@rebasepro/cli 0.20.0 → 0.21.0

package/dist/index.es.js

@@ -18,14 +18,15 @@ import { execa, execaCommandSync } from "execa";
 import { cp } from "fs/promises";
 import { fileURLToPath, pathToFileURL } from "url";
 import crypto from "crypto";
-import { spawn, spawnSync } from "child_process";
+import { execFileSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
 import dotenv from "dotenv";
-import { BUNDLE_FORMAT_VERSION, DEFAULT_DATA_SOURCE_KEY, DEFAULT_RESOURCE_KEY, RUNTIME_CONTRACT_VERSION, buildResourceGraph, computeSchemaVersion, declareFunction, declaredQueueConsumers, declaredResources, declaredSubscriptions, deserializeCollections, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getDataSourceCapabilities, isResourceHandle, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveResourceRefs, resourceEnvSuffix, resourceId, resourceKeyOf, resourceToDataSource } from "@rebasepro/types";
+import { BUNDLE_FORMAT_VERSION, DEFAULT_DATA_SOURCE_KEY, DEFAULT_RESOURCE_KEY, DEFAULT_STORAGE_SOURCE_KEY, RUNTIME_CONTRACT_VERSION, buildResourceGraph, computeSchemaVersion, declareFunction, declaredQueueConsumers, declaredResources, declaredSubscriptions, deserializeCollections, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getDataSourceCapabilities, isResourceHandle, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveResourceRefs, resourceEnvSuffix, resourceId, resourceKeyOf, resourceToDataSource } from "@rebasepro/types";
 import { CodegenError, generateSDK, toSafeIdentifier } from "@rebasepro/codegen";
 import { createRequire } from "module";
 import { randomBytes as randomBytes$1 } from "node:crypto";
+import net$1 from "node:net";
 //#region src/utils/version.ts
 /**
 * This CLI's own version, and the User-Agent built from it.
@@ -337,6 +338,27 @@ function credentialsPath() {
 	return path.join(os.homedir(), ".rebase", "credentials.json");
 }
 /** Project-local link file: <project>/.rebase/cloud.json */
+/**
+* The billing account an organization row points at, whichever key it arrived under.
+*
+* REST serves every column under its own property name, so the relation comes
+* back as `billingAccountId`. Both readers in this CLI checked
+* `billing_account_id` and `billingAccount` — neither is what arrives — so
+* `rebase cloud billing` answered "no billing account" for every organization,
+* and the deploy pre-check never saw an internal plan. The other two spellings
+* are still accepted: older servers and fixtures send them.
+*/
+function billingAccountIdOf(org) {
+	if (typeof org !== "object" || org === null) return void 0;
+	for (const key of [
+		"billingAccountId",
+		"billing_account_id",
+		"billingAccount"
+	]) {
+		const value = org[key];
+		if (typeof value === "string" || typeof value === "number") return value;
+	}
+}
 function projectLinkPath(cwd = process.cwd()) {
 	const root = findProjectRoot(cwd) || cwd;
 	return path.join(root, ".rebase", "cloud.json");
@@ -1175,6 +1197,45 @@ function openUrl(target, label = "Opening") {
 		child.unref();
 	} catch {}
 }
+/**
+* Read the control plane's rows as a subcommand's row shape.
+*
+* `client.data.collection(...)` is typed against the *generated* schema of the
+* project the SDK is pointed at, and the control-plane collections this CLI
+* reads are not in one — so every row arrives as an open
+* `Record<string, unknown>`. A declared `interface` gets no implicit index
+* signature, so it does not overlap that, and a direct `as` is refused: which
+* is how ten call sites came to write `as unknown as XRow[]`, an assertion
+* about a wire payload with nothing checking it in either direction.
+*
+* There is exactly one invariant to check and this checks it. Everything else
+* the shapes declare is optional and already read as such, so there is nothing
+* further to verify — but a row with no usable `id` is not a row any of these
+* commands can act on, and passing it through was how a listing came to print
+* `[undefined]` and a lookup came to compare against the string `"undefined"`.
+*/
+function cloudRows(rows) {
+	return (rows ?? []).filter((row) => typeof row?.id === "string" || typeof row?.id === "number");
+}
+/** {@link cloudRows} for an endpoint that returns a single row. */
+function cloudRow(row) {
+	return cloudRows(row ? [row] : [])[0];
+}
+/**
+* {@link cloudRows} for a write that must have produced a row.
+*
+* `create()` returning something with no usable `id` means the control plane
+* accepted the write and then described it in a way this CLI cannot act on.
+* The callers all go straight on to use that id — `setContextOrg(url,
+* String(created.id))` — so asserting the shape, which is what stood here,
+* turned a control-plane fault into an organization whose active id is the
+* seven-letter string `"undefined"`, stored in the user's config file.
+*/
+function requireCloudRow(row, what) {
+	const parsed = cloudRow(row);
+	if (!parsed) throw new Error(`The control plane accepted the ${what} but returned no id for it.`);
+	return parsed;
+}
 /** Duration in coarse bands — enough to see "slow", not enough to fingerprint. */
 function durationBucket(ms) {
 	if (!Number.isFinite(ms) || ms < 0) return "unknown";
@@ -1184,6 +1245,24 @@ function durationBucket(ms) {
 	return "120s+";
 }
 /**
+* An error reduced to something safe to transmit.
+*
+* The message and the stack are discarded, always. What survives is the
+* constructor name and, for the errors that carry one, a `code` — both of which
+* come from the program rather than from anything the user typed or named.
+* `EACCES` is useful and safe; "cannot write /Users/francesco/clients/acme" is
+* neither.
+*/
+function errorClass(error) {
+	if (error && typeof error === "object") {
+		const code = error.code;
+		if (typeof code === "string" && /^[A-Z][A-Z0-9_]{1,31}$/.test(code)) return code;
+		const name = error.name;
+		if (typeof name === "string" && /^[A-Za-z][A-Za-z0-9]{0,31}$/.test(name)) return name;
+	}
+	return "Unknown";
+}
+/**
 * Drop anything that is not a permitted value type, and clamp strings.
 *
 * The last line of defence rather than the first. Every call site is supposed
@@ -1495,33 +1574,30 @@ function renderPreview(event, properties) {
 * CI must behave exactly as it does today, which means not asking and not
 * sending.
 */
-async function promptForConsent(event, properties, options = {}) {
+async function promptForConsent(options = {}) {
 	if (!shouldPrompt(process.env, options)) return false;
 	const askedBefore = suppressionReason(process.env) === "declined";
 	try {
 		console.log("");
 		console.log(chalk.bold("Help improve Rebase?"));
 		console.log("");
-		console.log(chalk.gray("  Rebase is self-hosted, so we have no idea what works and what does not"));
-		console.log(chalk.gray("  unless you tell us. Sharing is entirely optional and off by default."));
-		console.log("");
-		console.log(chalk.gray("  This is exactly what would be sent — nothing more, ever:"));
-		console.log("");
-		console.log(renderPreview(event, properties).split("\n").map((line) => chalk.gray("    " + line)).join("\n"));
+		console.log(chalk.gray("  Rebase is self-hosted, so we only learn what works if you tell us."));
+		console.log(chalk.gray("  Anonymous: random ids, the CLI version, your OS, and which template and"));
+		console.log(chalk.gray("  package manager you used. Never project names, paths, schemas, URLs or"));
+		console.log(chalk.gray("  error messages."));
 		console.log("");
-		console.log(chalk.gray("  No project names, paths, schemas, URLs or error messages. Change your"));
-		console.log(chalk.gray(`  mind any time with ${chalk.cyan("rebase telemetry disable")}.`));
+		console.log(chalk.gray(`  Print the exact payload with ${chalk.cyan("rebase telemetry show")}; change your mind`));
+		console.log(chalk.gray(`  any time with ${chalk.cyan("rebase telemetry disable")}.`));
 		if (askedBefore) {
 			console.log("");
-			console.log(chalk.gray("  You declined before, and that is still the answer unless you change it"));
-			console.log(chalk.gray("  here. Asked once per new project; never during ordinary work."));
+			console.log(chalk.gray("  You declined before; that stands unless you change it here."));
 		}
 		console.log("");
 		const { accepted } = await inquirer.prompt([{
 			type: "confirm",
 			name: "accepted",
 			message: "Share anonymous usage data?",
-			default: false
+			default: true
 		}]);
 		setConsent(Boolean(accepted));
 		console.log(accepted ? chalk.green("  Thank you — sharing enabled.") : chalk.gray("  Nothing will be sent." + (options.reAskDeclined ? " You will be asked again the next time you scaffold a project." : " You will not be asked again.")));
@@ -1626,11 +1702,6 @@ var PRESET_CHOICES = [
 		short: "Blank"
 	}
 ];
-/**
-* Builds the interactive prompt questions for `rebase init`.
-* Exported for testability — all prompt `type` values must match
-* types registered by the installed version of inquirer.
-*/
 function buildInitQuestions(params) {
 	const { nameArg, templateArg, headlessArg, hasGitFlag, hasInstallFlag, pm } = params;
 	const questions = [];
@@ -2124,7 +2195,7 @@ async function createProject$1(options) {
 		git: Boolean(options.git),
 		duration: durationBucket(Date.now() - startedAt)
 	};
-	if (await promptForConsent("cli.init", initProperties, { reAskDeclined: true })) await recordEvent("cli.init", initProperties, { projectRoot: options.targetDirectory });
+	if (await promptForConsent({ reAskDeclined: true })) await recordEvent("cli.init", initProperties, { projectRoot: options.targetDirectory });
 }
 /**
 * Apply a template preset by replacing the default collection files.
@@ -4403,6 +4474,38 @@ function checkAppPath(value, fieldPath, issues) {
 	}
 	return value;
 }
+/**
+* Is `candidate` the path `parent`, or something beneath it?
+*
+* Segment-aware for the same reason `isForbiddenStaticPath` is: a plain
+* `startsWith` reads `/admin` as living under `/adm`.
+*/
+function isUnderPath(candidate, parent) {
+	if (parent === "/") return true;
+	return candidate === parent || candidate.startsWith(`${parent}/`);
+}
+/**
+* Validate where an app says it mounts the Rebase CMS.
+*
+* The same shape as {@link checkAppPath} — it is a URL path and ends up in the
+* same places — plus one rule of its own: it has to be inside the app declaring
+* it. The app's SPA fallback is what answers that URL, so a `cms` outside its
+* `path` names an address this app will never serve. That is a link the console
+* would then offer to a 404, which is worse than the missing link it replaces.
+*/
+function checkCmsPath(value, appPath, fieldPath, issues) {
+	if (value === void 0) return void 0;
+	const cms = checkAppPath(value, fieldPath, issues);
+	if (cms === void 0) return void 0;
+	if (!isUnderPath(cms, appPath)) {
+		issues.push({
+			path: fieldPath,
+			message: `must be inside this app's path — it is at "${appPath}", so it cannot serve "${cms}". The CMS is a route of this app, not a separate deployment; if it really lives elsewhere, declare that app and put \`cms\` on it instead`
+		});
+		return;
+	}
+	return cms;
+}
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4412,8 +4515,25 @@ function isRecord(value) {
 * A manifest is committed and reviewed, so this is not a security boundary so
 * much as a guard against `../../` typos that would otherwise have `rebase build`
 * writing outside the project.
-*/
-function checkRelativePath(value, fieldPath, issues, { required }) {
+*
+* `mayEscape` is for `context`, and only for `context`. Every other path here
+* names something Rebase *reads* — collections, functions, the generated
+* schema, the built assets to serve — and those have to be inside the project
+* or the bundle cannot carry them. A Docker build context is the one field that
+* names something Rebase never opens: it is handed to `docker build`, and in
+* any workspace repository the thing it has to name is the workspace root,
+* above the app. That is not exotic. It is what pnpm, turbo and nx layouts all
+* look like, and it is what this repository's own reference project needs — its
+* Dockerfile's first instruction copies `pnpm-lock.yaml`, which does not exist
+* beside `rebase.json` and never will.
+*
+* Refusing it did not prevent the escape; it only stopped anyone declaring it.
+* `app/rebase.json` built from the monorepo root the whole time — via
+* `infra/cloudbuild.yaml`, which says `-f app/backend/Dockerfile .` — while the
+* manifest said the context was `app/` and `rebase build` printed a command
+* that dies on its first `COPY`.
+*/
+function checkRelativePath(value, fieldPath, issues, { required, mayEscape = false }) {
 	if (value === void 0) {
 		if (required) issues.push({
 			path: fieldPath,
@@ -4436,7 +4556,7 @@ function checkRelativePath(value, fieldPath, issues, { required }) {
 		return;
 	}
 	const normalized = path.normalize(value);
-	if (normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+	if (!mayEscape && (normalized === ".." || normalized.startsWith(`..${path.sep}`))) {
 		issues.push({
 			path: fieldPath,
 			message: "must stay inside the project directory"
@@ -4465,7 +4585,8 @@ var KNOWN_APP_FIELDS = {
 		"build",
 		"output",
 		"path",
-		"spa"
+		"spa",
+		"cms"
 	]
 };
 /**
@@ -4570,14 +4691,28 @@ function validateApp(name, raw, issues) {
 				message: "only applies to a custom runtime — set \"runtime\": \"custom\" to build your own image"
 			});
 			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
-			checkRelativePath(raw.context, `${base}.context`, issues, { required: false });
+			checkRelativePath(raw.context, `${base}.context`, issues, {
+				required: false,
+				mayEscape: true
+			});
 			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
 				path: `${base}.port`,
 				message: "must be an integer"
 			});
-			return raw;
+			return {
+				type: "backend",
+				runtime: custom ? "custom" : "managed",
+				config: raw.config,
+				functions: raw.functions,
+				crons: raw.crons,
+				schema: raw.schema,
+				usersCollection: raw.usersCollection,
+				dockerfile: raw.dockerfile,
+				context: raw.context,
+				port: raw.port
+			};
 		}
-		case "static":
+		case "static": {
 			checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
 			checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
 			if (raw.build !== void 0 && typeof raw.build !== "string") issues.push({
@@ -4588,8 +4723,18 @@ function validateApp(name, raw, issues) {
 				path: `${base}.spa`,
 				message: "must be a boolean"
 			});
-			checkAppPath(raw.path, `${base}.path`, issues);
-			return raw;
+			const appPath = checkAppPath(raw.path, `${base}.path`, issues);
+			checkCmsPath(raw.cms, appPath ?? "/", `${base}.cms`, issues);
+			return {
+				type: "static",
+				root: raw.root,
+				build: raw.build,
+				output: raw.output,
+				path: appPath,
+				spa: raw.spa,
+				cms: raw.cms
+			};
+		}
 		default: return;
 	}
 }
@@ -4656,6 +4801,11 @@ function validateManifest(raw) {
 		}
 		byPath.set(at, name);
 	}
+	const withCms = Object.entries(apps).filter(([, app]) => app.type === "static" && typeof app.cms === "string");
+	if (withCms.length > 1) for (const [name] of withCms.slice(1)) issues.push({
+		path: `apps.${name}.cms`,
+		message: `a project has one CMS — "${withCms[0][0]}" already declares one`
+	});
 	refuseStorageBlock(raw.storage, issues);
 	let telemetry;
 	if (raw.telemetry !== void 0) if (typeof raw.telemetry === "boolean") telemetry = raw.telemetry;
@@ -4838,6 +4988,30 @@ function findBackendApp(manifest) {
 	};
 }
 /**
+* Where this project mounts the Rebase CMS, if it says.
+*
+* The CMS is a component inside a developer's own app, so its address is a
+* client-side route: no build artifact, no running server and no control plane
+* can observe it. {@link RebaseStaticAppConfig.cms} is the only place that fact
+* is ever written down, and this is the one reader of it — so that "the
+* project's CMS" means the same thing to `rebase dev`, `rebase apps list`, the
+* bundle it builds and the console that shows it.
+*
+* Returns the *serving* app alongside the path, because a caller with a base URL
+* needs to know which app answers there — and because the path alone cannot say
+* whether the CMS is the whole of an app or one route of it.
+*/
+function cmsMountOf(manifest) {
+	for (const [name, app] of Object.entries(manifest.apps)) {
+		if (app.type !== "static" || typeof app.cms !== "string") continue;
+		return {
+			appName: name,
+			app,
+			path: app.cms
+		};
+	}
+}
+/**
 * The app a deploy targets: the one named, or the obvious one.
 *
 * A repository declares apps; a project owns them. So "which app" is a question
@@ -5634,14 +5808,21 @@ async function devCommand(rawArgs) {
 	* a shape that has no such directory reads as a broken scaffold on the
 	* very first run of the very command the headless quickstart names.
 	*/
-	const declaresStaticApp = (() => {
+	const staticShape = (() => {
 		try {
 			const { manifest } = loadManifest(projectRoot);
-			return Object.values(manifest.apps ?? {}).some((app) => app.type === "static");
+			return {
+				declaresStaticApp: Object.values(manifest.apps ?? {}).some((app) => app.type === "static"),
+				cmsPath: cmsMountOf(manifest)?.path
+			};
 		} catch {
-			return Boolean(frontendDir);
+			return {
+				declaresStaticApp: Boolean(frontendDir),
+				cmsPath: void 0
+			};
 		}
 	})();
+	const declaresStaticApp = staticShape.declaresStaticApp;
 	let frontendUrl = "";
 	let backendUrl = "";
 	let debounceSummary = null;
@@ -5681,6 +5862,7 @@ async function devCommand(rawArgs) {
 				["✦ Rebase API is ready!", ""],
 				["➜ API:      ", api]
 			];
+			if (declaresStaticApp && staticShape.cmsPath && staticShape.cmsPath !== "/") lines.push(["➜ CMS:   ", `${stripAnsi(frontendUrl).replace(/\/$/, "")}${staticShape.cmsPath}`]);
 			if (!declaresStaticApp) {
 				if (swaggerPath) lines.push(["➜ Swagger:  ", `${api}${swaggerPath}`]);
 				else lines.push(["  ", "(no tables served yet, so no data API and no docs)"]);
@@ -7797,7 +7979,7 @@ function vendorDependencies(options) {
 * in one image already, that is exactly what it had.
 */
 function foldStaticIntoBundle(options) {
-	const { bundleDir, assetsDir, appName, path: basePath, spa } = options;
+	const { bundleDir, assetsDir, appName, path: basePath, spa, cms } = options;
 	const manifestPath = path.join(bundleDir, "manifest.json");
 	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);
 	if (!fs.existsSync(assetsDir)) throw new Error(`No built assets at ${assetsDir}.`);
@@ -7822,7 +8004,9 @@ function foldStaticIntoBundle(options) {
 		static: [...existing, {
 			path: basePath,
 			dir,
-			spa
+			spa,
+			name: appName,
+			...cms ? { cms } : {}
 		}]
 	};
 	fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
@@ -7857,7 +8041,9 @@ function buildStaticBundle(options) {
 		entry: { static: [{
 			path: basePath,
 			dir: "static",
-			spa: options.spa ?? true
+			spa: options.spa ?? true,
+			name: appName,
+			...options.cms ? { cms: options.cms } : {}
 		}] },
 		hooks: { native: false },
 		deps: { declared: {} },
@@ -7989,7 +8175,8 @@ function foldableApps(manifest) {
 			build: app.build,
 			output: app.output,
 			path: app.path ?? "/",
-			spa: app.spa ?? true
+			spa: app.spa ?? true,
+			cms: app.cms
 		});
 	}
 	apps.sort((a, b) => b.path.length - a.path.length);
@@ -8109,7 +8296,8 @@ async function foldFrontendIntoBundle(options) {
 			assetsDir,
 			appName: app.name,
 			path: app.path,
-			spa: app.spa
+			spa: app.spa,
+			cms: app.cms
 		});
 		outcomes.push({
 			appName: app.name,
@@ -8621,6 +8809,42 @@ ${chalk.bold("Examples")}
   rebase build web             Build only the "web" static app
 `.trim());
 }
+/**
+* The two commands that turn a custom-runtime app into an image.
+*
+* Exported for the test, because the failure this replaced was in the printed
+* text and nowhere else. It said:
+*
+*     docker build -f backend/Dockerfile .
+*
+* for every custom backend, and the `.` was a guess — `context` was validated,
+* stored on the config, and read by nothing. For the reference project that
+* guess is wrong: `app/backend/Dockerfile` opens by copying `pnpm-lock.yaml`
+* and `pnpm-workspace.yaml`, which live at the monorepo root, so the command
+* `rebase build` handed you died on its first instruction. The deploy that
+* actually works, `infra/cloudbuild.yaml`, has always said
+* `-f app/backend/Dockerfile .` from the root.
+*
+* `dockerfile` is relative to `rebase.json`; `context` is too, and may point
+* above it. Docker resolves `-f` against the working directory, not the
+* context, so the path has to be re-expressed against wherever the command
+* runs — which is what the old line never did and is the whole reason it
+* could not be right for both.
+*/
+function dockerBuildHint(projectRoot, name, app) {
+	const dockerfile = app.dockerfile ?? "Dockerfile";
+	const context = app.context ?? ".";
+	const contextDir = path.resolve(projectRoot, context);
+	const fromContext = path.relative(contextDir, path.resolve(projectRoot, dockerfile));
+	const build = `${chalk.cyan(`npm run build --workspace ${name}`)}`;
+	if (fromContext.startsWith("..")) return [
+		chalk.dim(`    ${build}`),
+		chalk.yellow(`    ⚠ ${dockerfile} is outside the build context (${context}) — nothing it COPYs is reachable.`),
+		chalk.dim(`      Widen "context" in rebase.json, or move the Dockerfile inside it.`)
+	];
+	const docker = chalk.cyan(`docker build -f ${fromContext} .`);
+	return context === "." ? [chalk.dim(`    ${build}  then  ${docker}`)] : [chalk.dim(`    ${build}`), chalk.dim(`    ${chalk.cyan(`cd ${context}`)} && ${docker}`)];
+}
 async function buildCommand(rawArgs = []) {
 	if (wantsHelp(rawArgs)) {
 		printHelp$5();
@@ -8684,7 +8908,7 @@ async function buildCommand(rawArgs = []) {
 		console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));
 		if (app.type === "backend" && app.runtime === "custom") {
 			console.log(chalk.dim("  custom runtime — this project builds its own image, not a bundle"));
-			console.log(chalk.dim(`    ${chalk.cyan(`npm run build --workspace ${name}`)}  then  ${chalk.cyan(`docker build -f ${app.dockerfile ?? "Dockerfile"} .`)}`));
+			for (const line of dockerBuildHint(projectRoot, name, app)) console.log(line);
 			console.log("");
 			continue;
 		}
@@ -8821,7 +9045,8 @@ async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride)
 		outDir: outOverride ? path.resolve(process.cwd(), outOverride) : path.join(projectRoot, `dist-bundle-${name}`),
 		runtimeRange,
 		path: basePath,
-		spa: asset.spa ?? true
+		spa: asset.spa ?? true,
+		cms: asset.cms
 	});
 	const rel = path.relative(projectRoot, result.outDir);
 	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s) → served at ${basePath})`));
@@ -8875,8 +9100,19 @@ function findCliRoot(from) {
 	}
 	return null;
 }
-/** The block names the payload may switch on. A typo has to be an error. */
+/**
+* The block names the payload may switch on. A typo has to be an error.
+*
+* Typed as keys of {@link ProjectShape}, which is what makes that true: `as
+* const` alone gave these two string literals and tied them to nothing, so a
+* flag renamed on the interface left this list naming a block that no longer
+* exists, and the template kept switching on it.
+*/
 var SHAPE_FLAGS = ["collections", "frontend"];
+/** Narrow a marker name to a flag, having checked it is one. */
+function isShapeFlag(name) {
+	return SHAPE_FLAGS.includes(name);
+}
 /**
 * Render one payload file for this project.
 *
@@ -8900,7 +9136,6 @@ var SHAPE_FLAGS = ["collections", "frontend"];
 * typechecker would see.
 */
 function renderPayload(contents, shape, projectName) {
-	const flags = shape;
 	const out = [];
 	let open = null;
 	for (const line of contents.split("\n")) {
@@ -8916,10 +9151,10 @@ function renderPayload(contents, shape, projectName) {
 			continue;
 		}
 		if (open) throw new Error(`Eject template: {{${kind}${name}}} inside an open ${open.name} block.`);
-		if (!SHAPE_FLAGS.includes(name)) throw new Error(`Eject template: unknown block {{${kind}${name}}}.`);
+		if (!isShapeFlag(name)) throw new Error(`Eject template: unknown block {{${kind}${name}}}.`);
 		open = {
 			name,
-			keep: kind === "#" ? flags[name] === true : flags[name] !== true
+			keep: kind === "#" ? shape[name] === true : shape[name] !== true
 		};
 	}
 	if (open) throw new Error(`Eject template: {{#${open.name}}} was never closed.`);
@@ -9004,13 +9239,6 @@ async function ejectCommand(rawArgs = []) {
 	const dryRun = Boolean(args["--dry-run"]);
 	const force = Boolean(args["--force"]);
 	const requested = positionals[0];
-	if (requested === "infra") {
-		console.error(chalk.red("  ✗ `rebase eject infra` has been removed."));
-		console.error(chalk.gray("    It wrote rebase.infra.json, which nothing ever read. Resources bind"));
-		console.error(chalk.gray("    from the environment on the <BASE>__<KEY> convention; declare them in"));
-		console.error(chalk.gray("    config/resources.ts and see `rebase resources` for the names."));
-		process.exit(1);
-	}
 	let loaded;
 	try {
 		loaded = loadManifest(projectRoot);
@@ -11735,8 +11963,11 @@ function printPayload() {
 		console.log("");
 		console.log(`  ${describeState()}`);
 		console.log("");
-		console.log(chalk.gray("  Nothing is being sent, so there is no payload to show."));
-		console.log(chalk.gray(`  Run ${chalk.cyan("rebase telemetry enable")} first if you want to inspect one.`));
+		console.log(chalk.gray("  Nothing is being sent. This is what WOULD be sent if you said yes:"));
+		console.log("");
+		console.log(renderPreview("cli.dev", { first_run: false }).split("\n").map((l) => "  " + l).join("\n"));
+		console.log("");
+		console.log(chalk.gray(`  Start sharing with ${chalk.cyan("rebase telemetry enable")}.`));
 		console.log("");
 		return;
 	}
@@ -11752,7 +11983,7 @@ function printPayload() {
 }
 function printHelp$2() {
 	console.log(`
-${chalk.bold("rebase telemetry")} — anonymous usage sharing (opt-in, off by default)
+${chalk.bold("rebase telemetry")} — anonymous usage sharing (asked once per project)
 
 ${chalk.bold("Commands")}
   ${chalk.blue("status")}     Whether anything is being shared, and why ${chalk.gray("(default)")}
@@ -12039,10 +12270,10 @@ async function linkCommand(rawArgs) {
 		} else {
 			requireInteractive("a project to link", "--project <slug>");
 			const org = getContextOrg(url);
-			const projects = (await client.data.collection("projects").find({
+			const projects = cloudRows((await client.data.collection("projects").find({
 				where: org ? { organization: ["==", org] } : void 0,
 				limit: 100
-			})).data;
+			})).data);
 			if (projects.length === 0) fail("No projects found for your account.", `Create one with ${chalk.bold("rebase cloud projects create")}.`, "no_projects");
 			const { picked } = await inquirer.prompt([{
 				type: "select",
@@ -12506,14 +12737,14 @@ async function webhooksCommand(subcommand, rawArgs) {
 			const table = args["--table"] || fail("--table is required.", void 0, "usage");
 			const url = args["--endpoint"] || fail("--endpoint is required.", "Where the POST goes.", "usage");
 			const events = (args["--events"] || "insert,update,delete").split(",").map((s) => s.trim());
-			const created = await client.data.collection("webhooks").create({
+			const created = requireCloudRow(await client.data.collection("webhooks").create({
 				project: projectId,
 				name,
 				table,
 				url,
 				events,
 				enabled: true
-			});
+			}), "webhook");
 			success(`Created webhook ${chalk.bold(name)} [${created.id}]`);
 			emit(() => {}, {
 				success: true,
@@ -12606,15 +12837,22 @@ async function storageCommand(action, rawArgs) {
 				return;
 			}
 			for (const s of stores) {
-				console.log(`  ${chalk.bold(s.bucketName ?? s.type ?? "bucket")} ${chalk.gray(`[${s.id}]`)} ${colorStatus(s.status)}`);
-				keyValues([["Provider", s.provider], ["Type", s.type]]);
+				const name = s.bucketName || s.s3Bucket || "(no bucket)";
+				const key = s.sourceKey || DEFAULT_STORAGE_SOURCE_KEY;
+				console.log(`  ${chalk.bold(name)} ${chalk.gray(`[${s.id}]`)} ${colorStatus(s.status)}`);
+				keyValues([
+					["Source", key],
+					["Provider", s.provider],
+					["Type", s.type]
+				]);
 			}
 			console.log("");
 		}, {
 			projectId,
 			stores: stores.map((s) => ({
 				id: String(s.id),
-				bucketName: s.bucketName ?? null,
+				sourceKey: s.sourceKey || DEFAULT_STORAGE_SOURCE_KEY,
+				bucketName: s.bucketName || s.s3Bucket || null,
 				type: s.type ?? null,
 				provider: s.provider ?? null,
 				status: s.status ?? null
@@ -12646,7 +12884,8 @@ function printStorageHelp() {
 					["--secret-access-key <s>", "Secret access key. Required"],
 					["--endpoint <url>", "S3 endpoint. Omit for AWS"],
 					["--region <region>", "Region"],
-					["--force-path-style", "Required by MinIO and some gateways"]
+					["--force-path-style", "Required by MinIO and some gateways"],
+					["--source <key>", "Which declared bucket. Default: the default one"]
 				]
 			}
 		],
@@ -12671,11 +12910,10 @@ async function storageCreateCommand(rawArgs) {
 	try {
 		noteBlank();
 		note(chalk.gray("Provisioning managed storage — this creates a bucket and its credentials..."));
-		const res = await client.functions.invoke("storage-provision", void 0, {
+		const info = (await client.functions.invoke("storage-provision", void 0, {
 			method: "POST",
 			path: projectId
-		});
-		const info = res.data ?? res.data;
+		})).data;
 		success(`Managed storage provisioned for ${displayProjectRef(rawArgs)}.`);
 		emit(() => {
 			keyValues([
@@ -12710,7 +12948,8 @@ async function storageAttachCommand(rawArgs) {
 			"--secret-access-key": String,
 			"--endpoint": String,
 			"--region": String,
-			"--force-path-style": Boolean
+			"--force-path-style": Boolean,
+			"--source": String
 		},
 		rawArgs,
 		commandWords: 3,
@@ -12728,13 +12967,18 @@ async function storageAttachCommand(rawArgs) {
 	if (missing.length > 0) fail(`Missing ${missing.join(", ")}.`, "A bucket without credentials cannot be used, and would be stored as though it could. Run `rebase cloud storage --help` for the full list.", "usage");
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
+	const sourceKey = (parsed["--source"] ?? "").trim() || DEFAULT_STORAGE_SOURCE_KEY;
 	try {
 		const existing = (await client.data.collection("storages").find({
 			where: { project: ["==", projectId] },
-			limit: 1
-		})).data[0];
+			limit: 50
+		})).data.find((r) => {
+			const key = r.sourceKey;
+			return (typeof key === "string" && key ? key : DEFAULT_STORAGE_SOURCE_KEY) === sourceKey;
+		});
 		const row = {
 			project: projectId,
+			sourceKey,
 			type: "byos",
 			status: "active",
 			s3Bucket: bucket,
@@ -13065,8 +13309,7 @@ async function billingCommand(rawArgs) {
 	}
 	if (!org) fail("No active organization.", "Run `rebase cloud use` first.", "no_org");
 	try {
-		const orgRow = await client.data.collection("organizations").findById(org);
-		const billingId = orgRow?.billing_account_id ?? orgRow?.billingAccount;
+		const billingId = billingAccountIdOf(await client.data.collection("organizations").findById(org));
 		if (!billingId) {
 			emit(() => {
 				console.log("");
@@ -13154,7 +13397,6 @@ var DIAL_FLAGS = {
 	"--replicas": "replicaCount",
 	"--spot": "preemptible",
 	"--scale-to-zero": "scaleToZero",
-	"--db-mode": "databaseMode",
 	"--db-instances": "databaseInstances",
 	"--db-cpu": "databaseCpu",
 	"--db-memory": "databaseMemory",
@@ -13246,7 +13488,6 @@ async function computeCommand(action, rawArgs) {
 					true: "scale to zero",
 					false: "stay warm"
 				})],
-				["Database", dialLine(project.databaseMode)],
 				["Database instances", dialLine(project.databaseInstances)],
 				["Database CPU", dialLine(project.databaseCpu)],
 				["Database memory", dialLine(project.databaseMemory)],
@@ -13273,7 +13514,6 @@ async function computeCommand(action, rawArgs) {
 			replicaCount: project.replicaCount ?? null,
 			preemptible: project.preemptible ?? null,
 			scaleToZero: project.scaleToZero ?? null,
-			databaseMode: project.databaseMode ?? null,
 			databaseInstances: project.databaseInstances ?? null,
 			databaseCpu: project.databaseCpu ?? null,
 			databaseMemory: project.databaseMemory ?? null,
@@ -13355,6 +13595,227 @@ function buildDialPatch(rawArgs, opts) {
 	return { patch };
 }
 //#endregion
+//#region src/commands/cloud/db-connect.ts
+/**
+* `rebase cloud db connect` — a local port that is your cloud database.
+*
+* ## What this replaces
+*
+* A managed database lives in a namespace of the platform's cluster, and its
+* address (`postgres-rw.rebase-tenant-….svc.cluster.local`) resolves to nothing
+* on a developer's machine. The console used to bridge that gap by printing
+*
+*     kubectl port-forward svc/postgres-rw -n rebase-tenant-… 5432:5432
+*
+* which nobody outside the platform can run: a tenant of Rebase Cloud has no
+* kubeconfig for our cluster, and there is no product that sells one. So the
+* platform reaches into the cluster instead, and this command is the local end
+* of that reach.
+*
+* ## How it works
+*
+* A listener on 127.0.0.1. Every TCP connection it accepts opens its own
+* WebSocket to the control plane, authenticates in-band with the console session
+* this CLI already holds, and from `ready` onwards the two are a byte pipe. The
+* database still asks for a password — the tunnel is a network path, not a
+* credential — so `psql` behaves exactly as it would against a local Postgres.
+*
+* One WebSocket per connection rather than one multiplexed socket: `psql` is one
+* connection and a pool is a handful, and per-connection sockets keep the
+* framing at "these bytes are those bytes" with no stream ids to get wrong.
+*
+* Node's global `WebSocket` is used rather than `ws`, which is why the token
+* goes in the first frame instead of an `Authorization` header — the WHATWG
+* client cannot set request headers, and a header-only endpoint would be
+* unreachable from a browser too.
+*/
+/** Documented in `action-help.ts`, and paired with it by `action-help.test.ts`. */
+var DB_CONNECT_FLAGS = {
+	"--port": Number,
+	"--reveal": Boolean
+};
+/** The default, because it is what every Postgres client assumes. */
+var DEFAULT_LOCAL_PORT = 5432;
+/** `https://app.rebase.pro` → `wss://app.rebase.pro/api/db-tunnel/p1`. */
+function tunnelUrl(cloudUrl, projectId) {
+	const url = new URL(cloudUrl);
+	url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
+	url.pathname = `/api/db-tunnel/${encodeURIComponent(projectId)}`;
+	url.search = "";
+	return url.toString();
+}
+/**
+* A local DSN for the tunnel, with the password only if the caller asked.
+*
+* Built here and nowhere else. The server reports the *cluster's* URI, which is
+* the one thing that must not be printed as the way to connect — it is exactly
+* the address that does not work from here.
+*/
+function localDsn(opts) {
+	const user = opts.username ? encodeURIComponent(opts.username) : "postgres";
+	const auth = opts.password ? `${user}:${encodeURIComponent(opts.password)}` : user;
+	const database = opts.database ?? "rebase";
+	return `postgresql://${auth}@127.0.0.1:${opts.port}/${database}`;
+}
+async function dbConnect(rawArgs) {
+	const { flags: args } = parseCloudArgs({
+		spec: DB_CONNECT_FLAGS,
+		rawArgs,
+		commandWords: 3,
+		command: "cloud db connect",
+		maxPositionals: 0
+	});
+	const { client, url } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
+	let info;
+	try {
+		info = await client.functions.invoke("db-info", void 0, {
+			method: "GET",
+			path: projectId
+		});
+	} catch (e) {
+		return reportError(e, "Failed to load database info");
+	}
+	if (info.type === "byodb") fail("This project uses your own database.", "Connect to it directly — there is nothing for the platform to tunnel.", "byodb");
+	if (!info.directAccess) fail("The platform could not resolve this project's database, so it cannot open a path to it.", info.unavailableReason ?? "A managed database is provisioned at the project's first deploy; before then there is nothing to connect to.", "db_unavailable");
+	let password;
+	if (args["--reveal"]) {
+		if (!info.passwordAvailable) fail("No password is available to reveal for this database.", info.unavailableReason ?? void 0, "password_unavailable");
+		try {
+			password = (await client.functions.invoke("db-info", { projectId }, { path: "reveal" })).password;
+		} catch (e) {
+			return reportError(e, "Failed to reveal the database password");
+		}
+	}
+	const requested = args["--port"] ?? DEFAULT_LOCAL_PORT;
+	if (!Number.isInteger(requested) || requested < 0 || requested > 65535) fail(`--port must be a port number, not ${requested}.`, void 0, "bad_port");
+	const endpoint = tunnelUrl(url, projectId);
+	const server = net$1.createServer((socket) => {
+		pipeThroughTunnel(socket, endpoint, client.auth.getSession()?.accessToken ?? "");
+	});
+	server.on("error", (err) => {
+		if (err.code === "EADDRINUSE") fail(`Port ${requested} on 127.0.0.1 is already in use.`, "Pass --port to choose another, or stop whatever is listening there.", "port_in_use");
+		fail(`Could not open a local listener: ${err.message}`, void 0, "listen_failed");
+	});
+	await new Promise((resolve) => {
+		server.listen(requested, "127.0.0.1", () => resolve());
+	});
+	const address = server.address();
+	const port = address && typeof address !== "string" ? address.port : requested;
+	const dsn = localDsn({
+		port,
+		username: info.username,
+		database: info.database,
+		password
+	});
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  🔌 Tunnel open — project ${projectRef}`));
+		console.log("");
+		console.log(`  ${chalk.green(dsn)}`);
+		console.log("");
+		if (!password) {
+			console.log(chalk.gray("  The password is hidden. Re-run with --reveal to print it in the URL,"));
+			console.log(chalk.gray("  or read it with `rebase cloud db info --reveal`."));
+			console.log("");
+		}
+		console.log(chalk.gray("  Leave this running, and point any Postgres client at it."));
+		console.log(chalk.gray("  Ctrl-C closes the tunnel."));
+		console.log("");
+	}, {
+		projectId,
+		host: "127.0.0.1",
+		port,
+		database: info.database,
+		username: info.username,
+		connectionString: dsn,
+		...password ? { password } : {}
+	});
+	await new Promise((resolve) => {
+		process.once("SIGINT", () => {
+			noteBlank();
+			note(chalk.gray("Tunnel closed."));
+			server.close();
+			resolve();
+		});
+	});
+}
+/**
+* One accepted connection, carried over one WebSocket.
+*
+* The local socket is paused until the tunnel says `ready`, so a client that
+* sends its startup packet the instant it connects — which every Postgres
+* client does — cannot have those bytes arrive before there is a database to
+* send them to.
+*
+* Exported for `db-connect.pipe.test.ts`, which drives it with a real socket
+* against a real WebSocket: this is the half a developer's client actually
+* talks to, and a pipe is the one component whose bugs are silent — a dropped
+* or reordered chunk does not throw, it corrupts a Postgres message and
+* surfaces as a protocol error nowhere near here.
+*/
+function pipeThroughTunnel(socket, endpoint, token) {
+	socket.pause();
+	socket.setNoDelay(true);
+	const ws = new WebSocket(endpoint);
+	ws.binaryType = "arraybuffer";
+	let ready = false;
+	const closeBoth = (reason) => {
+		if (reason && !ready) note(chalk.red(`✗ ${reason}`));
+		try {
+			if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) ws.close();
+		} catch {}
+		socket.destroy();
+	};
+	ws.onopen = () => {
+		ws.send(JSON.stringify({
+			type: "authenticate",
+			token
+		}));
+	};
+	ws.onmessage = (event) => {
+		if (typeof event.data === "string") {
+			let frame = null;
+			try {
+				frame = JSON.parse(event.data);
+			} catch {
+				return closeBoth(`the tunnel endpoint answered with ${event.data.slice(0, 80)}`);
+			}
+			if (frame.type === "ready") {
+				ready = true;
+				socket.resume();
+				return;
+			}
+			const refusal = frame.type === "error" ? frame : null;
+			return closeBoth(refusal?.message ?? `the tunnel was refused (${refusal?.code ?? "unknown"})`);
+		}
+		socket.write(Buffer.from(event.data));
+	};
+	ws.onerror = () => {
+		closeBoth("could not reach the control plane's tunnel endpoint");
+	};
+	ws.onclose = () => {
+		socket.destroy();
+	};
+	socket.on("data", (chunk) => {
+		if (ws.readyState !== WebSocket.OPEN) return;
+		ws.send(new Uint8Array(chunk));
+		if (ws.bufferedAmount > 1024 * 1024) {
+			socket.pause();
+			const drain = setInterval(() => {
+				if (ws.readyState !== WebSocket.OPEN) return clearInterval(drain);
+				if (ws.bufferedAmount < 256 * 1024) {
+					clearInterval(drain);
+					socket.resume();
+				}
+			}, 5);
+		}
+	});
+	socket.on("close", () => closeBoth());
+	socket.on("error", () => closeBoth());
+}
+//#endregion
 //#region src/commands/cloud/databases.ts
 async function dbCommand(subcommand, rawArgs) {
 	switch (subcommand) {
@@ -13368,6 +13829,9 @@ async function dbCommand(subcommand, rawArgs) {
 		case "info":
 			await dbInfo(rawArgs);
 			break;
+		case "connect":
+			await dbConnect(rawArgs);
+			break;
 		case "test":
 			await testDatabase(rawArgs);
 			break;
@@ -13395,10 +13859,10 @@ async function listDatabases(rawArgs) {
 	const projectId = await requireProject(rawArgs, client);
 	const projectRef = displayProjectRef(rawArgs);
 	try {
-		const dbs = (await client.data.collection("databases").find({
+		const dbs = cloudRows((await client.data.collection("databases").find({
 			where: { project: ["==", projectId] },
 			limit: 50
-		})).data;
+		})).data);
 		emit(() => {
 			console.log("");
 			console.log(chalk.bold(`  🗄  Databases — project ${projectRef}`));
@@ -13435,10 +13899,10 @@ async function listDatabases(rawArgs) {
 * point, since the answer decides which row a deploy will actually use.
 */
 async function firstAttachedDatabase(client, projectId) {
-	return (await client.data.collection("databases").find({
+	return cloudRows((await client.data.collection("databases").find({
 		where: { project: ["==", projectId] },
 		limit: 1
-	})).data[0];
+	})).data)[0];
 }
 /**
 * Attach a database row to a project.
@@ -13449,12 +13913,12 @@ async function firstAttachedDatabase(client, projectId) {
 * afterwards".
 */
 async function attachDatabaseRow(client, input) {
-	return await client.data.collection("databases").create({
+	return requireCloudRow(await client.data.collection("databases").create({
 		project: input.projectId,
 		type: input.type,
 		connectionString: input.type === "byodb" ? input.connectionString : void 0,
 		connectionStatus: "untested"
-	});
+	}), "database");
 }
 /** What `rebase cloud db create` parses. Exported so its help page cannot drift. */
 var CREATE_DATABASE_FLAGS = {
@@ -13641,10 +14105,19 @@ async function dbInfo(rawArgs) {
 				["Connection", connectionString]
 			]);
 			if (info.unavailableReason) console.log(chalk.gray(`  ${info.unavailableReason}`));
-			if (info.portForward) {
-				const pf = info.portForward;
+			if (info.directAccess) {
+				console.log("");
+				console.log(chalk.gray("  The host above is inside the platform's cluster: it is the address your"));
+				console.log(chalk.gray("  deployed backend uses, and it resolves to nothing from here. To reach this"));
+				console.log(chalk.gray("  database from this machine, open a tunnel:"));
 				console.log("");
-				console.log(chalk.gray(`  Port-forward:  kubectl -n ${pf.namespace} port-forward svc/${pf.service} ${pf.localPort}:${pf.remotePort}`));
+				console.log(`    ${chalk.cyan("rebase cloud db connect")}`);
+				const pf = info.directAccess.kubectl;
+				if (pf) {
+					console.log("");
+					console.log(chalk.gray("  Or, on your own cluster:"));
+					console.log(chalk.gray(`    kubectl -n ${pf.namespace} port-forward svc/${pf.service} ${pf.localPort}:${pf.remotePort}`));
+				}
 			}
 			console.log("");
 		}, {
@@ -13655,7 +14128,7 @@ async function dbInfo(rawArgs) {
 			database: info.database,
 			username: info.username,
 			passwordAvailable: info.passwordAvailable,
-			portForward: info.portForward,
+			directAccess: info.directAccess,
 			unavailableReason: info.unavailableReason,
 			...args["--reveal"] ? {
 				password,
@@ -13941,7 +14414,13 @@ function printDbHelp() {
 				action: "info",
 				section: "Database",
 				description: "Connection details",
-				flags: [["--reveal", "Include the password. Without it, the value is masked"]]
+				flags: [["--reveal", "Include the password (owner or admin). Without it, the value is masked"]]
+			},
+			{
+				action: "connect",
+				section: "Database",
+				description: "Open a local port that IS the project's database",
+				flags: [["--port <n>", "Local port to listen on. Default: 5432"], ["--reveal", "Print the password in the connection URL"]]
 			},
 			{
 				action: "test",
@@ -14001,7 +14480,9 @@ function printDbHelp() {
 			"A project has exactly one database: `create` refuses rather than attaching a second, because",
 			"which of two rows a deploy uses is undefined.",
 			"A managed database is provisioned at the project's FIRST DEPLOY, so `test` failing before then",
-			"is not a fault."
+			"is not a fault.",
+			"The host `info` reports is inside the platform's cluster — your backend's address for it, not",
+			"one your laptop can resolve. `connect` is what makes it reachable from here."
 		]
 	});
 }
@@ -14025,7 +14506,7 @@ async function listProjects(rawArgs) {
 			where: org ? { organization: ["==", org] } : void 0,
 			orderBy: ["name", "asc"],
 			limit: 100
-		}).then((res) => res.data), fetchTenantBaseDomain(client, url)]);
+		}).then((res) => cloudRows(res.data)), fetchTenantBaseDomain(client, url)]);
 		const linkedId = readLink()?.projectId;
 		emit(() => {
 			console.log("");
@@ -14144,8 +14625,8 @@ var CREATE_PROJECT_FLAGS = {
 	* means the two-command sequence that every project needs is one command,
 	* and `--db none` is there for the case that genuinely wants to decide later.
 	*
-	* Distinct from `--db-mode`/`--db-cpu` next to it, which are resource dials
-	* on a database that exists. This is whether there is one.
+	* Distinct from `--db-cpu`/`--db-instances` next to it, which are resource
+	* dials on a database that exists. This is whether there is one.
 	*/
 	"--db": String,
 	/** For `--db byodb`. Same spelling as `rebase cloud db create` uses. */
@@ -14156,7 +14637,6 @@ var CREATE_PROJECT_FLAGS = {
 	"--replicas": String,
 	"--spot": String,
 	"--scale-to-zero": String,
-	"--db-mode": String,
 	"--db-instances": String,
 	"--db-cpu": String,
 	"--db-memory": String,
@@ -14210,7 +14690,7 @@ async function createProject(rawArgs) {
 	try {
 		const user = await client.auth.getUser();
 		if (!user) fail("Session is no longer valid.", "Run `rebase cloud login` again.", "session_invalid");
-		const created = await client.data.collection("projects").create({
+		const created = requireCloudRow(await client.data.collection("projects").create({
 			name,
 			subdomain,
 			gitRepoUrl,
@@ -14221,7 +14701,7 @@ async function createProject(rawArgs) {
 			organization: org,
 			createdById: user.uid,
 			status: "provisioning"
-		});
+		}), "project");
 		const host = projectHost(created, await fetchTenantBaseDomain(client, url));
 		const linked = Boolean(args["--link"]);
 		if (linked) writeLink({
@@ -14531,12 +15011,63 @@ function packBundle(bundleDir, outPath) {
 	});
 }
 /**
-* Assemble the deploy-trigger body for a bundle deploy.
+* The commit HEAD is on, read here because here is the only place it exists.
+*
+* A bundle deploy has no repository anywhere near the control plane: the CLI
+* builds a tarball and uploads it, so the three paths `deploy.ts` documents for
+* learning a commit — clone, `ls-remote`, or "there is no repo at all" — all
+* resolve to the third. Every bundle deployment therefore recorded an empty
+* hash, which is 291 of the 305 rows in production: a Deployments list where
+* almost nothing says what it shipped.
+*
+* But the CLI is standing IN the repository. `git -C <dir> log -1` answers
+* exactly, message included — the one thing even the git-build path cannot get
+* from `ls-remote`.
 *
-* The manifest travels with the trigger so the control plane can validate intake
-* without unpacking the uploaded archive first — a rejection (native deps, no
-* matching runtime) is then a fast, cheap answer.
+* Returns null rather than guessing, for every reason it can fail: no git, not a
+* repository, no commits yet. The server records what it is given and nothing
+* more, so null here stays `UNKNOWN_COMMIT_HASH` there.
+*
+* A dirty tree is NOT reported as a different commit. The bundle may contain
+* uncommitted work, and the honest statement about that is "built from a tree at
+* <hash>", not a fabricated identifier — the same rule the rest of this file
+* follows about inventing values.
 */
+function bundleCommit(cwd, run = gitIn(cwd)) {
+	try {
+		const hash = run([
+			"rev-parse",
+			"--short=7",
+			"HEAD"
+		]).trim();
+		if (!/^[0-9a-f]{7,40}$/.test(hash)) return null;
+		return {
+			hash,
+			message: run([
+				"log",
+				"-1",
+				"--pretty=%s"
+			]).trim()
+		};
+	} catch {
+		return null;
+	}
+}
+/** `git -C <cwd> …`, as a function, so `bundleCommit` is testable without a repo. */
+function gitIn(cwd) {
+	return (args) => execFileSync("git", [
+		"-C",
+		cwd,
+		...args
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		]
+	});
+}
 function bundleDeployBody(input) {
 	return {
 		projectId: input.projectId,
@@ -14546,7 +15077,11 @@ function bundleDeployBody(input) {
 		client: "cli",
 		frameworkVersion: input.manifest.runtime?.builtAgainst,
 		...input.declaredApps?.length ? { declaredApps: input.declaredApps } : {},
-		...input.message ? { message: input.message } : {}
+		...input.message ? { message: input.message } : {},
+		...input.commit ? {
+			gitCommitHash: input.commit.hash,
+			gitCommitMessage: input.commit.message
+		} : {}
 	};
 }
 /**
@@ -14813,7 +15348,8 @@ async function uploadAndTrigger(opts) {
 		manifest,
 		app: opts.appName,
 		message: opts.message,
-		declaredApps
+		declaredApps,
+		commit: bundleCommit(process.cwd())
 	});
 	let deploymentId;
 	let managed;
@@ -15058,8 +15594,7 @@ async function readBillingState(client, projectId) {
 		if (!card) return unknown;
 		let plan = null;
 		try {
-			const orgRow = await client.data.collection("organizations").findById(org);
-			const billingId = orgRow?.billing_account_id ?? orgRow?.billingAccount;
+			const billingId = billingAccountIdOf(await client.data.collection("organizations").findById(org));
 			if (billingId != null) {
 				const acct = await client.data.collection("billing-accounts").findById(billingId);
 				plan = typeof acct?.plan === "string" ? acct.plan : null;
@@ -15500,7 +16035,7 @@ async function listOrgs(rawArgs) {
 	});
 	const { client, url } = await requireClient(rawArgs);
 	try {
-		const orgs = (await client.data.collection("organizations").find({ limit: 100 })).data;
+		const orgs = cloudRows((await client.data.collection("organizations").find({ limit: 100 })).data);
 		const active = getContextOrg(url);
 		emit(() => {
 			console.log("");
@@ -15560,11 +16095,11 @@ async function createOrg(rawArgs) {
 	if (!name) fail("Organization name is required.", "Pass `--name <name>`.", "input_required");
 	const slug = (args["--slug"] || slugify(name)).trim();
 	try {
-		const created = await client.data.collection("organizations").create({
+		const created = requireCloudRow(await client.data.collection("organizations").create({
 			name,
 			slug,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
+		}), "organization");
 		setContextOrg(url, String(created.id));
 		success(`Created organization ${chalk.bold(name)} and set it active`);
 		emit(() => {}, {
@@ -16745,11 +17280,11 @@ function cancelView(res) {
 	};
 }
 async function fetchDeployments(client, projectId, limit = 100) {
-	return (await client.data.collection("deployments").find({
+	return cloudRows((await client.data.collection("deployments").find({
 		where: { project: ["==", projectId] },
 		orderBy: ["createdAt", "desc"],
 		limit
-	})).data;
+	})).data);
 }
 /** Hard ceiling on `--limit`, matching the backend's own page size. */
 var MAX_DEPLOYMENTS_LIMIT = 100;
@@ -17594,9 +18129,10 @@ async function dbDebugCommand(rawArgs) {
 	} catch (e) {
 		reportError(e, "Failed to read database connection info");
 	}
-	const pf = info.portForward;
-	const forwardCmd = pf ? `kubectl port-forward -n ${pf.namespace} svc/${pf.service} ${pf.localPort}:${pf.remotePort}` : null;
-	const psqlCmd = pf && info.username && info.database ? `psql -h 127.0.0.1 -p ${pf.localPort} -U ${info.username} -d ${info.database}` : null;
+	const access = info.directAccess;
+	const connectCmd = access ? "rebase cloud db connect" : null;
+	const psqlCmd = access && info.username && info.database ? `psql -h 127.0.0.1 -p 5432 -U ${info.username} -d ${info.database}` : null;
+	const kubectlCmd = access?.kubectl ? `kubectl port-forward -n ${access.kubectl.namespace} svc/${access.kubectl.service} ${access.kubectl.localPort}:${access.kubectl.remotePort}` : null;
 	emit(() => {
 		console.log("");
 		console.log(chalk.bold(`  🐘 Database — ${displayProjectRef(rawArgs)}`));
@@ -17615,12 +18151,18 @@ async function dbDebugCommand(rawArgs) {
 			["Password", info.passwordAvailable ? chalk.gray("stored — not shown here") : chalk.yellow("none stored")]
 		]);
 		console.log("");
-		if (forwardCmd) {
-			console.log(chalk.gray("  A managed database is only reachable inside its cluster. To connect:"));
+		if (connectCmd) {
+			console.log(chalk.gray("  That host is inside the platform's cluster and does not resolve here."));
+			console.log(chalk.gray("  To reach the database from this machine:"));
 			console.log("");
-			console.log(`    ${forwardCmd}`);
+			console.log(`    ${connectCmd}`);
 			if (psqlCmd) console.log(`    ${psqlCmd}`);
 			console.log("");
+			if (kubectlCmd) {
+				console.log(chalk.gray("  Or, on your own cluster:"));
+				console.log(`    ${kubectlCmd}`);
+				console.log("");
+			}
 			if (info.passwordAvailable) {
 				console.log(chalk.gray("  Get the password with:  ") + chalk.bold("rebase cloud db info --reveal"));
 				console.log("");
@@ -17633,7 +18175,8 @@ async function dbDebugCommand(rawArgs) {
 		database: info.database ?? null,
 		username: info.username ?? null,
 		passwordAvailable: Boolean(info.passwordAvailable),
-		portForwardCommand: forwardCmd,
+		connectCommand: connectCmd,
+		kubectlCommand: kubectlCmd,
 		psqlCommand: psqlCmd
 	});
 }
@@ -17932,7 +18475,6 @@ var ACTION_HELP = {
 			["--replicas <n>", "Instance count"],
 			["--spot <true|false>", "Run on preemptible capacity"],
 			["--scale-to-zero <true|false>", "Stop the instances when idle"],
-			["--db-mode <mode>", "Database topology dial"],
 			["--db-instances <n>", "Database instance count"],
 			["--db-cpu <n>", "vCPU per database instance"],
 			["--db-memory <size>", "Memory per database instance"],
@@ -17961,11 +18503,28 @@ var ACTION_HELP = {
 		],
 		examples: ["rebase cloud db create --type managed", "rebase cloud db create --type byodb --connection-string \"$DATABASE_URL\" --wait"],
 		notes: [
-			"A managed database is CloudNativePG in a shared in-cluster pool, and it is created at the project's first deploy. There is nothing to poll before then, so --wait says so and returns rather than looping.",
+			"A managed database is a CloudNativePG cluster of the project's own, in the project's own namespace and backed up on its own schedule. It is created at the project's first deploy: there is nothing to poll before then, so --wait says so and returns rather than looping.",
 			"`rebase cloud db test` legitimately fails before the first deploy.",
 			"A project has exactly one database — attaching a second is refused, because the platform reads one row and it becomes undefined which it deploys against."
 		]
 	},
+	"db connect": {
+		command: "cloud db connect",
+		usage: "cloud db connect [--port <n>] [--reveal]",
+		summary: "Open a local port that is the project's managed database, and hold it open until Ctrl-C. A managed database lives inside the platform's cluster, so the host `db info` reports is your backend's address for it and resolves to nothing on your machine; this is what makes it reachable from here. Point psql, TablePlus, Drizzle Studio or pg_dump at the URL it prints. The database still asks for its password — the tunnel is a network path, not a credential.",
+		flags: [["--port <n>", "Local port to listen on. Default: 5432"], ["--reveal", "Print the password inside the connection URL"]],
+		examples: [
+			"rebase cloud db connect",
+			"rebase cloud db connect --port 6543",
+			"rebase cloud db connect --reveal --project shop"
+		],
+		notes: [
+			"Requires the organization's owner or admin role — the same gate as the console's SQL console, because it is the same capability.",
+			"Piped or with --json it prints one object — host, port, database, username, connectionString — and keeps serving, so a script can read the URL and connect.",
+			"Connections go through the control plane, so they count against the project's own database connection limit like any other client.",
+			"Bring-your-own databases are refused: that host is already yours to reach, and there is nothing for the platform to tunnel."
+		]
+	},
 	deploy: {
 		command: "cloud deploy",
 		usage: "cloud deploy [app] [options]",
@@ -18067,7 +18626,7 @@ var ACTION_HELP = {
 			"rebase cloud db backup restore base-20260831 --yes",
 			"rebase cloud db backup download base-20260831"
 		],
-		notes: ["`restore` replaces the live database. Nothing about it is undoable from here — `--yes`, the global flag listed below, is what skips that confirmation.", "A managed database on the shared pool is backed up with the pool, not per project."]
+		notes: ["`restore` replaces the live database. Nothing about it is undoable from here — `--yes`, the global flag listed below, is what skips that confirmation.", "Backups are the project's own: a base backup on a schedule, plus continuous WAL archiving for point-in-time recovery."]
 	},
 	"db pitr": {
 		command: "cloud db pitr",
@@ -18142,7 +18701,7 @@ var ACTION_HELP = {
 	},
 	"storage attach": {
 		command: "cloud storage attach",
-		usage: "cloud storage attach --bucket <name> --access-key-id <id> --secret-access-key <secret> [--endpoint <url>] [--region <region>] [--force-path-style]",
+		usage: "cloud storage attach --bucket <name> --access-key-id <id> --secret-access-key <secret> [--endpoint <url>] [--region <region>] [--force-path-style] [--source <key>]",
 		summary: "Point the project at storage you already own — S3, R2, MinIO, any S3-compatible bucket. The alternative to `storage create`, for a bucket the platform does not manage.",
 		flags: [
 			["--bucket <name>", "The bucket name. Required"],
@@ -18150,9 +18709,14 @@ var ACTION_HELP = {
 			["--secret-access-key <secret>", "Required. Stored encrypted and never returned"],
 			["--endpoint <url>", "For anything that is not AWS S3 — R2, MinIO, Backblaze"],
 			["--region <region>", "Bucket region. Default: the provider's own default"],
-			["--force-path-style", "Address as endpoint/bucket rather than bucket.endpoint. Needed by MinIO"]
+			["--force-path-style", "Address as endpoint/bucket rather than bucket.endpoint. Needed by MinIO"],
+			["--source <key>", "Which declared bucket to configure. Default: the project's default bucket"]
+		],
+		examples: [
+			"rebase cloud storage attach --bucket assets --access-key-id … --secret-access-key …",
+			"rebase cloud storage attach --source media --bucket media-eu --access-key-id … --secret-access-key …",
+			"rebase cloud storage attach --bucket assets --access-key-id … --secret-access-key … \\\n    --endpoint https://<account>.r2.cloudflarestorage.com --region auto"
 		],
-		examples: ["rebase cloud storage attach --bucket assets --access-key-id AKIA… --secret-access-key …", "rebase cloud storage attach --bucket assets --access-key-id … --secret-access-key … \\\n    --endpoint https://<account>.r2.cloudflarestorage.com --region auto"],
 		notes: ["All three of --bucket, --access-key-id and --secret-access-key, or none: a bucket with no credentials reads as configured and fails on the first upload.", "Redeploy for the tenant to pick the credentials up."]
 	},
 	"webhooks create": {
@@ -18239,7 +18803,6 @@ var ACTION_HELP = {
 			["--replicas <n>", "Instances that always exist — the autoscaler's floor, and what is billed at rest"],
 			["--spot <true|false>", "Preemptible capacity: cheaper, and restarted without notice"],
 			["--scale-to-zero <true|false>", "Request-billed compute that stops when idle, at the cost of a cold start"],
-			["--db-mode <shared|dedicated>", "Pooled cluster, or one of this project's own"],
 			["--db-instances <n>", "1–3. 1 is a single instance with no failover; 2 adds an automatic standby"],
 			["--db-cpu <n>", "Database CPU request per instance. Default: 500m"],
 			["--db-memory <size>", "Database memory request per instance. Default: 2Gi"],
@@ -18251,7 +18814,7 @@ var ACTION_HELP = {
 		examples: [
 			"rebase cloud compute set --cpu 500m --memory 2Gi",
 			"rebase cloud compute set --replicas 2 --autoscale-max 6",
-			"rebase cloud compute set --db-mode dedicated --db-instances 2"
+			"rebase cloud compute set --db-instances 2 --db-memory 4Gi"
 		],
 		notes: [
 			"Run `rebase cloud compute` first — it prints the current dials and the €/month this project is quoted.",
@@ -18893,8 +19456,8 @@ async function appsCommand(subcommand, rawArgs = []) {
 }
 function describeApp(app) {
 	switch (app.type) {
-		case "backend": return app.runtime === "custom" ? `custom runtime — ${app.dockerfile ?? "Dockerfile"}` : `managed runtime, config: ${app.config ?? "config"}`;
-		case "static": return `${app.root} → ${app.output} @ ${app.path ?? "/"}`;
+		case "backend": return app.runtime === "custom" ? `custom runtime — ${app.dockerfile ?? "Dockerfile"}` + (app.context && app.context !== "." ? ` (context: ${app.context})` : "") : `managed runtime, config: ${app.config ?? "config"}`;
+		case "static": return `${app.root} → ${app.output} @ ${app.path ?? "/"}` + (app.cms ? `  ${chalk.magenta(`CMS at ${app.cms}`)}` : "");
 		default: return "";
 	}
 }
@@ -19108,7 +19671,7 @@ async function entry(args) {
 		await recordEvent("cli.error", {
 			command: command ?? "none",
 			subcommand: effectiveSubcommand ?? "none",
-			error_type: error instanceof Error ? error.constructor.name : "unknown",
+			error_type: errorClass(error),
 			usage: Boolean(error && typeof error === "object" && error.isUsageError)
 		}, { projectRoot: process.cwd() });
 		throw error;
@@ -19297,6 +19860,6 @@ function telemetryNotice() {
 	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, ManifestError, VENDOR_SIZE_MAX_BYTES, VENDOR_SIZE_WARN_BYTES, VENDOR_TARGET_CPU, VENDOR_TARGET_OS, assessManagedCompatibility, buildBundle, buildStaticBundle, buildableApps, collectDeclaredDependencies, commentSpans, composeBundleManifest, detectDeclaredDepConflicts, detectFrameworkDepDrift, detectNativeDependencies, detectStorageAuthorize, entry, findBackendApp, findUnusedServerEntry, foldStaticIntoBundle, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, resolveBackendPaths, selectDeployApp, synthesizeManifest, validateManifest, vendorDependencies, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, ManifestError, VENDOR_SIZE_MAX_BYTES, VENDOR_SIZE_WARN_BYTES, VENDOR_TARGET_CPU, VENDOR_TARGET_OS, assessManagedCompatibility, buildBundle, buildStaticBundle, buildableApps, cmsMountOf, collectDeclaredDependencies, commentSpans, composeBundleManifest, detectDeclaredDepConflicts, detectFrameworkDepDrift, detectNativeDependencies, detectStorageAuthorize, entry, findBackendApp, findUnusedServerEntry, foldStaticIntoBundle, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, resolveBackendPaths, selectDeployApp, synthesizeManifest, validateManifest, vendorDependencies, writeManifest };
 
 //# sourceMappingURL=index.es.js.map