@rebasepro/cli 0.24.0 → 0.24.1-canary.g19596ef

package/dist/bundle-CqURVN-K.js

@@ -0,0 +1,1621 @@
+import { g as resolveTsx, h as resolvePluginCliScript, l as getActiveBackendPlugin, m as resolveLocalBin } from "./project-Wp2zoyeN.js";
+import { n as cliVersion } from "./version-Buyyo1ut.js";
+import { g as resolveBackendPaths, u as compareMountOrder } from "./manifest-DRp0UVTj.js";
+import { n as summarisePortability, t as analyseFunctionsDirectory } from "./function-portability-BIvlvR9q.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { createRequire } from "module";
+import { spawnSync } from "child_process";
+import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, findStorageSuffixCollision, parseEnvBoolean } from "@rebasepro/types";
+import zlib from "zlib";
+//#region src/utils/tool-stdio.ts
+/**
+* The stdio a build tool the CLI runs in the foreground gets: a static app's
+* build command, `tsc`, `tar`.
+*
+* Inherited, so its output streams as it happens. With `quietStdout` its stdout
+* goes to stderr instead, for a command whose own stdout carries a result:
+* `rebase cloud deploy` in JSON mode — every piped run — owes stdout exactly one
+* JSON value, and a `vite v6 building…` line in front of it is a result no
+* parser can read. The tool's output still reaches the person watching.
+*/
+function toolStdio(quietStdout) {
+	return quietStdout ? [
+		"ignore",
+		2,
+		"inherit"
+	] : "inherit";
+}
+//#endregion
+//#region src/precompress.ts
+/**
+* `.br` and `.gz` beside a static build's content-hashed assets, written when
+* the build is folded into a bundle.
+*
+* The runtime serves a sibling when the browser accepts its encoding
+* (`serveSPA` turns `precompressed` on at mount when the build holds any), so a
+* hashed chunk costs no compression CPU at all, on any request — including the
+* first one after a deploy, which otherwise gzips every chunk once per process
+* — and the browsers that accept brotli get it. Without siblings the runtime
+* only ever sends gzip.
+*
+* Which files: the ones the runtime caches as `immutable` — a content hash in
+* the name, by the same rule as the server's `isContentHashed` — of a type worth
+* compressing, and 1 KB or more (the runtime's own compression threshold). An
+* unhashed file (`index.html`) is left to on-the-fly compression, where a
+* rewrite of it can never be served stale from a sibling. A sibling is written
+* only when it is smaller, and never over one the build already emitted.
+*
+* Brotli at quality 9, not 11. On the example app's 5.6 MB of JavaScript,
+* quality 11 is 1.30 MB and took 20 s (8.7 s across the thread pool); quality
+* 9 is 1.41 MB in 0.9 s. gzip at level 9 is 1.57 MB in 0.3 s. A deploy runs
+* this every time, and a CI runner has fewer cores than a laptop.
+*/
+/** Below this a compressed response saves less than its headers cost — the runtime's threshold. */
+var MIN_BYTES = 1024;
+/**
+* Extensions whose content type the runtime compresses (`COMPRESSIBLE_CONTENT_TYPE_REGEX`).
+* All of them, because a build with any sibling switches the runtime's cache of
+* gzipped hashed files off: a hashed type left out here would be compressed on
+* every request instead of once.
+*/
+var COMPRESSIBLE = /* @__PURE__ */ new Set([
+	"js",
+	"mjs",
+	"cjs",
+	"css",
+	"html",
+	"htm",
+	"txt",
+	"csv",
+	"md",
+	"xml",
+	"json",
+	"webmanifest",
+	"svg",
+	"wasm",
+	"ttf",
+	"otf",
+	"eot",
+	"ico",
+	"bmp"
+]);
+/**
+* A content hash in the name, by the runtime's rule (`isContentHashed` in the
+* server's `serve-spa.ts`): 8+ base64url characters after the last `-` with a
+* digit or a capital in them. `index-vgugiqRO.js` is; `vendor-analytics.js` is
+* not.
+*/
+function isContentHashedName(fileName) {
+	const dot = fileName.lastIndexOf(".");
+	if (dot <= 0) return false;
+	const stem = fileName.slice(0, dot);
+	const dash = stem.lastIndexOf("-");
+	if (dash < 0) return false;
+	const suffix = stem.slice(dash + 1);
+	return suffix.length >= 8 && /^[A-Za-z0-9_-]+$/.test(suffix) && /[0-9A-Z]/.test(suffix);
+}
+/** Write `.br` and `.gz` siblings for every hashed, compressible asset under `dir`. */
+function precompressStaticAssets(dir) {
+	const outcome = {
+		files: 0,
+		bytes: 0,
+		brotliBytes: 0,
+		gzipBytes: 0
+	};
+	const pending = [dir];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+			if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+			const file = path.join(current, entry.name);
+			if (entry.isDirectory()) {
+				pending.push(file);
+				continue;
+			}
+			if (!entry.isFile() || !worthCompressing(entry.name)) continue;
+			const source = fs.readFileSync(file);
+			if (source.byteLength < MIN_BYTES) continue;
+			const brotli = writeSibling(`${file}.br`, source, () => zlib.brotliCompressSync(source, { params: {
+				[zlib.constants.BROTLI_PARAM_QUALITY]: 9,
+				[zlib.constants.BROTLI_PARAM_MODE]: zlib.constants.BROTLI_MODE_TEXT,
+				[zlib.constants.BROTLI_PARAM_SIZE_HINT]: source.byteLength
+			} }));
+			const gzip = writeSibling(`${file}.gz`, source, () => zlib.gzipSync(source, { level: 9 }));
+			if (brotli === 0 && gzip === 0) continue;
+			outcome.files++;
+			outcome.bytes += source.byteLength;
+			outcome.brotliBytes += brotli;
+			outcome.gzipBytes += gzip;
+		}
+	}
+	return outcome;
+}
+function worthCompressing(fileName) {
+	const extension = fileName.slice(fileName.lastIndexOf(".") + 1).toLowerCase();
+	return COMPRESSIBLE.has(extension) && isContentHashedName(fileName);
+}
+/** The sibling's size, or 0 when there already was one or it would not be smaller. */
+function writeSibling(target, source, compress) {
+	if (fs.existsSync(target)) return 0;
+	const compressed = compress();
+	if (compressed.byteLength >= source.byteLength) return 0;
+	fs.writeFileSync(target, compressed);
+	return compressed.byteLength;
+}
+//#endregion
+//#region src/bundle.ts
+/**
+* Building a project bundle.
+*
+* A bundle is the deployable form of a project: compiled collections, functions,
+* crons and schema, plus a generated manifest describing exactly what it needs
+* to run. It contains no Dockerfile and no repository — the runtime is supplied
+* separately, which is what allows a project to be moved onto a patched runtime
+* without being rebuilt.
+*
+* Compilation runs through a generated tsconfig rooted at the project directory,
+* so the output mirrors the source layout (`config/…`, `backend/functions/…`)
+* and every path in the manifest is predictable. Letting each workspace package
+* emit into its own `dist/` would have meant guessing at three different
+* layouts, since `rootDir` differs between the template flavours.
+*/
+var DEFAULT_BUNDLE_DIR = "dist-bundle";
+/** Packages whose presence means the bundle cannot run on a stock runtime image. */
+var KNOWN_NATIVE_PACKAGES = /* @__PURE__ */ new Set([
+	"sharp",
+	"canvas",
+	"bcrypt",
+	"argon2",
+	"node-sass",
+	"sqlite3",
+	"better-sqlite3",
+	"grpc",
+	"@grpc/grpc-js-native",
+	"re2",
+	"sodium-native",
+	"libpq",
+	"pg-native"
+]);
+/** Dependencies supplied by the runtime image itself, not by the bundle. */
+var RUNTIME_PROVIDED = /* @__PURE__ */ new Set([
+	"@rebasepro/server",
+	"@rebasepro/types",
+	"@rebasepro/client",
+	"@rebasepro/common",
+	"@rebasepro/utils",
+	"hono",
+	"@hono/node-server",
+	"typescript",
+	"tsx",
+	"zod"
+]);
+function log(options, message) {
+	(options.log ?? ((m) => console.log(m)))(message);
+}
+/**
+* A line the build says to the person running it — a warning, or what it left
+* out — which progress callbacks may drop and this does not: stdout, or stderr
+* when stdout carries the caller's result.
+*/
+function say(options, line) {
+	if (options.quietStdout) console.error(line);
+	else console.log(line);
+}
+/**
+* Every `node_modules/@types` directory the project can see.
+*
+* Type roots normally resolve by walking up from the tsconfig's own directory,
+* which breaks here for two reasons: the generated config lives in `.rebase/`,
+* and a pnpm workspace puts `@types/node` inside the *package* that depends on
+* it (`config/node_modules/@types`) rather than at the project root. Listing them
+* explicitly, as absolute paths, sidesteps both.
+*/
+function discoverTypeRoots(projectRoot) {
+	const candidates = [];
+	for (const relative of [
+		".",
+		"config",
+		"backend",
+		"frontend"
+	]) candidates.push(path.join(projectRoot, relative, "node_modules", "@types"));
+	let dir = projectRoot;
+	for (let i = 0; i < 4; i++) {
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		candidates.push(path.join(parent, "node_modules", "@types"));
+		dir = parent;
+	}
+	return candidates.filter((candidate) => fs.existsSync(candidate));
+}
+/**
+* Read a tsconfig's own `compilerOptions`.
+*
+* Parsed with the project's own TypeScript, because a tsconfig is not JSON: it
+* permits comments and trailing commas. Hand-rolled comment stripping gets this
+* wrong in a way that is easy to miss — a `paths` entry like
+* `"@acme/types/*": ["src/*"]` contains the character sequence that opens a
+* block comment, so a regex happily eats the rest of the file and the result
+* parses as *something*, just not the config the developer wrote.
+*
+* One level only, and only `paths` is used from it.
+*/
+async function readCompilerOptions(projectRoot, file) {
+	if (!fs.existsSync(file)) return void 0;
+	const text = fs.readFileSync(file, "utf8");
+	try {
+		const { config } = createRequire(path.join(projectRoot, "package.json"))("typescript").parseConfigFileTextToJson(file, text);
+		return config?.compilerOptions;
+	} catch {
+		try {
+			return JSON.parse(text.replace(/^\s*\/\/.*$/gm, "")).compilerOptions;
+		} catch {
+			return;
+		}
+	}
+}
+/**
+* Drop path aliases that resolve outside the project.
+*
+* A monorepo commonly aliases its workspace packages to their **source**
+* (`"@acme/types": ["packages/types/src/index.ts"]`) so editors jump to real
+* files. That is right for developing the monorepo and wrong for building a
+* bundle: it drags foreign `.ts` files into the program, none of which are under
+* the project's `rootDir`, and the compile fails on files the developer never
+* asked to build.
+*
+* A bundle is built against *installed packages*. Aliases pointing inside the
+* project are kept, because those are the project's own code.
+*/
+function filterProjectPaths(baseDir, projectRoot, paths, baseUrl) {
+	const kept = {};
+	const dropped = [];
+	for (const [alias, targets] of Object.entries(paths)) {
+		if (!Array.isArray(targets)) continue;
+		const resolved = targets.map((target) => path.resolve(baseUrl, target));
+		if (resolved.every((target) => {
+			const relative = path.relative(projectRoot, target);
+			return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+		})) kept[alias] = resolved.map((target) => {
+			return path.relative(baseDir, target).split(path.sep).join("/");
+		});
+		else dropped.push(alias);
+	}
+	return {
+		kept,
+		dropped
+	};
+}
+/**
+* Compose the tsconfig used to compile the bundle.
+*
+* Extends the config package's own tsconfig when there is one, so the project's
+* choices about target, JSX and strictness are respected. It has to be `extends`
+* rather than a copy of `compilerOptions`: TypeScript resolves relative paths
+* against the file they were written in, so copying a value like
+* `baseUrl: "../../"` into a config in a different directory silently repoints
+* it at the wrong place.
+*/
+async function writeBundleTsconfig(projectRoot, outDir, includes, options) {
+	const skipTypeCheck = options.skipTypeCheck === true;
+	const tsconfigDir = path.join(projectRoot, ".rebase");
+	const fromTsconfig = (target) => {
+		return path.relative(tsconfigDir, path.resolve(projectRoot, target)).split(path.sep).join("/");
+	};
+	const configTsconfigPath = path.join(projectRoot, "config", "tsconfig.json");
+	const extendsFrom = fs.existsSync(configTsconfigPath) ? fromTsconfig(path.join("config", "tsconfig.json")) : void 0;
+	let pathOverrides = {};
+	const baseOptions = await readCompilerOptions(projectRoot, configTsconfigPath);
+	if (baseOptions?.paths && typeof baseOptions.paths === "object") {
+		const baseDir = path.dirname(configTsconfigPath);
+		const baseUrl = path.resolve(baseDir, typeof baseOptions.baseUrl === "string" ? baseOptions.baseUrl : ".");
+		const { kept, dropped } = filterProjectPaths(tsconfigDir, projectRoot, baseOptions.paths, baseUrl);
+		pathOverrides = {
+			baseUrl: fromTsconfig("."),
+			paths: kept
+		};
+		if (dropped.length > 0) say(options, chalk.dim(`    ignoring ${dropped.length} path alias(es) pointing outside the project (${dropped.join(", ")}) — resolving those from node_modules instead`));
+	}
+	const compilerOptions = {
+		target: "ES2022",
+		module: "ESNext",
+		moduleResolution: "bundler",
+		lib: ["ES2022"],
+		jsx: "react-jsx",
+		allowSyntheticDefaultImports: true,
+		esModuleInterop: true,
+		resolveJsonModule: true,
+		forceConsistentCasingInFileNames: true,
+		rootDir: fromTsconfig("."),
+		outDir: fromTsconfig(path.relative(projectRoot, outDir) || "."),
+		typeRoots: discoverTypeRoots(projectRoot),
+		...pathOverrides,
+		declaration: false,
+		declarationMap: false,
+		sourceMap: true,
+		noEmit: false,
+		skipLibCheck: true,
+		allowJs: true,
+		...skipTypeCheck ? { noCheck: true } : {}
+	};
+	const tsconfig = {
+		...extendsFrom ? { extends: extendsFrom } : {},
+		compilerOptions,
+		include: includes.map(fromTsconfig),
+		exclude: [
+			"node_modules",
+			"**/*.test.ts",
+			"**/*.spec.ts",
+			"**/dist/**",
+			DEFAULT_BUNDLE_DIR
+		].map((pattern) => pattern.startsWith("**") ? pattern : fromTsconfig(pattern))
+	};
+	fs.mkdirSync(tsconfigDir, { recursive: true });
+	const tsconfigPath = path.join(tsconfigDir, "tsconfig.bundle.json");
+	fs.writeFileSync(tsconfigPath, JSON.stringify(tsconfig, null, 2), "utf8");
+	return tsconfigPath;
+}
+/**
+* Whether the compiled config package exports a `storageAuthorize` hook.
+*
+* Recorded in the manifest so a host can refuse a deploy that would enable file
+* storage with no access model, rather than let the runtime's boot guard turn it
+* into a crash loop the developer cannot read.
+*
+* Read from the *compiled* index, deliberately: that is the exact module the
+* runtime imports and reads the export off, so this cannot disagree with what
+* actually happens at boot. It is a textual check rather than an import because
+* a freshly built bundle cannot resolve its own dependencies until it is
+* deployed — the same reason schema hashing reads source.
+*
+* Errs toward `false`: a missed detection costs a deploy rejection whose message
+* says exactly how to proceed, while a false positive would hand back the crash
+* loop this exists to prevent.
+*/
+function detectStorageAuthorize(compiledConfigDir, depth = 0) {
+	const indexPath = [
+		".js",
+		".mjs",
+		".ts"
+	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
+	if (!indexPath) return false;
+	return moduleExportsStorageAuthorize(indexPath, depth);
+}
+/**
+* Whether one compiled module re-exports or defines `storageAuthorize`.
+*
+* Split out from {@link detectStorageAuthorize} so a wildcard re-export can be
+* followed. `export * from "./storage.js"` is an ordinary way to write a config
+* barrel, and treating it as "no hook" rejected deploys that were correct — with
+* a message telling the developer to add a hook they had already written.
+*/
+function moduleExportsStorageAuthorize(modulePath, depth) {
+	let source;
+	try {
+		source = fs.readFileSync(modulePath, "utf8");
+	} catch {
+		return false;
+	}
+	if (/\bexport\s+(?:async\s+)?(?:const|let|var|function)\s+storageAuthorize\b/.test(source)) return true;
+	for (const clause of source.matchAll(/\bexport\s*\{([^}]*)\}/g)) if (clause[1].split(",").map((entry) => {
+		const parts = entry.split(/\bas\b/);
+		return parts[parts.length - 1].trim();
+	}).includes("storageAuthorize")) return true;
+	if (depth < 3) for (const clause of source.matchAll(/\bexport\s*\*\s*from\s*["']([^"']+)["']/g)) {
+		const specifier = clause[1];
+		if (!specifier.startsWith(".")) continue;
+		const resolved = resolveRelativeModule(path.dirname(modulePath), specifier);
+		if (resolved && moduleExportsStorageAuthorize(resolved, depth + 1)) return true;
+	}
+	return false;
+}
+/**
+* Resolve a relative ESM specifier to a file on disk.
+*
+* Compiled output carries explicit `.js` extensions, but the same function reads
+* TypeScript sources during a source boot, where the specifier may be
+* extensionless or point at a directory index.
+*/
+function resolveRelativeModule(fromDir, specifier) {
+	const base = path.resolve(fromDir, specifier);
+	const candidates = [
+		base,
+		`${base}.js`,
+		`${base}.mjs`,
+		`${base}.ts`,
+		path.join(base, "index.js"),
+		path.join(base, "index.mjs"),
+		path.join(base, "index.ts")
+	];
+	for (const candidate of candidates) try {
+		if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;
+	} catch {
+		continue;
+	}
+	if (/\.js$/.test(base)) {
+		const asTs = base.replace(/\.js$/, ".ts");
+		try {
+			if (fs.existsSync(asTs) && fs.statSync(asTs).isFile()) return asTs;
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+/**
+* Detect native code in the dependency closure.
+*
+* Walks declared runtime dependencies breadth-first through `node_modules`,
+* flagging anything with a `binding.gyp`, a prebuilt `.node` binary, or an
+* install script that builds one. The managed runtime cannot run these: a
+* binary compiled for one image will not load in another, and finding that out
+* at deploy time is far better than in a crash loop.
+*
+* The walk is bounded. A dependency graph can be enormous, and this is a
+* heuristic gate whose false negatives are caught at deploy time anyway.
+*/
+function detectNativeDependencies(projectRoot, declared, limit = 2e3) {
+	const found = [];
+	const seen = /* @__PURE__ */ new Set();
+	const queue = Object.keys(declared);
+	let visited = 0;
+	const searchRoots = [
+		path.join(projectRoot, "node_modules"),
+		path.join(projectRoot, "backend", "node_modules"),
+		path.join(projectRoot, "config", "node_modules")
+	].filter((dir) => fs.existsSync(dir));
+	while (queue.length > 0 && visited < limit) {
+		const name = queue.shift();
+		if (seen.has(name)) continue;
+		seen.add(name);
+		visited++;
+		if (KNOWN_NATIVE_PACKAGES.has(name)) {
+			found.push({
+				name,
+				reason: "known native module"
+			});
+			continue;
+		}
+		const packageDir = searchRoots.map((root) => path.join(root, ...name.split("/"))).find((dir) => fs.existsSync(path.join(dir, "package.json")));
+		if (!packageDir) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+		} catch {
+			continue;
+		}
+		if (pkg.gypfile || fs.existsSync(path.join(packageDir, "binding.gyp"))) {
+			found.push({
+				name,
+				reason: "builds a native addon (binding.gyp)"
+			});
+			continue;
+		}
+		const install = `${pkg.scripts?.install ?? ""} ${pkg.scripts?.preinstall ?? ""} ${pkg.scripts?.postinstall ?? ""}`;
+		if (/node-gyp|prebuild|node-pre-gyp|cmake-js/.test(install)) {
+			found.push({
+				name,
+				reason: "install script compiles native code"
+			});
+			continue;
+		}
+		if (hasNodeBinary(packageDir)) {
+			found.push({
+				name,
+				reason: "ships a prebuilt .node binary"
+			});
+			continue;
+		}
+		for (const dep of Object.keys(pkg.dependencies ?? {})) if (!seen.has(dep)) queue.push(dep);
+	}
+	return found;
+}
+/** Shallow scan for `.node` binaries — deep enough for the usual `build/Release`. */
+function hasNodeBinary(dir, depth = 0) {
+	if (depth > 3) return false;
+	let entries;
+	try {
+		entries = fs.readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return false;
+	}
+	for (const entry of entries) {
+		if (entry.isFile() && entry.name.endsWith(".node")) return true;
+		if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".bin") {
+			if (hasNodeBinary(path.join(dir, entry.name), depth + 1)) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a dependency name resolves to a package *inside this repository* — a
+* workspace package rather than a registry one.
+*
+* The bundle's declared deps are installed with `npm install` from the public
+* registry beside the bundle at boot. A workspace package is not there, so
+* declaring it guarantees a boot-time install failure. The most common case is
+* the standard `config` package: the backend depends on it by name, but it is
+* *carried in the bundle* (as `entry.config`), so it must never also be an npm
+* dependency. Projects often express this as a `workspace:` range — caught
+* separately — but a plain `"*"` against a workspace symlink is just as common
+* and looks like a registry range, so the symlink is what actually settles it.
+*
+* Detection: the installed `node_modules/<name>` is a symlink whose real path is
+* inside the project and not within a pnpm virtual store (`.pnpm`). That is
+* exactly a workspace link and nothing else.
+*/
+function resolvesToWorkspacePackage(projectRoot, name) {
+	let realRoot;
+	try {
+		realRoot = fs.realpathSync(projectRoot);
+	} catch {
+		realRoot = projectRoot;
+	}
+	for (const base of [
+		projectRoot,
+		path.join(projectRoot, "backend"),
+		path.join(projectRoot, "config")
+	]) {
+		const link = path.join(base, "node_modules", name);
+		try {
+			if (!fs.lstatSync(link).isSymbolicLink()) continue;
+			const real = fs.realpathSync(link);
+			const insideRepo = real.startsWith(realRoot + path.sep);
+			const inStore = real.includes(`${path.sep}.pnpm${path.sep}`) || real.includes(`${path.sep}node_modules${path.sep}`);
+			if (insideRepo && !inStore) return true;
+		} catch {}
+	}
+	return false;
+}
+/**
+* The manifests a bundle's declared dependencies come from, least specific first.
+*
+* Order is the whole point. `collectDeclaredDependencies` lets a later manifest
+* win, and the app — `backend/` — is the one whose code was written and
+* typechecked against the range it names. The project root is a workspace root:
+* it exists to hold scripts and the tooling every workspace shares, and its
+* ranges were never exercised by the code that ends up in the bundle. It used to
+* be read last, so a scaffold declaring `dotenv ^16` at the root and `^17.4.2`
+* in the backend shipped a manifest telling the managed runtime to install 16.
+*/
+var BUNDLE_DEP_MANIFESTS = [
+	"package.json",
+	"config/package.json",
+	"backend/package.json"
+];
+/**
+* Specifiers the registry the managed runtime installs from cannot resolve.
+*
+* `workspace:` is handled separately (it is normal and expected inside this
+* repo's own projects); everything here is a specifier that works on the
+* developer's disk and nowhere else. The runtime installs `deps.declared` from
+* npm with no access to the machine the bundle was built on, so a `file:` or a
+* `git+` range is a deploy-time install failure — the worst place to find out.
+*/
+var NON_REGISTRY_PROTOCOLS = [
+	"file:",
+	"link:",
+	"portal:",
+	"git+",
+	"git:",
+	"github:"
+];
+/** Whether a range names something npm could not install from the registry. */
+function nonRegistrySpecifier(version) {
+	const trimmed = version.trim();
+	for (const protocol of NON_REGISTRY_PROTOCOLS) if (trimmed.startsWith(protocol)) return protocol;
+	if (/^\.{0,2}\//.test(trimmed)) return "a filesystem path";
+	return null;
+}
+/**
+* Collect the runtime dependencies a bundle needs installed beside it.
+*
+* Packages the runtime image already provides are excluded — reinstalling a
+* second copy of the server next to the one running the process is at best
+* wasted space and at worst a version conflict. Workspace packages are excluded
+* too: they are not on the registry the runtime installs from, and the project's
+* own config package already travels inside the bundle.
+*
+* Throws when a declared range is not something the registry can resolve, or
+* when two manifests declare a name at ranges nothing satisfies. The
+* alternative is a bundle that builds green and fails at the deploy's install
+* step, minutes later and on a machine the developer cannot see. `rebase build`
+* reports both in its own words first; this is the backstop for every other
+* caller, `rebase cloud deploy` included.
+*/
+function collectDeclaredDependencies(projectRoot) {
+	const declared = {};
+	const conflicts = detectDeclaredDepConflicts(projectRoot);
+	if (conflicts.length > 0) {
+		const described = conflicts.map((c) => {
+			const [a, b] = c.declarations;
+			return `${c.name}: ${a.range} (${a.file}) vs ${b.range} (${b.file})`;
+		}).join("; ");
+		throw new Error(`No single version satisfies every range this project declares — ${described}. The bundle installs one of them and the rest of the project was built against the other. Declare one range, in the app that uses it.`);
+	}
+	for (const relative of BUNDLE_DEP_MANIFESTS) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+		} catch {
+			continue;
+		}
+		for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+			if (RUNTIME_PROVIDED.has(name)) continue;
+			if (typeof version === "string" && version.startsWith("workspace:")) continue;
+			if (resolvesToWorkspacePackage(projectRoot, name)) continue;
+			const protocol = typeof version === "string" ? nonRegistrySpecifier(version) : null;
+			if (protocol && parseEnvBoolean(process.env.REBASE_E2E) === true && protocol === "file:") {
+				declared[name] = version;
+				continue;
+			}
+			if (protocol) throw new Error(`${relative} declares "${name}": "${version}", which the managed runtime cannot install — ${protocol} resolves only on this machine. Publish the package to a registry and depend on it by version, or vendor its source into the backend.`);
+			declared[name] = version;
+		}
+	}
+	return declared;
+}
+/**
+* Lowest version a range could resolve to, or null if it is not a range.
+*
+* Kept deliberately tiny and local. The published range grammar here is a caret,
+* a tilde, an exact version or a `>=` floor, and the alternative — a semver
+* dependency in the CLI — buys breadth this does not need.
+*/
+function lowerBoundOf(range) {
+	const raw = range.trim().replace(/^[\^~]/, "").replace(/^>=\s*/, "").replace(/^v/, "");
+	if (!/^\d+(\.\d+){0,2}$/.test(raw)) return null;
+	const [major, minor = 0, patch = 0] = raw.split(".").map(Number);
+	return [
+		major,
+		minor,
+		patch
+	];
+}
+/** Highest version a range could resolve to (exclusive), or null. */
+function upperBoundOf(range) {
+	const trimmed = range.trim();
+	const min = lowerBoundOf(trimmed);
+	if (!min) return null;
+	if (trimmed.startsWith(">=")) return null;
+	const [major, minor, patch] = min;
+	if (trimmed.startsWith("^")) {
+		if (major > 0) return [
+			major + 1,
+			0,
+			0
+		];
+		if (minor > 0) return [
+			0,
+			minor + 1,
+			0
+		];
+		return [
+			0,
+			0,
+			patch + 1
+		];
+	}
+	if (trimmed.startsWith("~")) return trimmed.replace(/^~v?/, "").split(".").length >= 2 ? [
+		major,
+		minor + 1,
+		0
+	] : [
+		major + 1,
+		0,
+		0
+	];
+	const parts = trimmed.replace(/^v/, "").split(".").length;
+	if (parts === 1) return [
+		major + 1,
+		0,
+		0
+	];
+	if (parts === 2) return [
+		major,
+		minor + 1,
+		0
+	];
+	return [
+		major,
+		minor,
+		patch + 1
+	];
+}
+function compareTriples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Whether a declared range could EVER resolve at or above `target`.
+*
+* The same question the control plane asks at intake, asked here first. Only a
+* range whose entire span sits below the target is reported — `^0.10.0` can
+* never cross to 0.12 whatever npm publishes — because a false alarm on a build
+* that would have worked trains people to ignore the warning that matters.
+*/
+function canReach(range, target) {
+	const ceiling = upperBoundOf(range);
+	const floor = lowerBoundOf(target);
+	if (!floor || !lowerBoundOf(range)) return null;
+	if (!ceiling) return true;
+	return compareTriples(ceiling, floor) > 0;
+}
+/**
+* Whether no single published version can satisfy both ranges.
+*
+* Only a provable disagreement counts. Anything this tiny grammar cannot read —
+* a tag, an `||`, a `*` — returns false, because a build refused over a range
+* the CLI merely failed to parse is worse than the drift it was looking for.
+*/
+function rangesDisjoint(a, b) {
+	const loA = lowerBoundOf(a);
+	const loB = lowerBoundOf(b);
+	if (!loA || !loB) return false;
+	const hiA = upperBoundOf(a);
+	const hiB = upperBoundOf(b);
+	if (hiA && compareTriples(hiA, loB) <= 0) return true;
+	if (hiB && compareTriples(hiB, loA) <= 0) return true;
+	return false;
+}
+/**
+* Names two of the bundle's manifests declare at ranges nothing satisfies.
+*
+* `collectDeclaredDependencies` has to pick one — the app's — and the loser is
+* silent: the bundle tells the managed runtime to install a version the other
+* half of the project was never compiled against. The stock scaffold shipped
+* exactly that (`dotenv ^16` at the root, `^17.4.2` in `backend/`), so every
+* bundle built from a default project asked for dotenv 16.
+*
+* Scoped to the three manifests that feed `deps.declared`, and to their
+* `dependencies`: a `frontend/` that wants a different major of a build tool is
+* not this problem, and `devDependencies` never reach the bundle.
+*/
+function detectDeclaredDepConflicts(projectRoot) {
+	const seen = /* @__PURE__ */ new Map();
+	const conflicts = [];
+	for (const relative of BUNDLE_DEP_MANIFESTS) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+		} catch {
+			continue;
+		}
+		for (const [name, range] of Object.entries(pkg.dependencies ?? {})) {
+			if (typeof range !== "string") continue;
+			if (RUNTIME_PROVIDED.has(name)) continue;
+			if (range.startsWith("workspace:")) continue;
+			const first = seen.get(name);
+			if (!first) {
+				seen.set(name, {
+					name,
+					range,
+					file: relative
+				});
+				continue;
+			}
+			if (first.range === range) continue;
+			if (!rangesDisjoint(first.range, range)) continue;
+			conflicts.push({
+				name,
+				declarations: [first, {
+					name,
+					range,
+					file: relative
+				}]
+			});
+		}
+	}
+	return conflicts;
+}
+/**
+* Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+*
+* This is the only place a developer can be told. In development, every
+* `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+* checkout, so the version STRINGS in package.json are never exercised — the
+* project runs fine locally on whatever is on disk, and the declared numbers are
+* first honoured when the runtime npm-installs them from a bundle in the cloud.
+* A project scaffolded at 0.10.0 therefore keeps working on a developer's
+* machine indefinitely while being, in the cloud, a 0.10.0 driver.
+*
+* That matters because the image supplies only `@rebasepro/server`; the database
+* driver comes from these declarations and a newer runtime never updates it.
+* Every package.json is scanned, `dependencies` and `devDependencies` both,
+* because they have to be bumped together and the one that gets forgotten is the
+* one nobody looks at.
+*/
+function detectFrameworkDepDrift(projectRoot, cliVersion) {
+	const found = [];
+	for (const relative of [
+		"package.json",
+		"backend/package.json",
+		"config/package.json",
+		"frontend/package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const block of [pkg.dependencies, pkg.devDependencies]) for (const [name, range] of Object.entries(block ?? {})) {
+				if (!name.startsWith("@rebasepro/")) continue;
+				if (typeof range !== "string") continue;
+				found.push({
+					name,
+					range,
+					file: relative
+				});
+			}
+		} catch {}
+	}
+	const behind = found.filter((d) => canReach(d.range, cliVersion) === false);
+	const bounds = new Set(found.map((d) => lowerBoundOf(d.range)).filter((b) => b != null).map((b) => b.join(".")));
+	return {
+		behind,
+		disagreeing: bounds.size > 1 ? [...bounds].sort() : [],
+		conflicting: detectDeclaredDepConflicts(projectRoot)
+	};
+}
+/**
+* The `[start, end)` ranges of `//` and block comments in JavaScript source.
+*
+* `normalizeEsmSpecifiers` scans emitted output with a regular expression, and a
+* regular expression cannot tell a specifier from a specifier somebody wrote
+* about. The stock template ships one: `config/resources.ts` documents
+* `import { media } from "../resources";` inside a docblock, tsc preserves the
+* comment, and every `rebase build` of an untouched scaffold printed
+* `⚠ 1 import(s) could not be resolved`. A warning that is wrong on the default
+* project teaches people to ignore the warning that predicts a boot failure.
+*
+* Strings are tracked only so a `//` inside one — every `http://` in the tree —
+* does not open a comment that swallows the rest of the line. A `'` or `"` span
+* ends at the newline as well as at its closing quote: a JavaScript string
+* cannot contain a raw newline, so a quote that reaches one was never a string
+* (a regex literal's, most likely) and the mistake must not run on.
+*/
+function commentSpans(source) {
+	const spans = [];
+	let quote = null;
+	let i = 0;
+	while (i < source.length) {
+		const c = source[i];
+		if (quote) {
+			if (c === "\\") {
+				i += 2;
+				continue;
+			}
+			if (c === quote || c === "\n" && quote !== "`") quote = null;
+			i++;
+			continue;
+		}
+		if (c === "\"" || c === "'" || c === "`") {
+			quote = c;
+			i++;
+			continue;
+		}
+		if (c === "/" && source[i + 1] === "/") {
+			const newline = source.indexOf("\n", i);
+			const end = newline === -1 ? source.length : newline;
+			spans.push([i, end]);
+			i = end;
+			continue;
+		}
+		if (c === "/" && source[i + 1] === "*") {
+			const close = source.indexOf("*/", i + 2);
+			const end = close === -1 ? source.length : close + 2;
+			spans.push([i, end]);
+			i = end;
+			continue;
+		}
+		i++;
+	}
+	return spans;
+}
+/**
+* Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
+*
+* TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
+* lets a project write `from "./posts"` or `from "./collections"`, and TypeScript
+* emits them unchanged on the assumption that a bundler will finish the job.
+* Nothing bundles a Rebase bundle — the runtime imports these files directly with
+* Node's ESM loader, which requires a full path with an extension and refuses
+* directory imports outright.
+*
+* Without this, adopting the bundle would mean asking every project written in
+* the (extremely common) extensionless style to rewrite all of its imports. The
+* rewrite is mechanical and verifiable: only relative specifiers are touched, and
+* only when the target file actually exists on disk.
+*
+* `write: false` computes the same answer and leaves every file as it was —
+* `rebase normalize-imports --check`, which reports and must not repair.
+*/
+function normalizeEsmSpecifiers(outDir, options = {}) {
+	const write = options.write !== false;
+	const unresolved = [];
+	let rewritten = 0;
+	const SPECIFIER = /(\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)(["'])(\.[^"']*)\2/g;
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, entry.name);
+			if (entry.isDirectory()) {
+				if (entry.name === "node_modules") continue;
+				walk(full);
+			} else if (entry.isFile() && entry.name.endsWith(".js")) rewriteFile(full);
+		}
+	};
+	const rewriteFile = (file) => {
+		const original = fs.readFileSync(file, "utf8");
+		const dir = path.dirname(file);
+		const comments = commentSpans(original);
+		const inComment = (at) => comments.some(([start, end]) => at >= start && at < end);
+		const updated = original.replace(SPECIFIER, (match, prefix, quote, specifier, offset) => {
+			if (inComment(offset)) return match;
+			if (/\.(js|mjs|cjs|json|node)$/.test(specifier)) return match;
+			const target = path.resolve(dir, specifier);
+			if (fs.existsSync(`${target}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}.js${quote}`;
+			}
+			if (fs.existsSync(path.join(target, "index.js"))) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}${specifier.endsWith("/") ? "index.js" : "/index.js"}${quote}`;
+			}
+			if (specifier.endsWith(".ts") && fs.existsSync(`${target.slice(0, -3)}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier.slice(0, -3)}.js${quote}`;
+			}
+			unresolved.push(`${path.basename(file)} → ${specifier}`);
+			return match;
+		});
+		if (write && updated !== original) fs.writeFileSync(file, updated, "utf8");
+	};
+	if (fs.existsSync(outDir)) walk(outDir);
+	return {
+		rewritten,
+		unresolved
+	};
+}
+/**
+* Remove a previous build so stale output cannot masquerade as current.
+*
+* The containment check matters because this is a recursive force-delete of a
+* path that came from a command-line flag: `rebase build --out ../..` would
+* otherwise erase the parent of the project. The manifest's own paths are
+* checked the same way; a flag deserves no less.
+*/
+function cleanOutDir(projectRoot, outDir) {
+	const relative = path.relative(projectRoot, outDir);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Refusing to build into "${outDir}": the output directory must be inside the project.`);
+	if (fs.existsSync(outDir)) fs.rmSync(outDir, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(outDir, { recursive: true });
+}
+/**
+* Regenerate the Drizzle schema from the collections.
+*
+* Delegated to the database driver's own CLI — the same code `rebase schema
+* generate` runs — so there is one implementation of what a schema is. When no
+* driver is resolvable the build continues with a warning rather than failing:
+* a `baas` project has no schema to generate, and a project mid-install should
+* get a clear message rather than a hard stop.
+*/
+async function regenerateSchema(projectRoot, configDir, options) {
+	const backendDir = path.join(projectRoot, "backend");
+	if (!fs.existsSync(backendDir)) return;
+	const plugin = getActiveBackendPlugin(backendDir);
+	const script = plugin ? resolvePluginCliScript(backendDir, plugin) : null;
+	if (!script) {
+		log(options, chalk.dim("  (no database driver found — skipping schema generation)"));
+		return;
+	}
+	const runner = script.endsWith(".ts") ? resolveTsx(projectRoot) : "node";
+	if (!runner) {
+		log(options, chalk.dim("  (tsx not installed — skipping schema generation)"));
+		return;
+	}
+	const collectionsPath = path.join("..", configDir, "collections");
+	const { execa } = await import("execa");
+	try {
+		await execa(runner, [
+			script,
+			"schema",
+			"generate",
+			"--collections",
+			collectionsPath
+		], {
+			cwd: backendDir,
+			stdio: "pipe"
+		});
+		log(options, chalk.dim("  regenerated database schema from collections"));
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		throw new Error(`Schema generation failed, so the bundle was not written.\n${detail}\nRun \`rebase schema generate\` to see the full output, or pass --skip-schema if the committed schema is deliberately hand-maintained.`);
+	}
+}
+/**
+* A hand-written server entrypoint that a bundle does not use.
+*
+* `rebase dev` runs `backend/src/index.ts` whenever a project has one, so for
+* the whole of local development that file *is* the server and every route
+* written in it works. A bundle has no entrypoint of its own: the runtime boots
+* the bundle and mounts what the manifest points at — the config package,
+* functions, crons and the schema. The file is not compiled, not shipped, and
+* never imported.
+*
+* Nothing said so. A project with custom routes in its entrypoint built clean,
+* deployed green, and answered 404 on every one of them, with the file still
+* sitting in the repository looking exactly like the server.
+*
+* A project that means to own its server process runs `rebase eject`, which
+* writes an entrypoint, a Dockerfile and a compose file together and flips the
+* backend to `runtime: "custom"`. The warning names that route rather than
+* implying the file is a mistake — but eject writes *its* entrypoint, so the
+* warning must not read as "eject will keep what you wrote here".
+*/
+function findUnusedServerEntry(projectRoot, functionsDir) {
+	const found = [path.join("backend", "src", "index.ts"), path.join(path.dirname(functionsDir), "src", "index.ts")].find((candidate) => fs.existsSync(path.join(projectRoot, candidate)));
+	return found ? found.split(path.sep).join("/") : void 0;
+}
+/**
+* The bundle manifest, as a pure function of its inputs.
+*
+* Separated from `buildBundle` so the SHAPE a host reads can be pinned by a
+* test without compiling a project: `tooling/contracts/bundle-manifest.json`
+* is written from this with fixed inputs, and the control plane's own tests
+* read that file to prove they consume what the CLI emits. That contract is
+* what was missing when buckets moved from `storage.sources` into `resources`
+* and the control plane went on reading the old field for two weeks — every
+* declared bucket arriving as nothing, with both suites green.
+*/
+function composeBundleManifest(input) {
+	return {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: input.runtimeRange,
+			builtAgainst: input.builtAgainst,
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: input.schemaVersion,
+		app: input.appName,
+		kind: "backend",
+		entry: input.entry,
+		collections: [...input.collectionSlugs].sort(),
+		...input.functions.length > 0 ? { functions: input.functions } : {},
+		hooks: {
+			native: input.nativeModules.length > 0,
+			nativeModules: input.nativeModules.length > 0 ? input.nativeModules : void 0
+		},
+		storage: { authorize: input.declaresStorageAuthorize },
+		resources: input.resources,
+		deps: { declared: input.declaredDeps },
+		build: input.build
+	};
+}
+/**
+* What a build refusing on {@link detectDeclaredDepConflicts} says: every name,
+* both ranges and where each is declared.
+*/
+function describeDepConflicts(conflicts) {
+	const lines = [`${conflicts.length} dependency range(s) no single version satisfies:`];
+	for (const { name, declarations: [first, second] } of conflicts) lines.push(`    ${name}`, `      ${first.range}  (${first.file})`, `      ${second.range}  (${second.file})`);
+	lines.push("  The bundle installs one range; the other half of the project was built against the other.", "  Declare one range, in the app that uses it.");
+	return lines.join("\n");
+}
+async function buildBundle(options) {
+	const { projectRoot, app, appName } = options;
+	const conflicts = detectDeclaredDepConflicts(projectRoot);
+	if (conflicts.length > 0) throw new Error(describeDepConflicts(conflicts));
+	const paths = resolveBackendPaths(app, projectRoot);
+	const outDir = path.resolve(projectRoot, options.outDir ?? "dist-bundle");
+	const includes = [];
+	const addIfExists = (relative, pattern) => {
+		if (fs.existsSync(path.join(projectRoot, relative))) includes.push(pattern);
+	};
+	if (paths.hasConfig) addIfExists(paths.config, `${paths.config}/**/*.ts`);
+	addIfExists(paths.functions, `${paths.functions}/**/*.ts`);
+	addIfExists(paths.crons, `${paths.crons}/**/*.ts`);
+	if (fs.existsSync(path.join(projectRoot, paths.schema))) includes.push(paths.schema);
+	if (includes.length === 0) throw new Error(`Nothing to build for app "${appName}". Expected a config directory at "${paths.config}" or functions at "${paths.functions}".`);
+	if (paths.hasCollections && options.skipSchema !== true) await regenerateSchema(projectRoot, paths.config, options);
+	const unusedEntry = findUnusedServerEntry(projectRoot, paths.functions);
+	if (unusedEntry) {
+		const parts = [
+			...paths.hasCollections ? [`${paths.config}/`] : [],
+			`${paths.functions}/`,
+			"the schema"
+		];
+		const compiled = `${parts.slice(0, -1).join(", ")} and ${parts[parts.length - 1]}`;
+		say(options, chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
+		say(options, chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
+		say(options, chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
+		say(options, chalk.dim("      or run `rebase eject`, which writes an entrypoint of its own and owns"));
+		say(options, chalk.dim("      the image — it does not adopt this file, and will not replace it"));
+		say(options, chalk.dim("      without --force."));
+	}
+	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
+	cleanOutDir(projectRoot, outDir);
+	const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options);
+	const tsc = resolveLocalBin(projectRoot, "tsc");
+	if (!tsc) throw new Error("TypeScript is not installed in this project. Run your package manager's install first.");
+	const { execa } = await import("execa");
+	try {
+		await execa(tsc, ["-p", tsconfigPath], {
+			cwd: projectRoot,
+			stdio: toolStdio(options.quietStdout)
+		});
+	} catch {
+		throw new Error("TypeScript compilation failed — the bundle was not written.");
+	}
+	const normalized = normalizeEsmSpecifiers(outDir);
+	if (normalized.rewritten > 0) log(options, chalk.dim(`  resolved ${normalized.rewritten} relative import(s) for Node ESM`));
+	if (normalized.unresolved.length > 0) {
+		say(options, chalk.yellow(`  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`));
+		for (const item of normalized.unresolved.slice(0, 5)) say(options, chalk.dim(`      ${item}`));
+		if (normalized.unresolved.length > 5) say(options, chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));
+	}
+	const compiledConfigDir = path.join(outDir, paths.config);
+	const compiledCollectionsDir = path.join(compiledConfigDir, "collections");
+	let collections = [];
+	if (paths.hasCollections) {
+		collections = await loadSourceCollections(path.join(projectRoot, paths.config, "collections"));
+		if (collections.length === 0) throw new Error(`No collections were found in ${path.join(paths.config, "collections")}. Define at least one collection there, or remove the directory to have the runtime introspect collections from the live database instead.`);
+		if (!fs.existsSync(compiledCollectionsDir)) throw new Error(`Compilation produced no collections directory at ${path.relative(projectRoot, compiledCollectionsDir)}.`);
+	}
+	const declared = collectDeclaredDependencies(projectRoot);
+	const nativeModules = detectNativeDependencies(projectRoot, declared);
+	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
+	const resourceGraph = options.resources ?? {
+		version: 1,
+		resources: []
+	};
+	const collision = findStorageSuffixCollision(resourceGraph.resources.filter((r) => r.kind === "bucket").map((r) => ({
+		key: r.key,
+		engine: r.engine,
+		transport: r.transport,
+		...r.label !== void 0 ? { label: r.label } : {}
+	})).map((s) => s.key));
+	if (collision) throw new Error(`Buckets "${collision.a}" and "${collision.b}" both map to the environment variable suffix "${collision.suffix || "(none)"}", so they would read each other's configuration. Rename one of them.`);
+	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
+	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
+	const functionReports = analyseFunctionsDirectory(path.join(projectRoot, paths.functions), projectRoot);
+	const bundledFunctions = functionReports.map((report) => {
+		const requires = [...new Set(report.issues.filter((issue) => issue.kind === "node-builtin" || issue.kind === "node-only-package").map((issue) => issue.message))];
+		return {
+			name: report.name,
+			file: report.file.replace(/\.ts$/, ".js"),
+			portable: report.portable,
+			...requires.length > 0 ? { requires } : {}
+		};
+	});
+	for (const line of summarisePortability(functionReports)) say(options, line.trimStart().startsWith("⚠") ? chalk.yellow(line) : chalk.dim(line));
+	const manifest = composeBundleManifest({
+		runtimeRange: options.runtimeRange,
+		builtAgainst: resolveServerVersion(projectRoot),
+		schemaVersion: paths.hasCollections ? computeSchemaVersion(collections) : "",
+		appName,
+		entry: {
+			config: paths.hasConfig ? relative(paths.config) : void 0,
+			collections: paths.hasCollections ? relative(path.join(paths.config, "collections")) : void 0,
+			functions: relative(paths.functions),
+			crons: relative(paths.crons),
+			schema: relative(schemaOut),
+			usersCollection: paths.hasCollections ? relative(path.join(paths.config, `${paths.usersCollection}.js`)) : void 0
+		},
+		collectionSlugs: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)),
+		functions: bundledFunctions,
+		nativeModules,
+		declaresStorageAuthorize,
+		resources: resourceGraph,
+		declaredDeps: declared,
+		build: {
+			cli: cliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	});
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: declared
+	}, null, 2)}\n`, "utf8");
+	const vendor = vendorDependencies({
+		outDir,
+		declared,
+		nativeModules,
+		required: [getActiveBackendPlugin(path.join(projectRoot, "backend"))].filter((name) => Boolean(name)),
+		requested: options.vendor
+	});
+	if (vendor.vendored) {
+		manifest.deps.vendored = true;
+		manifest.deps.vendorTarget = vendor.target;
+		fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	}
+	return {
+		outDir,
+		manifest,
+		collectionCount: collections.length,
+		vendor
+	};
+}
+/** Default install target: what the published runtime image runs. */
+var VENDOR_TARGET_OS = "linux";
+var VENDOR_TARGET_CPU = "x64";
+/**
+* Where a vendored bundle starts being too big to upload.
+*
+* The control plane refuses a bundle over 100 MB, and that ceiling is not
+* arbitrary or easily raised: its pod has a 512Mi memory limit and the upload
+* route holds the body while it writes it, so the cap protects the process that
+* also serves the console, deploys and billing. Vendoring is the one change that
+* can push a bundle near it.
+*
+* So the warning is here, at build time, where the remedy is one flag away —
+* rather than at deploy time as a 413 nobody can act on without rebuilding. The
+* threshold sits below the real cap because this measures the tree on disk and
+* the upload is compressed: crossing it means "getting close", not "will fail".
+*/
+var VENDOR_SIZE_WARN_BYTES = 150 * 1024 * 1024;
+/**
+* Where vendoring stops being an optimisation and becomes a bundle nobody can
+* deploy.
+*
+* Past this, shipping the tree anyway trades a faster cold start for a 413 — and
+* the 413 arrives at deploy time, after a build nobody watches, with a remedy
+* (`--no-vendor`) that requires knowing this happened. Unvendoring here costs
+* 40–60s of cold start and produces a bundle that uploads; that is the better
+* side of the trade to be on by default.
+*
+* 200 MB assumes a **2x** floor on compression, which is pessimistic for a tree
+* of JavaScript (3–5x is typical) and deliberately so: source maps and prebuilt
+* binaries compress far worse than source, and the failure this prevents is
+* asymmetric — a bundle refused at the door versus a minute of cold start.
+* `--vendor` overrides it, for a deploy path with no upload at all (a Dockerfile
+* built from source, where the tree is copied into an image and the control
+* plane never sees it).
+*/
+var VENDOR_SIZE_MAX_BYTES = 200 * 1024 * 1024;
+/** Bytes on disk under `dir`. Bounded so a pathological tree cannot hang a build. */
+function directorySize(dir, budget = 2e5) {
+	let total = 0;
+	let visited = 0;
+	const stack = [dir];
+	while (stack.length > 0 && visited < budget) {
+		const current = stack.pop();
+		let entries;
+		try {
+			entries = fs.readdirSync(current, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			visited++;
+			const full = path.join(current, entry.name);
+			if (entry.isDirectory()) stack.push(full);
+			else if (entry.isFile()) try {
+				total += fs.statSync(full).size;
+			} catch {}
+		}
+	}
+	return total;
+}
+/**
+* Install the bundle's declared dependencies into the bundle itself.
+*
+* ## What this buys
+*
+* A managed pod's bundle lives on an `emptyDir`, so it is re-fetched and
+* re-installed on **every** start — an eviction, a node failure, an OOM, a
+* runtime rollout. The install is 35–55 seconds of a 40–60 second cold start,
+* which makes it the price of every unplanned restart a tenant suffers. Doing it
+* once at build time instead of every time at boot takes that to roughly the
+* cost of untarring.
+*
+* The pod side needs no change to benefit: the init container already skips
+* installing when `node_modules` is present, a guard that existed for
+* pre-baked images and turns out to be exactly the hook this needs.
+*
+* ## Why it refuses to vendor native code
+*
+* A compiled binary is valid only for the platform it was built for, and a
+* developer's machine is rarely the deployment's. The managed runtime already
+* refuses bundles containing native modules for the same reason, so this refusal
+* costs nothing there — but a self-hosted project may legitimately use them, and
+* for those the honest answer is to install in the container, where the platform
+* is known.
+*
+* ## Why `--os` and `--cpu` are not optional
+*
+* The dangerous case is not native code, which is detectable. It is a pure-JS
+* package whose real work lives in a **platform-specific optional dependency** —
+* `esbuild` being the one everybody meets. Installing on an Apple Silicon Mac
+* resolves `@esbuild/darwin-arm64`, produces a tree that looks complete, and
+* fails at import inside a linux/amd64 pod. npm resolves optional dependencies
+* for the declared target rather than the host when told to, so it is told to.
+*/
+function vendorDependencies(options) {
+	if (options.requested === false) return {
+		vendored: false,
+		skipped: "disabled with --no-vendor"
+	};
+	if (Object.keys(options.declared).length === 0) return {
+		vendored: false,
+		skipped: "the bundle declares no dependencies"
+	};
+	if (options.nativeModules.length > 0) return {
+		vendored: false,
+		skipped: `the dependency closure contains native code (${options.nativeModules.map((m) => m.name).join(", ")}), which is only valid on the platform it was compiled for`
+	};
+	const target = {
+		os: VENDOR_TARGET_OS,
+		cpu: "x64",
+		node: process.versions.node.split(".")[0]
+	};
+	const run = options.run ?? ((cmd, args, cwd) => {
+		const result = spawnSync(cmd, args, {
+			cwd,
+			stdio: "pipe",
+			encoding: "utf8"
+		});
+		if (result.error) throw result.error;
+		if (result.status !== 0) throw new Error(`${cmd} ${args.join(" ")} exited ${result.status}\n${result.stderr || result.stdout || ""}`.trim());
+	});
+	try {
+		run("npm", [
+			"install",
+			"--omit=dev",
+			"--ignore-scripts",
+			"--no-audit",
+			"--no-fund",
+			`--os=${target.os}`,
+			`--cpu=${target.cpu}`
+		], options.outDir);
+	} catch (error) {
+		return {
+			vendored: false,
+			skipped: `npm install failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const installed = path.join(options.outDir, "node_modules");
+	if (!fs.existsSync(installed)) return {
+		vendored: false,
+		skipped: "npm install produced no node_modules"
+	};
+	const missing = (options.required ?? []).filter((name) => !fs.existsSync(path.join(installed, ...name.split("/"), "package.json")));
+	if (missing.length > 0) {
+		fs.rmSync(installed, {
+			recursive: true,
+			force: true
+		});
+		fs.rmSync(path.join(options.outDir, "package-lock.json"), { force: true });
+		return {
+			vendored: false,
+			skipped: `the installed tree is missing ${missing.join(", ")}, which the runtime resolves from the bundle — the bundle declares it at a version no registry can serve (a workspace link), so nothing was vendored rather than shipping a tree that boots without a driver`
+		};
+	}
+	const bytes = directorySize(installed);
+	if (bytes > 209715200 && options.requested !== true) {
+		fs.rmSync(installed, {
+			recursive: true,
+			force: true
+		});
+		fs.rmSync(path.join(options.outDir, "package-lock.json"), { force: true });
+		return {
+			vendored: false,
+			skipped: `the installed tree is ${Math.round(bytes / (1024 * 1024))} MB, past the point where the upload can be expected to fit under the control plane's 100 MB limit — a bundle that is refused at the door is worse than one that installs at boot. Pass --vendor to keep it anyway (a deploy that builds from source never uploads the tree), or shrink the declared dependencies`
+		};
+	}
+	return {
+		vendored: true,
+		target,
+		bytes
+	};
+}
+/**
+* Package a built static app (a `static` or bundled-`admin` app) into a bundle.
+*
+* A static bundle is the counterpart to a backend bundle: the same shape, the
+* same runtime image runs it, but its manifest says `mode: "static"` and it
+* carries only the built assets under `static/`. That is what lets a frontend or
+* admin app be its own deployable, scalable unit rather than something baked into
+* the backend container.
+*
+* `assetsDir` is the app's built output (e.g. `frontend/dist`), already produced
+* by its own build command. This copies it into the bundle and writes the
+* manifest — no compilation, no dependency closure (a static bundle installs
+* nothing at boot).
+*/
+/**
+* Fold a built static app into a backend bundle, so one runtime serves both.
+*
+* ## Why this exists
+*
+* A managed tenant runs one pod, and `bootFromBundle` on the backend path already
+* knows how to serve a SPA — it looks for `entry.static` and mounts `serveSPA`
+* last, behind `REBASE_SERVE_STATIC`. What was missing was anything putting the
+* assets there.
+*
+* The consequence was not subtle. A project whose custom image served its website
+* at `/` and its API at `/api` — the shape the scaffolded template produces — lost
+* the website the moment it moved to the managed runtime: the API answered
+* perfectly and every page 404'd. Managed could not be a drop-in replacement for
+* custom while the frontend simply vanished.
+*
+* Folding restores parity with the container it replaces, which is the only
+* honest baseline. It is deliberately the FIRST implementation and not the last:
+* a static app on its own bucket behind a CDN is better for cache behaviour and
+* lets the frontend deploy independently. But that needs infrastructure that does
+* not exist yet, and "your site is gone" is not an acceptable state to leave a
+* project in while it gets built.
+*
+* The trade it makes, stated plainly: frontend and backend now deploy together
+* and the bundle carries the built assets. For a project that was shipping both
+* in one image already, that is exactly what it had.
+*/
+function foldStaticIntoBundle(options) {
+	const { bundleDir, assetsDir, appName, path: basePath, host, spa, cms } = options;
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);
+	if (!fs.existsSync(assetsDir)) throw new Error(`No built assets at ${assetsDir}.`);
+	const dir = path.posix.join("static", appName);
+	const staticOut = path.join(bundleDir, "static", appName);
+	fs.rmSync(staticOut, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (target) => {
+		for (const entry of fs.readdirSync(target, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(target, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	precompressStaticAssets(staticOut);
+	const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	const existing = (manifest.entry?.static ?? []).filter((entry) => entry.dir !== dir);
+	manifest.entry = {
+		...manifest.entry,
+		static: [...existing, {
+			path: basePath,
+			...host ? { host } : {},
+			dir,
+			spa,
+			name: appName,
+			...cms ? { cms } : {}
+		}].sort(compareMountOrder)
+	};
+	fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	return {
+		fileCount,
+		dir
+	};
+}
+function buildStaticBundle(options) {
+	const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;
+	const basePath = options.path ?? "/";
+	cleanOutDir(projectRoot, outDir);
+	const staticOut = path.join(outDir, "static");
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	precompressStaticAssets(staticOut);
+	const manifest = {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: runtimeRange,
+			builtAgainst: resolveServerVersion(projectRoot),
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: "",
+		app: appName,
+		kind: "static",
+		entry: { static: [{
+			path: basePath,
+			...options.host ? { host: options.host } : {},
+			dir: "static",
+			spa: options.spa ?? true,
+			name: appName,
+			...options.cms ? { cms: options.cms } : {}
+		}] },
+		hooks: { native: false },
+		deps: { declared: {} },
+		build: {
+			cli: cliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	};
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: {}
+	}, null, 2)}\n`, "utf8");
+	return {
+		outDir,
+		manifest,
+		fileCount
+	};
+}
+/**
+* Which files in a collections directory are collections.
+*
+* Mirrors the runtime loader's rules exactly, and must keep mirroring them: the
+* set of files counted here decides the schema version, and the runtime decides
+* what it serves the same way. A divergence would show up as a client that is
+* permanently "out of date" against a server that agrees with it.
+*
+* (`._*` guards macOS AppleDouble files, which look like sources and are not.)
+*/
+function isCollectionSourceFile(name) {
+	if (name.startsWith(".")) return false;
+	if (name.includes(".test.") || name.includes(".spec.")) return false;
+	if (name.endsWith(".d.ts")) return false;
+	if (name === "index.ts" || name === "index.js") return false;
+	return name.endsWith(".ts") || name.endsWith(".js");
+}
+/**
+* Load collections from **source**, for hashing and for the manifest's slug list.
+*
+* Deliberately not the compiled output. A compiled bundle imports its
+* dependencies from beside itself — that is the whole point of shipping a
+* `package.json` with it — but at build time nothing has been installed there
+* yet, and under pnpm the project's own `node_modules` lives one directory per
+* package, so the emitted files genuinely cannot resolve their imports until
+* they are deployed.
+*
+* Reading source costs nothing in fidelity: compilation erases types, it does
+* not change the values a collection module exports, so the hash is the same
+* either way.
+*/
+async function loadSourceCollections(collectionsDir) {
+	if (!fs.existsSync(collectionsDir)) return [];
+	const { createJiti } = await import("jiti");
+	const jiti = createJiti(path.join(collectionsDir, "index.ts"), {
+		interopDefault: true,
+		esmResolve: true
+	});
+	const files = fs.readdirSync(collectionsDir).filter(isCollectionSourceFile).sort();
+	const collections = [];
+	const failures = [];
+	for (const file of files) try {
+		const mod = await jiti.import(path.join(collectionsDir, file));
+		const collection = mod.default ?? mod;
+		if (collection && typeof collection === "object" && "slug" in collection) collections.push(collection);
+		else failures.push(`${file}: no default-exported collection`);
+	} catch (err) {
+		failures.push(`${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (failures.length > 0) throw new Error(`Could not read ${failures.length} collection file(s):\n` + failures.map((f) => `  • ${f}`).join("\n"));
+	return collections;
+}
+/** The `@rebasepro/server` version the project resolves — what it was built against. */
+function resolveServerVersion(projectRoot) {
+	const candidates = [path.join(projectRoot, "node_modules", "@rebasepro", "server", "package.json"), path.join(projectRoot, "backend", "node_modules", "@rebasepro", "server", "package.json")];
+	for (const candidate of candidates) {
+		if (!fs.existsSync(candidate)) continue;
+		try {
+			return JSON.parse(fs.readFileSync(candidate, "utf8")).version;
+		} catch {}
+	}
+	return "unknown";
+}
+//#endregion
+export { foldStaticIntoBundle as _, VENDOR_TARGET_OS as a, toolStdio as b, collectDeclaredDependencies as c, describeDepConflicts as d, detectDeclaredDepConflicts as f, findUnusedServerEntry as g, detectStorageAuthorize as h, VENDOR_TARGET_CPU as i, commentSpans as l, detectNativeDependencies as m, VENDOR_SIZE_MAX_BYTES as n, buildBundle as o, detectFrameworkDepDrift as p, VENDOR_SIZE_WARN_BYTES as r, buildStaticBundle as s, DEFAULT_BUNDLE_DIR as t, composeBundleManifest as u, normalizeEsmSpecifiers as v, vendorDependencies as y };
+
+//# sourceMappingURL=bundle-CqURVN-K.js.map