@motherbase/cli 0.2.4 → 0.2.6

package/src/commands/functions.js

@@ -4,8 +4,9 @@ const fs = require('fs');
 const path = require('path');
 const api = require('../api');
 const ui = require('../ui');
-const { output, requireArg } = require('./_util');
+const { output, alias, requireArg, resolveInside } = require('./_util');
 const { CliError } = require('../context');
+const { templates, DEFAULT_TEMPLATE, findTemplate, renderTemplate } = require('../edge-templates');
 
 // Functions live as repo files, one directory per function, the layout Supabase
 // projects already use:
@@ -20,20 +21,30 @@ const DEFAULT_DIR = 'functions';
 const LEGACY_DIR = path.join('motherbase', 'functions');
 const ENTRY_NAMES = ['index.ts', 'index.js', 'index.mjs'];
 
-const TEMPLATE = `// Edge function: %NAME%
-//
-// Runs in a V8 isolate with the Fetch API available: Request, Response,
-// Headers, URL, TextEncoder/TextDecoder and crypto (including subtle.sign, for
-// webhook signature checks). npm imports are resolved at deploy time:
-//
-//   import { z } from 'zod';
-//
-// \`env\` holds this project's edge secrets.
+// Written next to the functions so an editor knows the runtime globals the
+// Deno edge runtime injects. Without it every `env.X` / `sendMail(...)` is a red squiggle.
+const TYPES_FILE = 'motherbase.d.ts';
+const TYPES = `// Generated by \`motherbase functions new\`. Runtime globals injected by the
+// Motherbase edge runtime. Safe to re-generate: delete it and scaffold again.
 
-export default async (req: Request) => {
-  const body = req.method === 'GET' ? {} : await req.json().catch(() => ({}));
-  return Response.json({ hello: '%NAME%', received: body, at: new Date().toISOString() });
-};
+/** This project's edge secrets (Studio > Edge functions > Secrets). */
+declare const env: Record<string, string>;
+
+/** The invoke payload, for the legacy expression-shaped function form. */
+declare const context: Record<string, unknown>;
+
+/**
+ * Sends an email through this project's SMTP settings, the same transport the
+ * auth emails use: the project API sends it, so there is no mail API to sign up for.
+ * Rejects when SMTP is unconfigured, when \`to\` is not an address, or when
+ * neither \`text\` nor \`html\` is given.
+ */
+declare function sendMail(options: {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}): Promise<{ ok: true }>;
 `;
 
 function functionsDir(ctx) {
@@ -75,16 +86,19 @@ function resolveLocal(ctx, name) {
 }
 
 /** Upsert by route, so deploying twice updates instead of conflicting. */
+async function upsertFunction(ctx, body) {
+  const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+  const existing = ((listing && listing.functions) || []).find(f => f.route === body.route);
+  if (existing) return api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body });
+  return api.adminRequest(ctx, 'POST', '/edge-functions', { body: { ...body, enabled: true } });
+}
+
 async function deployOne(ctx, fn, flags) {
   const code = fs.readFileSync(fn.entry, 'utf8');
   const body = { name: fn.name, route: fn.name, code };
   if (flags && flags.memory) body.memoryLimitMb = Number(flags.memory);
   if (flags && flags.timeout) body.timeoutMs = Number(flags.timeout);
-
-  const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
-  const existing = ((listing && listing.functions) || []).find(f => f.route === fn.name);
-  if (existing) return api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body });
-  return api.adminRequest(ctx, 'POST', '/edge-functions', { body: { ...body, enabled: true } });
+  return upsertFunction(ctx, body);
 }
 
 const subcommands = {
@@ -115,9 +129,13 @@ const subcommands = {
   },
   new: {
     summary: 'Scaffold functions/<name>/index.ts',
-    usage: 'motherbase functions new <name>',
-    async run(ctx, args) {
+    usage: `motherbase functions new <name> [--template ${templates.map(t => t.id).join('|')}]`,
+    async run(ctx, args, flags) {
       const name = requireArg(args[0], 'name');
+      const template = findTemplate(flags.template || DEFAULT_TEMPLATE);
+      if (!template) {
+        throw new CliError(`Unknown template "${flags.template}". Use one of: ${templates.map(t => t.id).join(', ')}.`);
+      }
       if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
         throw new CliError('Function names are lowercase letters, digits and hyphens (the name is also the route).');
       }
@@ -125,8 +143,13 @@ const subcommands = {
       if (entryFile(dir)) throw new CliError(`${path.relative(ctx.cwd, dir)} already has an entry file.`);
       fs.mkdirSync(dir, { recursive: true });
       const file = path.join(dir, 'index.ts');
-      fs.writeFileSync(file, TEMPLATE.replace(/%NAME%/g, name));
+      fs.writeFileSync(file, renderTemplate(template, name));
       ui.success(`Created ${path.relative(ctx.cwd, file)}`);
+      const types = path.join(functionsDir(ctx), TYPES_FILE);
+      if (!fs.existsSync(types)) {
+        fs.writeFileSync(types, TYPES);
+        ui.success(`Created ${path.relative(ctx.cwd, types)}`);
+      }
       ui.info(`Deploy it with: motherbase functions deploy ${name}`);
     },
   },
@@ -141,11 +164,7 @@ const subcommands = {
         if (!route) throw new CliError('--route is required with --file');
         const code = fs.readFileSync(path.resolve(ctx.cwd, flags.file), 'utf8');
         const name = flags.name || route;
-        const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
-        const existing = ((listing && listing.functions) || []).find(f => f.route === route);
-        const data = existing
-          ? await api.adminRequest(ctx, 'PATCH', `/edge-functions/${existing.id}`, { body: { name, route, code } })
-          : await api.adminRequest(ctx, 'POST', '/edge-functions', { body: { name, route, code, enabled: true } });
+        const data = await upsertFunction(ctx, { name, route, code });
         return output(ctx, data, (_d, u) => u.success(`Deployed function ${name} (${route})`));
       }
 
@@ -177,7 +196,7 @@ const subcommands = {
         // The list endpoint may omit code, so read the function itself.
         const detail = await api.adminRequest(ctx, 'GET', `/edge-functions/${fn.id}`);
         const code = (detail && detail.function ? detail.function.code : detail && detail.code) || '';
-        const dir = path.join(functionsDir(ctx), fn.route || fn.name);
+        const dir = resolveInside(functionsDir(ctx), fn.route || fn.name);
         fs.mkdirSync(dir, { recursive: true });
         const file = path.join(dir, 'index.ts');
         fs.writeFileSync(file, code);
@@ -190,8 +209,8 @@ const subcommands = {
     summary: 'Watch local functions and redeploy on every save',
     usage: 'motherbase functions serve [name]',
     async run(ctx, args) {
-      // Deliberately not a second local runtime. The isolate, the secrets and
-      // the bundler all live in the project API, and a local re-implementation
+      // Deliberately not a second local runtime. The runtime, the secrets and
+      // the mail bridge all live with the project API, and a local re-implementation
       // would differ from production in exactly the ways that matter. This
       // watches and redeploys instead, so the edit-invoke loop is one save long.
       const targets = resolveLocal(ctx, args[0]);
@@ -240,7 +259,7 @@ const subcommands = {
     },
   },
   invoke: {
-    summary: 'Invoke an edge function by route',
+    summary: 'Invoke a deployed edge function by route, as the operator',
     usage: 'motherbase functions invoke <route> [--body <json>]',
     async run(ctx, args, flags) {
       const route = requireArg(args[0], 'route');
@@ -248,7 +267,14 @@ const subcommands = {
       if (flags.body) {
         try { body = JSON.parse(flags.body); } catch { throw new CliError('--body must be valid JSON'); }
       }
-      const data = await api.edgeInvokeRequest(ctx, route, body);
+      // Through the admin surface, as Studio's "Run" does. The public /edge
+      // route authenticates the function's own callers: the console proxy
+      // strips the operator's session before forwarding there (operator code
+      // must never see it), so the CLI arrived anonymous and got a 401.
+      const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+      const fn = ((listing && listing.functions) || []).find(f => f.route === route || f.name === route);
+      if (!fn) throw new CliError(`No deployed function "${route}". See: motherbase functions list`);
+      const data = await api.adminRequest(ctx, 'POST', `/edge-functions/${fn.id}/invoke`, { body });
       output(ctx, data, (d, u) => u.json(d));
     },
   },
@@ -267,8 +293,12 @@ const subcommands = {
   },
 };
 
+// Supabase's name for `pull`.
+subcommands.download = alias(subcommands.pull, 'motherbase functions download [name]');
+
 module.exports = {
   summary: 'Edge functions (repo files, deploy, invoke, logs)',
-  usage: 'motherbase functions <list|get|new|deploy|pull|serve|delete|invoke|logs> ...',
+  usage: 'motherbase functions <list|get|new|deploy|pull|download|serve|delete|invoke|logs> ...',
   subcommands,
+  upsertFunction,
 };

package/src/commands/gen.js

@@ -1,8 +1,8 @@
 'use strict';
 
-// Code generation from the live schema. Today: TypeScript database types.
+// Code generation from the live schema: TypeScript types and zod schemas.
 //
-// The server owns the emitter (apps/server/services/admin/typegen.service.ts).
+// The server owns both emitters (apps/server/services/admin/typegen/).
 // This command is a transport: it asks `GET /admin/schema/types` for the
 // rendered file and writes it. Re-implementing the emitter here would guarantee
 // drift between the CLI, the Studio download and the MCP tool within a release.
@@ -12,9 +12,11 @@ const path = require('path');
 const api = require('../api');
 const config = require('../config');
 const { output } = require('./_util');
+const { outputFormat } = require('../format');
 const { CliError } = require('../context');
 
 const DEFAULT_OUTPUT = 'database.types.ts';
+const DEFAULT_ZOD_OUTPUT = 'database.schemas.ts';
 const DEFAULT_LOCAL_URL = 'http://localhost:5001';
 
 /**
@@ -51,31 +53,36 @@ function firstDifference(a, b) {
   return null;
 }
 
-const typescript = {
-  summary: 'Generate TypeScript types for the database schema',
-  usage:
-    'motherbase gen types typescript [--schema public] [--local] [--output database.types.ts] [--check]',
-  async run(ctx, args, flags) {
+/**
+ * Both targets are the same transport: ask the server for the rendered file,
+ * then write it, diff it or print it. `field` names which rendering to take
+ * from the one response, so a new target is a few lines rather than a copy of
+ * this whole flow.
+ */
+function emitter({ field, defaultOutput, label, command }) {
+  return async function run(ctx, args, flags) {
     const schema = flags.schema || 'public';
     const data = await api.adminRequest(resolveTarget(ctx, flags), 'GET', '/schema/types', {
       query: { schema },
     });
 
-    const types = data && typeof data.types === 'string' ? data.types : null;
+    const types = data && typeof data[field] === 'string' ? data[field] : null;
     if (!types) {
       throw new CliError(
-        'The server returned no generated types. Check that the project runs a build with GET /admin/schema/types.',
+        `The server returned no generated ${label}. Check that the project serves ` +
+          `GET /admin/schema/types with a build new enough for \`${command}\`.`,
       );
     }
 
     const outputPath = flags.output && flags.output !== true ? String(flags.output) : null;
+    const DEFAULT_OUTPUT = defaultOutput;
 
     // --check is the CI drift gate: compare the committed file with a fresh
     // generation and fail loudly, without ever writing.
     if (flags.check) {
       const target = path.resolve(ctx.cwd, outputPath || DEFAULT_OUTPUT);
       if (!fs.existsSync(target)) {
-        throw new CliError(`${target} does not exist. Run \`motherbase gen types typescript --output ${outputPath || DEFAULT_OUTPUT}\`.`);
+        throw new CliError(`${target} does not exist. Run \`${command} --output ${outputPath || DEFAULT_OUTPUT}\`.`);
       }
       const onDisk = fs.readFileSync(target, 'utf8');
       const diff = firstDifference(onDisk, types);
@@ -96,7 +103,7 @@ const typescript = {
     // No --output: write the file to stdout so `... > database.types.ts` works.
     // Nothing else may go to stdout on this path or it lands in the file.
     if (!outputPath) {
-      if (ctx.flags.json) {
+      if (outputFormat(ctx.flags) !== 'pretty') {
         output(ctx, { schema, types }, () => {});
         return;
       }
@@ -110,17 +117,56 @@ const typescript = {
     output(ctx, { schema, output: target, bytes: Buffer.byteLength(types) }, (d, ui) =>
       ui.success(`Wrote ${target} (${schema} schema)`),
     );
-  },
+  };
+}
+
+const typescript = {
+  summary: 'Generate TypeScript types for the database schema',
+  usage:
+    'motherbase gen types typescript [--schema public] [--local] [--output database.types.ts] [--check]',
+  // Here `--output` names the file to write, not the `-o` output format.
+  outputIsPath: true,
+  run: emitter({
+    field: 'types',
+    defaultOutput: DEFAULT_OUTPUT,
+    label: 'types',
+    command: 'motherbase gen types typescript',
+  }),
+};
+
+const zod = {
+  summary: 'Generate zod schemas for the database schema',
+  usage:
+    'motherbase gen types zod [--schema public] [--local] [--output database.schemas.ts] [--check]',
+  outputIsPath: true,
+  run: emitter({
+    field: 'zod',
+    defaultOutput: DEFAULT_ZOD_OUTPUT,
+    label: 'schemas',
+    command: 'motherbase gen types zod',
+  }),
 };
 
+const LANGS = { typescript, zod };
+
+// `gen types --lang typescript` is the Supabase spelling; `gen types typescript`
+// reaches the same emitter through the subcommand.
 const types = {
   summary: 'Generate types from the database schema',
-  usage: 'motherbase gen types typescript [flags]',
-  subcommands: { typescript },
+  usage: 'motherbase gen types [--lang typescript|zod] [flags]  |  motherbase gen types <typescript|zod> [flags]',
+  subcommands: LANGS,
+  outputIsPath: true,
+  async run(ctx, args, flags) {
+    const lang = flags.lang || 'typescript';
+    if (!LANGS[lang]) throw new CliError(`--lang must be one of: ${Object.keys(LANGS).join(', ')}`);
+    return LANGS[lang].run(ctx, args, flags);
+  },
 };
 
+const signing = require('./signing');
+
 module.exports = {
-  summary: 'Generate code from the live schema',
-  usage: 'motherbase gen types typescript [--schema public] [--local] [--output <file>] [--check]',
-  subcommands: { types },
+  summary: 'Generate code from the live schema, and signing keys, tokens and secrets',
+  usage: 'motherbase gen <types|signing-key|bearer-jwt|keys> ...',
+  subcommands: { types, 'signing-key': signing.signingKey, 'bearer-jwt': signing.bearerJwt, keys: signing.keys },
 };

package/src/commands/import.js

@@ -1,35 +1,55 @@
-'use strict';
-
-const api = require('../api');
-const prompt = require('../prompt');
-const { output } = require('./_util');
-const { CliError } = require('../context');
-
-module.exports = {
-  summary: 'Import a Supabase project (schema + data + auth) into the linked project',
-  usage: 'motherbase import --from-supabase <connectionString> [--preview] [--no-data] [--no-auth]',
-  async run(ctx, args, flags) {
-    const connectionString = flags['from-supabase'] || flags.fromSupabase;
-    if (!connectionString) throw new CliError('--from-supabase <connectionString> is required');
-
-    const include = { schema: true, data: !flags['no-data'], auth: !flags['no-auth'] };
-    const preview = Boolean(flags.preview);
-
-    const body = { connectionString, include };
-    if (preview) {
-      body.preview = true;
-    } else {
-      if (!flags.yes) {
-        const ok = await prompt.confirm('This will import into the linked project. Continue?');
-        if (!ok) throw new CliError('Aborted.');
-      }
-      body.confirm = 'IMPORT';
-    }
-
-    const data = await api.adminRequest(ctx, 'POST', '/import/supabase', { body });
-    output(ctx, data, (d, ui) => {
-      if (preview) { ui.info('Import preview (dry run):'); ui.json(d); }
-      else { ui.success('Import complete'); ui.json(d); }
-    });
-  },
-};
+'use strict';
+
+const api = require('../api');
+const prompt = require('../prompt');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+// Sections beyond the database need their own credential, because that is where
+// Supabase keeps them: object bytes behind the Storage API (service_role key),
+// edge functions and project secrets behind the Management API (a personal
+// access token). Both are optional; without one, that section reports what it
+// could not read instead of failing the import.
+module.exports = {
+  summary: 'Import a Supabase project (schema, data, auth, storage, edge functions, secrets)',
+  usage:
+    'motherbase import --from-supabase <connectionString> [--service-role-key <key>] [--management-token <sbp_…>] ' +
+    '[--preview] [--no-data] [--no-auth] [--no-storage] [--no-edge-functions] [--no-secrets]',
+  async run(ctx, args, flags) {
+    const connectionString = flags['from-supabase'] || flags.fromSupabase;
+    if (!connectionString) throw new CliError('--from-supabase <connectionString> is required');
+
+    const include = {
+      schema: true,
+      data: !flags['no-data'],
+      auth: !flags['no-auth'],
+      storage: !flags['no-storage'],
+      edgeFunctions: !flags['no-edge-functions'],
+      secrets: !flags['no-secrets'],
+    };
+    const preview = Boolean(flags.preview);
+
+    const body = { connectionString, include };
+    const serviceRoleKey = flags['service-role-key'] || flags.serviceRoleKey;
+    const managementToken = flags['management-token'] || flags.managementToken;
+    if (serviceRoleKey) body.serviceRoleKey = serviceRoleKey;
+    if (managementToken) body.managementToken = managementToken;
+    if (flags['project-ref'] || flags.projectRef) body.projectRef = flags['project-ref'] || flags.projectRef;
+
+    if (preview) {
+      body.preview = true;
+    } else {
+      if (!flags.yes) {
+        const ok = await prompt.confirm('This will import into the linked project. Continue?');
+        if (!ok) throw new CliError('Aborted.');
+      }
+      body.confirm = 'IMPORT';
+    }
+
+    const data = await api.adminRequest(ctx, 'POST', '/import/supabase', { body });
+    output(ctx, data, (d, ui) => {
+      if (preview) { ui.info('Import preview (dry run):'); ui.json(d); }
+      else { ui.success('Import complete'); ui.json(d); }
+    });
+  },
+};

package/src/commands/index.js

@@ -1,64 +1,85 @@
-'use strict';
-
-// Command registry: name -> { summary, usage, subcommands?, run? }.
-// `main.js` builds all help/dispatch from this single map.
-
-const local = require('./local');
-
-const registry = {
-  // ── Connection ─────────────────────────────────────────────────────────────
-  login: require('./login'),
-  logout: require('./logout'),
-  whoami: require('./whoami'),
-  link: require('./link'),
-  unlink: require('./unlink'),
-  status: require('./status'),
-
-  // ── Projects (Platform Console) ────────────────────────────────────────────
-  projects: require('./projects'),
-
-  // ── Local self-host (docker compose) ───────────────────────────────────────
-  init: local.init,
-  start: local.start,
-  stop: local.stop,
-  deploy: local.deploy,
-  logs: local.logs,
-
-  // ── Database / migrations / import ─────────────────────────────────────────
-  db: require('./db'),
-  migrations: require('./migrations'),
-  migration: require('./migration'),
-  import: require('./import'),
-
-  // ── Resource domains ───────────────────────────────────────────────────────
-  rls: require('./rls'),
-  users: require('./users'),
-  storage: require('./storage'),
-  functions: require('./functions'),
-  secrets: require('./secrets'),
-  keys: require('./keys'),
-  realtime: require('./realtime'),
-  webhooks: require('./webhooks'),
-  cron: require('./cron'),
-  config: require('./config'),
-  inspect: require('./inspect'),
-
-  // ── Codegen ────────────────────────────────────────────────────────────────
-  gen: require('./gen'),
-
-  // ── AI agents ──────────────────────────────────────────────────────────────
-  mcp: require('./mcp'),
-};
-
-// Grouping used only to render a tidy top-level help listing.
-const groups = [
-  { title: 'Connection', names: ['login', 'logout', 'whoami', 'link', 'unlink', 'status'] },
-  { title: 'Projects (Console)', names: ['projects'] },
-  { title: 'Local self-host', names: ['init', 'start', 'stop', 'deploy', 'logs'] },
-  { title: 'Database', names: ['db', 'migrations', 'migration', 'import'] },
-  { title: 'Resources', names: ['rls', 'users', 'storage', 'functions', 'secrets', 'keys', 'realtime', 'webhooks', 'cron', 'config', 'inspect'] },
-  { title: 'Codegen', names: ['gen'] },
-  { title: 'AI agents', names: ['mcp'] },
-];
-
-module.exports = { registry, groups };
+'use strict';
+
+// Command registry: name -> { summary, usage, subcommands?, run? }.
+// `main.js` builds all help/dispatch from this single map.
+
+const local = require('./local');
+const { alias } = require('./_util');
+const migration = require('./migration');
+
+const registry = {
+  // ── Connection ─────────────────────────────────────────────────────────────
+  login: require('./login'),
+  logout: require('./logout'),
+  whoami: require('./whoami'),
+  link: require('./link'),
+  unlink: require('./unlink'),
+  status: require('./status'),
+
+  // ── Orgs & projects (Platform Console) ─────────────────────────────────────
+  orgs: require('./orgs'),
+  projects: require('./projects'),
+  branches: require('./branches'),
+  domains: require('./domains').domains,
+  'vanity-subdomains': require('./domains').vanitySubdomains,
+
+  // ── Local self-host (docker compose) ───────────────────────────────────────
+  init: local.init,
+  start: local.start,
+  stop: local.stop,
+  deploy: local.deploy,
+  logs: local.logs,
+
+  // ── Database / migrations / import ─────────────────────────────────────────
+  db: require('./db'),
+  backups: require('./backups'),
+  migration,
+  // The name Motherbase used before it matched Supabase's `migration`.
+  migrations: alias(migration, 'motherbase migrations <new|list|up|down|repair|squash|fetch|diff|get|create|apply|rollback> ... (alias of `migration`)'),
+  import: require('./import'),
+  migrate: require('./migrate'),
+  test: require('./test'),
+  'postgres-config': require('./postgres-config'),
+
+  // ── Resource domains ───────────────────────────────────────────────────────
+  rls: require('./rls'),
+  users: require('./users'),
+  storage: require('./storage'),
+  functions: require('./functions'),
+  secrets: require('./secrets'),
+  keys: require('./keys'),
+  realtime: require('./realtime'),
+  webhooks: require('./webhooks'),
+  cron: require('./cron'),
+  queues: require('./queues'),
+  vault: require('./vault'),
+  wrappers: require('./wrappers'),
+  config: require('./config'),
+  inspect: require('./inspect'),
+  'network-restrictions': require('./network').networkRestrictions,
+  'ssl-enforcement': require('./network').sslEnforcement,
+  snippets: require('./snippets'),
+
+  // ── Codegen ────────────────────────────────────────────────────────────────
+  gen: require('./gen'),
+
+  // ── AI agents ──────────────────────────────────────────────────────────────
+  mcp: require('./mcp'),
+
+  // ── Shell ──────────────────────────────────────────────────────────────────
+  completion: require('./completion'),
+};
+
+// Grouping used only to render a tidy top-level help listing.
+const groups = [
+  { title: 'Connection', names: ['login', 'logout', 'whoami', 'link', 'unlink', 'status'] },
+  { title: 'Orgs & projects (Console)', names: ['orgs', 'projects', 'branches', 'domains', 'vanity-subdomains'] },
+  { title: 'Local self-host', names: ['init', 'start', 'stop', 'deploy', 'logs'] },
+  { title: 'Database', names: ['db', 'backups', 'migrations', 'migration', 'import', 'test', 'postgres-config'] },
+  { title: 'Resources', names: ['rls', 'users', 'storage', 'functions', 'secrets', 'keys', 'realtime', 'webhooks', 'cron', 'queues', 'vault', 'wrappers', 'config', 'inspect', 'snippets', 'network-restrictions', 'ssl-enforcement'] },
+  { title: 'Codegen', names: ['gen'] },
+  { title: 'AI agents', names: ['mcp'] },
+  { title: 'Shell', names: ['completion'] },
+];
+
+module.exports = { registry, groups };