@motherbase/cli 0.2.3 → 0.2.5

package/src/commands/migration.js

@@ -1,14 +1,21 @@
 'use strict';
 
-// `migration new <name>` — local scaffold only. The real migration lifecycle
-// (list/apply/rollback) lives under the `migrations` group and hits the server.
+// `migration`: Supabase's name for the group. The server-side lifecycle
+// (list/diff/get/create/apply/rollback) and the local `new` scaffold live
+// together here; `migrations` is registered as an alias of this entry.
 
 const fs = require('fs');
 const path = require('path');
+const api = require('../api');
 const ui = require('../ui');
-const { requireArg } = require('./_util');
+const { output, requireArg } = require('./_util');
 const { CliError } = require('../context');
 
+function readSql(cwd, file) {
+  if (!file) return undefined;
+  return fs.readFileSync(path.resolve(cwd, file), 'utf8');
+}
+
 const subcommands = {
   new: {
     summary: 'Scaffold a local migration .sql file',
@@ -20,14 +27,82 @@ const subcommands = {
       fs.mkdirSync(dir, { recursive: true });
       const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+/, '').replace('T', '');
       const file = path.join(dir, `${stamp}_${name}.sql`);
-      fs.writeFileSync(file, `-- Migration: ${name}\n-- Up\n\n\n-- Down (optional; keep in a separate file for \`migrations create --down\`)\n`);
+      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`);
       ui.success(`Created ${path.relative(ctx.cwd, file)}`);
     },
   },
+  list: {
+    summary: 'List schema migrations',
+    usage: 'motherbase migration list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/migrations');
+      const rows = (data && data.migrations) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(rows, [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'status', label: 'STATUS' },
+          { key: 'appliedAt', label: 'APPLIED' },
+        ]),
+      );
+    },
+  },
+  diff: {
+    summary: 'Show a diff between live schema and migrations',
+    usage: 'motherbase migration diff',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/migrations/diff');
+      output(ctx, data, (d, ui) => ui.json(d));
+    },
+  },
+  get: {
+    summary: 'Show a single migration',
+    usage: 'motherbase migration get <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/migrations/${id}`);
+      output(ctx, data, (d, ui) => ui.keyValue((d && d.migration) || d || {}));
+    },
+  },
+  create: {
+    summary: 'Create a migration from up/down SQL files',
+    usage: 'motherbase migration create --name <name> --up <file.sql> [--down <file.sql>]',
+    async run(ctx, args, flags) {
+      const name = flags.name || args[0];
+      if (!name) throw new CliError('--name is required');
+      const upSql = readSql(ctx.cwd, flags.up);
+      const downSql = readSql(ctx.cwd, flags.down);
+      if (!upSql) throw new CliError('--up <file.sql> is required');
+      const data = await api.adminRequest(ctx, 'POST', '/migrations', { body: { name, upSql, downSql } });
+      output(ctx, data, (d, ui) => ui.success(`Created migration ${name}`));
+    },
+  },
+  apply: {
+    summary: 'Apply a migration',
+    usage: 'motherbase migration apply <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'POST', `/migrations/${id}/apply`);
+      output(ctx, data, (d, ui) => ui.success(`Applied ${id}`));
+    },
+  },
+  rollback: {
+    summary: 'Roll back a migration',
+    usage: 'motherbase migration rollback <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'POST', `/migrations/${id}/rollback`);
+      output(ctx, data, (d, ui) => ui.success(`Rolled back ${id}`));
+    },
+  },
 };
 
+// The local-files workflow (list/up/down/repair/squash/fetch) lives with its
+// helpers in ../migration.
+Object.assign(subcommands, require('../migration/commands').migrationSubcommands);
+
 module.exports = {
-  summary: 'Scaffold local migration files',
-  usage: 'motherbase migration new <name>',
+  summary: 'Schema migrations: local files and the remote history',
+  usage: 'motherbase migration <new|list|up|down|repair|squash|fetch|diff|get|create|apply|rollback> ...',
   subcommands,
 };

package/src/commands/network.js

@@ -0,0 +1,83 @@
+'use strict';
+
+// Who may open a direct Postgres connection (Supabase's `network-restrictions`
+// and `ssl-enforcement`). Both are project admin routes, so they work through
+// the Console proxy and in direct mode alike.
+
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+function renderRestrictions(d, ui) {
+  ui.keyValue({
+    'IPv4 allowed': d.dbAllowedCidrs.join(', ') || '(none)',
+    'IPv6 allowed': d.dbAllowedCidrsV6.join(', ') || '(none)',
+    status: d.status,
+    exposure: d.exposure,
+  });
+  if (d.status !== 'applied') ui.warn('Stored only: this API does not manage its database access (not a Console stack).');
+  if (d.exposure !== 'public') ui.info('The database port is not public, so only the stack and SSH tunnels reach it today.');
+}
+
+const networkRestrictions = {
+  summary: 'IP ranges allowed to connect to the database directly',
+  usage: 'motherbase network-restrictions <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show the allowed ranges',
+      usage: 'motherbase network-restrictions get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/network-restrictions'), renderRestrictions);
+      },
+    },
+    update: {
+      summary: 'Replace the allowed ranges (repeat --db-allow-cidr; IPv4 and IPv6 are told apart)',
+      usage: 'motherbase network-restrictions update --db-allow-cidr <cidr> [--db-allow-cidr <cidr> ...]',
+      async run(ctx, _args, flags) {
+        const cidrs = [].concat(flags['db-allow-cidr'] ?? []).map(String);
+        if (!cidrs.length) {
+          throw new CliError('Pass at least one --db-allow-cidr (0.0.0.0/0 and ::/0 allow everyone).');
+        }
+        const body = {
+          dbAllowedCidrs: cidrs.filter(c => !c.includes(':')),
+          dbAllowedCidrsV6: cidrs.filter(c => c.includes(':')),
+        };
+        output(ctx, await api.adminRequest(ctx, 'PUT', '/network-restrictions', { body }), renderRestrictions);
+      },
+    },
+  },
+};
+
+function renderSsl(d, ui) {
+  ui.keyValue({ enforced: d.enforced, 'TLS active': d.sslActive, status: d.status });
+  if (d.enforced) ui.info('External clients must connect with sslmode=require.');
+}
+
+const sslEnforcement = {
+  summary: 'Require TLS for direct database connections',
+  usage: 'motherbase ssl-enforcement <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show whether TLS is enforced',
+      usage: 'motherbase ssl-enforcement get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/ssl-enforcement'), renderSsl);
+      },
+    },
+    update: {
+      summary: 'Turn enforcement on or off',
+      usage: 'motherbase ssl-enforcement update --enable-db-ssl-enforcement | --disable-db-ssl-enforcement',
+      async run(ctx, _args, flags) {
+        const enable = Boolean(flags['enable-db-ssl-enforcement']);
+        const disable = Boolean(flags['disable-db-ssl-enforcement']);
+        if (enable === disable) {
+          throw new CliError('Pass exactly one of --enable-db-ssl-enforcement or --disable-db-ssl-enforcement.');
+        }
+        const data = await api.adminRequest(ctx, 'PUT', '/ssl-enforcement', { body: { enforced: enable } });
+        output(ctx, data, renderSsl);
+      },
+    },
+  },
+};
+
+module.exports = { networkRestrictions, sslEnforcement };

package/src/commands/orgs.js

@@ -0,0 +1,40 @@
+'use strict';
+
+// Tenant organizations on the Platform Console. Projects sit under an org, as
+// they do on Supabase.
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+const subcommands = {
+  list: {
+    summary: 'List the organizations you belong to',
+    usage: 'motherbase orgs list',
+    async run(ctx) {
+      const data = await api.consoleRequest(ctx, 'GET', '/orgs');
+      output(ctx, data, (rows, ui) =>
+        ui.table(Array.isArray(rows) ? rows : [], [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'role', label: 'ROLE' },
+          { key: 'projectCount', label: 'PROJECTS' },
+        ]),
+      );
+    },
+  },
+  create: {
+    summary: 'Create an organization',
+    usage: 'motherbase orgs create <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const data = await api.consoleRequest(ctx, 'POST', '/orgs', { body: { name } });
+      output(ctx, data, (d, ui) => ui.success(`Created org ${d.name} (${d.id})`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Manage organizations on the Platform Console',
+  usage: 'motherbase orgs <list|create> ...',
+  subcommands,
+};

package/src/commands/postgres-config.js

@@ -0,0 +1,113 @@
+'use strict';
+
+// `motherbase postgres-config get|update|delete`, Supabase's command of the
+// same name. The one difference is where a value lands: the server picks the
+// narrowest scope Postgres allows (a per-database override for
+// `statement_timeout`, ALTER SYSTEM for `shared_buffers`), and `--scope`
+// overrides that. Motherbase never restarts Postgres itself, so `--no-restart`
+// is accepted for script compatibility and a restart-only change is reported.
+
+const api = require('../api');
+const { output, parseKeyValues } = require('./_util');
+const { CliError } = require('../context');
+
+const SCOPES = ['database', 'role', 'system'];
+
+function scopeFlags(flags) {
+  if (flags.scope !== undefined && !SCOPES.includes(flags.scope)) {
+    throw new CliError(`--scope must be one of: ${SCOPES.join(', ')}`);
+  }
+  if (flags.scope === 'role' && !flags.role) throw new CliError('--scope role needs --role <name>');
+  return {
+    ...(flags.scope ? { scope: flags.scope } : {}),
+    ...(flags.role ? { role: String(flags.role) } : {}),
+  };
+}
+
+// What `get` prints: one row per setting that has an override, like Supabase,
+// or every curated setting with --all.
+function overrideRows(config, all) {
+  return config.settings.flatMap(setting => {
+    if (!setting.overrides.length) {
+      return all ? [{ name: setting.name, value: setting.value, scope: '', role: '', restart: setting.context === 'postmaster' }] : [];
+    }
+    return setting.overrides.map(o => ({
+      name: setting.name,
+      value: o.value,
+      scope: o.scope,
+      role: o.role || '',
+      restart: setting.context === 'postmaster',
+    }));
+  });
+}
+
+function reportChange(result, ui) {
+  for (const change of result.applied) {
+    ui.success(`${change.name}: ${change.scope}${change.role ? ` (${change.role})` : ''}`);
+  }
+  if (result.restartRequired.length) {
+    ui.warn(`Restart Postgres to apply: ${result.restartRequired.join(', ')}`);
+  }
+}
+
+const subcommands = {
+  get: {
+    summary: 'Show Postgres config overrides (--all for every managed setting)',
+    usage: 'motherbase postgres-config get [--all]',
+    async run(ctx, args, flags) {
+      const data = await api.adminRequest(ctx, 'GET', '/database/config');
+      output(ctx, data, (d, ui) => {
+        ui.table(overrideRows(d, Boolean(flags.all)), [
+          { key: 'name', label: 'PARAMETER' },
+          { key: 'value', label: 'VALUE' },
+          { key: 'scope', label: 'SCOPE' },
+          { key: 'role', label: 'ROLE' },
+          { key: 'restart', label: 'NEEDS RESTART' },
+        ]);
+        if (!d.systemOverridesReadable) ui.warn('System-level overrides could not be read with this connection.');
+      });
+    },
+  },
+  update: {
+    summary: 'Set Postgres config values',
+    usage: 'motherbase postgres-config update --config key=value [--config ...] [--scope database|role|system] [--role r] [--replace-existing-overrides]',
+    async run(ctx, args, flags) {
+      const values = parseKeyValues([].concat(flags.config || []).filter(Boolean), { coerce: false });
+      if (!Object.keys(values).length) throw new CliError('Provide at least one --config key=value.');
+      const target = scopeFlags(flags);
+      const changes = Object.entries(values).map(([name, value]) => ({ name, value, ...target }));
+
+      // Supabase's flag: anything overridden before and not named now goes back to its default.
+      if (flags['replace-existing-overrides']) {
+        const current = await api.adminRequest(ctx, 'GET', '/database/config');
+        for (const setting of current.settings) {
+          if (setting.name in values) continue;
+          for (const o of setting.overrides) {
+            changes.push({ name: setting.name, value: null, scope: o.scope, ...(o.role ? { role: o.role } : {}) });
+          }
+        }
+      }
+
+      const data = await api.adminRequest(ctx, 'PATCH', '/database/config', { body: { changes } });
+      output(ctx, data, (d, ui) => reportChange(d, ui));
+    },
+  },
+  delete: {
+    summary: 'Remove Postgres config overrides, restoring the defaults',
+    usage: 'motherbase postgres-config delete --config key1,key2 [--scope database|role|system] [--role r]',
+    async run(ctx, args, flags) {
+      const names = [].concat(flags.config || []).flatMap(v => String(v).split(',')).map(s => s.trim()).filter(Boolean);
+      if (!names.length) throw new CliError('Provide the settings to reset with --config key1,key2.');
+      const target = scopeFlags(flags);
+      const changes = names.map(name => ({ name, value: null, ...target }));
+      const data = await api.adminRequest(ctx, 'PATCH', '/database/config', { body: { changes } });
+      output(ctx, data, (d, ui) => reportChange(d, ui));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Postgres configuration (statement_timeout, work_mem, max_connections, ...)',
+  usage: 'motherbase postgres-config <get|update|delete> ...',
+  subcommands,
+};

package/src/commands/projects.js

@@ -1,8 +1,10 @@
 'use strict';
 
 const api = require('../api');
-const { output, requireArg } = require('./_util');
+const keys = require('./keys');
+const { output, alias, requireArg } = require('./_util');
 const { CliError } = require('../context');
+const { outputFormat } = require('../format');
 
 const LIFECYCLE = ['start', 'stop', 'restart', 'update', 'rebuild'];
 
@@ -68,7 +70,7 @@ const subcommands = {
         if (d && d.stdout) ui.print(d.stdout);
         if (d && d.stderr) ui.printErr(d.stderr);
       });
-      if (flags.f && !ctx.flags.json) {
+      if (flags.f && outputFormat(ctx.flags) === 'pretty') {
         // The console logs endpoint returns a snapshot; approximate -f by polling.
         const ui = require('../ui');
         ui.warn('(-f) polling every 3s; Ctrl-C to stop');
@@ -118,8 +120,11 @@ const subcommands = {
 
 for (const action of LIFECYCLE) subcommands[action] = lifecycleCmd(action);
 
+// Supabase's `projects api-keys`; the keys themselves live under `keys`.
+subcommands['api-keys'] = alias(keys.subcommands.list, 'motherbase projects api-keys [--project-ref <id>]');
+
 module.exports = {
   summary: 'Manage projects on the Platform Console',
-  usage: 'motherbase projects <list|create|start|stop|restart|update|rebuild|delete|logs|info|limits> ...',
+  usage: 'motherbase projects <list|create|start|stop|restart|update|rebuild|delete|logs|info|limits|api-keys> ...',
   subcommands,
 };

package/src/commands/queues.js

@@ -0,0 +1,133 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+const enc = encodeURIComponent;
+
+function int(flag, name) {
+  if (flag === undefined) return undefined;
+  const n = Number(flag);
+  if (!Number.isInteger(n) || n < 0) throw new CliError(`--${name} must be a non-negative integer`);
+  return n;
+}
+
+function parseMessage(raw) {
+  try {
+    return JSON.parse(requireArg(raw, 'json'));
+  } catch (err) {
+    if (err instanceof CliError) throw err;
+    throw new CliError('the message must be valid JSON, e.g. \'{"task":"resize"}\'');
+  }
+}
+
+const subcommands = {
+  list: {
+    summary: 'List queues with their depth',
+    usage: 'motherbase queues list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/queues');
+      const queues = (data && data.queues) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(queues, [
+          { key: 'name', label: 'NAME' },
+          { key: 'type', label: 'TYPE' },
+          { key: 'length', label: 'MESSAGES' },
+          { key: 'visibleLength', label: 'VISIBLE' },
+          { key: 'totalMessages', label: 'TOTAL' },
+        ]),
+      );
+    },
+  },
+  enable: {
+    summary: 'Install pgmq for this project',
+    usage: 'motherbase queues enable',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'POST', '/queues/enable');
+      output(ctx, data, (_d, ui) => ui.success('Queues enabled'));
+    },
+  },
+  expose: {
+    summary: 'Expose queues to the client SDK through pgmq_public (or hide them)',
+    usage: 'motherbase queues expose <true|false>',
+    async run(ctx, args) {
+      const value = requireArg(args[0], 'true|false');
+      if (value !== 'true' && value !== 'false') throw new CliError('expected true or false');
+      const data = await api.adminRequest(ctx, 'PUT', '/queues/expose', { body: { enabled: value === 'true' } });
+      output(ctx, data, (_d, ui) => ui.success(`Queues ${value === 'true' ? 'exposed' : 'hidden'}`));
+    },
+  },
+  create: {
+    summary: 'Create a queue',
+    usage: 'motherbase queues create <name> [--type basic|unlogged|partitioned] [--rls true|false]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      const body = { name };
+      if (flags.type) body.type = flags.type;
+      if (flags.rls !== undefined) body.rls = flags.rls === true || flags.rls === 'true';
+      const data = await api.adminRequest(ctx, 'POST', '/queues', { body });
+      output(ctx, data, (_d, ui) => ui.success(`Created queue ${name}`));
+    },
+  },
+  drop: {
+    summary: 'Drop a queue and its messages',
+    usage: 'motherbase queues drop <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const data = await api.adminRequest(ctx, 'DELETE', `/queues/${enc(name)}`);
+      output(ctx, data, (_d, ui) => ui.success(`Dropped queue ${name}`));
+    },
+  },
+  send: {
+    summary: 'Send a JSON message',
+    usage: "motherbase queues send <name> '<json>' [--delay seconds]",
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      const body = { message: parseMessage(args[1]) };
+      const delay = int(flags.delay, 'delay');
+      if (delay !== undefined) body.delay = delay;
+      const data = await api.adminRequest(ctx, 'POST', `/queues/${enc(name)}/messages`, { body });
+      output(ctx, data, (d, ui) => ui.success(`Sent message ${((d && d.msgIds) || []).join(', ')}`));
+    },
+  },
+  read: {
+    summary: 'Read messages, hiding them from other readers for the visibility timeout',
+    usage: 'motherbase queues read <name> [--qty 1] [--vt 30]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      const body = {};
+      const qty = int(flags.qty, 'qty');
+      const vt = int(flags.vt, 'vt');
+      if (qty !== undefined) body.qty = qty;
+      if (vt !== undefined) body.vt = vt;
+      const data = await api.adminRequest(ctx, 'POST', `/queues/${enc(name)}/read`, { body });
+      output(ctx, data, (d, ui) => ui.json((d && d.messages) || []));
+    },
+  },
+  archive: {
+    summary: 'Move a message to the archive',
+    usage: 'motherbase queues archive <name> <msg-id>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const id = requireArg(args[1], 'msg-id');
+      const data = await api.adminRequest(ctx, 'POST', `/queues/${enc(name)}/messages/${enc(id)}/archive`);
+      output(ctx, data, (_d, ui) => ui.success(`Archived message ${id}`));
+    },
+  },
+  purge: {
+    summary: 'Delete every message in a queue',
+    usage: 'motherbase queues purge <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const data = await api.adminRequest(ctx, 'POST', `/queues/${enc(name)}/purge`);
+      output(ctx, data, (d, ui) => ui.success(`Purged ${(d && d.purged) ?? 0} messages from ${name}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Message queues (pgmq)',
+  usage: 'motherbase queues <list|enable|expose|create|drop|send|read|archive|purge> ...',
+  subcommands,
+};

package/src/commands/secrets.js

@@ -1,7 +1,24 @@
 'use strict';
 
+const fs = require('fs');
+const path = require('path');
 const api = require('../api');
-const { output, requireArg } = require('./_util');
+const { output, requireArg, parseKeyValues, parseDotenv } = require('./_util');
+const { CliError } = require('../context');
+
+// `NAME=VALUE ...` plus `--env-file`, as the Supabase CLI takes them. The older
+// `set NAME value` form keeps working. Positional pairs win over the file.
+// Node itself pre-scans argv for `--env-file` and exits (code 9) when the path
+// does not exist relative to the shell's cwd, before this code runs; with
+// `--workdir`, pass an absolute path.
+function collectSecrets(cwd, args, flags) {
+  const fromFile = flags['env-file']
+    ? parseDotenv(fs.readFileSync(path.resolve(cwd, String(flags['env-file'])), 'utf8'))
+    : {};
+  const legacy = args.length === 2 && !args[0].includes('=');
+  const fromArgs = legacy ? { [args[0]]: args[1] } : parseKeyValues(args, { coerce: false });
+  return { ...fromFile, ...fromArgs };
+}
 
 const subcommands = {
   list: {
@@ -18,13 +35,17 @@ const subcommands = {
     },
   },
   set: {
-    summary: 'Set a secret',
-    usage: 'motherbase secrets set <NAME> <value>',
-    async run(ctx, args) {
-      const name = requireArg(args[0], 'NAME');
-      const value = requireArg(args[1], 'value');
-      const data = await api.adminRequest(ctx, 'PUT', '/edge-secrets', { body: { name, value } });
-      output(ctx, data, (d, ui) => ui.success(`Set secret ${name}`));
+    summary: 'Set one or more secrets',
+    usage: 'motherbase secrets set NAME=VALUE [NAME=VALUE ...] [--env-file .env]',
+    async run(ctx, args, flags) {
+      const secrets = collectSecrets(ctx.cwd, args, flags);
+      const names = Object.keys(secrets);
+      if (!names.length) throw new CliError('Nothing to set. Pass NAME=VALUE pairs or --env-file <path>.');
+      // The server sets one secret per request.
+      for (const name of names) {
+        await api.adminRequest(ctx, 'PUT', '/edge-secrets', { body: { name, value: secrets[name] } });
+      }
+      output(ctx, { set: names }, (d, ui) => ui.success(`Set ${names.length === 1 ? 'secret' : 'secrets'} ${names.join(', ')}`));
     },
   },
   unset: {