@rebasepro/cli 0.11.1-canary.gfd39654 → 0.12.1-canary.g009ed95

package/dist/index.es.js

@@ -12,7 +12,7 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
-import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections } from "@rebasepro/types";
+import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, normalizeStorageSources, storageEnvSuffix } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
 import { createRequire } from "module";
 //#region src/utils/package-manager.ts
@@ -355,8 +355,9 @@ function requireProjectRoot() {
 	const root = findProjectRoot();
 	if (!root) {
 		console.error(chalk.red("✗ Could not find a Rebase project root."));
-		console.error(chalk.gray("  Make sure you are inside a Rebase project directory"));
-		console.error(chalk.gray("  (one with backend/, frontend/, and config/ directories)."));
+		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
+		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
+		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
 		process.exit(1);
 	}
 	return root;
@@ -532,7 +533,7 @@ async function requireClient(rawArgs) {
 * the ingress and the console read — see saas/backend/src/utils/tenant-domain.ts).
 *
 * The CLI cannot know this value: it is per-deployment configuration (production
-* serves tenants at `apps.rebase.pro`, a dev control plane at `localhost`). It
+* serves tenants at `rebase.website`, a dev control plane at `localhost`). It
 * used to be hardcoded to `rebase.pro`, so `cloud projects create` congratulated
 * the user with a URL that resolves nowhere near their app.
 *
@@ -602,6 +603,39 @@ function removeLink(cwd = process.cwd()) {
 	}
 	return false;
 }
+/**
+* Flags that may appear anywhere on a `rebase cloud` line, including *before*
+* the resource group.
+*
+* They have to be declared wherever positionals are resolved, because `arg`'s
+* `permissive: true` does not merely tolerate an undeclared flag — it pushes it
+* into `_` alongside the positionals, and for a flag that takes a value it
+* pushes the value in too. So `cloud --project acme storage create` parsed
+* without this spec yields `_` of `["--project", "acme", "storage", "create"]`,
+* and the group reads as `"acme"`: a real project name, in the group position,
+* dispatching to nothing. Skipping tokens that start with `-` does not save you
+* there — the damage is the orphaned value, which looks exactly like a
+* positional.
+*
+* Only genuinely global flags belong here. Group-specific ones (`--bucket`,
+* `--region`, …) are declared by the handler that owns them and always follow
+* the group, so they cannot shift the group or action.
+*
+* `-p` is `--project` in eighteen places and `--password` in `login`. That
+* ambiguity does not matter to the one caller that reads this spec: it resolves
+* positionals and never looks at a flag's value, so all it needs to know is
+* that `-p` takes one. Anything that wants the value must keep declaring it
+* itself, with the meaning its own command gives it.
+*/
+var GLOBAL_CLOUD_FLAGS = {
+	"--json": Boolean,
+	"--yes": Boolean,
+	"--help": Boolean,
+	"--project": String,
+	"-p": "--project",
+	"-y": "--yes",
+	"-h": "--help"
+};
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
 * The raw project reference to operate on: explicit `--project` flag wins,
@@ -707,6 +741,35 @@ function emit(human, json) {
 	if (JSON_MODE) printJson(json);
 	else human();
 }
+/**
+* Print a warning (+ optional hint) — in every output mode, always to stderr.
+*
+* `emit` is for a command's *result*, and JSON mode legitimately replaces the
+* human rendering of one. A warning is not a result: it says the command is
+* about to do something the caller may not have meant, and that is exactly as
+* true when the output is piped. Gating one on `!isJsonMode()` deleted it
+* precisely where nobody was watching the terminal — a `--source` deploy ejected
+* a live project off the managed runtime and said so only to a TTY that wasn't
+* there.
+*
+* stdout carries the JSON value and nothing else, so warnings go to stderr:
+* a machine parser reading stdout cannot be corrupted by one. Only the
+* *formatting* may depend on the mode — colour and indentation for a terminal,
+* plain ASCII otherwise. Whether a warning is emitted at all may not.
+*
+* Anything a caller might branch on belongs in the JSON payload as well; stderr
+* is for whoever reads the transcript afterwards.
+*/
+function warn(message, hint) {
+	if (JSON_MODE) {
+		process.stderr.write(`warning: ${stripAnsi(message)}\n`);
+		if (hint) process.stderr.write(`  ${stripAnsi(hint)}\n`);
+		return;
+	}
+	console.error("");
+	console.error(chalk.yellow(`  ⚠ ${message}`));
+	if (hint) console.error(chalk.gray(`    ${hint}`));
+}
 /** Print an error (+ optional hint) and exit non-zero. Never returns. */
 function fail(message, hint, code) {
 	if (JSON_MODE) {
@@ -829,7 +892,7 @@ function openUrl(target, label = "Opening") {
 //#region src/commands/init.ts
 var access = promisify(fs.access);
 var __filename$1 = fileURLToPath(import.meta.url);
-var __dirname$1 = path.dirname(__filename$1);
+var __dirname$2 = path.dirname(__filename$1);
 function findParentDir(currentDir, targetName) {
 	const root = path.parse(currentDir).root;
 	while (currentDir && currentDir !== root) {
@@ -838,22 +901,56 @@ function findParentDir(currentDir, targetName) {
 	}
 	return null;
 }
-var cliRoot = findParentDir(__dirname$1, "cli");
+var cliRoot = findParentDir(__dirname$2, "cli");
 var PROJECT_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+/**
+* Every scaffolded file that carries a `{{PLACEHOLDER}}`.
+*
+* Exported because it is the single source of truth: `init.test.ts` reads it and
+* asserts that every template file containing `{{` appears here. It used to be a
+* local, with the test harness keeping a *second* copy — so the two drifted, and
+* a test built on the copy could not observe the production list at all.
+*
+* The drift shipped: `docker-compose.yml` arrived with the self-host work
+* (26fd5259c) and was added to neither, so every scaffolded project got a literal
+* `name: {{PROJECT_NAME}}`. In YAML `{{...}}` is a map, not a string, so the
+* documented `docker compose up` path failed on the file before doing anything:
+*
+*   yaml: unmarshal errors: line 28: cannot unmarshal !!map into string
+*/
+var TEMPLATE_PLACEHOLDER_FILES = [
+	"package.json",
+	"frontend/package.json",
+	"backend/package.json",
+	"config/package.json",
+	"frontend/index.html",
+	"pnpm-workspace.yaml",
+	"docker-compose.yml",
+	"README.md"
+];
 /** Returns an error message, or null when the name is a valid package name. */
 function validateProjectName(name) {
 	if (!name.trim()) return "Project name is required";
 	if (!PROJECT_NAME_RE.test(name)) return "Project name must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, dots, or underscores";
 	return null;
 }
-var FLAVOR_CHOICES = [{
-	name: "BaaS + admin  — API plus an admin UI, driven by collections you define (like Payload/Directus)",
-	value: "cms",
-	short: "BaaS + admin"
+/**
+* Whether to scaffold the admin panel alongside the backend.
+*
+* A boolean, not a named pair. It was `--flavor cms|baas`, and neither word
+* survived what they described: "cms" is a product category rather than a thing
+* this tool builds, and "baas" was the same value that used to appear as
+* `backend.mode` — which is now derived from whether collections are declared.
+* What is left is one question: does this project get an admin UI?
+*/
+var HEADLESS_CHOICES = [{
+	name: "Backend + admin  — API plus an admin UI, driven by collections you define (like Payload/Directus)",
+	value: false,
+	short: "Backend + admin"
 }, {
-	name: "BaaS only     — headless API over your database. No collections, no UI (like Supabase)",
-	value: "baas",
-	short: "BaaS only"
+	name: "Backend only     — headless API over your database. No collections, no UI (like Supabase)",
+	value: true,
+	short: "Backend only"
 }];
 var PRESET_CHOICES = [
 	{
@@ -878,7 +975,7 @@ var PRESET_CHOICES = [
 * types registered by the installed version of inquirer.
 */
 function buildInitQuestions(params) {
-	const { nameArg, templateArg, flavorArg, hasGitFlag, hasInstallFlag, pm } = params;
+	const { nameArg, templateArg, headlessArg, hasGitFlag, hasInstallFlag, pm } = params;
 	const questions = [];
 	if (!nameArg) questions.push({
 		type: "input",
@@ -887,12 +984,12 @@ function buildInitQuestions(params) {
 		default: "my-rebase-app",
 		validate: (input) => validateProjectName(input) ?? true
 	});
-	if (!flavorArg) questions.push({
+	if (headlessArg === void 0) questions.push({
 		type: "select",
-		name: "flavor",
+		name: "headless",
 		message: "What do you want to build?",
-		choices: FLAVOR_CHOICES,
-		default: "cms"
+		choices: HEADLESS_CHOICES,
+		default: false
 	});
 	if (!templateArg) questions.push({
 		type: "select",
@@ -900,7 +997,7 @@ function buildInitQuestions(params) {
 		message: "Choose a starter template:",
 		choices: PRESET_CHOICES,
 		default: "blog",
-		when: (answers) => (flavorArg ?? answers.flavor) !== "baas"
+		when: (answers) => !(headlessArg ?? answers.headless)
 	});
 	if (!hasGitFlag) questions.push({
 		type: "confirm",
@@ -956,7 +1053,7 @@ ${chalk.bold("Usage")}
 
 ${chalk.bold("Options")}
   ${chalk.blue("-t, --template")} ${chalk.gray("<preset>")}   blog | ecommerce | blank ${chalk.gray("(default: blog)")}
-  ${chalk.blue("-f, --flavor")} ${chalk.gray("<flavor>")}     cms | baas ${chalk.gray("(default: cms)")}
+  ${chalk.blue("--headless")}                Backend only — no admin panel, no collections
   ${chalk.blue("-y, --yes")}                 Accept defaults, never prompt ${chalk.gray("(required for CI / non-TTY)")}
   ${chalk.blue("-i, --install")}             Install dependencies after scaffolding
   ${chalk.blue("-g, --git")}                 Initialize a git repository and make an initial commit
@@ -965,14 +1062,14 @@ ${chalk.bold("Options")}
   ${chalk.blue("--project")} ${chalk.gray("<slug>")}          Link the scaffold to a Rebase Cloud project
   ${chalk.blue("--setup-key")} ${chalk.gray("<key>")}         One-time key authenticating the cloud link ${chalk.gray("(use with --project)")}
 
-${chalk.bold("Flavors")}
-  ${chalk.blue("cms")}   BaaS + admin UI, driven by collections you define ${chalk.gray("(like Payload/Directus)")}
-  ${chalk.blue("baas")}  Headless API over your database — no collections, no UI ${chalk.gray("(like Supabase)")}
-        ${chalk.gray("--template has no effect on this flavor.")}
+${chalk.bold("What gets scaffolded")}
+  ${chalk.gray("default")}     Backend + an admin UI, driven by collections you define ${chalk.gray("(like Payload/Directus)")}
+  ${chalk.blue("--headless")}  Backend only, over your existing database ${chalk.gray("(like Supabase)")}
+              ${chalk.gray("--template has no effect: there are no collections to seed.")}
 
 ${chalk.bold("Examples")}
   ${chalk.gray("$")} rebase init my-shop --template ecommerce --install
-  ${chalk.gray("$")} rebase init my-api --flavor baas --yes
+  ${chalk.gray("$")} rebase init my-api --headless --yes
   ${chalk.gray("$")} rebase init . --yes --git
 `);
 }
@@ -993,14 +1090,13 @@ async function promptForOptions(rawArgs, pm) {
 		"--database-url": String,
 		"--introspect": Boolean,
 		"--template": String,
-		"--flavor": String,
+		"--headless": Boolean,
 		"--project": String,
 		"--setup-key": String,
 		"--yes": Boolean,
 		"-g": "--git",
 		"-i": "--install",
 		"-t": "--template",
-		"-f": "--flavor",
 		"-y": "--yes"
 	}, {
 		argv: rawArgs.slice(3),
@@ -1021,11 +1117,7 @@ async function promptForOptions(rawArgs, pm) {
 		console.error(chalk.red(`Unknown template "${templateArg}". Available: ${PRESET_CHOICES.map((p) => p.value).join(", ")}`));
 		process.exit(1);
 	}
-	const flavorArg = args["--flavor"];
-	if (flavorArg && !FLAVOR_CHOICES.some((f) => f.value === flavorArg)) {
-		console.error(chalk.red(`Unknown flavor "${flavorArg}". Available: ${FLAVOR_CHOICES.map((f) => f.value).join(", ")}`));
-		process.exit(1);
-	}
+	const headlessArg = args["--headless"] === true ? true : void 0;
 	if (isNonInteractive) {
 		const projectName = nameArg || "my-rebase-app";
 		const targetDirectory = path.resolve(process.cwd(), projectName);
@@ -1041,7 +1133,7 @@ async function promptForOptions(rawArgs, pm) {
 			introspect: args["--introspect"] || false,
 			preset: templateArg || "blog",
 			explicitPreset: !!templateArg,
-			flavor: flavorArg || "cms",
+			headless: headlessArg ?? false,
 			pm,
 			pmCommands,
 			cloudProject: args["--project"] || void 0,
@@ -1052,14 +1144,14 @@ async function promptForOptions(rawArgs, pm) {
 	if (!process.stdin.isTTY) {
 		console.error(chalk.red("Cannot prompt: this is a non-interactive terminal (no TTY)."));
 		console.error(chalk.yellow("  Re-run with --yes to accept defaults, passing any choices as flags, e.g.:"));
-		console.error(chalk.yellow(`    rebase init ${nameArg || "my-app"} --yes --template blog --flavor cms`));
-		console.error(chalk.gray("  Options: --template <blog|ecommerce|blank>  --flavor <cms|baas>  --database-url <url>  --install  --git"));
+		console.error(chalk.yellow(`    rebase init ${nameArg || "my-app"} --yes --template blog`));
+		console.error(chalk.gray("  Options: --template <blog|ecommerce|blank>  --headless  --database-url <url>  --install  --git"));
 		process.exit(1);
 	}
 	const questions = buildInitQuestions({
 		nameArg,
 		templateArg,
-		flavorArg,
+		headlessArg,
 		hasGitFlag: !!args["--git"],
 		hasInstallFlag: !!args["--install"],
 		pm
@@ -1079,7 +1171,7 @@ async function promptForOptions(rawArgs, pm) {
 		introspect: answers.introspect || false,
 		preset: templateArg || answers.preset || "blog",
 		explicitPreset: !!templateArg,
-		flavor: flavorArg || answers.flavor || "cms",
+		headless: headlessArg ?? Boolean(answers.headless),
 		pm,
 		pmCommands,
 		cloudProject: args["--project"] || void 0,
@@ -1163,12 +1255,12 @@ async function createProject$1(options) {
 		const shipped = path.join(options.targetDirectory, from);
 		if (fs.existsSync(shipped)) fs.renameSync(shipped, path.join(options.targetDirectory, to));
 	}
-	if (options.flavor === "baas" && options.explicitPreset) console.log(chalk.yellow(`  Ignoring --template ${options.preset}: the baas flavor has no collections.`));
-	if (options.flavor !== "baas") {
+	if (options.headless && options.explicitPreset) console.log(chalk.yellow(`  Ignoring --template ${options.preset}: a headless project declares no collections.`));
+	if (!options.headless) {
 		if (options.introspect && options.preset !== "blank") console.log(chalk.gray("  Using the blank template: collections will come from your database."));
 		await applyPreset(options.targetDirectory, options.introspect ? "blank" : options.preset);
 	}
-	await applyFlavor(options.targetDirectory, options.flavor);
+	await applyHeadless(options.targetDirectory, options.headless);
 	await replacePlaceholders(options);
 	await configureEnvFile(options.targetDirectory, options.databaseUrl);
 	if (options.git) {
@@ -1266,7 +1358,7 @@ async function createProject$1(options) {
 	console.log("");
 	const runDev = pmCommands.run("dev");
 	const runDbPush = pmCommands.run("db:push");
-	const isBaas = options.flavor === "baas";
+	const isBaas = options.headless;
 	const cdTarget = formatCdTarget(process.cwd(), options.targetDirectory);
 	if (cdTarget) console.log(`  ${chalk.cyan("cd")} ${cdTarget}`);
 	if (!options.installDeps) console.log(`  ${chalk.cyan(installCmd.join(" "))}`);
@@ -1336,18 +1428,31 @@ async function createProject$1(options) {
 * presets directory so the final project is clean.
 */
 /**
-* Reduce the scaffolded project to the chosen flavor.
+* Reduce the scaffolded project to the chosen shape.
 *
-* The base template is the full CMS triad. `baas` drops the frontend and the
-* collections config entirely — there is nothing to define, since the server
-* derives its API from the database — and overlays the files that differ.
+* The base template is the full triad. `--headless` drops the frontend and the
+* declared collections — there is nothing to define, since the server derives
+* its API from the database — and overlays the files that differ.
+*
+* The config *package* stays, holding only `storageAuthorize`. Storage is not
+* under row-level security, so a deployment with file storage enabled and no
+* access model serves every user's files to every signed-in user; the server
+* refuses to boot in that state. Deleting the package outright would leave a
+* headless project with nowhere to put the hook, and the scaffold's own
+* docker-compose.yml enables storage — so the first `docker compose up` would
+* crash-loop.
 */
-async function applyFlavor(targetDirectory, flavor) {
-	if (flavor !== "baas") return;
-	for (const dir of ["frontend", "config"]) fs.rmSync(path.join(targetDirectory, dir), {
+async function applyHeadless(targetDirectory, headless) {
+	if (!headless) return;
+	fs.rmSync(path.join(targetDirectory, "frontend"), {
+		recursive: true,
+		force: true
+	});
+	fs.rmSync(path.join(targetDirectory, "config", "collections"), {
 		recursive: true,
 		force: true
 	});
+	for (const stray of ["admin.d.ts", "frontend-assets.d.ts"]) fs.rmSync(path.join(targetDirectory, "config", stray), { force: true });
 	fs.rmSync(path.join(targetDirectory, "backend", "src", "schema.generated.ts"), { force: true });
 	const overlayDir = path.resolve(cliRoot, "templates", "overlays", "baas");
 	if (!fs.existsSync(overlayDir)) {
@@ -1394,15 +1499,7 @@ function cleanupPresets(presetsDir) {
 	});
 }
 async function replacePlaceholders(options) {
-	const filesToProcess = [
-		"package.json",
-		"frontend/package.json",
-		"backend/package.json",
-		"config/package.json",
-		"frontend/index.html",
-		"pnpm-workspace.yaml",
-		"README.md"
-	];
+	const filesToProcess = TEMPLATE_PLACEHOLDER_FILES;
 	const packageJsonPath = path.resolve(cliRoot, "package.json");
 	let cliVersion = "latest";
 	if (fs.existsSync(packageJsonPath)) cliVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).version || "latest";
@@ -1427,9 +1524,10 @@ async function replacePlaceholders(options) {
 			versionToUse = stdout.trim();
 		} catch {
 			try {
+				const tag = cliVersion.includes("canary") ? "canary" : "latest";
 				const { stdout } = await execa(viewBin, [
 					"view",
-					`${pkgName}@${cliVersion.includes("canary") ? "canary" : "latest"}`,
+					`${pkgName}@${tag}`,
 					"version"
 				]);
 				if (!stdout.trim()) throw new Error("Not found");
@@ -1497,6 +1595,26 @@ async function findAvailablePort(startPort) {
 	while (!await isPortAvailable(port)) port++;
 	return port;
 }
+/**
+* The CLI's own version, which is the runtime image tag a scaffolded project
+* pins. They move together: the CLI, the packages and the runtime image are cut
+* from one release, so the version that installed the project is the version
+* whose runtime can boot its bundle.
+*
+* Falls back to `latest` only when the CLI cannot read its own manifest — a
+* floating tag is worse than a pinned one, but better than a compose file that
+* names a version that was never published.
+*/
+function readCliVersion() {
+	try {
+		const manifest = path.resolve(cliRoot, "package.json");
+		if (fs.existsSync(manifest)) {
+			const pkg = JSON.parse(fs.readFileSync(manifest, "utf-8"));
+			if (typeof pkg.version === "string" && pkg.version) return pkg.version;
+		}
+	} catch {}
+	return "latest";
+}
 async function configureEnvFile(targetDirectory, databaseUrl) {
 	const envExamplePath = path.join(targetDirectory, ".env.example");
 	const envPath = path.join(targetDirectory, ".env");
@@ -1506,11 +1624,22 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		const dbPassword = crypto.randomBytes(16).toString("hex");
 		const serviceKey = crypto.randomBytes(48).toString("base64");
 		let envContent = fs.readFileSync(envPath, "utf-8");
+		envContent = envContent.replace(/^(# ║ {2})(Copy this file to \.env and fill in the values)( +║)$/m, (_match, open, old, close) => {
+			const replacement = "Generated by `rebase init` — the secrets below are already set";
+			const width = old.length + close.length - 1;
+			return open + replacement.slice(0, width).padEnd(width, " ") + "║";
+		});
 		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
+		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
+		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
+		const runtimeVersion = readCliVersion();
+		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, `REBASE_VERSION=${runtimeVersion}`) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\nREBASE_VERSION=${runtimeVersion}\n`;
 		if (databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}\nDATABASE_PASSWORD=${dbPassword}`);
+			const { pinSearchPath } = await import("@rebasepro/server-postgres");
+			const pinnedUrl = pinSearchPath(databaseUrl);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
@@ -2014,21 +2143,51 @@ var ManifestError = class extends Error {
 		this.name = "ManifestError";
 	}
 };
-var APP_TYPES = [
-	"backend",
-	"static",
-	"admin",
-	"mobile",
-	"custom"
-];
+var APP_TYPES = ["backend", "static"];
+/**
+* App types that used to exist, and what replaced each one.
+*
+* Kept so a manifest written against the old vocabulary fails with the fix in
+* hand rather than with `must be one of: backend, static`, which tells a reader
+* what is wrong but not what to write instead.
+*/
+var REMOVED_APP_TYPES = {
+	admin: "the admin panel is an ordinary static app now — declare it as { \"type\": \"static\", \"root\": \"frontend\", \"output\": \"frontend/dist\", \"path\": \"/admin\" }",
+	custom: "who owns the server is a property of the backend now — declare { \"type\": \"backend\", \"runtime\": \"custom\" } instead of a separate app",
+	mobile: "mobile apps are no longer declared in the manifest — nothing consumed this type. Remove the entry"
+};
 /** Reserved because they name things in URLs and CLI output. */
-var RESERVED_APP_NAMES = new Set([
+var RESERVED_APP_NAMES = /* @__PURE__ */ new Set([
 	"api",
 	"health",
 	"metrics",
 	"livez",
 	"_rebase"
 ]);
+/**
+* Validate a static app's public base path.
+*
+* Normalizes to "no trailing slash, except for the root" so that mounting and
+* the `REBASE_APP_BASE` build variable have one shape to reason about.
+*/
+function checkAppPath(value, fieldPath, issues) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || !value.startsWith("/") || value.includes("..")) {
+		issues.push({
+			path: fieldPath,
+			message: "must be an absolute path like \"/admin\""
+		});
+		return;
+	}
+	if (value !== "/" && value.endsWith("/")) {
+		issues.push({
+			path: fieldPath,
+			message: "must not end with a slash — write \"/admin\", not \"/admin/\""
+		});
+		return;
+	}
+	return value;
+}
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2071,6 +2230,73 @@ function checkRelativePath(value, fieldPath, issues, { required }) {
 	}
 	return value;
 }
+/** Fields each app type understands. Anything else is a typo or a newer CLI. */
+var KNOWN_APP_FIELDS = {
+	backend: [
+		"type",
+		"runtime",
+		"config",
+		"functions",
+		"crons",
+		"schema",
+		"usersCollection",
+		"dockerfile",
+		"context",
+		"port"
+	],
+	static: [
+		"type",
+		"root",
+		"build",
+		"output",
+		"path",
+		"spa"
+	]
+};
+/**
+* Report a field this CLI does not recognise.
+*
+* A warning rather than an error, and the distinction matters in both
+* directions. `"pathh": "/admin"` is a typo that would otherwise be silently
+* dropped — the app builds for `/`, mounts at `/`, and the only symptom is that
+* it is not where you put it. But an unknown field is also what an *older* CLI
+* sees when it opens a manifest written for a newer one, and refusing to build
+* over a field that is simply from the future would make every manifest addition
+* a breaking change.
+*
+* So: name it, suggest the near-miss, and carry on.
+*/
+function warnUnknownFields(name, raw, type) {
+	const known = KNOWN_APP_FIELDS[type];
+	if (!known) return;
+	for (const field of Object.keys(raw)) {
+		if (known.includes(field)) continue;
+		const suggestion = known.find((candidate) => isNearMiss(candidate, field));
+		console.warn(`⚠ rebase.json: apps.${name}.${field} is not a field this CLI knows.` + (suggestion ? ` Did you mean "${suggestion}"?` : " It is ignored — your CLI may be older than this manifest."));
+	}
+}
+/** One edit apart, ignoring case: enough for a typo, tight enough to stay quiet. */
+function isNearMiss(a, b) {
+	const x = a.toLowerCase();
+	const y = b.toLowerCase();
+	if (x === y) return true;
+	if (Math.abs(x.length - y.length) > 1) return false;
+	const [shorter, longer] = x.length <= y.length ? [x, y] : [y, x];
+	let i = 0;
+	let j = 0;
+	let edits = 0;
+	while (i < shorter.length && j < longer.length) {
+		if (shorter[i] === longer[j]) {
+			i++;
+			j++;
+			continue;
+		}
+		if (++edits > 1) return false;
+		if (shorter.length === longer.length) i++;
+		j++;
+	}
+	return edits + (longer.length - j) + (shorter.length - i) <= 1;
+}
 function validateApp(name, raw, issues) {
 	const base = `apps.${name}`;
 	if (!isRecord(raw)) {
@@ -2081,6 +2307,13 @@ function validateApp(name, raw, issues) {
 		return;
 	}
 	const type = raw.type;
+	if (typeof type === "string" && REMOVED_APP_TYPES[type]) {
+		issues.push({
+			path: `${base}.type`,
+			message: `"${type}" is no longer an app type — ${REMOVED_APP_TYPES[type]}`
+		});
+		return;
+	}
 	if (typeof type !== "string" || !APP_TYPES.includes(type)) {
 		issues.push({
 			path: `${base}.type`,
@@ -2088,18 +2321,39 @@ function validateApp(name, raw, issues) {
 		});
 		return;
 	}
+	warnUnknownFields(name, raw, type);
 	switch (type) {
-		case "backend":
+		case "backend": {
 			checkRelativePath(raw.config, `${base}.config`, issues, { required: false });
 			checkRelativePath(raw.functions, `${base}.functions`, issues, { required: false });
 			checkRelativePath(raw.crons, `${base}.crons`, issues, { required: false });
 			checkRelativePath(raw.schema, `${base}.schema`, issues, { required: false });
 			checkRelativePath(raw.usersCollection, `${base}.usersCollection`, issues, { required: false });
-			if (raw.mode !== void 0 && raw.mode !== "cms" && raw.mode !== "baas") issues.push({
+			if (raw.mode !== void 0) issues.push({
 				path: `${base}.mode`,
-				message: "must be \"cms\" or \"baas\""
+				message: "is no longer a field — collections come from the config directory when it exists, and are introspected from the database when it does not"
+			});
+			const custom = raw.runtime === "custom";
+			if (raw.runtime !== "managed" && !custom) issues.push({
+				path: `${base}.runtime`,
+				message: "is required, and must be \"managed\" or \"custom\""
+			});
+			for (const field of [
+				"dockerfile",
+				"context",
+				"port"
+			]) if (raw[field] !== void 0 && !custom) issues.push({
+				path: `${base}.${field}`,
+				message: "only applies to a custom runtime — set \"runtime\": \"custom\" to build your own image"
+			});
+			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
+			checkRelativePath(raw.context, `${base}.context`, issues, { required: false });
+			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
+				path: `${base}.port`,
+				message: "must be an integer"
 			});
 			return raw;
+		}
 		case "static":
 			checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
 			checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
@@ -2111,37 +2365,7 @@ function validateApp(name, raw, issues) {
 				path: `${base}.spa`,
 				message: "must be a boolean"
 			});
-			return raw;
-		case "admin": {
-			const mode = raw.mode ?? "hosted";
-			if (mode !== "hosted" && mode !== "bundled") {
-				issues.push({
-					path: `${base}.mode`,
-					message: "must be \"hosted\" or \"bundled\""
-				});
-				return;
-			}
-			if (mode === "bundled") {
-				checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
-				checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
-			}
-			return raw;
-		}
-		case "mobile": {
-			const platform = raw.platform;
-			if (platform !== "ios" && platform !== "android" && platform !== "other") issues.push({
-				path: `${base}.platform`,
-				message: "must be \"ios\", \"android\" or \"other\""
-			});
-			return raw;
-		}
-		case "custom":
-			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
-			checkRelativePath(raw.context, `${base}.context`, issues, { required: false });
-			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
-				path: `${base}.port`,
-				message: "must be an integer"
-			});
+			checkAppPath(raw.path, `${base}.path`, issues);
 			return raw;
 		default: return;
 	}
@@ -2155,10 +2379,13 @@ function validateManifest(raw) {
 		path: "",
 		message: `${MANIFEST_FILENAME} must contain a JSON object`
 	}] };
-	if (typeof raw.runtime !== "string" || raw.runtime.trim() === "") issues.push({
-		path: "runtime",
-		message: `is required, e.g. "^1"`
-	});
+	if (typeof raw.rebase !== "string" || raw.rebase.trim() === "") {
+		const message = typeof raw.runtime === "string" ? `is required, e.g. "^1" — this is the top-level "runtime" key renamed, because "runtime" now means "managed" or "custom" on the backend app` : `is required, e.g. "^1"`;
+		issues.push({
+			path: "rebase",
+			message
+		});
+	}
 	if (!isRecord(raw.apps)) {
 		issues.push({
 			path: "apps",
@@ -2192,55 +2419,148 @@ function validateManifest(raw) {
 		path: "apps",
 		message: "a project may declare at most one backend app"
 	});
+	const byPath = /* @__PURE__ */ new Map();
+	for (const [name, app] of Object.entries(apps)) {
+		if (app.type !== "static") continue;
+		const at = app.path ?? "/";
+		const owner = byPath.get(at);
+		if (owner) {
+			issues.push({
+				path: `apps.${name}.path`,
+				message: `two apps cannot serve the same path — "${owner}" is already at "${at}"`
+			});
+			continue;
+		}
+		byPath.set(at, name);
+	}
+	const storage = validateStorageSources(raw.storage, issues);
 	if (issues.length > 0) return { issues };
 	return {
 		manifest: {
 			$schema: typeof raw.$schema === "string" ? raw.$schema : void 0,
-			runtime: raw.runtime,
-			apps
+			rebase: raw.rebase,
+			apps,
+			...storage ? { storage } : {}
 		},
 		issues
 	};
 }
 /**
+* Validate the `storage` block — which buckets this project uses.
+*
+* Absent means one default source, so `undefined` is a valid answer and not an
+* issue. Everything else is checked strictly, because each key here becomes the
+* suffix of a set of environment variables: a key that cannot become a variable
+* name, or two keys that become the *same* one, are failures worth catching
+* while someone is looking at the file rather than at a tenant serving one
+* bucket's files with another's credentials.
+*/
+function validateStorageSources(raw, issues) {
+	if (raw === void 0) return void 0;
+	if (!isRecord(raw)) {
+		issues.push({
+			path: "storage",
+			message: "must be an object keyed by storage source name"
+		});
+		return;
+	}
+	const sources = {};
+	for (const [key, value] of Object.entries(raw)) {
+		if (!isRecord(value)) {
+			issues.push({
+				path: `storage.${key}`,
+				message: "must be an object"
+			});
+			continue;
+		}
+		if (typeof value.engine !== "string" || value.engine.trim() === "") {
+			issues.push({
+				path: `storage.${key}.engine`,
+				message: "is required, e.g. \"s3\", \"gcs\" or \"local\""
+			});
+			continue;
+		}
+		if (value.transport !== void 0 && value.transport !== "server" && value.transport !== "direct") {
+			issues.push({
+				path: `storage.${key}.transport`,
+				message: "must be \"server\" or \"direct\""
+			});
+			continue;
+		}
+		if (value.label !== void 0 && typeof value.label !== "string") {
+			issues.push({
+				path: `storage.${key}.label`,
+				message: "must be a string"
+			});
+			continue;
+		}
+		try {
+			storageEnvSuffix(key);
+		} catch {
+			issues.push({
+				path: `storage.${key}`,
+				message: "name cannot become an environment variable suffix — use a name containing at least one letter or digit"
+			});
+			continue;
+		}
+		sources[key] = {
+			engine: value.engine,
+			...value.transport !== void 0 ? { transport: value.transport } : {},
+			...value.label !== void 0 ? { label: value.label } : {}
+		};
+	}
+	const collision = findStorageSuffixCollision(Object.keys(sources));
+	if (collision) issues.push({
+		path: `storage.${collision.b}`,
+		message: `maps to the same environment variable suffix ("${collision.suffix || "(none)"}") as "${collision.a}", so the two would read each other's configuration — rename one of them`
+	});
+	return Object.keys(sources).length > 0 ? sources : void 0;
+}
+/**
 * Infer a manifest from a directory that does not have one.
 *
 * This mirrors exactly what the template scaffolds, which is what makes adopting
 * the manifest a no-op for existing projects: the synthesized result is what
 * they would have written by hand.
 *
-* An ejected backend — one with its own `src/index.ts` entrypoint — is reported
-* as a `custom` app rather than a `backend` app. That is not a downgrade; it is
-* an accurate description, and it is what keeps such a project deploying exactly
-* as it does today.
+* The backend's `runtime` is inferred from whether the repository declares a
+* **Dockerfile** — the thing that actually builds an image — and from nothing
+* else. It used to be inferred from the presence of `backend/src/index.ts`,
+* which every scaffolded project had whether or not it wanted its own server, so
+* projects predating the manifest silently landed on the custom runtime and paid
+* for it (see `docs/cloud-deploy-workspace-vendoring.md`).
 */
 function synthesizeManifest(projectRoot) {
 	const exists = (relative) => fs.existsSync(path.join(projectRoot, relative));
 	const apps = {};
 	const hasConfig = exists(DEFAULT_CONFIG_DIR);
 	const hasBackend = exists("backend");
-	const backendEntry = exists("backend/src/index.ts");
-	if (hasBackend && backendEntry) apps.backend = {
-		type: "custom",
-		dockerfile: exists("backend/Dockerfile") ? "backend/Dockerfile" : void 0,
-		context: "."
-	};
-	else if (hasBackend || hasConfig) {
-		const backend = { type: "backend" };
-		if (!hasConfig) backend.mode = "baas";
+	const dockerfile = ["Dockerfile", "backend/Dockerfile"].find(exists);
+	if (hasBackend || hasConfig) {
+		const backend = dockerfile ? {
+			type: "backend",
+			runtime: "custom",
+			dockerfile,
+			context: "."
+		} : {
+			type: "backend",
+			runtime: "managed"
+		};
 		if (exists("backend/functions")) backend.functions = DEFAULT_FUNCTIONS_DIR;
 		if (exists("backend/crons")) backend.crons = DEFAULT_CRONS_DIR;
 		apps.backend = backend;
+		if (!dockerfile && exists("backend/src/index.ts")) console.warn("⚠ backend/src/index.ts exists but this project's backend is managed — it is\n    never loaded. Delete it, or run `rebase eject` to make it the entrypoint.");
 	}
 	if (exists("frontend")) apps.web = {
 		type: "static",
 		root: "frontend",
 		build: "npm run build --workspace frontend",
 		output: "frontend/dist",
+		path: "/",
 		spa: true
 	};
 	return {
-		runtime: "^1",
+		rebase: "^1",
 		apps
 	};
 }
@@ -2282,7 +2602,7 @@ function writeManifest(projectRoot, manifest) {
 	const filePath = manifestPath(projectRoot);
 	const ordered = {
 		$schema: manifest.$schema ?? "https://rebase.pro/schemas/rebase.json",
-		runtime: manifest.runtime,
+		rebase: manifest.rebase,
 		apps: manifest.apps
 	};
 	fs.writeFileSync(filePath, `${JSON.stringify(ordered, null, 4)}\n`, "utf8");
@@ -2301,13 +2621,8 @@ function buildableApps(manifest) {
 		name,
 		app
 	}));
-	const rank = (app) => {
-		if (app.type === "backend") return 0;
-		if (app.type === "admin") return 1;
-		if (app.type === "static") return 2;
-		return 3;
-	};
-	return entries.filter(({ app }) => app.type !== "mobile").sort((a, b) => rank(a.app) - rank(b.app));
+	const rank = (app) => app.type === "backend" ? 0 : 1;
+	return entries.sort((a, b) => rank(a.app) - rank(b.app));
 }
 /**
 * Decide whether a project can run on the managed runtime, and say why not.
@@ -2317,28 +2632,45 @@ function buildableApps(manifest) {
 * verdict.
 */
 function assessManagedCompatibility(manifest) {
-	const reasons = [];
 	const backend = findBackendApp(manifest);
-	if (!backend) {
-		const custom = Object.entries(manifest.apps).find(([, app]) => app.type === "custom");
-		if (custom) reasons.push(`App "${custom[0]}" is a custom container. The managed runtime runs the platform image with your bundle, so a project that builds its own image uses the custom runtime instead.`);
-		else reasons.push("No backend app is declared in this repository. Only the repository that declares the backend selects the runtime.");
-	}
-	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "custom") reasons.push(`App "${name}" is a custom container image.`);
+	if (!backend) return {
+		eligible: false,
+		reasons: ["No backend app is declared in this repository. Only the repository that declares the backend selects the runtime."]
+	};
+	if (backend.app.runtime === "custom") return {
+		eligible: false,
+		reasons: [`App "${backend.name}" declares runtime: "custom", so it builds and runs its own image. The managed runtime boots the platform image with your bundle; the custom runtime deploys exactly the same way, from your Dockerfile.`]
+	};
 	return {
-		eligible: reasons.length === 0 && Boolean(backend),
-		reasons
+		eligible: true,
+		reasons: []
 	};
 }
-/** Resolve a backend app's directories against the conventions it omits. */
-function resolveBackendPaths(app) {
+/**
+* Resolve a backend app's directories against the conventions it omits.
+*
+* `hasCollections` replaces the old `mode: "cms" | "baas"` field. Where the
+* collections come from was never an independent choice: either they are
+* declared in code and the bundle ships them, or they are not and the runtime
+* introspects the live database at boot. Declaring it separately only created
+* the contradictory state — code-first declared, no collections anywhere.
+*
+* `hasConfig` is deliberately a **separate** question. A headless project has no
+* `config/collections`, but it may still ship a config package — that is where
+* the `storageAuthorize` hook lives, and storage is not under row-level
+* security, so without one the server refuses to boot with storage enabled.
+* Collapsing the two would leave a headless project nowhere to put it.
+*/
+function resolveBackendPaths(app, projectRoot) {
+	const config = app.config ?? "config";
 	return {
-		config: app.config ?? "config",
+		config,
 		functions: app.functions ?? "backend/functions",
 		crons: app.crons ?? "backend/crons",
 		schema: app.schema ?? "backend/src/schema.generated.ts",
 		usersCollection: app.usersCollection ?? "collections/users",
-		mode: app.mode ?? "cms"
+		hasConfig: fs.existsSync(path.join(projectRoot, config)),
+		hasCollections: fs.existsSync(path.join(projectRoot, config, "collections"))
 	};
 }
 //#endregion
@@ -2401,22 +2733,19 @@ function devRuntimeEnv(projectRoot) {
 		REBASE_DEV_CONFIG: "config",
 		REBASE_DEV_FUNCTIONS: "backend/functions",
 		REBASE_DEV_CRONS: "backend/crons",
-		REBASE_DEV_SCHEMA: "backend/src/schema.generated.ts",
-		REBASE_DEV_MODE: "cms"
+		REBASE_DEV_SCHEMA: "backend/src/schema.generated.ts"
 	};
 	try {
 		const backend = findBackendApp(loadManifest(projectRoot).manifest);
 		if (backend) {
-			const paths = resolveBackendPaths(backend.app);
+			const paths = resolveBackendPaths(backend.app, projectRoot);
 			result.REBASE_DEV_CONFIG = paths.config;
 			result.REBASE_DEV_FUNCTIONS = paths.functions;
 			result.REBASE_DEV_CRONS = paths.crons;
 			result.REBASE_DEV_SCHEMA = paths.schema;
-			result.REBASE_DEV_MODE = paths.mode;
 			result.REBASE_DEV_APP = backend.name;
 		}
 	} catch {}
-	if (!fs.existsSync(path.join(projectRoot, result.REBASE_DEV_CONFIG))) result.REBASE_DEV_MODE = "baas";
 	return result;
 }
 /** Well-known filename the backend writes its actual port to. */
@@ -2825,7 +3154,7 @@ ${chalk.green.bold("Description")}
 */
 var DEFAULT_BUNDLE_DIR = "dist-bundle";
 /** Packages whose presence means the bundle cannot run on a stock runtime image. */
-var KNOWN_NATIVE_PACKAGES = new Set([
+var KNOWN_NATIVE_PACKAGES = /* @__PURE__ */ new Set([
 	"sharp",
 	"canvas",
 	"bcrypt",
@@ -2841,7 +3170,7 @@ var KNOWN_NATIVE_PACKAGES = new Set([
 	"pg-native"
 ]);
 /** Dependencies supplied by the runtime image itself, not by the bundle. */
-var RUNTIME_PROVIDED = new Set([
+var RUNTIME_PROVIDED = /* @__PURE__ */ new Set([
 	"@rebasepro/server",
 	"@rebasepro/types",
 	"@rebasepro/client",
@@ -3024,16 +3353,27 @@ async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck)
 * says exactly how to proceed, while a false positive would hand back the crash
 * loop this exists to prevent.
 */
-function detectStorageAuthorize(compiledConfigDir) {
+function detectStorageAuthorize(compiledConfigDir, depth = 0) {
 	const indexPath = [
 		".js",
 		".mjs",
 		".ts"
 	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
 	if (!indexPath) return false;
+	return moduleExportsStorageAuthorize(indexPath, depth);
+}
+/**
+* Whether one compiled module re-exports or defines `storageAuthorize`.
+*
+* Split out from {@link detectStorageAuthorize} so a wildcard re-export can be
+* followed. `export * from "./storage.js"` is an ordinary way to write a config
+* barrel, and treating it as "no hook" rejected deploys that were correct — with
+* a message telling the developer to add a hook they had already written.
+*/
+function moduleExportsStorageAuthorize(modulePath, depth) {
 	let source;
 	try {
-		source = fs.readFileSync(indexPath, "utf8");
+		source = fs.readFileSync(modulePath, "utf8");
 	} catch {
 		return false;
 	}
@@ -3042,9 +3382,48 @@ function detectStorageAuthorize(compiledConfigDir) {
 		const parts = entry.split(/\bas\b/);
 		return parts[parts.length - 1].trim();
 	}).includes("storageAuthorize")) return true;
+	if (depth < 3) for (const clause of source.matchAll(/\bexport\s*\*\s*from\s*["']([^"']+)["']/g)) {
+		const specifier = clause[1];
+		if (!specifier.startsWith(".")) continue;
+		const resolved = resolveRelativeModule(path.dirname(modulePath), specifier);
+		if (resolved && moduleExportsStorageAuthorize(resolved, depth + 1)) return true;
+	}
 	return false;
 }
 /**
+* Resolve a relative ESM specifier to a file on disk.
+*
+* Compiled output carries explicit `.js` extensions, but the same function reads
+* TypeScript sources during a source boot, where the specifier may be
+* extensionless or point at a directory index.
+*/
+function resolveRelativeModule(fromDir, specifier) {
+	const base = path.resolve(fromDir, specifier);
+	const candidates = [
+		base,
+		`${base}.js`,
+		`${base}.mjs`,
+		`${base}.ts`,
+		path.join(base, "index.js"),
+		path.join(base, "index.mjs"),
+		path.join(base, "index.ts")
+	];
+	for (const candidate of candidates) try {
+		if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;
+	} catch {
+		continue;
+	}
+	if (/\.js$/.test(base)) {
+		const asTs = base.replace(/\.js$/, ".ts");
+		try {
+			if (fs.existsSync(asTs) && fs.statSync(asTs).isFile()) return asTs;
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+/**
 * Detect native code in the dependency closure.
 *
 * Walks declared runtime dependencies breadth-first through `node_modules`,
@@ -3200,6 +3579,139 @@ function collectDeclaredDependencies(projectRoot) {
 	return declared;
 }
 /**
+* Lowest version a range could resolve to, or null if it is not a range.
+*
+* Kept deliberately tiny and local. The published range grammar here is a caret,
+* a tilde, an exact version or a `>=` floor, and the alternative — a semver
+* dependency in the CLI — buys breadth this does not need.
+*/
+function lowerBoundOf(range) {
+	const raw = range.trim().replace(/^[\^~]/, "").replace(/^>=\s*/, "").replace(/^v/, "");
+	if (!/^\d+(\.\d+){0,2}$/.test(raw)) return null;
+	const [major, minor = 0, patch = 0] = raw.split(".").map(Number);
+	return [
+		major,
+		minor,
+		patch
+	];
+}
+/** Highest version a range could resolve to (exclusive), or null. */
+function upperBoundOf(range) {
+	const trimmed = range.trim();
+	const min = lowerBoundOf(trimmed);
+	if (!min) return null;
+	if (trimmed.startsWith(">=")) return null;
+	const [major, minor, patch] = min;
+	if (trimmed.startsWith("^")) {
+		if (major > 0) return [
+			major + 1,
+			0,
+			0
+		];
+		if (minor > 0) return [
+			0,
+			minor + 1,
+			0
+		];
+		return [
+			0,
+			0,
+			patch + 1
+		];
+	}
+	if (trimmed.startsWith("~")) return trimmed.replace(/^~v?/, "").split(".").length >= 2 ? [
+		major,
+		minor + 1,
+		0
+	] : [
+		major + 1,
+		0,
+		0
+	];
+	const parts = trimmed.replace(/^v/, "").split(".").length;
+	if (parts === 1) return [
+		major + 1,
+		0,
+		0
+	];
+	if (parts === 2) return [
+		major,
+		minor + 1,
+		0
+	];
+	return [
+		major,
+		minor,
+		patch + 1
+	];
+}
+function compareTriples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Whether a declared range could EVER resolve at or above `target`.
+*
+* The same question the control plane asks at intake, asked here first. Only a
+* range whose entire span sits below the target is reported — `^0.10.0` can
+* never cross to 0.12 whatever npm publishes — because a false alarm on a build
+* that would have worked trains people to ignore the warning that matters.
+*/
+function canReach(range, target) {
+	const ceiling = upperBoundOf(range);
+	const floor = lowerBoundOf(target);
+	if (!floor || !lowerBoundOf(range)) return null;
+	if (!ceiling) return true;
+	return compareTriples(ceiling, floor) > 0;
+}
+/**
+* Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+*
+* This is the only place a developer can be told. In development, every
+* `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+* checkout, so the version STRINGS in package.json are never exercised — the
+* project runs fine locally on whatever is on disk, and the declared numbers are
+* first honoured when the runtime npm-installs them from a bundle in the cloud.
+* A project scaffolded at 0.10.0 therefore keeps working on a developer's
+* machine indefinitely while being, in the cloud, a 0.10.0 driver.
+*
+* That matters because the image supplies only `@rebasepro/server`; the database
+* driver comes from these declarations and a newer runtime never updates it.
+* Every package.json is scanned, `dependencies` and `devDependencies` both,
+* because they have to be bumped together and the one that gets forgotten is the
+* one nobody looks at.
+*/
+function detectFrameworkDepDrift(projectRoot, cliVersion) {
+	const found = [];
+	for (const relative of [
+		"package.json",
+		"backend/package.json",
+		"config/package.json",
+		"frontend/package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const block of [pkg.dependencies, pkg.devDependencies]) for (const [name, range] of Object.entries(block ?? {})) {
+				if (!name.startsWith("@rebasepro/")) continue;
+				if (typeof range !== "string") continue;
+				found.push({
+					name,
+					range,
+					file: relative
+				});
+			}
+		} catch {}
+	}
+	const behind = found.filter((d) => canReach(d.range, cliVersion) === false);
+	const bounds = new Set(found.map((d) => lowerBoundOf(d.range)).filter((b) => b != null).map((b) => b.join(".")));
+	return {
+		behind,
+		disagreeing: bounds.size > 1 ? [...bounds].sort() : []
+	};
+}
+/**
 * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
 *
 * TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
@@ -3328,11 +3840,10 @@ async function regenerateSchema(projectRoot, configDir, options) {
 * deployed green, and answered 404 on every one of them, with the file still
 * sitting in the repository looking exactly like the server.
 *
-* A project that means to keep its own entrypoint declares the app as
-* `"type": "custom"`, which builds the repository's Dockerfile instead — which
-* is what {@link synthesizeManifest} already infers for a manifest-less repo
-* carrying one. The warning names that route rather than implying the file is
-* a mistake.
+* A project that means to keep its own entrypoint runs `rebase eject`, which
+* writes the entrypoint, a Dockerfile and a compose file together and flips the
+* backend to `runtime: "custom"`. The warning names that route rather than
+* implying the file is a mistake.
 */
 function findUnusedServerEntry(projectRoot, functionsDir) {
 	const found = [path.join("backend", "src", "index.ts"), path.join(path.dirname(functionsDir), "src", "index.ts")].find((candidate) => fs.existsSync(path.join(projectRoot, candidate)));
@@ -3343,22 +3854,22 @@ function findUnusedServerEntry(projectRoot, functionsDir) {
 */
 async function buildBundle(options) {
 	const { projectRoot, app, appName } = options;
-	const paths = resolveBackendPaths(app);
+	const paths = resolveBackendPaths(app, projectRoot);
 	const outDir = path.resolve(projectRoot, options.outDir ?? "dist-bundle");
 	const includes = [];
 	const addIfExists = (relative, pattern) => {
 		if (fs.existsSync(path.join(projectRoot, relative))) includes.push(pattern);
 	};
-	if (paths.mode === "cms") addIfExists(paths.config, `${paths.config}/**/*.ts`);
+	if (paths.hasConfig) addIfExists(paths.config, `${paths.config}/**/*.ts`);
 	addIfExists(paths.functions, `${paths.functions}/**/*.ts`);
 	addIfExists(paths.crons, `${paths.crons}/**/*.ts`);
 	if (fs.existsSync(path.join(projectRoot, paths.schema))) includes.push(paths.schema);
 	if (includes.length === 0) throw new Error(`Nothing to build for app "${appName}". Expected a config directory at "${paths.config}" or functions at "${paths.functions}".`);
-	if (paths.mode === "cms" && options.skipSchema !== true) await regenerateSchema(projectRoot, paths.config, options);
+	if (paths.hasCollections && options.skipSchema !== true) await regenerateSchema(projectRoot, paths.config, options);
 	const unusedEntry = findUnusedServerEntry(projectRoot, paths.functions);
 	if (unusedEntry) {
 		const parts = [
-			...paths.mode === "cms" ? [`${paths.config}/`] : [],
+			...paths.hasCollections ? [`${paths.config}/`] : [],
 			`${paths.functions}/`,
 			"the schema"
 		];
@@ -3366,7 +3877,7 @@ async function buildBundle(options) {
 		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
 		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
 		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
-		console.log(chalk.dim(`      or declare this app as "type": "custom" in rebase.json to keep your own entrypoint.`));
+		console.log(chalk.dim(`      or run \`rebase eject\` to make this file the entrypoint and own the image.`));
 	}
 	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
 	cleanOutDir(projectRoot, outDir);
@@ -3391,14 +3902,17 @@ async function buildBundle(options) {
 	const compiledConfigDir = path.join(outDir, paths.config);
 	const compiledCollectionsDir = path.join(compiledConfigDir, "collections");
 	let collections = [];
-	if (paths.mode === "cms") {
+	if (paths.hasCollections) {
 		collections = await loadSourceCollections(path.join(projectRoot, paths.config, "collections"));
-		if (collections.length === 0) throw new Error(`No collections were found in ${path.join(paths.config, "collections")}. A cms-mode project must define at least one collection.`);
+		if (collections.length === 0) throw new Error(`No collections were found in ${path.join(paths.config, "collections")}. Define at least one collection there, or remove the directory to have the runtime introspect collections from the live database instead.`);
 		if (!fs.existsSync(compiledCollectionsDir)) throw new Error(`Compilation produced no collections directory at ${path.relative(projectRoot, compiledCollectionsDir)}.`);
 	}
 	const declared = collectDeclaredDependencies(projectRoot);
 	const nativeModules = detectNativeDependencies(projectRoot, declared);
 	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
+	const storageSources = normalizeStorageSources(options.storage, void 0);
+	const collision = findStorageSuffixCollision(storageSources.map((s) => s.key));
+	if (collision) throw new Error(`Storage sources "${collision.a}" and "${collision.b}" in rebase.json both map to the environment variable suffix "${collision.suffix || "(none)"}", so they would read each other's configuration. Rename one of them.`);
 	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
 	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
 	const manifest = {
@@ -3408,23 +3922,26 @@ async function buildBundle(options) {
 			builtAgainst: resolveServerVersion(projectRoot),
 			contract: RUNTIME_CONTRACT_VERSION
 		},
-		schemaVersion: paths.mode === "baas" ? "" : computeSchemaVersion(collections),
+		schemaVersion: paths.hasCollections ? computeSchemaVersion(collections) : "",
 		app: appName,
-		mode: paths.mode,
+		kind: "backend",
 		entry: {
-			config: paths.mode === "cms" ? relative(paths.config) : void 0,
-			collections: paths.mode === "cms" ? relative(path.join(paths.config, "collections")) : void 0,
+			config: paths.hasConfig ? relative(paths.config) : void 0,
+			collections: paths.hasCollections ? relative(path.join(paths.config, "collections")) : void 0,
 			functions: relative(paths.functions),
 			crons: relative(paths.crons),
 			schema: relative(schemaOut),
-			usersCollection: paths.mode === "cms" ? relative(path.join(paths.config, `${paths.usersCollection}.js`)) : void 0
+			usersCollection: paths.hasCollections ? relative(path.join(paths.config, `${paths.usersCollection}.js`)) : void 0
 		},
 		collections: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
 		hooks: {
 			native: nativeModules.length > 0,
 			nativeModules: nativeModules.length > 0 ? nativeModules : void 0
 		},
-		storage: { authorize: declaresStorageAuthorize },
+		storage: {
+			authorize: declaresStorageAuthorize,
+			...storageSources.length > 0 ? { sources: storageSources } : {}
+		},
 		deps: { declared },
 		build: {
 			cli: resolveCliVersion(),
@@ -3487,11 +4004,12 @@ async function buildBundle(options) {
 * in one image already, that is exactly what it had.
 */
 function foldStaticIntoBundle(options) {
-	const { bundleDir, assetsDir } = options;
+	const { bundleDir, assetsDir, appName, path: basePath, spa } = options;
 	const manifestPath = path.join(bundleDir, "manifest.json");
 	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);
 	if (!fs.existsSync(assetsDir)) throw new Error(`No built assets at ${assetsDir}.`);
-	const staticOut = path.join(bundleDir, "static");
+	const dir = path.posix.join("static", appName);
+	const staticOut = path.join(bundleDir, "static", appName);
 	fs.rmSync(staticOut, {
 		recursive: true,
 		force: true
@@ -3499,21 +4017,30 @@ function foldStaticIntoBundle(options) {
 	fs.mkdirSync(staticOut, { recursive: true });
 	fs.cpSync(assetsDir, staticOut, { recursive: true });
 	let fileCount = 0;
-	const count = (dir) => {
-		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+	const count = (target) => {
+		for (const entry of fs.readdirSync(target, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(target, entry.name));
 		else fileCount++;
 	};
 	count(staticOut);
 	const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	const existing = (manifest.entry?.static ?? []).filter((entry) => entry.dir !== dir);
 	manifest.entry = {
 		...manifest.entry,
-		static: "static"
+		static: [...existing, {
+			path: basePath,
+			dir,
+			spa
+		}]
 	};
 	fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-	return { fileCount };
+	return {
+		fileCount,
+		dir
+	};
 }
 function buildStaticBundle(options) {
 	const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;
+	const basePath = options.path ?? "/";
 	cleanOutDir(projectRoot, outDir);
 	const staticOut = path.join(outDir, "static");
 	fs.mkdirSync(staticOut, { recursive: true });
@@ -3533,8 +4060,12 @@ function buildStaticBundle(options) {
 		},
 		schemaVersion: "",
 		app: appName,
-		mode: "static",
-		entry: { static: "static" },
+		kind: "static",
+		entry: { static: [{
+			path: basePath,
+			dir: "static",
+			spa: options.spa ?? true
+		}] },
 		hooks: { native: false },
 		deps: { declared: {} },
 		build: {
@@ -3636,7 +4167,7 @@ function resolveCliVersion() {
 //#endregion
 //#region src/fold-static.ts
 /**
-* Folding a project's frontend into its backend bundle.
+* Folding a project's static apps into its backend bundle.
 *
 * Shared by `rebase build` and `rebase cloud deploy` deliberately. It lived in
 * the build *command* first, and `deploy` rebuilds the bundle itself — so a
@@ -3645,34 +4176,77 @@ function resolveCliVersion() {
 * folding had never been written. Two callers building the same artefact must
 * share the step that completes it.
 *
-* Why fold at all: `bootFromBundle` already serves a SPA from `entry.static`
+* Why fold at all: `bootFromBundle` serves static apps from `entry.static`
 * behind `REBASE_SERVE_STATIC` (default on). A managed tenant runs one pod, so
-* putting the built site in the bundle gives it the shape a custom container
-* already had — site at `/`, API at `/api` — which is the only honest baseline
-* for calling the managed runtime a drop-in replacement.
+* putting the built assets in the bundle gives it the shape a custom container
+* already had — site at `/`, admin at `/admin`, API at `/api` — which is the
+* only honest baseline for calling the managed runtime a drop-in replacement.
+*
+* **Every** static app is folded, each at its declared path. Folding used to
+* pick exactly one and refuse when it found two, which meant a project with a
+* site and an admin panel deployed with neither.
 */
 /**
-* Which static app, if any, should be served by the backend.
+* Every static app in the manifest, in mount order.
 *
-* Exactly one `static` app is folded. With several, folding would have to choose,
-* and silently picking one of two websites is worse than doing nothing — so it
-* declines and names what it saw. Pure, so the decision is testable without a
-* filesystem.
+* Longest path first, so the `/`-rooted app is registered last — its catch-all
+* would otherwise claim its siblings' URLs. Pure, so the ordering is testable
+* without a filesystem.
 */
-function selectFoldableApp(manifest) {
-	const statics = Object.entries(manifest.apps ?? {}).filter(([, app]) => app?.type === "static").map(([name, app]) => ({
-		name,
-		build: app?.build,
-		output: app?.output
-	}));
-	if (statics.length === 0) return {};
-	if (statics.length > 1) return { reason: `${statics.length} static apps (${statics.map((s) => s.name).join(", ")}) — none folded in. Pick one to serve from the backend, or host them separately.` };
-	const only = statics[0];
-	if (!only.output) return { reason: `"${only.name}" declares no output directory — not folded in.` };
-	return { app: only };
+function foldableApps(manifest) {
+	const apps = [];
+	const skipped = [];
+	for (const [name, app] of Object.entries(manifest.apps ?? {})) {
+		if (app?.type !== "static") continue;
+		if (!app.output) {
+			skipped.push({
+				name,
+				reason: `"${name}" declares no output directory — not folded in.`
+			});
+			continue;
+		}
+		apps.push({
+			name,
+			build: app.build,
+			output: app.output,
+			path: app.path ?? "/",
+			spa: app.spa ?? true
+		});
+	}
+	apps.sort((a, b) => b.path.length - a.path.length);
+	return {
+		apps,
+		skipped
+	};
+}
+/**
+* Assert a built app's assets are actually rooted at the path it is served from.
+*
+* An app mounted at `/admin` but built with Vite's default `base: "/"` emits
+* `<script src="/assets/index-a1b2.js">`. The server serves `index.html` fine
+* and 404s every asset: a blank page, no server error, nothing in the logs. It
+* is the single most expensive silent failure in this design, so it is a build
+* error rather than a runtime surprise.
+*
+* Only `<script src>` and `<link href>` are inspected — those are what a bundler
+* rewrites through `base`. Author-written anchors and canonical URLs are not
+* evidence of a misbuild.
+*/
+function assertBuiltForPath(indexHtml, basePath, appName) {
+	if (basePath === "/") return;
+	const offenders = [];
+	for (const match of indexHtml.matchAll(/<(?:script|link)\b[^>]*?\b(?:src|href)\s*=\s*["']([^"']+)["']/gi)) {
+		const ref = match[1];
+		if (!ref.startsWith("/")) continue;
+		if (ref === `${basePath}` || ref.startsWith(`${basePath}/`)) continue;
+		offenders.push(ref);
+	}
+	if (offenders.length === 0) return;
+	throw new Error(`"${appName}" is declared at ${basePath} but its build emitted assets rooted at /.\n    index.html references: ${offenders.slice(0, 3).join(", ")}\n    The app would load a blank page. Set \`base\` from REBASE_APP_BASE in its
+    build config — see docs/apps-and-runtimes.md §4.2.`);
 }
 /**
-* Build the project's frontend and fold it into the backend bundle.
+* Build the project's static apps and fold them into the backend bundle.
 *
 * Throws rather than exiting, so the caller decides whether a missing frontend
 * should fail its command — a `build` may reasonably want to stop, and so should
@@ -3681,27 +4255,39 @@ function selectFoldableApp(manifest) {
 async function foldFrontendIntoBundle(options) {
 	const { projectRoot, manifest, bundleDir, skipBuild } = options;
 	const log = options.log ?? ((m) => console.log(m));
-	const { app, reason } = selectFoldableApp(manifest);
-	if (reason) {
-		log(chalk.yellow(`    ⚠ ${reason}`));
-		return null;
+	const { apps, skipped } = foldableApps(manifest);
+	for (const { reason } of skipped) log(chalk.yellow(`    ⚠ ${reason}`));
+	if (apps.length === 0) return [];
+	const outcomes = [];
+	for (const app of apps) {
+		if (app.build && !skipBuild) await execa(app.build, {
+			cwd: projectRoot,
+			stdio: "inherit",
+			shell: true,
+			env: {
+				REBASE_APP_PATH: app.path,
+				REBASE_APP_BASE: app.path === "/" ? "/" : `${app.path}/`,
+				REBASE_APP_NAME: app.name
+			}
+		});
+		const assetsDir = path.join(projectRoot, app.output);
+		if (!fs.existsSync(assetsDir)) throw new Error(`"${app.name}" declared output "${app.output}" does not exist after building — the bundle would ship without a frontend.`);
+		const indexHtml = path.join(assetsDir, "index.html");
+		if (fs.existsSync(indexHtml)) assertBuiltForPath(fs.readFileSync(indexHtml, "utf8"), app.path, app.name);
+		const { fileCount } = foldStaticIntoBundle({
+			bundleDir,
+			assetsDir,
+			appName: app.name,
+			path: app.path,
+			spa: app.spa
+		});
+		outcomes.push({
+			appName: app.name,
+			fileCount,
+			path: app.path
+		});
 	}
-	if (!app) return null;
-	if (app.build && !skipBuild) await execa(app.build, {
-		cwd: projectRoot,
-		stdio: "inherit",
-		shell: true
-	});
-	const assetsDir = path.join(projectRoot, app.output);
-	if (!fs.existsSync(assetsDir)) throw new Error(`"${app.name}" declared output "${app.output}" does not exist after building — the bundle would ship without a frontend.`);
-	const { fileCount } = foldStaticIntoBundle({
-		bundleDir,
-		assetsDir
-	});
-	return {
-		appName: app.name,
-		fileCount
-	};
+	return outcomes;
 }
 //#endregion
 //#region src/commands/build.ts
@@ -3719,7 +4305,7 @@ async function foldFrontendIntoBundle(options) {
 * entrypoint, falls back to the previous behaviour: run every workspace's own
 * `build` script. Nothing that built before stops building.
 */
-function printHelp$3() {
+function printHelp$4() {
 	console.log(`
 ${chalk.bold("rebase build")} — build the apps declared in rebase.json
 
@@ -3754,7 +4340,7 @@ async function buildCommand(rawArgs = []) {
 		permissive: true
 	});
 	if (args["--help"]) {
-		printHelp$3();
+		printHelp$4();
 		return;
 	}
 	const projectRoot = requireProjectRoot();
@@ -3798,13 +4384,20 @@ async function buildCommand(rawArgs = []) {
 	console.log(`${chalk.bold("Rebase")} — building ${targets.length} app(s)\n`);
 	for (const { name, app } of targets) {
 		console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));
+		if (app.type === "backend" && app.runtime === "custom") {
+			console.log(chalk.dim("  custom runtime — this project builds its own image, not a bundle"));
+			console.log(chalk.dim(`    ${chalk.cyan(`npm run build --workspace ${name}`)}  then  ${chalk.cyan(`docker build -f ${app.dockerfile ?? "Dockerfile"} .`)}`));
+			console.log("");
+			continue;
+		}
 		if (app.type === "backend") {
 			const result = await buildBundle({
 				projectRoot,
 				appName: name,
 				app,
 				outDir: args["--out"],
-				runtimeRange: manifest.runtime,
+				runtimeRange: manifest.rebase,
+				storage: manifest.storage,
 				skipTypeCheck: args["--skip-type-check"],
 				skipSchema: args["--skip-schema"]
 			});
@@ -3816,6 +4409,16 @@ async function buildCommand(rawArgs = []) {
 				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
 				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
 			}
+			const drift = detectFrameworkDepDrift(projectRoot, resolveCliVersion());
+			if (drift.behind.length > 0) {
+				console.log(chalk.yellow(`    ⚠ framework dependencies older than this CLI (${resolveCliVersion()}):`));
+				for (const dep of drift.behind) console.log(chalk.dim(`      ${dep.name}@${dep.range}  (${dep.file})`));
+				console.log(chalk.dim("      The image supplies the server, but your bundle supplies the database"));
+				console.log(chalk.dim("      driver — a newer runtime does not update it. Bump these and rebuild."));
+			} else if (drift.disagreeing.length > 0) {
+				console.log(chalk.yellow(`    ⚠ mixed @rebasepro versions declared: ${drift.disagreeing.join(", ")}`));
+				console.log(chalk.dim("      These are published together and expect to run together; pin them alike."));
+			}
 			if (!args["--no-static"]) {
 				const folded = await foldFrontendIntoBundle({
 					projectRoot,
@@ -3827,28 +4430,24 @@ async function buildCommand(rawArgs = []) {
 					console.error(chalk.red(`    ✗ ${err instanceof Error ? err.message : String(err)}`));
 					process.exit(1);
 				});
-				if (folded) console.log(chalk.green(`    ✓ ${folded.appName} folded in`) + chalk.dim(` (${folded.fileCount} file(s) → served at /)`));
+				for (const outcome of folded ?? []) console.log(chalk.green(`    ✓ ${outcome.appName} folded in`) + chalk.dim(` (${outcome.fileCount} file(s) → served at ${outcome.path})`));
 			}
-		} else if (app.type === "static" || app.type === "admin") await buildAssetApp(projectRoot, name, app, manifest.runtime, args["--out"]);
-		else if (app.type === "custom") console.log(chalk.dim("  custom container — built at deploy time from its Dockerfile"));
+		} else if (app.type === "static") await buildAssetApp(projectRoot, name, app, manifest.rebase, args["--out"]);
 		console.log("");
 	}
 	console.log(chalk.green("✓ Build complete."));
 }
 /**
-* Build a static or bundled-admin app and package it into a static bundle.
+* Build a static app and package it into a static bundle.
 *
 * Runs the app's own build command, checks it produced the declared output, then
-* packages that output into a `static`-mode bundle — the same deployable shape as
+* packages that output into a `static`-kind bundle — the same deployable shape as
 * a backend bundle, so a frontend or admin app deploys through the identical
 * path and runs on the identical image, just serving files instead of an API.
 */
 async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride) {
 	const asset = app;
-	if (app.type === "admin" && app.mode !== "bundled") {
-		console.log(chalk.dim("  hosted admin panel — nothing to build"));
-		return;
-	}
+	const basePath = asset.path ?? "/";
 	if (!asset.build) {
 		console.log(chalk.dim("  no build command declared — skipping"));
 		return;
@@ -3857,7 +4456,12 @@ async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride)
 		await execa(asset.build, {
 			cwd: projectRoot,
 			stdio: "inherit",
-			shell: true
+			shell: true,
+			env: {
+				REBASE_APP_PATH: basePath,
+				REBASE_APP_BASE: basePath === "/" ? "/" : `${basePath}/`,
+				REBASE_APP_NAME: name
+			}
 		});
 	} catch {
 		console.error(chalk.red(`  ✗ build command failed for "${name}"`));
@@ -3872,15 +4476,24 @@ async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride)
 		console.error(chalk.red(`  ✗ declared output "${asset.output}" does not exist after building`));
 		process.exit(1);
 	}
+	const indexHtml = path.join(outputPath, "index.html");
+	if (fs.existsSync(indexHtml)) try {
+		assertBuiltForPath(fs.readFileSync(indexHtml, "utf8"), basePath, name);
+	} catch (err) {
+		console.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
 	const result = buildStaticBundle({
 		projectRoot,
 		appName: name,
 		assetsDir: outputPath,
 		outDir: outOverride ? path.resolve(process.cwd(), outOverride) : path.join(projectRoot, `dist-bundle-${name}`),
-		runtimeRange
+		runtimeRange,
+		path: basePath,
+		spa: asset.spa ?? true
 	});
 	const rel = path.relative(projectRoot, result.outDir);
-	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s))`));
+	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s) → served at ${basePath})`));
 }
 /** The pre-manifest behaviour: build every workspace package. */
 async function runWorkspaceBuilds(projectRoot) {
@@ -3898,6 +4511,234 @@ async function runWorkspaceBuilds(projectRoot) {
 	}
 }
 //#endregion
+//#region src/commands/eject.ts
+/**
+* CLI command: rebase eject
+*
+* The supported route from the managed runtime to a custom one.
+*
+* Without it, `runtime: "custom"` is a mode a user can only reach by
+* hand-writing an entrypoint they have never seen. The template used to solve
+* that by scaffolding `backend/src/index.ts` into every project — ~190 lines
+* configuring CORS, auth, cookies, storage and history, which the managed
+* runtime never loads. It was the most important-looking file in a new project
+* and editing it did nothing.
+*
+* So the file moved here. A managed project does not carry it; a project that
+* asks for it gets it together with the Dockerfile and the manifest change that
+* make it actually run.
+*
+* There is deliberately no `rebase uneject`. Going back is deleting two files
+* and editing one line, and a command that silently discarded a user's server
+* code would be worse than its absence.
+*/
+var __dirname$1 = path.dirname(fileURLToPath(import.meta.url));
+/** Walk up to the package root, which holds `templates/`. */
+function findCliRoot(from) {
+	const root = path.parse(from).root;
+	let dir = from;
+	while (dir && dir !== root) {
+		if (fs.existsSync(path.join(dir, "templates", "eject"))) return dir;
+		dir = path.dirname(dir);
+	}
+	return null;
+}
+/** Files the eject payload contributes, as `<source> → <destination>`. */
+var PAYLOAD = [
+	{
+		from: "backend/src/index.ts",
+		to: "backend/src/index.ts",
+		overwrite: true
+	},
+	{
+		from: "backend/src/env.ts",
+		to: "backend/src/env.ts",
+		overwrite: true
+	},
+	{
+		from: "Dockerfile",
+		to: "Dockerfile",
+		overwrite: false
+	},
+	{
+		from: "docker-compose.custom.yml",
+		to: "docker-compose.custom.yml",
+		overwrite: false
+	}
+];
+/**
+* The project's name, for the `{{PROJECT_NAME}}` the payload carries.
+*
+* Falls back to the directory name — a compose project name is cosmetic, and a
+* missing or unreadable package.json is not a reason to refuse to eject.
+*/
+function projectNameOf(projectRoot) {
+	try {
+		const pkg = JSON.parse(fs.readFileSync(path.join(projectRoot, "package.json"), "utf8"));
+		if (typeof pkg.name === "string" && pkg.name.trim()) return pkg.name.trim();
+	} catch {}
+	return path.basename(projectRoot);
+}
+function printHelp$3() {
+	console.log(`
+${chalk.bold("rebase eject")} — take ownership of the server process
+
+Writes the backend entrypoint and a Dockerfile into this project, and flips its
+backend to ${chalk.cyan("runtime: \"custom\"")}. From then on this repository builds its own
+image: platform runtime upgrades no longer reach it, and CORS, auth wiring,
+storage and shutdown become yours to configure.
+
+${chalk.bold("Usage")}
+  rebase eject [app]
+
+${chalk.bold("Options")}
+  --dry-run                    List what would change, and change nothing
+  -h, --help                   Show this help
+`.trim());
+}
+async function ejectCommand(rawArgs = []) {
+	const args = arg({
+		"--dry-run": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printHelp$3();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	const dryRun = Boolean(args["--dry-run"]);
+	const requested = args._.slice(1).find((value) => !value.startsWith("-"));
+	let loaded;
+	try {
+		loaded = loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) {
+			console.error(chalk.red(`✗ ${err.message}`));
+			for (const issue of err.issues) console.error(chalk.dim(`    ${issue.path}: ${issue.message}`));
+			process.exit(1);
+		}
+		throw err;
+	}
+	const { manifest } = loaded;
+	let appName;
+	let app;
+	if (requested) {
+		const declared = manifest.apps[requested];
+		if (!declared) {
+			console.error(chalk.red(`✗ No app named "${requested}" in rebase.json.`));
+			console.error(chalk.dim(`  Declared: ${Object.keys(manifest.apps).join(", ") || "(none)"}`));
+			process.exit(1);
+		}
+		if (declared.type !== "backend") {
+			console.error(chalk.red(`✗ "${requested}" is a ${declared.type} app — only a backend can be ejected.`));
+			process.exit(1);
+		}
+		appName = requested;
+		app = declared;
+	} else {
+		const backend = findBackendApp(manifest);
+		if (!backend) {
+			console.error(chalk.red("✗ This repository declares no backend app."));
+			console.error(chalk.dim("  Only the repository that declares the backend chooses its runtime."));
+			process.exit(1);
+		}
+		appName = backend.name;
+		app = backend.app;
+	}
+	if (app.runtime === "custom") {
+		console.error(chalk.red(`✗ "${appName}" is already ejected — it declares runtime: "custom".`));
+		console.error(chalk.dim(`  Its entrypoint is ${app.dockerfile ?? "Dockerfile"} and backend/src/index.ts.`));
+		process.exit(1);
+	}
+	const cliRoot = findCliRoot(__dirname$1);
+	if (!cliRoot) {
+		console.error(chalk.red("✗ Could not locate the eject templates. Reinstall @rebasepro/cli."));
+		process.exit(1);
+	}
+	const payloadDir = path.join(cliRoot, "templates", "eject");
+	const planned = [];
+	for (const file of PAYLOAD) {
+		const source = path.join(payloadDir, file.from);
+		if (!fs.existsSync(source)) {
+			console.error(chalk.red(`✗ The eject template is missing ${file.from}. Reinstall @rebasepro/cli.`));
+			process.exit(1);
+		}
+		const exists = fs.existsSync(path.join(projectRoot, file.to));
+		planned.push({
+			to: file.to,
+			action: exists && !file.overwrite ? "keep" : "write"
+		});
+	}
+	if (dryRun) {
+		console.log(chalk.bold(`Would eject "${appName}" to a custom runtime:`));
+		console.log("");
+		for (const item of planned) console.log(item.action === "write" ? `  ${chalk.green("write")}  ${item.to}` : `  ${chalk.dim("keep")}   ${item.to} ${chalk.dim("(already exists)")}`);
+		console.log(`  ${chalk.green("write")}  rebase.json ${chalk.dim("(runtime: \"custom\")")}`);
+		console.log("");
+		console.log(chalk.dim("Nothing was changed."));
+		return;
+	}
+	const projectName = projectNameOf(projectRoot);
+	for (const [index, file] of PAYLOAD.entries()) {
+		if (planned[index].action === "keep") continue;
+		const destination = path.join(projectRoot, file.to);
+		fs.mkdirSync(path.dirname(destination), { recursive: true });
+		const contents = fs.readFileSync(path.join(payloadDir, file.from), "utf8").replace(/\{\{PROJECT_NAME\}\}/g, projectName);
+		fs.writeFileSync(destination, contents, "utf8");
+	}
+	const dockerfile = app.dockerfile ?? "Dockerfile";
+	manifest.apps[appName] = {
+		...app,
+		runtime: "custom",
+		dockerfile,
+		port: app.port ?? 8080
+	};
+	writeManifest(projectRoot, manifest);
+	restoreBackendScripts(projectRoot);
+	console.log("");
+	console.log(chalk.green(`✓ Ejected "${appName}" to a custom runtime.`));
+	console.log("");
+	console.log(`  ${chalk.cyan("backend/src/index.ts".padEnd(26))} your entrypoint — the runtime no longer boots the bundle`);
+	console.log(`  ${chalk.cyan("backend/src/env.ts".padEnd(26))} the environment it reads`);
+	console.log(`  ${chalk.cyan(dockerfile.padEnd(26))} your image`);
+	console.log(`  ${chalk.cyan("docker-compose.custom.yml".padEnd(26))} runs it`);
+	console.log(`  ${chalk.cyan("rebase.json".padEnd(26))} runtime: custom`);
+	console.log("");
+	console.log(chalk.yellow("  You now own CORS, auth wiring, storage and shutdown. Platform runtime"));
+	console.log(chalk.yellow("  upgrades no longer reach this project."));
+	console.log("");
+	console.log(chalk.dim(`  ${chalk.cyan("docker compose -f docker-compose.custom.yml up --build")}`));
+	console.log(chalk.dim("  docker-compose.yml is untouched — it still runs the managed shape if you go back."));
+	console.log("");
+}
+/**
+* Point the backend workspace's scripts at the entrypoint that now exists.
+*
+* A managed project's backend package deliberately declares no `main` and no
+* `start`: there is no entrypoint to name. Ejecting creates one.
+*/
+function restoreBackendScripts(projectRoot) {
+	const packagePath = path.join(projectRoot, "backend", "package.json");
+	if (!fs.existsSync(packagePath)) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+	} catch {
+		console.log(chalk.yellow("  ⚠ backend/package.json is not valid JSON — its scripts were left alone."));
+		return;
+	}
+	const scripts = parsed.scripts ?? {};
+	parsed.main ??= "src/index.ts";
+	scripts.dev ??= "tsx watch --include=\"../config/**/*\" --include=\"./functions/**/*\" src/index.ts";
+	scripts.start ??= "node dist/backend/src/index.js";
+	parsed.scripts = scripts;
+	fs.writeFileSync(packagePath, `${JSON.stringify(parsed, null, 4)}\n`, "utf8");
+}
+//#endregion
 //#region src/commands/start.ts
 /**
 * CLI command: rebase start
@@ -4436,7 +5277,7 @@ function parseAgentFlags(rawArgs) {
 	return requested;
 }
 async function skillsInstall(rawArgs = []) {
-	const projectDir = process.cwd();
+	const projectDir = findProjectRoot() ?? process.cwd();
 	let skillsDir;
 	try {
 		skillsDir = getSkillsSourceDir();
@@ -4480,7 +5321,8 @@ async function skillsInstall(rawArgs = []) {
 	for (const agentKey of agents) {
 		const agent = AGENTS[agentKey];
 		const count = installForAgent(agentKey, skills, projectDir);
-		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(agent.targetDir)}`);
+		const shown = path.relative(process.cwd(), path.join(projectDir, agent.targetDir)) || agent.targetDir;
+		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(shown)}`);
 	}
 	console.log("");
 	console.log(chalk.gray("  Skills are project-local. Commit them to share with your team."));
@@ -5345,7 +6187,7 @@ function declaredAppsFrom(manifest) {
 	if (!apps || typeof apps !== "object") return [];
 	return Object.entries(apps).filter(([name]) => name.trim().length > 0).map(([name, value]) => ({
 		name,
-		type: String(value?.type ?? "custom")
+		type: value?.type === "backend" ? "backend" : "static"
 	}));
 }
 /** Upload a bundle archive; returns the control-plane bundle id. */
@@ -5460,12 +6302,24 @@ function resolveFrameworkVersion(sourceDir) {
 		dir = parent;
 	}
 }
+/**
+* A progress line for a human — dropped entirely in JSON mode.
+*
+* Progress is not a result. In JSON mode stdout carries the one result value
+* and nothing else, so every unguarded `console.log` on a deploy path was a
+* line printed in front of the JSON, breaking the parser meant to read it.
+* Warnings are the other half of this rule and go the other way: they are
+* `warn`, which prints in every mode, to stderr. See `warn` in `context.ts`.
+*/
+function progress(line) {
+	if (!isJsonMode()) console.log(line);
+}
 /** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
 async function uploadSource(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
 	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
 	if (bytes.length > MAX_SOURCE_UPLOAD_BYTES) fail(`Source context is ${sizeMb} MB — the upload cap is ${Math.round(MAX_SOURCE_UPLOAD_BYTES / 1024 / 1024)} MB.`, "Trim the build context: exclude sourcemaps (*.map), build output and large assets via .rebaseignore or .gitignore.");
-	console.log(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
+	progress(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
 	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
 		method: "POST",
 		headers: {
@@ -5497,23 +6351,24 @@ async function deployBundle(opts) {
 		const loaded = loadManifest(projectRoot);
 		const backend = findBackendApp(loaded.manifest);
 		if (!backend) fail("This repository declares no backend app to deploy as a bundle.", "A managed deploy runs the backend; declare one in rebase.json, or deploy from the backend's repository.");
-		console.log(chalk.gray("  Building bundle..."));
+		progress(chalk.gray("  Building bundle..."));
 		bundleDir = (await buildBundle({
 			projectRoot,
 			appName: backend.name,
 			app: backend.app,
-			runtimeRange: loaded.manifest.runtime,
+			runtimeRange: loaded.manifest.rebase,
+			storage: loaded.manifest.storage,
 			skipTypeCheck: opts.skipTypeCheck,
-			log: (m) => console.log(chalk.gray(m))
+			log: (m) => progress(chalk.gray(m))
 		})).outDir;
 		try {
 			const folded = await foldFrontendIntoBundle({
 				projectRoot,
 				manifest: loaded.manifest,
 				bundleDir,
-				log: (m) => console.log(m)
+				log: (m) => progress(m)
 			});
-			if (folded) console.log(chalk.gray(`  folded ${folded.appName} in (${folded.fileCount} file(s), served at /)`));
+			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
 		} catch (err) {
 			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
 		}
@@ -5530,7 +6385,7 @@ async function deployBundle(opts) {
 	try {
 		await packBundle(bundleDir, tarPath);
 		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
-		console.log(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
 		bundleId = await uploadBundle(url, token, projectId, tarPath);
 	} catch (e) {
 		fail(e instanceof Error ? e.message : String(e));
@@ -5538,8 +6393,10 @@ async function deployBundle(opts) {
 	} finally {
 		fs.rmSync(tarPath, { force: true });
 	}
-	console.log("");
-	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	}
 	let declaredApps = [];
 	try {
 		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
@@ -5627,9 +6484,75 @@ function planBareDeploy(project, latest, now) {
 		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
 	};
 }
+/** `code` of the warning below, and the field name it sets in the payload. */
+var EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
 /** The one sentence that says a source build undoes `runtimeMode: managed`. */
 function ejectWarning(projectRef) {
-	return `⚠ ${projectRef} runs on the managed runtime — a source build ejects it to a custom container.`;
+	return {
+		code: EJECTS_MANAGED_RUNTIME,
+		message: `${projectRef} runs on the managed runtime — this build ejects it to a custom container.`,
+		hint: "Use `rebase cloud deploy --bundle` to stay on managed."
+	};
+}
+/**
+* Why a container-image deploy of a managed project is refused — or `undefined`
+* to let it through.
+*
+* Every path below this point builds a container image, and a successful one
+* sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+* was used" but "did the caller ask to leave the managed runtime", and only
+* `--force` answers it.
+*
+* `--source` used to be read as answering it too, on the theory that uploading a
+* build context is self-evidently a deliberate eject. It is not: `--source`
+* picks *which source* gets built — this directory, rather than the stale
+* archive the control plane is holding — and the eject is a side effect of the
+* answer. That is exactly how a live project got flipped to `custom` by someone
+* whose actual intent was "deploy what I have here", and it is the same
+* ignorance the bare form is refused for. Same ignorance, same refusal.
+*/
+function ejectRefusal(opts, projectRef) {
+	if (!opts.managed || opts.force) return void 0;
+	const eject = "To eject on purpose, add `--force`.";
+	if (opts.source) return {
+		message: `${projectRef} runs on the managed runtime, and \`--source\` builds a container image from this directory — which ejects it from managed. Picking a build method is not the same as asking to leave the runtime.`,
+		hint: `Deploy this directory to the managed runtime with \`rebase cloud deploy --bundle\`. ${eject}`,
+		code: "managed_project"
+	};
+	return {
+		message: `${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`,
+		hint: `Redeploy it with \`rebase cloud deploy --bundle\`. ${eject} \`--source . --force\` builds this directory; \`--force\` alone builds what the control plane holds.`,
+		code: "managed_project"
+	};
+}
+/**
+* Which warnings a container-image deploy has earned.
+*
+* Pure, and separate from the printing, because the printing is what went
+* wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+* the fact that a deploy ejects a managed project existed only as a side effect
+* of a TTY being attached. Deciding here, emitting once at the call site, means
+* the decision cannot be output-mode-dependent again.
+*
+* The condition is just `managed`: anything reaching this point is a container
+* image build that `ejectRefusal` has already let through, and on a managed
+* project that is an eject however it was spelled. A caller who passed `--force`
+* knows — the warning is for the transcript and the payload, which is what
+* anyone reviewing the deploy afterwards actually reads.
+*/
+function deployWarnings(opts, projectRef) {
+	return opts.managed ? [ejectWarning(projectRef)] : [];
+}
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+function warningPayload(warnings) {
+	return {
+		warnings: warnings.map((w) => ({
+			code: w.code,
+			message: w.message,
+			hint: w.hint ?? null
+		})),
+		ejectsManagedRuntime: warnings.some((w) => w.code === EJECTS_MANAGED_RUNTIME)
+	};
 }
 /**
 * Read the two rows the preflight needs.
@@ -5650,6 +6573,23 @@ async function readDeployContext(client, projectId) {
 		return {};
 	}
 }
+/**
+* Whether this repository's backend declares the managed runtime.
+*
+* Deliberately quiet: a directory that is not a Rebase project, or whose
+* manifest does not parse, simply does not route this way — `rebase build` is
+* where a broken manifest gets reported, and a deploy refusing on one before it
+* has even said what it is doing would be the wrong place to find out.
+*/
+function declaresManagedRuntime() {
+	try {
+		const projectRoot = findProjectRoot();
+		if (!projectRoot) return false;
+		return findBackendApp(loadManifest(projectRoot).manifest)?.app.runtime === "managed";
+	} catch {
+		return false;
+	}
+}
 async function deployCommand(rawArgs, projectRef) {
 	const args = arg({
 		"--no-follow": Boolean,
@@ -5666,8 +6606,10 @@ async function deployCommand(rawArgs, projectRef) {
 	});
 	const { client, url } = await requireClient(rawArgs);
 	const projectId = await resolveProjectRef(projectRef, client);
-	if (args["--bundle"]) {
-		if (args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
+	const declaredManaged = !args["--source"] && !args["--bundle"] && declaresManagedRuntime();
+	if (args["--bundle"] || declaredManaged) {
+		if (args["--bundle"] && args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
+		if (declaredManaged && !isJsonMode()) console.log(chalk.gray("  rebase.json declares runtime: managed — deploying a bundle."));
 		await deployBundle({
 			client,
 			url,
@@ -5681,17 +6623,18 @@ async function deployCommand(rawArgs, projectRef) {
 	}
 	const { project, latest } = await readDeployContext(client, projectId);
 	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
-	if (!args["--source"]) {
-		if (plan.managed && args["--force"] !== true) fail(`${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`, "Redeploy it with `rebase cloud deploy --bundle`. To eject on purpose, pass `--source .` to build this directory, or `--force` to build what the control plane holds.", "managed_project");
-		if (!isJsonMode()) {
-			console.log("");
-			if (plan.managed) console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-			for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
-		}
-	} else if (plan.managed && !isJsonMode()) {
+	const eject = {
+		managed: plan.managed,
+		source: Boolean(args["--source"]),
+		force: args["--force"] === true
+	};
+	const refusal = ejectRefusal(eject, projectRef);
+	if (refusal) fail(refusal.message, refusal.hint, refusal.code);
+	const warnings = deployWarnings(eject, projectRef);
+	for (const w of warnings) warn(w.message, w.hint);
+	if (!args["--source"] && !isJsonMode()) {
 		console.log("");
-		console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-		console.log(chalk.gray("    Use `rebase cloud deploy --bundle` to stay on managed."));
+		for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
 	}
 	let source;
 	if (args["--source"]) {
@@ -5704,8 +6647,10 @@ async function deployCommand(rawArgs, projectRef) {
 			fs.rmSync(tarPath, { force: true });
 		}
 	}
-	console.log("");
-	console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	}
 	const body = { projectId };
 	if (source) body.source = source;
 	if (args["--message"]) body.message = args["--message"];
@@ -5733,7 +6678,8 @@ async function deployCommand(rawArgs, projectRef) {
 			deploymentId,
 			deduplicated,
 			frameworkVersion: frameworkVersion ?? null,
-			following: false
+			following: false,
+			...warningPayload(warnings)
 		});
 		return;
 	}
@@ -5747,7 +6693,8 @@ async function deployCommand(rawArgs, projectRef) {
 		deduplicated,
 		frameworkVersion: frameworkVersion ?? null,
 		following: true,
-		status
+		status,
+		...warningPayload(warnings)
 	});
 }
 /**
@@ -8361,6 +9308,7 @@ function describeDatabaseState(db) {
 * So both are printed, rather than leaving anyone to infer one from a Docker tag.
 */
 function describeRuntime(project) {
+	if (project.runtimeMode == null || project.runtimeMode.trim() === "") return `not deployed yet ${chalk.gray("· the first deploy decides (`--bundle` keeps it managed)")}`;
 	if (project.runtimeMode !== "managed") return `custom ${chalk.gray("· your own image")}`;
 	const version = project.runtimeVersion ?? "unknown";
 	const framework = project.runtimeFrameworkVersion;
@@ -8759,17 +9707,41 @@ async function billingCommand(rawArgs) {
 * dispatched from here. Individual groups live in sibling modules; this file
 * only routes and prints help.
 */
-/** Positional tokens after `rebase cloud` (group, action, …). */
+/**
+* Positional tokens after `rebase cloud` (group, action, …).
+*
+* Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
+* declared so `arg` *consumes* the flags that may precede it — critically
+* together with their values, which is the half that filtering cannot do. The
+* leading-`-` skip then covers a flag nobody declared, so an unrecognised
+* boolean shifts nothing.
+*
+* Only leading tokens are skipped: past the group and action, an undeclared
+* flag and its value are somebody else's positionals and none of our business.
+* A flag this file has never heard of, that takes a value, placed before the
+* group, is the one shape still unresolvable here — there is no way to know
+* whether the token after it is its value or the group, and guessing either way
+* is worse than the handler reporting an unknown group.
+*
+* Exported so its tests can drive the real thing. The dispatch test used to
+* re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which
+* filtered flags, while this function did not — so the test asserted the
+* behaviour we wanted against a copy that had it, and stayed green for as long
+* as the real dispatcher was broken.
+*/
 function positionals(rawArgs) {
-	return arg({}, {
+	const rest = arg(GLOBAL_CLOUD_FLAGS, {
 		argv: rawArgs.slice(3),
 		permissive: true
 	})._;
+	let i = 0;
+	while (i < rest.length && rest[i].startsWith("-")) i++;
+	return rest.slice(i);
 }
 async function cloudCommand(subcommand, rawArgs) {
 	initOutputMode(rawArgs);
 	const pos = positionals(rawArgs);
-	const group = subcommand && subcommand !== "--help" ? subcommand : pos[0];
+	const group = pos[0] ?? (subcommand !== "--help" ? subcommand : void 0);
 	const action = pos[1];
 	if (!group || subcommand === "--help") {
 		printCloudHelp();
@@ -9039,11 +10011,8 @@ async function appsCommand(subcommand, rawArgs = []) {
 }
 function describeApp(app) {
 	switch (app.type) {
-		case "backend": return `config: ${app.config ?? "config"}, mode: ${app.mode ?? "cms"}`;
-		case "static": return `${app.root} → ${app.output}`;
-		case "admin": return app.mode === "bundled" ? `bundled → ${app.output ?? "?"}` : "hosted by the platform";
-		case "mobile": return app.platform;
-		case "custom": return app.dockerfile ?? "Dockerfile";
+		case "backend": return app.runtime === "custom" ? `custom runtime — ${app.dockerfile ?? "Dockerfile"}` : `managed runtime, config: ${app.config ?? "config"}`;
+		case "static": return `${app.root} → ${app.output} @ ${app.path ?? "/"}`;
 		default: return "";
 	}
 }
@@ -9053,7 +10022,7 @@ async function listApps(asJson) {
 	if (asJson) {
 		console.log(JSON.stringify({
 			source: loaded.source,
-			runtime: loaded.manifest.runtime,
+			rebase: loaded.manifest.rebase,
 			apps: loaded.manifest.apps,
 			managed: compatibility
 		}, null, 2));
@@ -9063,7 +10032,7 @@ async function listApps(asJson) {
 		console.log(chalk.dim("No rebase.json — showing the layout inferred from this project."));
 		console.log(chalk.dim(`Run ${chalk.cyan("rebase apps init")} to write it down.\n`));
 	}
-	console.log(chalk.bold(`Runtime  ${loaded.manifest.runtime}`));
+	console.log(chalk.bold(`Rebase   ${loaded.manifest.rebase}`));
 	console.log("");
 	const entries = Object.entries(loaded.manifest.apps);
 	if (entries.length === 0) {
@@ -9194,8 +10163,9 @@ async function entry(args) {
 		console.log(getVersion());
 		return;
 	}
-	const command = parsedArgs._[0];
-	const subcommand = parsedArgs._[1];
+	const words = parsedArgs._.filter((a) => !a.startsWith("-"));
+	const command = words[0];
+	const subcommand = words[1];
 	if (!command || parsedArgs["--help"] && ![
 		"init",
 		"schema",
@@ -9209,6 +10179,7 @@ async function entry(args) {
 		"api-keys",
 		"cloud",
 		"apps",
+		"eject",
 		"generate-sdk"
 	].includes(command)) {
 		printHelp();
@@ -9233,9 +10204,10 @@ async function entry(args) {
 				argv: args.slice(3),
 				permissive: true
 			});
+			const sdkRoot = sdkArgs["--help"] ? process.cwd() : requireProjectRoot();
 			await generateSdkCommand({
-				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
-				output: sdkArgs["--output"] || "./generated/sdk",
+				collectionsDir: sdkArgs["--collections-dir"] || path.join(sdkRoot, "config/collections"),
+				output: sdkArgs["--output"] || path.join(sdkRoot, "generated/sdk"),
 				from: sdkArgs["--from"],
 				token: sdkArgs["--token"],
 				help: sdkArgs["--help"],
@@ -9261,6 +10233,9 @@ async function entry(args) {
 		case "apps":
 			await appsCommand(effectiveSubcommand, args);
 			break;
+		case "eject":
+			await ejectCommand(args);
+			break;
 		case "auth":
 			await authCommand(effectiveSubcommand, args);
 			break;
@@ -9295,6 +10270,8 @@ ${chalk.green.bold("Commands")}
   ${chalk.blue.bold("dev")}                     Start the development server
   ${chalk.blue.bold("build")}                   Build all workspace packages
   ${chalk.blue.bold("start")}                   Start the backend server ${chalk.gray("(production)")}
+  ${chalk.blue.bold("apps list")}               Show the apps this repository declares
+  ${chalk.blue.bold("eject")}                   Take ownership of the server process and image
 
 ${chalk.green.bold("Schema")}
   ${chalk.blue.bold("schema generate")}         Generate Drizzle schema from collections
@@ -9312,25 +10289,25 @@ ${chalk.green.bold("SDK")}
 
 ${chalk.green.bold("Auth")}
   ${chalk.blue.bold("auth reset-password")}     Reset a user's password
-  ${chalk.blue.bold("auth")} ${chalk.gray("--help")}              Show auth command help
+  ${chalk.blue.bold("auth")} ${chalk.gray("--help")}             Show auth command help
 
 ${chalk.green.bold("Diagnostics")}
   ${chalk.blue.bold("doctor")}                  Detect schema drift between collections, schema, and DB
 
 ${chalk.green.bold("AI Agent Skills")}
-  ${chalk.blue.bold("skills install")}           Install Rebase agent skills for your AI coding assistant
+  ${chalk.blue.bold("skills install")}          Install Rebase agent skills for your AI coding assistant
 
 ${chalk.green.bold("API Keys")}
-  ${chalk.blue.bold("api-keys list")}            List all service API keys
-  ${chalk.blue.bold("api-keys create")}          Create a new scoped API key
-  ${chalk.blue.bold("api-keys revoke")}          Revoke an existing API key
-  ${chalk.blue.bold("api-keys")} ${chalk.gray("--help")}          Show API key command help
+  ${chalk.blue.bold("api-keys list")}           List all service API keys
+  ${chalk.blue.bold("api-keys create")}         Create a new scoped API key
+  ${chalk.blue.bold("api-keys revoke")}         Revoke an existing API key
+  ${chalk.blue.bold("api-keys")} ${chalk.gray("--help")}         Show API key command help
 
 ${chalk.green.bold("Rebase Cloud")}
   ${chalk.blue.bold("cloud login")}             Sign in to the hosted control plane
   ${chalk.blue.bold("cloud link")}              Link this directory to a cloud project
   ${chalk.blue.bold("cloud deploy")}            Deploy the linked project + stream logs
-  ${chalk.blue.bold("cloud")} ${chalk.gray("--help")}             Show all cloud commands
+  ${chalk.blue.bold("cloud")} ${chalk.gray("--help")}            Show all cloud commands
 
 ${chalk.green.bold("Options")}
   ${chalk.blue("--version, -v")}   Show version number
@@ -9340,6 +10317,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map