@motherbase/cli 0.2.6 → 0.2.9

package/src/commands/local.js

@@ -18,11 +18,16 @@ const { CliError } = require('../context');
 const COMPOSE_FILE = 'docker-compose.yml';
 const ENV_FILE = '.env';
 
-// Where the images are built from when the caller has no checkout. Docker
-// Compose accepts a git URL as a build context, so a scaffolded directory needs
-// nothing but Docker: no clone, no registry, no published image. The first `up`
-// pays for the build; every one after that is cached.
-const DEFAULT_REPO = 'https://github.com/JulienGuinot/BoilerPlate-Backend.git';
+// By default the stack runs the images CI publishes after every green build of
+// the default branch, so `start` pulls instead of compiling. Building from a git
+// context used to be the default and could not work on a clean machine: the API
+// image derives from a base image (motherbase-deps) that only the repository's
+// own build script produces.
+const DEFAULT_REGISTRY = 'ghcr.io/julienguinot';
+const DEFAULT_TAG = 'latest';
+// Build-from-source mode, kept for --repo / --ref. It needs motherbase-deps:1.0.0
+// built locally first (see the compose header it writes).
+const DEFAULT_REPO = 'https://github.com/JulienGuinot/motherbase.git';
 const DEFAULT_REF = 'master';
 
 function dockerCompose(composeArgs) {
@@ -59,6 +64,14 @@ function renderEnv(context) {
     `BASE_HOST=localhost:${context.port}`,
     'NODE_ENV=production',
     '',
+    '# Origins allowed to call this API from a browser. Required: the API refuses',
+    '# to boot in production without an explicit list. Comma-separated.',
+    `CORS_ORIGINS=${context.corsOrigins}`,
+    '',
+    '# Raw SQL over the admin API (`motherbase db sql`). This stack has no Console',
+    '# in front of it, so the admin API is the only way in.',
+    'CONSOLE_SQL_ENABLED=true',
+    '',
     '# Secrets. Regenerating any of these invalidates what it protects:',
     '# JWT_SECRET signs sessions, CONFIG_ENCRYPTION_KEY encrypts Studio-managed',
     '# secrets (SMTP, OAuth credentials) at rest.',
@@ -67,6 +80,7 @@ function renderEnv(context) {
     `POSTGRES_PASSWORD=${hex(16)}`,
     `S3_ACCESS_KEY_ID=${hex(8)}`,
     `S3_SECRET_ACCESS_KEY=${hex(20)}`,
+    `EDGE_RUNTIME_TOKEN=${hex(24)}`,
     '',
     'S3_BUCKET=uploads',
     'S3_PUBLIC_BUCKET=public',
@@ -77,29 +91,44 @@ function renderEnv(context) {
     'MINIO_PORT=59000',
     'MINIO_CONSOLE_PORT=59001',
     '',
-    '# First operator account, created on first boot.',
+    '# Operator account. Created (or reset to these values) by running the seed',
+    '# once: docker compose exec api node apps/server/dist/prisma/seed.js',
     `SEED_ADMIN_EMAIL=${context.adminEmail}`,
     `SEED_ADMIN_PASSWORD=${context.adminPassword}`,
     '',
+    ...(context.mode === 'image'
+      ? [
+          '# Published images this stack runs. Pin MOTHERBASE_TAG to a sha-<commit> tag',
+          '# to stop `docker compose pull` from moving it.',
+          `MOTHERBASE_REGISTRY=${context.registry}`,
+          `MOTHERBASE_TAG=${context.tag}`,
+          '',
+        ]
+      : []),
   ].join('\n');
 }
 
 function renderCompose(context) {
   const buildContext = `${context.repo}#${context.ref}`;
+  const fromImages = context.mode === 'image';
+  const image = name => `\${MOTHERBASE_REGISTRY:-${DEFAULT_REGISTRY}}/motherbase-${name}:\${MOTHERBASE_TAG:-${DEFAULT_TAG}}`;
+  const source = (dockerfile, indent = '    ') => fromImages
+    ? ''
+    : `${indent}build:\n${indent}  context: ${buildContext}\n${dockerfile ? `${indent}  dockerfile: ${dockerfile}\n` : ''}`;
+  const header = fromImages
+    ? `# Runs the images published for Motherbase (MOTHERBASE_REGISTRY / MOTHERBASE_TAG
+# in .env), so this directory needs Docker and nothing else. \`docker compose pull\`
+# then \`motherbase start\` updates it.`
+    : `# Builds from ${buildContext}. The API image derives from motherbase-deps:1.0.0,
+# which Compose cannot build: in a checkout of that repository, run
+#   docker build -t motherbase-deps:1.0.0 -f deploy/deps.Dockerfile .
+# once first. Point every \`context:\` value at that checkout to build locally.`;
   return `# Generated by \`motherbase init\`.
 #
-# Images are built from the public repository, so this directory needs Docker and
-# nothing else: no checkout, no registry login. The first \`up\` builds them, which
-# takes a few minutes; after that the layers are cached.
-#
-# Working from a checkout instead? Replace both \`context:\` values with the path
-# to it and the build becomes local and incremental.
+${header}
 services:
   db:
-    build:
-      context: ${buildContext}
-      dockerfile: deploy/postgres.Dockerfile
-    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
+${fromImages ? `    image: ${image('postgres')}\n` : source('deploy/postgres.Dockerfile')}    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
     restart: unless-stopped
     environment:
       POSTGRES_USER: postgres
@@ -138,7 +167,11 @@ services:
 
   # One-shot: a private bucket and a separate anonymously-downloadable one.
   createbuckets:
-    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
+    # Not quay.io/minio/mc: that path now requires a registry login.
+    image: bitnamilegacy/minio-client:2025.5.21
+    # mc keeps its config under $HOME; the image's HOME (/) is not writable.
+    environment:
+      HOME: /tmp
     depends_on:
       minio:
         condition: service_healthy
@@ -152,10 +185,27 @@ services:
       echo 'buckets ready';
       "
 
+  # Runs edge functions. Only the API shares its network, so function code has
+  # no route to Postgres or MinIO.
+  edge-runtime:
+${fromImages ? `    image: ${image('edge-runtime')}\n` : source('deploy/edge-runtime.Dockerfile')}    restart: unless-stopped
+    environment:
+      EDGE_RUNTIME_PORT: 9000
+      DENO_DIR: /tmp/deno-dir
+      EDGE_RUNTIME_TOKEN: \${EDGE_RUNTIME_TOKEN:?EDGE_RUNTIME_TOKEN is required}
+      EDGE_ALLOWED_INTERNAL_ORIGINS: http://api:5001
+    networks:
+      - edge
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
   api:
-    build:
-      context: ${buildContext}
-    restart: unless-stopped
+${fromImages ? `    image: ${image('api')}\n` : source(null)}    restart: unless-stopped
     depends_on:
       db:
         condition: service_healthy
@@ -163,6 +213,8 @@ services:
         condition: service_healthy
       createbuckets:
         condition: service_completed_successfully
+      edge-runtime:
+        condition: service_started
     env_file:
       - ${ENV_FILE}
     # Container-internal wiring, overriding the localhost values in .env so the
@@ -173,13 +225,24 @@ services:
       DATABASE_URL: postgresql://postgres:\${POSTGRES_PASSWORD}@db:5432/app?schema=public
       STORAGE_DRIVER: s3
       S3_ENDPOINT: http://minio:9000
+      # Signed URLs are fetched from this machine, where MinIO is published on
+      # MINIO_PORT, not at its container address.
+      S3_PRESIGN_ENDPOINT: http://localhost:\${MINIO_PORT:-59000}
       DB_PORT: \${POSTGRES_PORT:-55432}
+      EDGE_RUNTIME_URL: http://edge-runtime:9000
+      EDGE_RUNTIME_CALLBACK_URL: http://api:5001
     ports:
       - '\${PORT:-5001}:5001'
+    networks:
+      - default
+      - edge
 
 volumes:
   db_data:
   minio_data:
+
+networks:
+  edge:
 `;
 }
 
@@ -189,8 +252,11 @@ volumes:
 const INIT_FLAG_PATTERNS = {
   'admin-email': /^[^\s"'`$#\\]+$/,
   'admin-password': /^[^\s"'`$#\\]+$/,
+  'cors-origins': /^[\w.:/,*-]+$/,
   repo: /^[\w.:/@~+-]+$/,
   ref: /^[\w./-]+$/,
+  registry: /^[\w.:/-]+$/,
+  tag: /^[\w.-]+$/,
 };
 
 function validateInitFlags(flags) {
@@ -205,7 +271,7 @@ function validateInitFlags(flags) {
 
 const init = {
   summary: 'Scaffold a runnable local stack (compose file, .env, generated secrets)',
-  usage: 'motherbase init [dir] [--port 5001] [--repo URL] [--ref BRANCH] [--force]',
+  usage: 'motherbase init [dir] [--port 5001] [--cors-origins http://localhost:3000] [--tag latest] [--repo URL --ref BRANCH] [--force]',
   async run(ctx, args, flags = {}) {
     validateInitFlags(flags);
     const dir = args[0] || '.';
@@ -215,6 +281,11 @@ const init = {
     const context = {
       port: Number(flags.port) || 5001,
       postgresPort: Number(flags['postgres-port']) || 55432,
+      corsOrigins: flags['cors-origins'] || 'http://localhost:3000',
+      // --repo / --ref ask for a source build; anything else runs published images.
+      mode: flags.repo || flags.ref ? 'source' : 'image',
+      registry: flags.registry || DEFAULT_REGISTRY,
+      tag: flags.tag || DEFAULT_TAG,
       repo: flags.repo || DEFAULT_REPO,
       ref: flags.ref || DEFAULT_REF,
       adminEmail: flags['admin-email'] || 'admin@example.com',
@@ -243,13 +314,19 @@ const init = {
       ui.warn(`kept existing ${skipped.join(', ')} (use --force to overwrite, which discards their secrets)`);
     }
     if (written.includes(ENV_FILE)) {
+      // No Studio here: Studio is served by the Platform Console, which this
+      // stack does not include. Saying otherwise sent people to a URL that
+      // answers JSON.
       ui.print('');
-      ui.print(`  Studio:   http://localhost:${context.port}`);
-      ui.print(`  Sign in:  ${context.adminEmail} / ${context.adminPassword}`);
+      ui.print(`  API:       http://localhost:${context.port}   (no Studio: that comes with the Platform Console)`);
+      ui.print(`  Operator:  ${context.adminEmail} / ${context.adminPassword}`);
       ui.print('');
       ui.print('  Next:');
       if (dir !== '.') ui.print(`    cd ${dir}`);
-      ui.print('    motherbase start        # first run builds the images, give it a few minutes');
+      ui.print(context.mode === 'image'
+        ? '    motherbase start        # pulls the images on first run'
+        : '    motherbase start        # builds the images on first run (see the compose header)');
+      ui.print('    docker compose exec api node apps/server/dist/prisma/seed.js   # once, creates the operator');
       ui.print('');
     }
   },

package/src/commands/login.js

@@ -8,7 +8,7 @@ const { CliError } = require('../context');
 
 module.exports = {
   summary: 'Log in to a Motherbase Console (email/password → session token)',
-  usage: 'motherbase login [--url <consoleUrl>] [--email <email>]',
+  usage: 'motherbase login [--url <consoleUrl>] [--email <email>] [--code <totp>]',
   async run(ctx, args, flags) {
     const consoleUrl = config.normalizeUrl(
       flags.url || ctx.env.MOTHERBASE_CONSOLE_URL || ctx.consoleUrl || '',
@@ -25,13 +25,19 @@ module.exports = {
       return;
     }
 
+
     const email = flags.email || (await prompt.question('Email: '));
     if (!email) throw new CliError('email is required');
     const password = (typeof flags.password === 'string' && flags.password) || (await prompt.password('Password: '));
     if (!password) throw new CliError('password is required');
 
-    const data = await api.loginRequest(consoleUrl, email, password);
-    const token = data && data.token;
+    let data = await api.loginRequest(consoleUrl, email, password);
+    if (data.twoFactorCookie) {
+      const code = (typeof flags.code === 'string' && flags.code) || (await prompt.question('Authenticator code: '));
+      if (!code) throw new CliError('two-factor code is required');
+      data = await api.verifyTotpRequest(consoleUrl, data.twoFactorCookie, code);
+    }
+    const token = data.token;
     if (!token) throw new CliError('login succeeded but no token was returned');
     config.saveConsoleToken(consoleUrl, token, email);
     ui.success(`Logged in to ${consoleUrl} as ${email}`);

package/src/commands/logout.js

@@ -1,16 +1,16 @@
-'use strict';
-
-const config = require('../config');
-const ui = require('../ui');
-const { CliError } = require('../context');
-
-module.exports = {
-  summary: 'Remove the stored token for the current (or --url) console',
-  usage: 'motherbase logout [--url <consoleUrl>]',
-  async run(ctx) {
-    const url = config.normalizeUrl(ctx.flags.url || ctx.consoleUrl || '');
-    if (!url) throw new CliError('No console to log out of.');
-    config.clearConsoleToken(url);
-    ui.success(`Logged out of ${url}`);
-  },
-};
+'use strict';
+
+const config = require('../config');
+const ui = require('../ui');
+const { CliError } = require('../context');
+
+module.exports = {
+  summary: 'Remove the stored token for the current (or --url) console',
+  usage: 'motherbase logout [--url <consoleUrl>]',
+  async run(ctx) {
+    const url = config.normalizeUrl(ctx.flags.url || ctx.consoleUrl || '');
+    if (!url) throw new CliError('No console to log out of.');
+    config.clearConsoleToken(url);
+    ui.success(`Logged out of ${url}`);
+  },
+};

package/src/commands/mcp.js

@@ -1,61 +1,61 @@
-'use strict';
-
-// `motherbase mcp`: expose the linked project, and the console's organizations
-// and projects, to an AI agent over the Model Context Protocol.
-//
-// The transport is stdio, which is how an MCP client launches a server: it spawns
-// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
-// stdout except protocol messages, so diagnostics go to stderr.
-
-const { serve, toolServer } = require('../mcp/protocol');
-const { buildTools } = require('../mcp/tools');
-const { CliError } = require('../context');
-
-const pkg = require('../../package.json');
-
-/** Whether a `require*()` resolves, without surfacing its error. */
-function reaches(resolve) {
-  try {
-    resolve();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-const mcp = {
-  summary: 'Serve the linked project and console to an AI agent over MCP (stdio)',
-  usage: 'motherbase mcp [--write]',
-  async run(ctx, _args, flags = {}) {
-    // Resolve what this session reaches up front. Failing here is a clear CLI
-    // error; failing on the first tool call is an opaque one inside someone's agent.
-    const scope = { project: reaches(() => ctx.requireProject()), console: reaches(() => ctx.requireConsole()) };
-    if (!scope.project && !scope.console) {
-      throw new CliError(
-        'Nothing to serve. Run `motherbase login` for the organization and project tools, and `motherbase link` '
-          + '(or set MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN) for the database tools.',
-      );
-    }
-
-    const write = Boolean(flags.write);
-    const tools = buildTools(ctx, { write, ...scope });
-
-    process.stderr.write(
-      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
-        + `Project: ${scope.project ? ctx.projectName || ctx.projectId || 'direct' : 'none linked'}. `
-        + `Console: ${scope.console ? ctx.consoleUrl : 'not logged in'}\n`,
-    );
-    if (!write) {
-      process.stderr.write('  Pass --write to expose apply_migration, raw SQL writes, function deploys and project lifecycle.\n');
-    }
-
-    await serve({
-      input: process.stdin,
-      output: process.stdout,
-      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
-      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
-    });
-  },
-};
-
-module.exports = mcp;
+'use strict';
+
+// `motherbase mcp`: expose the linked project, and the console's organizations
+// and projects, to an AI agent over the Model Context Protocol.
+//
+// The transport is stdio, which is how an MCP client launches a server: it spawns
+// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
+// stdout except protocol messages, so diagnostics go to stderr.
+
+const { serve, toolServer } = require('../mcp/protocol');
+const { buildTools } = require('../mcp/tools');
+const { CliError } = require('../context');
+
+const pkg = require('../../package.json');
+
+/** Whether a `require*()` resolves, without surfacing its error. */
+function reaches(resolve) {
+  try {
+    resolve();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const mcp = {
+  summary: 'Serve the linked project and console to an AI agent over MCP (stdio)',
+  usage: 'motherbase mcp [--write]',
+  async run(ctx, _args, flags = {}) {
+    // Resolve what this session reaches up front. Failing here is a clear CLI
+    // error; failing on the first tool call is an opaque one inside someone's agent.
+    const scope = { project: reaches(() => ctx.requireProject()), console: reaches(() => ctx.requireConsole()) };
+    if (!scope.project && !scope.console) {
+      throw new CliError(
+        'Nothing to serve. Run `motherbase login` for the organization and project tools, and `motherbase link` '
+          + '(or set MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN) for the database tools.',
+      );
+    }
+
+    const write = Boolean(flags.write);
+    const tools = buildTools(ctx, { write, ...scope });
+
+    process.stderr.write(
+      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
+        + `Project: ${scope.project ? ctx.projectName || ctx.projectId || 'direct' : 'none linked'}. `
+        + `Console: ${scope.console ? ctx.consoleUrl : 'not logged in'}\n`,
+    );
+    if (!write) {
+      process.stderr.write('  Pass --write to expose apply_migration, raw SQL writes, function deploys and project lifecycle.\n');
+    }
+
+    await serve({
+      input: process.stdin,
+      output: process.stdout,
+      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
+      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
+    });
+  },
+};
+
+module.exports = mcp;

package/src/commands/migrate.js

@@ -80,11 +80,6 @@ const UNSUPPORTED = [
     what: 'auth.mfa.*',
     advice: 'Use auth.twoFactor: enable({ password }), verifyTotp({ code }), disable({ password }).',
   },
-  {
-    pattern: /transform\s*:\s*\{/g,
-    what: 'storage image transform options',
-    advice: 'No image pipeline yet. Store the sizes you need at upload time.',
-  },
   {
     pattern: /\.delete\(\s*\)\s*(?![\s\S]{0,200}?\.(eq|neq|in|gt|gte|lt|lte|like|ilike|is|filter|match|or|not)\()/g,
     what: 'delete() with no filter',

package/src/commands/migration.js

@@ -27,7 +27,7 @@ const subcommands = {
       fs.mkdirSync(dir, { recursive: true });
       const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+/, '').replace('T', '');
       const file = path.join(dir, `${stamp}_${name}.sql`);
-      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`);
+      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`, { flag: 'wx' });
       ui.success(`Created ${path.relative(ctx.cwd, file)}`);
     },
   },

package/src/commands/network.js

@@ -1,83 +1,83 @@
-'use strict';
-
-// Who may open a direct Postgres connection (Supabase's `network-restrictions`
-// and `ssl-enforcement`). Both are project admin routes, so they work through
-// the Console proxy and in direct mode alike.
-
-const api = require('../api');
-const { output } = require('./_util');
-const { CliError } = require('../context');
-
-function renderRestrictions(d, ui) {
-  ui.keyValue({
-    'IPv4 allowed': d.dbAllowedCidrs.join(', ') || '(none)',
-    'IPv6 allowed': d.dbAllowedCidrsV6.join(', ') || '(none)',
-    status: d.status,
-    exposure: d.exposure,
-  });
-  if (d.status !== 'applied') ui.warn('Stored only: this API does not manage its database access (not a Console stack).');
-  if (d.exposure !== 'public') ui.info('The database port is not public, so only the stack and SSH tunnels reach it today.');
-}
-
-const networkRestrictions = {
-  summary: 'IP ranges allowed to connect to the database directly',
-  usage: 'motherbase network-restrictions <get|update> ...',
-  subcommands: {
-    get: {
-      summary: 'Show the allowed ranges',
-      usage: 'motherbase network-restrictions get',
-      async run(ctx) {
-        output(ctx, await api.adminRequest(ctx, 'GET', '/network-restrictions'), renderRestrictions);
-      },
-    },
-    update: {
-      summary: 'Replace the allowed ranges (repeat --db-allow-cidr; IPv4 and IPv6 are told apart)',
-      usage: 'motherbase network-restrictions update --db-allow-cidr <cidr> [--db-allow-cidr <cidr> ...]',
-      async run(ctx, _args, flags) {
-        const cidrs = [].concat(flags['db-allow-cidr'] ?? []).map(String);
-        if (!cidrs.length) {
-          throw new CliError('Pass at least one --db-allow-cidr (0.0.0.0/0 and ::/0 allow everyone).');
-        }
-        const body = {
-          dbAllowedCidrs: cidrs.filter(c => !c.includes(':')),
-          dbAllowedCidrsV6: cidrs.filter(c => c.includes(':')),
-        };
-        output(ctx, await api.adminRequest(ctx, 'PUT', '/network-restrictions', { body }), renderRestrictions);
-      },
-    },
-  },
-};
-
-function renderSsl(d, ui) {
-  ui.keyValue({ enforced: d.enforced, 'TLS active': d.sslActive, status: d.status });
-  if (d.enforced) ui.info('External clients must connect with sslmode=require.');
-}
-
-const sslEnforcement = {
-  summary: 'Require TLS for direct database connections',
-  usage: 'motherbase ssl-enforcement <get|update> ...',
-  subcommands: {
-    get: {
-      summary: 'Show whether TLS is enforced',
-      usage: 'motherbase ssl-enforcement get',
-      async run(ctx) {
-        output(ctx, await api.adminRequest(ctx, 'GET', '/ssl-enforcement'), renderSsl);
-      },
-    },
-    update: {
-      summary: 'Turn enforcement on or off',
-      usage: 'motherbase ssl-enforcement update --enable-db-ssl-enforcement | --disable-db-ssl-enforcement',
-      async run(ctx, _args, flags) {
-        const enable = Boolean(flags['enable-db-ssl-enforcement']);
-        const disable = Boolean(flags['disable-db-ssl-enforcement']);
-        if (enable === disable) {
-          throw new CliError('Pass exactly one of --enable-db-ssl-enforcement or --disable-db-ssl-enforcement.');
-        }
-        const data = await api.adminRequest(ctx, 'PUT', '/ssl-enforcement', { body: { enforced: enable } });
-        output(ctx, data, renderSsl);
-      },
-    },
-  },
-};
-
-module.exports = { networkRestrictions, sslEnforcement };
+'use strict';
+
+// Who may open a direct Postgres connection (Supabase's `network-restrictions`
+// and `ssl-enforcement`). Both are project admin routes, so they work through
+// the Console proxy and in direct mode alike.
+
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+function renderRestrictions(d, ui) {
+  ui.keyValue({
+    'IPv4 allowed': d.dbAllowedCidrs.join(', ') || '(none)',
+    'IPv6 allowed': d.dbAllowedCidrsV6.join(', ') || '(none)',
+    status: d.status,
+    exposure: d.exposure,
+  });
+  if (d.status !== 'applied') ui.warn('Stored only: this API does not manage its database access (not a Console stack).');
+  if (d.exposure !== 'public') ui.info('The database port is not public, so only the stack and SSH tunnels reach it today.');
+}
+
+const networkRestrictions = {
+  summary: 'IP ranges allowed to connect to the database directly',
+  usage: 'motherbase network-restrictions <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show the allowed ranges',
+      usage: 'motherbase network-restrictions get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/network-restrictions'), renderRestrictions);
+      },
+    },
+    update: {
+      summary: 'Replace the allowed ranges (repeat --db-allow-cidr; IPv4 and IPv6 are told apart)',
+      usage: 'motherbase network-restrictions update --db-allow-cidr <cidr> [--db-allow-cidr <cidr> ...]',
+      async run(ctx, _args, flags) {
+        const cidrs = [].concat(flags['db-allow-cidr'] ?? []).map(String);
+        if (!cidrs.length) {
+          throw new CliError('Pass at least one --db-allow-cidr (0.0.0.0/0 and ::/0 allow everyone).');
+        }
+        const body = {
+          dbAllowedCidrs: cidrs.filter(c => !c.includes(':')),
+          dbAllowedCidrsV6: cidrs.filter(c => c.includes(':')),
+        };
+        output(ctx, await api.adminRequest(ctx, 'PUT', '/network-restrictions', { body }), renderRestrictions);
+      },
+    },
+  },
+};
+
+function renderSsl(d, ui) {
+  ui.keyValue({ enforced: d.enforced, 'TLS active': d.sslActive, status: d.status });
+  if (d.enforced) ui.info('External clients must connect with sslmode=require.');
+}
+
+const sslEnforcement = {
+  summary: 'Require TLS for direct database connections',
+  usage: 'motherbase ssl-enforcement <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show whether TLS is enforced',
+      usage: 'motherbase ssl-enforcement get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/ssl-enforcement'), renderSsl);
+      },
+    },
+    update: {
+      summary: 'Turn enforcement on or off',
+      usage: 'motherbase ssl-enforcement update --enable-db-ssl-enforcement | --disable-db-ssl-enforcement',
+      async run(ctx, _args, flags) {
+        const enable = Boolean(flags['enable-db-ssl-enforcement']);
+        const disable = Boolean(flags['disable-db-ssl-enforcement']);
+        if (enable === disable) {
+          throw new CliError('Pass exactly one of --enable-db-ssl-enforcement or --disable-db-ssl-enforcement.');
+        }
+        const data = await api.adminRequest(ctx, 'PUT', '/ssl-enforcement', { body: { enforced: enable } });
+        output(ctx, data, renderSsl);
+      },
+    },
+  },
+};
+
+module.exports = { networkRestrictions, sslEnforcement };