@mybase-dev/cli 1.0.7 → 1.0.9

package/dist/mybase.js

@@ -116,6 +116,8 @@ var KEY_RESOURCES = [
   { id: "vector", name: "Vector search", description: "Indexes, documents, and queries (read), and changing them (write)" },
   { id: "users", name: "Users", description: "Your app's users and sessions (read), revoking and deleting them, and sending sign-in events (write)" },
   { id: "captcha", name: "Captcha", description: "Captcha settings (read), and verifying tokens (write)" },
+  { id: "realtime", name: "Realtime", description: "Channels, members, and settings (read), and publishing messages (write)" },
+  { id: "sandbox", name: "Agent sandboxes", description: "Sandboxes, executions, files, artifacts, and browser connections" },
   { id: "audit", name: "Audit log", description: "Who did what: sign-ins, key and project changes, secret reads (read only)" }
 ];
 function parseDotenv(text) {
@@ -139,7 +141,7 @@ function parseDotenv(text) {
 // package.json
 var package_default = {
   name: "@mybase-dev/cli",
-  version: "1.0.7",
+  version: "1.0.9",
   description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   type: "module",
   repository: {
@@ -261,15 +263,18 @@ function confirm(yes, warning, expected, what = expected) {
 var config = await loadConfig();
 var API_URL = (process.env.MYBASE_API_URL || config.url || DEFAULT_API_URL).replace(/\/$/, "");
 var TOKEN = process.env.MYBASE_TOKEN || config.token;
+var apiToken = () => TOKEN;
 var CLI_VERSION = package_default.version;
 async function api(path, init) {
   const token = init?.token === undefined ? TOKEN : init.token;
   const base = init?.url ?? API_URL;
+  const headers = new Headers({ "Content-Type": "application/json", "User-Agent": `mybase-cli/${CLI_VERSION}`, ...token ? { Authorization: `Bearer ${token}` } : {} });
+  new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
   let res;
   try {
     res = await fetch(`${base}${path}`, {
       ...init,
-      headers: { "Content-Type": "application/json", "User-Agent": `mybase-cli/${CLI_VERSION}`, ...token ? { Authorization: `Bearer ${token}` } : {} }
+      headers
     });
   } catch {
     throw new CliError(`can't reach the API at ${base}. Check that it's running, or point MYBASE_API_URL / \`mybase login --url\` at it.`);
@@ -277,6 +282,8 @@ async function api(path, init) {
   init?.onStatus?.(res.status);
   if (res.status === 204)
     return;
+  if (res.ok && init?.raw)
+    return res;
   const body = await res.json().catch(() => ({}));
   if (res.status === 401 && !path.startsWith("/auth/login")) {
     const message = token ? "the API rejected your token. Run `mybase login` again." : "not signed in. Run `mybase login` (or set MYBASE_TOKEN).";
@@ -652,6 +659,9 @@ function contextMarkdown(c) {
   }
   if (c.captcha)
     out.push("## Captcha", "", `Script: ${c.captcha.scriptUrl} (data-project="${c.project}"). Check tokens with \`createCaptchaClient\` (\`captcha:write\` key) or Better Auth's captcha plugin via \`mybaseCaptcha()\`.`, "");
+  if (c.realtime) {
+    out.push("## Realtime", "", `Browsers: \`connectRealtime({ apiUrl, project: "${c.project}", token })\` (socket ${c.realtime.socketUrl}) with tokens your server signs via \`createRealtimeToken(MYBASE_REALTIME_SECRET, \u2026)\`. Publish from the server: POST ${c.realtime.publishUrl} (\`realtime:write\` key, \`createRealtimeClient\`).`, "");
+  }
   if (c.analytics)
     out.push("## Analytics", "", `Public write key \`${c.analytics.writeKey}\`, script ${c.analytics.scriptUrl}`, "");
   out.push("## Env vars", "", ...c.env.map((e) => `- \`${e.name}\`: ${e.description}`), "");
@@ -2077,6 +2087,145 @@ async function sync4(file, dryRun) {
   printSync(config.project, dryRun, await api(`${base6(config.project)}/rules`, { method: "PUT", body: JSON.stringify(body) }));
 }
 
+// src/realtime.ts
+var realtimeUsage = `  realtime enable <project>      Turn on realtime and print the socket URL and secret
+  realtime info <project>        Settings, connections, and messages in the last 24 hours
+  realtime key <project> [--rotate]  Show (or replace) the secret that signs browser tokens and webhooks
+                                 (rotating closes every open connection)
+  realtime settings <project> [--origins a,b|none] [--public on|off] [--webhook <url>|none]
+                                 [--events message,presence,channel] [--max-connections n]
+                                 [--max-channels n] [--max-message-bytes n] [--max-rate n]
+  realtime channels <project> [--prefix p]   Channels with subscribers right now
+  realtime publish <project> <channel> <event> [json]   Send a message to everyone subscribed
+  realtime disable <project> [--yes]  Turn it off (closes every connection)`;
+var base7 = (project) => `/projects/${encodeURIComponent(project)}/realtime`;
+function printSettings3(s) {
+  console.log(`  socket      ${s.socketUrl}  (connectRealtime in @mybase-dev/sdk/realtime)`);
+  console.log(`  publish     POST ${s.publishUrl}  (realtime:write key)`);
+  console.log(`  secret      ${s.secret}  (server-side only: MYBASE_REALTIME_SECRET)`);
+  console.log(`  public      ${s.publicChannels ? "on: public:\u2026 channels need no token" : "off: every connection needs a token"}`);
+  console.log(`  origins     ${s.allowedOrigins.length ? s.allowedOrigins.join(", ") : "any"}`);
+  console.log(`  webhook     ${s.webhookUrl ? `${s.webhookUrl} (${s.webhookEvents.join(", ") || "no events"})` : "none"}`);
+  console.log(`  limits      ${s.maxConnections} connections, ${s.maxChannels} channels each, ${s.maxMessageBytes} B frames, ${s.maxRate}/s`);
+}
+var list2 = (value) => value === "none" ? [] : value.split(",").map((v) => v.trim()).filter(Boolean);
+function onOff(value, name) {
+  if (value === undefined)
+    return;
+  if (value === "on" || value === "off")
+    return value === "on";
+  throw usageError(`--${name} takes on or off`);
+}
+async function realtime(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project, channel, event, data] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      const { linked } = await enableService(p, "realtime", flags);
+      const s = await api(base7(p));
+      print({ enabled: "realtime", project: p, linked, ...s }, () => {
+        console.log(`Realtime enabled for "${p}"
+`);
+        printSettings3(s);
+        printLinked(p, linked, flags);
+      });
+      return true;
+    }
+    case "info": {
+      const p = need(project, "project name");
+      const [s, stats] = await Promise.all([api(base7(p)), api(`${base7(p)}/stats`)]);
+      const { secret: _secret, ...settings } = s;
+      print({ ...settings, stats }, () => {
+        printSettings3({ ...s, secret: "(mybase realtime key)" });
+        const out = stats.hours.reduce((n, h) => n + h.messagesOut, 0);
+        console.log(`
+  now         ${stats.connections} connections (peak ${stats.peakConnections}), ${stats.channels} channels`);
+        console.log(`  24 hours    ${out} messages delivered`);
+        if (stats.webhook.lastError)
+          console.log(`  webhook     failing: ${stats.webhook.lastError} (${stats.webhook.queued} queued, ${stats.webhook.dropped} dropped)`);
+      });
+      return true;
+    }
+    case "key": {
+      const p = need(project, "project name");
+      if (flags.has("rotate"))
+        confirm(args.includes("--yes"), `Every open realtime connection on "${p}" closes, and tokens signed with the old secret stop working.`, p, "the project name");
+      const s = flags.has("rotate") ? await api(`${base7(p)}/secret/rotate`, { method: "POST" }) : await api(base7(p));
+      print({ secret: s.secret }, () => {
+        if (flags.has("rotate"))
+          console.log(`Rotated. Update MYBASE_REALTIME_SECRET where your server signs tokens.
+`);
+        console.log(s.secret);
+      });
+      return true;
+    }
+    case "settings": {
+      const p = need(project, "project name");
+      const body = {};
+      const origins = flagString(flags, "origins");
+      if (origins !== undefined)
+        body.allowedOrigins = list2(origins);
+      const pub = onOff(flagString(flags, "public"), "public");
+      if (pub !== undefined)
+        body.publicChannels = pub;
+      const webhook = flagString(flags, "webhook");
+      if (webhook !== undefined)
+        body.webhookUrl = webhook === "none" ? null : webhook;
+      const events = flagString(flags, "events");
+      if (events !== undefined)
+        body.webhookEvents = list2(events);
+      const ints = { maxConnections: "max-connections", maxChannels: "max-channels", maxMessageBytes: "max-message-bytes", maxRate: "max-rate" };
+      for (const [key, flag] of Object.entries(ints)) {
+        const n = flagInt(flags, flag);
+        if (n !== undefined)
+          body[key] = n;
+      }
+      const s = Object.keys(body).length ? await api(base7(p), { method: "PATCH", body: JSON.stringify(body) }) : await api(base7(p));
+      const { secret: _secret, ...shown } = s;
+      print(shown, () => printSettings3({ ...s, secret: "(mybase realtime key)" }));
+      return true;
+    }
+    case "channels": {
+      const p = need(project, "project name");
+      const prefix = flagString(flags, "prefix");
+      const { channels } = await api(`${base7(p)}/channels${prefix ? `?prefix=${encodeURIComponent(prefix)}` : ""}`);
+      print(channels, () => {
+        if (!channels.length)
+          return console.log("No channels have subscribers right now.");
+        for (const c of channels)
+          console.log(`${c.channel}  ${c.subscribers} subscribers${c.members === undefined ? "" : `, ${c.members} members`}`);
+      });
+      return true;
+    }
+    case "publish": {
+      const p = need(project, "project name");
+      let payload = null;
+      if (data !== undefined) {
+        try {
+          payload = JSON.parse(data);
+        } catch {
+          payload = data;
+        }
+      }
+      const { ids } = await api(`${base7(p)}/publish`, {
+        method: "POST",
+        body: JSON.stringify({ channel: need(channel, "channel"), event: need(event, "event"), data: payload })
+      });
+      print({ id: ids[0] }, () => console.log(`Published ${event} to ${channel}`));
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(args.includes("--yes"), `Every open realtime connection on "${p}" closes, and pages listening for updates stop getting them.`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/realtime`, { method: "DELETE" });
+      print({ disabled: "realtime", project: p }, () => console.log(`Realtime disabled for "${p}"`));
+      return true;
+    }
+  }
+  return false;
+}
+
 // src/run.ts
 import { constants } from "os";
 
@@ -2113,8 +2262,8 @@ async function target(flags, needEnv = true) {
   }
   return { project, env: env ?? "" };
 }
-var base7 = (project) => `/projects/${encodeURIComponent(project)}/secrets`;
-var envPath = (project, env, rest = "") => `${base7(project)}/envs/${encodeURIComponent(env)}${rest}`;
+var base8 = (project) => `/projects/${encodeURIComponent(project)}/secrets`;
+var envPath = (project, env, rest = "") => `${base8(project)}/envs/${encodeURIComponent(env)}${rest}`;
 var fetchSecrets = (project, env) => api(`/secrets/${encodeURIComponent(project)}/${encodeURIComponent(env)}`);
 var describeEnv = (e) => [e.name, e.parent ? `branch of ${e.parent}` : "root", `${e.keys} keys`, `rev ${e.revision}`, e.linked ? "linked" : ""].filter(Boolean).join("\t");
 async function readStdin() {
@@ -2133,7 +2282,7 @@ async function secrets(sub, args) {
     case "enable": {
       const p = need(positional[0] ?? flagString(flags, "project"), "project name");
       await api(`/projects/${encodeURIComponent(p)}/services/secrets`, { method: "PUT" });
-      const overview = await api(base7(p));
+      const overview = await api(base8(p));
       print({ enabled: "secrets", project: p, ...overview }, () => {
         console.log(`Secrets enabled for "${p}": ${overview.envs.map((e) => e.name).join(", ")}
 `);
@@ -2153,7 +2302,7 @@ async function secrets(sub, args) {
     }
     case "setup": {
       const { project, env } = await target(flags);
-      const overview = await api(base7(project));
+      const overview = await api(base8(project));
       if (!overview.envs.some((e) => e.name === env)) {
         throw usageError(`"${project}" has no env "${env}" (envs: ${overview.envs.map((e) => e.name).join(", ")})`);
       }
@@ -2163,7 +2312,7 @@ async function secrets(sub, args) {
     }
     case "envs": {
       const { project } = await target(flags, false);
-      const overview = await api(base7(project));
+      const overview = await api(base8(project));
       print(overview.envs, () => {
         for (const e of overview.envs)
           console.log(describeEnv(e));
@@ -2174,7 +2323,7 @@ async function secrets(sub, args) {
       const [action, name, next] = positional;
       const { project } = await target(flags, false);
       if (action === "create") {
-        const env = await api(`${base7(project)}/envs`, {
+        const env = await api(`${base8(project)}/envs`, {
           method: "POST",
           body: JSON.stringify({ name: need(name, "env name"), parent: flagString(flags, "from") ?? null })
         });
@@ -2277,7 +2426,7 @@ async function secrets(sub, args) {
       const { project, env } = await target(flags);
       const envs = env.split(",").map((e) => e.trim()).filter(Boolean);
       confirm(yes, `This rotates the credentials of "${project}" (database password, storage key, cache password if the cache is on, and the API key link made before) and stores the new ones, with the other services' keys, in ${envs.join(", ")} plus any env linked before. Apps still using the old credentials will stop working.`, project, "the project name");
-      const result = await api(`${base7(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
+      const result = await api(`${base8(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
       print(result, () => {
         console.log(`Rotated and stored in ${result.envs.join(", ")}: ${result.keys.join(", ")}`);
         console.log("Restart your apps with `mybase run` to pick them up.");
@@ -2287,7 +2436,7 @@ async function secrets(sub, args) {
     case "unlink": {
       const { project, env } = await target(flags);
       confirm(yes, `This removes the project credentials from "${env}". They stay valid; nothing is rotated.`, env, "the env name");
-      await api(`${base7(project)}/link/${encodeURIComponent(env)}`, { method: "DELETE" });
+      await api(`${base8(project)}/link/${encodeURIComponent(env)}`, { method: "DELETE" });
       print({ unlinked: env, project }, () => console.log(`Removed the credentials from "${env}"`));
       return true;
     }
@@ -2365,6 +2514,93 @@ async function search(sub, args) {
   }
 }
 
+// src/sandbox.ts
+var sandboxUsage = `  sandbox enable <project>       Enable isolated agent compute (requires sandbox worker)
+  sandbox disable <project> [--yes]  Stop sandboxes and delete their artifacts
+  sandbox create <project> --key <key> [--ttl 300] [--idle 120]
+  sandbox list|get|usage <project> [<id>]
+  sandbox terminate <project> <id> [--yes]
+  sandbox exec <project> <id> --key <key> [--code file.js | --command '["node","script.js"]'] [--timeout 30000]
+  sandbox runs|artifacts|browser <project> <id>
+  sandbox run <project> <id> <execution>
+  sandbox cancel <project> <id> <execution> [--yes]
+  sandbox upload|download <project> <id> <workspace-path> <local-file>
+  sandbox export <project> <id> <workspace-path> [--type image/png]
+  sandbox artifact <project> <id> <artifact-id> <local-file>
+  Creation/execution return promptly. Poll get/run. Cancelling execution terminates sandbox.
+  Browser credentials expire after 30s; authenticated CDP connection lasts at most 60s.`;
+async function sandbox(sub, args) {
+  const known = ["enable", "disable", "create", "list", "get", "usage", "terminate", "exec", "runs", "run", "cancel", "upload", "download", "export", "artifacts", "artifact", "browser"];
+  if (!known.includes(sub))
+    return false;
+  const { positional, flags } = parseArgs(args);
+  const [project, id, item, local] = positional;
+  const p = need(project, "project name");
+  const base = `/sandbox/${encodeURIComponent(p)}`;
+  const root = () => `${base}/${encodeURIComponent(need(id, "sandbox id"))}`;
+  const value = (key) => {
+    const found = flags.get(key);
+    return typeof found === "string" ? found : undefined;
+  };
+  const number = (key) => value(key) === undefined ? undefined : Number(value(key));
+  let result;
+  if (sub === "enable") {
+    result = await enableService(p, "sandbox", flags);
+  } else if (sub === "disable") {
+    confirm(flags.has("yes"), `This stops every sandbox and permanently deletes sandbox artifacts for "${p}".`, p, "the project name");
+    await api(`/projects/${encodeURIComponent(p)}/services/sandbox`, { method: "DELETE" });
+    result = { disabled: "sandbox", project: p };
+  } else if (sub === "create")
+    result = await api(base, { method: "POST", body: JSON.stringify({ key: need(value("key"), "--key"), ttlSeconds: number("ttl"), idleSeconds: number("idle"), profile: "browser" }) });
+  else if (sub === "list" || sub === "usage")
+    result = await api(sub === "list" ? base : `${base}/usage`);
+  else if (sub === "get")
+    result = await api(root());
+  else if (sub === "terminate") {
+    confirm(flags.has("yes"), `This stops sandbox "${need(id, "sandbox id")}" and deletes its temporary workspace.`, id, "the sandbox id");
+    result = await api(root(), { method: "DELETE" });
+  } else if (sub === "exec") {
+    const codePath = value("code");
+    const command = value("command");
+    if (!!codePath === !!command)
+      usageError(`provide exactly one of --code file.js or --command '["node","script.js"]'`);
+    let argv;
+    if (command) {
+      try {
+        argv = JSON.parse(command);
+      } catch {
+        usageError("--command must be a JSON argument array");
+      }
+    }
+    result = await api(`${root()}/executions`, { method: "POST", body: JSON.stringify({ key: need(value("key"), "--key"), code: codePath ? await Bun.file(codePath).text() : undefined, command: argv, timeoutMs: number("timeout") }) });
+  } else if (sub === "runs")
+    result = await api(`${root()}/executions`);
+  else if (sub === "run" || sub === "cancel") {
+    if (sub === "cancel")
+      confirm(flags.has("yes"), `Cancelling stops the entire sandbox "${need(id, "sandbox id")}" and deletes its temporary workspace.`, id, "the sandbox id");
+    result = await api(`${root()}/executions/${encodeURIComponent(need(item, "execution id"))}`, { method: sub === "run" ? "GET" : "DELETE" });
+  } else if (sub === "upload") {
+    const bytes = await Bun.file(need(local, "local file")).arrayBuffer();
+    await api(`${root()}/files?path=${encodeURIComponent(need(item, "workspace path"))}`, { method: "PUT", body: bytes, headers: { "Content-Type": "application/octet-stream" } });
+    result = { uploaded: item, bytes: bytes.byteLength };
+  } else if (sub === "download" || sub === "artifact") {
+    const path = sub === "download" ? `${root()}/files?path=${encodeURIComponent(need(item, "workspace path"))}` : `${root()}/artifacts/${encodeURIComponent(need(item, "artifact id"))}`;
+    const response = await api(path, { raw: true });
+    const size = await Bun.write(need(local, "local file"), response);
+    result = { file: local, bytes: size };
+  } else if (sub === "export")
+    result = await api(`${root()}/artifacts`, { method: "POST", body: JSON.stringify({ path: need(item, "workspace path"), type: value("type") }) });
+  else if (sub === "artifacts")
+    result = await api(`${root()}/artifacts`);
+  else if (sub === "browser") {
+    const connection = await api(`${root()}/browser`, { method: "POST", body: "{}" });
+    connection.headers.Authorization = `Bearer ${apiToken()}`;
+    result = connection;
+  }
+  print(result, () => console.log(JSON.stringify(result, null, 2)));
+  return true;
+}
+
 // ../../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
 import { styleText } from "util";
 import { stdout, stdin } from "process";
@@ -3755,6 +3991,9 @@ var SERVICE_COLORS = {
   alerts: color.red,
   users: color.green,
   captcha: color.blue,
+  realtime: color.magenta,
+  sandbox: color.yellow,
+  "sandbox-worker": color.yellow,
   "db-public": color.cyan,
   dev: color.gray
 };
@@ -3940,6 +4179,8 @@ services:
       # 1 for one restart turns the admin's 2FA off (lost phone and recovery codes).
       MYBASE_ADMIN_RESET_MFA: \${MYBASE_ADMIN_RESET_MFA:-}
       LOG_LEVEL: \${LOG_LEVEL:-info}
+      MYBASE_SANDBOX_WORKER_URL: \${MYBASE_SANDBOX_WORKER_URL:-}
+      MYBASE_SANDBOX_WORKER_KEY: \${MYBASE_SANDBOX_WORKER_KEY:-}
     ports:
       - "\${MYBASE_BIND:-0.0.0.0}:\${MYBASE_PORT:-4000}:4000"
 
@@ -4017,6 +4258,27 @@ services:
       - source: searxng
         target: /etc/searxng/settings.yml
 
+  # Opt-in trusted agent host. Requires runsc/cgroup v2 on the Docker host and a pre-pulled
+  # sandbox image. See docs/sandboxes.md. No guest ever receives this socket or worker key.
+  sandbox-worker:
+    image: \${MYBASE_SANDBOX_WORKER_IMAGE:-ghcr.io/landonharter/mybase-sandbox-worker:latest}
+    profiles: [sandbox]
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    stop_grace_period: 45s
+    environment:
+      MYBASE_SANDBOX_WORKER_KEY: \${MYBASE_SANDBOX_WORKER_KEY:-}
+      MYBASE_SANDBOX_DENY_HOSTS: \${MYBASE_SANDBOX_DENY_HOSTS:-}
+      MYBASE_SANDBOX_IMAGE: \${MYBASE_SANDBOX_IMAGE:-ghcr.io/landonharter/mybase-sandbox:latest}
+      LOG_LEVEL: \${LOG_LEVEL:-info}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4010/health',{headers:{Authorization:'Bearer '+process.env.MYBASE_SANDBOX_WORKER_KEY}}).then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 30s
+    # Private Compose network only. No published worker or browser-debugging ports.
+
   # Cloudflare Tunnel: public HTTPS without opening router ports. Off unless COMPOSE_PROFILES=tunnel.
   # Hostnames are set up in the Cloudflare dashboard (see the top of this file).
   cloudflared:
@@ -5682,7 +5944,7 @@ var usersUsage = `  users enable <project>         Turn on users: an auth schema
   users revoke <project> <user-id> [<session-id>]  Sign a user out (one session, or everywhere)
   users delete <project> <user-id> [--yes]  Delete a user and their sessions
   users disable <project> [--yes]  Turn it off, deleting every user account`;
-var base8 = (project) => `/projects/${encodeURIComponent(project)}/users`;
+var base9 = (project) => `/projects/${encodeURIComponent(project)}/users`;
 function authSnippet(project, apiUrl) {
   return `// auth.ts: npm i better-auth pg @mybase-dev/sdk
 import { betterAuth } from "better-auth";
@@ -5713,7 +5975,7 @@ async function users(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "users", flags);
-      const o = await api(base8(p));
+      const o = await api(base9(p));
       print({ enabled: "users", project: p, linked, ...o }, () => {
         console.log(`Users enabled for "${p}". Better Auth's tables go in the "${o.schema}" schema.
 `);
@@ -5727,7 +5989,7 @@ async function users(sub, args) {
     }
     case "init": {
       const p = need(project, "project name");
-      const o = await api(base8(p));
+      const o = await api(base9(p));
       const env = flagString(flags, "env");
       let stored = null;
       if (env) {
@@ -5750,7 +6012,7 @@ Set BETTER_AUTH_SECRET to 32+ random bytes (openssl rand -base64 32), or rerun w
     case "list": {
       const p = need(project, "project name");
       const search = flagString(flags, "search");
-      const list = await api(`${base8(p)}/accounts?limit=100${search ? `&search=${encodeURIComponent(search)}` : ""}`);
+      const list = await api(`${base9(p)}/accounts?limit=100${search ? `&search=${encodeURIComponent(search)}` : ""}`);
       print(list, () => {
         if (list.users.length === 0)
           console.log(search ? "No users match." : "No users yet.");
@@ -5763,7 +6025,7 @@ Set BETTER_AUTH_SECRET to 32+ random bytes (openssl rand -base64 32), or rerun w
     }
     case "show": {
       const p = need(project, "project name");
-      const u = await api(`${base8(p)}/accounts/${encodeURIComponent(need(userId, "user id"))}`);
+      const u = await api(`${base9(p)}/accounts/${encodeURIComponent(need(userId, "user id"))}`);
       print(u, () => {
         console.log(`${u.email ?? u.id}${u.name ? ` (${u.name})` : ""}${u.banned ? "  BANNED" : ""}`);
         console.log(`  id          ${u.id}`);
@@ -5781,10 +6043,10 @@ Active sessions (${u.sessions.length}):`);
       const p = need(project, "project name");
       const id = encodeURIComponent(need(userId, "user id"));
       if (sessionId) {
-        await api(`${base8(p)}/accounts/${id}/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
+        await api(`${base9(p)}/accounts/${id}/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
         print({ revoked: 1 }, () => console.log("Signed out that session."));
       } else {
-        const r = await api(`${base8(p)}/accounts/${id}/sessions`, { method: "DELETE" });
+        const r = await api(`${base9(p)}/accounts/${id}/sessions`, { method: "DELETE" });
         print(r, () => console.log(`Signed out ${r.revoked} session(s).`));
       }
       return true;
@@ -5793,7 +6055,7 @@ Active sessions (${u.sessions.length}):`);
       const p = need(project, "project name");
       const id = need(userId, "user id");
       confirm(args.includes("--yes"), `This deletes user ${id} of "${p}" and signs them out.`, id, "the user id");
-      await api(`${base8(p)}/accounts/${encodeURIComponent(id)}`, { method: "DELETE" });
+      await api(`${base9(p)}/accounts/${encodeURIComponent(id)}`, { method: "DELETE" });
       print({ deleted: id }, () => console.log(`Deleted user ${id}`));
       return true;
     }
@@ -5831,10 +6093,12 @@ var USAGE = {
   ratelimit: ratelimitUsage,
   queue: queueUsage,
   search: searchUsage,
+  sandbox: sandboxUsage,
   secrets: secretsUsage,
   vector: vectorUsage,
   users: usersUsage,
   captcha: captchaUsage,
+  realtime: realtimeUsage,
   run: runUsage
 };
 var GLOBAL_FLAGS = `  --json                         Print results as JSON (errors too, on stderr)
@@ -5877,6 +6141,8 @@ async function main(args) {
     return audit(args.slice(1));
   if (command === "alerts")
     return alerts(args.slice(1));
+  if (command === "sandbox" && sub && await sandbox(sub, rest))
+    return;
   if (command === "project" && sub === "create") {
     const name = need(rest[0], "project name");
     const project = await api("/projects", {
@@ -5967,6 +6233,10 @@ async function main(args) {
     if (await captcha(sub, rest))
       return;
   }
+  if (command === "realtime" && sub) {
+    if (await realtime(sub, rest))
+      return;
+  }
   if (command && command !== "help")
     throw usageError(`unknown command: mybase ${args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" ")}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybase-dev/cli",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   "type": "module",
   "repository": {