@motherbase/cli 0.2.4 → 0.2.6

package/src/commands/db-catalog.js

@@ -0,0 +1,326 @@
+'use strict';
+
+// `motherbase db indexes|types|roles|publications`: the Database section of
+// Studio from the terminal. Supabase's CLI has no equivalent for these, so they
+// live under `db` rather than claiming top-level names Supabase might use.
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+const schemaQuery = flags => (flags.schema ? { schema: flags.schema } : undefined);
+const csv = value => String(value).split(',').map(s => s.trim()).filter(Boolean);
+
+// `--login`, `--login true` and `--login false` all read naturally; absent
+// means "leave as is", which ALTER ROLE needs to change one attribute only.
+function bool(value) {
+  if (value === undefined) return undefined;
+  return value === true || value === 'true';
+}
+
+// Parse `schema.table` (or a bare `table` in public) into the API's shape.
+function tableRef(ref) {
+  const [schema, table] = ref.includes('.') ? ref.split('.', 2) : ['public', ref];
+  return { schema, table };
+}
+
+function roleAttributes(flags) {
+  const attributes = {
+    canLogin: bool(flags.login),
+    isSuperuser: bool(flags.superuser),
+    canCreateDb: bool(flags.createdb),
+    canCreateRole: bool(flags.createrole),
+    canReplicate: bool(flags.replication),
+    canBypassRls: bool(flags.bypassrls),
+    inheritRole: bool(flags.inherit),
+    connectionLimit: flags['connection-limit'] === undefined ? undefined : Number(flags['connection-limit']),
+    password: typeof flags.password === 'string' ? flags.password : undefined,
+    validUntil: flags['valid-until'] === undefined ? undefined : String(flags['valid-until']),
+  };
+  return Object.fromEntries(Object.entries(attributes).filter(([, v]) => v !== undefined));
+}
+
+function publishFlags(flags, defaults) {
+  const actions = flags.publish === undefined ? null : csv(flags.publish);
+  if (!actions) return defaults;
+  return Object.fromEntries(['insert', 'update', 'delete', 'truncate'].map(a => [a, actions.includes(a)]));
+}
+
+const indexes = {
+  summary: 'Indexes across a schema: list, create, drop',
+  usage: 'motherbase db indexes <list|create|drop> ...',
+  subcommands: {
+    list: {
+      summary: 'List every index in a schema',
+      usage: 'motherbase db indexes list [--schema public]',
+      async run(ctx, args, flags) {
+        const data = await api.adminRequest(ctx, 'GET', '/schema/indexes', { query: schemaQuery(flags) });
+        output(ctx, data, (d, ui) =>
+          ui.table((d.indexes || []).map(i => ({ ...i, columns: i.columns.join(', ') })), [
+            { key: 'table', label: 'TABLE' },
+            { key: 'name', label: 'INDEX' },
+            { key: 'method', label: 'METHOD' },
+            { key: 'unique', label: 'UNIQUE' },
+            { key: 'columns', label: 'COLUMNS' },
+            { key: 'sizeBytes', label: 'BYTES' },
+          ]),
+        );
+      },
+    },
+    create: {
+      summary: 'Create an index on one or more columns',
+      usage: 'motherbase db indexes create <table> --columns a,b [--unique] [--method btree|hash|gist|gin|brin|spgist] [--name n] [--schema s]',
+      async run(ctx, args, flags) {
+        const table = requireArg(args[0], 'table');
+        if (!flags.columns) throw new CliError('--columns is required');
+        const body = { columns: csv(flags.columns), unique: bool(flags.unique) || false };
+        if (flags.method) body.method = String(flags.method);
+        if (flags.name) body.name = String(flags.name);
+        const data = await api.adminRequest(ctx, 'POST', `/schema/tables/${encodeURIComponent(table)}/indexes`, { body, query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Created index on ${table} (${body.columns.join(', ')})`));
+      },
+    },
+    drop: {
+      summary: 'Drop an index by name',
+      usage: 'motherbase db indexes drop <name> [--schema s]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const data = await api.adminRequest(ctx, 'DELETE', `/schema/indexes/${encodeURIComponent(name)}`, { query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Dropped index ${name}`));
+      },
+    },
+  },
+};
+
+const enumPath = name => `/schema/enums/${encodeURIComponent(name)}`;
+
+const types = {
+  summary: 'Enumerated types: list, create, add-value, rename-value, drop',
+  usage: 'motherbase db types <list|create|add-value|rename-value|drop> ...',
+  subcommands: {
+    list: {
+      summary: 'List enum types and their values',
+      usage: 'motherbase db types list [--schema public]',
+      async run(ctx, args, flags) {
+        const data = await api.adminRequest(ctx, 'GET', '/schema/enums', { query: schemaQuery(flags) });
+        output(ctx, data, (d, ui) =>
+          ui.table((d.enums || []).map(e => ({ name: e.name, values: e.values.join(', '), usedBy: e.usedBy.length })), [
+            { key: 'name', label: 'TYPE' },
+            { key: 'values', label: 'VALUES' },
+            { key: 'usedBy', label: 'COLUMNS' },
+          ]),
+        );
+      },
+    },
+    create: {
+      summary: 'Create an enum type',
+      usage: 'motherbase db types create <name> --values a,b,c [--schema s]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        if (!flags.values) throw new CliError('--values is required');
+        const data = await api.adminRequest(ctx, 'POST', '/schema/enums', { body: { name, values: csv(flags.values) }, query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Created type ${name}`));
+      },
+    },
+    'add-value': {
+      summary: 'Add a value to an enum (values cannot be removed)',
+      usage: 'motherbase db types add-value <name> <value> [--before v | --after v] [--schema s]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const value = requireArg(args[1], 'value');
+        const body = { action: 'add-value', value, before: flags.before, after: flags.after };
+        const data = await api.adminRequest(ctx, 'PATCH', enumPath(name), { body, query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Added "${value}" to ${name}`));
+      },
+    },
+    'rename-value': {
+      summary: 'Rename one value of an enum',
+      usage: 'motherbase db types rename-value <name> <from> <to> [--schema s]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const body = { action: 'rename-value', from: requireArg(args[1], 'from'), to: requireArg(args[2], 'to') };
+        const data = await api.adminRequest(ctx, 'PATCH', enumPath(name), { body, query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Renamed "${body.from}" to "${body.to}" in ${name}`));
+      },
+    },
+    drop: {
+      summary: 'Drop an enum type (refused while a column uses it)',
+      usage: 'motherbase db types drop <name> [--schema s]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const data = await api.adminRequest(ctx, 'DELETE', enumPath(name), { query: schemaQuery(flags) });
+        output(ctx, data, (_d, ui) => ui.success(`Dropped type ${name}`));
+      },
+    },
+  },
+};
+
+const ROLE_FLAGS = '[--login] [--password p] [--createdb] [--createrole] [--replication] [--bypassrls] [--superuser] [--connection-limit n] [--valid-until iso]';
+
+const roles = {
+  summary: 'Postgres roles: list, create, alter, drop',
+  usage: 'motherbase db roles <list|create|alter|drop> ...',
+  subcommands: {
+    list: {
+      summary: 'List roles with their attributes and live connections',
+      usage: 'motherbase db roles list',
+      async run(ctx) {
+        const data = await api.adminRequest(ctx, 'GET', '/database/roles');
+        output(ctx, data, (d, ui) =>
+          ui.table(d.roles || [], [
+            { key: 'name', label: 'ROLE' },
+            { key: 'canLogin', label: 'LOGIN' },
+            { key: 'isSuperuser', label: 'SUPERUSER' },
+            { key: 'canBypassRls', label: 'BYPASSRLS' },
+            { key: 'connectionLimit', label: 'LIMIT' },
+            { key: 'activeConnections', label: 'CONNECTIONS' },
+            { key: 'reserved', label: 'RESERVED' },
+          ]),
+        );
+      },
+    },
+    create: {
+      summary: 'Create a role',
+      usage: `motherbase db roles create <name> ${ROLE_FLAGS}`,
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const data = await api.adminRequest(ctx, 'POST', '/database/roles', { body: { name, ...roleAttributes(flags) } });
+        output(ctx, data, (_d, ui) => ui.success(`Created role ${name}`));
+      },
+    },
+    alter: {
+      summary: 'Change attributes of a role, or rename it with --rename',
+      usage: `motherbase db roles alter <name> [--rename new] ${ROLE_FLAGS}`,
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const body = { ...roleAttributes(flags), ...(flags.rename ? { name: String(flags.rename) } : {}) };
+        if (!Object.keys(body).length) throw new CliError('Nothing to change: pass at least one attribute flag.');
+        const data = await api.adminRequest(ctx, 'PATCH', `/database/roles/${encodeURIComponent(name)}`, { body });
+        output(ctx, data, (_d, ui) => ui.success(`Updated role ${name}`));
+      },
+    },
+    drop: {
+      summary: 'Drop a role (refused for reserved roles and roles that own objects)',
+      usage: 'motherbase db roles drop <name>',
+      async run(ctx, args) {
+        const name = requireArg(args[0], 'name');
+        const data = await api.adminRequest(ctx, 'DELETE', `/database/roles/${encodeURIComponent(name)}`);
+        output(ctx, data, (_d, ui) => ui.success(`Dropped role ${name}`));
+      },
+    },
+  },
+};
+
+const publications = {
+  summary: 'Logical-replication publications: list, create, alter, drop',
+  usage: 'motherbase db publications <list|create|alter|drop> ...',
+  subcommands: {
+    list: {
+      summary: 'List publications, their tables and published actions',
+      usage: 'motherbase db publications list',
+      async run(ctx) {
+        const data = await api.adminRequest(ctx, 'GET', '/database/publications');
+        output(ctx, data, (d, ui) => {
+          ui.table((d.publications || []).map(p => ({
+            name: p.name,
+            publish: ['insert', 'update', 'delete', 'truncate'].filter(a => p[a]).join(', '),
+            tables: p.allTables ? '(all tables)' : p.tables.map(t => `${t.schema}.${t.table}`).join(', '),
+          })), [
+            { key: 'name', label: 'PUBLICATION' },
+            { key: 'publish', label: 'PUBLISH' },
+            { key: 'tables', label: 'TABLES' },
+          ]);
+          if (d.walLevel !== 'logical') ui.warn(`wal_level is "${d.walLevel}": publications stream nothing until it is "logical".`);
+        });
+      },
+    },
+    create: {
+      summary: 'Create a publication',
+      usage: 'motherbase db publications create <name> [--tables a,schema.b | --all-tables] [--publish insert,update,delete,truncate]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const body = {
+          name,
+          ...publishFlags(flags, { insert: true, update: true, delete: true, truncate: true }),
+          ...(flags['all-tables'] ? { allTables: true } : {}),
+          ...(flags.tables ? { tables: csv(flags.tables).map(tableRef) } : {}),
+        };
+        const data = await api.adminRequest(ctx, 'POST', '/database/publications', { body });
+        output(ctx, data, (_d, ui) => ui.success(`Created publication ${name}`));
+      },
+    },
+    alter: {
+      summary: 'Add or drop tables, or change what is published',
+      usage: 'motherbase db publications alter <name> [--add a,schema.b] [--drop c] [--publish insert,update]',
+      async run(ctx, args, flags) {
+        const name = requireArg(args[0], 'name');
+        const body = {
+          ...publishFlags(flags, {}),
+          ...(flags.add ? { addTables: csv(flags.add).map(tableRef) } : {}),
+          ...(flags.drop ? { dropTables: csv(flags.drop).map(tableRef) } : {}),
+        };
+        if (!Object.keys(body).length) throw new CliError('Nothing to change: pass --add, --drop or --publish.');
+        const data = await api.adminRequest(ctx, 'PATCH', `/database/publications/${encodeURIComponent(name)}`, { body });
+        output(ctx, data, (_d, ui) => ui.success(`Updated publication ${name}`));
+      },
+    },
+    drop: {
+      summary: 'Drop a publication',
+      usage: 'motherbase db publications drop <name>',
+      async run(ctx, args) {
+        const name = requireArg(args[0], 'name');
+        const data = await api.adminRequest(ctx, 'DELETE', `/database/publications/${encodeURIComponent(name)}`);
+        output(ctx, data, (_d, ui) => ui.success(`Dropped publication ${name}`));
+      },
+    },
+  },
+};
+
+function privilegeChange(grant) {
+  return {
+    summary: `${grant ? 'Grant' : 'Revoke'} a column privilege for a role`,
+    usage: `motherbase db column-privileges ${grant ? 'grant' : 'revoke'} <[schema.]table> --role r --privilege select|insert|update|references --columns a,b`,
+    async run(ctx, args, flags) {
+      const { schema, table } = tableRef(requireArg(args[0], 'table'));
+      if (!flags.role || !flags.privilege || !flags.columns) throw new CliError('--role, --privilege and --columns are required');
+      const body = {
+        schema,
+        table,
+        role: String(flags.role),
+        privilege: String(flags.privilege).toUpperCase(),
+        columns: csv(flags.columns),
+        grant,
+      };
+      const data = await api.adminRequest(ctx, 'PUT', '/database/column-privileges', { body });
+      output(ctx, data, (_d, ui) => ui.success(`${grant ? 'Granted' : 'Revoked'} ${body.privilege} on ${body.columns.join(', ')} ${grant ? 'to' : 'from'} ${body.role}`));
+    },
+  };
+}
+
+const columnPrivileges = {
+  summary: 'Column-level GRANT / REVOKE per role',
+  usage: 'motherbase db column-privileges <list|grant|revoke> <[schema.]table> ...',
+  subcommands: {
+    list: {
+      summary: 'Show which columns each role may select, insert, update or reference',
+      usage: 'motherbase db column-privileges list <[schema.]table>',
+      async run(ctx, args) {
+        const query = tableRef(requireArg(args[0], 'table'));
+        const data = await api.adminRequest(ctx, 'GET', '/database/column-privileges', { query });
+        output(ctx, data, (d, ui) =>
+          ui.table((d.roles || []).map(r => ({
+            role: r.role,
+            ...Object.fromEntries(Object.entries(r.privileges).map(([privilege, p]) => [
+              privilege,
+              p.tableLevel ? '(all)' : p.columns.join(', '),
+            ])),
+          })), ['role', 'SELECT', 'INSERT', 'UPDATE', 'REFERENCES']),
+        );
+      },
+    },
+    grant: privilegeChange(true),
+    revoke: privilegeChange(false),
+  },
+};
+
+module.exports = { indexes, types, roles, 'column-privileges': columnPrivileges, publications };

package/src/commands/db.js

@@ -1,92 +1,103 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const api = require('../api');
-const prompt = require('../prompt');
-const { output, parseKeyValues } = require('./_util');
-const { CliError } = require('../context');
-
-const subcommands = {
-  tables: {
-    summary: 'List database tables',
-    usage: 'motherbase db tables',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/schema/tables');
-      const tables = (data && data.tables) || data || [];
-      output(ctx, data, (_d, ui) =>
-        ui.table(Array.isArray(tables) ? tables : [], [
-          { key: 'name', label: 'TABLE' },
-          { key: 'schema', label: 'SCHEMA' },
-        ]),
-      );
-    },
-  },
-  sql: {
-    summary: 'Run SQL from -e "..." or a file',
-    usage: 'motherbase db sql -e "select 1" | motherbase db sql <file.sql>',
-    async run(ctx, args, flags) {
-      let sql = flags.e || flags.execute;
-      if (!sql && args[0]) sql = fs.readFileSync(path.resolve(ctx.cwd, args[0]), 'utf8');
-      if (!sql) throw new CliError('Provide SQL via -e "..." or a file path.');
-      const data = await api.adminRequest(ctx, 'POST', '/sql', { body: { sql } });
-      output(ctx, data, (d, ui) => {
-        if (d && Array.isArray(d.rows)) ui.table(d.rows);
-        else if (Array.isArray(d)) ui.table(d);
-        else ui.json(d);
-      });
-    },
-  },
-  dump: {
-    summary: 'Create a database backup on the server',
-    usage: 'motherbase db dump [file]',
-    async run(ctx, args) {
-      const body = args[0] ? { file: args[0] } : {};
-      const data = await api.adminRequest(ctx, 'POST', '/backups', { body });
-      output(ctx, data, (d, ui) => ui.success(`Backup created${d && d.file ? `: ${d.file}` : ''}`));
-    },
-  },
-  restore: {
-    summary: 'Restore the database from a server dump or offsite key',
-    usage: 'motherbase db restore <file> | --key <remoteKey>  --confirm',
-    async run(ctx, args, flags) {
-      const file = args[0];
-      const key = flags.key;
-      if (!file && !key) throw new CliError('Provide a <file> or --key <remoteKey>.');
-      if (!flags.confirm && !flags.yes) {
-        const ok = await prompt.confirm('This will overwrite the database. Continue?');
-        if (!ok) throw new CliError('Aborted.');
-      }
-      const body = key ? { key, confirm: 'RESTORE' } : { file, confirm: 'RESTORE' };
-      const data = await api.adminRequest(ctx, 'POST', '/backups/restore', { body });
-      output(ctx, data, (d, ui) => ui.success('Restore complete'));
-    },
-  },
-  backups: {
-    summary: 'List backups, or manage backup config (`db backups config`)',
-    usage: 'motherbase db backups [list] | motherbase db backups config [--set key=value ...]',
-    async run(ctx, args, flags) {
-      const sub = args[0];
-      if (sub === 'config') {
-        const sets = [].concat(flags.set || []).filter(Boolean);
-        if (sets.length) {
-          const body = parseKeyValues(sets);
-          const data = await api.adminRequest(ctx, 'PUT', '/backups/config', { body });
-          output(ctx, data, (d, ui) => ui.success('Backup config saved'));
-        } else {
-          const data = await api.adminRequest(ctx, 'GET', '/backups/config');
-          output(ctx, data, (d, ui) => ui.keyValue(d || {}));
-        }
-        return;
-      }
-      const data = await api.adminRequest(ctx, 'GET', '/backups/list');
-      output(ctx, data, (d, ui) => ui.json(d));
-    },
-  },
-};
-
-module.exports = {
-  summary: 'Database: tables, SQL, dumps and restores',
-  usage: 'motherbase db <tables|sql|dump|restore|backups> ...',
-  subcommands,
-};
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const prompt = require('../prompt');
+const rls = require('./rls');
+const { output, alias, parseKeyValues } = require('./_util');
+const { CliError } = require('../context');
+
+const subcommands = {
+  tables: {
+    summary: 'List database tables',
+    usage: 'motherbase db tables',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/schema/tables');
+      const tables = (data && data.tables) || data || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(Array.isArray(tables) ? tables : [], [
+          { key: 'name', label: 'TABLE' },
+          { key: 'schema', label: 'SCHEMA' },
+        ]),
+      );
+    },
+  },
+  sql: {
+    summary: 'Run SQL from -e "..." or a file',
+    usage: 'motherbase db sql -e "select 1" | motherbase db sql <file.sql>',
+    async run(ctx, args, flags) {
+      let sql = flags.e || flags.execute;
+      if (!sql && args[0]) sql = fs.readFileSync(path.resolve(ctx.cwd, args[0]), 'utf8');
+      if (!sql) throw new CliError('Provide SQL via -e "..." or a file path.');
+      const data = await api.adminRequest(ctx, 'POST', '/sql', { body: { sql } });
+      output(ctx, data, (d, ui) => {
+        if (d && Array.isArray(d.rows)) ui.table(d.rows);
+        else if (Array.isArray(d)) ui.table(d);
+        else ui.json(d);
+      });
+    },
+  },
+  // `db dump` is Supabase's local dump (../migration/commands); this is the
+  // server-side backup it used to be.
+  backup: {
+    summary: 'Create a database backup on the server',
+    usage: 'motherbase db backup [file]',
+    async run(ctx, args) {
+      const body = args[0] ? { file: args[0] } : {};
+      const data = await api.adminRequest(ctx, 'POST', '/backups', { body });
+      output(ctx, data, (d, ui) => ui.success(`Backup created${d && d.file ? `: ${d.file}` : ''}`));
+    },
+  },
+  restore: {
+    summary: 'Restore the database from a server dump or offsite key',
+    usage: 'motherbase db restore <file> | --key <remoteKey>  --confirm',
+    async run(ctx, args, flags) {
+      const file = args[0];
+      const key = flags.key;
+      if (!file && !key) throw new CliError('Provide a <file> or --key <remoteKey>.');
+      if (!flags.confirm && !flags.yes) {
+        const ok = await prompt.confirm('This will overwrite the database. Continue?');
+        if (!ok) throw new CliError('Aborted.');
+      }
+      const body = key ? { key, confirm: 'RESTORE' } : { file, confirm: 'RESTORE' };
+      const data = await api.adminRequest(ctx, 'POST', '/backups/restore', { body });
+      output(ctx, data, (d, ui) => ui.success('Restore complete'));
+    },
+  },
+  backups: {
+    summary: 'List backups, or manage backup config (`db backups config`)',
+    usage: 'motherbase db backups [list] | motherbase db backups config [--set key=value ...]',
+    async run(ctx, args, flags) {
+      const sub = args[0];
+      if (sub === 'config') {
+        const sets = [].concat(flags.set || []).filter(Boolean);
+        if (sets.length) {
+          const body = parseKeyValues(sets);
+          const data = await api.adminRequest(ctx, 'PUT', '/backups/config', { body });
+          output(ctx, data, (d, ui) => ui.success('Backup config saved'));
+        } else {
+          const data = await api.adminRequest(ctx, 'GET', '/backups/config');
+          output(ctx, data, (d, ui) => ui.keyValue(d || {}));
+        }
+        return;
+      }
+      const data = await api.adminRequest(ctx, 'GET', '/backups/list');
+      output(ctx, data, (d, ui) => ui.json(d));
+    },
+  },
+};
+
+// Supabase's local-files workflow: push, pull, diff, reset, dump, seed.
+Object.assign(subcommands, require('../migration/commands').dbSubcommands);
+// Studio's Database section: indexes, enum types, roles, column privileges, publications.
+Object.assign(subcommands, require('./db-catalog'));
+
+// Supabase's `db lint`: the same advisor as `rls lint`.
+subcommands.lint = alias(rls.subcommands.lint, 'motherbase db lint [--level critical|warning|info]');
+
+module.exports = {
+  summary: 'Database: tables, SQL, dumps, restores, indexes, types, roles, publications',
+  usage: 'motherbase db <push|pull|diff|reset|dump|seed|tables|sql|backup|restore|backups|lint|indexes|types|roles|column-privileges|publications> ...',
+  subcommands,
+};

package/src/commands/domains.js

@@ -0,0 +1,124 @@
+'use strict';
+
+// Custom domains and vanity subdomains (Supabase's `supabase domains` and
+// `supabase vanity-subdomains`). Both are Console routes on the linked project.
+
+const api = require('../api');
+const { output, requireArg, consoleProjectPath } = require('./_util');
+
+function renderHostname(d, ui) {
+  const custom = d.customHostname;
+  if (!custom) {
+    ui.info(`No custom domain. The API answers on ${d.projectDomain}.`);
+    return;
+  }
+  ui.keyValue({ hostname: custom.hostname, status: custom.status, projectDomain: d.projectDomain });
+  if (custom.status !== 'active') {
+    ui.print('');
+    ui.print('Publish these DNS records, then run `motherbase domains reverify`:');
+    ui.table(custom.requiredRecords, [
+      { key: 'type', label: 'TYPE' },
+      { key: 'name', label: 'NAME' },
+      { key: 'value', label: 'VALUE' },
+    ]);
+  }
+  for (const check of custom.checks || []) {
+    ui[check.ok ? 'success' : 'warn'](`${check.record} ${check.name}: ${check.ok ? 'ok' : `found ${check.found.join(', ') || 'nothing'}`}`);
+  }
+}
+
+const hostnamePath = (ctx, suffix = '') => consoleProjectPath(ctx, `/custom-hostname${suffix}`);
+
+const domains = {
+  summary: 'Custom domain for the linked project\'s API',
+  usage: 'motherbase domains <create|get|reverify|activate|delete> ...',
+  subcommands: {
+    create: {
+      summary: 'Start using a custom hostname (prints the DNS records to publish)',
+      usage: 'motherbase domains create --custom-hostname <api.example.com>',
+      async run(ctx, _args, flags) {
+        const hostname = requireArg(flags['custom-hostname'], 'custom-hostname');
+        const data = await api.consoleRequest(ctx, 'POST', hostnamePath(ctx), { body: { hostname } });
+        output(ctx, data, renderHostname);
+      },
+    },
+    get: {
+      summary: 'Show the custom hostname and its verification state',
+      usage: 'motherbase domains get',
+      async run(ctx) {
+        output(ctx, await api.consoleRequest(ctx, 'GET', hostnamePath(ctx)), renderHostname);
+      },
+    },
+    reverify: {
+      summary: 'Check the DNS records again',
+      usage: 'motherbase domains reverify',
+      async run(ctx) {
+        output(ctx, await api.consoleRequest(ctx, 'POST', hostnamePath(ctx, '/reverify')), renderHostname);
+      },
+    },
+    activate: {
+      summary: 'Serve the API on the verified hostname (TLS is issued on first request)',
+      usage: 'motherbase domains activate',
+      async run(ctx) {
+        output(ctx, await api.consoleRequest(ctx, 'POST', hostnamePath(ctx, '/activate')), renderHostname);
+      },
+    },
+    delete: {
+      summary: 'Stop using the custom hostname',
+      usage: 'motherbase domains delete',
+      async run(ctx) {
+        const data = await api.consoleRequest(ctx, 'DELETE', hostnamePath(ctx));
+        output(ctx, data, (_d, ui) => ui.success('Custom hostname removed'));
+      },
+    },
+  },
+};
+
+function renderVanity(d, ui) {
+  if (d.vanitySubdomain) ui.keyValue(d.vanitySubdomain);
+  else ui.info(`No vanity subdomain${d.vanitySuffix ? ` (they live under ${d.vanitySuffix})` : ''}.`);
+}
+
+const vanityPath = (ctx, suffix = '') => consoleProjectPath(ctx, `/vanity-subdomain${suffix}`);
+
+const vanitySubdomains = {
+  summary: 'Vanity subdomain under the platform domain',
+  usage: 'motherbase vanity-subdomains <get|check-availability|activate|delete> ...',
+  subcommands: {
+    get: {
+      summary: 'Show the active vanity subdomain',
+      usage: 'motherbase vanity-subdomains get',
+      async run(ctx) {
+        output(ctx, await api.consoleRequest(ctx, 'GET', vanityPath(ctx)), renderVanity);
+      },
+    },
+    'check-availability': {
+      summary: 'Is a subdomain free?',
+      usage: 'motherbase vanity-subdomains check-availability --desired-subdomain <name>',
+      async run(ctx, _args, flags) {
+        const subdomain = requireArg(flags['desired-subdomain'], 'desired-subdomain');
+        const data = await api.consoleRequest(ctx, 'POST', vanityPath(ctx, '/check-availability'), { body: { subdomain } });
+        output(ctx, data, (d, ui) => (d.available ? ui.success(`${d.hostname} is available`) : ui.warn(`${d.hostname} is taken`)));
+      },
+    },
+    activate: {
+      summary: 'Serve the API on <name>.<platform domain> as well',
+      usage: 'motherbase vanity-subdomains activate --desired-subdomain <name>',
+      async run(ctx, _args, flags) {
+        const subdomain = requireArg(flags['desired-subdomain'], 'desired-subdomain');
+        const data = await api.consoleRequest(ctx, 'POST', vanityPath(ctx), { body: { subdomain } });
+        output(ctx, data, renderVanity);
+      },
+    },
+    delete: {
+      summary: 'Remove the vanity subdomain',
+      usage: 'motherbase vanity-subdomains delete',
+      async run(ctx) {
+        const data = await api.consoleRequest(ctx, 'DELETE', vanityPath(ctx));
+        output(ctx, data, (_d, ui) => ui.success('Vanity subdomain removed'));
+      },
+    },
+  },
+};
+
+module.exports = { domains, vanitySubdomains };