@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/manifest-DRp0UVTj.js

@@ -0,0 +1,880 @@
+import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
+import { t as MANIFEST_FILENAME } from "./project-Wp2zoyeN.js";
+import fs from "fs";
+import path from "path";
+import { parseAppAddress, reservedPrefixFor } from "@rebasepro/types";
+//#region src/manifest.ts
+/**
+* Loading, validating and synthesizing `rebase.json`.
+*
+* The manifest declares *topology*: which runtime major a project targets and
+* which apps this repository contributes. It is deliberately small — schema,
+* security rules, hooks and functions stay in TypeScript, where a type system
+* can check them.
+*
+* Two properties matter more than the file format itself:
+*
+* - **A missing manifest is never an error.** Every project that exists today
+*   predates this file. One is synthesized from the conventions the template
+*   already follows, so nothing breaks and nobody is forced to migrate.
+* - **Validation reports every problem at once**, with the path to each. A
+*   config file that surfaces its mistakes one run at a time is a bad config
+*   file.
+*/
+/** Runtime range written into new manifests. */
+var CURRENT_RUNTIME_RANGE = "^1";
+/** Conventional locations, matching what `rebase init` scaffolds. */
+var DEFAULT_CONFIG_DIR = "config";
+var DEFAULT_FUNCTIONS_DIR = "backend/functions";
+var DEFAULT_CRONS_DIR = "backend/crons";
+var DEFAULT_SCHEMA_FILE = "backend/src/schema.generated.ts";
+var ManifestError = class extends Error {
+	issues;
+	constructor(message, issues = []) {
+		super(message);
+		this.issues = issues;
+		this.name = "ManifestError";
+	}
+};
+var APP_TYPES = ["backend", "static"];
+/**
+* App types that used to exist, and what replaced each one.
+*
+* Kept so a manifest written against the old vocabulary fails with the fix in
+* hand rather than with `must be one of: backend, static`, which tells a reader
+* what is wrong but not what to write instead.
+*/
+var REMOVED_APP_TYPES = {
+	admin: "the admin panel is an ordinary static app now — declare it as { \"type\": \"static\", \"root\": \"frontend\", \"output\": \"frontend/dist\", \"path\": \"/admin\" }",
+	custom: "who owns the server is a property of the backend now — declare { \"type\": \"backend\", \"runtime\": \"custom\" } instead of a separate app",
+	mobile: "mobile apps are no longer declared in the manifest — nothing consumed this type. Remove the entry"
+};
+/** Reserved because they name things in URLs and CLI output. */
+var RESERVED_APP_NAMES = /* @__PURE__ */ new Set([
+	"api",
+	"health",
+	"metrics",
+	"livez",
+	"_rebase"
+]);
+/**
+* Validate a URL path an app is served at: a static app's `path`, or the path
+* part of it when `path` is a URL, and `cms`.
+*
+* Normalizes to "no trailing slash, except for the root" so that mounting and
+* the `REBASE_APP_BASE` build variable have one shape to reason about.
+*
+* `origin` is `https://<host>` when the path came out of a URL, and is only
+* used to phrase the fix in the form the author wrote: telling someone who
+* wrote `"https://admin.example.com/cms/"` to write `"/cms"` would be telling
+* them to drop the hostname.
+*/
+function checkAppPath(value, fieldPath, issues, origin = "") {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || !value.startsWith("/")) {
+		issues.push({
+			path: fieldPath,
+			message: "must be an absolute path like \"/admin\""
+		});
+		return;
+	}
+	if (!origin && value.startsWith("//")) {
+		issues.push({
+			path: fieldPath,
+			message: `looks like a URL without its scheme — write "https:${value}" to give this app its own hostname`
+		});
+		return;
+	}
+	if (value.includes("..") || value.includes("//")) {
+		issues.push({
+			path: fieldPath,
+			message: origin ? `must have a plain path after the hostname, with no ".." and no empty segment — like "${origin}/admin"` : "must be an absolute path like \"/admin\", with no \"..\" and no empty segment"
+		});
+		return;
+	}
+	if (value !== "/" && value.endsWith("/")) {
+		issues.push({
+			path: fieldPath,
+			message: `must not end with a slash — write "${origin}${value.slice(0, -1)}", not "${origin}${value}"`
+		});
+		return;
+	}
+	const reserved = reservedPrefixFor(value);
+	if (reserved) {
+		issues.push({
+			path: fieldPath,
+			message: `cannot be "${reserved}" or nest under it — the backend serves that path` + (origin ? " on every hostname, this one included" : "") + ", and an app mounted there would answer the API's requests with its own index.html"
+		});
+		return;
+	}
+	return value;
+}
+/**
+* Validate a static app's `path`, which is either a path or an https URL that
+* also gives the app a hostname of its own.
+*
+* The split is {@link parseAppAddress}, shared with the control plane and the
+* runtime so that all three read one value the same way. What it leaves to the
+* caller — the path rules — are {@link checkAppPath}'s, applied to the path
+* part of either form.
+*/
+function checkAppAddress(value, fieldPath, issues) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string") {
+		issues.push({
+			path: fieldPath,
+			message: "must be an absolute path like \"/admin\", or a URL like \"https://admin.example.com\""
+		});
+		return;
+	}
+	const parsed = parseAppAddress(value);
+	if (!parsed.ok) {
+		issues.push({
+			path: fieldPath,
+			message: parsed.reason
+		});
+		return;
+	}
+	const { host } = parsed.address;
+	const appPath = checkAppPath(parsed.address.path, fieldPath, issues, host ? `https://${host}` : "");
+	if (appPath === void 0) return void 0;
+	return host ? {
+		host,
+		path: appPath
+	} : { path: appPath };
+}
+/**
+* Where a validated static app answers: its hostname, if its `path` names one,
+* and the path under it.
+*
+* The manifest keeps `path` as it was written, URL and all, because it is also
+* what `writeManifest` puts back: storing the split pieces instead would have
+* `rebase eject` rewrite `"https://admin.example.com"` to `"/"` and drop the
+* hostname from a file the developer never asked it to touch. Everything that
+* mounts, builds or prints an app reads it through here instead, so there is
+* one reading of the field.
+*
+* Throws on a value `validateManifest` would have refused. Every caller holds a
+* manifest that came through it, so reaching the throw means one did not — and
+* guessing an address for it would build or mount the app somewhere it was
+* never declared.
+*/
+function staticAppAddress(name, app) {
+	if (app.path === void 0) return { path: "/" };
+	const parsed = parseAppAddress(app.path);
+	if (!parsed.ok) throw new ManifestError(`apps.${name}.path ${parsed.reason}`, [{
+		path: `apps.${name}.path`,
+		message: parsed.reason
+	}]);
+	return parsed.address;
+}
+/**
+* An address as a developer would type it: the path alone for an app on every
+* hostname, the https URL for one on its own. The root of a hostname prints as
+* the bare origin — `https://admin.example.com`, which is how it is declared.
+*/
+function formatAppAddress(address) {
+	if (!address.host) return address.path;
+	return `https://${address.host}${address.path === "/" ? "" : address.path}`;
+}
+/**
+* The order static apps are mounted in, and the order a bundle lists them.
+*
+* Longest path first, so an app at `/` is registered after the apps beneath it
+* and its catch-all cannot claim their URLs. At an equal path, the app bound to
+* a hostname goes first: on that hostname it is the one that answers, and the
+* app on every hostname answers the rest. That is the runtime's matching rule,
+* restated as a sort so a bundle reads in the order it is served.
+*/
+function compareMountOrder(a, b) {
+	if (a.path.length !== b.path.length) return b.path.length - a.path.length;
+	return (a.host ? 0 : 1) - (b.host ? 0 : 1);
+}
+/**
+* Is `candidate` the path `parent`, or something beneath it?
+*
+* Segment-aware for the same reason `isForbiddenStaticPath` is: a plain
+* `startsWith` reads `/admin` as living under `/adm`.
+*/
+function isUnderPath(candidate, parent) {
+	if (parent === "/") return true;
+	return candidate === parent || candidate.startsWith(`${parent}/`);
+}
+/**
+* Validate where an app says it mounts the Rebase CMS.
+*
+* The same shape as {@link checkAppPath} — it is a URL path and ends up in the
+* same places — plus one rule of its own: it has to be inside the app declaring
+* it. The app's SPA fallback is what answers that URL, so a `cms` outside its
+* `path` names an address this app will never serve. That is a link the console
+* would then offer to a 404, which is worse than the missing link it replaces.
+*
+* Always a path, even on an app whose `path` is a URL. The app's address
+* already says which hostname it answers on, and a second hostname here could
+* only disagree with it; `cms` says where on that hostname the CMS is.
+*/
+function checkCmsPath(value, app, fieldPath, issues) {
+	if (value === void 0) return void 0;
+	if (typeof value === "string" && (/^[a-z][a-z0-9+.-]*:/i.test(value) || value.startsWith("//"))) {
+		const parsed = parseAppAddress(value.startsWith("//") ? `https:${value}` : value);
+		issues.push({
+			path: fieldPath,
+			message: "must be a path, not a URL — the CMS is a route of this app, which is served where its `path` says" + (parsed.ok ? `. Write "${parsed.address.path}"` : "")
+		});
+		return;
+	}
+	const cms = checkAppPath(value, fieldPath, issues);
+	if (cms === void 0) return void 0;
+	if (!isUnderPath(cms, app.path)) {
+		issues.push({
+			path: fieldPath,
+			message: `must be inside this app's path — it is at "${formatAppAddress(app)}", so it cannot serve "${cms}". The CMS is a route of this app, not a separate deployment; if it really lives elsewhere, declare that app and put \`cms\` on it instead`
+		});
+		return;
+	}
+	return cms;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Reject paths that escape the repository.
+*
+* A manifest is committed and reviewed, so this is not a security boundary so
+* much as a guard against `../../` typos that would otherwise have `rebase build`
+* writing outside the project.
+*
+* `mayEscape` is for `context`, and only for `context`. Every other path here
+* names something Rebase *reads* — collections, functions, the generated
+* schema, the built assets to serve — and those have to be inside the project
+* or the bundle cannot carry them. A Docker build context is the one field that
+* names something Rebase never opens: it is handed to `docker build`, and in
+* any workspace repository the thing it has to name is the workspace root,
+* above the app. That is not exotic. It is what pnpm, turbo and nx layouts all
+* look like, and it is what this repository's own reference project needs — its
+* Dockerfile's first instruction copies `pnpm-lock.yaml`, which does not exist
+* beside `rebase.json` and never will.
+*
+* Refusing it did not prevent the escape; it only stopped anyone declaring it.
+* `app/rebase.json` built from the monorepo root the whole time — via
+* `infra/cloudbuild.yaml`, which says `-f app/backend/Dockerfile .` — while the
+* manifest said the context was `app/` and `rebase build` printed a command
+* that dies on its first `COPY`.
+*/
+function checkRelativePath(value, fieldPath, issues, { required, mayEscape = false }) {
+	if (value === void 0) {
+		if (required) issues.push({
+			path: fieldPath,
+			message: "is required"
+		});
+		return;
+	}
+	if (typeof value !== "string" || value.trim() === "") {
+		issues.push({
+			path: fieldPath,
+			message: "must be a non-empty string"
+		});
+		return;
+	}
+	if (path.isAbsolute(value)) {
+		issues.push({
+			path: fieldPath,
+			message: "must be a relative path, not absolute"
+		});
+		return;
+	}
+	const normalized = path.normalize(value);
+	if (!mayEscape && (normalized === ".." || normalized.startsWith(`..${path.sep}`))) {
+		issues.push({
+			path: fieldPath,
+			message: "must stay inside the project directory"
+		});
+		return;
+	}
+	return value;
+}
+/** Fields each app type understands. Anything else is a typo or a newer CLI. */
+var KNOWN_APP_FIELDS = {
+	backend: [
+		"type",
+		"runtime",
+		"config",
+		"functions",
+		"crons",
+		"schema",
+		"usersCollection",
+		"registerDatabase",
+		"dockerfile",
+		"context",
+		"port"
+	],
+	static: [
+		"type",
+		"root",
+		"build",
+		"output",
+		"path",
+		"spa",
+		"cms"
+	]
+};
+/**
+* Fields people reach for to give a static app a hostname, which is spelled as
+* a URL in `path` instead. Named so the warning says that, rather than "your
+* CLI may be older than this manifest" — which is false here and sends the
+* reader to upgrade a CLI that already does what they wanted.
+*/
+var HOSTNAME_FIELDS = /* @__PURE__ */ new Set([
+	"host",
+	"hostname",
+	"domain"
+]);
+/**
+* Report a field this CLI does not recognise.
+*
+* A warning rather than an error, and the distinction matters in both
+* directions. `"pathh": "/admin"` is a typo that would otherwise be silently
+* dropped — the app builds for `/`, mounts at `/`, and the only symptom is that
+* it is not where you put it. But an unknown field is also what an *older* CLI
+* sees when it opens a manifest written for a newer one, and refusing to build
+* over a field that is simply from the future would make every manifest addition
+* a breaking change.
+*
+* So: name it, suggest the near-miss, and carry on.
+*/
+function warnUnknownFields(name, raw, type) {
+	const known = KNOWN_APP_FIELDS[type];
+	if (!known) return;
+	for (const field of Object.keys(raw)) {
+		if (known.includes(field)) continue;
+		if (type === "static" && HOSTNAME_FIELDS.has(field)) {
+			const value = raw[field];
+			const host = typeof value === "string" && value.trim() !== "" ? value.trim().replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "") : "admin.example.com";
+			const under = typeof raw.path === "string" && raw.path.startsWith("/") && raw.path !== "/" ? raw.path : "";
+			console.warn(`⚠ rebase.json: apps.${name}.${field} is not a field — it is ignored. To serve this app on its own hostname, write its path as a URL: "path": "https://${host}${under}"`);
+			continue;
+		}
+		const suggestion = known.find((candidate) => isNearMiss(candidate, field));
+		console.warn(`⚠ rebase.json: apps.${name}.${field} is not a field this CLI knows.` + (suggestion ? ` Did you mean "${suggestion}"?` : " It is ignored — your CLI may be older than this manifest."));
+	}
+}
+/**
+* One edit apart, ignoring case: enough for a typo, tight enough to stay quiet.
+*
+* The same rule as `isNearMiss` in `@rebasepro/utils`, which the collection
+* validator uses for unknown `admin` keys. It is a copy rather than an import
+* because the CLI does not depend on `@rebasepro/utils`, and adding the
+* dependency is a lockfile change; collapsing the two is worth doing the next
+* time this package's dependencies are touched.
+*/
+function isNearMiss(a, b) {
+	const x = a.toLowerCase();
+	const y = b.toLowerCase();
+	if (x === y) return true;
+	if (Math.abs(x.length - y.length) > 1) return false;
+	const [shorter, longer] = x.length <= y.length ? [x, y] : [y, x];
+	let i = 0;
+	let j = 0;
+	let edits = 0;
+	while (i < shorter.length && j < longer.length) {
+		if (shorter[i] === longer[j]) {
+			i++;
+			j++;
+			continue;
+		}
+		if (++edits > 1) return false;
+		if (shorter.length === longer.length) i++;
+		j++;
+	}
+	return edits + (longer.length - j) + (shorter.length - i) <= 1;
+}
+function validateApp(name, raw, issues) {
+	const base = `apps.${name}`;
+	if (!isRecord(raw)) {
+		issues.push({
+			path: base,
+			message: "must be an object"
+		});
+		return;
+	}
+	const type = raw.type;
+	if (typeof type === "string" && REMOVED_APP_TYPES[type]) {
+		issues.push({
+			path: `${base}.type`,
+			message: `"${type}" is no longer an app type — ${REMOVED_APP_TYPES[type]}`
+		});
+		return;
+	}
+	if (typeof type !== "string" || !APP_TYPES.includes(type)) {
+		issues.push({
+			path: `${base}.type`,
+			message: `must be one of: ${APP_TYPES.join(", ")}`
+		});
+		return;
+	}
+	warnUnknownFields(name, raw, type);
+	switch (type) {
+		case "backend": {
+			checkRelativePath(raw.config, `${base}.config`, issues, { required: false });
+			checkRelativePath(raw.functions, `${base}.functions`, issues, { required: false });
+			checkRelativePath(raw.crons, `${base}.crons`, issues, { required: false });
+			checkRelativePath(raw.schema, `${base}.schema`, issues, { required: false });
+			checkRelativePath(raw.usersCollection, `${base}.usersCollection`, issues, { required: false });
+			if (raw.mode !== void 0) issues.push({
+				path: `${base}.mode`,
+				message: "is no longer a field — collections come from the config directory when it exists, and are introspected from the database when it does not"
+			});
+			const custom = raw.runtime === "custom";
+			if (raw.runtime !== "managed" && !custom) issues.push({
+				path: `${base}.runtime`,
+				message: "is required, and must be \"managed\" or \"custom\""
+			});
+			for (const field of [
+				"dockerfile",
+				"context",
+				"port"
+			]) if (raw[field] !== void 0 && !custom) issues.push({
+				path: `${base}.${field}`,
+				message: "only applies to a custom runtime — set \"runtime\": \"custom\" to build your own image"
+			});
+			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
+			checkRelativePath(raw.context, `${base}.context`, issues, {
+				required: false,
+				mayEscape: true
+			});
+			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
+				path: `${base}.port`,
+				message: "must be an integer"
+			});
+			if (raw.registerDatabase !== void 0 && typeof raw.registerDatabase !== "boolean") issues.push({
+				path: `${base}.registerDatabase`,
+				message: "must be a boolean"
+			});
+			return {
+				type: "backend",
+				runtime: custom ? "custom" : "managed",
+				config: raw.config,
+				functions: raw.functions,
+				crons: raw.crons,
+				schema: raw.schema,
+				usersCollection: raw.usersCollection,
+				registerDatabase: raw.registerDatabase,
+				dockerfile: raw.dockerfile,
+				context: raw.context,
+				port: raw.port
+			};
+		}
+		case "static": {
+			checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
+			checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
+			if (raw.build !== void 0 && typeof raw.build !== "string") issues.push({
+				path: `${base}.build`,
+				message: "must be a string command"
+			});
+			if (raw.spa !== void 0 && typeof raw.spa !== "boolean") issues.push({
+				path: `${base}.spa`,
+				message: "must be a boolean"
+			});
+			const address = checkAppAddress(raw.path, `${base}.path`, issues);
+			checkCmsPath(raw.cms, address ?? { path: "/" }, `${base}.cms`, issues);
+			return {
+				type: "static",
+				root: raw.root,
+				build: raw.build,
+				output: raw.output,
+				path: address ? raw.path : void 0,
+				spa: raw.spa,
+				cms: raw.cms
+			};
+		}
+		default: return;
+	}
+}
+/**
+* Validate a parsed manifest, collecting every problem.
+*/
+function validateManifest(raw) {
+	const issues = [];
+	if (!isRecord(raw)) return { issues: [{
+		path: "",
+		message: `${MANIFEST_FILENAME} must contain a JSON object`
+	}] };
+	if (typeof raw.rebase !== "string" || raw.rebase.trim() === "") {
+		const message = typeof raw.runtime === "string" ? `is required, e.g. "^1" — this is the top-level "runtime" key renamed, because "runtime" now means "managed" or "custom" on the backend app` : `is required, e.g. "^1"`;
+		issues.push({
+			path: "rebase",
+			message
+		});
+	}
+	if (!isRecord(raw.apps)) {
+		issues.push({
+			path: "apps",
+			message: "is required and must be an object"
+		});
+		return { issues };
+	}
+	const apps = {};
+	let backendCount = 0;
+	for (const [name, value] of Object.entries(raw.apps)) {
+		if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name must be lowercase alphanumeric with dashes (it appears in URLs)"
+			});
+			continue;
+		}
+		if (RESERVED_APP_NAMES.has(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name is reserved"
+			});
+			continue;
+		}
+		const app = validateApp(name, value, issues);
+		if (!app) continue;
+		if (app.type === "backend") backendCount++;
+		apps[name] = app;
+	}
+	if (backendCount > 1) issues.push({
+		path: "apps",
+		message: "a project may declare at most one backend app"
+	});
+	const byAddress = /* @__PURE__ */ new Map();
+	for (const [name, app] of Object.entries(apps)) {
+		if (app.type !== "static") continue;
+		const address = staticAppAddress(name, app);
+		const key = `${address.host ?? ""} ${address.path}`;
+		const owner = byAddress.get(key);
+		if (owner) {
+			issues.push({
+				path: `apps.${name}.path`,
+				message: `two apps cannot serve the same path — "${owner}" is already at "${formatAppAddress(address)}"`
+			});
+			continue;
+		}
+		byAddress.set(key, name);
+	}
+	const withCms = Object.entries(apps).filter(([, app]) => app.type === "static" && typeof app.cms === "string");
+	if (withCms.length > 1) for (const [name] of withCms.slice(1)) issues.push({
+		path: `apps.${name}.cms`,
+		message: `a project has one CMS — "${withCms[0][0]}" already declares one`
+	});
+	refuseStorageBlock(raw.storage, issues);
+	let telemetry;
+	if (raw.telemetry !== void 0) if (typeof raw.telemetry === "boolean") telemetry = raw.telemetry;
+	else issues.push({
+		path: "telemetry",
+		message: "must be a boolean — only `false` does anything, and it opts this repository out of usage sharing"
+	});
+	if (issues.length > 0) return { issues };
+	return {
+		manifest: {
+			$schema: typeof raw.$schema === "string" ? raw.$schema : void 0,
+			rebase: raw.rebase,
+			apps,
+			...telemetry !== void 0 ? { telemetry } : {}
+		},
+		issues
+	};
+}
+/**
+* Refuse a hand-written `storage` block.
+*
+* Buckets are declared in config code now — `bucket("media")` — and the graph
+* is generated from those declarations into `rebase.resources.json`. Two homes
+* for one concept is what this replaced, and the reason it had to go is that
+* the runtime *merged* them: a bucket declared in both had one engine kept and
+* the other silently discarded.
+*
+* Refused rather than ignored. A key that still parses and no longer does
+* anything is the same failure wearing a nicer hat — the author sees valid
+* JSON, the platform sees a bucket, and the runtime has neither.
+*/
+function refuseStorageBlock(raw, issues) {
+	if (raw === void 0) return void 0;
+	issues.push({
+		path: "storage",
+		message: "is no longer read. Declare each bucket in your config's resources.ts — bucket(\"media\", { engine: \"s3\" }) — then run `rebase resources --write`, which generates rebase.resources.json. Refused rather than ignored: this block used to be merged with the code's declarations and silently win."
+	});
+}
+/**
+* Infer a manifest from a directory that does not have one.
+*
+* This mirrors what the template scaffolds, which is what makes adopting the
+* manifest a no-op for existing projects: the synthesized result is what they
+* would have written by hand. A field is written only when it says something
+* its default does not, as the scaffold's own `rebase.json` does — `spa`,
+* `functions` and `crons` restate their defaults, so they are left out.
+*
+* The static app's build command is the project's package manager, spelled the
+* way `rebase init` spells it, so a pnpm project is never built with npm.
+*
+* The static app is named `web`, where the scaffold says `admin`. The name is an
+* app's identity on a deployed project: Rebase Cloud registered `web` for every
+* project that deployed without a manifest, and its next deploy has to name the
+* same app. Nor can an inference know where an app mounts the CMS (`cms`), which
+* is a client-side route. `rebase apps init --force` therefore keeps the name,
+* `path` and `cms` a manifest already declares for the app it infers again.
+*
+* The backend's `runtime` is inferred from whether the repository declares a
+* **Dockerfile** — the thing that actually builds an image — and from nothing
+* else. It used to be inferred from the presence of `backend/src/index.ts`,
+* which every scaffolded project had whether or not it wanted its own server, so
+* projects predating the manifest silently landed on the custom runtime and paid
+* for it.
+*/
+function synthesizeManifest(projectRoot) {
+	const exists = (relative) => fs.existsSync(path.join(projectRoot, relative));
+	const apps = {};
+	const hasConfig = exists(DEFAULT_CONFIG_DIR);
+	const hasBackend = exists("backend");
+	const dockerfile = ["Dockerfile", "backend/Dockerfile"].find(exists);
+	if (hasBackend || hasConfig) {
+		apps.backend = dockerfile ? {
+			type: "backend",
+			runtime: "custom",
+			dockerfile,
+			context: "."
+		} : {
+			type: "backend",
+			runtime: "managed"
+		};
+		if (!dockerfile && exists("backend/src/index.ts")) console.warn("⚠ backend/src/index.ts exists but this project's backend is managed — it is\n    never loaded. Delete it, or move it aside and run `rebase eject`, which\n    writes an entrypoint of its own and owns the image. Eject does not adopt\n    this file: it refuses to replace it unless you pass --force.");
+	}
+	if (exists("frontend")) apps.web = {
+		type: "static",
+		root: "frontend",
+		build: getPMCommands(detectPackageManager(projectRoot)).runWorkspace("frontend", "build").join(" "),
+		output: "frontend/dist",
+		path: "/"
+	};
+	return {
+		rebase: "^1",
+		apps
+	};
+}
+function manifestPath(projectRoot) {
+	return path.join(projectRoot, MANIFEST_FILENAME);
+}
+function manifestExists(projectRoot) {
+	return fs.existsSync(manifestPath(projectRoot));
+}
+/**
+* Read the manifest, falling back to a synthesized one.
+*
+* A malformed manifest throws — unlike a missing one. Silently ignoring a file
+* the developer wrote, and building something else instead, is the worst
+* available behaviour.
+*/
+function loadManifest(projectRoot) {
+	const filePath = manifestPath(projectRoot);
+	if (!fs.existsSync(filePath)) return {
+		manifest: synthesizeManifest(projectRoot),
+		source: "synthesized"
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (err) {
+		throw new ManifestError(`${MANIFEST_FILENAME} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const { manifest, issues } = validateManifest(parsed);
+	if (!manifest) throw new ManifestError(`${MANIFEST_FILENAME} is invalid`, issues);
+	return {
+		manifest,
+		source: "file",
+		filePath
+	};
+}
+/** The keys `writeManifest` knows how to write. Everything else is carried through. */
+var MODELLED_MANIFEST_KEYS = [
+	"$schema",
+	"rebase",
+	"apps",
+	"storage",
+	"telemetry"
+];
+/**
+* What is on disk right now, or `{}` — this is a *rewrite*, so the file that is
+* about to be replaced is the only record of the keys the caller did not model.
+* Unparseable is treated as absent: `loadManifest` refuses malformed JSON long
+* before anything gets here, and a writer is not the place to fail on it.
+*/
+function readManifestObject(filePath) {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+		return isRecord(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Write a manifest, with a trailing newline so it plays well with other tools.
+*
+* **Every key on disk survives.** This used to emit exactly `$schema`, `rebase`
+* and `apps`, so a rewrite deleted the rest of the file — and two commands with
+* no visible relationship to either key rewrite it: `rebase eject` and
+* `rebase apps init --force`. A repository that had committed
+* `"telemetry": false` lost its opt-out, and a multi-bucket project lost its
+* whole `storage` block, in a commit whose stated change was `runtime: custom`.
+*
+* So: the caller's manifest wins for what it models, the file supplies the rest.
+* `storage` and `telemetry` fall back to the file because the callers that
+* synthesize a manifest (`apps init --force`) cannot know them — they are
+* authored, not inferred — and unknown top-level keys are copied verbatim
+* rather than listed, since a hand-listed set loses the next key too.
+*/
+function writeManifest(projectRoot, manifest) {
+	const filePath = manifestPath(projectRoot);
+	const existing = readManifestObject(filePath);
+	const carried = {};
+	for (const [key, value] of Object.entries(existing)) if (!MODELLED_MANIFEST_KEYS.includes(key)) carried[key] = value;
+	const schema = manifest.$schema ?? (typeof existing.$schema === "string" ? existing.$schema : void 0) ?? "https://rebase.pro/schemas/rebase.json";
+	const telemetry = manifest.telemetry ?? (typeof existing.telemetry === "boolean" ? existing.telemetry : void 0);
+	const ordered = {
+		$schema: schema,
+		rebase: manifest.rebase,
+		apps: manifest.apps,
+		...telemetry !== void 0 ? { telemetry } : {},
+		...carried
+	};
+	fs.writeFileSync(filePath, `${JSON.stringify(ordered, null, 4)}\n`, "utf8");
+	return filePath;
+}
+/** Find the single backend app, if this repository declares one. */
+function findBackendApp(manifest) {
+	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "backend") return {
+		name,
+		app
+	};
+}
+/**
+* Where this project mounts the Rebase CMS, if it says.
+*
+* The CMS is a component inside a developer's own app, so its address is a
+* client-side route: no build artifact, no running server and no control plane
+* can observe it. {@link RebaseStaticAppConfig.cms} is the only place that fact
+* is ever written down, and this is the one reader of it — so that "the
+* project's CMS" means the same thing to `rebase dev`, `rebase apps list`, the
+* bundle it builds and the console that shows it.
+*
+* Returns the *serving* app alongside the path, because a caller with a base URL
+* needs to know which app answers there — and because the path alone cannot say
+* whether the CMS is the whole of an app or one route of it.
+*
+* `path` is always a path. `host` is the serving app's hostname, when its `path`
+* gives it one: the CMS is then at `https://<host><path>` and nowhere else, and
+* a caller holding a local or project base URL must not put the path on that.
+*/
+function cmsMountOf(manifest) {
+	for (const [name, app] of Object.entries(manifest.apps)) {
+		if (app.type !== "static" || typeof app.cms !== "string") continue;
+		const { host } = staticAppAddress(name, app);
+		return {
+			appName: name,
+			app,
+			path: app.cms,
+			...host ? { host } : {}
+		};
+	}
+}
+/**
+* The app a deploy targets: the one named, or the obvious one.
+*
+* A repository declares apps; a project owns them. So "which app" is a question
+* a multi-repo setup asks routinely and a single-app repository should never
+* have to answer — hence the fallbacks, in the order that makes each of them
+* unambiguous:
+*
+* - A name, when one is given. Wrong names fail loudly, listing what is there;
+*   guessing past a typo would deploy the wrong app to a live project.
+* - The backend, when this repository declares one. It is the app whose deploy
+*   people mean when they do not say, and it is what every existing invocation
+*   already did.
+* - The only app, when there is exactly one. This is what makes a static-only
+*   repository — an admin panel, a marketing site — deploy with no argument.
+* - Otherwise a refusal that lists the choices. A repository with two static
+*   apps and no backend has no obvious default, and picking one would publish
+*   somebody's admin panel at their marketing domain.
+*/
+function selectDeployApp(manifest, requested) {
+	const entries = Object.entries(manifest.apps).map(([name, app]) => ({
+		name,
+		app
+	}));
+	if (requested) {
+		const match = entries.find((entry) => entry.name === requested);
+		if (!match) throw new ManifestError(`This repository declares no app named "${requested}". It declares: ${entries.map((e) => e.name).join(", ") || "none"}.`);
+		return match;
+	}
+	const backend = findBackendApp(manifest);
+	if (backend) return {
+		name: backend.name,
+		app: backend.app
+	};
+	if (entries.length === 1) return entries[0];
+	if (entries.length === 0) throw new ManifestError(`${MANIFEST_FILENAME} declares no apps, so there is nothing to deploy.`);
+	throw new ManifestError(`This repository declares several apps and no backend, so there is no obvious one to deploy. Name one: ${entries.map((e) => e.name).join(", ")}.`);
+}
+/** Apps that produce build output, in the order they should be built. */
+function buildableApps(manifest) {
+	const entries = Object.entries(manifest.apps).map(([name, app]) => ({
+		name,
+		app
+	}));
+	const rank = (app) => app.type === "backend" ? 0 : 1;
+	return entries.sort((a, b) => rank(a.app) - rank(b.app));
+}
+/**
+* Decide whether a project can run on the managed runtime, and say why not.
+*
+* "Not eligible" is never a dead end — it selects the custom-runtime path, which
+* still deploys. The reasons exist so the answer is actionable rather than a
+* verdict.
+*/
+function assessManagedCompatibility(manifest) {
+	const backend = findBackendApp(manifest);
+	if (!backend) return {
+		eligible: false,
+		reasons: ["No backend app is declared in this repository. Only the repository that declares the backend selects the runtime."]
+	};
+	if (backend.app.runtime === "custom") return {
+		eligible: false,
+		reasons: [`App "${backend.name}" declares runtime: "custom", so it builds and runs its own image. The managed runtime boots the platform image with your bundle; the custom runtime deploys exactly the same way, from your Dockerfile.`]
+	};
+	return {
+		eligible: true,
+		reasons: []
+	};
+}
+/**
+* Resolve a backend app's directories against the conventions it omits.
+*
+* `hasCollections` replaces the old `mode: "cms" | "baas"` field. Where the
+* collections come from was never an independent choice: either they are
+* declared in code and the bundle ships them, or they are not and the runtime
+* introspects the live database at boot. Declaring it separately only created
+* the contradictory state — code-first declared, no collections anywhere.
+*
+* `hasConfig` is deliberately a **separate** question. A headless project has no
+* `config/collections`, but it may still ship a config package — that is where
+* the `storageAuthorize` hook lives, and storage is not under row-level
+* security, so without one the server refuses to boot with storage enabled.
+* Collapsing the two would leave a headless project nowhere to put it.
+*/
+function resolveBackendPaths(app, projectRoot) {
+	const config = app.config ?? "config";
+	return {
+		config,
+		functions: app.functions ?? "backend/functions",
+		crons: app.crons ?? "backend/crons",
+		schema: app.schema ?? "backend/src/schema.generated.ts",
+		usersCollection: app.usersCollection ?? "collections/users",
+		hasConfig: fs.existsSync(path.join(projectRoot, config)),
+		hasCollections: fs.existsSync(path.join(projectRoot, config, "collections"))
+	};
+}
+//#endregion
+export { selectDeployApp as _, DEFAULT_SCHEMA_FILE as a, validateManifest as b, buildableApps as c, findBackendApp as d, formatAppAddress as f, resolveBackendPaths as g, manifestPath as h, DEFAULT_FUNCTIONS_DIR as i, cmsMountOf as l, manifestExists as m, DEFAULT_CONFIG_DIR as n, ManifestError as o, loadManifest as p, DEFAULT_CRONS_DIR as r, assessManagedCompatibility as s, CURRENT_RUNTIME_RANGE as t, compareMountOrder as u, staticAppAddress as v, writeManifest as x, synthesizeManifest as y };
+
+//# sourceMappingURL=manifest-DRp0UVTj.js.map