@rebasepro/cli 0.9.1-canary.ff338b5 → 0.10.1-canary.14e53ae

package/dist/index.es.js

@@ -12,6 +12,7 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
+import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
 import { createRequire } from "module";
 //#region src/utils/package-manager.ts
@@ -23,21 +24,61 @@ import { createRequire } from "module";
 * the rest of the CLI never has to hardcode a specific PM.
 */
 /**
+* How long to wait for `pnpm --version` before giving up on the probe.
+*
+* `pnpm --version` is a cold Node start, and on a machine that is busy — a
+* parallel install, a full test run — it routinely takes seconds. Measured at
+* 630ms, 990ms and 4293ms on three consecutive runs of one developer laptop
+* under load, so the previous 3s budget was inside the normal spread rather
+* than safely outside it.
+*/
+var PNPM_PROBE_TIMEOUT_MS = 5e3;
+/** Memoised result of the probe. pnpm cannot appear or vanish mid-process. */
+var cachedPnpmAvailable;
+/**
+* Decide availability from a `spawnSync` outcome.
+*
+* Split out from the spawn itself so the decision is testable without starting
+* a process — which is what made the old test load-sensitive and occasionally
+* red for reasons that had nothing to do with the code under test.
+*
+* The three outcomes are distinguishable, and the old code conflated two of
+* them by asking only `status === 0`:
+*
+*   not installed   status null, signal null,    error.code ENOENT
+*   timed out       status null, signal SIGTERM, error.code ETIMEDOUT
+*   broken install  status non-zero, no error
+*/
+function pnpmAvailabilityFromProbe(res) {
+	const code = res.error?.code;
+	if (code === "ENOENT") return false;
+	if (code === "ETIMEDOUT" || res.signal) return true;
+	if (res.error) return false;
+	return res.status === 0;
+}
+/**
 * Whether pnpm is runnable on this machine.
 *
 * Used to decide whether a fresh project can be scaffolded with pnpm. Kept
-* cheap and non-interactive (short timeout, output discarded) so it never
-* hangs detection if a corepack shim misbehaves.
+* cheap and non-interactive (bounded timeout, output discarded) so it never
+* hangs detection if a corepack shim misbehaves, and memoised so that repeated
+* detection in one CLI run costs one process rather than one per call.
 */
 function isPnpmAvailable() {
+	if (cachedPnpmAvailable !== void 0) return cachedPnpmAvailable;
 	try {
-		return spawnSync("pnpm", ["--version"], {
+		cachedPnpmAvailable = pnpmAvailabilityFromProbe(spawnSync("pnpm", ["--version"], {
 			stdio: "ignore",
-			timeout: 3e3
-		}).status === 0;
+			timeout: PNPM_PROBE_TIMEOUT_MS
+		}));
 	} catch {
-		return false;
+		cachedPnpmAvailable = false;
 	}
+	return cachedPnpmAvailable;
+}
+/** Forget the memoised probe. For tests; nothing in a CLI run needs it. */
+function resetPnpmAvailabilityCache() {
+	cachedPnpmAvailable = void 0;
 }
 /**
 * Detect the package manager for a Rebase project.
@@ -156,17 +197,26 @@ function getPMCommands(pm) {
 * These helpers locate the project root, backend directory, .env file,
 * and local binaries — used by all CLI command modules.
 */
+/** The authored project manifest. Its presence alone marks a project root. */
+var MANIFEST_FILENAME = "rebase.json";
 /**
 * Walk up from `startDir` to find the Rebase project root.
 *
-* The root is identified by a `package.json` that either:
-* - has `workspaces` containing "backend" or "frontend", OR
-* - has a sibling `backend/` directory
+* A directory is the root when it holds a `rebase.json`, or when it holds a
+* `package.json` that either lists `backend` as a workspace or sits beside both
+* `backend/` and `config/`.
+*
+* `rebase.json` is checked first and needs no `package.json` beside it, because
+* the conventions below all describe a repository that *contains the backend*.
+* A repository holding only a frontend — the normal shape once a project's apps
+* live in separate repositories — matches none of them, so without this the
+* tooling could not run there at all.
 */
 function findProjectRoot(startDir = process.cwd()) {
 	let dir = path.resolve(startDir);
 	const root = path.parse(dir).root;
 	while (dir !== root) {
+		if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
 		const pkgPath = path.join(dir, "package.json");
 		if (fs.existsSync(pkgPath)) {
 			try {
@@ -636,9 +686,17 @@ var ANSI_RE = /\[[0-9;]*m/g;
 function stripAnsi(s) {
 	return s.replace(ANSI_RE, "");
 }
-/** Write one JSON value to stdout, followed by a newline. */
+/**
+* Write one JSON value to stdout, followed by a newline.
+*
+* Indented, because the overwhelmingly common reader is a person or an agent
+* looking at a terminal — JSON mode is entered automatically whenever stdout is
+* not a TTY, so `rebase cloud deployments list` piped anywhere at all produced
+* a project's entire deployment history as one unwrapped line. `JSON.parse`
+* does not care about the whitespace; everything else does.
+*/
 function printJson(value) {
-	process.stdout.write(JSON.stringify(value) + "\n");
+	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
 /**
 * The one output primitive every new command uses: in JSON mode emit `json`
@@ -875,7 +933,54 @@ function buildInitQuestions(params) {
 	});
 	return questions;
 }
+/**
+* The `cd` a user must type to enter the new project.
+*
+* Not the project's basename: `init apps/my-app` has to say `cd apps/my-app`,
+* and `init .` returns "" because they are already in the project.
+*/
+function formatCdTarget(cwd, targetDirectory) {
+	return path.relative(cwd, targetDirectory);
+}
+/** Help for `rebase init` — the flags were previously only discoverable by
+* triggering the non-TTY error. */
+function printInitHelp() {
+	console.log(`
+${chalk.bold("rebase init")} — Create a new Rebase project
+
+${chalk.bold("Usage")}
+  rebase init ${chalk.blue("[name]")} [options]
+
+  ${chalk.gray("The name may be a nested path (apps/my-app) or \".\" for the current directory.")}
+  ${chalk.gray("Defaults to \"my-rebase-app\" when omitted with --yes.")}
+
+${chalk.bold("Options")}
+  ${chalk.blue("-t, --template")} ${chalk.gray("<preset>")}   blog | ecommerce | blank ${chalk.gray("(default: blog)")}
+  ${chalk.blue("-f, --flavor")} ${chalk.gray("<flavor>")}     cms | baas ${chalk.gray("(default: cms)")}
+  ${chalk.blue("-y, --yes")}                 Accept defaults, never prompt ${chalk.gray("(required for CI / non-TTY)")}
+  ${chalk.blue("-i, --install")}             Install dependencies after scaffolding
+  ${chalk.blue("-g, --git")}                 Initialize a git repository and make an initial commit
+  ${chalk.blue("--database-url")} ${chalk.gray("<url>")}      Use an existing database instead of the generated one
+  ${chalk.blue("--introspect")}              Generate collections from that database ${chalk.gray("(implies --template blank; needs --install)")}
+  ${chalk.blue("--project")} ${chalk.gray("<slug>")}          Link the scaffold to a Rebase Cloud project
+  ${chalk.blue("--setup-key")} ${chalk.gray("<key>")}         One-time key authenticating the cloud link ${chalk.gray("(use with --project)")}
+
+${chalk.bold("Flavors")}
+  ${chalk.blue("cms")}   BaaS + admin UI, driven by collections you define ${chalk.gray("(like Payload/Directus)")}
+  ${chalk.blue("baas")}  Headless API over your database — no collections, no UI ${chalk.gray("(like Supabase)")}
+        ${chalk.gray("--template has no effect on this flavor.")}
+
+${chalk.bold("Examples")}
+  ${chalk.gray("$")} rebase init my-shop --template ecommerce --install
+  ${chalk.gray("$")} rebase init my-api --flavor baas --yes
+  ${chalk.gray("$")} rebase init . --yes --git
+`);
+}
 async function createRebaseApp(rawArgs) {
+	if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+		printInitHelp();
+		return;
+	}
 	console.log(`
 ${chalk.bold("Rebase")} — Create a new project 🚀
 `);
@@ -935,6 +1040,7 @@ async function promptForOptions(rawArgs, pm) {
 			databaseUrl: args["--database-url"] || void 0,
 			introspect: args["--introspect"] || false,
 			preset: templateArg || "blog",
+			explicitPreset: !!templateArg,
 			flavor: flavorArg || "cms",
 			pm,
 			pmCommands,
@@ -972,6 +1078,7 @@ async function promptForOptions(rawArgs, pm) {
 		databaseUrl: answers.databaseUrl?.trim() || void 0,
 		introspect: answers.introspect || false,
 		preset: templateArg || answers.preset || "blog",
+		explicitPreset: !!templateArg,
 		flavor: flavorArg || answers.flavor || "cms",
 		pm,
 		pmCommands,
@@ -1056,6 +1163,7 @@ async function createProject$1(options) {
 		const shipped = path.join(options.targetDirectory, from);
 		if (fs.existsSync(shipped)) fs.renameSync(shipped, path.join(options.targetDirectory, to));
 	}
+	if (options.flavor === "baas" && options.explicitPreset) console.log(chalk.yellow(`  Ignoring --template ${options.preset}: the baas flavor has no collections.`));
 	if (options.flavor !== "baas") {
 		if (options.introspect && options.preset !== "blank") console.log(chalk.gray("  Using the blank template: collections will come from your database."));
 		await applyPreset(options.targetDirectory, options.introspect ? "blank" : options.preset);
@@ -1067,6 +1175,33 @@ async function createProject$1(options) {
 		console.log(chalk.gray("  Initializing git repository..."));
 		try {
 			await execa("git", ["init"], { cwd: options.targetDirectory });
+			try {
+				await execa("git", [
+					"symbolic-ref",
+					"HEAD",
+					"refs/heads/main"
+				], { cwd: options.targetDirectory });
+			} catch {}
+			await execa("git", ["add", "-A"], { cwd: options.targetDirectory });
+			let identity = {};
+			try {
+				await execa("git", ["config", "user.email"], { cwd: options.targetDirectory });
+			} catch {
+				identity = {
+					GIT_AUTHOR_NAME: "Rebase",
+					GIT_AUTHOR_EMAIL: "noreply@rebase.pro",
+					GIT_COMMITTER_NAME: "Rebase",
+					GIT_COMMITTER_EMAIL: "noreply@rebase.pro"
+				};
+			}
+			await execa("git", [
+				"commit",
+				"-m",
+				"Initial commit from Rebase"
+			], {
+				cwd: options.targetDirectory,
+				env: identity
+			});
 		} catch {
 			console.warn(chalk.yellow("  Warning: Failed to initialize git repository"));
 		}
@@ -1097,6 +1232,7 @@ async function createProject$1(options) {
 			console.warn(chalk.yellow(`  Warning: Failed to install dependencies. You may need to run \`${installCmd.join(" ")}\` manually.`));
 		}
 	}
+	let introspected = false;
 	if (options.introspect) {
 		console.log("");
 		if (options.installDeps) {
@@ -1112,6 +1248,7 @@ async function createProject$1(options) {
 					stdio: "inherit"
 				});
 				console.log(chalk.green("  Database successfully introspected!"));
+				introspected = true;
 			} catch {
 				console.warn(chalk.yellow("  Warning: Failed to introspect database automatically."));
 				console.warn(chalk.yellow(`  You can run \`${execCmd.join(" ")}\` then \`${generateCmd.join(" ")}\` manually after setup.`));
@@ -1130,13 +1267,21 @@ async function createProject$1(options) {
 	const runDev = pmCommands.run("dev");
 	const runDbPush = pmCommands.run("db:push");
 	const isBaas = options.flavor === "baas";
-	console.log(`  ${chalk.cyan("cd")} ${options.projectName}`);
+	const cdTarget = formatCdTarget(process.cwd(), options.targetDirectory);
+	if (cdTarget) console.log(`  ${chalk.cyan("cd")} ${cdTarget}`);
 	if (!options.installDeps) console.log(`  ${chalk.cyan(installCmd.join(" "))}`);
 	console.log("");
-	if (options.databaseUrl) if (options.introspect) {
+	if (options.databaseUrl) if (introspected) {
 		console.log(chalk.gray("  # Database has been introspected & collections generated!"));
 		console.log(chalk.gray("  # Start the development server (frontend + backend):"));
 		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
+	} else if (options.introspect) {
+		console.log(chalk.gray("  # Introspection did not run — finish it with:"));
+		console.log(`  ${chalk.cyan(execCmd.join(" "))}`);
+		console.log(`  ${chalk.cyan(generateCmd.join(" "))}`);
+		console.log("");
+		console.log(chalk.gray("  # Then start the development server:"));
+		console.log(`  ${chalk.cyan(runDev.join(" "))}`);
 	} else {
 		console.log(chalk.gray("  # Your custom database is configured in .env."));
 		console.log(chalk.gray("  # If the database is empty, push the Rebase schema to initialize it:"));
@@ -1365,7 +1510,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
 		if (databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}`);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
@@ -1465,21 +1610,156 @@ function writeFiles(outputDir, files) {
 		fs.writeFileSync(filePath, file.content, "utf-8");
 	}
 }
+function printSdkHelp() {
+	console.log(`
+${chalk.bold("rebase generate-sdk")} — generate a typed client from a project's schema
+
+${chalk.bold("Usage")}
+  rebase generate-sdk [options]
+
+${chalk.bold("Options")}
+  -c, --collections-dir <dir>  Local collections directory (default: ./config/collections)
+  -o, --output <dir>           Where to write the SDK (default: ./generated/sdk)
+      --from <link|url>        Fetch the schema from a running project instead of
+                               local source. "link" uses this checkout's linked project.
+      --token <token>          Bearer token for the contract endpoint
+                               (default: $REBASE_SERVICE_KEY)
+  -h, --help                   Show this help
+
+${chalk.bold("Examples")}
+  rebase generate-sdk                              From local collections
+  rebase generate-sdk --from link                  From the linked project
+  rebase generate-sdk --from https://api.acme.com  From any Rebase backend
+`.trim());
+}
+/**
+* Fetch collections from a running project's contract endpoint.
+*
+* The payload replaces relation `target` functions with slug references, so it
+* has to be rehydrated before the generator sees it — the generator *calls*
+* `target()` to decide whether a foreign key is a string or a number, and a
+* missing target silently degrades that to a union rather than failing.
+*/
+async function fetchRemoteCollections(baseUrl, token) {
+	const url = `${baseUrl.replace(/\/+$/, "")}/api/meta/contract`;
+	const headers = { accept: "application/json" };
+	if (token) headers.authorization = `Bearer ${token}`;
+	let response;
+	try {
+		response = await fetch(url, { headers });
+	} catch (err) {
+		console.log(chalk.red(`  ✗ Could not reach ${url}`));
+		console.log(chalk.gray(`    ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	if (response.status === 401 || response.status === 403) {
+		console.log(chalk.red(`  ✗ Not authorized to read the project contract (${response.status}).`));
+		console.log(chalk.gray("    The contract describes every table and relation, so it is admin-only."));
+		console.log(chalk.gray("    Pass --token, or set REBASE_SERVICE_KEY."));
+		process.exit(1);
+	}
+	if (response.status === 404) {
+		console.log(chalk.red("  ✗ This server has no contract endpoint."));
+		console.log(chalk.gray("    It needs to be running Rebase 0.11 or newer."));
+		process.exit(1);
+	}
+	if (!response.ok) {
+		console.log(chalk.red(`  ✗ Contract request failed with ${response.status}.`));
+		process.exit(1);
+	}
+	const contract = await response.json();
+	if (!Array.isArray(contract.collections)) {
+		console.log(chalk.red("  ✗ The contract response did not contain collections."));
+		process.exit(1);
+	}
+	return {
+		collections: deserializeCollections(contract.collections),
+		schemaVersion: contract.schemaVersion ?? "unknown"
+	};
+}
+/**
+* Decide whether the ambient service key may be sent to this host.
+*
+* `REBASE_SERVICE_KEY` grants full admin bypass. Attaching it to whatever URL
+* happened to be passed — or, worse, to whatever a committed `.rebase/cloud.json`
+* points at — would hand the project's most powerful credential to a host nobody
+* vetted. An explicit `--token` is a decision the caller made; the ambient
+* variable is not, so it only travels to the project this checkout is linked to.
+*/
+function mayUseAmbientKey(target, cwd) {
+	const link = readLink(findProjectRoot(cwd) ?? cwd);
+	if (!link?.apiUrl) return false;
+	try {
+		return new URL(link.apiUrl).origin === new URL(target).origin;
+	} catch {
+		return false;
+	}
+}
+/** Resolve `--from` into a base URL, following the link file when asked. */
+function resolveSchemaSource(from, cwd) {
+	if (from !== "link") {
+		let parsed;
+		try {
+			parsed = new URL(from);
+		} catch {
+			console.log(chalk.red(`  ✗ "${from}" is not a valid URL.`));
+			console.log(chalk.gray("    Pass a full URL, e.g. https://api.example.com, or \"link\"."));
+			process.exit(1);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+			console.log(chalk.red("  ✗ The project URL must be http or https."));
+			process.exit(1);
+		}
+		return from;
+	}
+	const link = readLink(findProjectRoot(cwd) ?? cwd);
+	if (!link) {
+		console.log(chalk.red("  ✗ This checkout is not linked to a project."));
+		console.log(chalk.gray("    Run `rebase link <url>`, or pass --from <url>."));
+		process.exit(1);
+	}
+	const apiUrl = link.apiUrl;
+	if (!apiUrl) {
+		console.log(chalk.red("  ✗ The project link has no API URL."));
+		console.log(chalk.gray("    Re-link with `rebase link <url>` to record one."));
+		process.exit(1);
+	}
+	return apiUrl;
+}
 /**
 * Main entry point for the generate-sdk command.
 */
 async function generateSdkCommand(args) {
 	const { collectionsDir, output, cwd } = args;
+	if (args.help) {
+		printSdkHelp();
+		return;
+	}
 	const resolvedCollectionsDir = path.isAbsolute(collectionsDir) ? collectionsDir : path.join(cwd, collectionsDir);
 	const resolvedOutput = path.isAbsolute(output) ? output : path.join(cwd, output);
 	console.log("");
 	console.log(chalk.bold("  🔧 Rebase SDK Generator"));
 	console.log("");
-	console.log(`  ${chalk.gray("Collections:")} ${resolvedCollectionsDir}`);
-	console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
-	console.log("");
-	console.log(chalk.cyan("  → Loading collection definitions..."));
-	const collections = await loadCollections(resolvedCollectionsDir);
+	let collections;
+	let remoteSchemaVersion;
+	if (args.from) {
+		const baseUrl = resolveSchemaSource(args.from, cwd);
+		console.log(`  ${chalk.gray("Project:")}     ${baseUrl}`);
+		console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
+		console.log("");
+		console.log(chalk.cyan("  → Fetching the project contract..."));
+		const ambient = mayUseAmbientKey(baseUrl, cwd) ? process.env.REBASE_SERVICE_KEY : void 0;
+		if (!args.token && !ambient && process.env.REBASE_SERVICE_KEY) console.log(chalk.dim("  (not sending REBASE_SERVICE_KEY — this host is not the linked project; pass --token to override)"));
+		const remote = await fetchRemoteCollections(baseUrl, args.token || ambient);
+		collections = remote.collections;
+		remoteSchemaVersion = remote.schemaVersion;
+	} else {
+		console.log(`  ${chalk.gray("Collections:")} ${resolvedCollectionsDir}`);
+		console.log(`  ${chalk.gray("Output:")}      ${resolvedOutput}`);
+		console.log("");
+		console.log(chalk.cyan("  → Loading collection definitions..."));
+		collections = await loadCollections(resolvedCollectionsDir);
+	}
 	collections.sort((a, b) => a.slug.localeCompare(b.slug));
 	if (collections.length === 0) {
 		console.log(chalk.red("  ✗ No collections found. Nothing to generate."));
@@ -1489,7 +1769,22 @@ async function generateSdkCommand(args) {
 	console.log("");
 	console.log(chalk.cyan("  → Generating SDK files..."));
 	const files = generateSDK(collections);
+	const schemaVersion = remoteSchemaVersion ?? computeSchemaVersion(collections);
+	files.push({
+		path: "schema.meta.ts",
+		content: `// Auto-generated by \`rebase generate-sdk\`. Do not edit.
+//
+// The schema version this SDK was generated from. Compare it against the
+// project's current version to detect drift:
+//
+//     curl -s <api-url>/api/meta/schema-version
+//
+export const SCHEMA_VERSION = ${JSON.stringify(schemaVersion)};
+export const GENERATED_AT = ${JSON.stringify((/* @__PURE__ */ new Date()).toISOString())};
+`
+	});
 	console.log(chalk.green(`  ✓ Generated ${files.length} file(s)`));
+	console.log(chalk.gray(`    schema ${schemaVersion}`));
 	console.log(chalk.cyan(`  → Writing to ${resolvedOutput}...`));
 	writeFiles(resolvedOutput, files);
 	console.log("");
@@ -1659,6 +1954,367 @@ ${chalk.green.bold("Examples")}
 `);
 }
 //#endregion
+//#region src/manifest.ts
+/**
+* Loading, validating and synthesizing `rebase.json`.
+*
+* The manifest declares *topology*: which runtime major a project targets and
+* which apps this repository contributes. It is deliberately small — schema,
+* security rules, hooks and functions stay in TypeScript, where a type system
+* can check them.
+*
+* Two properties matter more than the file format itself:
+*
+* - **A missing manifest is never an error.** Every project that exists today
+*   predates this file. One is synthesized from the conventions the template
+*   already follows, so nothing breaks and nobody is forced to migrate.
+* - **Validation reports every problem at once**, with the path to each. A
+*   config file that surfaces its mistakes one run at a time is a bad config
+*   file.
+*/
+/** Runtime range written into new manifests. */
+var CURRENT_RUNTIME_RANGE = "^1";
+/** Conventional locations, matching what `rebase init` scaffolds. */
+var DEFAULT_CONFIG_DIR = "config";
+var DEFAULT_FUNCTIONS_DIR = "backend/functions";
+var DEFAULT_CRONS_DIR = "backend/crons";
+var DEFAULT_SCHEMA_FILE = "backend/src/schema.generated.ts";
+var ManifestError = class extends Error {
+	issues;
+	constructor(message, issues = []) {
+		super(message);
+		this.issues = issues;
+		this.name = "ManifestError";
+	}
+};
+var APP_TYPES = [
+	"backend",
+	"static",
+	"admin",
+	"mobile",
+	"custom"
+];
+/** Reserved because they name things in URLs and CLI output. */
+var RESERVED_APP_NAMES = new Set([
+	"api",
+	"health",
+	"metrics",
+	"livez",
+	"_rebase"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Reject paths that escape the repository.
+*
+* A manifest is committed and reviewed, so this is not a security boundary so
+* much as a guard against `../../` typos that would otherwise have `rebase build`
+* writing outside the project.
+*/
+function checkRelativePath(value, fieldPath, issues, { required }) {
+	if (value === void 0) {
+		if (required) issues.push({
+			path: fieldPath,
+			message: "is required"
+		});
+		return;
+	}
+	if (typeof value !== "string" || value.trim() === "") {
+		issues.push({
+			path: fieldPath,
+			message: "must be a non-empty string"
+		});
+		return;
+	}
+	if (path.isAbsolute(value)) {
+		issues.push({
+			path: fieldPath,
+			message: "must be a relative path, not absolute"
+		});
+		return;
+	}
+	const normalized = path.normalize(value);
+	if (normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+		issues.push({
+			path: fieldPath,
+			message: "must stay inside the project directory"
+		});
+		return;
+	}
+	return value;
+}
+function validateApp(name, raw, issues) {
+	const base = `apps.${name}`;
+	if (!isRecord(raw)) {
+		issues.push({
+			path: base,
+			message: "must be an object"
+		});
+		return;
+	}
+	const type = raw.type;
+	if (typeof type !== "string" || !APP_TYPES.includes(type)) {
+		issues.push({
+			path: `${base}.type`,
+			message: `must be one of: ${APP_TYPES.join(", ")}`
+		});
+		return;
+	}
+	switch (type) {
+		case "backend":
+			checkRelativePath(raw.config, `${base}.config`, issues, { required: false });
+			checkRelativePath(raw.functions, `${base}.functions`, issues, { required: false });
+			checkRelativePath(raw.crons, `${base}.crons`, issues, { required: false });
+			checkRelativePath(raw.schema, `${base}.schema`, issues, { required: false });
+			checkRelativePath(raw.usersCollection, `${base}.usersCollection`, issues, { required: false });
+			if (raw.mode !== void 0 && raw.mode !== "cms" && raw.mode !== "baas") issues.push({
+				path: `${base}.mode`,
+				message: "must be \"cms\" or \"baas\""
+			});
+			return raw;
+		case "static":
+			checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
+			checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
+			if (raw.build !== void 0 && typeof raw.build !== "string") issues.push({
+				path: `${base}.build`,
+				message: "must be a string command"
+			});
+			if (raw.spa !== void 0 && typeof raw.spa !== "boolean") issues.push({
+				path: `${base}.spa`,
+				message: "must be a boolean"
+			});
+			return raw;
+		case "admin": {
+			const mode = raw.mode ?? "hosted";
+			if (mode !== "hosted" && mode !== "bundled") {
+				issues.push({
+					path: `${base}.mode`,
+					message: "must be \"hosted\" or \"bundled\""
+				});
+				return;
+			}
+			if (mode === "bundled") {
+				checkRelativePath(raw.root, `${base}.root`, issues, { required: true });
+				checkRelativePath(raw.output, `${base}.output`, issues, { required: true });
+			}
+			return raw;
+		}
+		case "mobile": {
+			const platform = raw.platform;
+			if (platform !== "ios" && platform !== "android" && platform !== "other") issues.push({
+				path: `${base}.platform`,
+				message: "must be \"ios\", \"android\" or \"other\""
+			});
+			return raw;
+		}
+		case "custom":
+			checkRelativePath(raw.dockerfile, `${base}.dockerfile`, issues, { required: false });
+			checkRelativePath(raw.context, `${base}.context`, issues, { required: false });
+			if (raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isInteger(raw.port))) issues.push({
+				path: `${base}.port`,
+				message: "must be an integer"
+			});
+			return raw;
+		default: return;
+	}
+}
+/**
+* Validate a parsed manifest, collecting every problem.
+*/
+function validateManifest(raw) {
+	const issues = [];
+	if (!isRecord(raw)) return { issues: [{
+		path: "",
+		message: `${MANIFEST_FILENAME} must contain a JSON object`
+	}] };
+	if (typeof raw.runtime !== "string" || raw.runtime.trim() === "") issues.push({
+		path: "runtime",
+		message: `is required, e.g. "^1"`
+	});
+	if (!isRecord(raw.apps)) {
+		issues.push({
+			path: "apps",
+			message: "is required and must be an object"
+		});
+		return { issues };
+	}
+	const apps = {};
+	let backendCount = 0;
+	for (const [name, value] of Object.entries(raw.apps)) {
+		if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name must be lowercase alphanumeric with dashes (it appears in URLs)"
+			});
+			continue;
+		}
+		if (RESERVED_APP_NAMES.has(name)) {
+			issues.push({
+				path: `apps.${name}`,
+				message: "name is reserved"
+			});
+			continue;
+		}
+		const app = validateApp(name, value, issues);
+		if (!app) continue;
+		if (app.type === "backend") backendCount++;
+		apps[name] = app;
+	}
+	if (backendCount > 1) issues.push({
+		path: "apps",
+		message: "a project may declare at most one backend app"
+	});
+	if (issues.length > 0) return { issues };
+	return {
+		manifest: {
+			$schema: typeof raw.$schema === "string" ? raw.$schema : void 0,
+			runtime: raw.runtime,
+			apps
+		},
+		issues
+	};
+}
+/**
+* Infer a manifest from a directory that does not have one.
+*
+* This mirrors exactly what the template scaffolds, which is what makes adopting
+* the manifest a no-op for existing projects: the synthesized result is what
+* they would have written by hand.
+*
+* An ejected backend — one with its own `src/index.ts` entrypoint — is reported
+* as a `custom` app rather than a `backend` app. That is not a downgrade; it is
+* an accurate description, and it is what keeps such a project deploying exactly
+* as it does today.
+*/
+function synthesizeManifest(projectRoot) {
+	const exists = (relative) => fs.existsSync(path.join(projectRoot, relative));
+	const apps = {};
+	const hasConfig = exists(DEFAULT_CONFIG_DIR);
+	const hasBackend = exists("backend");
+	const backendEntry = exists("backend/src/index.ts");
+	if (hasBackend && backendEntry) apps.backend = {
+		type: "custom",
+		dockerfile: exists("backend/Dockerfile") ? "backend/Dockerfile" : void 0,
+		context: "."
+	};
+	else if (hasBackend || hasConfig) {
+		const backend = { type: "backend" };
+		if (!hasConfig) backend.mode = "baas";
+		if (exists("backend/functions")) backend.functions = DEFAULT_FUNCTIONS_DIR;
+		if (exists("backend/crons")) backend.crons = DEFAULT_CRONS_DIR;
+		apps.backend = backend;
+	}
+	if (exists("frontend")) apps.web = {
+		type: "static",
+		root: "frontend",
+		build: "npm run build --workspace frontend",
+		output: "frontend/dist",
+		spa: true
+	};
+	return {
+		runtime: "^1",
+		apps
+	};
+}
+function manifestPath(projectRoot) {
+	return path.join(projectRoot, MANIFEST_FILENAME);
+}
+function manifestExists(projectRoot) {
+	return fs.existsSync(manifestPath(projectRoot));
+}
+/**
+* Read the manifest, falling back to a synthesized one.
+*
+* A malformed manifest throws — unlike a missing one. Silently ignoring a file
+* the developer wrote, and building something else instead, is the worst
+* available behaviour.
+*/
+function loadManifest(projectRoot) {
+	const filePath = manifestPath(projectRoot);
+	if (!fs.existsSync(filePath)) return {
+		manifest: synthesizeManifest(projectRoot),
+		source: "synthesized"
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (err) {
+		throw new ManifestError(`${MANIFEST_FILENAME} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const { manifest, issues } = validateManifest(parsed);
+	if (!manifest) throw new ManifestError(`${MANIFEST_FILENAME} is invalid`, issues);
+	return {
+		manifest,
+		source: "file",
+		filePath
+	};
+}
+/** Write a manifest, with a trailing newline so it plays well with other tools. */
+function writeManifest(projectRoot, manifest) {
+	const filePath = manifestPath(projectRoot);
+	const ordered = {
+		$schema: manifest.$schema ?? "https://rebase.pro/schemas/rebase.json",
+		runtime: manifest.runtime,
+		apps: manifest.apps
+	};
+	fs.writeFileSync(filePath, `${JSON.stringify(ordered, null, 4)}\n`, "utf8");
+	return filePath;
+}
+/** Find the single backend app, if this repository declares one. */
+function findBackendApp(manifest) {
+	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "backend") return {
+		name,
+		app
+	};
+}
+/** Apps that produce build output, in the order they should be built. */
+function buildableApps(manifest) {
+	const entries = Object.entries(manifest.apps).map(([name, app]) => ({
+		name,
+		app
+	}));
+	const rank = (app) => {
+		if (app.type === "backend") return 0;
+		if (app.type === "admin") return 1;
+		if (app.type === "static") return 2;
+		return 3;
+	};
+	return entries.filter(({ app }) => app.type !== "mobile").sort((a, b) => rank(a.app) - rank(b.app));
+}
+/**
+* Decide whether a project can run on the managed runtime, and say why not.
+*
+* "Not eligible" is never a dead end — it selects the custom-runtime path, which
+* still deploys. The reasons exist so the answer is actionable rather than a
+* verdict.
+*/
+function assessManagedCompatibility(manifest) {
+	const reasons = [];
+	const backend = findBackendApp(manifest);
+	if (!backend) {
+		const custom = Object.entries(manifest.apps).find(([, app]) => app.type === "custom");
+		if (custom) reasons.push(`App "${custom[0]}" is a custom container. The managed runtime runs the platform image with your bundle, so a project that builds its own image uses the custom runtime instead.`);
+		else reasons.push("No backend app is declared in this repository. Only the repository that declares the backend selects the runtime.");
+	}
+	for (const [name, app] of Object.entries(manifest.apps)) if (app.type === "custom") reasons.push(`App "${name}" is a custom container image.`);
+	return {
+		eligible: reasons.length === 0 && Boolean(backend),
+		reasons
+	};
+}
+/** Resolve a backend app's directories against the conventions it omits. */
+function resolveBackendPaths(app) {
+	return {
+		config: app.config ?? "config",
+		functions: app.functions ?? "backend/functions",
+		crons: app.crons ?? "backend/crons",
+		schema: app.schema ?? "backend/src/schema.generated.ts",
+		usersCollection: app.usersCollection ?? "collections/users",
+		mode: app.mode ?? "cms"
+	};
+}
+//#endregion
 //#region src/commands/dev.ts
 /**
 * CLI command: rebase dev
@@ -1676,6 +2332,66 @@ ${chalk.green.bold("Examples")}
 * Each project gets a deterministic default port derived from the project
 * root path, so multiple Rebase instances never collide.
 */
+/**
+* Quote a path for the shell `execa` runs the backend through.
+*
+* The dev runtime's path is absolute and therefore contains whatever the
+* developer's directories are called. Double quotes do not neutralize `$`,
+* backticks or backslashes in a POSIX shell, so a checkout under a directory
+* named `$(...)` would execute it. Single quotes disable all expansion; on
+* Windows, `cmd.exe` performs no such expansion and wants double quotes.
+*/
+function quoteForShell(value) {
+	if (process.platform === "win32") return `"${value.replace(/"/g, "\\\"")}"`;
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+* Locate the dev runtime shim shipped with the CLI.
+*
+* Published under `runtime/` in the package rather than compiled into `dist/`,
+* because tsx executes it as a file and it must exist on disk at a stable path.
+*/
+function resolveDevRuntimeEntry() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 5; i++) {
+		const candidate = path.join(dir, "runtime", "dev-server.mjs");
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	throw new Error("Could not find the Rebase dev runtime (runtime/dev-server.mjs). Reinstall @rebasepro/cli, or add a backend/src/index.ts to run your own entrypoint.");
+}
+/**
+* Tell the dev runtime where this project keeps its parts.
+*
+* Read from `rebase.json` when there is one, so a project that moved its config
+* directory is honoured; otherwise the conventional layout.
+*/
+function devRuntimeEnv(projectRoot) {
+	const result = {
+		REBASE_DEV_PROJECT_ROOT: projectRoot,
+		REBASE_DEV_CONFIG: "config",
+		REBASE_DEV_FUNCTIONS: "backend/functions",
+		REBASE_DEV_CRONS: "backend/crons",
+		REBASE_DEV_SCHEMA: "backend/src/schema.generated.ts",
+		REBASE_DEV_MODE: "cms"
+	};
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (backend) {
+			const paths = resolveBackendPaths(backend.app);
+			result.REBASE_DEV_CONFIG = paths.config;
+			result.REBASE_DEV_FUNCTIONS = paths.functions;
+			result.REBASE_DEV_CRONS = paths.crons;
+			result.REBASE_DEV_SCHEMA = paths.schema;
+			result.REBASE_DEV_MODE = paths.mode;
+			result.REBASE_DEV_APP = backend.name;
+		}
+	} catch {}
+	if (!fs.existsSync(path.join(projectRoot, result.REBASE_DEV_CONFIG))) result.REBASE_DEV_MODE = "baas";
+	return result;
+}
 /** Well-known filename the backend writes its actual port to. */
 var DEV_PORT_FILENAME = ".rebase-dev-port";
 /**
@@ -1926,11 +2642,15 @@ async function devCommand(rawArgs) {
 				});
 			}
 		}
+		const ejectedEntry = path.join(backendDir, "src", "index.ts");
+		const usesStockRuntime = !fs.existsSync(ejectedEntry);
+		const entryTarget = usesStockRuntime ? resolveDevRuntimeEntry() : "src/index.ts";
+		if (usesStockRuntime) Object.assign(env, devRuntimeEnv(projectRoot));
 		const watchArgs = [
 			"watch",
 			"--conditions",
 			"development",
-			"src/index.ts"
+			quoteForShell(entryTarget)
 		];
 		if (!shouldGenerate) {
 			watchArgs.splice(1, 0, `--watch="${path.join("..", "config", "**", "*")}"`);
@@ -2060,68 +2780,1068 @@ ${chalk.green.bold("Description")}
 `);
 }
 //#endregion
-//#region src/commands/build.ts
+//#region src/bundle.ts
 /**
-* CLI command: rebase build
+* Building a project bundle.
 *
-* Runs the build script in all workspace packages.
-* Automatically detects the package manager (pnpm or npm) and
-* uses the correct workspace-aware command.
+* A bundle is the deployable form of a project: compiled collections, functions,
+* crons and schema, plus a generated manifest describing exactly what it needs
+* to run. It contains no Dockerfile and no repository — the runtime is supplied
+* separately, which is what allows a project to be moved onto a patched runtime
+* without being rebuilt.
+*
+* Compilation runs through a generated tsconfig rooted at the project directory,
+* so the output mirrors the source layout (`config/…`, `backend/functions/…`)
+* and every path in the manifest is predictable. Letting each workspace package
+* emit into its own `dist/` would have meant guessing at three different
+* layouts, since `rootDir` differs between the template flavours.
 */
-async function buildCommand() {
-	const projectRoot = requireProjectRoot();
-	const pm = detectPackageManager(projectRoot);
-	const buildCmd = getPMCommands(pm).runAll("build");
-	console.log(`${chalk.bold("Rebase")} — Building all workspaces with ${chalk.cyan(pm)}...\n`);
+var DEFAULT_BUNDLE_DIR = "dist-bundle";
+/** Packages whose presence means the bundle cannot run on a stock runtime image. */
+var KNOWN_NATIVE_PACKAGES = new Set([
+	"sharp",
+	"canvas",
+	"bcrypt",
+	"argon2",
+	"node-sass",
+	"sqlite3",
+	"better-sqlite3",
+	"grpc",
+	"@grpc/grpc-js-native",
+	"re2",
+	"sodium-native",
+	"libpq",
+	"pg-native"
+]);
+/** Dependencies supplied by the runtime image itself, not by the bundle. */
+var RUNTIME_PROVIDED = new Set([
+	"@rebasepro/server",
+	"@rebasepro/types",
+	"@rebasepro/client",
+	"@rebasepro/common",
+	"@rebasepro/utils",
+	"hono",
+	"@hono/node-server",
+	"typescript",
+	"tsx"
+]);
+function log(options, message) {
+	(options.log ?? ((m) => console.log(m)))(message);
+}
+/**
+* Every `node_modules/@types` directory the project can see.
+*
+* Type roots normally resolve by walking up from the tsconfig's own directory,
+* which breaks here for two reasons: the generated config lives in `.rebase/`,
+* and a pnpm workspace puts `@types/node` inside the *package* that depends on
+* it (`config/node_modules/@types`) rather than at the project root. Listing them
+* explicitly, as absolute paths, sidesteps both.
+*/
+function discoverTypeRoots(projectRoot) {
+	const candidates = [];
+	for (const relative of [
+		".",
+		"config",
+		"backend",
+		"frontend"
+	]) candidates.push(path.join(projectRoot, relative, "node_modules", "@types"));
+	let dir = projectRoot;
+	for (let i = 0; i < 4; i++) {
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		candidates.push(path.join(parent, "node_modules", "@types"));
+		dir = parent;
+	}
+	return candidates.filter((candidate) => fs.existsSync(candidate));
+}
+/**
+* Read a tsconfig's own `compilerOptions`.
+*
+* Parsed with the project's own TypeScript, because a tsconfig is not JSON: it
+* permits comments and trailing commas. Hand-rolled comment stripping gets this
+* wrong in a way that is easy to miss — a `paths` entry like
+* `"@acme/types/*": ["src/*"]` contains the character sequence that opens a
+* block comment, so a regex happily eats the rest of the file and the result
+* parses as *something*, just not the config the developer wrote.
+*
+* One level only, and only `paths` is used from it.
+*/
+async function readCompilerOptions(projectRoot, file) {
+	if (!fs.existsSync(file)) return void 0;
+	const text = fs.readFileSync(file, "utf8");
 	try {
-		await execa(buildCmd[0], buildCmd.slice(1), {
-			cwd: projectRoot,
-			stdio: "inherit"
-		});
+		const { config } = createRequire(path.join(projectRoot, "package.json"))("typescript").parseConfigFileTextToJson(file, text);
+		return config?.compilerOptions;
 	} catch {
-		console.error(chalk.red("\n✗ Build failed."));
-		process.exit(1);
+		try {
+			return JSON.parse(text.replace(/^\s*\/\/.*$/gm, "")).compilerOptions;
+		} catch {
+			return;
+		}
 	}
 }
-//#endregion
-//#region src/commands/start.ts
 /**
-* CLI command: rebase start
+* Drop path aliases that resolve outside the project.
 *
-* Starts the backend server in production mode.
-* Automatically detects the package manager (pnpm or npm) and
-* runs the start script in the backend workspace.
+* A monorepo commonly aliases its workspace packages to their **source**
+* (`"@acme/types": ["packages/types/src/index.ts"]`) so editors jump to real
+* files. That is right for developing the monorepo and wrong for building a
+* bundle: it drags foreign `.ts` files into the program, none of which are under
+* the project's `rootDir`, and the compile fails on files the developer never
+* asked to build.
+*
+* A bundle is built against *installed packages*. Aliases pointing inside the
+* project are kept, because those are the project's own code.
 */
-async function startCommand() {
-	const projectRoot = requireProjectRoot();
-	const startCmd = getPMCommands(detectPackageManager(projectRoot)).runWorkspace("backend", "start");
-	const envFile = findEnvFile(projectRoot);
-	const env = { ...process.env };
-	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
-	console.log(`${chalk.bold("Rebase")} — Starting backend server...\n`);
-	try {
-		await execa(startCmd[0], startCmd.slice(1), {
-			cwd: projectRoot,
-			stdio: "inherit",
-			env
+function filterProjectPaths(baseDir, projectRoot, paths, baseUrl) {
+	const kept = {};
+	const dropped = [];
+	for (const [alias, targets] of Object.entries(paths)) {
+		if (!Array.isArray(targets)) continue;
+		const resolved = targets.map((target) => path.resolve(baseUrl, target));
+		if (resolved.every((target) => {
+			const relative = path.relative(projectRoot, target);
+			return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+		})) kept[alias] = resolved.map((target) => {
+			return path.relative(baseDir, target).split(path.sep).join("/");
 		});
-	} catch {
-		console.error(chalk.red("\n✗ Failed to start server."));
-		process.exit(1);
+		else dropped.push(alias);
 	}
+	return {
+		kept,
+		dropped
+	};
 }
-//#endregion
-//#region src/commands/auth.ts
 /**
-* CLI command: rebase auth <action>
+* Compose the tsconfig used to compile the bundle.
 *
-* Subcommands:
-*   reset-password — Reset a user's password
+* Extends the config package's own tsconfig when there is one, so the project's
+* choices about target, JSX and strictness are respected. It has to be `extends`
+* rather than a copy of `compilerOptions`: TypeScript resolves relative paths
+* against the file they were written in, so copying a value like
+* `baseUrl: "../../"` into a config in a different directory silently repoints
+* it at the wrong place.
 */
-async function authCommand(subcommand, rawArgs) {
-	if (!subcommand || subcommand === "--help") {
-		printAuthHelp();
-		return;
+async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck) {
+	const tsconfigDir = path.join(projectRoot, ".rebase");
+	const fromTsconfig = (target) => {
+		return path.relative(tsconfigDir, path.resolve(projectRoot, target)).split(path.sep).join("/");
+	};
+	const configTsconfigPath = path.join(projectRoot, "config", "tsconfig.json");
+	const extendsFrom = fs.existsSync(configTsconfigPath) ? fromTsconfig(path.join("config", "tsconfig.json")) : void 0;
+	let pathOverrides = {};
+	const baseOptions = await readCompilerOptions(projectRoot, configTsconfigPath);
+	if (baseOptions?.paths && typeof baseOptions.paths === "object") {
+		const baseDir = path.dirname(configTsconfigPath);
+		const baseUrl = path.resolve(baseDir, typeof baseOptions.baseUrl === "string" ? baseOptions.baseUrl : ".");
+		const { kept, dropped } = filterProjectPaths(tsconfigDir, projectRoot, baseOptions.paths, baseUrl);
+		pathOverrides = {
+			baseUrl: fromTsconfig("."),
+			paths: kept
+		};
+		if (dropped.length > 0) console.log(chalk.dim(`    ignoring ${dropped.length} path alias(es) pointing outside the project (${dropped.join(", ")}) — resolving those from node_modules instead`));
+	}
+	const compilerOptions = {
+		target: "ES2022",
+		module: "ESNext",
+		moduleResolution: "bundler",
+		lib: ["ES2022"],
+		jsx: "react-jsx",
+		allowSyntheticDefaultImports: true,
+		esModuleInterop: true,
+		resolveJsonModule: true,
+		forceConsistentCasingInFileNames: true,
+		rootDir: fromTsconfig("."),
+		outDir: fromTsconfig(path.relative(projectRoot, outDir) || "."),
+		typeRoots: discoverTypeRoots(projectRoot),
+		...pathOverrides,
+		declaration: false,
+		declarationMap: false,
+		sourceMap: true,
+		noEmit: false,
+		skipLibCheck: true,
+		allowJs: true,
+		...skipTypeCheck ? { noCheck: true } : {}
+	};
+	const tsconfig = {
+		...extendsFrom ? { extends: extendsFrom } : {},
+		compilerOptions,
+		include: includes.map(fromTsconfig),
+		exclude: [
+			"node_modules",
+			"**/*.test.ts",
+			"**/*.spec.ts",
+			"**/dist/**",
+			DEFAULT_BUNDLE_DIR
+		].map((pattern) => pattern.startsWith("**") ? pattern : fromTsconfig(pattern))
+	};
+	fs.mkdirSync(tsconfigDir, { recursive: true });
+	const tsconfigPath = path.join(tsconfigDir, "tsconfig.bundle.json");
+	fs.writeFileSync(tsconfigPath, JSON.stringify(tsconfig, null, 2), "utf8");
+	return tsconfigPath;
+}
+/**
+* Whether the compiled config package exports a `storageAuthorize` hook.
+*
+* Recorded in the manifest so a host can refuse a deploy that would enable file
+* storage with no access model, rather than let the runtime's boot guard turn it
+* into a crash loop the developer cannot read.
+*
+* Read from the *compiled* index, deliberately: that is the exact module the
+* runtime imports and reads the export off, so this cannot disagree with what
+* actually happens at boot. It is a textual check rather than an import because
+* a freshly built bundle cannot resolve its own dependencies until it is
+* deployed — the same reason schema hashing reads source.
+*
+* Errs toward `false`: a missed detection costs a deploy rejection whose message
+* says exactly how to proceed, while a false positive would hand back the crash
+* loop this exists to prevent.
+*/
+function detectStorageAuthorize(compiledConfigDir) {
+	const indexPath = [
+		".js",
+		".mjs",
+		".ts"
+	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
+	if (!indexPath) return false;
+	let source;
+	try {
+		source = fs.readFileSync(indexPath, "utf8");
+	} catch {
+		return false;
+	}
+	if (/\bexport\s+(?:async\s+)?(?:const|let|var|function)\s+storageAuthorize\b/.test(source)) return true;
+	for (const clause of source.matchAll(/\bexport\s*\{([^}]*)\}/g)) if (clause[1].split(",").map((entry) => {
+		const parts = entry.split(/\bas\b/);
+		return parts[parts.length - 1].trim();
+	}).includes("storageAuthorize")) return true;
+	return false;
+}
+/**
+* Detect native code in the dependency closure.
+*
+* Walks declared runtime dependencies breadth-first through `node_modules`,
+* flagging anything with a `binding.gyp`, a prebuilt `.node` binary, or an
+* install script that builds one. The managed runtime cannot run these: a
+* binary compiled for one image will not load in another, and finding that out
+* at deploy time is far better than in a crash loop.
+*
+* The walk is bounded. A dependency graph can be enormous, and this is a
+* heuristic gate whose false negatives are caught at deploy time anyway.
+*/
+function detectNativeDependencies(projectRoot, declared, limit = 2e3) {
+	const found = [];
+	const seen = /* @__PURE__ */ new Set();
+	const queue = Object.keys(declared);
+	let visited = 0;
+	const searchRoots = [
+		path.join(projectRoot, "node_modules"),
+		path.join(projectRoot, "backend", "node_modules"),
+		path.join(projectRoot, "config", "node_modules")
+	].filter((dir) => fs.existsSync(dir));
+	while (queue.length > 0 && visited < limit) {
+		const name = queue.shift();
+		if (seen.has(name)) continue;
+		seen.add(name);
+		visited++;
+		if (KNOWN_NATIVE_PACKAGES.has(name)) {
+			found.push({
+				name,
+				reason: "known native module"
+			});
+			continue;
+		}
+		const packageDir = searchRoots.map((root) => path.join(root, ...name.split("/"))).find((dir) => fs.existsSync(path.join(dir, "package.json")));
+		if (!packageDir) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+		} catch {
+			continue;
+		}
+		if (pkg.gypfile || fs.existsSync(path.join(packageDir, "binding.gyp"))) {
+			found.push({
+				name,
+				reason: "builds a native addon (binding.gyp)"
+			});
+			continue;
+		}
+		const install = `${pkg.scripts?.install ?? ""} ${pkg.scripts?.preinstall ?? ""} ${pkg.scripts?.postinstall ?? ""}`;
+		if (/node-gyp|prebuild|node-pre-gyp|cmake-js/.test(install)) {
+			found.push({
+				name,
+				reason: "install script compiles native code"
+			});
+			continue;
+		}
+		if (hasNodeBinary(packageDir)) {
+			found.push({
+				name,
+				reason: "ships a prebuilt .node binary"
+			});
+			continue;
+		}
+		for (const dep of Object.keys(pkg.dependencies ?? {})) if (!seen.has(dep)) queue.push(dep);
+	}
+	return found;
+}
+/** Shallow scan for `.node` binaries — deep enough for the usual `build/Release`. */
+function hasNodeBinary(dir, depth = 0) {
+	if (depth > 3) return false;
+	let entries;
+	try {
+		entries = fs.readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return false;
+	}
+	for (const entry of entries) {
+		if (entry.isFile() && entry.name.endsWith(".node")) return true;
+		if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".bin") {
+			if (hasNodeBinary(path.join(dir, entry.name), depth + 1)) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a dependency name resolves to a package *inside this repository* — a
+* workspace package rather than a registry one.
+*
+* The bundle's declared deps are installed with `npm install` from the public
+* registry beside the bundle at boot. A workspace package is not there, so
+* declaring it guarantees a boot-time install failure. The most common case is
+* the standard `config` package: the backend depends on it by name, but it is
+* *carried in the bundle* (as `entry.config`), so it must never also be an npm
+* dependency. Projects often express this as a `workspace:` range — caught
+* separately — but a plain `"*"` against a workspace symlink is just as common
+* and looks like a registry range, so the symlink is what actually settles it.
+*
+* Detection: the installed `node_modules/<name>` is a symlink whose real path is
+* inside the project and not within a pnpm virtual store (`.pnpm`). That is
+* exactly a workspace link and nothing else.
+*/
+function resolvesToWorkspacePackage(projectRoot, name) {
+	let realRoot;
+	try {
+		realRoot = fs.realpathSync(projectRoot);
+	} catch {
+		realRoot = projectRoot;
+	}
+	for (const base of [
+		projectRoot,
+		path.join(projectRoot, "backend"),
+		path.join(projectRoot, "config")
+	]) {
+		const link = path.join(base, "node_modules", name);
+		try {
+			if (!fs.lstatSync(link).isSymbolicLink()) continue;
+			const real = fs.realpathSync(link);
+			const insideRepo = real.startsWith(realRoot + path.sep);
+			const inStore = real.includes(`${path.sep}.pnpm${path.sep}`) || real.includes(`${path.sep}node_modules${path.sep}`);
+			if (insideRepo && !inStore) return true;
+		} catch {}
+	}
+	return false;
+}
+/**
+* Collect the runtime dependencies a bundle needs installed beside it.
+*
+* Packages the runtime image already provides are excluded — reinstalling a
+* second copy of the server next to the one running the process is at best
+* wasted space and at worst a version conflict. Workspace packages are excluded
+* too: they are not on the registry the runtime installs from, and the project's
+* own config package already travels inside the bundle.
+*/
+function collectDeclaredDependencies(projectRoot) {
+	const declared = {};
+	for (const relative of [
+		"backend/package.json",
+		"config/package.json",
+		"package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+				if (RUNTIME_PROVIDED.has(name)) continue;
+				if (typeof version === "string" && version.startsWith("workspace:")) continue;
+				if (resolvesToWorkspacePackage(projectRoot, name)) continue;
+				declared[name] = version;
+			}
+		} catch {}
+	}
+	return declared;
+}
+/**
+* Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
+*
+* TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
+* lets a project write `from "./posts"` or `from "./collections"`, and TypeScript
+* emits them unchanged on the assumption that a bundler will finish the job.
+* Nothing bundles a Rebase bundle — the runtime imports these files directly with
+* Node's ESM loader, which requires a full path with an extension and refuses
+* directory imports outright.
+*
+* Without this, adopting the bundle would mean asking every project written in
+* the (extremely common) extensionless style to rewrite all of its imports. The
+* rewrite is mechanical and verifiable: only relative specifiers are touched, and
+* only when the target file actually exists on disk.
+*/
+function normalizeEsmSpecifiers(outDir) {
+	const unresolved = [];
+	let rewritten = 0;
+	const SPECIFIER = /(\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)(["'])(\.[^"']*)\2/g;
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, entry.name);
+			if (entry.isDirectory()) {
+				if (entry.name === "node_modules") continue;
+				walk(full);
+			} else if (entry.isFile() && entry.name.endsWith(".js")) rewriteFile(full);
+		}
+	};
+	const rewriteFile = (file) => {
+		const original = fs.readFileSync(file, "utf8");
+		const dir = path.dirname(file);
+		const updated = original.replace(SPECIFIER, (match, prefix, quote, specifier) => {
+			if (/\.(js|mjs|cjs|json|node)$/.test(specifier)) return match;
+			const target = path.resolve(dir, specifier);
+			if (fs.existsSync(`${target}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}.js${quote}`;
+			}
+			if (fs.existsSync(path.join(target, "index.js"))) {
+				rewritten++;
+				return `${prefix}${quote}${specifier}${specifier.endsWith("/") ? "index.js" : "/index.js"}${quote}`;
+			}
+			if (specifier.endsWith(".ts") && fs.existsSync(`${target.slice(0, -3)}.js`)) {
+				rewritten++;
+				return `${prefix}${quote}${specifier.slice(0, -3)}.js${quote}`;
+			}
+			unresolved.push(`${path.basename(file)} → ${specifier}`);
+			return match;
+		});
+		if (updated !== original) fs.writeFileSync(file, updated, "utf8");
+	};
+	if (fs.existsSync(outDir)) walk(outDir);
+	return {
+		rewritten,
+		unresolved
+	};
+}
+/**
+* Remove a previous build so stale output cannot masquerade as current.
+*
+* The containment check matters because this is a recursive force-delete of a
+* path that came from a command-line flag: `rebase build --out ../..` would
+* otherwise erase the parent of the project. The manifest's own paths are
+* checked the same way; a flag deserves no less.
+*/
+function cleanOutDir(projectRoot, outDir) {
+	const relative = path.relative(projectRoot, outDir);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Refusing to build into "${outDir}": the output directory must be inside the project.`);
+	if (fs.existsSync(outDir)) fs.rmSync(outDir, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(outDir, { recursive: true });
+}
+/**
+* Regenerate the Drizzle schema from the collections.
+*
+* Delegated to the database driver's own CLI — the same code `rebase schema
+* generate` runs — so there is one implementation of what a schema is. When no
+* driver is resolvable the build continues with a warning rather than failing:
+* a `baas` project has no schema to generate, and a project mid-install should
+* get a clear message rather than a hard stop.
+*/
+async function regenerateSchema(projectRoot, configDir, options) {
+	const backendDir = path.join(projectRoot, "backend");
+	if (!fs.existsSync(backendDir)) return;
+	const plugin = getActiveBackendPlugin(backendDir);
+	const script = plugin ? resolvePluginCliScript(backendDir, plugin) : null;
+	if (!script) {
+		log(options, chalk.dim("  (no database driver found — skipping schema generation)"));
+		return;
+	}
+	const runner = script.endsWith(".ts") ? resolveTsx(projectRoot) : "node";
+	if (!runner) {
+		log(options, chalk.dim("  (tsx not installed — skipping schema generation)"));
+		return;
+	}
+	const collectionsPath = path.join("..", configDir, "collections");
+	try {
+		await execa(runner, [
+			script,
+			"schema",
+			"generate",
+			"--collections",
+			collectionsPath
+		], {
+			cwd: backendDir,
+			stdio: "pipe"
+		});
+		log(options, chalk.dim("  regenerated database schema from collections"));
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		throw new Error(`Schema generation failed, so the bundle was not written.\n${detail}\nRun \`rebase schema generate\` to see the full output, or pass --skip-schema if the committed schema is deliberately hand-maintained.`);
+	}
+}
+/**
+* Compile and assemble a bundle.
+*/
+async function buildBundle(options) {
+	const { projectRoot, app, appName } = options;
+	const paths = resolveBackendPaths(app);
+	const outDir = path.resolve(projectRoot, options.outDir ?? "dist-bundle");
+	const includes = [];
+	const addIfExists = (relative, pattern) => {
+		if (fs.existsSync(path.join(projectRoot, relative))) includes.push(pattern);
+	};
+	if (paths.mode === "cms") addIfExists(paths.config, `${paths.config}/**/*.ts`);
+	addIfExists(paths.functions, `${paths.functions}/**/*.ts`);
+	addIfExists(paths.crons, `${paths.crons}/**/*.ts`);
+	if (fs.existsSync(path.join(projectRoot, paths.schema))) includes.push(paths.schema);
+	if (includes.length === 0) throw new Error(`Nothing to build for app "${appName}". Expected a config directory at "${paths.config}" or functions at "${paths.functions}".`);
+	if (paths.mode === "cms" && options.skipSchema !== true) await regenerateSchema(projectRoot, paths.config, options);
+	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
+	cleanOutDir(projectRoot, outDir);
+	const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options.skipTypeCheck === true);
+	const tsc = resolveLocalBin(projectRoot, "tsc");
+	if (!tsc) throw new Error("TypeScript is not installed in this project. Run your package manager's install first.");
+	try {
+		await execa(tsc, ["-p", tsconfigPath], {
+			cwd: projectRoot,
+			stdio: "inherit"
+		});
+	} catch {
+		throw new Error("TypeScript compilation failed — the bundle was not written.");
+	}
+	const normalized = normalizeEsmSpecifiers(outDir);
+	if (normalized.rewritten > 0) log(options, chalk.dim(`  resolved ${normalized.rewritten} relative import(s) for Node ESM`));
+	if (normalized.unresolved.length > 0) {
+		console.log(chalk.yellow(`  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`));
+		for (const item of normalized.unresolved.slice(0, 5)) console.log(chalk.dim(`      ${item}`));
+		if (normalized.unresolved.length > 5) console.log(chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));
+	}
+	const compiledConfigDir = path.join(outDir, paths.config);
+	const compiledCollectionsDir = path.join(compiledConfigDir, "collections");
+	let collections = [];
+	if (paths.mode === "cms") {
+		collections = await loadSourceCollections(path.join(projectRoot, paths.config, "collections"));
+		if (collections.length === 0) throw new Error(`No collections were found in ${path.join(paths.config, "collections")}. A cms-mode project must define at least one collection.`);
+		if (!fs.existsSync(compiledCollectionsDir)) throw new Error(`Compilation produced no collections directory at ${path.relative(projectRoot, compiledCollectionsDir)}.`);
+	}
+	const declared = collectDeclaredDependencies(projectRoot);
+	const nativeModules = detectNativeDependencies(projectRoot, declared);
+	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
+	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
+	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
+	const manifest = {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: options.runtimeRange,
+			builtAgainst: resolveServerVersion(projectRoot),
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: paths.mode === "baas" ? "" : computeSchemaVersion(collections),
+		app: appName,
+		mode: paths.mode,
+		entry: {
+			config: paths.mode === "cms" ? relative(paths.config) : void 0,
+			collections: paths.mode === "cms" ? relative(path.join(paths.config, "collections")) : void 0,
+			functions: relative(paths.functions),
+			crons: relative(paths.crons),
+			schema: relative(schemaOut),
+			usersCollection: paths.mode === "cms" ? relative(path.join(paths.config, `${paths.usersCollection}.js`)) : void 0
+		},
+		collections: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
+		hooks: {
+			native: nativeModules.length > 0,
+			nativeModules: nativeModules.length > 0 ? nativeModules : void 0
+		},
+		storage: { authorize: declaresStorageAuthorize },
+		deps: { declared },
+		build: {
+			cli: resolveCliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	};
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: declared
+	}, null, 2)}\n`, "utf8");
+	return {
+		outDir,
+		manifest,
+		collectionCount: collections.length
+	};
+}
+/**
+* Package a built static app (a `static` or bundled-`admin` app) into a bundle.
+*
+* A static bundle is the counterpart to a backend bundle: the same shape, the
+* same runtime image runs it, but its manifest says `mode: "static"` and it
+* carries only the built assets under `static/`. That is what lets a frontend or
+* admin app be its own deployable, scalable unit rather than something baked into
+* the backend container.
+*
+* `assetsDir` is the app's built output (e.g. `frontend/dist`), already produced
+* by its own build command. This copies it into the bundle and writes the
+* manifest — no compilation, no dependency closure (a static bundle installs
+* nothing at boot).
+*/
+function buildStaticBundle(options) {
+	const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;
+	cleanOutDir(projectRoot, outDir);
+	const staticOut = path.join(outDir, "static");
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	const manifest = {
+		bundleFormat: BUNDLE_FORMAT_VERSION,
+		runtime: {
+			range: runtimeRange,
+			builtAgainst: resolveServerVersion(projectRoot),
+			contract: RUNTIME_CONTRACT_VERSION
+		},
+		schemaVersion: "",
+		app: appName,
+		mode: "static",
+		entry: { static: "static" },
+		hooks: { native: false },
+		deps: { declared: {} },
+		build: {
+			cli: resolveCliVersion(),
+			node: process.versions.node.split(".")[0],
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	};
+	fs.writeFileSync(path.join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	fs.writeFileSync(path.join(outDir, "package.json"), `${JSON.stringify({
+		name: "rebase-bundle",
+		private: true,
+		type: "module",
+		dependencies: {}
+	}, null, 2)}\n`, "utf8");
+	return {
+		outDir,
+		manifest,
+		fileCount
+	};
+}
+/**
+* Which files in a collections directory are collections.
+*
+* Mirrors the runtime loader's rules exactly, and must keep mirroring them: the
+* set of files counted here decides the schema version, and the runtime decides
+* what it serves the same way. A divergence would show up as a client that is
+* permanently "out of date" against a server that agrees with it.
+*
+* (`._*` guards macOS AppleDouble files, which look like sources and are not.)
+*/
+function isCollectionSourceFile(name) {
+	if (name.startsWith(".")) return false;
+	if (name.includes(".test.") || name.includes(".spec.")) return false;
+	if (name.endsWith(".d.ts")) return false;
+	if (name === "index.ts" || name === "index.js") return false;
+	return name.endsWith(".ts") || name.endsWith(".js");
+}
+/**
+* Load collections from **source**, for hashing and for the manifest's slug list.
+*
+* Deliberately not the compiled output. A compiled bundle imports its
+* dependencies from beside itself — that is the whole point of shipping a
+* `package.json` with it — but at build time nothing has been installed there
+* yet, and under pnpm the project's own `node_modules` lives one directory per
+* package, so the emitted files genuinely cannot resolve their imports until
+* they are deployed.
+*
+* Reading source costs nothing in fidelity: compilation erases types, it does
+* not change the values a collection module exports, so the hash is the same
+* either way.
+*/
+async function loadSourceCollections(collectionsDir) {
+	if (!fs.existsSync(collectionsDir)) return [];
+	const { createJiti } = await import("jiti");
+	const jiti = createJiti(path.join(collectionsDir, "index.ts"), {
+		interopDefault: true,
+		esmResolve: true
+	});
+	const files = fs.readdirSync(collectionsDir).filter(isCollectionSourceFile).sort();
+	const collections = [];
+	const failures = [];
+	for (const file of files) try {
+		const mod = await jiti.import(path.join(collectionsDir, file));
+		const collection = mod.default ?? mod;
+		if (collection && typeof collection === "object" && "slug" in collection) collections.push(collection);
+		else failures.push(`${file}: no default-exported collection`);
+	} catch (err) {
+		failures.push(`${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (failures.length > 0) throw new Error(`Could not read ${failures.length} collection file(s):\n` + failures.map((f) => `  • ${f}`).join("\n"));
+	return collections;
+}
+/** The `@rebasepro/server` version the project resolves — what it was built against. */
+function resolveServerVersion(projectRoot) {
+	const candidates = [path.join(projectRoot, "node_modules", "@rebasepro", "server", "package.json"), path.join(projectRoot, "backend", "node_modules", "@rebasepro", "server", "package.json")];
+	for (const candidate of candidates) {
+		if (!fs.existsSync(candidate)) continue;
+		try {
+			return JSON.parse(fs.readFileSync(candidate, "utf8")).version;
+		} catch {}
+	}
+	return "unknown";
+}
+function resolveCliVersion() {
+	try {
+		let dir = path.dirname(new URL(import.meta.url).pathname);
+		for (let i = 0; i < 5; i++) {
+			const candidate = path.join(dir, "package.json");
+			if (fs.existsSync(candidate)) {
+				const pkg = JSON.parse(fs.readFileSync(candidate, "utf8"));
+				if (pkg.name === "@rebasepro/cli" && pkg.version) return pkg.version;
+			}
+			dir = path.dirname(dir);
+		}
+	} catch {}
+	return "unknown";
+}
+//#endregion
+//#region src/commands/build.ts
+/**
+* CLI command: rebase build [app...]
+*
+* Builds the apps a repository declares in `rebase.json`.
+*
+* For a `backend` app this produces a **bundle** — compiled collections,
+* functions and schema plus a manifest — which is the artifact the runtime
+* loads. For `static` and bundled `admin` apps it runs the declared build
+* command and reports where the output landed.
+*
+* A project with no manifest, or one whose backend has been ejected to its own
+* entrypoint, falls back to the previous behaviour: run every workspace's own
+* `build` script. Nothing that built before stops building.
+*/
+function printHelp$3() {
+	console.log(`
+${chalk.bold("rebase build")} — build the apps declared in rebase.json
+
+${chalk.bold("Usage")}
+  rebase build [app...]        Build the named apps (default: all)
+
+${chalk.bold("Options")}
+  --out <dir>                  Bundle output directory (default: ${DEFAULT_BUNDLE_DIR})
+  --skip-type-check            Compile without type checking (faster; use for iteration only)
+  --skip-schema                Do not regenerate the database schema from collections
+  --legacy                     Run every workspace's own build script instead
+  -h, --help                   Show this help
+
+${chalk.bold("Examples")}
+  rebase build                 Build every app in this repository
+  rebase build backend         Build only the backend bundle
+  rebase build web             Build only the "web" static app
+`.trim());
+}
+async function buildCommand(rawArgs = []) {
+	const args = arg({
+		"--out": String,
+		"--skip-type-check": Boolean,
+		"--skip-schema": Boolean,
+		"--legacy": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printHelp$3();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	if (args["--legacy"]) {
+		await runWorkspaceBuilds(projectRoot);
+		return;
+	}
+	let loaded;
+	try {
+		loaded = loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) {
+			console.error(chalk.red(`✗ ${err.message}`));
+			for (const issue of err.issues) console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : ""}${issue.message}`));
+			process.exit(1);
+		}
+		throw err;
+	}
+	const { manifest, source } = loaded;
+	const requested = args._.filter((a) => !a.startsWith("-"));
+	let targets = buildableApps(manifest);
+	if (requested.length > 0) {
+		const known = new Set(targets.map((t) => t.name));
+		const unknown = requested.filter((name) => !known.has(name));
+		if (unknown.length > 0) {
+			console.error(chalk.red(`✗ Unknown app(s): ${unknown.join(", ")}`));
+			console.error(chalk.dim(`  This repository declares: ${targets.map((t) => t.name).join(", ") || "(none)"}`));
+			process.exit(1);
+		}
+		targets = targets.filter((t) => requested.includes(t.name));
+	}
+	if (targets.length === 0) {
+		console.log(chalk.yellow("No buildable apps declared. Nothing to do."));
+		return;
+	}
+	if (!findBackendApp(manifest) && source === "synthesized") {
+		console.log(chalk.dim("No rebase.json found — building workspace packages.\n"));
+		await runWorkspaceBuilds(projectRoot);
+		return;
+	}
+	console.log(`${chalk.bold("Rebase")} — building ${targets.length} app(s)\n`);
+	for (const { name, app } of targets) {
+		console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));
+		if (app.type === "backend") {
+			const result = await buildBundle({
+				projectRoot,
+				appName: name,
+				app,
+				outDir: args["--out"],
+				runtimeRange: manifest.runtime,
+				skipTypeCheck: args["--skip-type-check"],
+				skipSchema: args["--skip-schema"]
+			});
+			const rel = path.relative(projectRoot, result.outDir);
+			console.log(chalk.green(`  ✓ bundle → ${rel}/`));
+			console.log(chalk.dim(`    ${result.collectionCount} collection(s), schema ${result.manifest.schemaVersion}`));
+			if (result.manifest.hooks.native) {
+				const names = (result.manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
+				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
+				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
+			}
+		} else if (app.type === "static" || app.type === "admin") await buildAssetApp(projectRoot, name, app, manifest.runtime, args["--out"]);
+		else if (app.type === "custom") console.log(chalk.dim("  custom container — built at deploy time from its Dockerfile"));
+		console.log("");
+	}
+	console.log(chalk.green("✓ Build complete."));
+}
+/**
+* Build a static or bundled-admin app and package it into a static bundle.
+*
+* Runs the app's own build command, checks it produced the declared output, then
+* packages that output into a `static`-mode bundle — the same deployable shape as
+* a backend bundle, so a frontend or admin app deploys through the identical
+* path and runs on the identical image, just serving files instead of an API.
+*/
+async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride) {
+	const asset = app;
+	if (app.type === "admin" && app.mode !== "bundled") {
+		console.log(chalk.dim("  hosted admin panel — nothing to build"));
+		return;
+	}
+	if (!asset.build) {
+		console.log(chalk.dim("  no build command declared — skipping"));
+		return;
+	}
+	try {
+		await execa(asset.build, {
+			cwd: projectRoot,
+			stdio: "inherit",
+			shell: true
+		});
+	} catch {
+		console.error(chalk.red(`  ✗ build command failed for "${name}"`));
+		process.exit(1);
+	}
+	if (!asset.output) {
+		console.log(chalk.yellow("  no output directory declared — built, but nothing to bundle"));
+		return;
+	}
+	const outputPath = path.join(projectRoot, asset.output);
+	if (!fs.existsSync(outputPath)) {
+		console.error(chalk.red(`  ✗ declared output "${asset.output}" does not exist after building`));
+		process.exit(1);
+	}
+	const result = buildStaticBundle({
+		projectRoot,
+		appName: name,
+		assetsDir: outputPath,
+		outDir: outOverride ? path.resolve(process.cwd(), outOverride) : path.join(projectRoot, `dist-bundle-${name}`),
+		runtimeRange
+	});
+	const rel = path.relative(projectRoot, result.outDir);
+	console.log(chalk.green(`  ✓ static bundle → ${rel}/`) + chalk.dim(` (${result.fileCount} file(s))`));
+}
+/** The pre-manifest behaviour: build every workspace package. */
+async function runWorkspaceBuilds(projectRoot) {
+	const pm = detectPackageManager(projectRoot);
+	const buildCmd = getPMCommands(pm).runAll("build");
+	console.log(`${chalk.bold("Rebase")} — Building all workspaces with ${chalk.cyan(pm)}...\n`);
+	try {
+		await execa(buildCmd[0], buildCmd.slice(1), {
+			cwd: projectRoot,
+			stdio: "inherit"
+		});
+	} catch {
+		console.error(chalk.red("\n✗ Build failed."));
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/commands/start.ts
+/**
+* CLI command: rebase start
+*
+* Runs a built bundle through the Rebase runtime — the same path the official
+* container image takes, so what you test locally is what a deployment runs.
+*
+* When there is no bundle (an ejected backend, or a project that has not adopted
+* `rebase.json`) this falls back to the backend workspace's own `start` script,
+* which is what such a project has always used.
+*/
+function printHelp$2() {
+	console.log(`
+${chalk.bold("rebase start")} — run a built bundle
+
+${chalk.bold("Usage")}
+  rebase start [options]
+
+${chalk.bold("Options")}
+  --bundle <dir>     Bundle directory (default: ${DEFAULT_BUNDLE_DIR})
+  --legacy           Run the backend workspace's own start script
+  -h, --help         Show this help
+
+Build first with ${chalk.cyan("rebase build")}.
+`.trim());
+}
+async function startCommand(rawArgs = []) {
+	const args = arg({
+		"--bundle": String,
+		"--legacy": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"]) {
+		printHelp$2();
+		return;
+	}
+	const projectRoot = requireProjectRoot();
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	const bundleDir = path.resolve(projectRoot, args["--bundle"] ?? "dist-bundle");
+	const hasBundle = fs.existsSync(path.join(bundleDir, "manifest.json"));
+	if (args["--legacy"] || !hasBundle) {
+		if (!args["--legacy"] && !hasBundle) console.log(chalk.dim(`No bundle at ${path.relative(projectRoot, bundleDir)}/ — starting the backend workspace instead.
+`));
+		await startWorkspaceBackend(projectRoot, env);
+		return;
+	}
+	ensureBundleDependencies(projectRoot, bundleDir);
+	console.log(`${chalk.bold("Rebase")} — starting runtime from ${chalk.cyan(path.relative(projectRoot, bundleDir))}/\n`);
+	if (envFile && fs.existsSync(envFile)) (await import("dotenv")).config({ path: envFile });
+	process.env.REBASE_BUNDLE = bundleDir;
+	try {
+		const { runFromBundle } = await import("@rebasepro/server");
+		await runFromBundle({ bundleDir });
+	} catch (err) {
+		console.error(chalk.red("\n✗ Failed to start the runtime."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+}
+/**
+* Make a bundle's imports resolvable for a local run.
+*
+* Node resolves a module by walking up from the *importing file*, so compiled
+* code sitting in `dist-bundle/` no longer sees the per-package `node_modules`
+* its source could: pnpm and npm both install a workspace package's
+* dependencies inside that package, and the bundle is not inside any of them.
+*
+* A deployment solves this by installing the bundle's own `package.json` beside
+* it — that is what the generated `package.json` is for. Locally, doing a second
+* install to run code whose dependencies are already on disk would be wasteful,
+* so this links what is already there instead.
+*
+* Only ever created when absent, and only under the bundle directory, so a real
+* install always wins and nothing here is ever uploaded (`rebase build` cleans
+* the directory and never writes this).
+*/
+function ensureBundleDependencies(projectRoot, bundleDir) {
+	const target = path.join(bundleDir, "node_modules");
+	if (fs.existsSync(target)) return;
+	const sources = [
+		"backend/node_modules",
+		"config/node_modules",
+		"node_modules"
+	].map((relative) => path.join(projectRoot, relative)).filter((dir) => fs.existsSync(dir));
+	if (sources.length === 0) return;
+	let linked = 0;
+	fs.mkdirSync(target, { recursive: true });
+	const linkInto = (sourceDir, targetDir) => {
+		let entries;
+		try {
+			entries = fs.readdirSync(sourceDir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (entry.name === ".bin" || entry.name.startsWith(".")) continue;
+			const from = path.join(sourceDir, entry.name);
+			const to = path.join(targetDir, entry.name);
+			if (entry.name.startsWith("@") && entry.isDirectory()) {
+				fs.mkdirSync(to, { recursive: true });
+				linkInto(from, to);
+				continue;
+			}
+			if (fs.existsSync(to)) continue;
+			try {
+				fs.symlinkSync(fs.realpathSync(from), to, "junction");
+				linked++;
+			} catch {}
+		}
+	};
+	for (const source of sources) linkInto(source, target);
+	if (linked > 0) console.log(chalk.dim(`  linked ${linked} package(s) into the bundle for this local run\n  (a deployment installs the bundle's package.json instead)
+`));
+}
+async function startWorkspaceBackend(projectRoot, env) {
+	const startCmd = getPMCommands(detectPackageManager(projectRoot)).runWorkspace("backend", "start");
+	console.log(`${chalk.bold("Rebase")} — Starting backend server...\n`);
+	try {
+		await execa(startCmd[0], startCmd.slice(1), {
+			cwd: projectRoot,
+			stdio: "inherit",
+			env
+		});
+	} catch {
+		console.error(chalk.red("\n✗ Failed to start server."));
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/commands/auth.ts
+/**
+* CLI command: rebase auth <action>
+*
+* Subcommands:
+*   reset-password — Reset a user's password
+*/
+async function authCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printAuthHelp();
+		return;
 	}
 	switch (subcommand) {
 		case "reset-password":
@@ -2974,6 +4694,55 @@ async function whoamiCommand(rawArgs) {
 * `link` associates the current directory with a cloud project by writing
 * `.rebase/cloud.json`; deploy/logs/status then operate on it with no flags.
 */
+/**
+* Link this checkout straight at a running backend.
+*
+* No control plane, no authentication, no project id — just the URL of a Rebase
+* API. This is what makes the multi-repo workflow available to self-hosters: a
+* frontend repository links to `https://api.example.com` and then generates its
+* typed SDK from that project exactly as a cloud-linked repository would.
+*
+* The URL is verified before it is written. Recording an unreachable address and
+* failing later, in a different command, would be a worse experience than
+* failing here where the user can see what they typed.
+*/
+async function linkDirect(target, rawArgs) {
+	let base;
+	try {
+		base = new URL(target);
+	} catch {
+		fail(`"${target}" is not a valid URL.`);
+		return;
+	}
+	if (base.protocol !== "http:" && base.protocol !== "https:") fail("A project URL must be http or https.");
+	const apiUrl = base.toString().replace(/\/+$/, "");
+	const probe = `${apiUrl}/api/meta/schema-version`;
+	let reachable = false;
+	let detail = "";
+	try {
+		const response = await fetch(probe, { headers: { accept: "application/json" } });
+		reachable = response.ok;
+		if (!response.ok) detail = `responded ${response.status}`;
+	} catch (err) {
+		detail = err instanceof Error ? err.message : String(err);
+	}
+	if (!reachable) {
+		console.log(chalk.yellow(`⚠ Could not reach ${probe}${detail ? ` (${detail})` : ""}.`));
+		console.log(chalk.dim("  Linking anyway — the server may not be running yet."));
+		console.log(chalk.dim("  It must be a Rebase backend of version 0.11 or newer."));
+	}
+	writeLink({
+		url: apiUrl,
+		projectId: "",
+		apiUrl,
+		mode: "direct",
+		projectName: base.host
+	});
+	success(`Linked to ${apiUrl}`);
+	console.log(chalk.dim(`  Written to ${projectLinkPath()}`));
+	console.log("");
+	console.log(`Next: ${chalk.cyan("rebase generate-sdk --from link")}`);
+}
 async function linkCommand(rawArgs) {
 	const args = arg({
 		"--project": String,
@@ -2982,6 +4751,11 @@ async function linkCommand(rawArgs) {
 		argv: rawArgs.slice(3),
 		permissive: true
 	});
+	const positional = args._.find((value) => /^https?:\/\//i.test(value));
+	if (positional) {
+		await linkDirect(positional, rawArgs);
+		return;
+	}
 	const { client, url } = await requireClient(rawArgs);
 	try {
 		let project;
@@ -2997,7 +4771,7 @@ async function linkCommand(rawArgs) {
 			})).data;
 			if (projects.length === 0) fail("No projects found for your account.", `Create one with ${chalk.bold("rebase cloud projects create")}.`);
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select a project to link:",
 				choices: projects.map((p) => ({
@@ -3041,7 +4815,7 @@ async function selectOrgCommand(rawArgs) {
 		let chosen = target ? orgs.find((o) => String(o.id) === target || o.slug === target) : void 0;
 		if (!chosen && !target) {
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select the active organization:",
 				choices: orgs.map((o) => ({
@@ -3277,6 +5051,101 @@ function fmtDate(value) {
 	return isNaN(d.getTime()) ? value : d.toLocaleString();
 }
 //#endregion
+//#region src/commands/cloud/bundle-deploy.ts
+/**
+* Deploying a project as a managed **bundle** rather than a source build.
+*
+* `rebase cloud deploy --bundle` builds the bundle, tars it, uploads it to the
+* control plane's bundle endpoint, and triggers a deploy carrying the bundle id
+* and its generated manifest. The control plane resolves a runtime from the
+* manifest's range and runs the platform image with this bundle — the managed
+* path. A project not in managed mode, or one whose bundle fails intake, is told
+* so by the control plane; this side just packages and hands it over.
+*
+* The pieces here are separated from the network calls so they can be tested: the
+* manifest read, the tar packaging, and the request body assembly are pure enough
+* to check without a control plane.
+*/
+/** Read and shallow-validate a built bundle's manifest. */
+function readBundleManifest(bundleDir) {
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest.json in ${bundleDir}. Run \`rebase build\` first.`);
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (typeof manifest.bundleFormat !== "number" || !manifest.runtime?.range) throw new Error(`${manifestPath} is not a valid bundle manifest.`);
+	return manifest;
+}
+/**
+* Tar a built bundle into a gzipped archive.
+*
+* `node_modules` is excluded on purpose: the bundle ships a `package.json`, and
+* the managed runtime installs the declared dependencies at boot. Uploading an
+* installed `node_modules` would bloat the archive and could carry a
+* platform-specific build that will not run on the runtime image.
+*/
+function packBundle(bundleDir, outPath) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("tar", [
+			"-czf",
+			outPath,
+			"--exclude",
+			"node_modules",
+			"-C",
+			bundleDir,
+			"."
+		], {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				COPYFILE_DISABLE: "1"
+			}
+		});
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`tar exited ${code}`)));
+	});
+}
+/**
+* Assemble the deploy-trigger body for a bundle deploy.
+*
+* The manifest travels with the trigger so the control plane can validate intake
+* without unpacking the uploaded archive first — a rejection (native deps, no
+* matching runtime) is then a fast, cheap answer.
+*/
+function bundleDeployBody(input) {
+	return {
+		projectId: input.projectId,
+		bundleId: input.bundleId,
+		bundleManifest: input.manifest,
+		app: input.app ?? input.manifest.app ?? "backend",
+		client: "cli",
+		frameworkVersion: input.manifest.runtime?.builtAgainst,
+		...input.message ? { message: input.message } : {}
+	};
+}
+/** Upload a bundle archive; returns the control-plane bundle id. */
+async function uploadBundle(url, token, projectId, tarPath) {
+	const bytes = fs.readFileSync(tarPath);
+	const res = await fetch(`${url}/api/functions/deploy/bundle/upload?projectId=${encodeURIComponent(projectId)}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/gzip"
+		},
+		body: bytes
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Bundle upload failed (${res.status}): ${body || res.statusText}`);
+	}
+	const data = await res.json();
+	if (!data.bundleId) throw new Error("Bundle upload endpoint did not return a bundle id.");
+	return data.bundleId;
+}
+//#endregion
 //#region src/commands/cloud/deploy.ts
 /**
 * `rebase cloud deploy` and `rebase cloud logs`.
@@ -3334,6 +5203,35 @@ async function createSourceTarball(sourceDir) {
 	}
 	return tarPath;
 }
+/**
+* The `@rebasepro/*` version this source directory actually resolves.
+*
+* Recorded on the deployment so a row in Deployment History says which
+* framework build shipped. Nothing else on the platform knows: an app that
+* links the framework locally pins it at package time, and a silent bump is
+* invisible afterwards — it has already cost one debugging session.
+*
+* `@rebasepro/server` first, because that is what the deployed backend runs;
+* `@rebasepro/client` is the fallback for a frontend-only bundle. Resolution is
+* a plain walk up from the source directory rather than `require.resolve`,
+* which would answer for the CLI's own install tree instead of the app's.
+*
+* Best effort by construction: a version that cannot be read is simply not
+* recorded. Nothing about a deploy should fail over a bookkeeping string.
+*/
+function resolveFrameworkVersion(sourceDir) {
+	let dir = path.resolve(sourceDir);
+	for (;;) {
+		for (const pkg of ["@rebasepro/server", "@rebasepro/client"]) try {
+			const manifest = path.join(dir, "node_modules", ...pkg.split("/"), "package.json");
+			const version = JSON.parse(fs.readFileSync(manifest, "utf8")).version;
+			if (typeof version === "string" && version.trim() !== "") return version.trim();
+		} catch {}
+		const parent = path.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
 /** Upload a build-context tarball; returns the opaque `source` ref for deploy. */
 async function uploadSource(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
@@ -3356,16 +5254,100 @@ async function uploadSource(url, token, projectId, tarPath) {
 	if (!data.source) fail("Upload endpoint did not return a source reference.");
 	return data.source;
 }
+/**
+* Build, upload and deploy a project as a managed bundle.
+*
+* Builds the backend app into `dist-bundle` (unless one is pointed at with
+* `--bundle-dir`), packs it without `node_modules`, uploads it, and triggers a
+* deploy carrying the manifest so the control plane can validate intake fast.
+*/
+async function deployBundle(opts) {
+	const { client, url, projectId, projectRef } = opts;
+	const projectRoot = requireProjectRoot();
+	let bundleDir = opts.bundleDir ? path.resolve(process.cwd(), opts.bundleDir) : path.join(projectRoot, "dist-bundle");
+	if (!opts.bundleDir) {
+		const loaded = loadManifest(projectRoot);
+		const backend = findBackendApp(loaded.manifest);
+		if (!backend) fail("This repository declares no backend app to deploy as a bundle.", "A managed deploy runs the backend; declare one in rebase.json, or deploy from the backend's repository.");
+		console.log(chalk.gray("  Building bundle..."));
+		bundleDir = (await buildBundle({
+			projectRoot,
+			appName: backend.name,
+			app: backend.app,
+			runtimeRange: loaded.manifest.runtime,
+			log: (m) => console.log(chalk.gray(m))
+		})).outDir;
+	}
+	const manifest = readBundleManifest(bundleDir);
+	if (manifest.hooks?.native) {
+		const names = (manifest.hooks.nativeModules ?? []).map((m) => m.name).join(", ");
+		fail(`This bundle depends on native modules${names ? ` (${names})` : ""}, which the managed runtime cannot run.`, "Remove the native dependency, or deploy on the custom runtime.");
+	}
+	const tarPath = path.join(os.tmpdir(), `rebase-bundle-${Date.now()}.tar.gz`);
+	const token = client.auth.getSession()?.accessToken;
+	if (!token) fail("Not authenticated.", "Run `rebase cloud login`.");
+	let bundleId;
+	try {
+		await packBundle(bundleDir, tarPath);
+		const sizeMb = (fs.statSync(tarPath).size / 1024 / 1024).toFixed(1);
+		console.log(chalk.gray(`  Uploading bundle (${sizeMb} MB)...`));
+		bundleId = await uploadBundle(url, token, projectId, tarPath);
+	} catch (e) {
+		fail(e instanceof Error ? e.message : String(e));
+		return;
+	} finally {
+		fs.rmSync(tarPath, { force: true });
+	}
+	console.log("");
+	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	const body = bundleDeployBody({
+		projectId,
+		bundleId,
+		manifest,
+		message: opts.message
+	});
+	try {
+		const res = await client.functions.invoke("deploy", body);
+		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
+		if (isJsonMode()) printJson({
+			success: true,
+			deploymentId: String(res.deployment.id),
+			managed: res.managed === true
+		});
+		else {
+			console.log(chalk.green(`  ✓ Managed deploy started (deployment ${res.deployment.id}).`));
+			console.log(chalk.gray("    Track it with `rebase cloud logs` or in the console."));
+		}
+	} catch (e) {
+		reportError(e, "Managed deploy failed to start");
+	}
+}
 async function deployCommand(rawArgs, projectRef) {
 	const args = arg({
 		"--no-follow": Boolean,
-		"--source": String
+		"--source": String,
+		"--message": String,
+		"--bundle": Boolean,
+		"--bundle-dir": String,
+		"-m": "--message"
 	}, {
 		argv: rawArgs.slice(2),
 		permissive: true
 	});
 	const { client, url } = await requireClient(rawArgs);
 	const projectId = await resolveProjectRef(projectRef, client);
+	if (args["--bundle"]) {
+		if (args["--source"]) fail("--bundle and --source cannot be combined: one is a managed bundle, the other a source build.");
+		await deployBundle({
+			client,
+			url,
+			projectId,
+			projectRef,
+			bundleDir: args["--bundle-dir"],
+			message: args["--message"]
+		});
+		return;
+	}
 	let source;
 	if (args["--source"]) {
 		const tarPath = await createSourceTarball(args["--source"]);
@@ -3379,32 +5361,87 @@ async function deployCommand(rawArgs, projectRef) {
 	}
 	console.log("");
 	console.log(`  🚀 Triggering deployment for project ${chalk.bold(projectRef)}${source ? " from uploaded source" : ""}...`);
-	let deploymentId;
+	const body = { projectId };
+	if (source) body.source = source;
+	if (args["--message"]) body.message = args["--message"];
+	body.client = "cli";
+	const frameworkVersion = resolveFrameworkVersion(args["--source"] ?? process.cwd());
+	if (frameworkVersion) body.frameworkVersion = frameworkVersion;
+	let triggered;
 	try {
-		const res = await client.functions.invoke("deploy", source ? {
-			projectId,
-			source
-		} : { projectId });
+		const res = await client.functions.invoke("deploy", body);
 		if (!res?.deployment?.id) fail("Control plane did not return a deployment id.");
-		deploymentId = String(res.deployment.id);
+		triggered = {
+			deploymentId: String(res.deployment.id),
+			deduplicated: res.deduplicated === true
+		};
 	} catch (e) {
-		const err = e;
-		if (err?.status === 409) fail("A deployment is already in progress for this project.");
-		if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.");
-		reportError(e, "Failed to trigger deployment");
+		triggered = resolveTriggerFailure(e);
 	}
-	console.log(chalk.gray(`  Deployment ${deploymentId} created.`));
+	const { deploymentId, deduplicated } = triggered;
+	if (!isJsonMode()) console.log(chalk.gray(deduplicated ? `  Deployment ${deploymentId} is already running — following it.` : `  Deployment ${deploymentId} created.${frameworkVersion ? `  (@rebasepro/* ${frameworkVersion})` : ""}`));
 	if (args["--no-follow"]) {
-		console.log(chalk.gray("  Not following logs (--no-follow). Check status with `rebase cloud logs`."));
-		console.log("");
+		emit(() => {
+			console.log(chalk.gray("  Not following logs (--no-follow). Check status with `rebase cloud logs`."));
+			console.log("");
+		}, {
+			deploymentId,
+			deduplicated,
+			frameworkVersion: frameworkVersion ?? null,
+			following: false
+		});
 		return;
 	}
-	console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
-	console.log("");
-	await streamBuildLogs(client, deploymentId);
+	if (!isJsonMode()) {
+		console.log(chalk.gray("  Streaming build logs (Ctrl-C to stop watching — the build keeps running):"));
+		console.log("");
+	}
+	const status = await streamBuildLogs(client, deploymentId, { quiet: isJsonMode() });
+	emit(() => {}, {
+		deploymentId,
+		deduplicated,
+		frameworkVersion: frameworkVersion ?? null,
+		following: true,
+		status
+	});
+}
+/**
+* Turn a failed trigger into either a deployment to follow, or an exit.
+*
+* The 409 is the interesting one. A deploy trigger can reach the control plane
+* twice without anybody asking twice — the SDK transport replays a request once
+* after refreshing an expired token, and any lost response has the same effect
+* — so "a deployment is already in progress" was routinely describing the
+* deployment this very command had just created. With no id in the message the
+* only available reading was "someone else is deploying, back off", and the
+* build stream was lost either way.
+*
+* So: if the control plane says the blocking deployment is ours, we attach to
+* it. If it is not ours, we still name it, because "which one, since when, from
+* where" is the difference between an actionable refusal and a dead end.
+*/
+function resolveTriggerFailure(e) {
+	const err = e;
+	if (err?.status === 409) {
+		const blocking = err.details?.deployment;
+		if (blocking?.id && blocking.mine) return {
+			deploymentId: String(blocking.id),
+			deduplicated: true
+		};
+		fail(blocking?.id ? `Deployment ${blocking.id} is already in progress for this project${blocking.triggerSource && blocking.triggerSource !== "unknown" ? `, triggered from the ${blocking.triggerSource}` : ""}${blocking.createdAt ? ` at ${fmtDate(blocking.createdAt)}` : ""}.` : "A deployment is already in progress for this project.", blocking?.id ? `Follow it with \`rebase cloud logs -f\`, or stop it with \`rebase cloud cancel ${blocking.id}\`.` : "Follow it with `rebase cloud logs -f`.", "deploy_in_progress");
+	}
+	if (err?.status === 402) fail(err.message || "Payment required before deploying.", "Attach a card once with `rebase cloud billing setup`, then deploy again.", "payment_required");
+	reportError(e, "Failed to trigger deployment");
 }
-/** Poll a deployment record and print new log output as it arrives. */
-async function streamBuildLogs(client, deploymentId) {
+/**
+* Poll a deployment record and print new log output as it arrives. Returns the
+* terminal status; a non-success still exits non-zero, as it always has.
+*
+* `quiet` follows without printing — JSON mode, where the log stream would
+* corrupt the one object the caller is parsing.
+*/
+async function streamBuildLogs(client, deploymentId, opts = {}) {
+	const quiet = opts.quiet === true;
 	let printed = 0;
 	const started = Date.now();
 	for (;;) {
@@ -3414,26 +5451,37 @@ async function streamBuildLogs(client, deploymentId) {
 		} catch (e) {
 			reportError(e, "Failed to read deployment status");
 		}
-		if (!dep) fail(`Deployment ${deploymentId} disappeared.`);
+		if (!dep) fail(`Deployment ${deploymentId} disappeared.`, void 0, "not_found");
 		const logs = dep.logs ?? "";
-		if (logs.length > printed) {
-			process.stdout.write(logs.slice(printed));
-			printed = logs.length;
-		}
+		if (!quiet && logs.length > printed) process.stdout.write(logs.slice(printed));
+		printed = logs.length;
 		if (dep.status && dep.status !== "deploying") {
-			console.log("");
-			if (dep.status === "success") console.log(chalk.bold.green("  ✓ Deployment succeeded"));
-			else {
+			if (dep.status !== "success") {
+				if (quiet) {
+					printJson({ error: {
+						message: `Deployment ${deploymentId} ${dep.status}.`,
+						code: "deploy_failed",
+						status: null,
+						deploymentId,
+						logs
+					} });
+					process.exit(1);
+				}
+				console.log("");
 				console.log(chalk.bold.red(`  ✗ Deployment ${dep.status}`));
 				console.log("");
 				process.exit(1);
 			}
-			console.log("");
-			return;
+			if (!quiet) {
+				console.log("");
+				console.log(chalk.bold.green("  ✓ Deployment succeeded"));
+				console.log("");
+			}
+			return dep.status;
 		}
 		if (Date.now() - started > POLL_TIMEOUT_MS) {
-			console.log("");
-			fail("Timed out waiting for the build to finish.", "The deployment may still be running — check `rebase cloud logs`.");
+			if (!quiet) console.log("");
+			fail("Timed out waiting for the build to finish.", "The deployment may still be running — check `rebase cloud logs`.", "timeout");
 		}
 		await sleep(POLL_INTERVAL_MS);
 	}
@@ -3679,7 +5727,7 @@ async function createDatabase(rawArgs) {
 	let type = args["--type"];
 	if (!type) {
 		const { picked } = await inquirer.prompt([{
-			type: "list",
+			type: "select",
 			name: "picked",
 			message: "Database type:",
 			choices: [{
@@ -4146,9 +6194,35 @@ function parseEnvAssignment(operands) {
 		value: operands[1] ?? ""
 	};
 }
+/**
+* Prefixes whose variables are read by a BUNDLER at build time, not by the
+* process at run time.
+*
+* These are the ones this command cannot deliver. A project's environment is
+* applied at rollout — after Kaniko has already built the image — so a
+* `VITE_API_URL` set here is present in the running container and absent from
+* the JavaScript that was compiled minutes earlier. Nothing fails: the variable
+* exists, the deploy succeeds, and the bundle carries `undefined` where the
+* value should be. The bug then presents in the browser as missing
+* configuration, which is several steps away from the cause.
+*
+* `import.meta.env` inlining is Vite's; `NEXT_PUBLIC_`/`PUBLIC_`/`REACT_APP_`
+* are the same contract in Next, Astro/SvelteKit and CRA.
+*/
+var BUILD_TIME_ENV_PREFIXES = [
+	"VITE_",
+	"NEXT_PUBLIC_",
+	"PUBLIC_",
+	"REACT_APP_"
+];
+/** The prefix that makes `key` a build-time variable, or undefined. */
+function buildTimeEnvPrefix(key) {
+	return BUILD_TIME_ENV_PREFIXES.find((prefix) => key.toUpperCase().startsWith(prefix));
+}
 async function setEnv(rawArgs) {
 	const args = arg({
 		"--secret": Boolean,
+		"--force": Boolean,
 		"--project": String,
 		"-p": "--project"
 	}, {
@@ -4160,6 +6234,8 @@ async function setEnv(rawArgs) {
 	displayProjectRef(rawArgs);
 	const parsed = parseEnvAssignment(cloudPositionals(rawArgs).slice(2));
 	if (!parsed || !parsed.key) fail("Usage: rebase cloud env set KEY=VALUE [--secret]", void 0, "usage");
+	const buildTimePrefix = buildTimeEnvPrefix(parsed.key);
+	if (buildTimePrefix && !args["--force"]) fail(`${parsed.key} is read by your bundler at BUILD time, and project variables are applied at rollout — after the image is built. Setting it here would not reach the bundle.`, `Put ${buildTimePrefix}* variables in the source you deploy (a committed .env, or your build config), then \`rebase cloud deploy\`. Pass --force if your build genuinely reads this at run time.`, "build_time_variable");
 	const body = {
 		key: parsed.key,
 		value: parsed.value
@@ -4316,10 +6392,13 @@ ${chalk.green.bold("Commands")}
 
 ${chalk.green.bold("Options")}
   ${chalk.blue("--secret")}                  Mark a variable write-only ${chalk.gray("(set)")}
+  ${chalk.blue("--force")}                   Set a build-time key anyway ${chalk.gray("(set)")}
   ${chalk.blue("--json")}                    Machine-readable output
   ${chalk.blue("--project, -p")}             Project slug ${chalk.gray("(defaults to the linked project)")}
 
 ${chalk.gray("Values are encrypted at rest (AES-256-GCM) and only decrypted at deploy time.")}
+${chalk.gray("VITE_* / NEXT_PUBLIC_* / PUBLIC_* / REACT_APP_* are read by your bundler at BUILD time;")}
+${chalk.gray("these are applied at rollout, after the image is built, so they never reach the bundle.")}
 `);
 }
 function printEnvHelpJson() {
@@ -4871,7 +6950,7 @@ function deploymentDurationMs(dep) {
 	const ms = b - a;
 	return ms >= 0 ? ms : null;
 }
-function formatDuration(ms) {
+function formatDuration$1(ms) {
 	const totalSec = Math.max(0, Math.round(ms / 1e3));
 	if (totalSec < 60) return `${totalSec}s`;
 	const m = Math.floor(totalSec / 60);
@@ -4915,6 +6994,8 @@ function deploymentView(dep) {
 		isRollback: str(dep, "rollbackOf", "rollback_of") !== null,
 		rollbackable: isRollbackable(dep),
 		trigger: triggerInfo(dep),
+		message: str(dep, "deployMessage", "deploy_message"),
+		frameworkVersion: str(dep, "frameworkVersion", "framework_version"),
 		commit: {
 			hash: str(dep, "gitCommitHash", "gitCommitHash"),
 			message: str(dep, "gitCommitMessage", "gitCommitMessage")
@@ -4928,12 +7009,31 @@ async function fetchDeployments(client, projectId, limit = 100) {
 		limit
 	})).data;
 }
+/** Hard ceiling on `--limit`, matching the backend's own page size. */
+var MAX_DEPLOYMENTS_LIMIT = 100;
+/** `--limit N`, bounded. A garbage value is a refusal, never a silent default. */
+function parseDeploymentsLimit(raw) {
+	if (raw === void 0) return 20;
+	if (!Number.isInteger(raw) || raw < 1 || raw > MAX_DEPLOYMENTS_LIMIT) fail(`--limit must be a whole number between 1 and ${MAX_DEPLOYMENTS_LIMIT}.`, void 0, "usage");
+	return raw;
+}
 async function deploymentsListCommand(rawArgs) {
+	const args = arg({
+		"--limit": Number,
+		"--all": Boolean,
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const limit = args["--all"] ? MAX_DEPLOYMENTS_LIMIT : parseDeploymentsLimit(args["--limit"]);
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
 	const projectRef = displayProjectRef(rawArgs);
 	try {
-		const views = (await fetchDeployments(client, projectId)).map(deploymentView);
+		const views = (await fetchDeployments(client, projectId, limit)).map(deploymentView);
+		const truncated = views.length === limit;
 		emit(() => {
 			console.log("");
 			console.log(chalk.bold(`  🚀 Deployments — project ${projectRef}`));
@@ -4944,14 +7044,22 @@ async function deploymentsListCommand(rawArgs) {
 				return;
 			}
 			for (const v of views) {
-				const dur = v.durationMs !== null ? formatDuration(v.durationMs) : chalk.gray("running");
+				const dur = v.durationMs !== null ? formatDuration$1(v.durationMs) : chalk.gray("running");
 				const trig = v.trigger.source;
 				const roll = v.rollbackable ? chalk.green(" ↺ rollbackable") : "";
 				console.log(`  ${chalk.gray(`[${v.id}]`)} ${colorStatus(v.status)}  ${chalk.gray(String(v.createdAt ?? "—"))}  ${dur}  ${chalk.gray(trig)}${roll}`);
+				const label = [v.message, v.frameworkVersion ? `@rebasepro/* ${v.frameworkVersion}` : null].filter(Boolean).join("  ·  ");
+				if (label) console.log(`      ${chalk.gray(label)}`);
+			}
+			if (truncated) {
+				console.log("");
+				console.log(chalk.gray(`  Showing the ${limit} most recent. Use \`--limit N\` or \`--all\` for more.`));
 			}
 			console.log("");
 		}, {
 			projectId,
+			limit,
+			truncated,
 			deployments: views
 		});
 	} catch (e) {
@@ -5018,131 +7126,928 @@ async function rollbackCommand(rawArgs) {
 		reportError(e, "Failed to roll back");
 	}
 }
-async function cancelCommand(rawArgs) {
-	const args = arg({
-		"--yes": Boolean,
-		"-y": "--yes",
-		"--project": String,
-		"-p": "--project"
+async function cancelCommand(rawArgs) {
+	const args = arg({
+		"--yes": Boolean,
+		"-y": "--yes",
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
+	const explicitId = cloudPositionals(rawArgs).slice(1)[0];
+	await confirmDestructive({
+		yes: Boolean(args["--yes"]),
+		prompt: `Cancel the in-flight build for project ${projectRef}?`
+	});
+	try {
+		const res = await client.functions.invoke("deploy", explicitId ? {
+			projectId,
+			deploymentId: explicitId
+		} : { projectId }, { path: "cancel" });
+		emit(() => {
+			success(`Cancelled deployment ${chalk.bold(res.deploymentId)}`);
+			if (res.buildJobDeleted) console.log(chalk.gray("  The build job was deleted."));
+			console.log("");
+		}, {
+			success: true,
+			deploymentId: res.deploymentId,
+			buildJobDeleted: res.buildJobDeleted
+		});
+	} catch (e) {
+		if (e?.status === 404) fail("No deployment in progress to cancel.", void 0, "not_found");
+		reportError(e, "Failed to cancel deployment");
+	}
+}
+//#endregion
+//#region src/commands/cloud/power.ts
+/**
+* `rebase cloud start | stop | restart` — power operations.
+*
+* These flip the project's `status`, exactly as the console's `handleServerAction`
+* does: stop → `stopped`, start → `active`, restart → stop then start with a
+* brief pause in between (a real stop→start with genuine downtime). Stop and
+* restart cause downtime, so they require `--yes` in non-interactive use.
+*/
+async function setStatus(client, projectId, status) {
+	await client.data.collection("projects").update(projectId, { status });
+}
+async function powerCommand(action, rawArgs) {
+	const args = arg({
+		"--yes": Boolean,
+		"-y": "--yes",
+		"--project": String,
+		"-p": "--project"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	const projectRef = displayProjectRef(rawArgs);
+	if (action !== "start") await confirmDestructive({
+		yes: Boolean(args["--yes"]),
+		prompt: `${action === "stop" ? "Stop" : "Restart"} project ${projectRef}? This causes downtime.`
+	});
+	try {
+		if (action === "stop") {
+			await setStatus(client, projectId, "stopped");
+			emit(() => success(`Stopped project ${projectRef}`), {
+				success: true,
+				projectId,
+				status: "stopped"
+			});
+		} else if (action === "start") {
+			await setStatus(client, projectId, "active");
+			emit(() => success(`Started project ${projectRef}`), {
+				success: true,
+				projectId,
+				status: "active"
+			});
+		} else {
+			await setStatus(client, projectId, "stopped");
+			await new Promise((r) => setTimeout(r, 1500));
+			await setStatus(client, projectId, "active");
+			emit(() => success(`Restarted project ${projectRef}`), {
+				success: true,
+				projectId,
+				status: "active"
+			});
+		}
+	} catch (e) {
+		reportError(e, `Failed to ${action} project`);
+	}
+}
+//#endregion
+//#region src/commands/cloud/debug.ts
+/**
+* `rebase cloud debug <subcommand>` — one entry point for "why is my deployed
+* app not behaving".
+*
+* ## Why this exists
+*
+* The useful signals for a deployed project live in four different places — the
+* control plane, the workload's pods, the tenant database, and the public URL —
+* and each is normally reached with a different tool and a different set of
+* flags. Getting to a log should not be a research task. This started life as a
+* hand-rolled `prod-debug.sh` for a single project, with the namespace and the
+* URL hardcoded at the top; it earned its place twice in one week, so it is
+* generalised here to any project the CLI can already resolve.
+*
+* ## Read-only by default
+*
+* Every subcommand here only reads. The two things the original script could do
+* that mutate are deliberately NOT reproduced as-is:
+*
+*   - restarting the workload lives at `rebase cloud restart`, which already
+*     gates downtime behind `--yes`; duplicating it here would give the same
+*     destructive act a second, ungated spelling.
+*   - `debug db` prints the port-forward recipe and the connection's *shape*.
+*     It opens no session and prints no password — `rebase cloud db info
+*     --reveal` is the explicit, auditable way to get one.
+*
+* ## The probes are the point
+*
+* `debug health` is the highest-value piece and the reason the script existed.
+* A bare status code is not a diagnosis: a 404 from a functions route means
+* something completely different from a 404 at the root, and a 200 on an
+* unauthenticated read is a finding rather than a success. So every probe ships
+* with the interpretation of what it got, not just the number — see
+* {@link PROBES}.
+*/
+/** A response never arrived: DNS, TLS, ingress, or the pod. */
+var NO_RESPONSE = {
+	verdict: "fail",
+	meaning: "nothing answered — the hostname does not resolve, the ingress has no route, or no pod is running"
+};
+function serverError(what) {
+	return {
+		verdict: "fail",
+		meaning: `the server is running but ${what}`
+	};
+}
+/**
+* The probe set, in the order a failure cascades: if `health` is down, nothing
+* below it is meaningful, so it is checked first and reported first.
+*/
+var PROBES = [
+	{
+		id: "health",
+		label: "health",
+		method: "GET",
+		path: () => "/health",
+		healthy: "200 — the backend is up",
+		interpret: (status) => {
+			if (status === null) return NO_RESPONSE;
+			if (status === 200) return {
+				verdict: "ok",
+				meaning: "the backend is up and serving"
+			};
+			if (status === 404) return {
+				verdict: "fail",
+				meaning: "something answered but it is not a Rebase backend — the ingress is routing this host elsewhere"
+			};
+			if (status >= 500) return serverError("its health endpoint is failing");
+			return {
+				verdict: "unknown",
+				meaning: "unexpected for a health endpoint"
+			};
+		}
+	},
+	{
+		id: "spa",
+		label: "spa",
+		method: "GET",
+		path: () => "/",
+		healthy: "200 — the frontend is being served",
+		interpret: (status) => {
+			if (status === null) return NO_RESPONSE;
+			if (status === 200) return {
+				verdict: "ok",
+				meaning: "the frontend bundle is being served"
+			};
+			if (status === 404) return {
+				verdict: "warn",
+				meaning: "no frontend at the root — expected for a backend-only project, otherwise the SPA assets were not bundled into the image"
+			};
+			if (status >= 500) return serverError("the root route throws");
+			return {
+				verdict: "unknown",
+				meaning: "unexpected at the site root"
+			};
+		}
+	},
+	{
+		id: "auth",
+		label: "auth",
+		method: "POST",
+		path: () => "/api/auth/login",
+		body: {},
+		healthy: "400 — auth is mounted and rejects an empty body",
+		interpret: (status) => {
+			if (status === null) return NO_RESPONSE;
+			if (status === 400 || status === 422) return {
+				verdict: "ok",
+				meaning: "auth is mounted and rejected the empty body, as it should"
+			};
+			if (status === 401 || status === 403) return {
+				verdict: "ok",
+				meaning: "auth is mounted and refused the credentials"
+			};
+			if (status === 404) return {
+				verdict: "fail",
+				meaning: "the auth routes are NOT mounted — this project cannot sign anyone in"
+			};
+			if (status === 200) return {
+				verdict: "fail",
+				meaning: "an EMPTY login body was accepted — a login with no credentials must never succeed"
+			};
+			if (status >= 500) return serverError("the login route throws — often a missing or unmigrated auth table");
+			return {
+				verdict: "unknown",
+				meaning: "unexpected for a login route"
+			};
+		}
+	},
+	{
+		id: "unauthRead",
+		label: "unauth read",
+		method: "GET",
+		path: (t) => `/api/data/${encodeURIComponent(t.collection)}`,
+		healthy: "401 — reads require authentication",
+		interpret: (status) => {
+			if (status === null) return NO_RESPONSE;
+			if (status === 401 || status === 403) return {
+				verdict: "ok",
+				meaning: "unauthenticated reads are refused — row-level security is enforced"
+			};
+			if (status === 200) return {
+				verdict: "warn",
+				meaning: "this collection is readable with NO authentication — correct only if it is deliberately public"
+			};
+			if (status === 404) return {
+				verdict: "warn",
+				meaning: "no such collection on this deployment — check the name, or pass --collection"
+			};
+			if (status >= 500) return serverError("the read reached the database and failed — most often an RLS policy naming a column or table that is not there");
+			return {
+				verdict: "unknown",
+				meaning: "unexpected for a data read"
+			};
+		}
+	},
+	{
+		id: "functions",
+		label: "functions",
+		method: "GET",
+		/**
+		* The router's own listing endpoint, NOT a function's path.
+		*
+		* This matters, and it is the one place the original script got a wrong
+		* answer. A function is a Hono sub-app mounted at `/<name>`, and it
+		* usually defines only sub-routes (`/get`, `/list`) — so
+		* `/api/functions/<name>` 404s **even when everything is mounted and
+		* healthy**. Probing there cannot separate "the router is missing" from
+		* "that function defines no root route", and reporting the first is how
+		* you send someone to debug a deployment that was fine.
+		*
+		* `GET /api/functions` is unambiguous: the router registers a listing
+		* route at its own root (see `createFunctionRoutes`), so a 200 proves
+		* the mount *and* names every function that loaded.
+		*/
+		path: () => "/api/functions",
+		healthy: "200 — the functions router is mounted and lists its functions",
+		interpret: (status) => {
+			if (status === null) return NO_RESPONSE;
+			if (status === 200) return {
+				verdict: "ok",
+				meaning: "the functions router is mounted"
+			};
+			if (status === 401 || status === 403) return {
+				verdict: "ok",
+				meaning: "the functions router is mounted (its listing requires auth)"
+			};
+			if (status === 404) return {
+				verdict: "fail",
+				meaning: "the functions router did not mount — no functions directory was found at build time, or it held no functions, so every function on this project is unreachable"
+			};
+			if (status >= 500) return serverError("the functions router throws");
+			return {
+				verdict: "unknown",
+				meaning: "unexpected for the functions listing"
+			};
+		},
+		needsBody: true,
+		refine: (body, t) => {
+			const names = functionNames(body);
+			if (!names) return null;
+			if (t.fn && !names.includes(t.fn)) return {
+				verdict: "fail",
+				meaning: `the router is mounted but no function is named "${t.fn}" — it loaded ${names.length}: ${names.join(", ")}`
+			};
+			const found = t.fn ? `, including ${t.fn}` : "";
+			return {
+				verdict: "ok",
+				meaning: `the functions router is mounted and loaded ${names.length} function${names.length === 1 ? "" : "s"}${found}`
+			};
+		}
+	}
+];
+/** The function names out of a listing body, or null when it is not one. */
+function functionNames(body) {
+	const list = body?.functions;
+	if (!Array.isArray(list)) return null;
+	const names = list.map((f) => f?.name).filter((n) => typeof n === "string");
+	return names.length === list.length ? names : null;
+}
+/** Milliseconds before a probe is treated as unanswered. */
+var PROBE_TIMEOUT_MS = 1e4;
+/**
+* Ceiling on a probe body we will parse. The only body read is the function
+* listing; anything larger is a page we have no use for, and a debug command
+* must not be the thing that runs a machine out of memory.
+*/
+var MAX_PROBE_BODY_BYTES = 256 * 1024;
+/**
+* Run one probe. A transport failure is a `null` status, never a thrown error:
+* "nothing answered" is a diagnosis in its own right and the other probes still
+* need to run.
+*/
+async function runProbe(origin, spec, targets) {
+	const url = `${origin}${spec.path(targets)}`;
+	const started = Date.now();
+	let status = null;
+	let body;
+	try {
+		const res = await fetch(url, {
+			method: spec.method,
+			headers: spec.body ? { "Content-Type": "application/json" } : void 0,
+			body: spec.body ? JSON.stringify(spec.body) : void 0,
+			redirect: "manual",
+			signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+		});
+		status = res.status;
+		if (spec.needsBody && res.ok) {
+			const text = await res.text();
+			if (text.length <= MAX_PROBE_BODY_BYTES) try {
+				body = JSON.parse(text);
+			} catch {}
+		}
+	} catch {
+		status = null;
+	}
+	const statusReading = spec.interpret(status);
+	const reading = status !== null && spec.refine?.(body, targets) || statusReading;
+	return {
+		statusOk: statusReading.verdict === "ok",
+		id: spec.id,
+		label: spec.label,
+		method: spec.method,
+		url,
+		status,
+		ms: Date.now() - started,
+		verdict: reading.verdict,
+		meaning: reading.meaning,
+		healthy: spec.healthy
+	};
+}
+/** The worst verdict across probes — what the command's exit code keys off. */
+function overallVerdict(results) {
+	if (results.some((r) => r.verdict === "fail")) return "fail";
+	if (results.some((r) => r.verdict === "unknown")) return "unknown";
+	if (results.some((r) => r.verdict === "warn")) return "warn";
+	return "ok";
+}
+function verdictMark(v) {
+	switch (v) {
+		case "ok": return chalk.green("✓");
+		case "warn": return chalk.yellow("!");
+		case "fail": return chalk.red("✗");
+		default: return chalk.gray("?");
+	}
+}
+var LOG_PREFIX_RE = /^(?:(\d{4}-\d{2}-\d{2}T[\d:.]+Z?)\s+)?(?:\[([^\]]+)\]\s+)?([\s\S]*)$/;
+function parseLogLine(line) {
+	const m = LOG_PREFIX_RE.exec(line);
+	if (!m) return {
+		ts: null,
+		pod: null,
+		text: line
+	};
+	return {
+		ts: m[1] ?? null,
+		pod: m[2] ?? null,
+		text: m[3] ?? ""
+	};
+}
+/**
+* Lines an operator scanning for a fault wants to see.
+*
+* Matches the structured `severity` field first, then the shapes that show up
+* in unstructured output. `refus`/`denied` are in the list because a permission
+* failure often logs at info level and is exactly what one is hunting for.
+*/
+function isErrorLine(text) {
+	return /"(?:severity|level)":\s*"(?:ERROR|WARN(?:ING)?|error|warn)"|\bError:|\bERR!|refus|denied|EACCES|ECONNREFUSED/i.test(text);
+}
+/**
+* Pull an HTTP request record out of a log line, or null when it is not one.
+*
+* Only structured request lines are recognised. Guessing at prose would produce
+* a table with invented columns, which is worse than a short one.
+*/
+function parseRequestLine(text) {
+	const start = text.indexOf("{");
+	if (start === -1) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(text.slice(start));
+	} catch {
+		return null;
+	}
+	if (parsed.message !== "request" && parsed.msg !== "request") return null;
+	const num = (v) => {
+		const n = typeof v === "string" ? Number(v) : typeof v === "number" ? v : NaN;
+		return Number.isFinite(n) ? n : null;
+	};
+	return {
+		status: num(parsed.status),
+		method: typeof parsed.method === "string" ? parsed.method : "",
+		path: typeof parsed.path === "string" ? parsed.path : "",
+		latencyMs: num(parsed.latencyMs ?? parsed.durationMs)
+	};
+}
+/**
+* Startup lines: what the server *decided* it was going to do. Which storage
+* backend it bound, which functions it loaded, whether auth tables were found.
+* This is the fastest way to tell a misconfiguration from a runtime fault.
+*/
+function isBootLine(text) {
+	return /storage|Loaded function|Mounted|Auth tables|Server running|listening|Refusing|migrat/i.test(text);
+}
+/** Render a number of seconds back as the compact duration a user would type. */
+function formatDuration(seconds) {
+	if (seconds % 86400 === 0 && seconds >= 86400) return `${seconds / 86400}d`;
+	if (seconds % 3600 === 0 && seconds >= 3600) return `${seconds / 3600}h`;
+	if (seconds % 60 === 0 && seconds >= 60) return `${seconds / 60}m`;
+	return `${seconds}s`;
+}
+/**
+* Parse a duration like `15m`, `2h`, `90s`, `1d` (or a bare number of seconds)
+* into seconds. Returns null when it is not a duration.
+*/
+function parseSince(input) {
+	if (!input) return null;
+	const m = /^(\d+(?:\.\d+)?)\s*([smhd])?$/i.exec(input.trim());
+	if (!m) return null;
+	const value = parseFloat(m[1]);
+	const unit = (m[2] || "s").toLowerCase();
+	return Math.round(value * (unit === "s" ? 1 : unit === "m" ? 60 : unit === "h" ? 3600 : 86400));
+}
+async function fetchRuntimeLogs(client, projectId, opts) {
+	const params = new URLSearchParams();
+	if (opts.sinceSeconds !== void 0) params.set("sinceSeconds", String(opts.sinceSeconds));
+	if (opts.tailLines !== void 0) params.set("tailLines", String(opts.tailLines));
+	if (opts.previous) params.set("previous", "true");
+	params.set("timestamps", "true");
+	const qs = params.toString();
+	return client.functions.invoke("runtime-logs", void 0, {
+		method: "GET",
+		path: `${projectId}${qs ? `?${qs}` : ""}`
+	});
+}
+/** Print the per-pod states runtime-logs reports, including its hints. */
+function printPodStates(res) {
+	if (res.state === "no_pods") {
+		console.log(chalk.yellow(`  ${res.message ?? "No pods are running for this project."}`));
+		console.log("");
+		return;
+	}
+	for (const p of res.pods ?? []) {
+		if (p.state === "ok") continue;
+		console.log(`  ${chalk.yellow(p.pod)} ${chalk.gray(`(${p.state})`)}`);
+		if (p.message) console.log(chalk.gray(`    ${p.message}`));
+		if (p.hint) console.log(chalk.cyan(`    → ${p.hint}`));
+	}
+	if (res.truncated) console.log(chalk.gray("  (output truncated — narrow the window with --since)"));
+}
+/** Resolve the public origin a project is served at. */
+async function resolveOrigin(rawArgs, client, url, projectId) {
+	const parsed = arg({ "--host": String }, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (parsed["--host"]) {
+		const h = parsed["--host"].trim().replace(/\/+$/, "");
+		return /^https?:\/\//.test(h) ? h : `https://${h}`;
+	}
+	const [project, baseDomain] = await Promise.all([client.data.collection("projects").findById(projectId), fetchTenantBaseDomain(client, url)]);
+	if (!project) fail(`Project ${displayProjectRef(rawArgs)} not found.`);
+	const host = projectHost(project, baseDomain);
+	if (!host) fail("Could not determine the public URL for this project.", "It may never have been deployed. Pass --host <hostname> to probe an address directly.");
+	return `https://${host}`;
+}
+async function healthCommand(rawArgs) {
+	const parsed = arg({
+		"--collection": String,
+		"--function": String
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	const targets = {
+		collection: parsed["--collection"] || "users",
+		fn: parsed["--function"]
+	};
+	const { client, url } = await requireClient(rawArgs);
+	const origin = await resolveOrigin(rawArgs, client, url, await requireProject(rawArgs, client));
+	const results = [];
+	for (const spec of PROBES) results.push(await runProbe(origin, spec, targets));
+	const overall = overallVerdict(results);
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  🩺 Health — ${displayProjectRef(rawArgs)}`) + chalk.gray(`  ${origin}`));
+		console.log("");
+		const width = Math.max(...results.map((r) => r.label.length));
+		for (const r of results) {
+			const code = r.status === null ? chalk.red("---") : String(r.status);
+			console.log(`  ${verdictMark(r.verdict)} ${chalk.bold(r.label.padEnd(width))}  ${code.padStart(3)}  ${chalk.gray(`${r.ms}ms`)}`);
+			console.log(`      ${chalk.gray(r.meaning)}`);
+		}
+		console.log("");
+		if (overall === "ok") console.log(chalk.green("  Everything reachable and wired as expected."));
+		else {
+			const bad = results.filter((r) => r.verdict === "fail" || r.verdict === "warn");
+			console.log(chalk.gray(`  ${bad.length} of ${results.length} check${bad.length === 1 ? "" : "s"} need attention.`));
+			const wrongStatus = bad.filter((r) => !r.statusOk);
+			if (wrongStatus.length > 0) {
+				console.log(chalk.gray("  A healthy deployment answers:"));
+				for (const r of wrongStatus) console.log(chalk.gray(`    ${r.label.padEnd(width)}  ${r.healthy}`));
+			}
+		}
+		console.log("");
+	}, {
+		origin,
+		overall,
+		probes: results
+	});
+	if (overall === "fail") process.exit(1);
+}
+async function logView(rawArgs, view) {
+	const parsed = arg({
+		"--since": String,
+		"--tail": Number,
+		"--previous": Boolean
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	const sinceArg = parsed["--since"];
+	if (sinceArg !== void 0 && parseSince(sinceArg) === null) fail(`--since must be a duration like 15m, 2h or 90s; received "${sinceArg}".`);
+	const sinceSeconds = parseSince(sinceArg) ?? view.defaultSinceSeconds;
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	let res;
+	try {
+		res = await fetchRuntimeLogs(client, projectId, {
+			sinceSeconds,
+			tailLines: parsed["--tail"] ?? 500,
+			previous: Boolean(parsed["--previous"])
+		});
+	} catch (e) {
+		reportError(e, "Failed to fetch runtime logs");
+	}
+	const parsedLines = (res.logs ?? "").split("\n").filter((l) => l !== "").map(parseLogLine);
+	const kept = view.filter ? parsedLines.filter((l) => view.filter(l.text)) : parsedLines;
+	const shown = kept.slice(-view.limit);
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  ${view.title} — ${displayProjectRef(rawArgs)}`) + chalk.gray(`  last ${formatDuration(sinceSeconds)}`));
+		console.log("");
+		printPodStates(res);
+		if (shown.length === 0) {
+			console.log(chalk.gray("  (nothing matched in this window)"));
+			console.log("");
+			return;
+		}
+		for (const l of shown) console.log(`  ${l.pod ? chalk.gray(`[${l.pod}] `) : ""}${l.text}`);
+		console.log("");
+		if (kept.length > shown.length) {
+			console.log(chalk.gray(`  (showing the last ${shown.length} of ${kept.length} matching lines)`));
+			console.log("");
+		}
+	}, {
+		sinceSeconds,
+		state: res.state ?? null,
+		pods: res.pods ?? [],
+		truncated: Boolean(res.truncated),
+		matched: kept.length,
+		lines: shown
+	});
+}
+async function requestsCommand(rawArgs) {
+	const parsed = arg({
+		"--since": String,
+		"--tail": Number
 	}, {
-		argv: rawArgs.slice(2),
+		argv: rawArgs.slice(3),
 		permissive: true
 	});
+	const sinceArg = parsed["--since"];
+	if (sinceArg !== void 0 && parseSince(sinceArg) === null) fail(`--since must be a duration like 15m, 2h or 90s; received "${sinceArg}".`);
+	const sinceSeconds = parseSince(sinceArg) ?? 900;
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	const explicitId = cloudPositionals(rawArgs).slice(1)[0];
-	await confirmDestructive({
-		yes: Boolean(args["--yes"]),
-		prompt: `Cancel the in-flight build for project ${projectRef}?`
-	});
+	let res;
 	try {
-		const res = await client.functions.invoke("deploy", explicitId ? {
-			projectId,
-			deploymentId: explicitId
-		} : { projectId }, { path: "cancel" });
-		emit(() => {
-			success(`Cancelled deployment ${chalk.bold(res.deploymentId)}`);
-			if (res.buildJobDeleted) console.log(chalk.gray("  The build job was deleted."));
-			console.log("");
-		}, {
-			success: true,
-			deploymentId: res.deploymentId,
-			buildJobDeleted: res.buildJobDeleted
+		res = await fetchRuntimeLogs(client, projectId, {
+			sinceSeconds,
+			tailLines: parsed["--tail"] ?? 1e3
 		});
 	} catch (e) {
-		if (e?.status === 404) fail("No deployment in progress to cancel.", void 0, "not_found");
-		reportError(e, "Failed to cancel deployment");
+		reportError(e, "Failed to fetch runtime logs");
 	}
-}
-//#endregion
-//#region src/commands/cloud/power.ts
-/**
-* `rebase cloud start | stop | restart` — power operations.
-*
-* These flip the project's `status`, exactly as the console's `handleServerAction`
-* does: stop → `stopped`, start → `active`, restart → stop then start with a
-* brief pause in between (a real stop→start with genuine downtime). Stop and
-* restart cause downtime, so they require `--yes` in non-interactive use.
-*/
-async function setStatus(client, projectId, status) {
-	await client.data.collection("projects").update(projectId, { status });
-}
-async function powerCommand(action, rawArgs) {
-	const args = arg({
-		"--yes": Boolean,
-		"-y": "--yes",
-		"--project": String,
-		"-p": "--project"
+	const shown = (res.logs ?? "").split("\n").filter((l) => l !== "").map((l) => parseRequestLine(parseLogLine(l).text)).filter((e) => e !== null).slice(-40);
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  🌐 Requests — ${displayProjectRef(rawArgs)}`) + chalk.gray(`  last ${formatDuration(sinceSeconds)}`));
+		console.log("");
+		printPodStates(res);
+		if (shown.length === 0) {
+			console.log(chalk.gray("  No structured request lines in this window."));
+			console.log(chalk.gray("  (this view needs the server's request logging; try `debug logs`)"));
+			console.log("");
+			return;
+		}
+		for (const e of shown) {
+			const status = e.status ?? 0;
+			const color = status >= 500 ? chalk.red : status >= 400 ? chalk.yellow : chalk.green;
+			console.log(`  ${color(String(e.status ?? "---").padStart(3))}  ${e.method.padEnd(6)} ${e.path.slice(0, 70).padEnd(70)} ${chalk.gray(e.latencyMs === null ? "" : `${e.latencyMs}ms`)}`);
+		}
+		console.log("");
 	}, {
-		argv: rawArgs.slice(2),
-		permissive: true
+		sinceSeconds,
+		requests: shown
 	});
+}
+async function podCommand(rawArgs) {
 	const { client } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
-	const projectRef = displayProjectRef(rawArgs);
-	if (action !== "start") await confirmDestructive({
-		yes: Boolean(args["--yes"]),
-		prompt: `${action === "stop" ? "Stop" : "Restart"} project ${projectRef}? This causes downtime.`
+	let m;
+	try {
+		m = await client.functions.invoke("metrics", void 0, {
+			method: "GET",
+			path: projectId
+		});
+	} catch (e) {
+		reportError(e, "Failed to read workload placement");
+	}
+	const p = m.placement ?? {};
+	const replicas = p.replicas ?? {};
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  ☸  Workload — ${displayProjectRef(rawArgs)}`));
+		console.log("");
+		keyValues([
+			["Status", m.status ? colorStatus(m.status === "running" ? "active" : m.status) : void 0],
+			["Replicas", replicas.desired === void 0 ? void 0 : `${replicas.available ?? 0} / ${replicas.desired} available`],
+			["Namespace", p.namespace],
+			["Cluster", p.cluster],
+			["Region", [p.provider, p.region].filter(Boolean).join(" · ") || void 0],
+			["Host", p.host],
+			["Image", p.image],
+			["CPU", m.cpu ?? void 0],
+			["Memory", m.memory ?? void 0]
+		]);
+		console.log("");
+		if ((replicas.available ?? 0) === 0 && (replicas.desired ?? 0) > 0) {
+			console.log(chalk.yellow("  No replica is available — the pod is not passing its readiness check."));
+			console.log(chalk.gray("  See why with:  ") + chalk.bold("rebase cloud debug logs --previous"));
+			console.log("");
+		}
+	}, {
+		status: m.status ?? null,
+		placement: p
 	});
+}
+async function dbDebugCommand(rawArgs) {
+	const { client } = await requireClient(rawArgs);
+	const projectId = await requireProject(rawArgs, client);
+	let info;
 	try {
-		if (action === "stop") {
-			await setStatus(client, projectId, "stopped");
-			emit(() => success(`Stopped project ${projectRef}`), {
-				success: true,
-				projectId,
-				status: "stopped"
+		info = await client.functions.invoke("db-info", void 0, {
+			method: "GET",
+			path: projectId
+		});
+	} catch (e) {
+		reportError(e, "Failed to read database connection info");
+	}
+	const pf = info.portForward;
+	const forwardCmd = pf ? `kubectl port-forward -n ${pf.namespace} svc/${pf.service} ${pf.localPort}:${pf.remotePort}` : null;
+	const psqlCmd = pf && info.username && info.database ? `psql -h 127.0.0.1 -p ${pf.localPort} -U ${info.username} -d ${info.database}` : null;
+	emit(() => {
+		console.log("");
+		console.log(chalk.bold(`  🐘 Database — ${displayProjectRef(rawArgs)}`));
+		console.log("");
+		if (info.unavailableReason) {
+			console.log(chalk.yellow(`  ${info.unavailableReason}`));
+			console.log("");
+			return;
+		}
+		keyValues([
+			["Type", info.type],
+			["Host", info.host],
+			["Port", info.port],
+			["Database", info.database],
+			["Username", info.username],
+			["Password", info.passwordAvailable ? chalk.gray("stored — not shown here") : chalk.yellow("none stored")]
+		]);
+		console.log("");
+		if (forwardCmd) {
+			console.log(chalk.gray("  A managed database is only reachable inside its cluster. To connect:"));
+			console.log("");
+			console.log(`    ${forwardCmd}`);
+			if (psqlCmd) console.log(`    ${psqlCmd}`);
+			console.log("");
+			if (info.passwordAvailable) {
+				console.log(chalk.gray("  Get the password with:  ") + chalk.bold("rebase cloud db info --reveal"));
+				console.log("");
+			}
+		}
+	}, {
+		type: info.type ?? null,
+		host: info.host ?? null,
+		port: info.port ?? null,
+		database: info.database ?? null,
+		username: info.username ?? null,
+		passwordAvailable: Boolean(info.passwordAvailable),
+		portForwardCommand: forwardCmd,
+		psqlCommand: psqlCmd
+	});
+}
+async function debugCommand(action, rawArgs) {
+	switch (action) {
+		case void 0:
+		case "health":
+			await healthCommand(rawArgs);
+			break;
+		case "logs":
+			await logView(rawArgs, {
+				defaultSinceSeconds: 900,
+				limit: 200,
+				title: "📄 Logs"
 			});
-		} else if (action === "start") {
-			await setStatus(client, projectId, "active");
-			emit(() => success(`Started project ${projectRef}`), {
-				success: true,
-				projectId,
-				status: "active"
+			break;
+		case "errors":
+			await logView(rawArgs, {
+				filter: isErrorLine,
+				defaultSinceSeconds: 3600,
+				limit: 40,
+				title: "🔥 Errors"
 			});
-		} else {
-			await setStatus(client, projectId, "stopped");
-			await new Promise((r) => setTimeout(r, 1500));
-			await setStatus(client, projectId, "active");
-			emit(() => success(`Restarted project ${projectRef}`), {
-				success: true,
-				projectId,
-				status: "active"
+			break;
+		case "boot":
+			await logView(rawArgs, {
+				filter: isBootLine,
+				defaultSinceSeconds: 168 * 3600,
+				limit: 25,
+				title: "🚀 Boot"
 			});
-		}
-	} catch (e) {
-		reportError(e, `Failed to ${action} project`);
+			break;
+		case "requests":
+			await requestsCommand(rawArgs);
+			break;
+		case "pod":
+		case "workload":
+			await podCommand(rawArgs);
+			break;
+		case "db":
+			await dbDebugCommand(rawArgs);
+			break;
+		case "help":
+		case "--help":
+			printDebugHelp();
+			break;
+		default:
+			if (isJsonMode()) fail(`Unknown debug command: ${action}`, void 0, "unknown_command");
+			console.error(chalk.red(`Unknown debug command: ${action}`));
+			console.log("");
+			printDebugHelp();
+			process.exit(1);
 	}
 }
+function printDebugHelp() {
+	console.log(`
+${chalk.bold("rebase cloud debug")} — Find out why a deployed project is misbehaving
+
+${chalk.green.bold("Usage")}
+  rebase cloud debug ${chalk.blue("<subcommand>")} [options]
+
+${chalk.green.bold("End-to-end")}
+  ${chalk.blue.bold("health")}                  Probe the live URL and explain every status code ${chalk.gray("(default)")}
+
+${chalk.green.bold("Runtime")}
+  ${chalk.blue.bold("logs")} ${chalk.gray("[--since 15m]")}      Recent application logs
+  ${chalk.blue.bold("errors")} ${chalk.gray("[--since 1h]")}     Error and warning lines only
+  ${chalk.blue.bold("requests")} ${chalk.gray("[--since 15m]")}  HTTP requests the server logged ${chalk.gray("(status, path, latency)")}
+  ${chalk.blue.bold("boot")}                    What the server decided at startup ${chalk.gray("(storage, functions, auth)")}
+  ${chalk.blue.bold("pod")}                     Replicas, image, namespace, cluster placement
+
+${chalk.green.bold("Data")}
+  ${chalk.blue.bold("db")}                      Connection shape + the port-forward recipe ${chalk.gray("(no password)")}
+
+${chalk.green.bold("Options")}
+  ${chalk.blue("--since <dur>")}           Lookback window: ${chalk.gray("90s, 15m, 2h, 1d")}
+  ${chalk.blue("--tail <n>")}              Lines to read per pod ${chalk.gray("(default 500)")}
+  ${chalk.blue("--previous")}              Read the CRASHED container instance ${chalk.gray("(where the reason lives)")}
+  ${chalk.blue("--host <hostname>")}       Probe this address instead of the project's own
+  ${chalk.blue("--collection <name>")}     Collection for the unauth-read probe ${chalk.gray("(default: users)")}
+  ${chalk.blue("--function <name>")}       Also assert this function loaded ${chalk.gray("(checked against the listing)")}
+  ${chalk.blue("--project, -p <slug>")}    Operate on a project without linking
+
+${chalk.gray("Everything here is read-only. `health` exits non-zero when a check fails,")}
+${chalk.gray("so it works in a deploy script. To restart a workload, use `rebase cloud restart`.")}
+`);
+}
 //#endregion
 //#region src/commands/cloud/resources.ts
 /**
 * `rebase cloud` resource subcommands: status, metrics, webhooks, storage,
 * clusters, billing.
 */
+/**
+* One line describing this project's storage — or `undefined` when the control
+* plane could not be asked, which prints as a blank rather than a guess.
+*
+* `status` used to render the `storages` row and nothing else, so a project
+* whose bucket is configured through its own `STORAGE_TYPE`/`S3_*` variables —
+* the supported path, and the one `mergeStorageEnv` deliberately lets WIN over
+* the row — was reported as `Storage: none` while its pod logged `Initialized
+* storage backends count: 1` against a live bucket. Storage is the thing an app
+* refuses to boot without, so that false negative sends someone off to
+* provision a bucket they already have. The row is not the answer; the tenant's
+* resolved environment is, and the control plane computes it with the same two
+* functions the build log uses.
+*/
+function describeStorageState(state) {
+	const verdict = state?.effective;
+	if (!verdict?.kind) return void 0;
+	const via = state?.overridden ? chalk.gray(" · from env vars") : "";
+	switch (verdict.kind) {
+		case "durable": return `${chalk.green("durable")}${verdict.summary ? ` · ${verdict.summary}` : ""}${via}`;
+		case "ephemeral": return `${chalk.yellow("ephemeral")} ${chalk.gray("· uploads are lost on restart")}`;
+		case "incomplete": return `${chalk.red("incomplete")} ${chalk.gray(`· missing ${(verdict.missing ?? []).join(", ")}`)}`;
+		case "unrecognized": return `${chalk.red("unrecognized")} ${chalk.gray(`· STORAGE_TYPE=${verdict.storageType ?? "?"}`)}`;
+		default: return;
+	}
+}
+/**
+* One line describing the database.
+*
+* `connectionStatus` is written `"untested"` at creation and only ever changed
+* by `rebase cloud db test`, so `managed (untested)` was reporting the absence
+* of a manual test as though it were the database's condition — on a project
+* that had just deployed against it. A never-tested database says only its
+* type; the verdict appears once there is one.
+*/
+function describeDatabaseState(db) {
+	if (!db) return void 0;
+	const type = typeof db.type === "string" ? db.type : "database";
+	const connection = db.connectionStatus;
+	if (connection === "connected" || connection === "failed") return `${type} (${colorStatus(connection)})`;
+	return `${type} ${chalk.gray("· not tested (`rebase cloud db test`)")}`;
+}
 async function statusCommand(rawArgs) {
 	const { client, url } = await requireClient(rawArgs);
 	const projectId = await requireProject(rawArgs, client);
 	try {
 		const project = await client.data.collection("projects").findById(projectId);
-		if (!project) fail(`Project ${displayProjectRef(rawArgs)} not found.`);
+		if (!project) fail(`Project ${displayProjectRef(rawArgs)} not found.`, void 0, "not_found");
 		const [db, storage, deploy, baseDomain] = await Promise.all([
 			firstRow(client, "databases", projectId),
-			firstRow(client, "storages", projectId),
+			client.functions.invoke("storage-provision", void 0, {
+				method: "GET",
+				path: projectId
+			}).catch(() => void 0),
 			latestDeployment(client, projectId),
 			fetchTenantBaseDomain(client, url)
 		]);
-		console.log("");
-		console.log(`  ${chalk.bold(project.name ?? project.subdomain ?? "")} ${chalk.gray(`[${project.subdomain ?? displayProjectRef(rawArgs)}]`)} ${colorStatus(project.status)}`);
-		console.log("");
-		keyValues([
-			["URL", projectHost(project, baseDomain)],
-			["Branch", project.gitBranch],
-			["Last deploy", deploy ? `${colorStatus(deploy.status)} · ${fmtDate(deploy.createdAt)}` : "never"],
-			["Database", db ? `${db.type} (${colorStatus(db.connectionStatus)})` : "none"],
-			["Storage", storage ? `${storage.type} (${colorStatus(storage.status)})` : "none"]
-		]);
-		console.log("");
+		const storageLine = describeStorageState(storage);
+		const databaseLine = describeDatabaseState(db);
+		emit(() => {
+			console.log("");
+			console.log(`  ${chalk.bold(project.name ?? project.subdomain ?? "")} ${chalk.gray(`[${project.subdomain ?? displayProjectRef(rawArgs)}]`)} ${colorStatus(project.status)}`);
+			console.log("");
+			keyValues([
+				["URL", projectHost(project, baseDomain)],
+				["Branch", project.gitBranch],
+				["Last deploy", deploy ? `${colorStatus(deploy.status)} · ${fmtDate(deploy.createdAt)}` : "never"],
+				["Database", databaseLine],
+				["Storage", storageLine]
+			]);
+			console.log("");
+		}, {
+			projectId: String(project.id),
+			name: project.name ?? null,
+			subdomain: project.subdomain ?? null,
+			status: project.status ?? null,
+			url: projectHost(project, baseDomain) ?? null,
+			branch: project.gitBranch ?? null,
+			lastDeploy: deploy ? {
+				id: String(deploy.id),
+				status: deploy.status ?? null,
+				createdAt: deploy.createdAt ?? null
+			} : null,
+			database: db ? {
+				type: db.type ?? null,
+				connectionStatus: db.connectionStatus ?? null
+			} : null,
+			storage: storage ?? null
+		});
 	} catch (e) {
 		reportError(e, "Failed to load status");
 	}
@@ -5271,8 +8176,9 @@ function printStorageHelp() {
 	console.log(chalk.gray("    --region <region>        Region"));
 	console.log(chalk.gray("    --force-path-style       Required by MinIO and some gateways"));
 	console.log("");
-	console.log(chalk.gray("  Without either, a tenant falls back to the container filesystem and"));
-	console.log(chalk.gray("  loses uploaded files on its next restart."));
+	console.log(chalk.gray("  Without either, file storage stays off: uploads are refused with"));
+	console.log(chalk.gray("  501 STORAGE_NOT_CONFIGURED rather than written to a container"));
+	console.log(chalk.gray("  filesystem that is erased on the next restart."));
 	console.log("");
 }
 async function storageCreateCommand(rawArgs) {
@@ -5547,6 +8453,9 @@ async function cloudCommand(subcommand, rawArgs) {
 		case "metrics":
 			await metricsCommand(rawArgs);
 			break;
+		case "debug":
+			await debugCommand(action, rawArgs);
+			break;
 		case "env":
 			await envCommand(action, rawArgs);
 			break;
@@ -5650,14 +8559,15 @@ ${chalk.green.bold("Projects")}
   ${chalk.blue.bold("projects delete")} ${chalk.gray("[id]")}    Delete a project
 
 ${chalk.green.bold("Deploy & observe")}
-  ${chalk.blue.bold("deploy")} ${chalk.gray("[--source .]")}     Deploy the linked project + stream build logs
+  ${chalk.blue.bold("deploy")} ${chalk.gray("[--source .] [-m msg]")}  Deploy the linked project + stream build logs
   ${chalk.blue.bold("logs")} ${chalk.gray("[--runtime] [-f]")}   Show build (or runtime) logs
-  ${chalk.blue.bold("deployments list")}        Deployment history ${chalk.gray("(status, duration, trigger)")}
+  ${chalk.blue.bold("deployments list")} ${chalk.gray("[--limit N|--all]")}  Deployment history ${chalk.gray("(status, duration, trigger)")}
   ${chalk.blue.bold("rollback")} ${chalk.gray("[id] [-y]")}       Roll back to a successful deploy
   ${chalk.blue.bold("cancel")} ${chalk.gray("[-y]")}             Cancel the in-flight build
   ${chalk.blue.bold("start|stop|restart")} ${chalk.gray("[-y]")}  Power ops ${chalk.gray("(stop/restart need -y)")}
   ${chalk.blue.bold("status")}                  One-glance project status
   ${chalk.blue.bold("metrics")}                 Live CPU / memory / disk
+  ${chalk.blue.bold("debug")} ${chalk.gray("[health|logs|…]")}    Diagnose a misbehaving deployment ${chalk.gray("(read-only)")}
 
 ${chalk.green.bold("Config")}
   ${chalk.blue.bold("env list|set|unset|reveal|pull")}
@@ -5692,6 +8602,199 @@ ${chalk.gray("Docs: https://rebase.pro/docs")}
 `);
 }
 //#endregion
+//#region src/commands/apps.ts
+/**
+* CLI command: rebase apps
+*
+* Inspect the apps this repository contributes to a project, adopt a
+* `rebase.json` for a project that predates it, and print the client bootstrap
+* an app needs to reach its backend.
+*
+* The distinction that runs through all of this: a *repository* declares apps,
+* a *project* owns them. Two repositories can contribute to the same project and
+* never know about each other, which is what makes a separate frontend repo — or
+* a mobile app with no repo relationship at all — an ordinary thing rather than
+* a special case.
+*/
+function printHelp$1() {
+	console.log(`
+${chalk.bold("rebase apps")} — the apps this repository contributes
+
+${chalk.bold("Usage")}
+  rebase apps list             List declared apps and their build outputs
+  rebase apps init             Write a rebase.json inferred from this project
+  rebase apps config <app>     Print the client configuration for an app
+
+${chalk.bold("Options")}
+  --json                       Machine-readable output
+  --force                      Overwrite an existing rebase.json (apps init)
+  -h, --help                   Show this help
+`.trim());
+}
+async function appsCommand(subcommand, rawArgs = []) {
+	const args = arg({
+		"--json": Boolean,
+		"--force": Boolean,
+		"--help": Boolean,
+		"-h": "--help"
+	}, {
+		argv: rawArgs.slice(3),
+		permissive: true
+	});
+	if (args["--help"] || !subcommand || subcommand === "--help") {
+		printHelp$1();
+		return;
+	}
+	switch (subcommand) {
+		case "list":
+			await listApps(Boolean(args["--json"]));
+			break;
+		case "init":
+			await initManifest(Boolean(args["--force"]));
+			break;
+		case "config":
+			await printAppConfig(args._[1], Boolean(args["--json"]));
+			break;
+		default:
+			console.error(chalk.red(`Unknown subcommand: ${subcommand}`));
+			console.log("");
+			printHelp$1();
+			process.exit(1);
+	}
+}
+function describeApp(app) {
+	switch (app.type) {
+		case "backend": return `config: ${app.config ?? "config"}, mode: ${app.mode ?? "cms"}`;
+		case "static": return `${app.root} → ${app.output}`;
+		case "admin": return app.mode === "bundled" ? `bundled → ${app.output ?? "?"}` : "hosted by the platform";
+		case "mobile": return app.platform;
+		case "custom": return app.dockerfile ?? "Dockerfile";
+		default: return "";
+	}
+}
+async function listApps(asJson) {
+	const loaded = loadManifestOrExit(requireProjectRoot());
+	const compatibility = assessManagedCompatibility(loaded.manifest);
+	if (asJson) {
+		console.log(JSON.stringify({
+			source: loaded.source,
+			runtime: loaded.manifest.runtime,
+			apps: loaded.manifest.apps,
+			managed: compatibility
+		}, null, 2));
+		return;
+	}
+	if (loaded.source === "synthesized") {
+		console.log(chalk.dim("No rebase.json — showing the layout inferred from this project."));
+		console.log(chalk.dim(`Run ${chalk.cyan("rebase apps init")} to write it down.\n`));
+	}
+	console.log(chalk.bold(`Runtime  ${loaded.manifest.runtime}`));
+	console.log("");
+	const entries = Object.entries(loaded.manifest.apps);
+	if (entries.length === 0) {
+		console.log(chalk.yellow("No apps declared."));
+		return;
+	}
+	const width = Math.max(...entries.map(([name]) => name.length));
+	for (const [name, app] of entries) console.log(`  ${chalk.cyan(name.padEnd(width))}  ${chalk.dim(app.type.padEnd(8))}  ${describeApp(app)}`);
+	console.log("");
+	if (compatibility.eligible) console.log(chalk.green("✓ Eligible for the managed runtime."));
+	else {
+		console.log(chalk.yellow("• Uses the custom runtime:"));
+		for (const reason of compatibility.reasons) console.log(chalk.dim(`    ${reason}`));
+	}
+}
+async function initManifest(force) {
+	const projectRoot = requireProjectRoot();
+	if (manifestExists(projectRoot) && !force) {
+		console.error(chalk.red("✗ rebase.json already exists."));
+		console.error(chalk.dim("  Pass --force to overwrite it."));
+		process.exit(1);
+	}
+	const manifest = synthesizeManifest(projectRoot);
+	const filePath = writeManifest(projectRoot, manifest);
+	console.log(chalk.green(`✓ Wrote ${path.relative(projectRoot, filePath)}`));
+	console.log("");
+	for (const [name, app] of Object.entries(manifest.apps)) console.log(`  ${chalk.cyan(name)} ${chalk.dim(`(${app.type})`)}`);
+	const compatibility = assessManagedCompatibility(manifest);
+	if (!compatibility.eligible) {
+		console.log("");
+		console.log(chalk.yellow("This project will use the custom runtime:"));
+		for (const reason of compatibility.reasons) console.log(chalk.dim(`  ${reason}`));
+	}
+}
+/**
+* Print what a client needs to reach this project.
+*
+* Never prints a secret. The API URL and an app's publishable identity are meant
+* to ship inside a client bundle; anything that is not safe there does not belong
+* in output that will inevitably be pasted into a `.env` that gets committed.
+*/
+async function printAppConfig(appName, asJson) {
+	const projectRoot = requireProjectRoot();
+	const loaded = loadManifestOrExit(projectRoot);
+	if (!appName) {
+		console.error(chalk.red("✗ Which app? Usage: rebase apps config <app>"));
+		process.exit(1);
+	}
+	const app = loaded.manifest.apps[appName];
+	if (!app) {
+		console.error(chalk.red(`✗ No app named "${appName}" in rebase.json.`));
+		console.error(chalk.dim(`  Declared: ${Object.keys(loaded.manifest.apps).join(", ") || "(none)"}`));
+		process.exit(1);
+	}
+	const link = readLink(projectRoot);
+	const apiUrl = resolveApiUrl(projectRoot, link);
+	const config = {
+		app: appName,
+		type: app.type,
+		apiUrl: apiUrl ?? null,
+		project: link?.projectId ?? link?.slug ?? null
+	};
+	if (asJson) {
+		console.log(JSON.stringify(config, null, 2));
+		return;
+	}
+	if (!apiUrl) {
+		console.log(chalk.yellow("This checkout is not linked to a project yet."));
+		console.log(chalk.dim(`  Run ${chalk.cyan("rebase link")} (cloud) or ${chalk.cyan("rebase link <url>")} (self-hosted).`));
+		console.log("");
+	}
+	console.log(chalk.bold(`# ${appName}`));
+	console.log("");
+	console.log(`VITE_API_URL=${apiUrl ?? "http://localhost:3001"}`);
+	console.log("");
+	console.log(chalk.dim("Then, in the app:"));
+	console.log(chalk.dim("  const rebase = createRebaseClient({ baseUrl: import.meta.env.VITE_API_URL });"));
+}
+/**
+* Work out the API base URL for this checkout.
+*
+* Prefers an explicit link, then the dev server's own record of where it bound.
+* The dev port is chosen dynamically, so a hardcoded default would be wrong on
+* any machine running more than one project.
+*/
+function resolveApiUrl(projectRoot, link) {
+	if (link?.apiUrl) return link.apiUrl;
+	const statePath = path.join(projectRoot, ".rebase", "state.json");
+	if (fs.existsSync(statePath)) try {
+		const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		if (state.baseUrl) return state.baseUrl;
+	} catch {}
+}
+function loadManifestOrExit(projectRoot) {
+	try {
+		return loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) {
+			console.error(chalk.red(`✗ ${err.message}`));
+			for (const issue of err.issues) console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : ""}${issue.message}`));
+			process.exit(1);
+		}
+		throw err;
+	}
+}
+//#endregion
 //#region src/cli.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path.dirname(__filename);
@@ -5719,6 +8822,7 @@ async function entry(args) {
 	const command = parsedArgs._[0];
 	const subcommand = parsedArgs._[1];
 	if (!command || parsedArgs["--help"] && ![
+		"init",
 		"schema",
 		"db",
 		"dev",
@@ -5728,7 +8832,9 @@ async function entry(args) {
 		"doctor",
 		"skills",
 		"api-keys",
-		"cloud"
+		"cloud",
+		"apps",
+		"generate-sdk"
 	].includes(command)) {
 		printHelp();
 		return;
@@ -5742,8 +8848,12 @@ async function entry(args) {
 			const sdkArgs = arg({
 				"--collections-dir": String,
 				"--output": String,
+				"--from": String,
+				"--token": String,
+				"--help": Boolean,
 				"-c": "--collections-dir",
-				"-o": "--output"
+				"-o": "--output",
+				"-h": "--help"
 			}, {
 				argv: args.slice(3),
 				permissive: true
@@ -5751,6 +8861,9 @@ async function entry(args) {
 			await generateSdkCommand({
 				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
 				output: sdkArgs["--output"] || "./generated/sdk",
+				from: sdkArgs["--from"],
+				token: sdkArgs["--token"],
+				help: sdkArgs["--help"],
 				cwd: process.cwd()
 			});
 			break;
@@ -5765,10 +8878,13 @@ async function entry(args) {
 			await devCommand(args);
 			break;
 		case "build":
-			await buildCommand();
+			await buildCommand(args);
 			break;
 		case "start":
-			await startCommand();
+			await startCommand(args);
+			break;
+		case "apps":
+			await appsCommand(effectiveSubcommand, args);
 			break;
 		case "auth":
 			await authCommand(effectiveSubcommand, args);
@@ -5849,6 +8965,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { authCommand, buildCommand, buildInitQuestions, cloudCommand, configureEnvFile, createRebaseApp, dbCommand, detectPackageManager, devCommand, doctorCommand, entry, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isPnpmAvailable, requireBackendDir, requireProjectRoot, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, validateProjectName, validateTsxInstallation };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map