naro-cli 0.9.1 → 0.11.0

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
   NaroClient,
   NaroError,
@@ -9,6 +10,7 @@ import {
   buildResetPlan,
   cellText,
   clearSession,
+  commentText,
   compareMigrations,
   controlPlaneUrl,
   countLintedTables,
@@ -33,11 +35,14 @@ import {
   openBrowser,
   parseGitHubRemote,
   parsePolicyNode,
+  parsePolicyStatement,
   parseRedirectEntry,
   pendingMigrationNames,
   policiesForTypes,
   projectPath,
   promptForMissingEnv,
+  quoteIdent,
+  quotePolicyName,
   readProjectLink,
   refreshStoredSession,
   removeProjectLink,
@@ -48,11 +53,12 @@ import {
   schemaMigrationTitle,
   serializeDotenv,
   slugify,
+  splitPolicyStatements,
   summarizeStatement,
   systemTablePredicate,
   toNaroError,
   writeProjectLink
-} from "./chunk-Z757IOF3.js";
+} from "./chunk-L7JOGWP3.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -82,8 +88,10 @@ var BOOLEAN_FLAGS = {
   "--unique": "unique",
   "--no-write": "noWrite",
   "--signed-in": "signedIn",
+  "--allow-unindexed": "allowUnindexed",
   "--api-key-stdin": "apiKeyStdin",
-  "--client-secret-stdin": "clientSecretStdin"
+  "--client-secret-stdin": "clientSecretStdin",
+  "--password-stdin": "passwordStdin"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -120,7 +128,11 @@ var STRING_FLAGS = {
   "--from-file": "fromFile",
   "--provider": "provider",
   "--from": "from",
-  "--client-id": "clientId"
+  "--client-id": "clientId",
+  "--username": "username",
+  "--email": "email",
+  "--password": "password",
+  "--min-length": "minLength"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -571,6 +583,9 @@ function printable(text) {
   }
   return out;
 }
+function isPrintable(text) {
+  return printable(text) === text;
+}
 function warningLine(warning) {
   if (warning === "out-of-order")
     return "  \u26A0 older than an applied migration \u2014 db push will still apply it";
@@ -985,12 +1000,24 @@ var AUTH_USAGE = {
   oauth: "Usage: naro backend auth oauth set google|github --client-id <id> --client-secret-stdin",
   oauthRemove: "Usage: naro backend auth oauth remove google|github",
   redirect: "Usage: naro backend auth redirects add|remove <url>",
-  verification: "Usage: naro backend auth require-verification on|off"
+  verification: "Usage: naro backend auth require-verification on|off",
+  signups: "Usage: naro backend auth signups on|off",
+  password: "Usage: naro backend auth password --min-length <n>"
 };
+var MIN_LENGTH_FLOOR = 6;
+var MIN_LENGTH_CEILING = 128;
 function sentence2(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
+function stoppedMessage(backend) {
+  const step = backend.step ?? "worker";
+  const reason = backend.error?.trim() ? `: ${sentence2(backend.error)}` : ".";
+  if (BACKEND_STEPS.indexOf(step) > BACKEND_STEPS.indexOf("worker"))
+    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`naro backend enable\` to finish.`;
+  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`naro backend enable\` puts the saved ones on it.`;
+}
+var NOT_APPLIED_WARNING = "\u26A0 These are the saved settings. The Naro worker's last update did not get past its upload, so it may still run older ones \u2014 run `naro backend enable` to put these on it.";
 function authLines(auth) {
   const lines = [
     auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
@@ -1003,7 +1030,9 @@ function authLines(auth) {
   }
   lines.push(
     `Redirects:   ${[`${productionOrigins(auth).join(", ")} (production hosts, always)`, ...auth.redirectOrigins].join(", ")}`,
-    `Email verification: ${auth.requireEmailVerification ? "required to sign in" : "not required"}`
+    `Email verification: ${auth.requireEmailVerification ? "required to sign in" : "not required"}`,
+    `Sign-ups:    ${auth.signupsEnabled ? "open" : "closed (only `naro backend users create` makes accounts)"}`,
+    `Minimum password length: ${String(auth.passwordMinLength)}`
   );
   return lines;
 }
@@ -1026,9 +1055,9 @@ function adviceLines2(auth) {
     "Redirect URIs to register with each provider \u2014 the one for the origin your app passes to createClient({ url }):"
   );
   for (const provider of ["google", "github"]) {
-    const label = `  ${LABELS[provider]}: `;
+    const label2 = `  ${LABELS[provider]}: `;
     callbacksOf(auth, provider).forEach(
-      (url, index) => lines.push(`${index === 0 ? label : " ".repeat(label.length)}${url}`)
+      (url, index) => lines.push(`${index === 0 ? label2 : " ".repeat(label2.length)}${url}`)
     );
   }
   return lines;
@@ -1037,6 +1066,7 @@ async function runBackendAuthStatus(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
+  if (auth.applied === false) context.output.warn(NOT_APPLIED_WARNING);
   context.output.result({ projectId, auth }, [
     ...authLines(auth),
     ...adviceLines2(auth)
@@ -1066,17 +1096,22 @@ async function change(context, send, done, after) {
         "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
         { cause: error }
       );
+    const saved = isNaroError(error) ? error.details?.auth : void 0;
+    if (isNaroError(error) && error.code === "BACKEND_PROVISION_FAILED" && typeof saved === "object" && saved !== null) {
+      for (const line of authLines(saved))
+        context.output.log(line);
+      throw new NaroError(error.code, error.message, {
+        details: { projectId, ...error.details }
+      });
+    }
     throw error;
   }
   const { auth, backend } = answer;
   if (backend.status === "error") {
     for (const line of authLines(auth)) context.output.log(line);
-    const step = backend.step ? `the ${backend.step} step` : "a step";
-    throw new NaroError(
-      "BACKEND_PROVISION_FAILED",
-      `Saved, but updating the Naro worker stopped at ${step}${backend.error ? `: ${sentence2(backend.error)}` : "."} Run \`naro backend enable\` to finish.`,
-      { details: { projectId, auth, backend } }
-    );
+    throw new NaroError("BACKEND_PROVISION_FAILED", stoppedMessage(backend), {
+      details: { projectId, auth, backend }
+    });
   }
   if (backend.status !== "ready")
     context.output.warn(
@@ -1272,6 +1307,199 @@ async function runBackendAuthRequireVerification(context) {
     ]
   );
 }
+async function runBackendAuthSignups(context) {
+  const [value] = context.positionals;
+  if (value !== "on" && value !== "off")
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.signups);
+  const open = value === "on";
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, { signupsEnabled: open }),
+    [
+      open ? "\u2705 Sign-ups are open: anyone can create an account, by email or with Google or GitHub." : "\u2705 Sign-ups are closed: sign-up answers 403 SIGNUPS_DISABLED, and a first Google or GitHub sign-in is refused. Existing users still sign in; create accounts with `naro backend users create`."
+    ]
+  );
+}
+async function runBackendAuthPassword(context) {
+  const given = context.flags.minLength;
+  if (given === void 0 || context.positionals.length > 0)
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.password);
+  const length = /^\d{1,3}$/.test(given) ? Number(given) : Number.NaN;
+  if (!Number.isInteger(length) || length < MIN_LENGTH_FLOOR || length > MIN_LENGTH_CEILING)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--min-length must be a whole number from ${String(MIN_LENGTH_FLOOR)} to ${String(MIN_LENGTH_CEILING)}. ${AUTH_USAGE.password}`
+    );
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, { passwordMinLength: length }),
+    [
+      `\u2705 New passwords take at least ${String(length)} characters: sign-up, password reset and \`naro backend users create\`. Passwords set before still sign in.`
+    ]
+  );
+}
+
+// src/commands/backend-users.ts
+var USERS_USAGE = {
+  create: "Usage: naro backend users create (--username <name> | --email <address>) (--password-stdin | --password <password>)",
+  delete: "Usage: naro backend users delete <id|username|email> [--yes]"
+};
+var PASSWORD_FLAG_WARNING = "\u26A0 --password puts the password in your shell history. Pipe it in with --password-stdin instead.";
+var OUTDATED_MESSAGE = "This project's backend is older than user management. Run `naro backend enable` once to update this project's backend. Then run this command again.";
+var PAGE_SIZE = 1e3;
+var processStdin3 = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+async function usersCall(call) {
+  try {
+    return await call();
+  } catch (error) {
+    if (isNaroError(error) && error.code === "BACKEND_OUTDATED")
+      throw new NaroError("BACKEND_OUTDATED", OUTDATED_MESSAGE, {
+        ...error.status !== void 0 ? { status: error.status } : {},
+        cause: error
+      });
+    throw error;
+  }
+}
+async function allUsers(client, projectId) {
+  const users = [];
+  let total = 0;
+  for (let page = 1; ; page++) {
+    const listed = await usersCall(
+      () => client.backend.listUsers(projectId, { page, perPage: PAGE_SIZE })
+    );
+    total = listed.total;
+    users.push(...listed.users);
+    if (listed.users.length < PAGE_SIZE || users.length >= total)
+      return { users, total };
+  }
+}
+function orDash(value) {
+  return value === null ? "-" : printable(value);
+}
+function label(user) {
+  return printable(user.username ?? user.email ?? user.id);
+}
+function userTable(users) {
+  const rows = users.map((user) => [
+    printable(user.id),
+    orDash(user.username),
+    orDash(user.email),
+    user.emailVerified ? "yes" : "no",
+    printable(user.createdAt)
+  ]);
+  const header = ["ID", "USERNAME", "EMAIL", "VERIFIED", "CREATED"];
+  const widths = header.map(
+    (title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0))
+  );
+  return [header, ...rows].map(
+    (row) => row.map(
+      (cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)
+    ).join("  ")
+  );
+}
+async function runBackendUsersList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { users, total } = await allUsers(client, projectId);
+  context.output.result(
+    { projectId, users, total },
+    users.length === 0 ? [
+      "No users yet. Create one with `naro backend users create --username <name> --password-stdin`."
+    ] : [
+      `${String(total)} ${total === 1 ? "user" : "users"}, newest first:`,
+      ...userTable(users)
+    ]
+  );
+}
+async function passwordOf(context, input) {
+  const { password, passwordStdin } = context.flags;
+  if (password !== void 0 && passwordStdin)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Pass the password one way: --password-stdin or --password. ${USERS_USAGE.create}`
+    );
+  if (password !== void 0) {
+    context.output.warn(PASSWORD_FLAG_WARNING);
+    if (password === "")
+      throw new NaroError("VALIDATION_FAILED", "The password is empty.");
+    return password;
+  }
+  if (!passwordStdin)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Pass the password on stdin with --password-stdin. ${USERS_USAGE.create}`
+    );
+  const value = input.stdinIsTty() ? await context.prompter.askHidden("? Password: ") : await input.readStdin();
+  if (value === "")
+    throw new NaroError("VALIDATION_FAILED", "No password came in on stdin.");
+  return value;
+}
+function userLines(user) {
+  return [
+    `ID:          ${printable(user.id)}`,
+    `Username:    ${orDash(user.username)}`,
+    `Email:       ${orDash(user.email)}`,
+    `Verified:    ${user.emailVerified ? "yes" : "no"}`,
+    `Created:     ${printable(user.createdAt)}`
+  ];
+}
+async function runBackendUsersCreate(context, input = processStdin3) {
+  const { username, email } = context.flags;
+  if (username === void 0 && email === void 0 || context.positionals.length > 0)
+    throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
+  const password = await passwordOf(context, input);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const body = { password };
+  if (username !== void 0) body.username = username;
+  if (email !== void 0) body.email = email;
+  const user = await usersCall(
+    () => client.backend.createUser(projectId, body)
+  );
+  const signIn = user.username === null ? "naro.auth.signIn({ email, password })" : `naro.auth.signIn({ username: ${JSON.stringify(printable(user.username))}, password })`;
+  context.output.result({ projectId, user }, [
+    `\u2705 Created user ${label(user)}. It signs in at once with ${signIn}.`,
+    ...userLines(user)
+  ]);
+}
+function find(users, given) {
+  const byId = users.find((user) => user.id === given);
+  if (byId) return byId;
+  const wanted = given.toLowerCase();
+  return users.find(
+    (user) => given.includes("@") ? user.email?.toLowerCase() === wanted : user.username?.toLowerCase() === wanted
+  );
+}
+async function runBackendUsersDelete(context) {
+  const [given] = context.positionals;
+  if (given === void 0 || context.positionals.length > 1)
+    throw new NaroError("VALIDATION_FAILED", USERS_USAGE.delete);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { users } = await allUsers(client, projectId);
+  const user = find(users, given);
+  if (!user)
+    throw new NaroError(
+      "USER_NOT_FOUND",
+      `No user has the id, username or email ${printable(given)}. \`naro backend users\` lists them.`
+    );
+  const named = user.id === label(user) ? label(user) : `${label(user)} (${printable(user.id)})`;
+  await confirmOrAbort(
+    context,
+    `Delete the user ${named}? Their sessions end at once and the account cannot be brought back.`
+  );
+  const deleted = await usersCall(
+    () => client.backend.deleteUser(projectId, user.id)
+  );
+  context.output.result({ projectId, user: deleted }, [
+    `\u2705 Deleted user ${named}. Their sessions have ended.`
+  ]);
+}
 
 // src/commands/cancel.ts
 async function runCancel(context) {
@@ -1300,7 +1528,7 @@ async function runCancel(context) {
 // src/commands/db.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve } from "path";
-var processStdin3 = {
+var processStdin4 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1418,7 +1646,7 @@ async function readSql(context, deps) {
     throw new NaroError("VALIDATION_FAILED", USAGE);
   return sql;
 }
-async function runDbQuery(context, deps = processStdin3) {
+async function runDbQuery(context, deps = processStdin4) {
   const sql = await readSql(context, deps);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -1682,7 +1910,7 @@ async function runDbRestore(context) {
     target = resolved.bookmark;
     at = resolved.timestamp ?? given.timestamp;
   }
-  const label = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
+  const label2 = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
   if (context.flags.dryRun) {
     context.output.result(
       {
@@ -1690,13 +1918,13 @@ async function runDbRestore(context) {
         bookmark: target,
         ...at === null ? {} : { timestamp: at }
       },
-      [`Would restore to ${label}. Nothing was changed.`]
+      [`Would restore to ${label2}. Nothing was changed.`]
     );
     return;
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore the project database to ${label2}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -1999,1987 +2227,2207 @@ async function runDbReset(context) {
 // src/commands/db-schema.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3 } from "path";
-var USAGE2 = {
-  table: "Usage: naro db table create|add-column|rename-column|rename|drop-column|drop \u2026 (see naro help)",
-  index: "Usage: naro db index create|drop \u2026 (see naro help)",
-  create: "Usage: naro db table create <name> --column <spec> [--column <spec>\u2026] [--owner <column>] [--if-not-exists]",
-  addColumn: "Usage: naro db table add-column <table> --column <spec>",
-  renameColumn: "Usage: naro db table rename-column <table> <column> <new-name>",
-  rename: "Usage: naro db table rename <table> <new-name>",
-  dropColumn: "Usage: naro db table drop-column <table> <column>",
-  drop: "Usage: naro db table drop <table>",
-  indexCreate: "Usage: naro db index create <table> <column[,column\u2026]> [--unique] [--name <name>]",
-  indexDrop: "Usage: naro db index drop <name>"
+
+// src/commands/policy.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+
+// ../../packages/naro-sdk/src/query/filters.ts
+var MAX_FILTER_DEPTH = 4;
+var OPERATORS = {
+  eq: "eq",
+  neq: "neq",
+  gt: "gt",
+  gte: "gte",
+  lt: "lt",
+  lte: "lte",
+  in: "in",
+  is: "is",
+  like: "like",
+  ilike: "ilike",
+  contains: "contains",
+  containedBy: "containedBy",
+  overlaps: "overlaps",
+  cs: "contains",
+  cd: "containedBy",
+  ov: "overlaps"
 };
-var SPEC_USAGE = '--column needs name:type, e.g. --column "title:text:notnull".';
-var ON_DELETE = {
-  cascade: "CASCADE",
-  "set-null": "SET NULL",
-  "set-default": "SET DEFAULT",
-  restrict: "RESTRICT",
-  "no-action": "NO ACTION"
+function operatorOf(name) {
+  return typeof name === "string" && Object.hasOwn(OPERATORS, name) ? OPERATORS[name] : void 0;
+}
+var Refusal = class extends Error {
 };
-var KEYWORDS = /* @__PURE__ */ new Set(["CURRENT_TIMESTAMP", "CURRENT_DATE", "CURRENT_TIME"]);
-var NUMBER = /^-?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
-function segments(spec) {
-  const parts = [];
-  let current = "";
-  let quoted = false;
-  for (const char of spec) {
-    if (char === "'") quoted = !quoted;
-    if (char === ":" && !quoted) {
-      parts.push(current);
-      current = "";
-      continue;
-    }
-    current += char;
-  }
-  if (quoted) return null;
-  parts.push(current);
-  return parts;
+function refuse(reason) {
+  throw new Refusal(reason);
 }
-function defaultValue(text) {
-  if (text.length >= 2 && text.startsWith("'") && text.endsWith("'"))
-    return text.slice(1, -1).replace(/''/g, "'");
-  const lower = text.toLowerCase();
-  if (lower === "null") return null;
-  if (lower === "true") return true;
-  if (lower === "false") return false;
-  const upper = text.toUpperCase();
-  if (KEYWORDS.has(upper)) return { keyword: upper };
-  if (NUMBER.test(text)) return Number(text);
-  return text;
+var LIST_HINT = {
+  in: ["(", ")", "needs a list in parentheses, like in.(a,b),"],
+  array: ["{", "}", "needs a list in braces, like cs.{a,b},"]
+};
+function isSpace(char) {
+  return char !== "" && char.trim() === "";
 }
-function parseColumnSpec(spec) {
-  const shown = `--column "${printable(spec)}"`;
-  const parts = segments(spec);
-  if (parts === null)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      `${shown}: a quoted default is not closed.`
-    );
-  const [name, type, ...modifiers] = parts;
-  if (!name || !type) throw new NaroError("VALIDATION_FAILED", SPEC_USAGE);
-  const column = {
-    name,
-    type
-  };
-  let onDelete;
-  for (const modifier of modifiers) {
-    const eq = modifier.indexOf("=");
-    const key = (eq < 0 ? modifier : modifier.slice(0, eq)).toLowerCase();
-    const value = eq < 0 ? void 0 : modifier.slice(eq + 1);
-    if (value === void 0 && key === "pk") column.primaryKey = true;
-    else if (value === void 0 && key === "autoincrement")
-      column.autoIncrement = true;
-    else if (value === void 0 && key === "notnull") column.notNull = true;
-    else if (value === void 0 && key === "unique") column.unique = true;
-    else if (value !== void 0 && key === "default")
-      column.default = defaultValue(value);
-    else if (value !== void 0 && key === "references") {
-      const dot = value.lastIndexOf(".");
-      const table = dot < 0 ? "" : value.slice(0, dot);
-      const target = dot < 0 ? "" : value.slice(dot + 1);
-      if (!table || !target)
-        throw new NaroError(
-          "VALIDATION_FAILED",
-          `${shown}: references needs <table>.<column>.`
-        );
-      column.references = { table, column: target };
-    } else if (value !== void 0 && key === "ondelete") {
-      onDelete = ON_DELETE[value.toLowerCase()];
-      if (!onDelete)
-        throw new NaroError(
-          "VALIDATION_FAILED",
-          `${shown}: ondelete takes cascade, set-null, set-default, restrict or no-action.`
-        );
-    } else
-      throw new NaroError(
-        "VALIDATION_FAILED",
-        `${shown}: unknown modifier ${printable(modifier)}. Use pk, autoincrement, notnull, unique, default=<value>, references=<table>.<column> or ondelete=<action>.`
-      );
+function looseWord(text) {
+  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "");
+}
+var Parser = class {
+  constructor(text, tokens = {}) {
+    this.text = text;
+    this.tokens = tokens;
   }
-  if (onDelete !== void 0) {
-    if (!column.references)
-      throw new NaroError(
-        "VALIDATION_FAILED",
-        `${shown}: ondelete needs references=<table>.<column>.`
-      );
-    column.references.onDelete = onDelete;
+  index = 0;
+  /**
+   * A token at the next value, followed only by spaces and then one of
+   * `stops` or the end — `auth.uid()x` is text, not the token.
+   */
+  token(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    for (const [word, value] of Object.entries(this.tokens)) {
+      if (!this.text.startsWith(word, at)) continue;
+      let end = at + word.length;
+      while (isSpace(this.text[end] ?? "")) end++;
+      const next = this.text[end] ?? "";
+      if (next !== "" && !stops.includes(next)) continue;
+      this.index = end;
+      return { value, word, at };
+    }
+    return void 0;
   }
-  return column;
-}
-function policyLine(policy, dryRun = false) {
-  const rules = [policy.select, policy.insert, policy.update, policy.delete];
-  const owner = policy.ownerColumn === null ? "" : ` (owner column ${printable(policy.ownerColumn)})`;
-  const uniform = rules.every((rule) => rule === rules[0]);
-  const summary = uniform ? `${String(rules[0])} for select, insert, update and delete` : `select ${policy.select}, insert ${policy.insert}, update ${policy.update}, delete ${policy.delete}`;
-  const head = dryRun ? "Would set the Data API policy" : "\u2713 Data API policy";
-  return `${head} on ${printable(policy.table)}: ${summary}${owner}.`;
-}
-function removedLine(policy, dryRun) {
-  const owner = policy.ownerColumn === null ? "" : `, owner column ${printable(policy.ownerColumn)}`;
-  const rules = `select ${policy.select}, insert ${policy.insert}, update ${policy.update}, delete ${policy.delete}${owner}`;
-  return `${dryRun ? "Would remove" : "\u2713 Removed"} the Data API policy on ${printable(policy.table)} (${rules}).`;
-}
-async function runSchemaChange(context, operations, question) {
-  const dryRun = context.flags.dryRun === true;
-  if (question !== void 0 && !dryRun)
-    await confirmOrAbort(context, question);
-  const sent = dryRun ? operations.map((operation) => {
-    if (operation.op !== "dropTable" && operation.op !== "dropColumn")
-      return operation;
-    const { confirm: _confirm, ...rest } = operation;
-    return rest;
-  }) : operations;
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const dir = migrationsDir(context);
-  const local = listMigrationFiles(dir);
-  const ledger = await appliedMigrations(client, projectId);
-  const pending = pendingMigrationNames(local, ledger);
-  if (pending.length > 0 && !dryRun)
-    throw migrationsPendingError(pending.map(printable));
-  const name = nextMigrationFileName(
-    [...local, ...ledger.map((row) => row.name)],
-    schemaMigrationTitle(operations[0] ?? {})
-  );
-  const result = await client.db.schema(projectId, sent, {
-    ...dryRun ? { dryRun: true } : {},
-    name
-  });
-  const sqlLines = result.sql.trimEnd().split("\n").map(printable);
-  const removed = result.removedPolicies ?? [];
-  if (result.dryRun) {
-    for (const warning of result.warnings)
-      context.output.warn(`\u26A0 ${printable(warning)}`);
-    context.output.result({ projectId, ...result, file: null }, [
-      ...sqlLines,
-      `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
-      ...result.policies.map((policy) => policyLine(policy, true)),
-      ...removed.map((policy) => removedLine(policy, true))
-    ]);
-    return;
-  }
-  const allWarnings = result.name === name ? result.warnings : [...result.warnings, migrationNameMismatch(name, result.name)];
-  let file = null;
-  let fileWarning;
-  const relDir = relativeToCwd(context, dir);
-  const rel = join3(relDir === "." ? "" : relDir, name);
-  if (context.flags.noWrite) {
-    fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
-  } else {
-    try {
-      mkdirSync3(dir, { recursive: true });
-      writeFileSync3(join3(dir, name), result.sql, { flag: "wx" });
-      file = rel;
-    } catch (error) {
-      const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
-      fileWarning = `Applied, but ${rel} could not be written: ${reason}. Save the SQL above as ${rel} so naro db push and naro db reset see it.`;
-    }
+  at() {
+    return this.text[this.index] ?? "";
   }
-  for (const warning of allWarnings)
-    context.output.warn(`\u26A0 ${printable(warning)}`);
-  if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
-  context.output.result(
-    {
-      projectId,
-      ...result,
-      warnings: allWarnings,
-      file,
-      ...fileWarning ? { fileWarning } : {}
-    },
-    [
-      ...sqlLines,
-      file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
-      ...result.policies.map((policy) => policyLine(policy)),
-      ...removed.map((policy) => removedLine(policy, false))
-    ]
-  );
-}
-function columnsFlag(context) {
-  return context.flags.columns ?? [];
-}
-async function runDbTableUsage() {
-  throw new NaroError("VALIDATION_FAILED", USAGE2.table);
-}
-async function runDbIndexUsage() {
-  throw new NaroError("VALIDATION_FAILED", USAGE2.index);
-}
-async function runDbTableCreate(context) {
-  const [table] = context.positionals;
-  const specs = columnsFlag(context);
-  if (!table || specs.length === 0)
-    throw new NaroError("VALIDATION_FAILED", USAGE2.create);
-  const columns = specs.map(parseColumnSpec);
-  const owner = context.flags.ownerColumn;
-  await runSchemaChange(context, [
-    {
-      op: "createTable",
-      table,
-      columns,
-      ...context.flags.ifNotExists ? { ifNotExists: true } : {},
-      ...owner === void 0 ? {} : { owner: { column: owner } }
-    }
-  ]);
-}
-async function runDbTableAddColumn(context) {
-  const [table] = context.positionals;
-  const specs = columnsFlag(context);
-  const [spec] = specs;
-  if (!table || spec === void 0 || specs.length !== 1)
-    throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
-  await runSchemaChange(context, [
-    { op: "addColumn", table, column: parseColumnSpec(spec) }
-  ]);
-}
-async function runDbTableRenameColumn(context) {
-  const [table, column, to] = context.positionals;
-  if (!table || !column || !to)
-    throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
-  await runSchemaChange(context, [{ op: "renameColumn", table, column, to }]);
-}
-async function runDbTableRename(context) {
-  const [table, to] = context.positionals;
-  if (!table || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
-  await runSchemaChange(context, [{ op: "renameTable", table, to }]);
-}
-async function runDbTableDropColumn(context) {
-  const [table, column] = context.positionals;
-  if (!table || !column)
-    throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
-  const target = `${table}.${column}`;
-  await runSchemaChange(
-    context,
-    [{ op: "dropColumn", table, column, confirm: target }],
-    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
-  );
-}
-async function runDbTableDrop(context) {
-  const [table] = context.positionals;
-  if (!table) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
-  await runSchemaChange(
-    context,
-    [{ op: "dropTable", table, confirm: table }],
-    `Drop table ${printable(table)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
-  );
-}
-async function runDbIndexCreate(context) {
-  const [table, list] = context.positionals;
-  const columns = listFlag(list);
-  if (!table || columns.length === 0)
-    throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
-  const name = context.flags.name;
-  await runSchemaChange(context, [
-    {
-      op: "createIndex",
-      table,
-      columns,
-      ...context.flags.unique ? { unique: true } : {},
-      ...name === void 0 ? {} : { name }
-    }
-  ]);
-}
-async function runDbIndexDrop(context) {
-  const [name] = context.positionals;
-  if (!name) throw new NaroError("VALIDATION_FAILED", USAGE2.indexDrop);
-  await runSchemaChange(context, [{ op: "dropIndex", name }]);
-}
-
-// src/commands/git.ts
-var defaults2 = {
-  detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
-  openBrowser,
-  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
-};
-function connected(context, project) {
-  const branch = project.defaultBranch;
-  context.output.result(
-    {
-      projectId: project.id,
-      repositoryFullName: project.repositoryFullName,
-      autoDeploy: true
-    },
-    [
-      `\u2705 Connected to ${project.repositoryFullName ?? "the repository"}.`,
-      `   Pushes to ${branch} now deploy automatically.`,
-      "",
-      "   To turn this off: naro git disconnect"
-    ]
-  );
-}
-async function runGitConnect(context, overrides = {}) {
-  const deps = { ...defaults2, ...overrides };
-  const { output } = context;
-  const explicit = context.positionals[0];
-  let fullName;
-  if (explicit) {
-    const parsed = parseGitHubRemote(explicit) ?? parseGitHubRemote(`https://github.com/${explicit}`);
-    if (!parsed)
-      throw new NaroError(
-        "VALIDATION_FAILED",
-        `"${explicit}" is not an owner/repo pair.`
-      );
-    fullName = parsed.fullName;
-  } else {
-    const remote = await deps.detectRemote(context.cwd);
-    const parsed = remote ? parseGitHubRemote(remote) : null;
-    if (!parsed) {
-      throw new NaroError(
-        "NO_GIT_REMOTE",
-        remote ? `Could not read a GitHub owner/repo from "${remote}". Pass it directly: naro git connect <owner/repo>` : "This directory has no GitHub origin remote. Pass one directly: naro git connect <owner/repo>"
-      );
-    }
-    fullName = parsed.fullName;
+  /**
+   * An unquoted value that is one of the tokens misspelled — `auth.uid`,
+   * `AUTH.UID` — is refused: read as text it would compare with the words
+   * themselves (사용자 리뷰 반영). Quoted, it is the text.
+   */
+  notNearToken(value, at) {
+    const loose = looseWord(value);
+    for (const word of Object.keys(this.tokens))
+      if (loose !== "" && loose === looseWord(word))
+        refuse(
+          `has ${JSON.stringify(value)} ${this.where(at)}: did you mean ${word}? Quote it to mean the text`
+        );
   }
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const first = await client.projects.connectGit(projectId, fullName);
-  if (first.ok) {
-    connected(context, first.project);
-    return;
+  /** `scalar`, with an unquoted value held to notNearToken. */
+  bareOrQuoted(stops) {
+    this.skipSpaces();
+    const at = this.index;
+    const quoted = this.at() === '"';
+    const text = this.scalar(stops);
+    if (!quoted) this.notNearToken(text, at);
+    return { text, quoted };
   }
-  if (!first.installUrl) {
-    throw new NaroError(
-      "REPOSITORY_NOT_ACCESSIBLE",
-      `Naro cannot reach ${fullName}, and no install URL was offered. Connect it from the dashboard.`
-    );
+  where(index = this.index) {
+    return `at character ${String(index + 1)}`;
   }
-  output.log(`
-\u25B8 Naro needs access to ${fullName}.`);
-  output.log(`  Opening ${first.installUrl}`);
-  deps.openBrowser(first.installUrl);
-  output.log("  Waiting for the installation to finish...\n");
-  await waitForInstall(context, projectId, fullName, deps);
-}
-async function waitForInstall(context, projectId, fullName, deps) {
-  const client = await context.client();
-  const project = await client.projects.get(projectId);
-  const teams = await client.teams.list();
-  const teamSlug = teams.find((team) => team.id === project.teamId)?.slug;
-  if (teamSlug) {
-    const attempts = deps.pollAttempts ?? 60;
-    const interval = deps.pollIntervalMs ?? 3e3;
-    for (let attempt2 = 0; attempt2 < attempts; attempt2 += 1) {
-      await deps.sleep(interval);
-      let reachable = false;
-      try {
-        const repositories = await client.github.listRepositories(teamSlug);
-        reachable = repositories.some(
-          (repository) => repository.fullName.toLowerCase() === fullName.toLowerCase()
-        );
-      } catch {
-      }
-      if (!reachable) continue;
-      const retry = await client.projects.connectGit(projectId, fullName);
-      if (retry.ok) {
-        connected(context, retry.project);
-        return;
-      }
-    }
+  skipSpaces() {
+    while (isSpace(this.at())) this.index++;
   }
-  context.output.result(
-    { projectId, repositoryFullName: null, autoDeploy: false },
-    [
-      `\u25B8 Still waiting on access to ${fullName}.`,
-      "  Finish the installation, then run: naro git connect"
-    ]
-  );
-}
-async function runGitDisconnect(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const project = await client.projects.disconnectGit(projectId);
-  context.output.result({ projectId: project.id, autoDeploy: false }, [
-    `\u2705 ${project.name} no longer deploys on push.`,
-    "   Deploy from here with: naro deploy"
-  ]);
-}
-async function offerAutoDeploy(context, projectId, overrides) {
-  const deps = { ...defaults2, ...overrides };
-  if (overrides.canPrompt === false) return;
-  try {
-    if (readProjectLink(context.cwd)?.autoDeployDeclined === true) return;
-    const connection = overrides.gitConnection;
-    if (connection.state === "connected" || connection.state === "none") return;
-    const fullName = connection.fullName;
-    if (!fullName) return;
-    let wanted;
-    if (connection.state === "unreachable") {
-      const installed = connection.installedAccounts ?? [];
-      context.output.log(
-        `
-\u25B8 Automatic deploys need the Naro GitHub App on \`${connection.repoOwner ?? fullName}\`.`
-      );
-      if (overrides.teamSlug && installed.length > 0)
-        context.output.log(
-          `  Team ${overrides.teamSlug} has it on: ${installed.join(", ")}.`
-        );
-      wanted = await context.prompter.confirm(
-        "Install it for this team now? (opens your browser)"
-      );
-    } else {
-      wanted = await context.prompter.confirm(
-        "Should your changes deploy automatically from now on?"
-      );
-    }
-    if (!wanted) {
-      const link = readProjectLink(context.cwd);
-      writeProjectLink(context.cwd, {
-        ...link ?? { projectId },
-        autoDeployDeclined: true
-      });
-      context.output.log(
-        "\u25B8 Not now. Later, if you change your mind: naro git connect"
-      );
-      return;
-    }
-    const client = await context.client();
-    const result = await client.projects.connectGit(projectId, fullName);
-    if (result.ok) {
-      connected(context, result.project);
-      return;
+  /** `item ("," item)*`, up to a `)` or the end, inside `level` groups. */
+  list(level) {
+    const nodes = [];
+    for (; ; ) {
+      nodes.push(this.item(level));
+      this.skipSpaces();
+      const char = this.at();
+      if (char === ",") this.index++;
+      else if (char === ")" || char === "") return nodes;
+      else refuse(`has unexpected text ${this.where()}`);
     }
-    if (!result.installUrl) return;
-    context.output.log(`
-\u25B8 Naro needs access to ${fullName}.`);
-    context.output.log(`  Opening ${result.installUrl}`);
-    deps.openBrowser(result.installUrl);
-    context.output.log("  Waiting for the installation to finish...\n");
-    await waitForInstall(context, projectId, fullName, deps);
-  } catch (error) {
-    context.output.log(
-      `\u25B8 Could not set up automatic deploys (${error instanceof Error ? error.message : String(error)}).`
-    );
-    context.output.log("  Try later with: naro git connect");
-  }
-}
-
-// src/commands/link.ts
-var SWITCH_ACCOUNT = "Sign in as a different account\u2026";
-async function resolveTeam(context, teams, deps = {}) {
-  const explicit = context.flags.team ?? process.env.NARO_TEAM;
-  if (explicit) {
-    const match = teams.find((team) => team.slug === explicit);
-    if (!match)
-      throw new NaroError(
-        "NOT_FOUND",
-        `You are not a member of team "${explicit}".`
-      );
-    return match;
-  }
-  const linked = context.projectLink();
-  if (linked?.teamSlug) {
-    const match = teams.find((team) => team.slug === linked.teamSlug);
-    if (match) return match;
   }
-  if (teams.length === 0)
-    throw new NaroError("NOT_FOUND", "Your account has no teams yet.");
-  const only = teams.length === 1 ? teams[0] : null;
-  const deploying = (deps.intent ?? "deploy") === "deploy";
-  if (only && !deploying) return only;
-  const canPrompt = deps.canPrompt?.() ?? (!context.flags.json && !context.flags.yes && isInteractive());
-  if (!canPrompt)
-    throw new NaroError(
-      "TEAM_REQUIRED",
-      `Cannot pick a team without a prompt. Pass --team <slug>, set NARO_TEAM, or run \`naro link\` first.
-  Your teams: ${teams.map((team) => team.slug).join(", ")}`
-    );
-  const account = deps.accountLabel ? await deps.accountLabel() : "this account";
-  if (only) {
-    const label = only.isPersonal ? `${only.name} (personal)` : only.name;
-    context.output.log(`
-   ${account} \u2192 ${label}`);
-    const ok = await context.prompter.confirm(
-      "Deploy to this account and team?"
-    );
-    if (ok) return only;
-    return switchAndRetry(context, deps);
+  item(level) {
+    this.skipSpaces();
+    const start = this.index;
+    const char = this.at();
+    if (char === "" || char === "," || char === ")")
+      refuse(`has an empty item ${this.where()}`);
+    const group = /^(not\.)?(and|or)\(/.exec(this.text.slice(start));
+    if (!group) return this.leaf(level);
+    const negated = group[1] !== void 0;
+    const inner = level + (negated ? 2 : 1);
+    if (inner > MAX_FILTER_DEPTH)
+      refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
+    const open = start + group[0].length - 1;
+    this.index = open + 1;
+    const children = this.list(inner);
+    if (this.at() !== ")") refuse(`has an unclosed "(" ${this.where(open)}`);
+    this.index++;
+    const node = group[2] === "or" ? { or: children } : { and: children };
+    return negated ? { not: node } : node;
   }
-  const options = [
-    ...teams.map(
-      (team) => `${team.name}${team.isPersonal ? "  (personal)" : ""}`
-    ),
-    SWITCH_ACCOUNT
-  ];
-  const index = await context.prompter.select(
-    deploying ? `Deploying as ${account} \u2014 which team owns this project?` : `Signed in as ${account}. Which team?`,
-    options
-  );
-  const picked = teams[index];
-  if (picked) return picked;
-  return switchAndRetry(context, deps);
-}
-async function switchAndRetry(context, deps) {
-  if (!deps.switchAccount || !deps.listTeams)
-    throw new NaroError(
-      "CANCELED",
-      "Canceled. Switch accounts with `naro logout && naro login`."
-    );
-  await deps.switchAccount();
-  const teams = await deps.listTeams();
-  return resolveTeam(context, teams, deps);
-}
-function saveLink(context, project, teamSlug) {
-  writeProjectLink(context.cwd, {
-    projectId: project.id,
-    teamSlug,
-    projectName: project.name
-  });
-  if (ensureGitignoreHasNaro(context.cwd))
-    context.output.log("\u25B8 added .naro to .gitignore");
-}
-async function runLink(context) {
-  const client = await context.client();
-  const teams = await client.teams.list();
-  const team = await resolveTeam(context, teams, { intent: "read" });
-  const projects = await client.projects.list(team.slug);
-  let project;
-  if (context.flags.project) {
-    project = projects.find(
-      (candidate) => candidate.id === context.flags.project
-    );
-    if (!project) {
-      project = await client.projects.get(context.flags.project);
+  /** `column.[not.]operator.value`. */
+  leaf(level) {
+    const start = this.index;
+    const column = this.at() === '"' ? this.quoted() : this.word().trim();
+    if (column === "" || this.at() !== ".")
+      refuse(`needs column.operator.value ${this.where(start)}`);
+    this.index++;
+    let nameAt = this.index;
+    let name = this.word();
+    let negated = false;
+    if (name === "not" && this.at() === ".") {
+      if (level + 1 > MAX_FILTER_DEPTH)
+        refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
+      negated = true;
+      this.index++;
+      nameAt = this.index;
+      name = this.word();
     }
-  } else if (context.flags.name) {
-    project = projects.find(
-      (candidate) => candidate.name === context.flags.name || candidate.slug === context.flags.name
-    );
-    if (!project)
-      throw new NaroError(
-        "PROJECT_NOT_FOUND",
-        `No project named "${context.flags.name}" in team ${team.slug}. Run \`naro deploy\` to create it.`
-      );
-  } else {
-    const guess = slugify(context.cwd.split("/").at(-1) ?? "app");
-    const exact = projects.find(
-      (candidate) => candidate.name === guess || candidate.slug === guess
-    );
-    if (exact && (context.flags.yes || context.flags.json)) {
-      project = exact;
-    } else if (projects.length === 0) {
-      throw new NaroError(
-        "PROJECT_NOT_FOUND",
-        `Team ${team.slug} has no projects yet. Run \`naro deploy\` to create one.`
-      );
-    } else {
-      const options = projects.map(
-        (candidate) => `${candidate.name} (${candidate.subdomain})`
-      );
-      const index = await context.prompter.select(
-        `Link ${context.cwd} to which project?`,
-        options
-      );
-      project = projects[index];
+    const operator = operatorOf(name);
+    if (this.at() !== ".") {
+      if (name !== "" && operator === void 0)
+        refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+      refuse(`needs column.operator.value ${this.where(start)}`);
     }
+    if (operator === void 0)
+      refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
+    this.index++;
+    const leaf = { operator, column, value: this.value(operator) };
+    return negated ? { not: leaf } : leaf;
   }
-  if (!project)
-    throw new NaroError("PROJECT_NOT_FOUND", "No project selected.");
-  const owningTeam = teams.find((candidate) => candidate.id === project.teamId) ?? team;
-  saveLink(context, project, owningTeam.slug);
-  context.output.result(
-    {
-      projectId: project.id,
-      projectName: project.name,
-      teamSlug: owningTeam.slug,
-      subdomain: project.subdomain
-    },
-    [`\u2705 Linked to ${owningTeam.slug}/${project.name} (.naro/project.json)`]
-  );
-}
-async function runUnlink(context) {
-  const existing = readProjectLink(context.cwd);
-  const removed = removeProjectLink(context.cwd);
-  context.output.result(
-    { removed, ...existing ? { projectId: existing.projectId } : {} },
-    [removed ? "\u2705 Unlinked (.naro removed)" : "Nothing to unlink here."]
-  );
-}
-
-// src/commands/deploy.ts
-async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
-  const { flags, output } = context;
-  const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
-  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
-    const confirmed = await context.prompter.confirm("Deploy to production?");
-    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  /** Up to the next `.`, `,`, `(`, `)` or the end. */
+  word() {
+    const start = this.index;
+    while (this.index < this.text.length && !".,()".includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index);
   }
-  output.log(`
-\u{1F680} Deploying ${context.cwd}
-`);
-  const canPrompt = deps.canPrompt?.() ?? (!flags.json && !flags.yes && isInteractive());
-  const team = await resolveDestination(context, link, canPrompt);
-  const account = await accountLabel(context);
-  output.log(`   ${account} \u2192 ${team.slug}
-`);
-  const result = await deps.deploy(
-    context.cwd,
-    {
-      name: flags.name,
-      projectId: link?.projectId,
-      teamSlug: team.slug,
-      rootDirectory: flags.root ?? null,
-      branch: flags.branch,
-      production: flags.prod,
-      ...canPrompt && {
-        onMissingEnv: (keys) => promptForMissingEnv(
-          { cwd: context.cwd, prompter: context.prompter, output },
-          keys
-        )
-      },
-      token: flags.token,
-      allowLogin: !flags.json && !flags.yes
-    },
-    (message) => output.log(message)
-  );
-  const existing = readProjectLink(context.cwd);
-  writeProjectLink(context.cwd, {
-    projectId: result.projectId,
-    teamSlug: result.teamSlug,
-    projectName: result.projectSlug,
-    ...existing?.autoDeployDeclined === true ? { autoDeployDeclined: true } : {}
-  });
-  if (!link) {
-    if (ensureGitignoreHasNaro(context.cwd))
-      output.log("\u25B8 added .naro to .gitignore");
-    output.log("\u25B8 linked (.naro/project.json)");
+  /** `"…"`, with `\` making the next character literal. */
+  quoted() {
+    const start = this.index;
+    this.index++;
+    let text = "";
+    for (; ; ) {
+      if (this.index >= this.text.length)
+        refuse(`has an unclosed quote ${this.where(start)}`);
+      const char = this.at();
+      this.index++;
+      if (char === '"') return text;
+      if (char === "\\" && this.index < this.text.length) {
+        text += this.at();
+        this.index++;
+      } else text += char;
+    }
+  }
+  /** A quoted value, or everything up to `stops`, trimmed. */
+  scalar(stops) {
+    this.skipSpaces();
+    if (this.at() === '"') {
+      const text = this.quoted();
+      this.skipSpaces();
+      if (this.at() !== "" && !stops.includes(this.at()))
+        refuse(`has text after a closing quote ${this.where()}`);
+      return text;
+    }
+    const start = this.index;
+    while (this.index < this.text.length && !stops.includes(this.at()))
+      this.index++;
+    return this.text.slice(start, this.index).trim();
+  }
+  /**
+   * `(a,b)` for `in`: text values, except that an unquoted `true` or `false`
+   * is a boolean (사용자 리뷰 반영, as in `eq`). `{a,b}` for the array
+   * operators: text, except that an unquoted exact decimal is a number
+   * (적대적 리뷰 반영, narrowed by 사용자 리뷰 반영) — json_each's values
+   * have no type affinity to turn the text "1" into 1, so as text `cs.{1}`
+   * matched no numeric array and `not.ov.{1}` matched every row. Quoted,
+   * `"1"` and `"true"` stay text.
+   */
+  listValue(kind) {
+    const [open, close, hint] = LIST_HINT[kind];
+    this.skipSpaces();
+    const openAt = this.index;
+    if (this.at() !== open) refuse(`${hint} ${this.where()}`);
+    this.index++;
+    this.skipSpaces();
+    const values = [];
+    if (this.at() === close) {
+      this.index++;
+      return values;
+    }
+    for (; ; ) {
+      this.skipSpaces();
+      const itemAt = this.index;
+      const token = this.token(`,${close}`);
+      if (token) values.push(token.value);
+      else {
+        const { text: value, quoted } = this.bareOrQuoted(`,${close}`);
+        if (!quoted && value === "") {
+          if (this.index >= this.text.length)
+            refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
+          refuse(`has an empty item ${this.where(itemAt)}`);
+        }
+        values.push(
+          quoted ? value : kind === "array" ? exactNumber(value) : truth(value)
+        );
+      }
+      if (this.index >= this.text.length)
+        refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
+      const char = this.at();
+      this.index++;
+      if (char === close) return values;
+    }
   }
-  await deps.offerAutoDeploy?.(context, result.projectId, {
-    canPrompt,
-    gitConnection: result.gitConnection,
-    teamSlug: result.teamSlug
-  });
-  const inspect = `${controlPlaneUrl()}${projectPath(result.teamSlug, result.projectSlug)}`;
-  context.output.result(
-    {
-      deploymentId: result.deploymentId,
-      projectId: result.projectId,
-      status: result.status,
-      url: result.url,
-      target: result.production ? "production" : "preview",
-      teamSlug: result.teamSlug,
-      inspectUrl: inspect,
-      missingEnvKeys: result.missingEnvKeys
-    },
-    [
-      "",
-      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
-      "",
-      `   ${result.url}`,
-      `   Inspect  ${inspect}`
-    ]
-  );
-}
-async function resolveDestination(context, link, canPrompt) {
-  const client = await context.client();
-  const teams = await client.teams.list();
-  const deps = scopeDeps(context, canPrompt);
-  if (link?.teamSlug) {
-    const match = teams.find((team) => team.slug === link.teamSlug);
-    if (match) return match;
-  } else if (link) {
-    let project;
-    try {
-      project = await client.projects.get(link.projectId);
-    } catch (error) {
-      if (isNaroError(error) && error.code !== "NOT_FOUND") throw error;
-      throw new NaroError(
-        "PROJECT_NOT_FOUND",
-        `This directory is linked to a project ${await accountLabel(context)} cannot see.
-  The CLI signs in separately from the dashboard \u2014 check with \`naro whoami\`.
-  Wrong account?  naro logout && naro login
-  Project gone?   remove .naro, then naro deploy`,
-        { cause: error }
-      );
+  /** The value after `operator.`. */
+  value(operator) {
+    const start = this.index;
+    switch (operator) {
+      case "in":
+        return this.listValue("in");
+      case "contains":
+      case "containedBy":
+      case "overlaps":
+        return this.listValue("array");
+      case "is":
+        return keyword(this.scalar(",)"), start);
+      case "like":
+      case "ilike": {
+        const token = this.token(",)");
+        if (token)
+          refuse(
+            `cannot use ${token.word} with ${operator} ${this.where(token.at)}`
+          );
+        return likePattern(this.bareOrQuoted(",)").text);
+      }
+      case "eq":
+      case "neq": {
+        const token = this.token(",)");
+        if (token) return token.value;
+        const { text, quoted } = this.bareOrQuoted(",)");
+        return quoted ? text : truth(text);
+      }
+      default: {
+        const token = this.token(",)");
+        return token ? token.value : this.bareOrQuoted(",)").text;
+      }
     }
-    const match = teams.find((team) => team.id === project.teamId);
-    if (match) return match;
   }
-  return resolveTeam(context, teams, deps);
+};
+function likePattern(pattern) {
+  return pattern.replaceAll("*", "%");
 }
-function scopeDeps(context, canPrompt) {
-  return {
-    canPrompt: () => canPrompt,
-    accountLabel: () => accountLabel(context),
-    switchAccount: async () => {
-      clearSession();
-      await runLogin(context);
-    },
-    listTeams: async () => (await context.client()).teams.list()
-  };
+function truth(text) {
+  const word = text.toLowerCase();
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return text;
 }
-async function accountLabel(context) {
-  try {
-    const { user } = await context.auth();
-    if (!user) return "this account";
-    const name = user.email ?? user.id;
-    return user.github ? `${name} (${user.github})` : name;
-  } catch {
-    return "this account";
-  }
+var DECIMAL = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+function exactNumber(text) {
+  if (!DECIMAL.test(text)) return text;
+  const number = Number(text);
+  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
+  const trimmed = text.replace(/\.?0+$/, "");
+  return String(number) === trimmed ? number : text;
 }
-
-// src/commands/deployments.ts
-function shortSha(sha) {
-  return sha ? sha.slice(0, 7) : "-";
+function quoteFilterValue(value) {
+  const text = String(value);
+  return `"${text.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
-function formatDeploymentLine(deployment) {
-  return [
-    deployment.id.padEnd(38),
-    deployment.status.padEnd(10),
-    deployment.branch.padEnd(16),
-    shortSha(deployment.gitCommitSha).padEnd(9),
-    deployment.url ?? ""
-  ].join(" ");
+function keyword(text, at) {
+  const word = text.toLowerCase();
+  if (word === "null") return null;
+  if (word === "true") return true;
+  if (word === "false") return false;
+  return refuse(
+    `needs null, true or false after is at character ${String(at + 1)}`
+  );
 }
-async function runDeployments(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const deployments = await client.deployments.list(projectId);
-  context.output.result({ projectId, deployments }, [
-    `Deployments for ${projectId}:`,
-    "",
-    [
-      "ID".padEnd(38),
-      "STATUS".padEnd(10),
-      "BRANCH".padEnd(16),
-      "COMMIT".padEnd(9),
-      "URL"
-    ].join(" "),
-    ...deployments.map(formatDeploymentLine)
-  ]);
+function attempt(parse) {
+  try {
+    return { ok: true, node: parse() };
+  } catch (error) {
+    if (error instanceof Refusal) return { ok: false, reason: error.message };
+    throw error;
+  }
 }
-async function runInspect(context) {
-  const [deploymentId] = context.positionalOrThrow(
-    1,
-    "Usage: naro inspect <deployment-id>"
-  );
-  const client = await context.client();
-  const detail = await client.deployments.get(deploymentId);
-  const { deployment } = detail;
-  const lastLogs = detail.logs.slice(-15);
-  context.output.result({ deployment, logs: detail.logs }, [
-    `Deployment ${deployment.id}`,
-    `  status:   ${deployment.status}${deployment.errorCode ? ` (${deployment.errorCode})` : ""}`,
-    `  branch:   ${deployment.branch}`,
-    `  commit:   ${deployment.gitCommitSha ?? "-"}`,
-    `  url:      ${deployment.url ?? "-"}`,
-    `  created:  ${deployment.createdAt}`,
-    `  finished: ${deployment.finishedAt ?? "-"}`,
-    ...deployment.errorMessage ? [`  error:    ${deployment.errorMessage}`] : [],
-    ...lastLogs.length > 0 ? [
-      "",
-      "Recent build logs:",
-      ...lastLogs.map((log) => `  [${log.stage}] ${log.message}`)
-    ] : []
-  ]);
+function parseLogic(text, kind, options = {}) {
+  if (typeof text !== "string")
+    return { ok: false, reason: "must be a filter string or a function" };
+  if (text.trim() === "") return { ok: false, reason: "must not be empty" };
+  return attempt(() => {
+    if (options.group === false) {
+      const alone = items(text, options.tokens, 0);
+      if (alone.length === 1 && alone[0]) return alone[0];
+    }
+    const nodes = items(text, options.tokens, 1);
+    return kind === "or" ? { or: nodes } : { and: nodes };
+  });
+}
+function items(text, tokens, level) {
+  const parser = new Parser(text, tokens);
+  const nodes = parser.list(level);
+  if (parser.at() === ")") refuse(`has an unmatched ")" ${parser.where()}`);
+  return nodes;
 }
 
-// src/commands/domains.ts
-var defaults3 = {
-  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
-  now: () => Date.now()
+// src/commands/policy.ts
+var SET_USAGE = "Usage: naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>] [--owner <column>] [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>] [--update-check <filter>] [--delete-when <filter>] [--signed-in] | --from-file <policy.json>";
+var REMOVE_USAGE = "Usage: naro policy remove <table>";
+var CREATE_USAGE = 'Usage: naro policy create "CREATE POLICY <name> ON <table> \u2026" | --file <policies.sql>';
+var DROP_USAGE = "Usage: naro policy drop <name> --table <table>";
+var TAKES_EFFECT = "It takes effect within about 10 seconds.";
+var DEFAULT_DENY = "Tables without a policy deny anon and signed-in requests. The service key skips policies.";
+var RULE_FLAGS = {
+  select: "selectRule",
+  insert: "insertRule",
+  update: "updateRule",
+  delete: "deleteRule"
 };
-var FIRST_DELAY_MS = 5e3;
-var MAX_DELAY_MS = 3e4;
-var WAIT_TIMEOUT_MS = 10 * 6e4;
-function isReady(domain) {
-  return domain.ready ?? (domain.status === "active" && domain.sslStatus === "active");
+var WHEN_FLAGS = {
+  select: { key: "selectWhen", tree: "using" },
+  insert: { key: "insertWhen", tree: "check" },
+  update: { key: "updateWhen", tree: "using" },
+  delete: { key: "deleteWhen", tree: "using" }
+};
+var AUTH_UID = "auth.uid()";
+var OTHER_FLAGS = [
+  "selectRule",
+  "insertRule",
+  "updateRule",
+  "deleteRule",
+  "ownerColumn",
+  "selectWhen",
+  "insertWhen",
+  "updateWhen",
+  "updateCheck",
+  "deleteWhen",
+  "signedIn"
+];
+function isRule(value) {
+  return POLICY_RULES.includes(value);
 }
-function isTerminal(domain) {
-  return domain.ownership === "deleted" || domain.status === "blocked" || domain.status === "moved" || domain.status === "deleted";
+function refuse2(message) {
+  throw new NaroError("VALIDATION_FAILED", message);
 }
-var AXIS_DONE = /* @__PURE__ */ new Set(["verified", "active", "live"]);
-var AXIS_FAILED = /* @__PURE__ */ new Set(["failed", "deleted"]);
-function axisMark(value) {
-  if (AXIS_DONE.has(value)) return "\u2713";
-  if (AXIS_FAILED.has(value)) return "\u2717";
-  return "\xB7";
+function flagName(key) {
+  return `--${key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}`;
 }
-function axisLines(domain) {
-  const axes = [
-    ["ownership", domain.ownership],
-    ["certificate", domain.certificate],
-    ["routing", domain.routing]
-  ];
-  return axes.filter((axis) => axis[1] !== void 0).map(
-    ([name, value]) => `    ${`${name}:`.padEnd(13)}${axisMark(value)} ${value}`
-  );
+function conditionTree(flag, text) {
+  const parsed = parseLogic(text, "and", {
+    tokens: { [AUTH_UID]: { auth: "uid" } },
+    group: false
+  });
+  if (!parsed.ok) refuse2(`${flag} ${parsed.reason}.`);
+  const tree = parsed.node;
+  const checked = parsePolicyNode(tree, "");
+  if (!checked.ok) {
+    const path = checked.path.replace(/^\./, "");
+    refuse2(
+      path === "" ? `${flag} ${checked.reason}.` : `${flag}: ${path} ${checked.reason}.`
+    );
+  }
+  return tree;
 }
-function axisSummary(domain) {
-  const axes = [
-    domain.ownership,
-    domain.certificate,
-    domain.routing
-  ].filter((value) => value !== void 0);
-  return axes.length > 0 ? axes.join(" \xB7 ") : `${domain.status} \xB7 ssl ${domain.sslStatus}`;
+function conditionsFrom(flags) {
+  const conditions = {};
+  for (const action of POLICY_ACTIONS) {
+    const { key, tree } = WHEN_FLAGS[action];
+    const text = flags[key];
+    if (text === void 0) continue;
+    const flag = flagName(key);
+    if (flags[RULE_FLAGS[action]] !== void 0)
+      refuse2(`--${action} and ${flag} cannot be used together.`);
+    const condition = { [tree]: conditionTree(flag, text) };
+    if (action === "update" && flags.updateCheck !== void 0)
+      condition.check = conditionTree("--update-check", flags.updateCheck);
+    if (flags.signedIn) condition.role = "authenticated";
+    conditions[action] = condition;
+  }
+  if (flags.updateCheck !== void 0 && flags.updateWhen === void 0)
+    refuse2("--update-check needs --update-when.");
+  if (flags.signedIn && Object.keys(conditions).length === 0)
+    refuse2(
+      "--signed-in needs --select-when, --insert-when, --update-when or --delete-when."
+    );
+  return conditions;
 }
-function recordLines(domain) {
-  const instructions = domain.instructions ?? [];
-  if (instructions.length > 0) {
-    const lines2 = ["    Required DNS records:"];
-    for (const instruction of instructions) {
-      lines2.push(
-        `      ${instruction.type.padEnd(5)} ${instruction.name}`,
-        `        host: ${instruction.host.padEnd(24)} value: ${instruction.value}`
+function patchFromFile(context, path, table) {
+  let text;
+  try {
+    text = readFileSync3(resolve3(context.cwd, path), "utf8");
+  } catch {
+    refuse2(`Could not read ${path}.`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    refuse2(`${path} is not JSON.`);
+  }
+  if (typeof body !== "object" || body === null || Array.isArray(body))
+    refuse2(`${path} must hold a JSON object.`);
+  const { table: named, ...fields } = body;
+  const patch = Object.fromEntries(
+    Object.entries(fields).filter(([key]) => key !== "policies")
+  );
+  if (Object.hasOwn(body, "table")) {
+    if (typeof named !== "string")
+      refuse2(`${path}: table must be a string, the table's name.`);
+    if (table !== void 0 && asciiLower(named) !== asciiLower(table))
+      refuse2(
+        `${path} is the policy of ${printable(named)}, not ${printable(table)}. Remove its "table" to set it on ${printable(table)}.`
       );
-      if (instruction.note) lines2.push(`        note: ${instruction.note}`);
-    }
-    return lines2;
   }
-  if (domain.verification.length === 0) return [];
-  const lines = ["    Required DNS records:"];
-  for (const record of domain.verification) {
-    lines.push(
-      `      Type: ${record.type.toUpperCase().padEnd(6)} Name: ${record.name}`,
-      `      Value: ${record.value}`
+  const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
+  if (Object.keys(patch).some((key) => !allowed.has(key)))
+    refuse2(
+      `${path}: Only table, select, insert, update, delete and ownerColumn can be set.`
     );
-  }
-  return lines;
+  return patch;
 }
-function domainLines(domain) {
-  const lines = [
-    `  ${domain.hostname.padEnd(36)} ${domain.status.padEnd(12)} ssl: ${domain.sslStatus}`,
-    ...axisLines(domain)
-  ];
-  if (domain.redirectTo) {
-    const status = domain.redirectStatus ?? 308;
-    lines.push(`    redirects to ${domain.redirectTo} (${String(status)})`);
+function asciiLower(text) {
+  return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+}
+function policyPatch(flags, context, table) {
+  if (flags.fromFile !== void 0) {
+    if (OTHER_FLAGS.some(
+      (key) => flags[key] !== void 0 && flags[key] !== false
+    ))
+      refuse2(
+        "--from-file takes the whole policy: leave out the other policy options."
+      );
+    if (!context) refuse2(SET_USAGE);
+    return patchFromFile(context, flags.fromFile, table);
   }
-  if (domain.cause) {
-    lines.push(`    \u2717 ${domain.cause.message}`);
-    if (domain.cause.fix) lines.push(`    \u2192 ${domain.cause.fix}`);
+  const patch = {};
+  for (const action of POLICY_ACTIONS) {
+    const value = flags[RULE_FLAGS[action]];
+    if (value === void 0) continue;
+    if (!isRule(value))
+      refuse2(`--${action} must be one of ${POLICY_RULES.join(", ")}.`);
+    patch[action] = value;
   }
-  if (isReady(domain)) return lines;
-  lines.push(...recordLines(domain));
-  const guidance = domain.guidance;
-  if (guidance && guidance.notes.length > 0) {
-    lines.push(
-      guidance.apex ? `    Apex domain (${domain.hostname}):` : "    Note:"
-    );
-    for (const note of guidance.notes) lines.push(`      ${note}`);
+  Object.assign(patch, conditionsFrom(flags));
+  if (flags.ownerColumn !== void 0) {
+    if (flags.ownerColumn.trim() === "") refuse2("--owner must name a column.");
+    patch.ownerColumn = flags.ownerColumn;
   }
-  return lines;
+  if (Object.keys(patch).length === 0)
+    refuse2(
+      `Set at least one of --select, --insert, --update, --delete, --owner, --select-when, --insert-when, --update-when, --delete-when or --from-file. ${SET_USAGE}`
+    );
+  return patch;
 }
-async function runDomainsList(context) {
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const domains = await client.domains.list(projectId);
-  const pending = domains.filter((domain) => !isReady(domain));
-  context.output.result(
-    { projectId, domains },
-    domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
-      `Domains (${String(domains.length)}):`,
-      ...domains.flatMap(domainLines),
-      // list reads our stored copy; only verify goes and looks again.
-      ...pending.length > 0 ? ["", "Re-check DNS now: naro domains verify"] : []
-    ]
-  );
+var SHORT = {
+  contains: "cs",
+  containedBy: "cd",
+  overlaps: "ov"
+};
+function isAuthUid(value) {
+  return typeof value === "object" && value !== null && value.auth === "uid";
 }
-async function runDomainsAdd(context) {
-  const [hostname] = context.positionalOrThrow(
-    1,
-    "Usage: naro domains add <hostname> [--no-www]"
-  );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const withWww = context.flags.noWww !== true;
-  const domain = await client.domains.add(projectId, hostname, {
-    withWww
-  });
-  const companion = domain.companion;
-  const apex = domain.apex ?? domain.guidance?.apex ?? false;
-  const alternative = domain.guidance?.alternative ?? `www.${domain.hostname}`;
-  context.output.result(
-    { projectId, domain, withWww, ...companion ? { companion } : {} },
-    [
-      `\u2705 Domain added: ${domain.hostname}`,
-      "",
-      ...domainLines(domain),
-      ...companion ? [
-        "",
-        `   Also registered ${companion.hostname} \u2014 an apex domain often cannot hold`,
-        "   the CNAME above, and this form always can.",
-        "",
-        ...domainLines(companion)
-      ] : [],
-      ...!companion && apex && !withWww ? [
-        "",
-        `   --no-www: ${domain.hostname} was registered on its own. If your registrar`,
-        `   refuses the record above, run \`naro domains add ${alternative}\`.`
-      ] : [],
-      "",
-      isReady(domain) ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains verify`."
-    ]
-  );
+function nearAuthUid(text) {
+  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "") === "auth.uid";
 }
-async function verifyAll(client, projectId, hostname, auto = false) {
-  if (hostname !== void 0)
-    return [
-      await client.domains.verifyByHostname(projectId, hostname, { auto })
-    ];
-  const listed = await client.domains.list(projectId);
-  const verified = [];
-  for (const domain of listed)
-    verified.push(await client.domains.verify(projectId, domain.id, { auto }));
-  return verified;
+var DECIMAL2 = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+function readsAsNumber(value) {
+  const text = String(value);
+  if (!DECIMAL2.test(text) || !Object.is(Number(text), value)) return false;
+  return text.includes(".") || Number.isSafeInteger(value);
+}
+function stringText(value, slot) {
+  if (slot === "is") return void 0;
+  if (slot === "like" && value.includes("*")) return void 0;
+  const bare = value !== "" && value.trim() === value && !/[,()"{}\\]/.test(value) && !/^(?:true|false|null)$/i.test(value) && !nearAuthUid(value) && !(slot === "array" && DECIMAL2.test(value));
+  return bare ? value : quoteFilterValue(value);
+}
+function valueText(value, slot) {
+  if (isAuthUid(value))
+    return slot === "like" || slot === "is" ? void 0 : AUTH_UID;
+  if (value === null) return slot === "is" ? "null" : void 0;
+  if (typeof value === "boolean")
+    return slot === "is" || slot === "eq" || slot === "in" ? String(value) : void 0;
+  if (typeof value === "number")
+    return slot === "array" && readsAsNumber(value) ? String(value) : void 0;
+  if (typeof value === "string") return stringText(value, slot);
+  return void 0;
+}
+function columnText(name) {
+  if (name === "") return void 0;
+  return /[.,()"\s]/.test(name) ? quoteFilterValue(name) : name;
+}
+function slotOf(operator) {
+  if (operator === "eq" || operator === "neq") return "eq";
+  if (operator === "like" || operator === "ilike") return "like";
+  if (operator === "is") return "is";
+  return "ordered";
 }
-async function runDomainsVerify(context, overrides = {}) {
-  const deps = { ...defaults3, ...overrides };
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const hostname = context.positionals[0];
-  const wait = context.flags.wait === true;
-  const progress = (line) => {
-    if (!context.flags.json) context.output.log(line);
-  };
-  let domains = await verifyAll(client, projectId, hostname);
-  if (domains.length === 0) {
-    context.output.result({ projectId, domains, ready: false }, [
-      "No custom domains. Add one with `naro domains add example.com`."
-    ]);
-    return;
+function leafText(leaf, negated) {
+  const column = columnText(leaf.column);
+  if (column === void 0) return void 0;
+  const prefix = `${column}.${negated ? "not." : ""}`;
+  const short = SHORT[leaf.operator];
+  if (leaf.operator === "in" || short !== void 0) {
+    if (!Array.isArray(leaf.value)) return void 0;
+    const slot = short === void 0 ? "in" : "array";
+    const items2 = leaf.value.map((item) => valueText(item, slot));
+    if (items2.some((item) => item === void 0)) return void 0;
+    const list = items2.join(",");
+    return slot === "in" ? `${prefix}in.(${list})` : `${prefix}${String(short)}.{${list}}`;
   }
-  let timedOut = false;
-  let abandoned = false;
-  if (wait && !domains.every(isReady)) {
-    const deadline = deps.now() + WAIT_TIMEOUT_MS;
-    let delay = FIRST_DELAY_MS;
-    for (; ; ) {
-      const pending = domains.filter((domain) => !isReady(domain));
-      if (pending.length > 0 && pending.every(isTerminal)) {
-        abandoned = true;
-        break;
-      }
-      const remaining = deadline - deps.now();
-      if (remaining <= 0) {
-        timedOut = true;
-        break;
-      }
-      for (const domain of pending)
-        progress(
-          isTerminal(domain) ? `\u26A0 ${domain.hostname}: ${axisSummary(domain)} \u2014 waiting cannot fix this one` : `\u25B8 ${domain.hostname}: ${axisSummary(domain)}`
-        );
-      await deps.sleep(Math.min(delay, remaining));
-      delay = Math.min(delay * 2, MAX_DELAY_MS);
-      domains = await verifyAll(client, projectId, hostname, true);
-      if (domains.every(isReady)) break;
-    }
+  if (Array.isArray(leaf.value)) return void 0;
+  const text = valueText(leaf.value, slotOf(leaf.operator));
+  return text === void 0 ? void 0 : `${prefix}${leaf.operator}.${text}`;
+}
+function groupText(kind, children) {
+  const texts = children.map((child) => filterText(child, false));
+  if (texts.length === 0 || texts.some((text) => text === void 0))
+    return void 0;
+  return `${kind}(${texts.join(",")})`;
+}
+function filterText(node, top = true) {
+  if ("operator" in node) return leafText(node, false);
+  if ("not" in node) {
+    const inner = node.not;
+    if ("operator" in inner) return leafText(inner, true);
+    if ("or" in inner) return negatedText(groupText("or", inner.or));
+    if ("and" in inner) return negatedText(groupText("and", inner.and));
+    return void 0;
   }
-  const ready = domains.every(isReady);
-  const body = domains.flatMap(domainLines);
-  if (!ready) {
-    for (const line of body) progress(line);
-    const notReady = domains.filter((domain) => !isReady(domain));
-    const names = notReady.map((domain) => domain.hostname).join(", ");
-    const details = { projectId, domains, ready: false };
-    if (timedOut) {
-      const cause2 = notReady[0]?.cause;
-      throw new NaroError(
-        "TIMEOUT",
-        `${names} did not go live within 10 minutes.${cause2 ? ` ${cause2.message}` : ""} DNS changes can take longer to propagate \u2014 re-run \`naro domains verify\` later.`,
-        { details }
-      );
-    }
-    if (abandoned) {
-      const blocked = domains.find(isTerminal);
-      throw new NaroError(
-        blocked?.cause?.code ?? "DOMAIN_VERIFICATION_FAILED",
-        blocked?.cause?.message ?? `${names} cannot be verified (status: ${blocked?.status ?? "unknown"}). Remove it and add it again.`,
-        { details }
-      );
-    }
-    const cause = notReady[0]?.cause;
-    throw new NaroError(
-      cause?.code ?? "DOMAIN_NOT_READY",
-      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} Add the records above, then run \`naro domains verify --wait\`.`,
-      { details }
-    );
+  if ("or" in node) return groupText("or", node.or);
+  if (top && node.and.length > 1) {
+    const texts = node.and.map((child) => filterText(child, false));
+    return texts.some((text) => text === void 0) ? void 0 : texts.join(",");
   }
-  context.output.result({ projectId, domains, ready }, [
-    ...body,
-    "",
-    domains.length === 1 ? `\u2705 ${domains[0]?.hostname ?? ""} is live.` : "\u2705 Every domain is live."
-  ]);
+  return groupText("and", node.and);
 }
-async function runDomainsRemove(context) {
-  const [hostname] = context.positionalOrThrow(
-    1,
-    "Usage: naro domains remove <hostname>"
+function negatedText(text) {
+  return text === void 0 ? void 0 : `not.${text}`;
+}
+function isInvalid(value) {
+  return typeof value === "object" && "invalid" in value;
+}
+function cellOf(value) {
+  if (typeof value === "string") return value;
+  return isInvalid(value) ? "invalid" : "condition";
+}
+function conditionText(action, value) {
+  if (typeof value === "string") return value;
+  if (isInvalid(value))
+    return `cannot be read (${value.invalid}); it denies everyone but the service key`;
+  const using = value.using ? filterText(value.using) : "";
+  const check = value.check ? filterText(value.check) : "";
+  if (using === void 0 || check === void 0)
+    return `as JSON ${JSON.stringify(value)}`;
+  const parts = [];
+  if (using !== "") parts.push(`using ${using}`);
+  if (check !== "") parts.push(`check ${check}`);
+  else if (action === "update") parts.push("check = using");
+  const text = parts.join("; ");
+  return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
+}
+function policyTable(policies) {
+  const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
+  const rows = policies.map((policy) => [
+    printable(policy.table),
+    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
+    policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
+  ]);
+  const widths = header.map(
+    (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
   );
-  await confirmOrAbort(
-    context,
-    `Remove ${String(hostname)}? Traffic to it will stop routing here.`
+  const table = [header, ...rows].map(
+    (cells) => cells.map(
+      (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
+    ).join("  ").trimEnd()
   );
-  const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  await client.domains.remove(projectId, hostname);
-  context.output.result({ projectId, hostname, removed: true }, [
-    `\u2705 Removed ${String(hostname)}`
-  ]);
+  const lines = policies.flatMap(
+    (policy) => POLICY_ACTIONS.filter((action) => typeof policy[action] !== "string").map(
+      (action) => {
+        const value = policy[action];
+        const text = conditionText(action, value);
+        return {
+          label: `${printable(policy.table)}.${action}`,
+          text: isInvalid(value) || isPrintable(text) ? printable(text) : `${UNSHOWN}: naro policy list --json has the exact text`
+        };
+      }
+    )
+  );
+  if (lines.length === 0) return table;
+  const width = Math.max(...lines.map((line) => line.label.length));
+  return [
+    ...table,
+    "",
+    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
+  ];
 }
-
-// src/commands/env.ts
-import { existsSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join4 } from "path";
-var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
-var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function parseTarget(value) {
-  if (value === void 0) return "all";
-  if (!TARGETS.has(value))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Environment must be production, preview or all."
+var UNSHOWN = "has characters that cannot be shown here";
+function statementLine(policy) {
+  if (policy.invalid !== null)
+    return printable(
+      `-- ${policyNamed(policy.name, policy.table)} cannot be read (${commentText(policy.invalid)}); the requests it applies to are refused until it is dropped or created again.`
     );
-  return value;
+  return shownStatement(policy, policy.table, "naro policy list --json");
 }
-function maskedValue(row) {
-  if (!row.isSecret) return row.value ?? "";
-  return "\u2022\u2022\u2022\u2022\u2022\u2022 (secret)";
+function policyNamed(name, table) {
+  return `Policy ${commentText(quotePolicyName(name))} on ${commentText(quoteIdent(table))}`;
 }
-async function runEnvList(context) {
+function shownStatement(statement, table, exact) {
+  if (isPrintable(statement.sql)) return statement.sql;
+  return printable(
+    `-- ${policyNamed(statement.name, table)} ${UNSHOWN}, so it is not printed as CREATE POLICY: ${exact} has its exact text.`
+  );
+}
+function policyStatements(policies) {
+  const lines = [];
+  let table;
+  for (const policy of policies) {
+    if (table !== void 0 && policy.table !== table) lines.push("");
+    table = policy.table;
+    lines.push(statementLine(policy));
+  }
+  return lines;
+}
+async function runPolicyList(context) {
+  const table = context.flags.table;
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const reveal = context.flags.reveal;
-  const rows = await client.env.list(projectId, { reveal });
-  context.output.result(
-    {
-      projectId,
-      envVars: rows.map((row) => ({
-        id: row.id,
-        key: row.key,
-        target: row.target,
-        isSecret: row.isSecret,
-        value: row.isSecret && !reveal ? null : row.value
-      }))
-    },
-    [
-      `Environment variables (${String(rows.length)}):`,
-      ...rows.map(
-        (row) => `  ${row.key.padEnd(32)} ${row.target.padEnd(12)} ${reveal ? row.value ?? "" : maskedValue(row)}`
-      )
-    ]
+  const policies = await client.backend.rlsPolicies(
+    projectId,
+    table === void 0 ? {} : { table }
   );
+  let lines;
+  if (policies.length > 0)
+    lines = [...policyStatements(policies), "", DEFAULT_DENY];
+  else if (table !== void 0)
+    lines = [
+      `No policies on ${printable(table)}: anon and signed-in requests to it are denied.`
+    ];
+  else
+    lines = [
+      "No policies yet: every table denies anon and signed-in requests.",
+      'Add one with `naro policy create "CREATE POLICY \u2026"` or `naro policy set <table> --select public`.'
+    ];
+  context.output.result({ projectId, policies }, lines);
+}
+function statementText(context) {
+  const [positional] = context.positionals;
+  const file = context.flags.file;
+  if (positional !== void 0 && file !== void 0)
+    refuse2(`Give the statement or --file, not both. ${CREATE_USAGE}`);
+  let text = positional;
+  if (file !== void 0) {
+    try {
+      text = readFileSync3(resolve3(context.cwd, file), "utf8");
+    } catch {
+      refuse2(`Could not read ${file}.`);
+    }
+  }
+  if (text === void 0 || text.trim() === "") refuse2(CREATE_USAGE);
+  return text;
 }
-async function runEnvAdd(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env add KEY [production|preview|all]"
-  );
-  const [key, targetArg] = context.positionals;
-  if (!key || !KEY_RE.test(key) || key.length > 256)
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "Keys must look like MY_VARIABLE (letters, digits, underscore)."
+function policyStatementsOf(text) {
+  const split = splitPolicyStatements(text);
+  if (!split.ok)
+    refuse2(`${split.reason} at character ${String(split.position)}.`);
+  const { statements } = split;
+  if (statements.length === 0) refuse2(CREATE_USAGE);
+  statements.forEach((statement, index) => {
+    const parsed = parsePolicyStatement(statement);
+    if (parsed.ok) return;
+    const where = `${parsed.reason} at character ${String(parsed.position)}.`;
+    refuse2(
+      statements.length === 1 ? where : `Statement ${String(index + 1)} of ${String(statements.length)}: ${where} Nothing was sent.`
     );
-  const target = parseTarget(targetArg);
-  let value;
-  if (!process.stdin.isTTY) {
-    value = await readStdin();
-  } else {
-    value = await context.prompter.askHidden(`? What's the value of ${key}? `);
+  });
+  return statements;
+}
+function resultLine(result) {
+  if ("created" in result)
+    return `\u2705 Created policy ${printable(result.created.name)} on ${printable(result.created.table)}.`;
+  if (result.dropped === null)
+    return "Nothing to drop: no such policy (IF EXISTS).";
+  return `\u2705 Dropped policy ${printable(result.dropped.name)} on ${printable(result.dropped.table)}.`;
+}
+async function runStatements(client, projectId, statements, allowUnindexed) {
+  const applied = [];
+  for (const [index, statement] of statements.entries()) {
+    try {
+      applied.push(
+        await client.backend.runPolicySql(
+          projectId,
+          statement,
+          allowUnindexed ? { allowUnindexed } : {}
+        )
+      );
+    } catch (error) {
+      if (!isNaroError(error) || statements.length === 1) throw error;
+      let before = "Nothing ran.";
+      if (index === 1)
+        before = "Statement 1 ran and stays; the rest were not sent.";
+      else if (index > 1)
+        before = `Statements 1\u2013${String(index)} ran and stay; the rest were not sent.`;
+      throw new NaroError(
+        error.code,
+        `Statement ${String(index + 1)} of ${String(statements.length)}: ${error.message} ${before}`,
+        {
+          ...error.status === void 0 ? {} : { status: error.status },
+          details: { ...error.details, applied },
+          cause: error
+        }
+      );
+    }
   }
-  if (value.length === 0)
-    throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
-  const isSecret = !key.startsWith("NEXT_PUBLIC_");
+  return applied;
+}
+async function runPolicyCreate(context) {
+  const statements = policyStatementsOf(statementText(context));
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  await client.env.set(projectId, [{ key, value, target, isSecret }]);
-  context.output.result({ projectId, key, target, isSecret }, [
-    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  const applied = await runStatements(
+    client,
+    projectId,
+    statements,
+    context.flags.allowUnindexed === true
+  );
+  context.output.result({ projectId, applied }, [
+    ...applied.map(resultLine),
+    applied.length === 1 ? TAKES_EFFECT : "They take effect within about 10 seconds."
   ]);
 }
-async function runEnvRemove(context) {
-  context.positionalOrThrow(
-    1,
-    "Usage: naro env remove KEY [production|preview|all]"
-  );
-  const [key, targetArg] = context.positionals;
-  const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
+async function runPolicyDrop(context) {
+  const [name] = context.positionalOrThrow(1, DROP_USAGE);
+  const table = context.flags.table;
+  if (table === void 0 || table === "") refuse2(DROP_USAGE);
   await confirmOrAbort(
     context,
-    `Remove ${String(key)}${target ? ` (${target})` : ""} from this project?`
+    `Drop policy ${printable(name)} on ${printable(table)}? It stops applying within about 10 seconds.`
   );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const removed = await client.env.remove(projectId, key, target);
-  context.output.result({ projectId, key, removed }, [
-    `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
+  const dropped = await client.backend.dropRlsPolicy(
+    projectId,
+    table,
+    name
+  );
+  context.output.result({ projectId, dropped }, [
+    `\u2705 Dropped policy ${printable(dropped.name)} on ${printable(dropped.table)}. It stops applying within about 10 seconds.`
   ]);
 }
-async function runEnvPull(context) {
-  const file = context.positionals[0] ?? ".env.local";
-  const surface = context.flags.env === "production" ? "production" : "preview";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--env must be production or preview."
-    );
+async function runPolicySet(context) {
+  const [table] = context.positionalOrThrow(1, SET_USAGE);
+  const patch = policyPatch(context.flags, context, table);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const rows = await client.env.list(projectId, { reveal: true });
-  const selected = rows.filter(
-    (row) => row.target === "all" || row.target === surface
-  );
-  const vars = Object.fromEntries(
-    selected.map((row) => [row.key, row.value ?? ""])
+  const policy = await client.backend.setPolicy(
+    projectId,
+    table,
+    patch
   );
-  const path = join4(context.cwd, file);
-  if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
-    const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
-    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  let named;
+  try {
+    named = await client.backend.rlsPolicies(projectId, {
+      table: policy.table
+    });
+  } catch (error) {
+    if (!isNaroError(error)) throw error;
   }
-  writeFileSync4(
-    path,
-    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
-${serializeDotenv(vars)}`,
-    { mode: 384 }
-  );
   context.output.result(
-    { projectId, file, environment: surface, count: selected.length },
-    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
+    { projectId, policy, ...named === void 0 ? {} : { policies: named } },
+    [
+      `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
+      ...policyTable([policy]),
+      ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
+    ]
   );
 }
-
-// src/commands/gen.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname2, resolve as resolve3 } from "path";
-var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
-async function runGenTypes(context) {
-  const { lang } = context.flags;
-  if (lang !== void 0 && lang !== "typescript")
-    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
+async function runPolicyRemove(context) {
+  const [table] = context.positionalOrThrow(1, REMOVE_USAGE);
+  await confirmOrAbort(
+    context,
+    `Remove every policy on ${printable(table)}? Anon and signed-in requests to it are denied from then on.`
+  );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const tables = await client.db.tables(projectId);
-  const read = await policiesForTypes(client, projectId);
-  const types = generateTypes(
-    tables,
-    read.policies === void 0 ? {} : { policies: read.policies }
-  );
-  const undescribed = tables.flatMap(
-    (table) => table.error === void 0 ? [] : [{ name: table.name, error: table.error }]
-  );
-  for (const { name, error } of undescribed)
-    context.output.warn(
-      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
-    );
-  if (read.policies === void 0)
-    context.output.warn(
-      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
-    );
-  const extra = {
-    ...undescribed.length > 0 ? { undescribed } : {},
-    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
-  };
-  if (context.flags.output) {
-    const path = resolve3(context.cwd, context.flags.output);
-    mkdirSync4(dirname2(path), { recursive: true });
-    writeFileSync5(path, types);
-    context.output.result(
-      {
-        projectId,
-        output: context.flags.output,
-        tables: tables.length,
-        ...extra
-      },
-      [
-        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
-      ]
-    );
-    return;
-  }
-  context.output.result({ projectId, types, ...extra }, [
-    types.replace(/\n$/, "")
+  const policy = await client.backend.removePolicy(projectId, table);
+  const names = policy.policies ?? [];
+  context.output.result({ projectId, removed: true, policy }, [
+    names.length === 0 ? `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.` : `\u2705 Removed ${names.length === 1 ? "policy" : "policies"} ${names.map(printable).join(", ")} on ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
   ]);
 }
 
-// src/commands/logs.ts
-var FOLLOW_INTERVAL_MS = 3e3;
-function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-function formatBuildLog(log) {
-  return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
+// src/commands/db-schema.ts
+var USAGE2 = {
+  table: "Usage: naro db table create|add-column|rename-column|rename|drop-column|drop \u2026 (see naro help)",
+  index: "Usage: naro db index create|drop \u2026 (see naro help)",
+  create: "Usage: naro db table create <name> --column <spec> [--column <spec>\u2026] [--owner <column>] [--if-not-exists]",
+  addColumn: "Usage: naro db table add-column <table> --column <spec>",
+  renameColumn: "Usage: naro db table rename-column <table> <column> <new-name>",
+  rename: "Usage: naro db table rename <table> <new-name>",
+  dropColumn: "Usage: naro db table drop-column <table> <column>",
+  drop: "Usage: naro db table drop <table>",
+  indexCreate: "Usage: naro db index create <table> <column[,column\u2026]> [--unique] [--name <name>]",
+  indexDrop: "Usage: naro db index drop <name>"
+};
+var SPEC_USAGE = '--column needs name:type, e.g. --column "title:text:notnull".';
+var ON_DELETE = {
+  cascade: "CASCADE",
+  "set-null": "SET NULL",
+  "set-default": "SET DEFAULT",
+  restrict: "RESTRICT",
+  "no-action": "NO ACTION"
+};
+var KEYWORDS = /* @__PURE__ */ new Set(["CURRENT_TIMESTAMP", "CURRENT_DATE", "CURRENT_TIME"]);
+var NUMBER = /^-?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+function segments(spec) {
+  const parts = [];
+  let current = "";
+  let quoted = false;
+  for (const char of spec) {
+    if (char === "'") quoted = !quoted;
+    if (char === ":" && !quoted) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (quoted) return null;
+  parts.push(current);
+  return parts;
 }
-function formatRuntimeLog(entry) {
-  const time = new Date(entry.ts).toISOString();
-  const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
-  return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
+function defaultValue(text) {
+  if (text.length >= 2 && text.startsWith("'") && text.endsWith("'"))
+    return text.slice(1, -1).replace(/''/g, "'");
+  const lower = text.toLowerCase();
+  if (lower === "null") return null;
+  if (lower === "true") return true;
+  if (lower === "false") return false;
+  const upper = text.toUpperCase();
+  if (KEYWORDS.has(upper)) return { keyword: upper };
+  if (NUMBER.test(text)) return Number(text);
+  return text;
 }
-async function latestProductionDeploymentId(client, projectId) {
-  const deployments = await client.deployments.list(projectId);
-  const latest = deployments.find(
-    (deployment) => deployment.status === "READY"
-  );
-  const fallback = deployments[0];
-  const chosen = latest ?? fallback;
-  if (!chosen)
+function parseColumnSpec(spec) {
+  const shown = `--column "${printable(spec)}"`;
+  const parts = segments(spec);
+  if (parts === null)
     throw new NaroError(
-      "DEPLOYMENT_NOT_FOUND",
-      "This project has no deployments yet."
-    );
-  return chosen.id;
-}
-async function buildLogs(context, client, deploymentId) {
-  if (!context.flags.follow) {
-    const detail = await client.deployments.get(deploymentId);
-    context.output.result(
-      { deploymentId, type: "build", logs: detail.logs },
-      detail.logs.map(formatBuildLog)
+      "VALIDATION_FAILED",
+      `${shown}: a quoted default is not closed.`
     );
-    return;
-  }
-  let lastSequence = -1;
-  for (; ; ) {
-    const detail = await client.deployments.get(deploymentId);
-    for (const log of detail.logs) {
-      if (log.sequence > lastSequence) {
-        lastSequence = log.sequence;
-        context.output.log(formatBuildLog(log));
-      }
-    }
-    if (isTerminalStatus(detail.deployment.status)) {
-      context.output.result(
-        {
-          deploymentId,
-          type: "build",
-          status: detail.deployment.status,
-          logs: detail.logs
-        },
-        [`\u2014 deployment ${detail.deployment.status} \u2014`]
+  const [name, type, ...modifiers] = parts;
+  if (!name || !type) throw new NaroError("VALIDATION_FAILED", SPEC_USAGE);
+  const column = {
+    name,
+    type
+  };
+  let onDelete;
+  for (const modifier of modifiers) {
+    const eq = modifier.indexOf("=");
+    const key = (eq < 0 ? modifier : modifier.slice(0, eq)).toLowerCase();
+    const value = eq < 0 ? void 0 : modifier.slice(eq + 1);
+    if (value === void 0 && key === "pk") column.primaryKey = true;
+    else if (value === void 0 && key === "autoincrement")
+      column.autoIncrement = true;
+    else if (value === void 0 && key === "notnull") column.notNull = true;
+    else if (value === void 0 && key === "unique") column.unique = true;
+    else if (value !== void 0 && key === "default")
+      column.default = defaultValue(value);
+    else if (value !== void 0 && key === "references") {
+      const dot = value.lastIndexOf(".");
+      const table = dot < 0 ? "" : value.slice(0, dot);
+      const target = dot < 0 ? "" : value.slice(dot + 1);
+      if (!table || !target)
+        throw new NaroError(
+          "VALIDATION_FAILED",
+          `${shown}: references needs <table>.<column>.`
+        );
+      column.references = { table, column: target };
+    } else if (value !== void 0 && key === "ondelete") {
+      onDelete = ON_DELETE[value.toLowerCase()];
+      if (!onDelete)
+        throw new NaroError(
+          "VALIDATION_FAILED",
+          `${shown}: ondelete takes cascade, set-null, set-default, restrict or no-action.`
+        );
+    } else
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${shown}: unknown modifier ${printable(modifier)}. Use pk, autoincrement, notnull, unique, default=<value>, references=<table>.<column> or ondelete=<action>.`
       );
-      return;
-    }
-    await sleep(FOLLOW_INTERVAL_MS);
   }
+  if (onDelete !== void 0) {
+    if (!column.references)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `${shown}: ondelete needs references=<table>.<column>.`
+      );
+    column.references.onDelete = onDelete;
+  }
+  return column;
 }
-async function runtimeLogs(context, client, projectId) {
-  const environment = context.flags.env === "preview" ? "preview" : "production";
-  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--env must be production or preview."
+function policyLine(policy, dryRun = false) {
+  const rules = [policy.select, policy.insert, policy.update, policy.delete];
+  const owner = policy.ownerColumn === null ? "" : ` (owner column ${printable(policy.ownerColumn)})`;
+  const uniform = rules.every((rule) => rule === rules[0]);
+  const summary = uniform ? `${String(rules[0])} for select, insert, update and delete` : `select ${policy.select}, insert ${policy.insert}, update ${policy.update}, delete ${policy.delete}`;
+  const head = dryRun ? "Would set the Data API policy" : "\u2713 Data API policy";
+  return `${head} on ${printable(policy.table)}: ${summary}${owner}.`;
+}
+function ruleText(value) {
+  if (typeof value === "string") return value;
+  return "invalid" in value ? "invalid" : "condition";
+}
+var SUGAR_NAME = /^naro_(?:select|insert|update|delete)$/;
+function removedLines(policy, dryRun) {
+  const verb = dryRun ? "Would remove" : "\u2713 Removed";
+  const names = policy.policies ?? [];
+  let line;
+  if (names.every((name) => SUGAR_NAME.test(name))) {
+    const owner = policy.ownerColumn === null ? "" : `, owner column ${printable(policy.ownerColumn)}`;
+    const rules = `select ${ruleText(policy.select)}, insert ${ruleText(policy.insert)}, update ${ruleText(policy.update)}, delete ${ruleText(policy.delete)}${owner}`;
+    line = `${verb} the Data API policy on ${printable(policy.table)} (${rules}).`;
+  } else
+    line = `${verb} ${String(names.length)} Data API ${names.length === 1 ? "policy" : "policies"} on ${printable(policy.table)}: ${names.map(printable).join(", ")}.`;
+  const heading = "  As SQL, for naro policy create:";
+  const statements = policy.statements;
+  if (statements === void 0) {
+    const sql = policy.sql ?? "";
+    if (sql === "") return [line];
+    return isPrintable(sql) ? [line, heading, sql] : [
+      line,
+      "  The SQL has characters that cannot be shown here: --json has the exact text."
+    ];
+  }
+  const owners = statements.filter(
+    (statement) => typeof statement.ownerColumn === "string"
+  );
+  const created = statements.filter((statement) => !owners.includes(statement));
+  const lines = [line];
+  if (created.length > 0)
+    lines.push(
+      heading,
+      ...created.map(
+        (statement) => shownStatement(statement, policy.table, "--json")
+      )
     );
-  const options = {
-    environment,
-    ...context.flags.level ? { level: context.flags.level } : {}
-  };
-  if (!context.flags.follow) {
-    const entries = await client.logs.runtime(projectId, options);
-    context.output.result(
-      { projectId, type: "runtime", environment, entries },
-      entries.length > 0 ? entries.map(formatRuntimeLog) : ["(no runtime logs yet \u2014 the worker logs on each request)"]
+  if (owners.length > 0) {
+    const one = owners.length === 1;
+    const command = policy.setCommand;
+    lines.push(
+      `  As a command, for the owner ${one ? "rule" : "rules"} (${owners.map((owner) => printable(owner.name)).join(", ")}): CREATE POLICY has no owner column, so naro policy create cannot make ${one ? "it" : "them"} again.`,
+      // The server's bytes, or not shown: a name may hold a line break.
+      typeof command !== "string" ? "  naro policy set <table> --<action> owner --owner <column> sets one." : isPrintable(command) ? command : "  The command has characters that cannot be shown here: --json has the exact text."
     );
-    return;
   }
-  context.output.log(
-    `Following ${environment} runtime logs (Ctrl-C to stop)...`
+  return lines;
+}
+function removedBeforeFailure(error) {
+  if (!isNaroError(error)) return [];
+  const removed = error.details?.removedPolicies;
+  if (!Array.isArray(removed)) return [];
+  return removed.filter(
+    (entry) => typeof entry === "object" && entry !== null && typeof entry.table === "string" && entry.ownerColumn !== void 0
   );
-  let lastTs = -1;
-  let boundary = /* @__PURE__ */ new Set();
-  for (; ; ) {
-    const entries = await client.logs.runtime(projectId, options);
-    for (const entry of entries) {
-      if (entry.ts < lastTs) continue;
-      const key = JSON.stringify(entry);
-      if (entry.ts === lastTs) {
-        if (boundary.has(key)) continue;
-      } else {
-        lastTs = entry.ts;
-        boundary = /* @__PURE__ */ new Set();
-      }
-      boundary.add(key);
-      context.output.log(formatRuntimeLog(entry));
-    }
-    await sleep(FOLLOW_INTERVAL_MS);
-  }
 }
-async function runLogs(context) {
+async function runSchemaChange(context, operations, question) {
+  const dryRun = context.flags.dryRun === true;
+  if (question !== void 0 && !dryRun)
+    await confirmOrAbort(context, question);
+  const sent = dryRun ? operations.map((operation) => {
+    if (operation.op !== "dropTable" && operation.op !== "dropColumn")
+      return operation;
+    const { confirm: _confirm, ...rest } = operation;
+    return rest;
+  }) : operations;
   const client = await context.client();
-  const [deploymentId] = context.positionals;
-  const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
-  if (type !== "build" && type !== "runtime")
-    throw new NaroError(
-      "VALIDATION_FAILED",
-      "--type must be build or runtime."
-    );
-  if (type === "runtime") {
-    if (deploymentId)
-      throw new NaroError(
-        "VALIDATION_FAILED",
-        "Runtime logs are per project, not per deployment. Drop the deployment id or use --type build."
-      );
-    const projectId = await context.resolveProjectId();
-    await runtimeLogs(context, client, projectId);
+  const projectId = await context.resolveProjectId();
+  const dir = migrationsDir(context);
+  const local = listMigrationFiles(dir);
+  const ledger = await appliedMigrations(client, projectId);
+  const pending = pendingMigrationNames(local, ledger);
+  if (pending.length > 0 && !dryRun)
+    throw migrationsPendingError(pending.map(printable));
+  const name = nextMigrationFileName(
+    [...local, ...ledger.map((row) => row.name)],
+    schemaMigrationTitle(operations[0] ?? {})
+  );
+  const result = await client.db.schema(projectId, sent, {
+    ...dryRun ? { dryRun: true } : {},
+    name
+  }).catch((error) => {
+    if (!context.flags.json)
+      for (const policy of removedBeforeFailure(error))
+        for (const line of removedLines(policy, false))
+          context.output.warn(line);
+    throw error;
+  });
+  const sqlLines = result.sql.trimEnd().split("\n").map(printable);
+  const removed = result.removedPolicies ?? [];
+  if (result.dryRun) {
+    for (const warning of result.warnings)
+      context.output.warn(`\u26A0 ${printable(warning)}`);
+    context.output.result({ projectId, ...result, file: null }, [
+      ...sqlLines,
+      `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
+      ...result.policies.map((policy) => policyLine(policy, true)),
+      ...removed.flatMap((policy) => removedLines(policy, true))
+    ]);
     return;
   }
-  const target = deploymentId ?? await latestProductionDeploymentId(
-    client,
-    await context.resolveProjectId()
+  const allWarnings = result.name === name ? result.warnings : [...result.warnings, migrationNameMismatch(name, result.name)];
+  let file = null;
+  let fileWarning;
+  const relDir = relativeToCwd(context, dir);
+  const rel = join3(relDir === "." ? "" : relDir, name);
+  if (context.flags.noWrite) {
+    fileWarning = `Not written to ${relDir} (--no-write): naro db reset will not re-apply ${result.name}, and naro migration list shows it as remote-only.`;
+  } else {
+    try {
+      mkdirSync3(dir, { recursive: true });
+      writeFileSync3(join3(dir, name), result.sql, { flag: "wx" });
+      file = rel;
+    } catch (error) {
+      const reason = (error instanceof Error ? error.message : String(error)).replace(/[.\s]+$/, "");
+      fileWarning = `Applied, but ${rel} could not be written: ${reason}. Save the SQL above as ${rel} so naro db push and naro db reset see it.`;
+    }
+  }
+  for (const warning of allWarnings)
+    context.output.warn(`\u26A0 ${printable(warning)}`);
+  if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
+  context.output.result(
+    {
+      projectId,
+      ...result,
+      warnings: allWarnings,
+      file,
+      ...fileWarning ? { fileWarning } : {}
+    },
+    [
+      ...sqlLines,
+      file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
+      ...result.policies.map((policy) => policyLine(policy)),
+      ...removed.flatMap((policy) => removedLines(policy, false))
+    ]
   );
-  await buildLogs(context, client, target);
 }
-
-// src/commands/policy.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve4 } from "path";
-
-// ../../packages/naro-sdk/src/query/filters.ts
-var MAX_FILTER_DEPTH = 4;
-var OPERATORS = {
-  eq: "eq",
-  neq: "neq",
-  gt: "gt",
-  gte: "gte",
-  lt: "lt",
-  lte: "lte",
-  in: "in",
-  is: "is",
-  like: "like",
-  ilike: "ilike",
-  contains: "contains",
-  containedBy: "containedBy",
-  overlaps: "overlaps",
-  cs: "contains",
-  cd: "containedBy",
-  ov: "overlaps"
-};
-function operatorOf(name) {
-  return typeof name === "string" && Object.hasOwn(OPERATORS, name) ? OPERATORS[name] : void 0;
+function columnsFlag(context) {
+  return context.flags.columns ?? [];
+}
+async function runDbTableUsage() {
+  throw new NaroError("VALIDATION_FAILED", USAGE2.table);
+}
+async function runDbIndexUsage() {
+  throw new NaroError("VALIDATION_FAILED", USAGE2.index);
+}
+async function runDbTableCreate(context) {
+  const [table] = context.positionals;
+  const specs = columnsFlag(context);
+  if (!table || specs.length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.create);
+  const columns = specs.map(parseColumnSpec);
+  const owner = context.flags.ownerColumn;
+  await runSchemaChange(context, [
+    {
+      op: "createTable",
+      table,
+      columns,
+      ...context.flags.ifNotExists ? { ifNotExists: true } : {},
+      ...owner === void 0 ? {} : { owner: { column: owner } }
+    }
+  ]);
+}
+async function runDbTableAddColumn(context) {
+  const [table] = context.positionals;
+  const specs = columnsFlag(context);
+  const [spec] = specs;
+  if (!table || spec === void 0 || specs.length !== 1)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.addColumn);
+  await runSchemaChange(context, [
+    { op: "addColumn", table, column: parseColumnSpec(spec) }
+  ]);
+}
+async function runDbTableRenameColumn(context) {
+  const [table, column, to] = context.positionals;
+  if (!table || !column || !to)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.renameColumn);
+  await runSchemaChange(context, [{ op: "renameColumn", table, column, to }]);
+}
+async function runDbTableRename(context) {
+  const [table, to] = context.positionals;
+  if (!table || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
+  await runSchemaChange(context, [{ op: "renameTable", table, to }]);
+}
+async function runDbTableDropColumn(context) {
+  const [table, column] = context.positionals;
+  if (!table || !column)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
+  const target = `${table}.${column}`;
+  await runSchemaChange(
+    context,
+    [{ op: "dropColumn", table, column, confirm: target }],
+    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
+  );
+}
+async function runDbTableDrop(context) {
+  const [table] = context.positionals;
+  if (!table) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  await runSchemaChange(
+    context,
+    [{ op: "dropTable", table, confirm: table }],
+    `Drop table ${printable(table)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+  );
+}
+async function runDbIndexCreate(context) {
+  const [table, list] = context.positionals;
+  const columns = listFlag(list);
+  if (!table || columns.length === 0)
+    throw new NaroError("VALIDATION_FAILED", USAGE2.indexCreate);
+  const name = context.flags.name;
+  await runSchemaChange(context, [
+    {
+      op: "createIndex",
+      table,
+      columns,
+      ...context.flags.unique ? { unique: true } : {},
+      ...name === void 0 ? {} : { name }
+    }
+  ]);
 }
-var Refusal = class extends Error {
-};
-function refuse(reason) {
-  throw new Refusal(reason);
+async function runDbIndexDrop(context) {
+  const [name] = context.positionals;
+  if (!name) throw new NaroError("VALIDATION_FAILED", USAGE2.indexDrop);
+  await runSchemaChange(context, [{ op: "dropIndex", name }]);
 }
-var LIST_HINT = {
-  in: ["(", ")", "needs a list in parentheses, like in.(a,b),"],
-  array: ["{", "}", "needs a list in braces, like cs.{a,b},"]
+
+// src/commands/git.ts
+var defaults2 = {
+  detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
+  openBrowser,
+  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
 };
-function isSpace(char) {
-  return char !== "" && char.trim() === "";
-}
-function looseWord(text) {
-  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "");
+function connected(context, project) {
+  const branch = project.defaultBranch;
+  context.output.result(
+    {
+      projectId: project.id,
+      repositoryFullName: project.repositoryFullName,
+      autoDeploy: true
+    },
+    [
+      `\u2705 Connected to ${project.repositoryFullName ?? "the repository"}.`,
+      `   Pushes to ${branch} now deploy automatically.`,
+      "",
+      "   To turn this off: naro git disconnect"
+    ]
+  );
 }
-var Parser = class {
-  constructor(text, tokens = {}) {
-    this.text = text;
-    this.tokens = tokens;
-  }
-  index = 0;
-  /**
-   * A token at the next value, followed only by spaces and then one of
-   * `stops` or the end — `auth.uid()x` is text, not the token.
-   */
-  token(stops) {
-    this.skipSpaces();
-    const at = this.index;
-    for (const [word, value] of Object.entries(this.tokens)) {
-      if (!this.text.startsWith(word, at)) continue;
-      let end = at + word.length;
-      while (isSpace(this.text[end] ?? "")) end++;
-      const next = this.text[end] ?? "";
-      if (next !== "" && !stops.includes(next)) continue;
-      this.index = end;
-      return { value, word, at };
+async function runGitConnect(context, overrides = {}) {
+  const deps = { ...defaults2, ...overrides };
+  const { output } = context;
+  const explicit = context.positionals[0];
+  let fullName;
+  if (explicit) {
+    const parsed = parseGitHubRemote(explicit) ?? parseGitHubRemote(`https://github.com/${explicit}`);
+    if (!parsed)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `"${explicit}" is not an owner/repo pair.`
+      );
+    fullName = parsed.fullName;
+  } else {
+    const remote = await deps.detectRemote(context.cwd);
+    const parsed = remote ? parseGitHubRemote(remote) : null;
+    if (!parsed) {
+      throw new NaroError(
+        "NO_GIT_REMOTE",
+        remote ? `Could not read a GitHub owner/repo from "${remote}". Pass it directly: naro git connect <owner/repo>` : "This directory has no GitHub origin remote. Pass one directly: naro git connect <owner/repo>"
+      );
     }
-    return void 0;
-  }
-  at() {
-    return this.text[this.index] ?? "";
-  }
-  /**
-   * An unquoted value that is one of the tokens misspelled — `auth.uid`,
-   * `AUTH.UID` — is refused: read as text it would compare with the words
-   * themselves (사용자 리뷰 반영). Quoted, it is the text.
-   */
-  notNearToken(value, at) {
-    const loose = looseWord(value);
-    for (const word of Object.keys(this.tokens))
-      if (loose !== "" && loose === looseWord(word))
-        refuse(
-          `has ${JSON.stringify(value)} ${this.where(at)}: did you mean ${word}? Quote it to mean the text`
-        );
-  }
-  /** `scalar`, with an unquoted value held to notNearToken. */
-  bareOrQuoted(stops) {
-    this.skipSpaces();
-    const at = this.index;
-    const quoted = this.at() === '"';
-    const text = this.scalar(stops);
-    if (!quoted) this.notNearToken(text, at);
-    return { text, quoted };
+    fullName = parsed.fullName;
   }
-  where(index = this.index) {
-    return `at character ${String(index + 1)}`;
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const first = await client.projects.connectGit(projectId, fullName);
+  if (first.ok) {
+    connected(context, first.project);
+    return;
   }
-  skipSpaces() {
-    while (isSpace(this.at())) this.index++;
+  if (!first.installUrl) {
+    throw new NaroError(
+      "REPOSITORY_NOT_ACCESSIBLE",
+      `Naro cannot reach ${fullName}, and no install URL was offered. Connect it from the dashboard.`
+    );
   }
-  /** `item ("," item)*`, up to a `)` or the end, inside `level` groups. */
-  list(level) {
-    const nodes = [];
-    for (; ; ) {
-      nodes.push(this.item(level));
-      this.skipSpaces();
-      const char = this.at();
-      if (char === ",") this.index++;
-      else if (char === ")" || char === "") return nodes;
-      else refuse(`has unexpected text ${this.where()}`);
+  output.log(`
+\u25B8 Naro needs access to ${fullName}.`);
+  output.log(`  Opening ${first.installUrl}`);
+  deps.openBrowser(first.installUrl);
+  output.log("  Waiting for the installation to finish...\n");
+  await waitForInstall(context, projectId, fullName, deps);
+}
+async function waitForInstall(context, projectId, fullName, deps) {
+  const client = await context.client();
+  const project = await client.projects.get(projectId);
+  const teams = await client.teams.list();
+  const teamSlug = teams.find((team) => team.id === project.teamId)?.slug;
+  if (teamSlug) {
+    const attempts = deps.pollAttempts ?? 60;
+    const interval = deps.pollIntervalMs ?? 3e3;
+    for (let attempt2 = 0; attempt2 < attempts; attempt2 += 1) {
+      await deps.sleep(interval);
+      let reachable = false;
+      try {
+        const repositories = await client.github.listRepositories(teamSlug);
+        reachable = repositories.some(
+          (repository) => repository.fullName.toLowerCase() === fullName.toLowerCase()
+        );
+      } catch {
+      }
+      if (!reachable) continue;
+      const retry = await client.projects.connectGit(projectId, fullName);
+      if (retry.ok) {
+        connected(context, retry.project);
+        return;
+      }
     }
   }
-  item(level) {
-    this.skipSpaces();
-    const start = this.index;
-    const char = this.at();
-    if (char === "" || char === "," || char === ")")
-      refuse(`has an empty item ${this.where()}`);
-    const group = /^(not\.)?(and|or)\(/.exec(this.text.slice(start));
-    if (!group) return this.leaf(level);
-    const negated = group[1] !== void 0;
-    const inner = level + (negated ? 2 : 1);
-    if (inner > MAX_FILTER_DEPTH)
-      refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
-    const open = start + group[0].length - 1;
-    this.index = open + 1;
-    const children = this.list(inner);
-    if (this.at() !== ")") refuse(`has an unclosed "(" ${this.where(open)}`);
-    this.index++;
-    const node = group[2] === "or" ? { or: children } : { and: children };
-    return negated ? { not: node } : node;
-  }
-  /** `column.[not.]operator.value`. */
-  leaf(level) {
-    const start = this.index;
-    const column = this.at() === '"' ? this.quoted() : this.word().trim();
-    if (column === "" || this.at() !== ".")
-      refuse(`needs column.operator.value ${this.where(start)}`);
-    this.index++;
-    let nameAt = this.index;
-    let name = this.word();
-    let negated = false;
-    if (name === "not" && this.at() === ".") {
-      if (level + 1 > MAX_FILTER_DEPTH)
-        refuse(`nests deeper than ${String(MAX_FILTER_DEPTH)} groups`);
-      negated = true;
-      this.index++;
-      nameAt = this.index;
-      name = this.word();
+  context.output.result(
+    { projectId, repositoryFullName: null, autoDeploy: false },
+    [
+      `\u25B8 Still waiting on access to ${fullName}.`,
+      "  Finish the installation, then run: naro git connect"
+    ]
+  );
+}
+async function runGitDisconnect(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.disconnectGit(projectId);
+  context.output.result({ projectId: project.id, autoDeploy: false }, [
+    `\u2705 ${project.name} no longer deploys on push.`,
+    "   Deploy from here with: naro deploy"
+  ]);
+}
+async function offerAutoDeploy(context, projectId, overrides) {
+  const deps = { ...defaults2, ...overrides };
+  if (overrides.canPrompt === false) return;
+  try {
+    if (readProjectLink(context.cwd)?.autoDeployDeclined === true) return;
+    const connection = overrides.gitConnection;
+    if (connection.state === "connected" || connection.state === "none") return;
+    const fullName = connection.fullName;
+    if (!fullName) return;
+    let wanted;
+    if (connection.state === "unreachable") {
+      const installed = connection.installedAccounts ?? [];
+      context.output.log(
+        `
+\u25B8 Automatic deploys need the Naro GitHub App on \`${connection.repoOwner ?? fullName}\`.`
+      );
+      if (overrides.teamSlug && installed.length > 0)
+        context.output.log(
+          `  Team ${overrides.teamSlug} has it on: ${installed.join(", ")}.`
+        );
+      wanted = await context.prompter.confirm(
+        "Install it for this team now? (opens your browser)"
+      );
+    } else {
+      wanted = await context.prompter.confirm(
+        "Should your changes deploy automatically from now on?"
+      );
     }
-    const operator = operatorOf(name);
-    if (this.at() !== ".") {
-      if (name !== "" && operator === void 0)
-        refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
-      refuse(`needs column.operator.value ${this.where(start)}`);
+    if (!wanted) {
+      const link = readProjectLink(context.cwd);
+      writeProjectLink(context.cwd, {
+        ...link ?? { projectId },
+        autoDeployDeclined: true
+      });
+      context.output.log(
+        "\u25B8 Not now. Later, if you change your mind: naro git connect"
+      );
+      return;
     }
-    if (operator === void 0)
-      refuse(`has an unknown operator "${name}" ${this.where(nameAt)}`);
-    this.index++;
-    const leaf = { operator, column, value: this.value(operator) };
-    return negated ? { not: leaf } : leaf;
+    const client = await context.client();
+    const result = await client.projects.connectGit(projectId, fullName);
+    if (result.ok) {
+      connected(context, result.project);
+      return;
+    }
+    if (!result.installUrl) return;
+    context.output.log(`
+\u25B8 Naro needs access to ${fullName}.`);
+    context.output.log(`  Opening ${result.installUrl}`);
+    deps.openBrowser(result.installUrl);
+    context.output.log("  Waiting for the installation to finish...\n");
+    await waitForInstall(context, projectId, fullName, deps);
+  } catch (error) {
+    context.output.log(
+      `\u25B8 Could not set up automatic deploys (${error instanceof Error ? error.message : String(error)}).`
+    );
+    context.output.log("  Try later with: naro git connect");
   }
-  /** Up to the next `.`, `,`, `(`, `)` or the end. */
-  word() {
-    const start = this.index;
-    while (this.index < this.text.length && !".,()".includes(this.at()))
-      this.index++;
-    return this.text.slice(start, this.index);
+}
+
+// src/commands/link.ts
+var SWITCH_ACCOUNT = "Sign in as a different account\u2026";
+async function resolveTeam(context, teams, deps = {}) {
+  const explicit = context.flags.team ?? process.env.NARO_TEAM;
+  if (explicit) {
+    const match = teams.find((team) => team.slug === explicit);
+    if (!match)
+      throw new NaroError(
+        "NOT_FOUND",
+        `You are not a member of team "${explicit}".`
+      );
+    return match;
   }
-  /** `"…"`, with `\` making the next character literal. */
-  quoted() {
-    const start = this.index;
-    this.index++;
-    let text = "";
-    for (; ; ) {
-      if (this.index >= this.text.length)
-        refuse(`has an unclosed quote ${this.where(start)}`);
-      const char = this.at();
-      this.index++;
-      if (char === '"') return text;
-      if (char === "\\" && this.index < this.text.length) {
-        text += this.at();
-        this.index++;
-      } else text += char;
-    }
+  const linked = context.projectLink();
+  if (linked?.teamSlug) {
+    const match = teams.find((team) => team.slug === linked.teamSlug);
+    if (match) return match;
   }
-  /** A quoted value, or everything up to `stops`, trimmed. */
-  scalar(stops) {
-    this.skipSpaces();
-    if (this.at() === '"') {
-      const text = this.quoted();
-      this.skipSpaces();
-      if (this.at() !== "" && !stops.includes(this.at()))
-        refuse(`has text after a closing quote ${this.where()}`);
-      return text;
-    }
-    const start = this.index;
-    while (this.index < this.text.length && !stops.includes(this.at()))
-      this.index++;
-    return this.text.slice(start, this.index).trim();
+  if (teams.length === 0)
+    throw new NaroError("NOT_FOUND", "Your account has no teams yet.");
+  const only = teams.length === 1 ? teams[0] : null;
+  const deploying = (deps.intent ?? "deploy") === "deploy";
+  if (only && !deploying) return only;
+  const canPrompt = deps.canPrompt?.() ?? (!context.flags.json && !context.flags.yes && isInteractive());
+  if (!canPrompt)
+    throw new NaroError(
+      "TEAM_REQUIRED",
+      `Cannot pick a team without a prompt. Pass --team <slug>, set NARO_TEAM, or run \`naro link\` first.
+  Your teams: ${teams.map((team) => team.slug).join(", ")}`
+    );
+  const account = deps.accountLabel ? await deps.accountLabel() : "this account";
+  if (only) {
+    const label2 = only.isPersonal ? `${only.name} (personal)` : only.name;
+    context.output.log(`
+   ${account} \u2192 ${label2}`);
+    const ok = await context.prompter.confirm(
+      "Deploy to this account and team?"
+    );
+    if (ok) return only;
+    return switchAndRetry(context, deps);
   }
-  /**
-   * `(a,b)` for `in`: text values, except that an unquoted `true` or `false`
-   * is a boolean (사용자 리뷰 반영, as in `eq`). `{a,b}` for the array
-   * operators: text, except that an unquoted exact decimal is a number
-   * (적대적 리뷰 반영, narrowed by 사용자 리뷰 반영) — json_each's values
-   * have no type affinity to turn the text "1" into 1, so as text `cs.{1}`
-   * matched no numeric array and `not.ov.{1}` matched every row. Quoted,
-   * `"1"` and `"true"` stay text.
-   */
-  listValue(kind) {
-    const [open, close, hint] = LIST_HINT[kind];
-    this.skipSpaces();
-    const openAt = this.index;
-    if (this.at() !== open) refuse(`${hint} ${this.where()}`);
-    this.index++;
-    this.skipSpaces();
-    const values = [];
-    if (this.at() === close) {
-      this.index++;
-      return values;
-    }
-    for (; ; ) {
-      this.skipSpaces();
-      const itemAt = this.index;
-      const token = this.token(`,${close}`);
-      if (token) values.push(token.value);
-      else {
-        const { text: value, quoted } = this.bareOrQuoted(`,${close}`);
-        if (!quoted && value === "") {
-          if (this.index >= this.text.length)
-            refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
-          refuse(`has an empty item ${this.where(itemAt)}`);
-        }
-        values.push(
-          quoted ? value : kind === "array" ? exactNumber(value) : truth(value)
-        );
-      }
-      if (this.index >= this.text.length)
-        refuse(`has an unclosed "${open}" ${this.where(openAt)}`);
-      const char = this.at();
-      this.index++;
-      if (char === close) return values;
+  const options = [
+    ...teams.map(
+      (team) => `${team.name}${team.isPersonal ? "  (personal)" : ""}`
+    ),
+    SWITCH_ACCOUNT
+  ];
+  const index = await context.prompter.select(
+    deploying ? `Deploying as ${account} \u2014 which team owns this project?` : `Signed in as ${account}. Which team?`,
+    options
+  );
+  const picked = teams[index];
+  if (picked) return picked;
+  return switchAndRetry(context, deps);
+}
+async function switchAndRetry(context, deps) {
+  if (!deps.switchAccount || !deps.listTeams)
+    throw new NaroError(
+      "CANCELED",
+      "Canceled. Switch accounts with `naro logout && naro login`."
+    );
+  await deps.switchAccount();
+  const teams = await deps.listTeams();
+  return resolveTeam(context, teams, deps);
+}
+function saveLink(context, project, teamSlug) {
+  writeProjectLink(context.cwd, {
+    projectId: project.id,
+    teamSlug,
+    projectName: project.name
+  });
+  if (ensureGitignoreHasNaro(context.cwd))
+    context.output.log("\u25B8 added .naro to .gitignore");
+}
+async function runLink(context) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const team = await resolveTeam(context, teams, { intent: "read" });
+  const projects = await client.projects.list(team.slug);
+  let project;
+  if (context.flags.project) {
+    project = projects.find(
+      (candidate) => candidate.id === context.flags.project
+    );
+    if (!project) {
+      project = await client.projects.get(context.flags.project);
     }
-  }
-  /** The value after `operator.`. */
-  value(operator) {
-    const start = this.index;
-    switch (operator) {
-      case "in":
-        return this.listValue("in");
-      case "contains":
-      case "containedBy":
-      case "overlaps":
-        return this.listValue("array");
-      case "is":
-        return keyword(this.scalar(",)"), start);
-      case "like":
-      case "ilike": {
-        const token = this.token(",)");
-        if (token)
-          refuse(
-            `cannot use ${token.word} with ${operator} ${this.where(token.at)}`
-          );
-        return likePattern(this.bareOrQuoted(",)").text);
-      }
-      case "eq":
-      case "neq": {
-        const token = this.token(",)");
-        if (token) return token.value;
-        const { text, quoted } = this.bareOrQuoted(",)");
-        return quoted ? text : truth(text);
-      }
-      default: {
-        const token = this.token(",)");
-        return token ? token.value : this.bareOrQuoted(",)").text;
-      }
+  } else if (context.flags.name) {
+    project = projects.find(
+      (candidate) => candidate.name === context.flags.name || candidate.slug === context.flags.name
+    );
+    if (!project)
+      throw new NaroError(
+        "PROJECT_NOT_FOUND",
+        `No project named "${context.flags.name}" in team ${team.slug}. Run \`naro deploy\` to create it.`
+      );
+  } else {
+    const guess = slugify(context.cwd.split("/").at(-1) ?? "app");
+    const exact = projects.find(
+      (candidate) => candidate.name === guess || candidate.slug === guess
+    );
+    if (exact && (context.flags.yes || context.flags.json)) {
+      project = exact;
+    } else if (projects.length === 0) {
+      throw new NaroError(
+        "PROJECT_NOT_FOUND",
+        `Team ${team.slug} has no projects yet. Run \`naro deploy\` to create one.`
+      );
+    } else {
+      const options = projects.map(
+        (candidate) => `${candidate.name} (${candidate.subdomain})`
+      );
+      const index = await context.prompter.select(
+        `Link ${context.cwd} to which project?`,
+        options
+      );
+      project = projects[index];
     }
   }
-};
-function likePattern(pattern) {
-  return pattern.replaceAll("*", "%");
+  if (!project)
+    throw new NaroError("PROJECT_NOT_FOUND", "No project selected.");
+  const owningTeam = teams.find((candidate) => candidate.id === project.teamId) ?? team;
+  saveLink(context, project, owningTeam.slug);
+  context.output.result(
+    {
+      projectId: project.id,
+      projectName: project.name,
+      teamSlug: owningTeam.slug,
+      subdomain: project.subdomain
+    },
+    [`\u2705 Linked to ${owningTeam.slug}/${project.name} (.naro/project.json)`]
+  );
 }
-function truth(text) {
-  const word = text.toLowerCase();
-  if (word === "true") return true;
-  if (word === "false") return false;
-  return text;
+async function runUnlink(context) {
+  const existing = readProjectLink(context.cwd);
+  const removed = removeProjectLink(context.cwd);
+  context.output.result(
+    { removed, ...existing ? { projectId: existing.projectId } : {} },
+    [removed ? "\u2705 Unlinked (.naro removed)" : "Nothing to unlink here."]
+  );
 }
-var DECIMAL = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
-function exactNumber(text) {
-  if (!DECIMAL.test(text)) return text;
-  const number = Number(text);
-  if (!text.includes(".")) return Number.isSafeInteger(number) ? number : text;
-  const trimmed = text.replace(/\.?0+$/, "");
-  return String(number) === trimmed ? number : text;
+
+// src/commands/deploy.ts
+async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
+  const { flags, output } = context;
+  const link = flags.project ? { projectId: flags.project, teamSlug: void 0 } : readProjectLink(context.cwd);
+  if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
+    const confirmed = await context.prompter.confirm("Deploy to production?");
+    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  }
+  output.log(`
+\u{1F680} Deploying ${context.cwd}
+`);
+  const canPrompt = deps.canPrompt?.() ?? (!flags.json && !flags.yes && isInteractive());
+  const team = await resolveDestination(context, link, canPrompt);
+  const account = await accountLabel(context);
+  output.log(`   ${account} \u2192 ${team.slug}
+`);
+  const result = await deps.deploy(
+    context.cwd,
+    {
+      name: flags.name,
+      projectId: link?.projectId,
+      teamSlug: team.slug,
+      rootDirectory: flags.root ?? null,
+      branch: flags.branch,
+      production: flags.prod,
+      ...canPrompt && {
+        onMissingEnv: (keys) => promptForMissingEnv(
+          { cwd: context.cwd, prompter: context.prompter, output },
+          keys
+        )
+      },
+      token: flags.token,
+      allowLogin: !flags.json && !flags.yes
+    },
+    (message) => output.log(message)
+  );
+  const existing = readProjectLink(context.cwd);
+  writeProjectLink(context.cwd, {
+    projectId: result.projectId,
+    teamSlug: result.teamSlug,
+    projectName: result.projectSlug,
+    ...existing?.autoDeployDeclined === true ? { autoDeployDeclined: true } : {}
+  });
+  if (!link) {
+    if (ensureGitignoreHasNaro(context.cwd))
+      output.log("\u25B8 added .naro to .gitignore");
+    output.log("\u25B8 linked (.naro/project.json)");
+  }
+  await deps.offerAutoDeploy?.(context, result.projectId, {
+    canPrompt,
+    gitConnection: result.gitConnection,
+    teamSlug: result.teamSlug
+  });
+  const inspect = `${controlPlaneUrl()}${projectPath(result.teamSlug, result.projectSlug)}`;
+  context.output.result(
+    {
+      deploymentId: result.deploymentId,
+      projectId: result.projectId,
+      status: result.status,
+      url: result.url,
+      target: result.production ? "production" : "preview",
+      teamSlug: result.teamSlug,
+      inspectUrl: inspect,
+      missingEnvKeys: result.missingEnvKeys
+    },
+    [
+      "",
+      `\u2705 Deployment ready (${result.production ? "production" : "preview"})`,
+      "",
+      `   ${result.url}`,
+      `   Inspect  ${inspect}`
+    ]
+  );
 }
-function quoteFilterValue(value) {
-  const text = String(value);
-  return `"${text.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+async function resolveDestination(context, link, canPrompt) {
+  const client = await context.client();
+  const teams = await client.teams.list();
+  const deps = scopeDeps(context, canPrompt);
+  if (link?.teamSlug) {
+    const match = teams.find((team) => team.slug === link.teamSlug);
+    if (match) return match;
+  } else if (link) {
+    let project;
+    try {
+      project = await client.projects.get(link.projectId);
+    } catch (error) {
+      if (isNaroError(error) && error.code !== "NOT_FOUND") throw error;
+      throw new NaroError(
+        "PROJECT_NOT_FOUND",
+        `This directory is linked to a project ${await accountLabel(context)} cannot see.
+  The CLI signs in separately from the dashboard \u2014 check with \`naro whoami\`.
+  Wrong account?  naro logout && naro login
+  Project gone?   remove .naro, then naro deploy`,
+        { cause: error }
+      );
+    }
+    const match = teams.find((team) => team.id === project.teamId);
+    if (match) return match;
+  }
+  return resolveTeam(context, teams, deps);
 }
-function keyword(text, at) {
-  const word = text.toLowerCase();
-  if (word === "null") return null;
-  if (word === "true") return true;
-  if (word === "false") return false;
-  return refuse(
-    `needs null, true or false after is at character ${String(at + 1)}`
-  );
+function scopeDeps(context, canPrompt) {
+  return {
+    canPrompt: () => canPrompt,
+    accountLabel: () => accountLabel(context),
+    switchAccount: async () => {
+      clearSession();
+      await runLogin(context);
+    },
+    listTeams: async () => (await context.client()).teams.list()
+  };
 }
-function attempt(parse) {
+async function accountLabel(context) {
   try {
-    return { ok: true, node: parse() };
-  } catch (error) {
-    if (error instanceof Refusal) return { ok: false, reason: error.message };
-    throw error;
+    const { user } = await context.auth();
+    if (!user) return "this account";
+    const name = user.email ?? user.id;
+    return user.github ? `${name} (${user.github})` : name;
+  } catch {
+    return "this account";
   }
 }
-function parseLogic(text, kind, options = {}) {
-  if (typeof text !== "string")
-    return { ok: false, reason: "must be a filter string or a function" };
-  if (text.trim() === "") return { ok: false, reason: "must not be empty" };
-  return attempt(() => {
-    if (options.group === false) {
-      const alone = items(text, options.tokens, 0);
-      if (alone.length === 1 && alone[0]) return alone[0];
-    }
-    const nodes = items(text, options.tokens, 1);
-    return kind === "or" ? { or: nodes } : { and: nodes };
-  });
+
+// src/commands/deployments.ts
+function shortSha(sha) {
+  return sha ? sha.slice(0, 7) : "-";
 }
-function items(text, tokens, level) {
-  const parser = new Parser(text, tokens);
-  const nodes = parser.list(level);
-  if (parser.at() === ")") refuse(`has an unmatched ")" ${parser.where()}`);
-  return nodes;
+function formatDeploymentLine(deployment) {
+  return [
+    deployment.id.padEnd(38),
+    deployment.status.padEnd(10),
+    deployment.branch.padEnd(16),
+    shortSha(deployment.gitCommitSha).padEnd(9),
+    deployment.url ?? ""
+  ].join(" ");
 }
-
-// src/commands/policy.ts
-var SET_USAGE = "Usage: naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>] [--owner <column>] [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>] [--update-check <filter>] [--delete-when <filter>] [--signed-in] | --from-file <policy.json>";
-var REMOVE_USAGE = "Usage: naro policy remove <table>";
-var RULE_FLAGS = {
-  select: "selectRule",
-  insert: "insertRule",
-  update: "updateRule",
-  delete: "deleteRule"
-};
-var WHEN_FLAGS = {
-  select: { key: "selectWhen", tree: "using" },
-  insert: { key: "insertWhen", tree: "check" },
-  update: { key: "updateWhen", tree: "using" },
-  delete: { key: "deleteWhen", tree: "using" }
+async function runDeployments(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const deployments = await client.deployments.list(projectId);
+  context.output.result({ projectId, deployments }, [
+    `Deployments for ${projectId}:`,
+    "",
+    [
+      "ID".padEnd(38),
+      "STATUS".padEnd(10),
+      "BRANCH".padEnd(16),
+      "COMMIT".padEnd(9),
+      "URL"
+    ].join(" "),
+    ...deployments.map(formatDeploymentLine)
+  ]);
+}
+async function runInspect(context) {
+  const [deploymentId] = context.positionalOrThrow(
+    1,
+    "Usage: naro inspect <deployment-id>"
+  );
+  const client = await context.client();
+  const detail = await client.deployments.get(deploymentId);
+  const { deployment } = detail;
+  const lastLogs = detail.logs.slice(-15);
+  context.output.result({ deployment, logs: detail.logs }, [
+    `Deployment ${deployment.id}`,
+    `  status:   ${deployment.status}${deployment.errorCode ? ` (${deployment.errorCode})` : ""}`,
+    `  branch:   ${deployment.branch}`,
+    `  commit:   ${deployment.gitCommitSha ?? "-"}`,
+    `  url:      ${deployment.url ?? "-"}`,
+    `  created:  ${deployment.createdAt}`,
+    `  finished: ${deployment.finishedAt ?? "-"}`,
+    ...deployment.errorMessage ? [`  error:    ${deployment.errorMessage}`] : [],
+    ...lastLogs.length > 0 ? [
+      "",
+      "Recent build logs:",
+      ...lastLogs.map((log) => `  [${log.stage}] ${log.message}`)
+    ] : []
+  ]);
+}
+
+// src/commands/domains.ts
+var defaults3 = {
+  sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+  now: () => Date.now()
 };
-var AUTH_UID = "auth.uid()";
-var OTHER_FLAGS = [
-  "selectRule",
-  "insertRule",
-  "updateRule",
-  "deleteRule",
-  "ownerColumn",
-  "selectWhen",
-  "insertWhen",
-  "updateWhen",
-  "updateCheck",
-  "deleteWhen",
-  "signedIn"
-];
-function isRule(value) {
-  return POLICY_RULES.includes(value);
+var FIRST_DELAY_MS = 5e3;
+var MAX_DELAY_MS = 3e4;
+var WAIT_TIMEOUT_MS = 10 * 6e4;
+function isReady(domain) {
+  return domain.ready ?? (domain.status === "active" && domain.sslStatus === "active");
 }
-function refuse2(message) {
-  throw new NaroError("VALIDATION_FAILED", message);
+function isTerminal(domain) {
+  return domain.ownership === "deleted" || domain.status === "blocked" || domain.status === "moved" || domain.status === "deleted";
 }
-function flagName(key) {
-  return `--${key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}`;
+var AXIS_DONE = /* @__PURE__ */ new Set(["verified", "active", "live"]);
+var AXIS_FAILED = /* @__PURE__ */ new Set(["failed", "deleted"]);
+function axisMark(value) {
+  if (AXIS_DONE.has(value)) return "\u2713";
+  if (AXIS_FAILED.has(value)) return "\u2717";
+  return "\xB7";
 }
-function conditionTree(flag, text) {
-  const parsed = parseLogic(text, "and", {
-    tokens: { [AUTH_UID]: { auth: "uid" } },
-    group: false
-  });
-  if (!parsed.ok) refuse2(`${flag} ${parsed.reason}.`);
-  const tree = parsed.node;
-  const checked = parsePolicyNode(tree, "");
-  if (!checked.ok) {
-    const path = checked.path.replace(/^\./, "");
-    refuse2(
-      path === "" ? `${flag} ${checked.reason}.` : `${flag}: ${path} ${checked.reason}.`
-    );
-  }
-  return tree;
+function axisLines(domain) {
+  const axes = [
+    ["ownership", domain.ownership],
+    ["certificate", domain.certificate],
+    ["routing", domain.routing]
+  ];
+  return axes.filter((axis) => axis[1] !== void 0).map(
+    ([name, value]) => `    ${`${name}:`.padEnd(13)}${axisMark(value)} ${value}`
+  );
 }
-function conditionsFrom(flags) {
-  const conditions = {};
-  for (const action of POLICY_ACTIONS) {
-    const { key, tree } = WHEN_FLAGS[action];
-    const text = flags[key];
-    if (text === void 0) continue;
-    const flag = flagName(key);
-    if (flags[RULE_FLAGS[action]] !== void 0)
-      refuse2(`--${action} and ${flag} cannot be used together.`);
-    const condition = { [tree]: conditionTree(flag, text) };
-    if (action === "update" && flags.updateCheck !== void 0)
-      condition.check = conditionTree("--update-check", flags.updateCheck);
-    if (flags.signedIn) condition.role = "authenticated";
-    conditions[action] = condition;
-  }
-  if (flags.updateCheck !== void 0 && flags.updateWhen === void 0)
-    refuse2("--update-check needs --update-when.");
-  if (flags.signedIn && Object.keys(conditions).length === 0)
-    refuse2(
-      "--signed-in needs --select-when, --insert-when, --update-when or --delete-when."
-    );
-  return conditions;
+function axisSummary(domain) {
+  const axes = [
+    domain.ownership,
+    domain.certificate,
+    domain.routing
+  ].filter((value) => value !== void 0);
+  return axes.length > 0 ? axes.join(" \xB7 ") : `${domain.status} \xB7 ssl ${domain.sslStatus}`;
 }
-function patchFromFile(context, path, table) {
-  let text;
-  try {
-    text = readFileSync3(resolve4(context.cwd, path), "utf8");
-  } catch {
-    refuse2(`Could not read ${path}.`);
-  }
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch {
-    refuse2(`${path} is not JSON.`);
-  }
-  if (typeof body !== "object" || body === null || Array.isArray(body))
-    refuse2(`${path} must hold a JSON object.`);
-  const { table: named, ...patch } = body;
-  if (Object.hasOwn(body, "table")) {
-    if (typeof named !== "string")
-      refuse2(`${path}: table must be a string, the table's name.`);
-    if (table !== void 0 && asciiLower(named) !== asciiLower(table))
-      refuse2(
-        `${path} is the policy of ${printable(named)}, not ${printable(table)}. Remove its "table" to set it on ${printable(table)}.`
+function recordLines(domain) {
+  const instructions = domain.instructions ?? [];
+  if (instructions.length > 0) {
+    const lines2 = ["    Required DNS records:"];
+    for (const instruction of instructions) {
+      lines2.push(
+        `      ${instruction.type.padEnd(5)} ${instruction.name}`,
+        `        host: ${instruction.host.padEnd(24)} value: ${instruction.value}`
       );
+      if (instruction.note) lines2.push(`        note: ${instruction.note}`);
+    }
+    return lines2;
   }
-  const allowed = /* @__PURE__ */ new Set([...POLICY_ACTIONS, "ownerColumn"]);
-  if (Object.keys(patch).some((key) => !allowed.has(key)))
-    refuse2(
-      `${path}: Only table, select, insert, update, delete and ownerColumn can be set.`
+  if (domain.verification.length === 0) return [];
+  const lines = ["    Required DNS records:"];
+  for (const record of domain.verification) {
+    lines.push(
+      `      Type: ${record.type.toUpperCase().padEnd(6)} Name: ${record.name}`,
+      `      Value: ${record.value}`
     );
-  return patch;
-}
-function asciiLower(text) {
-  return text.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
-}
-function policyPatch(flags, context, table) {
-  if (flags.fromFile !== void 0) {
-    if (OTHER_FLAGS.some(
-      (key) => flags[key] !== void 0 && flags[key] !== false
-    ))
-      refuse2(
-        "--from-file takes the whole policy: leave out the other policy options."
-      );
-    if (!context) refuse2(SET_USAGE);
-    return patchFromFile(context, flags.fromFile, table);
   }
-  const patch = {};
-  for (const action of POLICY_ACTIONS) {
-    const value = flags[RULE_FLAGS[action]];
-    if (value === void 0) continue;
-    if (!isRule(value))
-      refuse2(`--${action} must be one of ${POLICY_RULES.join(", ")}.`);
-    patch[action] = value;
+  return lines;
+}
+function domainLines(domain) {
+  const lines = [
+    `  ${domain.hostname.padEnd(36)} ${domain.status.padEnd(12)} ssl: ${domain.sslStatus}`,
+    ...axisLines(domain)
+  ];
+  if (domain.redirectTo) {
+    const status = domain.redirectStatus ?? 308;
+    lines.push(`    redirects to ${domain.redirectTo} (${String(status)})`);
   }
-  Object.assign(patch, conditionsFrom(flags));
-  if (flags.ownerColumn !== void 0) {
-    if (flags.ownerColumn.trim() === "") refuse2("--owner must name a column.");
-    patch.ownerColumn = flags.ownerColumn;
+  if (domain.cause) {
+    lines.push(`    \u2717 ${domain.cause.message}`);
+    if (domain.cause.fix) lines.push(`    \u2192 ${domain.cause.fix}`);
   }
-  if (Object.keys(patch).length === 0)
-    refuse2(
-      `Set at least one of --select, --insert, --update, --delete, --owner, --select-when, --insert-when, --update-when, --delete-when or --from-file. ${SET_USAGE}`
+  if (isReady(domain)) return lines;
+  lines.push(...recordLines(domain));
+  const guidance = domain.guidance;
+  if (guidance && guidance.notes.length > 0) {
+    lines.push(
+      guidance.apex ? `    Apex domain (${domain.hostname}):` : "    Note:"
     );
-  return patch;
-}
-var SHORT = {
-  contains: "cs",
-  containedBy: "cd",
-  overlaps: "ov"
-};
-function isAuthUid(value) {
-  return typeof value === "object" && value !== null && value.auth === "uid";
-}
-function nearAuthUid(text) {
-  return text.replace(/\s+/g, "").toLowerCase().replace(/\(\)$/, "") === "auth.uid";
-}
-var DECIMAL2 = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
-function readsAsNumber(value) {
-  const text = String(value);
-  if (!DECIMAL2.test(text) || !Object.is(Number(text), value)) return false;
-  return text.includes(".") || Number.isSafeInteger(value);
-}
-function stringText(value, slot) {
-  if (slot === "is") return void 0;
-  if (slot === "like" && value.includes("*")) return void 0;
-  const bare = value !== "" && value.trim() === value && !/[,()"{}\\]/.test(value) && !/^(?:true|false|null)$/i.test(value) && !nearAuthUid(value) && !(slot === "array" && DECIMAL2.test(value));
-  return bare ? value : quoteFilterValue(value);
+    for (const note of guidance.notes) lines.push(`      ${note}`);
+  }
+  return lines;
 }
-function valueText(value, slot) {
-  if (isAuthUid(value))
-    return slot === "like" || slot === "is" ? void 0 : AUTH_UID;
-  if (value === null) return slot === "is" ? "null" : void 0;
-  if (typeof value === "boolean")
-    return slot === "is" || slot === "eq" || slot === "in" ? String(value) : void 0;
-  if (typeof value === "number")
-    return slot === "array" && readsAsNumber(value) ? String(value) : void 0;
-  if (typeof value === "string") return stringText(value, slot);
-  return void 0;
+async function runDomainsList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const domains = await client.domains.list(projectId);
+  const pending = domains.filter((domain) => !isReady(domain));
+  context.output.result(
+    { projectId, domains },
+    domains.length === 0 ? ["No custom domains. Add one with `naro domains add example.com`."] : [
+      `Domains (${String(domains.length)}):`,
+      ...domains.flatMap(domainLines),
+      // list reads our stored copy; only verify goes and looks again.
+      ...pending.length > 0 ? ["", "Re-check DNS now: naro domains verify"] : []
+    ]
+  );
 }
-function columnText(name) {
-  if (name === "") return void 0;
-  return /[.,()"\s]/.test(name) ? quoteFilterValue(name) : name;
+async function runDomainsAdd(context) {
+  const [hostname] = context.positionalOrThrow(
+    1,
+    "Usage: naro domains add <hostname> [--no-www]"
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const withWww = context.flags.noWww !== true;
+  const domain = await client.domains.add(projectId, hostname, {
+    withWww
+  });
+  const companion = domain.companion;
+  const apex = domain.apex ?? domain.guidance?.apex ?? false;
+  const alternative = domain.guidance?.alternative ?? `www.${domain.hostname}`;
+  context.output.result(
+    { projectId, domain, withWww, ...companion ? { companion } : {} },
+    [
+      `\u2705 Domain added: ${domain.hostname}`,
+      "",
+      ...domainLines(domain),
+      ...companion ? [
+        "",
+        `   Also registered ${companion.hostname} \u2014 an apex domain often cannot hold`,
+        "   the CNAME above, and this form always can.",
+        "",
+        ...domainLines(companion)
+      ] : [],
+      ...!companion && apex && !withWww ? [
+        "",
+        `   --no-www: ${domain.hostname} was registered on its own. If your registrar`,
+        `   refuses the record above, run \`naro domains add ${alternative}\`.`
+      ] : [],
+      "",
+      isReady(domain) ? "The domain is active." : "Status: Pending verification \u2014 add the DNS records above, then run `naro domains verify`."
+    ]
+  );
 }
-function slotOf(operator) {
-  if (operator === "eq" || operator === "neq") return "eq";
-  if (operator === "like" || operator === "ilike") return "like";
-  if (operator === "is") return "is";
-  return "ordered";
+async function verifyAll(client, projectId, hostname, auto = false) {
+  if (hostname !== void 0)
+    return [
+      await client.domains.verifyByHostname(projectId, hostname, { auto })
+    ];
+  const listed = await client.domains.list(projectId);
+  const verified = [];
+  for (const domain of listed)
+    verified.push(await client.domains.verify(projectId, domain.id, { auto }));
+  return verified;
 }
-function leafText(leaf, negated) {
-  const column = columnText(leaf.column);
-  if (column === void 0) return void 0;
-  const prefix = `${column}.${negated ? "not." : ""}`;
-  const short = SHORT[leaf.operator];
-  if (leaf.operator === "in" || short !== void 0) {
-    if (!Array.isArray(leaf.value)) return void 0;
-    const slot = short === void 0 ? "in" : "array";
-    const items2 = leaf.value.map((item) => valueText(item, slot));
-    if (items2.some((item) => item === void 0)) return void 0;
-    const list = items2.join(",");
-    return slot === "in" ? `${prefix}in.(${list})` : `${prefix}${String(short)}.{${list}}`;
+async function runDomainsVerify(context, overrides = {}) {
+  const deps = { ...defaults3, ...overrides };
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const hostname = context.positionals[0];
+  const wait = context.flags.wait === true;
+  const progress = (line) => {
+    if (!context.flags.json) context.output.log(line);
+  };
+  let domains = await verifyAll(client, projectId, hostname);
+  if (domains.length === 0) {
+    context.output.result({ projectId, domains, ready: false }, [
+      "No custom domains. Add one with `naro domains add example.com`."
+    ]);
+    return;
   }
-  if (Array.isArray(leaf.value)) return void 0;
-  const text = valueText(leaf.value, slotOf(leaf.operator));
-  return text === void 0 ? void 0 : `${prefix}${leaf.operator}.${text}`;
-}
-function groupText(kind, children) {
-  const texts = children.map((child) => filterText(child, false));
-  if (texts.length === 0 || texts.some((text) => text === void 0))
-    return void 0;
-  return `${kind}(${texts.join(",")})`;
-}
-function filterText(node, top = true) {
-  if ("operator" in node) return leafText(node, false);
-  if ("not" in node) {
-    const inner = node.not;
-    if ("operator" in inner) return leafText(inner, true);
-    if ("or" in inner) return negatedText(groupText("or", inner.or));
-    if ("and" in inner) return negatedText(groupText("and", inner.and));
-    return void 0;
+  let timedOut = false;
+  let abandoned = false;
+  if (wait && !domains.every(isReady)) {
+    const deadline = deps.now() + WAIT_TIMEOUT_MS;
+    let delay = FIRST_DELAY_MS;
+    for (; ; ) {
+      const pending = domains.filter((domain) => !isReady(domain));
+      if (pending.length > 0 && pending.every(isTerminal)) {
+        abandoned = true;
+        break;
+      }
+      const remaining = deadline - deps.now();
+      if (remaining <= 0) {
+        timedOut = true;
+        break;
+      }
+      for (const domain of pending)
+        progress(
+          isTerminal(domain) ? `\u26A0 ${domain.hostname}: ${axisSummary(domain)} \u2014 waiting cannot fix this one` : `\u25B8 ${domain.hostname}: ${axisSummary(domain)}`
+        );
+      await deps.sleep(Math.min(delay, remaining));
+      delay = Math.min(delay * 2, MAX_DELAY_MS);
+      domains = await verifyAll(client, projectId, hostname, true);
+      if (domains.every(isReady)) break;
+    }
   }
-  if ("or" in node) return groupText("or", node.or);
-  if (top && node.and.length > 1) {
-    const texts = node.and.map((child) => filterText(child, false));
-    return texts.some((text) => text === void 0) ? void 0 : texts.join(",");
+  const ready = domains.every(isReady);
+  const body = domains.flatMap(domainLines);
+  if (!ready) {
+    for (const line of body) progress(line);
+    const notReady = domains.filter((domain) => !isReady(domain));
+    const names = notReady.map((domain) => domain.hostname).join(", ");
+    const details = { projectId, domains, ready: false };
+    if (timedOut) {
+      const cause2 = notReady[0]?.cause;
+      throw new NaroError(
+        "TIMEOUT",
+        `${names} did not go live within 10 minutes.${cause2 ? ` ${cause2.message}` : ""} DNS changes can take longer to propagate \u2014 re-run \`naro domains verify\` later.`,
+        { details }
+      );
+    }
+    if (abandoned) {
+      const blocked = domains.find(isTerminal);
+      throw new NaroError(
+        blocked?.cause?.code ?? "DOMAIN_VERIFICATION_FAILED",
+        blocked?.cause?.message ?? `${names} cannot be verified (status: ${blocked?.status ?? "unknown"}). Remove it and add it again.`,
+        { details }
+      );
+    }
+    const cause = notReady[0]?.cause;
+    throw new NaroError(
+      cause?.code ?? "DOMAIN_NOT_READY",
+      `${names} is not live yet.${cause ? ` ${cause.message}` : ""} Add the records above, then run \`naro domains verify --wait\`.`,
+      { details }
+    );
   }
-  return groupText("and", node.and);
+  context.output.result({ projectId, domains, ready }, [
+    ...body,
+    "",
+    domains.length === 1 ? `\u2705 ${domains[0]?.hostname ?? ""} is live.` : "\u2705 Every domain is live."
+  ]);
 }
-function negatedText(text) {
-  return text === void 0 ? void 0 : `not.${text}`;
+async function runDomainsRemove(context) {
+  const [hostname] = context.positionalOrThrow(
+    1,
+    "Usage: naro domains remove <hostname>"
+  );
+  await confirmOrAbort(
+    context,
+    `Remove ${String(hostname)}? Traffic to it will stop routing here.`
+  );
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await client.domains.remove(projectId, hostname);
+  context.output.result({ projectId, hostname, removed: true }, [
+    `\u2705 Removed ${String(hostname)}`
+  ]);
 }
-function isInvalid(value) {
-  return typeof value === "object" && "invalid" in value;
+
+// src/commands/env.ts
+import { existsSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join4 } from "path";
+var TARGETS = /* @__PURE__ */ new Set(["production", "preview", "all"]);
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function parseTarget(value) {
+  if (value === void 0) return "all";
+  if (!TARGETS.has(value))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Environment must be production, preview or all."
+    );
+  return value;
 }
-function cellOf(value) {
-  if (typeof value === "string") return value;
-  return isInvalid(value) ? "invalid" : "condition";
+function maskedValue(row) {
+  if (!row.isSecret) return row.value ?? "";
+  return "\u2022\u2022\u2022\u2022\u2022\u2022 (secret)";
 }
-function conditionText(action, value) {
-  if (typeof value === "string") return value;
-  if (isInvalid(value))
-    return `cannot be read (${value.invalid}); it denies everyone but the service key`;
-  const using = value.using ? filterText(value.using) : "";
-  const check = value.check ? filterText(value.check) : "";
-  if (using === void 0 || check === void 0)
-    return `as JSON ${JSON.stringify(value)}`;
-  const parts = [];
-  if (using !== "") parts.push(`using ${using}`);
-  if (check !== "") parts.push(`check ${check}`);
-  else if (action === "update") parts.push("check = using");
-  const text = parts.join("; ");
-  return value.role === "authenticated" ? `${text} (signed-in users only)` : text;
+async function runEnvList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const reveal = context.flags.reveal;
+  const rows = await client.env.list(projectId, { reveal });
+  context.output.result(
+    {
+      projectId,
+      envVars: rows.map((row) => ({
+        id: row.id,
+        key: row.key,
+        target: row.target,
+        isSecret: row.isSecret,
+        value: row.isSecret && !reveal ? null : row.value
+      }))
+    },
+    [
+      `Environment variables (${String(rows.length)}):`,
+      ...rows.map(
+        (row) => `  ${row.key.padEnd(32)} ${row.target.padEnd(12)} ${reveal ? row.value ?? "" : maskedValue(row)}`
+      )
+    ]
+  );
 }
-function policyTable(policies) {
-  const header = ["Table", ...POLICY_ACTIONS, "Owner column"];
-  const rows = policies.map((policy) => [
-    printable(policy.table),
-    ...POLICY_ACTIONS.map((action) => cellOf(policy[action])),
-    policy.ownerColumn === null ? "-" : printable(policy.ownerColumn)
-  ]);
-  const widths = header.map(
-    (title, index) => Math.max(title.length, ...rows.map((row) => row[index]?.length ?? 0))
+async function runEnvAdd(context) {
+  context.positionalOrThrow(
+    1,
+    "Usage: naro env add KEY [production|preview|all]"
   );
-  const table = [header, ...rows].map(
-    (cells) => cells.map(
-      (cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)
-    ).join("  ").trimEnd()
+  const [key, targetArg] = context.positionals;
+  if (!key || !KEY_RE.test(key) || key.length > 256)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Keys must look like MY_VARIABLE (letters, digits, underscore)."
+    );
+  const target = parseTarget(targetArg);
+  let value;
+  if (!process.stdin.isTTY) {
+    value = await readStdin();
+  } else {
+    value = await context.prompter.askHidden(`? What's the value of ${key}? `);
+  }
+  if (value.length === 0)
+    throw new NaroError("VALIDATION_FAILED", `No value provided for ${key}.`);
+  const isSecret = !key.startsWith("NEXT_PUBLIC_");
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  await client.env.set(projectId, [{ key, value, target, isSecret }]);
+  context.output.result({ projectId, key, target, isSecret }, [
+    `\u2705 Added ${key} (${target}${isSecret ? ", secret" : ""})`
+  ]);
+}
+async function runEnvRemove(context) {
+  context.positionalOrThrow(
+    1,
+    "Usage: naro env remove KEY [production|preview|all]"
   );
-  const lines = policies.flatMap(
-    (policy) => POLICY_ACTIONS.filter((action) => typeof policy[action] !== "string").map(
-      (action) => ({
-        label: `${printable(policy.table)}.${action}`,
-        text: printable(conditionText(action, policy[action]))
-      })
-    )
+  const [key, targetArg] = context.positionals;
+  const target = targetArg === void 0 ? void 0 : parseTarget(targetArg);
+  await confirmOrAbort(
+    context,
+    `Remove ${String(key)}${target ? ` (${target})` : ""} from this project?`
   );
-  if (lines.length === 0) return table;
-  const width = Math.max(...lines.map((line) => line.label.length));
-  return [
-    ...table,
-    "",
-    ...lines.map((line) => `${line.label.padEnd(width)}  ${line.text}`)
-  ];
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const removed = await client.env.remove(projectId, key, target);
+  context.output.result({ projectId, key, removed }, [
+    `\u2705 Removed ${String(key)} (${String(removed)} entr${removed === 1 ? "y" : "ies"})`
+  ]);
 }
-async function runPolicyList(context) {
+async function runEnvPull(context) {
+  const file = context.positionals[0] ?? ".env.local";
+  const surface = context.flags.env === "production" ? "production" : "preview";
+  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production or preview."
+    );
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policies = await client.backend.policies(projectId);
+  const rows = await client.env.list(projectId, { reveal: true });
+  const selected = rows.filter(
+    (row) => row.target === "all" || row.target === surface
+  );
+  const vars = Object.fromEntries(
+    selected.map((row) => [row.key, row.value ?? ""])
+  );
+  const path = join4(context.cwd, file);
+  if (existsSync(path) && isInteractive() && !context.flags.yes && !context.flags.json) {
+    const confirmed = await context.prompter.confirm(`Overwrite ${file}?`);
+    if (!confirmed) throw new NaroError("CANCELED", "Canceled.");
+  }
+  writeFileSync4(
+    path,
+    `# Pulled from Naro (${surface}) \u2014 do not commit secrets.
+${serializeDotenv(vars)}`,
+    { mode: 384 }
+  );
   context.output.result(
-    { projectId, policies },
-    policies.length === 0 ? [
-      "No policies yet: every table denies anon and signed-in requests.",
-      "Open one with `naro policy set <table> --select public`."
-    ] : [
-      ...policyTable(policies),
-      "",
-      "Tables not listed deny anon and signed-in requests. The service key skips policies."
-    ]
+    { projectId, file, environment: surface, count: selected.length },
+    [`\u2705 Pulled ${String(selected.length)} variable(s) into ${file}`]
   );
 }
-async function runPolicySet(context) {
-  const [table] = context.positionalOrThrow(1, SET_USAGE);
-  const patch = policyPatch(context.flags, context, table);
+
+// src/commands/gen.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname2, resolve as resolve4 } from "path";
+var LANG_MESSAGE = "naro gen types writes TypeScript only. Pass --lang typescript, or leave --lang out.";
+async function runGenTypes(context) {
+  const { lang } = context.flags;
+  if (lang !== void 0 && lang !== "typescript")
+    throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
-  const policy = await client.backend.setPolicy(
-    projectId,
-    table,
-    patch
+  const tables = await client.db.tables(projectId);
+  const read = await policiesForTypes(client, projectId);
+  const types = generateTypes(
+    tables,
+    read.policies === void 0 ? {} : { policies: read.policies }
+  );
+  const undescribed = tables.flatMap(
+    (table) => table.error === void 0 ? [] : [{ name: table.name, error: table.error }]
   );
-  context.output.result({ projectId, policy }, [
-    `\u2705 Saved the policy for ${printable(policy.table)}. It takes effect within about 10 seconds.`,
-    ...policyTable([policy])
+  for (const { name, error } of undescribed)
+    context.output.warn(
+      `\u26A0 ${printable(name)} could not be described and was generated as an empty interface: ${printable(error)}`
+    );
+  if (read.policies === void 0)
+    context.output.warn(
+      `\u26A0 The backend's policies could not be read (${printable(read.reason)}), so owner columns stay required in Insert.`
+    );
+  const extra = {
+    ...undescribed.length > 0 ? { undescribed } : {},
+    ...read.policies === void 0 ? { policies: "unavailable", policiesReason: read.reason } : {}
+  };
+  if (context.flags.output) {
+    const path = resolve4(context.cwd, context.flags.output);
+    mkdirSync4(dirname2(path), { recursive: true });
+    writeFileSync5(path, types);
+    context.output.result(
+      {
+        projectId,
+        output: context.flags.output,
+        tables: tables.length,
+        ...extra
+      },
+      [
+        `\u2705 Wrote types for ${String(tables.length)} table(s) to ${context.flags.output}`
+      ]
+    );
+    return;
+  }
+  context.output.result({ projectId, types, ...extra }, [
+    types.replace(/\n$/, "")
   ]);
 }
-async function runPolicyRemove(context) {
-  const [table] = context.positionalOrThrow(1, REMOVE_USAGE);
-  await confirmOrAbort(
-    context,
-    `Remove the policy for ${printable(table)}? Anon and signed-in requests to it are denied from then on.`
+
+// src/commands/logs.ts
+var FOLLOW_INTERVAL_MS = 3e3;
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+function formatBuildLog(log) {
+  return `[${log.stage}] ${log.level === "ERROR" ? "\u2717 " : ""}${log.message}`;
+}
+function formatRuntimeLog(entry) {
+  const time = new Date(entry.ts).toISOString();
+  const request = entry.method && entry.path ? ` ${entry.method} ${entry.path}${entry.status ? ` ${String(entry.status)}` : ""}` : "";
+  return `${time} [${entry.level}]${request} ${entry.message}`.trimEnd();
+}
+async function latestProductionDeploymentId(client, projectId) {
+  const deployments = await client.deployments.list(projectId);
+  const latest = deployments.find(
+    (deployment) => deployment.status === "READY"
+  );
+  const fallback = deployments[0];
+  const chosen = latest ?? fallback;
+  if (!chosen)
+    throw new NaroError(
+      "DEPLOYMENT_NOT_FOUND",
+      "This project has no deployments yet."
+    );
+  return chosen.id;
+}
+async function buildLogs(context, client, deploymentId) {
+  if (!context.flags.follow) {
+    const detail = await client.deployments.get(deploymentId);
+    context.output.result(
+      { deploymentId, type: "build", logs: detail.logs },
+      detail.logs.map(formatBuildLog)
+    );
+    return;
+  }
+  let lastSequence = -1;
+  for (; ; ) {
+    const detail = await client.deployments.get(deploymentId);
+    for (const log of detail.logs) {
+      if (log.sequence > lastSequence) {
+        lastSequence = log.sequence;
+        context.output.log(formatBuildLog(log));
+      }
+    }
+    if (isTerminalStatus(detail.deployment.status)) {
+      context.output.result(
+        {
+          deploymentId,
+          type: "build",
+          status: detail.deployment.status,
+          logs: detail.logs
+        },
+        [`\u2014 deployment ${detail.deployment.status} \u2014`]
+      );
+      return;
+    }
+    await sleep(FOLLOW_INTERVAL_MS);
+  }
+}
+async function runtimeLogs(context, client, projectId) {
+  const environment = context.flags.env === "preview" ? "preview" : "production";
+  if (context.flags.env && !["production", "preview"].includes(context.flags.env))
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--env must be production or preview."
+    );
+  const options = {
+    environment,
+    ...context.flags.level ? { level: context.flags.level } : {}
+  };
+  if (!context.flags.follow) {
+    const entries = await client.logs.runtime(projectId, options);
+    context.output.result(
+      { projectId, type: "runtime", environment, entries },
+      entries.length > 0 ? entries.map(formatRuntimeLog) : ["(no runtime logs yet \u2014 the worker logs on each request)"]
+    );
+    return;
+  }
+  context.output.log(
+    `Following ${environment} runtime logs (Ctrl-C to stop)...`
   );
+  let lastTs = -1;
+  let boundary = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const entries = await client.logs.runtime(projectId, options);
+    for (const entry of entries) {
+      if (entry.ts < lastTs) continue;
+      const key = JSON.stringify(entry);
+      if (entry.ts === lastTs) {
+        if (boundary.has(key)) continue;
+      } else {
+        lastTs = entry.ts;
+        boundary = /* @__PURE__ */ new Set();
+      }
+      boundary.add(key);
+      context.output.log(formatRuntimeLog(entry));
+    }
+    await sleep(FOLLOW_INTERVAL_MS);
+  }
+}
+async function runLogs(context) {
   const client = await context.client();
-  const projectId = await context.resolveProjectId();
-  const policy = await client.backend.removePolicy(projectId, table);
-  context.output.result({ projectId, removed: true, policy }, [
-    `\u2705 Removed the policy for ${printable(policy.table)}. Anon and signed-in requests to it are denied within about 10 seconds.`
-  ]);
+  const [deploymentId] = context.positionals;
+  const type = context.flags.type ?? (deploymentId !== void 0 ? "build" : "runtime");
+  if (type !== "build" && type !== "runtime")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "--type must be build or runtime."
+    );
+  if (type === "runtime") {
+    if (deploymentId)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        "Runtime logs are per project, not per deployment. Drop the deployment id or use --type build."
+      );
+    const projectId = await context.resolveProjectId();
+    await runtimeLogs(context, client, projectId);
+    return;
+  }
+  const target = deploymentId ?? await latestProductionDeploymentId(
+    client,
+    await context.resolveProjectId()
+  );
+  await buildLogs(context, client, target);
 }
 
 // src/commands/projects.ts
@@ -4191,9 +4639,16 @@ Usage:
   naro backend keys [--reveal]       API keys; --reveal prints the service key (a secret; needs database write)
   naro backend keys rotate --anon|--service
                                      Replace a key; the old one stops working at once (asks first)
-  naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs
+  naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs,
+                                     sign-ups and the minimum password length
+  naro backend auth signups <on|off>
+                                     off: nobody signs up on their own, by email or Google/GitHub;
+                                     the accounts you create (naro backend users create) sign in
+  naro backend auth password --min-length <n>
+                                     The fewest characters a new password takes (6-128; 6 by default)
   naro backend auth email set --provider resend --from "App <no-reply@example.com>" --api-key-stdin
                                      Confirmation and reset emails from your Resend account
+                                     (email and password sign-in needs no setup)
   naro backend auth email remove     Turn email off (asks first)
   naro backend auth oauth set <google|github> --client-id <id> --client-secret-stdin
   naro backend auth oauth remove <google|github>  Turn a provider off (asks first)
@@ -4205,15 +4660,31 @@ Usage:
                                      Exits 1, changing nothing, when <url> is not in the list
   naro backend auth require-verification <on|off>
                                      Refuse sign-in until the email is confirmed (needs email)
-  naro policy list                   Who the Data API lets through, per table (no policy = deny)
+  naro backend users                 The project's users: id, username, email, verified, created
+  naro backend users create --username <name> --password-stdin
+                                     Create a confirmed account (--email <address> instead of or with
+                                     --username); works while sign-ups are closed. --password <p>
+                                     works too, but lands in shell history
+  naro backend users delete <id|username|email>
+                                     Delete a user and end its sessions (asks first; --yes to skip)
+  naro policy list [--table <t>]     Row-level security policies as CREATE POLICY (no policy = deny)
+  naro policy create "CREATE POLICY <name> ON <table> \u2026" | --file <policies.sql>
+                                     Postgres's CREATE POLICY: AS PERMISSIVE|RESTRICTIVE,
+                                     FOR ALL|SELECT|INSERT|UPDATE|DELETE, TO anon|authenticated|public,
+                                     USING (\u2026), WITH CHECK (\u2026); a file may hold DROP POLICY too
+                                     (run in order, stops at the first refusal)
+       [--allow-unindexed]           Accept a subquery on the outer row that no index serves
+                                     (refused otherwise, naming the index to create)
+  naro policy drop <name> --table <t>  DROP POLICY (asks first)
   naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>]
        [--owner <column>]            Rules: none | public | authenticated | owner (owner needs --owner)
        [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>]
        [--update-check <filter>] [--delete-when <filter>] [--signed-in]
                                      Or a condition per action, in Supabase filter syntax;
                                      auth.uid() is the signed-in user's id
-       [--from-file <policy.json>]   Or the whole policy as JSON
-  naro policy remove <table>         Back to deny for anon and signed-in requests (asks first)
+       [--from-file <policy.json>]   Or the whole policy as JSON. Writes the policies naro_select,
+                                     naro_insert, naro_update, naro_delete (shorthand for CREATE POLICY)
+  naro policy remove <table>         Drop every policy on it: back to deny (asks first)
 
   naro promote <deployment-id>       Publish a build to production
   naro rollback [deployment-id]      Roll production back to the previous build
@@ -4230,7 +4701,7 @@ Global options:
   --prod          Deploy/target production
   --wait          Poll until the domain goes live (naro domains verify)
   --no-www        Register the apex alone (naro domains add)
-  --file <path>   SQL file to run (naro db query)
+  --file <path>   SQL file to run (naro db query, naro policy create)
   --dry-run       Show what would change without changing it (naro db push, db restore, db reset, db table, db index)
   --output <file> Write to a file instead of stdout (naro gen types, db dump)
   --lang <lang>   Language of the types; typescript, the default, is the only one (naro gen types)
@@ -4238,7 +4709,8 @@ Global options:
   --strict        Fail on warnings too, not only errors (naro db lint)
   --schema-only   Dump the schema without rows (naro db dump)
   --data-only     Dump rows without the schema (naro db dump)
-  --table <a,b>   Dump only these tables, comma-separated (naro db dump)
+  --table <a,b>   Dump only these tables, comma-separated (naro db dump); the policy's table
+                  (naro policy list, naro policy drop)
   --bookmark <id> Restore point: a bookmark from db dump or db restore (naro db restore)
   --timestamp <time>  Restore point: RFC 3339 with a timezone, or Unix seconds (naro db restore)
   --status <s>    applied or reverted (naro migration repair)
@@ -4249,6 +4721,11 @@ Global options:
   --client-id <id>  The OAuth app's client ID (naro backend auth oauth set)
   --api-key-stdin | --client-secret-stdin
                   Read the secret from stdin (a pipe, or a hidden prompt); never from argv
+  --username <name> | --email <address>
+                  The new user's username (3-30 of a-z, 0-9, _ and .) and/or email (naro backend users create)
+  --password-stdin  Read the new user's password from stdin (a pipe, or a hidden prompt)
+  --password <p>  The password in argv: works, but lands in shell history (naro backend users create)
+  --min-length <n>  Fewest characters of a new password, 6-128 (naro backend auth password)
   --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
   --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
   --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
@@ -4315,6 +4792,29 @@ function routeBackendAuth(words) {
         handler: runBackendAuthRequireVerification,
         positionals: words.slice(1)
       };
+    // Spec 2026-09-26 §2.1, §2.4.
+    case "signups":
+      return { handler: runBackendAuthSignups, positionals: words.slice(1) };
+    case "password":
+      return { handler: runBackendAuthPassword, positionals: words.slice(1) };
+    default:
+      return null;
+  }
+}
+function routeBackendUsers(words) {
+  const [action] = words;
+  const rest = words.slice(1);
+  switch (action) {
+    case void 0:
+    case "list":
+    case "ls":
+      return rest.length === 0 ? { handler: runBackendUsersList, positionals: [] } : null;
+    case "create":
+      return { handler: runBackendUsersCreate, positionals: rest };
+    case "delete":
+    case "remove":
+    case "rm":
+      return { handler: runBackendUsersDelete, positionals: rest };
     default:
       return null;
   }
@@ -4484,6 +4984,8 @@ function route(parsed) {
           return null;
         case "auth":
           return routeBackendAuth(positionals.slice(1));
+        case "users":
+          return routeBackendUsers(positionals.slice(1));
         default:
           return null;
       }
@@ -4495,6 +4997,13 @@ function route(parsed) {
           return { handler: runPolicyList, positionals: positionals.slice(1) };
         case "set":
           return { handler: runPolicySet, positionals: positionals.slice(1) };
+        case "create":
+          return {
+            handler: runPolicyCreate,
+            positionals: positionals.slice(1)
+          };
+        case "drop":
+          return { handler: runPolicyDrop, positionals: positionals.slice(1) };
         case "remove":
         case "rm":
           return {