@mybase-dev/cli 1.0.1 → 1.0.3

package/dist/mybase.js

@@ -139,7 +139,7 @@ function parseDotenv(text) {
 // package.json
 var package_default = {
   name: "@mybase-dev/cli",
-  version: "1.0.1",
+  version: "1.0.3",
   description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   type: "module",
   repository: {
@@ -3724,8 +3724,21 @@ var compose_default = `# Runs mybase: the control plane (API + dashboard), the s
 #      Optionally POSTGRES_BIND=127.0.0.1, GARAGE_S3_BIND=127.0.0.1, and VALKEY_BIND=127.0.0.1 to stop exposing those ports on the LAN.
 #   5. docker compose up -d
 # Apps on serverless hosts reach Postgres at wss://mybase.<domain>/db with @neondatabase/serverless,
+# or, with a router port forward, at a normal postgres:// URL (public Postgres, below).
 # and the cache at https://mybase.<domain>/cache/<project> (@mybase-dev/sdk/cache or @upstash/redis).
 # Cloudflare's free plan caps request bodies at 100 MB: bigger dashboard uploads only work on the LAN.
+#
+# Public Postgres (any driver, from anywhere): \`mybase server database-public\` sets this up. By hand:
+#   1. On your router, forward TCP 5432 to this machine (it reveals your home IP; won't work behind CGNAT).
+#   2. Create a Cloudflare API token with Zone \u203A DNS \u203A Edit + Zone \u203A Zone \u203A Read for your zone.
+#   3. In .env:
+#        MYBASE_DB_PUBLIC=on
+#        MYBASE_DB_PUBLIC_HOST=db.<domain>
+#        MYBASE_DNS_TOKEN=<token>
+#   4. docker compose up -d
+# mybase then keeps an unproxied A record for db.<domain> on your public IP, gets a Let's Encrypt
+# certificate for it (DNS challenge, no port 80), and connection strings end in ?sslmode=require.
+# From the internet only project roles can sign in, to their own database, over TLS.
 name: mybase
 
 services:
@@ -3759,6 +3772,12 @@ services:
       MYBASE_PUBLIC_URL: \${MYBASE_PUBLIC_URL:-http://\${MYBASE_PUBLIC_HOST:-localhost}:\${MYBASE_PORT:-4000}}
       # Postgres over WebSocket, for apps that can't reach the Postgres port. Defaults to <MYBASE_PUBLIC_URL>/db.
       MYBASE_DB_WS_URL: \${MYBASE_DB_WS_URL:-}
+      # Public Postgres (see the top of this file): on + MYBASE_DB_PUBLIC_HOST + MYBASE_DNS_TOKEN.
+      MYBASE_DB_PUBLIC: \${MYBASE_DB_PUBLIC:-}
+      MYBASE_DNS_TOKEN: \${MYBASE_DNS_TOKEN:-}
+      # Optional: contact for Let's Encrypt, and 1 to use its staging CA (untrusted certs, for testing).
+      MYBASE_ACME_EMAIL: \${MYBASE_ACME_EMAIL:-}
+      MYBASE_ACME_STAGING: \${MYBASE_ACME_STAGING:-}
       MYBASE_MAX_UPLOAD: \${MYBASE_MAX_UPLOAD:-1073741824}
       VALKEY_HOST: valkey
       VALKEY_PORT: 6379
@@ -3875,6 +3894,8 @@ configs:
       metadata_dir = "/var/lib/garage/meta"
       data_dir = "/var/lib/garage/data"
       db_engine = "lmdb"
+      # Garage maps 1 TiB by default; Raspberry Pi kernels give processes only 512 GiB (39-bit VA).
+      lmdb_map_size = "64G"
       replication_factor = 1
       rpc_bind_addr = "[::]:3901"
       rpc_public_addr = "127.0.0.1:3901"
@@ -3933,6 +3954,10 @@ var SECTIONS = [
     keys: ["MYBASE_PORT", "MYBASE_PUBLIC_HOST", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY", "POSTGRES_PORT", "GARAGE_S3_PORT", "VALKEY_PORT", "POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"]
   },
   { title: "Cloudflare Tunnel (public HTTPS without opening router ports)", keys: ["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN"] },
+  {
+    title: "Public Postgres (router port forward; `mybase server database-public`)",
+    keys: ["MYBASE_DB_PUBLIC", "MYBASE_DB_PUBLIC_HOST", "MYBASE_DNS_TOKEN", "MYBASE_ACME_EMAIL", "MYBASE_ACME_STAGING"]
+  },
   { title: "Startup: `no` keeps mybase from starting again after a reboot or crash", keys: ["MYBASE_RESTART"] },
   { title: "Tuning", keys: ["CACHE_MAXMEMORY", "GARAGE_CAPACITY", "MYBASE_MAX_UPLOAD", "LOG_LEVEL"] }
 ];
@@ -4198,14 +4223,15 @@ import { homedir as homedir2, hostname as hostname3 } from "os";
 import { join as join3, resolve as resolve4 } from "path";
 import { styleText as styleText3 } from "util";
 
-// src/cloudflare.ts
+// ../../packages/shared/src/cloudflare.ts
 var API = "https://api.cloudflare.com/client/v4";
 var TOKEN_PERMISSIONS = ["Account \u203A Cloudflare Tunnel \u203A Edit", "Zone \u203A DNS \u203A Edit", "Zone \u203A Zone \u203A Read"];
+var DNS_TOKEN_PERMISSIONS = ["Zone \u203A DNS \u203A Edit", "Zone \u203A Zone \u203A Read"];
 var TOKEN_URL = "https://dash.cloudflare.com/profile/api-tokens";
 
 class CloudflareError extends Error {
 }
-function cloudflare(token, fetcher = fetch) {
+function cloudflare(token, fetcher = fetch, permissions = TOKEN_PERMISSIONS) {
   async function call(method, path, body) {
     const res = await fetcher(`${API}${path}`, {
       method,
@@ -4218,7 +4244,7 @@ function cloudflare(token, fetcher = fetch) {
     if (!res.ok || !data?.success) {
       const message = data?.errors?.map((e) => e.message).join("; ") || res.statusText;
       if (res.status === 401 || res.status === 403)
-        throw new CloudflareError(`Cloudflare refused the token (${message}). It needs: ${TOKEN_PERMISSIONS.join(", ")}.`);
+        throw new CloudflareError(`Cloudflare refused the token (${message}). It needs: ${permissions.join(", ")}.`);
       throw new CloudflareError(`Cloudflare: ${message}`);
     }
     return data.result;
@@ -4226,6 +4252,19 @@ function cloudflare(token, fetcher = fetch) {
   return {
     listAccounts: () => call("GET", "/accounts?per_page=50"),
     listZones: () => call("GET", "/zones?per_page=50&status=active"),
+    async zoneFor(host) {
+      const zones = await call("GET", "/zones?per_page=50&status=active");
+      return zoneOf(zones, host);
+    },
+    async upsertRecord(zoneId, record) {
+      const path = `/zones/${zoneId}/dns_records`;
+      const existing = await call("GET", `${path}?type=${record.type}&name=${encodeURIComponent(record.name)}`);
+      if (existing[0])
+        return call("PUT", `${path}/${existing[0].id}`, record);
+      return call("POST", path, record);
+    },
+    createRecord: (zoneId, record) => call("POST", `/zones/${zoneId}/dns_records`, record),
+    deleteRecord: (zoneId, id) => call("DELETE", `/zones/${zoneId}/dns_records/${id}`),
     async ensureTunnel(accountId, name) {
       const existing = await call("GET", `/accounts/${accountId}/cfd_tunnel?name=${encodeURIComponent(name)}&is_deleted=false`);
       if (existing[0])
@@ -4252,7 +4291,16 @@ function cloudflare(token, fetcher = fetch) {
   };
 }
 var pointsAtTunnel = (record, tunnelId) => record.content === `${tunnelId}.cfargotunnel.com`;
-
+function zoneOf(zones, host) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  let best = null;
+  for (const zone of zones) {
+    const z = zone.name.toLowerCase();
+    if ((name === z || name.endsWith(`.${z}`)) && z.length > (best?.name.length ?? -1))
+      best = zone;
+  }
+  return best;
+}
 // src/server-setup.ts
 var DEFAULT_DIR = join3(homedir2(), "mybase");
 var USERNAME_PATTERN = /^[a-zA-Z0-9_.@-]{1,64}$/;
@@ -4481,6 +4529,70 @@ async function bindStep(lan, existing) {
   }));
   return Object.fromEntries(BIND_KEYS.map((k) => [k, lock ? "127.0.0.1" : null]));
 }
+var DB_PUBLIC_KEYS = ["MYBASE_DB_PUBLIC", "MYBASE_DB_PUBLIC_HOST", "MYBASE_DNS_TOKEN", "MYBASE_ACME_EMAIL", "MYBASE_ACME_STAGING"];
+async function dbPublicStep(existing) {
+  ui.note([
+    `Apps anywhere get a normal postgres:// URL, with any driver. You need:`,
+    `\u2022 Your router to forward TCP port ${existing.POSTGRES_PORT || "5432"} to this machine. ${dim("Shows your home IP; not possible behind CGNAT.")}`,
+    `\u2022 A Cloudflare token that mybase keeps, to point db.<domain> at your IP and get a TLS certificate.`,
+    `  Create one at ${cyan(TOKEN_URL)} ${dim("(Custom token)")} with only:`,
+    ...DNS_TOKEN_PERMISSIONS.map((perm) => `     \u2022 ${perm}`)
+  ].join(`
+`), "Public Postgres");
+  const tunnelHost = URL.parse(existing.MYBASE_PUBLIC_URL ?? "")?.hostname ?? "";
+  for (;; ) {
+    const token = (await ask(password({ message: "Cloudflare API token (DNS edit)", validate: (v) => v?.trim() ? undefined : "required" }))).trim();
+    const cf = cloudflare(token, fetch, DNS_TOKEN_PERMISSIONS);
+    const s = ui.spinner();
+    s.start("Looking up your domains");
+    let zones;
+    try {
+      zones = await cf.listZones();
+    } catch (err) {
+      s.error(err.message);
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      throw new CliError("public Postgres not set up: no working token");
+    }
+    if (zones.length === 0) {
+      s.error("No active domains on this token");
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      throw new CliError("public Postgres not set up: the token can't see any domain");
+    }
+    s.stop(`Found ${zones.length} domain${zones.length === 1 ? "" : "s"}`);
+    const preferred = zoneOf(zones, existing.MYBASE_DB_PUBLIC_HOST || tunnelHost);
+    const zoneId = zones.length === 1 ? zones[0].id : await ask(select({ message: "Which domain?", options: zones.map((z) => ({ value: z.id, label: z.name })), initialValue: preferred?.id }));
+    const chosen = zones.find((z) => z.id === zoneId);
+    const suggested = existing.MYBASE_DB_PUBLIC_HOST && zoneOf([chosen], existing.MYBASE_DB_PUBLIC_HOST) ? existing.MYBASE_DB_PUBLIC_HOST : `db.${chosen.name}`;
+    const host = (await ask(text({
+      message: "Hostname for the database",
+      placeholder: suggested,
+      defaultValue: suggested,
+      validate: (v) => {
+        const h = (v || suggested).trim().toLowerCase();
+        if (validHost(h))
+          return validHost(h);
+        return zoneOf([chosen], h) ? undefined : `must end in ${chosen.name}`;
+      }
+    }))).trim().toLowerCase() || suggested;
+    const record = await cf.findRecord(chosen.id, host).catch(() => null);
+    if (record && record.type !== "A") {
+      const replace = await ask(confirm2({ message: `${host} already has a ${record.type} record (${record.content}). Replace it?`, initialValue: false }));
+      if (!replace)
+        continue;
+      await cf.deleteRecord(chosen.id, record.id);
+    }
+    const email = (await ask(text({ message: "Email for Let's Encrypt expiry notices (optional)", placeholder: "skip" }))).trim();
+    return {
+      MYBASE_DB_PUBLIC: "on",
+      MYBASE_DB_PUBLIC_HOST: host,
+      MYBASE_DNS_TOKEN: token,
+      MYBASE_ACME_EMAIL: email || null,
+      POSTGRES_BIND: null
+    };
+  }
+}
 async function adminStep() {
   const when = await ask(select({
     message: "Create the admin account now?",
@@ -4604,6 +4716,22 @@ async function writeCompose(dir, interactive, replace) {
   await Bun.write(file, compose_default);
   return true;
 }
+function pullHint(output) {
+  const failed = /Image (\S+) Error/.exec(output)?.[1];
+  if (/unauthorized|denied|requested access to the resource/i.test(output)) {
+    const image = failed ?? "an image";
+    return failed?.startsWith("ghcr.io/") ? `
+
+${image} is private on GitHub's registry (or doesn't exist). Its owner has to make the package public (GitHub \u2192 Packages \u2192 Package settings \u2192 Change visibility), or sign in first: docker login ghcr.io` : `
+
+The registry refused ${image}: check the image name (MYBASE_IMAGE / MYBASE_POSTGRES_IMAGE in .env), or docker login.`;
+  }
+  if (/timeout|no such host|network|TLS handshake/i.test(output))
+    return `
+
+This machine couldn't reach the registry. Check its internet connection and DNS, then run setup again.`;
+  return "";
+}
 async function missingImages(dir) {
   const images = await compose(dir, ["config", "--images"]);
   const missing = [];
@@ -4615,6 +4743,14 @@ async function missingImages(dir) {
   return missing;
 }
 var imageExists = (image) => Bun.spawnSync(["docker", "image", "inspect", image], { stdout: "ignore", stderr: "ignore" }).exitCode === 0;
+async function brokenServices(dir) {
+  const ps = await compose(dir, ["ps", "-a", "--format", "json"]);
+  if (!ps.ok || !ps.stdout)
+    return [];
+  const rows = ps.stdout.startsWith("[") ? JSON.parse(ps.stdout) : ps.stdout.split(`
+`).filter(Boolean).map((l) => JSON.parse(l));
+  return rows.filter((r) => r.State !== "running" || r.Health === "unhealthy").map((r) => r.Service);
+}
 async function startStack(dir, env, pull = true) {
   const s = ui.spinner();
   if (pull) {
@@ -4625,7 +4761,7 @@ async function startStack(dir, env, pull = true) {
       if (missing.length) {
         s.error("Couldn't download the images");
         throw new CliError(`couldn't download ${missing.join(", ")}:
-${tail(pulled.stderr || pulled.stdout)}`);
+${tail(pulled.stderr || pulled.stdout)}${pullHint(pulled.stderr || pulled.stdout)}`);
       }
       s.stop("Using the images already on this machine (couldn't download newer ones)");
     } else
@@ -4642,11 +4778,21 @@ ${tail(up.stderr || up.stdout)}`);
   const version = await waitHealthy(localUrl(env));
   if (!version) {
     s.error("mybase didn't come up");
-    const logs = await compose(dir, ["logs", "--tail", "30", "mybase"]);
-    throw new CliError(`mybase didn't answer at ${localUrl(env)}/health within 3 minutes. Its last log lines:
-${logs.stdout || logs.stderr}
+    const broken = await brokenServices(dir);
+    const sections = [];
+    for (const service of broken.length ? broken : ["mybase"]) {
+      const logs = await compose(dir, ["logs", "--no-log-prefix", "--tail", "25", service]);
+      sections.push(`\u2500\u2500 ${service} \u2500\u2500
+${logs.stdout || logs.stderr || "(no output)"}`);
+    }
+    const which = broken.length ? `Not running: ${broken.join(", ")}.` : "Every container is up, but the API isn't answering.";
+    throw new CliError(`mybase didn't answer at ${localUrl(env)}/health within 3 minutes. ${which}
 
-Fix the problem, then run \`mybase server setup --dir ${dir}\` again (keys are kept).`);
+${sections.join(`
+
+`)}
+
+Fix the problem, then run \`mybase server setup --dir ${dir}\` again (keys are kept). \`mybase server status\` shows every container.`);
   }
   s.stop(`mybase ${version} is running`);
   return version;
@@ -4862,6 +5008,9 @@ var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machi
   server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
   server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
   server tunnel [--dir <dir>]    Add or replace the Cloudflare Tunnel [--tunnel-token <t> --domain <d>] | --off
+  server database-public [--dir <dir>]   A normal postgres:// URL from anywhere: router port forward +
+                                 Let's Encrypt TLS + DNS kept on your IP (Cloudflare)
+    [--host <db.domain> --dns-token <t> [--email <e>] [--staging]] | --off
   server autostart on|off        Start mybase when this machine boots (and restart it after crashes)
   Default dir: the last one setup used, else ~/mybase`;
 var dim2 = (s) => styleText4("dim", s);
@@ -4929,7 +5078,7 @@ async function update(args) {
   const version = await startStack(dir, values);
   const minor = (v) => v.split(".").slice(0, 2).join(".");
   if (minor(version) !== minor(CLI_VERSION)) {
-    ui.warn(`The server is ${version}, this CLI ${CLI_VERSION}. Update the CLI: curl -fsSL https://raw.githubusercontent.com/LandonHarter/mybase/master/scripts/install.sh | sh`);
+    ui.warn(`The server is ${version}, this CLI ${CLI_VERSION}. Update the CLI: mybase update --cli`);
   }
   if (jsonMode)
     return print({ dir, version, composeUpdated: replaced }, () => {});
@@ -4968,6 +5117,53 @@ async function tunnel(args) {
     return print({ dir, version, publicUrl: host ? `https://${host}` : null }, () => {});
   outro(host ? `Public at https://${host}. Turn on two-factor sign-in in Settings if you haven't.` : "Tunnel off. mybase is reachable on this machine and your network only.");
 }
+async function databasePublic(args) {
+  const dir = await serverDir(args);
+  const { text, values } = await loadEnv(dir);
+  const interactive = !jsonMode && process.stdin.isTTY === true;
+  const off = args.includes("--off");
+  if (!jsonMode)
+    intro(`${styleText4("bold", " mybase ")} ${dim2("server database-public")}`);
+  let updates;
+  if (off) {
+    updates = Object.fromEntries(DB_PUBLIC_KEYS.map((k) => [k, null]));
+  } else if (flag(args, "--dns-token")) {
+    const host = flag(args, "--host");
+    if (!host)
+      throw usageError("--dns-token needs --host (like db.example.com)");
+    updates = {
+      MYBASE_DB_PUBLIC: "on",
+      MYBASE_DB_PUBLIC_HOST: host.toLowerCase(),
+      MYBASE_DNS_TOKEN: flag(args, "--dns-token"),
+      MYBASE_ACME_EMAIL: flag(args, "--email") ?? null,
+      MYBASE_ACME_STAGING: args.includes("--staging") ? "1" : null,
+      POSTGRES_BIND: null
+    };
+  } else if (interactive) {
+    updates = await dbPublicStep(values);
+  } else
+    throw usageError("without a terminal, pass --host <db.domain> --dns-token <t>, or --off");
+  if (!off && values.POSTGRES_BIND === "127.0.0.1")
+    ui.info("Postgres now listens on your network again (POSTGRES_BIND), so the router can reach it.");
+  await saveEnv(dir, mergeEnv(text, updates));
+  const version = await startStack(dir, values, false);
+  const port = values.POSTGRES_PORT || "5432";
+  const lan = addresses().find((a) => a.label.startsWith("LAN IP"))?.value ?? "<this machine's LAN IP>";
+  const host = off ? null : updates.MYBASE_DB_PUBLIC_HOST;
+  if (jsonMode)
+    return print({ dir, version, host, port: Number(port), forward: host ? `${lan}:${port}` : null }, () => {});
+  if (!host)
+    return outro("Public Postgres off. Connection strings point at your network address again. Remove the port forward on your router.");
+  ui.note([
+    `On your router (usually "Port forwarding" or "Virtual server"):`,
+    `  TCP ${port} (external) \u2192 ${lan}:${port}`,
+    ``,
+    dim2("mybase now points the DNS record at your public IP and requests the certificate (about a minute)."),
+    dim2("Check progress in the dashboard (Database \u2192 Settings) or with `mybase doctor`.")
+  ].join(`
+`), "Last step");
+  outro(`New connection strings: postgres://<project>:<password>@${host}:${port}/<project>?sslmode=require`);
+}
 async function autostart(args) {
   const mode = args[0];
   if (mode !== "on" && mode !== "off")
@@ -4998,6 +5194,8 @@ async function server(command, args) {
     await update(args);
   else if (command === "tunnel")
     await tunnel(args);
+  else if (command === "database-public")
+    await databasePublic(args);
   else if (command === "autostart")
     await autostart(args);
   else
@@ -5005,6 +5203,125 @@ async function server(command, args) {
   return true;
 }
 
+// src/update.ts
+import { chmod as chmod3, rename, rm } from "fs/promises";
+import { join as join5 } from "path";
+var updateUsage = `  update [--version <v>] [--cli] [--yes]
+                                 Update this CLI to the latest release (or <v>), then the server on this
+                                 machine, if there is one. --cli: only the CLI`;
+var REPO = "landonharter/mybase";
+var isCompiled = () => Bun.main.startsWith("/$bunfs/") || Bun.main.includes("~BUN");
+function assetName(platform = process.platform, arch = process.arch) {
+  const os = platform === "win32" ? "windows" : platform;
+  if (!["linux", "darwin", "windows"].includes(os))
+    throw new CliError(`no mybase binary for ${platform}`);
+  const cpu = arch === "x64" ? "x64" : arch === "arm64" ? "arm64" : null;
+  if (!cpu)
+    throw new CliError(`no mybase binary for ${arch} CPUs`);
+  return `mybase-${os}-${cpu}${os === "windows" ? ".exe" : ""}`;
+}
+async function latestVersion() {
+  const res = await fetch(`https://github.com/${REPO}/releases/latest`, { redirect: "manual" }).catch(() => {
+    throw new CliError("can't reach github.com to check for updates");
+  });
+  const tag = /\/tag\/v?([^/?#]+)$/.exec(res.headers.get("location") ?? "")?.[1];
+  if (!tag)
+    throw new CliError(`couldn't find the latest release (GitHub answered ${res.status})`);
+  return tag;
+}
+function newer(a, b) {
+  const pa = a.split(/[.-]/).map((n) => Number.parseInt(n, 10) || 0);
+  const pb = b.split(/[.-]/).map((n) => Number.parseInt(n, 10) || 0);
+  for (let i = 0;i < 3; i++)
+    if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+      return (pa[i] ?? 0) > (pb[i] ?? 0);
+  return false;
+}
+async function replaceBinary(version) {
+  const target = process.execPath;
+  const url = `https://github.com/${REPO}/releases/download/v${version}/${assetName()}`;
+  const res = await fetch(url).catch(() => {
+    throw new CliError(`can't download ${url}`);
+  });
+  if (!res.ok)
+    throw new CliError(`can't download ${url} (${res.status})`);
+  const temp = `${target}.new`;
+  try {
+    const writer = Bun.file(temp).writer();
+    for await (const chunk of res.body)
+      writer.write(chunk);
+    await writer.end();
+    await chmod3(temp, 493);
+  } catch (err) {
+    const code = err.code;
+    if (code === "EACCES" || code === "EPERM")
+      throw new CliError(`can't write next to ${target}. Run it with sudo, or reinstall: curl -fsSL https://raw.githubusercontent.com/${REPO}/master/scripts/install.sh | sh`);
+    throw err;
+  }
+  const check = Bun.spawnSync([temp, "help"], { stdout: "ignore", stderr: "ignore" });
+  if (check.exitCode !== 0) {
+    await rm(temp, { force: true });
+    throw new CliError(`the downloaded binary doesn't run on this machine; kept ${CLI_VERSION}`);
+  }
+  if (process.platform === "win32") {
+    await rm(`${target}.old`, { force: true });
+    await rename(target, `${target}.old`);
+  }
+  await rename(temp, target);
+}
+async function updateServer(bin, dir) {
+  const args = [...bin, "server", "update", "--dir", dir, ...jsonMode ? ["--json", "--yes"] : []];
+  const proc = Bun.spawn(args, { stdio: [jsonMode ? "ignore" : "inherit", jsonMode ? "ignore" : "inherit", "inherit"] });
+  return await proc.exited === 0;
+}
+async function update2(args) {
+  const versionIndex = args.indexOf("--version");
+  const wanted = versionIndex === -1 ? null : args[versionIndex + 1]?.replace(/^v/, "");
+  if (versionIndex !== -1 && !wanted)
+    throw new CliError("--version needs a value", 2);
+  const yes = args.includes("--yes");
+  const result = {
+    cli: { from: CLI_VERSION, to: CLI_VERSION, updated: false },
+    server: null
+  };
+  if (!isCompiled()) {
+    if (!jsonMode)
+      console.log("This CLI was installed with npm/bun. Update it with: bun add -g @mybase-dev/cli@latest (or npm i -g)");
+  } else {
+    const target = wanted ?? await latestVersion();
+    result.cli.to = target;
+    if (target === CLI_VERSION || !wanted && !newer(target, CLI_VERSION)) {
+      if (!jsonMode)
+        console.log(`CLI ${CLI_VERSION} is up to date.`);
+    } else {
+      if (!jsonMode)
+        console.log(`Updating the CLI: ${CLI_VERSION} \u2192 ${target}`);
+      await replaceBinary(target);
+      result.cli.updated = true;
+      if (!jsonMode)
+        console.log(`CLI ${target} installed at ${process.execPath}`);
+    }
+  }
+  const dir = (await loadConfig()).server;
+  const installed = dir && await Bun.file(join5(dir, "compose.yml")).exists();
+  if (installed && !args.includes("--cli")) {
+    let go = yes || jsonMode;
+    if (!go && process.stdin.isTTY) {
+      const answer = prompt(`Update the server in ${dir} too? (new images, restart) [Y/n]`);
+      go = answer === null || /^(y|yes|)$/i.test(answer.trim());
+    }
+    if (go) {
+      const bin = isCompiled() ? [process.execPath] : [process.execPath, Bun.main];
+      const ok = await updateServer(bin, dir);
+      result.server = { dir, updated: ok };
+      if (!ok)
+        throw new CliError(`the server update failed${result.cli.updated ? ` (the CLI is ${result.cli.to} now)` : ""}. Run \`mybase server update\` to see why.`);
+    } else if (!jsonMode)
+      console.log("Server left as it is. Update it later with: mybase server update");
+  }
+  print(result, () => {});
+}
+
 // src/users.ts
 var usersUsage = `  users enable <project>         Turn on users: an auth schema for Better Auth, plus setup steps
   users init <project> [--env <secrets env>]  Print an auth.ts for Better Auth; --env stores a new BETTER_AUTH_SECRET there
@@ -5145,6 +5462,7 @@ var projectUsage = `  project create <name>          Create a new project (datab
 var USAGE = {
   auth: authUsage,
   server: serverUsage,
+  update: updateUsage,
   token: tokenUsage,
   project: projectUsage,
   context: contextUsage,
@@ -5198,6 +5516,8 @@ async function main(args) {
     return;
   if (command === "run")
     return run(args.slice(1));
+  if (command === "update")
+    return update2(args.slice(1));
   if (command === "doctor")
     return doctor(args.slice(1));
   if (command === "audit")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybase-dev/cli",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   "type": "module",
   "repository": {