@motherbase/cli 0.2.6 → 0.2.9

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Motherbase contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Motherbase contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -146,10 +146,17 @@ emits, so `createClient<Database>(url, key)` types every row, rejects unknown
 columns and types `.rpc()` calls:
 
 ```bash
-motherbase gen types typescript > database.types.ts
+motherbase gen types typescript            # in a terminal: writes ./database.types.ts
+motherbase gen types typescript > database.types.ts   # piped: prints the file
 motherbase gen types typescript --schema shop --output src/shop.types.ts
 ```
 
+The same `Database` also names the project's edge functions and buckets, under
+`__InternalMotherbase`, so `client.functions.invoke('…')` and
+`client.storage.from('…')` autocomplete with no extra generic. A name created
+after the file was generated still compiles. Since they are part of the file,
+adding a function or a bucket is drift for `--check` below.
+
 With no `--output` the file goes to stdout and nothing else does, so the
 redirect above produces a compiling file. `--local` skips the Console proxy and
 talks to a project API on this machine (`MOTHERBASE_URL`, default

package/bin/.motherbase/config.json

@@ -0,0 +1,5 @@
+{
+  "consoleUrl": "https://console.test.fidelix.pro",
+  "projectId": "gvask8",
+  "projectName": "gvask8"
+}

package/bin/motherbase.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-'use strict';
-
-const { main } = require('../src/main');
-
-main(process.argv.slice(2))
-  .then(code => { process.exitCode = code || 0; })
-  .catch(err => {
-    process.stderr.write((err && err.message ? err.message : String(err)) + '\n');
-    process.exitCode = 1;
-  });
+'use strict';
+
+const { main } = require('../src/main');
+
+main(process.argv.slice(2))
+  .then(code => { process.exitCode = code || 0; })
+  .catch(err => {
+    process.stderr.write((err && err.message ? err.message : String(err)) + '\n');
+    process.exitCode = 1;
+  });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/cli",
-  "version": "0.2.6",
+  "version": "0.2.9",
   "description": "Motherbase operator CLI: drives the Platform Console and linked projects.",
   "type": "commonjs",
   "bin": {
@@ -25,11 +25,11 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/JulienGuinot/Boilerplate-backend.git",
+    "url": "git+https://github.com/JulienGuinot/motherbase.git",
     "directory": "packages/cli"
   },
-  "homepage": "https://github.com/JulienGuinot/Boilerplate-backend#readme",
+  "homepage": "https://github.com/JulienGuinot/motherbase#readme",
   "bugs": {
-    "url": "https://github.com/JulienGuinot/Boilerplate-backend/issues"
+    "url": "https://github.com/JulienGuinot/motherbase/issues"
   }
 }

package/src/api.js

@@ -107,35 +107,57 @@ function consoleRequest(ctx, method, apiPath, { body, query } = {}) {
   return doFetch(url, { method, token, body });
 }
 
-// Login is special: no token yet. Uses Better Auth's native sign-in endpoint;
-// the session token comes back in the body and/or the `set-auth-token` header
-// (bearer plugin). Returns `{ token, user }` so the caller can persist it.
-async function loginRequest(consoleUrl, email, password) {
-  const url = `${consoleUrl}/api/auth/sign-in/email`;
+// Login is special: no token yet, so it talks to Better Auth's native endpoints
+// directly. Returns the raw response next to the parsed body because the token
+// lives in the `set-auth-token` header (bearer plugin) and the 2FA step needs
+// the response cookies.
+async function authPost(url, body, headers = {}) {
+  const finalHeaders = { 'content-type': 'application/json', ...headers };
+  const origin = originFor(url);
+  if (origin) finalHeaders['origin'] = origin;
   let res;
   try {
-    const headers = { 'content-type': 'application/json' };
-    const origin = originFor(url);
-    if (origin) headers['origin'] = origin;
-    res = await fetch(url, {
-      method: 'POST',
-      headers,
-      body: JSON.stringify({ email, password }),
-    });
+    res = await fetch(url, { method: 'POST', headers: finalHeaders, body: JSON.stringify(body) });
   } catch (err) {
     throw new CliError(`Cannot reach ${url}: ${err.message}`);
   }
   trace('POST', url, res);
   const text = await res.text();
-  let body;
-  if (text) { try { body = JSON.parse(text); } catch { body = undefined; } }
+  let parsed;
+  if (text) { try { parsed = JSON.parse(text); } catch { parsed = undefined; } }
   if (!res.ok) {
-    throw new CliError(errorMessage(res.status, body, text));
+    throw new CliError(errorMessage(res.status, parsed, text));
   }
+  return { res, body: parsed };
+}
+
+// The `two_factor` cookie (prefixed `__Secure-` on https) scopes the
+// verify-totp call to the pending sign-in.
+function twoFactorCookie(res) {
+  const setCookies = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : [];
+  const pair = setCookies.map(c => c.split(';')[0]).find(c => /two_factor=./.test(c));
+  if (!pair) throw new CliError('two-factor sign-in started but the server sent no two_factor cookie');
+  return pair;
+}
+
+// Returns `{ token, user }`, or `{ twoFactorCookie }` when the account has 2FA
+// enrolled. In that case Better Auth answers `{ twoFactorRedirect: true }` and
+// the `set-auth-token` header still carries the pre-2FA session it has just
+// deleted, so the header must not be trusted (see the console login route).
+async function loginRequest(consoleUrl, email, password) {
+  const { res, body } = await authPost(`${consoleUrl}/api/auth/sign-in/email`, { email, password });
+  if (body && body.twoFactorRedirect) return { twoFactorCookie: twoFactorCookie(res) };
   const token = (body && body.token) || res.headers.get('set-auth-token') || undefined;
   return { token, user: body && body.user };
 }
 
+// Second step of a 2FA sign-in: trade the TOTP code for the real session token.
+async function verifyTotpRequest(consoleUrl, cookie, code) {
+  const { res, body } = await authPost(`${consoleUrl}/api/auth/two-factor/verify-totp`, { code }, { cookie });
+  const token = res.headers.get('set-auth-token') || (body && body.token) || undefined;
+  return { token, user: body && body.user };
+}
+
 // ── Admin / resource (via proxy or direct) ───────────────────────────────────
 
 function adminBase(target) {
@@ -224,6 +246,7 @@ async function downloadFile(ctx, apiPath, destPath, { query } = {}) {
 module.exports = {
   consoleRequest,
   loginRequest,
+  verifyTotpRequest,
   adminRequest,
   projectUrl,
   uploadFile,

package/src/commands/_util.js

@@ -1,106 +1,106 @@
-'use strict';
-
-// Small shared helpers for command modules.
-
-const path = require('path');
-const { CliError } = require('../context');
-const { outputFormat, toYaml, toEnv } = require('../format');
-
-// Parse `key=value` tokens into an object. Values that look like numbers/bools are
-// coerced unless `raw` is set. Supports dotted keys via `--json`-style callers.
-function parseKeyValues(tokens, { coerce = true } = {}) {
-  const out = {};
-  for (const tok of tokens) {
-    const idx = tok.indexOf('=');
-    if (idx <= 0) throw new CliError(`expected key=value, got "${tok}"`);
-    const key = tok.slice(0, idx).trim();
-    let value = tok.slice(idx + 1);
-    if (coerce) {
-      if (value === 'true') value = true;
-      else if (value === 'false') value = false;
-      else if (value !== '' && !Number.isNaN(Number(value)) && /^-?\d+(\.\d+)?$/.test(value)) value = Number(value);
-    }
-    out[key] = value;
-  }
-  return out;
-}
-
-// Render a command's result in the selected `-o/--output` format; `pretty` is
-// the command's own human renderer.
-function output(ctx, data, humanFn) {
-  const ui = require('../ui');
-  switch (outputFormat(ctx.flags)) {
-    case 'json': ui.json(data); return;
-    case 'yaml': process.stdout.write(toYaml(data)); return;
-    case 'env': process.stdout.write(toEnv(data)); return;
-    default: humanFn(data, ui);
-  }
-}
-
-// The same command under a second (Supabase) name: one implementation, with
-// help that shows the name it was reached by.
-function alias(entry, usage, summary = entry.summary) {
-  return { ...entry, usage, summary };
-}
-
-// Parse a dotenv file: `KEY=value`, `export KEY=value`, `#` comments, and
-// single- or double-quoted values (double quotes expand \n).
-function parseDotenv(text) {
-  const out = {};
-  for (const raw of String(text).split(/\r?\n/)) {
-    const line = raw.trim().replace(/^export\s+/, '');
-    if (!line || line.startsWith('#')) continue;
-    const idx = line.indexOf('=');
-    if (idx <= 0) throw new CliError(`invalid env line: "${raw}"`);
-    const key = line.slice(0, idx).trim();
-    let value = line.slice(idx + 1).trim();
-    const quote = value[0];
-    if ((quote === '"' || quote === "'") && value.endsWith(quote) && value.length > 1) {
-      value = value.slice(1, -1);
-      if (quote === '"') value = value.replace(/\\n/g, '\n');
-    } else {
-      value = value.replace(/\s+#.*$/, '');
-    }
-    out[key] = value;
-  }
-  return out;
-}
-
-function requireArg(value, name) {
-  if (value === undefined || value === null || value === '') {
-    throw new CliError(`missing required argument: <${name}>`);
-  }
-  return value;
-}
-
-// Split "bucket:path" into { bucket, rest }.
-function splitRef(ref) {
-  const idx = ref.indexOf(':');
-  if (idx < 0) return { bucket: undefined, rest: ref };
-  return { bucket: ref.slice(0, idx), rest: ref.slice(idx + 1) };
-}
-
-// `/projects/<linked project>` on the Console, for the per-project platform
-// surfaces (branches, domains) that live on the Console rather than the
-// project API. They need a Console, so direct mode cannot reach them.
-function consoleProjectPath(ctx, suffix = '') {
-  ctx.requireConsole();
-  if (!ctx.projectId) {
-    throw new CliError('No project linked. Run `motherbase link` or pass --project-ref <id>.');
-  }
-  return `/projects/${encodeURIComponent(ctx.projectId)}${suffix}`;
-}
-
-// Join `parts` under `root`, refusing a result that escapes it. Names that come
-// from the server (object keys, function routes) must not write outside the
-// directory the user picked: `../../.bashrc` is a valid object key.
-function resolveInside(root, ...parts) {
-  const target = path.resolve(root, ...parts);
-  const rel = path.relative(root, target);
-  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
-    throw new CliError(`Refusing to write outside ${root}: ${parts.join('/')}`);
-  }
-  return target;
-}
-
-module.exports = { parseKeyValues, output, alias, parseDotenv, requireArg, splitRef, consoleProjectPath, resolveInside };
+'use strict';
+
+// Small shared helpers for command modules.
+
+const path = require('path');
+const { CliError } = require('../context');
+const { outputFormat, toYaml, toEnv } = require('../format');
+
+// Parse `key=value` tokens into an object. Values that look like numbers/bools are
+// coerced unless `raw` is set. Supports dotted keys via `--json`-style callers.
+function parseKeyValues(tokens, { coerce = true } = {}) {
+  const out = {};
+  for (const tok of tokens) {
+    const idx = tok.indexOf('=');
+    if (idx <= 0) throw new CliError(`expected key=value, got "${tok}"`);
+    const key = tok.slice(0, idx).trim();
+    let value = tok.slice(idx + 1);
+    if (coerce) {
+      if (value === 'true') value = true;
+      else if (value === 'false') value = false;
+      else if (value !== '' && !Number.isNaN(Number(value)) && /^-?\d+(\.\d+)?$/.test(value)) value = Number(value);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// Render a command's result in the selected `-o/--output` format; `pretty` is
+// the command's own human renderer.
+function output(ctx, data, humanFn) {
+  const ui = require('../ui');
+  switch (outputFormat(ctx.flags)) {
+    case 'json': ui.json(data); return;
+    case 'yaml': process.stdout.write(toYaml(data)); return;
+    case 'env': process.stdout.write(toEnv(data)); return;
+    default: humanFn(data, ui);
+  }
+}
+
+// The same command under a second (Supabase) name: one implementation, with
+// help that shows the name it was reached by.
+function alias(entry, usage, summary = entry.summary) {
+  return { ...entry, usage, summary };
+}
+
+// Parse a dotenv file: `KEY=value`, `export KEY=value`, `#` comments, and
+// single- or double-quoted values (double quotes expand \n).
+function parseDotenv(text) {
+  const out = {};
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim().replace(/^export\s+/, '');
+    if (!line || line.startsWith('#')) continue;
+    const idx = line.indexOf('=');
+    if (idx <= 0) throw new CliError(`invalid env line: "${raw}"`);
+    const key = line.slice(0, idx).trim();
+    let value = line.slice(idx + 1).trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote) && value.length > 1) {
+      value = value.slice(1, -1);
+      if (quote === '"') value = value.replace(/\\n/g, '\n');
+    } else {
+      value = value.replace(/\s+#.*$/, '');
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+function requireArg(value, name) {
+  if (value === undefined || value === null || value === '') {
+    throw new CliError(`missing required argument: <${name}>`);
+  }
+  return value;
+}
+
+// Split "bucket:path" into { bucket, rest }.
+function splitRef(ref) {
+  const idx = ref.indexOf(':');
+  if (idx < 0) return { bucket: undefined, rest: ref };
+  return { bucket: ref.slice(0, idx), rest: ref.slice(idx + 1) };
+}
+
+// `/projects/<linked project>` on the Console, for the per-project platform
+// surfaces (branches, domains) that live on the Console rather than the
+// project API. They need a Console, so direct mode cannot reach them.
+function consoleProjectPath(ctx, suffix = '') {
+  ctx.requireConsole();
+  if (!ctx.projectId) {
+    throw new CliError('No project linked. Run `motherbase link` or pass --project-ref <id>.');
+  }
+  return `/projects/${encodeURIComponent(ctx.projectId)}${suffix}`;
+}
+
+// Join `parts` under `root`, refusing a result that escapes it. Names that come
+// from the server (object keys, function routes) must not write outside the
+// directory the user picked: `../../.bashrc` is a valid object key.
+function resolveInside(root, ...parts) {
+  const target = path.resolve(root, ...parts);
+  const rel = path.relative(root, target);
+  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new CliError(`Refusing to write outside ${root}: ${parts.join('/')}`);
+  }
+  return target;
+}
+
+module.exports = { parseKeyValues, output, alias, parseDotenv, requireArg, splitRef, consoleProjectPath, resolveInside };

package/src/commands/backups.js

@@ -1,16 +1,16 @@
-'use strict';
-
-// Supabase's top-level `backups`. The implementations live under `db`, which
-// keeps its own names for them.
-
-const db = require('./db');
-const { alias } = require('./_util');
-
-module.exports = {
-  summary: 'List and restore database backups',
-  usage: 'motherbase backups <list|restore> ...',
-  subcommands: {
-    list: alias(db.subcommands.backups, 'motherbase backups list', 'List database backups'),
-    restore: alias(db.subcommands.restore, 'motherbase backups restore <file> | --key <remoteKey>  --confirm'),
-  },
-};
+'use strict';
+
+// Supabase's top-level `backups`. The implementations live under `db`, which
+// keeps its own names for them.
+
+const db = require('./db');
+const { alias } = require('./_util');
+
+module.exports = {
+  summary: 'List and restore database backups',
+  usage: 'motherbase backups <list|restore> ...',
+  subcommands: {
+    list: alias(db.subcommands.backups, 'motherbase backups list', 'List database backups'),
+    restore: alias(db.subcommands.restore, 'motherbase backups restore <file> | --key <remoteKey>  --confirm'),
+  },
+};