@motherbase/cli 0.2.4 → 0.2.6

package/src/api.js

@@ -1,229 +1,233 @@
-'use strict';
-
-// The one and only HTTP layer. Every command routes through here so auth headers,
-// URL construction and error mapping live in a single place.
-//
-// URL shapes:
-//   console request      -> ${consoleUrl}/api/platform${path}
-//   admin (console mode) -> ${consoleUrl}/api/projects/${projectId}/admin${path}
-//   admin (direct mode)  -> ${directUrl}/api/admin${path}
-//   edge invoke (console)-> ${consoleUrl}/api/projects/${projectId}/edge/${route}
-//   edge invoke (direct) -> ${directUrl}/api/edge/${route}
-//
-// Auth: the console session token is sent as `Authorization: Bearer <token>`.
-// Success envelopes differ across surfaces; both wrap payload under `data`, so we
-// unwrap `body.data` when present. Non-2xx becomes a thrown CliError with the
-// status and a short message/body snippet.
-
-const fs = require('fs');
-const path = require('path');
-const { Readable } = require('stream');
-const { CliError } = require('./context');
-
-function buildQuery(query) {
-  if (!query) return '';
-  const params = new URLSearchParams();
-  for (const [k, v] of Object.entries(query)) {
-    if (v === undefined || v === null) continue;
-    params.append(k, String(v));
-  }
-  const s = params.toString();
-  return s ? `?${s}` : '';
-}
-
-function unwrap(body) {
-  if (body && typeof body === 'object' && 'data' in body) return body.data;
-  return body;
-}
-
-// Non-browser clients send no Origin header. Better Auth (and reverse proxies
-// that inject cookies) then treat the request as CSRF-suspect and reject it with
-// "Missing or null Origin". Sending the target's own origin — which the server
-// keeps in its trustedOrigins (baseURL) — satisfies that check for every route.
-function originFor(url) {
-  try { return new URL(url).origin; } catch { return undefined; }
-}
-
-function errorMessage(status, body, text) {
-  const snippet = (body && (body.message || body.error)) || (text ? text.slice(0, 300) : '');
-  if (status === 401) {
-    return `Unauthorized (401)${snippet ? `: ${snippet}` : ''}. Run \`motherbase login\` (or check --token).`;
-  }
-  if (status === 403) {
-    return `Forbidden (403)${snippet ? `: ${snippet}` : ''}.`;
-  }
-  if (status === 404) {
-    return `Not found (404)${snippet ? `: ${snippet}` : ''}.`;
-  }
-  return `Request failed (${status})${snippet ? `: ${snippet}` : ''}`;
-}
-
-async function parseResponse(res) {
-  const text = await res.text();
-  let body;
-  if (text) {
-    try { body = JSON.parse(text); } catch { body = undefined; }
-  }
-  if (!res.ok) {
-    throw new CliError(errorMessage(res.status, body, text));
-  }
-  return body === undefined ? text : unwrap(body);
-}
-
-async function doFetch(url, { method = 'GET', token, body, headers = {} } = {}) {
-  const finalHeaders = { ...headers };
-  if (token) finalHeaders['authorization'] = `Bearer ${token}`;
-  if (!finalHeaders['origin']) {
-    const origin = originFor(url);
-    if (origin) finalHeaders['origin'] = origin;
-  }
-  let payload;
-  if (body !== undefined && body !== null) {
-    finalHeaders['content-type'] = 'application/json';
-    payload = JSON.stringify(body);
-  }
-  let res;
-  try {
-    res = await fetch(url, { method, headers: finalHeaders, body: payload });
-  } catch (err) {
-    throw new CliError(`Cannot reach ${url}: ${err.message}`);
-  }
-  return parseResponse(res);
-}
-
-// ── Console (account / multi-project) ────────────────────────────────────────
-
-function consoleRequest(ctx, method, apiPath, { body, query } = {}) {
-  const { consoleUrl, token } = ctx.requireConsole();
-  const url = `${consoleUrl}/api/platform${apiPath}${buildQuery(query)}`;
-  return doFetch(url, { method, token, body });
-}
-
-// Login is special: no token yet. Uses Better Auth's native sign-in endpoint;
-// the session token comes back in the body and/or the `set-auth-token` header
-// (bearer plugin). Returns `{ token, user }` so the caller can persist it.
-async function loginRequest(consoleUrl, email, password) {
-  const url = `${consoleUrl}/api/auth/sign-in/email`;
-  let res;
-  try {
-    const headers = { 'content-type': 'application/json' };
-    const origin = originFor(url);
-    if (origin) headers['origin'] = origin;
-    res = await fetch(url, {
-      method: 'POST',
-      headers,
-      body: JSON.stringify({ email, password }),
-    });
-  } catch (err) {
-    throw new CliError(`Cannot reach ${url}: ${err.message}`);
-  }
-  const text = await res.text();
-  let body;
-  if (text) { try { body = JSON.parse(text); } catch { body = undefined; } }
-  if (!res.ok) {
-    throw new CliError(errorMessage(res.status, body, text));
-  }
-  const token = (body && body.token) || res.headers.get('set-auth-token') || undefined;
-  return { token, user: body && body.user };
-}
-
-// ── Admin / resource (via proxy or direct) ───────────────────────────────────
-
-function adminBase(target) {
-  if (target.mode === 'direct') {
-    return { base: `${target.baseUrl}/api/admin`, token: target.token };
-  }
-  return { base: `${target.consoleUrl}/api/projects/${target.projectId}/admin`, token: target.token };
-}
-
-function adminRequest(ctx, method, apiPath, { body, query } = {}) {
-  const target = ctx.requireProject();
-  const { base, token } = adminBase(target);
-  const url = `${base}${apiPath}${buildQuery(query)}`;
-  return doFetch(url, { method, token, body });
-}
-
-// The public URL of a project path (`/edge/<route>`, `/rest/v1/<table>`), for
-// printing. Mirrors how the proxy addresses a project in each mode.
-function projectUrl(ctx, projectPath) {
-  const target = ctx.requireProject();
-  return target.mode === 'direct'
-    ? `${target.baseUrl}/api${projectPath}`
-    : `${target.consoleUrl}/api/projects/${target.projectId}${projectPath}`;
-}
-
-// Edge invoke goes through the un-authenticated edge route, not /admin.
-function edgeInvokeRequest(ctx, route, body) {
-  const url = projectUrl(ctx, `/edge/${encodeURIComponent(route)}`);
-  const target = ctx.requireProject();
-  return doFetch(url, { method: 'POST', token: target.token, body: body || {} });
-}
-
-// ── Multipart upload (native FormData/Blob; zero-dep on Node >=18) ────────────
-
-async function uploadFile(ctx, apiPath, filePath, fields = {}) {
-  const target = ctx.requireProject();
-  const { base, token } = adminBase(target);
-  const url = `${base}${apiPath}`;
-  const buf = fs.readFileSync(filePath);
-  const form = new FormData();
-  form.append('file', new Blob([buf]), path.basename(filePath));
-  for (const [k, v] of Object.entries(fields)) {
-    if (v !== undefined && v !== null) form.append(k, String(v));
-  }
-  const uploadHeaders = token ? { authorization: `Bearer ${token}` } : {};
-  const uploadOrigin = originFor(url);
-  if (uploadOrigin) uploadHeaders['origin'] = uploadOrigin;
-  let res;
-  try {
-    res = await fetch(url, {
-      method: 'POST',
-      headers: uploadHeaders,
-      body: form,
-    });
-  } catch (err) {
-    throw new CliError(`Cannot reach ${url}: ${err.message}`);
-  }
-  return parseResponse(res);
-}
-
-// ── Streamed download to a local file ────────────────────────────────────────
-
-async function downloadFile(ctx, apiPath, destPath, { query } = {}) {
-  const target = ctx.requireProject();
-  const { base, token } = adminBase(target);
-  const url = `${base}${apiPath}${buildQuery(query)}`;
-  const dlHeaders = token ? { authorization: `Bearer ${token}` } : {};
-  const dlOrigin = originFor(url);
-  if (dlOrigin) dlHeaders['origin'] = dlOrigin;
-  let res;
-  try {
-    res = await fetch(url, { headers: dlHeaders });
-  } catch (err) {
-    throw new CliError(`Cannot reach ${url}: ${err.message}`);
-  }
-  if (!res.ok) {
-    const text = await res.text().catch(() => '');
-    let body; try { body = JSON.parse(text); } catch { /* noop */ }
-    throw new CliError(errorMessage(res.status, body, text));
-  }
-  await new Promise((resolve, reject) => {
-    const out = fs.createWriteStream(destPath);
-    out.on('error', reject);
-    out.on('finish', resolve);
-    Readable.fromWeb(res.body).pipe(out);
-  });
-  return { path: destPath, contentType: res.headers.get('content-type') || undefined };
-}
-
-module.exports = {
-  consoleRequest,
-  loginRequest,
-  adminRequest,
-  edgeInvokeRequest,
-  projectUrl,
-  uploadFile,
-  downloadFile,
-  buildQuery,
-  unwrap,
-};
+'use strict';
+
+// The one and only HTTP layer. Every command routes through here so auth headers,
+// URL construction and error mapping live in a single place.
+//
+// URL shapes:
+//   console request      -> ${consoleUrl}/api/platform${path}
+//   admin (console mode) -> ${consoleUrl}/api/projects/${projectId}/admin${path}
+//   admin (direct mode)  -> ${directUrl}/api/admin${path}
+//
+// Auth: the console session token is sent as `Authorization: Bearer <token>`.
+// Success envelopes differ across surfaces; both wrap payload under `data`, so we
+// unwrap `body.data` when present. Non-2xx becomes a thrown CliError with the
+// status and a short message/body snippet.
+
+const fs = require('fs');
+const path = require('path');
+const { Readable } = require('stream');
+const { pipeline } = require('stream/promises');
+const { CliError } = require('./context');
+const ui = require('./ui');
+
+function buildQuery(query) {
+  if (!query) return '';
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(query)) {
+    if (v === undefined || v === null) continue;
+    params.append(k, String(v));
+  }
+  const s = params.toString();
+  return s ? `?${s}` : '';
+}
+
+function unwrap(body) {
+  if (body && typeof body === 'object' && 'data' in body) return body.data;
+  return body;
+}
+
+// Non-browser clients send no Origin header. Better Auth (and reverse proxies
+// that inject cookies) then treat the request as CSRF-suspect and reject it with
+// "Missing or null Origin". Sending the target's own origin (which the server
+// keeps in its trustedOrigins (baseURL)) satisfies that check for every route.
+function originFor(url) {
+  try { return new URL(url).origin; } catch { return undefined; }
+}
+
+function errorMessage(status, body, text) {
+  const snippet = (body && (body.message || body.error)) || (text ? text.slice(0, 300) : '');
+  if (status === 401) {
+    return `Unauthorized (401)${snippet ? `: ${snippet}` : ''}. Run \`motherbase login\` (or check --token).`;
+  }
+  if (status === 403) {
+    return `Forbidden (403)${snippet ? `: ${snippet}` : ''}.`;
+  }
+  if (status === 404) {
+    return `Not found (404)${snippet ? `: ${snippet}` : ''}.`;
+  }
+  return `Request failed (${status})${snippet ? `: ${snippet}` : ''}`;
+}
+
+// `--debug` (or MOTHERBASE_DEBUG=1): one stderr line per request. Never the
+// headers or body, which carry the token and passwords.
+function trace(method, url, res) {
+  if (!process.env.MOTHERBASE_DEBUG) return;
+  ui.printErr(ui.color.dim(`[debug] ${method} ${url} → ${res.status}`));
+}
+
+async function parseResponse(res) {
+  const text = await res.text();
+  let body;
+  if (text) {
+    try { body = JSON.parse(text); } catch { body = undefined; }
+  }
+  if (!res.ok) {
+    throw new CliError(errorMessage(res.status, body, text));
+  }
+  return body === undefined ? text : unwrap(body);
+}
+
+async function doFetch(url, { method = 'GET', token, body, headers = {} } = {}) {
+  const finalHeaders = { ...headers };
+  if (token) finalHeaders['authorization'] = `Bearer ${token}`;
+  if (!finalHeaders['origin']) {
+    const origin = originFor(url);
+    if (origin) finalHeaders['origin'] = origin;
+  }
+  let payload;
+  if (body !== undefined && body !== null) {
+    finalHeaders['content-type'] = 'application/json';
+    payload = JSON.stringify(body);
+  }
+  let res;
+  try {
+    res = await fetch(url, { method, headers: finalHeaders, body: payload });
+  } catch (err) {
+    throw new CliError(`Cannot reach ${url}: ${err.message}`);
+  }
+  trace(method, url, res);
+  return parseResponse(res);
+}
+
+// ── Console (account / multi-project) ────────────────────────────────────────
+
+function consoleRequest(ctx, method, apiPath, { body, query } = {}) {
+  const { consoleUrl, token } = ctx.requireConsole();
+  const url = `${consoleUrl}/api/platform${apiPath}${buildQuery(query)}`;
+  return doFetch(url, { method, token, body });
+}
+
+// Login is special: no token yet. Uses Better Auth's native sign-in endpoint;
+// the session token comes back in the body and/or the `set-auth-token` header
+// (bearer plugin). Returns `{ token, user }` so the caller can persist it.
+async function loginRequest(consoleUrl, email, password) {
+  const url = `${consoleUrl}/api/auth/sign-in/email`;
+  let res;
+  try {
+    const headers = { 'content-type': 'application/json' };
+    const origin = originFor(url);
+    if (origin) headers['origin'] = origin;
+    res = await fetch(url, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ email, password }),
+    });
+  } catch (err) {
+    throw new CliError(`Cannot reach ${url}: ${err.message}`);
+  }
+  trace('POST', url, res);
+  const text = await res.text();
+  let body;
+  if (text) { try { body = JSON.parse(text); } catch { body = undefined; } }
+  if (!res.ok) {
+    throw new CliError(errorMessage(res.status, body, text));
+  }
+  const token = (body && body.token) || res.headers.get('set-auth-token') || undefined;
+  return { token, user: body && body.user };
+}
+
+// ── Admin / resource (via proxy or direct) ───────────────────────────────────
+
+function adminBase(target) {
+  if (target.mode === 'direct') {
+    return { base: `${target.baseUrl}/api/admin`, token: target.token };
+  }
+  return { base: `${target.consoleUrl}/api/projects/${target.projectId}/admin`, token: target.token };
+}
+
+function adminRequest(ctx, method, apiPath, { body, query } = {}) {
+  const target = ctx.requireProject();
+  const { base, token } = adminBase(target);
+  const url = `${base}${apiPath}${buildQuery(query)}`;
+  return doFetch(url, { method, token, body });
+}
+
+// The public URL of a project path (`/edge/<route>`, `/rest/v1/<table>`), for
+// printing. Mirrors how the proxy addresses a project in each mode.
+function projectUrl(ctx, projectPath) {
+  const target = ctx.requireProject();
+  return target.mode === 'direct'
+    ? `${target.baseUrl}/api${projectPath}`
+    : `${target.consoleUrl}/api/projects/${target.projectId}${projectPath}`;
+}
+
+// ── Multipart upload (native FormData/Blob; zero-dep on Node >=18) ────────────
+
+async function uploadFile(ctx, apiPath, filePath, fields = {}) {
+  const target = ctx.requireProject();
+  const { base, token } = adminBase(target);
+  const url = `${base}${apiPath}`;
+  const buf = fs.readFileSync(filePath);
+  const form = new FormData();
+  form.append('file', new Blob([buf]), path.basename(filePath));
+  for (const [k, v] of Object.entries(fields)) {
+    if (v !== undefined && v !== null) form.append(k, String(v));
+  }
+  const uploadHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const uploadOrigin = originFor(url);
+  if (uploadOrigin) uploadHeaders['origin'] = uploadOrigin;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: 'POST',
+      headers: uploadHeaders,
+      body: form,
+    });
+  } catch (err) {
+    throw new CliError(`Cannot reach ${url}: ${err.message}`);
+  }
+  trace('POST', url, res);
+  return parseResponse(res);
+}
+
+// ── Streamed download to a local file ────────────────────────────────────────
+
+async function downloadFile(ctx, apiPath, destPath, { query } = {}) {
+  const target = ctx.requireProject();
+  const { base, token } = adminBase(target);
+  const url = `${base}${apiPath}${buildQuery(query)}`;
+  const dlHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const dlOrigin = originFor(url);
+  if (dlOrigin) dlHeaders['origin'] = dlOrigin;
+  let res;
+  try {
+    res = await fetch(url, { headers: dlHeaders });
+  } catch (err) {
+    throw new CliError(`Cannot reach ${url}: ${err.message}`);
+  }
+  trace('GET', url, res);
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    let body; try { body = JSON.parse(text); } catch { /* noop */ }
+    throw new CliError(errorMessage(res.status, body, text));
+  }
+  try {
+    await pipeline(Readable.fromWeb(res.body), fs.createWriteStream(destPath));
+  } catch (err) {
+    // A dropped connection leaves a truncated file that looks like a download.
+    fs.rmSync(destPath, { force: true });
+    throw new CliError(`Download failed: ${err.message}`);
+  }
+  return { path: destPath, contentType: res.headers.get('content-type') || undefined };
+}
+
+module.exports = {
+  consoleRequest,
+  loginRequest,
+  adminRequest,
+  projectUrl,
+  uploadFile,
+  downloadFile,
+  buildQuery,
+  unwrap,
+};

package/src/commands/_util.js

@@ -1,50 +1,106 @@
-'use strict';
-
-// Small shared helpers for command modules.
-
-const { CliError } = require('../context');
-
-// Parse `key=value` tokens into an object. Values that look like numbers/bools are
-// coerced unless `raw` is set. Supports dotted keys via `--json`-style callers.
-function parseKeyValues(tokens, { coerce = true } = {}) {
-  const out = {};
-  for (const tok of tokens) {
-    const idx = tok.indexOf('=');
-    if (idx <= 0) throw new CliError(`expected key=value, got "${tok}"`);
-    const key = tok.slice(0, idx).trim();
-    let value = tok.slice(idx + 1);
-    if (coerce) {
-      if (value === 'true') value = true;
-      else if (value === 'false') value = false;
-      else if (value !== '' && !Number.isNaN(Number(value)) && /^-?\d+(\.\d+)?$/.test(value)) value = Number(value);
-    }
-    out[key] = value;
-  }
-  return out;
-}
-
-// Emit either raw JSON (when --json) or run the human renderer.
-function output(ctx, data, humanFn) {
-  const ui = require('../ui');
-  if (ctx.flags.json) {
-    ui.json(data);
-    return;
-  }
-  humanFn(data, ui);
-}
-
-function requireArg(value, name) {
-  if (value === undefined || value === null || value === '') {
-    throw new CliError(`missing required argument: <${name}>`);
-  }
-  return value;
-}
-
-// Split "bucket:path" into { bucket, rest }.
-function splitRef(ref) {
-  const idx = ref.indexOf(':');
-  if (idx < 0) return { bucket: undefined, rest: ref };
-  return { bucket: ref.slice(0, idx), rest: ref.slice(idx + 1) };
-}
-
-module.exports = { parseKeyValues, output, requireArg, splitRef };
+'use strict';
+
+// Small shared helpers for command modules.
+
+const path = require('path');
+const { CliError } = require('../context');
+const { outputFormat, toYaml, toEnv } = require('../format');
+
+// Parse `key=value` tokens into an object. Values that look like numbers/bools are
+// coerced unless `raw` is set. Supports dotted keys via `--json`-style callers.
+function parseKeyValues(tokens, { coerce = true } = {}) {
+  const out = {};
+  for (const tok of tokens) {
+    const idx = tok.indexOf('=');
+    if (idx <= 0) throw new CliError(`expected key=value, got "${tok}"`);
+    const key = tok.slice(0, idx).trim();
+    let value = tok.slice(idx + 1);
+    if (coerce) {
+      if (value === 'true') value = true;
+      else if (value === 'false') value = false;
+      else if (value !== '' && !Number.isNaN(Number(value)) && /^-?\d+(\.\d+)?$/.test(value)) value = Number(value);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// Render a command's result in the selected `-o/--output` format; `pretty` is
+// the command's own human renderer.
+function output(ctx, data, humanFn) {
+  const ui = require('../ui');
+  switch (outputFormat(ctx.flags)) {
+    case 'json': ui.json(data); return;
+    case 'yaml': process.stdout.write(toYaml(data)); return;
+    case 'env': process.stdout.write(toEnv(data)); return;
+    default: humanFn(data, ui);
+  }
+}
+
+// The same command under a second (Supabase) name: one implementation, with
+// help that shows the name it was reached by.
+function alias(entry, usage, summary = entry.summary) {
+  return { ...entry, usage, summary };
+}
+
+// Parse a dotenv file: `KEY=value`, `export KEY=value`, `#` comments, and
+// single- or double-quoted values (double quotes expand \n).
+function parseDotenv(text) {
+  const out = {};
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim().replace(/^export\s+/, '');
+    if (!line || line.startsWith('#')) continue;
+    const idx = line.indexOf('=');
+    if (idx <= 0) throw new CliError(`invalid env line: "${raw}"`);
+    const key = line.slice(0, idx).trim();
+    let value = line.slice(idx + 1).trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote) && value.length > 1) {
+      value = value.slice(1, -1);
+      if (quote === '"') value = value.replace(/\\n/g, '\n');
+    } else {
+      value = value.replace(/\s+#.*$/, '');
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+function requireArg(value, name) {
+  if (value === undefined || value === null || value === '') {
+    throw new CliError(`missing required argument: <${name}>`);
+  }
+  return value;
+}
+
+// Split "bucket:path" into { bucket, rest }.
+function splitRef(ref) {
+  const idx = ref.indexOf(':');
+  if (idx < 0) return { bucket: undefined, rest: ref };
+  return { bucket: ref.slice(0, idx), rest: ref.slice(idx + 1) };
+}
+
+// `/projects/<linked project>` on the Console, for the per-project platform
+// surfaces (branches, domains) that live on the Console rather than the
+// project API. They need a Console, so direct mode cannot reach them.
+function consoleProjectPath(ctx, suffix = '') {
+  ctx.requireConsole();
+  if (!ctx.projectId) {
+    throw new CliError('No project linked. Run `motherbase link` or pass --project-ref <id>.');
+  }
+  return `/projects/${encodeURIComponent(ctx.projectId)}${suffix}`;
+}
+
+// Join `parts` under `root`, refusing a result that escapes it. Names that come
+// from the server (object keys, function routes) must not write outside the
+// directory the user picked: `../../.bashrc` is a valid object key.
+function resolveInside(root, ...parts) {
+  const target = path.resolve(root, ...parts);
+  const rel = path.relative(root, target);
+  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new CliError(`Refusing to write outside ${root}: ${parts.join('/')}`);
+  }
+  return target;
+}
+
+module.exports = { parseKeyValues, output, alias, parseDotenv, requireArg, splitRef, consoleProjectPath, resolveInside };