@rebasepro/cli 0.10.1-canary.6f89f77 → 0.10.1-canary.7801eed

package/dist/index.es.js

@@ -12,6 +12,7 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
+import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
 import { createRequire } from "module";
 //#region src/utils/package-manager.ts
@@ -196,17 +197,26 @@ function getPMCommands(pm) {
 * These helpers locate the project root, backend directory, .env file,
 * and local binaries — used by all CLI command modules.
 */
+/** The authored project manifest. Its presence alone marks a project root. */
+var MANIFEST_FILENAME = "rebase.json";
 /**
 * Walk up from `startDir` to find the Rebase project root.
 *
-* The root is identified by a `package.json` that either:
-* - has `workspaces` containing "backend" or "frontend", OR
-* - has a sibling `backend/` directory
+* A directory is the root when it holds a `rebase.json`, or when it holds a
+* `package.json` that either lists `backend` as a workspace or sits beside both
+* `backend/` and `config/`.
+*
+* `rebase.json` is checked first and needs no `package.json` beside it, because
+* the conventions below all describe a repository that *contains the backend*.
+* A repository holding only a frontend — the normal shape once a project's apps
+* live in separate repositories — matches none of them, so without this the
+* tooling could not run there at all.
 */
 function findProjectRoot(startDir = process.cwd()) {
 	let dir = path.resolve(startDir);
 	const root = path.parse(dir).root;
 	while (dir !== root) {
+		if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
 		const pkgPath = path.join(dir, "package.json");
 		if (fs.existsSync(pkgPath)) {
 			try {
@@ -1600,21 +1610,179 @@ function writeFiles(outputDir, files) {
 		fs.writeFileSync(filePath, file.content, "utf-8");
 	}
 }
+function printSdkHelp() {
+	console.log(`
+${chalk.bold("rebase generate-sdk")} — generate a typed client from a project's schema
+
+${chalk.bold("Usage")}
+  rebase generate-sdk [options]
+
+${chalk.bold("Options")}
+  -c, --collections-dir <dir>  Local collections directory (default: ./config/collections)
+  -o, --output <dir>           Where to write the SDK (default: ./generated/sdk)
+      --from <link|url>        Fetch the schema from a running project instead of
+                               local source. "link" uses this checkout's linked project.
+      --token <token>          Bearer token for the contract endpoint
+                               (default: $REBASE_SERVICE_KEY)
+  -h, --help                   Show this help
+
+${chalk.bold("Examples")}
+  rebase generate-sdk                              From local collections
+  rebase generate-sdk --from link                  From the linked project
+  rebase generate-sdk --from https://api.acme.com  From any Rebase backend
+`.trim());
+}
+/**
+* Fetch collections from a running project's contract endpoint.
+*
+* The payload replaces relation `target` functions with slug references, so it
+* has to be rehydrated before the generator sees it — the generator *calls*
+* `target()` to decide whether a foreign key is a string or a number, and a
+* missing target silently degrades that to a union rather than failing.
+*/
+async function fetchRemoteCollections(baseUrl, token) {
+	const url = `${baseUrl.replace(/\/+$/, "")}/api/meta/contract`;
+	const headers = { accept: "application/json" };
+	if (token) headers.authorization = `Bearer ${token}`;
+	let response;
+	try {
+		response = await fetch(url, { headers });
+	} catch (err) {
+		console.log(chalk.red(`  ✗ Could not reach ${url}`));
+		console.log(chalk.gray(`    ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	if (response.status === 401 || response.status === 403) {
+		console.log(chalk.red(`  ✗ Not authorized to read the project contract (${response.status}).`));
+		console.log(chalk.gray("    The contract describes every table and relation, so it is admin-only."));
+		console.log(chalk.gray("    Pass --token, or set REBASE_SERVICE_KEY."));
+		process.exit(1);
+	}
+	if (response.status === 404) {
+		console.log(chalk.red("  ✗ This server has no contract endpoint."));
+		console.log(chalk.gray("    It needs to be running Rebase 0.11 or newer."));
+		process.exit(1);
+	}
+	if (!response.ok) {
+		console.log(chalk.red(`  ✗ Contract request failed with ${response.status}.`));
+		process.exit(1);
+	}
+	const contract = await response.json();
+	if (!Array.isArray(contract.collections)) {
+		console.log(chalk.red("  ✗ The contract response did not contain collections."));
+		process.exit(1);
+	}
+	return {
+		collections: deserializeCollections(contract.collections),
+		schemaVersion: contract.schemaVersion ?? "unknown"
+	};
+}
+/**
+* Decide whether the ambient service key may be sent to this host.
+*
+* `REBASE_SERVICE_KEY` grants full admin bypass. Attaching it to whatever URL
+* happened to be passed — or, worse, to whatever a committed `.rebase/cloud.json`
+* points at — would hand the project's most powerful credential to a host nobody
+* vetted. An explicit `--token` is a decision the caller made; the ambient
+* variable is not, so it only travels to the project this checkout is linked to.
+*/
+function mayUseAmbientKey(target, cwd) {
+	const link = readLink(findProjectRoot(cwd) ?? cwd);
+	if (!link?.apiUrl) return false;
+	try {
+		return new URL(link.apiUrl).origin === new URL(target).origin;
+	} catch {
+		return false;
+	}
+}
+/**
+* The base URL to show in the printed usage example.
+*
+* `rebase dev` binds a port derived from the project path, not 3001, and writes
+* the one it actually got to `.rebase/state.json`. Printing a hardcoded
+* `localhost:3001` sent people to a port nothing was listening on — or, with
+* several projects on one machine, to a different project's backend. Prefer the
+* port this project last ran on; fall back to the literal only when the project
+* has never been started.
+*/
+function resolveExampleBaseUrl(cwd) {
+	const projectRoot = findProjectRoot(cwd) ?? cwd;
+	try {
+		const state = JSON.parse(fs.readFileSync(path.join(projectRoot, ".rebase", "state.json"), "utf-8"));
+		if (typeof state.baseUrl === "string" && state.baseUrl) return state.baseUrl;
+		if (typeof state.port === "number") return `http://localhost:${state.port}`;
+	} catch {}
+	return "http://localhost:3001";
+}
+/** Whether a slug can be written as `rebase.data.<slug>` rather than a lookup. */
+function isIdentifierLike(slug) {
+	return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(slug);
+}
+/** Resolve `--from` into a base URL, following the link file when asked. */
+function resolveSchemaSource(from, cwd) {
+	if (from !== "link") {
+		let parsed;
+		try {
+			parsed = new URL(from);
+		} catch {
+			console.log(chalk.red(`  ✗ "${from}" is not a valid URL.`));
+			console.log(chalk.gray("    Pass a full URL, e.g. https://api.example.com, or \"link\"."));
+			process.exit(1);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+			console.log(chalk.red("  ✗ The project URL must be http or https."));
+			process.exit(1);
+		}
+		return from;
+	}
+	const link = readLink(findProjectRoot(cwd) ?? cwd);
+	if (!link) {
+		console.log(chalk.red("  ✗ This checkout is not linked to a project."));
+		console.log(chalk.gray("    Run `rebase link <url>`, or pass --from <url>."));
+		process.exit(1);
+	}
+	const apiUrl = link.apiUrl;
+	if (!apiUrl) {
+		console.log(chalk.red("  ✗ The project link has no API URL."));
+		console.log(chalk.gray("    Re-link with `rebase link <url>` to record one."));
+		process.exit(1);
+	}
+	return apiUrl;
+}
 /**
 * Main entry point for the generate-sdk command.
 */
 async function generateSdkCommand(args) {
 	const { collectionsDir, output, cwd } = args;
+	if (args.help) {
+		printSdkHelp();
+		return;
+	}
 	const resolvedCollectionsDir = path.isAbsolute(collectionsDir) ? collectionsDir : path.join(cwd, collectionsDir);
 	const resolvedOutput = path.isAbsolute(output) ? output : path.join(cwd, output);
 	console.log("");
 	console.log(chalk.bold("  🔧 Rebase SDK Generator"));
 	console.log("");
-	console.log(`  ${chalk.gray("Collections:")} ${resolvedCollectionsDir}`);
-	console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
-	console.log("");
-	console.log(chalk.cyan("  → Loading collection definitions..."));
-	const collections = await loadCollections(resolvedCollectionsDir);
+	let collections;
+	let remoteSchemaVersion;
+	if (args.from) {
+		const baseUrl = resolveSchemaSource(args.from, cwd);
+		console.log(`  ${chalk.gray("Project:")}     ${baseUrl}`);
+		console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
+		console.log("");
+		console.log(chalk.cyan("  → Fetching the project contract..."));
+		const ambient = mayUseAmbientKey(baseUrl, cwd) ? process.env.REBASE_SERVICE_KEY : void 0;
+		if (!args.token && !ambient && process.env.REBASE_SERVICE_KEY) console.log(chalk.dim("  (not sending REBASE_SERVICE_KEY — this host is not the linked project; pass --token to override)"));
+		const remote = await fetchRemoteCollections(baseUrl, args.token || ambient);
+		collections = remote.collections;
+		remoteSchemaVersion = remote.schemaVersion;
+	} else {
+		console.log(`  ${chalk.gray("Collections:")} ${resolvedCollectionsDir}`);
+		console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
+		console.log("");
+		console.log(chalk.cyan("  → Loading collection definitions..."));
+		collections = await loadCollections(resolvedCollectionsDir);
+	}
 	collections.sort((a, b) => a.slug.localeCompare(b.slug));
 	if (collections.length === 0) {
 		console.log(chalk.red("  ✗ No collections found. Nothing to generate."));
@@ -1624,22 +1792,41 @@ async function generateSdkCommand(args) {
 	console.log("");
 	console.log(chalk.cyan("  → Generating SDK files..."));
 	const files = generateSDK(collections);
+	const schemaVersion = remoteSchemaVersion ?? computeSchemaVersion(collections);
+	files.push({
+		path: "schema.meta.ts",
+		content: `// Auto-generated by \`rebase generate-sdk\`. Do not edit.
+//
+// The schema version this SDK was generated from. Compare it against the
+// project's current version to detect drift:
+//
+//     curl -s <api-url>/api/meta/schema-version
+//
+export const SCHEMA_VERSION = ${JSON.stringify(schemaVersion)};
+export const GENERATED_AT = ${JSON.stringify((/* @__PURE__ */ new Date()).toISOString())};
+`
+	});
 	console.log(chalk.green(`  ✓ Generated ${files.length} file(s)`));
+	console.log(chalk.gray(`    schema ${schemaVersion}`));
 	console.log(chalk.cyan(`  → Writing to ${resolvedOutput}...`));
 	writeFiles(resolvedOutput, files);
 	console.log("");
 	console.log(chalk.green.bold("  ✓ SDK generated successfully!"));
 	console.log("");
+	const typesImport = `./${path.relative(cwd, path.join(resolvedOutput, "database.types"))}`;
+	const exampleSlug = collections[0]?.slug || "my_collection";
 	console.log(chalk.gray("  Usage:"));
 	console.log(chalk.gray("    import { createRebaseClient } from '@rebasepro/client';"));
-	console.log(chalk.gray(`    import type { Database } from './${path.relative(cwd, path.join(resolvedOutput, "database.types"))}';`));
+	console.log(chalk.gray(`    import { collectionsDictionary, type Database } from '${typesImport}';`));
 	console.log("");
 	console.log(chalk.gray("    const rebase = createRebaseClient<Database>({"));
-	console.log(chalk.gray("        baseUrl: 'http://localhost:3001',"));
+	console.log(chalk.gray(`        baseUrl: '${resolveExampleBaseUrl(cwd)}',`));
+	console.log(chalk.gray("        collections: collectionsDictionary,"));
 	console.log(chalk.gray("        // token: 'your-jwt-token',"));
 	console.log(chalk.gray("    });"));
 	console.log("");
-	console.log(chalk.gray(`    const { data } = await rebase.collection('${collections[0]?.slug || "my_collection"}').find();`));
+	console.log(chalk.gray(`    const { data } = await rebase.data.collection('${exampleSlug}').find();`));
+	if (isIdentifierLike(exampleSlug)) console.log(chalk.gray(`    // …or in property style: rebase.data.${exampleSlug}.find()`));
 	console.log("");
 }
 //#endregion
@@ -1794,6 +1981,367 @@ ${chalk.green.bold("Examples")}
 `);
 }
 //#endregion
+//#region src/manifest.ts
+/**
+* Loading, validating and synthesizing `rebase.json`.
+*
+* The manifest declares *topology*: which runtime major a project targets and
+* which apps this repository contributes. It is deliberately small — schema,
+* security rules, hooks and functions stay in TypeScript, where a type system
+* can check them.
+*
+* Two properties matter more than the file format itself:
+*
+* - **A missing manifest is never an error.** Every project that exists today
+*   predates this file. One is synthesized from the conventions the template
+*   already follows, so nothing breaks and nobody is forced to migrate.
+* - **Validation reports every problem at once**, with the path to each. A
+*   config file that surfaces its mistakes one run at a time is a bad config
+*   file.
+*/
+/** Runtime range written into new manifests. */
+var CURRENT_RUNTIME_RANGE = "^1";
+/** Conventional locations, matching what `rebase init` scaffolds. */
+var DEFAULT_CONFIG_DIR = "config";
+var DEFAULT_FUNCTIONS_DIR = "backend/functions";
+var DEFAULT_CRONS_DIR = "backend/crons";
+var DEFAULT_SCHEMA_FILE = "backend/src/schema.generated.ts";
+var ManifestError = class extends Error {
+	issues;
+	constructor(message, issues = []) {
+		super(message);
+		this.issues = issues;
+		this.name = "ManifestError";
+	}
+};
+var APP_TYPES = [
+	"backend",
+	"static",
+	"admin",
+	"mobile",
+	"custom"
+];
+/** Reserved because they name things in URLs and CLI output. */
+var RESERVED_APP_NAMES = new Set([
+	"api",
+	"health",
+	"metrics",
+	"livez",
+	"_rebase"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Reject paths that escape the repository.
+*
+* A manifest is committed and reviewed, so this is not a security boundary so
+* much as a guard against `../../` typos that would otherwise have `rebase build`
+* writing outside the project.
+*/
+function checkRelativePath(value, fieldPath, issues, { required }) {
+	if (value === void 0) {
+		if (required) issues.push({
+			path: fieldPath,
+			message: "is required"
+		});
+		return;
+	}
+	if (typeof value !== "string" || value.trim() === "") {
+		issues.push({
+			path: fieldPath,
+			message: "must be a non-empty string"
+		});
+		return;
+	}
+	if (path.isAbsolute(value)) {
+		issues.push({
+			path: fieldPath,
+			message: "must be a relative path, not absolute"
+		});
+		return;
+	}
+	const normalized = path.normalize(value);
+	if (normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+		issues.push({
+			path: fieldPath,
+			message: "must stay inside the project directory"
+		});
+		return;
+	}
+	return value;
+}
+function validateApp(name, raw, issues) {
+	const base = `apps.${name}`;
+	if (!isRecord(raw)) {
+		issues.push({
+			path: base,
+			message: "must be an object"
+		});
+		return;
+	}
+	const type = raw.type;
+	if (typeof type !== "string" || !APP_TYPES.includes(type)) {
+		issues.push({
+			path: `${base}.type`,
+			message: `must be one of: ${APP_TYPES.join(", ")}`
+		});
+		return;
+	}
+	switch (type) {
+		case "backend":
+			checkRelativePath(raw.config, `${base}.config`, issues, { required: false });
+			checkRelativePath(raw.functions, `${base}.functions`, issues, { required: false });
+			checkRelativePath(raw.crons, `${base}.crons`, issues, { required: false });
+			checkRelativePath(raw.schema, `${base}.schema`, issues, { required: false });
+			checkRelativePath(raw.usersCollection, `${base}.usersCollection`, issues, { required: false });
+			if (raw.mode !== void 0 && raw.mode !== "cms" && raw.mode !== "baas") issues.push({
+				path: `${base}.mode`,
+				message: "must be \"cms\" or \"baas\""
+			});
+			return raw;
+		case "static":
+			checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
+			checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
+			if (raw.build !== void 0 && typeof raw.build !== "string") issues.push({
+				path: `${base}.build`,
+				message: "must be a string command"
+			});
+			if (raw.spa !== void 0 && typeof raw.spa !== "boolean") issues.push({
+				path: `${base}.spa`,
+				message: "must be a boolean"
+			});
+			return raw;
+		case "admin": {
+			const mode = raw.mode ?? "hosted";
+			if (mode !== "hosted" && mode !== "bundled") {
+				issues.push({
+					path: `${base}.mode`,
+					message: "must be \"hosted\" or \"bundled\""
+				});
+				return;
+			}
+			if (mode === "bundled") {
+				checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
+				checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
+			}
+			return raw;
+		}
+		case "mobile": {
+			const platform = raw.platform;
+			if (platform !== "ios" && platform !== "android" && platform !== "other") issues.push({
+				path: `${base}.platform`,
+				message: "must be \"ios\", \"android\" or \"other\""
+			});
+			return raw;
+		}
+		case "custom":
+			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
+			checkRelativePath(raw.context, `${base}.context`, issues, { required: false });
+			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
+				path: `${base}.port`,
+				message: "must be an integer"
+			});
+			return raw;
+		default: return;
+	}
+}
+/**
+* Validate a parsed manifest, collecting every problem.
+*/
+function validateManifest(raw) {
+	const issues = [];
+	if (!isRecord(raw)) return { issues: [{
+		path: "",
+		message: `${MANIFEST_FILENAME} must contain a JSON object`
+	}] };
+	if (typeof raw.runtime !== "string" || raw.runtime.trim() === "") issues.push({
+		path: "runtime",
+		message: `is required, e.g. "^1"`
+	});
+	if (!isRecord(raw.apps)) {
+		issues.push({
+			path: "apps",
+			message: "is required and must be an object"
+		});
+		return { issues };
+	}
+	const apps = {};
+	let backendCount = 0;
+	for (const [name, value] of Object.entries(raw.apps)) {
+		if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name must be lowercase alphanumeric with dashes (it appears in URLs)"
+			});
+			continue;
+		}
+		if (RESERVED_APP_NAMES.has(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name is reserved"
+			});
+			continue;
+		}
+		const app = validateApp(name, value, issues);
+		if (!app) continue;
+		if (app.type === "backend") backendCount++;
+		apps[name] = app;
+	}
+	if (backendCount > 1) issues.push({
+		path: "apps",
+		message: "a project may declare at most one backend app"
+	});
+	if (issues.length > 0) return { issues };
+	return {
+		manifest: {
+			$schema: typeof raw.$schema === "string" ? raw.$schema : void 0,
+			runtime: raw.runtime,
+			apps
+		},
+		issues
+	};
+}
+/**
+* Infer a manifest from a directory that does not have one.
+*
+* This mirrors exactly what the template scaffolds, which is what makes adopting
+* the manifest a no-op for existing projects: the synthesized result is what
+* they would have written by hand.
+*
+* An ejected backend — one with its own `src/index.ts` entrypoint — is reported
+* as a `custom` app rather than a `backend` app. That is not a downgrade; it is
+* an accurate description, and it is what keeps such a project deploying exactly
+* as it does today.
+*/
+function synthesizeManifest(projectRoot) {
+	const exists = (relative) => fs.existsSync(path.join(projectRoot, relative));
+	const apps = {};
+	const hasConfig = exists(DEFAULT_CONFIG_DIR);
+	const hasBackend = exists("backend");
+	const backendEntry = exists("backend/src/index.ts");
+	if (hasBackend && backendEntry) apps.backend = {
+		type: "custom",
+		dockerfile: exists("backend/Dockerfile") ? "backend/Dockerfile" : void 0,
+		context: "."
+	};
+	else if (hasBackend || hasConfig) {
+		const backend = { type: "backend" };
+		if (!hasConfig) backend.mode = "baas";
+		if (exists("backend/functions")) backend.functions = DEFAULT_FUNCTIONS_DIR;
+		if (exists("backend/crons")) backend.crons = DEFAULT_CRONS_DIR;
+		apps.backend = backend;
+	}
+	if (exists("frontend")) apps.web = {
+		type: "static",
+		root: "frontend",
+		build: "npm run build --workspace frontend",
+		output: "frontend/dist",
+		spa: true
+	};
+	return {
+		runtime: "^1",
+		apps
+	};
+}
+function manifestPath(projectRoot) {
+	return path.join(projectRoot, MANIFEST_FILENAME);
+}
+function manifestExists(projectRoot) {
+	return fs.existsSync(manifestPath(projectRoot));
+}
+/**
+* Read the manifest, falling back to a synthesized one.
+*
+* A malformed manifest throws — unlike a missing one. Silently ignoring a file
+* the developer wrote, and building something else instead, is the worst
+* available behaviour.
+*/
+function loadManifest(projectRoot) {
+	const filePath = manifestPath(projectRoot);
+	if (!fs.existsSync(filePath)) return {
+		manifest: synthesizeManifest(projectRoot),
+		source: "synthesized"
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (err) {
+		throw new ManifestError(`${MANIFEST_FILENAME} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const { manifest, issues } = validateManifest(parsed);
+	if (!manifest) throw new ManifestError(`${MANIFEST_FILENAME} is invalid`, issues);
+	return {
+		manifest,
+		source: "file",
+		filePath
+	};
+}
+/** Write a manifest, with a trailing newline so it plays well with other tools. */
+function writeManifest(projectRoot, manifest) {
+	const filePath = manifestPath(projectRoot);
+	const ordered = {
+		$schema: manifest.$schema ?? "https://rebase.pro/schemas/rebase.json",
+		runtime: manifest.runtime,
+		apps: manifest.apps
+	};
+	fs.writeFileSync(filePath, `${JSON.stringify(ordered, null, 4)}\n`, "utf8");
+	return filePath;
+}
+/** Find the single backend app, if this repository declares one. */
+function findBackendApp(manifest) {
+	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "backend") return {
+		name,
+		app
+	};
+}
+/** Apps that produce build output, in the order they should be built. */
+function buildableApps(manifest) {
+	const entries = Object.entries(manifest.apps).map(([name, app]) => ({
+		name,
+		app
+	}));
+	const rank = (app) => {
+		if (app.type === "backend") return 0;
+		if (app.type === "admin") return 1;
+		if (app.type === "static") return 2;
+		return 3;
+	};
+	return entries.filter(({ app }) => app.type !== "mobile").sort((a, b) => rank(a.app) - rank(b.app));
+}
+/**
+* Decide whether a project can run on the managed runtime, and say why not.
+*
+* "Not eligible" is never a dead end — it selects the custom-runtime path, which
+* still deploys. The reasons exist so the answer is actionable rather than a
+* verdict.
+*/
+function assessManagedCompatibility(manifest) {
+	const reasons = [];
+	const backend = findBackendApp(manifest);
+	if (!backend) {
+		const custom = Object.entries(manifest.apps).find(([, app]) => app.type === "custom");
+		if (custom) reasons.push(`App "${custom[0]}" is a custom container. The managed runtime runs the platform image with your bundle, so a project that builds its own image uses the custom runtime instead.`);
+		else reasons.push("No backend app is declared in this repository. Only the repository that declares the backend selects the runtime.");
+	}
+	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "custom") reasons.push(`App "${name}" is a custom container image.`);
+	return {
+		eligible: reasons.length === 0 && Boolean(backend),
+		reasons
+	};
+}
+/** Resolve a backend app's directories against the conventions it omits. */
+function resolveBackendPaths(app) {
+	return {
+		config: app.config ?? "config",
+		functions: app.functions ?? "backend/functions",
+		crons: app.crons ?? "backend/crons",
+		schema: app.schema ?? "backend/src/schema.generated.ts",
+		usersCollection: app.usersCollection ?? "collections/users",
+		mode: app.mode ?? "cms"
+	};
+}
+//#endregion
 //#region src/commands/dev.ts
 /**
 * CLI command: rebase dev
@@ -1811,6 +2359,66 @@ ${chalk.green.bold("Examples")}
 * Each project gets a deterministic default port derived from the project
 * root path, so multiple Rebase instances never collide.
 */
+/**
+* Quote a path for the shell `execa` runs the backend through.
+*
+* The dev runtime's path is absolute and therefore contains whatever the
+* developer's directories are called. Double quotes do not neutralize `$`,
+* backticks or backslashes in a POSIX shell, so a checkout under a directory
+* named `$(...)` would execute it. Single quotes disable all expansion; on
+* Windows, `cmd.exe` performs no such expansion and wants double quotes.
+*/
+function quoteForShell(value) {
+	if (process.platform === "win32") return `"${value.replace(/"/g, "\\\"")}"`;
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+* Locate the dev runtime shim shipped with the CLI.
+*
+* Published under `runtime/` in the package rather than compiled into `dist/`,
+* because tsx executes it as a file and it must exist on disk at a stable path.
+*/
+function resolveDevRuntimeEntry() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 5; i++) {
+		const candidate = path.join(dir, "runtime", "dev-server.mjs");
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	throw new Error("Could not find the Rebase dev runtime (runtime/dev-server.mjs). Reinstall @rebasepro/cli, or add a backend/src/index.ts to run your own entrypoint.");
+}
+/**
+* Tell the dev runtime where this project keeps its parts.
+*
+* Read from `rebase.json` when there is one, so a project that moved its config
+* directory is honoured; otherwise the conventional layout.
+*/
+function devRuntimeEnv(projectRoot) {
+	const result = {
+		REBASE_DEV_PROJECT_ROOT: projectRoot,
+		REBASE_DEV_CONFIG: "config",
+		REBASE_DEV_FUNCTIONS: "backend/functions",
+		REBASE_DEV_CRONS: "backend/crons",
+		REBASE_DEV_SCHEMA: "backend/src/schema.generated.ts",
+		REBASE_DEV_MODE: "cms"
+	};
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (backend) {
+			const paths = resolveBackendPaths(backend.app);
+			result.REBASE_DEV_CONFIG = paths.config;
+			result.REBASE_DEV_FUNCTIONS = paths.functions;
+			result.REBASE_DEV_CRONS = paths.crons;
+			result.REBASE_DEV_SCHEMA = paths.schema;
+			result.REBASE_DEV_MODE = paths.mode;
+			result.REBASE_DEV_APP = backend.name;
+		}
+	} catch {}
+	if (!fs.existsSync(path.join(projectRoot, result.REBASE_DEV_CONFIG))) result.REBASE_DEV_MODE = "baas";
+	return result;
+}
 /** Well-known filename the backend writes its actual port to. */
 var DEV_PORT_FILENAME = ".rebase-dev-port";
 /**
@@ -2061,11 +2669,15 @@ async function devCommand(rawArgs) {
 				});
 			}
 		}
+		const ejectedEntry = path.join(backendDir, "src", "index.ts");
+		const usesStockRuntime = !fs.existsSync(ejectedEntry);
+		const entryTarget = usesStockRuntime ? resolveDevRuntimeEntry() : "src/index.ts";
+		if (usesStockRuntime) Object.assign(env, devRuntimeEnv(projectRoot));
 		const watchArgs = [
 			"watch",
 			"--conditions",
 			"development",
-			"src/index.ts"
+			quoteForShell(entryTarget)
 		];
 		if (!shouldGenerate) {
 			watchArgs.splice(1, 0, `--watch="${path.join("..", "config", "**", "*")}"`);
@@ -2194,17 +2806,1084 @@ ${chalk.green.bold("Description")}
   in your environment to enable it.
 `);
 }
-//#endregion
-//#region src/commands/build.ts
-/**
-* CLI command: rebase build
-*
-* Runs the build script in all workspace packages.
-* Automatically detects the package manager (pnpm or npm) and
-* uses the correct workspace-aware command.
-*/
-async function buildCommand() {
-	const projectRoot = requireProjectRoot();
+//#endregion
+//#region src/bundle.ts
+/**
+* Building a project bundle.
+*
+* A bundle is the deployable form of a project: compiled collections, functions,
+* crons and schema, plus a generated manifest describing exactly what it needs
+* to run. It contains no Dockerfile and no repository — the runtime is supplied
+* separately, which is what allows a project to be moved onto a patched runtime
+* without being rebuilt.
+*
+* Compilation runs through a generated tsconfig rooted at the project directory,
+* so the output mirrors the source layout (`config/…`, `backend/functions/…`)
+* and every path in the manifest is predictable. Letting each workspace package
+* emit into its own `dist/` would have meant guessing at three different
+* layouts, since `rootDir` differs between the template flavours.
+*/
+var DEFAULT_BUNDLE_DIR = "dist-bundle";
+/** Packages whose presence means the bundle cannot run on a stock runtime image. */
+var KNOWN_NATIVE_PACKAGES = new Set([
+	"sharp",
+	"canvas",
+	"bcrypt",
+	"argon2",
+	"node-sass",
+	"sqlite3",
+	"better-sqlite3",
+	"grpc",
+	"@grpc/grpc-js-native",
+	"re2",
+	"sodium-native",
+	"libpq",
+	"pg-native"
+]);
+/** Dependencies supplied by the runtime image itself, not by the bundle. */
+var RUNTIME_PROVIDED = new Set([
+	"@rebasepro/server",
+	"@rebasepro/types",
+	"@rebasepro/client",
+	"@rebasepro/common",
+	"@rebasepro/utils",
+	"hono",
+	"@hono/node-server",
+	"typescript",
+	"tsx"
+]);
+function log(options, message) {
+	(options.log ?? ((m) => console.log(m)))(message);
+}
+/**
+* Every `node_modules/@types` directory the project can see.
+*
+* Type roots normally resolve by walking up from the tsconfig's own directory,
+* which breaks here for two reasons: the generated config lives in `.rebase/`,
+* and a pnpm workspace puts `@types/node` inside the *package* that depends on
+* it (`config/node_modules/@types`) rather than at the project root. Listing them
+* explicitly, as absolute paths, sidesteps both.
+*/
+function discoverTypeRoots(projectRoot) {
+	const candidates = [];
+	for (const relative of [
+		".",
+		"config",
+		"backend",
+		"frontend"
+	]) candidates.push(path.join(projectRoot, relative, "node_modules", "@types"));
+	let dir = projectRoot;
+	for (let i = 0; i < 4; i++) {
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		candidates.push(path.join(parent, "node_modules", "@types"));
+		dir = parent;
+	}
+	return candidates.filter((candidate) => fs.existsSync(candidate));
+}
+/**
+* Read a tsconfig's own `compilerOptions`.
+*
+* Parsed with the project's own TypeScript, because a tsconfig is not JSON: it
+* permits comments and trailing commas. Hand-rolled comment stripping gets this
+* wrong in a way that is easy to miss — a `paths` entry like
+* `"@acme/types/*": ["src/*"]` contains the character sequence that opens a
+* block comment, so a regex happily eats the rest of the file and the result
+* parses as *something*, just not the config the developer wrote.
+*
+* One level only, and only `paths` is used from it.
+*/
+async function readCompilerOptions(projectRoot, file) {
+	if (!fs.existsSync(file)) return void 0;
+	const text = fs.readFileSync(file, "utf8");
+	try {
+		const { config } = createRequire(path.join(projectRoot, "package.json"))("typescript").parseConfigFileTextToJson(file, text);
+		return config?.compilerOptions;
+	} catch {
+		try {
+			return JSON.parse(text.replace(/^\s*\/\/.*$/gm, "")).compilerOptions;
+		} catch {
+			return;
+		}
+	}
+}
+/**
+* Drop path aliases that resolve outside the project.
+*
+* A monorepo commonly aliases its workspace packages to their **source**
+* (`"@acme/types": ["packages/types/src/index.ts"]`) so editors jump to real
+* files. That is right for developing the monorepo and wrong for building a
+* bundle: it drags foreign `.ts` files into the program, none of which are under
+* the project's `rootDir`, and the compile fails on files the developer never
+* asked to build.
+*
+* A bundle is built against *installed packages*. Aliases pointing inside the
+* project are kept, because those are the project's own code.
+*/
+function filterProjectPaths(baseDir, projectRoot, paths, baseUrl) {
+	const kept = {};
+	const dropped = [];
+	for (const [alias, targets] of Object.entries(paths)) {
+		if (!Array.isArray(targets)) continue;
+		const resolved = targets.map((target) => path.resolve(baseUrl, target));
+		if (resolved.every((target) => {
+			const relative = path.relative(projectRoot, target);
+			return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+		})) kept[alias] = resolved.map((target) => {
+			return path.relative(baseDir, target).split(path.sep).join("/");
+		});
+		else dropped.push(alias);
+	}
+	return {
+		kept,
+		dropped
+	};
+}
+/**
+* Compose the tsconfig used to compile the bundle.
+*
+* Extends the config package's own tsconfig when there is one, so the project's
+* choices about target, JSX and strictness are respected. It has to be `extends`
+* rather than a copy of `compilerOptions`: TypeScript resolves relative paths
+* against the file they were written in, so copying a value like
+* `baseUrl: "../../"` into a config in a different directory silently repoints
+* it at the wrong place.
+*/
+async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck) {
+	const tsconfigDir = path.join(projectRoot, ".rebase");
+	const fromTsconfig = (target) => {
+		return path.relative(tsconfigDir, path.resolve(projectRoot, target)).split(path.sep).join("/");
+	};
+	const configTsconfigPath = path.join(projectRoot, "config", "tsconfig.json");
+	const extendsFrom = fs.existsSync(configTsconfigPath) ? fromTsconfig(path.join("config", "tsconfig.json")) : void 0;
+	let pathOverrides = {};
+	const baseOptions = await readCompilerOptions(projectRoot, configTsconfigPath);
+	if (baseOptions?.paths && typeof baseOptions.paths === "object") {
+		const baseDir = path.dirname(configTsconfigPath);
+		const baseUrl = path.resolve(baseDir, typeof baseOptions.baseUrl === "string" ? baseOptions.baseUrl : ".");
+		const { kept, dropped } = filterProjectPaths(tsconfigDir, projectRoot, baseOptions.paths, baseUrl);
+		pathOverrides = {
+			baseUrl: fromTsconfig("."),
+			paths: kept
+		};
+		if (dropped.length > 0) console.log(chalk.dim(`    ignoring ${dropped.length} path alias(es) pointing outside the project (${dropped.join(", ")}) — resolving those from node_modules instead`));
+	}
+	const compilerOptions = {
+		target: "ES2022",
+		module: "ESNext",
+		moduleResolution: "bundler",
+		lib: ["ES2022"],
+		jsx: "react-jsx",
+		allowSyntheticDefaultImports: true,
+		esModuleInterop: true,
+		resolveJsonModule: true,
+		forceConsistentCasingInFileNames: true,
+		rootDir: fromTsconfig("."),
+		outDir: fromTsconfig(path.relative(projectRoot, outDir) || "."),
+		typeRoots: discoverTypeRoots(projectRoot),
+		...pathOverrides,
+		declaration: false,
+		declarationMap: false,
+		sourceMap: true,
+		noEmit: false,
+		skipLibCheck: true,
+		allowJs: true,
+		...skipTypeCheck ? { noCheck: true } : {}
+	};
+	const tsconfig = {
+		...extendsFrom ? { extends: extendsFrom } : {},
+		compilerOptions,
+		include: includes.map(fromTsconfig),
+		exclude: [
+			"node_modules",
+			"**/*.test.ts",
+			"**/*.spec.ts",
+			"**/dist/**",
+			DEFAULT_BUNDLE_DIR
+		].map((pattern) => pattern.startsWith("**") ? pattern : fromTsconfig(pattern))
+	};
+	fs.mkdirSync(tsconfigDir, { recursive: true });
+	const tsconfigPath = path.join(tsconfigDir, "tsconfig.bundle.json");
+	fs.writeFileSync(tsconfigPath, JSON.stringify(tsconfig, null, 2), "utf8");
+	return tsconfigPath;
+}
+/**
+* Whether the compiled config package exports a `storageAuthorize` hook.
+*
+* Recorded in the manifest so a host can refuse a deploy that would enable file
+* storage with no access model, rather than let the runtime's boot guard turn it
+* into a crash loop the developer cannot read.
+*
+* Read from the *compiled* index, deliberately: that is the exact module the
+* runtime imports and reads the export off, so this cannot disagree with what
+* actually happens at boot. It is a textual check rather than an import because
+* a freshly built bundle cannot resolve its own dependencies until it is
+* deployed — the same reason schema hashing reads source.
+*
+* Errs toward `false`: a missed detection costs a deploy rejection whose message
+* says exactly how to proceed, while a false positive would hand back the crash
+* loop this exists to prevent.
+*/
+function detectStorageAuthorize(compiledConfigDir) {
+	const indexPath = [
+		".js",
+		".mjs",
+		".ts"
+	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
+	if (!indexPath) return false;
+	let source;
+	try {
+		source = fs.readFileSync(indexPath, "utf8");
+	} catch {
+		return false;
+	}
+	if (/\bexport\s+(?:async\s+)?(?:const|let|var|function)\s+storageAuthorize\b/.test(source)) return true;
+	for (const clause of source.matchAll(/\bexport\s*\{([^}]*)\}/g)) if (clause[1].split(",").map((entry) => {
+		const parts = entry.split(/\bas\b/);
+		return parts[parts.length - 1].trim();
+	}).includes("storageAuthorize")) return true;
+	return false;
+}
+/**
+* Detect native code in the dependency closure.
+*
+* Walks declared runtime dependencies breadth-first through `node_modules`,
+* flagging anything with a `binding.gyp`, a prebuilt `.node` binary, or an
+* install script that builds one. The managed runtime cannot run these: a
+* binary compiled for one image will not load in another, and finding that out
+* at deploy time is far better than in a crash loop.
+*
+* The walk is bounded. A dependency graph can be enormous, and this is a
+* heuristic gate whose false negatives are caught at deploy time anyway.
+*/
+function detectNativeDependencies(projectRoot, declared, limit = 2e3) {
+	const found = [];
+	const seen = /* @__PURE__ */ new Set();
+	const queue = Object.keys(declared);
+	let visited = 0;
+	const searchRoots = [
+		path.join(projectRoot, "node_modules"),
+		path.join(projectRoot, "backend", "node_modules"),
+		path.join(projectRoot, "config", "node_modules")
+	].filter((dir) => fs.existsSync(dir));
+	while (queue.length > 0 && visited < limit) {
+		const name = queue.shift();
+		if (seen.has(name)) continue;
+		seen.add(name);
+		visited++;
+		if (KNOWN_NATIVE_PACKAGES.has(name)) {
+			found.push({
+				name,
+				reason: "known native module"
+			});
+			continue;
+		}
+		const packageDir = searchRoots.map((root) => path.join(root, ...name.split("/"))).find((dir) => fs.existsSync(path.join(dir, "package.json")));
+		if (!packageDir) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+		} catch {
+			continue;
+		}
+		if (pkg.gypfile || fs.existsSync(path.join(packageDir, "binding.gyp"))) {
+			found.push({
+				name,
+				reason: "builds a native addon (binding.gyp)"
+			});
+			continue;
+		}
+		const install = `${pkg.scripts?.install ?? ""} ${pkg.scripts?.preinstall ?? ""} ${pkg.scripts?.postinstall ?? ""}`;
+		if (/node-gyp|prebuild|node-pre-gyp|cmake-js/.test(install)) {
+			found.push({
+				name,
+				reason: "install script compiles native code"
+			});
+			continue;
+		}
+		if (hasNodeBinary(packageDir)) {
+			found.push({
+				name,
+				reason: "ships a prebuilt .node binary"
+			});
+			continue;
+		}
+		for (const dep of Object.keys(pkg.dependencies ?? {})) if (!seen.has(dep)) queue.push(dep);
+	}
+	return found;
+}
+/** Shallow scan for `.node` binaries — deep enough for the usual `build/Release`. */
+function hasNodeBinary(dir, depth = 0) {
+	if (depth > 3) return false;
+	let entries;
+	try {
+		entries = fs.readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return false;
+	}
+	for (const entry of entries) {
+		if (entry.isFile() && entry.name.endsWith(".node")) return true;
+		if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".bin") {
+			if (hasNodeBinary(path.join(dir, entry.name), depth + 1)) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a dependency name resolves to a package *inside this repository* — a
+* workspace package rather than a registry one.
+*
+* The bundle's declared deps are installed with `npm install` from the public
+* registry beside the bundle at boot. A workspace package is not there, so
+* declaring it guarantees a boot-time install failure. The most common case is
+* the standard `config` package: the backend depends on it by name, but it is
+* *carried in the bundle* (as `entry.config`), so it must never also be an npm
+* dependency. Projects often express this as a `workspace:` range — caught
+* separately — but a plain `"*"` against a workspace symlink is just as common
+* and looks like a registry range, so the symlink is what actually settles it.
+*
+* Detection: the installed `node_modules/<name>` is a symlink whose real path is
+* inside the project and not within a pnpm virtual store (`.pnpm`). That is
+* exactly a workspace link and nothing else.
+*/
+function resolvesToWorkspacePackage(projectRoot, name) {
+	let realRoot;
+	try {
+		realRoot = fs.realpathSync(projectRoot);
+	} catch {
+		realRoot = projectRoot;
+	}
+	for (const base of [
+		projectRoot,
+		path.join(projectRoot, "backend"),
+		path.join(projectRoot, "config")
+	]) {
+		const link = path.join(base, "node_modules", name);
+		try {
+			if (!fs.lstatSync(link).isSymbolicLink()) continue;
+			const real = fs.realpathSync(link);
+			const insideRepo = real.startsWith(realRoot + path.sep);
+			const inStore = real.includes(`${path.sep}.pnpm${path.sep}`) || real.includes(`${path.sep}node_modules${path.sep}`);
+			if (insideRepo && !inStore) return true;
+		} catch {}
+	}
+	return false;
+}
+/**
+* Collect the runtime dependencies a bundle needs installed beside it.
+*
+* Packages the runtime image already provides are excluded — reinstalling a
+* second copy of the server next to the one running the process is at best
+* wasted space and at worst a version conflict. Workspace packages are excluded
+* too: they are not on the registry the runtime installs from, and the project's
+* own config package already travels inside the bundle.
+*/
+function collectDeclaredDependencies(projectRoot) {
+	const declared = {};
+	for (const relative of [
+		"backend/package.json",
+		"config/package.json",
+		"package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+				if (RUNTIME_PROVIDED.has(name)) continue;
+				if (typeof version === "string" && version.startsWith("workspace:")) continue;
+				if (resolvesToWorkspacePackage(projectRoot, name)) continue;
+				declared[name] = version;
+			}
+		} catch {}
+	}
+	return declared;
+}
+/**
+* Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
+*
+* TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
+* lets a project write `from "./posts"` or `from "./collections"`, and TypeScript
+* emits them unchanged on the assumption that a bundler will finish the job.
+* Nothing bundles a Rebase bundle — the runtime imports these files directly with
+* Node's ESM loader, which requires a full path with an extension and refuses
+* directory imports outright.
+*
+* Without this, adopting the bundle would mean asking every project written in
+* the (extremely common) extensionless style to rewrite all of its imports. The
+* rewrite is mechanical and verifiable: only relative specifiers are touched, and
+* only when the target file actually exists on disk.
+*/
+function normalizeEsmSpecifiers(outDir) {
+	const unresolved = [];
+	let rewritten = 0;
+	const SPECIFIER = /(\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)(["'])(\.[^"']*)\2/g;
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, entry.name);
+			if (entry.isDirectory()) {
+				if (entry.name === "node_modules") continue;
+				walk(full);
+			} else if (entry.isFile() && entry.name.endsWith(".js")) rewriteFile(full);
+		}
+	};
+	const rewriteFile = (file) => {
+		const original = fs.readFileSync(file, "utf8");
+		const dir = path.dirname(file);
+		const updated = original.replace(SPECIFIER, (match, prefix, quote, specifier) => {
+			if (/\.(js|mjs|cjs|json|node)$/.test(specifier)) return match;
+			const target = path.resolve(dir, specifier);
+			if (fs.existsSync(`${target}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}.js${quote}`;
+			}
+			if (fs.existsSync(path.join(target, "index.js"))) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}${specifier.endsWith("/") ? "index.js" : "/index.js"}${quote}`;
+			}
+			if (specifier.endsWith(".ts") && fs.existsSync(`${target.slice(0, -3)}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier.slice(0, -3)}.js${quote}`;
+			}
+			unresolved.push(`${path.basename(file)} → ${specifier}`);
+			return match;
+		});
+		if (updated !== original) fs.writeFileSync(file, updated, "utf8");
+	};
+	if (fs.existsSync(outDir)) walk(outDir);
+	return {
+		rewritten,
+		unresolved
+	};
+}
+/**
+* Remove a previous build so stale output cannot masquerade as current.
+*
+* The containment check matters because this is a recursive force-delete of a
+* path that came from a command-line flag: `rebase build --out ../..` would
+* otherwise erase the parent of the project. The manifest's own paths are
+* checked the same way; a flag deserves no less.
+*/
+function cleanOutDir(projectRoot, outDir) {
+	const relative = path.relative(projectRoot, outDir);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Refusing to build into "${outDir}": the output directory must be inside the project.`);
+	if (fs.existsSync(outDir)) fs.rmSync(outDir, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(outDir, { recursive: true });
+}
+/**
+* Regenerate the Drizzle schema from the collections.
+*
+* Delegated to the database driver's own CLI — the same code `rebase schema
+* generate` runs — so there is one implementation of what a schema is. When no
+* driver is resolvable the build continues with a warning rather than failing:
+* a `baas` project has no schema to generate, and a project mid-install should
+* get a clear message rather than a hard stop.
+*/
+async function regenerateSchema(projectRoot, configDir, options) {
+	const backendDir = path.join(projectRoot, "backend");
+	if (!fs.existsSync(backendDir)) return;
+	const plugin = getActiveBackendPlugin(backendDir);
+	const script = plugin ? resolvePluginCliScript(backendDir, plugin) : null;
+	if (!script) {
+		log(options, chalk.dim("  (no database driver found — skipping schema generation)"));
+		return;
+	}
+	const runner = script.endsWith(".ts") ? resolveTsx(projectRoot) : "node";
+	if (!runner) {
+		log(options, chalk.dim("  (tsx not installed — skipping schema generation)"));
+		return;
+	}
+	const collectionsPath = path.join("..", configDir, "collections");
+	try {
+		await execa(runner, [
+			script,
+			"schema",
+			"generate",
+			"--collections",
+			collectionsPath
+		], {
+			cwd: backendDir,
+			stdio: "pipe"
+		});
+		log(options, chalk.dim("  regenerated database schema from collections"));
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		throw new Error(`Schema generation failed, so the bundle was not written.\n${detail}\nRun \`rebase schema generate\` to see the full output, or pass --skip-schema if the committed schema is deliberately hand-maintained.`);
+	}
+}
+/**
+* A hand-written server entrypoint that a bundle does not use.
+*
+* `rebase dev` runs `backend/src/index.ts` whenever a project has one, so for
+* the whole of local development that file *is* the server and every route
+* written in it works. A bundle has no entrypoint of its own: the runtime boots
+* the bundle and mounts what the manifest points at — the config package,
+* functions, crons and the schema. The file is not compiled, not shipped, and
+* never imported.
+*
+* Nothing said so. A project with custom routes in its entrypoint built clean,
+* deployed green, and answered 404 on every one of them, with the file still
+* sitting in the repository looking exactly like the server.
+*
+* A project that means to keep its own entrypoint declares the app as
+* `"type": "custom"`, which builds the repository's Dockerfile instead — which
+* is what {@link synthesizeManifest} already infers for a manifest-less repo
+* carrying one. The warning names that route rather than implying the file is
+* a mistake.
+*/
+function findUnusedServerEntry(projectRoot, functionsDir) {
+	const found = [path.join("backend", "src", "index.ts"), path.join(path.dirname(functionsDir), "src", "index.ts")].find((candidate) => fs.existsSync(path.join(projectRoot, candidate)));
+	return found ? found.split(path.sep).join("/") : void 0;
+}
+/**
+* Compile and assemble a bundle.
+*/
+async function buildBundle(options) {
+	const { projectRoot, app, appName } = options;
+	const paths = resolveBackendPaths(app);
+	const outDir = path.resolve(projectRoot, options.outDir ?? "dist-bundle");
+	const includes = [];
+	const addIfExists = (relative, pattern) => {
+		if (fs.existsSync(path.join(projectRoot, relative))) includes.push(pattern);
+	};
+	if (paths.mode === "cms") addIfExists(paths.config, `${paths.config}/**/*.ts`);
+	addIfExists(paths.functions, `${paths.functions}/**/*.ts`);
+	addIfExists(paths.crons, `${paths.crons}/**/*.ts`);
+	if (fs.existsSync(path.join(projectRoot, paths.schema))) includes.push(paths.schema);
+	if (includes.length === 0) throw new Error(`Nothing to build for app "${appName}". Expected a config directory at "${paths.config}" or functions at "${paths.functions}".`);
+	if (paths.mode === "cms" && options.skipSchema !== true) await regenerateSchema(projectRoot, paths.config, options);
+	const unusedEntry = findUnusedServerEntry(projectRoot, paths.functions);
+	if (unusedEntry) {
+		const parts = [
+			...paths.mode === "cms" ? [`${paths.config}/`] : [],
+			`${paths.functions}/`,
+			"the schema"
+		];
+		const compiled = `${parts.slice(0, -1).join(", ")} and ${parts[parts.length - 1]}`;
+		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
+		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
+		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
+		console.log(chalk.dim(`      or declare this app as "type": "custom" in rebase.json to keep your own entrypoint.`));
+	}
+	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
+	cleanOutDir(projectRoot, outDir);
+	const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options.skipTypeCheck === true);
+	const tsc = resolveLocalBin(projectRoot, "tsc");
+	if (!tsc) throw new Error("TypeScript is not installed in this project. Run your package manager's install first.");
+	try {
+		await execa(tsc, ["-p", tsconfigPath], {
+			cwd: projectRoot,
+			stdio: "inherit"
+		});
+	} catch {
+		throw new Error("TypeScript compilation failed — the bundle was not written.");
+	}
+	const normalized = normalizeEsmSpecifiers(outDir);
+	if (normalized.rewritten > 0) log(options, chalk.dim(`  resolved ${normalized.rewritten} relative import(s) for Node ESM`));
+	if (normalized.unresolved.length > 0) {
+		console.log(chalk.yellow(`  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`));
+		for (const item of normalized.unresolved.slice(0, 5)) console.log(chalk.dim(`      ${item}`));
+		if (normalized.unresolved.length > 5) console.log(chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));
+	}
+	const compiledConfigDir = path.join(outDir, paths.config);
+	const compiledCollectionsDir = path.join(compiledConfigDir, "collections");
+	let collections = [];
+	if (paths.mode === "cms") {
+		collections = await loadSourceCollections(path.join(projectRoot, paths.config, "collections"));
+		if (collections.length === 0) throw new Error(`No collections were found in ${path.join(paths.config, "collections")}. A cms-mode project must define at least one collection.`);
+		if (!fs.existsSync(compiledCollectionsDir)) throw new Error(`Compilation produced no collections directory at ${path.relative(projectRoot, compiledCollectionsDir)}.`);
+	}
+	const declared = collectDeclaredDependencies(projectRoot);
+	const nativeModules = detectNativeDependencies(projectRoot, declared);
+	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
+	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
+	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
+	const manifest = {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: options.runtimeRange,
+			builtAgainst: resolveServerVersion(projectRoot),
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: paths.mode === "baas" ? "" : computeSchemaVersion(collections),
+		app: appName,
+		mode: paths.mode,
+		entry: {
+			config: paths.mode === "cms" ? relative(paths.config) : void 0,
+			collections: paths.mode === "cms" ? relative(path.join(paths.config, "collections")) : void 0,
+			functions: relative(paths.functions),
+			crons: relative(paths.crons),
+			schema: relative(schemaOut),
+			usersCollection: paths.mode === "cms" ? relative(path.join(paths.config, `${paths.usersCollection}.js`)) : void 0
+		},
+		collections: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
+		hooks: {
+			native: nativeModules.length > 0,
+			nativeModules: nativeModules.length > 0 ? nativeModules : void 0
+		},
+		storage: { authorize: declaresStorageAuthorize },
+		deps: { declared },
+		build: {
+			cli: resolveCliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	};
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: declared
+	}, null, 2)}\n`, "utf8");
+	return {
+		outDir,
+		manifest,
+		collectionCount: collections.length
+	};
+}
+/**
+* Package a built static app (a `static` or bundled-`admin` app) into a bundle.
+*
+* A static bundle is the counterpart to a backend bundle: the same shape, the
+* same runtime image runs it, but its manifest says `mode: "static"` and it
+* carries only the built assets under `static/`. That is what lets a frontend or
+* admin app be its own deployable, scalable unit rather than something baked into
+* the backend container.
+*
+* `assetsDir` is the app's built output (e.g. `frontend/dist`), already produced
+* by its own build command. This copies it into the bundle and writes the
+* manifest — no compilation, no dependency closure (a static bundle installs
+* nothing at boot).
+*/
+/**
+* Fold a built static app into a backend bundle, so one runtime serves both.
+*
+* ## Why this exists
+*
+* A managed tenant runs one pod, and `bootFromBundle` on the backend path already
+* knows how to serve a SPA — it looks for `entry.static` and mounts `serveSPA`
+* last, behind `REBASE_SERVE_STATIC`. What was missing was anything putting the
+* assets there.
+*
+* The consequence was not subtle. A project whose custom image served its website
+* at `/` and its API at `/api` — the shape the scaffolded template produces — lost
+* the website the moment it moved to the managed runtime: the API answered
+* perfectly and every page 404'd. Managed could not be a drop-in replacement for
+* custom while the frontend simply vanished.
+*
+* Folding restores parity with the container it replaces, which is the only
+* honest baseline. It is deliberately the FIRST implementation and not the last:
+* a static app on its own bucket behind a CDN is better for cache behaviour and
+* lets the frontend deploy independently. But that needs infrastructure that does
+* not exist yet, and "your site is gone" is not an acceptable state to leave a
+* project in while it gets built.
+*
+* The trade it makes, stated plainly: frontend and backend now deploy together
+* and the bundle carries the built assets. For a project that was shipping both
+* in one image already, that is exactly what it had.
+*/
+function foldStaticIntoBundle(options) {
+	const { bundleDir, assetsDir } = options;
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);
+	if (!fs.existsSync(assetsDir)) throw new Error(`No built assets at ${assetsDir}.`);
+	const staticOut = path.join(bundleDir, "static");
+	fs.rmSync(staticOut, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	manifest.entry = {
+		...manifest.entry,
+		static: "static"
+	};
+	fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	return { fileCount };
+}
+function buildStaticBundle(options) {
+	const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;
+	cleanOutDir(projectRoot, outDir);
+	const staticOut = path.join(outDir, "static");
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	const manifest = {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: runtimeRange,
+			builtAgainst: resolveServerVersion(projectRoot),
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: "",
+		app: appName,
+		mode: "static",
+		entry: { static: "static" },
+		hooks: { native: false },
+		deps: { declared: {} },
+		build: {
+			cli: resolveCliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	};
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: {}
+	}, null, 2)}\n`, "utf8");
+	return {
+		outDir,
+		manifest,
+		fileCount
+	};
+}
+/**
+* Which files in a collections directory are collections.
+*
+* Mirrors the runtime loader's rules exactly, and must keep mirroring them: the
+* set of files counted here decides the schema version, and the runtime decides
+* what it serves the same way. A divergence would show up as a client that is
+* permanently "out of date" against a server that agrees with it.
+*
+* (`._*` guards macOS AppleDouble files, which look like sources and are not.)
+*/
+function isCollectionSourceFile(name) {
+	if (name.startsWith(".")) return false;
+	if (name.includes(".test.") || name.includes(".spec.")) return false;
+	if (name.endsWith(".d.ts")) return false;
+	if (name === "index.ts" || name === "index.js") return false;
+	return name.endsWith(".ts") || name.endsWith(".js");
+}
+/**
+* Load collections from **source**, for hashing and for the manifest's slug list.
+*
+* Deliberately not the compiled output. A compiled bundle imports its
+* dependencies from beside itself — that is the whole point of shipping a
+* `package.json` with it — but at build time nothing has been installed there
+* yet, and under pnpm the project's own `node_modules` lives one directory per
+* package, so the emitted files genuinely cannot resolve their imports until
+* they are deployed.
+*
+* Reading source costs nothing in fidelity: compilation erases types, it does
+* not change the values a collection module exports, so the hash is the same
+* either way.
+*/
+async function loadSourceCollections(collectionsDir) {
+	if (!fs.existsSync(collectionsDir)) return [];
+	const { createJiti } = await import("jiti");
+	const jiti = createJiti(path.join(collectionsDir, "index.ts"), {
+		interopDefault: true,
+		esmResolve: true
+	});
+	const files = fs.readdirSync(collectionsDir).filter(isCollectionSourceFile).sort();
+	const collections = [];
+	const failures = [];
+	for (const file of files) try {
+		const mod = await jiti.import(path.join(collectionsDir, file));
+		const collection = mod.default ?? mod;
+		if (collection && typeof collection === "object" && "slug" in collection) collections.push(collection);
+		else failures.push(`${file}: no default-exported collection`);
+	} catch (err) {
+		failures.push(`${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (failures.length > 0) throw new Error(`Could not read ${failures.length} collection file(s):\n` + failures.map((f) => `  • ${f}`).join("\n"));
+	return collections;
+}
+/** The `@rebasepro/server` version the project resolves — what it was built against. */
+function resolveServerVersion(projectRoot) {
+	const candidates = [path.join(projectRoot, "node_modules", "@rebasepro", "server", "package.json"), path.join(projectRoot, "backend", "node_modules", "@rebasepro", "server", "package.json")];
+	for (const candidate of candidates) {
+		if (!fs.existsSync(candidate)) continue;
+		try {
+			return JSON.parse(fs.readFileSync(candidate, "utf8")).version;
+		} catch {}
+	}
+	return "unknown";
+}
+function resolveCliVersion() {
+	try {
+		let dir = path.dirname(new URL(import.meta.url).pathname);
+		for (let i = 0; i < 5; i++) {
+			const candidate = path.join(dir, "package.json");
+			if (fs.existsSync(candidate)) {
+				const pkg = JSON.parse(fs.readFileSync(candidate, "utf8"));
+				if (pkg.name === "@rebasepro/cli" && pkg.version) return pkg.version;
+			}
+			dir = path.dirname(dir);
+		}
+	} catch {}
+	return "unknown";
+}
+//#endregion
+//#region src/fold-static.ts
+/**
+* Folding a project's frontend into its backend bundle.
+*
+* Shared by `rebase build` and `rebase cloud deploy` deliberately. It lived in
+* the build *command* first, and `deploy` rebuilds the bundle itself — so a
+* deploy silently produced a bundle without the frontend, packed 164 KB where
+* 39 MB was expected, and the site 404'd on the managed runtime exactly as if
+* folding had never been written. Two callers building the same artefact must
+* share the step that completes it.
+*
+* Why fold at all: `bootFromBundle` already serves a SPA from `entry.static`
+* behind `REBASE_SERVE_STATIC` (default on). A managed tenant runs one pod, so
+* putting the built site in the bundle gives it the shape a custom container
+* already had — site at `/`, API at `/api` — which is the only honest baseline
+* for calling the managed runtime a drop-in replacement.
+*/
+/**
+* Which static app, if any, should be served by the backend.
+*
+* Exactly one `static` app is folded. With several, folding would have to choose,
+* and silently picking one of two websites is worse than doing nothing — so it
+* declines and names what it saw. Pure, so the decision is testable without a
+* filesystem.
+*/
+function selectFoldableApp(manifest) {
+	const statics = Object.entries(manifest.apps ?? {}).filter(([, app]) => app?.type === "static").map(([name, app]) => ({
+		name,
+		build: app?.build,
+		output: app?.output
+	}));
+	if (statics.length === 0) return {};
+	if (statics.length > 1) return { reason: `${statics.length} static apps (${statics.map((s) => s.name).join(", ")}) — none folded in. Pick one to serve from the backend, or host them separately.` };
+	const only = statics[0];
+	if (!only.output) return { reason: `"${only.name}" declares no output directory — not folded in.` };
+	return { app: only };
+}
+/**
+* Build the project's frontend and fold it into the backend bundle.
+*
+* Throws rather than exiting, so the caller decides whether a missing frontend
+* should fail its command — a `build` may reasonably want to stop, and so should
+* a deploy, but that is not this function's call to make.
+*/
+async function foldFrontendIntoBundle(options) {
+	const { projectRoot, manifest, bundleDir, skipBuild } = options;
+	const log = options.log ?? ((m) => console.log(m));
+	const { app, reason } = selectFoldableApp(manifest);
+	if (reason) {
+		log(chalk.yellow(`    ⚠ ${reason}`));
+		return null;
+	}
+	if (!app) return null;
+	if (app.build && !skipBuild) await execa(app.build, {
+		cwd: projectRoot,
+		stdio: "inherit",
+		shell: true
+	});
+	const assetsDir = path.join(projectRoot, app.output);
+	if (!fs.existsSync(assetsDir)) throw new Error(`"${app.name}" declared output "${app.output}" does not exist after building — the bundle would ship without a frontend.`);
+	const { fileCount } = foldStaticIntoBundle({
+		bundleDir,
+		assetsDir
+	});
+	return {
+		appName: app.name,
+		fileCount
+	};
+}
+//#endregion
+//#region src/commands/build.ts
+/**
+* CLI command: rebase build [app...]
+*
+* Builds the apps a repository declares in `rebase.json`.
+*
+* For a `backend` app this produces a **bundle** — compiled collections,
+* functions and schema plus a manifest — which is the artifact the runtime
+* loads. For `static` and bundled `admin` apps it runs the declared build
+* command and reports where the output landed.
+*
+* A project with no manifest, or one whose backend has been ejected to its own
+* entrypoint, falls back to the previous behaviour: run every workspace's own
+* `build` script. Nothing that built before stops building.
+*/
+function printHelp$3() {
+	console.log(`
+${chalk.bold("rebase build")} — build the apps declared in rebase.json
+
+${chalk.bold("Usage")}
+  rebase build [app...]        Build the named apps (default: all)
+
+${chalk.bold("Options")}
+  --out <dir>                  Bundle output directory (default: ${DEFAULT_BUNDLE_DIR})
+  --skip-type-check            Compile without type checking (faster; use for iteration only)
+  --skip-schema                Do not regenerate the database schema from collections
+  --legacy                     Run every workspace's own build script instead
+  -h, --help                   Show this help
+
+${chalk.bold("Examples")}
+  rebase build                 Build every app in this repository
+  rebase build backend         Build only the backend bundle
+  rebase build web             Build only the "web" static app
+`.trim());
+}
+async function buildCommand(rawArgs = []) {
+	const args = arg({
+		"--out": String,
+		"--skip-type-check": Boolean,
+		"--skip-schema": Boolean,
+		"--no-static": Boolean,
+		"--skip-static-build": Boolean,
+		"--legacy": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printHelp$3();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	if (args["--legacy"]) {
+		await runWorkspaceBuilds(projectRoot);
+		return;
+	}
+	let loaded;
+	try {
+		loaded = loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) {
+			console.error(chalk.red(`✗ ${err.message}`));
+			for (const issue of err.issues) console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : ""}${issue.message}`));
+			process.exit(1);
+		}
+		throw err;
+	}
+	const { manifest, source } = loaded;
+	const requested = args._.filter((a) => !a.startsWith("-"));
+	let targets = buildableApps(manifest);
+	if (requested.length > 0) {
+		const known = new Set(targets.map((t) => t.name));
+		const unknown = requested.filter((name) => !known.has(name));
+		if (unknown.length > 0) {
+			console.error(chalk.red(`✗ Unknown app(s): ${unknown.join(", ")}`));
+			console.error(chalk.dim(`  This repository declares: ${targets.map((t) => t.name).join(", ") || "(none)"}`));
+			process.exit(1);
+		}
+		targets = targets.filter((t) => requested.includes(t.name));
+	}
+	if (targets.length === 0) {
+		console.log(chalk.yellow("No buildable apps declared. Nothing to do."));
+		return;
+	}
+	if (!findBackendApp(manifest) && source === "synthesized") {
+		console.log(chalk.dim("No rebase.json found — building workspace packages.\n"));
+		await runWorkspaceBuilds(projectRoot);
+		return;
+	}
+	console.log(`${chalk.bold("Rebase")} — building ${targets.length} app(s)\n`);
+	for (const { name, app } of targets) {
+		console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));
+		if (app.type === "backend") {
+			const result = await buildBundle({
+				projectRoot,
+				appName: name,
+				app,
+				outDir: args["--out"],
+				runtimeRange: manifest.runtime,
+				skipTypeCheck: args["--skip-type-check"],
+				skipSchema: args["--skip-schema"]
+			});
+			const rel = path.relative(projectRoot, result.outDir);
+			console.log(chalk.green(`  ✓ bundle → ${rel}/`));
+			console.log(chalk.dim(`    ${result.collectionCount} collection(s), schema ${result.manifest.schemaVersion}`));
+			if (result.manifest.hooks.native) {
+				const names = (result.manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
+				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
+				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
+			}
+			if (!args["--no-static"]) {
+				const folded = await foldFrontendIntoBundle({
+					projectRoot,
+					manifest,
+					bundleDir: result.outDir,
+					skipBuild: args["--skip-static-build"] === true,
+					log: (m) => console.log(m)
+				}).catch((err) => {
+					console.error(chalk.red(`    ✗ ${err instanceof Error ? err.message : String(err)}`));
+					process.exit(1);
+				});
+				if (folded) console.log(chalk.green(`    ✓ ${folded.appName} folded in`) + chalk.dim(` (${folded.fileCount} file(s) → served at /)`));
+			}
+		} else if (app.type === "static" || app.type === "admin") await buildAssetApp(projectRoot, name, app, manifest.runtime, args["--out"]);
+		else if (app.type === "custom") console.log(chalk.dim("  custom container — built at deploy time from its Dockerfile"));
+		console.log("");
+	}
+	console.log(chalk.green("✓ Build complete."));
+}
+/**
+* Build a static or bundled-admin app and package it into a static bundle.
+*
+* Runs the app's own build command, checks it produced the declared output, then
+* packages that output into a `static`-mode bundle — the same deployable shape as
+* a backend bundle, so a frontend or admin app deploys through the identical
+* path and runs on the identical image, just serving files instead of an API.
+*/
+async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride) {
+	const asset = app;
+	if (app.type === "admin" && app.mode !== "bundled") {
+		console.log(chalk.dim("  hosted admin panel — nothing to build"));
+		return;
+	}
+	if (!asset.build) {
+		console.log(chalk.dim("  no build command declared — skipping"));
+		return;
+	}
+	try {
+		await execa(asset.build, {
+			cwd: projectRoot,
+			stdio: "inherit",
+			shell: true
+		});
+	} catch {
+		console.error(chalk.red(`  ✗ build command failed for "${name}"`));
+		process.exit(1);
+	}
+	if (!asset.output) {
+		console.log(chalk.yellow("  no output directory declared — built, but nothing to bundle"));
+		return;
+	}
+	const outputPath = path.join(projectRoot, asset.output);
+	if (!fs.existsSync(outputPath)) {
+		console.error(chalk.red(`  ✗ declared output "${asset.output}" does not exist after building`));
+		process.exit(1);
+	}
+	const result = buildStaticBundle({
+		projectRoot,
+		appName: name,
+		assetsDir: outputPath,
+		outDir: outOverride ? path.resolve(process.cwd(), outOverride) : path.join(projectRoot, `dist-bundle-${name}`),
+		runtimeRange
+	});
+	const rel = path.relative(projectRoot, result.outDir);
+	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s))`));
+}
+/** The pre-manifest behaviour: build every workspace package. */
+async function runWorkspaceBuilds(projectRoot) {
 	const pm = detectPackageManager(projectRoot);
 	const buildCmd = getPMCommands(pm).runAll("build");
 	console.log(`${chalk.bold("Rebase")} — Building all workspaces with ${chalk.cyan(pm)}...\n`);
@@ -2223,16 +3902,124 @@ async function buildCommand() {
 /**
 * CLI command: rebase start
 *
-* Starts the backend server in production mode.
-* Automatically detects the package manager (pnpm or npm) and
-* runs the start script in the backend workspace.
+* Runs a built bundle through the Rebase runtime — the same path the official
+* container image takes, so what you test locally is what a deployment runs.
+*
+* When there is no bundle (an ejected backend, or a project that has not adopted
+* `rebase.json`) this falls back to the backend workspace's own `start` script,
+* which is what such a project has always used.
 */
-async function startCommand() {
+function printHelp$2() {
+	console.log(`
+${chalk.bold("rebase start")} — run a built bundle
+
+${chalk.bold("Usage")}
+  rebase start [options]
+
+${chalk.bold("Options")}
+  --bundle <dir>     Bundle directory (default: ${DEFAULT_BUNDLE_DIR})
+  --legacy           Run the backend workspace's own start script
+  -h, --help         Show this help
+
+Build first with ${chalk.cyan("rebase build")}.
+`.trim());
+}
+async function startCommand(rawArgs = []) {
+	const args = arg({
+		"--bundle": String,
+		"--legacy": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printHelp$2();
+		return;
+	}
 	const projectRoot = requireProjectRoot();
-	const startCmd = getPMCommands(detectPackageManager(projectRoot)).runWorkspace("backend", "start");
 	const envFile = findEnvFile(projectRoot);
 	const env = { ...process.env };
 	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	const bundleDir = path.resolve(projectRoot, args["--bundle"] ?? "dist-bundle");
+	const hasBundle = fs.existsSync(path.join(bundleDir, "manifest.json"));
+	if (args["--legacy"] || !hasBundle) {
+		if (!args["--legacy"] && !hasBundle) console.log(chalk.dim(`No bundle at ${path.relative(projectRoot, bundleDir)}/ — starting the backend workspace instead.
+`));
+		await startWorkspaceBackend(projectRoot, env);
+		return;
+	}
+	ensureBundleDependencies(projectRoot, bundleDir);
+	console.log(`${chalk.bold("Rebase")} — starting runtime from ${chalk.cyan(path.relative(projectRoot, bundleDir))}/\n`);
+	if (envFile && fs.existsSync(envFile)) (await import("dotenv")).config({ path: envFile });
+	process.env.REBASE_BUNDLE = bundleDir;
+	try {
+		const { runFromBundle } = await import("@rebasepro/server");
+		await runFromBundle({ bundleDir });
+	} catch (err) {
+		console.error(chalk.red("\n✗ Failed to start the runtime."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+}
+/**
+* Make a bundle's imports resolvable for a local run.
+*
+* Node resolves a module by walking up from the *importing file*, so compiled
+* code sitting in `dist-bundle/` no longer sees the per-package `node_modules`
+* its source could: pnpm and npm both install a workspace package's
+* dependencies inside that package, and the bundle is not inside any of them.
+*
+* A deployment solves this by installing the bundle's own `package.json` beside
+* it — that is what the generated `package.json` is for. Locally, doing a second
+* install to run code whose dependencies are already on disk would be wasteful,
+* so this links what is already there instead.
+*
+* Only ever created when absent, and only under the bundle directory, so a real
+* install always wins and nothing here is ever uploaded (`rebase build` cleans
+* the directory and never writes this).
+*/
+function ensureBundleDependencies(projectRoot, bundleDir) {
+	const target = path.join(bundleDir, "node_modules");
+	if (fs.existsSync(target)) return;
+	const sources = [
+		"backend/node_modules",
+		"config/node_modules",
+		"node_modules"
+	].map((relative) => path.join(projectRoot, relative)).filter((dir) => fs.existsSync(dir));
+	if (sources.length === 0) return;
+	let linked = 0;
+	fs.mkdirSync(target, { recursive: true });
+	const linkInto = (sourceDir, targetDir) => {
+		let entries;
+		try {
+			entries = fs.readdirSync(sourceDir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (entry.name === ".bin" || entry.name.startsWith(".")) continue;
+			const from = path.join(sourceDir, entry.name);
+			const to = path.join(targetDir, entry.name);
+			if (entry.name.startsWith("@") && entry.isDirectory()) {
+				fs.mkdirSync(to, { recursive: true });
+				linkInto(from, to);
+				continue;
+			}
+			if (fs.existsSync(to)) continue;
+			try {
+				fs.symlinkSync(fs.realpathSync(from), to, "junction");
+				linked++;
+			} catch {}
+		}
+	};
+	for (const source of sources) linkInto(source, target);
+	if (linked > 0) console.log(chalk.dim(`  linked ${linked} package(s) into the bundle for this local run\n  (a deployment installs the bundle's package.json instead)
+`));
+}
+async function startWorkspaceBackend(projectRoot, env) {
+	const startCmd = getPMCommands(detectPackageManager(projectRoot)).runWorkspace("backend", "start");
 	console.log(`${chalk.bold("Rebase")} — Starting backend server...\n`);
 	try {
 		await execa(startCmd[0], startCmd.slice(1), {
@@ -3109,6 +4896,55 @@ async function whoamiCommand(rawArgs) {
 * `link` associates the current directory with a cloud project by writing
 * `.rebase/cloud.json`; deploy/logs/status then operate on it with no flags.
 */
+/**
+* Link this checkout straight at a running backend.
+*
+* No control plane, no authentication, no project id — just the URL of a Rebase
+* API. This is what makes the multi-repo workflow available to self-hosters: a
+* frontend repository links to `https://api.example.com` and then generates its
+* typed SDK from that project exactly as a cloud-linked repository would.
+*
+* The URL is verified before it is written. Recording an unreachable address and
+* failing later, in a different command, would be a worse experience than
+* failing here where the user can see what they typed.
+*/
+async function linkDirect(target, rawArgs) {
+	let base;
+	try {
+		base = new URL(target);
+	} catch {
+		fail(`"${target}" is not a valid URL.`);
+		return;
+	}
+	if (base.protocol !== "http:" && base.protocol !== "https:") fail("A project URL must be http or https.");
+	const apiUrl = base.toString().replace(/\/+$/, "");
+	const probe = `${apiUrl}/api/meta/schema-version`;
+	let reachable = false;
+	let detail = "";
+	try {
+		const response = await fetch(probe, { headers: { accept: "application/json" } });
+		reachable = response.ok;
+		if (!response.ok) detail = `responded ${response.status}`;
+	} catch (err) {
+		detail = err instanceof Error ? err.message : String(err);
+	}
+	if (!reachable) {
+		console.log(chalk.yellow(`⚠ Could not reach ${probe}${detail ? ` (${detail})` : ""}.`));
+		console.log(chalk.dim("  Linking anyway — the server may not be running yet."));
+		console.log(chalk.dim("  It must be a Rebase backend of version 0.11 or newer."));
+	}
+	writeLink({
+		url: apiUrl,
+		projectId: "",
+		apiUrl,
+		mode: "direct",
+		projectName: base.host
+	});
+	success(`Linked to ${apiUrl}`);
+	console.log(chalk.dim(`  Written to ${projectLinkPath()}`));
+	console.log("");
+	console.log(`Next: ${chalk.cyan("rebase generate-sdk --from link")}`);
+}
 async function linkCommand(rawArgs) {
 	const args = arg({
 		"--project": String,
@@ -3117,6 +4953,11 @@ async function linkCommand(rawArgs) {
 		argv: rawArgs.slice(3),
 		permissive: true
 	});
+	const positional = args._.find((value) => /^https?:\/\//i.test(value));
+	if (positional) {
+		await linkDirect(positional, rawArgs);
+		return;
+	}
 	const { client, url } = await requireClient(rawArgs);
 	try {
 		let project;
@@ -3132,7 +4973,7 @@ async function linkCommand(rawArgs) {
 			})).data;
 			if (projects.length === 0) fail("No projects found for your account.", `Create one with ${chalk.bold("rebase cloud projects create")}.`);
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select a project to link:",
 				choices: projects.map((p) => ({
@@ -3176,7 +5017,7 @@ async function selectOrgCommand(rawArgs) {
 		let chosen = target ? orgs.find((o) => String(o.id) === target || o.slug === target) : void 0;
 		if (!chosen && !target) {
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select the active organization:",
 				choices: orgs.map((o) => ({
@@ -3412,6 +5253,121 @@ function fmtDate(value) {
 	return isNaN(d.getTime()) ? value : d.toLocaleString();
 }
 //#endregion
+//#region src/commands/cloud/bundle-deploy.ts
+/**
+* Deploying a project as a managed **bundle** rather than a source build.
+*
+* `rebase cloud deploy --bundle` builds the bundle, tars it, uploads it to the
+* control plane's bundle endpoint, and triggers a deploy carrying the bundle id
+* and its generated manifest. The control plane resolves a runtime from the
+* manifest's range and runs the platform image with this bundle — the managed
+* path. A project not in managed mode, or one whose bundle fails intake, is told
+* so by the control plane; this side just packages and hands it over.
+*
+* The pieces here are separated from the network calls so they can be tested: the
+* manifest read, the tar packaging, and the request body assembly are pure enough
+* to check without a control plane.
+*/
+/** Read and shallow-validate a built bundle's manifest. */
+function readBundleManifest(bundleDir) {
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest.json in ${bundleDir}. Run \`rebase build\` first.`);
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (typeof manifest.bundleFormat !== "number" || !manifest.runtime?.range) throw new Error(`${manifestPath} is not a valid bundle manifest.`);
+	return manifest;
+}
+/**
+* Tar a built bundle into a gzipped archive.
+*
+* `node_modules` is excluded on purpose: the bundle ships a `package.json`, and
+* the managed runtime installs the declared dependencies at boot. Uploading an
+* installed `node_modules` would bloat the archive and could carry a
+* platform-specific build that will not run on the runtime image.
+*/
+function packBundle(bundleDir, outPath) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("tar", [
+			"-czf",
+			outPath,
+			"--no-xattrs",
+			"--exclude",
+			"node_modules",
+			"-C",
+			bundleDir,
+			"."
+		], {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				COPYFILE_DISABLE: "1"
+			}
+		});
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`tar exited ${code}`)));
+	});
+}
+/**
+* Assemble the deploy-trigger body for a bundle deploy.
+*
+* The manifest travels with the trigger so the control plane can validate intake
+* without unpacking the uploaded archive first — a rejection (native deps, no
+* matching runtime) is then a fast, cheap answer.
+*/
+function bundleDeployBody(input) {
+	return {
+		projectId: input.projectId,
+		bundleId: input.bundleId,
+		bundleManifest: input.manifest,
+		app: input.app ?? input.manifest.app ?? "backend",
+		client: "cli",
+		frameworkVersion: input.manifest.runtime?.builtAgainst,
+		...input.declaredApps?.length ? { declaredApps: input.declaredApps } : {},
+		...input.message ? { message: input.message } : {}
+	};
+}
+/**
+* The apps a project manifest declares.
+*
+* A deploy only ever ships ONE app's bundle, so the trigger alone could never
+* tell the platform that the repository also contains a web frontend and an
+* admin panel — and the Apps page, whose whole job is to show the set, listed a
+* single entry called "backend". Sending the declared set fixes that without
+* pretending the others are deployed: the platform registers them, and their
+* status says what is actually true.
+*/
+function declaredAppsFrom(manifest) {
+	const apps = manifest?.apps;
+	if (!apps || typeof apps !== "object") return [];
+	return Object.entries(apps).filter(([name]) => name.trim().length > 0).map(([name, value]) => ({
+		name,
+		type: String(value?.type ?? "custom")
+	}));
+}
+/** Upload a bundle archive; returns the control-plane bundle id. */
+async function uploadBundle(url, token, projectId, tarPath) {
+	const bytes = fs.readFileSync(tarPath);
+	const res = await fetch(`${url}/api/functions/deploy/bundle/upload?projectId=${encodeURIComponent(projectId)}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/gzip"
+		},
+		body: bytes
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Bundle upload failed (${res.status}): ${body || res.statusText}`);
+	}
+	const data = await res.json();
+	if (!data.bundleId) throw new Error("Bundle upload endpoint did not return a bundle id.");
+	return data.bundleId;
+}
+//#endregion
 //#region src/commands/cloud/deploy.ts
 /**
 * `rebase cloud deploy` and `rebase cloud logs`.
@@ -3419,6 +5375,12 @@ function fmtDate(value) {
 * `deploy` triggers the control-plane `deploy` function, then tails the build
 * logs from the deployment record until it succeeds or fails. `logs` shows the
 * latest build log, or runtime logs with `--runtime`.
+*
+* There are three deploys behind the one verb, and which one runs depends on the
+* flags: `--bundle` builds and uploads a managed bundle, `--source .` uploads
+* this directory as a build context, and the bare form uploads nothing and asks
+* the control plane to rebuild what it already holds. That last one is the
+* dangerous one — see `planBareDeploy`.
 */
 var POLL_INTERVAL_MS = 1500;
 var POLL_TIMEOUT_MS = 900 * 1e3;
@@ -3520,11 +5482,183 @@ async function uploadSource(url, token, projectId, tarPath) {
 	if (!data.source) fail("Upload endpoint did not return a source reference.");
 	return data.source;
 }
+/**
+* Build, upload and deploy a project as a managed bundle.
+*
+* Builds the backend app into `dist-bundle` (unless one is pointed at with
+* `--bundle-dir`), packs it without `node_modules`, uploads it, and triggers a
+* deploy carrying the manifest so the control plane can validate intake fast.
+*/
+async function deployBundle(opts) {
+	const { client, url, projectId, projectRef } = opts;
+	const projectRoot = requireProjectRoot();
+	let bundleDir = opts.bundleDir ? path.resolve(process.cwd(), opts.bundleDir) : path.join(projectRoot, "dist-bundle");
+	if (!opts.bundleDir) {
+		const loaded = loadManifest(projectRoot);
+		const backend = findBackendApp(loaded.manifest);
+		if (!backend) fail("This repository declares no backend app to deploy as a bundle.", "A managed deploy runs the backend; declare one in rebase.json, or deploy from the backend's repository.");
+		console.log(chalk.gray("  Building bundle..."));
+		bundleDir = (await buildBundle({
+			projectRoot,
+			appName: backend.name,
+			app: backend.app,
+			runtimeRange: loaded.manifest.runtime,
+			skipTypeCheck: opts.skipTypeCheck,
+			log: (m) => console.log(chalk.gray(m))
+		})).outDir;
+		try {
+			const folded = await foldFrontendIntoBundle({
+				projectRoot,
+				manifest: loaded.manifest,
+				bundleDir,
+				log: (m) => console.log(m)
+			});
+			if (folded) console.log(chalk.gray(`  folded ${folded.appName} in (${folded.fileCount} file(s), served at /)`));
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
+		}
+	}
+	const manifest = readBundleManifest(bundleDir);
+	if (manifest.hooks?.native) {
+		const names = (manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
+		fail(`This bundle depends on native modules${names ? ` (${names})` : ""}, which the managed runtime cannot run.`, "Remove the native dependency, or deploy on the custom runtime.");
+	}
+	const tarPath = path.join(os.tmpdir(), `rebase-bundle-${Date.now()}.tar.gz`);
+	const token = client.auth.getSession()?.accessToken;
+	if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
+	let bundleId;
+	try {
+		await packBundle(bundleDir, tarPath);
+		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
+		console.log(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		bundleId = await uploadBundle(url, token, projectId, tarPath);
+	} catch (e) {
+		fail(e instanceof Error ? e.message : String(e));
+		return;
+	} finally {
+		fs.rmSync(tarPath, { force: true });
+	}
+	console.log("");
+	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	let declaredApps = [];
+	try {
+		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
+	} catch {}
+	const body = bundleDeployBody({
+		projectId,
+		bundleId,
+		manifest,
+		message: opts.message,
+		declaredApps
+	});
+	try {
+		const res = await client.functions.invoke("deploy", body);
+		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
+		if (isJsonMode()) printJson({
+			success: true,
+			deploymentId: String(res.deployment.id),
+			managed: res.managed === true
+		});
+		else {
+			console.log(chalk.green(`  ✓ Managed deploy started (deployment ${res.deployment.id}).`));
+			console.log(chalk.gray("    Track it with `rebase cloud logs` or in the console."));
+		}
+	} catch (e) {
+		reportError(e, "Managed deploy failed to start");
+	}
+}
+function pick(row, ...keys) {
+	for (const key of keys) {
+		const raw = row?.[key];
+		if (typeof raw === "string" && raw.trim() !== "") return raw.trim();
+	}
+}
+/** Rough age of a timestamp, for "…uploaded 6d ago". Undefined if unreadable. */
+function timeAgo(value, now) {
+	if (value === void 0) return void 0;
+	const then = value instanceof Date ? value.getTime() : new Date(value).getTime();
+	if (Number.isNaN(then)) return void 0;
+	const ms = now.getTime() - then;
+	if (ms < 0) return void 0;
+	const minutes = Math.floor(ms / 6e4);
+	if (minutes < 1) return "just now";
+	if (minutes < 60) return `${minutes}m ago`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ago`;
+	return `${Math.floor(hours / 24)}d ago`;
+}
+/**
+* Whether this project runs on the managed runtime.
+*
+* `runtimeMode` on the project row is the authority — the control plane writes
+* it. The bundle-id fallback covers a control plane that does not return the
+* field: a successful deploy that served a bundle only happens on the managed
+* path.
+*/
+function isManagedProject(project, latest) {
+	if (pick(project, "runtimeMode", "runtime_mode") === "managed") return true;
+	return latest?.status === "success" && pick(latest, "bundleId", "bundle_id") !== void 0;
+}
+/** What a `deploy` with nothing attached will build, in the words to print. */
+function planBareDeploy(project, latest, now) {
+	const projectRow = project;
+	const deploymentRow = latest;
+	const managed = isManagedProject(project, latest);
+	const repo = pick(projectRow, "gitRepoUrl", "git_repo_url");
+	if (repo) {
+		const branch = pick(projectRow, "gitBranch", "git_branch");
+		return {
+			managed,
+			source: "git",
+			lines: [`Building from git: ${repo}${branch ? ` (${branch})` : ""}.`]
+		};
+	}
+	if (pick(deploymentRow, "sourceRef", "source_ref")) {
+		const age = timeAgo(latest?.createdAt ?? latest?.created_at, now);
+		return {
+			managed,
+			source: "snapshot",
+			lines: [`Rebuilding the stored source archive${latest?.id !== void 0 ? ` from deployment ${latest.id}` : ""}${age ? `, uploaded ${age}` : ""}.`, "This directory is NOT uploaded — pass `--source .` to build what is on disk."]
+		};
+	}
+	return {
+		managed,
+		source: "none",
+		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
+	};
+}
+/** The one sentence that says a source build undoes `runtimeMode: managed`. */
+function ejectWarning(projectRef) {
+	return `⚠ ${projectRef} runs on the managed runtime — a source build ejects it to a custom container.`;
+}
+/**
+* Read the two rows the preflight needs.
+*
+* Best effort by construction: a preflight that cannot read is a preflight that
+* says nothing, never a deploy that fails. The managed refusal rides on the same
+* read, so an unreadable project falls through to the old behaviour rather than
+* blocking a deploy on a lookup.
+*/
+async function readDeployContext(client, projectId) {
+	try {
+		const [project, latest] = await Promise.all([client.data.collection("projects").findById(projectId), latestDeployment(client, projectId)]);
+		return {
+			project,
+			latest
+		};
+	} catch {
+		return {};
+	}
+}
 async function deployCommand(rawArgs, projectRef) {
 	const args = arg({
 		"--no-follow": Boolean,
 		"--source": String,
 		"--message": String,
+		"--bundle": Boolean,
+		"--bundle-dir": String,
+		"--skip-type-check": Boolean,
+		"--force": Boolean,
 		"-m": "--message"
 	}, {
 		argv: rawArgs.slice(2),
@@ -3532,6 +5666,33 @@ async function deployCommand(rawArgs, projectRef) {
 	});
 	const { client, url } = await requireClient(rawArgs);
 	const projectId = await resolveProjectRef(projectRef, client);
+	if (args["--bundle"]) {
+		if (args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
+		await deployBundle({
+			client,
+			url,
+			projectId,
+			projectRef,
+			bundleDir: args["--bundle-dir"],
+			message: args["--message"],
+			skipTypeCheck: args["--skip-type-check"] === true
+		});
+		return;
+	}
+	const { project, latest } = await readDeployContext(client, projectId);
+	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
+	if (!args["--source"]) {
+		if (plan.managed && args["--force"] !== true) fail(`${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`, "Redeploy it with `rebase cloud deploy --bundle`. To eject on purpose, pass `--source .` to build this directory, or `--force` to build what the control plane holds.", "managed_project");
+		if (!isJsonMode()) {
+			console.log("");
+			if (plan.managed) console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
+			for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
+		}
+	} else if (plan.managed && !isJsonMode()) {
+		console.log("");
+		console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
+		console.log(chalk.gray("    Use `rebase cloud deploy --bundle` to stay on managed."));
+	}
 	let source;
 	if (args["--source"]) {
 		const tarPath = await createSourceTarball(args["--source"]);
@@ -3911,7 +6072,7 @@ async function createDatabase(rawArgs) {
 	let type = args["--type"];
 	if (!type) {
 		const { picked } = await inquirer.prompt([{
-			type: "list",
+			type: "select",
 			name: "picked",
 			message: "Database type:",
 			choices: [{
@@ -6743,7 +8904,7 @@ ${chalk.green.bold("Projects")}
   ${chalk.blue.bold("projects delete")} ${chalk.gray("[id]")}    Delete a project
 
 ${chalk.green.bold("Deploy & observe")}
-  ${chalk.blue.bold("deploy")} ${chalk.gray("[--source .] [-m msg]")}  Deploy the linked project + stream build logs
+  ${chalk.blue.bold("deploy")} ${chalk.gray("[--bundle|--source .]")}   Deploy the linked project + stream build logs
   ${chalk.blue.bold("logs")} ${chalk.gray("[--runtime] [-f]")}   Show build (or runtime) logs
   ${chalk.blue.bold("deployments list")} ${chalk.gray("[--limit N|--all]")}  Deployment history ${chalk.gray("(status, duration, trigger)")}
   ${chalk.blue.bold("rollback")} ${chalk.gray("[id] [-y]")}       Roll back to a successful deploy
@@ -6786,6 +8947,199 @@ ${chalk.gray("Docs: https://rebase.pro/docs")}
 `);
 }
 //#endregion
+//#region src/commands/apps.ts
+/**
+* CLI command: rebase apps
+*
+* Inspect the apps this repository contributes to a project, adopt a
+* `rebase.json` for a project that predates it, and print the client bootstrap
+* an app needs to reach its backend.
+*
+* The distinction that runs through all of this: a *repository* declares apps,
+* a *project* owns them. Two repositories can contribute to the same project and
+* never know about each other, which is what makes a separate frontend repo — or
+* a mobile app with no repo relationship at all — an ordinary thing rather than
+* a special case.
+*/
+function printHelp$1() {
+	console.log(`
+${chalk.bold("rebase apps")} — the apps this repository contributes
+
+${chalk.bold("Usage")}
+  rebase apps list             List declared apps and their build outputs
+  rebase apps init             Write a rebase.json inferred from this project
+  rebase apps config <app>     Print the client configuration for an app
+
+${chalk.bold("Options")}
+  --json                       Machine-readable output
+  --force                      Overwrite an existing rebase.json (apps init)
+  -h, --help                   Show this help
+`.trim());
+}
+async function appsCommand(subcommand, rawArgs = []) {
+	const args = arg({
+		"--json": Boolean,
+		"--force": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"] || !subcommand || subcommand === "--help") {
+		printHelp$1();
+		return;
+	}
+	switch (subcommand) {
+		case "list":
+			await listApps(Boolean(args["--json"]));
+			break;
+		case "init":
+			await initManifest(Boolean(args["--force"]));
+			break;
+		case "config":
+			await printAppConfig(args._[1], Boolean(args["--json"]));
+			break;
+		default:
+			console.error(chalk.red(`Unknown subcommand: ${subcommand}`));
+			console.log("");
+			printHelp$1();
+			process.exit(1);
+	}
+}
+function describeApp(app) {
+	switch (app.type) {
+		case "backend": return `config: ${app.config ?? "config"}, mode: ${app.mode ?? "cms"}`;
+		case "static": return `${app.root} → ${app.output}`;
+		case "admin": return app.mode === "bundled" ? `bundled → ${app.output ?? "?"}` : "hosted by the platform";
+		case "mobile": return app.platform;
+		case "custom": return app.dockerfile ?? "Dockerfile";
+		default: return "";
+	}
+}
+async function listApps(asJson) {
+	const loaded = loadManifestOrExit(requireProjectRoot());
+	const compatibility = assessManagedCompatibility(loaded.manifest);
+	if (asJson) {
+		console.log(JSON.stringify({
+			source: loaded.source,
+			runtime: loaded.manifest.runtime,
+			apps: loaded.manifest.apps,
+			managed: compatibility
+		}, null, 2));
+		return;
+	}
+	if (loaded.source === "synthesized") {
+		console.log(chalk.dim("No rebase.json — showing the layout inferred from this project."));
+		console.log(chalk.dim(`Run ${chalk.cyan("rebase apps init")} to write it down.\n`));
+	}
+	console.log(chalk.bold(`Runtime  ${loaded.manifest.runtime}`));
+	console.log("");
+	const entries = Object.entries(loaded.manifest.apps);
+	if (entries.length === 0) {
+		console.log(chalk.yellow("No apps declared."));
+		return;
+	}
+	const width = Math.max(...entries.map(([name]) => name.length));
+	for (const [name, app] of entries) console.log(`  ${chalk.cyan(name.padEnd(width))}  ${chalk.dim(app.type.padEnd(8))}  ${describeApp(app)}`);
+	console.log("");
+	if (compatibility.eligible) console.log(chalk.green("✓ Eligible for the managed runtime."));
+	else {
+		console.log(chalk.yellow("• Uses the custom runtime:"));
+		for (const reason of compatibility.reasons) console.log(chalk.dim(`    ${reason}`));
+	}
+}
+async function initManifest(force) {
+	const projectRoot = requireProjectRoot();
+	if (manifestExists(projectRoot) && !force) {
+		console.error(chalk.red("✗ rebase.json already exists."));
+		console.error(chalk.dim("  Pass --force to overwrite it."));
+		process.exit(1);
+	}
+	const manifest = synthesizeManifest(projectRoot);
+	const filePath = writeManifest(projectRoot, manifest);
+	console.log(chalk.green(`✓ Wrote ${path.relative(projectRoot, filePath)}`));
+	console.log("");
+	for (const [name, app] of Object.entries(manifest.apps)) console.log(`  ${chalk.cyan(name)} ${chalk.dim(`(${app.type})`)}`);
+	const compatibility = assessManagedCompatibility(manifest);
+	if (!compatibility.eligible) {
+		console.log("");
+		console.log(chalk.yellow("This project will use the custom runtime:"));
+		for (const reason of compatibility.reasons) console.log(chalk.dim(`  ${reason}`));
+	}
+}
+/**
+* Print what a client needs to reach this project.
+*
+* Never prints a secret. The API URL and an app's publishable identity are meant
+* to ship inside a client bundle; anything that is not safe there does not belong
+* in output that will inevitably be pasted into a `.env` that gets committed.
+*/
+async function printAppConfig(appName, asJson) {
+	const projectRoot = requireProjectRoot();
+	const loaded = loadManifestOrExit(projectRoot);
+	if (!appName) {
+		console.error(chalk.red("✗ Which app? Usage: rebase apps config <app>"));
+		process.exit(1);
+	}
+	const app = loaded.manifest.apps[appName];
+	if (!app) {
+		console.error(chalk.red(`✗ No app named "${appName}" in rebase.json.`));
+		console.error(chalk.dim(`  Declared: ${Object.keys(loaded.manifest.apps).join(", ") || "(none)"}`));
+		process.exit(1);
+	}
+	const link = readLink(projectRoot);
+	const apiUrl = resolveApiUrl(projectRoot, link);
+	const config = {
+		app: appName,
+		type: app.type,
+		apiUrl: apiUrl ?? null,
+		project: link?.projectId ?? link?.slug ?? null
+	};
+	if (asJson) {
+		console.log(JSON.stringify(config, null, 2));
+		return;
+	}
+	if (!apiUrl) {
+		console.log(chalk.yellow("This checkout is not linked to a project yet."));
+		console.log(chalk.dim(`  Run ${chalk.cyan("rebase link")} (cloud) or ${chalk.cyan("rebase link <url>")} (self-hosted).`));
+		console.log("");
+	}
+	console.log(chalk.bold(`# ${appName}`));
+	console.log("");
+	console.log(`VITE_API_URL=${apiUrl ?? "http://localhost:3001"}`);
+	console.log("");
+	console.log(chalk.dim("Then, in the app:"));
+	console.log(chalk.dim("  const rebase = createRebaseClient({ baseUrl: import.meta.env.VITE_API_URL });"));
+}
+/**
+* Work out the API base URL for this checkout.
+*
+* Prefers an explicit link, then the dev server's own record of where it bound.
+* The dev port is chosen dynamically, so a hardcoded default would be wrong on
+* any machine running more than one project.
+*/
+function resolveApiUrl(projectRoot, link) {
+	if (link?.apiUrl) return link.apiUrl;
+	const statePath = path.join(projectRoot, ".rebase", "state.json");
+	if (fs.existsSync(statePath)) try {
+		const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		if (state.baseUrl) return state.baseUrl;
+	} catch {}
+}
+function loadManifestOrExit(projectRoot) {
+	try {
+		return loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) {
+			console.error(chalk.red(`✗ ${err.message}`));
+			for (const issue of err.issues) console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : ""}${issue.message}`));
+			process.exit(1);
+		}
+		throw err;
+	}
+}
+//#endregion
 //#region src/cli.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path.dirname(__filename);
@@ -6823,7 +9177,9 @@ async function entry(args) {
 		"doctor",
 		"skills",
 		"api-keys",
-		"cloud"
+		"cloud",
+		"apps",
+		"generate-sdk"
 	].includes(command)) {
 		printHelp();
 		return;
@@ -6837,8 +9193,12 @@ async function entry(args) {
 			const sdkArgs = arg({
 				"--collections-dir": String,
 				"--output": String,
+				"--from": String,
+				"--token": String,
+				"--help": Boolean,
 				"-c": "--collections-dir",
-				"-o": "--output"
+				"-o": "--output",
+				"-h": "--help"
 			}, {
 				argv: args.slice(3),
 				permissive: true
@@ -6846,6 +9206,9 @@ async function entry(args) {
 			await generateSdkCommand({
 				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
 				output: sdkArgs["--output"] || "./generated/sdk",
+				from: sdkArgs["--from"],
+				token: sdkArgs["--token"],
+				help: sdkArgs["--help"],
 				cwd: process.cwd()
 			});
 			break;
@@ -6860,10 +9223,13 @@ async function entry(args) {
 			await devCommand(args);
 			break;
 		case "build":
-			await buildCommand();
+			await buildCommand(args);
 			break;
 		case "start":
-			await startCommand();
+			await startCommand(args);
+			break;
+		case "apps":
+			await appsCommand(effectiveSubcommand, args);
 			break;
 		case "auth":
 			await authCommand(effectiveSubcommand, args);
@@ -6944,6 +9310,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { authCommand, buildCommand, buildInitQuestions, cloudCommand, configureEnvFile, createRebaseApp, dbCommand, detectPackageManager, devCommand, doctorCommand, entry, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isPnpmAvailable, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, validateProjectName, validateTsxInstallation };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map