList(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  await confirmOrAbort(context, `Cancel the build ${String(deploymentId)}?`);
-  const canceled = await client.deployments.cancel(
-    projectId,
-    deploymentId
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const migrations = compareMigrations(local, ledger);
+  const relDir = relativeToCwd(context, dir);
+  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
+    `Migrations in ${relDir} (${String(migrations.length)}):`,
+    ...migrations.flatMap((row) => {
+      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
+      const warning = warningLine(row.warning);
+      return warning ? [line, warning] : [line];
+    })
+  ];
+  context.output.result({ projectId, dir: relDir, migrations }, lines);
+}
+async function applyMigrationFiles(context, client, projectId, dir, names) {
+  const applied = [];
+  for (const name of names) {
+    const sql = readFileSync(join(dir, name), "utf8");
+    try {
+      await client.db.applyMigration(projectId, { name, sql });
+    } catch (error) {
+      if (!isNaroError(error)) throw error;
+      const shown = context.output.json ? name : printable(name);
+      throw new NaroError(error.code, `${shown}: ${error.message}`, {
+        ...error.status === void 0 ? {} : { status: error.status },
+        details: { ...error.details, migration: name, applied },
+        cause: error
+      });
+    }
+    context.output.log(`\u2713 ${printable(name)}`);
+    applied.push(name);
+  }
+  return applied;
+}
+var MIGRATION_NAME_RE = /^[A-Za-z0-9_.-]{1,200}\.sql$/;
+var LEDGER_DDL = "CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)";
+var LEDGER_INSERT = "INSERT INTO d1_migrations (name) SELECT ? WHERE NOT EXISTS (SELECT 1 FROM d1_migrations WHERE name = ?)";
+var LEDGER_DELETE = "DELETE FROM d1_migrations WHERE name IN (?, ?)";
+function withoutSuffix(key) {
+  return key.slice(0, -".sql".length);
+}
+async function runMigrationRepair(context) {
+  const [name] = context.positionalOrThrow(
+    1,
+    "Usage: naro migration repair <name> --status applied|reverted"
   );
-  context.output.result(
-    {
-      deploymentId: canceled.id,
-      projectId,
-      status: canceled.status,
-      errorCode: canceled.errorCode
-    },
-    [`\u2705 Canceled ${canceled.id}`]
+  const key = name;
+  if (!MIGRATION_NAME_RE.test(key))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "name must end with .sql and contain only letters, digits, _ . -"
+    );
+  const status = context.flags.status;
+  if (status !== "applied" && status !== "reverted")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --status applied or --status reverted."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const ledger = await appliedMigrations(client, projectId);
+  const recorded = ledger.some(
+    (row) => row.name === key || row.name === withoutSuffix(key)
   );
+  const nothingToDo = status === "applied" ? `${key} was already applied; nothing to do.` : `${key} was not in the ledger; nothing to do.`;
+  if (status === "applied" ? recorded : !recorded) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    status === "applied" ? `Mark ${key} as applied in the project database's ledger? Its SQL is not run.` : `Remove ${key} from the project database's ledger? Its SQL is not rolled back.`
+  );
+  if (status === "applied" && ledger.length === 0)
+    await client.db.query(projectId, { sql: LEDGER_DDL });
+  const answer = await client.db.query(projectId, {
+    sql: status === "applied" ? LEDGER_INSERT : LEDGER_DELETE,
+    params: status === "applied" ? [key, key] : [key, withoutSuffix(key)]
+  });
+  const changed = (answer.statements[0]?.meta.changes ?? 0) > 0;
+  if (!changed) {
+    context.output.warn(nothingToDo);
+    context.output.result({ name: key, status, changed: false });
+    return;
+  }
+  context.output.result({ name: key, status, changed: true }, [
+    status === "applied" ? `\u2713 Marked ${key} as applied.` : `\u2713 Removed ${key} from the ledger.`
+  ]);
+}
+async function runMigrationUp(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
+  if (pending.length === 0) {
+    context.output.result({ projectId, applied: [], pending: [] }, [
+      "No pending migrations."
+    ]);
+    return;
+  }
+  if (context.flags.dryRun) {
+    context.output.result({ projectId, dryRun: true, pending }, [
+      `Pending migrations (${String(pending.length)}):`,
+      ...pending.map((name) => `  ${printable(name)}`)
+    ]);
+    return;
+  }
+  context.output.log(`Pending migrations (${String(pending.length)}):`);
+  for (const name of pending) context.output.log(`  ${printable(name)}`);
+  await confirmOrAbort(
+    context,
+    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
+  );
+  const applied = await applyMigrationFiles(
+    context,
+    client,
+    projectId,
+    dir,
+    pending
+  );
+  context.output.result({ projectId, applied, pending: [] }, [
+    `\u2705 Applied ${String(applied.length)} migration(s).`
+  ]);
 }
 
-// src/commands/db.ts
-import { readFileSync } from "fs";
-import { resolve } from "path";
-var processStdin = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-var USAGE = "Usage: naro db query <sql> | --file <path> | (stdin)";
-var ROW_CAP_NOTICE = "\u26A0 Output was cut at 10,000 rows. Add a LIMIT to see the rest.";
-function humanSize(bytes) {
-  const units = ["B", "KB", "MB", "GB"];
-  let value = bytes;
-  let unit = 0;
-  while (value >= 1024 && unit < units.length - 1) {
-    value /= 1024;
-    unit += 1;
+// src/commands/backend.ts
+var SERVICE_KEY_WARNING = "\u26A0 The service key skips every policy. Keep it on a server (NARO_SERVICE_KEY) and never put it in browser code.";
+var ROTATE_USAGE = "Usage: naro backend keys rotate --anon | --service";
+var DISABLE_QUESTION = "Turn the backend off? In up to about 90 seconds your app's sign-ins and data requests get 404 from /_naro/*, until it is turned back on. The data, users, sign-in settings and keys are kept.";
+var OFF_ADVICE = "Turned off: your app's /_naro/* requests get 404. The data, users and keys are kept \u2014 `naro backend enable` turns it back on with the same keys.";
+var TURNING_OFF_ADVICE = "Turning it off did not finish: your app's /_naro/* requests may still be answered. Run `naro backend disable` again to finish it \u2014 the control plane also retries every few minutes.";
+var TURNING_OFF_NOW_ADVICE = "Turning off: another run is removing the routes right now. Check again in a minute with `naro backend`.";
+function leaseHeld(info, now) {
+  if (info.leaseExpiresAt === null) return false;
+  const until = Date.parse(info.leaseExpiresAt);
+  return !Number.isNaN(until) && until > now;
+}
+function sentence(text) {
+  const line = printable(text).trim();
+  return /[.!?…]$/.test(line) ? line : `${line}.`;
+}
+function statusText(info, now) {
+  switch (info.status) {
+    case "none":
+      return "not provisioned";
+    case "ready":
+      return "ready";
+    default: {
+      const text = info.step ? `${info.status} (step: ${info.step})` : info.status;
+      return isStalledBackend(info, now) ? `${text}, stalled` : text;
+    }
   }
-  return `${unit === 0 ? String(value) : value.toFixed(1)} ${units[unit] ?? "B"}`;
 }
-function describeLines(info) {
+function switchText(info) {
+  if (info.enabled) return "on";
+  if (info.turningOff)
+    return info.disabledAt ? `turning off (since ${printable(info.disabledAt)})` : "turning off";
+  return info.disabledAt ? `off since ${printable(info.disabledAt)}` : "off";
+}
+function backendLines(info, now = Date.now()) {
   const lines = [
-    `Provider: ${info.provider}`,
-    `Status:   ${info.status}`,
-    `Binding:  env.${info.binding}`
+    `Backend:     ${switchText(info)}`,
+    `Status:      ${statusText(info, now)}`,
+    `URL:         ${info.url}`
   ];
-  if (info.resourceName)
+  if (info.anonKey) lines.push(`Anon key:    ${info.anonKey}`);
+  if (info.serviceKeyPrefix)
     lines.push(
-      `Database: ${info.resourceName}${info.resourceId ? ` (${info.resourceId})` : ""}`
+      `Service key: ${info.serviceKeyPrefix}\u2026 (secret \u2014 \`naro backend keys --reveal\` prints it)`
     );
-  if (info.cloudflare) {
-    const size = info.cloudflare.fileSize === null ? "?" : humanSize(info.cloudflare.fileSize);
-    const tables = info.cloudflare.numTables === null ? "?" : String(info.cloudflare.numTables);
-    lines.push(`Size:     ${size} \xB7 Tables: ${tables}`);
+  return lines;
+}
+function adviceLines(info, now) {
+  if (!info.enabled && info.status !== "none") {
+    if (!info.turningOff) return [OFF_ADVICE];
+    return [leaseHeld(info, now) ? TURNING_OFF_NOW_ADVICE : TURNING_OFF_ADVICE];
   }
-  const { limits } = info;
-  lines.push(
-    `Limits:   ${humanSize(limits.maxSizeBytes)} per database \xB7 ${humanSize(limits.maxStatementBytes)} per statement \xB7 ${String(limits.maxParams)} params \xB7 ${String(limits.maxStatements)} statements per request \xB7 ${String(limits.maxQuerySeconds)} s per query`
+  switch (info.status) {
+    case "none":
+      return ["Run `naro backend enable` to turn it on."];
+    case "error":
+      return [
+        ...info.error ? [`Error:       ${printable(info.error)}`] : [],
+        "Run `naro backend enable` again \u2014 it picks up where it stopped."
+      ];
+    case "provisioning":
+      return isStalledBackend(info, now) ? [
+        "No run is working on it: the last one stopped part-way. Run `naro backend enable` to pick it up."
+      ] : [
+        "Provisioning is running. Check again in a minute with `naro backend`."
+      ];
+    default:
+      return [];
+  }
+}
+function stoppedAt(info) {
+  const step = info.step ? `the ${info.step} step` : "a step";
+  return `stopped at ${step}${info.error ? `: ${sentence(info.error)}` : "."}`;
+}
+async function runBackendInfo(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const backend = await client.backend.info(projectId);
+  const now = Date.now();
+  context.output.result(
+    { projectId, backend, stalled: isStalledBackend(backend, now) },
+    [...backendLines(backend, now), ...adviceLines(backend, now)]
   );
-  if (info.provider === "none")
-    lines.push("Run `naro db enable` to create the database.");
-  return lines;
 }
-async function runDbInfo(context) {
+async function runBackendEnable(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const database = await client.db.info(projectId);
-  context.output.result({ projectId, database }, describeLines(database));
+  let backend;
+  try {
+    backend = await client.backend.enable(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        "Provisioning did not answer within 2 minutes. `naro backend` shows where it got to, and `naro backend enable` again picks up where it stopped.",
+        { cause: error }
+      );
+    throw error;
+  }
+  if (!backend.enabled) {
+    for (const line of backendLines(backend)) context.output.log(line);
+    throw new NaroError(
+      "BACKEND_BUSY",
+      "Another run holds this backend right now, so it is still off. Run `naro backend enable` again in a minute.",
+      { details: { projectId, backend } }
+    );
+  }
+  if (backend.status === "error") {
+    for (const line of backendLines(backend)) context.output.log(line);
+    throw new NaroError(
+      "BACKEND_PROVISION_FAILED",
+      `Provisioning ${stoppedAt(backend)} Run \`naro backend enable\` again \u2014 it picks up where it stopped.`,
+      { details: { projectId, backend } }
+    );
+  }
+  if (backend.status === "provisioning") {
+    context.output.result({ projectId, backend }, [
+      `\u23F3 Another run is provisioning this backend right now${backend.step ? ` (step: ${backend.step})` : ""}. Check again in a minute with \`naro backend\`.`,
+      ...backendLines(backend)
+    ]);
+    return;
+  }
+  context.output.result({ projectId, backend }, [
+    `\u2705 Backend ready \u2014 ${backend.url}`,
+    ...backendLines(backend)
+  ]);
 }
-async function runDbEnable(context) {
+async function runBackendDisable(context) {
+  await confirmOrAbort(context, DISABLE_QUESTION);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const database = await client.db.enable(projectId);
-  context.output.result({ projectId, database }, [
-    `\u2705 Database enabled \u2014 ${database.resourceName ?? "(pending)"} (${database.status})`,
-    ...describeLines(database)
+  const backend = await client.backend.disable(projectId);
+  if (backend.status === "none") {
+    context.output.result({ projectId, backend }, [
+      "This project has no backend, so there is nothing to turn off.",
+      ...backendLines(backend)
+    ]);
+    return;
+  }
+  context.output.result({ projectId, backend }, [
+    "\u2705 Backend turned off. In up to about 90 seconds your app's /_naro/* requests get 404.",
+    "The data, users, sign-in settings and keys are kept \u2014 `naro backend enable` turns it back on with the same keys.",
+    ...backendLines(backend)
+  ]);
+}
+async function runBackendKeys(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const keys = await client.backend.keys(projectId);
+  if (!context.flags.reveal) {
+    context.output.result(
+      {
+        projectId,
+        anonKey: keys.anonKey,
+        serviceKeyPrefix: keys.serviceKeyPrefix
+      },
+      [
+        `Anon key:    ${keys.anonKey}`,
+        `Service key: ${keys.serviceKeyPrefix}\u2026 (hidden)`,
+        "`naro backend keys --reveal` prints the service key (needs database write access)."
+      ]
+    );
+    return;
+  }
+  const serviceKey = await client.backend.revealServiceKey(projectId);
+  context.output.warn(SERVICE_KEY_WARNING);
+  context.output.result({ projectId, anonKey: keys.anonKey, serviceKey }, [
+    `Anon key:    ${keys.anonKey}`,
+    `Service key: ${serviceKey}`
+  ]);
+}
+function rotateKind(context) {
+  const { anon, service } = context.flags;
+  if (anon === service) throw new NaroError("VALIDATION_FAILED", ROTATE_USAGE);
+  return anon ? "anon" : "service";
+}
+function keyLabel(kind) {
+  return kind === "anon" ? "Anon key:    " : "Service key: ";
+}
+function rotationWarning(kind, backend) {
+  if (backend.status === "error")
+    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`naro backend enable\` to finish.`;
+  if (backend.status !== "ready")
+    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend\`.`;
+  return null;
+}
+function checkKeysSentence(kind) {
+  const keys = kind === "service" ? "naro backend keys --reveal" : "naro backend keys";
+  return `Run \`${keys}\` to see which key is live, then \`naro backend enable\`.`;
+}
+function rotationHint(kind) {
+  return `The rotation may have gone through anyway. ${checkKeysSentence(kind)}`;
+}
+function outcomeUnknown(error) {
+  return error.code === "BACKEND_ROTATION_FAILED" || error.code === "INTERNAL_ERROR" || error.code === "NETWORK_ERROR" || error.status !== void 0 && error.status >= 500;
+}
+async function runBackendKeysRotate(context) {
+  const kind = rotateKind(context);
+  await confirmOrAbort(
+    context,
+    `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.`
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  let rotated;
+  try {
+    rotated = await client.backend.rotateKey(projectId, kind);
+  } catch (error) {
+    if (!isNaroError(error)) throw error;
+    const hint = rotationHint(kind);
+    if (error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind)}`,
+        { details: { hint }, cause: error }
+      );
+    if (!outcomeUnknown(error)) throw error;
+    context.output.warn(`\u26A0 ${hint}`);
+    throw new NaroError(error.code, error.message, {
+      ...error.status !== void 0 ? { status: error.status } : {},
+      details: { ...error.details, hint },
+      cause: error
+    });
+  }
+  const { backend, key } = rotated;
+  const warning = rotationWarning(kind, backend);
+  if (kind === "service") context.output.warn(SERVICE_KEY_WARNING);
+  if (warning) context.output.warn(warning);
+  context.output.result(
+    { projectId, kind, key, backend, ...warning ? { warning } : {} },
+    [
+      `\u2705 Replaced the ${kind} key. The old one no longer works.`,
+      `${keyLabel(kind)}${key}`,
+      kind === "anon" ? "Put the new key in your app and redeploy." : "Update NARO_SERVICE_KEY wherever your servers read it."
+    ]
+  );
+}
+
+// src/commands/backend-auth.ts
+var processStdin2 = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+var LABELS = {
+  google: "Google",
+  github: "GitHub"
+};
+var AUTH_USAGE = {
+  email: 'Usage: naro backend auth email set --provider resend --from "App <no-reply@example.com>" --api-key-stdin',
+  oauth: "Usage: naro backend auth oauth set google|github --client-id <id> --client-secret-stdin",
+  oauthRemove: "Usage: naro backend auth oauth remove google|github",
+  redirect: "Usage: naro backend auth redirects add|remove <url>",
+  verification: "Usage: naro backend auth require-verification on|off"
+};
+function sentence2(text) {
+  const line = printable(text).trim();
+  return /[.!?…]$/.test(line) ? line : `${line}.`;
+}
+function authLines(auth) {
+  const lines = [
+    auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
+  ];
+  for (const provider of ["google", "github"]) {
+    const client = auth.oauth[provider];
+    lines.push(
+      `${`${LABELS[provider]}:`.padEnd(13)}${client ? `${printable(client.clientId)} (secret set)` : "not set up"}`
+    );
+  }
+  lines.push(
+    `Redirects:   ${[`${productionOrigins(auth).join(", ")} (production hosts, always)`, ...auth.redirectOrigins].join(", ")}`,
+    `Email verification: ${auth.requireEmailVerification ? "required to sign in" : "not required"}`
+  );
+  return lines;
+}
+function productionOrigins(auth) {
+  return auth.productionOrigins?.length ? auth.productionOrigins : [auth.defaultOrigin];
+}
+function callbacksOf(auth, provider) {
+  const urls = auth.callbackUrls[provider];
+  if (typeof urls === "string") return [urls];
+  return Array.isArray(urls) ? urls.filter((url) => typeof url === "string") : [];
+}
+function adviceLines2(auth) {
+  const lines = [];
+  if (!auth.email)
+    lines.push(
+      "Set up email (confirmation and password reset links) with:",
+      `  ${AUTH_USAGE.email.replace("Usage: ", "")} < resend-key.txt`
+    );
+  lines.push(
+    "Redirect URIs to register with each provider \u2014 the one for the origin your app passes to createClient({ url }):"
+  );
+  for (const provider of ["google", "github"]) {
+    const label = `  ${LABELS[provider]}: `;
+    callbacksOf(auth, provider).forEach(
+      (url, index) => lines.push(`${index === 0 ? label : " ".repeat(label.length)}${url}`)
+    );
+  }
+  return lines;
+}
+async function runBackendAuthStatus(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const auth = await client.backend.auth(projectId);
+  context.output.result({ projectId, auth }, [
+    ...authLines(auth),
+    ...adviceLines2(auth)
+  ]);
+}
+async function readSecret(context, input, given, flag, what, usage) {
+  if (!given)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Pass the ${what} on stdin with ${flag}. ${usage}`
+    );
+  const value = input.stdinIsTty() ? await context.prompter.askHidden(`? ${what}: `) : await input.readStdin();
+  const secret = value.trim();
+  if (secret === "")
+    throw new NaroError("VALIDATION_FAILED", `No ${what} came in on stdin.`);
+  return secret;
+}
+async function change(context, send, done, after) {
+  const projectId = await context.resolveProjectId();
+  let answer;
+  try {
+    answer = await send(projectId);
+  } catch (error) {
+    if (isNaroError(error) && error.code === "TIMEOUT")
+      throw new NaroError(
+        "TIMEOUT",
+        "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
+        { cause: error }
+      );
+    throw error;
+  }
+  const { auth, backend } = answer;
+  if (backend.status === "error") {
+    for (const line of authLines(auth)) context.output.log(line);
+    const step = backend.step ? `the ${backend.step} step` : "a step";
+    throw new NaroError(
+      "BACKEND_PROVISION_FAILED",
+      `Saved, but updating the Naro worker stopped at ${step}${backend.error ? `: ${sentence2(backend.error)}` : "."} Run \`naro backend enable\` to finish.`,
+      { details: { projectId, auth, backend } }
+    );
+  }
+  if (backend.status !== "ready")
+    context.output.warn(
+      "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`."
+    );
+  context.output.result({ projectId, auth, backend }, [
+    ...done,
+    ...after ? after(auth) : [],
+    ...authLines(auth)
+  ]);
+}
+async function runBackendAuthEmailSet(context, input = processStdin2) {
+  const { provider, from } = context.flags;
+  if (provider === void 0 || from === void 0)
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.email);
+  if (provider !== "resend")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--provider must be resend. ${AUTH_USAGE.email}`
+    );
+  const apiKey = await readSecret(
+    context,
+    input,
+    context.flags.apiKeyStdin,
+    "--api-key-stdin",
+    "Resend API key",
+    AUTH_USAGE.email
+  );
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, {
+      email: { provider, from, apiKey }
+    }),
+    [
+      `\u2705 Email set up: ${provider}, from ${printable(from)}. Confirmation and reset links go out from it.`
+    ]
+  );
+}
+async function runBackendAuthEmailRemove(context) {
+  await confirmOrAbort(
+    context,
+    "Remove email? Confirmation and password reset emails stop at once."
+  );
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.removeAuth(projectId, "email"),
+    ["\u2705 Removed email. Confirmation and password reset emails are off."]
+  );
+}
+function providerOf(context, usage) {
+  const [provider] = context.positionals;
+  if (provider !== "google" && provider !== "github")
+    throw new NaroError("VALIDATION_FAILED", usage);
+  return provider;
+}
+async function runBackendAuthOAuthSet(context, input = processStdin2) {
+  const provider = providerOf(context, AUTH_USAGE.oauth);
+  const clientId = context.flags.clientId;
+  if (clientId === void 0)
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.oauth);
+  const clientSecret = await readSecret(
+    context,
+    input,
+    context.flags.clientSecretStdin,
+    "--client-secret-stdin",
+    `${LABELS[provider]} client secret`,
+    AUTH_USAGE.oauth
+  );
+  const client = await context.client();
+  const patch = {
+    oauth: { [provider]: { clientId, clientSecret } }
+  };
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, patch),
+    [
+      `\u2705 ${LABELS[provider]} sign-in set up. Register the redirect URI below with the ${LABELS[provider]} app.`
+    ]
+  );
+}
+async function runBackendAuthOAuthRemove(context) {
+  const provider = providerOf(context, AUTH_USAGE.oauthRemove);
+  await confirmOrAbort(
+    context,
+    `Remove ${LABELS[provider]} sign-in? Users who signed in with ${LABELS[provider]} cannot sign in with it until it is set up again.`
+  );
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.removeAuth(projectId, provider),
+    [`\u2705 Removed ${LABELS[provider]} sign-in.`]
+  );
+}
+async function runBackendAuthRedirectsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const auth = await client.backend.auth(projectId);
+  const production = productionOrigins(auth);
+  context.output.result(
+    {
+      projectId,
+      defaultOrigin: auth.defaultOrigin,
+      productionOrigins: production,
+      redirectOrigins: auth.redirectOrigins
+    },
+    [
+      ...production.map(
+        (origin) => `${origin} (a production host: every page, unless an entry below narrows it to a path)`
+      ),
+      ...auth.redirectOrigins,
+      ...auth.redirectOrigins.length === 0 ? [
+        "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/."
+      ] : []
+    ]
+  );
+}
+function originOf(context) {
+  const [origin] = context.positionals;
+  if (origin === void 0)
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.redirect);
+  return origin;
+}
+async function runBackendAuthRedirectsAdd(context) {
+  const origin = originOf(context);
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, {
+      redirectOrigins: { add: [origin] }
+    }),
+    [`\u2705 Sign-in may now send the browser back to ${printable(origin)}.`]
+  );
+}
+function allowing(list, origin) {
+  return list.filter((entry) => parseRedirectEntry(entry)?.origin === origin);
+}
+async function runBackendAuthRedirectsRemove(context) {
+  const given = originOf(context);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const parsed = parseRedirectEntry(given);
+  if (parsed) {
+    const entry = formatRedirectEntry(parsed);
+    const shown = printable(entry);
+    const current = await client.backend.auth(projectId);
+    if (!current.redirectOrigins.includes(entry)) {
+      if (entry === parsed.origin && productionOrigins(current).includes(entry))
+        throw new NaroError(
+          "REDIRECT_NOT_FOUND",
+          `${shown} is a production host of this project: it is always allowed, and is not in the redirect list to remove.`
+        );
+      const others = allowing(current.redirectOrigins, parsed.origin);
+      const origin = printable(parsed.origin);
+      throw new NaroError(
+        "REDIRECT_NOT_FOUND",
+        `${shown} is not in the redirect list, so nothing was removed. ${others.length > 0 ? `These entries still allow ${origin}: ${others.map(printable).join(", ")}. Remove them by name.` : `Nothing else allows ${origin}; \`naro backend auth redirects\` shows the list.`}`,
+        { details: { projectId, redirectOrigins: current.redirectOrigins } }
+      );
+    }
+  }
+  await change(
+    context,
+    (id) => client.backend.setAuth(id, {
+      redirectOrigins: { remove: [given] }
+    }),
+    [],
+    (auth) => {
+      const origin = parsed?.origin ?? given;
+      const still = [
+        ...productionOrigins(auth).filter((host) => host === origin),
+        ...allowing(auth.redirectOrigins, origin)
+      ];
+      const removed = printable(parsed ? formatRedirectEntry(parsed) : given);
+      return [
+        still.length > 0 ? `\u2705 Removed ${removed}. ${printable(origin)} is still allowed by: ${still.map(printable).join(", ")}.` : `\u2705 Removed ${removed}. Sign-in no longer sends the browser back to ${printable(origin)}.`
+      ];
+    }
+  );
+}
+async function runBackendAuthRequireVerification(context) {
+  const [value] = context.positionals;
+  if (value !== "on" && value !== "off")
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.verification);
+  const on = value === "on";
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, { requireEmailVerification: on }),
+    [
+      on ? "\u2705 Sign-in now waits for a confirmed email. New sign-ups get a confirmation link." : "\u2705 Sign-in no longer waits for a confirmed email."
+    ]
+  );
+}
+
+// src/commands/cancel.ts
+async function runCancel(context) {
+  const [deploymentId] = context.positionalOrThrow(
+    1,
+    "Usage: naro cancel <deployment-id>"
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(context, `Cancel the build ${String(deploymentId)}?`);
+  const canceled = await client.deployments.cancel(
+    projectId,
+    deploymentId
+  );
+  context.output.result(
+    {
+      deploymentId: canceled.id,
+      projectId,
+      status: canceled.status,
+      errorCode: canceled.errorCode
+    },
+    [`\u2705 Canceled ${canceled.id}`]
+  );
+}
+
+// src/commands/db.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { resolve } from "path";
+var processStdin3 = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+var USAGE = "Usage: naro db query <sql> | --file <path> | (stdin)";
+var ROW_CAP_NOTICE = "\u26A0 Output was cut at 10,000 rows. Add a LIMIT to see the rest.";
+function humanSize(bytes) {
+  const units = ["B", "KB", "MB", "GB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${unit === 0 ? String(value) : value.toFixed(1)} ${units[unit] ?? "B"}`;
+}
+function decimalSize(bytes) {
+  const units = ["B", "KB", "MB", "GB"];
+  let value = bytes;
+  let unit = 0;
+  for (; ; ) {
+    const rounded = Number(value.toFixed(2));
+    if (rounded < 1e3 || unit === units.length - 1)
+      return `${String(rounded)} ${units[unit] ?? "B"}`;
+    value /= 1e3;
+    unit += 1;
+  }
+}
+function storageSize(bytes) {
+  if (bytes < 1e9) return decimalSize(bytes);
+  const hundredths = Math.floor(bytes / 1e7);
+  return `${String(Math.floor(hundredths / 100))}.${String(hundredths % 100).padStart(2, "0")} GB`;
+}
+var STORAGE_WARNING = "\u26A0 This database is over 8 GB of D1's 10 GB limit, which cannot be raised. Writes fail once it is full: delete data you no longer need, or move large blobs to storage (R2).";
+var WRITE_WARNING_RATIO = 0.8;
+function usageLines(info) {
+  const usage = info.usage;
+  if (!usage) return [];
+  const lines = [
+    `Writes today (UTC): ${usage.rowsWritten.toLocaleString("en-US")} / ${usage.writeLimit.toLocaleString("en-US")} rows`
+  ];
+  if (usage.writesBlocked)
+    lines.push(
+      "\u2717 Over today's write limit: writes through naro (db query, db push, the Data API) are refused until 00:00 UTC. Reads still work."
+    );
+  else if (usage.rowsWritten >= usage.writeLimit * WRITE_WARNING_RATIO)
+    lines.push(
+      `\u26A0 ${String(Math.floor(usage.rowsWritten / usage.writeLimit * 100))}% of today's write limit is used. At 100%, writes through naro (db query, db push, the Data API) stop until 00:00 UTC.`
+    );
+  const sizeBytes = info.cloudflare?.fileSize ?? usage.storageBytes;
+  if (sizeBytes !== null && usage.storageLimitBytes !== void 0) {
+    lines.push(
+      `Storage: ${storageSize(sizeBytes)} / ${decimalSize(usage.storageLimitBytes)}`
+    );
+    if (usage.storageWarning === true) lines.push(STORAGE_WARNING);
+  }
+  return lines;
+}
+function describeLines(info) {
+  const lines = [
+    `Provider: ${info.provider}`,
+    `Status:   ${info.status}`,
+    `Binding:  env.${info.binding}`
+  ];
+  if (info.resourceName)
+    lines.push(
+      `Database: ${info.resourceName}${info.resourceId ? ` (${info.resourceId})` : ""}`
+    );
+  if (info.cloudflare) {
+    const size = info.cloudflare.fileSize === null ? "?" : storageSize(info.cloudflare.fileSize);
+    const tables = info.cloudflare.numTables === null ? "?" : String(info.cloudflare.numTables);
+    lines.push(`Size:     ${size} \xB7 Tables: ${tables}`);
+  }
+  const { limits } = info;
+  lines.push(
+    `Limits:   ${decimalSize(limits.maxSizeBytes)} per database \xB7 ${decimalSize(limits.maxStatementBytes)} per statement \xB7 ${String(limits.maxParams)} params \xB7 ${String(limits.maxStatements)} statements per request \xB7 ${String(limits.maxQuerySeconds)} s per query`
+  );
+  lines.push(...usageLines(info));
+  if (info.provider === "none")
+    lines.push("Run `naro db enable` to create the database.");
+  return lines;
+}
+async function runDbInfo(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const database = await client.db.info(projectId);
+  context.output.result({ projectId, database }, describeLines(database));
+}
+async function runDbEnable(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const database = await client.db.enable(projectId);
+  context.output.result({ projectId, database }, [
+    `\u2705 Database enabled \u2014 ${database.resourceName ?? "(pending)"} (${database.status})`,
+    ...describeLines(database)
+  ]);
+}
+async function readSql(context, deps) {
+  const positional = context.positionals[0];
+  let sql;
+  if (positional !== void 0) {
+    sql = positional;
+  } else if (context.flags.file !== void 0) {
+    try {
+      sql = readFileSync2(resolve(context.cwd, context.flags.file), "utf8");
+    } catch {
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `Could not read ${context.flags.file}.`
+      );
+    }
+  } else if (!deps.stdinIsTty()) {
+    sql = await deps.readStdin();
+  }
+  if (sql === void 0 || sql.trim().length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE);
+  return sql;
+}
+async function runDbQuery(context, deps = processStdin3) {
+  const sql = await readSql(context, deps);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const result = await client.db.query(projectId, { sql });
+  const lines = [];
+  result.statements.forEach((statement, index) => {
+    if (index > 0) lines.push("");
+    lines.push(...renderRows(statement), summarizeStatement(statement));
+  });
+  if (result.truncated) lines.push(ROW_CAP_NOTICE);
+  context.output.result({ projectId, result }, lines);
+}
+
+// src/commands/db-backup.ts
+import {
+  createWriteStream,
+  mkdirSync as mkdirSync2,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { basename, dirname, join as join2, resolve as resolve2 } from "path";
+import { Transform } from "stream";
+import { pipeline } from "stream/promises";
+var defaults = {
+  fetch: (input, init) => fetch(input, init),
+  stdout: process.stdout,
+  sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
+  writeFile: (path, data) => {
+    mkdirSync2(dirname(path), { recursive: true });
+    writeFileSync2(path, data, { flag: "wx" });
+  }
+};
+var EXPORT_NOTICE = "Exporting the project database. Cloudflare holds other queries to this database until the export finishes.";
+function reasonOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function withoutUrl(text, url) {
+  return text.split(url).join("the signed URL").replace(/\S*X-Amz-Signature=\S*/gi, "the signed URL");
+}
+function downloadFailed(url, reason, original) {
+  const scrubbed = withoutUrl(reason, url);
+  let cause;
+  if (original !== void 0) {
+    cause = new Error(scrubbed);
+    if (original instanceof Error) {
+      cause.name = original.name;
+      if (original.stack !== void 0)
+        cause.stack = withoutUrl(original.stack, url);
+    }
+  }
+  return new NaroError(
+    "DATABASE_UNAVAILABLE",
+    `Could not download the dump (${scrubbed}). Run naro db dump again.`,
+    cause === void 0 ? {} : { cause }
+  );
+}
+function writeFailed(shown, error) {
+  return new NaroError(
+    "INTERNAL_ERROR",
+    `Could not write ${shown}: ${reasonOf(error)}.`,
+    { cause: error }
+  );
+}
+var DownloadStreamError = class extends Error {
+  constructor(original) {
+    super(reasonOf(original));
+    this.original = original;
+    this.name = "DownloadStreamError";
+  }
+};
+async function openDownload(deps, url) {
+  let response;
+  try {
+    response = await deps.fetch(url);
+  } catch (error) {
+    throw downloadFailed(url, reasonOf(error), error);
+  }
+  if (!response.ok || response.body === null) {
+    await response.body?.cancel().catch(() => {
+    });
+    throw downloadFailed(url, `HTTP ${String(response.status)}`);
+  }
+  return response.body;
+}
+async function* chunksOf(body) {
+  const reader = body.getReader();
+  const read = async () => {
+    try {
+      return await reader.read();
+    } catch (error) {
+      throw new DownloadStreamError(error);
+    }
+  };
+  try {
+    for (; ; ) {
+      const next = await read();
+      if (next.done) return;
+      yield next.value;
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+}
+async function streamInto(body, destination, end) {
+  let bytes = 0;
+  const counter = new Transform({
+    transform(chunk2, _encoding, done) {
+      bytes += chunk2.length;
+      done(null, chunk2);
+    }
+  });
+  await pipeline(chunksOf(body), counter, destination, { end });
+  return bytes;
+}
+function streamFailed(error, url, shown) {
+  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original) : writeFailed(shown, error);
+}
+function refuseDirectory(path, shown) {
+  let isDirectory = false;
+  try {
+    isDirectory = statSync(path, { throwIfNoEntry: false })?.isDirectory() ?? false;
+  } catch {
+  }
+  if (isDirectory)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--output ${shown} is a directory. Pass a file path.`
+    );
+}
+function makeOutputDirectory(path, shown) {
+  try {
+    mkdirSync2(dirname(path), { recursive: true });
+  } catch (error) {
+    throw writeFailed(shown, error);
+  }
+}
+async function downloadToFile(deps, url, path, shown) {
+  const body = await openDownload(deps, url);
+  const partial = join2(
+    dirname(path),
+    `.${basename(path)}.${String(process.pid)}.part`
+  );
+  try {
+    const bytes = await streamInto(body, createWriteStream(partial), true);
+    renameSync(partial, path);
+    return bytes;
+  } catch (error) {
+    try {
+      rmSync(partial, { force: true });
+    } catch {
+    }
+    throw streamFailed(error, url, shown);
+  }
+}
+async function downloadToStdout(deps, url) {
+  const body = await openDownload(deps, url);
+  try {
+    return await streamInto(body, deps.stdout, false);
+  } catch (error) {
+    throw streamFailed(error, url, "stdout");
+  }
+}
+async function runDbDump(context, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  const { flags } = context;
+  if (flags.schemaOnly && flags.dataOnly)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --schema-only or --data-only, not both."
+    );
+  if (flags.json && flags.output === void 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--json needs --output: the dump and the JSON result would share stdout."
+    );
+  const tables = listFlag(flags.table);
+  if (flags.table !== void 0 && tables.length === 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--table needs at least one table name."
+    );
+  const options = {
+    ...flags.schemaOnly ? { schemaOnly: true } : {},
+    ...flags.dataOnly ? { dataOnly: true } : {},
+    ...tables.length > 0 ? { tables } : {}
+  };
+  const output = flags.output === void 0 ? null : { path: resolve2(context.cwd, flags.output), shown: flags.output };
+  if (output) refuseDirectory(output.path, output.shown);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  if (output) makeOutputDirectory(output.path, output.shown);
+  context.output.warn(EXPORT_NOTICE);
+  const step = await client.db.export(projectId, options, {
+    sleep: deps.sleep
+  });
+  const file = step.file;
+  if (file === null)
+    throw new NaroError(
+      "DATABASE_UNAVAILABLE",
+      "Could not download the dump (Cloudflare finished the export without a file). Run naro db dump again."
+    );
+  const bytes = output === null ? await downloadToStdout(deps, file.url) : await downloadToFile(deps, file.url, output.path, output.shown);
+  const bookmark = step.atBookmark;
+  if (!context.output.json) {
+    context.output.warn(
+      `\u2713 Wrote ${flags.output ?? "stdout"} (${humanSize(bytes)}) at bookmark ${bookmark}.`
+    );
+    context.output.warn(
+      `  naro db restore --bookmark ${bookmark} returns the database to this point.`
+    );
+  }
+  context.output.result({ output: flags.output, bytes, atBookmark: bookmark });
+}
+async function bookmarkNow(context, client, projectId, action = "restoring") {
+  try {
+    const { bookmark } = await client.db.bookmark(projectId);
+    return isBookmark(bookmark) ? bookmark : null;
+  } catch (error) {
+    context.output.debugLog(
+      `Could not read the current bookmark before ${action}: ${reasonOf(error)}`
+    );
+    return null;
+  }
+}
+function withWayBack(context, error, before) {
+  if (before === null || !isNaroError(error) || !RESTORE_OUTCOME_UNKNOWN_CODES.has(error.code))
+    return error;
+  if (!context.output.json)
+    context.output.warn(
+      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before} undoes it.`
+    );
+  return new NaroError(error.code, error.message, {
+    ...error.status === void 0 ? {} : { status: error.status },
+    details: { ...error.details, previousBookmark: before },
+    cause: error
+  });
+}
+async function runDbRestore(context) {
+  const { bookmark, timestamp } = context.flags;
+  const given = bookmark !== void 0 && timestamp === void 0 ? { bookmark } : timestamp !== void 0 && bookmark === void 0 ? { timestamp } : null;
+  if (given === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Pass --timestamp <time> or --bookmark <id> (exactly one)."
+    );
+  if ("bookmark" in given && !isBookmark(given.bookmark))
+    throw new NaroError("VALIDATION_FAILED", BOOKMARK_FORMAT_MESSAGE);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  let target;
+  let at = null;
+  if ("bookmark" in given) {
+    target = given.bookmark;
+  } else {
+    const resolved = await client.db.bookmark(projectId, {
+      timestamp: given.timestamp
+    });
+    target = resolved.bookmark;
+    at = resolved.timestamp ?? given.timestamp;
+  }
+  const label = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
+  if (context.flags.dryRun) {
+    context.output.result(
+      {
+        dryRun: true,
+        bookmark: target,
+        ...at === null ? {} : { timestamp: at }
+      },
+      [`Would restore to ${label}. Nothing was changed.`]
+    );
+    return;
+  }
+  await confirmOrAbort(
+    context,
+    `Restore the project database to ${label}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+  );
+  const before = await bookmarkNow(context, client, projectId);
+  let restored;
+  try {
+    restored = await client.db.restore(projectId, { bookmark: target });
+  } catch (error) {
+    throw withWayBack(context, error, before);
+  }
+  context.output.result(
+    {
+      bookmark: restored.bookmark,
+      previousBookmark: restored.previousBookmark
+    },
+    [
+      `\u2713 Restored the project database to bookmark ${restored.bookmark}.`,
+      `  To undo: naro db restore --bookmark ${restored.previousBookmark}`
+    ]
+  );
+}
+async function runDbPull(context, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  const dir = migrationsDir(context);
+  const existing = listMigrationFiles(dir);
+  if (existing.length > 0)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${relativeToCwd(context, dir)} already has ${String(existing.length)} migration file(s). naro db pull only baselines a project without migrations; to see the current schema, run naro db dump --schema-only.`
+    );
+  const name = nextMigrationFileName(existing, "remote_schema");
+  const path = join2(dir, name);
+  const shown = relativeToCwd(context, path);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await confirmOrAbort(
+    context,
+    `Write ${shown} with the database's current schema and record it as already applied?`
+  );
+  const pulled = await client.db.pull(projectId, { name });
+  try {
+    deps.writeFile(path, `${pulled.sql}
+`);
+  } catch (error) {
+    if (!context.output.json) context.output.log(pulled.sql);
+    throw new NaroError(
+      "INTERNAL_ERROR",
+      `Recorded ${pulled.name} as applied but could not write ${shown}: ${reasonOf(error)}. The SQL is on stdout \u2014 save it as that file.`,
+      {
+        details: { migration: pulled.name, path: shown, sql: pulled.sql },
+        cause: error
+      }
+    );
+  }
+  context.output.result(
+    {
+      projectId,
+      name: pulled.name,
+      path: shown,
+      statements: pulled.statements
+    },
+    [
+      `\u2713 Wrote ${shown} (${String(pulled.statements)} ${pulled.statements === 1 ? "statement" : "statements"}) and recorded it as applied.`
+    ]
+  );
+}
+
+// src/commands/db-lint.ts
+var DIAGNOSTICS_SQL = [
+  `SELECT name FROM sqlite_master WHERE type = 'trigger' AND ${systemTablePredicate("name")} ORDER BY name;`,
+  "SELECT name, type FROM pragma_table_list WHERE schema = 'main' AND type IN ('virtual', 'shadow') ORDER BY name;",
+  "SELECT * FROM pragma_quick_check;",
+  "SELECT * FROM pragma_foreign_key_check;"
+].join("\n");
+var TRUNCATED_NOTICE = "\u26A0 The diagnostics were cut at 10,000 rows \u2014 there may be more broken rows than these.";
+function firstCell(row) {
+  const value = row[0];
+  return value === null || value === void 0 ? "" : String(value);
+}
+function rowidOf(text) {
+  if (text === "") return null;
+  const value = Number(text);
+  return Number.isFinite(value) ? value : null;
+}
+function issueLines(issues, tables) {
+  const errors = issues.filter((issue) => issue.severity === "error").length;
+  if (issues.length === 0)
+    return [`\u2713 No issues found in ${String(tables)} table(s).`];
+  return [
+    ...issues.map(
+      (issue) => printable(
+        `${issue.severity.padEnd(5)}  ${issue.rule}  ${issue.object}: ${issue.message}`
+      )
+    ),
+    `${String(errors)} error(s), ${String(issues.length - errors)} warning(s) in ${String(tables)} table(s).`
+  ];
+}
+async function runDbLint(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const tables = await client.db.tables(projectId);
+  const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
+  const [triggers, objects, quick, broken] = answer.statements;
+  if (triggers === void 0 || objects === void 0 || quick === void 0 || broken === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The diagnostics could not be read: the database answered with ${String(answer.statements.length)} result sets instead of 4.`
+    );
+  const virtualTables = [];
+  const shadow = /* @__PURE__ */ new Set();
+  for (const row of objects.rows) {
+    const name = cellText(objects, row, "name");
+    if (cellText(objects, row, "type") === "shadow") shadow.add(name);
+    else virtualTables.push(name);
+  }
+  const foreignKeyCheck = broken.rows.map((row) => ({
+    table: cellText(broken, row, "table"),
+    rowid: rowidOf(cellText(broken, row, "rowid")),
+    parent: cellText(broken, row, "parent")
+  }));
+  const input = {
+    tables: tables.filter((table) => !shadow.has(table.name)),
+    foreignKeyCheck,
+    quickCheck: quick.rows.map(firstCell),
+    triggers: triggers.rows.map((row) => cellText(triggers, row, "name")),
+    virtualTables
+  };
+  const issues = lintSchema(input);
+  const counted = countLintedTables(input);
+  const errors = issues.filter((issue) => issue.severity === "error").length;
+  const warnings = issues.length - errors;
+  if (answer.truncated) context.output.warn(TRUNCATED_NOTICE);
+  context.output.result(
+    { issues, errors, warnings, tables: counted },
+    issueLines(issues, counted)
+  );
+  if (errors > 0 || context.flags.strict === true && warnings > 0)
+    process.exitCode = 1;
+}
+
+// src/commands/db-reset.ts
+var MAX_STATEMENTS = 50;
+var SCHEMA_FILTER = `${systemTablePredicate("name")} AND ${systemTablePredicate("tbl_name")}`;
+var SCHEMA_SQL = [
+  `SELECT type, name FROM sqlite_master WHERE type IN ('table', 'view', 'trigger') AND ${SCHEMA_FILTER} ORDER BY name;`,
+  "SELECT name FROM pragma_table_list WHERE schema = 'main' AND type = 'virtual';",
+  "SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('sqlite_sequence', 'd1_migrations');"
+].join("\n");
+function literal(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function chunk(items2, size) {
+  const pieces = [];
+  for (let index = 0; index < items2.length; index += size)
+    pieces.push(items2.slice(index, index + size));
+  return pieces;
+}
+async function readSchema(client, projectId) {
+  const schema = await client.db.query(projectId, { sql: SCHEMA_SQL });
+  const [listed, virtual, internal] = schema.statements;
+  if (listed === void 0 || virtual === void 0 || internal === void 0)
+    throw new NaroError(
+      "DATABASE_QUERY_FAILED",
+      `The schema could not be read: the database answered with ${String(schema.statements.length)} result sets instead of 3.`
+    );
+  const internalNames = new Set(
+    internal.rows.map((row) => cellText(internal, row, "name"))
+  );
+  const virtualNames = new Set(
+    virtual.rows.map((row) => cellText(virtual, row, "name").toLowerCase())
+  );
+  const objects = listed.rows.map((row) => {
+    const name = cellText(listed, row, "name");
+    const type = cellText(listed, row, "type");
+    if (type === "view" || type === "trigger") return { type, name };
+    return {
+      type: virtualNames.has(name.toLowerCase()) ? "virtual" : "table",
+      name
+    };
+  });
+  const lookups = objects.filter((object) => object.type === "table" || object.type === "virtual").map(
+    (object) => `SELECT ${literal(object.name)} AS child, "table" AS parent FROM pragma_foreign_key_list(${literal(object.name)});`
+  );
+  const foreignKeys = [];
+  for (const piece of chunk(lookups, MAX_STATEMENTS)) {
+    const answer = await client.db.query(projectId, { sql: piece.join("\n") });
+    if (answer.truncated)
+      throw new NaroError(
+        "DATABASE_QUERY_FAILED",
+        "The schema is too large to read in one pass: the foreign key lookup was cut at 10,000 rows."
+      );
+    for (const statement of answer.statements)
+      for (const row of statement.rows)
+        foreignKeys.push({
+          child: cellText(statement, row, "child"),
+          parent: cellText(statement, row, "parent")
+        });
+  }
+  return {
+    objects,
+    foreignKeys,
+    internal: {
+      sqliteSequence: internalNames.has("sqlite_sequence"),
+      ledger: internalNames.has("d1_migrations")
+    }
+  };
+}
+function resetStopped(context, error, bookmark, lead, message) {
+  const naroError = isNaroError(error) ? error : toNaroError(error);
+  if (!context.output.json)
+    context.output.warn(
+      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+    );
+  return new NaroError(naroError.code, message(naroError.message), {
+    ...naroError.status === void 0 ? {} : { status: naroError.status },
+    details: {
+      ...naroError.details,
+      ...bookmark === null ? {} : { bookmark }
+    },
+    cause: naroError
+  });
+}
+async function runDbReset(context) {
+  const dir = migrationsDir(context);
+  const shownDir = relativeToCwd(context, dir);
+  const files = listMigrationFiles(dir);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
+  const plan = buildResetPlan(await readSchema(client, projectId));
+  const { tables, views, triggers } = plan.dropped;
+  const counts = `${String(tables.length)} table(s), ${String(views.length)} view(s) and ${String(triggers.length)} trigger(s)`;
+  const dropped = tables.length + views.length + triggers.length;
+  if (context.flags.dryRun) {
+    context.output.result(
+      { dryRun: true, tables, views, triggers, migrations: files },
+      [
+        `Would drop ${counts}:`,
+        ...views.map((name) => `  ${"view".padEnd(9)}${printable(name)}`),
+        ...triggers.map((name) => `  ${"trigger".padEnd(9)}${printable(name)}`),
+        ...tables.map((name) => `  ${"table".padEnd(9)}${printable(name)}`),
+        `Would re-apply ${String(files.length)} migration file(s) from ${shownDir}:`,
+        ...files.map((name) => `  ${printable(name)}`),
+        "Nothing was changed."
+      ]
+    );
+    return;
+  }
+  if (bookmark !== null)
+    context.output.log(
+      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+    );
+  await confirmOrAbort(
+    context,
+    `Reset the project database? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
+  );
+  let done = 0;
+  const total = plan.batches.length;
+  for (const batch of plan.batches) {
+    try {
+      await client.db.query(projectId, { sql: batch.join("\n") });
+    } catch (error) {
+      throw resetStopped(
+        context,
+        error,
+        bookmark,
+        "Part of the schema is already dropped.",
+        (underlying) => `The reset stopped after ${String(done)} of ${String(total)} batches: ${underlying}`
+      );
+    }
+    done += 1;
+  }
+  if (files.length === 0)
+    context.output.warn(
+      `No migration files in ${shownDir} \u2014 the database is now empty.`
+    );
+  let reapplied = [];
+  try {
+    if (files.length > 0)
+      reapplied = await applyMigrationFiles(
+        context,
+        client,
+        projectId,
+        dir,
+        files
+      );
+  } catch (error) {
+    throw resetStopped(
+      context,
+      error,
+      bookmark,
+      "The schema is dropped and the re-apply stopped.",
+      (underlying) => underlying
+    );
+  }
+  context.output.result({ dropped, reapplied: reapplied.length, bookmark }, [
+    `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+    ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
   ]);
 }
-async function readSql(context, deps) {
-  const positional = context.positionals[0];
-  let sql;
-  if (positional !== void 0) {
-    sql = positional;
-  } else if (context.flags.file !== void 0) {
-    try {
-      sql = readFileSync(resolve(context.cwd, context.flags.file), "utf8");
-    } catch {
+
+// src/commands/db-schema.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+var USAGE2 = {
+  table: "Usage: naro db table create|add-column|rename-column|rename|drop-column|drop \u2026 (see naro help)",
+  index: "Usage: naro db index create|drop \u2026 (see naro help)",
+  create: "Usage: naro db table create <name> --column <spec> [--column <spec>\u2026] [--owner <column>] [--if-not-exists]",
+  addColumn: "Usage: naro db table add-column <table> --column <spec>",
+  renameColumn: "Usage: naro db table rename-column <table> <column> <new-name>",
+  rename: "Usage: naro db table rename <table> <new-name>",
+  dropColumn: "Usage: naro db table drop-column <table> <column>",
+  drop: "Usage: naro db table drop <table>",
+  indexCreate: "Usage: naro db index create <table> <column[,column\u2026]> [--unique] [--name <name>]",
+  indexDrop: "Usage: naro db index drop <name>"
+};
+var SPEC_USAGE = '--column needs name:type, e.g. --column "title:text:notnull".';
+var ON_DELETE = {
+  cascade: "CASCADE",
+  "set-null": "SET NULL",
+  "set-default": "SET DEFAULT",
+  restrict: "RESTRICT",
+  "no-action": "NO ACTION"
+};
+var KEYWORDS = /* @__PURE__ */ new Set(["CURRENT_TIMESTAMP", "CURRENT_DATE", "CURRENT_TIME"]);
+var NUMBER = /^-?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+function segments(spec) {
+  const parts = [];
+  let current = "";
+  let quoted = false;
+  for (const char of spec) {
+    if (char === "'") quoted = !quoted;
+    if (char === ":" && !quoted) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (quoted) return null;
+  parts.push(current);
+  return parts;
+}
+function defaultValue(text) {
+  if (text.length >= 2 && text.startsWith("'") && text.endsWith("'"))
+    return text.slice(1, -1).replace(/''/g, "'");
+  const lower = text.toLowerCase();
+  if (lower === "null") return null;
+  if (lower === "true") return true;
+  if (lower === "false") return false;
+  const upper = text.toUpperCase();
+  if (KEYWORDS.has(upper)) return { keyword: upper };
+  if (NUMBER.test(text)) return Number(text);
+  return text;
+}
+function parseColumnSpec(spec) {
+  const shown = `--column "${printable(spec)}"`;
+  const parts = segments(spec);
+  if (parts === null)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `${shown}: a quoted default is not closed.`
+    );
+  const [name, type, ...modifiers] = parts;
+  if (!name || !type) throw new NaroError("VALIDATION_FAILED", SPEC_USAGE);
+  const column = {
+    name,
+    type
+  };
+  let onDelete;
+  for (const modifier of modifiers) {
+    const eq = modifier.indexOf("=");
+    const key = (eq < 0 ? modifier : modifier.slice(0, eq)).toLowerCase();
+    const value = eq < 0 ? void 0 : modifier.slice(eq + 1);
+    if (value === void 0 && key === "pk") column.primaryKey = true;
+    else if (value === void 0 && key === "autoincrement")
+      column.autoIncrement = true;
+    else if (value === void 0 && key === "notnull") column.notNull = true;
+    else if (value === void 0 && key === "unique") column.unique = true;
+    else if (value !== void 0 && key === "default")
+      column.default = defaultValue(value);
+    else if (value !== void 0 && key === "references") {
+      const dot = value.lastIndexOf(".");
+      const table = dot < 0 ? "" : value.slice(0, dot);
+      const target = dot < 0 ? "" : value.slice(dot + 1);
+      if (!table || !target)
+        throw new NaroError(
+          "VALIDATION_FAILED",
+          `${shown}: references needs <table>.<column>.`
+        );
+      column.references = { table, column: target };
+    } else if (value !== void 0 && key === "ondelete") {
+      onDelete = ON_DELETE[value.toLowerCase()];
+      if (!onDelete)
+        throw new NaroError(
+          "VALIDATION_FAILED",
+          `${shown}: ondelete takes cascade, set-null, set-default, restrict or no-action.`
+        );
+    } else
       throw new NaroError(
         "VALIDATION_FAILED",
-        `Could not read ${context.flags.file}.`
+        `${shown}: unknown modifier ${printable(modifier)}. Use pk, autoincrement, notnull, unique, default=<value>, references=<table>.<column> or ondelete=<action>.`
       );
-    }
-  } else if (!deps.stdinIsTty()) {
-    sql = await deps.readStdin();
   }
-  if (sql === void 0 || sql.trim().length === 0)
-    throw new NaroError("VALIDATION_FAILED", USAGE);
-  return sql;
+  if (onDelete !== void 0) {
+    if (!column.references)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${shown}: ondelete needs references=<table>.<column>.`
+      );
+    column.references.onDelete = onDelete;
+  }
+  return column;
 }
-async function runDbQuery(context, deps = processStdin) {
-  const sql = await readSql(context, deps);
+function policyLine(policy, dryRun = false) {
+  const rules = [policy.select, policy.insert, policy.update, policy.delete];
+  const owner = policy.ownerColumn === null ? "" : ` (owner column ${printable(policy.ownerColumn)})`;
+  const uniform = rules.every((rule) => rule === rules[0]);
+  const summary = uniform ? `${String(rules[0])} for select, insert, update and delete` : `select ${policy.select}, insert ${policy.insert}, update ${policy.update}, delete ${policy.delete}`;
+  const head = dryRun ? "Would set the Data API policy" : "\u2713 Data API policy";
+  return `${head} on ${printable(policy.table)}: ${summary}${owner}.`;
+}
+function removedLine(policy, dryRun) {
+  const owner = policy.ownerColumn === null ? "" : `, owner column ${printable(policy.ownerColumn)}`;
+  const rules = `select ${policy.select}, insert ${policy.insert}, update ${policy.update}, delete ${policy.delete}${owner}`;
+  return `${dryRun ? "Would remove" : "\u2713 Removed"} the Data API policy on ${printable(policy.table)} (${rules}).`;
+}
+async function runSchemaChange(context, operations, question) {
+  const dryRun = context.flags.dryRun === true;
+  if (question !== void 0 && !dryRun)
+    await confirmOrAbort(context, question);
+  const sent = dryRun ? operations.map((operation) => {
+    if (operation.op !== "dropTable" && operation.op !== "dropColumn")
+      return operation;
+    const { confirm: _confirm, ...rest } = operation;
+    return rest;
+  }) : operations;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const result = await client.db.query(projectId, { sql });
-  const lines = [];
-  result.statements.forEach((statement, index) => {
-    if (index > 0) lines.push("");
-    lines.push(...renderRows(statement), summarizeStatement(statement));
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = pendingMigrationNames(local, ledger);
+  if (pending.length > 0 && !dryRun)
+    throw migrationsPendingError(pending.map(printable));
+  const name = nextMigrationFileName(
+    [...local, ...ledger.map((row) => row.name)],
+    schemaMigrationTitle(operations[0] ?? {})
+  );
+  const result = await client.db.schema(projectId, sent, {
+    ...dryRun ? { dryRun: true } : {},
+    name
   });
-  if (result.truncated) lines.push(ROW_CAP_NOTICE);
-  context.output.result({ projectId, result }, lines);
+  const sqlLines = result.sql.trimEnd().split("\n").map(printable);
+  const removed = result.removedPolicies ?? [];
+  if (result.dryRun) {
+    for (const warning of result.warnings)
+      context.output.warn(`\u26A0 ${printable(warning)}`);
+    context.output.result({ projectId, ...result, file: null }, [
+      ...sqlLines,
+      `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
+      ...result.policies.map((policy) => policyLine(policy, true)),
+      ...removed.map((policy) => removedLine(policy, true))
+    ]);
+    return;
+  }
+  const allWarnings = result.name === name ? result.warnings : [...result.warnings, migrationNameMismatch(name, result.name)];
+  let file = null;
+  let fileWarning;
+  const relDir = relativeToCwd(context, dir);
+  const rel = join3(relDir === "." ? "" : relDir, name);
+  if (context.flags.noWrite) {
+    fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
+  } else {
+    try {
+      mkdirSync3(dir, { recursive: true });
+      writeFileSync3(join3(dir, name), result.sql, { flag: "wx" });
+      file = rel;
+    } catch (error) {
+      const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
+      fileWarning = `Applied, but ${rel} could not be written: ${reason}. Save the SQL above as ${rel} so naro db push and naro db reset see it.`;
+    }
+  }
+  for (const warning of allWarnings)
+    context.output.warn(`\u26A0 ${printable(warning)}`);
+  if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
+  context.output.result(
+    {
+      projectId,
+      ...result,
+      warnings: allWarnings,
+      file,
+      ...fileWarning ? { fileWarning } : {}
+    },
+    [
+      ...sqlLines,
+      file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
+      ...result.policies.map((policy) => policyLine(policy)),
+      ...removed.map((policy) => removedLine(policy, false))
+    ]
+  );
+}
+function columnsFlag(context) {
+  return context.flags.columns ?? [];
+}
+async function runDbTableUsage() {
+  throw new NaroError("VALIDATION_FAILED", USAGE2.table);
+}
+async function runDbIndexUsage() {
+  throw new NaroError("VALIDATION_FAILED", USAGE2.index);
+}
+async function runDbTableCreate(context) {
+  const [table] = context.positionals;
+  const specs = columnsFlag(context);
+  if (!table || specs.length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.create);
+  const columns = specs.map(parseColumnSpec);
+  const owner = context.flags.ownerColumn;
+  await runSchemaChange(context, [
+    {
+      op: "createTable",
+      table,
+      columns,
+      ...context.flags.ifNotExists ? { ifNotExists: true } : {},
+      ...owner === void 0 ? {} : { owner: { column: owner } }
+    }
+  ]);
+}
+async function runDbTableAddColumn(context) {
+  const [table] = context.positionals;
+  const specs = columnsFlag(context);
+  const [spec] = specs;
+  if (!table || spec === void 0 || specs.length !== 1)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
+  await runSchemaChange(context, [
+    { op: "addColumn", table, column: parseColumnSpec(spec) }
+  ]);
+}
+async function runDbTableRenameColumn(context) {
+  const [table, column, to] = context.positionals;
+  if (!table || !column || !to)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
+  await runSchemaChange(context, [{ op: "renameColumn", table, column, to }]);
+}
+async function runDbTableRename(context) {
+  const [table, to] = context.positionals;
+  if (!table || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table, to }]);
+}
+async function runDbTableDropColumn(context) {
+  const [table, column] = context.positionals;
+  if (!table || !column)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
+  const target = `${table}.${column}`;
+  await runSchemaChange(
+    context,
+    [{ op: "dropColumn", table, column, confirm: target }],
+    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
+  );
+}
+async function runDbTableDrop(context) {
+  const [table] = context.positionals;
+  if (!table) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  await runSchemaChange(
+    context,
+    [{ op: "dropTable", table, confirm: table }],
+    `Drop table ${printable(table)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+  );
+}
+async function runDbIndexCreate(context) {
+  const [table, list] = context.positionals;
+  const columns = listFlag(list);
+  if (!table || columns.length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
+  const name = context.flags.name;
+  await runSchemaChange(context, [
+    {
+      op: "createIndex",
+      table,
+      columns,
+      ...context.flags.unique ? { unique: true } : {},
+      ...name === void 0 ? {} : { name }
+    }
+  ]);
+}
+async function runDbIndexDrop(context) {
+  const [name] = context.positionals;
+  if (!name) throw new NaroError("VALIDATION_FAILED", USAGE2.indexDrop);
+  await runSchemaChange(context, [{ op: "dropIndex", name }]);
 }
 
 // src/commands/git.ts
-var defaults = {
+var defaults2 = {
   detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
   openBrowser,
-  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms))
+  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
 };
 function connected(context, project) {
   const branch = project.defaultBranch;
@@ -589,7 +2309,7 @@ function connected(context, project) {
   );
 }
 async function runGitConnect(context, overrides = {}) {
-  const deps = { ...defaults, ...overrides };
+  const deps = { ...defaults2, ...overrides };
   const { output } = context;
   const explicit = context.positionals[0];
   let fullName;
@@ -640,7 +2360,7 @@ async function waitForInstall(context, projectId, fullName, deps) {
   if (teamSlug) {
     const attempts = deps.pollAttempts ?? 60;
     const interval = deps.pollIntervalMs ?? 3e3;
-    for (let attempt = 0; attempt < attempts; attempt += 1) {
+    for (let attempt2 = 0; attempt2 < attempts; attempt2 += 1) {
       await deps.sleep(interval);
       let reachable = false;
       try {
@@ -676,7 +2396,7 @@ async function runGitDisconnect(context) {
   ]);
 }
 async function offerAutoDeploy(context, projectId, overrides) {
-  const deps = { ...defaults, ...overrides };
+  const deps = { ...defaults2, ...overrides };
   if (overrides.canPrompt === false) return;
   try {
     if (readProjectLink(context.cwd)?.autoDeployDeclined === true) return;
@@ -1057,8 +2777,8 @@ async function runInspect(context) {
 }
 
 // src/commands/domains.ts
-var defaults2 = {
-  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
+var defaults3 = {
+  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
   now: () => Date.now()
 };
 var FIRST_DELAY_MS = 5e3;
@@ -1206,7 +2926,7 @@ async function verifyAll(client, projectId, hostname, auto = false) {
   return verified;
 }
 async function runDomainsVerify(context, overrides = {}) {
-  const deps = { ...defaults2, ...overrides };
+  const deps = { ...defaults3, ...overrides };
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const hostname = context.positionals[0];
@@ -1301,8 +3021,8 @@ async function runDomainsRemove(context) {
 }
 
 // src/commands/env.ts
-import { existsSync, writeFileSync } from "fs";
-import { join } from "path";
+import { existsSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join4 } from "path";
 var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseTarget(value) {
@@ -1370,199 +3090,74 @@ async function runEnvAdd(context) {
     `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
   ]);
 }
-async function runEnvRemove(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env remove KEY [production|preview|all]"
-  );
-  const [key, targetArg] = context.positionals;
-  const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
-  await confirmOrAbort(
-    context,
-    `Remove ${String(key)}${target ? ` (${target})` : ""} from this project?`
-  );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const removed = await client.env.remove(projectId, key, target);
-  context.output.result({ projectId, key, removed }, [
-    `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
-  ]);
-}
-async function runEnvPull(context) {
-  const file = context.positionals[0] ?? ".env.local";
-  const surface = context.flags.env === "production" ? "production" : "preview";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--env must be production or preview."
-    );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const rows = await client.env.list(projectId, { reveal: true });
-  const selected = rows.filter(
-    (row) => row.target === "all" || row.target === surface
-  );
-  const vars = Object.fromEntries(
-    selected.map((row) => [row.key, row.value ?? ""])
-  );
-  const path = join(context.cwd, file);
-  if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
-    const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
-    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
-  }
-  writeFileSync(
-    path,
-    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
-${serializeDotenv(vars)}`,
-    { mode: 384 }
-  );
-  context.output.result(
-    { projectId, file, environment: surface, count: selected.length },
-    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
-  );
-}
-
-// src/commands/gen.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname, resolve as resolve2 } from "path";
-
-// src/commands/migration.ts
-import { mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, relative } from "path";
-var processStdin2 = {
-  stdinIsTty: () => process.stdin.isTTY === true,
-  readStdin
-};
-function migrationsDir(context) {
-  return resolveMigrationsDir({
-    baseDir: context.cwd,
-    rootDirectory: context.flags.root,
-    dir: context.flags.dir
-  });
-}
-function relativeToCwd(context, path) {
-  const rel = relative(context.cwd, path);
-  return rel === "" ? "." : rel;
-}
-async function appliedMigrations(client, projectId) {
-  try {
-    return await client.db.migrations(projectId);
-  } catch (error) {
-    if (isNaroError(error) && error.code === "DATABASE_NOT_READY") return [];
-    throw error;
-  }
-}
-function printable(text) {
-  let out = "";
-  for (const char of text) {
-    const code = char.charCodeAt(0);
-    const control = code < 32 || code >= 127 && code <= 159;
-    out += control ? "?" : char;
-  }
-  return out;
-}
-function warningLine(warning) {
-  if (warning === "out-of-order")
-    return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
-  if (warning === "ledger-name-missing-extension")
-    return "  \u26A0 recorded without .sql in the ledger";
-  return null;
-}
-async function runMigrationNew(context, deps = processStdin2) {
-  const [name] = context.positionalOrThrow(
-    1,
-    "Usage: naro migration new <name>"
-  );
-  const dir = migrationsDir(context);
-  const fileName = nextMigrationFileName(
-    listMigrationFiles(dir),
-    name
-  );
-  mkdirSync(dir, { recursive: true });
-  const piped = !deps.stdinIsTty() ? await deps.readStdin() : "";
-  const fromStdin = piped.length > 0;
-  const body = fromStdin ? piped.endsWith("\n") ? piped : `${piped}
-` : `-- Migration: ${fileName}
-`;
-  const path = join2(dir, fileName);
-  writeFileSync2(path, body, { flag: "wx" });
-  const relPath = relativeToCwd(context, path);
-  context.output.result({ file: fileName, path: relPath, fromStdin }, [
-    `\u2705 Created ${relPath}`
-  ]);
-}
-async function runMigrationList(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const migrations = compareMigrations(local, ledger);
-  const relDir = relativeToCwd(context, dir);
-  const lines = migrations.length === 0 ? ["No migrations yet. Create one with `naro migration new <name>`."] : [
-    `Migrations in ${relDir} (${String(migrations.length)}):`,
-    ...migrations.flatMap((row) => {
-      const line = `  ${row.status.padEnd(12)}${printable(row.name)}${row.appliedAt ? `  ${printable(row.appliedAt)}` : ""}`;
-      const warning = warningLine(row.warning);
-      return warning ? [line, warning] : [line];
-    })
-  ];
-  context.output.result({ projectId, dir: relDir, migrations }, lines);
-}
-async function runMigrationUp(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = compareMigrations(local, ledger).filter((row) => row.status === "pending").map((row) => row.name);
-  if (pending.length === 0) {
-    context.output.result({ projectId, applied: [], pending: [] }, [
-      "No pending migrations."
-    ]);
-    return;
-  }
-  if (context.flags.dryRun) {
-    context.output.result({ projectId, dryRun: true, pending }, [
-      `Pending migrations (${String(pending.length)}):`,
-      ...pending.map((name) => `  ${printable(name)}`)
-    ]);
-    return;
-  }
-  context.output.log(`Pending migrations (${String(pending.length)}):`);
-  for (const name of pending) context.output.log(`  ${printable(name)}`);
+async function runEnvRemove(context) {
+  context.positionalOrThrow(
+    1,
+    "Usage: naro env remove KEY [production|preview|all]"
+  );
+  const [key, targetArg] = context.positionals;
+  const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
   await confirmOrAbort(
     context,
-    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
+    `Remove ${String(key)}${target ? ` (${target})` : ""} from this project?`
   );
-  const applied = [];
-  for (const name of pending) {
-    const sql = readFileSync2(join2(dir, name), "utf8");
-    try {
-      await client.db.applyMigration(projectId, { name, sql });
-    } catch (error) {
-      if (!isNaroError(error)) throw error;
-      const shown = context.output.json ? name : printable(name);
-      throw new NaroError(error.code, `${shown}: ${error.message}`, {
-        ...error.status === void 0 ? {} : { status: error.status },
-        details: { ...error.details, migration: name, applied },
-        cause: error
-      });
-    }
-    context.output.log(`\u2713 ${printable(name)}`);
-    applied.push(name);
-  }
-  context.output.result({ projectId, applied, pending: [] }, [
-    `\u2705 Applied ${String(applied.length)} migration(s).`
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const removed = await client.env.remove(projectId, key, target);
+  context.output.result({ projectId, key, removed }, [
+    `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
   ]);
 }
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = context.flags.env === "production" ? "production" : "preview";
+  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production or preview."
+    );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const rows = await client.env.list(projectId, { reveal: true });
+  const selected = rows.filter(
+    (row) => row.target === "all" || row.target === surface
+  );
+  const vars = Object.fromEntries(
+    selected.map((row) => [row.key, row.value ?? ""])
+  );
+  const path = join4(context.cwd, file);
+  if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
+    const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
+    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  }
+  writeFileSync4(
+    path,
+    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
+${serializeDotenv(vars)}`,
+    { mode: 384 }
+  );
+  context.output.result(
+    { projectId, file, environment: surface, count: selected.length },
+    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+  );
+}
 
 // src/commands/gen.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
 async function runGenTypes(context) {
+  const { lang } = context.flags;
+  if (lang !== void 0 && lang !== "typescript")
+    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
-  const types = generateTypes(tables);
+  const read = await policiesForTypes(client, projectId);
+  const types = generateTypes(
+    tables,
+    read.policies === void 0 ? {} : { policies: read.policies }
+  );
   const undescribed = tables.flatMap(
     (table) => table.error === void 0 ? [] : [{ name: table.name, error: table.error }]
   );
@@ -1570,11 +3165,18 @@ async function runGenTypes(context) {
     context.output.warn(
       `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
     );
-  const extra = undescribed.length > 0 ? { undescribed } : {};
+  if (read.policies === void 0)
+    context.output.warn(
+      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
+    );
+  const extra = {
+    ...undescribed.length > 0 ? { undescribed } : {},
+    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
+  };
   if (context.flags.output) {
-    const path = resolve2(context.cwd, context.flags.output);
-    mkdirSync2(dirname(path), { recursive: true });
-    writeFileSync3(path, types);
+    const path = resolve3(context.cwd, context.flags.output);
+    mkdirSync4(dirname2(path), { recursive: true });
+    writeFileSync5(path, types);
     context.output.result(
       {
         projectId,
@@ -1596,7 +3198,7 @@ async function runGenTypes(context) {
 // src/commands/logs.ts
 var FOLLOW_INTERVAL_MS = 3e3;
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function formatBuildLog(log) {
   return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
@@ -1720,6 +3322,666 @@ async function runLogs(context) {
   await buildLogs(context, client, target);
 }
 
+// src/commands/policy.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+
+// ../../packages/naro-sdk/src/query/filters.ts
+var MAX_FILTER_DEPTH = 4;
+var OPERATORS = {
+  eq: "eq",
+  neq: "neq",
+  gt: "gt",
+  gte: "gte",
+  lt: "lt",
+  lte: "lte",
+  in: "in",
+  is: "is",
+  like: "like",
+  ilike: "ilike",
+  contains: "contains",
+  containedBy: "containedBy",
+  overlaps: "overlaps",
+  cs: "contains",
+  cd: "containedBy",
+  ov: "overlaps"
+};
+function operatorOf(name) {
+  return typeof name === "string" && Object.hasOwn(OPERATORS, name) ? OPERATORS[name] : void 0;
+}
+var Refusal = class extends Error {
+};
+function refuse(reason) {
+  throw new Refusal(reason);
+}
+var LIST_HINT = {
+  in: ["(", ")", "needs a list in parentheses, like in.(a,b),"],
+  array: ["{", "}", "needs a list in braces, like cs.{a,b},"]
+};
+function isSpace(char) {
+  return char !== "" && char.trim() === "";
+}
+function looseWord(text) {
+  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "");
+}
+var Parser = class {
+  constructor(text, tokens = {}) {
+    this.text = text;
+    this.tokens = tokens;
+  }
+  index = 0;
+  /**
+   * A token at the next value, followed only by spaces and then one of
+   * `stops` or the end — `auth.uid()x` is text, not the token.
+   */
+  token(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    for (const [word, value] of Object.entries(this.tokens)) {
+      if (!this.text.startsWith(word, at)) continue;
+      let end = at + word.length;
+      while (isSpace(this.text[end] ?? "")) end++;
+      const next = this.text[end] ?? "";
+      if (next !== "" && !stops.includes(next)) continue;
+      this.index = end;
+      return { value, word, at };
+    }
+    return void 0;
+  }
+  at() {
+    return this.text[this.index] ?? "";
+  }
+  /**
+   * An unquoted value that is one of the tokens misspelled — `auth.uid`,
+   * `AUTH.UID` — is refused: read as text it would compare with the words
+   * themselves (사용자 리뷰 반영). Quoted, it is the text.
+   */
+  notNearToken(value, at) {
+    const loose = looseWord(value);
+    for (const word of Object.keys(this.tokens))
+      if (loose !== "" && loose === looseWord(word))
+        refuse(
+          `has ${JSON.stringify(value)} ${this.where(at)}: did you mean ${word}? Quote it to mean the text`
+        );
+  }
+  /** `scalar`, with an unquoted value held to notNearToken. */
+  bareOrQuoted(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    const quoted = this.at() === '"';
+    const text = this.scalar(stops);
+    if (!quoted) this.notNearToken(text, at);
+    return { text, quoted };
+  }
+  where(index = this.index) {
+    return `at character ${String(index + 1)}`;
+  }
+  skipSpaces() {
+    while (isSpace(this.at())) this.index++;
+  }
+  /** `item ("," item)*`, up to a `)` or the end, inside `level` groups. */
+  list(level) {
+    const nodes = [];
+    for (; ; ) {
+      nodes.push(this.item(level));
+      this.skipSpaces();
+      const char = this.at();
+      if (char === ",") this.index++;
+      else if (char === ")" || char === "") return nodes;
+      else refuse(`has unexpected text ${this.where()}`);
+    }
+  }
+  item(level) {
+    this.skipSpaces();
+    const start = this.index;
+    const char = this.at();
+    if (char === "" || char === "," || char === ")")
+      refuse(`has an empty item ${this.where()}`);
+    const group = /^(not\.)?(and|or)\(/.exec(this.text.slice(start));
+    if (!group) return this.leaf(level);
+    const negated = group[1] !== void 0;
+    const inner = level + (negated ? 2 : 1);
+    if (inner > MAX_FILTER_DEPTH)
+      refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
+    const open = start + group[0].length - 1;
+    this.index = open + 1;
+    const children = this.list(inner);
+    if (this.at() !== ")") refuse(`has an unclosed "(" ${this.where(open)}`);
+    this.index++;
+    const node = group[2] === "or" ? { or: children } : { and: children };
+    return negated ? { not: node } : node;
+  }
+  /** `column.[not.]operator.value`. */
+  leaf(level) {
+    const start = this.index;
+    const column = this.at() === '"' ? this.quoted() : this.word().trim();
+    if (column === "" || this.at() !== ".")
+      refuse(`needs column.operator.value ${this.where(start)}`);
+    this.index++;
+    let nameAt = this.index;
+    let name = this.word();
+    let negated = false;
+    if (name === "not" && this.at() === ".") {
+      if (level + 1 > MAX_FILTER_DEPTH)
+        refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
+      negated = true;
+      this.index++;
+      nameAt = this.index;
+      name = this.word();
+    }
+    const operator = operatorOf(name);
+    if (this.at() !== ".") {
+      if (name !== "" && operator === void 0)
+        refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+      refuse(`needs column.operator.value ${this.where(start)}`);
+    }
+    if (operator === void 0)
+      refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+    this.index++;
+    const leaf = { operator, column, value: this.value(operator) };
+    return negated ? { not: leaf } : leaf;
+  }
+  /** Up to the next `.`, `,`, `(`, `)` or the end. */
+  word() {
+    const start = this.index;
+    while (this.index < this.text.length && !".,()".includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index);
+  }
+  /** `"…"`, with `\` making the next character literal. */
+  quoted() {
+    const start = this.index;
+    this.index++;
+    let text = "";
+    for (; ; ) {
+      if (this.index >= this.text.length)
+        refuse(`has an unclosed quote ${this.where(start)}`);
+      const char = this.at();
+      this.index++;
+      if (char === '"') return text;
+      if (char === "\\" && this.index < this.text.length) {
+        text += this.at();
+        this.index++;
+      } else text += char;
+    }
+  }
+  /** A quoted value, or everything up to `stops`, trimmed. */
+  scalar(stops) {
+    this.skipSpaces();
+    if (this.at() === '"') {
+      const text = this.quoted();
+      this.skipSpaces();
+      if (this.at() !== "" && !stops.includes(this.at()))
+        refuse(`has text after a closing quote ${this.where()}`);
+      return text;
+    }
+    const start = this.index;
+    while (this.index < this.text.length && !stops.includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index).trim();
+  }
+  /**
+   * `(a,b)` for `in`: text values, except that an unquoted `true` or `false`
+   * is a boolean (사용자 리뷰 반영, as in `eq`). `{a,b}` for the array
+   * operators: text, except that an unquoted exact decimal is a number
+   * (적대적 리뷰 반영, narrowed by 사용자 리뷰 반영) — json_each's values
+   * have no type affinity to turn the text "1" into 1, so as text `cs.{1}`
+   * matched no numeric array and `not.ov.{1}` matched every row. Quoted,
+   * `"1"` and `"true"` stay text.
+   */
+  listValue(kind) {
+    const [open, close, hint] = LIST_HINT[kind];
+    this.skipSpaces();
+    const openAt = this.index;
+    if (this.at() !== open) refuse(`${hint} ${this.where()}`);
+    this.index++;
+    this.skipSpaces();
+    const values = [];
+    if (this.at() === close) {
+      this.index++;
+      return values;
+    }
+    for (; ; ) {
+      this.skipSpaces();
+      const itemAt = this.index;
+      const token = this.token(`,${close}`);
+      if (token) values.push(token.value);
+      else {
+        const { text: value, quoted } = this.bareOrQuoted(`,${close}`);
+        if (!quoted && value === "") {
+          if (this.index >= this.text.length)
+            refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
+          refuse(`has an empty item ${this.where(itemAt)}`);
+        }
+        values.push(
+          quoted ? value : kind === "array" ? exactNumber(value) : truth(value)
+        );
+      }
+      if (this.index >= this.text.length)
+        refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
+      const char = this.at();
+      this.index++;
+      if (char === close) return values;
+    }
+  }
+  /** The value after `operator.`. */
+  value(operator) {
+    const start = this.index;
+    switch (operator) {
+      case "in":
+        return this.listValue("in");
+      case "contains":
+      case "containedBy":
+      case "overlaps":
+        return this.listValue("array");
+      case "is":
+        return keyword(this.scalar(",)"), start);
+      case "like":
+      case "ilike": {
+        const token = this.token(",)");
+        if (token)
+          refuse(
+            `cannot use ${token.word} with ${operator} ${this.where(token.at)}`
+          );
+        return likePattern(this.bareOrQuoted(",)").text);
+      }
+      case "eq":
+      case "neq": {
+        const token = this.token(",)");
+        if (token) return token.value;
+        const { text, quoted } = this.bareOrQuoted(",)");
+        return quoted ? text : truth(text);
+      }
+      default: {
+        const token = this.token(",)");
+        return token ? token.value : this.bareOrQuoted(",)").text;
+      }
+    }
+  }
+};
+function likePattern(pattern) {
+  return pattern.replaceAll("*", "%");
+}
+function truth(text) {
+  const word = text.toLowerCase();
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return text;
+}
+var DECIMAL = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+function exactNumber(text) {
+  if (!DECIMAL.test(text)) return text;
+  const number = Number(text);
+  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
+  const trimmed = text.replace(/\.?0+$/, "");
+  return String(number) === trimmed ? number : text;
+}
+function quoteFilterValue(value) {
+  const text = String(value);
+  return `"${text.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function keyword(text, at) {
+  const word = text.toLowerCase();
+  if (word === "null") return null;
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return refuse(
+    `needs null, true or false after is at character ${String(at + 1)}`
+  );
+}
+function attempt(parse) {
+  try {
+    return { ok: true, node: parse() };
+  } catch (error) {
+    if (error instanceof Refusal) return { ok: false, reason: error.message };
+    throw error;
+  }
+}
+function parseLogic(text, kind, options = {}) {
+  if (typeof text !== "string")
+    return { ok: false, reason: "must be a filter string or a function" };
+  if (text.trim() === "") return { ok: false, reason: "must not be empty" };
+  return attempt(() => {
+    if (options.group === false) {
+      const alone = items(text, options.tokens, 0);
+      if (alone.length === 1 && alone[0]) return alone[0];
+    }
+    const nodes = items(text, options.tokens, 1);
+    return kind === "or" ? { or: nodes } : { and: nodes };
+  });
+}
+function items(text, tokens, level) {
+  const parser = new Parser(text, tokens);
+  const nodes = parser.list(level);
+  if (parser.at() === ")") refuse(`has an unmatched ")" ${parser.where()}`);
+  return nodes;
+}
+
+// src/commands/policy.ts
+var SET_USAGE = "Usage: naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>] [--owner <column>] [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>] [--update-check <filter>] [--delete-when <filter>] [--signed-in] | --from-file <policy.json>";
+var REMOVE_USAGE = "Usage: naro policy remove <table>";
+var RULE_FLAGS = {
+  select: "selectRule",
+  insert: "insertRule",
+  update: "updateRule",
+  delete: "deleteRule"
+};
+var WHEN_FLAGS = {
+  select: { key: "selectWhen", tree: "using" },
+  insert: { key: "insertWhen", tree: "check" },
+  update: { key: "updateWhen", tree: "using" },
+  delete: { key: "deleteWhen", tree: "using" }
+};
+var AUTH_UID = "auth.uid()";
+var OTHER_FLAGS = [
+  "selectRule",
+  "insertRule",
+  "updateRule",
+  "deleteRule",
+  "ownerColumn",
+  "selectWhen",
+  "insertWhen",
+  "updateWhen",
+  "updateCheck",
+  "deleteWhen",
+  "signedIn"
+];
+function isRule(value) {
+  return POLICY_RULES.includes(value);
+}
+function refuse2(message) {
+  throw new NaroError("VALIDATION_FAILED", message);
+}
+function flagName(key) {
+  return `--${key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}`;
+}
+function conditionTree(flag, text) {
+  const parsed = parseLogic(text, "and", {
+    tokens: { [AUTH_UID]: { auth: "uid" } },
+    group: false
+  });
+  if (!parsed.ok) refuse2(`${flag} ${parsed.reason}.`);
+  const tree = parsed.node;
+  const checked = parsePolicyNode(tree, "");
+  if (!checked.ok) {
+    const path = checked.path.replace(/^\./, "");
+    refuse2(
+      path === "" ? `${flag} ${checked.reason}.` : `${flag}: ${path} ${checked.reason}.`
+    );
+  }
+  return tree;
+}
+function conditionsFrom(flags) {
+  const conditions = {};
+  for (const action of POLICY_ACTIONS) {
+    const { key, tree } = WHEN_FLAGS[action];
+    const text = flags[key];
+    if (text === void 0) continue;
+    const flag = flagName(key);
+    if (flags[RULE_FLAGS[action]] !== void 0)
+      refuse2(`--${action} and ${flag} cannot be used together.`);
+    const condition = { [tree]: conditionTree(flag, text) };
+    if (action === "update" && flags.updateCheck !== void 0)
+      condition.check = conditionTree("--update-check", flags.updateCheck);
+    if (flags.signedIn) condition.role = "authenticated";
+    conditions[action] = condition;
+  }
+  if (flags.updateCheck !== void 0 && flags.updateWhen === void 0)
+    refuse2("--update-check needs --update-when.");
+  if (flags.signedIn && Object.keys(conditions).length === 0)
+    refuse2(
+      "--signed-in needs --select-when, --insert-when, --update-when or --delete-when."
+    );
+  return conditions;
+}
+function patchFromFile(context, path, table) {
+  let text;
+  try {
+    text = readFileSync3(resolve4(context.cwd, path), "utf8");
+  } catch {
+    refuse2(`Could not read ${path}.`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    refuse2(`${path} is not JSON.`);
+  }
+  if (typeof body !== "object" || body === null || Array.isArray(body))
+    refuse2(`${path} must hold a JSON object.`);
+  const { table: named, ...patch } = body;
+  if (Object.hasOwn(body, "table")) {
+    if (typeof named !== "string")
+      refuse2(`${path}: table must be a string, the table's name.`);
+    if (table !== void 0 && asciiLower(named) !== asciiLower(table))
+      refuse2(
+        `${path} is the policy of ${printable(named)}, not ${printable(table)}. Remove its "table" to set it on ${printable(table)}.`
+      );
+  }
+  const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
+  if (Object.keys(patch).some((key) => !allowed.has(key)))
+    refuse2(
+      `${path}: Only table, select, insert, update, delete and ownerColumn can be set.`
+    );
+  return patch;
+}
+function asciiLower(text) {
+  return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+}
+function policyPatch(flags, context, table) {
+  if (flags.fromFile !== void 0) {
+    if (OTHER_FLAGS.some(
+      (key) => flags[key] !== void 0 && flags[key] !== false
+    ))
+      refuse2(
+        "--from-file takes the whole policy: leave out the other policy options."
+      );
+    if (!context) refuse2(SET_USAGE);
+    return patchFromFile(context, flags.fromFile, table);
+  }
+  const patch = {};
+  for (const action of POLICY_ACTIONS) {
+    const value = flags[RULE_FLAGS[action]];
+    if (value === void 0) continue;
+    if (!isRule(value))
+      refuse2(`--${action} must be one of ${POLICY_RULES.join(", ")}.`);
+    patch[action] = value;
+  }
+  Object.assign(patch, conditionsFrom(flags));
+  if (flags.ownerColumn !== void 0) {
+    if (flags.ownerColumn.trim() === "") refuse2("--owner must name a column.");
+    patch.ownerColumn = flags.ownerColumn;
+  }
+  if (Object.keys(patch).length === 0)
+    refuse2(
+      `Set at least one of --select, --insert, --update, --delete, --owner, --select-when, --insert-when, --update-when, --delete-when or --from-file. ${SET_USAGE}`
+    );
+  return patch;
+}
+var SHORT = {
+  contains: "cs",
+  containedBy: "cd",
+  overlaps: "ov"
+};
+function isAuthUid(value) {
+  return typeof value === "object" && value !== null && value.auth === "uid";
+}
+function nearAuthUid(text) {
+  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "") === "auth.uid";
+}
+var DECIMAL2 = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+function readsAsNumber(value) {
+  const text = String(value);
+  if (!DECIMAL2.test(text) || !Object.is(Number(text), value)) return false;
+  return text.includes(".") || Number.isSafeInteger(value);
+}
+function stringText(value, slot) {
+  if (slot === "is") return void 0;
+  if (slot === "like" && value.includes("*")) return void 0;
+  const bare = value !== "" && value.trim() === value && !/[,()"{}\\]/.test(value) && !/^(?:true|false|null)$/i.test(value) && !nearAuthUid(value) && !(slot === "array" && DECIMAL2.test(value));
+  return bare ? value : quoteFilterValue(value);
+}
+function valueText(value, slot) {
+  if (isAuthUid(value))
+    return slot === "like" || slot === "is" ? void 0 : AUTH_UID;
+  if (value === null) return slot === "is" ? "null" : void 0;
+  if (typeof value === "boolean")
+    return slot === "is" || slot === "eq" || slot === "in" ? String(value) : void 0;
+  if (typeof value === "number")
+    return slot === "array" && readsAsNumber(value) ? String(value) : void 0;
+  if (typeof value === "string") return stringText(value, slot);
+  return void 0;
+}
+function columnText(name) {
+  if (name === "") return void 0;
+  return /[.,()"\s]/.test(name) ? quoteFilterValue(name) : name;
+}
+function slotOf(operator) {
+  if (operator === "eq" || operator === "neq") return "eq";
+  if (operator === "like" || operator === "ilike") return "like";
+  if (operator === "is") return "is";
+  return "ordered";
+}
+function leafText(leaf, negated) {
+  const column = columnText(leaf.column);
+  if (column === void 0) return void 0;
+  const prefix = `${column}.${negated ? "not." : ""}`;
+  const short = SHORT[leaf.operator];
+  if (leaf.operator === "in" || short !== void 0) {
+    if (!Array.isArray(leaf.value)) return void 0;
+    const slot = short === void 0 ? "in" : "array";
+    const items2 = leaf.value.map((item) => valueText(item, slot));
+    if (items2.some((item) => item === void 0)) return void 0;
+    const list = items2.join(",");
+    return slot === "in" ? `${prefix}in.(${list})` : `${prefix}${String(short)}.{${list}}`;
+  }
+  if (Array.isArray(leaf.value)) return void 0;
+  const text = valueText(leaf.value, slotOf(leaf.operator));
+  return text === void 0 ? void 0 : `${prefix}${leaf.operator}.${text}`;
+}
+function groupText(kind, children) {
+  const texts = children.map((child) => filterText(child, false));
+  if (texts.length === 0 || texts.some((text) => text === void 0))
+    return void 0;
+  return `${kind}(${texts.join(",")})`;
+}
+function filterText(node, top = true) {
+  if ("operator" in node) return leafText(node, false);
+  if ("not" in node) {
+    const inner = node.not;
+    if ("operator" in inner) return leafText(inner, true);
+    if ("or" in inner) return negatedText(groupText("or", inner.or));
+    if ("and" in inner) return negatedText(groupText("and", inner.and));
+    return void 0;
+  }
+  if ("or" in node) return groupText("or", node.or);
+  if (top && node.and.length > 1) {
+    const texts = node.and.map((child) => filterText(child, false));
+    return texts.some((text) => text === void 0) ? void 0 : texts.join(",");
+  }
+  return groupText("and", node.and);
+}
+function negatedText(text) {
+  return text === void 0 ? void 0 : `not.${text}`;
+}
+function isInvalid(value) {
+  return typeof value === "object" && "invalid" in value;
+}
+function cellOf(value) {
+  if (typeof value === "string") return value;
+  return isInvalid(value) ? "invalid" : "condition";
+}
+function conditionText(action, value) {
+  if (typeof value === "string") return value;
+  if (isInvalid(value))
+    return `cannot be read (${value.invalid}); it denies everyone but the service key`;
+  const using = value.using ? filterText(value.using) : "";
+  const check = value.check ? filterText(value.check) : "";
+  if (using === void 0 || check === void 0)
+    return `as JSON ${JSON.stringify(value)}`;
+  const parts = [];
+  if (using !== "") parts.push(`using ${using}`);
+  if (check !== "") parts.push(`check ${check}`);
+  else if (action === "update") parts.push("check = using");
+  const text = parts.join("; ");
+  return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
+}
+function policyTable(policies) {
+  const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
+  const rows = policies.map((policy) => [
+    printable(policy.table),
+    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
+    policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
+  ]);
+  const widths = header.map(
+    (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
+  );
+  const table = [header, ...rows].map(
+    (cells) => cells.map(
+      (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
+    ).join("  ").trimEnd()
+  );
+  const lines = policies.flatMap(
+    (policy) => POLICY_ACTIONS.filter((action) => typeof policy[action] !== "string").map(
+      (action) => ({
+        label: `${printable(policy.table)}.${action}`,
+        text: printable(conditionText(action, policy[action]))
+      })
+    )
+  );
+  if (lines.length === 0) return table;
+  const width = Math.max(...lines.map((line) => line.label.length));
+  return [
+    ...table,
+    "",
+    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
+  ];
+}
+async function runPolicyList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const policies = await client.backend.policies(projectId);
+  context.output.result(
+    { projectId, policies },
+    policies.length === 0 ? [
+      "No policies yet: every table denies anon and signed-in requests.",
+      "Open one with `naro policy set <table> --select public`."
+    ] : [
+      ...policyTable(policies),
+      "",
+      "Tables not listed deny anon and signed-in requests. The service key skips policies."
+    ]
+  );
+}
+async function runPolicySet(context) {
+  const [table] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const policy = await client.backend.setPolicy(
+    projectId,
+    table,
+    patch
+  );
+  context.output.result({ projectId, policy }, [
+    `\u2705 Saved the policy for ${printable(policy.table)}. It takes effect within about 10 seconds.`,
+    ...policyTable([policy])
+  ]);
+}
+async function runPolicyRemove(context) {
+  const [table] = context.positionalOrThrow(1, REMOVE_USAGE);
+  await confirmOrAbort(
+    context,
+    `Remove the policy for ${printable(table)}? Anon and signed-in requests to it are denied from then on.`
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const policy = await client.backend.removePolicy(projectId, table);
+  context.output.result({ projectId, removed: true, policy }, [
+    `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
+  ]);
+}
+
 // src/commands/projects.ts
 function productionUrl(subdomain) {
   return `https://${subdomain}.${new URL(controlPlaneUrl()).hostname}`;
@@ -1882,12 +4144,76 @@ Usage:
 
   naro db enable                     Create the project's database (Cloudflare D1)
   naro db info                       Database status, size, table count and limits
+       and today's writes against the daily write limit (UTC)
   naro db query <sql> | --file <f>   Run SQL against it (reads stdin when piped)
   naro db push [--dry-run]           Apply pending migrations from ./migrations (asks first; --yes to skip)
+  naro db dump [--output <f>]        Download a SQL dump of the database (stdout by default)
+       [--schema-only|--data-only] [--table a,b]  Cloudflare holds other queries until it finishes
+  naro db restore --bookmark <id>    Roll the database back (Time Travel, last 30 days; asks first)
+       | --timestamp <time> [--dry-run]  prints the command that undoes it
+  naro db pull [--dir <d>]           Write the remote schema as migrations/0001_remote_schema.sql
+                                     and record it as applied - a baseline (asks first)
+  naro db reset [--dir <d>]          Drop everything, clear the ledger, re-apply ./migrations
+       [--dry-run] [--yes]           (asks first; db restore --bookmark undoes it)
+  naro db lint [--strict]            Check the schema for what D1 actually trips on
+                                     (exits 1 on an error, --strict on a warning too)
+  naro db table create <name> --column <spec> [--column <spec>\u2026]
+       [--owner <column>] [--if-not-exists]  Create a table without SQL. <spec> is name:type[:modifier\u2026]:
+                                     types integer, real, text, blob, numeric, boolean, datetime, json;
+                                     modifiers pk, autoincrement, notnull, unique, default=<v>,
+                                     references=<table>.<column>, ondelete=cascade|set-null|\u2026
+                                     --owner adds that column (TEXT NOT NULL) and an owner policy
+  naro db table add-column <table> --column <spec>
+  naro db table rename-column <table> <column> <new-name>
+  naro db table rename <table> <new-name>
+  naro db table drop-column <table> <column>  Asks first (--yes to skip)
+  naro db table drop <table>         Asks first (--yes to skip)
+  naro db index create <table> <col[,col\u2026]> [--unique] [--name <name>]
+  naro db index drop <name>
+       Each runs as one migration in d1_migrations and is written to ./migrations
+       (--no-write skips the file; --dry-run prints the SQL and changes nothing)
   naro migration new <name>          Create migrations/NNNN_<name>.sql (stdin becomes the body when piped)
   naro migration list                Local vs applied migrations
   naro migration up [--dry-run]      Same as db push
-  naro gen types [--output <file>]   TypeScript types for the schema (stdout by default; TypeScript only)
+  naro migration repair <name>       Fix the ledger alone: mark a migration applied or
+       --status applied|reverted [--yes]  remove its row. Its SQL is never run (asks first)
+  naro gen types [--lang typescript] [--output <file>]
+                                     TypeScript types for the schema, for createClient<Database>()
+                                     from @naro/sdk (stdout by default)
+
+  naro backend [status]              On or off, status, URL and anon key (the service key stays hidden)
+  naro backend enable                Turn the backend on: D1, sign-in and the Data API (safe to re-run;
+                                     resumes a failed run; brings a turned-off one back with the same keys;
+                                     provision is the same command)
+  naro backend disable               Turn it off: in up to about 90 seconds the app's /_naro/* answers 404;
+                                     data, users and keys are kept (asks first; --yes to skip; re-run
+                                     finishes a turn-off that stopped half-way)
+  naro backend keys [--reveal]       API keys; --reveal prints the service key (a secret; needs database write)
+  naro backend keys rotate --anon|--service
+                                     Replace a key; the old one stops working at once (asks first)
+  naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs
+  naro backend auth email set --provider resend --from "App <no-reply@example.com>" --api-key-stdin
+                                     Confirmation and reset emails from your Resend account
+  naro backend auth email remove     Turn email off (asks first)
+  naro backend auth oauth set <google|github> --client-id <id> --client-secret-stdin
+  naro backend auth oauth remove <google|github>  Turn a provider off (asks first)
+  naro backend auth redirects [list]  Where sign-in may send the browser back to (the production
+                                     hosts always; a preview host only when added)
+  naro backend auth redirects add <url>  An origin, https://app.example.com, or only the pages
+                                     under a path, https://app.example.com/auth/ (http only for localhost)
+  naro backend auth redirects remove <url>
+                                     Exits 1, changing nothing, when <url> is not in the list
+  naro backend auth require-verification <on|off>
+                                     Refuse sign-in until the email is confirmed (needs email)
+  naro policy list                   Who the Data API lets through, per table (no policy = deny)
+  naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>]
+       [--owner <column>]            Rules: none | public | authenticated | owner (owner needs --owner)
+       [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>]
+       [--update-check <filter>] [--delete-when <filter>] [--signed-in]
+                                     Or a condition per action, in Supabase filter syntax;
+                                     auth.uid() is the signed-in user's id
+       [--from-file <policy.json>]   Or the whole policy as JSON
+  naro policy remove <table>         Back to deny for anon and signed-in requests (asks first)
 
   naro promote <deployment-id>       Publish a build to production
   naro rollback [deployment-id]      Roll production back to the previous build
@@ -1898,21 +4224,101 @@ Global options:
   --token <t>     Access token (or set NARO_TOKEN)
   --project <id>  Target project (overrides .naro/project.json)
   --root <dir>    App directory inside the repo (monorepos), e.g. apps/web
-  --name <name>   Project name for a first deploy (defaults to package.json)
+  --name <name>   Project name for a first deploy (defaults to package.json); the index name (naro db index create)
   --team <slug>   Team scope for project listing/linking
   --cwd <dir>     Run as if started in <dir>
   --prod          Deploy/target production
   --wait          Poll until the domain goes live (naro domains verify)
   --no-www        Register the apex alone (naro domains add)
   --file <path>   SQL file to run (naro db query)
-  --dry-run       List pending migrations without applying (naro db push)
-  --output <file> Write to a file instead of stdout (naro gen types)
+  --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
+  --output <file> Write to a file instead of stdout (naro gen types, db dump)
+  --lang <lang>   Language of the types; typescript, the default, is the only one (naro gen types)
   --dir <path>    Migrations directory (default ./migrations, or <--root>/migrations)
+  --strict        Fail on warnings too, not only errors (naro db lint)
+  --schema-only   Dump the schema without rows (naro db dump)
+  --data-only     Dump rows without the schema (naro db dump)
+  --table <a,b>   Dump only these tables, comma-separated (naro db dump)
+  --bookmark <id> Restore point: a bookmark from db dump or db restore (naro db restore)
+  --timestamp <time>  Restore point: RFC 3339 with a timezone, or Unix seconds (naro db restore)
+  --status <s>    applied or reverted (naro migration repair)
+  --reveal        Print secrets: env values (naro env list), the service key (naro backend keys)
+  --anon | --service  Which key to replace (naro backend keys rotate)
+  --provider <p>  Email provider; resend is the one (naro backend auth email set)
+  --from <address>  Sender, e.g. "App <no-reply@example.com>" (naro backend auth email set)
+  --client-id <id>  The OAuth app's client ID (naro backend auth oauth set)
+  --api-key-stdin | --client-secret-stdin
+                  Read the secret from stdin (a pipe, or a hidden prompt); never from argv
+  --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
+  --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
+  --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
+                  row must meet), --update-when, --delete-when likewise (naro policy set)
+  --update-check <filter>  What an updated row must still meet (default: --update-when)
+  --signed-in     The conditions given let signed-in users only (naro policy set)
+  --from-file <path>  The policy as JSON: the body PUT \u2026/backend/policies/<table> takes, or a policy --json printed (naro policy set)
+  --column <spec> A column, repeatable: name:type[:modifier\u2026] (naro db table create, add-column)
+  --if-not-exists Leave an existing table as it is (naro db table create)
+  --unique        Make the index unique (naro db index create)
+  --no-write      Apply, but write no migration file to ./migrations (naro db table, db index)
   --debug         Verbose diagnostics
 
 Credentials: \`naro login\` opens a browser (GitHub). CI: NARO_TOKEN=$(naro token).
 Set NARO_CONTROL_PLANE_URL to use a custom control plane (default https://naro.sh).
 `;
+var TABLE_ACTIONS = {
+  create: runDbTableCreate,
+  "add-column": runDbTableAddColumn,
+  "rename-column": runDbTableRenameColumn,
+  rename: runDbTableRename,
+  "drop-column": runDbTableDropColumn,
+  drop: runDbTableDrop
+};
+var INDEX_ACTIONS = {
+  create: runDbIndexCreate,
+  drop: runDbIndexDrop
+};
+function routeBackendAuth(words) {
+  const [area, action] = words;
+  const rest = words.slice(2);
+  switch (area) {
+    case void 0:
+    case "status":
+      return words.length <= 1 ? { handler: runBackendAuthStatus, positionals: [] } : null;
+    case "email":
+      if (action === "set")
+        return { handler: runBackendAuthEmailSet, positionals: rest };
+      if (action === "remove" || action === "rm")
+        return { handler: runBackendAuthEmailRemove, positionals: rest };
+      return null;
+    case "oauth":
+      if (action === "set")
+        return { handler: runBackendAuthOAuthSet, positionals: rest };
+      if (action === "remove" || action === "rm")
+        return { handler: runBackendAuthOAuthRemove, positionals: rest };
+      return null;
+    case "redirects":
+      switch (action) {
+        case void 0:
+        case "list":
+        case "ls":
+          return { handler: runBackendAuthRedirectsList, positionals: rest };
+        case "add":
+          return { handler: runBackendAuthRedirectsAdd, positionals: rest };
+        case "remove":
+        case "rm":
+          return { handler: runBackendAuthRedirectsRemove, positionals: rest };
+        default:
+          return null;
+      }
+    case "require-verification":
+      return {
+        handler: runBackendAuthRequireVerification,
+        positionals: words.slice(1)
+      };
+    default:
+      return null;
+  }
+}
 function route(parsed) {
   const { command, positionals } = parsed;
   const sub = positionals[0];
@@ -2000,6 +4406,28 @@ function route(parsed) {
           return { handler: runDbQuery, positionals: positionals.slice(1) };
         case "push":
           return { handler: runMigrationUp, positionals: positionals.slice(1) };
+        case "dump":
+          return { handler: runDbDump, positionals: positionals.slice(1) };
+        case "restore":
+          return { handler: runDbRestore, positionals: positionals.slice(1) };
+        case "pull":
+          return { handler: runDbPull, positionals: positionals.slice(1) };
+        case "reset":
+          return { handler: runDbReset, positionals: positionals.slice(1) };
+        case "lint":
+          return { handler: runDbLint, positionals: positionals.slice(1) };
+        case "table":
+        case "index": {
+          const actions = sub === "table" ? TABLE_ACTIONS : INDEX_ACTIONS;
+          const action = positionals[1];
+          if (action === void 0)
+            return {
+              handler: sub === "table" ? runDbTableUsage : runDbIndexUsage,
+              positionals: []
+            };
+          const handler = Object.hasOwn(actions, action) ? actions[action] : void 0;
+          return handler ? { handler, positionals: positionals.slice(2) } : null;
+        }
         default:
           return null;
       }
@@ -2019,6 +4447,60 @@ function route(parsed) {
           };
         case "up":
           return { handler: runMigrationUp, positionals: positionals.slice(1) };
+        case "repair":
+          return {
+            handler: runMigrationRepair,
+            positionals: positionals.slice(1)
+          };
+        default:
+          return null;
+      }
+    case "backend":
+      switch (sub) {
+        case void 0:
+        case "info":
+        case "status":
+          return { handler: runBackendInfo, positionals: positionals.slice(1) };
+        // `provision` is enable's first name (toggle spec §2.6).
+        case "enable":
+        case "provision":
+          return {
+            handler: runBackendEnable,
+            positionals: positionals.slice(1)
+          };
+        case "disable":
+          return {
+            handler: runBackendDisable,
+            positionals: positionals.slice(1)
+          };
+        case "keys":
+          if (positionals[1] === void 0)
+            return { handler: runBackendKeys, positionals: [] };
+          if (positionals[1] === "rotate")
+            return {
+              handler: runBackendKeysRotate,
+              positionals: positionals.slice(2)
+            };
+          return null;
+        case "auth":
+          return routeBackendAuth(positionals.slice(1));
+        default:
+          return null;
+      }
+    case "policy":
+      switch (sub) {
+        case void 0:
+        case "list":
+        case "ls":
+          return { handler: runPolicyList, positionals: positionals.slice(1) };
+        case "set":
+          return { handler: runPolicySet, positionals: positionals.slice(1) };
+        case "remove":
+        case "rm":
+          return {
+            handler: runPolicyRemove,
+            positionals: positionals.slice(1)
+          };
         default:
           return null;
       }
@@ -2044,8 +4526,8 @@ function route(parsed) {
 function version() {
   try {
     const pkg = JSON.parse(
-      readFileSync3(
-        join3(dirname2(fileURLToPath(import.meta.url)), "..", "package.json"),
+      readFileSync4(
+        join5(dirname3(fileURLToPath(import.meta.url)), "..", "package.json"),
         "utf8"
       )
     );
@@ -2081,7 +4563,7 @@ async function main(argv = process.argv.slice(2)) {
     output.fail(
       new NaroError(
         "VALIDATION_FAILED",
-        `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`
+        secretFlagProblem(parsed.unknown) ?? `Unknown option: ${parsed.unknown.join(", ")}. See \`naro help\`.`
       )
     );
     return;