@rebasepro/cli 0.0.1-canary.f81da60 → 0.0.1-canary.fc811d7

package/dist/utils/package-manager.d.ts

@@ -0,0 +1,33 @@
+export type PackageManager = "pnpm" | "npm";
+export interface PMCommands {
+    /** The binary name ("pnpm" | "npm"). */
+    name: PackageManager;
+    /** Install all dependencies — e.g. `pnpm install` / `npm install`. */
+    install: string[];
+    /** Run a script — e.g. `pnpm run dev` / `npm run dev`. */
+    run: (script: string) => string[];
+    /** Execute a local bin — e.g. `pnpm exec rebase ...` / `npx rebase ...`. */
+    exec: (bin: string, args: string[]) => string[];
+    /** Query the registry — e.g. `pnpm view <pkg> version` / `npm view <pkg> version`. */
+    view: (pkg: string, field: string) => string[];
+    /** Run all workspace scripts — e.g. `pnpm -r run build` / `npm run build --workspaces`. */
+    runAll: (script: string) => string[];
+    /** Run a script in a specific workspace — e.g. `pnpm --filter "*-backend" start` / `npm run start -w backend`. */
+    runWorkspace: (workspace: string, script: string) => string[];
+    /** Execute a one-off package — e.g. `pnpm dlx skills ...` / `npx -y skills ...`. */
+    dlx: (pkg: string, args: string[]) => string[];
+    /** The workspace dependency protocol: `"workspace:*"` for pnpm, `"*"` for npm. */
+    workspaceProtocol: string;
+}
+/**
+ * Detect the package manager from the environment or the target directory.
+ *
+ * Detection order:
+ * 1. Explicit override (if provided)
+ * 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
+ * 3. Lock-file presence in the target directory
+ * 4. Default to pnpm (Rebase's recommended PM)
+ */
+export declare function detectPackageManager(targetDir?: string): PackageManager;
+/** Build the command helpers for a given package manager. */
+export declare function getPMCommands(pm: PackageManager): PMCommands;

package/dist/utils/project.d.ts

@@ -11,7 +11,7 @@ export declare function findProjectRoot(startDir?: string): string | null;
  */
 export declare function findBackendDir(projectRoot: string): string | null;
 /**
- * Detect the active backend plugin (e.g. @rebasepro/server-postgresql) from the backend's package.json.
+ * Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
  */
 export declare function getActiveBackendPlugin(backendDir: string): string | null;
 /**
@@ -35,6 +35,21 @@ export declare function resolveLocalBin(projectRoot: string, binName: string): s
  * Resolve the tsx binary. Checks backend node_modules first, then root.
  */
 export declare function resolveTsx(projectRoot: string): string | null;
+/**
+ * Validate that a resolved tsx binary actually has an intact installation.
+ *
+ * `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+ * exists. If the pnpm content-addressable store was cleaned or a previous
+ * install was interrupted, the symlink can exist while critical files inside
+ * the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+ * confusing MODULE_NOT_FOUND error at runtime.
+ *
+ * This function follows the symlink, walks up to find the tsx package root
+ * (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+ * is present. Returns `null` when the installation looks healthy, or an
+ * error description string when it appears corrupted.
+ */
+export declare function validateTsxInstallation(tsxBinPath: string): string | null;
 /**
  * Require the project root or exit with a helpful error.
  */

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.0.1-canary.f81da60",
+  "version": "0.0.1-canary.fc811d7",
   "description": "Developer tools for Rebase projects",
-  "main": "./dist/index.cjs",
+  "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
   "types": "./dist/index.d.ts",
   "type": "module",
@@ -26,21 +26,25 @@
   "license": "MIT",
   "dependencies": {
     "arg": "^5.0.2",
-    "chalk": "^4.1.2",
-    "dotenv": "^16.0.0",
-    "execa": "^4.1.0",
-    "inquirer": "12.11.1",
-    "ncp": "^2.0.0",
-    "pnpm": "^9.0.0",
-    "@rebasepro/server-core": "0.0.1-canary.f81da60",
-    "@rebasepro/sdk-generator": "0.0.1-canary.f81da60",
-    "@rebasepro/types": "0.0.1-canary.f81da60"
+    "chalk": "^5.6.2",
+    "dotenv": "^17.4.2",
+    "execa": "^9.6.1",
+    "inquirer": "14.0.2",
+    "jiti": "^2.7.0",
+    "@rebasepro/agent-skills": "0.0.1-canary.fc811d7",
+    "@rebasepro/codegen": "0.0.1-canary.fc811d7",
+    "@rebasepro/client": "0.0.1-canary.fc811d7",
+    "@rebasepro/server": "0.0.1-canary.fc811d7",
+    "@rebasepro/types": "0.0.1-canary.fc811d7",
+    "@rebasepro/server-postgres": "0.0.1-canary.fc811d7"
   },
   "devDependencies": {
-    "@types/node": "^20.19.17",
-    "typescript": "^5.9.3",
-    "vite": "^7.2.4",
-    "vitest": "4.1.5"
+    "@types/node": "^25.9.3",
+    "@types/pg": "^8.20.0",
+    "pg": "^8.21.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.16",
+    "vitest": "4.1.8"
   },
   "files": [
     "bin/",
@@ -50,17 +54,17 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.cjs"
+      "import": "./dist/index.es.js"
     }
   },
-  "exclude": [
-    "node_modules",
-    "templates/template/node_modules"
-  ],
-  "gitHead": "d935eefa5aa8d1009a2398cfac2c1e4ee9aeb6b6",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rebasepro/rebase.git",
+    "directory": "packages/cli"
+  },
   "scripts": {
     "test": "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }

package/templates/overlays/baas/README.md

@@ -0,0 +1,37 @@
+# {{PROJECT_NAME}}
+
+A headless Rebase backend: a REST API, auth, storage, realtime and backups over
+your PostgreSQL database.
+
+There are no collection files. The server reads your database schema at boot and
+serves every table, so the API follows your migrations — change the schema and
+the endpoints change with it.
+
+## Run it
+
+```bash
+pnpm install
+pnpm dev
+```
+
+- API: `http://localhost:3001/api/data/<table>`
+- Docs: `http://localhost:3001/api/swagger`
+- Health: `http://localhost:3001/health`
+
+Set `DATABASE_URL` in `.env` to point at your database.
+
+## Use it from an app
+
+```ts
+import { createRebaseClient } from "@rebasepro/client";
+
+const rebase = createRebaseClient({ baseUrl: "http://localhost:3001" });
+const posts = await rebase.data.collection("posts").find();
+```
+
+## Adding an admin UI later
+
+Nothing here locks you out of it. Switch `mode` to `"cms"` in
+`backend/src/index.ts`, add a `config/collections` directory, and add a frontend
+that renders them. See MODULAR-ARCHITECTURE.md in the Rebase repo for the three
+adoption modes.

package/templates/overlays/baas/backend/package.json

@@ -0,0 +1,31 @@
+{
+    "name": "{{PROJECT_NAME}}-backend",
+    "version": "1.0.0",
+    "description": "Rebase BaaS — headless PostgreSQL API",
+    "main": "src/index.ts",
+    "type": "module",
+    "scripts": {
+        "dev": "tsx watch src/index.ts",
+        "build": "tsc",
+        "start": "node dist/backend/src/index.js"
+    },
+    "dependencies": {
+        "@rebasepro/server": "workspace:*",
+        "@rebasepro/server-postgres": "workspace:*",
+        "@rebasepro/types": "workspace:*",
+        "drizzle-orm": "^0.45.2",
+        "hono": "^4.12.10",
+        "@hono/node-server": "^1.19.12",
+        "pg": "^8.11.3",
+        "ws": "^8.16.0",
+        "dotenv": "^16.0.0",
+        "zod": "^4.4.3"
+    },
+    "devDependencies": {
+        "@types/pg": "^8.6.5",
+        "@types/node": "^20.10.5",
+        "@types/ws": "^8.5.10",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    }
+}

package/templates/overlays/baas/backend/src/index.ts

@@ -0,0 +1,172 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { secureHeaders } from "hono/secure-headers";
+import { getRequestListener } from "@hono/node-server";
+import { createServer } from "http";
+import path from "path";
+import { fileURLToPath } from "url";
+import {
+    initializeRebaseBackend,
+    installShutdownHandlers,
+    HonoEnv,
+    listenWithPortRetry,
+    cleanupDevPortFile,
+    logger
+} from "@rebasepro/server";
+import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
+import { env } from "./env.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// ─── App ─────────────────────────────────────────────────────────────
+const app: Hono<HonoEnv> = new Hono<HonoEnv>();
+
+const isProduction = env.NODE_ENV === "production";
+const allowedOrigins = isProduction
+    ? (() => {
+        const origins = env.CORS_ORIGINS || env.FRONTEND_URL;
+        if (!origins) {
+            throw new Error(
+                "CORS_ORIGINS or FRONTEND_URL must be set in production. " +
+                "Example: CORS_ORIGINS=https://yourdomain.com"
+            );
+        }
+        return origins.split(",").map(s => s.trim());
+    })()
+    : [];
+
+app.use("/*", cors({
+    origin: (origin) => {
+        if (!isProduction) return origin || "*";
+        return allowedOrigins.includes(origin) ? origin : null;
+    },
+    credentials: true
+}));
+
+app.use("/*", secureHeaders());
+
+// ─── Database ────────────────────────────────────────────────────────
+const databaseUrl = env.DATABASE_URL;
+
+const { db, pool, connectionString } = createPostgresDatabaseConnection(databaseUrl);
+
+// ─── Start ───────────────────────────────────────────────────────────
+async function startServer() {
+    const jwtSecret = env.JWT_SECRET;
+    const PORT = env.PORT;
+    const server = createServer(getRequestListener(app.fetch));
+
+    const backend = await initializeRebaseBackend({
+        // BaaS mode: every RLS-protected table is served over REST. There are
+        // no collection files to write or keep in sync — change the schema with
+        // a migration and the API follows.
+        //
+        // Your database's own row-level security is the whole authorization
+        // model here: requests run as the `rebase_user` role, so a table
+        // without RLS has no rules at all and is not served. Protect one with:
+        //   ALTER TABLE mytable ENABLE ROW LEVEL SECURITY;
+        //   CREATE POLICY mytable_read ON mytable FOR SELECT TO public USING (true);
+        mode: "baas",
+        functionsDir: path.resolve(__dirname, "../functions"),
+        server,
+        app,
+        database: createPostgresAdapter({
+            connection: db,
+            adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
+            connectionString
+        }),
+        auth: {
+            // No `collection` here: BaaS mode has no collection files, and the
+            // auth adapter owns its own user tables.
+            jwtSecret,
+            accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
+            refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
+            serviceKey: env.REBASE_SERVICE_KEY,
+            cookieAuth: { sameSite: "Lax" },
+            google: env.GOOGLE_CLIENT_ID
+                ? { clientId: env.GOOGLE_CLIENT_ID }
+                : undefined,
+            allowRegistration: env.ALLOW_REGISTRATION,
+            email: env.SMTP_HOST
+                ? {
+                    from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+                    smtp: {
+                        host: env.SMTP_HOST,
+                        port: env.SMTP_PORT,
+                        secure: env.SMTP_SECURE,
+                        auth: env.SMTP_USER
+                            ? { user: env.SMTP_USER,
+pass: env.SMTP_PASS! }
+                            : undefined,
+                        name: env.SMTP_NAME
+                    },
+                    appName: env.APP_NAME,
+                    resetPasswordUrl: env.FRONTEND_URL
+                }
+                : undefined
+        },
+        storage: env.STORAGE_TYPE === "s3"
+            ? {
+                type: "s3",
+                bucket: env.S3_BUCKET!,
+                region: env.S3_REGION || "auto",
+                accessKeyId: env.S3_ACCESS_KEY_ID || "",
+                secretAccessKey: env.S3_SECRET_ACCESS_KEY || "",
+                endpoint: env.S3_ENDPOINT,
+                forcePathStyle: env.S3_FORCE_PATH_STYLE
+            }
+            : {
+                type: "local",
+                basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
+            },
+        history: true,
+        enableSwagger: true
+    });
+
+    // ─── Health check ─────────────────────────────────────────────
+    app.get("/health", async (c) => {
+        const result = await backend.healthCheck();
+        const status = result.healthy ? 200 : 503;
+        return c.json({
+            status: result.healthy ? "ok" : "degraded",
+            latencyMs: result.latencyMs,
+            ...(result.details ? { details: result.details } : {})
+        }, status);
+    });
+
+    // No serveSPA: this is a headless API. Point any frontend at it over HTTP.
+
+    if (!isProduction) {
+        // Dev mode: retry the next port if the current one is in use
+        const projectRoot = path.resolve(__dirname, "../..");
+        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot, serviceKey: env.REBASE_SERVICE_KEY });
+
+        // Clean up port file on exit
+        const cleanup = () => cleanupDevPortFile(projectRoot);
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("exit", cleanup);
+
+        logger.info(`API running at http://localhost:${actualPort}`);
+        logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+    } else {
+        server.listen(PORT, () => {
+            logger.info(`API running at http://localhost:${PORT}`);
+        });
+    }
+
+    // ─── Graceful Shutdown ───────────────────────────────────────────────
+    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
+    // Guards against double signals and force-exits if shutdown hangs.
+    installShutdownHandlers(backend, {
+        onCleanup: () => pool.end()
+    });
+}
+
+startServer().catch(err => {
+    logger.error("Failed to start server", { error: err instanceof Error ? err : new Error(String(err)) });
+    process.exit(1);
+});
+
+export { app };

package/templates/overlays/baas/backend/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "node",
+    "lib": ["ES2022"],
+    "outDir": "./dist",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*", "drizzle.config.ts"]
+}

package/templates/overlays/baas/package.json

@@ -0,0 +1,42 @@
+{
+    "name": "{{PROJECT_NAME}}",
+    "version": "1.0.0",
+    "description": "Rebase BaaS — headless PostgreSQL API",
+    "private": true,
+    "type": "module",
+    "workspaces": [
+        "backend"
+    ],
+    "scripts": {
+        "dev": "rebase dev",
+        "build": "rebase build",
+        "start": "rebase start",
+        "db:migrate": "rebase db migrate",
+        "schema:introspect": "rebase schema introspect",
+        "generate:sdk": "rebase generate-sdk",
+        "skills:install": "rebase skills install",
+        "example": "tsx scripts/example.ts",
+        "deploy": "rebase build && rebase start"
+    },
+    "devDependencies": {
+        "@rebasepro/cli": "workspace:*",
+        "@rebasepro/types": "workspace:*",
+        "concurrently": "^8.2.2",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    },
+    "dependencies": {
+        "@rebasepro/client": "workspace:*",
+        "dotenv": "^16.0.0"
+    },
+    "engines": {
+        "node": ">=18.0.0"
+    },
+    "pnpm": {
+        "onlyBuiltDependencies": [
+            "esbuild",
+            "sharp",
+            "@ariga/atlas"
+        ]
+    }
+}

package/templates/overlays/baas/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+packages:
+  - "backend"
+linkWorkspacePackages: true
+blockExoticSubdeps: false
+minimumReleaseAge: 0
+allowBuilds:
+  esbuild: true
+  sharp: true
+  "@ariga/atlas": true

package/templates/template/.cursorrules

@@ -0,0 +1,2 @@
+# Rebase AI Rules
+Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).

package/templates/template/.env.example

@@ -7,8 +7,12 @@
 # Database connection string (required)
 # You can use PostgreSQL (postgresql://) or MongoDB (mongodb:// or mongodb+srv://).
 # The backend will automatically detect the database type.
-DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase
+DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public
 # DATABASE_URL=mongodb://localhost:27017/rebase
+#
+# Local Postgres without SSL? If you see "SSL is not enabled on the server",
+# append &sslmode=disable to the connection string, e.g.:
+#   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)
 # Falls back to DATABASE_URL if not set
@@ -22,6 +26,8 @@ DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase
 # ── Server ────────────────────────────────────────────────────────────────────
 PORT=3001
 NODE_ENV=development
+# Allow connecting to localhost / 127.0.0.1 in production mode (for local testing of prod builds)
+# ALLOW_LOCALHOST_IN_PRODUCTION=false
 
 # ── Logging ───────────────────────────────────────────────────────────────────
 # Levels: error, warn, info, debug
@@ -44,6 +50,7 @@ ALLOW_REGISTRATION=true
 # SMTP_USER=
 # SMTP_PASS=
 # SMTP_FROM=noreply@yourapp.com
+# SMTP_NAME=
 # APP_NAME=Your App Name
 
 # ── URLs ──────────────────────────────────────────────────────────────────────
@@ -90,7 +97,24 @@ VITE_API_URL=http://localhost:3001
 # For native GCS SDK or other providers (Azure Blob, etc.), implement the
 # StorageController interface and pass it directly in your backend config.
 
+# ── Backups (optional) ────────────────────────────────────────────────────────
+# Manual backups: `rebase db backup --out ./backups` (or an s3://… URL).
+# Scheduled backups: set BACKUP_SCHEDULE and add a cron file in backend/crons
+# that default-exports createBackupCron (from @rebasepro/server-postgres).
+# Backups contain secrets & PII — use a PRIVATE destination with encryption-at-rest.
+# BACKUP_SCHEDULE=0 3 * * *           # cron expression; unset ⇒ scheduled backups off
+# BACKUP_DESTINATION=./backups        # local path, or s3://bucket/prefix / gs://bucket/prefix
+# BACKUP_RETENTION_DAYS=14            # delete backups older than N days (unset/0 ⇒ keep all)
+# BACKUP_KEEP_MINIMUM=3               # always retain at least N most-recent backups
+# PG_DUMP_PATH=                       # override pg_dump binary (must match server major version)
+# PG_RESTORE_PATH=                    # override pg_restore binary
+
 # ── Admin Service Key (optional) ──────────────────────────────────────────────
 # When set, scripts authenticate with: Authorization: Bearer <key>
 # Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"
 # REBASE_SERVICE_KEY=
+
+# Disable switching to database-level roles (e.g. 'admin') for Studio SQL execution (optional)
+# Falls back to false. Useful for databases with application-only roles or managed setups.
+# DISABLE_DB_ROLE_SWITCHING=true
+

package/templates/template/.github/copilot-instructions.md

@@ -0,0 +1,2 @@
+# Rebase AI Rules
+Please refer to and follow the instructions defined in [ai-instructions.md](../ai-instructions.md).

package/templates/template/.windsurfrules

@@ -0,0 +1,2 @@
+# Rebase AI Rules
+Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).

package/templates/template/AGENTS.md

@@ -0,0 +1,2 @@
+# Rebase AI Rules
+Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).

package/templates/template/CLAUDE.md

@@ -0,0 +1,2 @@
+# Rebase AI Rules
+Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).

package/templates/template/README.md

@@ -23,15 +23,15 @@ That's it. Your app is running:
 #### Prerequisites
 
 - [Node.js](https://nodejs.org) >= 18
-- [pnpm](https://pnpm.io)
-- A PostgreSQL database
+- [pnpm](https://pnpm.io) or [npm](https://www.npmjs.com) (v7+)
+- A PostgreSQL database (you can start the included database container via `docker compose up -d db`)
 
 #### Setup
 
 1. Install dependencies:
 
 ```bash
-pnpm install
+pnpm install   # or: npm install
 ```
 
 2. Configure environment:
@@ -44,14 +44,14 @@ cp .env.example .env
 3. Generate schema and push to database:
 
 ```bash
-rebase schema generate
-rebase db push
+pnpm run schema:generate   # or: npm run schema:generate
+pnpm run db:push            # or: npm run db:push
 ```
 
 4. Start the dev server:
 
 ```bash
-pnpm dev
+pnpm dev   # or: npm run dev
 ```
 
 Backend (Hono + PostgreSQL) on port 3001, frontend (Vite + React) on port 5173.

package/templates/template/ai-instructions.md

@@ -0,0 +1,17 @@
+# Rebase AI Coding Rules
+
+Rebase provides agent skills for AI coding assistants (Cursor, Claude Code, Windsurf, Gemini CLI, Antigravity, and more) with detailed guidelines, architecture, SDK APIs, and troubleshooting guides.
+
+To install skills for your environment, run:
+
+```
+rebase skills install
+```
+
+## Core Tenets (Quick Reference)
+
+1. **Schema-as-Code**: Always define or edit collections in `config/collections/` (e.g., `config/collections/posts.ts`). Never modify generated Drizzle schemas or PostgreSQL tables manually.
+2. **Two-Step Migrations**:
+   - Step 1: Run `rebase schema generate` to compile collections to the Drizzle schema.
+   - Step 2: Run `rebase db push` (development) or `rebase db generate && rebase db migrate` (production) to apply schema changes to the database.
+3. **Use the SDK**: Always use the Rebase SDK (`rebase.data.<slug>`) to fetch or modify data. Bypassing it with raw SQL or direct Drizzle/PG queries circumvents model validations, lifecycle hooks, and Row-Level Security (RLS).

package/templates/template/backend/Dockerfile

@@ -14,12 +14,12 @@ ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
 
 # Native dependencies for bcrypt, pg, etc.
-RUN apk add --no-cache python3 make g++
+RUN apk add --no-cache python3 make g++ curl ca-certificates
 
 WORKDIR /app
 
 # Copy workspace root files first (cache-friendly layer)
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 
 # Copy workspace packages
 COPY backend ./backend
@@ -33,7 +33,7 @@ RUN pnpm --filter "*-config" run build
 RUN pnpm --filter "*-backend" run build
 
 # Prune dev dependencies for a smaller runtime
-RUN pnpm install --frozen-lockfile --prod
+RUN CI=true pnpm install --frozen-lockfile --prod
 
 # ── Stage 2: Production Runtime ──────────────────────────────────────
 FROM node:22-alpine AS runtime
@@ -41,6 +41,7 @@ FROM node:22-alpine AS runtime
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 ENV NODE_ENV=production
+ENV CI=true
 
 RUN corepack enable
 
@@ -50,7 +51,7 @@ RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
 WORKDIR /app
 
 # Copy only production artifacts
-COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml ./
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc ./
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/backend ./backend
 COPY --from=builder /app/config ./config