@rebasepro/cli 0.12.1-canary.g389e9b2 → 0.12.1-canary.g4e7bcbf

package/dist/commands/cloud/context.d.ts

@@ -84,6 +84,39 @@ export interface ProjectLink {
 export declare function readLink(cwd?: string): ProjectLink | null;
 export declare function writeLink(link: ProjectLink, cwd?: string): void;
 export declare function removeLink(cwd?: string): boolean;
+/**
+ * Flags that may appear anywhere on a `rebase cloud` line, including *before*
+ * the resource group.
+ *
+ * They have to be declared wherever positionals are resolved, because `arg`'s
+ * `permissive: true` does not merely tolerate an undeclared flag — it pushes it
+ * into `_` alongside the positionals, and for a flag that takes a value it
+ * pushes the value in too. So `cloud --project acme storage create` parsed
+ * without this spec yields `_` of `["--project", "acme", "storage", "create"]`,
+ * and the group reads as `"acme"`: a real project name, in the group position,
+ * dispatching to nothing. Skipping tokens that start with `-` does not save you
+ * there — the damage is the orphaned value, which looks exactly like a
+ * positional.
+ *
+ * Only genuinely global flags belong here. Group-specific ones (`--bucket`,
+ * `--region`, …) are declared by the handler that owns them and always follow
+ * the group, so they cannot shift the group or action.
+ *
+ * `-p` is `--project` in eighteen places and `--password` in `login`. That
+ * ambiguity does not matter to the one caller that reads this spec: it resolves
+ * positionals and never looks at a flag's value, so all it needs to know is
+ * that `-p` takes one. Anything that wants the value must keep declaring it
+ * itself, with the meaning its own command gives it.
+ */
+export declare const GLOBAL_CLOUD_FLAGS: {
+    readonly "--json": BooleanConstructor;
+    readonly "--yes": BooleanConstructor;
+    readonly "--help": BooleanConstructor;
+    readonly "--project": StringConstructor;
+    readonly "-p": "--project";
+    readonly "-y": "--yes";
+    readonly "-h": "--help";
+};
 /**
  * The raw project reference to operate on: explicit `--project` flag wins,
  * otherwise the linked project. Exits with guidance when neither is present.
@@ -134,6 +167,26 @@ export declare function printJson(value: unknown): void;
  * call is what guarantees a command can never print a table AND a JSON blob.
  */
 export declare function emit(human: () => void, json: unknown): void;
+/**
+ * Print a warning (+ optional hint) — in every output mode, always to stderr.
+ *
+ * `emit` is for a command's *result*, and JSON mode legitimately replaces the
+ * human rendering of one. A warning is not a result: it says the command is
+ * about to do something the caller may not have meant, and that is exactly as
+ * true when the output is piped. Gating one on `!isJsonMode()` deleted it
+ * precisely where nobody was watching the terminal — a `--source` deploy ejected
+ * a live project off the managed runtime and said so only to a TTY that wasn't
+ * there.
+ *
+ * stdout carries the JSON value and nothing else, so warnings go to stderr:
+ * a machine parser reading stdout cannot be corrupted by one. Only the
+ * *formatting* may depend on the mode — colour and indentation for a terminal,
+ * plain ASCII otherwise. Whether a warning is emitted at all may not.
+ *
+ * Anything a caller might branch on belongs in the JSON payload as well; stderr
+ * is for whoever reads the transcript afterwards.
+ */
+export declare function warn(message: string, hint?: string): void;
 /** Print an error (+ optional hint) and exit non-zero. Never returns. */
 export declare function fail(message: string, hint?: string, code?: string): never;
 /**

package/dist/commands/cloud/deploy.d.ts

@@ -46,5 +46,69 @@ export declare function timeAgo(value: string | Date | undefined, now: Date): st
 export declare function isManagedProject(project: DeployProjectRow | undefined, latest: DeploySourceRow | undefined): boolean;
 /** What a `deploy` with nothing attached will build, in the words to print. */
 export declare function planBareDeploy(project: DeployProjectRow | undefined, latest: DeploySourceRow | undefined, now: Date): BareDeployPlan;
+/**
+ * A warning attached to a deploy: printed for the human, carried in the JSON.
+ *
+ * `code` is the stable half — the message is prose and will be reworded, so it
+ * is the code that CI or an agent branches on.
+ */
+export interface DeployWarning {
+    code: string;
+    message: string;
+    hint?: string;
+}
+/** `code` of the warning below, and the field name it sets in the payload. */
+export declare const EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
+/** The one sentence that says a source build undoes `runtimeMode: managed`. */
+export declare function ejectWarning(projectRef: string): DeployWarning;
+/** How a container-image deploy was asked for — the input to both rules below. */
+export interface EjectContext {
+    /** The project currently runs on the managed runtime. */
+    managed: boolean;
+    /** `--source` was passed: build this directory. */
+    source: boolean;
+    /** `--force` was passed: eject on purpose. */
+    force: boolean;
+}
+/**
+ * Why a container-image deploy of a managed project is refused — or `undefined`
+ * to let it through.
+ *
+ * Every path below this point builds a container image, and a successful one
+ * sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+ * was used" but "did the caller ask to leave the managed runtime", and only
+ * `--force` answers it.
+ *
+ * `--source` used to be read as answering it too, on the theory that uploading a
+ * build context is self-evidently a deliberate eject. It is not: `--source`
+ * picks *which source* gets built — this directory, rather than the stale
+ * archive the control plane is holding — and the eject is a side effect of the
+ * answer. That is exactly how a live project got flipped to `custom` by someone
+ * whose actual intent was "deploy what I have here", and it is the same
+ * ignorance the bare form is refused for. Same ignorance, same refusal.
+ */
+export declare function ejectRefusal(opts: EjectContext, projectRef: string): {
+    message: string;
+    hint: string;
+    code: string;
+} | undefined;
+/**
+ * Which warnings a container-image deploy has earned.
+ *
+ * Pure, and separate from the printing, because the printing is what went
+ * wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+ * the fact that a deploy ejects a managed project existed only as a side effect
+ * of a TTY being attached. Deciding here, emitting once at the call site, means
+ * the decision cannot be output-mode-dependent again.
+ *
+ * The condition is just `managed`: anything reaching this point is a container
+ * image build that `ejectRefusal` has already let through, and on a managed
+ * project that is an eject however it was spelled. A caller who passed `--force`
+ * knows — the warning is for the transcript and the payload, which is what
+ * anyone reviewing the deploy afterwards actually reads.
+ */
+export declare function deployWarnings(opts: EjectContext, projectRef: string): DeployWarning[];
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+export declare function warningPayload(warnings: DeployWarning[]): Record<string, unknown>;
 export declare function deployCommand(rawArgs: string[], projectRef: string): Promise<void>;
 export declare function logsCommand(rawArgs: string[], projectRef: string): Promise<void>;

package/dist/commands/cloud/index.d.ts

@@ -1 +1,24 @@
+/**
+ * Positional tokens after `rebase cloud` (group, action, …).
+ *
+ * Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
+ * declared so `arg` *consumes* the flags that may precede it — critically
+ * together with their values, which is the half that filtering cannot do. The
+ * leading-`-` skip then covers a flag nobody declared, so an unrecognised
+ * boolean shifts nothing.
+ *
+ * Only leading tokens are skipped: past the group and action, an undeclared
+ * flag and its value are somebody else's positionals and none of our business.
+ * A flag this file has never heard of, that takes a value, placed before the
+ * group, is the one shape still unresolvable here — there is no way to know
+ * whether the token after it is its value or the group, and guessing either way
+ * is worse than the handler reporting an unknown group.
+ *
+ * Exported so its tests can drive the real thing. The dispatch test used to
+ * re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which
+ * filtered flags, while this function did not — so the test asserted the
+ * behaviour we wanted against a copy that had it, and stayed green for as long
+ * as the real dispatcher was broken.
+ */
+export declare function positionals(rawArgs: string[]): string[];
 export declare function cloudCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/dev.d.ts

@@ -1 +1,17 @@
+/** Well-known filename the backend writes its actual port to. */
+export declare const DEV_PORT_FILENAME = ".rebase-dev-port";
+/**
+ * Compute a deterministic port from the project root path.
+ * Range: 3001–3999 (avoids privileged ports and common services).
+ * Two different project directories will almost always get different ports.
+ */
+export declare function getProjectPort(projectRoot: string): number;
+/**
+ * Resolve the best starting port for this project:
+ * 1. Explicit --port flag (highest priority)
+ * 2. PORT env var
+ * 3. Previously used port from .rebase-dev-port (port affinity across restarts)
+ * 4. Deterministic hash from project path (unique per project)
+ */
+export declare function resolveStartPort(projectRoot: string, explicitPort?: number): number;
 export declare function devCommand(rawArgs: string[]): Promise<void>;

package/dist/index.es.js

@@ -603,6 +603,39 @@ function removeLink(cwd = process.cwd()) {
 	}
 	return false;
 }
+/**
+* Flags that may appear anywhere on a `rebase cloud` line, including *before*
+* the resource group.
+*
+* They have to be declared wherever positionals are resolved, because `arg`'s
+* `permissive: true` does not merely tolerate an undeclared flag — it pushes it
+* into `_` alongside the positionals, and for a flag that takes a value it
+* pushes the value in too. So `cloud --project acme storage create` parsed
+* without this spec yields `_` of `["--project", "acme", "storage", "create"]`,
+* and the group reads as `"acme"`: a real project name, in the group position,
+* dispatching to nothing. Skipping tokens that start with `-` does not save you
+* there — the damage is the orphaned value, which looks exactly like a
+* positional.
+*
+* Only genuinely global flags belong here. Group-specific ones (`--bucket`,
+* `--region`, …) are declared by the handler that owns them and always follow
+* the group, so they cannot shift the group or action.
+*
+* `-p` is `--project` in eighteen places and `--password` in `login`. That
+* ambiguity does not matter to the one caller that reads this spec: it resolves
+* positionals and never looks at a flag's value, so all it needs to know is
+* that `-p` takes one. Anything that wants the value must keep declaring it
+* itself, with the meaning its own command gives it.
+*/
+var GLOBAL_CLOUD_FLAGS = {
+	"--json": Boolean,
+	"--yes": Boolean,
+	"--help": Boolean,
+	"--project": String,
+	"-p": "--project",
+	"-y": "--yes",
+	"-h": "--help"
+};
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
 * The raw project reference to operate on: explicit `--project` flag wins,
@@ -708,6 +741,35 @@ function emit(human, json) {
 	if (JSON_MODE) printJson(json);
 	else human();
 }
+/**
+* Print a warning (+ optional hint) — in every output mode, always to stderr.
+*
+* `emit` is for a command's *result*, and JSON mode legitimately replaces the
+* human rendering of one. A warning is not a result: it says the command is
+* about to do something the caller may not have meant, and that is exactly as
+* true when the output is piped. Gating one on `!isJsonMode()` deleted it
+* precisely where nobody was watching the terminal — a `--source` deploy ejected
+* a live project off the managed runtime and said so only to a TTY that wasn't
+* there.
+*
+* stdout carries the JSON value and nothing else, so warnings go to stderr:
+* a machine parser reading stdout cannot be corrupted by one. Only the
+* *formatting* may depend on the mode — colour and indentation for a terminal,
+* plain ASCII otherwise. Whether a warning is emitted at all may not.
+*
+* Anything a caller might branch on belongs in the JSON payload as well; stderr
+* is for whoever reads the transcript afterwards.
+*/
+function warn(message, hint) {
+	if (JSON_MODE) {
+		process.stderr.write(`warning: ${stripAnsi(message)}\n`);
+		if (hint) process.stderr.write(`  ${stripAnsi(hint)}\n`);
+		return;
+	}
+	console.error("");
+	console.error(chalk.yellow(`  ⚠ ${message}`));
+	if (hint) console.error(chalk.gray(`    ${hint}`));
+}
 /** Print an error (+ optional hint) and exit non-zero. Never returns. */
 function fail(message, hint, code) {
 	if (JSON_MODE) {
@@ -1569,6 +1631,8 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		});
 		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
+		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
+		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
 		const runtimeVersion = readCliVersion();
 		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, `REBASE_VERSION=${runtimeVersion}`) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\nREBASE_VERSION=${runtimeVersion}\n`;
 		if (databaseUrl) {
@@ -6238,12 +6302,24 @@ function resolveFrameworkVersion(sourceDir) {
 		dir = parent;
 	}
 }
+/**
+* A progress line for a human — dropped entirely in JSON mode.
+*
+* Progress is not a result. In JSON mode stdout carries the one result value
+* and nothing else, so every unguarded `console.log` on a deploy path was a
+* line printed in front of the JSON, breaking the parser meant to read it.
+* Warnings are the other half of this rule and go the other way: they are
+* `warn`, which prints in every mode, to stderr. See `warn` in `context.ts`.
+*/
+function progress(line) {
+	if (!isJsonMode()) console.log(line);
+}
 /** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
 async function uploadSource(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
 	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
 	if (bytes.length > MAX_SOURCE_UPLOAD_BYTES) fail(`Source context is ${sizeMb} MB — the upload cap is ${Math.round(MAX_SOURCE_UPLOAD_BYTES / 1024 / 1024)} MB.`, "Trim the build context: exclude sourcemaps (*.map), build output and large assets via .rebaseignore or .gitignore.");
-	console.log(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
+	progress(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
 	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
 		method: "POST",
 		headers: {
@@ -6275,7 +6351,7 @@ async function deployBundle(opts) {
 		const loaded = loadManifest(projectRoot);
 		const backend = findBackendApp(loaded.manifest);
 		if (!backend) fail("This repository declares no backend app to deploy as a bundle.", "A managed deploy runs the backend; declare one in rebase.json, or deploy from the backend's repository.");
-		console.log(chalk.gray("  Building bundle..."));
+		progress(chalk.gray("  Building bundle..."));
 		bundleDir = (await buildBundle({
 			projectRoot,
 			appName: backend.name,
@@ -6283,16 +6359,16 @@ async function deployBundle(opts) {
 			runtimeRange: loaded.manifest.rebase,
 			storage: loaded.manifest.storage,
 			skipTypeCheck: opts.skipTypeCheck,
-			log: (m) => console.log(chalk.gray(m))
+			log: (m) => progress(chalk.gray(m))
 		})).outDir;
 		try {
 			const folded = await foldFrontendIntoBundle({
 				projectRoot,
 				manifest: loaded.manifest,
 				bundleDir,
-				log: (m) => console.log(m)
+				log: (m) => progress(m)
 			});
-			for (const outcome of folded) console.log(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
+			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
 		} catch (err) {
 			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
 		}
@@ -6309,7 +6385,7 @@ async function deployBundle(opts) {
 	try {
 		await packBundle(bundleDir, tarPath);
 		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
-		console.log(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
 		bundleId = await uploadBundle(url, token, projectId, tarPath);
 	} catch (e) {
 		fail(e instanceof Error ? e.message : String(e));
@@ -6317,8 +6393,10 @@ async function deployBundle(opts) {
 	} finally {
 		fs.rmSync(tarPath, { force: true });
 	}
-	console.log("");
-	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	}
 	let declaredApps = [];
 	try {
 		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
@@ -6406,9 +6484,75 @@ function planBareDeploy(project, latest, now) {
 		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
 	};
 }
+/** `code` of the warning below, and the field name it sets in the payload. */
+var EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
 /** The one sentence that says a source build undoes `runtimeMode: managed`. */
 function ejectWarning(projectRef) {
-	return `⚠ ${projectRef} runs on the managed runtime — a source build ejects it to a custom container.`;
+	return {
+		code: EJECTS_MANAGED_RUNTIME,
+		message: `${projectRef} runs on the managed runtime — this build ejects it to a custom container.`,
+		hint: "Use `rebase cloud deploy --bundle` to stay on managed."
+	};
+}
+/**
+* Why a container-image deploy of a managed project is refused — or `undefined`
+* to let it through.
+*
+* Every path below this point builds a container image, and a successful one
+* sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+* was used" but "did the caller ask to leave the managed runtime", and only
+* `--force` answers it.
+*
+* `--source` used to be read as answering it too, on the theory that uploading a
+* build context is self-evidently a deliberate eject. It is not: `--source`
+* picks *which source* gets built — this directory, rather than the stale
+* archive the control plane is holding — and the eject is a side effect of the
+* answer. That is exactly how a live project got flipped to `custom` by someone
+* whose actual intent was "deploy what I have here", and it is the same
+* ignorance the bare form is refused for. Same ignorance, same refusal.
+*/
+function ejectRefusal(opts, projectRef) {
+	if (!opts.managed || opts.force) return void 0;
+	const eject = "To eject on purpose, add `--force`.";
+	if (opts.source) return {
+		message: `${projectRef} runs on the managed runtime, and \`--source\` builds a container image from this directory — which ejects it from managed. Picking a build method is not the same as asking to leave the runtime.`,
+		hint: `Deploy this directory to the managed runtime with \`rebase cloud deploy --bundle\`. ${eject}`,
+		code: "managed_project"
+	};
+	return {
+		message: `${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`,
+		hint: `Redeploy it with \`rebase cloud deploy --bundle\`. ${eject} \`--source . --force\` builds this directory; \`--force\` alone builds what the control plane holds.`,
+		code: "managed_project"
+	};
+}
+/**
+* Which warnings a container-image deploy has earned.
+*
+* Pure, and separate from the printing, because the printing is what went
+* wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+* the fact that a deploy ejects a managed project existed only as a side effect
+* of a TTY being attached. Deciding here, emitting once at the call site, means
+* the decision cannot be output-mode-dependent again.
+*
+* The condition is just `managed`: anything reaching this point is a container
+* image build that `ejectRefusal` has already let through, and on a managed
+* project that is an eject however it was spelled. A caller who passed `--force`
+* knows — the warning is for the transcript and the payload, which is what
+* anyone reviewing the deploy afterwards actually reads.
+*/
+function deployWarnings(opts, projectRef) {
+	return opts.managed ? [ejectWarning(projectRef)] : [];
+}
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+function warningPayload(warnings) {
+	return {
+		warnings: warnings.map((w) => ({
+			code: w.code,
+			message: w.message,
+			hint: w.hint ?? null
+		})),
+		ejectsManagedRuntime: warnings.some((w) => w.code === EJECTS_MANAGED_RUNTIME)
+	};
 }
 /**
 * Read the two rows the preflight needs.
@@ -6479,17 +6623,18 @@ async function deployCommand(rawArgs, projectRef) {
 	}
 	const { project, latest } = await readDeployContext(client, projectId);
 	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
-	if (!args["--source"]) {
-		if (plan.managed && args["--force"] !== true) fail(`${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`, "Redeploy it with `rebase cloud deploy --bundle`. To eject on purpose, pass `--source .` to build this directory, or `--force` to build what the control plane holds.", "managed_project");
-		if (!isJsonMode()) {
-			console.log("");
-			if (plan.managed) console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-			for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
-		}
-	} else if (plan.managed && !isJsonMode()) {
+	const eject = {
+		managed: plan.managed,
+		source: Boolean(args["--source"]),
+		force: args["--force"] === true
+	};
+	const refusal = ejectRefusal(eject, projectRef);
+	if (refusal) fail(refusal.message, refusal.hint, refusal.code);
+	const warnings = deployWarnings(eject, projectRef);
+	for (const w of warnings) warn(w.message, w.hint);
+	if (!args["--source"] && !isJsonMode()) {
 		console.log("");
-		console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-		console.log(chalk.gray("    Use `rebase cloud deploy --bundle` to stay on managed."));
+		for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
 	}
 	let source;
 	if (args["--source"]) {
@@ -6502,8 +6647,10 @@ async function deployCommand(rawArgs, projectRef) {
 			fs.rmSync(tarPath, { force: true });
 		}
 	}
-	console.log("");
-	console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	}
 	const body = { projectId };
 	if (source) body.source = source;
 	if (args["--message"]) body.message = args["--message"];
@@ -6531,7 +6678,8 @@ async function deployCommand(rawArgs, projectRef) {
 			deploymentId,
 			deduplicated,
 			frameworkVersion: frameworkVersion ?? null,
-			following: false
+			following: false,
+			...warningPayload(warnings)
 		});
 		return;
 	}
@@ -6545,7 +6693,8 @@ async function deployCommand(rawArgs, projectRef) {
 		deduplicated,
 		frameworkVersion: frameworkVersion ?? null,
 		following: true,
-		status
+		status,
+		...warningPayload(warnings)
 	});
 }
 /**
@@ -9159,6 +9308,7 @@ function describeDatabaseState(db) {
 * So both are printed, rather than leaving anyone to infer one from a Docker tag.
 */
 function describeRuntime(project) {
+	if (project.runtimeMode == null || project.runtimeMode.trim() === "") return `not deployed yet ${chalk.gray("· the first deploy decides (`--bundle` keeps it managed)")}`;
 	if (project.runtimeMode !== "managed") return `custom ${chalk.gray("· your own image")}`;
 	const version = project.runtimeVersion ?? "unknown";
 	const framework = project.runtimeFrameworkVersion;
@@ -9557,17 +9707,41 @@ async function billingCommand(rawArgs) {
 * dispatched from here. Individual groups live in sibling modules; this file
 * only routes and prints help.
 */
-/** Positional tokens after `rebase cloud` (group, action, …). */
+/**
+* Positional tokens after `rebase cloud` (group, action, …).
+*
+* Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
+* declared so `arg` *consumes* the flags that may precede it — critically
+* together with their values, which is the half that filtering cannot do. The
+* leading-`-` skip then covers a flag nobody declared, so an unrecognised
+* boolean shifts nothing.
+*
+* Only leading tokens are skipped: past the group and action, an undeclared
+* flag and its value are somebody else's positionals and none of our business.
+* A flag this file has never heard of, that takes a value, placed before the
+* group, is the one shape still unresolvable here — there is no way to know
+* whether the token after it is its value or the group, and guessing either way
+* is worse than the handler reporting an unknown group.
+*
+* Exported so its tests can drive the real thing. The dispatch test used to
+* re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which
+* filtered flags, while this function did not — so the test asserted the
+* behaviour we wanted against a copy that had it, and stayed green for as long
+* as the real dispatcher was broken.
+*/
 function positionals(rawArgs) {
-	return arg({}, {
+	const rest = arg(GLOBAL_CLOUD_FLAGS, {
 		argv: rawArgs.slice(3),
 		permissive: true
 	})._;
+	let i = 0;
+	while (i < rest.length && rest[i].startsWith("-")) i++;
+	return rest.slice(i);
 }
 async function cloudCommand(subcommand, rawArgs) {
 	initOutputMode(rawArgs);
 	const pos = positionals(rawArgs);
-	const group = subcommand && subcommand !== "--help" ? subcommand : pos[0];
+	const group = pos[0] ?? (subcommand !== "--help" ? subcommand : void 0);
 	const action = pos[1];
 	if (!group || subcommand === "--help") {
 		printCloudHelp();
@@ -9989,8 +10163,9 @@ async function entry(args) {
 		console.log(getVersion());
 		return;
 	}
-	const command = parsedArgs._[0];
-	const subcommand = parsedArgs._[1];
+	const words = parsedArgs._.filter((a) => !a.startsWith("-"));
+	const command = words[0];
+	const subcommand = words[1];
 	if (!command || parsedArgs["--help"] && ![
 		"init",
 		"schema",
@@ -10142,6 +10317,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map