@motherbase/cli 0.2.6 → 0.2.8

package/src/commands/keys.js

@@ -1,72 +1,72 @@
-'use strict';
-
-// Project API keys. `secrets` next door is a different thing: those are values
-// an edge function reads, these are what a client presents to reach the project.
-
-const api = require('../api');
-const { output, requireArg } = require('./_util');
-
-const TYPES = ['publishable', 'secret'];
-
-const subcommands = {
-  list: {
-    summary: 'List project API keys',
-    usage: 'motherbase keys list',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/api-keys');
-      const keys = (data && data.keys) || [];
-      output(ctx, data, (_d, ui) =>
-        ui.table(
-          keys.map(k => ({
-            name: k.name,
-            type: k.type,
-            // A secret key has no stored clear value; the prefix is all there is.
-            key: k.token || `${k.prefix}…`,
-            status: k.revokedAt ? 'revoked' : 'active',
-          })),
-          [
-            { key: 'name', label: 'NAME' },
-            { key: 'type', label: 'TYPE' },
-            { key: 'key', label: 'KEY' },
-            { key: 'status', label: 'STATUS' },
-          ],
-        ),
-      );
-    },
-  },
-  create: {
-    summary: 'Create a key. A secret key is printed once and never again',
-    usage: 'motherbase keys create <NAME> [--type publishable|secret]',
-    async run(ctx, args, flags) {
-      const name = requireArg(args[0], 'NAME');
-      const type = flags.type || 'secret';
-      if (!TYPES.includes(type)) {
-        throw new Error(`--type must be one of: ${TYPES.join(', ')}`);
-      }
-      const data = await api.adminRequest(ctx, 'POST', '/api-keys', { body: { name, type } });
-      output(ctx, data, (d, ui) => {
-        ui.success(`Created ${type} key "${name}"`);
-        ui.print(d.clearToken);
-        if (type === 'secret') {
-          ui.warn('Copy it now. It is stored hashed and cannot be shown again.');
-          ui.warn('It bypasses row level security: keep it server side.');
-        }
-      });
-    },
-  },
-  revoke: {
-    summary: 'Revoke a key by id',
-    usage: 'motherbase keys revoke <ID>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'ID');
-      const data = await api.adminRequest(ctx, 'DELETE', `/api-keys/${encodeURIComponent(id)}`);
-      output(ctx, data, (d, ui) => ui.success(`Revoked key ${d.name || id}`));
-    },
-  },
-};
-
-module.exports = {
-  summary: 'Project API keys (publishable and secret)',
-  usage: 'motherbase keys <list|create|revoke> ...',
-  subcommands,
-};
+'use strict';
+
+// Project API keys. `secrets` next door is a different thing: those are values
+// an edge function reads, these are what a client presents to reach the project.
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+const TYPES = ['publishable', 'secret'];
+
+const subcommands = {
+  list: {
+    summary: 'List project API keys',
+    usage: 'motherbase keys list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/api-keys');
+      const keys = (data && data.keys) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(
+          keys.map(k => ({
+            name: k.name,
+            type: k.type,
+            // A secret key has no stored clear value; the prefix is all there is.
+            key: k.token || `${k.prefix}…`,
+            status: k.revokedAt ? 'revoked' : 'active',
+          })),
+          [
+            { key: 'name', label: 'NAME' },
+            { key: 'type', label: 'TYPE' },
+            { key: 'key', label: 'KEY' },
+            { key: 'status', label: 'STATUS' },
+          ],
+        ),
+      );
+    },
+  },
+  create: {
+    summary: 'Create a key. A secret key is printed once and never again',
+    usage: 'motherbase keys create <NAME> [--type publishable|secret]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'NAME');
+      const type = flags.type || 'secret';
+      if (!TYPES.includes(type)) {
+        throw new Error(`--type must be one of: ${TYPES.join(', ')}`);
+      }
+      const data = await api.adminRequest(ctx, 'POST', '/api-keys', { body: { name, type } });
+      output(ctx, data, (d, ui) => {
+        ui.success(`Created ${type} key "${name}"`);
+        ui.print(d.clearToken);
+        if (type === 'secret') {
+          ui.warn('Copy it now. It is stored hashed and cannot be shown again.');
+          ui.warn('It bypasses row level security: keep it server side.');
+        }
+      });
+    },
+  },
+  revoke: {
+    summary: 'Revoke a key by id',
+    usage: 'motherbase keys revoke <ID>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'ID');
+      const data = await api.adminRequest(ctx, 'DELETE', `/api-keys/${encodeURIComponent(id)}`);
+      output(ctx, data, (d, ui) => ui.success(`Revoked key ${d.name || id}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Project API keys (publishable and secret)',
+  usage: 'motherbase keys <list|create|revoke> ...',
+  subcommands,
+};

package/src/commands/link.js

@@ -1,35 +1,35 @@
-'use strict';
-
-const api = require('../api');
-const config = require('../config');
-const prompt = require('../prompt');
-const ui = require('../ui');
-const { CliError } = require('../context');
-
-module.exports = {
-  summary: 'Link the current directory to a project (writes ./.motherbase/config.json)',
-  usage: 'motherbase link [projectNameOrId]',
-  async run(ctx, args, flags) {
-    const { consoleUrl } = ctx.requireConsole();
-    const projects = await api.consoleRequest(ctx, 'GET', '/projects');
-    const list = Array.isArray(projects) ? projects : [];
-    if (list.length === 0) throw new CliError('No projects available on this console.');
-
-    let picked = args[0];
-    if (!picked) {
-      if (flags.yes) throw new CliError('Specify a project name/id when using --yes.');
-      ui.print(ui.color.bold('Available projects:'));
-      list.forEach((p, i) => ui.print(`  ${i + 1}. ${p.name || p.id}`));
-      const answer = await prompt.question('Pick a project (number or name): ');
-      const asNum = Number(answer);
-      picked = Number.isInteger(asNum) && list[asNum - 1] ? (list[asNum - 1].name || list[asNum - 1].id) : answer;
-    }
-
-    const match = list.find(p => p.name === picked || p.id === picked);
-    if (!match) throw new CliError(`Project "${picked}" not found on ${consoleUrl}.`);
-
-    const projectId = match.name || match.id;
-    config.writeLink(ctx.cwd, { consoleUrl, projectId, projectName: match.name || projectId });
-    ui.success(`Linked ${ctx.cwd} → ${projectId} (${consoleUrl})`);
-  },
-};
+'use strict';
+
+const api = require('../api');
+const config = require('../config');
+const prompt = require('../prompt');
+const ui = require('../ui');
+const { CliError } = require('../context');
+
+module.exports = {
+  summary: 'Link the current directory to a project (writes ./.motherbase/config.json)',
+  usage: 'motherbase link [projectNameOrId]',
+  async run(ctx, args, flags) {
+    const { consoleUrl } = ctx.requireConsole();
+    const projects = await api.consoleRequest(ctx, 'GET', '/projects');
+    const list = Array.isArray(projects) ? projects : [];
+    if (list.length === 0) throw new CliError('No projects available on this console.');
+
+    let picked = args[0];
+    if (!picked) {
+      if (flags.yes) throw new CliError('Specify a project name/id when using --yes.');
+      ui.print(ui.color.bold('Available projects:'));
+      list.forEach((p, i) => ui.print(`  ${i + 1}. ${p.name || p.id}`));
+      const answer = await prompt.question('Pick a project (number or name): ');
+      const asNum = Number(answer);
+      picked = Number.isInteger(asNum) && list[asNum - 1] ? (list[asNum - 1].name || list[asNum - 1].id) : answer;
+    }
+
+    const match = list.find(p => p.name === picked || p.id === picked);
+    if (!match) throw new CliError(`Project "${picked}" not found on ${consoleUrl}.`);
+
+    const projectId = match.name || match.id;
+    config.writeLink(ctx.cwd, { consoleUrl, projectId, projectName: match.name || projectId });
+    ui.success(`Linked ${ctx.cwd} → ${projectId} (${consoleUrl})`);
+  },
+};

package/src/commands/local.js

@@ -18,10 +18,15 @@ const { CliError } = require('../context');
 const COMPOSE_FILE = 'docker-compose.yml';
 const ENV_FILE = '.env';
 
-// Where the images are built from when the caller has no checkout. Docker
-// Compose accepts a git URL as a build context, so a scaffolded directory needs
-// nothing but Docker: no clone, no registry, no published image. The first `up`
-// pays for the build; every one after that is cached.
+// By default the stack runs the images CI publishes after every green build of
+// the default branch, so `start` pulls instead of compiling. Building from a git
+// context used to be the default and could not work on a clean machine: the API
+// image derives from a base image (motherbase-deps) that only the repository's
+// own build script produces.
+const DEFAULT_REGISTRY = 'ghcr.io/julienguinot';
+const DEFAULT_TAG = 'latest';
+// Build-from-source mode, kept for --repo / --ref. It needs motherbase-deps:1.0.0
+// built locally first (see the compose header it writes).
 const DEFAULT_REPO = 'https://github.com/JulienGuinot/BoilerPlate-Backend.git';
 const DEFAULT_REF = 'master';
 
@@ -59,6 +64,14 @@ function renderEnv(context) {
     `BASE_HOST=localhost:${context.port}`,
     'NODE_ENV=production',
     '',
+    '# Origins allowed to call this API from a browser. Required: the API refuses',
+    '# to boot in production without an explicit list. Comma-separated.',
+    `CORS_ORIGINS=${context.corsOrigins}`,
+    '',
+    '# Raw SQL over the admin API (`motherbase db sql`). This stack has no Console',
+    '# in front of it, so the admin API is the only way in.',
+    'CONSOLE_SQL_ENABLED=true',
+    '',
     '# Secrets. Regenerating any of these invalidates what it protects:',
     '# JWT_SECRET signs sessions, CONFIG_ENCRYPTION_KEY encrypts Studio-managed',
     '# secrets (SMTP, OAuth credentials) at rest.',
@@ -67,6 +80,7 @@ function renderEnv(context) {
     `POSTGRES_PASSWORD=${hex(16)}`,
     `S3_ACCESS_KEY_ID=${hex(8)}`,
     `S3_SECRET_ACCESS_KEY=${hex(20)}`,
+    `EDGE_RUNTIME_TOKEN=${hex(24)}`,
     '',
     'S3_BUCKET=uploads',
     'S3_PUBLIC_BUCKET=public',
@@ -77,29 +91,44 @@ function renderEnv(context) {
     'MINIO_PORT=59000',
     'MINIO_CONSOLE_PORT=59001',
     '',
-    '# First operator account, created on first boot.',
+    '# Operator account. Created (or reset to these values) by running the seed',
+    '# once: docker compose exec api node apps/server/dist/prisma/seed.js',
     `SEED_ADMIN_EMAIL=${context.adminEmail}`,
     `SEED_ADMIN_PASSWORD=${context.adminPassword}`,
     '',
+    ...(context.mode === 'image'
+      ? [
+          '# Published images this stack runs. Pin MOTHERBASE_TAG to a sha-<commit> tag',
+          '# to stop `docker compose pull` from moving it.',
+          `MOTHERBASE_REGISTRY=${context.registry}`,
+          `MOTHERBASE_TAG=${context.tag}`,
+          '',
+        ]
+      : []),
   ].join('\n');
 }
 
 function renderCompose(context) {
   const buildContext = `${context.repo}#${context.ref}`;
+  const fromImages = context.mode === 'image';
+  const image = name => `\${MOTHERBASE_REGISTRY:-${DEFAULT_REGISTRY}}/motherbase-${name}:\${MOTHERBASE_TAG:-${DEFAULT_TAG}}`;
+  const source = (dockerfile, indent = '    ') => fromImages
+    ? ''
+    : `${indent}build:\n${indent}  context: ${buildContext}\n${dockerfile ? `${indent}  dockerfile: ${dockerfile}\n` : ''}`;
+  const header = fromImages
+    ? `# Runs the images published for Motherbase (MOTHERBASE_REGISTRY / MOTHERBASE_TAG
+# in .env), so this directory needs Docker and nothing else. \`docker compose pull\`
+# then \`motherbase start\` updates it.`
+    : `# Builds from ${buildContext}. The API image derives from motherbase-deps:1.0.0,
+# which Compose cannot build: in a checkout of that repository, run
+#   docker build -t motherbase-deps:1.0.0 -f deploy/deps.Dockerfile .
+# once first. Point every \`context:\` value at that checkout to build locally.`;
   return `# Generated by \`motherbase init\`.
 #
-# Images are built from the public repository, so this directory needs Docker and
-# nothing else: no checkout, no registry login. The first \`up\` builds them, which
-# takes a few minutes; after that the layers are cached.
-#
-# Working from a checkout instead? Replace both \`context:\` values with the path
-# to it and the build becomes local and incremental.
+${header}
 services:
   db:
-    build:
-      context: ${buildContext}
-      dockerfile: deploy/postgres.Dockerfile
-    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
+${fromImages ? `    image: ${image('postgres')}\n` : source('deploy/postgres.Dockerfile')}    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
     restart: unless-stopped
     environment:
       POSTGRES_USER: postgres
@@ -138,7 +167,11 @@ services:
 
   # One-shot: a private bucket and a separate anonymously-downloadable one.
   createbuckets:
-    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
+    # Not quay.io/minio/mc: that path now requires a registry login.
+    image: bitnamilegacy/minio-client:2025.5.21
+    # mc keeps its config under $HOME; the image's HOME (/) is not writable.
+    environment:
+      HOME: /tmp
     depends_on:
       minio:
         condition: service_healthy
@@ -152,10 +185,27 @@ services:
       echo 'buckets ready';
       "
 
+  # Runs edge functions. Only the API shares its network, so function code has
+  # no route to Postgres or MinIO.
+  edge-runtime:
+${fromImages ? `    image: ${image('edge-runtime')}\n` : source('deploy/edge-runtime.Dockerfile')}    restart: unless-stopped
+    environment:
+      EDGE_RUNTIME_PORT: 9000
+      DENO_DIR: /tmp/deno-dir
+      EDGE_RUNTIME_TOKEN: \${EDGE_RUNTIME_TOKEN:?EDGE_RUNTIME_TOKEN is required}
+      EDGE_ALLOWED_INTERNAL_ORIGINS: http://api:5001
+    networks:
+      - edge
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
   api:
-    build:
-      context: ${buildContext}
-    restart: unless-stopped
+${fromImages ? `    image: ${image('api')}\n` : source(null)}    restart: unless-stopped
     depends_on:
       db:
         condition: service_healthy
@@ -163,6 +213,8 @@ services:
         condition: service_healthy
       createbuckets:
         condition: service_completed_successfully
+      edge-runtime:
+        condition: service_started
     env_file:
       - ${ENV_FILE}
     # Container-internal wiring, overriding the localhost values in .env so the
@@ -173,13 +225,24 @@ services:
       DATABASE_URL: postgresql://postgres:\${POSTGRES_PASSWORD}@db:5432/app?schema=public
       STORAGE_DRIVER: s3
       S3_ENDPOINT: http://minio:9000
+      # Signed URLs are fetched from this machine, where MinIO is published on
+      # MINIO_PORT, not at its container address.
+      S3_PRESIGN_ENDPOINT: http://localhost:\${MINIO_PORT:-59000}
       DB_PORT: \${POSTGRES_PORT:-55432}
+      EDGE_RUNTIME_URL: http://edge-runtime:9000
+      EDGE_RUNTIME_CALLBACK_URL: http://api:5001
     ports:
       - '\${PORT:-5001}:5001'
+    networks:
+      - default
+      - edge
 
 volumes:
   db_data:
   minio_data:
+
+networks:
+  edge:
 `;
 }
 
@@ -189,8 +252,11 @@ volumes:
 const INIT_FLAG_PATTERNS = {
   'admin-email': /^[^\s"'`$#\\]+$/,
   'admin-password': /^[^\s"'`$#\\]+$/,
+  'cors-origins': /^[\w.:/,*-]+$/,
   repo: /^[\w.:/@~+-]+$/,
   ref: /^[\w./-]+$/,
+  registry: /^[\w.:/-]+$/,
+  tag: /^[\w.-]+$/,
 };
 
 function validateInitFlags(flags) {
@@ -205,7 +271,7 @@ function validateInitFlags(flags) {
 
 const init = {
   summary: 'Scaffold a runnable local stack (compose file, .env, generated secrets)',
-  usage: 'motherbase init [dir] [--port 5001] [--repo URL] [--ref BRANCH] [--force]',
+  usage: 'motherbase init [dir] [--port 5001] [--cors-origins http://localhost:3000] [--tag latest] [--repo URL --ref BRANCH] [--force]',
   async run(ctx, args, flags = {}) {
     validateInitFlags(flags);
     const dir = args[0] || '.';
@@ -215,6 +281,11 @@ const init = {
     const context = {
       port: Number(flags.port) || 5001,
       postgresPort: Number(flags['postgres-port']) || 55432,
+      corsOrigins: flags['cors-origins'] || 'http://localhost:3000',
+      // --repo / --ref ask for a source build; anything else runs published images.
+      mode: flags.repo || flags.ref ? 'source' : 'image',
+      registry: flags.registry || DEFAULT_REGISTRY,
+      tag: flags.tag || DEFAULT_TAG,
       repo: flags.repo || DEFAULT_REPO,
       ref: flags.ref || DEFAULT_REF,
       adminEmail: flags['admin-email'] || 'admin@example.com',
@@ -243,13 +314,19 @@ const init = {
       ui.warn(`kept existing ${skipped.join(', ')} (use --force to overwrite, which discards their secrets)`);
     }
     if (written.includes(ENV_FILE)) {
+      // No Studio here: Studio is served by the Platform Console, which this
+      // stack does not include. Saying otherwise sent people to a URL that
+      // answers JSON.
       ui.print('');
-      ui.print(`  Studio:   http://localhost:${context.port}`);
-      ui.print(`  Sign in:  ${context.adminEmail} / ${context.adminPassword}`);
+      ui.print(`  API:       http://localhost:${context.port}   (no Studio: that comes with the Platform Console)`);
+      ui.print(`  Operator:  ${context.adminEmail} / ${context.adminPassword}`);
       ui.print('');
       ui.print('  Next:');
       if (dir !== '.') ui.print(`    cd ${dir}`);
-      ui.print('    motherbase start        # first run builds the images, give it a few minutes');
+      ui.print(context.mode === 'image'
+        ? '    motherbase start        # pulls the images on first run'
+        : '    motherbase start        # builds the images on first run (see the compose header)');
+      ui.print('    docker compose exec api node apps/server/dist/prisma/seed.js   # once, creates the operator');
       ui.print('');
     }
   },

package/src/commands/login.js

@@ -8,7 +8,7 @@ const { CliError } = require('../context');
 
 module.exports = {
   summary: 'Log in to a Motherbase Console (email/password → session token)',
-  usage: 'motherbase login [--url <consoleUrl>] [--email <email>]',
+  usage: 'motherbase login [--url <consoleUrl>] [--email <email>] [--code <totp>]',
   async run(ctx, args, flags) {
     const consoleUrl = config.normalizeUrl(
       flags.url || ctx.env.MOTHERBASE_CONSOLE_URL || ctx.consoleUrl || '',
@@ -25,13 +25,19 @@ module.exports = {
       return;
     }
 
+
     const email = flags.email || (await prompt.question('Email: '));
     if (!email) throw new CliError('email is required');
     const password = (typeof flags.password === 'string' && flags.password) || (await prompt.password('Password: '));
     if (!password) throw new CliError('password is required');
 
-    const data = await api.loginRequest(consoleUrl, email, password);
-    const token = data && data.token;
+    let data = await api.loginRequest(consoleUrl, email, password);
+    if (data.twoFactorCookie) {
+      const code = (typeof flags.code === 'string' && flags.code) || (await prompt.question('Authenticator code: '));
+      if (!code) throw new CliError('two-factor code is required');
+      data = await api.verifyTotpRequest(consoleUrl, data.twoFactorCookie, code);
+    }
+    const token = data.token;
     if (!token) throw new CliError('login succeeded but no token was returned');
     config.saveConsoleToken(consoleUrl, token, email);
     ui.success(`Logged in to ${consoleUrl} as ${email}`);

package/src/commands/logout.js

@@ -1,16 +1,16 @@
-'use strict';
-
-const config = require('../config');
-const ui = require('../ui');
-const { CliError } = require('../context');
-
-module.exports = {
-  summary: 'Remove the stored token for the current (or --url) console',
-  usage: 'motherbase logout [--url <consoleUrl>]',
-  async run(ctx) {
-    const url = config.normalizeUrl(ctx.flags.url || ctx.consoleUrl || '');
-    if (!url) throw new CliError('No console to log out of.');
-    config.clearConsoleToken(url);
-    ui.success(`Logged out of ${url}`);
-  },
-};
+'use strict';
+
+const config = require('../config');
+const ui = require('../ui');
+const { CliError } = require('../context');
+
+module.exports = {
+  summary: 'Remove the stored token for the current (or --url) console',
+  usage: 'motherbase logout [--url <consoleUrl>]',
+  async run(ctx) {
+    const url = config.normalizeUrl(ctx.flags.url || ctx.consoleUrl || '');
+    if (!url) throw new CliError('No console to log out of.');
+    config.clearConsoleToken(url);
+    ui.success(`Logged out of ${url}`);
+  },
+};

package/src/commands/mcp.js

@@ -1,61 +1,61 @@
-'use strict';
-
-// `motherbase mcp`: expose the linked project, and the console's organizations
-// and projects, to an AI agent over the Model Context Protocol.
-//
-// The transport is stdio, which is how an MCP client launches a server: it spawns
-// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
-// stdout except protocol messages, so diagnostics go to stderr.
-
-const { serve, toolServer } = require('../mcp/protocol');
-const { buildTools } = require('../mcp/tools');
-const { CliError } = require('../context');
-
-const pkg = require('../../package.json');
-
-/** Whether a `require*()` resolves, without surfacing its error. */
-function reaches(resolve) {
-  try {
-    resolve();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-const mcp = {
-  summary: 'Serve the linked project and console to an AI agent over MCP (stdio)',
-  usage: 'motherbase mcp [--write]',
-  async run(ctx, _args, flags = {}) {
-    // Resolve what this session reaches up front. Failing here is a clear CLI
-    // error; failing on the first tool call is an opaque one inside someone's agent.
-    const scope = { project: reaches(() => ctx.requireProject()), console: reaches(() => ctx.requireConsole()) };
-    if (!scope.project && !scope.console) {
-      throw new CliError(
-        'Nothing to serve. Run `motherbase login` for the organization and project tools, and `motherbase link` '
-          + '(or set MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN) for the database tools.',
-      );
-    }
-
-    const write = Boolean(flags.write);
-    const tools = buildTools(ctx, { write, ...scope });
-
-    process.stderr.write(
-      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
-        + `Project: ${scope.project ? ctx.projectName || ctx.projectId || 'direct' : 'none linked'}. `
-        + `Console: ${scope.console ? ctx.consoleUrl : 'not logged in'}\n`,
-    );
-    if (!write) {
-      process.stderr.write('  Pass --write to expose apply_migration, raw SQL writes, function deploys and project lifecycle.\n');
-    }
-
-    await serve({
-      input: process.stdin,
-      output: process.stdout,
-      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
-      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
-    });
-  },
-};
-
-module.exports = mcp;
+'use strict';
+
+// `motherbase mcp`: expose the linked project, and the console's organizations
+// and projects, to an AI agent over the Model Context Protocol.
+//
+// The transport is stdio, which is how an MCP client launches a server: it spawns
+// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
+// stdout except protocol messages, so diagnostics go to stderr.
+
+const { serve, toolServer } = require('../mcp/protocol');
+const { buildTools } = require('../mcp/tools');
+const { CliError } = require('../context');
+
+const pkg = require('../../package.json');
+
+/** Whether a `require*()` resolves, without surfacing its error. */
+function reaches(resolve) {
+  try {
+    resolve();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const mcp = {
+  summary: 'Serve the linked project and console to an AI agent over MCP (stdio)',
+  usage: 'motherbase mcp [--write]',
+  async run(ctx, _args, flags = {}) {
+    // Resolve what this session reaches up front. Failing here is a clear CLI
+    // error; failing on the first tool call is an opaque one inside someone's agent.
+    const scope = { project: reaches(() => ctx.requireProject()), console: reaches(() => ctx.requireConsole()) };
+    if (!scope.project && !scope.console) {
+      throw new CliError(
+        'Nothing to serve. Run `motherbase login` for the organization and project tools, and `motherbase link` '
+          + '(or set MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN) for the database tools.',
+      );
+    }
+
+    const write = Boolean(flags.write);
+    const tools = buildTools(ctx, { write, ...scope });
+
+    process.stderr.write(
+      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
+        + `Project: ${scope.project ? ctx.projectName || ctx.projectId || 'direct' : 'none linked'}. `
+        + `Console: ${scope.console ? ctx.consoleUrl : 'not logged in'}\n`,
+    );
+    if (!write) {
+      process.stderr.write('  Pass --write to expose apply_migration, raw SQL writes, function deploys and project lifecycle.\n');
+    }
+
+    await serve({
+      input: process.stdin,
+      output: process.stdout,
+      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
+      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
+    });
+  },
+};
+
+module.exports = mcp;

package/src/commands/migrate.js

@@ -80,11 +80,6 @@ const UNSUPPORTED = [
     what: 'auth.mfa.*',
     advice: 'Use auth.twoFactor: enable({ password }), verifyTotp({ code }), disable({ password }).',
   },
-  {
-    pattern: /transform\s*:\s*\{/g,
-    what: 'storage image transform options',
-    advice: 'No image pipeline yet. Store the sizes you need at upload time.',
-  },
   {
     pattern: /\.delete\(\s*\)\s*(?![\s\S]{0,200}?\.(eq|neq|in|gt|gte|lt|lte|like|ilike|is|filter|match|or|not)\()/g,
     what: 'delete() with no filter',

package/src/commands/migration.js

@@ -27,7 +27,7 @@ const subcommands = {
       fs.mkdirSync(dir, { recursive: true });
       const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+/, '').replace('T', '');
       const file = path.join(dir, `${stamp}_${name}.sql`);
-      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`);
+      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`, { flag: 'wx' });
       ui.success(`Created ${path.relative(ctx.cwd, file)}`);
     },
   },