@rebasepro/cli 0.17.1 → 0.17.2-canary.ga94217a

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { f as __exportAll } from "./state-c0CJ6Kwb.js";
-import { t as MANAGED_LIMITATIONS } from "./constraints-BK1_4vci.js";
+import { t as MANAGED_LIMITATIONS } from "./constraints-DKGbNfUW.js";
 import { n as ensureManagedDatabase } from "./daemon-Bdl4lrdt.js";
 import chalk from "chalk";
 import arg from "arg";
@@ -493,6 +493,135 @@ function requireBackendDir(projectRoot) {
 	return backendDir;
 }
 //#endregion
+//#region src/commands/cloud/errors.ts
+/**
+* The service accounts a Kubernetes 403 can name, and what each means.
+*
+* `system:serviceaccount:` is the platform's own identity — the control plane's
+* pod, or a tenant's operator. A project cannot grant it anything, because the
+* grant lives in a cluster the project does not own. `system:anonymous` is the
+* same fact with the credential missing entirely.
+*/
+var PLATFORM_PRINCIPAL_RE = /system:(?:serviceaccount:|anonymous|node:)/;
+/**
+* A Kubernetes `Status` object embedded anywhere in a message.
+*
+* Scanned for rather than parsed off the front: the control plane wraps it
+* ("Failed to create the tenant namespace: …"), the client library appends
+* headers after it, and both halves are worth keeping out of the summary.
+* Balanced-brace scanning rather than a regex, because `details.causes` nests
+* and a lazy `\{.*?\}` truncates the object at the first inner brace — which
+* parses to nothing and silently falls through to the raw message.
+*/
+function extractKubernetesStatus(text) {
+	for (let start = text.indexOf("{"); start !== -1; start = text.indexOf("{", start + 1)) {
+		let depth = 0;
+		let inString = false;
+		let escaped = false;
+		for (let i = start; i < text.length; i++) {
+			const ch = text[i];
+			if (escaped) {
+				escaped = false;
+				continue;
+			}
+			if (ch === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (ch === "\"") {
+				inString = !inString;
+				continue;
+			}
+			if (inString) continue;
+			if (ch === "{") depth++;
+			else if (ch === "}") {
+				depth--;
+				if (depth !== 0) continue;
+				const candidate = text.slice(start, i + 1);
+				let parsed;
+				try {
+					parsed = JSON.parse(candidate);
+				} catch {
+					break;
+				}
+				const obj = parsed;
+				if (obj?.kind === "Status" || obj?.status === "Failure" && typeof obj.code === "number") return {
+					message: typeof obj.message === "string" ? obj.message : void 0,
+					reason: typeof obj.reason === "string" ? obj.reason : void 0,
+					code: typeof obj.code === "number" ? obj.code : void 0,
+					details: obj.details ?? void 0
+				};
+				break;
+			}
+		}
+	}
+}
+/**
+* Strip the transport noise a Kubernetes client appends to its own message.
+*
+* Only ever applied to the fallback path — when no `Status` was found, the
+* message is all there is, and cutting it at the first header keeps the
+* sentence while dropping the `audit-id` and the flowschema uid nobody outside
+* the cluster can use.
+*/
+function trimTransportNoise(message) {
+	const cut = message.search(/\s*(?:headers:|HTTP request failed|audit-id|x-kubernetes-pf-|\{"kind":"Status")/i);
+	return (cut > 0 ? message.slice(0, cut) : message).trim().replace(/[\s:,-]+$/, "");
+}
+/** The longest a summary may be before it stops being one. */
+var MAX_SUMMARY = 300;
+/**
+* One actionable line (plus a hint) from whatever the control plane returned.
+*
+* `status` is the HTTP status of the control-plane call itself, which is a
+* different number from the `code` inside an embedded Kubernetes `Status` — the
+* control plane routinely answers 500 while the cluster answered 403, and it is
+* the inner one that says what happened.
+*/
+function summarizeError(error, context) {
+	const err = error;
+	const raw = err?.message ?? String(error);
+	const k8s = extractKubernetesStatus(raw);
+	if (k8s) {
+		const inner = k8s.message?.trim() ?? "";
+		if ((k8s.code === 403 || k8s.reason === "Forbidden") && PLATFORM_PRINCIPAL_RE.test(inner)) return {
+			message: `${context}: the platform's own cluster credentials were refused by Kubernetes.`,
+			hint: `${truncate(inner)}\n  This is a platform-side permission, not something your project can grant. Nothing in your code, collections or deploy flags will change it — report it with the message above rather than retrying or changing the project.`,
+			code: "platform_permission_denied",
+			platform: true,
+			raw
+		};
+		return {
+			message: `${context}: ${truncate(inner || k8s.reason || "the cluster refused the request")}`,
+			hint: k8s.code ? `Kubernetes answered ${k8s.code}${k8s.reason ? ` (${k8s.reason})` : ""}.` : void 0,
+			code: k8s.reason ? `k8s_${k8s.reason.toLowerCase()}` : "k8s_error",
+			platform: false,
+			raw
+		};
+	}
+	const trimmed = trimTransportNoise(raw);
+	return {
+		message: `${context}${err?.status ? ` (${err.status})` : ""}: ${truncate(trimmed || raw)}`,
+		code: err?.code ?? (err?.status ? `http_${err.status}` : "request_failed"),
+		platform: false,
+		raw
+	};
+}
+function truncate(text) {
+	const flat = text.replace(/\s+/g, " ").trim();
+	return flat.length > MAX_SUMMARY ? `${flat.slice(0, MAX_SUMMARY - 1)}…` : flat;
+}
+/**
+* Whether the caller asked for the untouched body.
+*
+* `--debug` is already what `bin/rebase.js` prints after every failure as the
+* thing to add, so the raw payload hangs off the flag people are told to reach
+* for rather than off one invented here.
+*/
+function wantsRawError(argv = process.argv) {
+	return argv.includes("--debug") || process.env.REBASE_DEBUG === "1";
+}
+//#endregion
 //#region src/commands/cloud/context.ts
 /**
 * Shared foundation for the `rebase cloud` command family.
@@ -1065,6 +1194,24 @@ function parseCloudArgs(opts) {
 	}
 }
 /**
+* `--timeout <seconds>` as milliseconds, or `fallbackMs` when it was not given.
+*
+* One function rather than one per command, because two commands take this flag
+* and a second copy is where the two would come to disagree about what
+* `--timeout 0` means.
+*
+* A value this cannot read is a refusal, not a fall back to the default. The
+* whole reason a caller passes a timeout is that it has a deadline of its own;
+* quietly substituting a different one is how a fifteen-minute wait turns up
+* inside a five-minute CI step, having been asked for `--timeout 30s`.
+*/
+function resolveTimeoutMs(value, opts) {
+	if (value === void 0) return opts.fallbackMs;
+	const seconds = Number(value);
+	if (!Number.isFinite(seconds) || seconds <= 0) fail(`--timeout takes a number of seconds (got "${value}").`, `Run \`rebase ${opts.command} --help\`.`, "usage");
+	return seconds * 1e3;
+}
+/**
 * Announce an outcome — "Logged in as …", "Deleted project …".
 *
 * On **stderr**, in both modes. It reads like a result and is not one: the
@@ -1142,19 +1289,29 @@ function keyValues(rows) {
 /**
 * Surface an SDK/HTTP error consistently. The SDK throws RebaseApiError with
 * a `.status` and `.message`; anything else falls back to its string form.
+*
+* The message is summarised rather than printed — see `summarizeError`. What
+* arrives here is routinely a whole Kubernetes `Status` object with the request
+* headers appended, and the one sentence worth reading is inside it. The
+* untouched body is still available, behind `--debug`, on stderr where it
+* cannot corrupt the JSON value on stdout.
 */
 function reportError(e, context) {
 	const err = e;
+	const summary = summarizeError(e, context);
+	if (wantsRawError()) process.stderr.write(`\n${summary.raw}\n\n`);
 	if (JSON_MODE) {
 		printJson({ error: {
-			message: err?.message ? stripAnsi(err.message) : String(e),
-			code: err?.code ?? (err?.status ? `http_${err.status}` : "request_failed"),
+			message: stripAnsi(summary.message),
+			code: summary.code,
 			status: err?.status ?? null,
+			hint: summary.hint ? stripAnsi(summary.hint) : void 0,
+			platform: summary.platform,
 			context
 		} });
 		process.exit(1);
 	}
-	fail(`${context}${err?.status ? ` (${err.status})` : ""}: ${err?.message ?? String(e)}`);
+	fail(summary.message, summary.hint, summary.code);
 }
 /**
 * Open a URL in the user's default browser (best effort). Always announces the
@@ -2972,8 +3129,8 @@ async function runDriverDbCommand(rawArgs, options = {}) {
 	});
 }
 async function dbCommand(subcommand, rawArgs) {
-	if (!subcommand || subcommand === "--help") {
-		printDbHelp$1();
+	if (!subcommand || subcommand === "--help" || rawArgs.includes("--help") || rawArgs.includes("-h")) {
+		printDbHelp$1(subcommand === "--help" ? void 0 : subcommand);
 		return;
 	}
 	const projectRoot = requireProjectRoot();
@@ -3135,7 +3292,76 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 		fs.rmSync(dumpFile, { force: true });
 	}
 }
-function printDbHelp$1() {
+/**
+* What each `rebase db <action>` does and takes.
+*
+* Kept here rather than delegated to the driver because the driver is reached
+* by *running* it — which is exactly what `--help` must not do. The page is
+* deliberately short: the authority on a flag is the command's own spec, and
+* `check-doc-commands.mjs` holds every command written in this repository's
+* markdown to it. What a reader needs from here is which subcommands exist and
+* what the destructive ones want before they will run.
+*/
+var DB_ACTION_HELP = {
+	push: {
+		usage: "rebase db push [--collections <dir>] [--allow-destructive] [--yes]",
+		summary: "Apply the schema straight to the database. Development only — it does not write a migration.",
+		notes: ["A change that would drop data needs --allow-destructive."]
+	},
+	generate: {
+		usage: "rebase db generate [--collections <dir>]",
+		summary: "Generate the Drizzle schema, the Postgres DDL and a SQL migration file from the collections."
+	},
+	migrate: {
+		usage: "rebase db migrate",
+		summary: "Run the pending migration files against the database."
+	},
+	branch: {
+		usage: "rebase db branch <create|list|delete|info> [name]",
+		summary: "Database branching."
+	},
+	backup: {
+		usage: "rebase db backup [--out <path|s3://…>]",
+		summary: "Create a pg_dump backup. --out is resolved against the directory you are standing in."
+	},
+	backups: {
+		usage: "rebase db backups",
+		summary: "List stored backups."
+	},
+	restore: {
+		usage: "rebase db restore <dump> [--target-db <name>] [--create-db] --yes",
+		summary: "Restore a backup with pg_restore.",
+		notes: ["Destructive, and refuses to run without --yes."]
+	},
+	pull: {
+		usage: "rebase db pull --from <url> [--schema <name>] [--anonymize] [--yes]",
+		summary: "Copy another database into local development. One-directional by design — it can never push."
+	},
+	stop: {
+		usage: "rebase db stop",
+		summary: "Stop the managed development database. Data is kept."
+	},
+	reset: {
+		usage: "rebase db reset [--yes]",
+		summary: "Delete the managed development database and start over.",
+		notes: ["Destructive, and the data exists only on this machine."]
+	}
+};
+function printDbHelp$1(action) {
+	const entry = action ? DB_ACTION_HELP[action] : void 0;
+	if (entry) {
+		console.log(`
+${chalk.bold(`rebase db ${action}`)}
+
+  ${entry.summary}
+
+${chalk.green.bold("Usage")}
+  ${chalk.blue(entry.usage)}
+${entry.notes?.length ? `\n${chalk.green.bold("Notes")}\n${entry.notes.map((n) => `  ${chalk.gray(`• ${n}`)}`).join("\n")}\n` : ""}
+${chalk.gray("Run `rebase db --help` for every subcommand.")}
+`);
+		return;
+	}
 	console.log(`
 ${chalk.bold("rebase db")} — Database management commands
 
@@ -9122,6 +9348,39 @@ function describeDatabaseState(db) {
 	if (connection === "connected" || connection === "failed") return `${type} (${colorStatus(connection)})`;
 	return `${type} ${chalk.gray("· not tested (`rebase cloud db test`)")}`;
 }
+/** Deployment states that mean the platform is still doing something. */
+var IN_FLIGHT = /* @__PURE__ */ new Set([
+	"deploying",
+	"building",
+	"pending",
+	"queued"
+]);
+function resolveBlockedState(input) {
+	if (!input.database) return {
+		blockedOn: "no_database",
+		nextAction: "rebase cloud db create --type managed"
+	};
+	if (input.lastDeploy && IN_FLIGHT.has(String(input.lastDeploy.status))) return {
+		blockedOn: null,
+		nextAction: null
+	};
+	if (!input.lastDeploy) return {
+		blockedOn: "never_deployed",
+		nextAction: "rebase cloud deploy"
+	};
+	if (input.lastDeploy.status && input.lastDeploy.status !== "success") return {
+		blockedOn: "last_deploy_failed",
+		nextAction: "rebase cloud logs"
+	};
+	if (input.database.connectionStatus === "failed") return {
+		blockedOn: "database_unreachable",
+		nextAction: "rebase cloud db test"
+	};
+	return {
+		blockedOn: null,
+		nextAction: null
+	};
+}
 /**
 * One line describing what engine is serving this project.
 *
@@ -9161,6 +9420,11 @@ async function statusCommand(rawArgs) {
 		]);
 		const storageLine = describeStorageState(storage);
 		const databaseLine = describeDatabaseState(db);
+		const blocked = resolveBlockedState({
+			projectStatus: project.status,
+			database: db,
+			lastDeploy: deploy
+		});
 		emit(() => {
 			console.log("");
 			console.log(`  ${chalk.bold(project.name ?? project.subdomain ?? "")} ${chalk.gray(`[${project.subdomain ?? displayProjectRef(rawArgs)}]`)} ${colorStatus(project.status)}`);
@@ -9173,12 +9437,19 @@ async function statusCommand(rawArgs) {
 				["Database", databaseLine],
 				["Storage", storageLine]
 			]);
+			if (blocked.blockedOn) {
+				console.log("");
+				console.log(`  ${chalk.yellow("Waiting on you")} ${chalk.gray(`— ${blocked.blockedOn}`)}`);
+				console.log(`  ${chalk.bold(blocked.nextAction ?? "")}`);
+			}
 			console.log("");
 		}, {
 			projectId: String(project.id),
 			name: project.name ?? null,
 			subdomain: project.subdomain ?? null,
 			status: project.status ?? null,
+			blockedOn: blocked.blockedOn,
+			nextAction: blocked.nextAction,
 			url: projectHost(project, baseDomain) ?? null,
 			branch: project.gitBranch ?? null,
 			lastDeploy: deploy ? {
@@ -9589,16 +9860,48 @@ async function clustersCommand(action, rawArgs) {
 * answered by a customer's first deploy failing halfway through provisioning,
 * with an error they cannot act on and half a tenant already created.
 */
+/**
+* Which cluster `clusters verify` was asked about, and whether `--baseline`
+* was given.
+*
+* Resolved against a real spec, not scanned out of `rawArgs` by hand — and this
+* is not a tidy-up. `rawArgs` is the whole `process.argv`, so the old scan
+* ("the first token that is not `--…` and is neither `clusters` nor `verify`")
+* matched `argv[0]`, the **node binary path**. Every `rebase cloud clusters
+* verify <id>` therefore asked the control plane about a cluster called
+* `/usr/local/bin/node`, and came back 404.
+*
+* So the one diagnostic that reports `permissions.allowed` /
+* `permissions.denied` was unreachable, and its 404 read as "this command is
+* not deployed yet" rather than "the id never left this machine intact". It is
+* the command that names a missing `cronjobs.batch` grant in a single call
+* instead of a twenty-minute A/B against a live project.
+*
+* Same failure as `cloud deploy` reading `_[0]` as `"cloud"`, and the same fix:
+* one parser, exported so its test drives the real thing rather than a copy.
+*/
+function resolveClusterVerifyArgs(rawArgs) {
+	const { flags, positionals } = parseCloudArgs({
+		spec: { "--baseline": Boolean },
+		rawArgs,
+		commandWords: 2,
+		command: "cloud clusters verify",
+		maxPositionals: 2
+	});
+	return {
+		id: positionals[1],
+		baseline: flags["--baseline"] === true
+	};
+}
 async function clustersVerifyCommand(rawArgs) {
-	const { client } = await requireClient(rawArgs);
-	const id = rawArgs.find((a) => !a.startsWith("--") && a !== "clusters" && a !== "verify");
+	const { id, baseline: withBaseline } = resolveClusterVerifyArgs(rawArgs);
 	if (!id) fail("Usage: rebase cloud clusters verify <cluster-id> [--baseline]", void 0, "bad_request");
-	const withBaseline = rawArgs.includes("--baseline");
+	const { client } = await requireClient(rawArgs);
 	let report;
 	try {
 		report = await client.functions.invoke("cluster-baseline", void 0, {
 			method: "GET",
-			path: `verify/${id}${withBaseline ? "?baseline=1" : ""}`
+			path: `verify/${encodeURIComponent(id)}${withBaseline ? "?baseline=1" : ""}`
 		});
 	} catch (error) {
 		reportError(error, "Could not verify the cluster");
@@ -10012,1834 +10315,2039 @@ function buildDialPatch(rawArgs, opts) {
 	return { patch };
 }
 //#endregion
-//#region src/commands/cloud/projects.ts
+//#region src/commands/cloud/databases.ts
 /**
-* `rebase cloud projects` — list / create / info / delete.
+* `rebase cloud db` — database + backup management for a project.
+*
+*   db list                List databases attached to the project
+*   db create              Attach a managed or bring-your-own database
+*   db test                Test connectivity to the project's database
+*   db backup list|create|restore
 */
-async function listProjects(rawArgs) {
-	const { client, url } = await requireClient(rawArgs);
-	const org = getContextOrg(url);
+async function dbCommand$1(subcommand, rawArgs) {
+	switch (subcommand) {
+		case "list":
+		case void 0:
+			await listDatabases(rawArgs);
+			break;
+		case "create":
+			await createDatabase(rawArgs);
+			break;
+		case "info":
+			await dbInfo(rawArgs);
+			break;
+		case "test":
+			await testDatabase(rawArgs);
+			break;
+		case "backup":
+			await backupCommand(rawArgs);
+			break;
+		case "pitr":
+			await pitrCommand(rawArgs);
+			break;
+		case "--help":
+			printDbHelp();
+			break;
+		default: fail(`Unknown db command: ${subcommand}`, "Run `rebase cloud db --help`.", "unknown_command");
+	}
+}
+async function listDatabases(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
 	try {
-		const [projects, baseDomain] = await Promise.all([client.data.collection("projects").find({
-			where: org ? { organization: ["==", org] } : void 0,
-			orderBy: ["name", "asc"],
-			limit: 100
-		}).then((res) => res.data), fetchTenantBaseDomain(client, url)]);
-		const linkedId = readLink()?.projectId;
+		const dbs = (await client.data.collection("databases").find({
+			where: { project: ["==", projectId] },
+			limit: 50
+		})).data;
 		emit(() => {
 			console.log("");
-			console.log(chalk.bold("  📦 Projects") + (org ? chalk.gray(`  (org ${org})`) : ""));
+			console.log(chalk.bold(`  🗄  Databases — project ${projectRef}`));
 			console.log("");
-			if (projects.length === 0) {
-				console.log(chalk.gray("  No projects yet. Create one with `rebase cloud projects create`."));
+			if (dbs.length === 0) {
+				console.log(chalk.gray("  No database attached. Add one with `rebase cloud db create`."));
 				console.log("");
 				return;
 			}
-			for (const p of projects) {
-				const marker = String(p.id) === linkedId ? chalk.green(" ●") : "  ";
-				console.log(`${marker}${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.subdomain ?? p.id}]`)} ${colorStatus(p.status)}`);
-				console.log(`    ${chalk.gray(projectHost(p, baseDomain) ?? "—")}${p.provider ? chalk.gray(`  ·  ${p.provider}`) : ""}`);
+			for (const d of dbs) {
+				console.log(`  ${chalk.bold(d.type ?? "unknown")} ${chalk.gray(`[${d.id}]`)}  ${colorStatus(d.connectionStatus)}`);
+				keyValues([["SSH tunnel", d.useSshTunnel ? "yes" : void 0], ["PITR", d.pitrEnabled ? "enabled" : void 0]]);
 			}
 			console.log("");
 		}, {
-			org: org ?? null,
-			projects: projects.map((p) => ({
-				id: String(p.id),
-				name: p.name ?? null,
-				slug: p.subdomain ?? null,
-				host: projectHost(p, baseDomain) ?? null,
-				status: p.status ?? null,
-				provider: p.provider ?? null,
-				linked: String(p.id) === linkedId
+			projectId,
+			databases: dbs.map((d) => ({
+				id: String(d.id),
+				type: d.type ?? null,
+				connectionStatus: d.connectionStatus ?? null,
+				useSshTunnel: Boolean(d.useSshTunnel),
+				pitrEnabled: Boolean(d.pitrEnabled)
 			}))
 		});
 	} catch (e) {
-		reportError(e, "Failed to list projects");
+		reportError(e, "Failed to list databases");
 	}
 }
 /**
-* Default region per provider. Required on create; the rest is dialled.
+* The database already attached to a project, if any.
 *
-* There used to be a `vmSize` here too — `e2-small`, `cx21` — naming a machine
-* on a price list this platform does not buy from. The column was dropped on
-* 2026-08-20 and this went on sending it, which a control plane can only ignore
-* or refuse. What a project reserves is a set of dials now, and a project that
-* sets none takes the platform default.
+* `limit: 1` deliberately mirrors what the control plane's own `db-test`,
+* `db-info` and `backup` do — asking the same question the same way is the
+* point, since the answer decides which row a deploy will actually use.
 */
-function providerDefaults(provider) {
-	switch (provider) {
-		case "gcp": return { region: "europe-west1" };
-		case "aws": return { region: "us-east-1" };
-		default: return { region: "nbg1" };
-	}
+async function firstAttachedDatabase(client, projectId) {
+	return (await client.data.collection("databases").find({
+		where: { project: ["==", projectId] },
+		limit: 1
+	})).data[0];
 }
 /**
-* Where this project says it runs.
-*
-* `provider`/`region` are a *request*: no code downstream reads them to pick a
-* deploy target — that comes from the project's cluster record or the ambient
-* in-cluster context (saas/backend/src/k8s/resolve.ts). So a wrong value here is
-* never contradicted by a failure; it just sits in the record. The CLI used to
-* default to `hetzner`/`nbg1` unconditionally, which is how projects running on
-* our GKE cluster came to describe themselves as Hetzner in the console — and
-* `provider` also decides which substrate's rules a project's dials are clamped
-* to — Autopilot's 250m floor and 1:1-6.5:1 band do not apply on Hetzner or EKS
-* — so a wrong value here resizes pods, it is not a cosmetic slip.
-*
-* The control plane already publishes the infrastructure that actually exists,
-* and the console's create wizard reads it. Ask the same question here.
-*
-* Exported for tests: the decision is pure, so it can be pinned without a
-* control plane. The fetching and the exit live in `resolveRequestedTarget`.
+* Attach a database row to a project.
 *
-* @param requested `--provider`, if the caller named one. An explicit flag wins:
-*   it is the caller stating intent, and `deploy` corrects the record anyway.
-* @param targets What the control plane says exists, or `undefined` when it
-*   cannot say — an older deployment with no `platform-config`, or a failed
-*   request. That is different from an empty list, which is a control plane
-*   stating it has no infrastructure at all.
-* @returns the target to record, or `null` when the control plane answered that
-*   there is none.
+* Extracted so `rebase cloud projects create` can do it in the same breath as
+* creating the project — see `--db` there. Two call sites, one insert, so the
+* shape of the row cannot drift between "attached at creation" and "attached
+* afterwards".
 */
-function chooseRequestedTarget(requested, targets) {
-	if (requested) return {
-		provider: requested,
-		region: void 0
-	};
-	if (!targets) return {
-		provider: "hetzner",
-		region: void 0
-	};
-	if (targets.length === 0) return null;
-	const [target] = targets;
-	return {
-		provider: target.provider,
-		region: target.region?.trim() || void 0
-	};
-}
-async function resolveRequestedTarget(client, url, requested) {
-	const chosen = chooseRequestedTarget(requested, await fetchDeployTargets(client, url));
-	if (!chosen) fail("This control plane has no deploy targets configured.", `Register a cluster, or pass ${chalk.bold("--provider")} and ${chalk.bold("--region")} to record one anyway.`, "no_deploy_targets");
-	return chosen;
+async function attachDatabaseRow(client, input) {
+	return await client.data.collection("databases").create({
+		project: input.projectId,
+		type: input.type,
+		connectionString: input.type === "byodb" ? input.connectionString : void 0,
+		connectionStatus: "untested"
+	});
 }
-/** The flags `rebase cloud projects create` takes. */
-var CREATE_PROJECT_FLAGS = {
-	"--name": String,
-	"--subdomain": String,
-	"--repo": String,
-	"--branch": String,
-	"--provider": String,
-	"--region": String,
-	"--org": String,
-	"--link": Boolean,
-	"-n": "--name",
-	"--cpu": String,
-	"--memory": String,
-	"--replicas": String,
-	"--spot": String,
-	"--scale-to-zero": String,
-	"--db-mode": String,
-	"--db-instances": String,
-	"--db-cpu": String,
-	"--db-memory": String,
-	"--storage": String
+/** What `rebase cloud db create` parses. Exported so its help page cannot drift. */
+var CREATE_DATABASE_FLAGS = {
+	"--type": String,
+	"--connection-string": String,
+	"--wait": Boolean,
+	"--timeout": String,
+	"--project": String,
+	"-p": "--project"
 };
-async function createProject(rawArgs) {
-	const { flags: args } = parseCloudArgs({
-		spec: CREATE_PROJECT_FLAGS,
-		rawArgs,
-		commandWords: 3,
-		command: "cloud projects create",
-		maxPositionals: 0
-	});
-	const { client, url } = await requireClient(rawArgs);
-	const org = args["--org"] || getContextOrg(url);
-	if (!org) fail("No organization selected.", `Pass ${chalk.bold("--org <id>")} or run ${chalk.bold("rebase cloud use")}.`, "no_org");
-	const prompts = [];
-	if (!args["--name"]) prompts.push({
-		type: "input",
-		name: "name",
-		message: "Project name:"
-	});
-	if (!args["--subdomain"]) prompts.push({
-		type: "input",
-		name: "subdomain",
-		message: "Subdomain:"
+async function createDatabase(rawArgs) {
+	const args = arg(CREATE_DATABASE_FLAGS, {
+		argv: rawArgs.slice(4),
+		permissive: true
 	});
-	const a = prompts.length && process.stdin.isTTY ? await inquirer.prompt(prompts) : {};
-	const name = (args["--name"] || a.name || "").trim();
-	const subdomain = (args["--subdomain"] || a.subdomain || "").trim().toLowerCase();
-	const gitRepoUrl = (args["--repo"] || a.repo || "").trim();
-	const gitBranch = (args["--branch"] || a.branch || "main").trim();
-	const target = await resolveRequestedTarget(client, url, (args["--provider"] || a.provider)?.trim() || void 0);
-	const provider = target.provider;
-	const defaults = providerDefaults(provider);
-	const region = (args["--region"] || target.region || defaults.region).trim();
-	const dials = buildDialPatch(rawArgs, { requireOne: false });
-	if (dials.error) fail(dials.error, void 0, "bad_request");
-	if (!name || !subdomain) fail("Name and subdomain are required.", `Pass ${chalk.bold("--name <name>")} and ${chalk.bold("--subdomain <slug>")}.`, "input_required");
-	try {
-		const check = await client.functions.invoke("check-subdomain", { subdomain });
-		if (!check.available) fail(`Subdomain "${subdomain}" is not available${check.reason ? ` (${check.reason})` : ""}.`, void 0, "subdomain_unavailable");
-	} catch {}
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
+	const existing = await firstAttachedDatabase(client, projectId);
+	if (existing) fail(`Project ${projectRef} already has a ${existing.type ?? "database"} attached (${existing.id}).`, "A project has exactly one database. Remove that one first, or run `rebase cloud db info` to see what it points at.", "database_exists");
+	let type = args["--type"];
+	if (!type) {
+		requireInteractive("a database type", "--type <managed|byodb>");
+		const { picked } = await inquirer.prompt([{
+			type: "select",
+			name: "picked",
+			message: "Database type:",
+			choices: [{
+				name: "SaaS Managed (provisioned for you)",
+				value: "managed"
+			}, {
+				name: "Bring Your Own DB (external PostgreSQL)",
+				value: "byodb"
+			}]
+		}]);
+		type = picked;
+	}
+	let connectionString = args["--connection-string"];
+	if (type === "byodb" && !connectionString) {
+		requireInteractive("a connection string", "--connection-string <url>");
+		const { cs } = await inquirer.prompt([{
+			type: "input",
+			name: "cs",
+			message: "PostgreSQL connection string:"
+		}]);
+		connectionString = cs?.trim();
+		if (!connectionString) fail("A connection string is required for bring-your-own databases.", "Pass `--connection-string <url>`.", "input_required");
+	}
+	let created;
 	try {
-		const user = await client.auth.getUser();
-		if (!user) fail("Session is no longer valid.", "Run `rebase cloud login` again.", "session_invalid");
-		const created = await client.data.collection("projects").create({
-			name,
-			subdomain,
-			gitRepoUrl,
-			gitBranch,
-			provider,
-			region,
-			...dials.patch,
-			organization: org,
-			createdById: user.uid,
-			status: "provisioning"
-		});
-		const host = projectHost(created, await fetchTenantBaseDomain(client, url));
-		const linked = Boolean(args["--link"]);
-		if (linked) writeLink({
-			url,
-			projectId: String(created.id),
-			slug: created.subdomain,
-			projectName: name,
-			orgId: String(org)
-		});
-		success(`Created project ${chalk.bold(name)}`);
-		emit(() => {
-			keyValues([
-				["Slug", String(created.subdomain ?? "")],
-				["URL", host],
-				["Provider", provider],
-				["Branch", gitBranch]
-			]);
-			if (linked) note(chalk.gray("Linked this directory to the new project."));
-			noteBlank();
-			note(chalk.gray(`Deploy it with:  ${chalk.bold(`rebase cloud deploy --project ${created.subdomain ?? created.id}`)}`));
-			noteBlank();
-		}, {
-			success: true,
-			id: String(created.id),
-			name,
-			slug: created.subdomain ?? null,
-			host: host ?? null,
-			provider,
-			region,
-			dials: dials.patch,
-			branch: gitBranch,
-			org: String(org),
-			linked
+		created = await attachDatabaseRow(client, {
+			projectId,
+			type,
+			connectionString
 		});
 	} catch (e) {
-		reportError(e, "Failed to create project");
+		reportError(e, "Failed to attach database");
 	}
+	const waited = args["--wait"] === true ? await waitForDatabase(client, {
+		projectId,
+		type,
+		timeoutMs: resolveTimeoutMs(args["--timeout"], {
+			fallbackMs: DEFAULT_WAIT_MS,
+			command: "cloud db create"
+		})
+	}) : void 0;
+	success(`Attached ${type} database to project ${projectRef}`);
+	emit(() => {
+		keyValues([["ID", String(created.id)]]);
+		if (waited?.note) note(chalk.gray(waited.note));
+		else if (type === "byodb") note(chalk.gray("Verify it with `rebase cloud db test`."));
+		else note(chalk.gray("It is created at your first deploy — run `rebase cloud deploy` next."));
+		noteBlank();
+	}, {
+		success: true,
+		id: String(created.id),
+		projectId,
+		type,
+		connectionStatus: waited?.connectionStatus ?? "untested",
+		waited: waited ? waited.waited : false,
+		materializedAt: type === "managed" ? "first_deploy" : "now"
+	});
 }
+/** How long `db create --wait` waits by default, and `--timeout` overrides. */
+var DEFAULT_WAIT_MS = 300 * 1e3;
+var WAIT_POLL_MS = 3e3;
 /**
-* Which project `projects info` / `projects delete` acts on.
-*
-* The id is optional — omitted, it falls back to `--project` or the link file —
-* and the dispatcher used to read it off `positionals()`, which skips only
-* LEADING `-` tokens and declares only the global cloud flags. So an undeclared
-* flag written after the action became the id: `rebase cloud projects delete
-* --force` looked up a project named "--force" and reported it missing, rather
-* than saying there is no such flag. Benign next to the deletes and writes the
-* rest of this family aimed at the wrong resource, but the same mistake, and
-* `positionals()` has no spec with which to do better — the handler's own
-* module does.
+* Wait for an attached database to become usable, where "usable" means
+* something.
 *
-* Exported so its tests drive the real parser rather than a copy of it.
+* Returns `waited: false` for the managed case, and says why — the caller then
+* knows the state it is looking at is final rather than early.
 */
-function resolveProjectArg(rawArgs, action) {
-	const { positionals } = parseCloudArgs({
-		spec: {},
-		rawArgs,
-		commandWords: 3,
-		command: `cloud projects ${action}`,
-		maxPositionals: 1
-	});
-	return positionals[0] || requireProjectRef(rawArgs);
+async function waitForDatabase(client, opts) {
+	if (opts.type !== "byodb") return {
+		waited: false,
+		connectionStatus: "untested",
+		note: "Nothing to wait for: a managed database is created at the project's first deploy. Run `rebase cloud deploy` next; `rebase cloud db test` only answers after that."
+	};
+	const started = Date.now();
+	for (;;) {
+		try {
+			if ((await client.functions.invoke("db-test", { projectId: opts.projectId })).success) return {
+				waited: true,
+				connectionStatus: "connected"
+			};
+		} catch {}
+		if (Date.now() - started > opts.timeoutMs) fail(`The database did not become reachable within ${Math.round(opts.timeoutMs / 1e3)}s.`, "Run `rebase cloud db test` for the connection log.", "timeout");
+		await new Promise((resolve) => setTimeout(resolve, opts.pollMs ?? WAIT_POLL_MS));
+	}
+}
+async function testDatabase(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
+	noteBlank();
+	note(`Testing database connectivity for project ${chalk.bold(projectRef)}...`);
+	try {
+		const res = await client.functions.invoke("db-test", { projectId });
+		if (res.logs) console.error(`\n${res.logs}`);
+		if (!res.success) fail("Database connection failed.", "The connection log above (stderr) has the reason.", "db_connection_failed");
+		success("Database connection succeeded");
+		emit(() => {}, {
+			success: true,
+			projectId,
+			logs: res.logs ?? null
+		});
+	} catch (e) {
+		reportError(e, "Failed to test database");
+	}
 }
 /**
-* A project's database capacity, or null.
+* `rebase cloud db info [--reveal]` — where a project's database actually lives.
 *
-* Swallows every failure on purpose. This decorates `status`; a control plane
-* that predates the `capacity` function 404s here, and an older CLI talking to a
-* newer one must still print the project. Losing the capacity line is a missing
-* nicety — failing the whole command over it would be the bug.
+* The password is NEVER in the default output; `--reveal` fetches it through the
+* separate reveal call, and it appears in JSON only when `--reveal` is given.
+* Any field the server could not resolve comes back `null` and is rendered as
+* unavailable, never a placeholder.
 */
-async function fetchCapacity(client, projectId) {
+async function dbInfo(rawArgs) {
+	const args = arg({
+		"--reveal": Boolean,
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
 	try {
-		return (await client.functions.invoke("capacity", void 0, {
+		const info = await client.functions.invoke("db-info", void 0, {
 			method: "GET",
 			path: projectId
-		}))?.database ?? null;
-	} catch {
-		return null;
-	}
-}
-async function projectInfo(rawArgs, projectRef) {
-	const { client, url } = await requireClient(rawArgs);
-	try {
-		const projectId = await resolveProjectRef(projectRef, client);
-		const p = await client.data.collection("projects").findById(projectId);
-		if (!p) fail(`Project ${projectRef} not found.`, void 0, "project_not_found");
-		const [db, lastDeploy, baseDomain, capacity] = await Promise.all([
-			firstRow(client, "databases", projectId),
-			latestDeployment(client, projectId),
-			fetchTenantBaseDomain(client, url),
-			fetchCapacity(client, projectId)
-		]);
+		});
+		let password;
+		let connectionString;
+		if (args["--reveal"]) {
+			if (!info.passwordAvailable) fail("No password is available to reveal for this database.", info.unavailableReason ?? void 0, "password_unavailable");
+			const revealed = await client.functions.invoke("db-info", { projectId }, { path: "reveal" });
+			password = revealed.password;
+			connectionString = revealed.connectionString;
+		}
 		emit(() => {
 			console.log("");
-			console.log(`  ${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.subdomain ?? p.id}]`)} ${colorStatus(p.status)}`);
+			console.log(chalk.bold(`  🗄  Database — project ${projectRef}`) + chalk.gray(`  (${info.type})`));
 			console.log("");
 			keyValues([
-				["Subdomain", projectHost(p, baseDomain)],
-				["Custom domain", p.customDomain],
-				["Repository", p.gitRepoUrl],
-				["Branch", p.gitBranch],
-				["Provider", p.provider],
-				["Region", p.region],
-				["Organization", p.organization !== void 0 ? String(p.organization) : void 0],
-				["Database", db ? `${db.type} (${colorStatus(db.connectionStatus)})` : "none"],
-				["Storage", capacity && capacity.limitMb > 0 ? `${capacity.usedMb} MB / ${capacity.limitMb} MB${capacity.usedFraction !== null ? ` (${(capacity.usedFraction * 100).toFixed(0)}%)` : ""}` : void 0],
-				["Last deploy", lastDeploy ? `${colorStatus(lastDeploy.status)} · ${fmtDate(lastDeploy.createdAt)}` : "never"]
+				["Host", info.host],
+				["Port", info.port],
+				["Database", info.database],
+				["Username", info.username],
+				["Password", info.passwordAvailable ? password ?? chalk.gray("hidden — pass --reveal") : chalk.gray("unavailable")],
+				["Connection", connectionString]
 			]);
-			if (capacity && capacity.state !== "ok") {
+			if (info.unavailableReason) console.log(chalk.gray(`  ${info.unavailableReason}`));
+			if (info.portForward) {
+				const pf = info.portForward;
 				console.log("");
-				console.log(capacity.state === "locked" ? `  ${chalk.red.bold("✗ Database locked — over its storage limit")}` : `  ${chalk.yellow.bold("⚠ Database approaching its storage limit")}`);
-				console.log(`  ${chalk.gray(capacity.detail)}`);
+				console.log(chalk.gray(`  Port-forward:  kubectl -n ${pf.namespace} port-forward svc/${pf.service} ${pf.localPort}:${pf.remotePort}`));
 			}
 			console.log("");
 		}, {
-			id: String(p.id),
-			name: p.name ?? null,
-			slug: p.subdomain ?? null,
-			host: projectHost(p, baseDomain) ?? null,
-			customDomain: p.customDomain ?? null,
-			repository: p.gitRepoUrl ?? null,
-			branch: p.gitBranch ?? null,
-			provider: p.provider ?? null,
-			region: p.region ?? null,
-			status: p.status ?? null,
-			org: p.organization !== void 0 ? String(p.organization) : null,
-			database: db ? {
-				type: db.type ?? null,
-				connectionStatus: db.connectionStatus ?? null,
-				capacity: capacity ?? null
-			} : null,
-			lastDeploy: lastDeploy ? {
-				id: String(lastDeploy.id),
-				status: lastDeploy.status ?? null,
-				createdAt: lastDeploy.createdAt ?? null
-			} : null
+			projectId,
+			type: info.type,
+			host: info.host,
+			port: info.port,
+			database: info.database,
+			username: info.username,
+			passwordAvailable: info.passwordAvailable,
+			portForward: info.portForward,
+			unavailableReason: info.unavailableReason,
+			...args["--reveal"] ? {
+				password,
+				connectionString
+			} : {}
 		});
 	} catch (e) {
-		reportError(e, "Failed to load project");
+		reportError(e, "Failed to load database info");
 	}
 }
-async function deleteProject(rawArgs, projectRef) {
-	const { flags: args } = parseCloudArgs({
-		spec: {},
+/**
+* `db backup [action] [filename]`, resolved in one strict parse.
+*
+* Both halves were reachable by the old operand filter, and both are
+* destructive: `rebase cloud db backup -p acme` read `--project`'s value as the
+* ACTION (falling through to a list, so the flag silently changed what ran),
+* and `db backup restore -p acme` read it as the FILENAME — a restore staged
+* over the live database, named after the project slug. An undeclared flag was
+* dropped instead of refused, which is the same failure one step quieter: `db
+* backup --dry-run` ran a list, having silently discarded the flag that was
+* supposed to change what it did.
+*
+* Exported so its tests drive the real parser.
+*/
+function resolveBackupArgs(rawArgs) {
+	const { flags, positionals } = parseCloudArgs({
+		spec: { "--yes": Boolean },
 		rawArgs,
 		commandWords: 3,
-		command: "cloud projects delete",
-		maxPositionals: 1
+		command: "cloud db backup",
+		maxPositionals: 2
 	});
+	return {
+		flags,
+		action: positionals[0] || "list",
+		filename: positionals[1]
+	};
+}
+async function backupCommand(rawArgs) {
+	const { flags: args, action, filename: backupFile } = resolveBackupArgs(rawArgs);
 	const { client } = await requireClient(rawArgs);
-	const projectId = await resolveProjectRef(projectRef, client);
-	const p = await client.data.collection("projects").findById(projectId).catch(() => void 0);
-	if (!p) fail(`Project ${projectRef} not found.`, void 0, "project_not_found");
-	await confirmDestructive({
-		yes: Boolean(args["--yes"]),
-		prompt: `Permanently delete project "${p.name ?? projectRef}" (${p.subdomain ?? projectRef})? This tears down its deployment.`
-	});
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
 	try {
-		await client.data.collection("projects").delete(projectId);
-		success(`Deleted project ${chalk.bold(p.name ?? projectId)}`);
-		emit(() => {}, {
-			success: true,
-			id: projectId,
-			name: p.name ?? null,
-			slug: p.subdomain ?? null
+		if (action === "create") {
+			const res = await client.functions.invoke("backup", {
+				projectId,
+				type: "manual"
+			}, { path: "create" });
+			if (!res.success) fail(res.error || "Backup failed.");
+			emit(() => success(`Backup created: ${res.backup?.filename ?? "(unknown)"}`), {
+				success: true,
+				backup: res.backup ?? null
+			});
+			return;
+		}
+		if (action === "restore") {
+			const filename = backupFile;
+			if (!filename) fail("Usage: rebase cloud db backup restore <filename>", void 0, "usage");
+			await confirmDestructive({
+				yes: Boolean(args["--yes"]),
+				prompt: `Restore "${filename}" over the current database for project ${projectRef}?`
+			});
+			const res = await client.functions.invoke("backup", {
+				projectId,
+				filename
+			}, { path: "restore" });
+			if (!res.success) fail(res.error || "Restore failed.");
+			emit(() => success(res.message || "Restore complete"), {
+				success: true,
+				message: res.message ?? null
+			});
+			return;
+		}
+		if (action === "status") {
+			const res = await client.functions.invoke("backup", void 0, {
+				method: "GET",
+				path: `backup-status/${projectId}`
+			});
+			emit(() => {
+				console.log("");
+				console.log(chalk.bold(`  💾 Automated backups — project ${projectRef}`));
+				console.log("");
+				keyValues([
+					["Enabled", res.enabled ? chalk.green("yes") : chalk.yellow("no")],
+					["Reason", String(res.reason ?? "")],
+					["Database type", String(res.databaseType ?? "")],
+					["Last backup", res.lastSuccessfulBackup ?? void 0],
+					["Recovery window", res.recoveryWindow ? `${res.recoveryWindow.from} → ${res.recoveryWindow.to}` : void 0]
+				]);
+				console.log("");
+			}, res);
+			return;
+		}
+		if (action === "download") {
+			const filename = backupFile;
+			if (!filename) fail("Usage: rebase cloud db backup download <filename>", void 0, "usage");
+			const res = await client.functions.invoke("backup", void 0, {
+				method: "GET",
+				path: `download/${projectId}/${encodeURIComponent(filename)}`
+			});
+			emit(() => {
+				console.log("");
+				console.log(chalk.bold(`  ${res.name}`) + chalk.gray(`  ${(res.size / 1024 / 1024).toFixed(1)} MB`));
+				console.log(`  ${chalk.cyan(res.url)}`);
+				console.log("");
+				console.log(chalk.gray("  Short-lived signed URL — fetch it with curl/wget."));
+				console.log("");
+			}, {
+				name: res.name,
+				size: res.size,
+				url: res.url
+			});
+			return;
+		}
+		const res = await client.functions.invoke("backup", void 0, {
+			method: "GET",
+			path: `list/${projectId}`
+		});
+		emit(() => {
+			console.log("");
+			console.log(chalk.bold(`  💾 Backups — project ${projectRef}`));
+			console.log("");
+			if (!res.backups?.length) {
+				console.log(chalk.gray("  No backups yet. Create one with `rebase cloud db backup create`."));
+				console.log("");
+				return;
+			}
+			for (const b of res.backups) {
+				const size = b.size !== void 0 ? `${(b.size / 1024 / 1024).toFixed(1)} MB` : "";
+				console.log(`  ${chalk.bold(b.filename)}  ${chalk.gray(`${b.type ?? ""} ${size}`.trim())}`);
+			}
+			console.log("");
+		}, {
+			projectId,
+			backups: res.backups ?? []
 		});
 	} catch (e) {
-		reportError(e, "Failed to delete project");
+		reportError(e, "Backup operation failed");
 	}
 }
-async function firstRow(client, collection, projectId) {
-	return (await client.data.collection(collection).find({
-		where: { project: ["==", projectId] },
-		limit: 1
-	})).data[0];
-}
-async function latestDeployment(client, projectId) {
-	return (await client.data.collection("deployments").find({
-		where: { project: ["==", projectId] },
-		orderBy: ["createdAt", "desc"],
-		limit: 1
-	})).data[0];
-}
-function fmtDate(value) {
-	if (!value) return "—";
-	const d = new Date(value);
-	return isNaN(d.getTime()) ? value : d.toLocaleString();
-}
-//#endregion
-//#region src/commands/cloud/bundle-deploy.ts
 /**
-* Deploying a project as a managed **bundle** rather than a source build.
-*
-* `rebase cloud deploy --bundle` builds the bundle, tars it, uploads it to the
-* control plane's bundle endpoint, and triggers a deploy carrying the bundle id
-* and its generated manifest. The control plane resolves a runtime from the
-* manifest's range and runs the platform image with this bundle — the managed
-* path. A project not in managed mode, or one whose bundle fails intake, is told
-* so by the control plane; this side just packages and hands it over.
+* `rebase cloud db pitr <status|restore|cutover|discard>`.
 *
-* The pieces here are separated from the network calls so they can be tested: the
-* manifest read, the tar packaging, and the request body assembly are pure enough
-* to check without a control plane.
+* A PITR restore is STAGED, not applied: `restore` creates a recovered copy of
+* the database beside the live one — the application is NOT repointed and the
+* original is left running and unchanged. `cutover` is the separate, explicit
+* step that repoints the app at the recovered copy (and restarts it). `discard`
+* removes a staged copy; the server refuses to discard a copy that has been cut
+* over to (it is now the live database). Every mutating step requires `--yes` in
+* non-interactive use, and the CLI surfaces these staged semantics honestly.
 */
-/** Read and shallow-validate a built bundle's manifest. */
-function readBundleManifest(bundleDir) {
-	const manifestPath = path.join(bundleDir, "manifest.json");
-	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest.json in ${bundleDir}. Run \`rebase build\` first.`);
-	let manifest;
+async function pitrCommand(rawArgs) {
+	const { flags: args, positionals } = parseCloudArgs({
+		spec: {
+			"--target": String,
+			"--yes": Boolean
+		},
+		rawArgs,
+		commandWords: 3,
+		command: "cloud db pitr",
+		maxPositionals: 1
+	});
+	const action = positionals[0] || "status";
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
 	try {
-		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-	} catch (err) {
-		throw new Error(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	if (typeof manifest.bundleFormat !== "number" || !manifest.runtime?.range) throw new Error(`${manifestPath} is not a valid bundle manifest.`);
-	return manifest;
-}
-/**
-* Tar a built bundle into a gzipped archive.
-*
-* `node_modules` is excluded on purpose: the bundle ships a `package.json`, and
-* the managed runtime installs the declared dependencies at boot. Uploading an
-* installed `node_modules` would bloat the archive and could carry a
-* platform-specific build that will not run on the runtime image.
-*/
-function packBundle(bundleDir, outPath) {
-	return new Promise((resolve, reject) => {
-		const child = spawn("tar", [
-			"-czf",
-			outPath,
-			"--no-xattrs",
-			"--exclude",
-			"node_modules",
-			"-C",
-			bundleDir,
-			"."
-		], {
-			stdio: "inherit",
-			env: {
-				...process.env,
-				COPYFILE_DISABLE: "1"
-			}
-		});
-		child.on("error", reject);
-		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`tar exited ${code}`)));
+		if (action === "status") {
+			const res = await client.functions.invoke("backup", void 0, {
+				method: "GET",
+				path: `pitr-status/${projectId}`
+			});
+			emit(() => {
+				console.log("");
+				console.log(chalk.bold(`  ⏱  Point-in-time recovery — project ${projectRef}`));
+				console.log("");
+				keyValues([
+					["Available", res.available ? chalk.green("yes") : chalk.yellow("no")],
+					["First recoverable", res.firstRecoverabilityPoint ?? void 0],
+					["Last backup", res.lastSuccessfulBackup ?? void 0],
+					["Message", res.message ?? void 0]
+				]);
+				console.log("");
+			}, res);
+			return;
+		}
+		if (action === "restore") {
+			const target = args["--target"];
+			if (!target) fail("Usage: rebase cloud db pitr restore --target <ISO timestamp>", void 0, "usage");
+			await confirmDestructive({
+				yes: Boolean(args["--yes"]),
+				prompt: `Stage a point-in-time recovery of project ${projectRef} at ${target}? (stages a copy; does not repoint your app)`
+			});
+			const res = await client.functions.invoke("backup", {
+				projectId,
+				targetTime: target,
+				acknowledgeNoCutover: true
+			}, { path: "pitr-restore" });
+			emit(() => {
+				console.log("");
+				console.log(chalk.yellow(`  ⏳ ${String(res.message ?? "Recovery staged.")}`));
+				console.log(chalk.gray("  Watch progress with `rebase cloud db pitr status`, then `rebase cloud db pitr cutover --yes`."));
+				console.log("");
+			}, res);
+			return;
+		}
+		if (action === "cutover") {
+			await confirmDestructive({
+				yes: Boolean(args["--yes"]),
+				prompt: `Cut project ${projectRef} over to the staged recovery? This repoints and restarts your application.`
+			});
+			const res = await client.functions.invoke("backup", { projectId }, { path: "pitr-restore-cutover" });
+			emit(() => {
+				console.log("");
+				console.log(String(res.message ?? "Cutover requested."));
+				console.log("");
+			}, res);
+			return;
+		}
+		if (action === "discard") {
+			await confirmDestructive({
+				yes: Boolean(args["--yes"]),
+				prompt: `Discard the staged recovery for project ${projectRef}? This deletes the staged copy and its storage.`
+			});
+			const res = await client.functions.invoke("backup", { projectId }, { path: "pitr-restore-discard" });
+			emit(() => success(String(res.message ?? "Staged restore discarded.")), res);
+			return;
+		}
+		fail(`Unknown pitr command: ${action}`, "Try status | restore | cutover | discard.", "usage");
+	} catch (e) {
+		reportError(e, "PITR operation failed");
+	}
+}
+function printDbHelp() {
+	emitHelp("db", [
+		"list",
+		"create",
+		"info",
+		"test",
+		"backup",
+		"pitr"
+	], () => {
+		console.log(`
+${chalk.bold("rebase cloud db")} — Database & backups
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}                      List databases attached to the project
+  ${chalk.blue.bold("create")}                    Attach a managed or bring-your-own database
+  ${chalk.blue.bold("info")} ${chalk.gray("[--reveal]")}           Connection details ${chalk.gray("(password only with --reveal)")}
+  ${chalk.blue.bold("test")}                      Test database connectivity
+  ${chalk.blue.bold("backup list")}               List backups
+  ${chalk.blue.bold("backup create")}             Create a manual backup
+  ${chalk.blue.bold("backup restore")} ${chalk.gray("<file>")}     Restore a backup
+  ${chalk.blue.bold("backup status")}             Automated-backup health
+  ${chalk.blue.bold("backup download")} ${chalk.gray("<file>")}    Signed URL for a backup
+  ${chalk.blue.bold("pitr status")}               Point-in-time recovery window
+  ${chalk.blue.bold("pitr restore")} ${chalk.gray("--target <ISO>")} Stage a recovery ${chalk.gray("(does not repoint)")}
+  ${chalk.blue.bold("pitr cutover")} ${chalk.gray("-y")}           Repoint the app at the staged recovery
+  ${chalk.blue.bold("pitr discard")} ${chalk.gray("-y")}           Delete a staged recovery
+
+${chalk.green.bold("Options")}
+  ${chalk.blue("--project, -p")}             Project slug ${chalk.gray("(defaults to the linked project)")}
+  ${chalk.blue("--reveal")}                  Include the DB password ${chalk.gray("(info)")}
+  ${chalk.blue("--type")}                    managed | byodb ${chalk.gray("(create)")}
+  ${chalk.blue("--connection-string")}       External DB URL ${chalk.gray("(byodb)")}
+  ${chalk.blue("--json")}                    Machine-readable output
+`);
 	});
 }
+//#endregion
+//#region src/commands/cloud/projects.ts
 /**
-* Assemble the deploy-trigger body for a bundle deploy.
-*
-* The manifest travels with the trigger so the control plane can validate intake
-* without unpacking the uploaded archive first — a rejection (native deps, no
-* matching runtime) is then a fast, cheap answer.
+* `rebase cloud projects` — list / create / info / delete.
 */
-function bundleDeployBody(input) {
-	return {
-		projectId: input.projectId,
-		bundleId: input.bundleId,
-		bundleManifest: input.manifest,
-		app: input.app ?? input.manifest.app ?? "backend",
-		client: "cli",
-		frameworkVersion: input.manifest.runtime?.builtAgainst,
-		...input.declaredApps?.length ? { declaredApps: input.declaredApps } : {},
-		...input.message ? { message: input.message } : {}
-	};
+async function listProjects(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	const org = getContextOrg(url);
+	try {
+		const [projects, baseDomain] = await Promise.all([client.data.collection("projects").find({
+			where: org ? { organization: ["==", org] } : void 0,
+			orderBy: ["name", "asc"],
+			limit: 100
+		}).then((res) => res.data), fetchTenantBaseDomain(client, url)]);
+		const linkedId = readLink()?.projectId;
+		emit(() => {
+			console.log("");
+			console.log(chalk.bold("  📦 Projects") + (org ? chalk.gray(`  (org ${org})`) : ""));
+			console.log("");
+			if (projects.length === 0) {
+				console.log(chalk.gray("  No projects yet. Create one with `rebase cloud projects create`."));
+				console.log("");
+				return;
+			}
+			for (const p of projects) {
+				const marker = String(p.id) === linkedId ? chalk.green(" ●") : "  ";
+				console.log(`${marker}${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.subdomain ?? p.id}]`)} ${colorStatus(p.status)}`);
+				console.log(`    ${chalk.gray(projectHost(p, baseDomain) ?? "—")}${p.provider ? chalk.gray(`  ·  ${p.provider}`) : ""}`);
+			}
+			console.log("");
+		}, {
+			org: org ?? null,
+			projects: projects.map((p) => ({
+				id: String(p.id),
+				name: p.name ?? null,
+				slug: p.subdomain ?? null,
+				host: projectHost(p, baseDomain) ?? null,
+				status: p.status ?? null,
+				provider: p.provider ?? null,
+				linked: String(p.id) === linkedId
+			}))
+		});
+	} catch (e) {
+		reportError(e, "Failed to list projects");
+	}
 }
 /**
-* The apps a project manifest declares.
+* Default region per provider. Required on create; the rest is dialled.
 *
-* A deploy only ever ships ONE app's bundle, so the trigger alone could never
-* tell the platform that the repository also contains a web frontend and an
-* admin panel — and the Apps page, whose whole job is to show the set, listed a
-* single entry called "backend". Sending the declared set fixes that without
-* pretending the others are deployed: the platform registers them, and their
-* status says what is actually true.
+* There used to be a `vmSize` here too — `e2-small`, `cx21` — naming a machine
+* on a price list this platform does not buy from. The column was dropped on
+* 2026-08-20 and this went on sending it, which a control plane can only ignore
+* or refuse. What a project reserves is a set of dials now, and a project that
+* sets none takes the platform default.
 */
-function declaredAppsFrom(manifest) {
-	const apps = manifest?.apps;
-	if (!apps || typeof apps !== "object") return [];
-	return Object.entries(apps).filter(([name]) => name.trim().length > 0).map(([name, value]) => ({
-		name,
-		type: value?.type === "backend" ? "backend" : "static"
-	}));
-}
-/** Upload a bundle archive; returns the control-plane bundle id. */
-async function uploadBundle(url, token, projectId, tarPath) {
-	const bytes = fs.readFileSync(tarPath);
-	const res = await fetch(`${url}/api/functions/deploy/bundle/upload?projectId=${encodeURIComponent(projectId)}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${token}`,
-			"Content-Type": "application/gzip"
-		},
-		body: bytes
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new Error(`Bundle upload failed (${res.status}): ${body || res.statusText}`);
+function providerDefaults(provider) {
+	switch (provider) {
+		case "gcp": return { region: "europe-west1" };
+		case "aws": return { region: "us-east-1" };
+		default: return { region: "nbg1" };
 	}
-	const data = await res.json();
-	if (!data.bundleId) throw new Error("Bundle upload endpoint did not return a bundle id.");
-	return data.bundleId;
 }
-//#endregion
-//#region src/commands/cloud/deploy.ts
 /**
-* `rebase cloud deploy` and `rebase cloud logs`.
+* Where this project says it runs.
 *
-* `deploy` triggers the control-plane `deploy` function, then tails the build
-* logs from the deployment record until it succeeds or fails. `logs` shows the
-* latest build log, or runtime logs with `--runtime`.
+* `provider`/`region` are a *request*: no code downstream reads them to pick a
+* deploy target — that comes from the project's cluster record or the ambient
+* in-cluster context (saas/backend/src/k8s/resolve.ts). So a wrong value here is
+* never contradicted by a failure; it just sits in the record. The CLI used to
+* default to `hetzner`/`nbg1` unconditionally, which is how projects running on
+* our GKE cluster came to describe themselves as Hetzner in the console — and
+* `provider` also decides which substrate's rules a project's dials are clamped
+* to — Autopilot's 250m floor and 1:1-6.5:1 band do not apply on Hetzner or EKS
+* — so a wrong value here resizes pods, it is not a cosmetic slip.
 *
-* There are three deploys behind the one verb, and which one runs depends on the
-* flags: `--bundle` builds and uploads a managed bundle, `--source .` uploads
-* this directory as a build context, and the bare form uploads nothing and asks
-* the control plane to rebuild what it already holds. That last one is the
-* dangerous one — see `planBareDeploy`.
+* The control plane already publishes the infrastructure that actually exists,
+* and the console's create wizard reads it. Ask the same question here.
+*
+* Exported for tests: the decision is pure, so it can be pinned without a
+* control plane. The fetching and the exit live in `resolveRequestedTarget`.
+*
+* @param requested `--provider`, if the caller named one. An explicit flag wins:
+*   it is the caller stating intent, and `deploy` corrects the record anyway.
+* @param targets What the control plane says exists, or `undefined` when it
+*   cannot say — an older deployment with no `platform-config`, or a failed
+*   request. That is different from an empty list, which is a control plane
+*   stating it has no infrastructure at all.
+* @returns the target to record, or `null` when the control plane answered that
+*   there is none.
 */
-var POLL_INTERVAL_MS = 1500;
-var POLL_TIMEOUT_MS = 900 * 1e3;
-var MAX_SOURCE_UPLOAD_BYTES = 100 * 1024 * 1024;
-function sleep(ms) {
-	return new Promise((r) => setTimeout(r, ms));
-}
-function run(cmd, cmdArgs, cwd, env) {
-	return new Promise((resolve, reject) => {
-		const child = spawn(cmd, cmdArgs, {
-			cwd,
-			env: env ? {
-				...process.env,
-				...env
-			} : void 0,
-			stdio: [
-				"ignore",
-				"ignore",
-				"pipe"
-			]
-		});
-		let stderr = "";
-		child.stderr.on("data", (d) => stderr += d.toString());
-		child.on("error", reject);
-		child.on("close", (code) => code === 0 ? resolve() : reject(new Error(stderr || `${cmd} exited ${code}`)));
+function chooseRequestedTarget(requested, targets) {
+	if (requested) return {
+		provider: requested,
+		region: void 0
+	};
+	if (!targets) return {
+		provider: "hetzner",
+		region: void 0
+	};
+	if (targets.length === 0) return null;
+	const [target] = targets;
+	return {
+		provider: target.provider,
+		region: target.region?.trim() || void 0
+	};
+}
+async function resolveRequestedTarget(client, url, requested) {
+	const chosen = chooseRequestedTarget(requested, await fetchDeployTargets(client, url));
+	if (!chosen) fail("This control plane has no deploy targets configured.", `Register a cluster, or pass ${chalk.bold("--provider")} and ${chalk.bold("--region")} to record one anyway.`, "no_deploy_targets");
+	return chosen;
+}
+/** The flags `rebase cloud projects create` takes. */
+var CREATE_PROJECT_FLAGS = {
+	"--name": String,
+	"--subdomain": String,
+	"--repo": String,
+	"--branch": String,
+	"--provider": String,
+	"--region": String,
+	"--org": String,
+	"--link": Boolean,
+	/**
+	* Which database the new project gets — `managed` (the default), `byodb`,
+	* or `none`.
+	*
+	* A default rather than a prompt, and `managed` rather than `none`, because
+	* the state this removes is not a missing convenience: a project with no
+	* database is written `status: "provisioning"` and can never deploy, and
+	* nothing in that word says a second command is owed. Attaching one here
+	* means the two-command sequence that every project needs is one command,
+	* and `--db none` is there for the case that genuinely wants to decide later.
+	*
+	* Distinct from `--db-mode`/`--db-cpu` next to it, which are resource dials
+	* on a database that exists. This is whether there is one.
+	*/
+	"--db": String,
+	/** For `--db byodb`. Same spelling as `rebase cloud db create` uses. */
+	"--connection-string": String,
+	"-n": "--name",
+	"--cpu": String,
+	"--memory": String,
+	"--replicas": String,
+	"--spot": String,
+	"--scale-to-zero": String,
+	"--db-mode": String,
+	"--db-instances": String,
+	"--db-cpu": String,
+	"--db-memory": String,
+	"--storage": String
+};
+async function createProject(rawArgs) {
+	const { flags: args } = parseCloudArgs({
+		spec: CREATE_PROJECT_FLAGS,
+		rawArgs,
+		commandWords: 3,
+		command: "cloud projects create",
+		maxPositionals: 0
+	});
+	const { client, url } = await requireClient(rawArgs);
+	const org = args["--org"] || getContextOrg(url);
+	if (!org) fail("No organization selected.", `Pass ${chalk.bold("--org <id>")} or run ${chalk.bold("rebase cloud use")}.`, "no_org");
+	const prompts = [];
+	if (!args["--name"]) prompts.push({
+		type: "input",
+		name: "name",
+		message: "Project name:"
 	});
+	if (!args["--subdomain"]) prompts.push({
+		type: "input",
+		name: "subdomain",
+		message: "Subdomain:"
+	});
+	const a = prompts.length && process.stdin.isTTY ? await inquirer.prompt(prompts) : {};
+	const name = (args["--name"] || a.name || "").trim();
+	const subdomain = (args["--subdomain"] || a.subdomain || "").trim().toLowerCase();
+	const gitRepoUrl = (args["--repo"] || a.repo || "").trim();
+	const gitBranch = (args["--branch"] || a.branch || "main").trim();
+	const target = await resolveRequestedTarget(client, url, (args["--provider"] || a.provider)?.trim() || void 0);
+	const provider = target.provider;
+	const defaults = providerDefaults(provider);
+	const region = (args["--region"] || target.region || defaults.region).trim();
+	const dials = buildDialPatch(rawArgs, { requireOne: false });
+	if (dials.error) fail(dials.error, void 0, "bad_request");
+	const dbChoice = (args["--db"] ?? "managed").trim().toLowerCase();
+	if (![
+		"managed",
+		"byodb",
+		"none"
+	].includes(dbChoice)) fail(`--db must be managed, byodb or none (got "${args["--db"]}").`, void 0, "bad_request");
+	if (dbChoice === "byodb" && !args["--connection-string"]) fail("--db byodb needs the database to point at.", `Pass ${chalk.bold("--connection-string <url>")}.`, "input_required");
+	if (!name || !subdomain) fail("Name and subdomain are required.", `Pass ${chalk.bold("--name <name>")} and ${chalk.bold("--subdomain <slug>")}.`, "input_required");
+	try {
+		const check = await client.functions.invoke("check-subdomain", { subdomain });
+		if (!check.available) fail(`Subdomain "${subdomain}" is not available${check.reason ? ` (${check.reason})` : ""}.`, void 0, "subdomain_unavailable");
+	} catch {}
+	try {
+		const user = await client.auth.getUser();
+		if (!user) fail("Session is no longer valid.", "Run `rebase cloud login` again.", "session_invalid");
+		const created = await client.data.collection("projects").create({
+			name,
+			subdomain,
+			gitRepoUrl,
+			gitBranch,
+			provider,
+			region,
+			...dials.patch,
+			organization: org,
+			createdById: user.uid,
+			status: "provisioning"
+		});
+		const host = projectHost(created, await fetchTenantBaseDomain(client, url));
+		const linked = Boolean(args["--link"]);
+		if (linked) writeLink({
+			url,
+			projectId: String(created.id),
+			slug: created.subdomain,
+			projectName: name,
+			orgId: String(org)
+		});
+		const database = await attachRequestedDatabase(client, {
+			projectId: String(created.id),
+			choice: dbChoice,
+			connectionString: args["--connection-string"],
+			projectRef: created.subdomain ?? String(created.id)
+		});
+		if (database.warning) warn(database.warning[0], database.warning[1]);
+		success(`Created project ${chalk.bold(name)}`);
+		emit(() => {
+			keyValues([
+				["Slug", String(created.subdomain ?? "")],
+				["URL", host],
+				["Provider", provider],
+				["Branch", gitBranch],
+				["Database", database.line]
+			]);
+			if (linked) note(chalk.gray("Linked this directory to the new project."));
+			noteBlank();
+			for (const line of database.notes) note(chalk.gray(line));
+			note(chalk.gray(`Deploy it with:  ${chalk.bold(`rebase cloud deploy --project ${created.subdomain ?? created.id}`)}`));
+			noteBlank();
+		}, {
+			success: true,
+			id: String(created.id),
+			name,
+			slug: created.subdomain ?? null,
+			host: host ?? null,
+			provider,
+			region,
+			dials: dials.patch,
+			branch: gitBranch,
+			org: String(org),
+			linked,
+			database: database.payload
+		});
+	} catch (e) {
+		reportError(e, "Failed to create project");
+	}
 }
 /**
-* Package `sourceDir` into a gzipped tarball, honoring `.gitignore`/`.rebaseignore`
-* and always excluding `.git` and `node_modules`. Returns the temp archive path.
+* Attach the database `--db` asked for, and describe what happened.
+*
+* Never throws. The project already exists by the time this runs, so a failure
+* here is a *partial* success and has to be reported as one — with the exact
+* command that finishes the job. Turning it into an exception would report the
+* whole `projects create` as failed and leave a real project behind, which is
+* the worst of both readings.
 */
-async function createSourceTarball(sourceDir) {
-	const dir = path.resolve(sourceDir);
-	if (!fs.existsSync(dir)) fail(`Source directory not found: ${dir}`);
-	const tarPath = path.join(os.tmpdir(), `rebase-src-${Date.now()}.tar.gz`);
-	const tarArgs = [
-		"-czf",
-		tarPath,
-		"--exclude=.git",
-		"--exclude=node_modules"
-	];
-	for (const ignore of [".gitignore", ".rebaseignore"]) if (fs.existsSync(path.join(dir, ignore))) tarArgs.push(`--exclude-from=${ignore}`);
-	tarArgs.push(".");
+async function attachRequestedDatabase(client, input) {
+	if (input.choice === "none") return {
+		line: chalk.yellow("none"),
+		notes: ["No database attached (--db none). This project cannot deploy until one is:", "  rebase cloud db create --type managed"],
+		payload: {
+			attached: false,
+			type: null,
+			reason: "requested_none"
+		}
+	};
 	try {
-		await run("tar", tarArgs, dir, { COPYFILE_DISABLE: "1" });
+		const row = await attachDatabaseRow(client, {
+			projectId: input.projectId,
+			type: input.choice,
+			connectionString: input.connectionString
+		});
+		return {
+			line: input.choice === "managed" ? `managed ${chalk.gray("· created at the first deploy")}` : `byodb ${chalk.gray("· not tested (`rebase cloud db test`)")}`,
+			notes: [],
+			payload: {
+				attached: true,
+				id: String(row.id),
+				type: input.choice,
+				materializedAt: input.choice === "managed" ? "first_deploy" : "now"
+			}
+		};
 	} catch (e) {
-		fail(`Failed to package source: ${e instanceof Error ? e.message : String(e)}`);
+		const message = e instanceof Error ? e.message : String(e);
+		return {
+			line: chalk.red("not attached"),
+			notes: [],
+			warning: [`The project was created, but attaching its ${input.choice} database failed: ${message}`, `Finish it with:  rebase cloud db create --type ${input.choice} --project ${input.projectRef}`],
+			payload: {
+				attached: false,
+				type: input.choice,
+				reason: "attach_failed",
+				error: message
+			}
+		};
 	}
-	return tarPath;
 }
 /**
-* The `@rebasepro/*` version this source directory actually resolves.
-*
-* Recorded on the deployment so a row in Deployment History says which
-* framework build shipped. Nothing else on the platform knows: an app that
-* links the framework locally pins it at package time, and a silent bump is
-* invisible afterwards — it has already cost one debugging session.
+* Which project `projects info` / `projects delete` acts on.
 *
-* `@rebasepro/server` first, because that is what the deployed backend runs;
-* `@rebasepro/client` is the fallback for a frontend-only bundle. Resolution is
-* a plain walk up from the source directory rather than `require.resolve`,
-* which would answer for the CLI's own install tree instead of the app's.
+* The id is optional — omitted, it falls back to `--project` or the link file —
+* and the dispatcher used to read it off `positionals()`, which skips only
+* LEADING `-` tokens and declares only the global cloud flags. So an undeclared
+* flag written after the action became the id: `rebase cloud projects delete
+* --force` looked up a project named "--force" and reported it missing, rather
+* than saying there is no such flag. Benign next to the deletes and writes the
+* rest of this family aimed at the wrong resource, but the same mistake, and
+* `positionals()` has no spec with which to do better — the handler's own
+* module does.
 *
-* Best effort by construction: a version that cannot be read is simply not
-* recorded. Nothing about a deploy should fail over a bookkeeping string.
+* Exported so its tests drive the real parser rather than a copy of it.
 */
-function resolveFrameworkVersion(sourceDir) {
-	let dir = path.resolve(sourceDir);
-	for (;;) {
-		for (const pkg of ["@rebasepro/server", "@rebasepro/client"]) try {
-			const manifest = path.join(dir, "node_modules", ...pkg.split("/"), "package.json");
-			const version = JSON.parse(fs.readFileSync(manifest, "utf8")).version;
-			if (typeof version === "string" && version.trim() !== "") return version.trim();
-		} catch {}
-		const parent = path.dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
+function resolveProjectArg(rawArgs, action) {
+	const { positionals } = parseCloudArgs({
+		spec: {},
+		rawArgs,
+		commandWords: 3,
+		command: `cloud projects ${action}`,
+		maxPositionals: 1
+	});
+	return positionals[0] || requireProjectRef(rawArgs);
 }
 /**
-* A progress line for a human — dropped entirely in JSON mode.
+* A project's database capacity, or null.
 *
-* Progress is not a result. In JSON mode stdout carries the one result value
-* and nothing else, so every unguarded `console.log` on a deploy path was a
-* line printed in front of the JSON, breaking the parser meant to read it.
-* Warnings are the other half of this rule and go the other way: they are
-* `warn`, which prints in every mode, to stderr. See `warn` in `context.ts`.
+* Swallows every failure on purpose. This decorates `status`; a control plane
+* that predates the `capacity` function 404s here, and an older CLI talking to a
+* newer one must still print the project. Losing the capacity line is a missing
+* nicety — failing the whole command over it would be the bug.
 */
-function progress(line) {
-	if (!isJsonMode()) console.log(line);
+async function fetchCapacity(client, projectId) {
+	try {
+		return (await client.functions.invoke("capacity", void 0, {
+			method: "GET",
+			path: projectId
+		}))?.database ?? null;
+	} catch {
+		return null;
+	}
 }
-/** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
-async function uploadSource(url, token, projectId, tarPath) {
-	const bytes = fs.readFileSync(tarPath);
-	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
-	if (bytes.length > MAX_SOURCE_UPLOAD_BYTES) fail(`Source context is ${sizeMb} MB — the upload cap is ${Math.round(MAX_SOURCE_UPLOAD_BYTES / 1024 / 1024)} MB.`, "Trim the build context: exclude sourcemaps (*.map), build output and large assets via .rebaseignore or .gitignore.");
-	progress(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
-	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${token}`,
-			"Content-Type": "application/gzip"
-		},
-		body: bytes
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		fail(`Source upload failed (${res.status}): ${body || res.statusText}`);
-	}
-	const data = await res.json();
-	if (!data.source) fail("Upload endpoint did not return a source reference.");
-	return data.source;
-}
-/**
-* Build, upload and deploy a project as a managed bundle.
-*
-* Builds the backend app into `dist-bundle` (unless one is pointed at with
-* `--bundle-dir`), packs it without `node_modules`, uploads it, and triggers a
-* deploy carrying the manifest so the control plane can validate intake fast.
-*/
-async function deployBundle(opts) {
-	const projectRoot = requireProjectRoot();
-	let bundleDir = opts.bundleDir ? path.resolve(process.cwd(), opts.bundleDir) : path.join(projectRoot, "dist-bundle");
-	if (!opts.bundleDir) {
-		const loaded = loadManifest(projectRoot);
-		let target;
-		try {
-			target = selectDeployApp(loaded.manifest, opts.appName);
-		} catch (err) {
-			fail(err instanceof Error ? err.message : String(err));
-			return;
-		}
-		if (target.app.type === "static") {
-			progress(chalk.gray(`  Building static app "${target.name}"...`));
-			const staticDir = await buildAssetApp(projectRoot, target.name, target.app, loaded.manifest.rebase);
-			if (!staticDir) {
-				fail(`App "${target.name}" produced no bundle.`, "A static app needs both a `build` command and an `output` directory in rebase.json.");
-				return;
-			}
-			bundleDir = staticDir;
-			await uploadAndTrigger({
-				...opts,
-				bundleDir,
-				appName: target.name
-			});
-			return;
-		}
-		progress(chalk.gray("  Building bundle..."));
-		const backend = {
-			name: target.name,
-			app: target.app
-		};
-		const { graph: resourceGraph, issues: resourceIssues } = await deriveResourceGraph({ configDir: path.join(projectRoot, resolveBackendPaths(backend.app, projectRoot).config) });
-		if (resourceIssues.length > 0) throw new Error(`${resourceIssues.length} problem(s) in the declared resources:\n` + resourceIssues.map((i) => `  ${i.path}  ${i.message}`).join("\n"));
-		bundleDir = (await buildBundle({
-			projectRoot,
-			appName: backend.name,
-			app: backend.app,
-			runtimeRange: loaded.manifest.rebase,
-			resources: resourceGraph,
-			skipTypeCheck: opts.skipTypeCheck,
-			log: (m) => progress(chalk.gray(m))
-		})).outDir;
-		try {
-			const folded = await foldFrontendIntoBundle({
-				projectRoot,
-				manifest: loaded.manifest,
-				bundleDir,
-				log: (m) => progress(m)
-			});
-			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
-		} catch (err) {
-			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
-		}
-	}
-	await uploadAndTrigger({
-		...opts,
-		bundleDir
-	});
-}
-/**
-* Pack a built bundle, upload it, and trigger the deploy.
-*
-* Shared by every managed deploy, whichever kind of app produced the bundle: a
-* backend and a static app differ in what is built and in the `kind` their
-* manifest carries, and in nothing after that. Keeping one tail is what makes
-* that true rather than nearly true — the folding step was once missing from
-* one of two callers producing the same artifact, and the deploy shipped a
-* bundle with no site in it.
-*/
-async function uploadAndTrigger(opts) {
-	const { client, url, projectId, projectRef, bundleDir } = opts;
-	const manifest = readBundleManifest(bundleDir);
-	if (manifest.hooks?.native) {
-		const names = (manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
-		fail(`This bundle depends on native modules${names ? ` (${names})` : ""}, which the managed runtime cannot run.`, "Remove the native dependency, or deploy on the custom runtime.");
-	}
-	const tarPath = path.join(os.tmpdir(), `rebase-bundle-${Date.now()}.tar.gz`);
-	const token = client.auth.getSession()?.accessToken;
-	if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
-	let bundleId;
+async function projectInfo(rawArgs, projectRef) {
+	const { client, url } = await requireClient(rawArgs);
 	try {
-		await packBundle(bundleDir, tarPath);
-		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
-		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
-		bundleId = await uploadBundle(url, token, projectId, tarPath);
+		const projectId = await resolveProjectRef(projectRef, client);
+		const p = await client.data.collection("projects").findById(projectId);
+		if (!p) fail(`Project ${projectRef} not found.`, void 0, "project_not_found");
+		const [db, lastDeploy, baseDomain, capacity] = await Promise.all([
+			firstRow(client, "databases", projectId),
+			latestDeployment(client, projectId),
+			fetchTenantBaseDomain(client, url),
+			fetchCapacity(client, projectId)
+		]);
+		emit(() => {
+			console.log("");
+			console.log(`  ${chalk.bold(p.name ?? "(unnamed)")} ${chalk.gray(`[${p.subdomain ?? p.id}]`)} ${colorStatus(p.status)}`);
+			console.log("");
+			keyValues([
+				["Subdomain", projectHost(p, baseDomain)],
+				["Custom domain", p.customDomain],
+				["Repository", p.gitRepoUrl],
+				["Branch", p.gitBranch],
+				["Provider", p.provider],
+				["Region", p.region],
+				["Organization", p.organization !== void 0 ? String(p.organization) : void 0],
+				["Database", db ? `${db.type} (${colorStatus(db.connectionStatus)})` : "none"],
+				["Storage", capacity && capacity.limitMb > 0 ? `${capacity.usedMb} MB / ${capacity.limitMb} MB${capacity.usedFraction !== null ? ` (${(capacity.usedFraction * 100).toFixed(0)}%)` : ""}` : void 0],
+				["Last deploy", lastDeploy ? `${colorStatus(lastDeploy.status)} · ${fmtDate(lastDeploy.createdAt)}` : "never"]
+			]);
+			if (capacity && capacity.state !== "ok") {
+				console.log("");
+				console.log(capacity.state === "locked" ? `  ${chalk.red.bold("✗ Database locked — over its storage limit")}` : `  ${chalk.yellow.bold("⚠ Database approaching its storage limit")}`);
+				console.log(`  ${chalk.gray(capacity.detail)}`);
+			}
+			console.log("");
+		}, {
+			id: String(p.id),
+			name: p.name ?? null,
+			slug: p.subdomain ?? null,
+			host: projectHost(p, baseDomain) ?? null,
+			customDomain: p.customDomain ?? null,
+			repository: p.gitRepoUrl ?? null,
+			branch: p.gitBranch ?? null,
+			provider: p.provider ?? null,
+			region: p.region ?? null,
+			status: p.status ?? null,
+			org: p.organization !== void 0 ? String(p.organization) : null,
+			database: db ? {
+				type: db.type ?? null,
+				connectionStatus: db.connectionStatus ?? null,
+				capacity: capacity ?? null
+			} : null,
+			lastDeploy: lastDeploy ? {
+				id: String(lastDeploy.id),
+				status: lastDeploy.status ?? null,
+				createdAt: lastDeploy.createdAt ?? null
+			} : null
+		});
 	} catch (e) {
-		fail(e instanceof Error ? e.message : String(e));
-		return;
-	} finally {
-		fs.rmSync(tarPath, { force: true });
-	}
-	if (!isJsonMode()) {
-		console.log("");
-		console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+		reportError(e, "Failed to load project");
 	}
-	let declaredApps = [];
-	try {
-		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
-	} catch {}
-	const body = bundleDeployBody({
-		projectId,
-		bundleId,
-		manifest,
-		app: opts.appName,
-		message: opts.message,
-		declaredApps
+}
+async function deleteProject(rawArgs, projectRef) {
+	const { flags: args } = parseCloudArgs({
+		spec: {},
+		rawArgs,
+		commandWords: 3,
+		command: "cloud projects delete",
+		maxPositionals: 1
+	});
+	const { client } = await requireClient(rawArgs);
+	const projectId = await resolveProjectRef(projectRef, client);
+	const p = await client.data.collection("projects").findById(projectId).catch(() => void 0);
+	if (!p) fail(`Project ${projectRef} not found.`, void 0, "project_not_found");
+	await confirmDestructive({
+		yes: Boolean(args["--yes"]),
+		prompt: `Permanently delete project "${p.name ?? projectRef}" (${p.subdomain ?? projectRef})? This tears down its deployment.`
 	});
 	try {
-		const res = await client.functions.invoke("deploy", body);
-		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
-		if (isJsonMode()) printJson({
+		await client.data.collection("projects").delete(projectId);
+		success(`Deleted project ${chalk.bold(p.name ?? projectId)}`);
+		emit(() => {}, {
 			success: true,
-			deploymentId: String(res.deployment.id),
-			managed: res.managed === true
+			id: projectId,
+			name: p.name ?? null,
+			slug: p.subdomain ?? null
 		});
-		else {
-			console.log(chalk.green(`  ✓ Managed deploy started (deployment ${res.deployment.id}).`));
-			console.log(chalk.gray("    Track it with `rebase cloud logs` or in the console."));
-		}
 	} catch (e) {
-		reportError(e, "Managed deploy failed to start");
+		reportError(e, "Failed to delete project");
 	}
 }
-function pick(row, ...keys) {
-	for (const key of keys) {
-		const raw = row?.[key];
-		if (typeof raw === "string" && raw.trim() !== "") return raw.trim();
-	}
+async function firstRow(client, collection, projectId) {
+	return (await client.data.collection(collection).find({
+		where: { project: ["==", projectId] },
+		limit: 1
+	})).data[0];
 }
-/** Rough age of a timestamp, for "…uploaded 6d ago". Undefined if unreadable. */
-function timeAgo(value, now) {
-	if (value === void 0) return void 0;
-	const then = value instanceof Date ? value.getTime() : new Date(value).getTime();
-	if (Number.isNaN(then)) return void 0;
-	const ms = now.getTime() - then;
-	if (ms < 0) return void 0;
-	const minutes = Math.floor(ms / 6e4);
-	if (minutes < 1) return "just now";
-	if (minutes < 60) return `${minutes}m ago`;
-	const hours = Math.floor(minutes / 60);
-	if (hours < 24) return `${hours}h ago`;
-	return `${Math.floor(hours / 24)}d ago`;
+async function latestDeployment(client, projectId) {
+	return (await client.data.collection("deployments").find({
+		where: { project: ["==", projectId] },
+		orderBy: ["createdAt", "desc"],
+		limit: 1
+	})).data[0];
+}
+function fmtDate(value) {
+	if (!value) return "—";
+	const d = new Date(value);
+	return isNaN(d.getTime()) ? value : d.toLocaleString();
 }
+//#endregion
+//#region src/commands/cloud/bundle-deploy.ts
 /**
-* Whether this project runs on the managed runtime.
+* Deploying a project as a managed **bundle** rather than a source build.
 *
-* `runtimeMode` on the project row is the authority — the control plane writes
-* it. The bundle-id fallback covers a control plane that does not return the
-* field: a successful deploy that served a bundle only happens on the managed
-* path.
-*/
-function isManagedProject(project, latest) {
-	if (pick(project, "runtimeMode", "runtime_mode") === "managed") return true;
-	return latest?.status === "success" && pick(latest, "bundleId", "bundle_id") !== void 0;
-}
-/** What a `deploy` with nothing attached will build, in the words to print. */
-function planBareDeploy(project, latest, now) {
-	const projectRow = project;
-	const deploymentRow = latest;
-	const managed = isManagedProject(project, latest);
-	const repo = pick(projectRow, "gitRepoUrl", "git_repo_url");
-	if (repo) {
-		const branch = pick(projectRow, "gitBranch", "git_branch");
-		return {
-			managed,
-			source: "git",
-			lines: [`Building from git: ${repo}${branch ? ` (${branch})` : ""}.`]
-		};
-	}
-	if (pick(deploymentRow, "sourceRef", "source_ref")) {
-		const age = timeAgo(latest?.createdAt ?? latest?.created_at, now);
-		return {
-			managed,
-			source: "snapshot",
-			lines: [`Rebuilding the stored source archive${latest?.id !== void 0 ? ` from deployment ${latest.id}` : ""}${age ? `, uploaded ${age}` : ""}.`, "This directory is NOT uploaded — pass `--source .` to build what is on disk."]
-		};
+* `rebase cloud deploy --bundle` builds the bundle, tars it, uploads it to the
+* control plane's bundle endpoint, and triggers a deploy carrying the bundle id
+* and its generated manifest. The control plane resolves a runtime from the
+* manifest's range and runs the platform image with this bundle — the managed
+* path. A project not in managed mode, or one whose bundle fails intake, is told
+* so by the control plane; this side just packages and hands it over.
+*
+* The pieces here are separated from the network calls so they can be tested: the
+* manifest read, the tar packaging, and the request body assembly are pure enough
+* to check without a control plane.
+*/
+/** Read and shallow-validate a built bundle's manifest. */
+function readBundleManifest(bundleDir) {
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest.json in ${bundleDir}. Run \`rebase build\` first.`);
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
-	return {
-		managed,
-		source: "none",
-		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
-	};
-}
-/** `code` of the warning below, and the field name it sets in the payload. */
-var EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
-/** The one sentence that says a source build undoes `runtimeMode: managed`. */
-function ejectWarning(projectRef) {
-	return {
-		code: EJECTS_MANAGED_RUNTIME,
-		message: `${projectRef} runs on the managed runtime — this build ejects it to a custom container.`,
-		hint: "Use `rebase cloud deploy --bundle` to stay on managed."
-	};
+	if (typeof manifest.bundleFormat !== "number" || !manifest.runtime?.range) throw new Error(`${manifestPath} is not a valid bundle manifest.`);
+	return manifest;
 }
 /**
-* Why a container-image deploy of a managed project is refused — or `undefined`
-* to let it through.
-*
-* Every path below this point builds a container image, and a successful one
-* sets `runtimeMode: "custom"` server-side. So the question is never "which flag
-* was used" but "did the caller ask to leave the managed runtime", and only
-* `--force` answers it.
+* Tar a built bundle into a gzipped archive.
 *
-* `--source` used to be read as answering it too, on the theory that uploading a
-* build context is self-evidently a deliberate eject. It is not: `--source`
-* picks *which source* gets built — this directory, rather than the stale
-* archive the control plane is holding — and the eject is a side effect of the
-* answer. That is exactly how a live project got flipped to `custom` by someone
-* whose actual intent was "deploy what I have here", and it is the same
-* ignorance the bare form is refused for. Same ignorance, same refusal.
+* `node_modules` is excluded on purpose: the bundle ships a `package.json`, and
+* the managed runtime installs the declared dependencies at boot. Uploading an
+* installed `node_modules` would bloat the archive and could carry a
+* platform-specific build that will not run on the runtime image.
 */
-function ejectRefusal(opts, projectRef) {
-	if (!opts.managed || opts.force) return void 0;
-	const eject = "To eject on purpose, add `--force`.";
-	if (opts.source) return {
-		message: `${projectRef} runs on the managed runtime, and \`--source\` builds a container image from this directory — which ejects it from managed. Picking a build method is not the same as asking to leave the runtime.`,
-		hint: `Deploy this directory to the managed runtime with \`rebase cloud deploy --bundle\`. ${eject}`,
-		code: "managed_project"
-	};
-	return {
-		message: `${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`,
-		hint: `Redeploy it with \`rebase cloud deploy --bundle\`. ${eject} \`--source . --force\` builds this directory; \`--force\` alone builds what the control plane holds.`,
-		code: "managed_project"
-	};
+function packBundle(bundleDir, outPath) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("tar", [
+			"-czf",
+			outPath,
+			"--no-xattrs",
+			"--exclude",
+			"node_modules",
+			"-C",
+			bundleDir,
+			"."
+		], {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				COPYFILE_DISABLE: "1"
+			}
+		});
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`tar exited ${code}`)));
+	});
 }
 /**
-* Which warnings a container-image deploy has earned.
-*
-* Pure, and separate from the printing, because the printing is what went
-* wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
-* the fact that a deploy ejects a managed project existed only as a side effect
-* of a TTY being attached. Deciding here, emitting once at the call site, means
-* the decision cannot be output-mode-dependent again.
+* Assemble the deploy-trigger body for a bundle deploy.
 *
-* The condition is just `managed`: anything reaching this point is a container
-* image build that `ejectRefusal` has already let through, and on a managed
-* project that is an eject however it was spelled. A caller who passed `--force`
-* knows — the warning is for the transcript and the payload, which is what
-* anyone reviewing the deploy afterwards actually reads.
+* The manifest travels with the trigger so the control plane can validate intake
+* without unpacking the uploaded archive first — a rejection (native deps, no
+* matching runtime) is then a fast, cheap answer.
 */
-function deployWarnings(opts, projectRef) {
-	return opts.managed ? [ejectWarning(projectRef)] : [];
-}
-/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
-function warningPayload(warnings) {
+function bundleDeployBody(input) {
 	return {
-		warnings: warnings.map((w) => ({
-			code: w.code,
-			message: w.message,
-			hint: w.hint ?? null
-		})),
-		ejectsManagedRuntime: warnings.some((w) => w.code === EJECTS_MANAGED_RUNTIME)
+		projectId: input.projectId,
+		bundleId: input.bundleId,
+		bundleManifest: input.manifest,
+		app: input.app ?? input.manifest.app ?? "backend",
+		client: "cli",
+		frameworkVersion: input.manifest.runtime?.builtAgainst,
+		...input.declaredApps?.length ? { declaredApps: input.declaredApps } : {},
+		...input.message ? { message: input.message } : {}
 	};
 }
 /**
-* Read the two rows the preflight needs.
+* The apps a project manifest declares.
 *
-* Best effort by construction: a preflight that cannot read is a preflight that
-* says nothing, never a deploy that fails. The managed refusal rides on the same
-* read, so an unreadable project falls through to the old behaviour rather than
-* blocking a deploy on a lookup.
+* A deploy only ever ships ONE app's bundle, so the trigger alone could never
+* tell the platform that the repository also contains a web frontend and an
+* admin panel — and the Apps page, whose whole job is to show the set, listed a
+* single entry called "backend". Sending the declared set fixes that without
+* pretending the others are deployed: the platform registers them, and their
+* status says what is actually true.
 */
-async function readDeployContext(client, projectId) {
-	try {
-		const [project, latest] = await Promise.all([client.data.collection("projects").findById(projectId), latestDeployment(client, projectId)]);
-		return {
-			project,
-			latest
-		};
-	} catch {
-		return {};
-	}
+function declaredAppsFrom(manifest) {
+	const apps = manifest?.apps;
+	if (!apps || typeof apps !== "object") return [];
+	return Object.entries(apps).filter(([name]) => name.trim().length > 0).map(([name, value]) => ({
+		name,
+		type: value?.type === "backend" ? "backend" : "static"
+	}));
 }
-/**
-* Whether this repository's backend declares the managed runtime.
-*
-* Deliberately quiet: a directory that is not a Rebase project, or whose
-* manifest does not parse, simply does not route this way — `rebase build` is
-* where a broken manifest gets reported, and a deploy refusing on one before it
-* has even said what it is doing would be the wrong place to find out.
-*/
-function declaresManagedRuntime(appName) {
-	try {
-		const projectRoot = findProjectRoot();
-		if (!projectRoot) return false;
-		const manifest = loadManifest(projectRoot).manifest;
-		if (appName) {
-			const app = manifest.apps[appName];
-			if (app?.type === "static") return true;
-			if (app?.type === "backend") return app.runtime === "managed";
-		}
-		const backend = findBackendApp(manifest);
-		if (!backend) return Object.keys(manifest.apps).length > 0;
-		return backend.app.runtime === "managed";
-	} catch {
-		return false;
+/** Upload a bundle archive; returns the control-plane bundle id. */
+async function uploadBundle(url, token, projectId, tarPath) {
+	const bytes = fs.readFileSync(tarPath);
+	const res = await fetch(`${url}/api/functions/deploy/bundle/upload?projectId=${encodeURIComponent(projectId)}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/gzip"
+		},
+		body: bytes
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Bundle upload failed (${res.status}): ${body || res.statusText}`);
 	}
+	const data = await res.json();
+	if (!data.bundleId) throw new Error("Bundle upload endpoint did not return a bundle id.");
+	return data.bundleId;
 }
+//#endregion
+//#region src/commands/cloud/deploy.ts
 /**
-* `rebase cloud deploy [app]` — its flags, and which app of this repository the
-* line named.
-*
-* Parsed through `parseCloudArgs` rather than `arg` directly, and the reason is
-* the positional. This command used to parse `rawArgs.slice(2)` permissively
-* and read `_[0]` as the app name — but `rawArgs` is the WHOLE `process.argv`,
-* so `_` opens with the command words themselves. `_[0]` was therefore the
-* literal string `"cloud"` on every run, which then went to `selectDeployApp`
-* and came back as:
-*
-*   This repository declares no app named "cloud". It declares: backend, web.
+* `rebase cloud deploy` and `rebase cloud logs`.
 *
-* So the documented `rebase cloud deploy --bundle` failed on every project that
-* did not happen to declare an app called `cloud`, `rebase cloud deploy web`
-* could not reach `web`, and the refusal named the user's real apps — reading
-* as a fault in their `rebase.json` rather than in the CLI's own parse.
+* `deploy` triggers the control-plane `deploy` function, then tails the build
+* logs from the deployment record until it succeeds or fails. `logs` shows the
+* latest build log, or runtime logs with `--runtime`.
 *
-* `commandWords` counts from `cloud` itself, so `cloud deploy` is 2, and it is
-* applied to the PARSED positionals: a flag written before the group no longer
-* shifts the app name either.
+* There are three deploys behind the one verb, and which one runs depends on the
+* flags: `--bundle` builds and uploads a managed bundle, `--source .` uploads
+* this directory as a build context, and the bare form uploads nothing and asks
+* the control plane to rebuild what it already holds. That last one is the
+* dangerous one — see `planBareDeploy`.
 */
-function resolveDeployArgs(rawArgs) {
-	const { flags, positionals } = parseCloudArgs({
-		spec: {
-			"--no-follow": Boolean,
-			"--source": String,
-			"--message": String,
-			"--bundle": Boolean,
-			"--bundle-dir": String,
-			"--skip-type-check": Boolean,
-			"--force": Boolean,
-			"-m": "--message"
-		},
-		rawArgs,
-		commandWords: 2,
-		command: "cloud deploy",
-		maxPositionals: 1
-	});
-	return {
-		flags,
-		appName: positionals[0]
-	};
+var POLL_INTERVAL_MS = 1500;
+var POLL_TIMEOUT_MS = 900 * 1e3;
+var MAX_SOURCE_UPLOAD_BYTES = 100 * 1024 * 1024;
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
 }
-async function deployCommand(rawArgs, projectRef) {
-	const { flags: args, appName } = resolveDeployArgs(rawArgs);
-	const { client, url } = await requireClient(rawArgs);
-	const projectId = await resolveProjectRef(projectRef, client);
-	const declaredManaged = !args["--source"] && !args["--bundle"] && declaresManagedRuntime(appName);
-	if (args["--bundle"] || declaredManaged) {
-		if (args["--bundle"] && args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
-		if (declaredManaged && !isJsonMode()) console.log(chalk.gray("  rebase.json declares runtime: managed — deploying a bundle."));
-		await deployBundle({
-			client,
-			url,
-			projectId,
-			projectRef,
-			bundleDir: args["--bundle-dir"],
-			message: args["--message"],
-			appName,
-			skipTypeCheck: args["--skip-type-check"] === true
+function run(cmd, cmdArgs, cwd, env) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(cmd, cmdArgs, {
+			cwd,
+			env: env ? {
+				...process.env,
+				...env
+			} : void 0,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			]
 		});
-		return;
-	}
-	const { project, latest } = await readDeployContext(client, projectId);
-	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
-	const eject = {
-		managed: plan.managed,
-		source: Boolean(args["--source"]),
-		force: args["--force"] === true
-	};
-	const refusal = ejectRefusal(eject, projectRef);
-	if (refusal) fail(refusal.message, refusal.hint, refusal.code);
-	const warnings = deployWarnings(eject, projectRef);
-	for (const w of warnings) warn(w.message, w.hint);
-	if (!args["--source"] && !isJsonMode()) {
-		console.log("");
-		for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
-	}
-	let source;
-	if (args["--source"]) {
-		const tarPath = await createSourceTarball(args["--source"]);
-		try {
-			const token = client.auth.getSession()?.accessToken;
-			if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
-			source = await uploadSource(url, token, projectId, tarPath);
-		} finally {
-			fs.rmSync(tarPath, { force: true });
-		}
-	}
-	if (!isJsonMode()) {
-		console.log("");
-		console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
-	}
-	const body = { projectId };
-	if (source) body.source = source;
-	if (args["--message"]) body.message = args["--message"];
-	body.client = "cli";
-	const frameworkVersion = resolveFrameworkVersion(args["--source"] ?? process.cwd());
-	if (frameworkVersion) body.frameworkVersion = frameworkVersion;
-	let triggered;
+		let stderr = "";
+		child.stderr.on("data", (d) => stderr += d.toString());
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(new Error(stderr || `${cmd} exited ${code}`)));
+	});
+}
+/**
+* Package `sourceDir` into a gzipped tarball, honoring `.gitignore`/`.rebaseignore`
+* and always excluding `.git` and `node_modules`. Returns the temp archive path.
+*/
+async function createSourceTarball(sourceDir) {
+	const dir = path.resolve(sourceDir);
+	if (!fs.existsSync(dir)) fail(`Source directory not found: ${dir}`);
+	const tarPath = path.join(os.tmpdir(), `rebase-src-${Date.now()}.tar.gz`);
+	const tarArgs = [
+		"-czf",
+		tarPath,
+		"--exclude=.git",
+		"--exclude=node_modules"
+	];
+	for (const ignore of [".gitignore", ".rebaseignore"]) if (fs.existsSync(path.join(dir, ignore))) tarArgs.push(`--exclude-from=${ignore}`);
+	tarArgs.push(".");
 	try {
-		const res = await client.functions.invoke("deploy", body);
-		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
-		triggered = {
-			deploymentId: String(res.deployment.id),
-			deduplicated: res.deduplicated === true
-		};
+		await run("tar", tarArgs, dir, { COPYFILE_DISABLE: "1" });
 	} catch (e) {
-		triggered = resolveTriggerFailure(e);
-	}
-	const { deploymentId, deduplicated } = triggered;
-	if (!isJsonMode()) console.log(chalk.gray(deduplicated ? `  Deployment ${deploymentId} is already running — following it.` : `  Deployment ${deploymentId} created.${frameworkVersion ? `  (@rebasepro/* ${frameworkVersion})` : ""}`));
-	if (args["--no-follow"]) {
-		emit(() => {
-			console.log(chalk.gray("  Not following logs (--no-follow). Check status with `rebase cloud logs`."));
-			console.log("");
-		}, {
-			deploymentId,
-			deduplicated,
-			frameworkVersion: frameworkVersion ?? null,
-			following: false,
-			...warningPayload(warnings)
-		});
-		return;
-	}
-	if (!isJsonMode()) {
-		console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
-		console.log("");
+		fail(`Failed to package source: ${e instanceof Error ? e.message : String(e)}`);
 	}
-	const status = await streamBuildLogs(client, deploymentId, { quiet: isJsonMode() });
-	emit(() => {}, {
-		deploymentId,
-		deduplicated,
-		frameworkVersion: frameworkVersion ?? null,
-		following: true,
-		status,
-		...warningPayload(warnings)
-	});
+	return tarPath;
 }
 /**
-* Turn a failed trigger into either a deployment to follow, or an exit.
+* The `@rebasepro/*` version this source directory actually resolves.
 *
-* The 409 is the interesting one. A deploy trigger can reach the control plane
-* twice without anybody asking twice — the SDK transport replays a request once
-* after refreshing an expired token, and any lost response has the same effect
-* — so "a deployment is already in progress" was routinely describing the
-* deployment this very command had just created. With no id in the message the
-* only available reading was "someone else is deploying, back off", and the
-* build stream was lost either way.
+* Recorded on the deployment so a row in Deployment History says which
+* framework build shipped. Nothing else on the platform knows: an app that
+* links the framework locally pins it at package time, and a silent bump is
+* invisible afterwards — it has already cost one debugging session.
 *
-* So: if the control plane says the blocking deployment is ours, we attach to
-* it. If it is not ours, we still name it, because "which one, since when, from
-* where" is the difference between an actionable refusal and a dead end.
+* `@rebasepro/server` first, because that is what the deployed backend runs;
+* `@rebasepro/client` is the fallback for a frontend-only bundle. Resolution is
+* a plain walk up from the source directory rather than `require.resolve`,
+* which would answer for the CLI's own install tree instead of the app's.
+*
+* Best effort by construction: a version that cannot be read is simply not
+* recorded. Nothing about a deploy should fail over a bookkeeping string.
 */
-function resolveTriggerFailure(e) {
-	const err = e;
-	if (err?.status === 409) {
-		const blocking = err.details?.deployment;
-		if (blocking?.id && blocking.mine) return {
-			deploymentId: String(blocking.id),
-			deduplicated: true
-		};
-		fail(blocking?.id ? `Deployment ${blocking.id} is already in progress for this project${blocking.triggerSource && blocking.triggerSource !== "unknown" ? `, triggered from the ${blocking.triggerSource}` : ""}${blocking.createdAt ? ` at ${fmtDate(blocking.createdAt)}` : ""}.` : "A deployment is already in progress for this project.", blocking?.id ? `Follow it with \`rebase cloud logs -f\`, or stop it with \`rebase cloud cancel ${blocking.id}\`.` : "Follow it with `rebase cloud logs -f`.", "deploy_in_progress");
+function resolveFrameworkVersion(sourceDir) {
+	let dir = path.resolve(sourceDir);
+	for (;;) {
+		for (const pkg of ["@rebasepro/server", "@rebasepro/client"]) try {
+			const manifest = path.join(dir, "node_modules", ...pkg.split("/"), "package.json");
+			const version = JSON.parse(fs.readFileSync(manifest, "utf8")).version;
+			if (typeof version === "string" && version.trim() !== "") return version.trim();
+		} catch {}
+		const parent = path.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
 	}
-	if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.", "payment_required");
-	if (err?.status === 400 && err.details?.intakeCode) fail(err.message || "This bundle was refused.", err.details.hint ?? "Run `rebase cloud resources` to see what this project is given.", err.details.intakeCode);
-	reportError(e, "Failed to trigger deployment");
 }
 /**
-* Poll a deployment record and print new log output as it arrives. Returns the
-* terminal status; a non-success still exits non-zero, as it always has.
+* A progress line for a human — dropped entirely in JSON mode.
 *
-* `quiet` follows without printing — JSON mode, where the log stream would
-* corrupt the one object the caller is parsing.
+* Progress is not a result. In JSON mode stdout carries the one result value
+* and nothing else, so every unguarded `console.log` on a deploy path was a
+* line printed in front of the JSON, breaking the parser meant to read it.
+* Warnings are the other half of this rule and go the other way: they are
+* `warn`, which prints in every mode, to stderr. See `warn` in `context.ts`.
 */
-async function streamBuildLogs(client, deploymentId, opts = {}) {
-	const quiet = opts.quiet === true;
-	let printed = 0;
-	const started = Date.now();
-	for (;;) {
-		let dep;
+function progress(line) {
+	if (!isJsonMode()) console.log(line);
+}
+/** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
+async function uploadSource(url, token, projectId, tarPath) {
+	const bytes = fs.readFileSync(tarPath);
+	const sizeMb = (bytes.length / 1024 / 1024).toFixed(1);
+	if (bytes.length > MAX_SOURCE_UPLOAD_BYTES) fail(`Source context is ${sizeMb} MB — the upload cap is ${Math.round(MAX_SOURCE_UPLOAD_BYTES / 1024 / 1024)} MB.`, "Trim the build context: exclude sourcemaps (*.map), build output and large assets via .rebaseignore or .gitignore.");
+	progress(chalk.gray(`  Uploading source (${sizeMb} MB)...`));
+	const res = await fetch(`${url}/api/functions/deploy/upload?projectId=${encodeURIComponent(projectId)}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/gzip"
+		},
+		body: bytes
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		fail(`Source upload failed (${res.status}): ${body || res.statusText}`);
+	}
+	const data = await res.json();
+	if (!data.source) fail("Upload endpoint did not return a source reference.");
+	return data.source;
+}
+/**
+* Build, upload and deploy a project as a managed bundle.
+*
+* Builds the backend app into `dist-bundle` (unless one is pointed at with
+* `--bundle-dir`), packs it without `node_modules`, uploads it, and triggers a
+* deploy carrying the manifest so the control plane can validate intake fast.
+*/
+async function deployBundle(opts) {
+	const projectRoot = requireProjectRoot();
+	let bundleDir = opts.bundleDir ? path.resolve(process.cwd(), opts.bundleDir) : path.join(projectRoot, "dist-bundle");
+	if (!opts.bundleDir) {
+		const loaded = loadManifest(projectRoot);
+		let target;
 		try {
-			dep = await client.data.collection("deployments").findById(deploymentId);
-		} catch (e) {
-			reportError(e, "Failed to read deployment status");
+			target = selectDeployApp(loaded.manifest, opts.appName);
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err));
+			return;
 		}
-		if (!dep) fail(`Deployment ${deploymentId} disappeared.`, void 0, "not_found");
-		const logs = dep.logs ?? "";
-		if (!quiet && logs.length > printed) process.stdout.write(logs.slice(printed));
-		printed = logs.length;
-		if (dep.status && dep.status !== "deploying") {
-			if (dep.status !== "success") {
-				if (quiet) {
-					printJson({ error: {
-						message: `Deployment ${deploymentId} ${dep.status}.`,
-						code: "deploy_failed",
-						status: null,
-						deploymentId,
-						logs
-					} });
-					process.exit(1);
-				}
-				console.log("");
-				console.log(chalk.bold.red(`  ✗ Deployment ${dep.status}`));
-				console.log("");
-				process.exit(1);
-			}
-			if (!quiet) {
-				console.log("");
-				console.log(chalk.bold.green("  ✓ Deployment succeeded"));
-				console.log("");
+		if (target.app.type === "static") {
+			progress(chalk.gray(`  Building static app "${target.name}"...`));
+			const staticDir = await buildAssetApp(projectRoot, target.name, target.app, loaded.manifest.rebase);
+			if (!staticDir) {
+				fail(`App "${target.name}" produced no bundle.`, "A static app needs both a `build` command and an `output` directory in rebase.json.");
+				return;
 			}
-			return dep.status;
-		}
-		if (Date.now() - started > POLL_TIMEOUT_MS) {
-			if (!quiet) console.log("");
-			fail("Timed out waiting for the build to finish.", "The deployment may still be running — check `rebase cloud logs`.", "timeout");
+			bundleDir = staticDir;
+			await uploadAndTrigger({
+				...opts,
+				bundleDir,
+				appName: target.name
+			});
+			return;
 		}
-		await sleep(POLL_INTERVAL_MS);
-	}
-}
-async function logsCommand(rawArgs, projectRef) {
-	const args = arg({
-		"--runtime": Boolean,
-		"--follow": Boolean,
-		"-f": "--follow"
-	}, {
-		argv: rawArgs.slice(2),
-		permissive: true
-	});
-	const { client } = await requireClient(rawArgs);
-	const projectId = await resolveProjectRef(projectRef, client);
-	if (args["--runtime"]) {
+		progress(chalk.gray("  Building bundle..."));
+		const backend = {
+			name: target.name,
+			app: target.app
+		};
+		const { graph: resourceGraph, issues: resourceIssues } = await deriveResourceGraph({ configDir: path.join(projectRoot, resolveBackendPaths(backend.app, projectRoot).config) });
+		if (resourceIssues.length > 0) throw new Error(`${resourceIssues.length} problem(s) in the declared resources:\n` + resourceIssues.map((i) => `  ${i.path}  ${i.message}`).join("\n"));
+		bundleDir = (await buildBundle({
+			projectRoot,
+			appName: backend.name,
+			app: backend.app,
+			runtimeRange: loaded.manifest.rebase,
+			resources: resourceGraph,
+			skipTypeCheck: opts.skipTypeCheck,
+			log: (m) => progress(chalk.gray(m))
+		})).outDir;
 		try {
-			const res = await client.functions.invoke("runtime-logs", void 0, {
-				method: "GET",
-				path: projectId
+			const folded = await foldFrontendIntoBundle({
+				projectRoot,
+				manifest: loaded.manifest,
+				bundleDir,
+				log: (m) => progress(m)
 			});
-			console.log("");
-			console.log(chalk.bold(`  📄 Runtime logs — project ${projectRef}`));
-			console.log("");
-			console.log(res.logs ?? chalk.gray("  (no logs)"));
-			console.log("");
-		} catch (e) {
-			reportError(e, "Failed to fetch runtime logs");
+			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
 		}
-		return;
 	}
+	await uploadAndTrigger({
+		...opts,
+		bundleDir
+	});
+}
+/**
+* Pack a built bundle, upload it, and trigger the deploy.
+*
+* Shared by every managed deploy, whichever kind of app produced the bundle: a
+* backend and a static app differ in what is built and in the `kind` their
+* manifest carries, and in nothing after that. Keeping one tail is what makes
+* that true rather than nearly true — the folding step was once missing from
+* one of two callers producing the same artifact, and the deploy shipped a
+* bundle with no site in it.
+*/
+async function uploadAndTrigger(opts) {
+	const { client, url, projectId, projectRef, bundleDir } = opts;
+	const manifest = readBundleManifest(bundleDir);
+	if (manifest.hooks?.native) {
+		const names = (manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
+		fail(`This bundle depends on native modules${names ? ` (${names})` : ""}, which the managed runtime cannot run.`, "Remove the native dependency, or deploy on the custom runtime.");
+	}
+	const tarPath = path.join(os.tmpdir(), `rebase-bundle-${Date.now()}.tar.gz`);
+	const token = client.auth.getSession()?.accessToken;
+	if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
+	let bundleId;
 	try {
-		const dep = await latestDeployment(client, projectId);
-		if (!dep) {
-			console.log("");
-			console.log(chalk.gray("  No deployments yet for this project."));
-			console.log("");
-			return;
-		}
-		console.log("");
-		console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
+		await packBundle(bundleDir, tarPath);
+		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
+		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		bundleId = await uploadBundle(url, token, projectId, tarPath);
+	} catch (e) {
+		fail(e instanceof Error ? e.message : String(e));
+		return;
+	} finally {
+		fs.rmSync(tarPath, { force: true });
+	}
+	if (!isJsonMode()) {
 		console.log("");
-		if (args["--follow"] && dep.status === "deploying") await streamBuildLogs(client, String(dep.id));
-		else {
-			console.log(dep.logs ?? chalk.gray("  (no logs)"));
-			console.log("");
-		}
+		console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	}
+	let declaredApps = [];
+	try {
+		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
+	} catch {}
+	const body = bundleDeployBody({
+		projectId,
+		bundleId,
+		manifest,
+		app: opts.appName,
+		message: opts.message,
+		declaredApps
+	});
+	let deploymentId;
+	let managed;
+	try {
+		const res = await client.functions.invoke("deploy", body);
+		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
+		deploymentId = String(res.deployment.id);
+		managed = res.managed === true;
 	} catch (e) {
-		reportError(e, "Failed to fetch build logs");
+		reportError(e, "Managed deploy failed to start");
+	}
+	if (!opts.follow) {
+		emit(() => {
+			console.log(chalk.green(`  ✓ Managed deploy started (deployment ${deploymentId}).`));
+			console.log(chalk.gray("    Not following (--no-follow). Track it with `rebase cloud logs`."));
+		}, {
+			success: true,
+			deploymentId,
+			managed,
+			following: false
+		});
+		return;
 	}
+	if (!isJsonMode()) {
+		console.log(chalk.green(`  ✓ Managed deploy started (deployment ${deploymentId}).`));
+		console.log(chalk.gray("    Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
+		console.log("");
+	}
+	const status = await streamBuildLogs(client, deploymentId, {
+		quiet: isJsonMode(),
+		timeoutMs: opts.timeoutMs
+	});
+	emit(() => {}, {
+		success: true,
+		deploymentId,
+		managed,
+		following: true,
+		status
+	});
+}
+function pick(row, ...keys) {
+	for (const key of keys) {
+		const raw = row?.[key];
+		if (typeof raw === "string" && raw.trim() !== "") return raw.trim();
+	}
+}
+/** Rough age of a timestamp, for "…uploaded 6d ago". Undefined if unreadable. */
+function timeAgo(value, now) {
+	if (value === void 0) return void 0;
+	const then = value instanceof Date ? value.getTime() : new Date(value).getTime();
+	if (Number.isNaN(then)) return void 0;
+	const ms = now.getTime() - then;
+	if (ms < 0) return void 0;
+	const minutes = Math.floor(ms / 6e4);
+	if (minutes < 1) return "just now";
+	if (minutes < 60) return `${minutes}m ago`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ago`;
+	return `${Math.floor(hours / 24)}d ago`;
 }
-//#endregion
-//#region src/commands/cloud/orgs.ts
 /**
-* `rebase cloud orgs` — list / create / members.
+* Whether this project runs on the managed runtime.
+*
+* `runtimeMode` on the project row is the authority — the control plane writes
+* it. The bundle-id fallback covers a control plane that does not return the
+* field: a successful deploy that served a bundle only happens on the managed
+* path.
 */
-async function orgsCommand(subcommand, rawArgs) {
-	switch (subcommand) {
-		case "list":
-		case void 0:
-			await listOrgs(rawArgs);
-			break;
-		case "create":
-			await createOrg(rawArgs);
-			break;
-		case "members":
-			await listMembers(rawArgs);
-			break;
-		case "--help":
-			printOrgsHelp();
-			break;
-		default: fail(`Unknown orgs command: ${subcommand}`, "Run `rebase cloud orgs --help`.", "unknown_command");
+function isManagedProject(project, latest) {
+	if (pick(project, "runtimeMode", "runtime_mode") === "managed") return true;
+	return latest?.status === "success" && pick(latest, "bundleId", "bundle_id") !== void 0;
+}
+/** What a `deploy` with nothing attached will build, in the words to print. */
+function planBareDeploy(project, latest, now) {
+	const projectRow = project;
+	const deploymentRow = latest;
+	const managed = isManagedProject(project, latest);
+	const repo = pick(projectRow, "gitRepoUrl", "git_repo_url");
+	if (repo) {
+		const branch = pick(projectRow, "gitBranch", "git_branch");
+		return {
+			managed,
+			source: "git",
+			lines: [`Building from git: ${repo}${branch ? ` (${branch})` : ""}.`]
+		};
+	}
+	if (pick(deploymentRow, "sourceRef", "source_ref")) {
+		const age = timeAgo(latest?.createdAt ?? latest?.created_at, now);
+		return {
+			managed,
+			source: "snapshot",
+			lines: [`Rebuilding the stored source archive${latest?.id !== void 0 ? ` from deployment ${latest.id}` : ""}${age ? `, uploaded ${age}` : ""}.`, "This directory is NOT uploaded — pass `--source .` to build what is on disk."]
+		};
 	}
+	return {
+		managed,
+		source: "none",
+		lines: ["This project has no git repository configured and no stored source archive to rebuild.", "Upload this directory with `--source .`, or set a repository URL in the project settings."]
+	};
 }
-async function listOrgs(rawArgs) {
-	const { client, url } = await requireClient(rawArgs);
+/** `code` of the warning below, and the field name it sets in the payload. */
+var EJECTS_MANAGED_RUNTIME = "ejects_managed_runtime";
+/** The one sentence that says a source build undoes `runtimeMode: managed`. */
+function ejectWarning(projectRef) {
+	return {
+		code: EJECTS_MANAGED_RUNTIME,
+		message: `${projectRef} runs on the managed runtime — this build ejects it to a custom container.`,
+		hint: "Use `rebase cloud deploy --bundle` to stay on managed."
+	};
+}
+/**
+* Why a container-image deploy of a managed project is refused — or `undefined`
+* to let it through.
+*
+* Every path below this point builds a container image, and a successful one
+* sets `runtimeMode: "custom"` server-side. So the question is never "which flag
+* was used" but "did the caller ask to leave the managed runtime", and only
+* `--force` answers it.
+*
+* `--source` used to be read as answering it too, on the theory that uploading a
+* build context is self-evidently a deliberate eject. It is not: `--source`
+* picks *which source* gets built — this directory, rather than the stale
+* archive the control plane is holding — and the eject is a side effect of the
+* answer. That is exactly how a live project got flipped to `custom` by someone
+* whose actual intent was "deploy what I have here", and it is the same
+* ignorance the bare form is refused for. Same ignorance, same refusal.
+*/
+function ejectRefusal(opts, projectRef) {
+	if (!opts.managed || opts.force) return void 0;
+	const eject = "To eject on purpose, add `--force`.";
+	if (opts.source) return {
+		message: `${projectRef} runs on the managed runtime, and \`--source\` builds a container image from this directory — which ejects it from managed. Picking a build method is not the same as asking to leave the runtime.`,
+		hint: `Deploy this directory to the managed runtime with \`rebase cloud deploy --bundle\`. ${eject}`,
+		code: "managed_project"
+	};
+	return {
+		message: `${projectRef} runs on the managed runtime, and a plain \`rebase cloud deploy\` builds a container image instead — ejecting it from managed, from source the control plane already holds rather than this directory.`,
+		hint: `Redeploy it with \`rebase cloud deploy --bundle\`. ${eject} \`--source . --force\` builds this directory; \`--force\` alone builds what the control plane holds.`,
+		code: "managed_project"
+	};
+}
+/**
+* Which warnings a container-image deploy has earned.
+*
+* Pure, and separate from the printing, because the printing is what went
+* wrong: the eject warning used to be written inline behind `!isJsonMode()`, so
+* the fact that a deploy ejects a managed project existed only as a side effect
+* of a TTY being attached. Deciding here, emitting once at the call site, means
+* the decision cannot be output-mode-dependent again.
+*
+* The condition is just `managed`: anything reaching this point is a container
+* image build that `ejectRefusal` has already let through, and on a managed
+* project that is an eject however it was spelled. A caller who passed `--force`
+* knows — the warning is for the transcript and the payload, which is what
+* anyone reviewing the deploy afterwards actually reads.
+*/
+function deployWarnings(opts, projectRef) {
+	return opts.managed ? [ejectWarning(projectRef)] : [];
+}
+/** The warning half of a deploy's JSON payload — merged into whatever it emits. */
+function warningPayload(warnings) {
+	return {
+		warnings: warnings.map((w) => ({
+			code: w.code,
+			message: w.message,
+			hint: w.hint ?? null
+		})),
+		ejectsManagedRuntime: warnings.some((w) => w.code === EJECTS_MANAGED_RUNTIME)
+	};
+}
+/**
+* Read the two rows the preflight needs.
+*
+* Best effort by construction: a preflight that cannot read is a preflight that
+* says nothing, never a deploy that fails. The managed refusal rides on the same
+* read, so an unreadable project falls through to the old behaviour rather than
+* blocking a deploy on a lookup.
+*/
+async function readDeployContext(client, projectId) {
 	try {
-		const orgs = (await client.data.collection("organizations").find({ limit: 100 })).data;
-		const active = getContextOrg(url);
-		emit(() => {
-			console.log("");
-			console.log(chalk.bold("  🏢 Organizations"));
-			console.log("");
-			if (orgs.length === 0) {
-				console.log(chalk.gray("  You are not a member of any organization."));
-				console.log("");
-				return;
-			}
-			for (const o of orgs) {
-				const marker = String(o.id) === active ? chalk.green(" ●") : "  ";
-				console.log(`${marker}${chalk.bold(o.name ?? "(unnamed)")} ${chalk.gray(`[${o.id}]`)}${o.slug ? chalk.gray(`  ${o.slug}`) : ""}`);
-			}
-			console.log("");
-			note(chalk.gray("● = active organization. Switch with `rebase cloud use <id>`."));
-			console.log("");
-		}, {
-			activeOrg: active ?? null,
-			organizations: orgs.map((o) => ({
-				id: String(o.id),
-				name: o.name ?? null,
-				slug: o.slug ?? null,
-				active: String(o.id) === active
-			}))
-		});
-	} catch (e) {
-		reportError(e, "Failed to list organizations");
+		const [project, latest] = await Promise.all([client.data.collection("projects").findById(projectId), latestDeployment(client, projectId)]);
+		return {
+			project,
+			latest
+		};
+	} catch {
+		return {};
 	}
 }
-async function createOrg(rawArgs) {
-	const args = arg({
-		"--name": String,
-		"--slug": String,
-		"-n": "--name"
-	}, {
-		argv: rawArgs.slice(4),
-		permissive: true
+/**
+* Whether this repository's backend declares the managed runtime.
+*
+* Deliberately quiet: a directory that is not a Rebase project, or whose
+* manifest does not parse, simply does not route this way — `rebase build` is
+* where a broken manifest gets reported, and a deploy refusing on one before it
+* has even said what it is doing would be the wrong place to find out.
+*/
+function declaresManagedRuntime(appName) {
+	try {
+		const projectRoot = findProjectRoot();
+		if (!projectRoot) return false;
+		const manifest = loadManifest(projectRoot).manifest;
+		if (appName) {
+			const app = manifest.apps[appName];
+			if (app?.type === "static") return true;
+			if (app?.type === "backend") return app.runtime === "managed";
+		}
+		const backend = findBackendApp(manifest);
+		if (!backend) return Object.keys(manifest.apps).length > 0;
+		return backend.app.runtime === "managed";
+	} catch {
+		return false;
+	}
+}
+/**
+* Every flag `rebase cloud deploy` accepts.
+*
+* Hoisted out of the `parseCloudArgs` call so that one declaration serves three
+* readers: the parser, `action-help.ts`'s page for this command, and the test
+* that holds the two to each other. A flag added here with no line in the help
+* page is a failing test rather than a flag nobody can discover.
+*/
+var DEPLOY_FLAGS = {
+	"--no-follow": Boolean,
+	"--wait": Boolean,
+	"--timeout": String,
+	"--source": String,
+	"--message": String,
+	"--bundle": Boolean,
+	"--bundle-dir": String,
+	"--skip-type-check": Boolean,
+	"--force": Boolean,
+	"-m": "--message"
+};
+/**
+* `rebase cloud deploy [app]` — its flags, and which app of this repository the
+* line named.
+*
+* Parsed through `parseCloudArgs` rather than `arg` directly, and the reason is
+* the positional. This command used to parse `rawArgs.slice(2)` permissively
+* and read `_[0]` as the app name — but `rawArgs` is the WHOLE `process.argv`,
+* so `_` opens with the command words themselves. `_[0]` was therefore the
+* literal string `"cloud"` on every run, which then went to `selectDeployApp`
+* and came back as:
+*
+*   This repository declares no app named "cloud". It declares: backend, web.
+*
+* So the documented `rebase cloud deploy --bundle` failed on every project that
+* did not happen to declare an app called `cloud`, `rebase cloud deploy web`
+* could not reach `web`, and the refusal named the user's real apps — reading
+* as a fault in their `rebase.json` rather than in the CLI's own parse.
+*
+* `commandWords` counts from `cloud` itself, so `cloud deploy` is 2, and it is
+* applied to the PARSED positionals: a flag written before the group no longer
+* shifts the app name either.
+*/
+function resolveDeployArgs(rawArgs) {
+	const { flags, positionals } = parseCloudArgs({
+		spec: DEPLOY_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "cloud deploy",
+		maxPositionals: 1
 	});
+	return {
+		flags,
+		appName: positionals[0]
+	};
+}
+async function deployCommand(rawArgs, projectRef) {
+	const { flags: args, appName } = resolveDeployArgs(rawArgs);
+	if (args["--wait"] && args["--no-follow"]) fail("--wait and --no-follow ask for opposite things.", "`deploy` follows by default — pass neither, or `--no-follow` to return as soon as the build is triggered.", "usage");
 	const { client, url } = await requireClient(rawArgs);
-	const prompts = [];
-	if (!args["--name"]) {
-		requireInteractive("an organization name", "--name <name>");
-		prompts.push({
-			type: "input",
-			name: "name",
-			message: "Organization name:"
+	const projectId = await resolveProjectRef(projectRef, client);
+	const declaredManaged = !args["--source"] && !args["--bundle"] && declaresManagedRuntime(appName);
+	if (args["--bundle"] || declaredManaged) {
+		if (args["--bundle"] && args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
+		if (declaredManaged && !isJsonMode()) console.log(chalk.gray("  rebase.json declares runtime: managed — deploying a bundle."));
+		await deployBundle({
+			client,
+			url,
+			projectId,
+			projectRef,
+			bundleDir: args["--bundle-dir"],
+			message: args["--message"],
+			appName,
+			skipTypeCheck: args["--skip-type-check"] === true,
+			follow: args["--no-follow"] !== true,
+			timeoutMs: resolveDeployTimeout(args["--timeout"])
 		});
+		return;
 	}
-	const answers = prompts.length ? await inquirer.prompt(prompts) : {};
-	const name = (args["--name"] || answers.name || "").trim();
-	if (!name) fail("Organization name is required.", "Pass `--name <name>`.", "input_required");
-	const slug = (args["--slug"] || slugify(name)).trim();
-	try {
-		const created = await client.data.collection("organizations").create({
-			name,
-			slug,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		setContextOrg(url, String(created.id));
-		success(`Created organization ${chalk.bold(name)} and set it active`);
-		emit(() => {}, {
-			success: true,
-			id: String(created.id),
-			name,
-			slug,
-			setActive: true
-		});
-	} catch (e) {
-		reportError(e, "Failed to create organization");
+	const { project, latest } = await readDeployContext(client, projectId);
+	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
+	const eject = {
+		managed: plan.managed,
+		source: Boolean(args["--source"]),
+		force: args["--force"] === true
+	};
+	const refusal = ejectRefusal(eject, projectRef);
+	if (refusal) fail(refusal.message, refusal.hint, refusal.code);
+	const warnings = deployWarnings(eject, projectRef);
+	for (const w of warnings) warn(w.message, w.hint);
+	if (!args["--source"] && !isJsonMode()) {
+		console.log("");
+		for (const line of plan.lines) console.log(chalk.gray(`  ${line}`));
+	}
+	let source;
+	if (args["--source"]) {
+		const tarPath = await createSourceTarball(args["--source"]);
+		try {
+			const token = client.auth.getSession()?.accessToken;
+			if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
+			source = await uploadSource(url, token, projectId, tarPath);
+		} finally {
+			fs.rmSync(tarPath, { force: true });
+		}
+	}
+	if (!isJsonMode()) {
+		console.log("");
+		console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
 	}
-}
-async function listMembers(rawArgs) {
-	const { client, url } = await requireClient(rawArgs);
-	const org = getContextOrg(url);
-	if (!org) fail("No active organization.", "Run `rebase cloud use` first.", "no_org");
+	const body = { projectId };
+	if (source) body.source = source;
+	if (args["--message"]) body.message = args["--message"];
+	body.client = "cli";
+	const frameworkVersion = resolveFrameworkVersion(args["--source"] ?? process.cwd());
+	if (frameworkVersion) body.frameworkVersion = frameworkVersion;
+	let triggered;
 	try {
-		const members = (await client.data.collection("organization-members").find({
-			where: { organization: ["==", org] },
-			limit: 200
-		})).data;
+		const res = await client.functions.invoke("deploy", body);
+		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
+		triggered = {
+			deploymentId: String(res.deployment.id),
+			deduplicated: res.deduplicated === true
+		};
+	} catch (e) {
+		triggered = resolveTriggerFailure(e);
+	}
+	const { deploymentId, deduplicated } = triggered;
+	if (!isJsonMode()) console.log(chalk.gray(deduplicated ? `  Deployment ${deploymentId} is already running — following it.` : `  Deployment ${deploymentId} created.${frameworkVersion ? `  (@rebasepro/* ${frameworkVersion})` : ""}`));
+	if (args["--no-follow"]) {
 		emit(() => {
-			console.log("");
-			console.log(chalk.bold(`  👥 Members — org ${org}`));
-			console.log("");
-			if (members.length === 0) {
-				console.log(chalk.gray("  No members found."));
-				console.log("");
-				return;
-			}
-			for (const m of members) console.log(`  ${chalk.bold(m.userId ?? "?")}  ${colorStatus(m.role)}`);
+			console.log(chalk.gray("  Not following logs (--no-follow). Check status with `rebase cloud logs`."));
 			console.log("");
 		}, {
-			org,
-			members: members.map((m) => ({
-				id: String(m.id),
-				userId: m.userId ?? null,
-				role: m.role ?? null
-			}))
+			deploymentId,
+			deduplicated,
+			frameworkVersion: frameworkVersion ?? null,
+			following: false,
+			...warningPayload(warnings)
 		});
-	} catch (e) {
-		reportError(e, "Failed to list members");
+		return;
 	}
+	if (!isJsonMode()) {
+		console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
+		console.log("");
+	}
+	const status = await streamBuildLogs(client, deploymentId, {
+		quiet: isJsonMode(),
+		timeoutMs: resolveDeployTimeout(args["--timeout"])
+	});
+	emit(() => {}, {
+		deploymentId,
+		deduplicated,
+		frameworkVersion: frameworkVersion ?? null,
+		following: true,
+		status,
+		...warningPayload(warnings)
+	});
 }
-function slugify(s) {
-	return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function printOrgsHelp() {
-	emitHelp("orgs", [
-		"list",
-		"create",
-		"members"
-	], () => {
-		console.log(`
-${chalk.bold("rebase cloud orgs")} — Manage organizations
-
-${chalk.green.bold("Commands")}
-  ${chalk.blue.bold("list")}              List organizations you belong to
-  ${chalk.blue.bold("create")}            Create a new organization ${chalk.gray("(--name, --slug)")}
-  ${chalk.blue.bold("members")}           List members of the active organization
-`);
+/** `--timeout <seconds>` for a deploy, or the 15-minute default. */
+function resolveDeployTimeout(value) {
+	return resolveTimeoutMs(value, {
+		fallbackMs: POLL_TIMEOUT_MS,
+		command: "cloud deploy"
 	});
 }
-//#endregion
-//#region src/commands/cloud/databases.ts
 /**
-* `rebase cloud db` — database + backup management for a project.
+* Turn a failed trigger into either a deployment to follow, or an exit.
 *
-*   db list                List databases attached to the project
-*   db create              Attach a managed or bring-your-own database
-*   db test                Test connectivity to the project's database
-*   db backup list|create|restore
+* The 409 is the interesting one. A deploy trigger can reach the control plane
+* twice without anybody asking twice — the SDK transport replays a request once
+* after refreshing an expired token, and any lost response has the same effect
+* — so "a deployment is already in progress" was routinely describing the
+* deployment this very command had just created. With no id in the message the
+* only available reading was "someone else is deploying, back off", and the
+* build stream was lost either way.
+*
+* So: if the control plane says the blocking deployment is ours, we attach to
+* it. If it is not ours, we still name it, because "which one, since when, from
+* where" is the difference between an actionable refusal and a dead end.
 */
-async function dbCommand$1(subcommand, rawArgs) {
-	switch (subcommand) {
-		case "list":
-		case void 0:
-			await listDatabases(rawArgs);
-			break;
-		case "create":
-			await createDatabase(rawArgs);
-			break;
-		case "info":
-			await dbInfo(rawArgs);
-			break;
-		case "test":
-			await testDatabase(rawArgs);
-			break;
-		case "backup":
-			await backupCommand(rawArgs);
-			break;
-		case "pitr":
-			await pitrCommand(rawArgs);
-			break;
-		case "--help":
-			printDbHelp();
-			break;
-		default: fail(`Unknown db command: ${subcommand}`, "Run `rebase cloud db --help`.", "unknown_command");
+function resolveTriggerFailure(e) {
+	const err = e;
+	if (err?.status === 409) {
+		const blocking = err.details?.deployment;
+		if (blocking?.id && blocking.mine) return {
+			deploymentId: String(blocking.id),
+			deduplicated: true
+		};
+		fail(blocking?.id ? `Deployment ${blocking.id} is already in progress for this project${blocking.triggerSource && blocking.triggerSource !== "unknown" ? `, triggered from the ${blocking.triggerSource}` : ""}${blocking.createdAt ? ` at ${fmtDate(blocking.createdAt)}` : ""}.` : "A deployment is already in progress for this project.", blocking?.id ? `Follow it with \`rebase cloud logs -f\`, or stop it with \`rebase cloud cancel ${blocking.id}\`.` : "Follow it with `rebase cloud logs -f`.", "deploy_in_progress");
 	}
+	if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.", "payment_required");
+	if (err?.status === 400 && err.details?.intakeCode) fail(err.message || "This bundle was refused.", err.details.hint ?? "Run `rebase cloud resources` to see what this project is given.", err.details.intakeCode);
+	reportError(e, "Failed to trigger deployment");
 }
-async function listDatabases(rawArgs) {
-	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	try {
-		const dbs = (await client.data.collection("databases").find({
-			where: { project: ["==", projectId] },
-			limit: 50
-		})).data;
-		emit(() => {
-			console.log("");
-			console.log(chalk.bold(`  🗄  Databases — project ${projectRef}`));
-			console.log("");
-			if (dbs.length === 0) {
-				console.log(chalk.gray("  No database attached. Add one with `rebase cloud db create`."));
+/**
+* Poll a deployment record and print new log output as it arrives. Returns the
+* terminal status; a non-success still exits non-zero, as it always has.
+*
+* `quiet` follows without printing — JSON mode, where the log stream would
+* corrupt the one object the caller is parsing.
+*/
+async function streamBuildLogs(client, deploymentId, opts = {}) {
+	const quiet = opts.quiet === true;
+	const timeoutMs = opts.timeoutMs ?? POLL_TIMEOUT_MS;
+	let printed = 0;
+	const started = Date.now();
+	for (;;) {
+		let dep;
+		try {
+			dep = await client.data.collection("deployments").findById(deploymentId);
+		} catch (e) {
+			reportError(e, "Failed to read deployment status");
+		}
+		if (!dep) fail(`Deployment ${deploymentId} disappeared.`, void 0, "not_found");
+		const logs = dep.logs ?? "";
+		if (!quiet && logs.length > printed) process.stdout.write(logs.slice(printed));
+		printed = logs.length;
+		if (dep.status && dep.status !== "deploying") {
+			if (dep.status !== "success") {
+				if (quiet) {
+					printJson({ error: {
+						message: `Deployment ${deploymentId} ${dep.status}.`,
+						code: "deploy_failed",
+						status: null,
+						deploymentId,
+						logs
+					} });
+					process.exit(1);
+				}
 				console.log("");
-				return;
-			}
-			for (const d of dbs) {
-				console.log(`  ${chalk.bold(d.type ?? "unknown")} ${chalk.gray(`[${d.id}]`)}  ${colorStatus(d.connectionStatus)}`);
-				keyValues([["SSH tunnel", d.useSshTunnel ? "yes" : void 0], ["PITR", d.pitrEnabled ? "enabled" : void 0]]);
+				console.log(chalk.bold.red(`  ✗ Deployment ${dep.status}`));
+				console.log("");
+				process.exit(1);
 			}
-			console.log("");
-		}, {
-			projectId,
-			databases: dbs.map((d) => ({
-				id: String(d.id),
-				type: d.type ?? null,
-				connectionStatus: d.connectionStatus ?? null,
-				useSshTunnel: Boolean(d.useSshTunnel),
-				pitrEnabled: Boolean(d.pitrEnabled)
-			}))
-		});
-	} catch (e) {
-		reportError(e, "Failed to list databases");
-	}
-}
-async function createDatabase(rawArgs) {
-	const args = arg({
-		"--type": String,
-		"--connection-string": String,
-		"--project": String,
-		"-p": "--project"
-	}, {
-		argv: rawArgs.slice(4),
-		permissive: true
-	});
-	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	let type = args["--type"];
-	if (!type) {
-		requireInteractive("a database type", "--type <managed|byodb>");
-		const { picked } = await inquirer.prompt([{
-			type: "select",
-			name: "picked",
-			message: "Database type:",
-			choices: [{
-				name: "SaaS Managed (provisioned for you)",
-				value: "managed"
-			}, {
-				name: "Bring Your Own DB (external PostgreSQL)",
-				value: "byodb"
-			}]
-		}]);
-		type = picked;
-	}
-	let connectionString = args["--connection-string"];
-	if (type === "byodb" && !connectionString) {
-		requireInteractive("a connection string", "--connection-string <url>");
-		const { cs } = await inquirer.prompt([{
-			type: "input",
-			name: "cs",
-			message: "PostgreSQL connection string:"
-		}]);
-		connectionString = cs?.trim();
-		if (!connectionString) fail("A connection string is required for bring-your-own databases.", "Pass `--connection-string <url>`.", "input_required");
-	}
-	try {
-		const created = await client.data.collection("databases").create({
-			project: projectId,
-			type,
-			connectionString: type === "byodb" ? connectionString : void 0,
-			connectionStatus: "untested"
-		});
-		success(`Attached ${type} database to project ${projectRef}`);
-		emit(() => {
-			keyValues([["ID", String(created.id)]]);
-			if (type === "byodb") {
-				note(chalk.gray("Verify it with `rebase cloud db test`."));
-				noteBlank();
+			if (!quiet) {
+				console.log("");
+				console.log(chalk.bold.green("  ✓ Deployment succeeded"));
+				console.log("");
 			}
-		}, {
-			success: true,
-			id: String(created.id),
-			projectId,
-			type,
-			connectionStatus: "untested"
-		});
-	} catch (e) {
-		reportError(e, "Failed to attach database");
-	}
-}
-async function testDatabase(rawArgs) {
-	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	noteBlank();
-	note(`Testing database connectivity for project ${chalk.bold(projectRef)}...`);
-	try {
-		const res = await client.functions.invoke("db-test", { projectId });
-		if (res.logs) console.error(`\n${res.logs}`);
-		if (!res.success) fail("Database connection failed.", "The connection log above (stderr) has the reason.", "db_connection_failed");
-		success("Database connection succeeded");
-		emit(() => {}, {
-			success: true,
-			projectId,
-			logs: res.logs ?? null
-		});
-	} catch (e) {
-		reportError(e, "Failed to test database");
+			return dep.status;
+		}
+		if (Date.now() - started > timeoutMs) {
+			if (!quiet) console.log("");
+			fail(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the build to finish.`, "The deployment may still be running — check `rebase cloud logs`.", "timeout");
+		}
+		await sleep(POLL_INTERVAL_MS);
 	}
 }
-/**
-* `rebase cloud db info [--reveal]` — where a project's database actually lives.
-*
-* The password is NEVER in the default output; `--reveal` fetches it through the
-* separate reveal call, and it appears in JSON only when `--reveal` is given.
-* Any field the server could not resolve comes back `null` and is rendered as
-* unavailable, never a placeholder.
-*/
-async function dbInfo(rawArgs) {
+async function logsCommand(rawArgs, projectRef) {
 	const args = arg({
-		"--reveal": Boolean,
-		"--project": String,
-		"-p": "--project"
+		"--runtime": Boolean,
+		"--follow": Boolean,
+		"-f": "--follow"
 	}, {
 		argv: rawArgs.slice(2),
 		permissive: true
 	});
 	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	try {
-		const info = await client.functions.invoke("db-info", void 0, {
-			method: "GET",
-			path: projectId
-		});
-		let password;
-		let connectionString;
-		if (args["--reveal"]) {
-			if (!info.passwordAvailable) fail("No password is available to reveal for this database.", info.unavailableReason ?? void 0, "password_unavailable");
-			const revealed = await client.functions.invoke("db-info", { projectId }, { path: "reveal" });
-			password = revealed.password;
-			connectionString = revealed.connectionString;
+	const projectId = await resolveProjectRef(projectRef, client);
+	if (args["--runtime"]) {
+		try {
+			const res = await client.functions.invoke("runtime-logs", void 0, {
+				method: "GET",
+				path: projectId
+			});
+			console.log("");
+			console.log(chalk.bold(`  📄 Runtime logs — project ${projectRef}`));
+			console.log("");
+			console.log(res.logs ?? chalk.gray("  (no logs)"));
+			console.log("");
+		} catch (e) {
+			reportError(e, "Failed to fetch runtime logs");
 		}
-		emit(() => {
+		return;
+	}
+	try {
+		const dep = await latestDeployment(client, projectId);
+		if (!dep) {
 			console.log("");
-			console.log(chalk.bold(`  🗄  Database — project ${projectRef}`) + chalk.gray(`  (${info.type})`));
+			console.log(chalk.gray("  No deployments yet for this project."));
 			console.log("");
-			keyValues([
-				["Host", info.host],
-				["Port", info.port],
-				["Database", info.database],
-				["Username", info.username],
-				["Password", info.passwordAvailable ? password ?? chalk.gray("hidden — pass --reveal") : chalk.gray("unavailable")],
-				["Connection", connectionString]
-			]);
-			if (info.unavailableReason) console.log(chalk.gray(`  ${info.unavailableReason}`));
-			if (info.portForward) {
-				const pf = info.portForward;
-				console.log("");
-				console.log(chalk.gray(`  Port-forward:  kubectl -n ${pf.namespace} port-forward svc/${pf.service} ${pf.localPort}:${pf.remotePort}`));
-			}
+			return;
+		}
+		console.log("");
+		console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
+		console.log("");
+		if (args["--follow"] && dep.status === "deploying") await streamBuildLogs(client, String(dep.id));
+		else {
+			console.log(dep.logs ?? chalk.gray("  (no logs)"));
 			console.log("");
-		}, {
-			projectId,
-			type: info.type,
-			host: info.host,
-			port: info.port,
-			database: info.database,
-			username: info.username,
-			passwordAvailable: info.passwordAvailable,
-			portForward: info.portForward,
-			unavailableReason: info.unavailableReason,
-			...args["--reveal"] ? {
-				password,
-				connectionString
-			} : {}
-		});
+		}
 	} catch (e) {
-		reportError(e, "Failed to load database info");
+		reportError(e, "Failed to fetch build logs");
 	}
 }
+//#endregion
+//#region src/commands/cloud/orgs.ts
 /**
-* `db backup [action] [filename]`, resolved in one strict parse.
-*
-* Both halves were reachable by the old operand filter, and both are
-* destructive: `rebase cloud db backup -p acme` read `--project`'s value as the
-* ACTION (falling through to a list, so the flag silently changed what ran),
-* and `db backup restore -p acme` read it as the FILENAME — a restore staged
-* over the live database, named after the project slug. An undeclared flag was
-* dropped instead of refused, which is the same failure one step quieter: `db
-* backup --dry-run` ran a list, having silently discarded the flag that was
-* supposed to change what it did.
-*
-* Exported so its tests drive the real parser.
+* `rebase cloud orgs` — list / create / members.
 */
-function resolveBackupArgs(rawArgs) {
-	const { flags, positionals } = parseCloudArgs({
-		spec: { "--yes": Boolean },
-		rawArgs,
-		commandWords: 3,
-		command: "cloud db backup",
-		maxPositionals: 2
-	});
-	return {
-		flags,
-		action: positionals[0] || "list",
-		filename: positionals[1]
-	};
+async function orgsCommand(subcommand, rawArgs) {
+	switch (subcommand) {
+		case "list":
+		case void 0:
+			await listOrgs(rawArgs);
+			break;
+		case "create":
+			await createOrg(rawArgs);
+			break;
+		case "members":
+			await listMembers(rawArgs);
+			break;
+		case "--help":
+			printOrgsHelp();
+			break;
+		default: fail(`Unknown orgs command: ${subcommand}`, "Run `rebase cloud orgs --help`.", "unknown_command");
+	}
 }
-async function backupCommand(rawArgs) {
-	const { flags: args, action, filename: backupFile } = resolveBackupArgs(rawArgs);
-	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
+async function listOrgs(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
 	try {
-		if (action === "create") {
-			const res = await client.functions.invoke("backup", {
-				projectId,
-				type: "manual"
-			}, { path: "create" });
-			if (!res.success) fail(res.error || "Backup failed.");
-			emit(() => success(`Backup created: ${res.backup?.filename ?? "(unknown)"}`), {
-				success: true,
-				backup: res.backup ?? null
-			});
-			return;
-		}
-		if (action === "restore") {
-			const filename = backupFile;
-			if (!filename) fail("Usage: rebase cloud db backup restore <filename>", void 0, "usage");
-			await confirmDestructive({
-				yes: Boolean(args["--yes"]),
-				prompt: `Restore "${filename}" over the current database for project ${projectRef}?`
-			});
-			const res = await client.functions.invoke("backup", {
-				projectId,
-				filename
-			}, { path: "restore" });
-			if (!res.success) fail(res.error || "Restore failed.");
-			emit(() => success(res.message || "Restore complete"), {
-				success: true,
-				message: res.message ?? null
-			});
-			return;
-		}
-		if (action === "status") {
-			const res = await client.functions.invoke("backup", void 0, {
-				method: "GET",
-				path: `backup-status/${projectId}`
-			});
-			emit(() => {
-				console.log("");
-				console.log(chalk.bold(`  💾 Automated backups — project ${projectRef}`));
-				console.log("");
-				keyValues([
-					["Enabled", res.enabled ? chalk.green("yes") : chalk.yellow("no")],
-					["Reason", String(res.reason ?? "")],
-					["Database type", String(res.databaseType ?? "")],
-					["Last backup", res.lastSuccessfulBackup ?? void 0],
-					["Recovery window", res.recoveryWindow ? `${res.recoveryWindow.from} → ${res.recoveryWindow.to}` : void 0]
-				]);
-				console.log("");
-			}, res);
-			return;
-		}
-		if (action === "download") {
-			const filename = backupFile;
-			if (!filename) fail("Usage: rebase cloud db backup download <filename>", void 0, "usage");
-			const res = await client.functions.invoke("backup", void 0, {
-				method: "GET",
-				path: `download/${projectId}/${encodeURIComponent(filename)}`
-			});
-			emit(() => {
-				console.log("");
-				console.log(chalk.bold(`  ${res.name}`) + chalk.gray(`  ${(res.size / 1024 / 1024).toFixed(1)} MB`));
-				console.log(`  ${chalk.cyan(res.url)}`);
-				console.log("");
-				console.log(chalk.gray("  Short-lived signed URL — fetch it with curl/wget."));
-				console.log("");
-			}, {
-				name: res.name,
-				size: res.size,
-				url: res.url
-			});
-			return;
-		}
-		const res = await client.functions.invoke("backup", void 0, {
-			method: "GET",
-			path: `list/${projectId}`
-		});
+		const orgs = (await client.data.collection("organizations").find({ limit: 100 })).data;
+		const active = getContextOrg(url);
 		emit(() => {
 			console.log("");
-			console.log(chalk.bold(`  💾 Backups — project ${projectRef}`));
+			console.log(chalk.bold("  🏢 Organizations"));
 			console.log("");
-			if (!res.backups?.length) {
-				console.log(chalk.gray("  No backups yet. Create one with `rebase cloud db backup create`."));
+			if (orgs.length === 0) {
+				console.log(chalk.gray("  You are not a member of any organization."));
 				console.log("");
 				return;
 			}
-			for (const b of res.backups) {
-				const size = b.size !== void 0 ? `${(b.size / 1024 / 1024).toFixed(1)} MB` : "";
-				console.log(`  ${chalk.bold(b.filename)}  ${chalk.gray(`${b.type ?? ""} ${size}`.trim())}`);
+			for (const o of orgs) {
+				const marker = String(o.id) === active ? chalk.green(" ●") : "  ";
+				console.log(`${marker}${chalk.bold(o.name ?? "(unnamed)")} ${chalk.gray(`[${o.id}]`)}${o.slug ? chalk.gray(`  ${o.slug}`) : ""}`);
 			}
 			console.log("");
+			note(chalk.gray("● = active organization. Switch with `rebase cloud use <id>`."));
+			console.log("");
 		}, {
-			projectId,
-			backups: res.backups ?? []
+			activeOrg: active ?? null,
+			organizations: orgs.map((o) => ({
+				id: String(o.id),
+				name: o.name ?? null,
+				slug: o.slug ?? null,
+				active: String(o.id) === active
+			}))
 		});
 	} catch (e) {
-		reportError(e, "Backup operation failed");
+		reportError(e, "Failed to list organizations");
 	}
 }
-/**
-* `rebase cloud db pitr <status|restore|cutover|discard>`.
-*
-* A PITR restore is STAGED, not applied: `restore` creates a recovered copy of
-* the database beside the live one — the application is NOT repointed and the
-* original is left running and unchanged. `cutover` is the separate, explicit
-* step that repoints the app at the recovered copy (and restarts it). `discard`
-* removes a staged copy; the server refuses to discard a copy that has been cut
-* over to (it is now the live database). Every mutating step requires `--yes` in
-* non-interactive use, and the CLI surfaces these staged semantics honestly.
-*/
-async function pitrCommand(rawArgs) {
-	const { flags: args, positionals } = parseCloudArgs({
-		spec: {
-			"--target": String,
-			"--yes": Boolean
-		},
-		rawArgs,
-		commandWords: 3,
-		command: "cloud db pitr",
-		maxPositionals: 1
+async function createOrg(rawArgs) {
+	const args = arg({
+		"--name": String,
+		"--slug": String,
+		"-n": "--name"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
 	});
-	const action = positionals[0] || "status";
-	const { client } = await requireClient(rawArgs);
-	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
+	const { client, url } = await requireClient(rawArgs);
+	const prompts = [];
+	if (!args["--name"]) {
+		requireInteractive("an organization name", "--name <name>");
+		prompts.push({
+			type: "input",
+			name: "name",
+			message: "Organization name:"
+		});
+	}
+	const answers = prompts.length ? await inquirer.prompt(prompts) : {};
+	const name = (args["--name"] || answers.name || "").trim();
+	if (!name) fail("Organization name is required.", "Pass `--name <name>`.", "input_required");
+	const slug = (args["--slug"] || slugify(name)).trim();
 	try {
-		if (action === "status") {
-			const res = await client.functions.invoke("backup", void 0, {
-				method: "GET",
-				path: `pitr-status/${projectId}`
-			});
-			emit(() => {
-				console.log("");
-				console.log(chalk.bold(`  ⏱  Point-in-time recovery — project ${projectRef}`));
-				console.log("");
-				keyValues([
-					["Available", res.available ? chalk.green("yes") : chalk.yellow("no")],
-					["First recoverable", res.firstRecoverabilityPoint ?? void 0],
-					["Last backup", res.lastSuccessfulBackup ?? void 0],
-					["Message", res.message ?? void 0]
-				]);
-				console.log("");
-			}, res);
-			return;
-		}
-		if (action === "restore") {
-			const target = args["--target"];
-			if (!target) fail("Usage: rebase cloud db pitr restore --target <ISO timestamp>", void 0, "usage");
-			await confirmDestructive({
-				yes: Boolean(args["--yes"]),
-				prompt: `Stage a point-in-time recovery of project ${projectRef} at ${target}? (stages a copy; does not repoint your app)`
-			});
-			const res = await client.functions.invoke("backup", {
-				projectId,
-				targetTime: target,
-				acknowledgeNoCutover: true
-			}, { path: "pitr-restore" });
-			emit(() => {
-				console.log("");
-				console.log(chalk.yellow(`  ⏳ ${String(res.message ?? "Recovery staged.")}`));
-				console.log(chalk.gray("  Watch progress with `rebase cloud db pitr status`, then `rebase cloud db pitr cutover --yes`."));
-				console.log("");
-			}, res);
-			return;
-		}
-		if (action === "cutover") {
-			await confirmDestructive({
-				yes: Boolean(args["--yes"]),
-				prompt: `Cut project ${projectRef} over to the staged recovery? This repoints and restarts your application.`
-			});
-			const res = await client.functions.invoke("backup", { projectId }, { path: "pitr-restore-cutover" });
-			emit(() => {
-				console.log("");
-				console.log(String(res.message ?? "Cutover requested."));
+		const created = await client.data.collection("organizations").create({
+			name,
+			slug,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		setContextOrg(url, String(created.id));
+		success(`Created organization ${chalk.bold(name)} and set it active`);
+		emit(() => {}, {
+			success: true,
+			id: String(created.id),
+			name,
+			slug,
+			setActive: true
+		});
+	} catch (e) {
+		reportError(e, "Failed to create organization");
+	}
+}
+async function listMembers(rawArgs) {
+	const { client, url } = await requireClient(rawArgs);
+	const org = getContextOrg(url);
+	if (!org) fail("No active organization.", "Run `rebase cloud use` first.", "no_org");
+	try {
+		const members = (await client.data.collection("organization-members").find({
+			where: { organization: ["==", org] },
+			limit: 200
+		})).data;
+		emit(() => {
+			console.log("");
+			console.log(chalk.bold(`  👥 Members — org ${org}`));
+			console.log("");
+			if (members.length === 0) {
+				console.log(chalk.gray("  No members found."));
 				console.log("");
-			}, res);
-			return;
-		}
-		if (action === "discard") {
-			await confirmDestructive({
-				yes: Boolean(args["--yes"]),
-				prompt: `Discard the staged recovery for project ${projectRef}? This deletes the staged copy and its storage.`
-			});
-			const res = await client.functions.invoke("backup", { projectId }, { path: "pitr-restore-discard" });
-			emit(() => success(String(res.message ?? "Staged restore discarded.")), res);
-			return;
-		}
-		fail(`Unknown pitr command: ${action}`, "Try status | restore | cutover | discard.", "usage");
+				return;
+			}
+			for (const m of members) console.log(`  ${chalk.bold(m.userId ?? "?")}  ${colorStatus(m.role)}`);
+			console.log("");
+		}, {
+			org,
+			members: members.map((m) => ({
+				id: String(m.id),
+				userId: m.userId ?? null,
+				role: m.role ?? null
+			}))
+		});
 	} catch (e) {
-		reportError(e, "PITR operation failed");
+		reportError(e, "Failed to list members");
 	}
 }
-function printDbHelp() {
-	emitHelp("db", [
+function slugify(s) {
+	return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function printOrgsHelp() {
+	emitHelp("orgs", [
 		"list",
 		"create",
-		"info",
-		"test",
-		"backup",
-		"pitr"
+		"members"
 	], () => {
 		console.log(`
-${chalk.bold("rebase cloud db")} — Database & backups
+${chalk.bold("rebase cloud orgs")} — Manage organizations
 
 ${chalk.green.bold("Commands")}
-  ${chalk.blue.bold("list")}                      List databases attached to the project
-  ${chalk.blue.bold("create")}                    Attach a managed or bring-your-own database
-  ${chalk.blue.bold("info")} ${chalk.gray("[--reveal]")}           Connection details ${chalk.gray("(password only with --reveal)")}
-  ${chalk.blue.bold("test")}                      Test database connectivity
-  ${chalk.blue.bold("backup list")}               List backups
-  ${chalk.blue.bold("backup create")}             Create a manual backup
-  ${chalk.blue.bold("backup restore")} ${chalk.gray("<file>")}     Restore a backup
-  ${chalk.blue.bold("backup status")}             Automated-backup health
-  ${chalk.blue.bold("backup download")} ${chalk.gray("<file>")}    Signed URL for a backup
-  ${chalk.blue.bold("pitr status")}               Point-in-time recovery window
-  ${chalk.blue.bold("pitr restore")} ${chalk.gray("--target <ISO>")} Stage a recovery ${chalk.gray("(does not repoint)")}
-  ${chalk.blue.bold("pitr cutover")} ${chalk.gray("-y")}           Repoint the app at the staged recovery
-  ${chalk.blue.bold("pitr discard")} ${chalk.gray("-y")}           Delete a staged recovery
-
-${chalk.green.bold("Options")}
-  ${chalk.blue("--project, -p")}             Project slug ${chalk.gray("(defaults to the linked project)")}
-  ${chalk.blue("--reveal")}                  Include the DB password ${chalk.gray("(info)")}
-  ${chalk.blue("--type")}                    managed | byodb ${chalk.gray("(create)")}
-  ${chalk.blue("--connection-string")}       External DB URL ${chalk.gray("(byodb)")}
-  ${chalk.blue("--json")}                    Machine-readable output
+  ${chalk.blue.bold("list")}              List organizations you belong to
+  ${chalk.blue.bold("create")}            Create a new organization ${chalk.gray("(--name, --slug)")}
+  ${chalk.blue.bold("members")}           List members of the active organization
 `);
 	});
 }
@@ -13832,6 +14340,208 @@ ${chalk.gray("so it works in a deploy script. To restart a workload, use `rebase
 	});
 }
 //#endregion
+//#region src/commands/cloud/action-help.ts
+/**
+* Per-action help for `rebase cloud`.
+*
+* `--help` was already answered centrally, but only per *group*: `rebase cloud
+* projects create --help` and `rebase cloud deploy --help` both fell through to
+* the index page, which lists groups and no flags at all. So the flags that
+* decide what those commands do — `--name`, `--subdomain`, `--type`, `--bundle`
+* — had no discoverable spelling anywhere. The way they were found on a real
+* first deploy was by reading `dist/index.es.js.map`. An agent cannot do that,
+* and neither should a person.
+*
+* Two rules hold this file honest:
+*
+*  1. **The spec is the source of truth, not this page.** `action-help.test.ts`
+*     pairs every entry with the `arg` spec its command actually parses and
+*     asserts they agree in both directions. A flag added to a command without
+*     a line here is a failing test, not a page that is quietly a year old.
+*     The pairing lives in the test rather than here on purpose: importing the
+*     command modules to describe them would make `--help` depend on the code
+*     it is meant to be readable without.
+*  2. **It answers in the reader's language.** Like every other page in this
+*     family it goes through `emitHelp`, so a piped `--help` is a structured
+*     description of the command rather than sixty lines of ANSI to scrape.
+*/
+/**
+* Flags every cloud command accepts, documented once.
+*
+* Excluded from the spec comparison below — they are merged in by
+* `parseCloudArgs` for every command in the family, so repeating them per entry
+* would be nine copies of the same four lines.
+*/
+var GLOBAL_HELP_FLAGS = [
+	["--project, -p <slug>", "Operate on a project without linking this directory"],
+	["--json", "Machine-readable output (also when piped, or REBASE_JSON=1)"],
+	["--url <origin>", "Target a specific control plane (or REBASE_CLOUD_URL)"],
+	["--yes, -y", "Skip confirmation prompts"],
+	["--debug", "Print the untouched error body after a failure"]
+];
+var ACTION_HELP = {
+	projects: {
+		command: "cloud projects",
+		usage: "cloud projects <list|create|info|delete> [options]",
+		summary: "List, create, inspect and delete projects in the selected organization.",
+		flags: [],
+		examples: [
+			"rebase cloud projects list",
+			"rebase cloud projects create --help",
+			"rebase cloud projects info shop",
+			"rebase cloud projects delete shop --yes"
+		]
+	},
+	clusters: {
+		command: "cloud clusters",
+		usage: "cloud clusters [list|add|verify] [options]",
+		summary: "The compute clusters tenants run on. Platform-admin only.",
+		flags: [],
+		examples: [
+			"rebase cloud clusters",
+			"rebase cloud clusters verify <cluster-id> --baseline",
+			"rebase cloud clusters add --name gke-eu --provider gcp --region europe-west1 --kubeconfig ./kubeconfig"
+		]
+	},
+	"projects create": {
+		command: "cloud projects create",
+		usage: "cloud projects create --name <name> --subdomain <slug> [options]",
+		summary: "Create a project. Unless --db says otherwise a managed database is attached in the same call, because a project without one can never deploy — it sits at status \"provisioning\" indefinitely, and that word does not mean work is underway.",
+		flags: [
+			["--name, -n <name>", "Display name. Required (prompted only on a terminal)"],
+			["--subdomain <slug>", "The <slug>.rebase.website host. Required, and not editable afterwards"],
+			["--db <managed|byodb|none>", "Which database to attach. Default: managed"],
+			["--connection-string <url>", "The PostgreSQL URL, for --db byodb"],
+			["--org <id>", "Organization to create it in (default: the selected one)"],
+			["--link", "Link this directory to the new project"],
+			["--repo <url>", "Git repository to build from"],
+			["--branch <name>", "Git branch. Default: main"],
+			["--provider <gcp|hetzner|…>", "Where to run it (default: the platform's target)"],
+			["--region <region>", "Region within the provider"],
+			["--cpu <n>", "vCPU per instance"],
+			["--memory <size>", "Memory per instance, e.g. 512Mi"],
+			["--replicas <n>", "Instance count"],
+			["--spot <true|false>", "Run on preemptible capacity"],
+			["--scale-to-zero <true|false>", "Stop the instances when idle"],
+			["--db-mode <mode>", "Database topology dial"],
+			["--db-instances <n>", "Database instance count"],
+			["--db-cpu <n>", "vCPU per database instance"],
+			["--db-memory <size>", "Memory per database instance"],
+			["--storage <size>", "Database volume size"]
+		],
+		examples: [
+			"rebase cloud projects create --name \"Shop\" --subdomain shop --link",
+			"rebase cloud projects create --name Shop --subdomain shop --db none",
+			"rebase cloud projects create --name Shop --subdomain shop --db byodb --connection-string \"$DATABASE_URL\""
+		],
+		notes: ["The subdomain cannot be changed in passing later — a typo here is a new project.", "A managed database is created at the project's FIRST DEPLOY, not here."]
+	},
+	"db create": {
+		command: "cloud db create",
+		usage: "cloud db create --type <managed|byodb> [options]",
+		summary: "Attach a database to the project. Required before the first deploy: a project with no database stays at status \"provisioning\" forever, waiting for this command. `rebase cloud projects create` now does it for you unless you passed --db none.",
+		flags: [
+			["--type <managed|byodb>", "Platform-provisioned Postgres, or your own"],
+			["--connection-string <url>", "The PostgreSQL URL, for --type byodb"],
+			["--wait", "Wait for the database to answer (byodb only — see below)"],
+			["--timeout <seconds>", "Ceiling on --wait. Default: 300"]
+		],
+		examples: ["rebase cloud db create --type managed", "rebase cloud db create --type byodb --connection-string \"$DATABASE_URL\" --wait"],
+		notes: [
+			"A managed database is CloudNativePG in a shared in-cluster pool, and it is created at the project's first deploy. There is nothing to poll before then, so --wait says so and returns rather than looping.",
+			"`rebase cloud db test` legitimately fails before the first deploy.",
+			"A project has exactly one database — attaching a second is refused, because the platform reads one row and it becomes undefined which it deploys against."
+		]
+	},
+	deploy: {
+		command: "cloud deploy",
+		usage: "cloud deploy [app] [options]",
+		summary: "Deploy an app of the linked project and follow the build to a terminal state, exiting non-zero if it failed. With no app named, the repository's backend is deployed.",
+		flags: [
+			["--wait", "Follow to a terminal state. Already the default; here to be explicit"],
+			["--timeout <seconds>", "Ceiling on the follow. Default: 900"],
+			["--no-follow", "Return as soon as the build is triggered"],
+			["--message, -m <text>", "Label the release"],
+			["--bundle", "Force a managed-bundle deploy (the default for runtime: managed)"],
+			["--bundle-dir <path>", "Deploy a bundle that is already built"],
+			["--source <path>", "Upload this directory and build a container image from it"],
+			["--skip-type-check", "Compile without type checking, as `rebase build` does"],
+			["--force", "Leave the managed runtime on purpose (ejects to a container image)"]
+		],
+		examples: [
+			"rebase cloud deploy",
+			"rebase cloud deploy web --message \"add search\"",
+			"rebase cloud deploy --timeout 300 --json"
+		],
+		notes: ["A project whose rebase.json declares runtime: managed deploys a bundle without --bundle.", "--source on a managed project is refused: it would swap the project onto a container image."]
+	},
+	logs: {
+		command: "cloud logs",
+		usage: "cloud logs [--runtime] [--follow]",
+		summary: "The latest build log, or the running container's log with --runtime.",
+		flags: [["--runtime", "The running app's log instead of the build log"], ["--follow, -f", "Tail a build that is still running"]],
+		examples: [
+			"rebase cloud logs",
+			"rebase cloud logs --runtime",
+			"rebase cloud logs -f"
+		]
+	},
+	status: {
+		command: "cloud status",
+		usage: "cloud status",
+		summary: "One-glance project status: URL, last deploy, runtime, database, storage — and blockedOn/nextAction, which say whether the platform is working or waiting for you.",
+		flags: [],
+		examples: ["rebase cloud status", "rebase cloud status --project shop --json"],
+		notes: ["Poll `status` only while blockedOn is null. Any other value names a command, and the state will not change until you run it."]
+	},
+	"clusters verify": {
+		command: "cloud clusters verify",
+		usage: "cloud clusters verify <cluster-id> [--baseline]",
+		summary: "Ask a registered cluster whether it can host tenants. Reports permissions.allowed and permissions.denied, which is what names a missing RBAC grant.",
+		flags: [["--baseline", "Also check ingress-nginx, cert-manager and CloudNativePG"]],
+		examples: ["rebase cloud clusters verify gke-europe-west1 --baseline"],
+		notes: ["Exits non-zero when the verdict is `unusable`, so it works as a gate."]
+	}
+};
+/** Print one action's page — human, or its JSON description when piped. */
+function printActionHelp(entry) {
+	emitHelp(entry.command, [], () => {
+		console.log("");
+		console.log(`${chalk.bold(`rebase ${entry.command}`)}`);
+		console.log("");
+		console.log(`  ${entry.summary}`);
+		console.log("");
+		console.log(chalk.green.bold("Usage"));
+		console.log(`  rebase ${chalk.blue(entry.usage.replace(/^cloud /, "cloud "))}`);
+		if (entry.flags.length > 0) {
+			console.log("");
+			console.log(chalk.green.bold("Options"));
+			for (const [flag, description] of entry.flags) console.log(`  ${chalk.blue(flag.padEnd(30))} ${description}`);
+		}
+		console.log("");
+		console.log(chalk.green.bold("Global options"));
+		for (const [flag, description] of GLOBAL_HELP_FLAGS) console.log(`  ${chalk.blue(flag.padEnd(30))} ${chalk.gray(description)}`);
+		if (entry.notes?.length) {
+			console.log("");
+			console.log(chalk.green.bold("Notes"));
+			for (const note of entry.notes) console.log(`  ${chalk.gray(`• ${note}`)}`);
+		}
+		console.log("");
+		console.log(chalk.green.bold("Examples"));
+		for (const example of entry.examples) console.log(`  ${chalk.gray(example)}`);
+		console.log("");
+	}, {
+		usage: `rebase ${entry.usage}`,
+		summary: entry.summary,
+		flags: [...entry.flags, ...GLOBAL_HELP_FLAGS].map(([flag, description]) => ({
+			flag,
+			description
+		})),
+		notes: entry.notes ?? [],
+		examples: entry.examples
+	});
+}
+//#endregion
 //#region src/commands/cloud/index.ts
 /**
 * CLI command: `rebase cloud <group> [action] [options]`
@@ -13906,6 +14616,11 @@ async function cloudCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (wantsHelp) {
+		const page = (action ? ACTION_HELP[`${group} ${action}`] : void 0) ?? ACTION_HELP[group];
+		if (page) {
+			printActionHelp(page);
+			return;
+		}
 		(GROUP_HELP[group] ?? printCloudHelp)();
 		return;
 	}
@@ -14414,7 +15129,7 @@ async function entry(args) {
 	const effectiveSubcommand = parsedArgs["--help"] && !subcommand ? "--help" : subcommand;
 	switch (command) {
 		case "__dev-db-daemon": {
-			const { parseDaemonArgs, runDaemon } = await import("./daemon-entry-Brq-S8XX.js");
+			const { parseDaemonArgs, runDaemon } = await import("./daemon-entry-CmJn83zu.js");
 			await runDaemon(parseDaemonArgs(args));
 			return;
 		}