@rebasepro/cli 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g06dbe5b

package/bin/rebase.js

@@ -88,4 +88,30 @@ if (!existsSync(distEntry)) {
 
 const { entry } = await import("../dist/index.es.js");
 
-entry(process.argv);
+/**
+ * The CLI's last line of defence.
+ *
+ * `entry()` returns a promise and nothing was awaiting it, so anything a
+ * command threw surfaced as an unhandled rejection: Node's own stack trace,
+ * rooted in `dist/index.es.js`, with the CLI's bundled line numbers and no
+ * exit code of its own. "Collections directory not found" is a sentence a
+ * developer can act on; the same sentence under ten frames of bundle internals
+ * reads as a crash in Rebase.
+ *
+ * The message is the error's own — commands that already print something
+ * friendly and exit never reach here. The stack is available behind
+ * `--debug`/`REBASE_DEBUG`, because when the message is *not* enough that is
+ * the only thing that helps.
+ */
+const wantsStack = process.argv.includes("--debug") || process.env.REBASE_DEBUG === "1";
+
+entry(process.argv).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`\x1b[31m✗ ${message}\x1b[0m\n`);
+    if (wantsStack && error instanceof Error && error.stack) {
+        process.stderr.write(`\n${error.stack}\n`);
+    } else {
+        process.stderr.write("\x1b[90m  Re-run with --debug for the stack trace.\x1b[0m\n");
+    }
+    process.exit(1);
+});

package/dist/bundle.d.ts

@@ -68,6 +68,41 @@ export declare function detectNativeDependencies(projectRoot: string, declared:
  * own config package already travels inside the bundle.
  */
 export declare function collectDeclaredDependencies(projectRoot: string): Record<string, string>;
+/** One `@rebasepro/*` dependency as some package.json in the project declares it. */
+export interface DeclaredFrameworkDep {
+    name: string;
+    range: string;
+    /** Project-relative package.json it was declared in. */
+    file: string;
+}
+export interface FrameworkDepDrift {
+    /** Declared at a version that can never reach the CLI's own. */
+    behind: DeclaredFrameworkDep[];
+    /**
+     * The distinct lower bounds found across all declared `@rebasepro/*`, when
+     * there is more than one — the project is pinning mixed-era framework
+     * packages against each other.
+     */
+    disagreeing: string[];
+}
+/**
+ * Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+ *
+ * This is the only place a developer can be told. In development, every
+ * `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+ * checkout, so the version STRINGS in package.json are never exercised — the
+ * project runs fine locally on whatever is on disk, and the declared numbers are
+ * first honoured when the runtime npm-installs them from a bundle in the cloud.
+ * A project scaffolded at 0.10.0 therefore keeps working on a developer's
+ * machine indefinitely while being, in the cloud, a 0.10.0 driver.
+ *
+ * That matters because the image supplies only `@rebasepro/server`; the database
+ * driver comes from these declarations and a newer runtime never updates it.
+ * Every package.json is scanned, `dependencies` and `devDependencies` both,
+ * because they have to be bumped together and the one that gets forgotten is the
+ * one nobody looks at.
+ */
+export declare function detectFrameworkDepDrift(projectRoot: string, cliVersion: string): FrameworkDepDrift;
 /**
  * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
  *
@@ -101,10 +136,11 @@ export declare function normalizeEsmSpecifiers(outDir: string): {
  * deployed green, and answered 404 on every one of them, with the file still
  * sitting in the repository looking exactly like the server.
  *
- * A project that means to keep its own entrypoint runs `rebase eject`, which
- * writes the entrypoint, a Dockerfile and a compose file together and flips the
+ * A project that means to own its server process runs `rebase eject`, which
+ * writes an entrypoint, a Dockerfile and a compose file together and flips the
  * backend to `runtime: "custom"`. The warning names that route rather than
- * implying the file is a mistake.
+ * implying the file is a mistake — but eject writes *its* entrypoint, so the
+ * warning must not read as "eject will keep what you wrote here".
  */
 export declare function findUnusedServerEntry(projectRoot: string, functionsDir: string): string | undefined;
 /**
@@ -182,3 +218,4 @@ export declare function buildStaticBundle(options: {
     manifest: RebaseBundleManifest;
     fileCount: number;
 };
+export declare function resolveCliVersion(): string;

package/dist/commands/api-keys.d.ts

@@ -1 +1,52 @@
 export declare function apiKeysCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
+/** The flags `rebase api-keys create` takes. */
+export declare const CREATE_KEY_FLAGS: {
+    readonly "--name": StringConstructor;
+    readonly "--permissions": StringConstructor;
+    readonly "--full-access": BooleanConstructor;
+    readonly "--admin": BooleanConstructor;
+    readonly "--rate-limit": NumberConstructor;
+    readonly "--expires": StringConstructor;
+    readonly "-n": "--name";
+};
+/**
+ * What this invocation asks to be created.
+ *
+ * The name may be given either way — `--name "My Key"` or as the single
+ * positional — and under the old permissive parse an undeclared flag became
+ * that positional: `rebase api-keys create --debug --full-access` created a
+ * key called `--debug` with read/write/delete on every collection, and
+ * `--debug` is what the CLI prints after every failure as the thing to re-run
+ * with. Strict parsing makes the flag an error instead of a name.
+ *
+ * Exported so its tests can drive the real parser rather than a copy of it.
+ */
+export declare function resolveCreateKeyArgs(rawArgs: string[]): {
+    flags: import("arg").Result<{
+        readonly "--name": StringConstructor;
+        readonly "--permissions": StringConstructor;
+        readonly "--full-access": BooleanConstructor;
+        readonly "--admin": BooleanConstructor;
+        readonly "--rate-limit": NumberConstructor;
+        readonly "--expires": StringConstructor;
+        readonly "-n": "--name";
+    }>;
+    name: string;
+};
+/** The flags `rebase api-keys revoke` takes. */
+export declare const REVOKE_KEY_FLAGS: {
+    readonly "--id": StringConstructor;
+};
+/**
+ * Which key this invocation names.
+ *
+ * The id is a positional, so the permissive parse handed one straight to the
+ * DELETE: `rebase api-keys revoke --foo` sent
+ * `DELETE /api/admin/api-keys/--foo`, and `rebase --debug api-keys revoke <id>`
+ * shifted the words along and revoked the key named `revoke`.
+ *
+ * Exported so its tests can drive the real parser rather than a copy of it.
+ */
+export declare function resolveRevokeKeyArgs(rawArgs: string[]): {
+    id?: string;
+};

package/dist/commands/auth.d.ts

@@ -1 +1,63 @@
+/** A user as the admin API returns it, reduced to what this command needs. */
+export interface ResolvedUser {
+    id: string;
+    email: string;
+}
+/**
+ * Pick the user with exactly this email out of a search response.
+ *
+ * `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display
+ * name**, ordered by role count descending. This used to take row `[0]` and
+ * reset it, then print the email it had been *given* as confirmation — so two
+ * ordinary situations ended in a successful-looking reset of somebody else's
+ * account:
+ *
+ *   - a substring collision: `bob@example.com` also matches
+ *     `robert.bob@example.com`;
+ *   - a display name, which is user-controlled and accepted up to 255
+ *     characters with no constraint on its content, containing an address
+ *     belonging to someone else.
+ *
+ * The ordering makes it worse rather than better — `array_length(roles) DESC
+ * NULLS LAST` puts the most privileged match first, so the account most likely
+ * to be reset by mistake is an admin's.
+ *
+ * Returns `undefined` when nothing matched exactly, which the caller reports
+ * rather than falling through to a guess. The direct-database fallback below
+ * has always matched with `eq(usersTable.email, email)`; this is the same
+ * definition, so the command no longer resets different accounts depending on
+ * whether the backend happened to be running.
+ */
+export declare function selectUserForEmail(payload: unknown, email: string): ResolvedUser | undefined;
 export declare function authCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * The flags `rebase auth reset-password` takes.
+ *
+ * `-p` was advertised in this command's own help and never declared here, so
+ * `arg` — running permissively — pushed it into the positionals and the value
+ * *after* it shifted out of reach: anyone following the help set the account's
+ * password to the two-character string `-p`. Declared now, and `auth.test.ts`
+ * asserts that the help and this spec list the same aliases.
+ */
+export declare const RESET_PASSWORD_FLAGS: {
+    readonly "--email": StringConstructor;
+    readonly "--password": StringConstructor;
+    readonly "-e": "--email";
+    readonly "-p": "--password";
+};
+/**
+ * Which account, and which password, this invocation names.
+ *
+ * Both may still be absent — the caller reports a missing email — but neither
+ * can be a flag. `parseCommandArgs` parses the whole line strictly, so an
+ * undeclared flag is an error rather than a positional. That is what stops
+ * `rebase auth reset-password bob@example.com --debug` from setting Bob's
+ * password to `--debug`, which is the flag the CLI itself prints after every
+ * failure as the thing to re-run with.
+ *
+ * Exported so its tests can drive the real parser rather than a copy of it.
+ */
+export declare function resolveResetPasswordArgs(rawArgs: string[]): {
+    email?: string;
+    password?: string;
+};

package/dist/commands/cloud/context.d.ts

@@ -1,3 +1,4 @@
+import arg from "arg";
 import { createRebaseClient } from "@rebasepro/client";
 /** Project-local link file: <project>/.rebase/cloud.json */
 export declare function projectLinkPath(cwd?: string): string;
@@ -24,7 +25,32 @@ export declare function requireClient(rawArgs: string[]): Promise<{
     client: CloudClient;
     url: string;
 }>;
+/** One place a deploy can actually land, as the control plane describes it. */
+export interface DeployTarget {
+    clusterId?: string | null;
+    provider: string;
+    region?: string;
+    label?: string;
+    baseDomain?: string;
+}
+export interface PlatformConfig {
+    tenantBaseDomain?: string;
+    deployTargets?: DeployTarget[];
+}
+export declare function fetchPlatformConfig(client: CloudClient, url: string): Promise<PlatformConfig | undefined>;
+/**
+ * The base domain tenant projects are served at, derived from the same
+ * TENANT_BASE_DOMAIN the ingress and the console read (see
+ * saas/backend/src/utils/tenant-domain.ts).
+ */
 export declare function fetchTenantBaseDomain(client: CloudClient, url: string): Promise<string | undefined>;
+/**
+ * The infrastructure a deploy for this control plane would ACTUALLY use, in the
+ * resolver's own preference order (saas/backend/src/k8s/resolve.ts).
+ *
+ * @returns the targets, or `undefined` when the control plane cannot say.
+ */
+export declare function fetchDeployTargets(client: CloudClient, url: string): Promise<DeployTarget[] | undefined>;
 /**
  * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when
  * the base domain is unknown.
@@ -84,6 +110,39 @@ export interface ProjectLink {
 export declare function readLink(cwd?: string): ProjectLink | null;
 export declare function writeLink(link: ProjectLink, cwd?: string): void;
 export declare function removeLink(cwd?: string): boolean;
+/**
+ * Flags that may appear anywhere on a `rebase cloud` line, including *before*
+ * the resource group.
+ *
+ * They have to be declared wherever positionals are resolved, because `arg`'s
+ * `permissive: true` does not merely tolerate an undeclared flag — it pushes it
+ * into `_` alongside the positionals, and for a flag that takes a value it
+ * pushes the value in too. So `cloud --project acme storage create` parsed
+ * without this spec yields `_` of `["--project", "acme", "storage", "create"]`,
+ * and the group reads as `"acme"`: a real project name, in the group position,
+ * dispatching to nothing. Skipping tokens that start with `-` does not save you
+ * there — the damage is the orphaned value, which looks exactly like a
+ * positional.
+ *
+ * Only genuinely global flags belong here. Group-specific ones (`--bucket`,
+ * `--region`, …) are declared by the handler that owns them and always follow
+ * the group, so they cannot shift the group or action.
+ *
+ * `-p` is `--project` in eighteen places and `--password` in `login`. That
+ * ambiguity does not matter to the one caller that reads this spec: it resolves
+ * positionals and never looks at a flag's value, so all it needs to know is
+ * that `-p` takes one. Anything that wants the value must keep declaring it
+ * itself, with the meaning its own command gives it.
+ */
+export declare const GLOBAL_CLOUD_FLAGS: {
+    readonly "--json": BooleanConstructor;
+    readonly "--yes": BooleanConstructor;
+    readonly "--help": BooleanConstructor;
+    readonly "--project": StringConstructor;
+    readonly "-p": "--project";
+    readonly "-y": "--yes";
+    readonly "-h": "--help";
+};
 /**
  * The raw project reference to operate on: explicit `--project` flag wins,
  * otherwise the linked project. Exits with guidance when neither is present.
@@ -134,6 +193,26 @@ export declare function printJson(value: unknown): void;
  * call is what guarantees a command can never print a table AND a JSON blob.
  */
 export declare function emit(human: () => void, json: unknown): void;
+/**
+ * Print a warning (+ optional hint) — in every output mode, always to stderr.
+ *
+ * `emit` is for a command's *result*, and JSON mode legitimately replaces the
+ * human rendering of one. A warning is not a result: it says the command is
+ * about to do something the caller may not have meant, and that is exactly as
+ * true when the output is piped. Gating one on `!isJsonMode()` deleted it
+ * precisely where nobody was watching the terminal — a `--source` deploy ejected
+ * a live project off the managed runtime and said so only to a TTY that wasn't
+ * there.
+ *
+ * stdout carries the JSON value and nothing else, so warnings go to stderr:
+ * a machine parser reading stdout cannot be corrupted by one. Only the
+ * *formatting* may depend on the mode — colour and indentation for a terminal,
+ * plain ASCII otherwise. Whether a warning is emitted at all may not.
+ *
+ * Anything a caller might branch on belongs in the JSON payload as well; stderr
+ * is for whoever reads the transcript afterwards.
+ */
+export declare function warn(message: string, hint?: string): void;
 /** Print an error (+ optional hint) and exit non-zero. Never returns. */
 export declare function fail(message: string, hint?: string, code?: string): never;
 /**
@@ -149,15 +228,63 @@ export declare function confirmDestructive(opts: {
     prompt: string;
 }): Promise<void>;
 /**
- * Positional tokens after `rebase cloud` — `[group, action, arg1, …]`.
+ * Resolve one cloud command's flags and ARGUMENTS from the full `process.argv`.
+ *
+ * This replaces `cloudPositionals`, which was `rawArgs.slice(3).filter(a =>
+ * !a.startsWith("-"))`. Dropping `-`-prefixed tokens looks like it solves the
+ * permissive-parse problem and does not: a flag that takes a VALUE leaves the
+ * value behind, an ordinary word in the argument position that no filter can
+ * tell from a real one. `--project` is the flag every one of these commands
+ * documents, so the failure was reachable from the help page:
+ *
+ *   rebase cloud env unset -p acme            → removed the variable "acme"
+ *   rebase cloud env set KEY -p acme          → stored the value "acme"
+ *   rebase cloud domains add -p acme          → registered the domain "acme"
+ *   rebase cloud webhooks delete -p acme 42   → deleted webhook "acme", not 42
+ *   rebase cloud cancel -p acme               → cancelled deployment id "acme"
+ *
+ * The filter's other half is quieter. A flag nobody declared *is* dropped by
+ * it — but only from the operands, never from the run: nothing rejects it, so
+ * the command proceeds with the argument missing or defaulted. `db backup
+ * --dry-run` listed backups, `domains remove --dry-run` detached the domain,
+ * and `env set KEY=v --secrett` stored the value as an ordinary variable that
+ * `env reveal` will hand back. The one place an undeclared flag became the
+ * argument outright is `projects info|delete`, which resolved its id through
+ * `positionals()` instead — that skips only LEADING `-` tokens, so `projects
+ * delete --force` looked up a project named "--force".
+ *
+ * So: parse the whole line strictly, through the same `parseCommandArgs` the
+ * non-cloud commands use — `arg` then consumes each declared flag *with its
+ * value* wherever it appears, and rejects the undeclared, leaving `_` holding
+ * the command words followed by the real arguments. `commandWords` counts from
+ * `cloud` itself (`cloud env set` ⇒ 3), and is applied to the parsed
+ * positionals, so a flag written before the group shifts nothing.
+ *
+ * Two things this adds over calling `parseCommandArgs` directly, and the reason
+ * it is worth a wrapper:
  *
- * Deliberately NOT `arg({}, { permissive: true })._`: in permissive mode `arg`
- * pushes UNKNOWN FLAGS onto `_` too, so `rollback --yes --json` would report
- * `--yes` as the deployment id. Operand extraction must see operands only, so
- * anything starting with `-` is dropped — the same filter the db backup handler
- * has always used.
+ *  - `GLOBAL_CLOUD_FLAGS` is merged in. `--json`, `--yes` and `--project` may
+ *    appear anywhere on a cloud line including before the group, so a strict
+ *    parse that did not declare them would reject the CLI's own documented
+ *    usage. (`parseCommandArgs` adds `--debug`/`--help` on top of that.)
+ *  - A parse error is reported through `fail`, not thrown. A throw reaches
+ *    `bin/rebase.js`, which prints `✗ …` to stderr — which is right for every
+ *    other command and wrong here: `rebase cloud` is in JSON mode whenever
+ *    stdout is not a TTY, i.e. always for the agents this family is built for,
+ *    and it promises them exactly one JSON value. `fail` keeps that promise,
+ *    with the same `usage` code the other refusals in this family use.
  */
-export declare function cloudPositionals(rawArgs: string[]): string[];
+export declare function parseCloudArgs<S extends arg.Spec>(opts: {
+    spec: S;
+    rawArgs: string[];
+    commandWords: number;
+    /** Names the command in errors, e.g. `cloud env set` (no leading `rebase`). */
+    command: string;
+    maxPositionals?: number;
+}): {
+    flags: arg.Result<S & typeof GLOBAL_CLOUD_FLAGS>;
+    positionals: string[];
+};
 export declare function success(message: string): void;
 /** Colorize a deployment / resource status token. */
 export declare function colorStatus(status: string | undefined): string;

package/dist/commands/cloud/databases.d.ts

@@ -1 +1,40 @@
+/**
+ * `rebase cloud db` — database + backup management for a project.
+ *
+ *   db list                List databases attached to the project
+ *   db create              Attach a managed or bring-your-own database
+ *   db test                Test connectivity to the project's database
+ *   db backup list|create|restore
+ */
+import arg from "arg";
 export declare function dbCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * `db backup [action] [filename]`, resolved in one strict parse.
+ *
+ * Both halves were reachable by the old operand filter, and both are
+ * destructive: `rebase cloud db backup -p acme` read `--project`'s value as the
+ * ACTION (falling through to a list, so the flag silently changed what ran),
+ * and `db backup restore -p acme` read it as the FILENAME — a restore staged
+ * over the live database, named after the project slug. An undeclared flag was
+ * dropped instead of refused, which is the same failure one step quieter: `db
+ * backup --dry-run` ran a list, having silently discarded the flag that was
+ * supposed to change what it did.
+ *
+ * Exported so its tests drive the real parser.
+ */
+export declare function resolveBackupArgs(rawArgs: string[]): {
+    flags: arg.Result<{
+        "--yes": BooleanConstructor;
+    } & {
+        readonly "--json": BooleanConstructor;
+        readonly "--yes": BooleanConstructor;
+        readonly "--help": BooleanConstructor;
+        readonly "--project": StringConstructor;
+        readonly "-p": "--project";
+        readonly "-y": "--yes";
+        readonly "-h": "--help";
+    }>;
+    action: string;
+    filename: string;
+};
+export declare function printDbHelp(): void;

package/dist/commands/cloud/debug.d.ts

@@ -115,3 +115,4 @@ export declare function formatDuration(seconds: number): string;
  */
 export declare function parseSince(input: string | undefined): number | null;
 export declare function debugCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
+export declare function printDebugHelp(): void;

package/dist/commands/cloud/deploy.d.ts

@@ -46,5 +46,69 @@ export declare function timeAgo(value: string | Date | undefined, now: Date): st
 export declare function isManagedProject(project: DeployProjectRow | undefined, latest: DeploySourceRow | undefined): boolean;
 /** What a `deploy` with nothing attached will build, in the words to print. */
 export declare function planBareDeploy(project: DeployProjectRow | undefined, latest: DeploySourceRow | undefined, now: Date): BareDeployPlan;
+/**
+ * A warning attached to a deploy: printed for the human, carried in the JSON.
+ *
+ * `code` is the stable half — the message is prose and will be reworded, so it
+ * is the code that CI or an agent branches on.
+ */
+export interface DeployWarning {
+    code: string;
+    message: string;
+    hint?: string;
+}
+/** `code` of the warning below, and the field name it sets in the payload. */
+export declare const EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
+/** The one sentence that says a source build undoes `runtimeMode: managed`. */
+export declare function ejectWarning(projectRef: string): DeployWarning;
+/** How a container-image deploy was asked for — the input to both rules below. */
+export interface EjectContext {
+    /** The project currently runs on the managed runtime. */
+    managed: boolean;
+    /** `--source` was passed: build this directory. */
+    source: boolean;
+    /** `--force` was passed: eject on purpose. */
+    force: boolean;
+}
+/**
+ * Why a container-image deploy of a managed project is refused — or `undefined`
+ * to let it through.
+ *
+ * Every path below this point builds a container image, and a successful one
+ * sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+ * was used" but "did the caller ask to leave the managed runtime", and only
+ * `--force` answers it.
+ *
+ * `--source` used to be read as answering it too, on the theory that uploading a
+ * build context is self-evidently a deliberate eject. It is not: `--source`
+ * picks *which source* gets built — this directory, rather than the stale
+ * archive the control plane is holding — and the eject is a side effect of the
+ * answer. That is exactly how a live project got flipped to `custom` by someone
+ * whose actual intent was "deploy what I have here", and it is the same
+ * ignorance the bare form is refused for. Same ignorance, same refusal.
+ */
+export declare function ejectRefusal(opts: EjectContext, projectRef: string): {
+    message: string;
+    hint: string;
+    code: string;
+} | undefined;
+/**
+ * Which warnings a container-image deploy has earned.
+ *
+ * Pure, and separate from the printing, because the printing is what went
+ * wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+ * the fact that a deploy ejects a managed project existed only as a side effect
+ * of a TTY being attached. Deciding here, emitting once at the call site, means
+ * the decision cannot be output-mode-dependent again.
+ *
+ * The condition is just `managed`: anything reaching this point is a container
+ * image build that `ejectRefusal` has already let through, and on a managed
+ * project that is an eject however it was spelled. A caller who passed `--force`
+ * knows — the warning is for the transcript and the payload, which is what
+ * anyone reviewing the deploy afterwards actually reads.
+ */
+export declare function deployWarnings(opts: EjectContext, projectRef: string): DeployWarning[];
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+export declare function warningPayload(warnings: DeployWarning[]): Record<string, unknown>;
 export declare function deployCommand(rawArgs: string[], projectRef: string): Promise<void>;
 export declare function logsCommand(rawArgs: string[], projectRef: string): Promise<void>;

package/dist/commands/cloud/deployments.d.ts

@@ -50,5 +50,27 @@ export declare const DEFAULT_DEPLOYMENTS_LIMIT = 20;
 /** `--limit N`, bounded. A garbage value is a refusal, never a silent default. */
 export declare function parseDeploymentsLimit(raw: number | undefined): number;
 export declare function deploymentsListCommand(rawArgs: string[]): Promise<void>;
+/**
+ * The deployment id `rollback`/`cancel` was given, if any.
+ *
+ * Both take an optional id, which is what made the old operand filter so easy
+ * to trip: `rebase cloud rollback -p acme` — the documented way to act on an
+ * unlinked project — read `--project`'s value as the id and refused with
+ * "Deployment acme not found", and `cancel -p acme` sent "acme" to the server
+ * as the deployment to cancel. Strict parsing consumes the flag with its value,
+ * so an id given as a flag value is never mistaken for an argument.
+ */
+export declare function resolveDeploymentIdArg(rawArgs: string[], command: string): {
+    flags: import("arg").Result<{
+        readonly "--json": BooleanConstructor;
+        readonly "--yes": BooleanConstructor;
+        readonly "--help": BooleanConstructor;
+        readonly "--project": StringConstructor;
+        readonly "-p": "--project";
+        readonly "-y": "--yes";
+        readonly "-h": "--help";
+    }>;
+    id: string;
+};
 export declare function rollbackCommand(rawArgs: string[]): Promise<void>;
 export declare function cancelCommand(rawArgs: string[]): Promise<void>;

package/dist/commands/cloud/domains.d.ts

@@ -1 +1,11 @@
 export declare function domainsCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * The domain `domains add` was asked to register.
+ *
+ * Exported so its tests drive the real parser. Under the old operand filter
+ * `rebase cloud domains add -p acme` registered a domain called "acme" — the
+ * project slug, read out of `--project`'s own value — and a registered domain
+ * is a project-record write, not a no-op.
+ */
+export declare function resolveDomainArg(rawArgs: string[]): string | undefined;
+export declare function printDomainsHelp(): void;

package/dist/commands/cloud/env.d.ts

@@ -6,3 +6,54 @@ export declare function parseEnvAssignment(operands: string[]): {
 } | null;
 /** The prefix that makes `key` a build-time variable, or undefined. */
 export declare function buildTimeEnvPrefix(key: string): string | undefined;
+/** The flags `rebase cloud env set` takes, on top of the global cloud ones. */
+export declare const ENV_SET_FLAGS: {
+    readonly "--secret": BooleanConstructor;
+    readonly "--force": BooleanConstructor;
+};
+/**
+ * What `env set` was asked to store.
+ *
+ * The sharp one in this family: the old operand filter left `--project`'s value
+ * in the operand list, so `rebase cloud env set KEY -p acme` parsed as the
+ * `KEY VALUE` form and stored the project slug as KEY's value — a write that
+ * succeeds, reports success, and is wrong. Strict parsing consumes `-p` with
+ * its value, leaving `["KEY"]` and the documented empty value.
+ *
+ * A value beginning with `-` must use the `KEY=-v` form; the bare `KEY -v` form
+ * is refused rather than guessed at, as everywhere else strict parsing is used.
+ *
+ * Exported so its tests drive the real parser rather than a copy of it.
+ */
+export declare function resolveEnvSetArgs(rawArgs: string[]): {
+    flags: import("arg").Result<{
+        readonly "--secret": BooleanConstructor;
+        readonly "--force": BooleanConstructor;
+    } & {
+        readonly "--json": BooleanConstructor;
+        readonly "--yes": BooleanConstructor;
+        readonly "--help": BooleanConstructor;
+        readonly "--project": StringConstructor;
+        readonly "-p": "--project";
+        readonly "-y": "--yes";
+        readonly "-h": "--help";
+    }>;
+    assignment: {
+        key: string;
+        value: string;
+    } | null;
+};
+/**
+ * The variable `env unset` / `env reveal` names.
+ *
+ * `unset` is a delete, and the operand filter aimed it at the wrong variable:
+ * `rebase cloud env unset -p acme` removed a variable called "acme" from the
+ * linked project instead of reporting a missing KEY, and `env unset -p acme
+ * KEY` removed "acme" instead of KEY. Both read `--project`'s value as the
+ * operand — a plain word in the right position that no flag filter can catch.
+ *
+ * `action` is the word the caller used (`unset`, `rm`, `delete`, `reveal`); the
+ * count of command words is the same for all of them.
+ */
+export declare function resolveEnvKeyArg(rawArgs: string[], action: string): string | undefined;
+export declare function printEnvHelp(): void;

package/dist/commands/cloud/extensions.d.ts

@@ -1,3 +1,24 @@
 /** The identifier CREATE EXTENSION takes. `pgvector` is a common alias. */
 export declare function resolveExtensionAlias(name: string): string;
 export declare function extensionsCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * The extension `enable`/`disable` names, plus the flags that gate it.
+ *
+ * Under the old operand filter `rebase cloud extensions enable -p acme` read
+ * `--project`'s value as the extension name and asked the server to install one
+ * called "acme"; `extensions disable -p acme vector` dropped "acme" rather than
+ * vector. Strict parsing consumes the flag with its value.
+ */
+export declare function resolveExtensionArgs(rawArgs: string[], action: "enable" | "disable"): {
+    flags: import("arg").Result<{
+        readonly "--json": BooleanConstructor;
+        readonly "--yes": BooleanConstructor;
+        readonly "--help": BooleanConstructor;
+        readonly "--project": StringConstructor;
+        readonly "-p": "--project";
+        readonly "-y": "--yes";
+        readonly "-h": "--help";
+    }>;
+    name: string;
+};
+export declare function printExtensionsHelp(): void;

package/dist/commands/cloud/index.d.ts

@@ -1 +1,24 @@
+/**
+ * Positional tokens after `rebase cloud` (group, action, …).
+ *
+ * Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
+ * declared so `arg` *consumes* the flags that may precede it — critically
+ * together with their values, which is the half that filtering cannot do. The
+ * leading-`-` skip then covers a flag nobody declared, so an unrecognised
+ * boolean shifts nothing.
+ *
+ * Only leading tokens are skipped: past the group and action, an undeclared
+ * flag and its value are somebody else's positionals and none of our business.
+ * A flag this file has never heard of, that takes a value, placed before the
+ * group, is the one shape still unresolvable here — there is no way to know
+ * whether the token after it is its value or the group, and guessing either way
+ * is worse than the handler reporting an unknown group.
+ *
+ * Exported so its tests can drive the real thing. The dispatch test used to
+ * re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which
+ * filtered flags, while this function did not — so the test asserted the
+ * behaviour we wanted against a copy that had it, and stayed green for as long
+ * as the real dispatcher was broken.
+ */
+export declare function positionals(rawArgs: string[]): string[];
 export declare function cloudCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/cloud/orgs.d.ts

@@ -1 +1,2 @@
 export declare function orgsCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
+export declare function printOrgsHelp(): void;