@rebasepro/cli 0.21.2-canary.g1ea48be → 0.23.0

package/dist/index.es.js

@@ -4,7 +4,7 @@ import { i as probeTcp, r as ensureDevDatabase, t as composeDatabaseUrl } from "
 import { r as readActiveBranch, t as branchUrl } from "./branch-pointer-dBiClJ0p.js";
 import { t as MANAGED_LIMITATIONS } from "./constraints-DKGbNfUW.js";
 import { i as managedUrl, n as ensureManagedDatabase, r as findRunningDaemon } from "./daemon-DR9Tk0La.js";
-import { n as resolveDevDatabase, t as describeDevDatabase } from "./resolve-Y56osuQH.js";
+import { n as resolveDevDatabase, t as describeDevDatabase } from "./resolve-BAeRUBhg.js";
 import chalk from "chalk";
 import arg from "arg";
 import inquirer from "inquirer";
@@ -459,16 +459,47 @@ function setCurrentContext(url) {
 	writeCredentials(creds);
 }
 function resolveCloudUrl(rawArgs) {
-	const explicit = arg({ "--url": String }, {
+	return resolveCloudTarget(rawArgs).url;
+}
+/** The control-plane URL, and which rung of the ladder above supplied it. */
+function resolveCloudTarget(rawArgs) {
+	const parsed = arg({ "--url": String }, {
 		argv: rawArgs.slice(2),
 		permissive: true
-	})["--url"] || process.env.REBASE_CLOUD_URL;
-	if (explicit) return normalizeUrl(explicit);
+	});
+	if (parsed["--url"]) return {
+		url: normalizeUrl(parsed["--url"]),
+		source: "flag"
+	};
+	if (process.env.REBASE_CLOUD_URL) return {
+		url: normalizeUrl(process.env.REBASE_CLOUD_URL),
+		source: "env"
+	};
 	const link = readLink();
-	if (link?.url && link.mode !== "direct") return normalizeUrl(link.url);
+	if (link?.url && link.mode !== "direct") return {
+		url: normalizeUrl(link.url),
+		source: "link"
+	};
 	const current = currentContextUrl();
-	if (current) return normalizeUrl(current);
-	return DEFAULT_CLOUD_URL;
+	if (current) return {
+		url: normalizeUrl(current),
+		source: "context"
+	};
+	return {
+		url: DEFAULT_CLOUD_URL,
+		source: "default"
+	};
+}
+/**
+* Whether a control-plane host is one the user chose: the platform's own, or a
+* host already in their credentials file because they signed in to it.
+*
+* A link file is part of the repository, and a cloned repository is not the
+* user's to trust with their password. `login` asks before sending one to a
+* linked host that is neither.
+*/
+function isKnownControlPlane(url) {
+	return url === DEFAULT_CLOUD_URL || Object.hasOwn(readCredentials().contexts, url);
 }
 /**
 * Refuse to run a control-plane command in a directory linked straight at a
@@ -522,6 +553,22 @@ function createCloudClient(url) {
 /** Two minutes of head-room before a token is treated as expired. */
 var EXPIRY_BUFFER_MS = 12e4;
 /**
+* An access token with time left on it, refreshed first if it is close to
+* expiry. Rejects when there is no session, or it cannot be refreshed.
+*
+* For the requests the SDK does not make itself. Its own calls refresh and
+* retry on a 401; a raw `fetch` or a tunnel handshake presents whatever token
+* it was handed, and `createCloudClient` never refreshes in the background. A
+* token read once at the start of a command that runs for longer than it
+* lives — a deploy's build, a `db connect` left open — is refused by the time
+* it is used, so it is read here at the moment it is sent.
+*/
+async function freshAccessToken(client) {
+	const session = client.auth.getSession();
+	if (session?.accessToken && session.expiresAt > Date.now() + EXPIRY_BUFFER_MS) return session.accessToken;
+	return (await client.auth.refreshSession()).accessToken;
+}
+/**
 * Return an authenticated client for the resolved host, refreshing the access
 * token if it is close to expiry. Exits with a helpful message when there is no
 * usable session (never logged in, or the refresh token was revoked).
@@ -2537,7 +2584,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
 			const { pinSearchPath } = await import("@rebasepro/server-postgres");
 			const pinnedUrl = pinSearchPath(databaseUrl);
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, () => `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, [
@@ -3637,7 +3684,7 @@ async function runDriverDbCommand(rawArgs, options = {}) {
 	const env = { ...process.env };
 	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
 	env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? "";
-	const { resolveDevDatabase } = await import("./resolve-Y56osuQH.js").then((n) => n.r);
+	const { resolveDevDatabase } = await import("./resolve-BAeRUBhg.js").then((n) => n.r);
 	const { readEnvFile } = await import("./project-3WCbrrfW.js").then((n) => n.u);
 	refuseBranchOnManagedDatabase(rawArgs, resolveDevDatabase({
 		flagUrl: readFlagValue(rawArgs, "--database-url"),
@@ -3807,7 +3854,7 @@ async function manageLocalDatabase(subcommand, projectRoot, rawArgs) {
 * and the wrong one here means overwriting production with a laptop.
 */
 async function pullIntoLocal(projectRoot, rawArgs) {
-	const { anonymizeStatements, describeTarget, dumpArgs, findPgDump, restoreArgs } = await import("./pull-Bj0XnH5s.js");
+	const { anonymizeStatements, describeTarget, dumpArgs, findPgTool, restoreArgs, restoreOutcome } = await import("./pull-Dywm5FWP.js");
 	const { prepareDatabaseEnv } = await Promise.resolve().then(() => prepare_exports);
 	const { readEnvFile } = await import("./project-3WCbrrfW.js").then((n) => n.u);
 	const source = readFlagValue(rawArgs, "--from");
@@ -3818,8 +3865,8 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 	}
 	const schemas = rawArgs.flatMap((arg, index) => arg === "--schema" && rawArgs[index + 1] ? [rawArgs[index + 1]] : []);
 	const anonymize = rawArgs.includes("--anonymize");
-	if (!await findPgDump()) {
-		console.error(chalk.red("✗ `pg_dump` is not on PATH, and this command cannot run without it."));
+	for (const tool of ["pg_dump", "pg_restore"]) if (!await findPgTool(tool)) {
+		console.error(chalk.red(`✗ \`${tool}\` is not on PATH, and this command cannot run without it.`));
 		console.error(chalk.gray("  Install the PostgreSQL client tools, e.g. `brew install libpq`."));
 		process.exit(1);
 	}
@@ -3876,6 +3923,7 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 		}
 	}
 	const dumpFile = path.join(os.tmpdir(), `rebase-pull-${process.pid}.dump`);
+	let failure = null;
 	try {
 		console.log(chalk.gray("  Dumping…"));
 		await execa("pg_dump", [
@@ -3888,12 +3936,14 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 			"inherit"
 		] });
 		console.log(chalk.gray("  Restoring…"));
-		await execa("pg_restore", restoreArgs(plan, dumpFile), { stdio: [
-			"ignore",
-			"inherit",
-			"inherit"
-		] }).catch(() => console.log(chalk.gray("  (pg_restore reported non-fatal diagnostics)")));
-		if (anonymize) {
+		const restored = restoreOutcome(await execa("pg_restore", restoreArgs(plan, dumpFile), {
+			stdin: "ignore",
+			stdout: "inherit",
+			stderr: ["pipe", "inherit"],
+			reject: false
+		}));
+		failure = restored.failure;
+		if (anonymize && restored.started) {
 			const { Client } = await import("pg");
 			const client = new Client({ connectionString: target });
 			await client.connect();
@@ -3910,11 +3960,17 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 				await client.end();
 			}
 		}
-		await restoreAppRole(target);
-		console.log(chalk.green("✓ Local database now holds a copy of " + describeTarget(source)));
+		if (!failure) await restoreAppRole(target);
 	} finally {
 		fs.rmSync(dumpFile, { force: true });
 	}
+	if (failure) {
+		console.error(chalk.red(`✗ ${failure}`));
+		console.error(chalk.yellow(`  The local database holds an incomplete copy of ${describeTarget(source)}.`));
+		console.error(chalk.gray("  Fix what the errors above name — often an extension or a role the source has — and pull again."));
+		process.exit(1);
+	}
+	console.log(chalk.green("✓ Local database now holds a copy of " + describeTarget(source)));
 }
 /**
 * Give the restored copy back the privileges `pg_dump` stripped.
@@ -3938,7 +3994,7 @@ async function pullIntoLocal(projectRoot, rawArgs) {
 async function restoreAppRole(target) {
 	const { Client } = await import("pg");
 	const { detectConnectionPosture, ensureAppRole, REBASE_USER_ROLE } = await import("@rebasepro/server-postgres");
-	const { provisionableSchemas } = await import("./pull-Bj0XnH5s.js");
+	const { provisionableSchemas } = await import("./pull-Dywm5FWP.js");
 	const client = new Client({ connectionString: target });
 	await client.connect();
 	try {
@@ -4044,7 +4100,7 @@ async function listFromParentDatabase(projectRoot, rawArgs) {
 	const active = readActiveBranch(projectRoot);
 	if (!active) return rawArgs;
 	const { readEnvFile } = await import("./project-3WCbrrfW.js").then((n) => n.u);
-	const { resolveDevDatabase } = await import("./resolve-Y56osuQH.js").then((n) => n.r);
+	const { resolveDevDatabase } = await import("./resolve-BAeRUBhg.js").then((n) => n.r);
 	const { resolveComposeUrl } = await Promise.resolve().then(() => prepare_exports);
 	const envFile = readEnvFile(projectRoot);
 	const parent = resolveDevDatabase({
@@ -4090,7 +4146,7 @@ async function listFromParentDatabase(projectRoot, rawArgs) {
 async function switchBranch(projectRoot, rawArgs) {
 	const { branchDatabaseName, clearActiveBranch, databaseNameOf, readActiveBranch, writeActiveBranch } = await import("./branch-pointer-dBiClJ0p.js").then((n) => n.n);
 	const { readEnvFile } = await import("./project-3WCbrrfW.js").then((n) => n.u);
-	const { resolveDevDatabase } = await import("./resolve-Y56osuQH.js").then((n) => n.r);
+	const { resolveDevDatabase } = await import("./resolve-BAeRUBhg.js").then((n) => n.r);
 	const { resolveComposeUrl } = await Promise.resolve().then(() => prepare_exports);
 	const goingOff = rawArgs.includes("--off") || rawArgs.includes("--main");
 	const name = commandWords(rawArgs, "db")[3];
@@ -4249,6 +4305,8 @@ var DB_ACTION_HELP = {
 		notes: ["Destructive, and the data exists only on this machine."]
 	}
 };
+/** Every subcommand the family dispatches — the help table's keys. */
+var DB_SUBCOMMANDS = Object.keys(DB_ACTION_HELP);
 function printDbHelp$1(action) {
 	const entry = action ? DB_ACTION_HELP[action] : void 0;
 	if (entry) {
@@ -4385,6 +4443,8 @@ var SCHEMA_ACTION_HELP = {
 		notes: ["--fix regenerates them instead of only reporting."]
 	}
 };
+/** Every subcommand the family dispatches — the help table's keys. */
+var SCHEMA_SUBCOMMANDS = Object.keys(SCHEMA_ACTION_HELP);
 function printSchemaHelp(action) {
 	const entry = action ? SCHEMA_ACTION_HELP[action] : void 0;
 	if (entry) {
@@ -6421,7 +6481,7 @@ ${chalk.green.bold("Which database")}
     2. ${chalk.gray("DATABASE_URL")}            in the shell environment
     3. the branch this checkout is switched to ${chalk.gray("(rebase db branch switch)")}
     4. ${chalk.gray("DATABASE_URL")}            in the project's .env
-    5. ${chalk.blue("--docker")}, or ${chalk.gray("devDatabase: \"docker\"")} in rebase.json
+    5. ${chalk.blue("--docker")}                on this command line
     6. the managed development database ${chalk.gray("(PGlite, data in .rebase/)")}
 
   A scaffolded project sets none of 1–5, so it lands on (6): no Docker,
@@ -6470,6 +6530,25 @@ ${chalk.green.bold("Description")}
 `);
 }
 //#endregion
+//#region src/utils/tool-stdio.ts
+/**
+* The stdio a build tool the CLI runs in the foreground gets: a static app's
+* build command, `tsc`, `tar`.
+*
+* Inherited, so its output streams as it happens. With `quietStdout` its stdout
+* goes to stderr instead, for a command whose own stdout carries a result:
+* `rebase cloud deploy` in JSON mode — every piped run — owes stdout exactly one
+* JSON value, and a `vite v6 building…` line in front of it is a result no
+* parser can read. The tool's output still reaches the person watching.
+*/
+function toolStdio(quietStdout) {
+	return quietStdout ? [
+		"ignore",
+		2,
+		"inherit"
+	] : "inherit";
+}
+//#endregion
 //#region src/function-portability.ts
 /**
 * What each of a project's custom functions depends on the *host* for.
@@ -6780,6 +6859,15 @@ function log(options, message) {
 	(options.log ?? ((m) => console.log(m)))(message);
 }
 /**
+* A line the build says to the person running it — a warning, or what it left
+* out — which progress callbacks may drop and this does not: stdout, or stderr
+* when stdout carries the caller's result.
+*/
+function say(options, line) {
+	if (options.quietStdout) console.error(line);
+	else console.log(line);
+}
+/**
 * Every `node_modules/@types` directory the project can see.
 *
 * Type roots normally resolve by walking up from the tsconfig's own directory,
@@ -6873,7 +6961,8 @@ function filterProjectPaths(baseDir, projectRoot, paths, baseUrl) {
 * `baseUrl: "../../"` into a config in a different directory silently repoints
 * it at the wrong place.
 */
-async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck) {
+async function writeBundleTsconfig(projectRoot, outDir, includes, options) {
+	const skipTypeCheck = options.skipTypeCheck === true;
 	const tsconfigDir = path.join(projectRoot, ".rebase");
 	const fromTsconfig = (target) => {
 		return path.relative(tsconfigDir, path.resolve(projectRoot, target)).split(path.sep).join("/");
@@ -6890,7 +6979,7 @@ async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck)
 			baseUrl: fromTsconfig("."),
 			paths: kept
 		};
-		if (dropped.length > 0) console.log(chalk.dim(`    ignoring ${dropped.length} path alias(es) pointing outside the project (${dropped.join(", ")}) — resolving those from node_modules instead`));
+		if (dropped.length > 0) say(options, chalk.dim(`    ignoring ${dropped.length} path alias(es) pointing outside the project (${dropped.join(", ")}) — resolving those from node_modules instead`));
 	}
 	const compilerOptions = {
 		target: "ES2022",
@@ -7668,8 +7757,20 @@ function composeBundleManifest(input) {
 		build: input.build
 	};
 }
+/**
+* What a build refusing on {@link detectDeclaredDepConflicts} says: every name,
+* both ranges and where each is declared.
+*/
+function describeDepConflicts(conflicts) {
+	const lines = [`${conflicts.length} dependency range(s) no single version satisfies:`];
+	for (const { name, declarations: [first, second] } of conflicts) lines.push(`    ${name}`, `      ${first.range}  (${first.file})`, `      ${second.range}  (${second.file})`);
+	lines.push("  The bundle installs one range; the other half of the project was built against the other.", "  Declare one range, in the app that uses it.");
+	return lines.join("\n");
+}
 async function buildBundle(options) {
 	const { projectRoot, app, appName } = options;
+	const conflicts = detectDeclaredDepConflicts(projectRoot);
+	if (conflicts.length > 0) throw new Error(describeDepConflicts(conflicts));
 	const paths = resolveBackendPaths(app, projectRoot);
 	const outDir = path.resolve(projectRoot, options.outDir ?? "dist-bundle");
 	const includes = [];
@@ -7690,22 +7791,22 @@ async function buildBundle(options) {
 			"the schema"
 		];
 		const compiled = `${parts.slice(0, -1).join(", ")} and ${parts[parts.length - 1]}`;
-		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
-		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
-		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
-		console.log(chalk.dim("      or run `rebase eject`, which writes an entrypoint of its own and owns"));
-		console.log(chalk.dim("      the image — it does not adopt this file, and will not replace it"));
-		console.log(chalk.dim("      without --force."));
+		say(options, chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
+		say(options, chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
+		say(options, chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
+		say(options, chalk.dim("      or run `rebase eject`, which writes an entrypoint of its own and owns"));
+		say(options, chalk.dim("      the image — it does not adopt this file, and will not replace it"));
+		say(options, chalk.dim("      without --force."));
 	}
 	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
 	cleanOutDir(projectRoot, outDir);
-	const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options.skipTypeCheck === true);
+	const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options);
 	const tsc = resolveLocalBin(projectRoot, "tsc");
 	if (!tsc) throw new Error("TypeScript is not installed in this project. Run your package manager's install first.");
 	try {
 		await execa(tsc, ["-p", tsconfigPath], {
 			cwd: projectRoot,
-			stdio: "inherit"
+			stdio: toolStdio(options.quietStdout)
 		});
 	} catch {
 		throw new Error("TypeScript compilation failed — the bundle was not written.");
@@ -7713,9 +7814,9 @@ async function buildBundle(options) {
 	const normalized = normalizeEsmSpecifiers(outDir);
 	if (normalized.rewritten > 0) log(options, chalk.dim(`  resolved ${normalized.rewritten} relative import(s) for Node ESM`));
 	if (normalized.unresolved.length > 0) {
-		console.log(chalk.yellow(`  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`));
-		for (const item of normalized.unresolved.slice(0, 5)) console.log(chalk.dim(`      ${item}`));
-		if (normalized.unresolved.length > 5) console.log(chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));
+		say(options, chalk.yellow(`  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`));
+		for (const item of normalized.unresolved.slice(0, 5)) say(options, chalk.dim(`      ${item}`));
+		if (normalized.unresolved.length > 5) say(options, chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));
 	}
 	const compiledConfigDir = path.join(outDir, paths.config);
 	const compiledCollectionsDir = path.join(compiledConfigDir, "collections");
@@ -7751,7 +7852,7 @@ async function buildBundle(options) {
 			...requires.length > 0 ? { requires } : {}
 		};
 	});
-	for (const line of summarisePortability(functionReports)) console.log(line.trimStart().startsWith("⚠") ? chalk.yellow(line) : chalk.dim(line));
+	for (const line of summarisePortability(functionReports)) say(options, line.trimStart().startsWith("⚠") ? chalk.yellow(line) : chalk.dim(line));
 	const manifest = composeBundleManifest({
 		runtimeRange: options.runtimeRange,
 		builtAgainst: resolveServerVersion(projectRoot),
@@ -8322,7 +8423,7 @@ async function foldFrontendIntoBundle(options) {
 	for (const app of apps) {
 		if (app.build && !skipBuild) await execa(app.build, {
 			cwd: projectRoot,
-			stdio: "inherit",
+			stdio: toolStdio(options.quietStdout),
 			shell: true,
 			env: staticBuildEnv(app.path, app.name)
 		});
@@ -8942,6 +9043,9 @@ async function buildCommand(rawArgs = []) {
 		await runWorkspaceBuilds(projectRoot);
 		return;
 	}
+	const output = args["--output"] ? path.resolve(process.cwd(), args["--output"]) : void 0;
+	const bundled = targets.filter(({ app }) => app.type === "backend" && app.runtime !== "custom" || app.type === "static" && Boolean(app.build) && Boolean(app.output));
+	if (output && bundled.length > 1) throw new UsageError(`--output names one bundle directory, and this build produces ${bundled.length}: ${bundled.map((t) => t.name).join(", ")}. Build one app into it: rebase build ${bundled[0].name} --output ${args["--output"]}`);
 	console.log(`${chalk.bold("Rebase")} — building ${targets.length} app(s)\n`);
 	for (const { name, app } of targets) {
 		console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));
@@ -8962,25 +9066,11 @@ async function buildCommand(rawArgs = []) {
 			}
 			writeResourceGraphFile(projectRoot, resourceGraph);
 			const drift = detectFrameworkDepDrift(projectRoot, cliVersion$1());
-			if (drift.conflicting.length > 0) {
-				console.error(chalk.red(`\n  ✗ ${drift.conflicting.length} dependency range(s) no single version satisfies:\n`));
-				for (const conflict of drift.conflicting) {
-					const [first, second] = conflict.declarations;
-					console.error(`    ${chalk.bold(conflict.name)}`);
-					console.error(chalk.dim(`      ${first.range}  (${first.file})`));
-					console.error(chalk.dim(`      ${second.range}  (${second.file})`));
-				}
-				console.error("");
-				console.error(chalk.dim("    The bundle installs one range; the other half of the project was built"));
-				console.error(chalk.dim("    against the other. Declare one range, in the app that uses it.\n"));
-				process.exitCode = 1;
-				return;
-			}
 			const result = await buildBundle({
 				projectRoot,
 				appName: name,
 				app,
-				outDir: args["--output"],
+				outDir: output,
 				runtimeRange: manifest.rebase,
 				resources: resourceGraph,
 				skipTypeCheck: args["--skip-type-check"],
@@ -9032,7 +9122,10 @@ async function buildCommand(rawArgs = []) {
 				});
 				for (const outcome of folded ?? []) console.log(chalk.green(`    ✓ ${outcome.appName} folded in`) + chalk.dim(` (${outcome.fileCount} file(s) → served at ${outcome.path})`));
 			}
-		} else if (app.type === "static") await buildAssetApp(projectRoot, name, app, manifest.rebase, args["--output"]);
+		} else if (app.type === "static") await buildAssetApp(projectRoot, name, app, manifest.rebase, output).catch((err) => {
+			console.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
+			process.exit(1);
+		});
 		console.log("");
 	}
 	console.log(chalk.green("✓ Build complete."));
@@ -9044,41 +9137,40 @@ async function buildCommand(rawArgs = []) {
 * packages that output into a `static`-kind bundle — the same deployable shape as
 * a backend bundle, so a frontend or admin app deploys through the identical
 * path and runs on the identical image, just serving files instead of an API.
+*
+* Throws when the build fails or produces nothing usable, so the caller answers
+* in its own way: `rebase build` with a red line, `rebase cloud deploy --json`
+* with its JSON error.
 */
-async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride) {
+async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride, options = {}) {
 	const asset = app;
 	const basePath = asset.path ?? "/";
+	const say = (line) => {
+		if (options.quietStdout) console.error(line);
+		else console.log(line);
+	};
 	if (!asset.build) {
-		console.log(chalk.dim("  no build command declared — skipping"));
+		say(chalk.dim("  no build command declared — skipping"));
 		return;
 	}
 	try {
 		await execa(asset.build, {
 			cwd: projectRoot,
-			stdio: "inherit",
+			stdio: toolStdio(options.quietStdout),
 			shell: true,
 			env: staticBuildEnv(basePath, name)
 		});
 	} catch {
-		console.error(chalk.red(`  ✗ build command failed for "${name}"`));
-		process.exit(1);
+		throw new Error(`build command failed for "${name}"`);
 	}
 	if (!asset.output) {
-		console.log(chalk.yellow("  no output directory declared — built, but nothing to bundle"));
+		say(chalk.yellow("  no output directory declared — built, but nothing to bundle"));
 		return;
 	}
 	const outputPath = path.join(projectRoot, asset.output);
-	if (!fs.existsSync(outputPath)) {
-		console.error(chalk.red(`  ✗ declared output "${asset.output}" does not exist after building`));
-		process.exit(1);
-	}
+	if (!fs.existsSync(outputPath)) throw new Error(`declared output "${asset.output}" does not exist after building`);
 	const indexHtml = path.join(outputPath, "index.html");
-	if (fs.existsSync(indexHtml)) try {
-		assertBuiltForPath(fs.readFileSync(indexHtml, "utf8"), basePath, name);
-	} catch (err) {
-		console.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
-		process.exit(1);
-	}
+	if (fs.existsSync(indexHtml)) assertBuiltForPath(fs.readFileSync(indexHtml, "utf8"), basePath, name);
 	const result = buildStaticBundle({
 		projectRoot,
 		appName: name,
@@ -9090,7 +9182,7 @@ async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride)
 		cms: asset.cms
 	});
 	const rel = path.relative(projectRoot, result.outDir);
-	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s) → served at ${basePath})`));
+	say(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s) → served at ${basePath})`));
 	return result.outDir;
 }
 /**
@@ -9210,7 +9302,7 @@ function renderPayload(contents, shape, projectName) {
 		};
 	}
 	if (open) throw new Error(`Eject template: {{#${open.name}}} was never closed.`);
-	return out.join("\n").replace(/\{\{PROJECT_NAME\}\}/g, projectName);
+	return out.join("\n").replace(/\{\{PROJECT_NAME\}\}/g, () => projectName);
 }
 /** Files the eject payload contributes, as `<source> → <destination>`. */
 var PAYLOAD = [
@@ -9781,7 +9873,59 @@ async function resetPassword(rawArgs) {
 		env.REBASE_RESET_EMAIL = email;
 		env.REBASE_RESET_PASSWORD = newPassword;
 		env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
-		const scriptContent = `
+		const { prepareDatabaseEnv } = await Promise.resolve().then(() => prepare_exports);
+		const prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
+		Object.assign(env, prepared.env);
+		const scriptContent = resetPasswordScript(wasGenerated);
+		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
+		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
+		console.log("");
+		console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (Direct DB Fallback)"));
+		console.log("");
+		console.log(`  ${chalk.gray("Email:")} ${email}`);
+		console.log(`  ${chalk.gray("Database:")} ${prepared.description}`);
+		if (!wasGenerated) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
+		console.log("");
+		const child = spawn(tsxBin, [tmpScriptPath], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+		const cleanup = () => {
+			try {
+				fs.unlinkSync(tmpScriptPath);
+			} catch {}
+		};
+		return new Promise((resolve) => {
+			child.on("error", (err) => {
+				cleanup();
+				console.error(chalk.red("✗ Could not run the reset script."));
+				console.error(chalk.gray(`  ${err.message}`));
+				process.exit(1);
+			});
+			child.on("close", (code) => {
+				cleanup();
+				if (code !== 0) process.exit(code ?? 1);
+				resolve();
+			});
+		});
+	} catch (err) {
+		console.error(chalk.red("✗ Direct database update failed."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+}
+/**
+* The script the direct-database fallback runs under the project's own tsx, so
+* it resolves the project's `@rebasepro/server-postgres` and schema.
+*
+* It exits 0 only when a row was updated: a missing user and a thrown error are
+* both exit 1. `echoPassword` prints the new password, for a generated one.
+*
+* Exported so its tests can run it.
+*/
+function resetPasswordScript(echoPassword) {
+	return `
 import { createPostgresDatabaseConnection } from "@rebasepro/server-postgres";
 import { hashPassword } from "@rebasepro/server";
 import { eq } from "drizzle-orm";
@@ -9826,7 +9970,7 @@ async function resetPassword() {
 
     if (result.length > 0) {
         console.log("✅ Password reset for: " + result[0].email);
-        ${wasGenerated ? "console.log(\"   New password: \" + newPassword);" : ""}
+        ${echoPassword ? "console.log(\"   New password: \" + newPassword);" : ""}
         process.exit(0);
     }
     // Nothing was updated, so nothing was reset. Exiting 0 here reported
@@ -9835,44 +9979,13 @@ async function resetPassword() {
     process.exit(1);
 }
 
-resetPassword().catch(console.error);
+// A thrown error is a failed reset, and exits like one — a refused connection
+// that exits 0 reads as a reset to anything checking the exit code.
+resetPassword().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
 `;
-		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
-		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
-		console.log("");
-		console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (Direct DB Fallback)"));
-		console.log("");
-		console.log(`  ${chalk.gray("Email:")} ${email}`);
-		if (!wasGenerated) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
-		console.log("");
-		const child = spawn(tsxBin, [tmpScriptPath], {
-			cwd: backendDir,
-			stdio: "inherit",
-			env
-		});
-		const cleanup = () => {
-			try {
-				fs.unlinkSync(tmpScriptPath);
-			} catch {}
-		};
-		return new Promise((resolve) => {
-			child.on("error", (err) => {
-				cleanup();
-				console.error(chalk.red("✗ Could not run the reset script."));
-				console.error(chalk.gray(`  ${err.message}`));
-				process.exit(1);
-			});
-			child.on("close", (code) => {
-				cleanup();
-				if (code !== 0) process.exit(code ?? 1);
-				resolve();
-			});
-		});
-	} catch (err) {
-		console.error(chalk.red("✗ Direct database update failed."));
-		console.error(err instanceof Error ? err.message : String(err));
-		process.exit(1);
-	}
 }
 function printAuthHelp() {
 	console.log(`
@@ -10259,7 +10372,8 @@ function findLibpqUrlProblems(projectRoot, envFile) {
 	return findings;
 }
 /**
-* Report unparseable connection strings, if any.
+* Report unparseable connection strings, if any. Returns true when there were,
+* so the finding reaches the exit code like the environment errors do.
 *
 * Runs before the plugin's drift check and never blocks it. The plugin connects
 * through node-postgres, which parses these URLs happily — so it cannot see this
@@ -10267,7 +10381,7 @@ function findLibpqUrlProblems(projectRoot, envFile) {
 * `rebase db backup` fails.
 */
 function reportLibpqUrlProblems(findings) {
-	if (findings.length === 0) return;
+	if (findings.length === 0) return false;
 	console.log("");
 	console.log(chalk.red.bold("  ✗ Connection string that PostgreSQL's own tools cannot parse"));
 	console.log("");
@@ -10287,6 +10401,7 @@ function reportLibpqUrlProblems(findings) {
 	console.log(chalk.gray("    is why a project can look healthy and still have no working backups."));
 	console.log(chalk.gray("    Projects scaffolded before 2026-08-18 all carry it."));
 	console.log("");
+	return true;
 }
 /**
 * `--help` is answered before the project guard, not after.
@@ -10592,9 +10707,10 @@ async function doctorCommand(rawArgs) {
 	const env = { ...process.env };
 	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
 	env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? "";
-	reportLibpqUrlProblems(findLibpqUrlProblems(projectRoot, envFile));
+	const connectionFailed = reportLibpqUrlProblems(findLibpqUrlProblems(projectRoot, envFile));
 	reportFunctionPortability(projectRoot);
 	const environmentFailed = reportEnvironmentFindings(collectEnvironmentFindings(projectRoot, envFile));
+	const failed = connectionFailed || environmentFailed;
 	try {
 		const prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
 		Object.assign(env, prepared.env);
@@ -10607,7 +10723,7 @@ async function doctorCommand(rawArgs) {
 	if (!hasDeclaredCollections(projectRoot)) {
 		console.log("");
 		console.log(chalk.gray("  ○ Schema drift not checked: this project derives its API from the database — run `rebase schema introspect` first."));
-		if (environmentFailed) process.exit(1);
+		if (failed) process.exit(1);
 		return;
 	}
 	try {
@@ -10628,7 +10744,7 @@ async function doctorCommand(rawArgs) {
 		reportSpawnFailure(error);
 		process.exit(1);
 	}
-	if (environmentFailed) process.exit(1);
+	if (failed) process.exit(1);
 }
 //#endregion
 //#region src/commands/resources.ts
@@ -12108,7 +12224,8 @@ async function loginCommand(rawArgs) {
 		maxPositionals: 0
 	});
 	refuseDirectLink(rawArgs);
-	const url = resolveCloudUrl(rawArgs);
+	const { url, source } = resolveCloudTarget(rawArgs);
+	if (source === "link" && !isKnownControlPlane(url)) await confirmLinkedControlPlane(url);
 	noteBlank();
 	note(`Signing in to ${chalk.cyan(url)}`);
 	noteBlank();
@@ -12161,6 +12278,31 @@ async function loginCommand(rawArgs) {
 		reportError(e, "Login failed");
 	}
 }
+/**
+* Ask before sending a password to a control plane a repository named.
+*
+* `.rebase/cloud.json` is committed with the code, so a cloned repository can
+* point its cloud commands at any host — and "Not logged in to <host>" invites
+* the login that would hand that host the user's email and password. A host
+* the user has signed in to before, or the platform's own, is theirs; any other
+* one is named and confirmed at a terminal, and refused without one: `--url`
+* is how a script says it means that host.
+*/
+async function confirmLinkedControlPlane(url) {
+	const message = `This directory's .rebase/cloud.json names the control plane ${url}, which you have not signed in to before.`;
+	if (isJsonMode() || process.stdin.isTTY !== true) fail(message, `Your email and password would be sent there. To sign in to it on purpose, pass --url ${url}.`, "unknown_control_plane");
+	warn(message, "Your Rebase Cloud email and password will be sent to it.");
+	const { confirmed } = await inquirer.prompt([{
+		type: "confirm",
+		name: "confirmed",
+		default: false,
+		message: `Sign in to ${url}?`
+	}]);
+	if (!confirmed) {
+		console.error(chalk.gray("  Aborted."));
+		process.exit(0);
+	}
+}
 async function logoutCommand(rawArgs) {
 	parseCloudArgs({
 		spec: {},
@@ -13742,10 +13884,7 @@ async function dbConnect(rawArgs) {
 	}
 	const requested = args["--port"] ?? DEFAULT_LOCAL_PORT;
 	if (!Number.isInteger(requested) || requested < 0 || requested > 65535) fail(`--port must be a port number, not ${requested}.`, void 0, "bad_port");
-	const endpoint = tunnelUrl(url, projectId);
-	const server = net$1.createServer((socket) => {
-		pipeThroughTunnel(socket, endpoint, client.auth.getSession()?.accessToken ?? "");
-	});
+	const server = tunnelListener(client, tunnelUrl(url, projectId));
 	server.on("error", (err) => {
 		if (err.code === "EADDRINUSE") fail(`Port ${requested} on 127.0.0.1 is already in use.`, "Pass --port to choose another, or stop whatever is listening there.", "port_in_use");
 		fail(`Could not open a local listener: ${err.message}`, void 0, "listen_failed");
@@ -13794,6 +13933,30 @@ async function dbConnect(rawArgs) {
 	});
 }
 /**
+* The local listener: each connection it accepts gets its own tunnel, signed in
+* with a token that is current when the connection arrives.
+*
+* The command is left running for as long as the developer works, and the
+* access token it started with lapses within the hour. Every connection is
+* authenticated on its own, so each one reads the token then, refreshing it
+* first when it is close to expiry — rather than the one read at startup, which
+* the control plane refuses for every connection opened after it expires.
+*
+* The socket is paused while the token is read, so a client's first bytes wait
+* for the tunnel exactly as they do once it is being established.
+*/
+function tunnelListener(client, endpoint) {
+	return net$1.createServer((socket) => {
+		socket.pause();
+		freshAccessToken(client).then((token) => {
+			if (!socket.destroyed) pipeThroughTunnel(socket, endpoint, token);
+		}, () => {
+			warn("A connection was closed: the session this tunnel signs in with has expired and could not be refreshed.", "Run `rebase cloud login`, then connect again.");
+			socket.destroy();
+		});
+	});
+}
+/**
 * One accepted connection, carried over one WebSocket.
 *
 * The local socket is paused until the tunnel says `ready`, so a client that
@@ -13814,7 +13977,7 @@ function pipeThroughTunnel(socket, endpoint, token) {
 	ws.binaryType = "arraybuffer";
 	let ready = false;
 	const closeBoth = (reason) => {
-		if (reason && !ready) note(chalk.red(`✗ ${reason}`));
+		if (reason && !ready) warn(`A connection was refused: ${reason}`);
 		try {
 			if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) ws.close();
 		} catch {}
@@ -13869,6 +14032,15 @@ function pipeThroughTunnel(socket, endpoint, token) {
 }
 //#endregion
 //#region src/commands/cloud/databases.ts
+/** The filename a backup is restored and downloaded by. */
+function backupName(row) {
+	return row?.name ?? row?.filename;
+}
+/** A backup's size for a person: the control plane's own string, or bytes as MB. */
+function backupSize(row) {
+	if (typeof row.size === "string") return row.size;
+	if (typeof row.size === "number" && Number.isFinite(row.size)) return `${(row.size / 1024 / 1024).toFixed(1)} MB`;
+}
 async function dbCommand(subcommand, rawArgs) {
 	switch (subcommand) {
 		case "list":
@@ -14260,7 +14432,7 @@ async function backupCommand(rawArgs) {
 				type: "manual"
 			}, { path: "create" });
 			if (!res.success) fail(res.error || "Backup failed.");
-			emit(() => success(`Backup created: ${res.backup?.filename ?? "(unknown)"}`), {
+			emit(() => success(`Backup created: ${backupName(res.backup) ?? "(unnamed)"}`), {
 				success: true,
 				backup: res.backup ?? null
 			});
@@ -14339,8 +14511,12 @@ async function backupCommand(rawArgs) {
 				return;
 			}
 			for (const b of res.backups) {
-				const size = b.size !== void 0 ? `${(b.size / 1024 / 1024).toFixed(1)} MB` : "";
-				console.log(`  ${chalk.bold(b.filename)}  ${chalk.gray(`${b.type ?? ""} ${size}`.trim())}`);
+				const detail = [
+					b.type,
+					backupSize(b),
+					b.date
+				].filter(Boolean).join("  ");
+				console.log(`  ${chalk.bold(backupName(b) ?? "(unnamed)")}  ${chalk.gray(detail)}`);
 			}
 			console.log("");
 		}, {
@@ -15033,26 +15209,29 @@ function readBundleManifest(bundleDir) {
 	return manifest;
 }
 /**
+* The control plane's cap on an uploaded bundle: its `MAX_BUNDLE_BYTES`, which
+* it checks before reading the body.
+*/
+var MAX_BUNDLE_UPLOAD_BYTES = 100 * 1024 * 1024;
+/**
 * Tar a built bundle into a gzipped archive.
 *
-* `node_modules` is excluded on purpose: the bundle ships a `package.json`, and
-* the managed runtime installs the declared dependencies at boot. Uploading an
-* installed `node_modules` would bloat the archive and could carry a
-* platform-specific build that will not run on the runtime image.
+* `node_modules` goes in only with `withModules`: a tree the build vendored for
+* the runtime's platform is the point of vendoring, while one installed into a
+* prebuilt bundle by hand was installed for whatever machine ran it.
 */
-function packBundle(bundleDir, outPath) {
+function packBundle(bundleDir, outPath, options = {}) {
 	return new Promise((resolve, reject) => {
 		const child = spawn("tar", [
 			"-czf",
 			outPath,
 			"--no-xattrs",
-			"--exclude",
-			"node_modules",
+			...options.withModules ? [] : ["--exclude", "node_modules"],
 			"-C",
 			bundleDir,
 			"."
 		], {
-			stdio: "inherit",
+			stdio: toolStdio(true),
 			env: {
 				...process.env,
 				COPYFILE_DISABLE: "1"
@@ -15063,6 +15242,35 @@ function packBundle(bundleDir, outPath) {
 	});
 }
 /**
+* Pack a bundle for upload — without `node_modules`, even a vendored tree.
+*
+* Vendoring exists so a pod untars and boots rather than spending 35-55s of
+* every start in `npm install`, and a deploy did carry the tree for one night
+* (c36ea4637). It is left out again because of what the control plane does
+* with the archive: `GET /bundle/:projectId/:bundleId` reads the whole object
+* into memory on every pod start, and a runtime rollout restarts every tenant's
+* pods at once. Bundles it was sized against are a few hundred kB; a vendored
+* one is tens of MB, up to the 100 MB cap — N pods starting together would hold
+* N of them. A slower cold start per pod is the status quo every deploy has
+* shipped with; a control plane out of memory is every tenant's outage. The
+* platform's own rebuilds build with `--no-vendor` for the same shape of
+* reason. When the control plane streams bundles, this is the one switch to
+* flip, and `rebase cloud deploy` builds with `vendor: false` until then.
+*
+* `modulesLeftOut` says a tree the build DID vendor was not uploaded — a
+* prebuilt `--bundle-dir` from a plain `rebase build`, which vendors by default.
+*/
+async function packBundleForUpload(bundleDir, outPath, manifest, maxBytes = MAX_BUNDLE_UPLOAD_BYTES) {
+	const vendored = manifest.deps?.vendored === true;
+	await packBundle(bundleDir, outPath, { withModules: false });
+	const bytes = fs.statSync(outPath).size;
+	if (bytes > maxBytes) throw new Error(`The bundle is ${(bytes / 1024 / 1024).toFixed(1)} MB without its dependencies, over the ${Math.round(maxBytes / 1024 / 1024)} MB upload limit.`);
+	return {
+		bytes,
+		modulesLeftOut: vendored
+	};
+}
+/**
 * The commit HEAD is on, read here because here is the only place it exists.
 *
 * A bundle deploy has no repository anywhere near the control plane: the CLI
@@ -15198,7 +15406,8 @@ async function uploadBundle(url, token, projectId, tarPath) {
 *    the developer considers source: `.gitignore` honoured the way git honours
 *    it, and a sibling package the project links (`link:../../packages/editor`)
 *    included, because it is outside the project directory but inside the
-*    repository.
+*    repository. Outside a repository — or inside one that ignores the project —
+*    the project is walked, and its `.gitignore` files still decide.
 *  - **Secrets never leave the machine, whatever git says.** A committed `.env`
 *    is still a `.env`. {@link neverUploaded} is applied after git, not instead
 *    of it.
@@ -15227,12 +15436,18 @@ var ENV_TEMPLATES = /* @__PURE__ */ new Set([
 * bundles are never source. Every `.env` and `.env.*` is excluded except the
 * three template names, and so is direnv's `.envrc`, which is the same thing
 * under another name.
+*
+* So is what the CLI keeps on this machine: `.rebase/`, which holds the
+* development database, and the `.rebase-dev-*` files beside it, one of which
+* is the development signing secrets. And so is a `*.dump`, which is what
+* `rebase db backup` writes: every row of the database, `rebase.users`
+* password hashes included.
 */
 function neverUploaded(relativePath) {
 	const segments = relativePath.split("/");
-	if (segments.some((segment) => segment === "node_modules" || segment === ".git" || segment.startsWith("dist-bundle"))) return true;
+	if (segments.some((segment) => segment === "node_modules" || segment === ".git" || segment === ".rebase" || segment.startsWith("dist-bundle"))) return true;
 	const base = segments[segments.length - 1];
-	if (base === ".envrc") return true;
+	if (base === ".envrc" || base.startsWith(".rebase-dev-") || base.endsWith(".dump")) return true;
 	if ((base === ".env" || base.startsWith(".env.")) && !ENV_TEMPLATES.has(base)) return true;
 	return false;
 }
@@ -15245,6 +15460,10 @@ var WALK_SKIP = /* @__PURE__ */ new Set([
 	".next",
 	"coverage"
 ]);
+/** The same directories as `ls-files` excludes, plus every `dist*` build directory. */
+var WALK_EXCLUDES = [...[...WALK_SKIP].map((name) => `--exclude=${name}/`), "--exclude=dist*/"];
+/** The file that says what a directory's source is not, which a walk has to honour. */
+var IGNORE_FILE = ".gitignore";
 var runGit = (cwd, args) => execFileSync("git", [
 	"-C",
 	cwd,
@@ -15269,29 +15488,106 @@ function isRegularFile(absolute) {
 		return false;
 	}
 }
+/** Split `-z` output into its entries. */
+function nulSeparated(output) {
+	return [...new Set(output.split("\0").filter(Boolean))];
+}
+/**
+* Run `fn` with the git directory of a throwaway, empty repository.
+*
+* `git ls-files` reads `.gitignore` files only inside a repository. Pointed at
+* an empty one with `--git-dir`, and at a directory with `--work-tree`, it lists
+* that directory's files the way git would — nested ignore files, negations and
+* the user's global excludes included — without the directory being a
+* repository, or `git init` touching it.
+*/
+function withScratchRepository(git, fn) {
+	const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "rebase-ignore-"));
+	try {
+		git(scratch, ["init", "-q"]);
+		return fn(path.join(scratch, ".git"));
+	} finally {
+		fs.rmSync(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
 /**
 * The files of the repository `dir` belongs to — tracked and unignored, the way
-* git sees them — or, outside any repository, `dir` walked with fixed excludes.
+* git sees them — or, when no repository holds it, `dir` walked.
+*
+* A repository that lists nothing under `dir` does not hold it: a project in a
+* directory the surrounding repository ignores (`tmp/my-app` under a repository
+* ignoring `tmp/`) has no repository of its own. Uploading that repository sent
+* everything except the project, so the project is walked instead.
 */
 function listUnit(dir, git) {
 	try {
 		const toplevel = git(dir, ["rev-parse", "--show-toplevel"]).trim();
 		if (toplevel) {
 			const root = fs.realpathSync(toplevel);
-			const listed = git(root, [
+			const files = nulSeparated(git(root, [
 				"ls-files",
 				"-z",
 				"--cached",
 				"--others",
 				"--exclude-standard"
-			]);
-			return {
+			])).filter((relative) => !neverUploaded(relative) && isRegularFile(path.join(root, relative)));
+			const inside = toPosix(path.relative(root, dir));
+			if (inside === "" || files.some((file) => file.startsWith(`${inside}/`))) return {
 				root,
-				files: [...new Set(listed.split("\0").filter(Boolean))].filter((relative) => !neverUploaded(relative) && isRegularFile(path.join(root, relative))),
+				files,
 				fromGit: true
 			};
 		}
 	} catch {}
+	return {
+		root: dir,
+		files: walkFiles(dir, git),
+		fromGit: false
+	};
+}
+/**
+* `dir`'s files, walked, with its `.gitignore` files honoured.
+*
+* A scaffold made without `git init` still carries the stock `.gitignore`, and
+* it is the only statement of what in the directory is not source: `backups/`
+* with its database dumps, `uploads/` with the users' files. Git reads it,
+* through a throwaway repository (see {@link withScratchRepository}); a
+* repository nested in `dir` lists as one directory entry, and is listed as the
+* repository it is.
+*
+* Without git the walk has fixed excludes alone, and those cannot read an
+* ignore file. So a directory holding one is refused rather than walked past
+* it — the developer wrote down what must stay on this machine.
+*/
+function walkFiles(dir, git) {
+	let listed;
+	try {
+		listed = withScratchRepository(git, (gitDir) => nulSeparated(git(dir, [
+			`--git-dir=${gitDir}`,
+			`--work-tree=${dir}`,
+			"ls-files",
+			"-z",
+			"--others",
+			"--exclude-standard",
+			...WALK_EXCLUDES
+		])));
+	} catch {
+		return walkWithoutGit(dir);
+	}
+	const files = [];
+	for (const relative of listed) if (relative.endsWith("/")) {
+		const nested = listUnit(path.join(dir, relative), git);
+		const prefix = toPosix(path.relative(dir, nested.root));
+		if (prefix.startsWith("..") || path.isAbsolute(prefix)) continue;
+		for (const file of nested.files) files.push(prefix ? `${prefix}/${file}` : file);
+	} else if (!neverUploaded(relative) && isRegularFile(path.join(dir, relative))) files.push(relative);
+	return files;
+}
+/** The walk with fixed excludes, for a machine with no git. Refuses a tree with an ignore file in it. */
+function walkWithoutGit(dir) {
 	const files = [];
 	const walk = (current, prefix) => {
 		let entries;
@@ -15305,15 +15601,12 @@ function listUnit(dir, git) {
 			if (entry.isDirectory()) {
 				if (WALK_SKIP.has(entry.name) || entry.name.startsWith("dist")) continue;
 				walk(path.join(current, entry.name), relative);
-			} else if (entry.isFile() && !neverUploaded(relative)) files.push(relative);
+			} else if (entry.isFile() && entry.name === IGNORE_FILE) throw new Error(`${relative} says what is not source, and reading it takes git, which is not available here`);
+			else if (entry.isFile() && !neverUploaded(relative)) files.push(relative);
 		}
 	};
 	walk(dir, "");
-	return {
-		root: dir,
-		files,
-		fromGit: false
-	};
+	return files;
 }
 /** Whether `candidate` is `dir` or inside it. */
 function isWithin(dir, candidate) {
@@ -15408,6 +15701,42 @@ function listSourceFiles(projectRoot, git = runGit) {
 		fromGit: units.every((u) => u.fromGit)
 	};
 }
+/** The per-directory file of patterns a `--source` build context leaves out, beside `.gitignore`. */
+var CONTEXT_IGNORE_FILE = ".rebaseignore";
+/**
+* The files of a `--source` build context: `dir` and what is under it, relative
+* to it, POSIX, sorted.
+*
+* The same rules as the rebuild source — git decides, and {@link neverUploaded}
+* after it — restricted to `dir`, which is the context's root, so a Dockerfile
+* in it still reads its paths from there. A `dir` that is a subfolder of a
+* repository is held to that repository's `.gitignore`, which is where a
+* monorepo keeps it.
+*
+* `.rebaseignore` in `dir` leaves out more, read with `.gitignore` syntax and
+* anchored at `dir`. It needs git to be read, like `.gitignore` outside a
+* repository; without git, a context that has one is refused.
+*/
+function listContextFiles(dir, git = runGit) {
+	const root = fs.realpathSync(dir);
+	const unit = listUnit(root, git);
+	const prefix = toPosix(path.relative(unit.root, root));
+	let files = prefix === "" ? unit.files : unit.files.filter((file) => file.startsWith(`${prefix}/`)).map((file) => file.slice(prefix.length + 1));
+	const contextIgnore = path.join(root, CONTEXT_IGNORE_FILE);
+	if (fs.existsSync(contextIgnore)) {
+		const ignored = new Set(withScratchRepository(git, (gitDir) => nulSeparated(git(root, [
+			`--git-dir=${gitDir}`,
+			`--work-tree=${root}`,
+			"ls-files",
+			"-z",
+			"--others",
+			"--ignored",
+			`--exclude-from=${contextIgnore}`
+		]))));
+		files = files.filter((file) => !ignored.has(file));
+	}
+	return [...files].sort();
+}
 /**
 * Pack a listing into a gzipped tarball at `outPath`.
 *
@@ -15552,7 +15881,7 @@ async function prepareRebuildSource(opts) {
 		}
 		opts.progress(`  Uploading source (${listing.files.length} files, ${mb(size)} MB)...`);
 		return {
-			sourceId: await steps.upload(opts.url, opts.token, opts.projectId, tarPath),
+			sourceId: await steps.upload(opts.url, await opts.token(), opts.projectId, tarPath),
 			projectPath: listing.projectPath,
 			buildEnv: collectBuildEnv(opts.projectRoot, staticAppRoots(opts.manifest))
 		};
@@ -15567,48 +15896,31 @@ async function prepareRebuildSource(opts) {
 //#region src/commands/cloud/deploy.ts
 var POLL_INTERVAL_MS = 1500;
 var POLL_TIMEOUT_MS = 900 * 1e3;
+/** How long a follow keeps retrying a status it cannot read before it says so. */
+var UNREADABLE_STATUS_MS = 60 * 1e3;
 function sleep(ms) {
 	return new Promise((r) => setTimeout(r, ms));
 }
-function run(cmd, cmdArgs, cwd, env) {
-	return new Promise((resolve, reject) => {
-		const child = spawn(cmd, cmdArgs, {
-			cwd,
-			env: env ? {
-				...process.env,
-				...env
-			} : void 0,
-			stdio: [
-				"ignore",
-				"ignore",
-				"pipe"
-			]
-		});
-		let stderr = "";
-		child.stderr.on("data", (d) => stderr += d.toString());
-		child.on("error", reject);
-		child.on("close", (code) => code === 0 ? resolve() : reject(new Error(stderr || `${cmd} exited ${code}`)));
-	});
-}
 /**
-* Package `sourceDir` into a gzipped tarball, honoring `.gitignore`/`.rebaseignore`
-* and always excluding `.git` and `node_modules`. Returns the temp archive path.
+* Package `sourceDir` into a gzipped tarball; returns the temp archive path.
+*
+* What goes in is {@link listContextFiles}: `.gitignore` read the way git reads
+* it, `.rebaseignore` beside it, and never an env file, a database dump or the
+* CLI's local state, whatever either says. The control plane keeps the archive
+* as the project's source, so this is the last point anything can be kept back.
 */
 async function createSourceTarball(sourceDir) {
 	const dir = path.resolve(sourceDir);
 	if (!fs.existsSync(dir)) fail(`Source directory not found: ${dir}`);
 	const tarPath = path.join(os.tmpdir(), `rebase-src-${Date.now()}.tar.gz`);
-	const tarArgs = [
-		"-czf",
-		tarPath,
-		"--exclude=.git",
-		"--exclude=node_modules"
-	];
-	for (const ignore of [".gitignore", ".rebaseignore"]) if (fs.existsSync(path.join(dir, ignore))) tarArgs.push(`--exclude-from=${ignore}`);
-	tarArgs.push(".");
 	try {
-		await run("tar", tarArgs, dir, { COPYFILE_DISABLE: "1" });
+		const files = listContextFiles(dir);
+		await packSource({
+			root: fs.realpathSync(dir),
+			files
+		}, tarPath);
 	} catch (e) {
+		fs.rmSync(tarPath, { force: true });
 		fail(`Failed to package source: ${e instanceof Error ? e.message : String(e)}`);
 	}
 	return tarPath;
@@ -15654,6 +15966,22 @@ function resolveFrameworkVersion(sourceDir) {
 function progress(line) {
 	if (!isJsonMode()) console.log(line);
 }
+/**
+* The token for one of the raw uploads below, read as it is sent.
+*
+* They are plain `fetch` calls, which never refresh a session the way the
+* SDK's own requests do, and each is sent after work that can outlive a token:
+* a type check and a build, or packing a large directory. Read once at the
+* start, the token had lapsed by then, the upload was refused with a 401, and
+* the build was thrown away.
+*/
+async function uploadToken(client, url) {
+	try {
+		return await freshAccessToken(client);
+	} catch {
+		fail(`Your session for ${url} has expired.`, "Run `rebase cloud login` to sign in again, then deploy again.", "session_expired");
+	}
+}
 /** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
 async function uploadSource(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
@@ -15680,14 +16008,20 @@ async function uploadSource(url, token, projectId, tarPath) {
 * Build, upload and deploy a project as a managed bundle.
 *
 * Builds the backend app into `dist-bundle` (unless one is pointed at with
-* `--bundle-dir`), packs it without `node_modules`, uploads it, and triggers a
-* deploy carrying the manifest so the control plane can validate intake fast.
+* `--bundle-dir`), packs it with the dependency tree the build vendored into it,
+* uploads it, and triggers a deploy carrying the manifest so the control plane
+* can validate intake fast.
 */
 async function deployBundle(opts) {
 	const projectRoot = requireProjectRoot();
 	let bundleDir = opts.bundleDir ? path.resolve(process.cwd(), opts.bundleDir) : path.join(projectRoot, "dist-bundle");
 	if (!opts.bundleDir) {
-		const loaded = loadManifest(projectRoot);
+		let loaded;
+		try {
+			loaded = loadManifest(projectRoot);
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err), void 0, "invalid_manifest");
+		}
 		let target;
 		try {
 			target = selectDeployApp(loaded.manifest, opts.appName);
@@ -15695,9 +16029,15 @@ async function deployBundle(opts) {
 			fail(err instanceof Error ? err.message : String(err));
 			return;
 		}
+		if (target.app.type === "static" && opts.noStatic) fail(`--no-static leaves a backend's frontend out of its bundle, and "${target.name}" is a static app: its bundle is nothing but its frontend.`, "Deploy it without --no-static.", "usage");
 		if (target.app.type === "static") {
 			progress(chalk.gray(`  Building static app "${target.name}"...`));
-			const staticDir = await buildAssetApp(projectRoot, target.name, target.app, loaded.manifest.rebase);
+			let staticDir;
+			try {
+				staticDir = await buildAssetApp(projectRoot, target.name, target.app, loaded.manifest.rebase, void 0, { quietStdout: isJsonMode() });
+			} catch (err) {
+				fail(err instanceof Error ? err.message : String(err));
+			}
 			if (!staticDir) {
 				fail(`App "${target.name}" produced no bundle.`, "A static app needs both a `build` command and an `output` directory in rebase.json.");
 				return;
@@ -15717,22 +16057,32 @@ async function deployBundle(opts) {
 			app: target.app
 		};
 		const { graph: resourceGraph, issues: resourceIssues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, backend.app));
-		if (resourceIssues.length > 0) throw new Error(`${resourceIssues.length} problem(s) in the declared resources:\n` + resourceIssues.map((i) => `  ${i.path}  ${i.message}`).join("\n"));
-		bundleDir = (await buildBundle({
-			projectRoot,
-			appName: backend.name,
-			app: backend.app,
-			runtimeRange: loaded.manifest.rebase,
-			resources: resourceGraph,
-			skipTypeCheck: opts.skipTypeCheck,
-			log: (m) => progress(chalk.gray(m))
-		})).outDir;
+		if (resourceIssues.length > 0) fail(`${resourceIssues.length} problem(s) in the declared resources:\n` + resourceIssues.map((i) => `  ${i.path}  ${i.message}`).join("\n"), void 0, "build_failed");
+		let result;
 		try {
+			result = await buildBundle({
+				projectRoot,
+				appName: backend.name,
+				app: backend.app,
+				runtimeRange: loaded.manifest.rebase,
+				resources: resourceGraph,
+				skipTypeCheck: opts.skipTypeCheck,
+				skipSchema: opts.skipSchema,
+				vendor: false,
+				log: (m) => progress(chalk.gray(m)),
+				quietStdout: isJsonMode()
+			});
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err), void 0, "build_failed");
+		}
+		bundleDir = result.outDir;
+		if (!opts.noStatic) try {
 			const folded = await foldFrontendIntoBundle({
 				projectRoot,
 				manifest: loaded.manifest,
 				bundleDir,
-				log: (m) => progress(m)
+				log: (m) => progress(m),
+				quietStdout: isJsonMode()
 			});
 			for (const outcome of folded) progress(chalk.gray(`  folded ${outcome.appName} in (${outcome.fileCount} file(s), served at ${outcome.path})`));
 		} catch (err) {
@@ -15757,20 +16107,32 @@ async function deployBundle(opts) {
 */
 async function uploadAndTrigger(opts) {
 	const { client, url, projectId, projectRef, projectRoot, bundleDir } = opts;
-	const manifest = readBundleManifest(bundleDir);
+	let manifest;
+	try {
+		manifest = readBundleManifest(bundleDir);
+	} catch (err) {
+		fail(err instanceof Error ? err.message : String(err), void 0, "invalid_bundle");
+	}
+	const record = (followed, status) => recordDeploy({
+		followed,
+		status,
+		deduplicated: false,
+		frameworkVersion: manifest.runtime?.builtAgainst,
+		startedAt: opts.startedAt,
+		projectRoot
+	});
 	if (manifest.hooks?.native) {
 		const names = (manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
 		fail(`This bundle depends on native modules${names ? ` (${names})` : ""}, which the managed runtime cannot run.`, "Remove the native dependency, or deploy on the custom runtime.");
 	}
 	const tarPath = path.join(os.tmpdir(), `rebase-bundle-${Date.now()}.tar.gz`);
-	const token = client.auth.getSession()?.accessToken;
-	if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
 	let bundleId;
 	try {
-		await packBundle(bundleDir, tarPath);
-		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
+		const packed = await packBundleForUpload(bundleDir, tarPath, manifest);
+		if (packed.modulesLeftOut) warn("This bundle's installed dependencies are not uploaded: a managed pod installs them when it starts.", "Build it with `rebase build --no-vendor` to skip installing a tree the upload leaves out.");
+		const sizeMb = (packed.bytes / 1024 / 1024).toFixed(1);
 		progress(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
-		bundleId = await uploadBundle(url, token, projectId, tarPath);
+		bundleId = await uploadBundle(url, await uploadToken(client, url), projectId, tarPath);
 	} catch (e) {
 		fail(e instanceof Error ? e.message : String(e));
 		return;
@@ -15791,7 +16153,7 @@ async function uploadAndTrigger(opts) {
 	else if (opts.uploadSource && manifest.kind !== "static") rebuildSource = await prepareRebuildSource({
 		projectRoot,
 		url,
-		token,
+		token: () => freshAccessToken(client),
 		projectId,
 		manifest: projectManifest,
 		progress: (line) => progress(chalk.gray(line)),
@@ -15831,6 +16193,7 @@ async function uploadAndTrigger(opts) {
 			sourceUploaded: rebuildSource !== null,
 			following: false
 		});
+		await record(false, "not_followed");
 		return;
 	}
 	if (!isJsonMode()) {
@@ -15838,11 +16201,12 @@ async function uploadAndTrigger(opts) {
 		console.log(chalk.gray("    Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
 		console.log("");
 	}
-	const status = await streamBuildLogs(client, deploymentId, {
+	const { status } = await streamBuildLogs(client, deploymentId, {
 		quiet: isJsonMode(),
 		timeoutMs: opts.timeoutMs,
 		projectId,
-		url
+		url,
+		onTerminal: (ended) => record(true, ended)
 	});
 	emit(() => {}, {
 		success: true,
@@ -15885,10 +16249,42 @@ function isManagedProject(project, latest) {
 	if (pick(project, "runtimeMode", "runtime_mode") === "managed") return true;
 	return latest?.status === "success" && pick(latest, "bundleId", "bundle_id") !== void 0;
 }
-/** What a `deploy` with nothing attached will build, in the words to print. */
-function planBareDeploy(project, latest, now) {
+/** A row's own `createdAt`, in ms; 0 when it has none that parses. */
+function createdAtMs(row) {
+	const raw = row.createdAt ?? row.created_at;
+	const at = raw instanceof Date ? raw.getTime() : typeof raw === "string" ? new Date(raw).getTime() : NaN;
+	return Number.isNaN(at) ? 0 : at;
+}
+/**
+* The deployment whose uploaded archive a bare deploy rebuilds, if any.
+*
+* The control plane's own rule (`reusableSourceRef`, over the newest 25 rows):
+* the newest row, by its own `createdAt`, carrying a build-context ref. Not the
+* newest row — a rollback or a bundle deploy carries none, and the upload
+* rebuilt then is the one before it.
+*/
+function snapshotDeployment(recent) {
+	let best;
+	for (const row of recent) {
+		const ref = pick(row, "sourceRef", "source_ref");
+		if (!ref || ref.includes("..") || !ref.endsWith(".tar.gz")) continue;
+		const at = createdAtMs(row);
+		if (!best || at > best.at) best = {
+			row,
+			at
+		};
+	}
+	return best?.row;
+}
+/**
+* What a `deploy` with nothing attached will build, in the words to print.
+*
+* `recent` is the project's newest deployments, newest first — the same page
+* the control plane reads to choose an archive.
+*/
+function planBareDeploy(project, recent, now) {
 	const projectRow = project;
-	const deploymentRow = latest;
+	const latest = recent[0];
 	const managed = isManagedProject(project, latest);
 	const repo = pick(projectRow, "gitRepoUrl", "git_repo_url");
 	if (repo) {
@@ -15899,12 +16295,16 @@ function planBareDeploy(project, latest, now) {
 			lines: [`Building from git: ${repo}${branch ? ` (${branch})` : ""}.`]
 		};
 	}
-	if (pick(deploymentRow, "sourceRef", "source_ref")) {
-		const age = timeAgo(latest?.createdAt ?? latest?.created_at, now);
+	const snapshot = snapshotDeployment(recent);
+	if (snapshot) {
+		const age = timeAgo(snapshot.createdAt ?? snapshot.created_at, now);
+		const lines = [`Rebuilding the stored source archive${snapshot.id !== void 0 ? ` from deployment ${snapshot.id}` : ""}${age ? `, uploaded ${age}` : ""}.`];
+		if (latest && snapshot !== latest && latest.id !== void 0) lines.push(`Deployment ${latest.id}, the newest, carried no archive of its own, so this is not what it deployed.`);
+		lines.push("This directory is NOT uploaded — pass `--source .` to build what is on disk.");
 		return {
 			managed,
 			source: "snapshot",
-			lines: [`Rebuilding the stored source archive${latest?.id !== void 0 ? ` from deployment ${latest.id}` : ""}${age ? `, uploaded ${age}` : ""}.`, "This directory is NOT uploaded — pass `--source .` to build what is on disk."]
+			lines
 		};
 	}
 	return {
@@ -15992,22 +16392,28 @@ function warningPayload(warnings) {
 	};
 }
 /**
-* Read the two rows the preflight needs.
+* Read what the preflight needs: the project row and its newest deployments.
 *
-* Best effort by construction: a preflight that cannot read is a preflight that
-* says nothing, never a deploy that fails. The managed refusal rides on the same
-* read, so an unreadable project falls through to the old behaviour rather than
-* blocking a deploy on a lookup.
+* `readable: false` when either read failed. The plan lines are best effort and
+* say nothing then; the managed refusal is not — see the caller.
 */
 async function readDeployContext(client, projectId) {
 	try {
-		const [project, latest] = await Promise.all([client.data.collection("projects").findById(projectId), latestDeployment(client, projectId)]);
+		const [project, recent] = await Promise.all([client.data.collection("projects").findById(projectId), client.data.collection("deployments").find({
+			where: { project: ["==", projectId] },
+			orderBy: ["createdAt", "desc"],
+			limit: 25
+		})]);
 		return {
 			project,
-			latest
+			recent: recent.data,
+			readable: true
 		};
 	} catch {
-		return {};
+		return {
+			recent: [],
+			readable: false
+		};
 	}
 }
 /**
@@ -16117,6 +16523,8 @@ var DEPLOY_FLAGS = {
 	"--bundle": Boolean,
 	"--bundle-dir": String,
 	"--skip-type-check": Boolean,
+	"--no-static": Boolean,
+	"--skip-schema": Boolean,
 	"--eject": Boolean,
 	"--no-source": Boolean,
 	"--allow-downgrade": Boolean,
@@ -16178,7 +16586,7 @@ async function recordDeploy(o) {
 		deduplicated: o.deduplicated,
 		framework_version: o.frameworkVersion ?? null,
 		duration: durationBucket(Date.now() - o.startedAt)
-	}, { projectRoot: process.cwd() });
+	}, { projectRoot: o.projectRoot ?? process.cwd() });
 }
 async function deployCommand(rawArgs, projectRef) {
 	const startedAt = Date.now();
@@ -16201,15 +16609,19 @@ async function deployCommand(rawArgs, projectRef) {
 			message: args["--message"],
 			appName,
 			skipTypeCheck: args["--skip-type-check"] === true,
+			skipSchema: args["--skip-schema"] === true,
+			noStatic: args["--no-static"] === true,
 			follow: args["--no-follow"] !== true,
 			timeoutMs: resolveDeployTimeout(args["--timeout"]),
 			uploadSource: args["--no-source"] !== true,
-			allowDowngrade: args["--allow-downgrade"] === true
+			allowDowngrade: args["--allow-downgrade"] === true,
+			startedAt
 		});
 		return;
 	}
-	const { project, latest } = await readDeployContext(client, projectId);
-	const plan = planBareDeploy(project, latest, /* @__PURE__ */ new Date());
+	const { project, recent, readable } = await readDeployContext(client, projectId);
+	const plan = planBareDeploy(project, recent, /* @__PURE__ */ new Date());
+	if (!readable && args["--eject"] !== true) fail(`Could not read ${projectRef}, so this deploy cannot tell whether it would eject the project from the managed runtime.`, "Try again in a moment. If leaving the managed runtime is intended, pass `--eject`.", "preflight_unreadable");
 	const eject = {
 		managed: plan.managed,
 		source: Boolean(args["--source"]),
@@ -16227,9 +16639,7 @@ async function deployCommand(rawArgs, projectRef) {
 	if (args["--source"]) {
 		const tarPath = await createSourceTarball(args["--source"]);
 		try {
-			const token = client.auth.getSession()?.accessToken;
-			if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
-			source = await uploadSource(url, token, projectId, tarPath);
+			source = await uploadSource(url, await uploadToken(client, url), projectId, tarPath);
 		} finally {
 			fs.rmSync(tarPath, { force: true });
 		}
@@ -16253,7 +16663,7 @@ async function deployCommand(rawArgs, projectRef) {
 			deduplicated: res.deduplicated === true
 		};
 	} catch (e) {
-		triggered = resolveTriggerFailure(e);
+		resolveTriggerFailure(e);
 	}
 	const { deploymentId, deduplicated } = triggered;
 	if (!isJsonMode()) console.log(chalk.gray(deduplicated ? `  Deployment ${deploymentId} is already running — following it.` : `  Deployment ${deploymentId} created.${frameworkVersion ? `  (@rebasepro/* ${frameworkVersion})` : ""}`));
@@ -16281,18 +16691,18 @@ async function deployCommand(rawArgs, projectRef) {
 		console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
 		console.log("");
 	}
-	const status = await streamBuildLogs(client, deploymentId, {
+	const { status } = await streamBuildLogs(client, deploymentId, {
 		quiet: isJsonMode(),
 		timeoutMs: resolveDeployTimeout(args["--timeout"]),
 		projectId,
-		url
-	});
-	await recordDeploy({
-		followed: true,
-		status,
-		deduplicated,
-		frameworkVersion,
-		startedAt
+		url,
+		onTerminal: (ended) => recordDeploy({
+			followed: true,
+			status: ended,
+			deduplicated,
+			frameworkVersion,
+			startedAt
+		})
 	});
 	emit(() => {}, {
 		deploymentId,
@@ -16311,29 +16721,26 @@ function resolveDeployTimeout(value) {
 	});
 }
 /**
-* Turn a failed trigger into either a deployment to follow, or an exit.
+* Turn a failed trigger into an exit that says why.
 *
-* The 409 is the interesting one. A deploy trigger can reach the control plane
-* twice without anybody asking twice — the SDK transport replays a request once
-* after refreshing an expired token, and any lost response has the same effect
-* — so "a deployment is already in progress" was routinely describing the
-* deployment this very command had just created. With no id in the message the
-* only available reading was "someone else is deploying, back off", and the
-* build stream was lost either way.
+* A 409 is a refusal, whoever holds the lock. The control plane answers a
+* replay of this very trigger — the same user sending the same uploaded
+* archive — with a 200 carrying `deduplicated: true`, which the success path
+* follows. So the deployment a 409 names is always a different one, and
+* `mine` means only that the same user started it: an earlier deploy, building
+* earlier code. Following it reported that deploy's verdict as this one's, and
+* the code just uploaded was never built.
 *
-* So: if the control plane says the blocking deployment is ours, we attach to
-* it. If it is not ours, we still name it, because "which one, since when, from
-* where" is the difference between an actionable refusal and a dead end.
+* The refusal names the blocker, because "which one, since when, from where"
+* is the difference between an actionable refusal and a dead end.
 */
 function resolveTriggerFailure(e) {
 	const err = e;
 	if (err?.status === 409) {
 		const blocking = err.details?.deployment;
-		if (blocking?.id && blocking.mine) return {
-			deploymentId: String(blocking.id),
-			deduplicated: true
-		};
-		fail(blocking?.id ? `Deployment ${blocking.id} is already in progress for this project${blocking.triggerSource && blocking.triggerSource !== "unknown" ? `, triggered from the ${blocking.triggerSource}` : ""}${blocking.createdAt ? ` at ${fmtDate(blocking.createdAt)}` : ""}.` : "A deployment is already in progress for this project.", blocking?.id ? `Follow it with \`rebase cloud logs -f\`, or stop it with \`rebase cloud cancel ${blocking.id}\`.` : "Follow it with `rebase cloud logs -f`.", "deploy_in_progress");
+		const where = blocking?.triggerSource && blocking.triggerSource !== "unknown" ? ` from the ${blocking.triggerSource}` : "";
+		const who = blocking?.mine ? ", triggered by you" : where ? ", triggered" : "";
+		fail(blocking?.id ? `Deployment ${blocking.id} is already in progress for this project${who}${where}${blocking.createdAt ? ` at ${fmtDate(blocking.createdAt)}` : ""}.` : "A deployment is already in progress for this project.", blocking?.id ? `Nothing was deployed. Wait for it (\`rebase cloud logs -f\`) or stop it with \`rebase cloud cancel ${blocking.id}\`, then deploy again.` : "Nothing was deployed. Wait for it (`rebase cloud logs -f`), then deploy again.", "deploy_in_progress");
 	}
 	if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.", "payment_required");
 	const refusal = intakeRefusal(e);
@@ -16416,23 +16823,95 @@ async function deployedUrl(client, opts) {
 		return;
 	}
 }
+/**
+* The line an in-progress build keeps rewriting at the end of its log, to prove
+* to the control plane that it is still alive.
+*
+* The control plane's own format — `HEARTBEAT_MARKER` and `heartbeatSuffix` in
+* its `functions/deploy.ts` — which appends `\n<marker><ISO time>\n` to the log
+* on every write and every 30 seconds, and drops it on the terminal write.
+*/
+var BUILD_HEARTBEAT_MARKER = "⏳ Build in progress — control-plane heartbeat ";
+/**
+* A deployment's log without its trailing heartbeat line: the build log itself.
+*
+* Only a heartbeat that is the last line is one. The same text anywhere else is
+* the build quoting it.
+*/
+function withoutHeartbeat(logs) {
+	const at = logs.lastIndexOf(`\n${BUILD_HEARTBEAT_MARKER}`);
+	if (at < 0) return logs;
+	const newline = logs.indexOf("\n", at + 1);
+	return newline === -1 || newline === logs.length - 1 ? logs.slice(0, at) : logs;
+}
+/**
+* What to print of a deployment's log, given everything printed so far.
+*
+* The `logs` column is not append-only. Its heartbeat line is rewritten at the
+* end on every write, and a failed static deploy replaces its whole log with
+* one line. Diffing the raw column by length therefore cut the start off every
+* new chunk — as many characters as the heartbeat that had been there — and
+* printed heartbeat fragments in their place: a failed managed deploy lost the
+* first half of its reason.
+*
+* So the heartbeat is stripped first, and the log printed so far is compared
+* with the log now. When it has only grown, the new text is printed. When it
+* was rewritten, printing resumes from the start of the first line that
+* differs, on a line of its own.
+*/
+function nextLogChunk(printed, rowLogs) {
+	const logs = withoutHeartbeat(rowLogs);
+	if (logs.startsWith(printed)) return {
+		chunk: logs.slice(printed.length),
+		printed: logs
+	};
+	if (printed.startsWith(logs)) return {
+		chunk: "",
+		printed
+	};
+	let same = 0;
+	while (same < logs.length && logs[same] === printed[same]) same++;
+	const lineStart = logs.lastIndexOf("\n", same - 1) + 1;
+	return {
+		chunk: `${printed.endsWith("\n") ? "" : "\n"}${logs.slice(lineStart)}`,
+		printed: logs
+	};
+}
 async function streamBuildLogs(client, deploymentId, opts = {}) {
 	const quiet = opts.quiet === true;
 	const timeoutMs = opts.timeoutMs ?? POLL_TIMEOUT_MS;
-	let printed = 0;
+	let printed = "";
 	const started = Date.now();
+	/** When the current run of failed status reads began. */
+	let unreadableSince;
+	const stopIfTimedOut = async () => {
+		if (Date.now() - started <= timeoutMs) return;
+		await opts.onTerminal?.("timeout");
+		if (!quiet) console.log("");
+		fail(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the build to finish.`, "The deployment may still be running — check `rebase cloud logs`.", "timeout");
+	};
 	for (;;) {
 		let dep;
 		try {
 			dep = await client.data.collection("deployments").findById(deploymentId);
+			unreadableSince = void 0;
 		} catch (e) {
-			reportError(e, "Failed to read deployment status");
+			if (!transientReadFailure(e)) reportError(e, "Failed to read deployment status");
+			unreadableSince ??= Date.now();
+			if (Date.now() - unreadableSince > UNREADABLE_STATUS_MS) {
+				await opts.onTerminal?.("status_unreadable");
+				fail(`Could not read deployment ${deploymentId}'s status for over a minute: ${e instanceof Error ? e.message : String(e)}`, "The deployment may still be running — check `rebase cloud logs`.", "status_unreadable");
+			}
+			await stopIfTimedOut();
+			await sleep(POLL_INTERVAL_MS);
+			continue;
 		}
 		if (!dep) fail(`Deployment ${deploymentId} disappeared.`, void 0, "not_found");
-		const logs = dep.logs ?? "";
-		if (!quiet && logs.length > printed) process.stdout.write(logs.slice(printed));
-		printed = logs.length;
+		const next = nextLogChunk(printed, dep.logs ?? "");
+		if (!quiet && next.chunk !== "") process.stdout.write(next.chunk);
+		printed = next.printed;
 		if (dep.status && dep.status !== "deploying") {
+			await opts.onTerminal?.(dep.status);
 			if (dep.status !== "success") {
 				if (quiet) {
 					printJson({ error: {
@@ -16440,7 +16919,7 @@ async function streamBuildLogs(client, deploymentId, opts = {}) {
 						code: "deploy_failed",
 						status: null,
 						deploymentId,
-						logs
+						logs: withoutHeartbeat(dep.logs ?? "")
 					} });
 					process.exit(1);
 				}
@@ -16456,15 +16935,24 @@ async function streamBuildLogs(client, deploymentId, opts = {}) {
 				if (url) console.log(`  ${chalk.cyan(`https://${url}`)}`);
 				console.log("");
 			}
-			return dep.status;
-		}
-		if (Date.now() - started > timeoutMs) {
-			if (!quiet) console.log("");
-			fail(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the build to finish.`, "The deployment may still be running — check `rebase cloud logs`.", "timeout");
+			return {
+				status: dep.status,
+				logs: withoutHeartbeat(dep.logs ?? "")
+			};
 		}
+		await stopIfTimedOut();
 		await sleep(POLL_INTERVAL_MS);
 	}
 }
+/**
+* Whether a failed status read is worth reading again: no answer at all (the
+* connection failed), or one saying the control plane could not answer now.
+* Anything else — a 401, a 403, a 404 — will say the same next time.
+*/
+function transientReadFailure(e) {
+	const status = typeof e === "object" && e !== null && "status" in e && typeof e.status === "number" ? e.status : void 0;
+	return status === void 0 || status === 408 || status === 429 || status >= 500;
+}
 /** What `rebase cloud logs` parses. Its page pairs against this. */
 var LOGS_FLAGS = {
 	"--runtime": Boolean,
@@ -16487,11 +16975,16 @@ async function logsCommand(rawArgs, projectRef) {
 				method: "GET",
 				path: projectId
 			});
-			console.log("");
-			console.log(chalk.bold(`  📄 Runtime logs — project ${projectRef}`));
-			console.log("");
-			console.log(res.logs ?? chalk.gray("  (no logs)"));
-			console.log("");
+			emit(() => {
+				console.log("");
+				console.log(chalk.bold(`  📄 Runtime logs — project ${projectRef}`));
+				console.log("");
+				console.log(res.logs ?? chalk.gray("  (no logs)"));
+				console.log("");
+			}, {
+				runtime: true,
+				logs: res.logs ?? null
+			});
 		} catch (e) {
 			reportError(e, "Failed to fetch runtime logs");
 		}
@@ -16500,22 +16993,48 @@ async function logsCommand(rawArgs, projectRef) {
 	try {
 		const dep = await latestDeployment(client, projectId);
 		if (!dep) {
-			console.log("");
-			console.log(chalk.gray("  No deployments yet for this project."));
-			console.log("");
+			emit(() => {
+				console.log("");
+				console.log(chalk.gray("  No deployments yet for this project."));
+				console.log("");
+			}, {
+				deploymentId: null,
+				status: null,
+				logs: null
+			});
 			return;
 		}
-		console.log("");
-		console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
-		console.log("");
-		if (args["--follow"] && dep.status === "deploying") await streamBuildLogs(client, String(dep.id), {
-			projectId,
-			url
-		});
-		else {
-			console.log(dep.logs ?? chalk.gray("  (no logs)"));
-			console.log("");
+		const deploymentId = String(dep.id);
+		if (args["--follow"] && dep.status === "deploying") {
+			if (!isJsonMode()) {
+				console.log("");
+				console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
+				console.log("");
+			}
+			const { status, logs } = await streamBuildLogs(client, deploymentId, {
+				quiet: isJsonMode(),
+				projectId,
+				url
+			});
+			emit(() => {}, {
+				deploymentId,
+				status,
+				logs
+			});
+			return;
 		}
+		const logs = dep.logs == null ? null : withoutHeartbeat(dep.logs);
+		emit(() => {
+			console.log("");
+			console.log(chalk.bold(`  📄 Build logs — deployment ${dep.id}`) + `  ${colorStatus(dep.status)}`);
+			console.log("");
+			console.log(logs ?? chalk.gray("  (no logs)"));
+			console.log("");
+		}, {
+			deploymentId,
+			status: dep.status ?? null,
+			logs
+		});
 	} catch (e) {
 		reportError(e, "Failed to fetch build logs");
 	}
@@ -16884,8 +17403,7 @@ async function setEnv(rawArgs) {
 	const projectId = await requireProject(rawArgs, client);
 	displayProjectRef(rawArgs);
 	if (!parsed || !parsed.key) fail("Usage: rebase cloud env set KEY=VALUE [--secret]", void 0, "usage");
-	const buildTimePrefix = buildTimeEnvPrefix(parsed.key);
-	if (buildTimePrefix && !args["--force"]) fail(`${parsed.key} is read by your bundler at BUILD time, and project variables are applied at rollout — after the image is built. Setting it here would not reach the bundle.`, `Put ${buildTimePrefix}* variables in the source you deploy (a committed .env, or your build config), then \`rebase cloud deploy\`. Pass --force if your build genuinely reads this at run time.`, "build_time_variable");
+	if (buildTimeEnvPrefix(parsed.key) && !args["--force"]) fail(`${parsed.key} is read by your bundler at BUILD time, and project variables are applied at rollout — after the image is built. Setting it here would not reach the bundle.`, `A managed deploy builds the frontend on this machine: set it in your shell when you run \`rebase cloud deploy\`${parsed.key === "VITE_API_URL" ? "" : ", or in the app's .env.production"}. A --source build runs on the platform and never receives .env files: set it in the build itself — an ENV line in your Dockerfile, or \`define\` in your bundler config. Pass --force if your build genuinely reads this at run time.`, "build_time_variable");
 	const body = {
 		key: parsed.key,
 		value: parsed.value
@@ -16983,6 +17501,28 @@ async function revealEnv(rawArgs) {
 		reportError(e, "Failed to reveal environment variable");
 	}
 }
+/**
+* One `KEY=value` line that dotenv reads back as exactly `value`, or null when
+* no quoting can carry it.
+*
+* dotenv's quoting is not JSON's, and `JSON.stringify` was what this used: a
+* double-quoted value has only `\n` and `\r` unescaped, so every other
+* backslash stayed and `{"a":1}` came back as `{\"a\":1}`. Single quotes and
+* backticks are literal — nothing inside is unescaped, and either may span
+* lines — so they carry any value without their own quote character. Double
+* quotes come last: they cannot hold a `"` or a literal backslash-n, and they
+* are the only way to carry a carriage return, which dotenv folds into a
+* newline everywhere else.
+*/
+function dotenvLine(key, value) {
+	if (!/[\s#'"`\\]/.test(value)) return `${key}=${value}`;
+	if (!value.includes("\r")) {
+		if (!value.includes("'")) return `${key}='${value}'`;
+		if (!value.includes("`")) return `${key}=\`${value}\``;
+	}
+	if (!value.includes("\"") && !/\\[nr]/.test(value)) return `${key}="${value.replace(/\r/g, "\\r").replace(/\n/g, "\\n")}"`;
+	return null;
+}
 async function pullEnv(rawArgs) {
 	const { flags: args } = parseCloudArgs({
 		spec: {
@@ -17024,15 +17564,22 @@ async function pullEnv(rawArgs) {
 				projectId,
 				key: v.key
 			}, { path: "reveal" });
-			const needsQuote = /[\s#'"]/.test(revealed.value);
-			lines.push(`${v.key}=${needsQuote ? JSON.stringify(revealed.value) : revealed.value}`);
+			const line = dotenvLine(v.key, revealed.value);
+			if (line === null) {
+				skipped.push({
+					key: v.key,
+					reason: "no .env quoting carries this value unchanged"
+				});
+				continue;
+			}
+			lines.push(line);
 			written.push(v.key);
 		}
 		fs.writeFileSync(outPath, lines.length ? lines.join("\n") + "\n" : "", { mode: 384 });
 		emit(() => {
 			success(`Wrote ${written.length} variable${written.length === 1 ? "" : "s"} to ${outPath}`);
 			if (skipped.length) {
-				console.log(chalk.gray(`  Skipped ${skipped.length} secret variable(s): ${skipped.map((s) => s.key).join(", ")}`));
+				for (const s of skipped) console.log(chalk.gray(`  Skipped ${s.key}: ${s.reason}`));
 				console.log("");
 			}
 		}, {
@@ -17086,27 +17633,129 @@ function printEnvHelp() {
 //#endregion
 //#region src/commands/cloud/domains.ts
 /**
-* `rebase cloud domains` — a project's custom domain.
-*
-*   domains list             Current domain + the DNS records it needs
-*   domains add <domain>     Register a domain (starts, does not finish, setup)
-*   domains verify           Check the published DNS now; live only if it passes
-*   domains remove           Detach the custom domain
-*
-* The DNS record set comes from the server (`verify-domain`), never composed
-* here: whether to publish an A or a CNAME depends on apex-vs-subdomain and on
-* the ingress address behind the tenant host, which the CLI cannot know. Adding
-* a domain only registers it — it is unverified until the records are published
-* and `verify` passes.
+* `rebase cloud domains` — the hostnames a project is served on.
+*
+*   domains list               Every host, its status, and the DNS records it needs
+*   domains add <domain>       Register a host (starts, does not finish, setup)
+*   domains verify [domain]    Check the host's published DNS now; live only if it passes
+*   domains remove <domain>    Stop serving a host
+*
+* A project's hosts are rows of the control plane's `project_domains` table,
+* managed through its `domains` function — the same one the console uses. The
+* Ingress is built from those rows, one verified host at a time, so every
+* action here addresses a row. The single `projects.customDomain` column is a
+* projection the control plane keeps in step with them; writing it directly
+* changes nothing that is served.
+*
+* Two cases still go through that column, because the control plane still
+* serves them from it: a project with no rows at all, whose one domain lives
+* only in the column, and a control plane that has no `domains` function.
+*
+* The DNS record set comes from the server, never composed here: whether to
+* publish an A or a CNAME depends on apex-vs-subdomain and on the ingress
+* address behind the tenant host, which the CLI cannot know. Adding a host only
+* registers it — it is unverified until the records are published and `verify`
+* passes.
+*/
+/** The column's one domain as an entry, or none. */
+function columnEntry(setup) {
+	if (!setup.domain) return [];
+	return [{
+		id: null,
+		host: setup.domain,
+		primary: true,
+		status: setup.status === "verified" ? "verified" : "pending",
+		verifiedAt: setup.verifiedAt ?? null,
+		isApex: setup.isApex,
+		tenantHost: setup.tenantHost,
+		instructions: setup.instructions
+	}];
+}
+/**
+* A row, or null for one with no id or host — it cannot be verified or removed,
+* so it is not offered as a domain. Anything but `verified` is pending: an
+* unreadable status must not read as live.
+*/
+function rowEntry(row) {
+	if (typeof row?.id !== "string" || typeof row.host !== "string") return null;
+	return {
+		id: row.id,
+		host: row.host,
+		primary: row.primary === true,
+		status: row.status === "verified" ? "verified" : "pending",
+		verifiedAt: row.verifiedAt ?? null,
+		isApex: row.isApex,
+		tenantHost: row.tenantHost,
+		instructions: row.instructions
+	};
+}
+/**
+* Whether a failed `domains` call means the control plane has no such function
+* — as opposed to refusing this project, which the function answers `not_found`.
 */
-async function fetchDomainSetup(client, projectId) {
+function noDomainsFunction(e) {
+	if (typeof e !== "object" || e === null) return false;
+	const status = "status" in e ? e.status : void 0;
+	const code = "code" in e ? e.code : void 0;
+	return status === 404 && code !== "not_found";
+}
+async function fetchColumnSetup(client, projectId) {
 	return client.functions.invoke("verify-domain", void 0, {
 		method: "GET",
 		path: projectId
 	});
 }
-function printRecords(setup) {
-	const recs = [setup.instructions?.pointing, setup.instructions?.ownership].filter(Boolean);
+/** Every host this project is served on, or may be once verified. */
+async function loadDomains(client, projectId) {
+	let listed;
+	try {
+		listed = await client.functions.invoke("domains", void 0, {
+			method: "GET",
+			path: projectId
+		});
+	} catch (e) {
+		if (!noDomainsFunction(e)) throw e;
+		const setup = await fetchColumnSetup(client, projectId);
+		return {
+			model: "column",
+			tenantHost: setup.tenantHost,
+			domains: columnEntry(setup)
+		};
+	}
+	const domains = (listed.domains ?? []).map(rowEntry).filter((d) => d !== null);
+	if (domains.length > 0) return {
+		model: "rows",
+		tenantHost: listed.tenantHost,
+		domains
+	};
+	const setup = await fetchColumnSetup(client, projectId);
+	return {
+		model: "rows",
+		tenantHost: listed.tenantHost ?? setup.tenantHost,
+		domains: columnEntry(setup)
+	};
+}
+/**
+* The host an action names, or the only one there is to name.
+*
+* Refuses to guess among several: removing or verifying the wrong host of a
+* live site is not a mistake worth saving a word over.
+*/
+function pickDomain(set, named, action) {
+	if (named) {
+		const wanted = named.trim().toLowerCase().replace(/\.$/, "");
+		const found = set.domains.find((d) => d.host.toLowerCase() === wanted);
+		if (!found) fail(`This project has no domain ${named}.`, set.domains.length ? `Its domains: ${set.domains.map((d) => d.host).join(", ")}.` : "It has no custom domains. Add one with `rebase cloud domains add <domain>`.", "not_found");
+		return found;
+	}
+	if (set.domains.length === 1) return set.domains[0];
+	if (set.domains.length === 0) fail("This project has no custom domains.", "Add one with `rebase cloud domains add <domain>`.", "not_found");
+	const pending = set.domains.filter((d) => d.status !== "verified");
+	if (action === "verify" && pending.length === 1) return pending[0];
+	fail(`This project has ${set.domains.length} domains; name the one to ${action}.`, `Run \`rebase cloud domains ${action} <domain>\` with one of: ${set.domains.map((d) => d.host).join(", ")}.`, "usage");
+}
+function printRecords(instructions) {
+	const recs = [instructions?.pointing, instructions?.ownership].filter(Boolean);
 	if (!recs.length) return;
 	console.log(chalk.bold("  DNS records to publish:"));
 	for (const r of recs) console.log(`    ${chalk.cyan(r.type)}  ${r.name}  →  ${r.values.join(", ")}`);
@@ -17124,7 +17773,7 @@ async function domainsCommand(action, rawArgs) {
 			await addDomain(rawArgs);
 			break;
 		case "verify":
-			await verifyDomains(rawArgs);
+			await verifyDomain(rawArgs);
 			break;
 		case "remove":
 		case "rm":
@@ -17149,47 +17798,50 @@ async function listDomains(rawArgs) {
 	const projectId = await requireProject(rawArgs, client);
 	const projectRef = displayProjectRef(rawArgs);
 	try {
-		const setup = await fetchDomainSetup(client, projectId);
+		const set = await loadDomains(client, projectId);
 		emit(() => {
 			console.log("");
-			console.log(chalk.bold(`  🌐 Custom domain — project ${projectRef}`));
+			console.log(chalk.bold(`  🌐 Custom domains — project ${projectRef}`));
 			console.log("");
-			if (!setup.domain) {
-				console.log(chalk.gray("  No custom domain. Add one with `rebase cloud domains add <domain>`."));
+			if (!set.domains.length) {
+				console.log(chalk.gray("  No custom domains. Add one with `rebase cloud domains add <domain>`."));
 				console.log("");
 				return;
 			}
-			keyValues([
-				["Domain", setup.domain],
-				["Status", setup.status === "verified" ? chalk.green(setup.status) : chalk.yellow(setup.status)],
-				["Apex", setup.isApex === void 0 ? void 0 : setup.isApex ? "yes" : "no"],
-				["Tenant host", setup.tenantHost],
-				["Verified at", setup.verifiedAt ?? void 0]
-			]);
+			if (set.tenantHost) {
+				keyValues([["Tenant host", set.tenantHost]]);
+				console.log("");
+			}
+			for (const d of set.domains) {
+				const status = d.status === "verified" ? chalk.green(d.status) : chalk.yellow(d.status);
+				console.log(`  ${chalk.bold(d.host)}  ${status}${d.primary && set.domains.length > 1 ? chalk.gray("  primary") : ""}`);
+				if (d.verifiedAt) console.log(chalk.gray(`    verified ${d.verifiedAt}`));
+				if (d.status !== "verified") printRecords(d.instructions);
+			}
 			console.log("");
-			if (setup.status !== "verified") printRecords(setup);
 		}, {
 			projectId,
-			...setup
+			tenantHost: set.tenantHost ?? null,
+			domains: set.domains
 		});
 	} catch (e) {
-		reportError(e, "Failed to load custom domain");
+		reportError(e, "Failed to load custom domains");
 	}
 }
 /**
-* The domain `domains add` was asked to register.
+* The domain an action was given, or undefined.
 *
 * Exported so its tests drive the real parser. Under the old operand filter
 * `rebase cloud domains add -p acme` registered a domain called "acme" — the
 * project slug, read out of `--project`'s own value — and a registered domain
 * is a project-record write, not a no-op.
 */
-function resolveDomainArg(rawArgs) {
+function resolveDomainArg(rawArgs, action = "add") {
 	return parseCloudArgs({
 		spec: {},
 		rawArgs,
 		commandWords: 3,
-		command: "cloud domains add",
+		command: `cloud domains ${action}`,
 		maxPositionals: 1
 	}).positionals[0];
 }
@@ -17198,41 +17850,51 @@ async function addDomain(rawArgs) {
 	if (!domain) fail("Usage: rebase cloud domains add <domain>", void 0, "usage");
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
+	let added;
 	try {
-		await client.data.collection("projects").update(projectId, { customDomain: domain });
-		const setup = await fetchDomainSetup(client, projectId);
-		emit(() => {
-			success(`Registered ${chalk.bold(domain)} — not yet verified`);
-			printRecords(setup);
-			console.log(chalk.gray("  Publish the records above, then run `rebase cloud domains verify`."));
-			console.log("");
-		}, {
-			success: true,
-			projectId,
-			...setup
-		});
+		const set = await loadDomains(client, projectId);
+		if (set.model === "column") {
+			await client.data.collection("projects").update(projectId, { customDomain: domain });
+			added = columnEntry(await fetchColumnSetup(client, projectId))[0];
+		} else {
+			const legacy = set.domains.find((d) => d.id === null);
+			if (legacy && legacy.host.toLowerCase() !== domain.trim().toLowerCase()) warn(`${legacy.host} is held outside this project's host list, and stops being served once another host is verified.`, `Keep it by adding it too: \`rebase cloud domains add ${legacy.host}\`, then \`rebase cloud domains verify ${legacy.host}\`.`);
+			added = rowEntry(await client.functions.invoke("domains", { host: domain }, { path: projectId })) ?? void 0;
+		}
 	} catch (e) {
 		reportError(e, "Failed to register domain");
 	}
-}
-async function verifyDomains(rawArgs) {
-	parseCloudArgs({
-		spec: {},
-		rawArgs,
-		commandWords: 3,
-		command: "cloud domains",
-		maxPositionals: 0
+	if (!added) fail(`The control plane did not return ${domain}, so whether it was registered is unknown.`, "Run `rebase cloud domains list`.");
+	const registered = added;
+	emit(() => {
+		success(`Registered ${chalk.bold(registered.host)} — not yet verified`);
+		printRecords(registered.instructions);
+		console.log(chalk.gray(`  Publish the records above, then run \`rebase cloud domains verify ${registered.host}\`.`));
+		console.log("");
+	}, {
+		success: true,
+		projectId,
+		...registered
 	});
+}
+async function verifyDomain(rawArgs) {
+	const named = resolveDomainArg(rawArgs, "verify");
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
-	displayProjectRef(rawArgs);
+	let set;
 	try {
-		const res = await client.functions.invoke("verify-domain", {}, { path: projectId });
+		set = await loadDomains(client, projectId);
+	} catch (e) {
+		reportError(e, "Failed to load custom domains");
+	}
+	const target = pickDomain(set, named, "verify");
+	try {
+		const res = verifyOutcome(target.id === null ? await client.functions.invoke("verify-domain", {}, { path: projectId }) : await client.functions.invoke("domains", {}, { path: `${projectId}/${target.id}/verify` }), target);
 		emit(() => {
 			console.log("");
-			if (res.verified) success(`${res.domain} is verified and live`);
+			if (res.verified) success(`${target.host} is verified and live`);
 			else {
-				console.log(chalk.yellow(`  ⚠ ${res.domain ?? "domain"} is not verified yet`));
+				console.log(chalk.yellow(`  ⚠ ${target.host} is not verified yet`));
 				console.log("");
 				const rows = [["Ownership", res.checks.ownership], ["Pointing", res.checks.pointing]];
 				for (const [label, check] of rows) {
@@ -17243,41 +17905,78 @@ async function verifyDomains(rawArgs) {
 					if (check.error) console.log(chalk.gray(`    error: ${check.error}`));
 				}
 				console.log("");
-				printRecords(res);
+				printRecords(res.entry.instructions);
 			}
 		}, {
 			projectId,
+			id: res.entry.id,
+			host: res.entry.host,
 			verified: res.verified,
-			status: res.status,
-			domain: res.domain,
+			status: res.entry.status,
 			checks: res.checks,
-			instructions: res.instructions
+			instructions: res.entry.instructions ?? null
 		});
 		if (!res.verified) process.exit(1);
 	} catch (e) {
 		reportError(e, "Failed to verify domain");
 	}
 }
+/** A verify answer from either door, as one shape. */
+function verifyOutcome(res, target) {
+	const verified = res.verified === true;
+	const unchecked = {
+		ok: false,
+		expected: [],
+		observed: []
+	};
+	return {
+		verified,
+		checks: res.checks ?? {
+			ownership: unchecked,
+			pointing: unchecked
+		},
+		entry: {
+			...target,
+			status: verified || res.status === "verified" ? "verified" : "pending",
+			verifiedAt: res.verifiedAt ?? target.verifiedAt,
+			instructions: res.instructions ?? target.instructions
+		}
+	};
+}
 async function removeDomain(rawArgs) {
-	const { flags: args } = parseCloudArgs({
+	const { flags: args, positionals } = parseCloudArgs({
 		spec: {},
 		rawArgs,
 		commandWords: 3,
 		command: "cloud domains remove",
-		maxPositionals: 0
+		maxPositionals: 1
 	});
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
 	const projectRef = displayProjectRef(rawArgs);
+	let set;
+	try {
+		set = await loadDomains(client, projectId);
+	} catch (e) {
+		reportError(e, "Failed to load custom domains");
+	}
+	const target = pickDomain(set, positionals[0], "remove");
 	await confirmDestructive({
 		yes: Boolean(args["--yes"]),
-		prompt: `Remove the custom domain from project ${projectRef}?`
+		prompt: `Stop serving ${target.host} on project ${projectRef}?`
 	});
 	try {
-		await client.data.collection("projects").update(projectId, { customDomain: "" });
-		emit(() => success(`Removed the custom domain from project ${projectRef}`), {
+		let removed = true;
+		if (target.id === null) await client.data.collection("projects").update(projectId, { customDomain: "" });
+		else removed = (await client.functions.invoke("domains", void 0, {
+			method: "DELETE",
+			path: `${projectId}/${target.id}`
+		}))?.removed !== false;
+		emit(() => success(removed ? `${target.host} is no longer served by project ${projectRef}` : `${target.host} was already gone from project ${projectRef}`), {
 			success: true,
-			projectId
+			projectId,
+			host: target.host,
+			removed
 		});
 	} catch (e) {
 		reportError(e, "Failed to remove domain");
@@ -17286,27 +17985,33 @@ async function removeDomain(rawArgs) {
 function printDomainsHelp() {
 	printGroupHelp({
 		command: "cloud domains",
-		title: "Custom domain",
+		title: "Custom domains",
 		actions: [
 			{
 				action: "list",
-				description: "Show the domain and the DNS records it needs"
+				description: "Every host, its status, and the DNS records it needs"
 			},
 			{
 				action: "add",
 				args: "<domain>",
-				description: "Register a custom domain"
+				description: "Register a host"
 			},
 			{
 				action: "verify",
-				description: "Check DNS and go live"
+				args: "[domain]",
+				description: "Check a host's DNS and put it live"
 			},
 			{
 				action: "remove",
-				description: "Detach the custom domain"
+				args: "<domain>",
+				description: "Stop serving a host"
 			}
 		],
-		notes: ["A CNAME is invalid at a zone apex: use an A record there and a CNAME below it.", "`list` prints the exact records to add — copy them rather than deriving them."]
+		notes: [
+			"A project can be served on several hosts; each is verified on its own.",
+			"A CNAME is invalid at a zone apex: use an A record there and a CNAME below it.",
+			"`list` prints the exact records to add — copy them rather than deriving them."
+		]
 	});
 }
 //#endregion
@@ -17904,6 +18609,25 @@ function resolveDeploymentIdArg(rawArgs, command) {
 		id: positionals[0]
 	};
 }
+/**
+* One deployment by id, when it belongs to `projectId`; undefined otherwise.
+*
+* A read that fails is "not found" too: the caller's refusal says so, and the
+* control plane checks the same ownership again before rolling back.
+*/
+async function deploymentOfProject(client, deploymentId, projectId) {
+	let row;
+	try {
+		row = await client.data.collection("deployments").findById(deploymentId);
+	} catch {
+		return;
+	}
+	if (!row) return void 0;
+	const owner = row.project ?? row.projectId ?? row.project_id;
+	const ownerId = typeof owner === "object" && owner !== null && "id" in owner ? owner.id : owner;
+	if (ownerId !== void 0 && ownerId !== null && String(ownerId) !== projectId) return void 0;
+	return cloudRow(row);
+}
 async function rollbackCommand(rawArgs) {
 	const { flags: args, id: explicitId } = resolveDeploymentIdArg(rawArgs, "cloud rollback");
 	const { client } = await requireClient(rawArgs);
@@ -17918,7 +18642,7 @@ async function rollbackCommand(rawArgs) {
 	if (!rows.length) fail("No deployments to roll back to.", void 0, "no_deployments");
 	let target;
 	if (explicitId) {
-		target = rows.find((d) => String(d.id) === explicitId);
+		target = rows.find((d) => String(d.id) === explicitId) ?? await deploymentOfProject(client, explicitId, projectId);
 		if (!target) fail(`Deployment ${explicitId} not found for project ${projectRef}.`, void 0, "not_found");
 		if (!isRollbackable(target)) fail(`Deployment ${explicitId} is not rollbackable (${ROLLBACKABLE_RULE}).`, "List candidates with `rebase cloud deployments list`.", "deploy_not_rollbackable");
 	} else {
@@ -19075,6 +19799,8 @@ var ACTION_HELP = {
 			["--bundle-dir <path>", "Deploy a bundle that is already built"],
 			["--source <path>", "Upload this directory and build a container image from it"],
 			["--skip-type-check", "Compile without type checking, as `rebase build` does"],
+			["--skip-schema", "Keep the committed database schema instead of regenerating it"],
+			["--no-static", "Deploy the backend without folding the static apps into its bundle"],
 			["--no-source", "Do not upload the project's source beside a backend bundle"],
 			["--allow-downgrade", "Deploy a bundle built on an older framework release than the project runs"],
 			["--eject", "Leave the managed runtime on purpose (ejects to a container image)"]
@@ -19199,7 +19925,7 @@ var ACTION_HELP = {
 	"domains add": {
 		command: "cloud domains add",
 		usage: "cloud domains add <domain>",
-		summary: "Register a custom domain on this project and print the DNS records to publish. Registering is not verifying — run `domains verify` once the records are live.",
+		summary: "Register a custom domain on this project, beside any it already has, and print the DNS records to publish. Registering is not verifying — run `domains verify <domain>` once the records are live.",
 		flags: [],
 		examples: ["rebase cloud domains add app.example.com"],
 		notes: ["At a zone apex use the A record this prints, not a CNAME: a CNAME is invalid at an apex.", "Verification is a separate command because DNS propagation is not instant."]
@@ -19207,7 +19933,7 @@ var ACTION_HELP = {
 	"domains remove": {
 		command: "cloud domains remove",
 		usage: "cloud domains remove <domain>",
-		summary: "Unregister a custom domain. The project keeps serving on its <slug>.rebase.website host. Aliases: `rm`, `delete`.",
+		summary: "Stop serving one custom domain. The project keeps its other domains and its <slug>.rebase.website host. The domain may be left out when the project has only one. Aliases: `rm`, `delete`.",
 		flags: [],
 		examples: ["rebase cloud domains remove app.example.com"]
 	},
@@ -19215,7 +19941,7 @@ var ACTION_HELP = {
 		command: "cloud env set",
 		usage: "cloud env set KEY=VALUE | KEY VALUE [--secret] [--force]",
 		summary: "Set one environment variable on the project. Takes effect on the next deploy — a running instance does not pick it up.",
-		flags: [["--secret", "Store it encrypted and never return it in a listing"], ["--force", "Overwrite a variable that is already set"]],
+		flags: [["--secret", "Store it encrypted and never return it in a listing"], ["--force", "Set a build-time key (VITE_*, NEXT_PUBLIC_*, …) anyway, for a build that reads it at run time"]],
 		examples: [
 			"rebase cloud env set STRIPE_KEY=sk_live_… --secret",
 			"rebase cloud env set LOG_LEVEL debug",
@@ -19376,7 +20102,11 @@ var ACTION_HELP = {
 			"rebase cloud login --email me@example.com",
 			"rebase cloud login --url https://cloud.example.com"
 		],
-		notes: ["--password warns, once, before the request: by the time a login succeeds the password is already in the history file.", "There is no machine token yet, so CI genuinely needs a human's credentials. REBASE_CLOUD_EMAIL and REBASE_CLOUD_PASSWORD are how a secret store hands them over without them appearing on a command line."]
+		notes: [
+			"--password warns, once, before the request: by the time a login succeeds the password is already in the history file.",
+			"There is no machine token yet, so CI genuinely needs a human's credentials. REBASE_CLOUD_EMAIL and REBASE_CLOUD_PASSWORD are how a secret store hands them over without them appearing on a command line.",
+			"In a directory whose .rebase/cloud.json names a control plane you have not signed in to before, login names it and asks first, and refuses without a terminal: a cloned repository does not choose where your password goes. Pass --url <that host> to sign in there on purpose."
+		]
 	},
 	logout: {
 		command: "cloud logout",
@@ -19868,7 +20598,7 @@ var CLOUD_GROUPS = [
 	{
 		action: "domains",
 		section: "Config",
-		description: "Custom domain, its DNS records, and verification"
+		description: "Custom domains, their DNS records, and verification"
 	},
 	{
 		action: "extensions",
@@ -19921,7 +20651,8 @@ var CLOUD_GROUPS = [
 		description: "The organization's billing account and card on file"
 	}
 ];
-CLOUD_GROUPS.map((g) => g.action);
+/** The dispatch words alone — what `--help` routing and the tests iterate. */
+var CLOUD_GROUP_NAMES = CLOUD_GROUPS.map((g) => g.action);
 function printCloudHelp() {
 	printGroupHelp({
 		command: "cloud",
@@ -20210,11 +20941,22 @@ function classifySpec(spec) {
 		kind: "local",
 		protocol
 	};
+	const catalog = /^catalog:(.*)$/.exec(spec.trim());
+	if (catalog) return {
+		kind: "catalog",
+		catalog: catalog[1].trim() || "default"
+	};
 	return {
 		kind: "other",
 		reason: otherReason(spec)
 	};
 }
+/** Why a spec that does not move is left alone, as the report says it. */
+function leftAloneReason(cls) {
+	if (cls.kind === "local") return `a local ${cls.protocol} path, which points at a checkout on this machine rather than a release`;
+	if (cls.kind === "catalog") return "a catalog: reference inside a catalog, which pnpm does not resolve";
+	return cls.reason;
+}
 function otherReason(spec) {
 	const trimmed = spec.trim();
 	if (trimmed.startsWith("workspace:")) return "a workspace: link, resolved inside this repository rather than from the registry";
@@ -20274,6 +21016,9 @@ function discoverProjectFiles(projectRoot) {
 	walk(projectRoot);
 	return found;
 }
+function catalogKey(catalog, pkg) {
+	return `${catalog}\u0000${pkg}`;
+}
 /** Project-relative, POSIX. What every file path in the output looks like. */
 function relativeTo(projectRoot, absolute) {
 	return path.relative(projectRoot, absolute).split(path.sep).join("/");
@@ -20291,13 +21036,18 @@ function planUpgrade(projectRoot, target, options = {}) {
 		skipped: [],
 		overrides: [],
 		unreadable: [],
-		writes: []
+		writes: [],
+		unchanged: 0
+	};
+	const ledger = {
+		refs: [],
+		defined: /* @__PURE__ */ new Set()
 	};
 	const files = discoverProjectFiles(projectRoot);
 	for (const absolute of files.packageJsons) {
 		const file = relativeTo(projectRoot, absolute);
 		const original = fs.readFileSync(absolute, "utf8");
-		const content = planPackageJson(file, original, target, options, plan);
+		const content = planPackageJson(file, original, target, options, plan, ledger);
 		if (content !== null && content !== original) plan.writes.push({
 			file,
 			absolute,
@@ -20307,13 +21057,23 @@ function planUpgrade(projectRoot, target, options = {}) {
 	for (const absolute of files.workspaceYamls) {
 		const file = relativeTo(projectRoot, absolute);
 		const original = fs.readFileSync(absolute, "utf8");
-		const content = planWorkspaceYaml(file, original, target, options, plan);
+		const content = planWorkspaceYaml(file, original, target, options, plan, ledger);
 		if (content !== original) plan.writes.push({
 			file,
 			absolute,
 			content
 		});
 	}
+	for (const ref of ledger.refs) {
+		if (ledger.defined.has(catalogKey(ref.catalog, ref.pkg))) continue;
+		plan.skipped.push({
+			file: ref.file,
+			name: ref.name,
+			field: ref.field,
+			spec: ref.spec,
+			reason: `a pnpm catalog: reference, and no catalog under this project defines it — move the version where the "${ref.catalog}" catalog is declared`
+		});
+	}
 	return plan;
 }
 /** Write what the plan changes. Nothing else on disk is touched. */
@@ -20326,7 +21086,7 @@ var JSON_OVERRIDE_BLOCKS = [
 	["overrides"],
 	["resolutions"]
 ];
-function planPackageJson(file, original, target, options, plan) {
+function planPackageJson(file, original, target, options, plan, ledger) {
 	const bom = original.startsWith("") ? "" : "";
 	const text = original.slice(bom.length);
 	let parsed;
@@ -20371,7 +21131,10 @@ function planPackageJson(file, original, target, options, plan) {
 			const cls = classifySpec(spec);
 			if (cls.kind === "movable") {
 				const to = `${cls.prefix}${target}`;
-				if (to === spec) continue;
+				if (to === spec) {
+					plan.unchanged++;
+					continue;
+				}
 				edits.push({
 					start: member.value.start,
 					end: member.value.end,
@@ -20385,16 +21148,21 @@ function planPackageJson(file, original, target, options, plan) {
 					from: spec,
 					to
 				});
-			} else {
-				const reason = cls.kind === "local" ? `a local ${cls.protocol} path, which points at a checkout on this machine rather than a release` : cls.reason;
-				plan.skipped.push({
-					file,
-					name: member.key,
-					field,
-					spec,
-					reason
-				});
-			}
+			} else if (cls.kind === "catalog") ledger.refs.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				catalog: cls.catalog,
+				pkg: member.key
+			});
+			else plan.skipped.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				reason: leftAloneReason(cls)
+			});
 		}
 	}
 	for (const blockPath of JSON_OVERRIDE_BLOCKS) {
@@ -20415,9 +21183,13 @@ function planPackageJson(file, original, target, options, plan) {
 			}
 			const spec = member.value.value;
 			const cls = classifySpec(spec);
+			const pkg = overrideTarget(member.key);
 			if (cls.kind === "movable") {
 				const to = `${cls.prefix}${target}`;
-				if (to === spec) continue;
+				if (to === spec) {
+					plan.unchanged++;
+					continue;
+				}
 				edits.push({
 					start: member.value.start,
 					end: member.value.end,
@@ -20431,7 +21203,15 @@ function planPackageJson(file, original, target, options, plan) {
 					action: "bumped",
 					to
 				});
-			} else if (cls.kind === "local") if (options.dropLocalOverrides) {
+			} else if (cls.kind === "catalog" && pkg) ledger.refs.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				catalog: cls.catalog,
+				pkg
+			});
+			else if (cls.kind === "local") if (options.dropLocalOverrides) {
 				removals.push([blockPath, member.key]);
 				deletePath(expected, [...blockPath, member.key]);
 				plan.overrides.push({
@@ -20451,7 +21231,7 @@ function planPackageJson(file, original, target, options, plan) {
 				name: member.key,
 				field,
 				spec,
-				reason: cls.reason
+				reason: leftAloneReason(cls)
 			});
 		}
 	}
@@ -20694,7 +21474,8 @@ function readYamlScalar(rest) {
 	};
 }
 /**
-* The top-level `overrides:` block of a `pnpm-workspace.yaml`, read line by line.
+* A top-level block mapping of a `pnpm-workspace.yaml` — `overrides:`,
+* `catalog:` — read line by line.
 *
 * Deliberately narrow. The file is YAML, and the CLI carries no YAML parser; the
 * shape pnpm documents and every project writes is a block mapping of one
@@ -20702,8 +21483,8 @@ function readYamlScalar(rest) {
 * block is counted rather than guessed at, and an inline `overrides: { … }` is
 * reported as not handled.
 */
-function readYamlOverrides(lines) {
-	const keyLine = lines.findIndex((line) => /^overrides:\s*(#.*)?$/.test(line));
+function readYamlBlock(lines, key) {
+	const keyLine = lines.findIndex((line) => new RegExp(`^${key}:\\s*(#.*)?$`).test(line));
 	if (keyLine === -1) return null;
 	const block = {
 		keyLine,
@@ -20716,29 +21497,142 @@ function readYamlOverrides(lines) {
 		if (line.trim() !== "" && !/^\s/.test(line) && !line.startsWith("#")) break;
 		block.lines.push(index);
 		if (line.trim() === "" || /^\s*#/.test(line)) continue;
-		const entry = /^(\s+)("[^"]*"|'[^']*'|[^\s"'#][^:#]*?)\s*:(\s+|$)/.exec(line);
-		const valueOffset = entry ? entry[0].length : -1;
-		const scalar = entry ? readYamlScalar(line.slice(valueOffset)) : null;
-		if (!entry || !scalar) {
-			block.otherContent++;
+		const entry = readYamlEntry(line, index);
+		if (entry) block.entries.push(entry);
+		else block.otherContent++;
+	}
+	return block;
+}
+/** One `key: scalar` line of a block mapping, or null when it is anything else. */
+function readYamlEntry(line, index) {
+	const entry = /^(\s+)("[^"]*"|'[^']*'|[^\s"'#][^:#]*?)\s*:(\s+|$)/.exec(line);
+	const valueOffset = entry ? entry[0].length : -1;
+	const scalar = entry ? readYamlScalar(line.slice(valueOffset)) : null;
+	if (!entry || !scalar) return null;
+	const rawKey = entry[2];
+	return {
+		line: index,
+		key: /^["']/.test(rawKey) ? rawKey.slice(1, -1) : rawKey,
+		value: scalar.value,
+		valueStart: valueOffset + scalar.start,
+		valueEnd: valueOffset + scalar.end
+	};
+}
+/**
+* Every catalog a `pnpm-workspace.yaml` declares: the top-level `catalog:`
+* block, and each named block under `catalogs:`.
+*
+* `catalogs:` is one level deeper — a header line per catalog, its entries
+* indented under it — and is read with the same one-scalar-per-line rule.
+*/
+function readYamlCatalogs(lines) {
+	const catalogs = [];
+	const single = readYamlBlock(lines, "catalog");
+	if (single) catalogs.push({
+		name: "default",
+		field: "catalog",
+		entries: single.entries
+	});
+	const keyLine = lines.findIndex((line) => /^catalogs:\s*(#.*)?$/.test(line));
+	if (keyLine === -1) return catalogs;
+	let current = null;
+	let headerIndent = -1;
+	for (let index = keyLine + 1; index < lines.length; index++) {
+		const line = lines[index];
+		if (line.trim() !== "" && !/^\s/.test(line) && !line.startsWith("#")) break;
+		if (line.trim() === "" || /^\s*#/.test(line)) continue;
+		const indent = line.length - line.trimStart().length;
+		const header = /^\s+("[^"]*"|'[^']*'|[^\s"'#][^:#]*?)\s*:\s*(#.*)?$/.exec(line);
+		if (header && (headerIndent === -1 || indent === headerIndent)) {
+			headerIndent = indent;
+			const name = /^["']/.test(header[1]) ? header[1].slice(1, -1) : header[1];
+			current = {
+				name,
+				field: `catalogs.${name}`,
+				entries: []
+			};
+			catalogs.push(current);
 			continue;
 		}
-		const rawKey = entry[2];
-		const key = /^["']/.test(rawKey) ? rawKey.slice(1, -1) : rawKey;
-		block.entries.push({
-			line: index,
-			key,
-			value: scalar.value,
-			valueStart: valueOffset + scalar.start,
-			valueEnd: valueOffset + scalar.end
+		if (!current || indent <= headerIndent) continue;
+		const entry = readYamlEntry(line, index);
+		if (entry) current.entries.push(entry);
+	}
+	return catalogs;
+}
+/** A `pnpm-workspace.yaml`, with its overrides and then its catalogs moved. */
+function planWorkspaceYaml(file, original, target, options, plan, ledger) {
+	return planYamlCatalogs(file, planYamlOverrides(file, original, target, options, plan, ledger), target, plan, ledger);
+}
+/**
+* Move the framework entries of every catalog. Entries are rewritten in place
+* — a catalog loses no line — and the result is read back and held to what was
+* meant, like every other rewrite here.
+*/
+function planYamlCatalogs(file, original, target, plan, ledger) {
+	const lines = splitLines(original);
+	const catalogs = readYamlCatalogs(lines);
+	for (const key of ["catalog", "catalogs"]) {
+		const inline = lines.find((line) => new RegExp(`^${key}:\\s*[^\\s#]`).test(line));
+		if (inline && inline.includes("@rebasepro/")) plan.skipped.push({
+			file,
+			name: key,
+			field: key,
+			spec: inline.slice(key.length + 1).trim(),
+			reason: `an inline ${key} map, which this does not rewrite; write it as a block, or edit it by hand`
 		});
 	}
-	return block;
+	if (catalogs.length === 0) return original;
+	const next = [...lines];
+	const expected = [];
+	for (const catalog of catalogs) for (const entry of catalog.entries) {
+		const meant = [
+			catalog.field,
+			entry.key,
+			entry.value
+		];
+		expected.push(meant);
+		if (!entry.key.startsWith("@rebasepro/")) continue;
+		ledger.defined.add(catalogKey(catalog.name, entry.key));
+		const cls = classifySpec(entry.value);
+		if (cls.kind !== "movable") {
+			plan.skipped.push({
+				file,
+				name: entry.key,
+				field: catalog.field,
+				spec: entry.value,
+				reason: leftAloneReason(cls)
+			});
+			continue;
+		}
+		const to = `${cls.prefix}${target}`;
+		if (to === entry.value) {
+			plan.unchanged++;
+			continue;
+		}
+		meant[2] = to;
+		const line = next[entry.line];
+		next[entry.line] = line.slice(0, entry.valueStart) + to + line.slice(entry.valueEnd);
+		plan.changed.push({
+			file,
+			name: entry.key,
+			field: catalog.field,
+			from: entry.value,
+			to
+		});
+	}
+	const content = next.join(original.includes("\r\n") ? "\r\n" : "\n");
+	if (!isDeepStrictEqual(readYamlCatalogs(splitLines(content)).flatMap((catalog) => catalog.entries.map((e) => [
+		catalog.field,
+		e.key,
+		e.value
+	])), expected)) throw new UpgradeError(`Could not rewrite ${file} without disturbing it; nothing was written.`, "rewrite_failed", "Move its @rebasepro catalog entries by hand, then run `rebase upgrade` again.");
+	return content;
 }
-function planWorkspaceYaml(file, original, target, options, plan) {
+function planYamlOverrides(file, original, target, options, plan, ledger) {
 	const lines = splitLines(original);
 	const crlf = original.includes("\r\n");
-	const block = readYamlOverrides(lines);
+	const block = readYamlBlock(lines, "overrides");
 	if (!block) {
 		const inline = lines.find((line) => /^overrides:\s*[^\s#]/.test(line));
 		if (inline && inline.includes("@rebasepro/")) plan.skipped.push({
@@ -20759,10 +21653,14 @@ function planWorkspaceYaml(file, original, target, options, plan) {
 			continue;
 		}
 		const cls = classifySpec(entry.value);
+		const pkg = overrideTarget(entry.key);
 		if (cls.kind === "movable") {
 			const to = `${cls.prefix}${target}`;
 			expected.set(entry.key, to);
-			if (to === entry.value) continue;
+			if (to === entry.value) {
+				plan.unchanged++;
+				continue;
+			}
 			const line = lines[entry.line];
 			next[entry.line] = line.slice(0, entry.valueStart) + to + line.slice(entry.valueEnd);
 			plan.overrides.push({
@@ -20772,6 +21670,16 @@ function planWorkspaceYaml(file, original, target, options, plan) {
 				action: "bumped",
 				to
 			});
+		} else if (cls.kind === "catalog" && pkg) {
+			expected.set(entry.key, entry.value);
+			ledger.refs.push({
+				file,
+				name: entry.key,
+				field: "overrides",
+				spec: entry.value,
+				catalog: cls.catalog,
+				pkg
+			});
 		} else if (cls.kind === "local") if (options.dropLocalOverrides) {
 			removed.add(entry.line);
 			plan.overrides.push({
@@ -20796,14 +21704,14 @@ function planWorkspaceYaml(file, original, target, options, plan) {
 				name: entry.key,
 				field: "overrides",
 				spec: entry.value,
-				reason: cls.reason
+				reason: leftAloneReason(cls)
 			});
 		}
 	}
 	const survivors = block.entries.filter((entry) => !removed.has(entry.line)).length + block.otherContent;
 	if (removed.size > 0 && survivors === 0) removed.add(block.keyLine);
 	const content = next.filter((_, index) => !removed.has(index)).join(crlf ? "\r\n" : "\n");
-	const after = readYamlOverrides(splitLines(content));
+	const after = readYamlBlock(splitLines(content), "overrides");
 	if (!isDeepStrictEqual(after ? after.entries.map((e) => [e.key, e.value]) : [], [...expected.entries()])) throw new UpgradeError(`Could not rewrite ${file} without disturbing it; nothing was written.`, "rewrite_failed", "Move its @rebasepro overrides by hand, then run `rebase upgrade` again.");
 	return content;
 }
@@ -20947,7 +21855,9 @@ ${chalk.bold("What it changes")}
   in every package.json under the project (node_modules, dist* and hidden
   directories excepted). ^ and ~ are kept. peerDependencies are left alone, and so
   are workspace:, link:, file:, git and tag specs, which are listed with the reason.
-  Overrides in pnpm-workspace.yaml and package.json are bumped the same way.
+  Overrides in pnpm-workspace.yaml and package.json are bumped the same way, and so
+  are the entries of pnpm-workspace.yaml's catalog: and catalogs: blocks, which is
+  where a catalog: pin's version lives.
 
 ${chalk.bold("Examples")}
   rebase upgrade                          Move to the latest release and install
@@ -21111,6 +22021,15 @@ function printSummary(plan, dryRun) {
 }
 function printOutcome(plan, outcome) {
 	const moved = plan.changed.length + plan.overrides.filter((o) => o.action !== "kept-local").length;
+	const leftAlone = plan.skipped.length + plan.overrides.filter((o) => o.action === "kept-local").length;
+	const entries = (n) => `${n} entr${n === 1 ? "y" : "ies"}`;
+	if (moved === 0 && leftAlone > 0) {
+		if (plan.unchanged > 0) console.log(chalk.green(`✓ Every pin this can move is already on ${plan.target}; ${entries(leftAlone)} ${leftAlone === 1 ? "was" : "were"} left alone, above.`));
+		else if (outcome.dryRun) console.log(chalk.yellow(`  Nothing to move to ${plan.target}: ${entries(leftAlone)} ${leftAlone === 1 ? "is" : "are"} left alone, above.`));
+		else console.log(chalk.yellow(`⚠ Nothing moved to ${plan.target}: ${entries(leftAlone)} ${leftAlone === 1 ? "was" : "were"} left alone, above.`));
+		console.log("");
+		return;
+	}
 	if (outcome.dryRun) {
 		console.log(chalk.gray(moved === 0 ? `  Nothing to change: this project is already on ${plan.target}.` : "  Dry run — nothing was written. Run it without --dry-run to apply."));
 		console.log("");
@@ -21166,6 +22085,85 @@ var ROOT_FLAGS = {
 	"-v": "--version",
 	"-h": "--help"
 };
+/**
+* Every command the dispatch below answers and the help lists. Declared as a
+* literal under this name: `help-coverage.test.ts`, `printed-commands.test.ts`
+* and the docs verifier read it out of this file's source.
+*/
+var namespacedCommands = [
+	"init",
+	"schema",
+	"db",
+	"dev",
+	"build",
+	"start",
+	"auth",
+	"doctor",
+	"skills",
+	"api-keys",
+	"cloud",
+	"apps",
+	"eject",
+	"generate-sdk",
+	"telemetry",
+	"resources",
+	"status",
+	"upgrade"
+];
+/**
+* The subcommands each command group dispatches, from the lists those groups
+* dispatch on. A command absent from here takes no subcommand.
+*/
+function knownSubcommands(command) {
+	switch (command) {
+		case "schema": return SCHEMA_SUBCOMMANDS;
+		case "db": return DB_SUBCOMMANDS;
+		case "auth": return AUTH_SUBCOMMANDS;
+		case "skills": return SKILLS_SUBCOMMANDS;
+		case "api-keys": return API_KEYS_SUBCOMMANDS;
+		case "apps": return APPS_SUBCOMMANDS;
+		case "telemetry": return TELEMETRY_SUBCOMMANDS;
+		case "cloud": return CLOUD_GROUP_NAMES;
+		default: return [];
+	}
+}
+/**
+* The command and subcommand words as `cli.error` may send them: each one is a
+* word this CLI dispatches, `"none"` when nothing was typed, or `"other"`.
+*
+* The words come from what was typed, and what is typed after a command is
+* only sometimes a subcommand. `rebase init acme-payroll-internal`, `rebase
+* cloud --project acme-prod deploy` and `rebase db psuh` put a project name, a
+* slug and a typo in the subcommand's position — the consent screen promises
+* "never project names", and `sanitize` cannot tell one of those from a
+* subcommand because neither has a separator in it. So the words are held
+* against the vocabulary here, where it is known, and nothing else survives.
+*
+* Exported for `cli.test.ts`.
+*/
+function telemetryCommandWords(command, subcommand) {
+	if (!command) return {
+		command: "none",
+		subcommand: "none"
+	};
+	if (!(namespacedCommands.includes(command) || command === "normalize-imports" || command === "__dev-db-daemon")) return {
+		command: "other",
+		subcommand: subcommand ? "other" : "none"
+	};
+	if (!subcommand) return {
+		command,
+		subcommand: "none"
+	};
+	if (subcommand === "--help") return {
+		command,
+		subcommand
+	};
+	const canonical = command === "cloud" ? GROUP_ALIASES[subcommand] ?? subcommand : subcommand;
+	return {
+		command,
+		subcommand: knownSubcommands(command).includes(canonical) ? canonical : "other"
+	};
+}
 async function entry(args) {
 	silenceDotenvBanner();
 	const parsedArgs = arg({ ...ROOT_FLAGS }, {
@@ -21179,26 +22177,6 @@ async function entry(args) {
 	const words = parsedArgs._.filter((a) => !a.startsWith("-"));
 	const command = words[0];
 	const subcommand = words[1];
-	const namespacedCommands = [
-		"init",
-		"schema",
-		"db",
-		"dev",
-		"build",
-		"start",
-		"auth",
-		"doctor",
-		"skills",
-		"api-keys",
-		"cloud",
-		"apps",
-		"eject",
-		"generate-sdk",
-		"telemetry",
-		"resources",
-		"status",
-		"upgrade"
-	];
 	if (!command || parsedArgs["--help"] && !namespacedCommands.includes(command)) {
 		printHelp();
 		return;
@@ -21208,8 +22186,7 @@ async function entry(args) {
 		await dispatch(command, effectiveSubcommand, args, parsedArgs, namespacedCommands);
 	} catch (error) {
 		await recordEvent("cli.error", {
-			command: command ?? "none",
-			subcommand: effectiveSubcommand ?? "none",
+			...telemetryCommandWords(command, effectiveSubcommand),
 			error_type: errorClass(error),
 			usage: Boolean(error && typeof error === "object" && error.isUsageError)
 		}, { projectRoot: process.cwd() });
@@ -21403,6 +22380,6 @@ function telemetryNotice() {
 	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, ManifestError, VENDOR_SIZE_MAX_BYTES, VENDOR_SIZE_WARN_BYTES, VENDOR_TARGET_CPU, VENDOR_TARGET_OS, assessManagedCompatibility, buildBundle, buildStaticBundle, buildableApps, cmsMountOf, collectDeclaredDependencies, commentSpans, composeBundleManifest, detectDeclaredDepConflicts, detectFrameworkDepDrift, detectNativeDependencies, detectStorageAuthorize, entry, findBackendApp, findUnusedServerEntry, foldStaticIntoBundle, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, resolveBackendPaths, selectDeployApp, synthesizeManifest, validateManifest, vendorDependencies, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, ManifestError, VENDOR_SIZE_MAX_BYTES, VENDOR_SIZE_WARN_BYTES, VENDOR_TARGET_CPU, VENDOR_TARGET_OS, assessManagedCompatibility, buildBundle, buildStaticBundle, buildableApps, cmsMountOf, collectDeclaredDependencies, commentSpans, composeBundleManifest, describeDepConflicts, detectDeclaredDepConflicts, detectFrameworkDepDrift, detectNativeDependencies, detectStorageAuthorize, entry, findBackendApp, findUnusedServerEntry, foldStaticIntoBundle, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, resolveBackendPaths, selectDeployApp, synthesizeManifest, validateManifest, vendorDependencies, writeManifest };
 
 //# sourceMappingURL=index.es.js.map