@rebasepro/cli 0.0.1-canary.2 → 0.0.1-canary.4829d6e

package/dist/index.es.js

@@ -3,222 +3,3978 @@ import arg from "arg";
 import inquirer from "inquirer";
 import path from "path";
 import fs from "fs";
+import net from "net";
 import { promisify } from "util";
-import execa from "execa";
-import ncp from "ncp";
+import { execa, execaCommandSync } from "execa";
+import { cp } from "fs/promises";
 import { fileURLToPath } from "url";
 import crypto from "crypto";
-import * as os from "os";
-const access = promisify(fs.access);
-const copy = promisify(ncp);
-const __filename$2 = fileURLToPath(import.meta.url);
-const __dirname$2 = path.dirname(__filename$2);
+import { generateSDK } from "@rebasepro/codegen";
+import { execSync, spawn } from "child_process";
+import { createRequire } from "module";
+import os from "os";
+import { createRebaseClient } from "@rebasepro/client";
+//#region src/utils/package-manager.ts
+/**
+* Package manager detection and command abstraction.
+*
+* Detects whether the user is running pnpm or npm and provides
+* a unified interface for common package-manager operations so
+* the rest of the CLI never has to hardcode a specific PM.
+*/
+/**
+* Detect the package manager from the environment or the target directory.
+*
+* Detection order:
+* 1. Explicit override (if provided)
+* 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
+* 3. Lock-file presence in the target directory
+* 4. Default to pnpm (Rebase's recommended PM)
+*/
+function detectPackageManager(targetDir) {
+	const userAgent = process.env.npm_config_user_agent ?? "";
+	if (userAgent.startsWith("npm/")) return "npm";
+	if (userAgent.startsWith("pnpm/")) return "pnpm";
+	if (targetDir) {
+		if (fs.existsSync(path.join(targetDir, "package-lock.json"))) return "npm";
+		if (fs.existsSync(path.join(targetDir, "pnpm-lock.yaml"))) return "pnpm";
+	}
+	const cwd = process.cwd();
+	if (cwd !== targetDir) {
+		if (fs.existsSync(path.join(cwd, "package-lock.json"))) return "npm";
+		if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+	}
+	return "pnpm";
+}
+/** Build the command helpers for a given package manager. */
+function getPMCommands(pm) {
+	if (pm === "npm") return {
+		name: "npm",
+		install: ["npm", "install"],
+		run: (script) => [
+			"npm",
+			"run",
+			script
+		],
+		exec: (bin, args) => [
+			"npx",
+			bin,
+			...args
+		],
+		view: (pkg, field) => [
+			"npm",
+			"view",
+			pkg,
+			field
+		],
+		runAll: (script) => [
+			"npm",
+			"run",
+			script,
+			"--workspaces",
+			"--if-present"
+		],
+		runWorkspace: (workspace, script) => [
+			"npm",
+			"run",
+			script,
+			"-w",
+			workspace
+		],
+		dlx: (pkg, args) => [
+			"npx",
+			"-y",
+			pkg,
+			...args
+		],
+		workspaceProtocol: "*"
+	};
+	return {
+		name: "pnpm",
+		install: ["pnpm", "install"],
+		run: (script) => [
+			"pnpm",
+			"run",
+			script
+		],
+		exec: (bin, args) => [
+			"pnpm",
+			"exec",
+			bin,
+			...args
+		],
+		view: (pkg, field) => [
+			"pnpm",
+			"view",
+			pkg,
+			field
+		],
+		runAll: (script) => [
+			"pnpm",
+			"-r",
+			"run",
+			script
+		],
+		runWorkspace: (workspace, script) => [
+			"pnpm",
+			"--filter",
+			workspace,
+			script
+		],
+		dlx: (pkg, args) => [
+			"pnpm",
+			"dlx",
+			pkg,
+			...args
+		],
+		workspaceProtocol: "workspace:*"
+	};
+}
+//#endregion
+//#region src/commands/init.ts
+var access = promisify(fs.access);
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path.dirname(__filename$1);
 function findParentDir(currentDir, targetName) {
-  const root = path.parse(currentDir).root;
-  while (currentDir && currentDir !== root) {
-    if (path.basename(currentDir) === targetName) {
-      return currentDir;
-    }
-    currentDir = path.dirname(currentDir);
-  }
-  return null;
+	const root = path.parse(currentDir).root;
+	while (currentDir && currentDir !== root) {
+		if (path.basename(currentDir) === targetName) return currentDir;
+		currentDir = path.dirname(currentDir);
+	}
+	return null;
+}
+var cliRoot = findParentDir(__dirname$1, "cli");
+var FLAVOR_CHOICES = [{
+	name: "BaaS + admin  — API plus an admin UI, driven by collections you define (like Payload/Directus)",
+	value: "cms",
+	short: "BaaS + admin"
+}, {
+	name: "BaaS only     — headless API over your database. No collections, no UI (like Supabase)",
+	value: "baas",
+	short: "BaaS only"
+}];
+var PRESET_CHOICES = [
+	{
+		name: "Blog         — Posts, Authors, Tags (with markdown editor)",
+		value: "blog",
+		short: "Blog"
+	},
+	{
+		name: "E-commerce   — Products, Categories, Orders",
+		value: "ecommerce",
+		short: "E-commerce"
+	},
+	{
+		name: "Blank        — Empty project, just authentication",
+		value: "blank",
+		short: "Blank"
+	}
+];
+/**
+* Builds the interactive prompt questions for `rebase init`.
+* Exported for testability — all prompt `type` values must match
+* types registered by the installed version of inquirer.
+*/
+function buildInitQuestions(params) {
+	const { nameArg, templateArg, flavorArg, hasGitFlag, hasInstallFlag, pm } = params;
+	const questions = [];
+	if (!nameArg) questions.push({
+		type: "input",
+		name: "projectName",
+		message: "Project name:",
+		default: "my-rebase-app",
+		validate: (input) => {
+			if (!input.trim()) return "Project name is required";
+			if (!/^[a-z0-9][a-z0-9._-]*$/.test(input)) return "Project name must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, dots, or underscores";
+			return true;
+		}
+	});
+	if (!flavorArg) questions.push({
+		type: "select",
+		name: "flavor",
+		message: "What do you want to build?",
+		choices: FLAVOR_CHOICES,
+		default: "cms"
+	});
+	if (!templateArg) questions.push({
+		type: "select",
+		name: "preset",
+		message: "Choose a starter template:",
+		choices: PRESET_CHOICES,
+		default: "blog",
+		when: (answers) => (flavorArg ?? answers.flavor) !== "baas"
+	});
+	if (!hasGitFlag) questions.push({
+		type: "confirm",
+		name: "git",
+		message: "Initialize a git repository?",
+		default: true
+	});
+	if (!hasInstallFlag) questions.push({
+		type: "confirm",
+		name: "installDeps",
+		message: `Install dependencies with ${pm}?`,
+		default: true
+	});
+	questions.push({
+		type: "input",
+		name: "databaseUrl",
+		message: "Enter your PostgreSQL database connection string (leave blank to use a local default):",
+		default: "",
+		validate: (input) => {
+			if (input.trim() && /[\r\n]/.test(input)) return "Database URL cannot contain newline characters.";
+			return true;
+		}
+	});
+	questions.push({
+		type: "confirm",
+		name: "introspect",
+		message: "Would you like to introspect this database to automatically generate collections?",
+		default: true,
+		when: (answers) => !!answers.databaseUrl?.trim()
+	});
+	return questions;
 }
-const cliRoot = findParentDir(__dirname$2, "cli");
 async function createRebaseApp(rawArgs) {
-  console.log(`
+	console.log(`
 ${chalk.bold("Rebase")} — Create a new project 🚀
 `);
-  const options = await promptForOptions(rawArgs);
-  await createProject(options);
-}
-async function promptForOptions(rawArgs) {
-  const args = arg(
-    {
-      "--git": Boolean,
-      "-g": "--git"
-    },
-    {
-      argv: rawArgs.slice(3),
-      // skip "node", "rebase", "init"
-      permissive: true
-    }
-  );
-  const nameArg = args._[0];
-  const questions = [];
-  if (!nameArg) {
-    questions.push({
-      type: "input",
-      name: "projectName",
-      message: "Project name:",
-      default: "my-rebase-app",
-      validate: (input) => {
-        if (!input.trim()) return "Project name is required";
-        if (!/^[a-z0-9][a-z0-9._-]*$/.test(input)) {
-          return "Project name must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, dots, or underscores";
+	await createProject$1(await promptForOptions(rawArgs, detectPackageManager()));
+}
+async function promptForOptions(rawArgs, pm) {
+	const args = arg({
+		"--git": Boolean,
+		"--install": Boolean,
+		"--database-url": String,
+		"--introspect": Boolean,
+		"--template": String,
+		"--flavor": String,
+		"--yes": Boolean,
+		"-g": "--git",
+		"-i": "--install",
+		"-t": "--template",
+		"-f": "--flavor",
+		"-y": "--yes"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	const nameArg = args._[0];
+	const isNonInteractive = args["--yes"] || false;
+	const templateArg = args["--template"];
+	if (templateArg && !PRESET_CHOICES.some((p) => p.value === templateArg)) {
+		console.error(chalk.red(`Unknown template "${templateArg}". Available: ${PRESET_CHOICES.map((p) => p.value).join(", ")}`));
+		process.exit(1);
+	}
+	const flavorArg = args["--flavor"];
+	if (flavorArg && !FLAVOR_CHOICES.some((f) => f.value === flavorArg)) {
+		console.error(chalk.red(`Unknown flavor "${flavorArg}". Available: ${FLAVOR_CHOICES.map((f) => f.value).join(", ")}`));
+		process.exit(1);
+	}
+	if (isNonInteractive) {
+		const projectName = nameArg || "my-rebase-app";
+		const targetDirectory = path.resolve(process.cwd(), projectName);
+		const templateDirectory = path.resolve(cliRoot, "templates", "template");
+		const pmCommands = getPMCommands(pm);
+		return {
+			projectName: path.basename(targetDirectory),
+			git: args["--git"] ?? false,
+			installDeps: args["--install"] ?? false,
+			targetDirectory,
+			templateDirectory,
+			databaseUrl: args["--database-url"] || void 0,
+			introspect: args["--introspect"] || false,
+			preset: templateArg || "blog",
+			flavor: flavorArg || "cms",
+			pm,
+			pmCommands
+		};
+	}
+	const questions = buildInitQuestions({
+		nameArg,
+		templateArg,
+		flavorArg,
+		hasGitFlag: !!args["--git"],
+		hasInstallFlag: !!args["--install"],
+		pm
+	});
+	const answers = await inquirer.prompt(questions);
+	const targetDirectory = path.resolve(process.cwd(), nameArg || answers.projectName);
+	const projectName = path.basename(targetDirectory);
+	const templateDirectory = path.resolve(cliRoot, "templates", "template");
+	const pmCommands = getPMCommands(pm);
+	return {
+		projectName,
+		git: args["--git"] || answers.git || false,
+		installDeps: args["--install"] || answers.installDeps || false,
+		targetDirectory,
+		templateDirectory,
+		databaseUrl: answers.databaseUrl?.trim() || void 0,
+		introspect: answers.introspect || false,
+		preset: templateArg || answers.preset || "blog",
+		flavor: flavorArg || answers.flavor || "cms",
+		pm,
+		pmCommands
+	};
+}
+async function createProject$1(options) {
+	if (fs.existsSync(options.targetDirectory)) {
+		if (fs.readdirSync(options.targetDirectory).length !== 0) {
+			console.error(`${chalk.red.bold("ERROR")} Directory "${options.projectName}" already exists and is not empty`);
+			process.exit(1);
+		}
+	} else fs.mkdirSync(options.targetDirectory, { recursive: true });
+	try {
+		await access(options.templateDirectory, fs.constants.R_OK);
+	} catch {
+		console.error(`${chalk.red.bold("ERROR")} Template not found at ${options.templateDirectory}`);
+		process.exit(1);
+	}
+	console.log(chalk.gray("  Copying project files..."));
+	try {
+		await cp(options.templateDirectory, options.targetDirectory, {
+			recursive: true,
+			filter: (source) => {
+				const basename = path.basename(source);
+				return basename !== "node_modules" && basename !== ".DS_Store";
+			}
+		});
+	} catch (err) {
+		console.error(`${chalk.red.bold("ERROR")} Failed to copy template files: ${err instanceof Error ? err.message : String(err)}`);
+		process.exit(1);
+	}
+	if (options.flavor !== "baas") await applyPreset(options.targetDirectory, options.preset);
+	await applyFlavor(options.targetDirectory, options.flavor);
+	await replacePlaceholders(options);
+	await configureEnvFile(options.targetDirectory, options.databaseUrl);
+	if (options.git) {
+		console.log(chalk.gray("  Initializing git repository..."));
+		try {
+			await execa("git", ["init"], { cwd: options.targetDirectory });
+		} catch {
+			console.warn(chalk.yellow("  Warning: Failed to initialize git repository"));
+		}
+	}
+	const { pm, pmCommands } = options;
+	const installCmd = pmCommands.install;
+	const execCmd = pmCommands.exec("rebase", [
+		"schema",
+		"introspect",
+		"--force"
+	]);
+	if (options.installDeps) {
+		console.log("");
+		console.log(chalk.gray(`  Installing dependencies with ${pm}...`));
+		console.log("");
+		try {
+			await execa(installCmd[0], installCmd.slice(1), {
+				cwd: options.targetDirectory,
+				stdio: "inherit"
+			});
+		} catch {
+			console.warn(chalk.yellow(`  Warning: Failed to install dependencies. You may need to run \`${installCmd.join(" ")}\` manually.`));
+		}
+	}
+	if (options.introspect) {
+		console.log("");
+		if (options.installDeps) {
+			console.log(chalk.gray("  Introspecting database and generating collections..."));
+			console.log("");
+			try {
+				await execa(execCmd[0], execCmd.slice(1), {
+					cwd: options.targetDirectory,
+					stdio: "inherit"
+				});
+				console.log(chalk.green("  Database successfully introspected!"));
+			} catch {
+				console.warn(chalk.yellow("  Warning: Failed to introspect database automatically."));
+				console.warn(chalk.yellow(`  You can run \`${execCmd.join(" ")}\` manually after setup.`));
+			}
+		} else {
+			console.warn(chalk.yellow("  Skipping introspection because dependencies were not installed."));
+			console.warn(chalk.yellow(`  Run \`${installCmd.join(" ")}\` then \`${execCmd.join(" ")}\` manually.`));
+		}
+	}
+	console.log("");
+	console.log(`${chalk.green.bold("✓")} Project ${chalk.bold(options.projectName)} created successfully!`);
+	console.log("");
+	console.log(chalk.bold("Next steps:"));
+	console.log("");
+	const runDev = pmCommands.run("dev");
+	const runDbPush = pmCommands.run("db:push");
+	const isBaas = options.flavor === "baas";
+	console.log(`  ${chalk.cyan("cd")} ${options.projectName}`);
+	if (!options.installDeps) console.log(`  ${chalk.cyan(installCmd.join(" "))}`);
+	console.log("");
+	if (options.databaseUrl) if (options.introspect) {
+		console.log(chalk.gray("  # Database has been introspected & collections generated!"));
+		console.log(chalk.gray("  # Start the development server (frontend + backend):"));
+		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
+	} else {
+		console.log(chalk.gray("  # Your custom database is configured in .env."));
+		console.log(chalk.gray("  # If the database is empty, push the Rebase schema to initialize it:"));
+		console.log(`  ${chalk.cyan(runDbPush.join(" "))}`);
+		console.log("");
+		console.log(chalk.gray("  # Then start the development server:"));
+		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
+	}
+	else if (isBaas) {
+		console.log(chalk.gray("  # A local database configuration has been generated in .env."));
+		console.log(chalk.gray("  # 1. Start the PostgreSQL database container:"));
+		console.log(`  ${chalk.cyan("docker compose up -d db")}`);
+		console.log("");
+		console.log(chalk.gray("  # 2. Create your tables (migrations, SQL, any tool you like)."));
+		console.log("");
+		console.log(chalk.gray("  # 3. Start the API — every table is served automatically:"));
+		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
+	} else {
+		console.log(chalk.gray("  # A local database configuration has been generated in .env."));
+		console.log(chalk.gray("  # 1. Start the PostgreSQL database container:"));
+		console.log(`  ${chalk.cyan("docker compose up -d db")}`);
+		console.log("");
+		console.log(chalk.gray("  # 2. Push the Rebase schema to initialize database tables:"));
+		console.log(`  ${chalk.cyan(runDbPush.join(" "))}`);
+		console.log("");
+		console.log(chalk.gray("  # 3. Start the development server (frontend + backend):"));
+		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
+	}
+	console.log("");
+	console.log(isBaas ? chalk.gray("This starts a headless API (Hono + PostgreSQL). There are no collection files: ") + chalk.gray("the API is derived from your database schema. Docs at /api/swagger.") : chalk.gray("This starts both the backend (Hono + PostgreSQL)") + chalk.gray(" and the frontend (Vite + React) concurrently."));
+	console.log("");
+	console.log(chalk.gray("Docs: https://rebase.pro/docs"));
+	console.log(chalk.gray("GitHub: https://github.com/rebasepro/rebase"));
+	console.log("");
+	console.log(chalk.bold("🤖 AI Agent Skills"));
+	console.log("");
+	console.log(chalk.gray("  Install Rebase agent skills for your AI coding assistant:"));
+	console.log("");
+	console.log(`  ${chalk.cyan("rebase skills install")}  ${chalk.gray("or")}  ${chalk.cyan(pmCommands.run("skills:install").join(" "))}`);
+	console.log("");
+}
+/**
+* Apply a template preset by replacing the default collection files.
+*
+* The template ships with blog collections at the top level and
+* preset alternatives under `config/collections/presets/<name>/`.
+* This function swaps the active collection files and removes the
+* presets directory so the final project is clean.
+*/
+/**
+* Reduce the scaffolded project to the chosen flavor.
+*
+* The base template is the full CMS triad. `baas` drops the frontend and the
+* collections config entirely — there is nothing to define, since the server
+* derives its API from the database — and overlays the files that differ.
+*/
+async function applyFlavor(targetDirectory, flavor) {
+	if (flavor !== "baas") return;
+	for (const dir of ["frontend", "config"]) fs.rmSync(path.join(targetDirectory, dir), {
+		recursive: true,
+		force: true
+	});
+	fs.rmSync(path.join(targetDirectory, "backend", "src", "schema.generated.ts"), { force: true });
+	const overlayDir = path.resolve(cliRoot, "templates", "overlays", "baas");
+	if (!fs.existsSync(overlayDir)) {
+		console.error(`${chalk.red.bold("ERROR")} BaaS template overlay not found at ${overlayDir}`);
+		process.exit(1);
+	}
+	await cp(overlayDir, targetDirectory, {
+		recursive: true,
+		force: true,
+		filter: (source) => {
+			const basename = path.basename(source);
+			return basename !== "node_modules" && basename !== ".DS_Store";
+		}
+	});
+}
+async function applyPreset(targetDirectory, preset) {
+	const collectionsDir = path.join(targetDirectory, "config", "collections");
+	const presetsDir = path.join(collectionsDir, "presets");
+	if (preset !== "blog") {
+		const presetDir = path.join(presetsDir, preset);
+		if (!fs.existsSync(presetDir)) {
+			console.warn(chalk.yellow(`  Warning: Preset "${preset}" not found, falling back to blog template.`));
+			cleanupPresets(presetsDir);
+			return;
+		}
+		for (const file of [
+			"posts.ts",
+			"authors.ts",
+			"tags.ts",
+			"index.ts"
+		]) {
+			const filePath = path.join(collectionsDir, file);
+			if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+		}
+		const presetFiles = fs.readdirSync(presetDir).filter((f) => f.endsWith(".ts"));
+		for (const file of presetFiles) fs.copyFileSync(path.join(presetDir, file), path.join(collectionsDir, file));
+	}
+	cleanupPresets(presetsDir);
+}
+function cleanupPresets(presetsDir) {
+	if (fs.existsSync(presetsDir)) fs.rmSync(presetsDir, {
+		recursive: true,
+		force: true
+	});
+}
+async function replacePlaceholders(options) {
+	const filesToProcess = [
+		"package.json",
+		"frontend/package.json",
+		"backend/package.json",
+		"config/package.json",
+		"frontend/index.html",
+		"pnpm-workspace.yaml",
+		"README.md"
+	];
+	const packageJsonPath = path.resolve(cliRoot, "package.json");
+	let cliVersion = "latest";
+	if (fs.existsSync(packageJsonPath)) cliVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).version || "latest";
+	const versionCache = /* @__PURE__ */ new Map();
+	const viewBin = "npm";
+	const getPackageVersion = async (pkgName) => {
+		if (versionCache.has(pkgName)) return versionCache.get(pkgName);
+		if (process.env.REBASE_E2E === "true") {
+			versionCache.set(pkgName, cliVersion);
+			return cliVersion;
+		}
+		let versionToUse = cliVersion;
+		try {
+			const { stdout } = await execa(viewBin, [
+				"view",
+				`${pkgName}@${cliVersion}`,
+				"version"
+			]);
+			if (!stdout.trim()) throw new Error("Not found");
+			versionToUse = stdout.trim();
+		} catch {
+			try {
+				const { stdout } = await execa(viewBin, [
+					"view",
+					`${pkgName}@${cliVersion.includes("canary") ? "canary" : "latest"}`,
+					"version"
+				]);
+				if (!stdout.trim()) throw new Error("Not found");
+				versionToUse = stdout.trim();
+			} catch {
+				try {
+					const { stdout } = await execa(viewBin, [
+						"view",
+						pkgName,
+						"version"
+					]);
+					versionToUse = stdout.trim() || "latest";
+				} catch {
+					versionToUse = "latest";
+				}
+			}
+		}
+		versionCache.set(pkgName, versionToUse);
+		return versionToUse;
+	};
+	const allPackages = /* @__PURE__ */ new Set();
+	const fileContents = /* @__PURE__ */ new Map();
+	for (const file of filesToProcess) {
+		const fullPath = path.resolve(options.targetDirectory, file);
+		if (!fs.existsSync(fullPath)) continue;
+		const content = fs.readFileSync(fullPath, "utf-8");
+		fileContents.set(fullPath, content);
+		const matches = [...content.matchAll(/"(@rebasepro\/[^"]+)":\s*"workspace:\*"/g)];
+		for (const match of matches) allPackages.add(match[1]);
+	}
+	console.log(chalk.gray("  Resolving package versions..."));
+	await Promise.all(Array.from(allPackages).map(getPackageVersion));
+	for (const [fullPath, originalContent] of fileContents.entries()) {
+		let content = originalContent.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
+		const matches = [...content.matchAll(/"(@rebasepro\/[^"]+)":\s*"workspace:\*"/g)];
+		for (const match of matches) {
+			const pkgName = match[1];
+			const resolvedVersion = versionCache.get(pkgName) || "latest";
+			content = content.replace(new RegExp(`"${pkgName}":\\s*"workspace:\\*"`, "g"), `"${pkgName}": "${resolvedVersion}"`);
+		}
+		fs.writeFileSync(fullPath, content, "utf-8");
+	}
+}
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = net.createServer();
+		server.once("error", () => {
+			resolve(false);
+		});
+		server.once("listening", () => {
+			server.close(() => resolve(true));
+		});
+		server.listen(port);
+	});
+}
+async function findAvailablePort(startPort) {
+	let port = startPort;
+	while (!await isPortAvailable(port)) port++;
+	return port;
+}
+async function configureEnvFile(targetDirectory, databaseUrl) {
+	const envExamplePath = path.join(targetDirectory, ".env.example");
+	const envPath = path.join(targetDirectory, ".env");
+	if (fs.existsSync(envExamplePath) && !fs.existsSync(envPath)) {
+		fs.copyFileSync(envExamplePath, envPath);
+		const jwtSecret = crypto.randomBytes(32).toString("hex");
+		const dbPassword = crypto.randomBytes(16).toString("hex");
+		let envContent = fs.readFileSync(envPath, "utf-8");
+		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
+		if (databaseUrl) {
+			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}`);
+		} else {
+			const dbPort = await findAvailablePort(5432);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public\nDATABASE_PASSWORD=${dbPassword}`);
+			const dockerComposePath = path.join(targetDirectory, "docker-compose.yml");
+			if (fs.existsSync(dockerComposePath)) {
+				let dockerComposeContent = fs.readFileSync(dockerComposePath, "utf-8");
+				dockerComposeContent = dockerComposeContent.replace(/-\s*"5432:5432"/g, `- "${dbPort}:5432"`);
+				fs.writeFileSync(dockerComposePath, dockerComposeContent, "utf-8");
+			}
+		}
+		fs.writeFileSync(envPath, envContent, "utf-8");
+	}
+}
+//#endregion
+//#region src/commands/generate_sdk.ts
+/**
+* CLI command: generate-sdk
+*
+* Reads collection definitions from a specified directory (default: ./config/collections),
+* generates a typed TypeScript SDK, and writes it to the output directory (default: ./generated/sdk).
+*
+* Uses jiti for dynamic TypeScript import of collection files.
+*/
+/**
+* Dynamically load collection definitions from a directory.
+*
+* Expects the directory to have an index.ts/index.js that exports a default
+* array of CollectionConfig objects (matching the app/config/collections pattern).
+*/
+async function loadCollections(collectionsDir) {
+	const absDir = path.resolve(collectionsDir);
+	if (!fs.existsSync(absDir)) throw new Error(`Collections directory not found: ${absDir}`);
+	let jiti;
+	try {
+		const jitiModule = await import("jiti");
+		jiti = jitiModule.default || jitiModule;
+	} catch {
+		const installCmd = [
+			...getPMCommands(detectPackageManager()).install,
+			"-D",
+			"jiti"
+		].join(" ");
+		throw new Error(`Could not load 'jiti'. Install it with: ${installCmd}\njiti is required to dynamically import TypeScript collection definitions.`);
+	}
+	const jitiInstance = jiti(absDir, {
+		interopDefault: true,
+		esmResolve: true
+	});
+	const indexCandidates = [
+		"index.ts",
+		"index.js",
+		"index.mjs"
+	];
+	let indexPath = null;
+	for (const candidate of indexCandidates) {
+		const p = path.join(absDir, candidate);
+		if (fs.existsSync(p)) {
+			indexPath = p;
+			break;
+		}
+	}
+	if (!indexPath) {
+		console.log(chalk.yellow("  No index file found, scanning individual collection files..."));
+		const collections = [];
+		const files = fs.readdirSync(absDir).filter((f) => (f.endsWith(".ts") || f.endsWith(".js")) && !f.startsWith("."));
+		for (const file of files) try {
+			const mod = jitiInstance(path.join(absDir, file));
+			const exported = mod.default || mod;
+			if (exported && typeof exported === "object" && "slug" in exported) collections.push(exported);
+			else if (Array.isArray(exported)) collections.push(...exported);
+		} catch (err) {
+			console.warn(chalk.yellow(`  ⚠ Skipping ${file}: ${err.message}`));
+		}
+		return collections;
+	}
+	const mod = jitiInstance(indexPath);
+	const exported = mod.default || mod;
+	if (Array.isArray(exported)) return exported;
+	else if (typeof exported === "object" && exported !== null) {
+		if ("collections" in exported && Array.isArray(exported.collections)) return exported.collections;
+		const collections = [];
+		for (const value of Object.values(exported)) if (value && typeof value === "object" && "slug" in value) collections.push(value);
+		if (collections.length > 0) return collections;
+	}
+	throw new Error(`Could not extract collections from ${indexPath}.\nExpected a default export of CollectionConfig[] or an object with named collection exports.`);
+}
+/**
+* Write generated files to the output directory.
+*/
+function writeFiles(outputDir, files) {
+	const absOutput = path.resolve(outputDir);
+	fs.mkdirSync(absOutput, { recursive: true });
+	for (const file of files) {
+		const filePath = path.join(absOutput, file.path);
+		const dir = path.dirname(filePath);
+		if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+		fs.writeFileSync(filePath, file.content, "utf-8");
+	}
+}
+/**
+* Main entry point for the generate-sdk command.
+*/
+async function generateSdkCommand(args) {
+	const { collectionsDir, output, cwd } = args;
+	const resolvedCollectionsDir = path.isAbsolute(collectionsDir) ? collectionsDir : path.join(cwd, collectionsDir);
+	const resolvedOutput = path.isAbsolute(output) ? output : path.join(cwd, output);
+	console.log("");
+	console.log(chalk.bold("  🔧 Rebase SDK Generator"));
+	console.log("");
+	console.log(`  ${chalk.gray("Collections:")} ${resolvedCollectionsDir}`);
+	console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
+	console.log("");
+	console.log(chalk.cyan("  → Loading collection definitions..."));
+	const collections = await loadCollections(resolvedCollectionsDir);
+	collections.sort((a, b) => a.slug.localeCompare(b.slug));
+	if (collections.length === 0) {
+		console.log(chalk.red("  ✗ No collections found. Nothing to generate."));
+		process.exit(1);
+	}
+	console.log(chalk.green(`  ✓ Found ${collections.length} collection(s): ${collections.map((c) => c.slug).join(", ")}`));
+	console.log("");
+	console.log(chalk.cyan("  → Generating SDK files..."));
+	const files = generateSDK(collections);
+	console.log(chalk.green(`  ✓ Generated ${files.length} file(s)`));
+	console.log(chalk.cyan(`  → Writing to ${resolvedOutput}...`));
+	writeFiles(resolvedOutput, files);
+	console.log("");
+	console.log(chalk.green.bold("  ✓ SDK generated successfully!"));
+	console.log("");
+	console.log(chalk.gray("  Usage:"));
+	console.log(chalk.gray("    import { createRebaseClient } from '@rebasepro/client';"));
+	console.log(chalk.gray(`    import type { Database } from './${path.relative(cwd, path.join(resolvedOutput, "database.types"))}';`));
+	console.log("");
+	console.log(chalk.gray("    const rebase = createRebaseClient<Database>({"));
+	console.log(chalk.gray("        baseUrl: 'http://localhost:3001',"));
+	console.log(chalk.gray("        // token: 'your-jwt-token',"));
+	console.log(chalk.gray("    });"));
+	console.log("");
+	console.log(chalk.gray(`    const { data } = await rebase.collection('${collections[0]?.slug || "my_collection"}').find();`));
+	console.log("");
+}
+//#endregion
+//#region src/utils/project.ts
+/**
+* Project discovery utilities for the Rebase CLI.
+*
+* These helpers locate the project root, backend directory, .env file,
+* and local binaries — used by all CLI command modules.
+*/
+/**
+* Walk up from `startDir` to find the Rebase project root.
+*
+* The root is identified by a `package.json` that either:
+* - has `workspaces` containing "backend" or "frontend", OR
+* - has a sibling `backend/` directory
+*/
+function findProjectRoot(startDir = process.cwd()) {
+	let dir = path.resolve(startDir);
+	const root = path.parse(dir).root;
+	while (dir !== root) {
+		const pkgPath = path.join(dir, "package.json");
+		if (fs.existsSync(pkgPath)) {
+			try {
+				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+				if (pkg.workspaces && Array.isArray(pkg.workspaces)) {
+					if (pkg.workspaces.some((w) => w === "backend")) return dir;
+				}
+			} catch {}
+			if (fs.existsSync(path.join(dir, "backend")) && fs.existsSync(path.join(dir, "config"))) return dir;
+		}
+		dir = path.dirname(dir);
+	}
+	return null;
+}
+/**
+* Locate the backend directory within the project root.
+*/
+function findBackendDir(projectRoot) {
+	const backendDir = path.join(projectRoot, "backend");
+	return fs.existsSync(backendDir) ? backendDir : null;
+}
+/**
+* Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
+*/
+function getActiveBackendPlugin(backendDir) {
+	const pkgPath = path.join(backendDir, "package.json");
+	if (!fs.existsSync(pkgPath)) return null;
+	try {
+		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+		const deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+		const candidates = Object.keys(deps).filter((dep) => dep.startsWith("@rebasepro/server-") && dep !== "@rebasepro/server");
+		if (candidates.length === 0) return null;
+		if (candidates.includes("@rebasepro/server-postgres")) return "@rebasepro/server-postgres";
+		for (const candidate of candidates) if (resolvePluginCliScript(backendDir, candidate)) return candidate;
+		return candidates[0];
+	} catch {}
+	return null;
+}
+/**
+* Resolve the active plugin's CLI script.
+*/
+function resolvePluginCliScript(backendDir, pluginName) {
+	const candidates = [
+		path.join(backendDir, "node_modules", pluginName, "src", "cli.ts"),
+		path.join(backendDir, "node_modules", pluginName, "dist", "cli.js"),
+		path.resolve(backendDir, "..", "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"),
+		path.resolve(backendDir, "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"),
+		path.resolve(backendDir, "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts")
+	];
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Locate the frontend directory within the project root.
+*/
+function findFrontendDir(projectRoot) {
+	const frontendDir = path.join(projectRoot, "frontend");
+	return fs.existsSync(frontendDir) ? frontendDir : null;
+}
+/**
+* Find the .env file. Checks the project root first, then backend.
+*/
+function findEnvFile(projectRoot) {
+	const candidates = [path.join(projectRoot, ".env"), path.join(projectRoot, "backend", ".env")];
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Resolve a binary from the project's node_modules/.bin.
+* Checks backend, root, parent monorepo root, then falls back to PATH.
+*/
+function resolveLocalBin(projectRoot, binName) {
+	const candidates = [path.join(projectRoot, "backend", "node_modules", ".bin", binName), path.join(projectRoot, "node_modules", ".bin", binName)];
+	let parent = path.dirname(projectRoot);
+	const rootDir = path.parse(parent).root;
+	while (parent !== rootDir) {
+		candidates.push(path.join(parent, "node_modules", ".bin", binName));
+		parent = path.dirname(parent);
+	}
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	try {
+		const globalPath = execSync(`which ${binName}`, { encoding: "utf-8" }).trim();
+		if (globalPath && fs.existsSync(globalPath)) return globalPath;
+	} catch {}
+	return null;
+}
+/**
+* Resolve the tsx binary. Checks backend node_modules first, then root.
+*/
+function resolveTsx(projectRoot) {
+	return resolveLocalBin(projectRoot, "tsx");
+}
+/**
+* Validate that a resolved tsx binary actually has an intact installation.
+*
+* `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+* exists. If the pnpm content-addressable store was cleaned or a previous
+* install was interrupted, the symlink can exist while critical files inside
+* the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+* confusing MODULE_NOT_FOUND error at runtime.
+*
+* This function follows the symlink, walks up to find the tsx package root
+* (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+* is present. Returns `null` when the installation looks healthy, or an
+* error description string when it appears corrupted.
+*/
+function validateTsxInstallation(tsxBinPath) {
+	try {
+		const realPath = fs.realpathSync(tsxBinPath);
+		let dir = path.dirname(realPath);
+		const fsRoot = path.parse(dir).root;
+		for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {
+			const pkgPath = path.join(dir, "package.json");
+			if (fs.existsSync(pkgPath)) try {
+				if (JSON.parse(fs.readFileSync(pkgPath, "utf-8")).name === "tsx") {
+					const preflightPath = path.join(dir, "dist", "preflight.cjs");
+					if (!fs.existsSync(preflightPath)) return `tsx package at ${dir} is missing dist/preflight.cjs`;
+					return null;
+				}
+			} catch {}
+			dir = path.dirname(dir);
+		}
+		return null;
+	} catch (err) {
+		return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;
+	}
+}
+/**
+* Require the project root or exit with a helpful error.
+*/
+function requireProjectRoot() {
+	const root = findProjectRoot();
+	if (!root) {
+		console.error(chalk.red("✗ Could not find a Rebase project root."));
+		console.error(chalk.gray("  Make sure you are inside a Rebase project directory"));
+		console.error(chalk.gray("  (one with backend/, frontend/, and config/ directories)."));
+		process.exit(1);
+	}
+	return root;
+}
+/**
+* Require the backend directory or exit with a helpful error.
+*/
+function requireBackendDir(projectRoot) {
+	const backendDir = findBackendDir(projectRoot);
+	if (!backendDir) {
+		console.error(chalk.red("✗ Could not find a backend/ directory."));
+		console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, "backend")}`));
+		process.exit(1);
+	}
+	return backendDir;
+}
+//#endregion
+//#region src/commands/schema.ts
+/**
+* CLI command: rebase schema <action>
+*/
+async function schemaCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printSchemaHelp();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	const backendDir = requireBackendDir(projectRoot);
+	const activePlugin = getActiveBackendPlugin(backendDir);
+	if (!activePlugin) {
+		console.error(chalk.red("✗ Could not detect an active database plugin."));
+		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
+		process.exit(1);
+	}
+	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
+	if (!pluginCli) {
+		console.error(chalk.red(`✗ Could not find CLI entry point for ${activePlugin}.`));
+		process.exit(1);
+	}
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	try {
+		if (pluginCli.endsWith(".ts")) {
+			const tsxBin = resolveTsx(projectRoot);
+			if (!tsxBin) {
+				console.error(chalk.red("✗ Could not find tsx binary."));
+				process.exit(1);
+			}
+			await execa(tsxBin, [pluginCli, ...rawArgs.slice(2)], {
+				cwd: backendDir,
+				stdio: "inherit",
+				env
+			});
+		} else await execa("node", [pluginCli, ...rawArgs.slice(2)], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+	} catch {
+		process.exit(1);
+	}
+}
+function printSchemaHelp() {
+	console.log(`
+${chalk.bold("rebase schema")} — Schema management commands
+
+${chalk.green.bold("Usage")}
+  rebase schema ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.gray("(Commands are provided by your active database driver plugin)")}
+  ${chalk.blue.bold("generate")}    Generate Schema from collection definitions
+  ${chalk.blue.bold("introspect")}  Introspect an existing database to generate collection definitions
+
+${chalk.green.bold("generate Options")}
+  ${chalk.blue("--collections, -c")}  Path to collections directory
+  ${chalk.blue("--output, -o")}       Output path for generated schema
+  ${chalk.blue("--watch, -w")}        Watch for changes and regenerate automatically
+
+${chalk.green.bold("introspect Options")}
+  ${chalk.blue("--output, -o")}       Output directory for generated collection files
+`);
+}
+//#endregion
+//#region src/commands/db.ts
+/**
+* CLI command: rebase db <action>
+*/
+async function dbCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printDbHelp$1();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	const backendDir = requireBackendDir(projectRoot);
+	const activePlugin = getActiveBackendPlugin(backendDir);
+	if (!activePlugin) {
+		console.error(chalk.red("✗ Could not detect an active database plugin."));
+		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
+		process.exit(1);
+	}
+	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
+	if (!pluginCli) {
+		console.error(chalk.red(`✗ Could not find CLI entry point for ${activePlugin}.`));
+		process.exit(1);
+	}
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	try {
+		if (pluginCli.endsWith(".ts")) {
+			const tsxBin = resolveTsx(projectRoot);
+			if (!tsxBin) {
+				console.error(chalk.red("✗ Could not find tsx binary."));
+				process.exit(1);
+			}
+			await execa(tsxBin, [pluginCli, ...rawArgs.slice(2)], {
+				cwd: backendDir,
+				stdio: "inherit",
+				env
+			});
+		} else await execa("node", [pluginCli, ...rawArgs.slice(2)], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+	} catch {
+		process.exit(1);
+	}
+}
+function printDbHelp$1() {
+	console.log(`
+${chalk.bold("rebase db")} — Database management commands
+
+${chalk.green.bold("Usage")}
+  rebase db ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.gray("(Commands are provided by your active database driver plugin)")}
+  ${chalk.blue.bold("push")}       Apply schema directly to database (development)
+  ${chalk.blue.bold("generate")}   Generate migration files
+  ${chalk.blue.bold("migrate")}    Run pending migrations
+  ${chalk.blue.bold("branch")}     Database branching (create, list, delete, info)
+  ${chalk.blue.bold("backup")}     Create a backup with pg_dump (--out <path|s3://…>)
+  ${chalk.blue.bold("restore")}    Restore a backup with pg_restore (destructive; needs --yes)
+  ${chalk.blue.bold("backups")}    List stored backups (backups list)
+
+${chalk.green.bold("Examples")}
+  ${chalk.gray("# Quick development workflow")}
+  rebase schema generate && rebase db push
+
+  ${chalk.gray("# Production migration workflow")}
+  rebase db generate
+  rebase db migrate
+
+  ${chalk.gray("# Create a database branch")}
+  rebase db branch create feature_auth
+
+  ${chalk.gray("# Back up to a local directory, then to object storage")}
+  rebase db backup --out ./backups
+  rebase db backup --out s3://my-private-bucket/backups
+
+  ${chalk.gray("# Restore into a fresh database (safe: does not touch the live one)")}
+  rebase db restore ./backups/rebase-app-20260714T030000Z.dump --create-db --target-db app_restored
+`);
+}
+//#endregion
+//#region src/commands/dev.ts
+/**
+* CLI command: rebase dev
+*
+* Starts the full development environment:
+* - Backend: tsx watch with auto-reload
+* - Frontend: vite dev server
+*
+* Both processes stream output with color-coded prefixes.
+*
+* When the backend uses port-retry (i.e. the configured port is busy and it
+* binds to the next free one), the CLI detects the actual port from stdout
+* and injects VITE_API_URL into the frontend so it connects automatically.
+*
+* Each project gets a deterministic default port derived from the project
+* root path, so multiple Rebase instances never collide.
+*/
+/** Well-known filename the backend writes its actual port to. */
+var DEV_PORT_FILENAME = ".rebase-dev-port";
+/**
+* Compute a deterministic port from the project root path.
+* Range: 3001–3999 (avoids privileged ports and common services).
+* Two different project directories will almost always get different ports.
+*/
+function getProjectPort(projectRoot) {
+	let hash = 0;
+	for (let i = 0; i < projectRoot.length; i++) hash = (hash << 5) - hash + projectRoot.charCodeAt(i) | 0;
+	return 3001 + Math.abs(hash) % 999;
+}
+/**
+* Resolve the best starting port for this project:
+* 1. Explicit --port flag (highest priority)
+* 2. PORT env var
+* 3. Previously used port from .rebase-dev-port (port affinity across restarts)
+* 4. Deterministic hash from project path (unique per project)
+*/
+function resolveStartPort(projectRoot, explicitPort) {
+	if (explicitPort) return explicitPort;
+	if (process.env.PORT) return parseInt(process.env.PORT, 10);
+	try {
+		const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+		if (fs.existsSync(portFile)) {
+			const saved = parseInt(fs.readFileSync(portFile, "utf-8").trim(), 10);
+			if (saved > 0 && saved < 65536) return saved;
+		}
+	} catch {}
+	return getProjectPort(projectRoot);
+}
+async function devCommand(rawArgs) {
+	const args = arg({
+		"--backend-only": Boolean,
+		"--frontend-only": Boolean,
+		"--port": Number,
+		"--generate": Boolean,
+		"--help": Boolean,
+		"-b": "--backend-only",
+		"-f": "--frontend-only",
+		"-p": "--port",
+		"-g": "--generate",
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printDevHelp();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	const backendDir = findBackendDir(projectRoot);
+	const frontendDir = findFrontendDir(projectRoot);
+	const backendOnly = args["--backend-only"] || false;
+	const frontendOnly = args["--frontend-only"] || false;
+	const shouldGenerate = args["--generate"] || process.env.REBASE_AUTO_GENERATE === "true" || process.env.REBASE_GENERATE === "true";
+	const startPort = resolveStartPort(projectRoot, args["--port"]);
+	console.log("");
+	console.log(chalk.bold("  🚀 Rebase Dev Server"));
+	console.log("");
+	const children = [];
+	let frontendUrl = "";
+	let backendUrl = "";
+	let debounceSummary = null;
+	let bannerPrinted = false;
+	/** Actual backend port, resolved once the server prints its URL. */
+	let resolvedBackendPort = null;
+	const stripAnsi = (str) => str.replace(/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g, "");
+	function printSummary() {
+		if (!frontendUrl || !backendUrl) return;
+		if (debounceSummary) clearTimeout(debounceSummary);
+		debounceSummary = setTimeout(() => {
+			if (bannerPrinted) return;
+			console.log("");
+			console.log(chalk.cyan("┌────────────────────────────────────────────────────────────┐"));
+			console.log(chalk.cyan("│                                                            │"));
+			console.log(chalk.cyan("│   ✦ Rebase Admin App is ready!                             │"));
+			const paddedUrl = stripAnsi(frontendUrl).padEnd(41);
+			console.log(chalk.cyan("│   ➜ Frontend URL: ") + chalk.white(paddedUrl) + chalk.cyan("│"));
+			console.log(chalk.cyan("│                                                            │"));
+			console.log(chalk.cyan("└────────────────────────────────────────────────────────────┘"));
+			console.log("");
+			bannerPrinted = true;
+		}, 500);
+	}
+	const cleanup = () => {
+		try {
+			const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+			if (fs.existsSync(portFile)) fs.unlinkSync(portFile);
+			const urlFile = path.join(projectRoot, ".rebase-dev-url");
+			if (fs.existsSync(urlFile)) fs.unlinkSync(urlFile);
+		} catch {}
+		children.forEach((child) => {
+			if (child.pid && !child.killed) try {
+				if (process.platform === "win32") execaCommandSync(`taskkill /pid ${child.pid} /T /F`);
+				else process.kill(-child.pid, "SIGKILL");
+			} catch (e) {
+				try {
+					child.kill("SIGKILL");
+				} catch (err) {}
+			}
+		});
+		process.exit(0);
+	};
+	process.on("SIGINT", cleanup);
+	process.on("SIGTERM", cleanup);
+	/**
+	* Start the Vite frontend, optionally injecting the backend port.
+	*/
+	function startFrontend(backendPort) {
+		if (!frontendDir) return;
+		console.log(`  ${chalk.magenta("▶")} Frontend: ${chalk.gray(frontendDir)}`);
+		const frontendEnv = { ...process.env };
+		if (backendPort) {
+			frontendEnv.VITE_API_URL = `http://localhost:${backendPort}`;
+			console.log(`  ${chalk.gray("↳ VITE_API_URL")} = ${chalk.white(`http://localhost:${backendPort}`)}`);
+		}
+		const runDevCmd = getPMCommands(detectPackageManager(projectRoot)).run("dev");
+		const frontendChild = execa(runDevCmd[0], runDevCmd.slice(1), {
+			cwd: frontendDir,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			env: frontendEnv,
+			shell: true,
+			detached: process.platform !== "win32"
+		});
+		frontendChild.catch(() => {});
+		frontendChild.stdout?.on("data", (data) => {
+			data.toString().split("\n").filter(Boolean).forEach((line) => {
+				console.log(`${chalk.magenta.bold("[admin]")} ${line}`);
+				const cleanLine = stripAnsi(line);
+				const urlMatch = cleanLine.match(/(http:\/\/(?:localhost|127\.0\.0\.1):\d+)/);
+				if (cleanLine.includes("Local:") && urlMatch) {
+					frontendUrl = urlMatch[1];
+					printSummary();
+				}
+			});
+		});
+		frontendChild.stderr?.on("data", (data) => {
+			data.toString().split("\n").filter(Boolean).forEach((line) => {
+				console.log(`${chalk.magenta.bold("[admin]")} ${line}`);
+			});
+		});
+		children.push(frontendChild);
+	}
+	if (!frontendOnly && backendDir) {
+		const tsxBin = resolveTsx(projectRoot);
+		if (!tsxBin) {
+			const addCmd = [
+				...getPMCommands(detectPackageManager(projectRoot)).install,
+				"-D",
+				"tsx"
+			].join(" ");
+			console.error(chalk.red("  ✗ Could not find tsx binary for backend."));
+			console.error(chalk.gray(`    Install it with: ${addCmd}`));
+			process.exit(1);
+		}
+		const tsxValidationError = validateTsxInstallation(tsxBin);
+		if (tsxValidationError) {
+			const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+			console.error(chalk.red("  ✗ tsx installation appears corrupted."));
+			console.error(chalk.gray(`    ${tsxValidationError}`));
+			console.error("");
+			console.error(chalk.gray("    To fix, run:"));
+			console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+			process.exit(1);
+		}
+		const envFile = findEnvFile(projectRoot);
+		const env = { ...process.env };
+		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+		env.PORT = String(startPort);
+		console.log(`  ${chalk.cyan("▶")} Backend:  ${chalk.gray(backendDir)}`);
+		console.log(`  ${chalk.gray("↳ PORT")} = ${chalk.white(String(startPort))}`);
+		if (envFile) try {
+			const envText = fs.readFileSync(envFile, "utf-8");
+			const readEnvKey = (key) => {
+				const m = envText.match(new RegExp(`^\\s*${key}\\s*=\\s*(.+?)\\s*$`, "m"));
+				return m ? m[1].replace(/^["']|["']$/g, "") : void 0;
+			};
+			const envPort = readEnvKey("PORT");
+			const envApiUrl = readEnvKey("VITE_API_URL");
+			const overridden = [];
+			if (envPort && envPort !== String(startPort)) overridden.push("PORT");
+			if (envApiUrl && envApiUrl !== `http://localhost:${startPort}`) overridden.push("VITE_API_URL");
+			if (overridden.length > 0) console.log(chalk.yellow(`  ⚠ dev uses a derived per-project port (${startPort}); your .env ${overridden.join(" / ")} ${overridden.length > 1 ? "are" : "is"} ignored here (avoids cross-project collisions). Pass ${chalk.white("--port")} to pin a port.`));
+		} catch {}
+		/** Whether the frontend has been launched (we only launch it once). */
+		let frontendLaunched = false;
+		if (shouldGenerate) {
+			console.log(chalk.gray("  → Ensuring schema and SDK are generated on start..."));
+			try {
+				const activePlugin = getActiveBackendPlugin(backendDir);
+				const pluginCli = activePlugin ? resolvePluginCliScript(backendDir, activePlugin) : null;
+				if (pluginCli) await execa(tsxBin, [
+					pluginCli,
+					"schema",
+					"generate"
+				], {
+					cwd: backendDir,
+					stdio: "inherit",
+					env
+				});
+				const sdkCmd = getPMCommands(detectPackageManager(projectRoot)).exec("rebase", ["generate-sdk"]);
+				await execa(sdkCmd[0], sdkCmd.slice(1), {
+					cwd: projectRoot,
+					stdio: "inherit",
+					env
+				});
+				console.log(chalk.green("  ✓ Initial schema and SDK generated successfully.\n"));
+			} catch (err) {
+				console.error(chalk.red(`  ✗ Initial schema/SDK generation failed: ${err instanceof Error ? err.message : err}\n`));
+			}
+			const collectionsDir = path.join(projectRoot, "config", "collections");
+			if (fs.existsSync(collectionsDir)) {
+				let watchDebounce = null;
+				fs.watch(collectionsDir, { recursive: true }, (eventType, filename) => {
+					if (!filename || filename.startsWith(".") || filename.endsWith(".tmp")) return;
+					if (watchDebounce) clearTimeout(watchDebounce);
+					watchDebounce = setTimeout(async () => {
+						console.log(chalk.yellow(`\n  🔄 Collection change detected (${filename}). Regenerating schema & SDK...`));
+						try {
+							const activePlugin = getActiveBackendPlugin(backendDir);
+							const pluginCli = activePlugin ? resolvePluginCliScript(backendDir, activePlugin) : null;
+							if (pluginCli) await execa(tsxBin, [
+								pluginCli,
+								"schema",
+								"generate"
+							], {
+								cwd: backendDir,
+								stdio: "inherit",
+								env
+							});
+							const sdkCmd = getPMCommands(detectPackageManager(projectRoot)).exec("rebase", ["generate-sdk"]);
+							await execa(sdkCmd[0], sdkCmd.slice(1), {
+								cwd: projectRoot,
+								stdio: "inherit",
+								env
+							});
+							console.log(chalk.green("  ✓ Schema & SDK regenerated successfully. Hono will reload."));
+						} catch (err) {
+							console.error(chalk.red(`  ✗ Failed to regenerate schema/SDK: ${err instanceof Error ? err.message : err}`));
+						}
+					}, 300);
+				});
+			}
+		}
+		const watchArgs = [
+			"watch",
+			"--conditions",
+			"development",
+			"src/index.ts"
+		];
+		if (!shouldGenerate) {
+			watchArgs.splice(1, 0, `--watch="${path.join("..", "config", "**", "*")}"`);
+			const collectionsDir = path.join(projectRoot, "config", "collections");
+			if (fs.existsSync(collectionsDir)) {
+				let driftDebounce = null;
+				fs.watch(collectionsDir, { recursive: true }, (_eventType, filename) => {
+					if (!filename || filename.startsWith(".") || filename.endsWith(".tmp")) return;
+					if (driftDebounce) clearTimeout(driftDebounce);
+					driftDebounce = setTimeout(() => {
+						console.log([
+							"",
+							chalk.yellow("  ┌──────────────────────────────────────────────────────────────┐"),
+							chalk.yellow("  │  ⚠️  Collection file changed: ") + chalk.white(filename.padEnd(31)) + chalk.yellow("│"),
+							chalk.yellow("  │                                                              │"),
+							chalk.yellow("  │  Your schema may be out of sync. Run:                        │"),
+							chalk.yellow("  │    ") + chalk.cyan("rebase schema generate") + chalk.yellow("   regenerate Drizzle schema        │"),
+							chalk.yellow("  │    ") + chalk.cyan("rebase db push        ") + chalk.yellow("   sync schema to database          │"),
+							chalk.yellow("  │    ") + chalk.cyan("rebase doctor         ") + chalk.yellow("   check for drift                  │"),
+							chalk.yellow("  │                                                              │"),
+							chalk.yellow("  │  TIP: Use ") + chalk.bold("rebase dev --generate") + chalk.yellow(" for auto-regeneration        │"),
+							chalk.yellow("  └──────────────────────────────────────────────────────────────┘"),
+							""
+						].join("\n"));
+					}, 500);
+				});
+			}
+		}
+		const backendChild = execa(tsxBin, watchArgs, {
+			cwd: backendDir,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			env,
+			shell: true,
+			detached: process.platform !== "win32"
+		});
+		backendChild.catch(() => {});
+		backendChild.stdout?.on("data", (data) => {
+			data.toString().split("\n").filter(Boolean).forEach((line) => {
+				console.log(`${chalk.cyan.bold("[backend]")}  ${line}`);
+				const serverMatch = stripAnsi(line).match(/Server running at http:\/\/(?:localhost|127\.0\.0\.1):(\d+)/);
+				if (serverMatch) {
+					resolvedBackendPort = parseInt(serverMatch[1], 10);
+					backendUrl = "started";
+					printSummary();
+					const urlFile = path.join(projectRoot, ".rebase-dev-url");
+					fs.writeFileSync(urlFile, `http://localhost:${resolvedBackendPort}`, "utf-8");
+					const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+					fs.writeFileSync(portFile, String(resolvedBackendPort), "utf-8");
+					if (!backendOnly && frontendDir && !frontendLaunched) {
+						frontendLaunched = true;
+						startFrontend(resolvedBackendPort);
+					}
+				}
+			});
+		});
+		/** Whether we've already shown a corrupted-modules recovery hint. */
+		let corruptedModulesWarned = false;
+		backendChild.stderr?.on("data", (data) => {
+			data.toString().split("\n").filter(Boolean).forEach((line) => {
+				console.log(`${chalk.cyan.bold("[backend]")}  ${line}`);
+				if (!corruptedModulesWarned) {
+					const cleanLine = stripAnsi(line);
+					if (cleanLine.includes("Cannot find module") && cleanLine.includes("node_modules/.pnpm/")) {
+						corruptedModulesWarned = true;
+						setTimeout(() => {
+							const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+							console.error("");
+							console.error(chalk.red("  ✗ node_modules appears corrupted — a required file is missing."));
+							console.error(chalk.gray("    This usually happens when a previous install was interrupted"));
+							console.error(chalk.gray("    or the package manager store was cleaned."));
+							console.error("");
+							console.error(chalk.gray("    To fix, stop the dev server and run:"));
+							console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+							console.error("");
+						}, 200);
+					}
+				}
+			});
+		});
+		children.push(backendChild);
+	} else if (!frontendOnly && !backendDir) console.warn(chalk.yellow("  ⚠ No backend/ directory found, skipping backend."));
+	if (!backendOnly && frontendDir && (frontendOnly || !backendDir)) startFrontend(null);
+	else if (!backendOnly && !frontendDir) console.warn(chalk.yellow("  ⚠ No frontend/ directory found, skipping frontend."));
+	if (children.length === 0) {
+		console.error(chalk.red("  ✗ Nothing to start. Check your project structure."));
+		process.exit(1);
+	}
+	console.log("");
+	console.log(chalk.gray("  Press Ctrl+C to stop all servers."));
+	console.log("");
+	await Promise.all(children.map((child) => new Promise((resolve) => {
+		child.finally(() => resolve());
+	})));
+}
+function printDevHelp() {
+	console.log(`
+${chalk.bold("rebase dev")} — Start the development server
+
+${chalk.green.bold("Usage")}
+  rebase dev [options]
+
+${chalk.green.bold("Options")}
+  ${chalk.blue("--backend-only, -b")}   Only start the backend server
+  ${chalk.blue("--frontend-only, -f")}  Only start the frontend server
+  ${chalk.blue("--port, -p")}           Backend port (default: auto-detected per project)
+  ${chalk.blue("--generate, -g")}        Enable automatic schema and SDK generation on startup and file changes
+
+${chalk.green.bold("Description")}
+  Starts both the backend (tsx watch + Hono) and frontend (Vite)
+  dev servers concurrently with color-coded output prefixes.
+
+  Each project automatically receives a unique default port derived
+  from its directory path, preventing collisions when running multiple
+  Rebase instances simultaneously.
+
+  If the assigned port is already in use, the server will automatically
+  try the next available port. The frontend is started only after the
+  backend is ready, and VITE_API_URL is injected automatically.
+
+  By default, automatic schema and SDK generation is disabled on startup
+  and file changes. Pass --generate (-g) or set REBASE_AUTO_GENERATE=true
+  in your environment to enable it.
+`);
+}
+//#endregion
+//#region src/commands/build.ts
+/**
+* CLI command: rebase build
+*
+* Runs the build script in all workspace packages.
+* Automatically detects the package manager (pnpm or npm) and
+* uses the correct workspace-aware command.
+*/
+async function buildCommand() {
+	const projectRoot = requireProjectRoot();
+	const pm = detectPackageManager(projectRoot);
+	const buildCmd = getPMCommands(pm).runAll("build");
+	console.log(`${chalk.bold("Rebase")} — Building all workspaces with ${chalk.cyan(pm)}...\n`);
+	try {
+		await execa(buildCmd[0], buildCmd.slice(1), {
+			cwd: projectRoot,
+			stdio: "inherit"
+		});
+	} catch {
+		console.error(chalk.red("\n✗ Build failed."));
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/commands/start.ts
+/**
+* CLI command: rebase start
+*
+* Starts the backend server in production mode.
+* Automatically detects the package manager (pnpm or npm) and
+* runs the start script in the backend workspace.
+*/
+async function startCommand() {
+	const projectRoot = requireProjectRoot();
+	const startCmd = getPMCommands(detectPackageManager(projectRoot)).runWorkspace("backend", "start");
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	console.log(`${chalk.bold("Rebase")} — Starting backend server...\n`);
+	try {
+		await execa(startCmd[0], startCmd.slice(1), {
+			cwd: projectRoot,
+			stdio: "inherit",
+			env
+		});
+	} catch {
+		console.error(chalk.red("\n✗ Failed to start server."));
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/commands/auth.ts
+/**
+* CLI command: rebase auth <action>
+*
+* Subcommands:
+*   reset-password — Reset a user's password
+*/
+async function authCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printAuthHelp();
+		return;
+	}
+	switch (subcommand) {
+		case "reset-password":
+			await resetPassword(rawArgs);
+			break;
+		default:
+			console.error(chalk.red(`Unknown auth command: ${subcommand}`));
+			console.log("");
+			printAuthHelp();
+			process.exit(1);
+	}
+}
+async function resetPassword(rawArgs) {
+	const args = arg({
+		"--email": String,
+		"--password": String,
+		"-e": "--email",
+		"-p": "--password"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const email = args["--email"] || args._[0];
+	const newPassword = args["--password"] || args._[1];
+	if (!email) {
+		console.error(chalk.red("✗ Email is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase auth reset-password <email> [new-password]"));
+		console.log(chalk.gray("         rebase auth reset-password --email user@example.com --password NewPass123!"));
+		process.exit(1);
+	}
+	const projectRoot = requireProjectRoot();
+	let envServiceKey;
+	const envFile = findEnvFile(projectRoot);
+	if (envFile && fs.existsSync(envFile)) try {
+		const match = fs.readFileSync(envFile, "utf8").match(/^\s*REBASE_SERVICE_KEY\s*=\s*['"]?(.*?)['"]?\s*$/m);
+		if (match && match[1]) envServiceKey = match[1];
+	} catch {}
+	let baseUrl = process.env.REBASE_BASE_URL;
+	let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;
+	const statePath = path.join(projectRoot, ".rebase", "state.json");
+	if (fs.existsSync(statePath)) try {
+		const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		if (state && typeof state === "object") {
+			if (typeof state.baseUrl === "string" && !baseUrl) baseUrl = state.baseUrl;
+			if (typeof state.serviceKey === "string" && !serviceKey) serviceKey = state.serviceKey;
+		}
+	} catch {}
+	const devUrlPath = path.join(projectRoot, ".rebase-dev-url");
+	if (fs.existsSync(devUrlPath) && !baseUrl) try {
+		baseUrl = fs.readFileSync(devUrlPath, "utf8").trim();
+	} catch {}
+	if (baseUrl && serviceKey) {
+		console.log("Trying API-first reset via running backend...");
+		try {
+			const finalPass = newPassword || "NewPassword123!";
+			const cleanBaseUrl = baseUrl.replace(/\/+$/, "");
+			const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=1`;
+			const searchRes = await fetch(searchUrl, { headers: {
+				"Authorization": `Bearer ${serviceKey}`,
+				"Accept": "application/json"
+			} });
+			if (!searchRes.ok) throw new Error(`Failed to list users: ${searchRes.statusText}`);
+			const searchData = await searchRes.json();
+			if (!searchData || typeof searchData !== "object") throw new Error("Invalid response format from user search API.");
+			let userId;
+			if (Array.isArray(searchData)) {
+				const firstUser = searchData[0];
+				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
+				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
+			} else if ("users" in searchData && Array.isArray(searchData.users)) {
+				const firstUser = searchData.users[0];
+				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
+				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
+			}
+			if (!userId) throw new Error(`User not found with email: ${email}`);
+			const resetUrl = `${cleanBaseUrl}/api/admin/users/${userId}/reset-password`;
+			const resetRes = await fetch(resetUrl, {
+				method: "POST",
+				headers: {
+					"Authorization": `Bearer ${serviceKey}`,
+					"Content-Type": "application/json",
+					"Accept": "application/json"
+				},
+				body: JSON.stringify({ password: finalPass })
+			});
+			if (!resetRes.ok) {
+				const errText = await resetRes.text();
+				throw new Error(`Password reset endpoint failed: ${errText || resetRes.statusText}`);
+			}
+			console.log("API reset successful.");
+			console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (via API)"));
+			console.log("");
+			console.log(`  ${chalk.gray("Email:")} ${email}`);
+			console.log(`  ${chalk.gray("Password:")} ${finalPass}`);
+			console.log("");
+			return;
+		} catch (err) {
+			const errMsg = err instanceof Error ? err.message : String(err);
+			console.warn(chalk.yellow("API reset failed, falling back to direct database update..."));
+			console.warn(chalk.gray(`  Details: ${errMsg}`));
+		}
+	}
+	const backendDir = requireBackendDir(projectRoot);
+	const tsxBin = resolveTsx(projectRoot);
+	if (!tsxBin) {
+		console.error(chalk.red("✗ Could not find tsx binary."));
+		process.exit(1);
+	}
+	try {
+		const env = { ...process.env };
+		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+		env.REBASE_RESET_EMAIL = email;
+		env.REBASE_RESET_PASSWORD = newPassword || "NewPassword123!";
+		env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
+		const scriptContent = `
+import { createPostgresDatabaseConnection } from "@rebasepro/server-postgres";
+import { hashPassword } from "@rebasepro/server";
+import { eq } from "drizzle-orm";
+import * as dotenv from "dotenv";
+import path from "path";
+import fs from "fs";
+
+dotenv.config({ path: process.env.REBASE_ENV_FILE_PATH });
+
+const email = process.env.REBASE_RESET_EMAIL!;
+const newPassword = process.env.REBASE_RESET_PASSWORD!;
+
+async function resetPassword() {
+    const { db } = createPostgresDatabaseConnection(process.env.DATABASE_URL!);
+    const hash = await hashPassword(newPassword);
+
+    let usersTable;
+    try {
+        const schemaPath = path.resolve("./src/schema.generated.ts");
+        if (fs.existsSync(schemaPath)) {
+            const schema = await import("file://" + schemaPath);
+            usersTable = schema.users || schema.tables?.users;
         }
-        return true;
-      }
-    });
-  }
-  if (!args["--git"]) {
-    questions.push({
-      type: "confirm",
-      name: "git",
-      message: "Initialize a git repository?",
-      default: true
-    });
-  }
-  const answers = await inquirer.prompt(questions);
-  const projectName = nameArg || answers.projectName;
-  const targetDirectory = path.resolve(process.cwd(), projectName);
-  const templateDirectory = path.resolve(cliRoot, "templates", "template");
-  return {
-    projectName,
-    git: args["--git"] || answers.git || false,
-    targetDirectory,
-    templateDirectory
-  };
-}
-async function createProject(options) {
-  if (fs.existsSync(options.targetDirectory)) {
-    if (fs.readdirSync(options.targetDirectory).length !== 0) {
-      console.error(`${chalk.red.bold("ERROR")} Directory "${options.projectName}" already exists and is not empty`);
-      process.exit(1);
+    } catch (e) {
+        // ignore and fallback
     }
-  } else {
-    fs.mkdirSync(options.targetDirectory, { recursive: true });
-  }
-  try {
-    await access(options.templateDirectory, fs.constants.R_OK);
-  } catch {
-    console.error(`${chalk.red.bold("ERROR")} Template not found at ${options.templateDirectory}`);
-    process.exit(1);
-  }
-  console.log(chalk.gray("  Copying project files..."));
-  await copy(options.templateDirectory, options.targetDirectory, {
-    clobber: false,
-    dot: true,
-    filter: (source) => {
-      const basename = path.basename(source);
-      return basename !== "node_modules" && basename !== ".DS_Store";
+
+    if (!usersTable) {
+        const pgServer = await import("@rebasepro/server-postgres");
+        usersTable = pgServer.users;
     }
-  });
-  await replacePlaceholders(options);
-  const envTemplatePath = path.join(options.targetDirectory, ".env.template");
-  const envPath = path.join(options.targetDirectory, ".env");
-  if (fs.existsSync(envTemplatePath) && !fs.existsSync(envPath)) {
-    fs.renameSync(envTemplatePath, envPath);
-    const jwtSecret = crypto.randomBytes(32).toString("hex");
-    const dbPassword = crypto.randomBytes(16).toString("hex");
-    let envContent = fs.readFileSync(envPath, "utf-8");
-    envContent = envContent.replace(
-      "postgresql://rebase:password@localhost:5432/rebase",
-      `postgresql://rebase:${dbPassword}@localhost:5432/rebase`
-    );
-    envContent = envContent.replace(
-      "change-this-to-a-secure-random-string",
-      jwtSecret
-    );
-    envContent += `
-# Docker Compose Database Password
-POSTGRES_PASSWORD=${dbPassword}
-`;
-    fs.writeFileSync(envPath, envContent, "utf-8");
-  }
-  if (options.git) {
-    console.log(chalk.gray("  Initializing git repository..."));
-    try {
-      await execa("git", ["init"], { cwd: options.targetDirectory });
-    } catch {
-      console.warn(chalk.yellow("  Warning: Failed to initialize git repository"));
+
+    const passwordHashKey = (usersTable.passwordHash || "passwordHash" in usersTable) ? "passwordHash" : "password_hash";
+
+    const result = await db.update(usersTable)
+        .set({ [passwordHashKey]: hash })
+        .where(eq(usersTable.email, email))
+        .returning({
+            id: usersTable.id,
+            email: usersTable.email
+        });
+
+    if (result.length > 0) {
+        console.log("✅ Password reset for: " + result[0].email);
+        ${!newPassword ? "console.log(\"   New password: \" + newPassword);" : ""}
+    } else {
+        console.log("✗ User not found: " + email);
     }
-  }
-  console.log("");
-  console.log(`${chalk.green.bold("✓")} Project ${chalk.bold(options.projectName)} created successfully!`);
-  console.log("");
-  console.log(chalk.bold("Next steps:"));
-  console.log("");
-  console.log(`  ${chalk.cyan("cd")} ${options.projectName}`);
-  console.log(`  ${chalk.cyan("pnpm install")}`);
-  console.log("");
-  console.log(chalk.gray("  # Set up your database connection in .env"));
-  console.log(chalk.gray("  # Then run:"));
-  console.log("");
-  console.log(`  ${chalk.cyan("pnpm dev")}`);
-  console.log("");
-  console.log(chalk.gray("This starts both the backend (Express + PostgreSQL)") + chalk.gray(" and the frontend (Vite + React) concurrently."));
-  console.log("");
-  console.log(chalk.gray("Docs: https://rebase.pro/docs"));
-  console.log(chalk.gray("GitHub: https://github.com/rebaseco/rebase"));
-  console.log("");
+    process.exit(0);
 }
-async function replacePlaceholders(options) {
-  const filesToProcess = [
-    "package.json",
-    "frontend/package.json",
-    "backend/package.json",
-    "shared/package.json",
-    "frontend/index.html"
-  ];
-  for (const file of filesToProcess) {
-    const fullPath = path.resolve(options.targetDirectory, file);
-    if (!fs.existsSync(fullPath)) continue;
-    let content = fs.readFileSync(fullPath, "utf-8");
-    content = content.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
-    fs.writeFileSync(fullPath, content, "utf-8");
-  }
-}
-const __filename$1 = fileURLToPath(import.meta.url);
-const __dirname$1 = path.dirname(__filename$1);
+
+resetPassword().catch(console.error);
+`;
+		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
+		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
+		console.log("");
+		console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (Direct DB Fallback)"));
+		console.log("");
+		console.log(`  ${chalk.gray("Email:")} ${email}`);
+		if (newPassword) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
+		console.log("");
+		const child = spawn(tsxBin, [tmpScriptPath], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+		return new Promise((resolve) => {
+			child.on("close", (code) => {
+				try {
+					fs.unlinkSync(tmpScriptPath);
+				} catch {}
+				if (code !== 0) process.exit(code ?? 1);
+				resolve();
+			});
+		});
+	} catch (err) {
+		console.error(chalk.red("✗ Direct database update failed."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+}
+function printAuthHelp() {
+	console.log(`
+${chalk.bold("rebase auth")} — Authentication management commands
+
+${chalk.green.bold("Usage")}
+  rebase auth ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("reset-password")}    Reset a user's password
+
+${chalk.green.bold("reset-password Options")}
+  ${chalk.blue("--email, -e")}        User's email address
+  ${chalk.blue("--password, -p")}     New password (default: NewPassword123!)
+
+${chalk.green.bold("Examples")}
+  rebase auth reset-password user@example.com
+  rebase auth reset-password --email user@example.com --password MyNewPass!
+`);
+}
+//#endregion
+//#region src/commands/doctor.ts
+/**
+* CLI command: rebase doctor
+*
+* Detects three-way schema drift between collection definitions,
+* the generated Drizzle schema, and the live PostgreSQL database.
+*/
+async function doctorCommand(rawArgs) {
+	const projectRoot = requireProjectRoot();
+	const backendDir = requireBackendDir(projectRoot);
+	const activePlugin = getActiveBackendPlugin(backendDir);
+	if (!activePlugin) {
+		console.error(chalk.red("✗ Could not detect an active database plugin."));
+		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
+		process.exit(1);
+	}
+	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
+	if (!pluginCli) {
+		console.error(chalk.red(`✗ Could not find CLI entry point for ${activePlugin}.`));
+		process.exit(1);
+	}
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	try {
+		if (pluginCli.endsWith(".ts")) {
+			const tsxBin = resolveTsx(projectRoot);
+			if (!tsxBin) {
+				console.error(chalk.red("✗ Could not find tsx binary."));
+				process.exit(1);
+			}
+			await execa(tsxBin, [pluginCli, ...rawArgs.slice(2)], {
+				cwd: backendDir,
+				stdio: "inherit",
+				env
+			});
+		} else await execa("node", [pluginCli, ...rawArgs.slice(2)], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+	} catch {
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/commands/skills.ts
+var require = createRequire(import.meta.url);
+/** Supported agent environments and their target directories. */
+var AGENTS = {
+	cursor: {
+		label: "Cursor",
+		detectDir: ".cursor",
+		targetDir: ".cursor/rules",
+		/** Cursor uses .mdc files (Markdown with Context). */
+		transformFile: (skillName, content) => ({
+			fileName: `${skillName}.mdc`,
+			content
+		})
+	},
+	claude: {
+		label: "Claude Code",
+		detectDir: ".claude",
+		targetDir: ".claude/skills",
+		/** Claude Code uses the standard SKILL.md format in subdirectories. */
+		transformFile: (skillName, content) => ({
+			fileName: path.join(skillName, "SKILL.md"),
+			content
+		})
+	},
+	windsurf: {
+		label: "Windsurf",
+		detectDir: ".windsurf",
+		targetDir: ".windsurf/rules",
+		/** Windsurf uses plain .md files. */
+		transformFile: (skillName, content) => ({
+			fileName: `${skillName}.md`,
+			content
+		})
+	},
+	gemini: {
+		label: "Gemini CLI / Antigravity",
+		detectDir: ".agents",
+		targetDir: ".agents/skills",
+		/** Gemini uses the standard SKILL.md format in subdirectories. */
+		transformFile: (skillName, content) => ({
+			fileName: path.join(skillName, "SKILL.md"),
+			content
+		})
+	}
+};
+/**
+* Resolve the path to the skills directory from @rebasepro/agent-skills.
+* Works in both workspace (symlink) and published (real files) layouts.
+*/
+function getSkillsSourceDir() {
+	const pkgJsonPath = require.resolve("@rebasepro/agent-skills/package.json");
+	const pkgRoot = path.dirname(pkgJsonPath);
+	const skillsDir = path.join(pkgRoot, "skills");
+	if (!fs.existsSync(skillsDir)) throw new Error(`Skills directory not found at ${skillsDir}. Make sure @rebasepro/agent-skills is installed.`);
+	return skillsDir;
+}
+/** Read all skill directories and return their names + content. */
+function loadSkills(skillsDir) {
+	const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+	const skills = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const skillMdPath = path.join(skillsDir, entry.name, "SKILL.md");
+		if (!fs.existsSync(skillMdPath)) continue;
+		skills.push({
+			name: entry.name,
+			content: fs.readFileSync(skillMdPath, "utf-8")
+		});
+	}
+	return skills;
+}
+/** Detect which agent environments already exist in the project. */
+function detectAgents(projectDir) {
+	const detected = [];
+	for (const [key, agent] of Object.entries(AGENTS)) if (fs.existsSync(path.join(projectDir, agent.detectDir))) detected.push(key);
+	return detected;
+}
+/** Install skills for a specific agent into the project directory. */
+function installForAgent(agentKey, skills, projectDir) {
+	const agent = AGENTS[agentKey];
+	const targetBase = path.join(projectDir, agent.targetDir);
+	fs.mkdirSync(targetBase, { recursive: true });
+	let count = 0;
+	for (const skill of skills) {
+		const { fileName, content } = agent.transformFile(skill.name, skill.content);
+		const targetPath = path.join(targetBase, fileName);
+		fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+		fs.writeFileSync(targetPath, content, "utf-8");
+		count++;
+	}
+	return count;
+}
+async function skillsCommand(subcommand, _args) {
+	switch (subcommand) {
+		case "install":
+			await skillsInstall();
+			break;
+		case "--help":
+		case void 0:
+			printSkillsHelp();
+			break;
+		default:
+			console.log(chalk.red(`Unknown skills subcommand: ${subcommand}`));
+			console.log("");
+			printSkillsHelp();
+	}
+}
+async function skillsInstall() {
+	const projectDir = process.cwd();
+	let skillsDir;
+	try {
+		skillsDir = getSkillsSourceDir();
+	} catch (err) {
+		console.error(`${chalk.red.bold("ERROR")} ${err instanceof Error ? err.message : String(err)}`);
+		process.exit(1);
+	}
+	const skills = loadSkills(skillsDir);
+	if (skills.length === 0) {
+		console.error(`${chalk.red.bold("ERROR")} No skills found in ${skillsDir}`);
+		process.exit(1);
+	}
+	let agents = detectAgents(projectDir);
+	if (agents.length === 0) {
+		const choices = Object.entries(AGENTS).map(([key, agent]) => ({
+			name: agent.label,
+			value: key,
+			checked: false
+		}));
+		const { selectedAgents } = await inquirer.prompt([{
+			type: "checkbox",
+			name: "selectedAgents",
+			message: "No AI agent configuration detected. Which agents do you use?",
+			choices,
+			validate: (input) => {
+				if (input.length === 0) return "Please select at least one agent.";
+				return true;
+			}
+		}]);
+		agents = selectedAgents;
+	}
+	console.log("");
+	console.log(chalk.gray(`  Found ${chalk.white(skills.length)} Rebase skills`));
+	console.log("");
+	for (const agentKey of agents) {
+		const agent = AGENTS[agentKey];
+		const count = installForAgent(agentKey, skills, projectDir);
+		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(agent.targetDir)}`);
+	}
+	console.log("");
+	console.log(chalk.gray("  Skills are project-local. Commit them to share with your team."));
+	console.log(chalk.gray("  Re-run this command anytime to update to the latest skills."));
+	console.log("");
+}
+function printSkillsHelp() {
+	console.log(`
+${chalk.bold("rebase skills")} — Manage AI agent skills
+
+${chalk.green.bold("Usage")}
+  rebase skills ${chalk.blue("<subcommand>")}
+
+${chalk.green.bold("Subcommands")}
+  ${chalk.blue.bold("install")}    Install Rebase agent skills for your AI coding assistant
+               Supports: Cursor, Claude Code, Windsurf, Gemini CLI, Antigravity
+
+${chalk.green.bold("Examples")}
+  ${chalk.cyan("rebase skills install")}
+`);
+}
+//#endregion
+//#region src/commands/api-keys.ts
+/**
+* CLI command: rebase api-keys <action>
+*
+* Subcommands:
+*   list    — List all API keys (masked)
+*   create  — Create a new API key
+*   revoke  — Revoke an existing API key
+*/
+function loadEnv(projectRoot) {
+	const envFile = findEnvFile(projectRoot);
+	const env = {};
+	if (envFile && fs.existsSync(envFile)) {
+		const content = fs.readFileSync(envFile, "utf-8");
+		for (const line of content.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed || trimmed.startsWith("#")) continue;
+			const idx = trimmed.indexOf("=");
+			if (idx > 0) {
+				const key = trimmed.slice(0, idx).trim();
+				let value = trimmed.slice(idx + 1).trim();
+				if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+				env[key] = value;
+			}
+		}
+	}
+	return env;
+}
+function resolveBaseUrl(env) {
+	const port = env.PORT || env.REBASE_PORT || "3001";
+	return env.REBASE_BASE_URL || `http://localhost:${port}`;
+}
+async function apiKeysCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printApiKeysHelp();
+		return;
+	}
+	switch (subcommand) {
+		case "list":
+			await listKeys(rawArgs);
+			break;
+		case "create":
+			await createKey(rawArgs);
+			break;
+		case "revoke":
+			await revokeKey(rawArgs);
+			break;
+		default:
+			console.error(chalk.red(`Unknown api-keys command: ${subcommand}`));
+			console.log("");
+			printApiKeysHelp();
+			process.exit(1);
+	}
+}
+async function listKeys(_rawArgs) {
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const res = await fetch(`${baseUrl}/api/admin/api-keys`, { headers: { Authorization: `Bearer ${serviceKey}` } });
+		if (!res.ok) {
+			const body = await res.text();
+			console.error(chalk.red(`✗ Failed to list API keys: ${res.status} ${body}`));
+			process.exit(1);
+		}
+		const { keys } = await res.json();
+		console.log("");
+		console.log(chalk.bold("  🔑 API Keys"));
+		console.log("");
+		if (keys.length === 0) {
+			console.log(chalk.gray("  No API keys found."));
+			console.log("");
+			return;
+		}
+		for (const key of keys) {
+			const status = key.revoked_at ? chalk.red("revoked") : key.expires_at && new Date(key.expires_at) < /* @__PURE__ */ new Date() ? chalk.yellow("expired") : chalk.green("active");
+			const perms = key.permissions.map((p) => `${p.collection}(${p.operations.join(",")})`).join(", ");
+			console.log(`  ${chalk.bold(key.name)} ${chalk.gray(`[${key.key_prefix}•••]`)} ${status}`);
+			console.log(`  ${chalk.gray("ID:")} ${key.id}`);
+			console.log(`  ${chalk.gray("Permissions:")} ${perms || "none"}`);
+			console.log(`  ${chalk.gray("Created:")} ${new Date(key.created_at).toLocaleDateString()}`);
+			if (key.last_used_at) console.log(`  ${chalk.gray("Last used:")} ${new Date(key.last_used_at).toLocaleDateString()}`);
+			console.log("");
+		}
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+async function createKey(rawArgs) {
+	const args = arg({
+		"--name": String,
+		"--permissions": String,
+		"--admin": Boolean,
+		"--rate-limit": Number,
+		"--expires": String,
+		"-n": "--name"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const name = args["--name"] || args._[0];
+	const permissionsRaw = args["--permissions"];
+	if (!name) {
+		console.error(chalk.red("✗ Name is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase api-keys create --name \"My Key\" --permissions '[{\"collection\":\"*\",\"operations\":[\"read\"]}]'"));
+		process.exit(1);
+	}
+	let permissions;
+	if (permissionsRaw) try {
+		permissions = JSON.parse(permissionsRaw);
+	} catch {
+		console.error(chalk.red("✗ Invalid --permissions JSON."));
+		console.log(chalk.gray("  Example: '[{\"collection\":\"*\",\"operations\":[\"read\",\"write\"]}]'"));
+		process.exit(1);
+		return;
+	}
+	else permissions = [{
+		collection: "*",
+		operations: [
+			"read",
+			"write",
+			"delete"
+		]
+	}];
+	let expires_at = null;
+	const expiresFlag = args["--expires"];
+	if (expiresFlag) {
+		const days = {
+			"7d": 7,
+			"30d": 30,
+			"90d": 90,
+			"1y": 365
+		};
+		if (days[expiresFlag]) expires_at = new Date(Date.now() + days[expiresFlag] * 864e5).toISOString();
+		else {
+			const parsed = new Date(expiresFlag);
+			if (isNaN(parsed.getTime())) {
+				console.error(chalk.red("✗ Invalid --expires value. Use 7d, 30d, 90d, 1y, or an ISO date."));
+				process.exit(1);
+			}
+			expires_at = parsed.toISOString();
+		}
+	}
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const body = {
+			name,
+			permissions,
+			admin: args["--admin"] ?? false,
+			rate_limit: args["--rate-limit"] ?? null,
+			expires_at
+		};
+		const res = await fetch(`${baseUrl}/api/admin/api-keys`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${serviceKey}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) {
+			const errBody = await res.text();
+			console.error(chalk.red(`✗ Failed to create API key: ${res.status} ${errBody}`));
+			process.exit(1);
+		}
+		const { key } = await res.json();
+		console.log("");
+		console.log(chalk.bold.green("  ✓ API key created successfully"));
+		console.log("");
+		console.log(`  ${chalk.gray("Name:")}   ${key.name}`);
+		console.log(`  ${chalk.gray("ID:")}     ${key.id}`);
+		console.log(`  ${chalk.gray("Prefix:")} ${key.key_prefix}`);
+		console.log("");
+		console.log(chalk.bold.yellow("  ⚠ Copy your key now — it won't be shown again:"));
+		console.log("");
+		console.log(`  ${chalk.cyan(key.key)}`);
+		console.log("");
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+async function revokeKey(rawArgs) {
+	const args = arg({ "--id": String }, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const id = args["--id"] || args._[0];
+	if (!id) {
+		console.error(chalk.red("✗ Key ID is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase api-keys revoke <key-id>"));
+		process.exit(1);
+	}
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const res = await fetch(`${baseUrl}/api/admin/api-keys/${encodeURIComponent(id)}`, {
+			method: "DELETE",
+			headers: { Authorization: `Bearer ${serviceKey}` }
+		});
+		if (!res.ok) {
+			const errBody = await res.text();
+			console.error(chalk.red(`✗ Failed to revoke API key: ${res.status} ${errBody}`));
+			process.exit(1);
+		}
+		console.log("");
+		console.log(chalk.bold.green("  ✓ API key revoked successfully"));
+		console.log(`  ${chalk.gray("ID:")} ${id}`);
+		console.log("");
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+function printApiKeysHelp() {
+	console.log(`
+${chalk.bold("rebase api-keys")} — Manage Service API Keys
+
+${chalk.green.bold("Usage")}
+  rebase api-keys ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}              List all API keys
+  ${chalk.blue.bold("create")}            Create a new API key
+  ${chalk.blue.bold("revoke")}            Revoke an API key
+
+${chalk.green.bold("create Options")}
+  ${chalk.blue("--name, -n")}        Key name ${chalk.gray("(required)")}
+  ${chalk.blue("--permissions")}     JSON array of permissions
+                    ${chalk.gray("Default: [{\"collection\":\"*\",\"operations\":[\"read\",\"write\",\"delete\"]}]")}
+  ${chalk.blue("--admin")}           Grant admin role (access to admin routes)
+  ${chalk.blue("--rate-limit")}      Requests per 15-min window ${chalk.gray("(default: 1000)")}
+  ${chalk.blue("--expires")}         Expiration: 7d, 30d, 90d, 1y, or ISO date
+
+${chalk.green.bold("revoke Options")}
+  ${chalk.blue("--id")}              API key ID to revoke ${chalk.gray("(or positional arg)")}
+
+${chalk.green.bold("Examples")}
+  rebase api-keys list
+  rebase api-keys create --name "Analytics" --permissions '[{"collection":"events","operations":["read"]}]'
+  rebase api-keys create -n "Full Access" --expires 90d
+  rebase api-keys revoke abc123-def456
+`);
+}
+//#endregion
+//#region src/commands/cloud/context.ts
+/**
+* Shared foundation for the `rebase cloud` command family.
+*
+* Everything cloud subcommands need in common lives here:
+*   - credential storage  (~/.rebase/credentials.json, keyed per control-plane host)
+*   - project link file    (.rebase/cloud.json in the project dir)
+*   - control-plane URL resolution
+*   - an authenticated `@rebasepro/client` instance (createCloudClient / requireClient)
+*   - small output helpers shared across subcommands
+*
+* The control plane is itself a Rebase app, so we reuse the same SDK the web
+* console uses (`@rebasepro/client`). Auth, token refresh, the data REST client
+* and function invocation all come from the SDK — the CLI only supplies a
+* file-backed AuthStorage so a login persists across invocations.
+*/
+/** Default hosted control plane (the Rebase Cloud console origin). */
+var DEFAULT_CLOUD_URL = "https://app.rebase.pro";
+/** The storage key the SDK's auth module reads/writes the session under. */
+var SDK_SESSION_KEY = "rebase_auth";
+/** ~/.rebase/credentials.json — one file, many hosts. */
+function credentialsPath() {
+	return path.join(os.homedir(), ".rebase", "credentials.json");
+}
+/** Project-local link file: <project>/.rebase/cloud.json */
+function projectLinkPath(cwd = process.cwd()) {
+	const root = findProjectRoot(cwd) || cwd;
+	return path.join(root, ".rebase", "cloud.json");
+}
+function readCredentials() {
+	try {
+		const raw = fs.readFileSync(credentialsPath(), "utf-8");
+		const parsed = JSON.parse(raw);
+		if (!parsed.contexts) parsed.contexts = {};
+		return parsed;
+	} catch {
+		return { contexts: {} };
+	}
+}
+function writeCredentials(data) {
+	const file = credentialsPath();
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, JSON.stringify(data, null, 2), { mode: 384 });
+	try {
+		fs.chmodSync(file, 384);
+	} catch {}
+}
+/** Host that a bare `rebase cloud` command should target, if any. */
+function currentContextUrl() {
+	return readCredentials().current;
+}
+/** Persist the active organization id for a host. */
+function setContextOrg(url, org) {
+	const creds = readCredentials();
+	const entry = creds.contexts[url] || {};
+	if (org) entry.org = org;
+	else delete entry.org;
+	creds.contexts[url] = entry;
+	writeCredentials(creds);
+}
+function getContextOrg(url) {
+	return readCredentials().contexts[url]?.org;
+}
+function createFileAuthStorage(url) {
+	return {
+		getItem(key) {
+			if (key !== SDK_SESSION_KEY) return null;
+			return readCredentials().contexts[url]?.auth ?? null;
+		},
+		setItem(key, value) {
+			if (key !== SDK_SESSION_KEY) return;
+			const creds = readCredentials();
+			const entry = creds.contexts[url] || {};
+			entry.auth = value;
+			creds.contexts[url] = entry;
+			if (!creds.current) creds.current = url;
+			writeCredentials(creds);
+		},
+		removeItem(key) {
+			if (key !== SDK_SESSION_KEY) return;
+			const creds = readCredentials();
+			if (creds.contexts[url]) {
+				delete creds.contexts[url].auth;
+				delete creds.contexts[url].org;
+			}
+			writeCredentials(creds);
+		}
+	};
+}
+/** Mark a host as the active context (called on login). */
+function setCurrentContext(url) {
+	const creds = readCredentials();
+	creds.current = url;
+	if (!creds.contexts[url]) creds.contexts[url] = {};
+	writeCredentials(creds);
+}
+function resolveCloudUrl(rawArgs) {
+	const explicit = arg({ "--url": String }, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	})["--url"] || process.env.REBASE_CLOUD_URL;
+	if (explicit) return normalizeUrl(explicit);
+	const link = readLink();
+	if (link?.url) return normalizeUrl(link.url);
+	const current = currentContextUrl();
+	if (current) return normalizeUrl(current);
+	return DEFAULT_CLOUD_URL;
+}
+function normalizeUrl(url) {
+	let u = url.trim().replace(/\/+$/, "");
+	if (!/^https?:\/\//.test(u)) u = `https://${u}`;
+	return u;
+}
+/**
+* Build an SDK client bound to a control-plane host, backed by the on-disk
+* credential store. `autoRefresh` is disabled so we never leave a dangling
+* setTimeout that keeps the CLI process alive; token refresh is done on demand
+* by `requireClient`.
+*/
+function createCloudClient(url) {
+	return createRebaseClient({
+		baseUrl: url,
+		websocketUrl: "",
+		auth: {
+			storage: createFileAuthStorage(url),
+			persistSession: true,
+			autoRefresh: false
+		}
+	});
+}
+/** Two minutes of head-room before a token is treated as expired. */
+var EXPIRY_BUFFER_MS = 12e4;
+/**
+* Return an authenticated client for the resolved host, refreshing the access
+* token if it is close to expiry. Exits with a helpful message when there is no
+* usable session (never logged in, or the refresh token was revoked).
+*/
+async function requireClient(rawArgs) {
+	const url = resolveCloudUrl(rawArgs);
+	const client = createCloudClient(url);
+	const session = client.auth.getSession();
+	if (!session || !session.accessToken) fail(`Not logged in to ${chalk.cyan(url)}.`, `Run ${chalk.bold("rebase cloud login")} first.`);
+	if (session.expiresAt <= Date.now() + EXPIRY_BUFFER_MS) try {
+		await client.auth.refreshSession();
+	} catch {
+		fail(`Your session for ${chalk.cyan(url)} has expired.`, `Run ${chalk.bold("rebase cloud login")} to sign in again.`);
+	}
+	return {
+		client,
+		url
+	};
+}
+function readLink(cwd = process.cwd()) {
+	try {
+		return JSON.parse(fs.readFileSync(projectLinkPath(cwd), "utf-8"));
+	} catch {
+		return null;
+	}
+}
+function writeLink(link, cwd = process.cwd()) {
+	const file = projectLinkPath(cwd);
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, JSON.stringify(link, null, 2));
+}
+function removeLink(cwd = process.cwd()) {
+	const file = projectLinkPath(cwd);
+	if (fs.existsSync(file)) {
+		fs.rmSync(file);
+		return true;
+	}
+	return false;
+}
+/**
+* Resolve the project id to operate on: explicit `--project` flag wins,
+* otherwise the linked project. Exits with guidance when neither is present.
+*/
+function requireProjectId(rawArgs) {
+	const parsed = arg({
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	if (parsed["--project"]) return parsed["--project"];
+	const link = readLink();
+	if (link?.projectId) return link.projectId;
+	fail("No project specified and this directory is not linked.", `Pass ${chalk.bold("--project <id>")} or run ${chalk.bold("rebase cloud link")}.`);
+}
+/** Print an error (+ optional hint) and exit non-zero. Never returns. */
+function fail(message, hint) {
+	console.error("");
+	console.error(chalk.red(`  ✗ ${message}`));
+	if (hint) console.error(chalk.gray(`  ${hint}`));
+	console.error("");
+	process.exit(1);
+}
+function success(message) {
+	console.log("");
+	console.log(chalk.bold.green(`  ✓ ${message}`));
+	console.log("");
+}
+/** Colorize a deployment / resource status token. */
+function colorStatus(status) {
+	switch (status) {
+		case "active":
+		case "success":
+		case "connected": return chalk.green(status);
+		case "deploying":
+		case "provisioning":
+		case "pending_billing":
+		case "untested": return chalk.yellow(status ?? "");
+		case "failed": return chalk.red(status);
+		case "stopped": return chalk.gray(status);
+		default: return chalk.gray(status ?? "unknown");
+	}
+}
+/** Render a two-column key/value block with aligned keys. */
+function keyValues(rows) {
+	const width = Math.max(...rows.map(([k]) => k.length));
+	for (const [k, v] of rows) {
+		if (v === void 0 || v === "") continue;
+		console.log(`  ${chalk.gray(`${k}:`.padEnd(width + 1))} ${v}`);
+	}
+}
+/**
+* Surface an SDK/HTTP error consistently. The SDK throws RebaseApiError with
+* a `.status` and `.message`; anything else falls back to its string form.
+*/
+function reportError(e, context) {
+	const err = e;
+	fail(`${context}${err?.status ? ` (${err.status})` : ""}: ${err?.message ?? String(e)}`);
+}
+/**
+* Open a URL in the user's default browser (best effort). Always prints the URL
+* first so it stays usable over SSH or when no browser is available.
+*/
+function openUrl(target, label = "Opening") {
+	console.log("");
+	console.log(`  ${label} ${chalk.cyan(target)}`);
+	console.log("");
+	const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+	try {
+		const child = spawn(opener, [target], {
+			stdio: "ignore",
+			detached: true,
+			shell: process.platform === "win32"
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+//#endregion
+//#region src/commands/cloud/auth.ts
+/**
+* `rebase cloud` auth subcommands: login, logout, whoami.
+*/
+async function loginCommand(rawArgs) {
+	const args = arg({
+		"--email": String,
+		"--password": String,
+		"-e": "--email",
+		"-p": "--password"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	const url = resolveCloudUrl(rawArgs);
+	console.log("");
+	console.log(`  Signing in to ${chalk.cyan(url)}`);
+	console.log("");
+	const prompts = [];
+	if (!args["--email"]) prompts.push({
+		type: "input",
+		name: "email",
+		message: "Email:"
+	});
+	if (!args["--password"]) prompts.push({
+		type: "password",
+		name: "password",
+		message: "Password:",
+		mask: "•"
+	});
+	const answers = prompts.length ? await inquirer.prompt(prompts) : {};
+	const email = (args["--email"] || answers.email || "").trim();
+	const password = args["--password"] || answers.password || "";
+	if (!email || !password) fail("Email and password are required.");
+	const client = createCloudClient(url);
+	try {
+		const { user } = await client.auth.signInWithEmail(email, password);
+		setCurrentContext(url);
+		try {
+			const orgs = await client.data.collection("organizations").find({ limit: 2 });
+			if (orgs.data.length === 1 && !getContextOrg(url)) setContextOrg(url, String(orgs.data[0].id));
+		} catch {}
+		success(`Logged in as ${chalk.bold(user.email ?? email)}`);
+		keyValues([
+			["Host", url],
+			["User", user.email ?? void 0],
+			["Active org", getContextOrg(url)]
+		]);
+		console.log("");
+	} catch (e) {
+		if (e?.status === 401) fail("Invalid email or password.");
+		reportError(e, "Login failed");
+	}
+}
+async function logoutCommand(rawArgs) {
+	const url = resolveCloudUrl(rawArgs);
+	const client = createCloudClient(url);
+	if (!client.auth.getSession()) {
+		console.log("");
+		console.log(chalk.gray(`  Not logged in to ${url}.`));
+		console.log("");
+		return;
+	}
+	try {
+		await client.auth.signOut();
+	} catch {}
+	success(`Logged out of ${url}`);
+}
+async function whoamiCommand(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	try {
+		const user = await client.auth.getUser();
+		if (!user) fail("Session is no longer valid.", "Run `rebase cloud login` again.");
+		const link = readLink();
+		console.log("");
+		console.log(chalk.bold("  🔐 Rebase Cloud session"));
+		console.log("");
+		keyValues([
+			["Host", url],
+			["User", user.email ?? void 0],
+			["User ID", user.uid],
+			["Roles", user.roles?.length ? user.roles.join(", ") : void 0],
+			["Active org", getContextOrg(url)],
+			["Linked project", link ? `${link.projectName ?? ""} (${link.projectId})`.trim() : void 0]
+		]);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to fetch session");
+	}
+}
+//#endregion
+//#region src/commands/cloud/link.ts
+/**
+* `rebase cloud` context subcommands: link, unlink, use, open.
+*
+* `link` associates the current directory with a cloud project by writing
+* `.rebase/cloud.json`; deploy/logs/status then operate on it with no flags.
+*/
+async function linkCommand(rawArgs) {
+	const args = arg({
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	const { client, url } = await requireClient(rawArgs);
+	try {
+		let project;
+		if (args["--project"]) {
+			project = await client.data.collection("projects").findById(args["--project"]);
+			if (!project) fail(`Project ${args["--project"]} not found.`);
+		} else {
+			const org = getContextOrg(url);
+			const projects = (await client.data.collection("projects").find({
+				where: org ? { organization: ["==", org] } : void 0,
+				limit: 100
+			})).data;
+			if (projects.length === 0) fail("No projects found for your account.", `Create one with ${chalk.bold("rebase cloud projects create")}.`);
+			const { picked } = await inquirer.prompt([{
+				type: "list",
+				name: "picked",
+				message: "Select a project to link:",
+				choices: projects.map((p) => ({
+					name: `${p.name ?? "(unnamed)"}  ${chalk.gray(`${p.subdomain ?? ""} · ${p.id}`)}`,
+					value: p
+				}))
+			}]);
+			project = picked;
+		}
+		if (!project) fail("No project selected.");
+		writeLink({
+			url,
+			projectId: String(project.id),
+			projectName: project.name,
+			orgId: project.organization !== void 0 ? String(project.organization) : void 0
+		});
+		success(`Linked to ${chalk.bold(project.name ?? project.id)}`);
+		console.log(chalk.gray(`  Wrote ${projectLinkPath()}`));
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to link project");
+	}
+}
+function unlinkCommand() {
+	if (!readLink()) {
+		console.log("");
+		console.log(chalk.gray("  This directory is not linked to a cloud project."));
+		console.log("");
+		return;
+	}
+	removeLink();
+	success("Unlinked from cloud project");
+}
+async function selectOrgCommand(rawArgs) {
+	const target = rawArgs.slice(3).filter((a) => !a.startsWith("-"))[1];
+	const { client, url } = await requireClient(rawArgs);
+	try {
+		const orgs = (await client.data.collection("organizations").find({ limit: 100 })).data;
+		if (orgs.length === 0) fail("You are not a member of any organization.");
+		let chosen = target ? orgs.find((o) => String(o.id) === target || o.slug === target) : void 0;
+		if (!chosen && !target) {
+			const { picked } = await inquirer.prompt([{
+				type: "list",
+				name: "picked",
+				message: "Select the active organization:",
+				choices: orgs.map((o) => ({
+					name: `${o.name ?? "(unnamed)"}  ${chalk.gray(`${o.slug ?? ""} · ${o.id}`)}`,
+					value: o
+				}))
+			}]);
+			chosen = picked;
+		}
+		if (!chosen) fail(`Organization "${target}" not found.`);
+		setContextOrg(url, String(chosen.id));
+		success(`Active organization set to ${chalk.bold(chosen.name ?? chosen.id)}`);
+	} catch (e) {
+		reportError(e, "Failed to set organization");
+	}
+}
+/** Open the Rebase Cloud dashboard (or the linked project) in a browser. */
+function openCommand(rawArgs) {
+	const url = resolveCloudUrl(rawArgs);
+	const link = readLink();
+	openUrl(link ? `${url}/projects/${link.projectId}` : url);
+}
+//#endregion
+//#region src/commands/cloud/projects.ts
+/**
+* `rebase cloud projects` — list / create / info / delete.
+*/
+async function listProjects(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	const org = getContextOrg(url);
+	try {
+		const projects = (await client.data.collection("projects").find({
+			where: org ? { organization: ["==", org] } : void 0,
+			orderBy: ["name", "asc"],
+			limit: 100
+		})).data;
+		console.log("");
+		console.log(chalk.bold("  📦 Projects") + (org ? chalk.gray(`  (org ${org})`) : ""));
+		console.log("");
+		if (projects.length === 0) {
+			console.log(chalk.gray("  No projects yet. Create one with `rebase cloud projects create`."));
+			console.log("");
+			return;
+		}
+		const linkedId = readLink()?.projectId;
+		for (const p of projects) {
+			const marker = String(p.id) === linkedId ? chalk.green(" ●") : "  ";
+			console.log(`${marker}${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.id}]`)} ${colorStatus(p.status)}`);
+			console.log(`    ${chalk.gray(`${p.subdomain ?? "—"}.rebase.pro`)}${p.provider ? chalk.gray(`  ·  ${p.provider}`) : ""}`);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list projects");
+	}
+}
+/** Default region + VM size per provider (both are required on create). */
+function providerDefaults(provider) {
+	switch (provider) {
+		case "gcp": return {
+			region: "europe-west1",
+			vmSize: "e2-small"
+		};
+		case "aws": return {
+			region: "us-east-1",
+			vmSize: "t3.small"
+		};
+		default: return {
+			region: "nbg1",
+			vmSize: "cx21"
+		};
+	}
+}
+async function createProject(rawArgs) {
+	const args = arg({
+		"--name": String,
+		"--subdomain": String,
+		"--repo": String,
+		"--branch": String,
+		"--provider": String,
+		"--region": String,
+		"--vm-size": String,
+		"--org": String,
+		"--link": Boolean,
+		"-n": "--name"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const { client, url } = await requireClient(rawArgs);
+	const org = args["--org"] || getContextOrg(url);
+	if (!org) fail("No organization selected.", `Pass ${chalk.bold("--org <id>")} or run ${chalk.bold("rebase cloud use")}.`);
+	const prompts = [];
+	if (!args["--name"]) prompts.push({
+		type: "input",
+		name: "name",
+		message: "Project name:"
+	});
+	if (!args["--subdomain"]) prompts.push({
+		type: "input",
+		name: "subdomain",
+		message: "Subdomain:"
+	});
+	const a = prompts.length && process.stdin.isTTY ? await inquirer.prompt(prompts) : {};
+	const name = (args["--name"] || a.name || "").trim();
+	const subdomain = (args["--subdomain"] || a.subdomain || "").trim().toLowerCase();
+	const gitRepoUrl = (args["--repo"] || a.repo || "").trim();
+	const gitBranch = (args["--branch"] || a.branch || "main").trim();
+	const provider = (args["--provider"] || a.provider || "hetzner").trim();
+	const defaults = providerDefaults(provider);
+	const region = (args["--region"] || defaults.region).trim();
+	const vmSize = (args["--vm-size"] || defaults.vmSize).trim();
+	if (!name || !subdomain) fail("Name and subdomain are required.");
+	try {
+		const check = await client.functions.invoke("check-subdomain", { subdomain });
+		if (!check.available) fail(`Subdomain "${subdomain}" is not available${check.reason ? ` (${check.reason})` : ""}.`);
+	} catch {}
+	try {
+		const user = await client.auth.getUser();
+		if (!user) fail("Session is no longer valid.", "Run `rebase cloud login` again.");
+		const created = await client.data.collection("projects").create({
+			name,
+			subdomain,
+			gitRepoUrl,
+			gitBranch,
+			provider,
+			region,
+			vmSize,
+			organization: org,
+			createdById: user.uid,
+			status: "provisioning"
+		});
+		success(`Created project ${chalk.bold(name)}`);
+		keyValues([
+			["ID", String(created.id)],
+			["URL", `${subdomain}.rebase.pro`],
+			["Provider", provider],
+			["Branch", gitBranch]
+		]);
+		if (args["--link"]) {
+			writeLink({
+				url,
+				projectId: String(created.id),
+				projectName: name,
+				orgId: String(org)
+			});
+			console.log(chalk.gray("  Linked this directory to the new project."));
+		}
+		console.log("");
+		console.log(chalk.gray(`  Deploy it with:  ${chalk.bold(`rebase cloud deploy --project ${created.id}`)}`));
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to create project");
+	}
+}
+async function projectInfo(rawArgs, projectId) {
+	const { client } = await requireClient(rawArgs);
+	try {
+		const p = await client.data.collection("projects").findById(projectId);
+		if (!p) fail(`Project ${projectId} not found.`);
+		const [db, lastDeploy] = await Promise.all([firstRow(client, "databases", projectId), latestDeployment(client, projectId)]);
+		console.log("");
+		console.log(`  ${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.id}]`)} ${colorStatus(p.status)}`);
+		console.log("");
+		keyValues([
+			["Subdomain", p.subdomain ? `${p.subdomain}.rebase.pro` : void 0],
+			["Custom domain", p.customDomain],
+			["Repository", p.gitRepoUrl],
+			["Branch", p.gitBranch],
+			["Provider", p.provider],
+			["Region", p.region],
+			["Organization", p.organization !== void 0 ? String(p.organization) : void 0],
+			["Database", db ? `${db.type} (${colorStatus(db.connectionStatus)})` : "none"],
+			["Last deploy", lastDeploy ? `${colorStatus(lastDeploy.status)} · ${fmtDate(lastDeploy.createdAt)}` : "never"]
+		]);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to load project");
+	}
+}
+async function deleteProject(rawArgs, projectId) {
+	const args = arg({
+		"--yes": Boolean,
+		"-y": "--yes"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client } = await requireClient(rawArgs);
+	const p = await client.data.collection("projects").findById(projectId).catch(() => void 0);
+	if (!p) fail(`Project ${projectId} not found.`);
+	if (!args["--yes"]) {
+		const { confirmed } = await inquirer.prompt([{
+			type: "confirm",
+			name: "confirmed",
+			default: false,
+			message: `Permanently delete project "${p.name ?? projectId}" (${projectId})? This tears down its deployment.`
+		}]);
+		if (!confirmed) {
+			console.log(chalk.gray("  Aborted."));
+			return;
+		}
+	}
+	try {
+		await client.data.collection("projects").delete(projectId);
+		success(`Deleted project ${chalk.bold(p.name ?? projectId)}`);
+	} catch (e) {
+		reportError(e, "Failed to delete project");
+	}
+}
+async function firstRow(client, collection, projectId) {
+	return (await client.data.collection(collection).find({
+		where: { project: ["==", projectId] },
+		limit: 1
+	})).data[0];
+}
+async function latestDeployment(client, projectId) {
+	return (await client.data.collection("deployments").find({
+		where: { project: ["==", projectId] },
+		orderBy: ["createdAt", "desc"],
+		limit: 1
+	})).data[0];
+}
+function fmtDate(value) {
+	if (!value) return "—";
+	const d = new Date(value);
+	return isNaN(d.getTime()) ? value : d.toLocaleString();
+}
+//#endregion
+//#region src/commands/cloud/deploy.ts
+/**
+* `rebase cloud deploy` and `rebase cloud logs`.
+*
+* `deploy` triggers the control-plane `deploy` function, then tails the build
+* logs from the deployment record until it succeeds or fails. `logs` shows the
+* latest build log, or runtime logs with `--runtime`.
+*/
+var POLL_INTERVAL_MS = 1500;
+var POLL_TIMEOUT_MS = 900 * 1e3;
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+function run(cmd, cmdArgs, cwd) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(cmd, cmdArgs, {
+			cwd,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			]
+		});
+		let stderr = "";
+		child.stderr.on("data", (d) => stderr += d.toString());
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(new Error(stderr || `${cmd} exited ${code}`)));
+	});
+}
+/**
+* Package `sourceDir` into a gzipped tarball, honoring `.gitignore`/`.rebaseignore`
+* and always excluding `.git` and `node_modules`. Returns the temp archive path.
+*/
+async function createSourceTarball(sourceDir) {
+	const dir = path.resolve(sourceDir);
+	if (!fs.existsSync(dir)) fail(`Source directory not found: ${dir}`);
+	const tarPath = path.join(os.tmpdir(), `rebase-src-${Date.now()}.tar.gz`);
+	const tarArgs = [
+		"-czf",
+		tarPath,
+		"--exclude=.git",
+		"--exclude=node_modules"
+	];
+	for (const ignore of [".gitignore", ".rebaseignore"]) if (fs.existsSync(path.join(dir, ignore))) tarArgs.push(`--exclude-from=${ignore}`);
+	tarArgs.push(".");
+	try {
+		await run("tar", tarArgs, dir);
+	} catch (e) {
+		fail(`Failed to package source: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	return tarPath;
+}
+/** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
+async function uploadSource(url, token, projectId, tarPath) {
+	const bytes = fs.readFileSync(tarPath);
+	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
+	console.log(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
+	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/gzip"
+		},
+		body: bytes
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		fail(`Source upload failed (${res.status}): ${body || res.statusText}`);
+	}
+	const data = await res.json();
+	if (!data.source) fail("Upload endpoint did not return a source reference.");
+	return data.source;
+}
+async function deployCommand(rawArgs, projectId) {
+	const args = arg({
+		"--no-follow": Boolean,
+		"--source": String
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client, url } = await requireClient(rawArgs);
+	let source;
+	if (args["--source"]) {
+		const tarPath = await createSourceTarball(args["--source"]);
+		try {
+			const token = client.auth.getSession()?.accessToken;
+			if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
+			source = await uploadSource(url, token, projectId, tarPath);
+		} finally {
+			fs.rmSync(tarPath, { force: true });
+		}
+	}
+	console.log("");
+	console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectId)}${source ? " from uploaded source" : ""}...`);
+	let deploymentId;
+	try {
+		const res = await client.functions.invoke("deploy", source ? {
+			projectId,
+			source
+		} : { projectId });
+		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
+		deploymentId = String(res.deployment.id);
+	} catch (e) {
+		const err = e;
+		if (err?.status === 409) fail("A deployment is already in progress for this project.");
+		if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.");
+		reportError(e, "Failed to trigger deployment");
+	}
+	console.log(chalk.gray(`  Deployment ${deploymentId} created.`));
+	if (args["--no-follow"]) {
+		console.log(chalk.gray("  Not following logs (--no-follow). Check status with `rebase cloud logs`."));
+		console.log("");
+		return;
+	}
+	console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
+	console.log("");
+	await streamBuildLogs(client, deploymentId);
+}
+/** Poll a deployment record and print new log output as it arrives. */
+async function streamBuildLogs(client, deploymentId) {
+	let printed = 0;
+	const started = Date.now();
+	for (;;) {
+		let dep;
+		try {
+			dep = await client.data.collection("deployments").findById(deploymentId);
+		} catch (e) {
+			reportError(e, "Failed to read deployment status");
+		}
+		if (!dep) fail(`Deployment ${deploymentId} disappeared.`);
+		const logs = dep.logs ?? "";
+		if (logs.length > printed) {
+			process.stdout.write(logs.slice(printed));
+			printed = logs.length;
+		}
+		if (dep.status && dep.status !== "deploying") {
+			console.log("");
+			if (dep.status === "success") console.log(chalk.bold.green("  ✓ Deployment succeeded"));
+			else {
+				console.log(chalk.bold.red(`  ✗ Deployment ${dep.status}`));
+				console.log("");
+				process.exit(1);
+			}
+			console.log("");
+			return;
+		}
+		if (Date.now() - started > POLL_TIMEOUT_MS) {
+			console.log("");
+			fail("Timed out waiting for the build to finish.", "The deployment may still be running — check `rebase cloud logs`.");
+		}
+		await sleep(POLL_INTERVAL_MS);
+	}
+}
+async function logsCommand(rawArgs, projectId) {
+	const args = arg({
+		"--runtime": Boolean,
+		"--follow": Boolean,
+		"-f": "--follow"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client } = await requireClient(rawArgs);
+	if (args["--runtime"]) {
+		try {
+			const res = await client.functions.invoke("runtime-logs", void 0, {
+				method: "GET",
+				path: projectId
+			});
+			console.log("");
+			console.log(chalk.bold(`  📄 Runtime logs — project ${projectId}`));
+			console.log("");
+			console.log(res.logs ?? chalk.gray("  (no logs)"));
+			console.log("");
+		} catch (e) {
+			reportError(e, "Failed to fetch runtime logs");
+		}
+		return;
+	}
+	try {
+		const dep = await latestDeployment(client, projectId);
+		if (!dep) {
+			console.log("");
+			console.log(chalk.gray("  No deployments yet for this project."));
+			console.log("");
+			return;
+		}
+		console.log("");
+		console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
+		console.log("");
+		if (args["--follow"] && dep.status === "deploying") await streamBuildLogs(client, String(dep.id));
+		else {
+			console.log(dep.logs ?? chalk.gray("  (no logs)"));
+			console.log("");
+		}
+	} catch (e) {
+		reportError(e, "Failed to fetch build logs");
+	}
+}
+//#endregion
+//#region src/commands/cloud/orgs.ts
+/**
+* `rebase cloud orgs` — list / create / members.
+*/
+async function orgsCommand(subcommand, rawArgs) {
+	switch (subcommand) {
+		case "list":
+		case void 0:
+			await listOrgs(rawArgs);
+			break;
+		case "create":
+			await createOrg(rawArgs);
+			break;
+		case "members":
+			await listMembers(rawArgs);
+			break;
+		case "--help":
+			printOrgsHelp();
+			break;
+		default: fail(`Unknown orgs command: ${subcommand}`);
+	}
+}
+async function listOrgs(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	try {
+		const orgs = (await client.data.collection("organizations").find({ limit: 100 })).data;
+		const active = getContextOrg(url);
+		console.log("");
+		console.log(chalk.bold("  🏢 Organizations"));
+		console.log("");
+		if (orgs.length === 0) {
+			console.log(chalk.gray("  You are not a member of any organization."));
+			console.log("");
+			return;
+		}
+		for (const o of orgs) {
+			const marker = String(o.id) === active ? chalk.green(" ●") : "  ";
+			console.log(`${marker}${chalk.bold(o.name ?? "(unnamed)")} ${chalk.gray(`[${o.id}]`)}${o.slug ? chalk.gray(`  ${o.slug}`) : ""}`);
+		}
+		console.log("");
+		console.log(chalk.gray("  ● = active organization. Switch with `rebase cloud use <id>`."));
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list organizations");
+	}
+}
+async function createOrg(rawArgs) {
+	const args = arg({
+		"--name": String,
+		"--slug": String,
+		"-n": "--name"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const { client, url } = await requireClient(rawArgs);
+	const prompts = [];
+	if (!args["--name"]) prompts.push({
+		type: "input",
+		name: "name",
+		message: "Organization name:"
+	});
+	const answers = prompts.length ? await inquirer.prompt(prompts) : {};
+	const name = (args["--name"] || answers.name || "").trim();
+	if (!name) fail("Organization name is required.");
+	const slug = (args["--slug"] || slugify(name)).trim();
+	try {
+		const created = await client.data.collection("organizations").create({
+			name,
+			slug,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		setContextOrg(url, String(created.id));
+		success(`Created organization ${chalk.bold(name)} and set it active`);
+	} catch (e) {
+		reportError(e, "Failed to create organization");
+	}
+}
+async function listMembers(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	const org = getContextOrg(url);
+	if (!org) fail("No active organization.", "Run `rebase cloud use` first.");
+	try {
+		const members = (await client.data.collection("organization-members").find({
+			where: { organization: ["==", org] },
+			limit: 200
+		})).data;
+		console.log("");
+		console.log(chalk.bold(`  👥 Members — org ${org}`));
+		console.log("");
+		if (members.length === 0) {
+			console.log(chalk.gray("  No members found."));
+			console.log("");
+			return;
+		}
+		for (const m of members) console.log(`  ${chalk.bold(m.userId ?? "?")}  ${colorStatus(m.role)}`);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list members");
+	}
+}
+function slugify(s) {
+	return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function printOrgsHelp() {
+	console.log(`
+${chalk.bold("rebase cloud orgs")} — Manage organizations
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}              List organizations you belong to
+  ${chalk.blue.bold("create")}            Create a new organization ${chalk.gray("(--name, --slug)")}
+  ${chalk.blue.bold("members")}           List members of the active organization
+`);
+}
+//#endregion
+//#region src/commands/cloud/databases.ts
+/**
+* `rebase cloud db` — database + backup management for a project.
+*
+*   db list                List databases attached to the project
+*   db create              Attach a managed or bring-your-own database
+*   db test                Test connectivity to the project's database
+*   db backup list|create|restore
+*/
+async function dbCommand$1(subcommand, rawArgs) {
+	switch (subcommand) {
+		case "list":
+		case void 0:
+			await listDatabases(rawArgs);
+			break;
+		case "create":
+			await createDatabase(rawArgs);
+			break;
+		case "test":
+			await testDatabase(rawArgs);
+			break;
+		case "backup":
+			await backupCommand(rawArgs);
+			break;
+		case "--help":
+			printDbHelp();
+			break;
+		default: fail(`Unknown db command: ${subcommand}`);
+	}
+}
+async function listDatabases(rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		const dbs = (await client.data.collection("databases").find({
+			where: { project: ["==", projectId] },
+			limit: 50
+		})).data;
+		console.log("");
+		console.log(chalk.bold(`  🗄  Databases — project ${projectId}`));
+		console.log("");
+		if (dbs.length === 0) {
+			console.log(chalk.gray("  No database attached. Add one with `rebase cloud db create`."));
+			console.log("");
+			return;
+		}
+		for (const d of dbs) {
+			console.log(`  ${chalk.bold(d.type ?? "unknown")} ${chalk.gray(`[${d.id}]`)}  ${colorStatus(d.connectionStatus)}`);
+			keyValues([["SSH tunnel", d.useSshTunnel ? "yes" : void 0], ["PITR", d.pitrEnabled ? "enabled" : void 0]]);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list databases");
+	}
+}
+async function createDatabase(rawArgs) {
+	const args = arg({
+		"--type": String,
+		"--connection-string": String,
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	let type = args["--type"];
+	if (!type) {
+		const { picked } = await inquirer.prompt([{
+			type: "list",
+			name: "picked",
+			message: "Database type:",
+			choices: [{
+				name: "SaaS Managed (provisioned for you)",
+				value: "managed"
+			}, {
+				name: "Bring Your Own DB (external PostgreSQL)",
+				value: "byodb"
+			}]
+		}]);
+		type = picked;
+	}
+	let connectionString = args["--connection-string"];
+	if (type === "byodb" && !connectionString) {
+		const { cs } = await inquirer.prompt([{
+			type: "input",
+			name: "cs",
+			message: "PostgreSQL connection string:"
+		}]);
+		connectionString = cs?.trim();
+		if (!connectionString) fail("A connection string is required for bring-your-own databases.");
+	}
+	try {
+		const created = await client.data.collection("databases").create({
+			project: projectId,
+			type,
+			connectionString: type === "byodb" ? connectionString : void 0,
+			connectionStatus: "untested"
+		});
+		success(`Attached ${type} database to project ${projectId}`);
+		keyValues([["ID", String(created.id)]]);
+		if (type === "byodb") {
+			console.log(chalk.gray("  Verify it with `rebase cloud db test`."));
+			console.log("");
+		}
+	} catch (e) {
+		reportError(e, "Failed to attach database");
+	}
+}
+async function testDatabase(rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	console.log("");
+	console.log(`  Testing database connectivity for project ${chalk.bold(projectId)}...`);
+	try {
+		const res = await client.functions.invoke("db-test", { projectId });
+		console.log("");
+		if (res.logs) console.log(res.logs);
+		if (res.success) success("Database connection succeeded");
+		else fail("Database connection failed. See logs above.");
+	} catch (e) {
+		reportError(e, "Failed to test database");
+	}
+}
+async function backupCommand(rawArgs) {
+	const action = rawArgs.slice(3).filter((a) => !a.startsWith("-"))[2] || "list";
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		if (action === "create") {
+			console.log("");
+			console.log(`  Creating backup for project ${chalk.bold(projectId)}...`);
+			const res = await client.functions.invoke("backup", {
+				projectId,
+				type: "manual"
+			}, { path: "create" });
+			if (res.success) success(`Backup created: ${res.backup?.filename ?? "(unknown)"}`);
+			else fail(res.error || "Backup failed.");
+			return;
+		}
+		if (action === "restore") {
+			const filename = rawArgs.slice(3).filter((a) => !a.startsWith("-"))[3];
+			if (!filename) fail("Usage: rebase cloud db backup restore <filename>");
+			const { confirmed } = await inquirer.prompt([{
+				type: "confirm",
+				name: "confirmed",
+				default: false,
+				message: `Restore "${filename}" over the current database for project ${projectId}?`
+			}]);
+			if (!confirmed) {
+				console.log(chalk.gray("  Aborted."));
+				return;
+			}
+			const res = await client.functions.invoke("backup", {
+				projectId,
+				filename
+			}, { path: "restore" });
+			if (res.success) success(res.message || "Restore complete");
+			else fail(res.error || "Restore failed.");
+			return;
+		}
+		const res = await client.functions.invoke("backup", void 0, {
+			method: "GET",
+			path: `list/${projectId}`
+		});
+		console.log("");
+		console.log(chalk.bold(`  💾 Backups — project ${projectId}`));
+		console.log("");
+		if (!res.backups?.length) {
+			console.log(chalk.gray("  No backups yet. Create one with `rebase cloud db backup create`."));
+			console.log("");
+			return;
+		}
+		for (const b of res.backups) {
+			const size = b.size !== void 0 ? `${(b.size / 1024 / 1024).toFixed(1)} MB` : "";
+			console.log(`  ${chalk.bold(b.filename)}  ${chalk.gray(`${b.type ?? ""} ${size}`.trim())}`);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Backup operation failed");
+	}
+}
+function printDbHelp() {
+	console.log(`
+${chalk.bold("rebase cloud db")} — Database & backups
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}                      List databases attached to the project
+  ${chalk.blue.bold("create")}                    Attach a managed or bring-your-own database
+  ${chalk.blue.bold("test")}                      Test database connectivity
+  ${chalk.blue.bold("backup list")}               List backups
+  ${chalk.blue.bold("backup create")}             Create a manual backup
+  ${chalk.blue.bold("backup restore")} ${chalk.gray("<file>")}     Restore a backup
+
+${chalk.green.bold("Options")}
+  ${chalk.blue("--project, -p")}             Target project id ${chalk.gray("(defaults to the linked project)")}
+  ${chalk.blue("--type")}                    managed | byodb ${chalk.gray("(create)")}
+  ${chalk.blue("--connection-string")}       External DB URL ${chalk.gray("(byodb)")}
+`);
+}
+//#endregion
+//#region src/commands/cloud/resources.ts
+/**
+* `rebase cloud` resource subcommands: status, metrics, webhooks, storage,
+* clusters, billing.
+*/
+async function statusCommand(rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		const project = await client.data.collection("projects").findById(projectId);
+		if (!project) fail(`Project ${projectId} not found.`);
+		const [db, storage, deploy] = await Promise.all([
+			firstRow(client, "databases", projectId),
+			firstRow(client, "storages", projectId),
+			latestDeployment(client, projectId)
+		]);
+		console.log("");
+		console.log(`  ${chalk.bold(project.name ?? projectId)} ${chalk.gray(`[${projectId}]`)} ${colorStatus(project.status)}`);
+		console.log("");
+		keyValues([
+			["URL", project.subdomain ? `${project.subdomain}.rebase.pro` : void 0],
+			["Branch", project.gitBranch],
+			["Last deploy", deploy ? `${colorStatus(deploy.status)} · ${fmtDate(deploy.createdAt)}` : "never"],
+			["Database", db ? `${db.type} (${colorStatus(db.connectionStatus)})` : "none"],
+			["Storage", storage ? `${storage.type} (${colorStatus(storage.status)})` : "none"]
+		]);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to load status");
+	}
+}
+async function metricsCommand(rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		const m = await client.functions.invoke("metrics", void 0, {
+			method: "GET",
+			path: projectId
+		});
+		console.log("");
+		console.log(chalk.bold(`  📊 Metrics — project ${projectId}`));
+		console.log("");
+		keyValues([
+			["Status", m.status ? colorStatus(m.status === "running" ? "active" : m.status) : void 0],
+			["CPU", m.cpu],
+			["Memory", m.memory ? `${m.memory}${m.memoryPercent ? ` (${m.memoryPercent})` : ""}` : void 0],
+			["Disk", m.disk]
+		]);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to fetch metrics");
+	}
+}
+async function webhooksCommand(subcommand, rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		if (subcommand === "create") {
+			const args = arg({
+				"--name": String,
+				"--table": String,
+				"--url": String,
+				"--events": String
+			}, {
+				argv: rawArgs.slice(4),
+				permissive: true
+			});
+			const name = args["--name"] || fail("--name is required.");
+			const table = args["--table"] || fail("--table is required.");
+			const url = args["--url"] || fail("--url (endpoint) is required.");
+			const events = (args["--events"] || "insert,update,delete").split(",").map((s) => s.trim());
+			const created = await client.data.collection("webhooks").create({
+				project: projectId,
+				name,
+				table,
+				url,
+				events,
+				enabled: true
+			});
+			success(`Created webhook ${chalk.bold(name)} [${created.id}]`);
+			return;
+		}
+		if (subcommand === "delete") {
+			const id = rawArgs.slice(3).filter((a) => !a.startsWith("-"))[2];
+			if (!id) fail("Usage: rebase cloud webhooks delete <id>");
+			await client.data.collection("webhooks").delete(id);
+			success(`Deleted webhook ${id}`);
+			return;
+		}
+		const hooks = (await client.data.collection("webhooks").find({
+			where: { project: ["==", projectId] },
+			limit: 100
+		})).data;
+		console.log("");
+		console.log(chalk.bold(`  🔗 Webhooks — project ${projectId}`));
+		console.log("");
+		if (hooks.length === 0) {
+			console.log(chalk.gray("  No webhooks. Add one with `rebase cloud webhooks create`."));
+			console.log("");
+			return;
+		}
+		for (const h of hooks) {
+			const state = h.enabled ? chalk.green("enabled") : chalk.gray("disabled");
+			console.log(`  ${chalk.bold(h.name ?? "(unnamed)")} ${chalk.gray(`[${h.id}]`)} ${state}`);
+			console.log(`    ${chalk.gray(`${h.table ?? "?"} → ${h.url ?? "?"}  (${(h.events ?? []).join(", ")})`)}`);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Webhook operation failed");
+	}
+}
+async function storageCommand(rawArgs) {
+	const projectId = requireProjectId(rawArgs);
+	const { client } = await requireClient(rawArgs);
+	try {
+		const stores = (await client.data.collection("storages").find({
+			where: { project: ["==", projectId] },
+			limit: 50
+		})).data;
+		console.log("");
+		console.log(chalk.bold(`  🪣 Storage — project ${projectId}`));
+		console.log("");
+		if (stores.length === 0) {
+			console.log(chalk.gray("  No storage buckets attached."));
+			console.log("");
+			return;
+		}
+		for (const s of stores) {
+			console.log(`  ${chalk.bold(s.bucketName ?? s.type ?? "bucket")} ${chalk.gray(`[${s.id}]`)} ${colorStatus(s.status)}`);
+			keyValues([["Provider", s.provider], ["Type", s.type]]);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list storage");
+	}
+}
+async function clustersCommand(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	try {
+		const clusters = (await client.data.collection("clusters").find({ limit: 100 })).data;
+		console.log("");
+		console.log(chalk.bold("  ☸  Clusters"));
+		console.log("");
+		if (clusters.length === 0) {
+			console.log(chalk.gray("  No clusters registered."));
+			console.log("");
+			return;
+		}
+		for (const c of clusters) {
+			console.log(`  ${chalk.bold(c.name ?? "(unnamed)")} ${chalk.gray(`[${c.id}]`)} ${colorStatus(c.status)}`);
+			keyValues([["Provider", c.provider], ["Region", c.region]]);
+		}
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to list clusters");
+	}
+}
+async function billingCommand(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	const org = getContextOrg(url);
+	const action = rawArgs.slice(3).filter((a) => !a.startsWith("-"))[1];
+	if (action === "setup") {
+		if (!org) fail("No active organization.", "Run `rebase cloud use` first.");
+		try {
+			const res = await client.functions.invoke("stripe-billing", { organizationId: org }, { path: "setup-session" });
+			if (!res.url) fail("Could not start billing setup.");
+			openUrl(res.url, "Add a payment method in your browser:");
+			if (res.simulated) {
+				console.log(chalk.gray("  (dev mode — Stripe not configured; complete setup from the console)"));
+				console.log("");
+			} else {
+				console.log(chalk.gray("  Once you've added a card, `rebase cloud deploy` runs without further prompts."));
+				console.log("");
+			}
+		} catch (e) {
+			reportError(e, "Failed to start billing setup");
+		}
+		return;
+	}
+	if (action === "checkout") {
+		const projectId = requireProjectId(rawArgs);
+		try {
+			const res = await client.functions.invoke("stripe-billing", { projectId }, { path: "session" });
+			if (!res.url) fail("Billing session could not be created.");
+			console.log("");
+			console.log("  Complete checkout in your browser:");
+			console.log(`  ${chalk.cyan(res.url)}`);
+			console.log("");
+		} catch (e) {
+			reportError(e, "Failed to start checkout");
+		}
+		return;
+	}
+	if (!org) fail("No active organization.", "Run `rebase cloud use` first.");
+	try {
+		const orgRow = await client.data.collection("organizations").findById(org);
+		const billingId = orgRow?.billing_account_id ?? orgRow?.billingAccount;
+		if (!billingId) {
+			console.log("");
+			console.log(chalk.gray(`  Organization ${org} has no billing account yet.`));
+			console.log("");
+			return;
+		}
+		const acct = await client.data.collection("billing-accounts").findById(billingId);
+		let card = {};
+		try {
+			card = await client.functions.invoke("stripe-billing", void 0, {
+				method: "GET",
+				path: `payment-method/${org}`
+			});
+		} catch {}
+		let plan;
+		try {
+			const projectId = arg({
+				"--project": String,
+				"-p": "--project"
+			}, {
+				argv: rawArgs.slice(2),
+				permissive: true
+			})["--project"] || readLink()?.projectId;
+			if (projectId) {
+				const proj = await client.data.collection("projects").findById(projectId);
+				const hasCluster = proj?.cluster_id != null || proj?.cluster != null;
+				plan = hasCluster ? "platform fee (own cluster)" : "managed compute";
+				try {
+					const pricing = await client.functions.invoke("pricing", void 0, { method: "GET" });
+					const key = hasCluster ? "platform_byo" : `compute_${proj?.provider || "hetzner"}_${proj?.vmSize || "cx21"}`;
+					const item = pricing.items?.find((i) => i.lookupKey === key);
+					if (item) plan = `${plan} — €${item.amountEur.toFixed(2)}/mo`;
+				} catch {}
+			}
+		} catch {}
+		console.log("");
+		console.log(chalk.bold(`  💳 Billing — org ${org}`));
+		console.log("");
+		keyValues([
+			["Account", acct ? String(acct.id) : void 0],
+			["Email", acct?.billingEmail],
+			["Status", acct?.status ? colorStatus(acct.status) : void 0],
+			["Plan", plan],
+			["Payment method", card.hasPaymentMethod ? `${card.brand ?? "card"} •••• ${card.last4 ?? "????"}${card.expMonth ? ` (exp ${card.expMonth}/${card.expYear})` : ""}` : chalk.yellow("none — run `rebase cloud billing setup`")]
+		]);
+		console.log("");
+	} catch (e) {
+		reportError(e, "Failed to load billing");
+	}
+}
+//#endregion
+//#region src/commands/cloud/index.ts
+/**
+* CLI command: `rebase cloud <group> [action] [options]`
+*
+* A single entry point for everything you do against Rebase Cloud — the hosted
+* control plane. Auth, project link, deploys, databases, and the rest are all
+* dispatched from here. Individual groups live in sibling modules; this file
+* only routes and prints help.
+*/
+/** Positional tokens after `rebase cloud` (group, action, …). */
+function positionals(rawArgs) {
+	return arg({}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	})._;
+}
+async function cloudCommand(subcommand, rawArgs) {
+	const pos = positionals(rawArgs);
+	const group = subcommand && subcommand !== "--help" ? subcommand : pos[0];
+	const action = pos[1];
+	if (!group || subcommand === "--help") {
+		printCloudHelp();
+		return;
+	}
+	switch (group) {
+		case "login":
+			await loginCommand(rawArgs);
+			break;
+		case "logout":
+			await logoutCommand(rawArgs);
+			break;
+		case "whoami":
+			await whoamiCommand(rawArgs);
+			break;
+		case "link":
+			await linkCommand(rawArgs);
+			break;
+		case "unlink":
+			unlinkCommand();
+			break;
+		case "use":
+			await selectOrgCommand(rawArgs);
+			break;
+		case "open":
+			openCommand(rawArgs);
+			break;
+		case "projects":
+		case "project":
+			await projectsGroup(action, rawArgs);
+			break;
+		case "deploy":
+			await deployCommand(rawArgs, requireProjectId(rawArgs));
+			break;
+		case "logs":
+			await logsCommand(rawArgs, requireProjectId(rawArgs));
+			break;
+		case "status":
+			await statusCommand(rawArgs);
+			break;
+		case "metrics":
+			await metricsCommand(rawArgs);
+			break;
+		case "orgs":
+		case "org":
+			await orgsCommand(action, rawArgs);
+			break;
+		case "db":
+		case "database":
+			await dbCommand$1(action, rawArgs);
+			break;
+		case "webhooks":
+			await webhooksCommand(action, rawArgs);
+			break;
+		case "storage":
+			await storageCommand(rawArgs);
+			break;
+		case "clusters":
+			await clustersCommand(rawArgs);
+			break;
+		case "billing":
+			await billingCommand(rawArgs);
+			break;
+		default:
+			console.error(chalk.red(`Unknown cloud command: ${group}`));
+			console.log("");
+			printCloudHelp();
+			process.exit(1);
+	}
+}
+async function projectsGroup(action, rawArgs) {
+	switch (action) {
+		case "list":
+		case void 0:
+			await listProjects(rawArgs);
+			break;
+		case "create":
+			await createProject(rawArgs);
+			break;
+		case "info":
+			await projectInfo(rawArgs, positionals(rawArgs)[2] || requireProjectId(rawArgs));
+			break;
+		case "delete":
+			await deleteProject(rawArgs, positionals(rawArgs)[2] || requireProjectId(rawArgs));
+			break;
+		case "--help":
+			printCloudHelp();
+			break;
+		default:
+			console.error(chalk.red(`Unknown projects command: ${action}`));
+			process.exit(1);
+	}
+}
+function printCloudHelp() {
+	console.log(`
+${chalk.bold("rebase cloud")} — Manage your apps on Rebase Cloud
+
+${chalk.green.bold("Usage")}
+  rebase cloud ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Auth")}
+  ${chalk.blue.bold("login")}                   Sign in to the control plane
+  ${chalk.blue.bold("logout")}                  Sign out
+  ${chalk.blue.bold("whoami")}                  Show the current session
+
+${chalk.green.bold("Project link")}
+  ${chalk.blue.bold("link")}                    Link this directory to a cloud project
+  ${chalk.blue.bold("unlink")}                  Remove the link
+  ${chalk.blue.bold("use")} ${chalk.gray("[org]")}               Select the active organization
+  ${chalk.blue.bold("open")}                    Open the dashboard in a browser
+
+${chalk.green.bold("Projects")}
+  ${chalk.blue.bold("projects list")}           List projects
+  ${chalk.blue.bold("projects create")}         Create a project ${chalk.gray("(--link to link it)")}
+  ${chalk.blue.bold("projects info")} ${chalk.gray("[id]")}      Show project details
+  ${chalk.blue.bold("projects delete")} ${chalk.gray("[id]")}    Delete a project
+
+${chalk.green.bold("Deploy & observe")}
+  ${chalk.blue.bold("deploy")} ${chalk.gray("[--source .]")}     Deploy the linked project + stream build logs
+  ${chalk.blue.bold("logs")} ${chalk.gray("[--runtime] [-f]")}   Show build (or runtime) logs
+  ${chalk.blue.bold("status")}                  One-glance project status
+  ${chalk.blue.bold("metrics")}                 Live CPU / memory / disk
+
+${chalk.green.bold("Organizations")}
+  ${chalk.blue.bold("orgs list|create|members")}
+
+${chalk.green.bold("Databases")}
+  ${chalk.blue.bold("db list|create|test")}
+  ${chalk.blue.bold("db backup list|create|restore")}
+
+${chalk.green.bold("Other resources")}
+  ${chalk.blue.bold("webhooks list|create|delete")}
+  ${chalk.blue.bold("storage")}                 List storage buckets
+  ${chalk.blue.bold("clusters")}                List compute clusters
+  ${chalk.blue.bold("billing setup")}           Attach a card to the org ${chalk.gray("(one-time, opens browser)")}
+  ${chalk.blue.bold("billing")}                 Show billing account + card on file
+
+${chalk.green.bold("Global options")}
+  ${chalk.blue("--url <origin>")}          Target a specific control plane ${chalk.gray("(or REBASE_CLOUD_URL)")}
+  ${chalk.blue("--project, -p <id>")}      Operate on a project without linking
+
+${chalk.gray("Most commands act on the linked project (.rebase/cloud.json) unless --project is given.")}
+${chalk.gray("Docs: https://rebase.pro/docs")}
+`);
+}
+//#endregion
+//#region src/cli.ts
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path.dirname(__filename);
 function getVersion() {
-  try {
-    const pkgPath = path.resolve(__dirname$1, "../package.json");
-    if (fs.existsSync(pkgPath)) {
-      return JSON.parse(fs.readFileSync(pkgPath, "utf-8")).version;
-    }
-  } catch {
-  }
-  return "unknown";
+	try {
+		const pkgPath = path.resolve(__dirname, "../package.json");
+		if (fs.existsSync(pkgPath)) return JSON.parse(fs.readFileSync(pkgPath, "utf-8")).version;
+	} catch {}
+	return "unknown";
 }
 async function entry(args) {
-  const parsedArgs = arg(
-    {
-      "--version": Boolean,
-      "--help": Boolean,
-      "-v": "--version",
-      "-h": "--help"
-    },
-    {
-      argv: args.slice(2),
-      permissive: true
-    }
-  );
-  if (parsedArgs["--version"]) {
-    console.log(getVersion());
-    return;
-  }
-  const command = parsedArgs._[0];
-  if (!command || parsedArgs["--help"]) {
-    printHelp();
-    return;
-  }
-  if (command === "init") {
-    await createRebaseApp(args);
-  } else {
-    console.log(chalk.red(`Unknown command: ${command}`));
-    console.log("");
-    printHelp();
-  }
+	const parsedArgs = arg({
+		"--version": Boolean,
+		"--help": Boolean,
+		"-v": "--version",
+		"-h": "--help"
+	}, {
+		argv: args.slice(2),
+		permissive: true
+	});
+	if (parsedArgs["--version"]) {
+		console.log(getVersion());
+		return;
+	}
+	const command = parsedArgs._[0];
+	const subcommand = parsedArgs._[1];
+	if (!command || parsedArgs["--help"] && ![
+		"schema",
+		"db",
+		"dev",
+		"build",
+		"start",
+		"auth",
+		"doctor",
+		"skills",
+		"api-keys",
+		"cloud"
+	].includes(command)) {
+		printHelp();
+		return;
+	}
+	const effectiveSubcommand = parsedArgs["--help"] ? "--help" : subcommand;
+	switch (command) {
+		case "init":
+			await createRebaseApp(args);
+			break;
+		case "generate-sdk": {
+			const sdkArgs = arg({
+				"--collections-dir": String,
+				"--output": String,
+				"-c": "--collections-dir",
+				"-o": "--output"
+			}, {
+				argv: args.slice(3),
+				permissive: true
+			});
+			await generateSdkCommand({
+				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
+				output: sdkArgs["--output"] || "./generated/sdk",
+				cwd: process.cwd()
+			});
+			break;
+		}
+		case "schema":
+			await schemaCommand(effectiveSubcommand, args);
+			break;
+		case "db":
+			await dbCommand(effectiveSubcommand, args);
+			break;
+		case "dev":
+			await devCommand(args);
+			break;
+		case "build":
+			await buildCommand();
+			break;
+		case "start":
+			await startCommand();
+			break;
+		case "auth":
+			await authCommand(effectiveSubcommand, args);
+			break;
+		case "doctor":
+			await doctorCommand(args);
+			break;
+		case "skills":
+			await skillsCommand(effectiveSubcommand, args);
+			break;
+		case "api-keys":
+			await apiKeysCommand(effectiveSubcommand, args);
+			break;
+		case "cloud":
+			await cloudCommand(effectiveSubcommand, args);
+			break;
+		default:
+			console.log(chalk.red(`Unknown command: ${command}`));
+			console.log("");
+			printHelp();
+	}
 }
 function printHelp() {
-  console.log(`
+	console.log(`
 ${chalk.bold("Rebase CLI")} — Developer tools for Rebase projects
 
 ${chalk.green.bold("Usage")}
   rebase ${chalk.blue("<command>")} [options]
 
 ${chalk.green.bold("Commands")}
-  ${chalk.blue.bold("init")}      Create a new Rebase project
+  ${chalk.blue.bold("init")}                    Create a new Rebase project
+  ${chalk.blue.bold("dev")}                     Start the development server
+  ${chalk.blue.bold("build")}                   Build all workspace packages
+  ${chalk.blue.bold("start")}                   Start the backend server ${chalk.gray("(production)")}
+
+${chalk.green.bold("Schema")}
+  ${chalk.blue.bold("schema generate")}         Generate Drizzle schema from collections
+  ${chalk.blue.bold("schema introspect")}       Introspect database → Rebase collections
+  ${chalk.blue.bold("schema")} ${chalk.gray("--help")}           Show schema command help
+
+${chalk.green.bold("Database")}
+  ${chalk.blue.bold("db push")}                 Apply schema directly to database ${chalk.gray("(dev)")}
+  ${chalk.blue.bold("db generate")}             Generate SQL migration files
+  ${chalk.blue.bold("db migrate")}              Run pending migrations
+  ${chalk.blue.bold("db")} ${chalk.gray("--help")}               Show database command help
+
+${chalk.green.bold("SDK")}
+  ${chalk.blue.bold("generate-sdk")}            Generate a typed TypeScript SDK from collections
+
+${chalk.green.bold("Auth")}
+  ${chalk.blue.bold("auth reset-password")}     Reset a user's password
+  ${chalk.blue.bold("auth")} ${chalk.gray("--help")}              Show auth command help
+
+${chalk.green.bold("Diagnostics")}
+  ${chalk.blue.bold("doctor")}                  Detect schema drift between collections, schema, and DB
+
+${chalk.green.bold("AI Agent Skills")}
+  ${chalk.blue.bold("skills install")}           Install Rebase agent skills for your AI coding assistant
+
+${chalk.green.bold("API Keys")}
+  ${chalk.blue.bold("api-keys list")}            List all service API keys
+  ${chalk.blue.bold("api-keys create")}          Create a new scoped API key
+  ${chalk.blue.bold("api-keys revoke")}          Revoke an existing API key
+  ${chalk.blue.bold("api-keys")} ${chalk.gray("--help")}          Show API key command help
+
+${chalk.green.bold("Rebase Cloud")}
+  ${chalk.blue.bold("cloud login")}             Sign in to the hosted control plane
+  ${chalk.blue.bold("cloud link")}              Link this directory to a cloud project
+  ${chalk.blue.bold("cloud deploy")}            Deploy the linked project + stream logs
+  ${chalk.blue.bold("cloud")} ${chalk.gray("--help")}             Show all cloud commands
 
 ${chalk.green.bold("Options")}
   ${chalk.blue("--version, -v")}   Show version number
@@ -227,56 +3983,7 @@ ${chalk.green.bold("Options")}
 ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
-const TOKEN_DIR = path.join(os.homedir(), ".rebase");
-function tokenPath(env) {
-  return path.join(TOKEN_DIR, (env === "dev" ? "staging." : "") + "tokens.json");
-}
-async function getTokens(env, _debug) {
-  const fp = tokenPath(env);
-  if (!fs.existsSync(fp)) return null;
-  try {
-    const data = fs.readFileSync(fp, "utf-8");
-    return JSON.parse(data);
-  } catch {
-    return null;
-  }
-}
-function parseJwt(token) {
-  if (!token) throw new Error("No JWT token");
-  const base64Url = token.split(".")[1];
-  const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-  const buffer = Buffer.from(base64, "base64");
-  return JSON.parse(buffer.toString());
-}
-async function refreshCredentials(env, credentials, _onErr) {
-  if (!credentials) return null;
-  const expiryDate = new Date(credentials["expiry_date"]);
-  if (expiryDate.getTime() > Date.now()) {
-    return credentials;
-  }
-  return null;
-}
-async function login(env, _debug) {
-  console.log(
-    "Interactive login is not yet implemented in @rebasepro/cli.\nPlease authenticate via the Rebase dashboard and copy your tokens to " + tokenPath(env)
-  );
-}
-async function logout(env, _debug) {
-  const fp = tokenPath(env);
-  if (fs.existsSync(fp)) {
-    fs.unlinkSync(fp);
-    console.log("You have been logged out.");
-  } else {
-    console.log("You are not logged in.");
-  }
-}
-export {
-  createRebaseApp,
-  entry,
-  getTokens,
-  login,
-  logout,
-  parseJwt,
-  refreshCredentials
-};
-//# sourceMappingURL=index.es.js.map
+//#endregion
+export { authCommand, buildCommand, buildInitQuestions, cloudCommand, configureEnvFile, createRebaseApp, dbCommand, detectPackageManager, devCommand, doctorCommand, entry, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, generateSdkCommand, getActiveBackendPlugin, getPMCommands, requireBackendDir, requireProjectRoot, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, validateTsxInstallation };
+
+//# sourceMappingURL=index.es.js.map