@motherbase/cli 0.2.8 → 0.2.9

package/README.md

@@ -1,248 +1,254 @@
-# Motherbase CLI
-
-A Supabase-CLI-like operator CLI for **Motherbase**. It drives both the
-**Platform Console** (account + multi-project lifecycle) and a **linked project's
-admin API** through the Console proxy, or a single project API directly.
-
-Zero runtime dependencies. Node ≥ 18 (uses built-in `fetch`, `readline`, `fs`,
-`child_process` only).
-
-```bash
-node bin/motherbase.js --help          # auto-generated help
-npm link                               # or: npm i -g @motherbase/cli
-motherbase login --url https://console.example.com
-motherbase link                        # pick a project → writes ./.motherbase/config.json
-motherbase db tables
-motherbase functions deploy --name hello --route hello --file ./hello.js
-```
-
-## Connection model
-
-1. **Console / account**, `motherbase login [--url <consoleUrl>]` performs a real
-   Console login (`POST /api/platform/login`) and stores the session token.
-2. **Linked project**, `motherbase link [project]` records which project this
-   directory targets. All resource commands then route through the Console proxy
-   (`/api/projects/:id/admin/*`).
-3. **Direct mode (CI / single stack)**. Set `MOTHERBASE_URL` +
-   `MOTHERBASE_ADMIN_TOKEN` to talk straight to one project's `/api/admin/*`.
-
-### Configuration files
-
-**Global credentials**: `~/.motherbase/config.json` (contains tokens, written `0o600`):
-
-```json
-{
-  "consoles": {
-    "https://console.example.com": { "token": "…", "email": "you@example.com" }
-  },
-  "current": "https://console.example.com"
-}
-```
-
-**Project link**: `./.motherbase/config.json` (versionable, non-secret):
-
-```json
-{ "consoleUrl": "https://console.example.com", "projectId": "my-app", "projectName": "my-app" }
-```
-
-### Resolution precedence
-
-`flags > env > config`, per value:
-
-| Value       | Flag              | Env                       | Config |
-| ----------- | ----------------- | ------------------------- | ------ |
-| console URL | `--url/-u`        | `MOTHERBASE_CONSOLE_URL`  | link / global `current` |
-| token       | `--token`         | `MOTHERBASE_TOKEN`        | global console entry |
-| project     | `--project/-p`    | `MOTHERBASE_PROJECT`      | link |
-| direct API  | (| `MOTHERBASE_URL` + `MOTHERBASE_ADMIN_TOKEN` |) |
-
-### Auth headers
-
-The console session token is sent as `Authorization: Bearer <token>` on every
-request. Console requests hit `/api/platform/*`; admin requests hit the proxy at
-`/api/projects/:id/admin/*` (which validates the session, then injects its own
-`X-Platform-Token` to the project). In direct mode the admin token is the Bearer.
-
-## Commands
-
-Global flags: `-o/--output pretty|json|yaml|env` (`--json` is `-o json`),
-`--yes/-y`, `--project/-p/--project-ref <id>`, `--url/-u <consoleUrl>`,
-`--token <t>`, `--workdir <dir>`, `--debug` (one stderr line per HTTP request),
-`-h/--help`, `-v/--version`.
-
-Commands follow the Supabase CLI's names. Where Motherbase already had its own
-name, both work: `projects api-keys` / `keys list`, `backups list|restore` /
-`db backups|restore`, `functions download` / `functions pull`, `db lint` /
-`rls lint`, `gen types --lang <l>` / `gen types <l>`.
-
-- **Connection**: `login`, `logout`, `whoami`, `link`, `unlink`, `status`
-- **Orgs & projects (Console)**: `orgs list|create`, `projects list|create|start|stop|restart|update|rebuild|delete|logs|info|limits|api-keys`
-- **Branches (Console)**: `branches create <name> [--with-data] [--git-branch <ref>]`, `branches list|get|update|delete|pause|unpause|reset|merge|rebase|switch <name>`
-- **Domains (Console)**: `domains create --custom-hostname <host>`, `domains get|reverify|activate|delete`, `vanity-subdomains get|check-availability|activate --desired-subdomain <name>|delete`
-- **Database access**: `network-restrictions get|update --db-allow-cidr <cidr> ...`, `ssl-enforcement get|update --enable-db-ssl-enforcement|--disable-db-ssl-enforcement`
-- **Local self-host** (docker compose): `init`, `start`, `stop`, `deploy`, `logs`
-- **Database**: `db push|pull|diff|reset|dump|seed`, `db tables|sql|backup|restore|backups|lint`, `backups list|restore`, `test db`
-- **Database objects**: `db indexes list|create|drop`, `db types list|create|add-value|rename-value|drop`, `db roles list|create|alter|drop`, `db column-privileges list|grant|revoke`, `db publications list|create|alter|drop`
-- **Postgres config**: `postgres-config get [--all]`, `postgres-config update --config k=v [--scope database|role|system] [--replace-existing-overrides]`, `postgres-config delete --config k1,k2`
-- **Migrations**: `migration new|list|up|down|repair|squash|fetch|diff|get|create|apply|rollback` (`migrations` is an alias)
-- **Import**: `import --from-supabase <conn> [--preview] [--no-data] [--no-auth]`
-- **RLS**: `rls list|enable|disable`, `rls policy create|delete`
-- **Users**: `users list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|audit`
-- **Storage**: `storage buckets list|create|delete`, `storage ls|cp|mv|rm [-r]` on `ss:///bucket/key` paths
-- **Functions**: `functions list|get|new|deploy|pull|download|serve|delete|invoke|logs`
-- **Secrets**: `secrets list|unset`, `secrets set NAME=VALUE ... [--env-file .env]`
-- **Realtime**: `realtime config|channels`
-- **Webhooks**: `webhooks list|create|delete|test`
-- **Cron**: `cron list|create|delete|toggle`
-- **Queues**: `queues list|enable|expose|create|drop|send|read|archive|purge`
-- **Vault**: `vault list|enable|create|update|reveal|delete`
-- **Wrappers**: `wrappers list|enable|create-server|drop-server|credentials|import|create-table|drop-table`
-- **Config**: `config list|get|set`
-- **Inspect**: `inspect db <query>`, `inspect report`, `inspect logs|stats|performance|index-advisor|requests|advisor|shield`
-- **Codegen**: `gen types [--lang typescript|zod] [--schema public] [--local] [--output <file>] [--check]`
-- **AI agents**: `mcp [--write]`
-- **Keys**: `gen signing-key [--algorithm ES256|RS256|EdDSA] [--append]`, `gen bearer-jwt --sub <user> [--role] [--valid-for 1h]`, `gen keys [-o env]`
-- **Shell**: `completion bash|zsh|fish` (e.g. `source <(motherbase completion bash)`)
-
-Run `motherbase <group> -h` for per-group usage.
-
-## Migrations and seeds
-
-Local files, laid out like a Supabase project's `supabase/` directory:
-
-```
-motherbase/
-  migrations/<version>_<name>.sql   `migration new <name>` stamps the version (UTC)
-  seed.sql                          or db.seed.sql_paths in motherbase/config.json
-  tests/*.sql                       pgTAP, for `motherbase test db`
-```
-
-A migration file may end with a `-- @down` line followed by the SQL that undoes
-it; `migration down` needs one. The linked project keeps the history, keyed on
-`version`, and the Studio Migrations page shows the same rows (origin `cli`,
-`studio` or `git`).
-
-```bash
-motherbase migration list                 # LOCAL | REMOTE side by side
-motherbase db push --dry-run              # then without, add --include-seed for the seeds
-motherbase db pull                        # remote changes -> a new file, recorded as applied
-motherbase db diff -f add_index           # the same diff, written as a new migration
-motherbase migration repair 20260101120000 --status reverted
-motherbase db reset --confirm             # backup, empty app schemas, replay migrations + seed
-motherbase db dump -f schema.sql --schema-only
-```
-
-Each pushed file runs in its own transaction; a push stops at the first file
-that fails, and nothing of that file is recorded. `db diff` replays the local
-migrations into a throwaway database on the same server and compares tables,
-columns and indexes: review what it writes. With no local migration yet, `db
-pull` writes the remote schema itself, from `pg_dump`. `db dump` used to take a
-server-side backup; that is `db backup` now.
-
-## Type generation
-
-Generate TypeScript definitions for the live schema, in the shape supabase-js
-emits, so `createClient<Database>(url, key)` types every row, rejects unknown
-columns and types `.rpc()` calls:
-
-```bash
-motherbase gen types typescript            # in a terminal: writes ./database.types.ts
-motherbase gen types typescript > database.types.ts   # piped: prints the file
-motherbase gen types typescript --schema shop --output src/shop.types.ts
-```
-
-With no `--output` the file goes to stdout and nothing else does, so the
-redirect above produces a compiling file. `--local` skips the Console proxy and
-talks to a project API on this machine (`MOTHERBASE_URL`, default
-`http://localhost:5001`, with `MOTHERBASE_ADMIN_TOKEN`).
-
-Gate CI on schema drift with `--check`, which never writes and exits non-zero
-when the committed file differs from a fresh generation:
-
-```bash
-motherbase gen types typescript --check --output database.types.ts
-```
-
-## Storage paths
-
-Objects are addressed as the Supabase CLI does, `ss:///<bucket>/<key>`, and
-`-r` applies a command to everything under a prefix:
-
-```bash
-motherbase storage ls                                   # buckets
-motherbase storage ls ss:///media/img                   # one level; -r for every key
-motherbase storage cp ./logo.png ss:///media/img/       # upload (overwrites)
-motherbase storage cp -r ./site ss:///web/v2            # upload a directory tree
-motherbase storage cp -r ss:///web/v2 ./site-backup     # download a prefix
-motherbase storage mv -r ss:///web/v2 ss:///web/live    # move within a bucket
-motherbase storage rm -r ss:///web/old
-```
-
-Bulk commands send one request per object and stop at the first failure,
-saying how many had already gone through. `mv` and in-bucket `cp` work within
-one bucket. The older forms still work: `cp ./a.png bucket:` uploads with a
-generated key, `cp <fileId> ./a.png` downloads and `rm <fileId>` deletes by id.
-
-## Database inspection
-
-`inspect db` runs the Supabase CLI's diagnostic queries against the linked
-project, on its read-only SQL endpoint:
-
-```bash
-motherbase inspect db outliers        # slowest queries by total time
-motherbase inspect db table-stats -o json
-motherbase inspect report --output-dir reports   # one CSV per query in reports/<YYYY-MM-DD>/
-```
-
-The queries are `bloat`, `blocking`, `calls`, `db-stats`, `index-stats`,
-`locks`, `long-running-queries`, `outliers`, `replication-slots`, `role-stats`,
-`table-stats`, `traffic-profile` and `vacuum-stats`. The names Supabase has
-deprecated (`cache-hit`, `index-usage`, `table-sizes`, `unused-indexes`, …)
-still work and run the query that replaced them. `calls` and `outliers` read
-`pg_stat_statements`: it is preloaded by the Motherbase Postgres image but has
-to be created once per database (Studio > Database > Extensions, or
-`motherbase db sql -e "create extension pg_stat_statements"`); `inspect report`
-skips those two files until it is.
-
-## MCP server
-
-`motherbase mcp` serves this project to an AI agent over stdio:
-
-```json
-{ "mcpServers": { "motherbase": { "command": "npx", "args": ["@motherbase/cli", "mcp"] } } }
-```
-
-It exposes what the session can reach. With a linked project (or direct mode):
-`list_tables`, `describe_table`, `list_policies`, `simulate_rls`,
-`get_advisors`, `get_logs`, `generate_types`, `execute_sql` (read-only),
-`get_project_url`, `get_publishable_keys`, `list_extensions`,
-`list_migrations`, `list_edge_functions`, `get_edge_function`,
-`list_storage_buckets` and `get_storage_config`. With a console login:
-`list_organizations`, `get_organization`, `list_projects` and `get_project`.
-
-Everything that changes something needs `--write`: `apply_migration`,
-`execute_sql_write`, `deploy_edge_function`, `create_project`,
-`pause_project` and `restore_project`. The names and arguments follow
-Supabase's MCP server.
-
-## Supabase migration
-
-Preview a Supabase import without writing to Motherbase:
-
-```bash
-motherbase import --from-supabase "$SUPABASE_DB_URL" --preview --json
-```
-
-Run the import:
-
-```bash
-motherbase import --from-supabase "$SUPABASE_DB_URL" --yes
-```
-
-The importer moves the portable parts of a Supabase project: `public` schema, table data, RLS policies, and email/password users from `auth.users`. Storage objects are not copied. Use `--no-data` or `--no-auth` for partial imports.
-
-## Tests
-
-```bash
-npm test        # node --test, mocked fetch, no network/DB
-```
+# Motherbase CLI
+
+A Supabase-CLI-like operator CLI for **Motherbase**. It drives both the
+**Platform Console** (account + multi-project lifecycle) and a **linked project's
+admin API** through the Console proxy, or a single project API directly.
+
+Zero runtime dependencies. Node ≥ 18 (uses built-in `fetch`, `readline`, `fs`,
+`child_process` only).
+
+```bash
+node bin/motherbase.js --help          # auto-generated help
+npm link                               # or: npm i -g @motherbase/cli
+motherbase login --url https://console.example.com
+motherbase link                        # pick a project → writes ./.motherbase/config.json
+motherbase db tables
+motherbase functions deploy --name hello --route hello --file ./hello.js
+```
+
+## Connection model
+
+1. **Console / account**, `motherbase login [--url <consoleUrl>]` performs a real
+   Console login (`POST /api/platform/login`) and stores the session token.
+2. **Linked project**, `motherbase link [project]` records which project this
+   directory targets. All resource commands then route through the Console proxy
+   (`/api/projects/:id/admin/*`).
+3. **Direct mode (CI / single stack)**. Set `MOTHERBASE_URL` +
+   `MOTHERBASE_ADMIN_TOKEN` to talk straight to one project's `/api/admin/*`.
+
+### Configuration files
+
+**Global credentials**: `~/.motherbase/config.json` (contains tokens, written `0o600`):
+
+```json
+{
+  "consoles": {
+    "https://console.example.com": { "token": "…", "email": "you@example.com" }
+  },
+  "current": "https://console.example.com"
+}
+```
+
+**Project link**: `./.motherbase/config.json` (versionable, non-secret):
+
+```json
+{ "consoleUrl": "https://console.example.com", "projectId": "my-app", "projectName": "my-app" }
+```
+
+### Resolution precedence
+
+`flags > env > config`, per value:
+
+| Value       | Flag              | Env                       | Config |
+| ----------- | ----------------- | ------------------------- | ------ |
+| console URL | `--url/-u`        | `MOTHERBASE_CONSOLE_URL`  | link / global `current` |
+| token       | `--token`         | `MOTHERBASE_TOKEN`        | global console entry |
+| project     | `--project/-p`    | `MOTHERBASE_PROJECT`      | link |
+| direct API  | (| `MOTHERBASE_URL` + `MOTHERBASE_ADMIN_TOKEN` |) |
+
+### Auth headers
+
+The console session token is sent as `Authorization: Bearer <token>` on every
+request. Console requests hit `/api/platform/*`; admin requests hit the proxy at
+`/api/projects/:id/admin/*` (which validates the session, then injects its own
+`X-Platform-Token` to the project). In direct mode the admin token is the Bearer.
+
+## Commands
+
+Global flags: `-o/--output pretty|json|yaml|env` (`--json` is `-o json`),
+`--yes/-y`, `--project/-p/--project-ref <id>`, `--url/-u <consoleUrl>`,
+`--token <t>`, `--workdir <dir>`, `--debug` (one stderr line per HTTP request),
+`-h/--help`, `-v/--version`.
+
+Commands follow the Supabase CLI's names. Where Motherbase already had its own
+name, both work: `projects api-keys` / `keys list`, `backups list|restore` /
+`db backups|restore`, `functions download` / `functions pull`, `db lint` /
+`rls lint`, `gen types --lang <l>` / `gen types <l>`.
+
+- **Connection**: `login`, `logout`, `whoami`, `link`, `unlink`, `status`
+- **Orgs & projects (Console)**: `orgs list|create`, `projects list|create|start|stop|restart|update|rebuild|delete|logs|info|limits|api-keys`
+- **Branches (Console)**: `branches create <name> [--with-data] [--git-branch <ref>]`, `branches list|get|update|delete|pause|unpause|reset|merge|rebase|switch <name>`
+- **Domains (Console)**: `domains create --custom-hostname <host>`, `domains get|reverify|activate|delete`, `vanity-subdomains get|check-availability|activate --desired-subdomain <name>|delete`
+- **Database access**: `network-restrictions get|update --db-allow-cidr <cidr> ...`, `ssl-enforcement get|update --enable-db-ssl-enforcement|--disable-db-ssl-enforcement`
+- **Local self-host** (docker compose): `init`, `start`, `stop`, `deploy`, `logs`
+- **Database**: `db push|pull|diff|reset|dump|seed`, `db tables|sql|backup|restore|backups|lint`, `backups list|restore`, `test db`
+- **Database objects**: `db indexes list|create|drop`, `db types list|create|add-value|rename-value|drop`, `db roles list|create|alter|drop`, `db column-privileges list|grant|revoke`, `db publications list|create|alter|drop`
+- **Postgres config**: `postgres-config get [--all]`, `postgres-config update --config k=v [--scope database|role|system] [--replace-existing-overrides]`, `postgres-config delete --config k1,k2`
+- **Migrations**: `migration new|list|up|down|repair|squash|fetch|diff|get|create|apply|rollback` (`migrations` is an alias)
+- **Import**: `import --from-supabase <conn> [--preview] [--no-data] [--no-auth]`
+- **RLS**: `rls list|enable|disable`, `rls policy create|delete`
+- **Users**: `users list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|audit`
+- **Storage**: `storage buckets list|create|delete`, `storage ls|cp|mv|rm [-r]` on `ss:///bucket/key` paths
+- **Functions**: `functions list|get|new|deploy|pull|download|serve|delete|invoke|logs`
+- **Secrets**: `secrets list|unset`, `secrets set NAME=VALUE ... [--env-file .env]`
+- **Realtime**: `realtime config|channels`
+- **Webhooks**: `webhooks list|create|delete|test`
+- **Cron**: `cron list|create|delete|toggle`
+- **Queues**: `queues list|enable|expose|create|drop|send|read|archive|purge`
+- **Vault**: `vault list|enable|create|update|reveal|delete`
+- **Wrappers**: `wrappers list|enable|create-server|drop-server|credentials|import|create-table|drop-table`
+- **Config**: `config list|get|set`
+- **Inspect**: `inspect db <query>`, `inspect report`, `inspect logs|stats|performance|index-advisor|requests|advisor|shield`
+- **Codegen**: `gen types [--lang typescript|zod] [--schema public] [--local] [--output <file>] [--check]`
+- **AI agents**: `mcp [--write]`
+- **Keys**: `gen signing-key [--algorithm ES256|RS256|EdDSA] [--append]`, `gen bearer-jwt --sub <user> [--role] [--valid-for 1h]`, `gen keys [-o env]`
+- **Shell**: `completion bash|zsh|fish` (e.g. `source <(motherbase completion bash)`)
+
+Run `motherbase <group> -h` for per-group usage.
+
+## Migrations and seeds
+
+Local files, laid out like a Supabase project's `supabase/` directory:
+
+```
+motherbase/
+  migrations/<version>_<name>.sql   `migration new <name>` stamps the version (UTC)
+  seed.sql                          or db.seed.sql_paths in motherbase/config.json
+  tests/*.sql                       pgTAP, for `motherbase test db`
+```
+
+A migration file may end with a `-- @down` line followed by the SQL that undoes
+it; `migration down` needs one. The linked project keeps the history, keyed on
+`version`, and the Studio Migrations page shows the same rows (origin `cli`,
+`studio` or `git`).
+
+```bash
+motherbase migration list                 # LOCAL | REMOTE side by side
+motherbase db push --dry-run              # then without, add --include-seed for the seeds
+motherbase db pull                        # remote changes -> a new file, recorded as applied
+motherbase db diff -f add_index           # the same diff, written as a new migration
+motherbase migration repair 20260101120000 --status reverted
+motherbase db reset --confirm             # backup, empty app schemas, replay migrations + seed
+motherbase db dump -f schema.sql --schema-only
+```
+
+Each pushed file runs in its own transaction; a push stops at the first file
+that fails, and nothing of that file is recorded. `db diff` replays the local
+migrations into a throwaway database on the same server and compares tables,
+columns and indexes: review what it writes. With no local migration yet, `db
+pull` writes the remote schema itself, from `pg_dump`. `db dump` used to take a
+server-side backup; that is `db backup` now.
+
+## Type generation
+
+Generate TypeScript definitions for the live schema, in the shape supabase-js
+emits, so `createClient<Database>(url, key)` types every row, rejects unknown
+columns and types `.rpc()` calls:
+
+```bash
+motherbase gen types typescript            # in a terminal: writes ./database.types.ts
+motherbase gen types typescript > database.types.ts   # piped: prints the file
+motherbase gen types typescript --schema shop --output src/shop.types.ts
+```
+
+The same `Database` also names the project's edge functions and buckets, under
+`__InternalMotherbase`, so `client.functions.invoke('…')` and
+`client.storage.from('…')` autocomplete with no extra generic. A name created
+after the file was generated still compiles. Since they are part of the file,
+adding a function or a bucket is drift for `--check` below.
+
+With no `--output` the file goes to stdout and nothing else does, so the
+redirect above produces a compiling file. `--local` skips the Console proxy and
+talks to a project API on this machine (`MOTHERBASE_URL`, default
+`http://localhost:5001`, with `MOTHERBASE_ADMIN_TOKEN`).
+
+Gate CI on schema drift with `--check`, which never writes and exits non-zero
+when the committed file differs from a fresh generation:
+
+```bash
+motherbase gen types typescript --check --output database.types.ts
+```
+
+## Storage paths
+
+Objects are addressed as the Supabase CLI does, `ss:///<bucket>/<key>`, and
+`-r` applies a command to everything under a prefix:
+
+```bash
+motherbase storage ls                                   # buckets
+motherbase storage ls ss:///media/img                   # one level; -r for every key
+motherbase storage cp ./logo.png ss:///media/img/       # upload (overwrites)
+motherbase storage cp -r ./site ss:///web/v2            # upload a directory tree
+motherbase storage cp -r ss:///web/v2 ./site-backup     # download a prefix
+motherbase storage mv -r ss:///web/v2 ss:///web/live    # move within a bucket
+motherbase storage rm -r ss:///web/old
+```
+
+Bulk commands send one request per object and stop at the first failure,
+saying how many had already gone through. `mv` and in-bucket `cp` work within
+one bucket. The older forms still work: `cp ./a.png bucket:` uploads with a
+generated key, `cp <fileId> ./a.png` downloads and `rm <fileId>` deletes by id.
+
+## Database inspection
+
+`inspect db` runs the Supabase CLI's diagnostic queries against the linked
+project, on its read-only SQL endpoint:
+
+```bash
+motherbase inspect db outliers        # slowest queries by total time
+motherbase inspect db table-stats -o json
+motherbase inspect report --output-dir reports   # one CSV per query in reports/<YYYY-MM-DD>/
+```
+
+The queries are `bloat`, `blocking`, `calls`, `db-stats`, `index-stats`,
+`locks`, `long-running-queries`, `outliers`, `replication-slots`, `role-stats`,
+`table-stats`, `traffic-profile` and `vacuum-stats`. The names Supabase has
+deprecated (`cache-hit`, `index-usage`, `table-sizes`, `unused-indexes`, …)
+still work and run the query that replaced them. `calls` and `outliers` read
+`pg_stat_statements`: it is preloaded by the Motherbase Postgres image but has
+to be created once per database (Studio > Database > Extensions, or
+`motherbase db sql -e "create extension pg_stat_statements"`); `inspect report`
+skips those two files until it is.
+
+## MCP server
+
+`motherbase mcp` serves this project to an AI agent over stdio:
+
+```json
+{ "mcpServers": { "motherbase": { "command": "npx", "args": ["@motherbase/cli", "mcp"] } } }
+```
+
+It exposes what the session can reach. With a linked project (or direct mode):
+`list_tables`, `describe_table`, `list_policies`, `simulate_rls`,
+`get_advisors`, `get_logs`, `generate_types`, `execute_sql` (read-only),
+`get_project_url`, `get_publishable_keys`, `list_extensions`,
+`list_migrations`, `list_edge_functions`, `get_edge_function`,
+`list_storage_buckets` and `get_storage_config`. With a console login:
+`list_organizations`, `get_organization`, `list_projects` and `get_project`.
+
+Everything that changes something needs `--write`: `apply_migration`,
+`execute_sql_write`, `deploy_edge_function`, `create_project`,
+`pause_project` and `restore_project`. The names and arguments follow
+Supabase's MCP server.
+
+## Supabase migration
+
+Preview a Supabase import without writing to Motherbase:
+
+```bash
+motherbase import --from-supabase "$SUPABASE_DB_URL" --preview --json
+```
+
+Run the import:
+
+```bash
+motherbase import --from-supabase "$SUPABASE_DB_URL" --yes
+```
+
+The importer moves the portable parts of a Supabase project: `public` schema, table data, RLS policies, and email/password users from `auth.users`. Storage objects are not copied. Use `--no-data` or `--no-auth` for partial imports.
+
+## Tests
+
+```bash
+npm test        # node --test, mocked fetch, no network/DB
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/cli",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Motherbase operator CLI: drives the Platform Console and linked projects.",
   "type": "commonjs",
   "bin": {
@@ -25,11 +25,11 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/JulienGuinot/Boilerplate-backend.git",
+    "url": "git+https://github.com/JulienGuinot/motherbase.git",
     "directory": "packages/cli"
   },
-  "homepage": "https://github.com/JulienGuinot/Boilerplate-backend#readme",
+  "homepage": "https://github.com/JulienGuinot/motherbase#readme",
   "bugs": {
-    "url": "https://github.com/JulienGuinot/Boilerplate-backend/issues"
+    "url": "https://github.com/JulienGuinot/motherbase/issues"
   }
 }

package/src/commands/db-catalog.js

@@ -323,4 +323,42 @@ const columnPrivileges = {
   },
 };
 
-module.exports = { indexes, types, roles, 'column-privileges': columnPrivileges, publications };
+
+
+
+
+const cron =  {
+  summary : "Manage cron jobs",
+  usage : "motherbase db cron <list|get|update|run|create>",
+
+  subcommands : {
+    list : {
+      summary : "List cron jobs",
+      usage :"motherbase db cron list",
+      async run(ctx) {
+        const data = await api.adminRequest(ctx, "GET", "/cron/pg/jobs")
+
+        console.log(data.jobs)
+     
+      }
+    },
+    
+
+    get : {
+      summary: "Get a cron job by id",
+      usage : "motherbase db cron get <id>",
+        async run(ctx, args) {
+        const jobId = requireArg(args[0], 'id');
+        const data = await api.adminRequest(ctx, "GET",`/cron/pg/jobs/${jobId}`)
+
+        console.log(data.jobs)
+      }
+    }
+  }
+
+
+}
+
+
+
+module.exports = { indexes, types, roles, 'column-privileges': columnPrivileges, publications, cron};

package/src/commands/index.js

@@ -68,6 +68,7 @@ const registry = {
 
   // ── Shell ──────────────────────────────────────────────────────────────────
   completion: require('./completion'),
+
 };
 
 // Grouping used only to render a tidy top-level help listing.

package/src/commands/local.js

@@ -27,7 +27,7 @@ const DEFAULT_REGISTRY = 'ghcr.io/julienguinot';
 const DEFAULT_TAG = 'latest';
 // Build-from-source mode, kept for --repo / --ref. It needs motherbase-deps:1.0.0
 // built locally first (see the compose header it writes).
-const DEFAULT_REPO = 'https://github.com/JulienGuinot/BoilerPlate-Backend.git';
+const DEFAULT_REPO = 'https://github.com/JulienGuinot/motherbase.git';
 const DEFAULT_REF = 'master';
 
 function dockerCompose(composeArgs) {

package/src/commands/users.js

@@ -104,6 +104,34 @@ const subcommands = {
       output(ctx, data, (d, ui) => ui.success(`Sessions revoked for ${id}`));
     },
   },
+
+
+  deactivate: {
+    summary: 'Deactivate a user account and revoke its sessions',
+    usage: 'motherbase users deactivate <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'PATCH', `/users/${id}`, { body: { status: 'deleted' } });
+      output(ctx, data, (_d, ui) => ui.success(`Deactivated user ${id}`));
+    },
+  },
+
+  impersonate: {
+    summary: 'Grants a token to impersonate a user by id',
+    usage: 'motherbase users impersonate <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'POST', `/users/${id}/impersonate`);
+      const session = { accessToken: data.token, user: data.user };
+      const cookie = `motherbase.session=${encodeURIComponent(JSON.stringify(session))}; path=/; expires=${new Date(data.expiresAt).toUTCString()}; SameSite=Lax`;
+      const command = `document.cookie=${JSON.stringify(cookie)}; location.reload()`;
+
+      output(ctx, data, (_d, ui) =>
+        ui.success(`Paste this in your browser console to impersonate ${data.user.username ?? data.user.email}: ${command}`),
+      );
+    },
+  },
+
   audit: {
     summary: 'Read the auth audit log, newest first',
     usage: 'motherbase users audit [--action <a>] [--actor <email|id>] [--type <log type>] [--from <iso>] [--to <iso>] [--limit <n>]',
@@ -137,6 +165,6 @@ const subcommands = {
 
 module.exports = {
   summary: 'Project auth users',
-  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|audit> ...',
+  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|deactivate|impersonate|audit> ...',
   subcommands,
 };

package/src/main.js

@@ -1,40 +1,64 @@
-'use strict';
+"use strict";
 
-const path = require('path');
-const { registry, groups } = require('./commands');
-const { createContext, CliError } = require('./context');
-const { FORMATS } = require('./format');
-const ui = require('./ui');
+const path = require("path");
+const { registry, groups } = require("./commands");
+const { createContext, CliError } = require("./context");
+const { FORMATS } = require("./format");
+const ui = require("./ui");
 
 // Flags that never consume a following value.
 const PURE_BOOLEAN = new Set([
-  'json', 'yes', 'help', 'version', 'force', 'preview', 'app', 'no-data', 'no-auth', 'f', 'debug',
+  "json",
+  "yes",
+  "help",
+  "version",
+  "force",
+  "preview",
+  "app",
+  "no-data",
+  "no-auth",
+  "f",
+  "debug",
   // Codegen: `--check` and `--local` never take a value, so a trailing
   // `--check database.types.ts` must not silently swallow the path.
-  'check', 'local',
+  "check",
+  "local",
   // `rls preset <table> <preset> --replace` must not swallow a following word.
-  'replace',
+  "replace",
   // `storage cp --recursive ./dir ss:///bucket` must not swallow the source.
-  'recursive',
+  "recursive",
   // Migration workflow switches: `db push --dry-run` must not eat a positional.
-  'dry-run', 'include-seed', 'include-all', 'schema-only', 'data-only', 'use-copy', 'confirm', 'no-seed', 'linked',
+  "dry-run",
+  "include-seed",
+  "include-all",
+  "schema-only",
+  "data-only",
+  "use-copy",
+  "confirm",
+  "no-seed",
+  "linked",
   // `postgres-config` and `db publications` switches, never followed by a value.
-  'replace-existing-overrides', 'no-restart', 'all-tables',
+  "replace-existing-overrides",
+  "no-restart",
+  "all-tables",
   // Branching, keys and database access: trailing switches that must not
   // swallow the next word.
-  'with-data', 'append', 'enable-db-ssl-enforcement', 'disable-db-ssl-enforcement',
+  "with-data",
+  "append",
+  "enable-db-ssl-enforcement",
+  "disable-db-ssl-enforcement",
 ]);
 // Short flag aliases → canonical (with whether they take a value).
 const SHORT = {
-  y: { name: 'yes', boolean: true },
-  h: { name: 'help', boolean: true },
-  v: { name: 'version', boolean: true },
-  p: { name: 'project', boolean: false },
-  u: { name: 'url', boolean: false },
-  e: { name: 'e', boolean: false },
-  f: { name: 'f', boolean: true },
-  o: { name: 'output', boolean: false },
-  r: { name: 'recursive', boolean: true },
+  y: { name: "yes", boolean: true },
+  h: { name: "help", boolean: true },
+  v: { name: "version", boolean: true },
+  p: { name: "project", boolean: false },
+  u: { name: "url", boolean: false },
+  e: { name: "e", boolean: false },
+  f: { name: "f", boolean: true },
+  o: { name: "output", boolean: false },
+  r: { name: "recursive", boolean: true },
 };
 
 /**
@@ -51,7 +75,7 @@ const SHORT = {
  * --superuser` into an error.
  */
 function isFlagToken(token) {
-  if (token.startsWith('--')) return token.length > 2;
+  if (token.startsWith("--")) return token.length > 2;
   return Object.prototype.hasOwnProperty.call(SHORT, token.slice(1));
 }
 
@@ -64,7 +88,9 @@ function isFlagToken(token) {
  * instead of guessing (PKG-16).
  */
 function dashValue(flag, value) {
-  return new CliError(`${flag} needs a value, and "${value}" starts with "-". Write ${flag}=${value} instead.`);
+  return new CliError(
+    `${flag} needs a value, and "${value}" starts with "-". Write ${flag}=${value} instead.`,
+  );
 }
 
 // Tokenize argv into positionals + flags. Repeated flags collapse into arrays.
@@ -81,24 +107,44 @@ function tokenize(argv) {
 
   for (let i = 0; i < argv.length; i++) {
     const tok = argv[i];
-    if (tok === '--') { positionals.push(...argv.slice(i + 1)); break; }
+    if (tok === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
 
-    if (tok.startsWith('--')) {
+    if (tok.startsWith("--")) {
       const body = tok.slice(2);
-      const eq = body.indexOf('=');
-      if (eq >= 0) { setFlag(body.slice(0, eq), body.slice(eq + 1)); continue; }
+      const eq = body.indexOf("=");
+      if (eq >= 0) {
+        setFlag(body.slice(0, eq), body.slice(eq + 1));
+        continue;
+      }
       const next = argv[i + 1];
-      if (PURE_BOOLEAN.has(body)) { setFlag(body, true); continue; }
-      if (next === undefined || isFlagToken(next)) { setFlag(body, true); continue; }
-      if (next.startsWith('-')) throw dashValue(`--${body}`, next);
-      setFlag(body, next); i++;
-    } else if (tok.startsWith('-') && tok.length > 1 && tok !== '-') {
+      if (PURE_BOOLEAN.has(body)) {
+        setFlag(body, true);
+        continue;
+      }
+      if (next === undefined || isFlagToken(next)) {
+        setFlag(body, true);
+        continue;
+      }
+      if (next.startsWith("-")) throw dashValue(`--${body}`, next);
+      setFlag(body, next);
+      i++;
+    } else if (tok.startsWith("-") && tok.length > 1 && tok !== "-") {
       const spec = SHORT[tok.slice(1)];
-      if (!spec) { setFlag(tok.slice(1), true); continue; }
+      if (!spec) {
+        setFlag(tok.slice(1), true);
+        continue;
+      }
       const next = argv[i + 1];
-      if (spec.boolean || next === undefined || isFlagToken(next)) { setFlag(spec.name, true); continue; }
-      if (next.startsWith('-')) throw dashValue(`--${spec.name}`, next);
-      setFlag(spec.name, next); i++;
+      if (spec.boolean || next === undefined || isFlagToken(next)) {
+        setFlag(spec.name, true);
+        continue;
+      }
+      if (next.startsWith("-")) throw dashValue(`--${spec.name}`, next);
+      setFlag(spec.name, next);
+      i++;
     } else {
       positionals.push(tok);
     }
@@ -112,58 +158,76 @@ function tokenize(argv) {
 // `--output` stays a file path on commands that declare `outputIsPath`.
 function normalizeFlags(flags, command = {}) {
   const out = { ...flags };
-  if (out.project === undefined && out['project-ref'] !== undefined) out.project = out['project-ref'];
+  if (out.project === undefined && out["project-ref"] !== undefined)
+    out.project = out["project-ref"];
   if (out.output !== undefined && FORMATS.includes(out.output)) {
     out.format = out.output;
     delete out.output;
   } else if (out.output !== undefined && !command.outputIsPath) {
-    throw new CliError(`--output must be one of: ${FORMATS.join(', ')}`);
+    throw new CliError(`--output must be one of: ${FORMATS.join(", ")}`);
   }
-  out.format = out.format || (out.json ? 'json' : 'pretty');
-  out.json = out.format === 'json';
+  out.format = out.format || (out.json ? "json" : "pretty");
+  out.json = out.format === "json";
   return out;
 }
 
 function version() {
   try {
-    return require(path.join(__dirname, '..', 'package.json')).version;
-  } catch { return '0.0.0'; }
+    return require(path.join(__dirname, "..", "package.json")).version;
+  } catch {
+    return "0.0.0";
+  }
 }
 
-function pad(s, n) { return String(s).padEnd(n); }
+function pad(s, n) {
+  return String(s).padEnd(n);
+}
 
 function topLevelHelp() {
-  ui.print(ui.color.bold('Motherbase CLI') + ` v${version()}`);
-  ui.print('');
-  ui.print('Usage: motherbase <command> [subcommand] [args] [flags]');
-  ui.print('');
+  ui.print(ui.color.bold("Motherbase CLI") + ` v${version()}`);
+  ui.print("");
+  ui.print("Usage: motherbase <command> [subcommand] [args] [flags]");
+  ui.print("");
   const width = Object.keys(registry).reduce((m, k) => Math.max(m, k.length), 0) + 2;
   for (const group of groups) {
     ui.print(ui.color.bold(group.title));
     for (const name of group.names) {
       const entry = registry[name];
       if (!entry) continue;
-      ui.print('  ' + ui.color.cyan(pad(name, width)) + ui.color.dim(entry.summary || ''));
+      ui.print(
+        "  " +
+          ui.color.cyan(pad(name, width)) +
+          ui.color.dim(entry.summary || ""),
+      );
     }
-    ui.print('');
+    ui.print("");
   }
-  ui.print('Global flags: -o/--output pretty|json|yaml|env  --json  --yes/-y  --project/-p/--project-ref <id>  --url/-u <consoleUrl>');
-  ui.print('              --token <t>  --workdir <dir>  --debug  -h/--help  -v/--version');
-  ui.print('Run `motherbase <command> -h` for command-specific help.');
+  ui.print(
+    "Global flags: -o/--output pretty|json|yaml|env  --json  --yes/-y  --project/-p/--project-ref <id>  --url/-u <consoleUrl>",
+  );
+  ui.print(
+    "              --token <t>  --workdir <dir>  --debug  -h/--help  -v/--version",
+  );
+  ui.print("Run `motherbase <command> -h` for command-specific help.");
 }
 
 function commandHelp(name, entry, trail) {
-  const full = ['motherbase', ...trail].join(' ');
-  ui.print(ui.color.bold(full) + (entry.summary ? `, ${entry.summary}` : ''));
-  ui.print('');
-  if (entry.usage) { ui.print('Usage: ' + entry.usage); ui.print(''); }
+  const full = ["motherbase", ...trail].join(" ");
+  ui.print(ui.color.bold(full) + (entry.summary ? `, ${entry.summary}` : ""));
+  ui.print("");
+  if (entry.usage) {
+    ui.print("Usage: " + entry.usage);
+    ui.print("");
+  }
   if (entry.subcommands) {
-    ui.print(ui.color.bold('Subcommands'));
+    ui.print(ui.color.bold("Subcommands"));
     const subs = Object.keys(entry.subcommands);
     const width = subs.reduce((m, k) => Math.max(m, k.length), 0) + 2;
     for (const sub of subs) {
       const s = entry.subcommands[sub];
-      ui.print('  ' + ui.color.cyan(pad(sub, width)) + ui.color.dim(s.summary || ''));
+      ui.print(
+        "  " + ui.color.cyan(pad(sub, width)) + ui.color.dim(s.summary || ""),
+      );
     }
   }
 }
@@ -172,15 +236,21 @@ async function main(argv) {
   const { positionals, flags } = tokenize(argv);
 
   // Only bare: `migration squash --version <v>` is Supabase's own flag.
-  if (flags.version && positionals.length === 0) { ui.print(version()); return 0; }
+  if (flags.version && positionals.length === 0) {
+    ui.print(version());
+    return 0;
+  }
 
-  if (positionals.length === 0) { topLevelHelp(); return 0; }
+  if (positionals.length === 0) {
+    topLevelHelp();
+    return 0;
+  }
 
   const name = positionals[0];
   const entry = registry[name];
   if (!entry) {
     ui.printErr(ui.color.red(`Unknown command: ${name}`));
-    ui.printErr('Run `motherbase --help` to see available commands.');
+    ui.printErr("Run `motherbase --help` to see available commands.");
     return 1;
   }
 
@@ -200,16 +270,25 @@ async function main(argv) {
   }
   if (!current.run) {
     // Group node: either no subcommand given or an unknown one.
-    if (rest.length) ui.printErr(ui.color.red(`Unknown subcommand: ${trail.join(' ')} ${rest[0]}`));
+    if (rest.length)
+      ui.printErr(
+        ui.color.red(`Unknown subcommand: ${trail.join(" ")} ${rest[0]}`),
+      );
     commandHelp(name, current, trail);
     return rest.length ? 1 : 0;
   }
 
   try {
     const resolved = normalizeFlags(flags, current);
-    if (resolved.debug) process.env.MOTHERBASE_DEBUG = '1';
-    const cwd = resolved.workdir ? path.resolve(String(resolved.workdir)) : process.cwd();
-    await current.run(createContext(resolved, process.env, cwd), rest, resolved);
+    if (resolved.debug) process.env.MOTHERBASE_DEBUG = "1";
+    const cwd = resolved.workdir
+      ? path.resolve(String(resolved.workdir))
+      : process.cwd();
+    await current.run(
+      createContext(resolved, process.env, cwd),
+      rest,
+      resolved,
+    );
     return 0;
   } catch (err) {
     if (err instanceof CliError || err.isCliError) {