@mybase-dev/cli 1.0.4 → 1.0.6

package/dist/mybase.js

@@ -139,7 +139,7 @@ function parseDotenv(text) {
 // package.json
 var package_default = {
   name: "@mybase-dev/cli",
-  version: "1.0.4",
+  version: "1.0.6",
   description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   type: "module",
   repository: {
@@ -305,6 +305,31 @@ function parseDelay(value) {
   return Math.round(Number(m[1]) * UNITS[m[2]]);
 }
 
+// src/service-enable.ts
+async function linkedEnvs(project) {
+  const overview = await api(`/projects/${encodeURIComponent(project)}/secrets`).catch(() => null);
+  return overview?.envs.filter((e) => e.linked).map((e) => e.name) ?? [];
+}
+async function enableService(project, id, flags) {
+  const envs = flags.has("no-link") ? [] : await linkedEnvs(project);
+  let link = envs.length > 0 && flags.has("link");
+  if (envs.length > 0 && !link && !jsonMode && process.stdin.isTTY) {
+    const answer = prompt(`Add the ${id} keys to the linked secrets envs (${envs.join(", ")})? [Y/n]`);
+    link = !answer?.trim() || /^y/i.test(answer.trim());
+  }
+  const path = `/projects/${encodeURIComponent(project)}/services/${id}`;
+  const result = await api(path, link ? { method: "PUT", body: JSON.stringify({ link: true }) } : { method: "PUT" });
+  return { result, linked: link ? envs : [] };
+}
+function printLinked(project, linked, flags) {
+  if (linked.length > 0)
+    console.log(`
+Keys added to the linked secrets envs: ${linked.join(", ")} (mybase run -p ${project} -e ${linked[0]} -- \u2026)`);
+  else if (flags.has("link"))
+    console.log(`
+No linked secrets envs yet: mybase secrets link -p ${project} -e prod`);
+}
+
 // src/cron.ts
 var cronUsage = `  cron enable <project>          Turn on cron for a project and print its signing secret
   cron disable <project> [--yes] Turn it off, deleting every job and its history
@@ -388,12 +413,13 @@ async function cron(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/cron`, { method: "PUT" });
+      const { linked } = await enableService(p, "cron", flags);
       const secret = await api(`/projects/${encodeURIComponent(p)}/cron/secret`);
-      print({ enabled: "cron", project: p, ...secret }, () => {
+      print({ enabled: "cron", project: p, linked, ...secret }, () => {
         console.log(`Cron enabled for "${p}"
 `);
         printSecret(secret);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -881,12 +907,14 @@ async function analytics(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need2(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/analytics`, { method: "PUT" });
+      const flags = parseArgs(args).flags;
+      const { linked } = await enableService(p, "analytics", flags);
       const settings = await api(`${base(p)}/settings`);
-      print({ enabled: "analytics", project: p, ...settings }, () => {
+      print({ enabled: "analytics", project: p, linked, ...settings }, () => {
         console.log(`Analytics enabled for "${p}"
 `);
         printSettings(p, settings);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -1351,13 +1379,14 @@ async function cache(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      const res = await api(`/projects/${encodeURIComponent(p)}/services/cache`, { method: "PUT" });
-      if (res.service !== "cache")
+      const { result: res, linked } = await enableService(p, "cache", flags);
+      if (res?.service !== "cache")
         throw new Error("unexpected answer from the API");
-      print({ enabled: "cache", project: p, ...res.credentials }, () => {
+      print({ enabled: "cache", project: p, linked, ...res.credentials }, () => {
         console.log(`Cache enabled for "${p}"
 `);
         printCredentials(p, res.credentials);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -1419,12 +1448,13 @@ async function captcha(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/captcha`, { method: "PUT" });
+      const { linked } = await enableService(p, "captcha", flags);
       const s = await api(base3(p));
-      print({ enabled: "captcha", project: p, ...s }, () => {
+      print({ enabled: "captcha", project: p, linked, ...s }, () => {
         console.log(`Captcha enabled for "${p}"
 `);
         printSettings2(p, s);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -1570,12 +1600,13 @@ async function queue(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/queue`, { method: "PUT" });
+      const { linked } = await enableService(p, "queue", flags);
       const settings = await api(base4(p));
-      print({ enabled: "queue", project: p, ...settings }, () => {
+      print({ enabled: "queue", project: p, linked, ...settings }, () => {
         console.log(`Queues enabled for "${p}"
 `);
         printUsage(p, settings);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -1770,12 +1801,13 @@ async function vector(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/vector`, { method: "PUT" });
+      const { linked } = await enableService(p, "vector", flags);
       const settings = await api(base5(p));
-      print({ enabled: "vector", project: p, ...settings }, () => {
+      print({ enabled: "vector", project: p, linked, ...settings }, () => {
         console.log(`Vector search enabled for "${p}"
 `);
         printUsage2(p, settings);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -1956,12 +1988,13 @@ async function ratelimit(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/ratelimit`, { method: "PUT" });
+      const { linked } = await enableService(p, "ratelimit", flags);
       const settings = await api(base6(p));
-      print({ enabled: "ratelimit", project: p, ...settings }, () => {
+      print({ enabled: "ratelimit", project: p, linked, ...settings }, () => {
         console.log(`Rate limits enabled for "${p}"
 `);
         printUsage3(p, settings);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -2063,8 +2096,11 @@ var secretsUsage = `  secrets enable <project>       Turn on secrets (dev, stagi
   secrets history [--limit 20]   Revisions, newest first
   secrets restore <revision> [--yes]  Put values back as they were after <revision>
   secrets link --env <env,\u2026> [--yes]  Rotate the project's DB/S3/cache credentials and keep them
-                                 in these envs (DATABASE_URL, S3_*, REDIS_URL, MYBASE_URL)
+                                 in these envs (DATABASE_URL, S3_*, REDIS_URL, MYBASE_URL), with
+                                 every service's keys (MYBASE_API_KEY, MYBASE_CRON_SECRET, \u2026)
   secrets unlink [--yes]         Remove the credentials from the env (they stay valid)
+                                 \`<service> enable\` asks to add that service's keys to linked
+                                 envs (--link / --no-link to skip the question)
                                  Project/env: -p/--project, -e/--env, else MYBASE_PROJECT/MYBASE_ENV,
                                  else \`secrets setup\` for this directory`;
 var expandShortFlags = (args) => args.map((a) => a === "-p" ? "--project" : a === "-e" ? "--env" : a);
@@ -2240,7 +2276,7 @@ async function secrets(sub, args) {
     case "link": {
       const { project, env } = await target(flags);
       const envs = env.split(",").map((e) => e.trim()).filter(Boolean);
-      confirm(yes, `This rotates the credentials of "${project}" (database password, storage key, and cache password if the cache is on) and stores the new ones in ${envs.join(", ")} plus any env linked before. Apps still using the old credentials will stop working.`, project, "the project name");
+      confirm(yes, `This rotates the credentials of "${project}" (database password, storage key, cache password if the cache is on, and the API key link made before) and stores the new ones, with the other services' keys, in ${envs.join(", ")} plus any env linked before. Apps still using the old credentials will stop working.`, project, "the project name");
       const result = await api(`${base7(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
       print(result, () => {
         console.log(`Rotated and stored in ${result.envs.join(", ")}: ${result.keys.join(", ")}`);
@@ -2300,9 +2336,9 @@ async function search(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(servicePath(p), { method: "PUT" });
+      const { linked } = await enableService(p, "search", flags);
       const searchUrl = `${API_URL}/search/${p}`;
-      print({ enabled: "search", project: p, searchUrl, fetchUrl: `${searchUrl}/fetch` }, () => {
+      print({ enabled: "search", project: p, linked, searchUrl, fetchUrl: `${searchUrl}/fetch` }, () => {
         console.log(`Web search enabled for "${p}"
 `);
         console.log(`  search URL  ${searchUrl}?q=\u2026`);
@@ -2313,6 +2349,7 @@ async function search(sub, args) {
 `);
         console.log(`  const web = createSearchClient({ apiUrl: "${API_URL}", project: "${p}", apiKey: process.env.MYBASE_API_KEY! })`);
         console.log(`  const { results } = await web.search("\u2026")   // or searchTools(web) for an LLM agent`);
+        printLinked(p, linked, flags);
       });
       return true;
     }
@@ -3722,6 +3759,7 @@ var compose_default = `# Runs mybase: the control plane (API + dashboard), the s
 #        MYBASE_S3_PUBLIC_URL=https://s3.<domain>
 #        MYBASE_TRUST_PROXY=cloudflare
 #      Optionally POSTGRES_BIND=127.0.0.1, GARAGE_S3_BIND=127.0.0.1, and VALKEY_BIND=127.0.0.1 to stop exposing those ports on the LAN.
+#      Optionally CLOUDFLARED_REGION=us if the tunnel lands on far-away data centers (see \`mybase server status\`).
 #   5. docker compose up -d
 # Apps on serverless hosts reach Postgres at wss://mybase.<domain>/db with @neondatabase/serverless,
 # or, with a router port forward, at a normal postgres:// URL (public Postgres, below).
@@ -3885,6 +3923,11 @@ services:
     command: tunnel --no-autoupdate run
     environment:
       TUNNEL_TOKEN: \${CLOUDFLARE_TUNNEL_TOKEN:-}
+      # Which Cloudflare data centers the tunnel connects to: empty = nearest by anycast, \`us\` = US only
+      # (if \`mybase server status\` shows far-away colos, every request takes the detour).
+      TUNNEL_REGION: \${CLOUDFLARED_REGION:-}
+      # auto (QUIC, falls back to HTTP/2), quic, or http2 (if your network blocks or throttles UDP).
+      TUNNEL_TRANSPORT_PROTOCOL: \${CLOUDFLARED_PROTOCOL:-auto}
     depends_on:
       - mybase
 
@@ -4216,6 +4259,25 @@ async function enableDockerOnBoot() {
     return false;
   }
 }
+function tunnelConnections(logs) {
+  const conns = new Map;
+  for (const line of logs.split(`
+`)) {
+    if (/Starting tunnel/.test(line))
+      conns.clear();
+    const index = Number(/connIndex=(\d+)/.exec(line)?.[1]);
+    if (Number.isNaN(index))
+      continue;
+    if (/Registered tunnel connection/.test(line)) {
+      const location = /location=(\S+)/.exec(line)?.[1];
+      if (location)
+        conns.set(index, { index, location, protocol: /protocol=(\S+)/.exec(line)?.[1] ?? null });
+    } else if (/Unregistered tunnel connection|Connection terminated|Retrying connection|Serve tunnel error/.test(line)) {
+      conns.delete(index);
+    }
+  }
+  return [...conns.values()].sort((a, b) => a.index - b.index);
+}
 
 // src/server-setup.ts
 import { chmod as chmod2, mkdir as mkdir3 } from "fs/promises";
@@ -5007,6 +5069,7 @@ var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machi
     [--admin-user <u> --admin-password-stdin]   Without a terminal: defaults plus these flags
   server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
   server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
+  server restart [--dir <dir>]   Restart every container (API, Postgres, storage, cache, search, tunnel)
   server tunnel [--dir <dir>]    Add or replace the Cloudflare Tunnel [--tunnel-token <t> --domain <d>] | --off
   server database-public [--dir <dir>]   A normal postgres:// URL from anywhere: router port forward +
                                  Let's Encrypt TLS + DNS kept on your IP (Cloudflare)
@@ -5039,6 +5102,10 @@ async function status(args) {
   const health = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3000) }).then(async (r) => r.ok ? (await r.json()).version ?? "unknown" : null).catch(() => null);
   const autostart = values.MYBASE_RESTART !== "no";
   const docker = dockerOnBoot();
+  const tunnelOn = !!values.CLOUDFLARE_TUNNEL_TOKEN && containers.some((c) => c.Service === "cloudflared");
+  const tunnelLogs = tunnelOn ? await compose(dir, ["logs", "--no-log-prefix", "--tail", "500", "cloudflared"]) : null;
+  const tunnel = tunnelLogs?.ok ? tunnelConnections(`${tunnelLogs.stdout}
+${tunnelLogs.stderr}`) : null;
   const data = {
     dir,
     url,
@@ -5047,6 +5114,7 @@ async function status(args) {
     autostart: autostart && docker !== "disabled",
     dockerOnBoot: docker,
     publicUrl: values.CLOUDFLARE_TUNNEL_TOKEN ? values.MYBASE_PUBLIC_URL ?? null : null,
+    tunnel,
     containers: containers.map((c) => ({ service: c.Service, state: c.State, health: c.Health || null }))
   };
   print(data, () => {
@@ -5054,6 +5122,10 @@ async function status(args) {
     console.log(`  ${health ? green("\u25CF") : red("\u25CF")} ${url}  ${health ? `version ${health}` : "not answering"}`);
     if (data.publicUrl)
       console.log(`  ${dim2("public")}  ${data.publicUrl}`);
+    if (tunnel) {
+      const where = tunnel.map((c) => `${c.location}${c.protocol ? ` ${c.protocol}` : ""}`).join(", ");
+      console.log(`  ${tunnel.length > 0 ? green("\u25CF") : red("\u25CF")} ${dim2("tunnel")}  ${tunnel.length > 0 ? `${tunnel.length} connection(s): ${where}` : "not connected to Cloudflare (public URL answers 530)"}`);
+    }
     console.log(`  ${dim2("starts on boot")}  ${!autostart ? "no (mybase server autostart on)" : docker === "disabled" ? "no: Docker doesn't start at boot (sudo systemctl enable docker)" : "yes"}`);
     console.log("");
     if (containers.length === 0)
@@ -5084,6 +5156,31 @@ async function update(args) {
     return print({ dir, version, composeUpdated: replaced }, () => {});
   outro(`mybase ${version} is running at ${localUrl(values)}`);
 }
+async function restart(args) {
+  const dir = await serverDir(args);
+  const { values } = await loadEnv(dir);
+  if (!await stackExists(dir))
+    throw new CliError("no containers to restart. Start them: mybase server update", 4);
+  const s = ui.spinner();
+  s.start("Restarting containers");
+  const res = await compose(dir, ["restart"]);
+  if (!res.ok) {
+    s.stop("Restart failed");
+    throw new CliError(`docker compose restart failed:
+${res.stderr}`);
+  }
+  s.message("Waiting for mybase to answer");
+  const version = await waitHealthy(localUrl(values), 120000);
+  s.stop(version ? "Restarted" : "Containers restarted");
+  if (!version) {
+    ui.warn("mybase didn't answer yet; check `mybase server status`.");
+    process.exitCode = 1;
+  }
+  print({ dir, healthy: version !== null, version }, () => {
+    if (version)
+      console.log(`mybase ${version} is running at ${localUrl(values)}`);
+  });
+}
 async function tunnel(args) {
   const dir = await serverDir(args);
   const { text, values } = await loadEnv(dir);
@@ -5240,6 +5337,8 @@ async function server(command, args) {
     await status(args);
   else if (command === "update")
     await update(args);
+  else if (command === "restart")
+    await restart(args);
   else if (command === "tunnel")
     await tunnel(args);
   else if (command === "database-public")
@@ -5408,15 +5507,16 @@ async function users(sub, args) {
   switch (sub) {
     case "enable": {
       const p = need(project, "project name");
-      await api(`/projects/${encodeURIComponent(p)}/services/users`, { method: "PUT" });
+      const { linked } = await enableService(p, "users", flags);
       const o = await api(base8(p));
-      print({ enabled: "users", project: p, ...o }, () => {
+      print({ enabled: "users", project: p, linked, ...o }, () => {
         console.log(`Users enabled for "${p}". Better Auth's tables go in the "${o.schema}" schema.
 `);
         console.log("Next:");
         console.log(`  1. An API key for the app: mybase token create ${p}-auth --project ${p} --perm users:write,cache:write`);
         console.log(`  2. The cache, for sessions: mybase cache enable ${p}`);
         console.log(`  3. An auth.ts to start from: mybase users init ${p}`);
+        printLinked(p, linked, flags);
       });
       return true;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybase-dev/cli",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   "type": "module",
   "repository": {