@motherbase/cli 0.2.1 → 0.2.3

package/README.md

@@ -84,9 +84,33 @@ Global flags: `--json`, `--yes/-y`, `--project/-p <id>`, `--url/-u <consoleUrl>`
 - **Cron**: `cron list|create|delete|toggle`
 - **Config**: `config list|get|set`
 - **Inspect**: `inspect logs|stats|performance|requests|advisor|shield`
+- **Codegen**: `gen types typescript [--schema public] [--local] [--output <file>] [--check]`
 
 Run `motherbase <group> -h` for per-group usage.
 
+## Type generation
+
+Generate TypeScript definitions for the live schema, in the shape supabase-js
+emits, so `createClient<Database>(url, key)` types every row, rejects unknown
+columns and types `.rpc()` calls:
+
+```bash
+motherbase gen types typescript > database.types.ts
+motherbase gen types typescript --schema shop --output src/shop.types.ts
+```
+
+With no `--output` the file goes to stdout and nothing else does, so the
+redirect above produces a compiling file. `--local` skips the Console proxy and
+talks to a project API on this machine (`MOTHERBASE_URL`, default
+`http://localhost:5001`, with `MOTHERBASE_ADMIN_TOKEN`).
+
+Gate CI on schema drift with `--check`, which never writes and exits non-zero
+when the committed file differs from a fresh generation:
+
+```bash
+motherbase gen types typescript --check --output database.types.ts
+```
+
 ## Supabase migration
 
 Preview a Supabase import without writing to Motherbase:

package/bin/motherbase.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 'use strict';
 
 const { main } = require('../src/main');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Motherbase operator CLI — drives the Platform Console and linked projects.",
   "type": "commonjs",
   "bin": {
@@ -20,5 +20,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {}
 }

package/src/api.js

@@ -36,6 +36,14 @@ function unwrap(body) {
   return body;
 }
 
+// Non-browser clients send no Origin header. Better Auth (and reverse proxies
+// that inject cookies) then treat the request as CSRF-suspect and reject it with
+// "Missing or null Origin". Sending the target's own origin — which the server
+// keeps in its trustedOrigins (baseURL) — satisfies that check for every route.
+function originFor(url) {
+  try { return new URL(url).origin; } catch { return undefined; }
+}
+
 function errorMessage(status, body, text) {
   const snippet = (body && (body.message || body.error)) || (text ? text.slice(0, 300) : '');
   if (status === 401) {
@@ -65,6 +73,10 @@ async function parseResponse(res) {
 async function doFetch(url, { method = 'GET', token, body, headers = {} } = {}) {
   const finalHeaders = { ...headers };
   if (token) finalHeaders['authorization'] = `Bearer ${token}`;
+  if (!finalHeaders['origin']) {
+    const origin = originFor(url);
+    if (origin) finalHeaders['origin'] = origin;
+  }
   let payload;
   if (body !== undefined && body !== null) {
     finalHeaders['content-type'] = 'application/json';
@@ -94,9 +106,12 @@ async function loginRequest(consoleUrl, email, password) {
   const url = `${consoleUrl}/api/auth/sign-in/email`;
   let res;
   try {
+    const headers = { 'content-type': 'application/json' };
+    const origin = originFor(url);
+    if (origin) headers['origin'] = origin;
     res = await fetch(url, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers,
       body: JSON.stringify({ email, password }),
     });
   } catch (err) {
@@ -128,12 +143,19 @@ function adminRequest(ctx, method, apiPath, { body, query } = {}) {
   return doFetch(url, { method, token, body });
 }
 
+// The public URL of a project path (`/edge/<route>`, `/rest/v1/<table>`), for
+// printing. Mirrors how the proxy addresses a project in each mode.
+function projectUrl(ctx, projectPath) {
+  const target = ctx.requireProject();
+  return target.mode === 'direct'
+    ? `${target.baseUrl}/api${projectPath}`
+    : `${target.consoleUrl}/api/projects/${target.projectId}${projectPath}`;
+}
+
 // Edge invoke goes through the un-authenticated edge route, not /admin.
 function edgeInvokeRequest(ctx, route, body) {
+  const url = projectUrl(ctx, `/edge/${encodeURIComponent(route)}`);
   const target = ctx.requireProject();
-  const url = target.mode === 'direct'
-    ? `${target.baseUrl}/api/edge/${encodeURIComponent(route)}`
-    : `${target.consoleUrl}/api/projects/${target.projectId}/edge/${encodeURIComponent(route)}`;
   return doFetch(url, { method: 'POST', token: target.token, body: body || {} });
 }
 
@@ -149,11 +171,14 @@ async function uploadFile(ctx, apiPath, filePath, fields = {}) {
   for (const [k, v] of Object.entries(fields)) {
     if (v !== undefined && v !== null) form.append(k, String(v));
   }
+  const uploadHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const uploadOrigin = originFor(url);
+  if (uploadOrigin) uploadHeaders['origin'] = uploadOrigin;
   let res;
   try {
     res = await fetch(url, {
       method: 'POST',
-      headers: token ? { authorization: `Bearer ${token}` } : {},
+      headers: uploadHeaders,
       body: form,
     });
   } catch (err) {
@@ -168,9 +193,12 @@ async function downloadFile(ctx, apiPath, destPath, { query } = {}) {
   const target = ctx.requireProject();
   const { base, token } = adminBase(target);
   const url = `${base}${apiPath}${buildQuery(query)}`;
+  const dlHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const dlOrigin = originFor(url);
+  if (dlOrigin) dlHeaders['origin'] = dlOrigin;
   let res;
   try {
-    res = await fetch(url, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+    res = await fetch(url, { headers: dlHeaders });
   } catch (err) {
     throw new CliError(`Cannot reach ${url}: ${err.message}`);
   }
@@ -193,6 +221,7 @@ module.exports = {
   loginRequest,
   adminRequest,
   edgeInvokeRequest,
+  projectUrl,
   uploadFile,
   downloadFile,
   buildQuery,

package/src/commands/functions.js

@@ -1,112 +1,274 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const api = require('../api');
-const ui = require('../ui');
-const { output, requireArg } = require('./_util');
-const { CliError } = require('../context');
-
-const subcommands = {
-  list: {
-    summary: 'List edge functions',
-    usage: 'motherbase functions list',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/edge-functions');
-      const rows = (data && data.functions) || [];
-      output(ctx, data, (_d, u) =>
-        u.table(rows, [
-          { key: 'id', label: 'ID' },
-          { key: 'name', label: 'NAME' },
-          { key: 'route', label: 'ROUTE' },
-          { key: 'enabled', label: 'ENABLED' },
-        ]),
-      );
-    },
-  },
-  get: {
-    summary: 'Get an edge function by id',
-    usage: 'motherbase functions get <id>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'id');
-      const data = await api.adminRequest(ctx, 'GET', `/edge-functions/${id}`);
-      output(ctx, data, (d, u) => u.keyValue((d && d.function) || d || {}));
-    },
-  },
-  new: {
-    summary: 'Scaffold a local edge function file',
-    usage: 'motherbase functions new <name>',
-    async run(ctx, args) {
-      const name = requireArg(args[0], 'name');
-      const dir = path.join(ctx.cwd, 'motherbase', 'functions');
-      fs.mkdirSync(dir, { recursive: true });
-      const file = path.join(dir, `${name}.js`);
-      fs.writeFileSync(file, `// Edge function: ${name}\n// The resolved value of this expression becomes the response body.\nasync () => {\n  return { hello: '${name}', at: new Date().toISOString() };\n}\n`);
-      ui.success(`Created ${path.relative(ctx.cwd, file)}`);
-    },
-  },
-  deploy: {
-    summary: 'Create or update an edge function (upsert by route)',
-    usage: 'motherbase functions deploy --name <n> --route <r> --file <f.js>',
-    async run(ctx, args, flags) {
-      const route = flags.route || args[0];
-      const file = flags.file || args[1];
-      const name = flags.name || route;
-      if (!route) throw new CliError('--route is required');
-      if (!file) throw new CliError('--file <f.js> is required');
-      const code = fs.readFileSync(path.resolve(ctx.cwd, file), 'utf8');
-
-      // Upsert: PATCH the existing function when a matching route is present.
-      const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
-      const existing = ((listing && listing.functions) || []).find(f => f.route === route);
-      let data;
-      if (existing) {
-        data = await api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body: { name, route, code } });
-      } else {
-        data = await api.adminRequest(ctx, 'POST', '/edge-functions', { body: { name, route, code, enabled: true } });
-      }
-      output(ctx, data, (d, u) => u.success(`Deployed function ${name} (${route})`));
-    },
-  },
-  delete: {
-    summary: 'Delete an edge function by id',
-    usage: 'motherbase functions delete <id>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'id');
-      const data = await api.adminRequest(ctx, 'DELETE', `/edge-functions/${id}`);
-      output(ctx, data, (d, u) => u.success(`Deleted function ${id}`));
-    },
-  },
-  invoke: {
-    summary: 'Invoke an edge function by route',
-    usage: 'motherbase functions invoke <route> [--body <json>]',
-    async run(ctx, args, flags) {
-      const route = requireArg(args[0], 'route');
-      let body = {};
-      if (flags.body) {
-        try { body = JSON.parse(flags.body); } catch { throw new CliError('--body must be valid JSON'); }
-      }
-      const data = await api.edgeInvokeRequest(ctx, route, body);
-      output(ctx, data, (d, u) => u.json(d));
-    },
-  },
-  logs: {
-    summary: 'Show logs for an edge function',
-    usage: 'motherbase functions logs <id>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'id');
-      const data = await api.adminRequest(ctx, 'GET', `/edge-functions/${id}/logs`);
-      output(ctx, data, (d, u) => {
-        const logs = (d && d.logs) || d || [];
-        if (Array.isArray(logs)) logs.forEach(l => u.print(typeof l === 'string' ? l : JSON.stringify(l)));
-        else u.json(d);
-      });
-    },
-  },
-};
-
-module.exports = {
-  summary: 'Edge functions (list/deploy/invoke/logs)',
-  usage: 'motherbase functions <list|get|new|deploy|delete|invoke|logs> ...',
-  subcommands,
-};
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const ui = require('../ui');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+// Functions live as repo files, one directory per function, the layout Supabase
+// projects already use:
+//
+//   functions/
+//     stripe-webhook/
+//       index.ts
+//
+// The directory name is both the function name and its route, so deploying is
+// `motherbase functions deploy` with nothing to remember.
+const DEFAULT_DIR = 'functions';
+const LEGACY_DIR = path.join('motherbase', 'functions');
+const ENTRY_NAMES = ['index.ts', 'index.js', 'index.mjs'];
+
+const TEMPLATE = `// Edge function: %NAME%
+//
+// Runs in a V8 isolate with the Fetch API available: Request, Response,
+// Headers, URL, TextEncoder/TextDecoder and crypto (including subtle.sign, for
+// webhook signature checks). npm imports are resolved at deploy time:
+//
+//   import { z } from 'zod';
+//
+// \`env\` holds this project's edge secrets.
+
+export default async (req: Request) => {
+  const body = req.method === 'GET' ? {} : await req.json().catch(() => ({}));
+  return Response.json({ hello: '%NAME%', received: body, at: new Date().toISOString() });
+};
+`;
+
+function functionsDir(ctx) {
+  for (const candidate of [DEFAULT_DIR, LEGACY_DIR]) {
+    if (fs.existsSync(path.join(ctx.cwd, candidate))) return path.join(ctx.cwd, candidate);
+  }
+  return path.join(ctx.cwd, DEFAULT_DIR);
+}
+
+/** Entry file of a function directory, or null when it has none. */
+function entryFile(dir) {
+  for (const name of ENTRY_NAMES) {
+    const file = path.join(dir, name);
+    if (fs.existsSync(file)) return file;
+  }
+  return null;
+}
+
+/** Every locally defined function: `{ name, dir, entry }`. */
+function localFunctions(ctx) {
+  const root = functionsDir(ctx);
+  if (!fs.existsSync(root)) return [];
+  return fs
+    .readdirSync(root, { withFileTypes: true })
+    .filter(item => item.isDirectory())
+    .map(item => ({ name: item.name, dir: path.join(root, item.name), entry: entryFile(path.join(root, item.name)) }))
+    .filter(fn => fn.entry);
+}
+
+function resolveLocal(ctx, name) {
+  const all = localFunctions(ctx);
+  if (!name) return all;
+  const hit = all.find(fn => fn.name === name);
+  if (!hit) {
+    const expected = path.relative(ctx.cwd, path.join(functionsDir(ctx), name, 'index.ts'));
+    throw new CliError(`No local function "${name}". Expected ${expected}.`);
+  }
+  return [hit];
+}
+
+/** Upsert by route, so deploying twice updates instead of conflicting. */
+async function deployOne(ctx, fn, flags) {
+  const code = fs.readFileSync(fn.entry, 'utf8');
+  const body = { name: fn.name, route: fn.name, code };
+  if (flags && flags.memory) body.memoryLimitMb = Number(flags.memory);
+  if (flags && flags.timeout) body.timeoutMs = Number(flags.timeout);
+
+  const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+  const existing = ((listing && listing.functions) || []).find(f => f.route === fn.name);
+  if (existing) return api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body });
+  return api.adminRequest(ctx, 'POST', '/edge-functions', { body: { ...body, enabled: true } });
+}
+
+const subcommands = {
+  list: {
+    summary: 'List edge functions',
+    usage: 'motherbase functions list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/edge-functions');
+      const rows = (data && data.functions) || [];
+      output(ctx, data, (_d, u) =>
+        u.table(rows, [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'route', label: 'ROUTE' },
+          { key: 'enabled', label: 'ENABLED' },
+        ]),
+      );
+    },
+  },
+  get: {
+    summary: 'Get an edge function by id',
+    usage: 'motherbase functions get <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/edge-functions/${id}`);
+      output(ctx, data, (d, u) => u.keyValue((d && d.function) || d || {}));
+    },
+  },
+  new: {
+    summary: 'Scaffold functions/<name>/index.ts',
+    usage: 'motherbase functions new <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+        throw new CliError('Function names are lowercase letters, digits and hyphens (the name is also the route).');
+      }
+      const dir = path.join(functionsDir(ctx), name);
+      if (entryFile(dir)) throw new CliError(`${path.relative(ctx.cwd, dir)} already has an entry file.`);
+      fs.mkdirSync(dir, { recursive: true });
+      const file = path.join(dir, 'index.ts');
+      fs.writeFileSync(file, TEMPLATE.replace(/%NAME%/g, name));
+      ui.success(`Created ${path.relative(ctx.cwd, file)}`);
+      ui.info(`Deploy it with: motherbase functions deploy ${name}`);
+    },
+  },
+  deploy: {
+    summary: 'Deploy local functions (all of them, or one by name)',
+    usage: 'motherbase functions deploy [name] [--memory <mb>] [--timeout <ms>] [--file <f> --route <r>]',
+    async run(ctx, args, flags) {
+      // The single-file form predates the directory layout and stays supported:
+      // scripts and older docs pass --file.
+      if (flags.file) {
+        const route = flags.route || args[0];
+        if (!route) throw new CliError('--route is required with --file');
+        const code = fs.readFileSync(path.resolve(ctx.cwd, flags.file), 'utf8');
+        const name = flags.name || route;
+        const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+        const existing = ((listing && listing.functions) || []).find(f => f.route === route);
+        const data = existing
+          ? await api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body: { name, route, code } })
+          : await api.adminRequest(ctx, 'POST', '/edge-functions', { body: { name, route, code, enabled: true } });
+        return output(ctx, data, (_d, u) => u.success(`Deployed function ${name} (${route})`));
+      }
+
+      const targets = resolveLocal(ctx, args[0]);
+      if (!targets.length) {
+        const where = path.relative(ctx.cwd, functionsDir(ctx));
+        throw new CliError(`No functions in ${where}. Create one with: motherbase functions new <name>`);
+      }
+
+      const deployed = [];
+      for (const fn of targets) {
+        await deployOne(ctx, fn, flags);
+        deployed.push(fn.name);
+      }
+      output(ctx, { deployed }, (_d, u) => u.success(`Deployed ${deployed.join(', ')}`));
+    },
+  },
+  pull: {
+    summary: 'Write deployed function source back to disk',
+    usage: 'motherbase functions pull [name]',
+    async run(ctx, args) {
+      const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+      const all = (listing && listing.functions) || [];
+      const wanted = args[0] ? all.filter(f => f.route === args[0] || f.name === args[0]) : all;
+      if (!wanted.length) throw new CliError(args[0] ? `No deployed function "${args[0]}"` : 'No deployed functions');
+
+      const written = [];
+      for (const fn of wanted) {
+        // The list endpoint may omit code, so read the function itself.
+        const detail = await api.adminRequest(ctx, 'GET', `/edge-functions/${fn.id}`);
+        const code = (detail && detail.function ? detail.function.code : detail && detail.code) || '';
+        const dir = path.join(functionsDir(ctx), fn.route || fn.name);
+        fs.mkdirSync(dir, { recursive: true });
+        const file = path.join(dir, 'index.ts');
+        fs.writeFileSync(file, code);
+        written.push(path.relative(ctx.cwd, file));
+      }
+      output(ctx, { written }, (_d, u) => u.success(`Wrote ${written.join(', ')}`));
+    },
+  },
+  serve: {
+    summary: 'Watch local functions and redeploy on every save',
+    usage: 'motherbase functions serve [name]',
+    async run(ctx, args) {
+      // Deliberately not a second local runtime. The isolate, the secrets and
+      // the bundler all live in the project API, and a local re-implementation
+      // would differ from production in exactly the ways that matter. This
+      // watches and redeploys instead, so the edit-invoke loop is one save long.
+      const targets = resolveLocal(ctx, args[0]);
+      if (!targets.length) {
+        throw new CliError('Nothing to serve. Create a function with: motherbase functions new <name>');
+      }
+
+      for (const fn of targets) {
+        await deployOne(ctx, fn);
+        ui.success(`Deployed ${fn.name}`);
+        ui.info(`  POST ${api.projectUrl(ctx, `/edge/${fn.name}`)}`);
+      }
+      ui.info('Watching for changes. Ctrl-C to stop.');
+
+      const pending = new Map();
+      for (const fn of targets) {
+        fs.watch(fn.dir, { recursive: true }, () => {
+          // Editors save in bursts (write, rename, truncate). Coalescing them
+          // keeps one save from becoming three deploys.
+          clearTimeout(pending.get(fn.name));
+          pending.set(
+            fn.name,
+            setTimeout(async () => {
+              try {
+                await deployOne(ctx, fn);
+                ui.success(`Redeployed ${fn.name} at ${new Date().toLocaleTimeString()}`);
+              } catch (error) {
+                ui.warn(`${fn.name}: ${error.message}`);
+              }
+            }, 150),
+          );
+        });
+      }
+
+      // Hold the process open; the watchers are the work.
+      await new Promise(() => {});
+    },
+  },
+  delete: {
+    summary: 'Delete an edge function by id',
+    usage: 'motherbase functions delete <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'DELETE', `/edge-functions/${id}`);
+      output(ctx, data, (d, u) => u.success(`Deleted function ${id}`));
+    },
+  },
+  invoke: {
+    summary: 'Invoke an edge function by route',
+    usage: 'motherbase functions invoke <route> [--body <json>]',
+    async run(ctx, args, flags) {
+      const route = requireArg(args[0], 'route');
+      let body = {};
+      if (flags.body) {
+        try { body = JSON.parse(flags.body); } catch { throw new CliError('--body must be valid JSON'); }
+      }
+      const data = await api.edgeInvokeRequest(ctx, route, body);
+      output(ctx, data, (d, u) => u.json(d));
+    },
+  },
+  logs: {
+    summary: 'Show logs for an edge function',
+    usage: 'motherbase functions logs <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/edge-functions/${id}/logs`);
+      output(ctx, data, (d, u) => {
+        const logs = (d && d.logs) || d || [];
+        if (Array.isArray(logs)) logs.forEach(l => u.print(typeof l === 'string' ? l : JSON.stringify(l)));
+        else u.json(d);
+      });
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Edge functions (repo files, deploy, invoke, logs)',
+  usage: 'motherbase functions <list|get|new|deploy|pull|serve|delete|invoke|logs> ...',
+  subcommands,
+};

package/src/commands/gen.js

@@ -0,0 +1,126 @@
+'use strict';
+
+// Code generation from the live schema. Today: TypeScript database types.
+//
+// The server owns the emitter (apps/server/services/admin/typegen.service.ts).
+// This command is a transport: it asks `GET /admin/schema/types` for the
+// rendered file and writes it. Re-implementing the emitter here would guarantee
+// drift between the CLI, the Studio download and the MCP tool within a release.
+
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const config = require('../config');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+const DEFAULT_OUTPUT = 'database.types.ts';
+const DEFAULT_LOCAL_URL = 'http://localhost:5001';
+
+/**
+ * `--local` bypasses the Console proxy and talks straight to a project API on
+ * this machine, which is how someone iterating on a local stack works: there is
+ * no console account, no link file, just a server on a port. Everything else
+ * about the context (flags, cwd, json mode) is preserved.
+ */
+function resolveTarget(ctx, flags) {
+  if (!flags.local) return ctx;
+  const baseUrl = config.normalizeUrl(flags.url || ctx.env.MOTHERBASE_URL || DEFAULT_LOCAL_URL);
+  const token = flags.token || ctx.env.MOTHERBASE_ADMIN_TOKEN || ctx.token;
+  return Object.assign({}, ctx, {
+    mode: 'direct',
+    requireProject: () => ({ mode: 'direct', baseUrl, token }),
+  });
+}
+
+// Git checkouts on Windows may rewrite line endings. The generator always emits
+// LF, so compare on normalised text: a CRLF working copy is not schema drift.
+function normalize(text) {
+  return String(text).replace(/\r\n/g, '\n');
+}
+
+/** First line where the two files diverge, 1-based, for a useful error. */
+function firstDifference(a, b) {
+  const left = normalize(a).split('\n');
+  const right = normalize(b).split('\n');
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    if (left[i] !== right[i]) {
+      return { line: i + 1, expected: right[i], actual: left[i] };
+    }
+  }
+  return null;
+}
+
+const typescript = {
+  summary: 'Generate TypeScript types for the database schema',
+  usage:
+    'motherbase gen types typescript [--schema public] [--local] [--output database.types.ts] [--check]',
+  async run(ctx, args, flags) {
+    const schema = flags.schema || 'public';
+    const data = await api.adminRequest(resolveTarget(ctx, flags), 'GET', '/schema/types', {
+      query: { schema },
+    });
+
+    const types = data && typeof data.types === 'string' ? data.types : null;
+    if (!types) {
+      throw new CliError(
+        'The server returned no generated types. Check that the project runs a build with GET /admin/schema/types.',
+      );
+    }
+
+    const outputPath = flags.output && flags.output !== true ? String(flags.output) : null;
+
+    // --check is the CI drift gate: compare the committed file with a fresh
+    // generation and fail loudly, without ever writing.
+    if (flags.check) {
+      const target = path.resolve(ctx.cwd, outputPath || DEFAULT_OUTPUT);
+      if (!fs.existsSync(target)) {
+        throw new CliError(`${target} does not exist. Run \`motherbase gen types typescript --output ${outputPath || DEFAULT_OUTPUT}\`.`);
+      }
+      const onDisk = fs.readFileSync(target, 'utf8');
+      const diff = firstDifference(onDisk, types);
+      if (diff) {
+        throw new CliError(
+          `${target} is out of date with the ${schema} schema (first difference at line ${diff.line}).\n` +
+            `  on disk:   ${diff.actual === undefined ? '(end of file)' : diff.actual}\n` +
+            `  generated: ${diff.expected === undefined ? '(end of file)' : diff.expected}\n` +
+            'Re-run without --check to update it.',
+        );
+      }
+      output(ctx, { schema, output: target, upToDate: true }, (d, ui) =>
+        ui.success(`${target} is up to date`),
+      );
+      return;
+    }
+
+    // No --output: write the file to stdout so `... > database.types.ts` works.
+    // Nothing else may go to stdout on this path or it lands in the file.
+    if (!outputPath) {
+      if (ctx.flags.json) {
+        output(ctx, { schema, types }, () => {});
+        return;
+      }
+      process.stdout.write(types);
+      return;
+    }
+
+    const target = path.resolve(ctx.cwd, outputPath);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, types, 'utf8');
+    output(ctx, { schema, output: target, bytes: Buffer.byteLength(types) }, (d, ui) =>
+      ui.success(`Wrote ${target} (${schema} schema)`),
+    );
+  },
+};
+
+const types = {
+  summary: 'Generate types from the database schema',
+  usage: 'motherbase gen types typescript [flags]',
+  subcommands: { typescript },
+};
+
+module.exports = {
+  summary: 'Generate code from the live schema',
+  usage: 'motherbase gen types typescript [--schema public] [--local] [--output <file>] [--check]',
+  subcommands: { types },
+};

package/src/commands/index.js

@@ -41,6 +41,9 @@ const registry = {
   cron: require('./cron'),
   config: require('./config'),
   inspect: require('./inspect'),
+
+  // ── Codegen ────────────────────────────────────────────────────────────────
+  gen: require('./gen'),
 };
 
 // Grouping used only to render a tidy top-level help listing.
@@ -50,6 +53,7 @@ const groups = [
   { title: 'Local self-host', names: ['init', 'start', 'stop', 'deploy', 'logs'] },
   { title: 'Database', names: ['db', 'migrations', 'migration', 'import'] },
   { title: 'Resources', names: ['rls', 'users', 'storage', 'functions', 'secrets', 'realtime', 'webhooks', 'cron', 'config', 'inspect'] },
+  { title: 'Codegen', names: ['gen'] },
 ];
 
 module.exports = { registry, groups };

package/src/commands/rls.js

@@ -76,10 +76,101 @@ const subcommands = {
     },
   },
   policy,
+  preset: {
+    summary: 'Apply a policy preset to a table',
+    usage:
+      'motherbase rls preset <table> <starter|public_crud|authenticated_crud|admin_only|blocked|owner_only|org_scoped|public_read_owner_write|soft_delete> [--owner-column c] [--org-column c] [--org-claim c] [--deleted-column c] [--replace]',
+    async run(ctx, args, flags) {
+      const table = requireArg(args[0], 'table');
+      const preset = requireArg(args[1], 'preset');
+      const body = { preset };
+      if (flags['owner-column']) body.ownerColumn = flags['owner-column'];
+      if (flags['org-column']) body.orgColumn = flags['org-column'];
+      if (flags['org-claim']) body.orgClaim = flags['org-claim'];
+      if (flags['deleted-column']) body.deletedColumn = flags['deleted-column'];
+      if (flags.replace) body.replace = true;
+      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/preset`, { body });
+      output(ctx, data, (d, ui) =>
+        ui.success(`Applied ${preset} to ${table}: ${(d && d.policies ? d.policies : []).join(', ')}`)
+      );
+    },
+  },
+  simulate: {
+    summary: 'Run a query as a given caller and show what RLS lets through',
+    usage:
+      'motherbase rls simulate --sql "select * from t" [--as anon|authenticated|<userId>] [--claims \'{"org_id":"x"}\'] [--limit n]',
+    async run(ctx, args, flags) {
+      const sql = flags.sql || args.join(' ');
+      if (!sql) throw new CliError('--sql is required');
+
+      // `--as` takes a role or a user id. A value that is not one of the two
+      // roles is treated as a user id, which is what makes "as this person"
+      // spellable without looking their claims up by hand.
+      const as = flags.as || 'anon';
+      const body = { sql };
+      if (as === 'anon' || as === 'authenticated') body.role = as;
+      else body.userId = as;
+      if (flags.claims) {
+        try {
+          body.claims = JSON.parse(flags.claims);
+        } catch {
+          throw new CliError('--claims must be a JSON object');
+        }
+      }
+      if (flags.limit) body.limit = Number(flags.limit);
+
+      const data = await api.adminRequest(ctx, 'POST', '/rls/simulate', { body });
+      output(ctx, data, (d, ui) => {
+        if (d.denied) {
+          ui.warn(`Refused by Postgres: ${d.denied.message}`);
+        }
+        if (d.rows && d.rows.length) {
+          ui.table(d.rows, (d.columns || []).map(key => ({ key, label: key.toUpperCase() })));
+        } else {
+          ui.info('0 rows');
+        }
+        if (d.truncated) ui.info(`Truncated at ${d.rowCount} rows.`);
+        for (const t of d.tables || []) {
+          const reason =
+            t.deniedBy === 'grant'
+              ? 'no privilege for this role'
+              : t.deniedBy === 'policy'
+                ? 'RLS on, no policy grants this role read access'
+                : null;
+          ui.info(`${t.schema}.${t.table}: RLS ${t.rlsEnabled ? 'on' : 'off'}${reason ? ` (${reason})` : ''}`);
+          for (const p of t.policies || []) {
+            ui.info(`  ${p.applies ? '*' : ' '} ${p.name} ${p.command} to ${p.roles.join(',')}: ${p.using || 'true'}`);
+          }
+        }
+      });
+    },
+  },
+  lint: {
+    summary: 'Run the security and performance advisor',
+    usage: 'motherbase rls lint [--level critical|warning|info]',
+    async run(ctx, args, flags) {
+      const data = await api.adminRequest(ctx, 'GET', '/advisor');
+      const findings = (data && data.findings ? data.findings : []).filter(
+        f => !flags.level || f.level === flags.level
+      );
+      output(ctx, { ...data, findings }, (d, ui) => {
+        if (!findings.length) return ui.success('No findings.');
+        ui.table(
+          findings.map(f => ({ level: f.level, id: f.id, target: f.target, title: f.title })),
+          [
+            { key: 'level', label: 'LEVEL' },
+            { key: 'id', label: 'RULE' },
+            { key: 'target', label: 'TARGET' },
+            { key: 'title', label: 'FINDING' },
+          ]
+        );
+      });
+    },
+  },
 };
 
 module.exports = {
-  summary: 'Row-level security (tables + policies)',
-  usage: 'motherbase rls <list|enable|disable|policy> ...',
+  summary: 'Row-level security (tables, policies, presets, simulator, lint)',
+  usage: 'motherbase rls <list|enable|disable|policy|preset|simulate|lint> ...',
   subcommands,
 };

package/src/main.js

@@ -8,6 +8,11 @@ const ui = require('./ui');
 // Flags that never consume a following value.
 const PURE_BOOLEAN = new Set([
   'json', 'yes', 'help', 'version', 'force', 'preview', 'app', 'no-data', 'no-auth', 'f',
+  // Codegen: `--check` and `--local` never take a value, so a trailing
+  // `--check database.types.ts` must not silently swallow the path.
+  'check', 'local',
+  // `rls preset <table> <preset> --replace` must not swallow a following word.
+  'replace',
 ]);
 // Short flag aliases → canonical (with whether they take a value).
 const SHORT = {

package/src/prompt.js

@@ -14,23 +14,70 @@ function question(query) {
   });
 }
 
-// Hidden input: we mute the output stream by intercepting writes so the typed
-// characters (and the password) never echo.
+// Hidden input. Reads the TTY in raw mode so nothing echoes, masking each typed
+// character with '*'. Handles backspace, Enter, Ctrl+C, Ctrl+D and swallows
+// escape sequences (arrow keys etc.) so they never land in the value. When
+// stdin is not a TTY (pipes, CI) we fall back to a plain, unmasked line read.
 function password(query = 'Password: ') {
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  if (!stdin.isTTY) return question(query);
+
   return new Promise(resolve => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-    const onData = () => {
-      // Overwrite whatever readline just echoed with the prompt only.
-      process.stdout.write(`\r${query}`);
+    let value = '';
+    let inEscape = false;
+    stdout.write(query);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding('utf8');
+
+    const done = result => {
+      stdin.removeListener('data', onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdout.write('\n');
+      resolve(result);
     };
-    process.stdout.write(query);
-    process.stdin.on('data', onData);
-    rl.question('', answer => {
-      process.stdin.removeListener('data', onData);
-      rl.close();
-      process.stdout.write('\n');
-      resolve(answer);
-    });
+
+    const onData = chunk => {
+      for (const ch of chunk) {
+        if (inEscape) {
+          // Terminators of a CSI/escape sequence (e.g. arrow keys): stop swallowing.
+          if (/[a-zA-Z~]/.test(ch)) inEscape = false;
+          continue;
+        }
+        switch (ch) {
+          case '\r':
+          case '\n':
+          case '\u0004': // Ctrl-D
+            return done(value);
+          case '\u0003': // Ctrl-C
+            stdin.setRawMode(false);
+            stdin.pause();
+            stdout.write('\n');
+            process.exit(130);
+            return;
+          case '\u007f': // Backspace / Delete
+          case '\b':
+            if (value.length > 0) {
+              value = value.slice(0, -1);
+              stdout.write('\b \b');
+            }
+            break;
+          case '\u001b': // ESC — start of an escape sequence
+            inEscape = true;
+            break;
+          default:
+            // Ignore remaining control characters; mask printable ones.
+            if (ch >= ' ') {
+              value += ch;
+              stdout.write('*');
+            }
+        }
+      }
+    };
+
+    stdin.on('data', onData);
   });
 }