@rebasepro/cli 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/index.es.js

@@ -12,9 +12,9 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
+import { createRequire } from "module";
 import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, normalizeStorageSources, storageEnvSuffix } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
-import { createRequire } from "module";
 //#region src/utils/package-manager.ts
 /**
 * Package manager detection and command abstraction.
@@ -355,8 +355,9 @@ function requireProjectRoot() {
 	const root = findProjectRoot();
 	if (!root) {
 		console.error(chalk.red("✗ Could not find a Rebase project root."));
-		console.error(chalk.gray("  Make sure you are inside a Rebase project directory"));
-		console.error(chalk.gray("  (one with backend/, frontend/, and config/ directories)."));
+		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
+		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
+		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
 		process.exit(1);
 	}
 	return root;
@@ -527,33 +528,51 @@ async function requireClient(rawArgs) {
 	};
 }
 /**
-* The base domain tenant projects are served at, as reported by the control
-* plane (`platform-config`, which derives it from the same TENANT_BASE_DOMAIN
-* the ingress and the console read — see saas/backend/src/utils/tenant-domain.ts).
+* The control plane's public, non-secret self-description (`platform-config`).
 *
-* The CLI cannot know this value: it is per-deployment configuration (production
-* serves tenants at `apps.rebase.pro`, a dev control plane at `localhost`). It
-* used to be hardcoded to `rebase.pro`, so `cloud projects create` congratulated
-* the user with a URL that resolves nowhere near their app.
+* None of it is knowable from the CLI side: it is per-deployment configuration —
+* production serves tenants at `rebase.website` on GKE, a dev control plane at
+* `localhost` on Docker. Guessing produced two separate lies: a congratulation
+* URL that resolved nowhere near the app, and a `provider` the project does not
+* run on (see `createProject`).
 *
 * Cached per host for the process: it is fixed for a control plane's lifetime,
 * and `projects list` formats one host per row off a single fetch.
 *
-* @returns the base domain, or `undefined` if the control plane doesn't serve
+* @returns the config, or `undefined` if the control plane doesn't serve
 *   `platform-config` (an older deployment) or the request failed. A failure is
-*   cached too — the caller renders a subdomain either way, and a short-lived
-*   CLI should not retry once per row.
-*/
-var tenantBaseDomainCache = /* @__PURE__ */ new Map();
-function fetchTenantBaseDomain(client, url) {
-	let pending = tenantBaseDomainCache.get(url);
+*   cached too — a short-lived CLI should not retry once per row. Note the
+*   distinction callers rely on: `undefined` means "this control plane cannot
+*   tell us", whereas `deployTargets: []` is a control plane stating that it has
+*   no infrastructure configured.
+*/
+var platformConfigCache = /* @__PURE__ */ new Map();
+function fetchPlatformConfig(client, url) {
+	let pending = platformConfigCache.get(url);
 	if (!pending) {
-		pending = client.functions.invoke("platform-config", void 0, { method: "GET" }).then((cfg) => cfg?.tenantBaseDomain?.trim() || void 0).catch(() => void 0);
-		tenantBaseDomainCache.set(url, pending);
+		pending = client.functions.invoke("platform-config", void 0, { method: "GET" }).then((cfg) => cfg ?? void 0).catch(() => void 0);
+		platformConfigCache.set(url, pending);
 	}
 	return pending;
 }
 /**
+* The base domain tenant projects are served at, derived from the same
+* TENANT_BASE_DOMAIN the ingress and the console read (see
+* saas/backend/src/utils/tenant-domain.ts).
+*/
+function fetchTenantBaseDomain(client, url) {
+	return fetchPlatformConfig(client, url).then((cfg) => cfg?.tenantBaseDomain?.trim() || void 0);
+}
+/**
+* The infrastructure a deploy for this control plane would ACTUALLY use, in the
+* resolver's own preference order (saas/backend/src/k8s/resolve.ts).
+*
+* @returns the targets, or `undefined` when the control plane cannot say.
+*/
+function fetchDeployTargets(client, url) {
+	return fetchPlatformConfig(client, url).then((cfg) => Array.isArray(cfg?.deployTargets) ? cfg.deployTargets : void 0);
+}
+/**
 * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when
 * the base domain is unknown.
 *
@@ -602,6 +621,39 @@ function removeLink(cwd = process.cwd()) {
 	}
 	return false;
 }
+/**
+* Flags that may appear anywhere on a `rebase cloud` line, including *before*
+* the resource group.
+*
+* They have to be declared wherever positionals are resolved, because `arg`'s
+* `permissive: true` does not merely tolerate an undeclared flag — it pushes it
+* into `_` alongside the positionals, and for a flag that takes a value it
+* pushes the value in too. So `cloud --project acme storage create` parsed
+* without this spec yields `_` of `["--project", "acme", "storage", "create"]`,
+* and the group reads as `"acme"`: a real project name, in the group position,
+* dispatching to nothing. Skipping tokens that start with `-` does not save you
+* there — the damage is the orphaned value, which looks exactly like a
+* positional.
+*
+* Only genuinely global flags belong here. Group-specific ones (`--bucket`,
+* `--region`, …) are declared by the handler that owns them and always follow
+* the group, so they cannot shift the group or action.
+*
+* `-p` is `--project` in eighteen places and `--password` in `login`. That
+* ambiguity does not matter to the one caller that reads this spec: it resolves
+* positionals and never looks at a flag's value, so all it needs to know is
+* that `-p` takes one. Anything that wants the value must keep declaring it
+* itself, with the meaning its own command gives it.
+*/
+var GLOBAL_CLOUD_FLAGS = {
+	"--json": Boolean,
+	"--yes": Boolean,
+	"--help": Boolean,
+	"--project": String,
+	"-p": "--project",
+	"-y": "--yes",
+	"-h": "--help"
+};
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
 * The raw project reference to operate on: explicit `--project` flag wins,
@@ -707,6 +759,35 @@ function emit(human, json) {
 	if (JSON_MODE) printJson(json);
 	else human();
 }
+/**
+* Print a warning (+ optional hint) — in every output mode, always to stderr.
+*
+* `emit` is for a command's *result*, and JSON mode legitimately replaces the
+* human rendering of one. A warning is not a result: it says the command is
+* about to do something the caller may not have meant, and that is exactly as
+* true when the output is piped. Gating one on `!isJsonMode()` deleted it
+* precisely where nobody was watching the terminal — a `--source` deploy ejected
+* a live project off the managed runtime and said so only to a TTY that wasn't
+* there.
+*
+* stdout carries the JSON value and nothing else, so warnings go to stderr:
+* a machine parser reading stdout cannot be corrupted by one. Only the
+* *formatting* may depend on the mode — colour and indentation for a terminal,
+* plain ASCII otherwise. Whether a warning is emitted at all may not.
+*
+* Anything a caller might branch on belongs in the JSON payload as well; stderr
+* is for whoever reads the transcript afterwards.
+*/
+function warn(message, hint) {
+	if (JSON_MODE) {
+		process.stderr.write(`warning: ${stripAnsi(message)}\n`);
+		if (hint) process.stderr.write(`  ${stripAnsi(hint)}\n`);
+		return;
+	}
+	console.error("");
+	console.error(chalk.yellow(`  ⚠ ${message}`));
+	if (hint) console.error(chalk.gray(`    ${hint}`));
+}
 /** Print an error (+ optional hint) and exit non-zero. Never returns. */
 function fail(message, hint, code) {
 	if (JSON_MODE) {
@@ -825,6 +906,369 @@ function openUrl(target, label = "Opening") {
 		child.unref();
 	} catch {}
 }
+/** Duration in coarse bands — enough to see "slow", not enough to fingerprint. */
+function durationBucket(ms) {
+	if (!Number.isFinite(ms) || ms < 0) return "unknown";
+	if (ms < 5e3) return "<5s";
+	if (ms < 3e4) return "5-30s";
+	if (ms < 12e4) return "30-120s";
+	return "120s+";
+}
+/**
+* Drop anything that is not a permitted value type, and clamp strings.
+*
+* The last line of defence rather than the first. Every call site is supposed
+* to pass enumerated values; this is what stops a future one that forgets from
+* turning into an incident. Strings are capped at 64 characters because no
+* legitimate enumerated value is longer, and a path or a message always is.
+*/
+/**
+* Key names that shadow an `Object.prototype` member.
+*
+* `__proto__` is already excluded by the pattern (it starts with an
+* underscore), and assigning any of these to an object literal shadows rather
+* than pollutes — so nothing is exploitable here. They are refused because a
+* stored property called `constructor` is a trap for every consumer downstream
+* that reaches for `properties.constructor` and gets a string.
+*/
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"constructor",
+	"prototype",
+	"hasownproperty",
+	"tostring",
+	"valueof"
+]);
+function sanitize(properties) {
+	const out = {};
+	for (const [key, value] of Object.entries(properties)) {
+		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key) || RESERVED_KEYS.has(key.toLowerCase())) continue;
+		if (typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) out[key] = value;
+		else if (typeof value === "string" && value.length > 0 && value.length <= 64) {
+			if (!/[/\\@:\s]/.test(value)) out[key] = value;
+		}
+	}
+	return out;
+}
+function cliVersion() {
+	try {
+		const pkg = createRequire(import.meta.url)("../../package.json");
+		return typeof pkg?.version === "string" ? pkg.version : "unknown";
+	} catch {
+		return "unknown";
+	}
+}
+function buildEvent(event, properties, identity) {
+	return {
+		schema: 1,
+		event,
+		machineId: identity.machineId,
+		projectId: identity.projectId,
+		cliVersion: cliVersion(),
+		nodeMajor: Number(process.versions.node.split(".")[0]) || 0,
+		platform: os.platform(),
+		arch: os.arch(),
+		at: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+		properties: sanitize(properties)
+	};
+}
+function configPath() {
+	return path.join(os.homedir(), ".rebase", "telemetry.json");
+}
+function readConfig() {
+	try {
+		const raw = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
+		if (raw && typeof raw === "object") return {
+			version: typeof raw.version === "number" ? raw.version : 1,
+			enabled: typeof raw.enabled === "boolean" ? raw.enabled : void 0,
+			machineId: typeof raw.machineId === "string" ? raw.machineId : void 0,
+			decidedAt: typeof raw.decidedAt === "string" ? raw.decidedAt : void 0
+		};
+	} catch {}
+	return { version: 1 };
+}
+function writeConfig(config) {
+	const file = configPath();
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, JSON.stringify({
+		...config,
+		version: 1
+	}, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+}
+/**
+* The machine's id, generating and persisting one on first use.
+*
+* Only called once consent exists — an id written before the user agreed would
+* be a record we had no right to create, even unsent.
+*/
+function ensureMachineId() {
+	const config = readConfig();
+	if (config.machineId) return config.machineId;
+	const machineId = crypto.randomUUID();
+	writeConfig({
+		...config,
+		machineId
+	});
+	return machineId;
+}
+/**
+* The checkout's id, generating one if this project has none.
+*
+* The directory is created when it is missing, but **only** where a
+* `rebase.json` proves this really is a project root. An earlier version
+* required `.rebase/` to already exist, on the assumption that `rebase init`
+* created it — it does not. It is written only when a scaffold is linked to
+* Rebase Cloud, so every self-hosted project reported no `projectId` at all,
+* for ever. That silently broke the funnel this id exists for, on exactly the
+* population the telemetry is meant to learn about.
+*
+* The `rebase.json` check is what keeps the fix from being "scatter `.rebase/`
+* wherever a command happens to run": no manifest, no project, no directory,
+* and the event simply reports no project.
+*/
+function ensureProjectId(projectRoot) {
+	if (!fs.existsSync(path.join(projectRoot, "rebase.json"))) return void 0;
+	const dir = path.join(projectRoot, ".rebase");
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+	} catch {
+		return;
+	}
+	const file = path.join(dir, "state.json");
+	let state = {};
+	if (fs.existsSync(file)) try {
+		const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
+		if (raw && typeof raw === "object") state = raw;
+	} catch {
+		return;
+	}
+	if (typeof state.telemetryProjectId === "string") return state.telemetryProjectId;
+	const projectId = crypto.randomUUID();
+	try {
+		fs.writeFileSync(file, JSON.stringify({
+			...state,
+			telemetryProjectId: projectId
+		}, null, 2), "utf-8");
+	} catch {
+		return;
+	}
+	return projectId;
+}
+//#endregion
+//#region src/telemetry/project.ts
+function readProjectPolicy(startDir = process.cwd()) {
+	try {
+		const root = findProjectRoot(startDir);
+		if (!root) return "unset";
+		const file = path.join(root, MANIFEST_FILENAME);
+		if (!fs.existsSync(file)) return "unset";
+		const raw = fs.readFileSync(file, "utf-8");
+		const match = /"telemetry"\s*:\s*(true|false)/.exec(raw);
+		if (!match) return "unset";
+		return match[1] === "false" ? "opt_out" : "ignored_opt_in";
+	} catch {
+		return "unset";
+	}
+}
+function endpoint() {
+	return process.env.REBASE_TELEMETRY_ENDPOINT?.trim() || "https://app.rebase.pro/api/functions/telemetry";
+}
+/**
+* The one function that decides whether anything leaves the machine.
+*
+* Every path is a refusal except the last, which is the point: consent is
+* opt-in, so the default answer at every branch — never asked, unreadable
+* config, a set env var, a CI runner — is no.
+*
+* `DO_NOT_TRACK` is honoured because it is the cross-tool convention
+* (consoledonottrack.com); a user who has set it globally has already answered
+* this question and should not be asked again by us.
+*
+* `CI` is refused for a different reason: a build runner is not a person, and
+* counting one is both useless and misleading. A single pipeline re-running on
+* every push would otherwise outweigh every real developer in the data.
+*
+* A project's own `"telemetry": false` is checked *before* the machine setting,
+* because it has to beat an individual opt-in to be worth anything — see
+* project.ts on why the reverse is refused.
+*/
+function suppressionReason(env = process.env, cwd = process.cwd()) {
+	if (env.DO_NOT_TRACK && env.DO_NOT_TRACK !== "0") return "do_not_track";
+	if (env.REBASE_TELEMETRY_DISABLED && env.REBASE_TELEMETRY_DISABLED !== "0") return "rebase_telemetry_disabled";
+	if (env.CI && env.CI !== "false") return "ci";
+	if (readProjectPolicy(cwd) === "opt_out") return "project_opt_out";
+	const config = readConfig();
+	if (config.enabled === void 0) return "not_asked";
+	if (!config.enabled) return "declined";
+	return null;
+}
+function isEnabled(env = process.env, cwd = process.cwd()) {
+	return suppressionReason(env, cwd) === null;
+}
+/**
+* Record the user's answer. `false` is final — nothing prompts again.
+*
+* Returns whether the choice could actually be persisted. A read-only or full
+* home directory makes `writeConfig` throw, and the direction of that failure
+* matters enormously: someone turning sharing **off** who sees a stack trace,
+* or worse sees nothing, is left sharing. The caller is expected to say so and
+* point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.
+*/
+function setConsent(enabled) {
+	const config = readConfig();
+	try {
+		writeConfig({
+			...config,
+			enabled,
+			decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			machineId: enabled ? config.machineId ?? void 0 : void 0
+		});
+		if (enabled) ensureMachineId();
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the event that *would* be sent, without sending it.
+*
+* This is what `rebase telemetry show` prints, and it is deliberately the same
+* function the sender uses — a preview assembled by separate code is a promise
+* that drifts. Returns `null` when nothing would be sent, so the command can
+* say why instead of showing a payload that is never going anywhere.
+*/
+function previewEvent(event, properties = {}, projectRoot) {
+	const config = readConfig();
+	if (!config.machineId) return null;
+	return buildEvent(event, properties, {
+		machineId: config.machineId,
+		projectId: projectRoot ? ensureProjectId(projectRoot) : void 0
+	});
+}
+/**
+* Send one event, or quietly do nothing.
+*
+* Three properties this must hold, in order of importance:
+*
+*  1. **It never throws.** Telemetry failing is not a reason for `rebase dev`
+*     to fail. Every error is swallowed.
+*  2. **It never blocks meaningfully.** A two-second ceiling, after which the
+*     command carries on regardless — a collector having a bad day must not
+*     become the CLI hanging.
+*  3. **It never sends without consent.** Enforced here rather than at the call
+*     sites, so a new call site cannot get it wrong.
+*/
+async function recordEvent(event, properties = {}, options = {}) {
+	try {
+		if (!isEnabled(process.env, options.projectRoot ?? process.cwd())) return;
+		const payload = buildEvent(event, properties, {
+			machineId: ensureMachineId(),
+			projectId: options.projectRoot ? ensureProjectId(options.projectRoot) : void 0
+		});
+		const abort = new AbortController();
+		const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? 2e3);
+		try {
+			await fetch(endpoint(), {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(payload),
+				signal: abort.signal
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+	} catch {}
+}
+//#endregion
+//#region src/telemetry/consent.ts
+/**
+* Asking, and what the question looks like.
+*
+* ## Why the prompt comes *after* the work
+*
+* The first `rebase init` on a machine is the event most worth having, and it
+* is the one where no consent exists yet. Asking before scaffolding puts a
+* privacy negotiation in front of someone who has not yet seen the tool do
+* anything — the worst possible moment, and a reliable way to get a reflexive
+* no.
+*
+* So the question is asked once the project exists and the user has seen it
+* work. The event's data is still in memory at that point, so nothing is lost
+* by waiting, and — this is the part that matters — **nothing has been
+* transmitted or written**. Declining leaves no id, no file, no record.
+*
+* ## Why the payload is shown rather than described
+*
+* "Anonymous usage data" is a phrase that has been used to mean almost
+* anything. Printing the exact JSON costs four lines of output and replaces a
+* claim the user has to take on faith with something they can read. It is also
+* the same builder the sender uses, so it cannot drift into a comfortable
+* fiction.
+*/
+/** True when we may ask: no decision recorded, and nothing else forbids it. */
+function shouldPrompt(env = process.env) {
+	return suppressionReason(env) === "not_asked" && Boolean(process.stdin.isTTY);
+}
+function renderPreview(event, properties) {
+	const preview = buildEvent(event, properties, {
+		machineId: "<random uuid, generated only if you say yes>",
+		projectId: "<random uuid, per checkout>"
+	});
+	return JSON.stringify(preview, null, 2);
+}
+/**
+* Ask, record the answer, and report it.
+*
+* Never throws and never blocks a non-interactive run: `rebase init --yes` in
+* CI must behave exactly as it does today, which means not asking and not
+* sending.
+*/
+async function promptForConsent(event, properties) {
+	if (!shouldPrompt()) return false;
+	try {
+		console.log("");
+		console.log(chalk.bold("Help improve Rebase?"));
+		console.log("");
+		console.log(chalk.gray("  Rebase is self-hosted, so we have no idea what works and what does not"));
+		console.log(chalk.gray("  unless you tell us. Sharing is entirely optional and off by default."));
+		console.log("");
+		console.log(chalk.gray("  This is exactly what would be sent — nothing more, ever:"));
+		console.log("");
+		console.log(renderPreview(event, properties).split("\n").map((line) => chalk.gray("    " + line)).join("\n"));
+		console.log("");
+		console.log(chalk.gray("  No project names, paths, schemas, URLs or error messages. Change your"));
+		console.log(chalk.gray(`  mind any time with ${chalk.cyan("rebase telemetry disable")}.`));
+		console.log("");
+		const { accepted } = await inquirer.prompt([{
+			type: "confirm",
+			name: "accepted",
+			message: "Share anonymous usage data?",
+			default: false
+		}]);
+		setConsent(Boolean(accepted));
+		console.log(accepted ? chalk.green("  Thank you — sharing enabled.") : chalk.gray("  Nothing will be sent. You will not be asked again."));
+		console.log("");
+		return Boolean(accepted);
+	} catch {
+		return false;
+	}
+}
+/** Human-readable current state, for `rebase telemetry status`. */
+function describeState(env = process.env) {
+	const reason = suppressionReason(env);
+	const config = readConfig();
+	switch (reason) {
+		case null: return `${chalk.green("enabled")} — schema v1, machine id ${chalk.gray(config.machineId ?? "unset")}`;
+		case "not_asked": return `${chalk.yellow("not configured")} — nothing has been sent, and you have not been asked yet`;
+		case "declined": return `${chalk.gray("disabled")} — you declined${config.decidedAt ? ` on ${config.decidedAt.slice(0, 10)}` : ""}`;
+		case "do_not_track": return `${chalk.gray("disabled")} — the ${chalk.cyan("DO_NOT_TRACK")} environment variable is set`;
+		case "rebase_telemetry_disabled": return `${chalk.gray("disabled")} — the ${chalk.cyan("REBASE_TELEMETRY_DISABLED")} environment variable is set`;
+		case "ci": return `${chalk.gray("disabled")} — this looks like CI (${chalk.cyan("CI")} is set), which is never counted`;
+		case "project_opt_out": return `${chalk.gray("disabled")} — this project's ${chalk.cyan("rebase.json")} sets ${chalk.cyan("\"telemetry\": false")}`;
+	}
+}
 //#endregion
 //#region src/commands/init.ts
 var access = promisify(fs.access);
@@ -1163,6 +1607,7 @@ async function linkScaffoldToCloud(options) {
 	}
 }
 async function createProject$1(options) {
+	const startedAt = Date.now();
 	if (fs.existsSync(options.targetDirectory)) {
 		if (fs.readdirSync(options.targetDirectory).length !== 0) {
 			console.error(`${chalk.red.bold("ERROR")} Directory "${options.projectName}" already exists and is not empty`);
@@ -1355,6 +1800,18 @@ async function createProject$1(options) {
 	console.log("");
 	console.log(`  ${chalk.cyan("rebase skills install")}  ${chalk.gray("or")}  ${chalk.cyan(pmCommands.run("skills:install").join(" "))}`);
 	console.log("");
+	const initProperties = {
+		preset: options.headless ? "none" : options.preset,
+		headless: Boolean(options.headless),
+		package_manager: options.pm,
+		installed_deps: Boolean(options.installDeps),
+		introspected,
+		own_database: Boolean(options.databaseUrl),
+		cloud_linked: Boolean(options.cloudProject),
+		git: Boolean(options.git),
+		duration: durationBucket(Date.now() - startedAt)
+	};
+	if (await promptForConsent("cli.init", initProperties)) await recordEvent("cli.init", initProperties, { projectRoot: options.targetDirectory });
 }
 /**
 * Apply a template preset by replacing the default collection files.
@@ -1461,9 +1918,10 @@ async function replacePlaceholders(options) {
 			versionToUse = stdout.trim();
 		} catch {
 			try {
+				const tag = cliVersion.includes("canary") ? "canary" : "latest";
 				const { stdout } = await execa(viewBin, [
 					"view",
-					`${pkgName}@${cliVersion.includes("canary") ? "canary" : "latest"}`,
+					`${pkgName}@${tag}`,
 					"version"
 				]);
 				if (!stdout.trim()) throw new Error("Not found");
@@ -1501,7 +1959,11 @@ async function replacePlaceholders(options) {
 	const prereleasePins = [...unreleased].filter(([, version]) => version === "latest" || version.includes("-"));
 	if (cliIsStable && prereleasePins.length > 0) {
 		const lines = prereleasePins.map(([name, version]) => `    ${name} → ${version}`).join("\n");
-		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —\nnot a problem with your machine, your network, or your package manager.\n\nStopped before writing dependency versions or installing anything. The\nproject directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
+		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —
+not a problem with your machine, your network, or your package manager.
+
+Stopped before writing dependency versions or installing anything. The
+project directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
 	}
 	for (const [fullPath, originalContent] of fileContents.entries()) {
 		let content = originalContent.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
@@ -1560,13 +2022,22 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		const dbPassword = crypto.randomBytes(16).toString("hex");
 		const serviceKey = crypto.randomBytes(48).toString("base64");
 		let envContent = fs.readFileSync(envPath, "utf-8");
+		envContent = envContent.replace(/^(# ║ {2})(Copy this file to \.env and fill in the values)( +║)$/m, (_match, open, old, close) => {
+			const replacement = "Generated by `rebase init` — the secrets below are already set";
+			const width = old.length + close.length - 1;
+			return open + replacement.slice(0, width).padEnd(width, " ") + "║";
+		});
 		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
+		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
+		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
 		const runtimeVersion = readCliVersion();
 		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, `REBASE_VERSION=${runtimeVersion}`) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\nREBASE_VERSION=${runtimeVersion}\n`;
 		if (databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}\nDATABASE_PASSWORD=${dbPassword}`);
+			const { pinSearchPath } = await import("@rebasepro/server-postgres");
+			const pinnedUrl = pinSearchPath(databaseUrl);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
@@ -1896,6 +2367,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.schema_generate", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -1964,6 +2436,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.db_push", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -2084,7 +2557,7 @@ var REMOVED_APP_TYPES = {
 	mobile: "mobile apps are no longer declared in the manifest — nothing consumed this type. Remove the entry"
 };
 /** Reserved because they name things in URLs and CLI output. */
-var RESERVED_APP_NAMES = new Set([
+var RESERVED_APP_NAMES = /* @__PURE__ */ new Set([
 	"api",
 	"health",
 	"metrics",
@@ -2727,6 +3200,11 @@ async function devCommand(rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.dev", {
+		backend_only: Boolean(args["--backend-only"]),
+		frontend_only: Boolean(args["--frontend-only"]),
+		generate: Boolean(args["--generate"])
+	}, { projectRoot });
 	const backendDir = findBackendDir(projectRoot);
 	const frontendDir = findFrontendDir(projectRoot);
 	const backendOnly = args["--backend-only"] || false;
@@ -3081,7 +3559,7 @@ ${chalk.green.bold("Description")}
 */
 var DEFAULT_BUNDLE_DIR = "dist-bundle";
 /** Packages whose presence means the bundle cannot run on a stock runtime image. */
-var KNOWN_NATIVE_PACKAGES = new Set([
+var KNOWN_NATIVE_PACKAGES = /* @__PURE__ */ new Set([
 	"sharp",
 	"canvas",
 	"bcrypt",
@@ -3097,7 +3575,7 @@ var KNOWN_NATIVE_PACKAGES = new Set([
 	"pg-native"
 ]);
 /** Dependencies supplied by the runtime image itself, not by the bundle. */
-var RUNTIME_PROVIDED = new Set([
+var RUNTIME_PROVIDED = /* @__PURE__ */ new Set([
 	"@rebasepro/server",
 	"@rebasepro/types",
 	"@rebasepro/client",
@@ -3506,6 +3984,139 @@ function collectDeclaredDependencies(projectRoot) {
 	return declared;
 }
 /**
+* Lowest version a range could resolve to, or null if it is not a range.
+*
+* Kept deliberately tiny and local. The published range grammar here is a caret,
+* a tilde, an exact version or a `>=` floor, and the alternative — a semver
+* dependency in the CLI — buys breadth this does not need.
+*/
+function lowerBoundOf(range) {
+	const raw = range.trim().replace(/^[\^~]/, "").replace(/^>=\s*/, "").replace(/^v/, "");
+	if (!/^\d+(\.\d+){0,2}$/.test(raw)) return null;
+	const [major, minor = 0, patch = 0] = raw.split(".").map(Number);
+	return [
+		major,
+		minor,
+		patch
+	];
+}
+/** Highest version a range could resolve to (exclusive), or null. */
+function upperBoundOf(range) {
+	const trimmed = range.trim();
+	const min = lowerBoundOf(trimmed);
+	if (!min) return null;
+	if (trimmed.startsWith(">=")) return null;
+	const [major, minor, patch] = min;
+	if (trimmed.startsWith("^")) {
+		if (major > 0) return [
+			major + 1,
+			0,
+			0
+		];
+		if (minor > 0) return [
+			0,
+			minor + 1,
+			0
+		];
+		return [
+			0,
+			0,
+			patch + 1
+		];
+	}
+	if (trimmed.startsWith("~")) return trimmed.replace(/^~v?/, "").split(".").length >= 2 ? [
+		major,
+		minor + 1,
+		0
+	] : [
+		major + 1,
+		0,
+		0
+	];
+	const parts = trimmed.replace(/^v/, "").split(".").length;
+	if (parts === 1) return [
+		major + 1,
+		0,
+		0
+	];
+	if (parts === 2) return [
+		major,
+		minor + 1,
+		0
+	];
+	return [
+		major,
+		minor,
+		patch + 1
+	];
+}
+function compareTriples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Whether a declared range could EVER resolve at or above `target`.
+*
+* The same question the control plane asks at intake, asked here first. Only a
+* range whose entire span sits below the target is reported — `^0.10.0` can
+* never cross to 0.12 whatever npm publishes — because a false alarm on a build
+* that would have worked trains people to ignore the warning that matters.
+*/
+function canReach(range, target) {
+	const ceiling = upperBoundOf(range);
+	const floor = lowerBoundOf(target);
+	if (!floor || !lowerBoundOf(range)) return null;
+	if (!ceiling) return true;
+	return compareTriples(ceiling, floor) > 0;
+}
+/**
+* Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+*
+* This is the only place a developer can be told. In development, every
+* `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+* checkout, so the version STRINGS in package.json are never exercised — the
+* project runs fine locally on whatever is on disk, and the declared numbers are
+* first honoured when the runtime npm-installs them from a bundle in the cloud.
+* A project scaffolded at 0.10.0 therefore keeps working on a developer's
+* machine indefinitely while being, in the cloud, a 0.10.0 driver.
+*
+* That matters because the image supplies only `@rebasepro/server`; the database
+* driver comes from these declarations and a newer runtime never updates it.
+* Every package.json is scanned, `dependencies` and `devDependencies` both,
+* because they have to be bumped together and the one that gets forgotten is the
+* one nobody looks at.
+*/
+function detectFrameworkDepDrift(projectRoot, cliVersion) {
+	const found = [];
+	for (const relative of [
+		"package.json",
+		"backend/package.json",
+		"config/package.json",
+		"frontend/package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const block of [pkg.dependencies, pkg.devDependencies]) for (const [name, range] of Object.entries(block ?? {})) {
+				if (!name.startsWith("@rebasepro/")) continue;
+				if (typeof range !== "string") continue;
+				found.push({
+					name,
+					range,
+					file: relative
+				});
+			}
+		} catch {}
+	}
+	const behind = found.filter((d) => canReach(d.range, cliVersion) === false);
+	const bounds = new Set(found.map((d) => lowerBoundOf(d.range)).filter((b) => b != null).map((b) => b.join(".")));
+	return {
+		behind,
+		disagreeing: bounds.size > 1 ? [...bounds].sort() : []
+	};
+}
+/**
 * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
 *
 * TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
@@ -3671,7 +4282,7 @@ async function buildBundle(options) {
 		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
 		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
 		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
-		console.log(chalk.dim(`      or run \`rebase eject\` to make this file the entrypoint and own the image.`));
+		console.log(chalk.dim("      or run `rebase eject` to make this file the entrypoint and own the image."));
 	}
 	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
 	cleanOutDir(projectRoot, outDir);
@@ -4099,7 +4710,7 @@ async function foldFrontendIntoBundle(options) {
 * entrypoint, falls back to the previous behaviour: run every workspace's own
 * `build` script. Nothing that built before stops building.
 */
-function printHelp$4() {
+function printHelp$5() {
 	console.log(`
 ${chalk.bold("rebase build")} — build the apps declared in rebase.json
 
@@ -4134,7 +4745,7 @@ async function buildCommand(rawArgs = []) {
 		permissive: true
 	});
 	if (args["--help"]) {
-		printHelp$4();
+		printHelp$5();
 		return;
 	}
 	const projectRoot = requireProjectRoot();
@@ -4203,6 +4814,16 @@ async function buildCommand(rawArgs = []) {
 				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
 				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
 			}
+			const drift = detectFrameworkDepDrift(projectRoot, resolveCliVersion());
+			if (drift.behind.length > 0) {
+				console.log(chalk.yellow(`    ⚠ framework dependencies older than this CLI (${resolveCliVersion()}):`));
+				for (const dep of drift.behind) console.log(chalk.dim(`      ${dep.name}@${dep.range}  (${dep.file})`));
+				console.log(chalk.dim("      The image supplies the server, but your bundle supplies the database"));
+				console.log(chalk.dim("      driver — a newer runtime does not update it. Bump these and rebuild."));
+			} else if (drift.disagreeing.length > 0) {
+				console.log(chalk.yellow(`    ⚠ mixed @rebasepro versions declared: ${drift.disagreeing.join(", ")}`));
+				console.log(chalk.dim("      These are published together and expect to run together; pin them alike."));
+			}
 			if (!args["--no-static"]) {
 				const folded = await foldFrontendIntoBundle({
 					projectRoot,
@@ -4363,7 +4984,7 @@ function projectNameOf(projectRoot) {
 	} catch {}
 	return path.basename(projectRoot);
 }
-function printHelp$3() {
+function printHelp$4() {
 	console.log(`
 ${chalk.bold("rebase eject")} — take ownership of the server process
 
@@ -4390,7 +5011,7 @@ async function ejectCommand(rawArgs = []) {
 		permissive: true
 	});
 	if (args["--help"]) {
-		printHelp$3();
+		printHelp$4();
 		return;
 	}
 	const projectRoot = requireProjectRoot();
@@ -4534,7 +5155,7 @@ function restoreBackendScripts(projectRoot) {
 * `rebase.json`) this falls back to the backend workspace's own `start` script,
 * which is what such a project has always used.
 */
-function printHelp$2() {
+function printHelp$3() {
 	console.log(`
 ${chalk.bold("rebase start")} — run a built bundle
 
@@ -4560,7 +5181,7 @@ async function startCommand(rawArgs = []) {
 		permissive: true
 	});
 	if (args["--help"]) {
-		printHelp$2();
+		printHelp$3();
 		return;
 	}
 	const projectRoot = requireProjectRoot();
@@ -5061,7 +5682,7 @@ function parseAgentFlags(rawArgs) {
 	return requested;
 }
 async function skillsInstall(rawArgs = []) {
-	const projectDir = process.cwd();
+	const projectDir = findProjectRoot() ?? process.cwd();
 	let skillsDir;
 	try {
 		skillsDir = getSkillsSourceDir();
@@ -5105,7 +5726,8 @@ async function skillsInstall(rawArgs = []) {
 	for (const agentKey of agents) {
 		const agent = AGENTS[agentKey];
 		const count = installForAgent(agentKey, skills, projectDir);
-		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(agent.targetDir)}`);
+		const shown = path.relative(process.cwd(), path.join(projectDir, agent.targetDir)) || agent.targetDir;
+		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(shown)}`);
 	}
 	console.log("");
 	console.log(chalk.gray("  Skills are project-local. Commit them to share with your team."));
@@ -5423,6 +6045,107 @@ ${chalk.green.bold("Examples")}
 `);
 }
 //#endregion
+//#region src/commands/telemetry.ts
+/**
+* `rebase telemetry` — the command that makes the rest of it inspectable.
+*
+* The whole subsystem asks for trust it cannot otherwise earn, and the cheapest
+* way to earn it is to stop describing the payload and print it. `show` runs
+* the same builder the sender uses, so what appears here is what would go, not
+* a documentation comment that quietly fell out of date two releases ago.
+*/
+async function telemetryCommand(rawArgs) {
+	switch (rawArgs.slice(3).filter((a) => !a.startsWith("-"))[0]) {
+		case "status":
+		case void 0:
+			printStatus();
+			return;
+		case "show":
+			printPayload();
+			return;
+		case "enable":
+			if (!setConsent(true)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing was not enabled.`));
+				process.exitCode = 1;
+				return;
+			}
+			console.log(chalk.green("Anonymous usage sharing enabled."));
+			console.log(chalk.gray(`Inspect what gets sent with ${chalk.cyan("rebase telemetry show")}.`));
+			return;
+		case "disable":
+			if (!setConsent(false)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing is still ON.`));
+				console.error(chalk.yellow(`Set ${chalk.cyan("REBASE_TELEMETRY_DISABLED=1")} in your environment instead; it needs no file.`));
+				process.exitCode = 1;
+				return;
+			}
+			console.log(chalk.gray("Anonymous usage sharing disabled. Nothing further will be sent."));
+			return;
+		default:
+			printHelp$2();
+			process.exitCode = 1;
+	}
+}
+function printStatus() {
+	console.log("");
+	console.log(`  Status:   ${describeState()}`);
+	if (readProjectPolicy() === "ignored_opt_in") {
+		console.log("");
+		console.log(chalk.yellow("  Note: this project's rebase.json sets \"telemetry\": true, which is ignored."));
+		console.log(chalk.gray("        A committed file cannot consent on behalf of everyone who clones it."));
+		console.log(chalk.gray(`        Only "telemetry": false is honoured there. Use ${chalk.cyan("rebase telemetry enable")}.`));
+	}
+	console.log(`  Endpoint: ${chalk.gray(endpoint())}`);
+	console.log(`  Config:   ${chalk.gray(configPath())}`);
+	console.log("");
+	console.log(chalk.gray(`  ${chalk.cyan("rebase telemetry show")} prints the exact payload.`));
+	console.log("");
+}
+function printPayload() {
+	if (readConfig().enabled !== true) {
+		console.log("");
+		console.log(`  ${describeState()}`);
+		console.log("");
+		console.log(chalk.gray("  Nothing is being sent, so there is no payload to show."));
+		console.log(chalk.gray(`  Run ${chalk.cyan("rebase telemetry enable")} first if you want to inspect one.`));
+		console.log("");
+		return;
+	}
+	const event = previewEvent("cli.dev", { first_run: false }, process.cwd());
+	console.log("");
+	console.log(chalk.gray("  Sent to ") + chalk.gray(endpoint()) + chalk.gray(", for example:"));
+	console.log("");
+	console.log(JSON.stringify(event, null, 2).split("\n").map((l) => "  " + l).join("\n"));
+	console.log("");
+	console.log(chalk.gray("  Both ids are random. Neither is derived from your machine, your"));
+	console.log(chalk.gray("  hostname, your project name or anything you have typed."));
+	console.log("");
+}
+function printHelp$2() {
+	console.log(`
+${chalk.bold("rebase telemetry")} — anonymous usage sharing (opt-in, off by default)
+
+${chalk.bold("Commands")}
+  ${chalk.blue("status")}     Whether anything is being shared, and why ${chalk.gray("(default)")}
+  ${chalk.blue("show")}       Print the exact payload that would be sent
+  ${chalk.blue("enable")}     Start sharing
+  ${chalk.blue("disable")}    Stop sharing, permanently
+
+${chalk.bold("Project policy")}
+  ${chalk.blue("\"telemetry\": false")} in ${chalk.blue("rebase.json")} disables sharing for everyone who
+  clones the repository, overriding each developer's own choice.
+  ${chalk.gray("\"telemetry\": true is ignored — a committed file cannot consent for others.")}
+
+${chalk.bold("Environment")}
+  ${chalk.blue("DO_NOT_TRACK")}                 Set to disable, across every tool that honours it
+  ${chalk.blue("REBASE_TELEMETRY_DISABLED")}    Set to disable Rebase specifically
+  ${chalk.blue("REBASE_TELEMETRY_ENDPOINT")}    Send elsewhere — your own collector, for instance
+
+${chalk.gray("Never shared: project names, paths, collection or table names, database")}
+${chalk.gray("URLs, hostnames, error messages, stack traces, or exact record counts.")}
+`);
+}
+//#endregion
 //#region src/commands/cloud/auth.ts
 /**
 * `rebase cloud` auth subcommands: login, logout, whoami.
@@ -5715,6 +6438,54 @@ function providerDefaults(provider) {
 		};
 	}
 }
+/**
+* Where this project says it runs.
+*
+* `provider`/`region` are a *request*: no code downstream reads them to pick a
+* deploy target — that comes from the project's cluster record or the ambient
+* in-cluster context (saas/backend/src/k8s/resolve.ts). So a wrong value here is
+* never contradicted by a failure; it just sits in the record. The CLI used to
+* default to `hetzner`/`nbg1` unconditionally, which is how projects running on
+* our GKE cluster came to describe themselves as Hetzner in the console — and
+* `provider` is half the Stripe compute lookup key (`compute_<provider>_<vmSize>`),
+* so that is a mispricing, not a cosmetic slip.
+*
+* The control plane already publishes the infrastructure that actually exists,
+* and the console's create wizard reads it. Ask the same question here.
+*
+* Exported for tests: the decision is pure, so it can be pinned without a
+* control plane. The fetching and the exit live in `resolveRequestedTarget`.
+*
+* @param requested `--provider`, if the caller named one. An explicit flag wins:
+*   it is the caller stating intent, and `deploy` corrects the record anyway.
+* @param targets What the control plane says exists, or `undefined` when it
+*   cannot say — an older deployment with no `platform-config`, or a failed
+*   request. That is different from an empty list, which is a control plane
+*   stating it has no infrastructure at all.
+* @returns the target to record, or `null` when the control plane answered that
+*   there is none.
+*/
+function chooseRequestedTarget(requested, targets) {
+	if (requested) return {
+		provider: requested,
+		region: void 0
+	};
+	if (!targets) return {
+		provider: "hetzner",
+		region: void 0
+	};
+	if (targets.length === 0) return null;
+	const [target] = targets;
+	return {
+		provider: target.provider,
+		region: target.region?.trim() || void 0
+	};
+}
+async function resolveRequestedTarget(client, url, requested) {
+	const chosen = chooseRequestedTarget(requested, await fetchDeployTargets(client, url));
+	if (!chosen) fail("This control plane has no deploy targets configured.", `Register a cluster, or pass ${chalk.bold("--provider")} and ${chalk.bold("--region")} to record one anyway.`);
+	return chosen;
+}
 async function createProject(rawArgs) {
 	const args = arg({
 		"--name": String,
@@ -5750,9 +6521,10 @@ async function createProject(rawArgs) {
 	const subdomain = (args["--subdomain"] || a.subdomain || "").trim().toLowerCase();
 	const gitRepoUrl = (args["--repo"] || a.repo || "").trim();
 	const gitBranch = (args["--branch"] || a.branch || "main").trim();
-	const provider = (args["--provider"] || a.provider || "hetzner").trim();
+	const target = await resolveRequestedTarget(client, url, (args["--provider"] || a.provider)?.trim() || void 0);
+	const provider = target.provider;
 	const defaults = providerDefaults(provider);
-	const region = (args["--region"] || defaults.region).trim();
+	const region = (args["--region"] || target.region || defaults.region).trim();
 	const vmSize = (args["--vm-size"] || defaults.vmSize).trim();
 	if (!name || !subdomain) fail("Name and subdomain are required.");
 	try {
@@ -6085,12 +6857,24 @@ function resolveFrameworkVersion(sourceDir) {
 		dir = parent;
 	}
 }
+/**
+* A progress line for a human — dropped entirely in JSON mode.
+*
+* Progress is not a result. In JSON mode stdout carries the one result value
+* and nothing else, so every unguarded `console.log` on a deploy path was a
+* line printed in front of the JSON, breaking the parser meant to read it.
+* Warnings are the other half of this rule and go the other way: they are
+* `warn`, which prints in every mode, to stderr. See `warn` in `context.ts`.
+*/
+function progress(line) {
+	if (!isJsonMode()) console.log(line);
+}
 /** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
 async function uploadSource(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
 	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
 	if (bytes.length > MAX_SOURCE_UPLOAD_BYTES) fail(`Source context is ${sizeMb} MB — the upload cap is ${Math.round(MAX_SOURCE_UPLOAD_BYTES / 1024 / 1024)} MB.`, "Trim the build context: exclude sourcemaps (*.map), build output and large assets via .rebaseignore or .gitignore.");
-	console.log(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
+	progress(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
 	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
 		method: "POST",
 		headers: {
@@ -6122,7 +6906,7 @@ async function deployBundle(opts) {
 		const loaded = loadManifest(projectRoot);
 		const backend = findBackendApp(loaded.manifest);
 		if (!backend) fail("This repository declares no backend app to deploy as a bundle.", "A managed deploy runs the backend; declare one in rebase.json, or deploy from the backend's repository.");
-		console.log(chalk.gray("  Building bundle..."));
+		progress(chalk.gray("  Building bundle..."));
 		bundleDir = (await buildBundle({
 			projectRoot,
 			appName: backend.name,
@@ -6130,16 +6914,16 @@ async function deployBundle(opts) {
 			runtimeRange: loaded.manifest.rebase,
 			storage: loaded.manifest.storage,
 			skipTypeCheck: opts.skipTypeCheck,
-			log: (m) => console.log(chalk.gray(m))
+			log: (m) => progress(chalk.gray(m))
 		})).outDir;
 		try {
 			const folded = await foldFrontendIntoBundle({
 				projectRoot,
 				manifest: loaded.manifest,
 				bundleDir,
-				log: (m) => console.log(m)
+				log: (m) => progress(m)
 			});
-			for (const outcome of folded) console.log(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
+			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
 		} catch (err) {
 			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
 		}
@@ -6156,7 +6940,7 @@ async function deployBundle(opts) {
 	try {
 		await packBundle(bundleDir, tarPath);
 		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
-		console.log(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
 		bundleId = await uploadBundle(url, token, projectId, tarPath);
 	} catch (e) {
 		fail(e instanceof Error ? e.message : String(e));
@@ -6164,8 +6948,10 @@ async function deployBundle(opts) {
 	} finally {
 		fs.rmSync(tarPath, { force: true });
 	}
-	console.log("");
-	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	}
 	let declaredApps = [];
 	try {
 		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
@@ -6253,9 +7039,75 @@ function planBareDeploy(project, latest, now) {
 		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
 	};
 }
+/** `code` of the warning below, and the field name it sets in the payload. */
+var EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
 /** The one sentence that says a source build undoes `runtimeMode: managed`. */
 function ejectWarning(projectRef) {
-	return `⚠ ${projectRef} runs on the managed runtime — a source build ejects it to a custom container.`;
+	return {
+		code: EJECTS_MANAGED_RUNTIME,
+		message: `${projectRef} runs on the managed runtime — this build ejects it to a custom container.`,
+		hint: "Use `rebase cloud deploy --bundle` to stay on managed."
+	};
+}
+/**
+* Why a container-image deploy of a managed project is refused — or `undefined`
+* to let it through.
+*
+* Every path below this point builds a container image, and a successful one
+* sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+* was used" but "did the caller ask to leave the managed runtime", and only
+* `--force` answers it.
+*
+* `--source` used to be read as answering it too, on the theory that uploading a
+* build context is self-evidently a deliberate eject. It is not: `--source`
+* picks *which source* gets built — this directory, rather than the stale
+* archive the control plane is holding — and the eject is a side effect of the
+* answer. That is exactly how a live project got flipped to `custom` by someone
+* whose actual intent was "deploy what I have here", and it is the same
+* ignorance the bare form is refused for. Same ignorance, same refusal.
+*/
+function ejectRefusal(opts, projectRef) {
+	if (!opts.managed || opts.force) return void 0;
+	const eject = "To eject on purpose, add `--force`.";
+	if (opts.source) return {
+		message: `${projectRef} runs on the managed runtime, and \`--source\` builds a container image from this directory — which ejects it from managed. Picking a build method is not the same as asking to leave the runtime.`,
+		hint: `Deploy this directory to the managed runtime with \`rebase cloud deploy --bundle\`. ${eject}`,
+		code: "managed_project"
+	};
+	return {
+		message: `${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`,
+		hint: `Redeploy it with \`rebase cloud deploy --bundle\`. ${eject} \`--source . --force\` builds this directory; \`--force\` alone builds what the control plane holds.`,
+		code: "managed_project"
+	};
+}
+/**
+* Which warnings a container-image deploy has earned.
+*
+* Pure, and separate from the printing, because the printing is what went
+* wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+* the fact that a deploy ejects a managed project existed only as a side effect
+* of a TTY being attached. Deciding here, emitting once at the call site, means
+* the decision cannot be output-mode-dependent again.
+*
+* The condition is just `managed`: anything reaching this point is a container
+* image build that `ejectRefusal` has already let through, and on a managed
+* project that is an eject however it was spelled. A caller who passed `--force`
+* knows — the warning is for the transcript and the payload, which is what
+* anyone reviewing the deploy afterwards actually reads.
+*/
+function deployWarnings(opts, projectRef) {
+	return opts.managed ? [ejectWarning(projectRef)] : [];
+}
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+function warningPayload(warnings) {
+	return {
+		warnings: warnings.map((w) => ({
+			code: w.code,
+			message: w.message,
+			hint: w.hint ?? null
+		})),
+		ejectsManagedRuntime: warnings.some((w) => w.code === EJECTS_MANAGED_RUNTIME)
+	};
 }
 /**
 * Read the two rows the preflight needs.
@@ -6326,17 +7178,18 @@ async function deployCommand(rawArgs, projectRef) {
 	}
 	const { project, latest } = await readDeployContext(client, projectId);
 	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
-	if (!args["--source"]) {
-		if (plan.managed && args["--force"] !== true) fail(`${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`, "Redeploy it with `rebase cloud deploy --bundle`. To eject on purpose, pass `--source .` to build this directory, or `--force` to build what the control plane holds.", "managed_project");
-		if (!isJsonMode()) {
-			console.log("");
-			if (plan.managed) console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-			for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
-		}
-	} else if (plan.managed && !isJsonMode()) {
+	const eject = {
+		managed: plan.managed,
+		source: Boolean(args["--source"]),
+		force: args["--force"] === true
+	};
+	const refusal = ejectRefusal(eject, projectRef);
+	if (refusal) fail(refusal.message, refusal.hint, refusal.code);
+	const warnings = deployWarnings(eject, projectRef);
+	for (const w of warnings) warn(w.message, w.hint);
+	if (!args["--source"] && !isJsonMode()) {
 		console.log("");
-		console.log(chalk.yellow(`  ${ejectWarning(projectRef)}`));
-		console.log(chalk.gray("    Use `rebase cloud deploy --bundle` to stay on managed."));
+		for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
 	}
 	let source;
 	if (args["--source"]) {
@@ -6349,8 +7202,10 @@ async function deployCommand(rawArgs, projectRef) {
 			fs.rmSync(tarPath, { force: true });
 		}
 	}
-	console.log("");
-	console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
+	}
 	const body = { projectId };
 	if (source) body.source = source;
 	if (args["--message"]) body.message = args["--message"];
@@ -6378,7 +7233,8 @@ async function deployCommand(rawArgs, projectRef) {
 			deploymentId,
 			deduplicated,
 			frameworkVersion: frameworkVersion ?? null,
-			following: false
+			following: false,
+			...warningPayload(warnings)
 		});
 		return;
 	}
@@ -6392,7 +7248,8 @@ async function deployCommand(rawArgs, projectRef) {
 		deduplicated,
 		frameworkVersion: frameworkVersion ?? null,
 		following: true,
-		status
+		status,
+		...warningPayload(warnings)
 	});
 }
 /**
@@ -9006,6 +9863,7 @@ function describeDatabaseState(db) {
 * So both are printed, rather than leaving anyone to infer one from a Docker tag.
 */
 function describeRuntime(project) {
+	if (project.runtimeMode == null || project.runtimeMode.trim() === "") return `not deployed yet ${chalk.gray("· the first deploy decides (`--bundle` keeps it managed)")}`;
 	if (project.runtimeMode !== "managed") return `custom ${chalk.gray("· your own image")}`;
 	const version = project.runtimeVersion ?? "unknown";
 	const framework = project.runtimeFrameworkVersion;
@@ -9404,17 +10262,41 @@ async function billingCommand(rawArgs) {
 * dispatched from here. Individual groups live in sibling modules; this file
 * only routes and prints help.
 */
-/** Positional tokens after `rebase cloud` (group, action, …). */
+/**
+* Positional tokens after `rebase cloud` (group, action, …).
+*
+* Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
+* declared so `arg` *consumes* the flags that may precede it — critically
+* together with their values, which is the half that filtering cannot do. The
+* leading-`-` skip then covers a flag nobody declared, so an unrecognised
+* boolean shifts nothing.
+*
+* Only leading tokens are skipped: past the group and action, an undeclared
+* flag and its value are somebody else's positionals and none of our business.
+* A flag this file has never heard of, that takes a value, placed before the
+* group, is the one shape still unresolvable here — there is no way to know
+* whether the token after it is its value or the group, and guessing either way
+* is worse than the handler reporting an unknown group.
+*
+* Exported so its tests can drive the real thing. The dispatch test used to
+* re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which
+* filtered flags, while this function did not — so the test asserted the
+* behaviour we wanted against a copy that had it, and stayed green for as long
+* as the real dispatcher was broken.
+*/
 function positionals(rawArgs) {
-	return arg({}, {
+	const rest = arg(GLOBAL_CLOUD_FLAGS, {
 		argv: rawArgs.slice(3),
 		permissive: true
 	})._;
+	let i = 0;
+	while (i < rest.length && rest[i].startsWith("-")) i++;
+	return rest.slice(i);
 }
 async function cloudCommand(subcommand, rawArgs) {
 	initOutputMode(rawArgs);
 	const pos = positionals(rawArgs);
-	const group = subcommand && subcommand !== "--help" ? subcommand : pos[0];
+	const group = pos[0] ?? (subcommand !== "--help" ? subcommand : void 0);
 	const action = pos[1];
 	if (!group || subcommand === "--help") {
 		printCloudHelp();
@@ -9836,8 +10718,9 @@ async function entry(args) {
 		console.log(getVersion());
 		return;
 	}
-	const command = parsedArgs._[0];
-	const subcommand = parsedArgs._[1];
+	const words = parsedArgs._.filter((a) => !a.startsWith("-"));
+	const command = words[0];
+	const subcommand = words[1];
 	if (!command || parsedArgs["--help"] && ![
 		"init",
 		"schema",
@@ -9852,7 +10735,8 @@ async function entry(args) {
 		"cloud",
 		"apps",
 		"eject",
-		"generate-sdk"
+		"generate-sdk",
+		"telemetry"
 	].includes(command)) {
 		printHelp();
 		return;
@@ -9876,9 +10760,10 @@ async function entry(args) {
 				argv: args.slice(3),
 				permissive: true
 			});
+			const sdkRoot = sdkArgs["--help"] ? process.cwd() : requireProjectRoot();
 			await generateSdkCommand({
-				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
-				output: sdkArgs["--output"] || "./generated/sdk",
+				collectionsDir: sdkArgs["--collections-dir"] || path.join(sdkRoot, "config/collections"),
+				output: sdkArgs["--output"] || path.join(sdkRoot, "generated/sdk"),
 				from: sdkArgs["--from"],
 				token: sdkArgs["--token"],
 				help: sdkArgs["--help"],
@@ -9922,6 +10807,9 @@ async function entry(args) {
 		case "cloud":
 			await cloudCommand(effectiveSubcommand, args);
 			break;
+		case "telemetry":
+			await telemetryCommand(args);
+			break;
 		default:
 			console.error(chalk.red(`Unknown command: ${command}`));
 			console.log("");
@@ -9972,6 +10860,7 @@ ${chalk.green.bold("API Keys")}
   ${chalk.blue.bold("api-keys list")}           List all service API keys
   ${chalk.blue.bold("api-keys create")}         Create a new scoped API key
   ${chalk.blue.bold("api-keys revoke")}         Revoke an existing API key
+  ${chalk.blue.bold("telemetry")}               Anonymous usage sharing (opt-in, off by default)
   ${chalk.blue.bold("api-keys")} ${chalk.gray("--help")}         Show API key command help
 
 ${chalk.green.bold("Rebase Cloud")}
@@ -9985,9 +10874,25 @@ ${chalk.green.bold("Options")}
   ${chalk.blue("--help, -h")}      Show this help message
 
 ${chalk.gray("Documentation: https://rebase.pro/docs")}
-`);
+${telemetryNotice()}`);
+}
+/**
+* One line about usage sharing, in the global help.
+*
+* Every other tool that collects anything prints a first-run notice. Ours asks
+* at the end of `rebase init` — but someone who installs the CLI and never runs
+* `init`, or who joins a project someone else scaffolded, would otherwise never
+* learn the subsystem exists. This is the cheapest place to close that: the
+* help is what an unfamiliar user reads first.
+*
+* It states the current setting rather than a generic sentence, so it is also
+* the fastest answer to "is this thing on?".
+*/
+function telemetryNotice() {
+	const sharing = isEnabled();
+	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map