@rebasepro/cli 0.15.0 → 0.16.0

package/dist/index.es.js

@@ -2423,7 +2423,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase_app:${dbPassword}@127.0.0.1:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase_app:${dbPassword}@127.0.0.1:${dbPort}/rebase?options=-c%20search_path%3Dpublic&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
 			const dockerComposePath = path.join(targetDirectory, "docker-compose.yml");
 			if (fs.existsSync(dockerComposePath)) {
 				let dockerComposeContent = fs.readFileSync(dockerComposePath, "utf-8");
@@ -2827,6 +2827,75 @@ ${chalk.green.bold("introspect Options")}
 /**
 * CLI command: rebase db <action>
 */
+/**
+* A destination that names a remote store rather than a local path.
+*
+* Matched as "scheme://" generally, not as a list of the schemes we support:
+* an unknown scheme is still not something to join onto a filesystem path, and
+* a Windows drive letter ("C:\backups") has no "//" so it stays a path.
+*/
+var REMOTE_DESTINATION_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+/**
+* Rewrite local path arguments so they mean what the user typed.
+*
+* The plugin CLI is spawned with `cwd: backendDir` — it has to be, because that
+* is where the plugin and its dependencies resolve from. But the developer runs
+* `rebase db` from the project root, so a relative `--out ./backups` was being
+* resolved against `backend/` and landed in `backend/backups`, while the
+* success line echoed the path as typed. The file was real and the reported
+* location was wrong, which is the worst way for a backup command to behave.
+* `rebase db --help` documents exactly this invocation.
+*
+* Absolutising here rather than inside the plugin keeps the fix where the cwd
+* is actually changed, and leaves the plugin usable on its own terms.
+*/
+function absolutizeLocalPathArgs(args, cwd) {
+	const takesPath = (flag) => flag === "--out" || flag === "-o";
+	/**
+	* Flags whose next token is a value, not a positional.
+	*
+	* Mirrors the `arg` specs in `@rebasepro/server-postgres`'s backup CLI.
+	* Needed only to find the `db restore` dump argument: without it,
+	* `restore --target-db app_restored ./x.dump` treats `app_restored` as the
+	* positional — it is the first token not starting with `-` — and turns a
+	* database name into a path while leaving the real dump path unresolved.
+	*/
+	const VALUE_FLAGS = /* @__PURE__ */ new Set([
+		"--out",
+		"-o",
+		"--target-db",
+		"--exclude-schema",
+		"--row-security-role"
+	]);
+	const out = [...args];
+	for (let i = 0; i < out.length; i++) {
+		const arg = out[i];
+		const eq = arg.indexOf("=");
+		if (eq > 0 && takesPath(arg.slice(0, eq))) {
+			const value = arg.slice(eq + 1);
+			if (value && !REMOTE_DESTINATION_RE.test(value)) out[i] = `${arg.slice(0, eq)}=${path.resolve(cwd, value)}`;
+			continue;
+		}
+		if (takesPath(arg)) {
+			const value = out[i + 1];
+			if (value && !value.startsWith("-") && !REMOTE_DESTINATION_RE.test(value)) {
+				out[i + 1] = path.resolve(cwd, value);
+				i++;
+			}
+		}
+	}
+	const restoreAt = out.indexOf("restore");
+	if (restoreAt !== -1) for (let i = restoreAt + 1; i < out.length; i++) {
+		const arg = out[i];
+		if (arg.startsWith("-")) {
+			if (!arg.includes("=") && VALUE_FLAGS.has(arg)) i++;
+			continue;
+		}
+		if (!REMOTE_DESTINATION_RE.test(arg)) out[i] = path.resolve(cwd, arg);
+		break;
+	}
+	return out;
+}
 async function dbCommand(subcommand, rawArgs) {
 	if (!subcommand || subcommand === "--help") {
 		printDbHelp$1();
@@ -2849,6 +2918,7 @@ async function dbCommand(subcommand, rawArgs) {
 	const envFile = findEnvFile(projectRoot);
 	const env = { ...process.env };
 	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	const childArgs = absolutizeLocalPathArgs(rawArgs.slice(2), process.cwd());
 	try {
 		if (pluginCli.endsWith(".ts")) {
 			const tsxBin = resolveTsx(projectRoot);
@@ -2856,12 +2926,12 @@ async function dbCommand(subcommand, rawArgs) {
 				console.error(chalk.red("✗ Could not find tsx binary."));
 				process.exit(1);
 			}
-			await execa(tsxBin, [pluginCli, ...rawArgs.slice(2)], {
+			await execa(tsxBin, [pluginCli, ...childArgs], {
 				cwd: backendDir,
 				stdio: "inherit",
 				env
 			});
-		} else await execa("node", [pluginCli, ...rawArgs.slice(2)], {
+		} else await execa("node", [pluginCli, ...childArgs], {
 			cwd: backendDir,
 			stdio: "inherit",
 			env
@@ -4963,10 +5033,165 @@ async function buildBundle(options) {
 		type: "module",
 		dependencies: declared
 	}, null, 2)}\n`, "utf8");
+	const vendor = vendorDependencies({
+		outDir,
+		declared,
+		nativeModules,
+		required: [getActiveBackendPlugin(path.join(projectRoot, "backend"))].filter((name) => Boolean(name)),
+		requested: options.vendor
+	});
+	if (vendor.vendored) {
+		manifest.deps.vendored = true;
+		manifest.deps.vendorTarget = vendor.target;
+		fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	}
 	return {
 		outDir,
 		manifest,
-		collectionCount: collections.length
+		collectionCount: collections.length,
+		vendor
+	};
+}
+/** Default install target: what the published runtime image runs. */
+var VENDOR_TARGET_OS = "linux";
+var VENDOR_TARGET_CPU = "x64";
+/**
+* Where a vendored bundle starts being too big to upload.
+*
+* The control plane refuses a bundle over 100 MB, and that ceiling is not
+* arbitrary or easily raised: its pod has a 512Mi memory limit and the upload
+* route holds the body while it writes it, so the cap protects the process that
+* also serves the console, deploys and billing. Vendoring is the one change that
+* can push a bundle near it.
+*
+* So the warning is here, at build time, where the remedy is one flag away —
+* rather than at deploy time as a 413 nobody can act on without rebuilding. The
+* threshold sits below the real cap because this measures the tree on disk and
+* the upload is compressed: crossing it means "getting close", not "will fail".
+*/
+var VENDOR_SIZE_WARN_BYTES = 150 * 1024 * 1024;
+/** Bytes on disk under `dir`. Bounded so a pathological tree cannot hang a build. */
+function directorySize(dir, budget = 2e5) {
+	let total = 0;
+	let visited = 0;
+	const stack = [dir];
+	while (stack.length > 0 && visited < budget) {
+		const current = stack.pop();
+		let entries;
+		try {
+			entries = fs.readdirSync(current, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			visited++;
+			const full = path.join(current, entry.name);
+			if (entry.isDirectory()) stack.push(full);
+			else if (entry.isFile()) try {
+				total += fs.statSync(full).size;
+			} catch {}
+		}
+	}
+	return total;
+}
+/**
+* Install the bundle's declared dependencies into the bundle itself.
+*
+* ## What this buys
+*
+* A managed pod's bundle lives on an `emptyDir`, so it is re-fetched and
+* re-installed on **every** start — an eviction, a node failure, an OOM, a
+* runtime rollout. The install is 35–55 seconds of a 40–60 second cold start,
+* which makes it the price of every unplanned restart a tenant suffers. Doing it
+* once at build time instead of every time at boot takes that to roughly the
+* cost of untarring.
+*
+* The pod side needs no change to benefit: the init container already skips
+* installing when `node_modules` is present, a guard that existed for
+* pre-baked images and turns out to be exactly the hook this needs.
+*
+* ## Why it refuses to vendor native code
+*
+* A compiled binary is valid only for the platform it was built for, and a
+* developer's machine is rarely the deployment's. The managed runtime already
+* refuses bundles containing native modules for the same reason, so this refusal
+* costs nothing there — but a self-hosted project may legitimately use them, and
+* for those the honest answer is to install in the container, where the platform
+* is known.
+*
+* ## Why `--os` and `--cpu` are not optional
+*
+* The dangerous case is not native code, which is detectable. It is a pure-JS
+* package whose real work lives in a **platform-specific optional dependency** —
+* `esbuild` being the one everybody meets. Installing on an Apple Silicon Mac
+* resolves `@esbuild/darwin-arm64`, produces a tree that looks complete, and
+* fails at import inside a linux/amd64 pod. npm resolves optional dependencies
+* for the declared target rather than the host when told to, so it is told to.
+*/
+function vendorDependencies(options) {
+	if (options.requested === false) return {
+		vendored: false,
+		skipped: "disabled with --no-vendor"
+	};
+	if (Object.keys(options.declared).length === 0) return {
+		vendored: false,
+		skipped: "the bundle declares no dependencies"
+	};
+	if (options.nativeModules.length > 0) return {
+		vendored: false,
+		skipped: `the dependency closure contains native code (${options.nativeModules.map((m) => m.name).join(", ")}), which is only valid on the platform it was compiled for`
+	};
+	const target = {
+		os: VENDOR_TARGET_OS,
+		cpu: "x64",
+		node: process.versions.node.split(".")[0]
+	};
+	const run = options.run ?? ((cmd, args, cwd) => {
+		const result = spawnSync(cmd, args, {
+			cwd,
+			stdio: "pipe",
+			encoding: "utf8"
+		});
+		if (result.error) throw result.error;
+		if (result.status !== 0) throw new Error(`${cmd} ${args.join(" ")} exited ${result.status}\n${result.stderr || result.stdout || ""}`.trim());
+	});
+	try {
+		run("npm", [
+			"install",
+			"--omit=dev",
+			"--ignore-scripts",
+			"--no-audit",
+			"--no-fund",
+			`--os=${target.os}`,
+			`--cpu=${target.cpu}`
+		], options.outDir);
+	} catch (error) {
+		return {
+			vendored: false,
+			skipped: `npm install failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const installed = path.join(options.outDir, "node_modules");
+	if (!fs.existsSync(installed)) return {
+		vendored: false,
+		skipped: "npm install produced no node_modules"
+	};
+	const missing = (options.required ?? []).filter((name) => !fs.existsSync(path.join(installed, ...name.split("/"), "package.json")));
+	if (missing.length > 0) {
+		fs.rmSync(installed, {
+			recursive: true,
+			force: true
+		});
+		fs.rmSync(path.join(options.outDir, "package-lock.json"), { force: true });
+		return {
+			vendored: false,
+			skipped: `the installed tree is missing ${missing.join(", ")}, which the runtime resolves from the bundle — the bundle declares it at a version no registry can serve (a workspace link), so nothing was vendored rather than shipping a tree that boots without a driver`
+		};
+	}
+	return {
+		vendored: true,
+		target,
+		bytes: directorySize(installed)
 	};
 }
 /**
@@ -5374,6 +5599,8 @@ ${chalk.bold("Options")}
   --out <dir>                  Bundle output directory (default: ${DEFAULT_BUNDLE_DIR})
   --skip-type-check            Compile without type checking (faster; use for iteration only)
   --skip-schema                Do not regenerate the database schema from collections
+  --no-vendor                  Do not install dependencies into the bundle (they
+                               install on every pod start instead, ~40-60s slower)
   --legacy                     Run every workspace's own build script instead
   -h, --help                   Show this help
 
@@ -5393,6 +5620,7 @@ async function buildCommand(rawArgs = []) {
 			"--output": String,
 			"--out": "--output",
 			"--skip-type-check": Boolean,
+			"--no-vendor": Boolean,
 			"--skip-schema": Boolean,
 			"--no-static": Boolean,
 			"--skip-static-build": Boolean,
@@ -5457,11 +5685,24 @@ async function buildCommand(rawArgs = []) {
 				runtimeRange: manifest.rebase,
 				storage: manifest.storage,
 				skipTypeCheck: args["--skip-type-check"],
-				skipSchema: args["--skip-schema"]
+				skipSchema: args["--skip-schema"],
+				vendor: args["--no-vendor"] ? false : void 0
 			});
 			const rel = path.relative(projectRoot, result.outDir);
 			console.log(chalk.green(`  ✓ bundle → ${rel}/`));
 			console.log(chalk.dim(`    ${result.collectionCount} collection(s), schema ${result.manifest.schemaVersion}`));
+			if (result.vendor.vendored) {
+				console.log(chalk.dim(`    dependencies installed into the bundle (${result.vendor.target?.os}/${result.vendor.target?.cpu})`));
+				if ((result.vendor.bytes ?? 0) > 157286400) {
+					const mb = Math.round((result.vendor.bytes ?? 0) / (1024 * 1024));
+					console.log(chalk.yellow(`    ⚠ the installed tree is ${mb} MB — close to the 100 MB upload limit`));
+					console.log(chalk.dim("      Rebuild with --no-vendor if the deploy is rejected as too large."));
+				}
+			} else if (Object.keys(result.manifest.deps.declared).length === 0) console.log(chalk.dim("    no dependencies to install — nothing to bundle"));
+			else {
+				console.log(chalk.yellow(`    ⚠ dependencies not bundled: ${result.vendor.skipped}`));
+				console.log(chalk.dim("      They install on every pod start instead, which is ~40-60s of cold start."));
+			}
 			if (result.manifest.hooks.native) {
 				const names = (result.manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
 				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
@@ -6312,6 +6553,92 @@ ${chalk.green.bold("Examples")}
 `);
 }
 //#endregion
+//#region src/utils/libpq-url.ts
+/** Postgres URI schemes. A key/value DSN ("host=… dbname=…") is not one. */
+var POSTGRES_URI_RE = /^postgres(ql)?:\/\//i;
+/**
+* Return the query parameters libpq would reject, or an empty array.
+*
+* Deliberately not built on `new URL()`: that parser is happy to accept the
+* broken form (it splits on the first `=` and keeps the rest as the value),
+* so it cannot see the defect at all. The rule being checked is libpq's, and
+* it is about the raw text.
+*/
+function findUnparseableParams(connectionString) {
+	if (!POSTGRES_URI_RE.test(connectionString)) return [];
+	const q = connectionString.indexOf("?");
+	if (q === -1) return [];
+	const query = connectionString.slice(q + 1).split("#")[0];
+	if (!query) return [];
+	const found = [];
+	for (const part of query.split("&")) {
+		if (!part) continue;
+		if (part.split("=").length > 2) found.push({
+			name: part.slice(0, part.indexOf("=")),
+			raw: part
+		});
+	}
+	return found;
+}
+/**
+* Percent-encode the offending `=` characters, leaving everything else byte for
+* byte as it was.
+*
+* Only the second and later `=` in a parameter are rewritten — the first is the
+* real separator. Nothing else is touched: re-serialising through `URL` would
+* also reorder parameters and turn spaces into `+`, which libpq does not decode,
+* so a "tidy up" would trade one unparseable string for another.
+*/
+function encodeExtraEquals(connectionString) {
+	if (findUnparseableParams(connectionString).length === 0) return connectionString;
+	const q = connectionString.indexOf("?");
+	const head = connectionString.slice(0, q + 1);
+	const rest = connectionString.slice(q + 1);
+	const hash = rest.indexOf("#");
+	const query = hash === -1 ? rest : rest.slice(0, hash);
+	const fragment = hash === -1 ? "" : rest.slice(hash);
+	return `${head}${query.split("&").map((part) => {
+		const first = part.indexOf("=");
+		if (first === -1) return part;
+		return `${part.slice(0, first)}=${part.slice(first + 1).replace(/=/g, "%3D")}`;
+	}).join("&")}${fragment}`;
+}
+/** Variables whose value is a Postgres connection string. */
+var CONNECTION_VARIABLES = ["DATABASE_URL", "ADMIN_CONNECTION_STRING"];
+/**
+* Scan one file's text for connection strings libpq would reject.
+*
+* Handles both shapes a scaffolded project uses, because both shipped with the
+* defect and a deployed stack is broken by the compose one alone:
+*
+*   .env               DATABASE_URL=postgresql://…
+*   docker-compose.yml   DATABASE_URL: postgresql://…
+*/
+function scanTextForLibpqUrls(file, text) {
+	const findings = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed.startsWith("#")) continue;
+		for (const variable of CONNECTION_VARIABLES) {
+			const match = trimmed.match(new RegExp(`^(?:export\\s+)?${variable}\\s*[:=]\\s*(.+)$`));
+			if (!match) continue;
+			let value = match[1].trim();
+			const quoted = value.match(/^(['"])(.*)\1$/);
+			if (quoted) value = quoted[2];
+			if (!value) continue;
+			const params = findUnparseableParams(value);
+			if (params.length === 0) continue;
+			findings.push({
+				file,
+				variable,
+				params: params.map((p) => p.name),
+				suggested: encodeExtraEquals(value)
+			});
+		}
+	}
+	return findings;
+}
+//#endregion
 //#region src/commands/doctor.ts
 /**
 * CLI command: rebase doctor
@@ -6320,6 +6647,76 @@ ${chalk.green.bold("Examples")}
 * the generated Drizzle schema, and the live PostgreSQL database.
 */
 /**
+* Files that can hold a connection string the project actually runs on.
+*
+* `.env` is what local commands read; the compose files are what a self-hosted
+* stack and its scheduled backup cron read. Both shipped with the defect, and a
+* deployed stack is broken by the compose one even when `.env` has been fixed.
+* `.env.example` is deliberately absent: nothing runs on it.
+*/
+var CONNECTION_FILES = [
+	".env",
+	".env.local",
+	"docker-compose.yml",
+	"docker-compose.yaml",
+	"docker-compose.custom.yml"
+];
+/**
+* Find connection strings libpq cannot parse, anywhere in the project.
+*
+* Exported for the tests; `envFile` is passed separately because a project may
+* keep its `.env` outside the root (see `findEnvFile`).
+*/
+function findLibpqUrlProblems(projectRoot, envFile) {
+	const candidates = CONNECTION_FILES.map((f) => path.join(projectRoot, f));
+	if (envFile) candidates.push(envFile);
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of candidates) {
+		if (seen.has(file)) continue;
+		seen.add(file);
+		let text;
+		try {
+			if (!fs.existsSync(file)) continue;
+			text = fs.readFileSync(file, "utf-8");
+		} catch {
+			continue;
+		}
+		findings.push(...scanTextForLibpqUrls(path.relative(projectRoot, file) || path.basename(file), text));
+	}
+	return findings;
+}
+/**
+* Report unparseable connection strings, if any.
+*
+* Runs before the plugin's drift check and never blocks it. The plugin connects
+* through node-postgres, which parses these URLs happily — so it cannot see this
+* defect, and a project with it will otherwise get a clean bill of health while
+* `rebase db backup` fails.
+*/
+function reportLibpqUrlProblems(findings) {
+	if (findings.length === 0) return;
+	console.log("");
+	console.log(chalk.red.bold("  ✗ Connection string that PostgreSQL's own tools cannot parse"));
+	console.log("");
+	for (const f of findings) {
+		console.log(`    ${chalk.bold(f.file)} → ${chalk.bold(f.variable)}`);
+		console.log(chalk.gray(`      the "${f.params.join("\", \"")}" parameter contains an unencoded "=".`));
+		console.log(chalk.gray("      Replace the value with:"));
+		console.log(`      ${chalk.cyan(f.suggested)}`);
+		console.log("");
+	}
+	console.log(chalk.gray("    libpq splits a query parameter on the first \"=\" and rejects any further"));
+	console.log(chalk.gray("    one, so this fails:"));
+	console.log(chalk.gray("      extra key/value separator \"=\" in URI query parameter"));
+	console.log("");
+	console.log(chalk.gray("    Affects rebase db backup / restore, scheduled backups, and psql."));
+	console.log(chalk.gray("    NOT rebase dev or db push — those use a driver that accepts it, which"));
+	console.log(chalk.gray("    is why a project can look healthy and still have no working backups."));
+	console.log(chalk.gray("    Projects scaffolded before 2026-08-18 all carry it."));
+	console.log("");
+}
+/**
 * `--help` is answered before the project guard, not after.
 *
 * `doctor` declared no `--help` at all, so the flag fell through to the command
@@ -6330,7 +6727,7 @@ ${chalk.green.bold("Examples")}
 */
 function printDoctorHelp() {
 	console.log(`
-${chalk.bold("rebase doctor")} — Detect drift between collections, schema and database
+${chalk.bold("rebase doctor")} — Check a project for drift and misconfiguration
 
 ${chalk.green.bold("Usage")}
   rebase doctor
@@ -6338,6 +6735,10 @@ ${chalk.green.bold("Usage")}
 Compares the collections you declare, the generated Drizzle schema, and the
 tables that actually exist, then reports what disagrees and how to reconcile it.
 
+Also checks the connection strings in .env and the compose files for the
+unencoded "=" that makes PostgreSQL's own tools refuse to parse them — which
+breaks backups and psql while leaving the app itself working.
+
 Run from inside a Rebase project — it reads the project's collections and
 connects to its database.
 `);
@@ -6363,6 +6764,7 @@ async function doctorCommand(rawArgs) {
 	const envFile = findEnvFile(projectRoot);
 	const env = { ...process.env };
 	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	reportLibpqUrlProblems(findLibpqUrlProblems(projectRoot, envFile));
 	try {
 		if (pluginCli.endsWith(".ts")) {
 			const tsxBin = resolveTsx(projectRoot);
@@ -11521,7 +11923,115 @@ async function storageAttachCommand(rawArgs) {
 		reportError(e, "Failed to attach storage");
 	}
 }
-async function clustersCommand(rawArgs) {
+/**
+* `rebase cloud clusters` — list, register and verify the clusters tenants run on.
+*
+* Registration is deliberately an operator action: the `clusters` collection is
+* admin-only, and a cluster record carries a credential with enough power to
+* create namespaces and read every secret in them. A self-serve "bring your own
+* cluster" flow is a different feature with a different threat model.
+*/
+async function clustersCommand(action, rawArgs) {
+	if (action === "verify") return clustersVerifyCommand(rawArgs);
+	if (action === "add") return clustersAddCommand(rawArgs);
+	return clustersListCommand(rawArgs);
+}
+/**
+* Ask a registered cluster whether it can actually host a tenant.
+*
+* The question this exists to answer early is the one that otherwise gets
+* answered by a customer's first deploy failing halfway through provisioning,
+* with an error they cannot act on and half a tenant already created.
+*/
+async function clustersVerifyCommand(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const id = rawArgs.find((a) => !a.startsWith("--") && a !== "clusters" && a !== "verify");
+	if (!id) fail("Usage: rebase cloud clusters verify <cluster-id> [--baseline]", void 0, "bad_request");
+	const withBaseline = rawArgs.includes("--baseline");
+	let report;
+	try {
+		report = await client.functions.invoke("cluster-baseline", void 0, {
+			method: "GET",
+			path: `verify/${id}${withBaseline ? "?baseline=1" : ""}`
+		});
+	} catch (error) {
+		reportError(error, "Could not verify the cluster");
+		return;
+	}
+	emit(() => {
+		console.log("");
+		const tone = report.verdict === "ready" ? chalk.green : report.verdict === "degraded" ? chalk.yellow : chalk.red;
+		console.log(`  ${tone(chalk.bold(report.verdict.toUpperCase()))}  ${chalk.gray(String(id))}`);
+		console.log("");
+		keyValues([["Reachable", report.reachable ? "yes" : chalk.red("no")], ["Permissions", `${report.permissions.allowed.length} allowed, ${report.permissions.denied.length} denied`]]);
+		if (report.blockers.length > 0) {
+			console.log("");
+			for (const b of report.blockers) console.log(`  ${chalk.red("✗")} ${b}`);
+		}
+		console.log("");
+		if (!withBaseline && report.verdict !== "unusable") {
+			note("Add --baseline to also check ingress-nginx, cert-manager and CloudNativePG.");
+			console.log("");
+		}
+	}, () => report);
+	if (report.verdict === "unusable") process.exitCode = 1;
+}
+/**
+* Register a cluster from a kubeconfig file.
+*
+* Verifies immediately rather than reporting a successful insert: a row that
+* names an unreachable cluster is worse than no row, because a project pointed
+* at it fails at deploy instead of at registration.
+*/
+async function clustersAddCommand(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const flag = (name) => {
+		const i = rawArgs.indexOf(name);
+		return i === -1 ? void 0 : rawArgs[i + 1];
+	};
+	const name = flag("--name");
+	const provider = flag("--provider");
+	const region = flag("--region");
+	const kubeconfigPath = flag("--kubeconfig");
+	if (!name || !provider || !region || !kubeconfigPath) fail("Usage: rebase cloud clusters add --name <n> --provider <gcp|aws|hetzner> --region <r> --kubeconfig <path>", void 0, "bad_request");
+	if (![
+		"gcp",
+		"aws",
+		"hetzner"
+	].includes(provider)) fail(`--provider must be gcp, aws or hetzner (got "${provider}")`, void 0, "bad_request");
+	let kubeConfigData;
+	try {
+		kubeConfigData = fs.readFileSync(kubeconfigPath, "utf8");
+	} catch {
+		fail(`Could not read ${kubeconfigPath}`, void 0, "bad_request");
+		return;
+	}
+	let created;
+	try {
+		created = await client.data.collection("clusters").create({
+			name,
+			provider,
+			region,
+			authType: "kubeconfig",
+			kubeConfigData
+		});
+	} catch (error) {
+		reportError(error, "Could not register the cluster");
+		return;
+	}
+	emit(() => {
+		success(`Registered ${name} (${created.id}).`);
+		noteBlank();
+		note("Verifying it can host tenants:");
+		note(chalk.cyan(`  rebase cloud clusters verify ${created.id} --baseline`));
+	}, () => ({
+		id: created.id,
+		name,
+		provider,
+		region
+	}));
+}
+async function clustersListCommand(rawArgs) {
 	const { client } = await requireClient(rawArgs);
 	try {
 		const clusters = (await client.data.collection("clusters").find({ limit: 100 })).data;
@@ -11677,6 +12187,122 @@ async function billingCommand(rawArgs) {
 		reportError(e, "Failed to load billing");
 	}
 }
+/** The dials, and the flag that sets each. */
+var DIAL_FLAGS = {
+	"--cpu": "cpu",
+	"--memory": "memory",
+	"--db-mode": "databaseMode",
+	"--db-instances": "databaseInstances",
+	"--db-cpu": "databaseCpu",
+	"--db-memory": "databaseMemory"
+};
+/**
+* `rebase cloud resources` — show what a project is given, and change it.
+*
+* ## Why nothing is validated here
+*
+* The rules are the *target cluster's*, not the CLI's: GKE Autopilot bills a
+* 250m/512Mi floor and rewrites anything outside a 1:1–6.5:1 memory:CPU band,
+* while a Hetzner or EKS node has neither constraint. A CLI that carried those
+* numbers would be wrong for two of the three providers the moment it shipped,
+* and would drift from the control plane the first time either changed.
+*
+* So the control plane validates and this reports what it said. The same
+* boundary refuses a raw PATCH and a console save, which is the property worth
+* having — a check in a client only covers the clients that run it.
+*/
+async function resourcesCommand(action, rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const project = await client.data.collection("projects").findById(projectId);
+	if (!project) fail(`Project ${displayProjectRef(rawArgs)} not found.`, void 0, "not_found");
+	if (action !== "set") {
+		emit(() => {
+			console.log("");
+			console.log(`  ${chalk.bold(String(project.name ?? ""))} ${chalk.gray(`[${String(project.subdomain ?? "")}]`)}`);
+			console.log("");
+			keyValues([
+				["Plan", String(project.plan ?? "legacy (no plan)")],
+				["App CPU", dialLine(project.cpu)],
+				["App memory", dialLine(project.memory)],
+				["App replicas", String(project.replicaCount ?? 1)],
+				["Database", dialLine(project.databaseMode)],
+				["Database instances", dialLine(project.databaseInstances)],
+				["Database CPU", dialLine(project.databaseCpu)],
+				["Database memory", dialLine(project.databaseMemory)]
+			]);
+			console.log("");
+			noteBlank();
+			note("Empty means the plan's default. Change one with:");
+			note(chalk.cyan("  rebase cloud resources set --cpu 500m --memory 2Gi"));
+			console.log("");
+		}, () => ({
+			plan: project.plan ?? null,
+			cpu: project.cpu ?? null,
+			memory: project.memory ?? null,
+			replicaCount: project.replicaCount ?? 1,
+			databaseMode: project.databaseMode ?? null,
+			databaseInstances: project.databaseInstances ?? null,
+			databaseCpu: project.databaseCpu ?? null,
+			databaseMemory: project.databaseMemory ?? null
+		}));
+		return;
+	}
+	const built = buildDialPatch(rawArgs);
+	if (built.error) fail(built.error, void 0, "bad_request");
+	const patch = built.patch;
+	try {
+		await client.data.collection("projects").update(projectId, patch);
+	} catch (error) {
+		reportError(error, "Could not change resources");
+		return;
+	}
+	emit(() => {
+		success("Resources updated.");
+		noteBlank();
+		for (const [field, value] of Object.entries(patch)) note(`  ${field} → ${String(value)}`);
+		noteBlank();
+		note("Applied on the next deploy, or by the hourly reconcile — whichever is first.");
+		note("A change that restarts the database waits for a maintenance window.");
+	}, () => ({ updated: patch }));
+}
+/** A dial's value, or a marker that the plan decides it. */
+function dialLine(value) {
+	if (value === null || value === void 0 || value === "") return chalk.gray("plan default");
+	return String(value);
+}
+/**
+* Turn `--cpu 500m --db-instances 2` into the patch to send.
+*
+* Pure, and exported, so the flag handling is testable without a control plane —
+* the same shape `buildSettingsPatch` uses. Returns an error string rather than
+* throwing, because the caller owns how a refusal is printed in JSON mode.
+*/
+function buildDialPatch(rawArgs) {
+	const patch = {};
+	for (const [flag, field] of Object.entries(DIAL_FLAGS)) {
+		const idx = rawArgs.indexOf(flag);
+		if (idx === -1) continue;
+		const value = rawArgs[idx + 1];
+		if (value === void 0 || value.startsWith("--")) return {
+			patch: {},
+			error: `${flag} needs a value.`
+		};
+		if (field === "databaseInstances") {
+			const n = Number(value);
+			if (!Number.isInteger(n)) return {
+				patch: {},
+				error: `${flag} takes a whole number of instances, not "${value}".`
+			};
+			patch[field] = n;
+		} else patch[field] = value;
+	}
+	if (Object.keys(patch).length === 0) return {
+		patch: {},
+		error: `Nothing to set. Pass one of: ${Object.keys(DIAL_FLAGS).join(", ")}.`
+	};
+	return { patch };
+}
 //#endregion
 //#region src/commands/cloud/index.ts
 /**
@@ -11839,8 +12465,11 @@ async function cloudCommand(subcommand, rawArgs) {
 		case "storage":
 			await storageCommand(action, rawArgs);
 			break;
+		case "resources":
+			await resourcesCommand(action, rawArgs);
+			break;
 		case "clusters":
-			await clustersCommand(rawArgs);
+			await clustersCommand(action, rawArgs);
 			break;
 		case "billing":
 			await billingCommand(rawArgs);
@@ -11972,6 +12601,11 @@ ${chalk.green.bold("Databases")}
 
 ${chalk.green.bold("Other resources")}
   ${chalk.blue.bold("webhooks list|create|delete")}
+  ${chalk.blue.bold("clusters")}                List the clusters tenants run on
+  ${chalk.blue.bold("clusters add")}            Register a cluster from a kubeconfig
+  ${chalk.blue.bold("clusters verify")}         Ask a cluster whether it can host tenants
+  ${chalk.blue.bold("resources")}               Show the CPU, memory and database this project is given
+  ${chalk.blue.bold("resources set")}           Change them (--cpu, --memory, --db-mode, --db-instances, --db-cpu, --db-memory)
   ${chalk.blue.bold("storage")}                 List storage buckets
   ${chalk.blue.bold("storage create")}          Provision platform-managed storage
   ${chalk.blue.bold("storage attach")}          Attach your own S3-compatible bucket
@@ -12400,6 +13034,6 @@ function telemetryNotice() {
 	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_FLAGS, DEV_PORT_FILENAME, INIT_FLAGS, MANIFEST_FILENAME, ManifestError, RESET_PASSWORD_FLAGS, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, isPortAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, readEnvFile, renderPayload, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveResetPasswordArgs, resolveRuntimeImageTag, resolveStartPort, resolveTsx, schemaCommand, selectUserForEmail, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_FLAGS, DEV_PORT_FILENAME, INIT_FLAGS, MANIFEST_FILENAME, ManifestError, RESET_PASSWORD_FLAGS, TEMPLATE_PLACEHOLDER_FILES, VENDOR_SIZE_WARN_BYTES, VENDOR_TARGET_CPU, VENDOR_TARGET_OS, absolutizeLocalPathArgs, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findLibpqUrlProblems, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, isPortAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, readEnvFile, renderPayload, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveResetPasswordArgs, resolveRuntimeImageTag, resolveStartPort, resolveTsx, schemaCommand, selectUserForEmail, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, vendorDependencies, writeManifest };
 
 //# sourceMappingURL=index.es.js.map