@hot-updater/server 1.0.0-rc.18 → 1.0.0-rc.21

package/dist/db/types.d.mts

@@ -1,78 +0,0 @@
-import { SchemaSettings } from "../database/fence.mjs";
-import { ResolvedSchema } from "../database/resolveSchema.mjs";
-import { EngineDatabase } from "@hot-updater/plugin-core";
-//#region src/db/types.d.ts
-declare const sqlProviders: readonly ["sqlite", "mysql", "postgresql"];
-declare const providers: readonly ["sqlite", "mysql", "postgresql", "mongodb"];
-type ORMProvider = (typeof providers)[number];
-type ORMSQLProvider = (typeof sqlProviders)[number];
-interface MigrateOptions {
-  mode?: "from-schema" | "from-database";
-  updateSettings?: boolean;
-  unsafe?: boolean;
-}
-type MigrationOperation = {
-  type: "create-table";
-  value: {
-    ormName: string;
-    columns: Record<string, {
-      ormName: string;
-      type: string;
-    }>;
-  };
-} | {
-  type: "custom";
-  description: string;
-} | {
-  type: "custom";
-  sql: string;
-} | {
-  type: "custom";
-  key: string;
-  value: unknown;
-};
-interface MigrationResult {
-  operations: MigrationOperation[];
-  execute: () => Promise<void>;
-  getSQL?: () => string;
-}
-interface Migrator {
-  getVersion: () => Promise<string | undefined>;
-  getNameVariants: () => Promise<unknown>;
-  next: () => Promise<{
-    version: string;
-  } | undefined>;
-  previous: () => Promise<{
-    version: string;
-  } | undefined>;
-  up: (options?: MigrateOptions) => Promise<MigrationResult>;
-  down: (options?: MigrateOptions) => Promise<MigrationResult>;
-  migrateTo: (version: string, options?: MigrateOptions) => Promise<MigrationResult>;
-  migrateToLatest: (options?: MigrateOptions) => Promise<MigrationResult>;
-}
-/**
- * The tables `db migrate` and `db generate` create and the settings rows they
- * write: core's, and those of each plugin the server runs.
- */
-interface ToolingTarget {
-  readonly schema: ResolvedSchema;
-  readonly settings: SchemaSettings;
-}
-type SchemaGenerator = (version: string | "latest", name?: string, target?: ToolingTarget) => {
-  code: string;
-  path: string;
-};
-/**
- * What `hot-updater db generate` and `db migrate` run for a provider's
- * database, beside the database itself. Without a target they cover core's
- * tables.
- */
-interface DatabaseTooling {
-  readonly provider?: ORMProvider;
-  readonly createMigrator?: (target?: ToolingTarget) => Migrator;
-  readonly generateSchema?: SchemaGenerator;
-}
-/** A provider's database on the storage engine, with its tooling. */
-type ToolingDatabase = EngineDatabase & DatabaseTooling;
-//#endregion
-export { DatabaseTooling, MigrateOptions, MigrationOperation, MigrationResult, Migrator, ORMProvider, ORMSQLProvider, SchemaGenerator, ToolingDatabase, ToolingTarget, providers, sqlProviders };

package/dist/db/types.mjs

@@ -1,10 +0,0 @@
-//#region src/db/types.ts
-const sqlProviders = [
-	"sqlite",
-	"mysql",
-	"postgresql"
-];
-const noSqlProviders = ["mongodb"];
-[...sqlProviders, ...noSqlProviders];
-//#endregion
-export { noSqlProviders, sqlProviders };

package/dist/diff.cjs

@@ -1,3 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createBundleDiff = require("./db/createBundleDiff.cjs");
-exports.createBundleDiff = require_createBundleDiff.createBundleDiff;

package/dist/diff.d.cts

@@ -1,2 +0,0 @@
-import { CreateBundleDiffDependencies, CreateBundleDiffInput, CreateBundleDiffOptions, createBundleDiff } from "./db/createBundleDiff.cjs";
-export { CreateBundleDiffDependencies, CreateBundleDiffInput, CreateBundleDiffOptions, createBundleDiff };

package/dist/diff.d.mts

@@ -1,2 +0,0 @@
-import { CreateBundleDiffDependencies, CreateBundleDiffInput, CreateBundleDiffOptions, createBundleDiff } from "./db/createBundleDiff.mjs";
-export { CreateBundleDiffDependencies, CreateBundleDiffInput, CreateBundleDiffOptions, createBundleDiff };

package/dist/diff.mjs

@@ -1,2 +0,0 @@
-import { createBundleDiff } from "./db/createBundleDiff.mjs";
-export { createBundleDiff };

package/dist/plugins/api-keys/apiKeys.cjs

@@ -1,139 +0,0 @@
-//#region src/plugins/api-keys/apiKeys.ts
-const API_KEY_HEADER_NAME = "x-api-key";
-const BASE64URL_32_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-const bytesToBase64Url = (bytes) => {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-const isApiKey = (value) => {
-	if (!BASE64URL_32_PATTERN.test(value)) return false;
-	try {
-		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
-		const binary = atob(`${base64}=`);
-		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-		return bytes.byteLength === 32 && bytesToBase64Url(bytes) === value;
-	} catch {
-		return false;
-	}
-};
-const normalizeApiKeyHeaderName = (value = API_KEY_HEADER_NAME) => {
-	if (typeof value !== "string" || value.length === 0) throw new TypeError("apiKeys({ headerName }) must name a valid header.");
-	try {
-		const headers = new Headers();
-		headers.set(value, "");
-		return headers.keys().next().value;
-	} catch {
-		throw new TypeError("apiKeys({ headerName }) must name a valid header.");
-	}
-};
-const hashApiKey = async (apiKey) => {
-	if (!isApiKey(apiKey)) throw new TypeError("API key must be a canonical 32-byte base64url value.");
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(apiKey));
-	return bytesToBase64Url(new Uint8Array(digest));
-};
-const apiKeyId = () => {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return `api-${bytesToBase64Url(bytes)}`;
-};
-const normalizeApiKeyName = (name) => {
-	const normalized = name.trim();
-	if (normalized.length === 0 || normalized.length > 64 || /[\p{Cc}\p{Cf}]/u.test(normalized)) throw new TypeError("API key names must contain 1-64 visible characters.");
-	return normalized;
-};
-const toApiKeyMetadata = ({ hash: _hash, ...metadata }) => Object.freeze(metadata);
-const registerApiKey = async (input) => {
-	const hash = await hashApiKey(input.apiKey);
-	const createdAtMs = input.createdAtMs ?? Date.now();
-	if (!Number.isSafeInteger(createdAtMs) || createdAtMs < 0) throw new TypeError("API key creation time must be non-negative.");
-	const record = Object.freeze({
-		created_at_ms: createdAtMs,
-		hash,
-		id: apiKeyId(),
-		name: normalizeApiKeyName(input.name),
-		prefix: input.apiKey.slice(0, 6),
-		revoked_at_ms: null,
-		role: "client"
-	});
-	if (await input.apiKeys.create(record) === "existing") {
-		const existing = await input.apiKeys.findByHash(hash);
-		if (existing === null || existing.revoked_at_ms !== null) throw new Error("The API key has been revoked.");
-		return Object.freeze({
-			apiKey: input.apiKey,
-			record: toApiKeyMetadata(existing)
-		});
-	}
-	return Object.freeze({
-		apiKey: input.apiKey,
-		record: toApiKeyMetadata(record)
-	});
-};
-const createApiKey = (input) => {
-	const bytes = /* @__PURE__ */ new Uint8Array(32);
-	crypto.getRandomValues(bytes);
-	return registerApiKey({
-		apiKey: bytesToBase64Url(bytes),
-		apiKeys: input.apiKeys,
-		name: input.name
-	});
-};
-/**
-* Provisions the client API key used by managed init.
-*
-* A saved plaintext key is registered idempotently; otherwise a new key is
-* created. Callers must persist or display the returned plaintext because the
-* database stores only its hash.
-*/
-const provisionApiKey = (input) => {
-	const existingApiKey = input.existingApiKey?.trim();
-	return existingApiKey ? registerApiKey({
-		apiKey: existingApiKey,
-		apiKeys: input.apiKeys,
-		name: input.name
-	}) : createApiKey({
-		apiKeys: input.apiKeys,
-		name: input.name
-	});
-};
-const authenticateApiKey = async (input) => {
-	const apiKey = input.request.headers.get(normalizeApiKeyHeaderName(input.headerName));
-	if (apiKey === null || !isApiKey(apiKey)) return false;
-	const hash = await hashApiKey(apiKey);
-	const record = await input.apiKeys.findByHash(hash);
-	return record !== null && record.hash === hash && record.role === "client" && record.revoked_at_ms === null;
-};
-const createApiKeyManagement = (input) => Object.freeze({
-	async create({ name }) {
-		const created = await createApiKey({
-			apiKeys: input.apiKeys,
-			name
-		});
-		return Object.freeze({
-			apiKey: created.apiKey,
-			record: created.record
-		});
-	},
-	async list() {
-		return Object.freeze((await input.apiKeys.list()).map(toApiKeyMetadata));
-	},
-	async revoke({ id }) {
-		const record = await input.apiKeys.revoke({
-			id,
-			revokedAtMs: Date.now()
-		});
-		return record === null ? null : toApiKeyMetadata(record);
-	}
-});
-//#endregion
-exports.API_KEY_HEADER_NAME = API_KEY_HEADER_NAME;
-exports.apiKeyId = apiKeyId;
-exports.authenticateApiKey = authenticateApiKey;
-exports.createApiKey = createApiKey;
-exports.createApiKeyManagement = createApiKeyManagement;
-exports.hashApiKey = hashApiKey;
-exports.isApiKey = isApiKey;
-exports.normalizeApiKeyHeaderName = normalizeApiKeyHeaderName;
-exports.normalizeApiKeyName = normalizeApiKeyName;
-exports.provisionApiKey = provisionApiKey;
-exports.registerApiKey = registerApiKey;

package/dist/plugins/api-keys/apiKeys.d.cts

@@ -1,27 +0,0 @@
-import { ApiKeyRow } from "./model.cjs";
-//#region src/plugins/api-keys/apiKeys.d.ts
-declare const API_KEY_HEADER_NAME = "x-api-key";
-type ApiKeyMetadata = Omit<ApiKeyRow, "hash">;
-interface CreatedApiKey {
-  /** Plaintext credential. It cannot be recovered after this call returns. */
-  readonly apiKey: string;
-  /** Non-secret metadata. The persisted SHA-256 hash is never exposed. */
-  readonly record: ApiKeyMetadata;
-}
-interface ApiKeyManagementAPI {
-  /** Creates an API key and returns its plaintext exactly once. */
-  create(input: {
-    readonly name: string;
-  }): Promise<{
-    readonly apiKey: string;
-    readonly record: ApiKeyMetadata;
-  }>;
-  /** Lists non-secret API key metadata, including revoked keys. */
-  list(): Promise<readonly ApiKeyMetadata[]>;
-  /** Revokes an API key immediately and returns only non-secret metadata. */
-  revoke(input: {
-    readonly id: string;
-  }): Promise<ApiKeyMetadata | null>;
-}
-//#endregion
-export { API_KEY_HEADER_NAME, ApiKeyManagementAPI, ApiKeyMetadata, CreatedApiKey };

package/dist/plugins/api-keys/apiKeys.d.mts

@@ -1,27 +0,0 @@
-import { ApiKeyRow } from "./model.mjs";
-//#region src/plugins/api-keys/apiKeys.d.ts
-declare const API_KEY_HEADER_NAME = "x-api-key";
-type ApiKeyMetadata = Omit<ApiKeyRow, "hash">;
-interface CreatedApiKey {
-  /** Plaintext credential. It cannot be recovered after this call returns. */
-  readonly apiKey: string;
-  /** Non-secret metadata. The persisted SHA-256 hash is never exposed. */
-  readonly record: ApiKeyMetadata;
-}
-interface ApiKeyManagementAPI {
-  /** Creates an API key and returns its plaintext exactly once. */
-  create(input: {
-    readonly name: string;
-  }): Promise<{
-    readonly apiKey: string;
-    readonly record: ApiKeyMetadata;
-  }>;
-  /** Lists non-secret API key metadata, including revoked keys. */
-  list(): Promise<readonly ApiKeyMetadata[]>;
-  /** Revokes an API key immediately and returns only non-secret metadata. */
-  revoke(input: {
-    readonly id: string;
-  }): Promise<ApiKeyMetadata | null>;
-}
-//#endregion
-export { API_KEY_HEADER_NAME, ApiKeyManagementAPI, ApiKeyMetadata, CreatedApiKey };

package/dist/plugins/api-keys/apiKeys.mjs

@@ -1,129 +0,0 @@
-//#region src/plugins/api-keys/apiKeys.ts
-const API_KEY_HEADER_NAME = "x-api-key";
-const BASE64URL_32_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-const bytesToBase64Url = (bytes) => {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-const isApiKey = (value) => {
-	if (!BASE64URL_32_PATTERN.test(value)) return false;
-	try {
-		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
-		const binary = atob(`${base64}=`);
-		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-		return bytes.byteLength === 32 && bytesToBase64Url(bytes) === value;
-	} catch {
-		return false;
-	}
-};
-const normalizeApiKeyHeaderName = (value = API_KEY_HEADER_NAME) => {
-	if (typeof value !== "string" || value.length === 0) throw new TypeError("apiKeys({ headerName }) must name a valid header.");
-	try {
-		const headers = new Headers();
-		headers.set(value, "");
-		return headers.keys().next().value;
-	} catch {
-		throw new TypeError("apiKeys({ headerName }) must name a valid header.");
-	}
-};
-const hashApiKey = async (apiKey) => {
-	if (!isApiKey(apiKey)) throw new TypeError("API key must be a canonical 32-byte base64url value.");
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(apiKey));
-	return bytesToBase64Url(new Uint8Array(digest));
-};
-const apiKeyId = () => {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return `api-${bytesToBase64Url(bytes)}`;
-};
-const normalizeApiKeyName = (name) => {
-	const normalized = name.trim();
-	if (normalized.length === 0 || normalized.length > 64 || /[\p{Cc}\p{Cf}]/u.test(normalized)) throw new TypeError("API key names must contain 1-64 visible characters.");
-	return normalized;
-};
-const toApiKeyMetadata = ({ hash: _hash, ...metadata }) => Object.freeze(metadata);
-const registerApiKey = async (input) => {
-	const hash = await hashApiKey(input.apiKey);
-	const createdAtMs = input.createdAtMs ?? Date.now();
-	if (!Number.isSafeInteger(createdAtMs) || createdAtMs < 0) throw new TypeError("API key creation time must be non-negative.");
-	const record = Object.freeze({
-		created_at_ms: createdAtMs,
-		hash,
-		id: apiKeyId(),
-		name: normalizeApiKeyName(input.name),
-		prefix: input.apiKey.slice(0, 6),
-		revoked_at_ms: null,
-		role: "client"
-	});
-	if (await input.apiKeys.create(record) === "existing") {
-		const existing = await input.apiKeys.findByHash(hash);
-		if (existing === null || existing.revoked_at_ms !== null) throw new Error("The API key has been revoked.");
-		return Object.freeze({
-			apiKey: input.apiKey,
-			record: toApiKeyMetadata(existing)
-		});
-	}
-	return Object.freeze({
-		apiKey: input.apiKey,
-		record: toApiKeyMetadata(record)
-	});
-};
-const createApiKey = (input) => {
-	const bytes = /* @__PURE__ */ new Uint8Array(32);
-	crypto.getRandomValues(bytes);
-	return registerApiKey({
-		apiKey: bytesToBase64Url(bytes),
-		apiKeys: input.apiKeys,
-		name: input.name
-	});
-};
-/**
-* Provisions the client API key used by managed init.
-*
-* A saved plaintext key is registered idempotently; otherwise a new key is
-* created. Callers must persist or display the returned plaintext because the
-* database stores only its hash.
-*/
-const provisionApiKey = (input) => {
-	const existingApiKey = input.existingApiKey?.trim();
-	return existingApiKey ? registerApiKey({
-		apiKey: existingApiKey,
-		apiKeys: input.apiKeys,
-		name: input.name
-	}) : createApiKey({
-		apiKeys: input.apiKeys,
-		name: input.name
-	});
-};
-const authenticateApiKey = async (input) => {
-	const apiKey = input.request.headers.get(normalizeApiKeyHeaderName(input.headerName));
-	if (apiKey === null || !isApiKey(apiKey)) return false;
-	const hash = await hashApiKey(apiKey);
-	const record = await input.apiKeys.findByHash(hash);
-	return record !== null && record.hash === hash && record.role === "client" && record.revoked_at_ms === null;
-};
-const createApiKeyManagement = (input) => Object.freeze({
-	async create({ name }) {
-		const created = await createApiKey({
-			apiKeys: input.apiKeys,
-			name
-		});
-		return Object.freeze({
-			apiKey: created.apiKey,
-			record: created.record
-		});
-	},
-	async list() {
-		return Object.freeze((await input.apiKeys.list()).map(toApiKeyMetadata));
-	},
-	async revoke({ id }) {
-		const record = await input.apiKeys.revoke({
-			id,
-			revokedAtMs: Date.now()
-		});
-		return record === null ? null : toApiKeyMetadata(record);
-	}
-});
-//#endregion
-export { API_KEY_HEADER_NAME, apiKeyId, authenticateApiKey, createApiKey, createApiKeyManagement, hashApiKey, isApiKey, normalizeApiKeyHeaderName, normalizeApiKeyName, provisionApiKey, registerApiKey };

package/dist/plugins/api-keys/cli.cjs

@@ -1,115 +0,0 @@
-//#region src/plugins/api-keys/cli.ts
-/** The environment variable init stores the app's API key in. */
-const API_KEY_ENV = "HOT_UPDATER_API_KEY";
-/** A new API key: 32 random bytes, base64url, as the plugin creates them. */
-const generateApiKey = () => {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-	return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-const formatList = (ui, records) => records.length === 0 ? ui.muted("(no API keys)") : ui.table([
-	{
-		key: "id",
-		label: "ID",
-		format: ui.id
-	},
-	{
-		key: "name",
-		label: "Name"
-	},
-	{
-		key: "prefix",
-		label: "Prefix",
-		format: ui.muted
-	},
-	{
-		key: "status",
-		label: "Status",
-		format: (value) => value.trim() === "active" ? ui.success(value) : ui.danger(value)
-	},
-	{
-		key: "created",
-		label: "Created",
-		format: ui.muted
-	}
-], records.map((record) => ({
-	created: new Date(record.created_at_ms).toISOString(),
-	id: record.id,
-	name: record.name,
-	prefix: record.prefix,
-	status: record.revoked_at_ms === null ? "active" : "revoked"
-})));
-/**
-* `hot-updater api-key create|list|revoke`, and the API key that init
-* provisions for an app, sent in `headerName`.
-*/
-const apiKeysCli = (headerName) => ({
-	commands: [{
-		name: "api-key",
-		description: "Manage API keys",
-		commands: [
-			{
-				name: "create",
-				description: "Create an API key",
-				options: [{
-					flags: "--name <name>",
-					description: "name used to identify the API key",
-					required: true
-				}],
-				async run({ api, options, ui }) {
-					const created = await api.create({ name: String(options.name) });
-					ui.message(ui.block("API key created", [
-						ui.kv("Name", created.record.name),
-						ui.kv("ID", ui.id(created.record.id)),
-						ui.kv("API key", ui.warning(created.apiKey))
-					]));
-					ui.warn("Save this API key now. It will not be shown again.");
-				}
-			},
-			{
-				name: "list",
-				description: "List API keys",
-				options: [{
-					flags: "--json",
-					description: "output API key metadata as JSON"
-				}],
-				async run({ api, options, ui }) {
-					const records = [...await api.list()].sort((left, right) => right.created_at_ms - left.created_at_ms);
-					if (options.json) ui.print(JSON.stringify(records, null, 2));
-					else ui.message(formatList(ui, records));
-				}
-			},
-			{
-				name: "revoke",
-				description: "Revoke an API key",
-				arguments: [{
-					name: "id",
-					description: "API key id"
-				}],
-				options: [{
-					flags: "-y, --yes",
-					description: "skip confirmation prompt"
-				}],
-				async run({ api, args, options, ui }) {
-					const id = String(args.id);
-					if (!options.yes) await ui.confirm(`Revoke API key ${id}?`);
-					const revoked = await api.revoke({ id });
-					if (revoked === null) throw new Error(`API key "${id}" was not found.`);
-					ui.message(ui.block("API key revoked", [ui.kv("Name", revoked.name), ui.kv("ID", ui.id(revoked.id))]));
-				}
-			}
-		]
-	}],
-	clientCredential: {
-		label: "API key",
-		header: headerName,
-		env: API_KEY_ENV,
-		generate: generateApiKey,
-		provision: async (api, { existing, name }) => (await api.provision({
-			...existing === void 0 ? {} : { existingApiKey: existing },
-			name
-		})).apiKey
-	}
-});
-//#endregion
-exports.API_KEY_ENV = API_KEY_ENV;
-exports.apiKeysCli = apiKeysCli;

package/dist/plugins/api-keys/cli.mjs

@@ -1,114 +0,0 @@
-//#region src/plugins/api-keys/cli.ts
-/** The environment variable init stores the app's API key in. */
-const API_KEY_ENV = "HOT_UPDATER_API_KEY";
-/** A new API key: 32 random bytes, base64url, as the plugin creates them. */
-const generateApiKey = () => {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-	return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-const formatList = (ui, records) => records.length === 0 ? ui.muted("(no API keys)") : ui.table([
-	{
-		key: "id",
-		label: "ID",
-		format: ui.id
-	},
-	{
-		key: "name",
-		label: "Name"
-	},
-	{
-		key: "prefix",
-		label: "Prefix",
-		format: ui.muted
-	},
-	{
-		key: "status",
-		label: "Status",
-		format: (value) => value.trim() === "active" ? ui.success(value) : ui.danger(value)
-	},
-	{
-		key: "created",
-		label: "Created",
-		format: ui.muted
-	}
-], records.map((record) => ({
-	created: new Date(record.created_at_ms).toISOString(),
-	id: record.id,
-	name: record.name,
-	prefix: record.prefix,
-	status: record.revoked_at_ms === null ? "active" : "revoked"
-})));
-/**
-* `hot-updater api-key create|list|revoke`, and the API key that init
-* provisions for an app, sent in `headerName`.
-*/
-const apiKeysCli = (headerName) => ({
-	commands: [{
-		name: "api-key",
-		description: "Manage API keys",
-		commands: [
-			{
-				name: "create",
-				description: "Create an API key",
-				options: [{
-					flags: "--name <name>",
-					description: "name used to identify the API key",
-					required: true
-				}],
-				async run({ api, options, ui }) {
-					const created = await api.create({ name: String(options.name) });
-					ui.message(ui.block("API key created", [
-						ui.kv("Name", created.record.name),
-						ui.kv("ID", ui.id(created.record.id)),
-						ui.kv("API key", ui.warning(created.apiKey))
-					]));
-					ui.warn("Save this API key now. It will not be shown again.");
-				}
-			},
-			{
-				name: "list",
-				description: "List API keys",
-				options: [{
-					flags: "--json",
-					description: "output API key metadata as JSON"
-				}],
-				async run({ api, options, ui }) {
-					const records = [...await api.list()].sort((left, right) => right.created_at_ms - left.created_at_ms);
-					if (options.json) ui.print(JSON.stringify(records, null, 2));
-					else ui.message(formatList(ui, records));
-				}
-			},
-			{
-				name: "revoke",
-				description: "Revoke an API key",
-				arguments: [{
-					name: "id",
-					description: "API key id"
-				}],
-				options: [{
-					flags: "-y, --yes",
-					description: "skip confirmation prompt"
-				}],
-				async run({ api, args, options, ui }) {
-					const id = String(args.id);
-					if (!options.yes) await ui.confirm(`Revoke API key ${id}?`);
-					const revoked = await api.revoke({ id });
-					if (revoked === null) throw new Error(`API key "${id}" was not found.`);
-					ui.message(ui.block("API key revoked", [ui.kv("Name", revoked.name), ui.kv("ID", ui.id(revoked.id))]));
-				}
-			}
-		]
-	}],
-	clientCredential: {
-		label: "API key",
-		header: headerName,
-		env: API_KEY_ENV,
-		generate: generateApiKey,
-		provision: async (api, { existing, name }) => (await api.provision({
-			...existing === void 0 ? {} : { existingApiKey: existing },
-			name
-		})).apiKey
-	}
-});
-//#endregion
-export { API_KEY_ENV, apiKeysCli };