@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/api-keys-Bl1I9q7M.js

@@ -0,0 +1,525 @@
+import { d as readEnvFile, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
+import { n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-BnmsEXvu.js";
+import { t as unknownCommand } from "./unknown-command-DNwDcX3w.js";
+import { t as cliUserAgent } from "./version-Buyyo1ut.js";
+import { r as serverUnreachableHint } from "./dev-server-DG8Tt-uf.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { ADMIN_SCOPES, DATA_PLANE_SCOPES, KEY_MANAGEMENT_SCOPES, parseScope } from "@rebasepro/types";
+import { RebaseApiError, createRebaseClient } from "@rebasepro/client";
+//#region src/commands/api-keys.ts
+/**
+* CLI command: rebase api-keys <action>
+*
+* The project's service keys, through `/api/admin/api-keys`, authenticated with
+* the service key from `.env`.
+*
+* Subcommands:
+*   list    — List the service keys (masked): kind, scopes, roles
+*   get     — Show one key
+*   create  — Create a service key holding the scopes named on the line
+*   revoke  — Revoke a key
+*   scopes  — List the scopes this backend knows, and which the caller holds
+*/
+/** Everything the switch below dispatches, for the did-you-mean. */
+var API_KEYS_SUBCOMMANDS = [
+	"list",
+	"get",
+	"create",
+	"revoke",
+	"scopes"
+];
+/**
+* Was a hand-rolled `indexOf("=")` loop. It keyed `export KEY=value` as
+* `export KEY` and carried a trailing `# comment` into the value — so a key
+* that was present read as absent, or reached an `Authorization` header with a
+* comment attached and came back 401. See `readEnvFile`.
+*/
+var loadEnv = readEnvFile;
+/** The running backend's URL. Shared with `rebase storage`. */
+function resolveBaseUrl(env, projectRoot) {
+	if (env.REBASE_BASE_URL) return env.REBASE_BASE_URL;
+	if (projectRoot) try {
+		const urlFile = path.join(projectRoot, ".rebase-dev-url");
+		if (fs.existsSync(urlFile)) {
+			const devUrl = fs.readFileSync(urlFile, "utf-8").trim();
+			if (devUrl) return devUrl;
+		}
+	} catch {}
+	return `http://localhost:${env.PORT || env.REBASE_PORT || "3001"}`;
+}
+/**
+* An SDK client for this project's backend, holding the service key.
+*
+* The service key is the project's own machine identity — the `admin` role,
+* every scope — so it is what may list, mint and revoke service keys. It is a
+* static bearer token: no session to restore or refresh, and no socket.
+*/
+function connect() {
+	const projectRoot = requireProjectRoot();
+	const env = loadEnv(projectRoot);
+	const baseUrl = resolveBaseUrl(env, projectRoot);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required to manage API keys."));
+		process.exit(1);
+	}
+	return {
+		client: createRebaseClient({
+			baseUrl,
+			token: serviceKey,
+			realtime: false,
+			headers: { "User-Agent": cliUserAgent() },
+			auth: {
+				persistSession: false,
+				autoRefresh: false
+			}
+		}),
+		baseUrl
+	};
+}
+/**
+* What to print when a request fails: the server's error code and message,
+* which is what says why — `SCOPE_EXCEEDS_CREATOR`, `INVALID_SCOPES`,
+* `ROLE_EXCEEDS_CREATOR`, `KEY_MANAGEMENT_SCOPE` — and a hint where one helps.
+*
+* Exported so its tests can read the lines without a server.
+*/
+function describeFailure(action, error, baseUrl) {
+	if (!(error instanceof RebaseApiError)) return [`✗ ${action}: ${error instanceof Error ? error.message : String(error)}`];
+	if (error.status === 0 || error.code === "NETWORK_ERROR") return [`✗ ${action}: ${error.message}`, ...serverUnreachableHint(baseUrl)];
+	const label = [error.code, error.status ? `(${error.status})` : void 0].filter(Boolean).join(" ");
+	const lines = [`✗ ${action}${label ? ` — ${label}` : ""}: ${error.message}`];
+	if (error.status === 401) lines.push(`  The server at ${baseUrl} did not accept SERVICE_KEY from .env — is it this project's server?`);
+	if (error.code === "UNKNOWN_SCOPE_TARGET" && isRecord(error.details)) for (const [kind, title] of [
+		["collections", "Collections"],
+		["buckets", "Buckets"],
+		["functions", "Functions"]
+	]) {
+		const names = error.details[kind];
+		if (Array.isArray(names) && names.length > 0) lines.push(`  ${title}: ${names.map(String).join(", ")}`);
+	}
+	return lines;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(action, error, baseUrl) {
+	for (const line of describeFailure(action, error, baseUrl)) console.error(line.startsWith("✗") ? chalk.red(line) : chalk.gray(line));
+	process.exit(1);
+}
+async function apiKeysCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help" || wantsHelp(rawArgs)) {
+		printApiKeysHelp();
+		return;
+	}
+	switch (subcommand) {
+		case "list":
+			await listKeys(rawArgs);
+			break;
+		case "get":
+			await getKey(rawArgs);
+			break;
+		case "create":
+			await createKey(rawArgs);
+			break;
+		case "revoke":
+			await revokeKey(rawArgs);
+			break;
+		case "scopes":
+			await listScopes(rawArgs);
+			break;
+		default: unknownCommand(subcommand, API_KEYS_SUBCOMMANDS, "api-keys");
+	}
+}
+function keyStatus(key, now) {
+	if (key.revoked_at) return chalk.red("revoked");
+	if (key.expires_at && new Date(key.expires_at) < now) return chalk.yellow("expired");
+	return chalk.green("active");
+}
+/**
+* The lines that describe one key: what it is, what it may do and whom it
+* runs as.
+*
+* A service key runs as the RLS role `service` plus its own `roles`; a
+* personal key runs as its owner's roles as they are when it is used, so it
+* has none of its own to show.
+*
+* Exported so its tests can read the lines without a server.
+*/
+function describeKey(key, now = /* @__PURE__ */ new Date()) {
+	const field = (label, value) => `  ${chalk.gray(`${label}:`.padEnd(12))}${value}`;
+	const roles = key.kind === "personal" ? `its owner's (${key.owner_uid ?? "unknown"})` : ["service", ...key.roles].join(", ");
+	const lines = [
+		`  ${chalk.bold(key.name)} ${chalk.gray(`[${key.key_prefix}•••]`)} ${keyStatus(key, now)}`,
+		field("ID", key.id),
+		field("Kind", key.kind),
+		field("Scopes", key.scopes.length > 0 ? key.scopes.join(", ") : chalk.gray("none")),
+		field("Roles", roles)
+	];
+	if (key.rate_limit !== null) lines.push(field("Rate limit", `${key.rate_limit} requests / 15 min`));
+	if (key.expires_at) lines.push(field("Expires", new Date(key.expires_at).toLocaleDateString()));
+	lines.push(field("Created", new Date(key.created_at).toLocaleDateString()));
+	if (key.last_used_at) lines.push(field("Last used", new Date(key.last_used_at).toLocaleDateString()));
+	return lines;
+}
+/** The flags `rebase api-keys list` takes: none of its own. */
+var LIST_KEYS_FLAGS = {};
+async function listKeys(rawArgs) {
+	parseCommandArgs({
+		spec: LIST_KEYS_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "api-keys list",
+		maxPositionals: 0
+	});
+	const { client, baseUrl } = connect();
+	let keys;
+	try {
+		({keys} = await client.apiKeys.listKeys());
+	} catch (e) {
+		fail("Failed to list API keys", e, baseUrl);
+	}
+	console.log("");
+	console.log(chalk.bold("  🔑 API Keys"));
+	console.log("");
+	if (keys.length === 0) {
+		console.log(chalk.gray("  No API keys found."));
+		console.log("");
+		return;
+	}
+	const now = /* @__PURE__ */ new Date();
+	for (const key of keys) {
+		for (const line of describeKey(key, now)) console.log(line);
+		console.log("");
+	}
+}
+/** The flags `rebase api-keys get` takes. */
+var GET_KEY_FLAGS = { "--id": String };
+/**
+* Which key this invocation names, as a positional or as `--id`.
+*
+* Exported so its tests can drive the real parser rather than a copy of it.
+*/
+function resolveGetKeyArgs(rawArgs) {
+	const { flags, positionals } = parseCommandArgs({
+		spec: GET_KEY_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "api-keys get",
+		maxPositionals: 1
+	});
+	return { id: flags["--id"] || positionals[0] };
+}
+async function getKey(rawArgs) {
+	const { id } = resolveGetKeyArgs(rawArgs);
+	if (!id) throw new UsageError("Key ID is required: rebase api-keys get <key-id> (`rebase api-keys list` shows them).");
+	const { client, baseUrl } = connect();
+	let key;
+	try {
+		({key} = await client.apiKeys.getKey(id));
+	} catch (e) {
+		fail("Failed to read API key", e, baseUrl);
+	}
+	console.log("");
+	for (const line of describeKey(key)) console.log(line);
+	console.log("");
+}
+/** The flags `rebase api-keys create` takes. */
+var CREATE_KEY_FLAGS = {
+	"--name": String,
+	"--scopes": [String],
+	"--full-access": Boolean,
+	"--roles": [String],
+	"--rate-limit": Number,
+	"--expires-in": String,
+	"--expires-at": String,
+	"-n": "--name"
+};
+/**
+* Options `create` refuses by name, each with the flag that does that job.
+*
+* Checked before the line is parsed: the strict parser would answer them
+* "unknown option", which does not say what to type instead.
+*/
+var RETIRED_CREATE_OPTIONS = {
+	"--permissions": "--permissions is gone: name what the key may do with --scopes, e.g. --scopes data:read:posts,data:write:posts (`rebase api-keys scopes` lists them).",
+	"--admin": "--admin is gone: give the key the RLS role with --roles admin, and the admin-plane scopes it needs with --scopes, e.g. --scopes users:read,schema:read.",
+	"--expires": "--expires is gone: use --expires-in <days> (e.g. --expires-in 90) or --expires-at <ISO date>."
+};
+/** Refuse a retired option, wherever on the line and however it is spelled. */
+function refuseRetiredOptions(rawArgs) {
+	for (const token of rawArgs.slice(2)) {
+		if (token === "--") return;
+		const name = token.split("=", 1)[0];
+		const replacement = Object.prototype.hasOwnProperty.call(RETIRED_CREATE_OPTIONS, name) ? RETIRED_CREATE_OPTIONS[name] : void 0;
+		if (replacement) throw new UsageError(replacement);
+	}
+}
+/**
+* A list flag's values, whether repeated (`--scopes a --scopes b`) or
+* comma-separated (`--scopes a,b`) — or both — trimmed and deduplicated.
+* Whitespace separates too: no scope or role name contains any.
+*/
+function splitList(values) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of values ?? []) for (const entry of value.split(/[\s,]+/)) if (entry) out.add(entry);
+	return [...out];
+}
+var DAY_MS = 864e5;
+function resolveExpiry(expiresIn, expiresAt, now) {
+	if (expiresIn !== void 0 && expiresAt !== void 0) throw new UsageError("Pass --expires-in or --expires-at, not both.");
+	if (expiresIn !== void 0) {
+		const days = /^\d+$/.test(expiresIn.trim()) ? Number(expiresIn.trim()) : NaN;
+		if (!Number.isSafeInteger(days) || days < 1) throw new UsageError(`--expires-in takes a whole number of days, e.g. --expires-in 90 (got "${expiresIn}").`);
+		return new Date(now.getTime() + days * DAY_MS).toISOString();
+	}
+	if (expiresAt !== void 0) {
+		const parsed = new Date(expiresAt);
+		if (isNaN(parsed.getTime())) throw new UsageError(`--expires-at takes an ISO date, e.g. --expires-at 2027-01-31 (got "${expiresAt}").`);
+		if (parsed.getTime() <= now.getTime()) throw new UsageError(`--expires-at must be in the future (got ${parsed.toISOString()}).`);
+		return parsed.toISOString();
+	}
+	return null;
+}
+/**
+* What this invocation asks to be created.
+*
+* The name may be given either way — `--name "My Key"` or as the single
+* positional — and under the old permissive parse an undeclared flag became
+* that positional: `rebase api-keys create --debug --full-access` created a
+* key called `--debug` with access to everything, and `--debug` is what the
+* CLI prints after every failure as the thing to re-run with. Strict parsing
+* makes the flag an error instead of a name.
+*
+* What the key may do has to be asked for by name — `--scopes` or
+* `--full-access` — never defaulted: a forgotten flag must not mint a key that
+* reaches everything.
+*
+* Exported so its tests can drive the real parser rather than a copy of it.
+*/
+function resolveCreateKeyArgs(rawArgs, now = /* @__PURE__ */ new Date()) {
+	refuseRetiredOptions(rawArgs);
+	const { flags, positionals } = parseCommandArgs({
+		spec: CREATE_KEY_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "api-keys create",
+		maxPositionals: 1
+	});
+	const name = (flags["--name"] || positionals[0] || "").trim();
+	if (!name) throw new UsageError("A key needs a name: rebase api-keys create \"CI\" --scopes data:read");
+	const named = splitList(flags["--scopes"]);
+	const fullAccess = flags["--full-access"] === true;
+	if (fullAccess && named.length > 0) throw new UsageError("Pass --scopes or --full-access, not both: --full-access already means every scope you hold.");
+	if (!fullAccess && named.length === 0) throw new UsageError("Name what the key may do: --scopes data:read:posts,data:write:posts, or --full-access for every scope you hold. `rebase api-keys scopes` lists them.");
+	const rateLimit = flags["--rate-limit"];
+	if (rateLimit !== void 0 && (!Number.isSafeInteger(rateLimit) || rateLimit < 1)) throw new UsageError("--rate-limit takes a whole number of requests per 15-minute window, e.g. --rate-limit 500.");
+	return {
+		name,
+		scopes: fullAccess ? "held" : named,
+		roles: splitList(flags["--roles"]),
+		rate_limit: rateLimit ?? null,
+		expires_at: resolveExpiry(flags["--expires-in"], flags["--expires-at"], now)
+	};
+}
+/**
+* The scopes `--full-access` puts on a key: every one the caller holds, less
+* key management, which no key may hold.
+*
+* Exported so its tests can check the subtraction without a server.
+*/
+function grantableScopes(held) {
+	const management = KEY_MANAGEMENT_SCOPES;
+	return held.filter((entry) => !management.includes(parseScope(entry)?.scope ?? entry));
+}
+async function createKey(rawArgs) {
+	const plan = resolveCreateKeyArgs(rawArgs);
+	const { client, baseUrl } = connect();
+	let scopes;
+	if (plan.scopes === "held") {
+		let held;
+		try {
+			({held} = await client.personalKeys.listScopes());
+		} catch (e) {
+			fail("Failed to read the scopes you hold", e, baseUrl);
+		}
+		scopes = grantableScopes(held);
+		if (scopes.length === 0) {
+			console.error(chalk.red("✗ You hold no scope a key may carry, so --full-access has nothing to grant."));
+			process.exit(1);
+		}
+	} else scopes = plan.scopes;
+	const request = {
+		name: plan.name,
+		scopes,
+		...plan.roles.length > 0 ? { roles: plan.roles } : {},
+		...plan.rate_limit !== null ? { rate_limit: plan.rate_limit } : {},
+		...plan.expires_at !== null ? { expires_at: plan.expires_at } : {}
+	};
+	let created;
+	try {
+		({key: created} = await client.apiKeys.createKey(request));
+	} catch (e) {
+		fail("Failed to create API key", e, baseUrl);
+	}
+	console.log("");
+	console.log(chalk.bold.green("  ✓ API key created"));
+	console.log("");
+	for (const line of describeKey(created)) console.log(line);
+	console.log("");
+	console.log(chalk.bold.yellow("  ⚠ Copy your key now — it won't be shown again:"));
+	console.log("");
+	console.log(`  ${chalk.cyan(created.key)}`);
+	console.log("");
+}
+/** The flags `rebase api-keys revoke` takes. */
+var REVOKE_KEY_FLAGS = { "--id": String };
+/**
+* Which key this invocation names.
+*
+* The id is a positional, so the permissive parse handed one straight to the
+* DELETE: `rebase api-keys revoke --foo` sent
+* `DELETE /api/admin/api-keys/--foo`, and `rebase --debug api-keys revoke <id>`
+* shifted the words along and revoked the key named `revoke`.
+*
+* Exported so its tests can drive the real parser rather than a copy of it.
+*/
+function resolveRevokeKeyArgs(rawArgs) {
+	const { flags, positionals } = parseCommandArgs({
+		spec: REVOKE_KEY_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "api-keys revoke",
+		maxPositionals: 1
+	});
+	return { id: flags["--id"] || positionals[0] };
+}
+async function revokeKey(rawArgs) {
+	const { id } = resolveRevokeKeyArgs(rawArgs);
+	if (!id) throw new UsageError("Key ID is required: rebase api-keys revoke <key-id> (`rebase api-keys list` shows them).");
+	const { client, baseUrl } = connect();
+	try {
+		await client.apiKeys.revokeKey(id);
+	} catch (e) {
+		fail("Failed to revoke API key", e, baseUrl);
+	}
+	console.log("");
+	console.log(chalk.bold.green("  ✓ API key revoked"));
+	console.log(`  ${chalk.gray("ID:")} ${id}`);
+	console.log("");
+}
+/** The flags `rebase api-keys scopes` takes: none of its own. */
+var SCOPES_LIST_FLAGS = {};
+var PLANES = [
+	{
+		plane: "data",
+		title: "Data",
+		note: "narrow what a key reaches; row-level security still decides the rows"
+	},
+	{
+		plane: "admin",
+		title: "Admin",
+		note: "nobody holds these unless a role grants them; the admin role holds all"
+	},
+	{
+		plane: "app",
+		title: "App",
+		note: "declared by this app under auth.scopes on the users collection"
+	}
+];
+/**
+* The scope catalogue as printed lines: one section per plane, each scope with
+* its label and what its target names, marked when the caller holds it.
+*
+* Exported so its tests can read the lines without a server.
+*/
+function describeScopes(scopes, held) {
+	const management = KEY_MANAGEMENT_SCOPES;
+	const width = Math.max(0, ...scopes.map((s) => s.scope.length)) + 2;
+	const labelWidth = Math.max(0, ...scopes.map((s) => s.label.length)) + 2;
+	const lines = [];
+	for (const { plane, title, note } of PLANES) {
+		const inPlane = scopes.filter((s) => s.plane === plane);
+		if (inPlane.length === 0) continue;
+		lines.push(`  ${chalk.bold(title)} ${chalk.gray(`— ${note}`)}`);
+		for (const s of inPlane) {
+			const mark = held.includes(s.scope) ? chalk.green("✓") : " ";
+			const extra = management.includes(s.scope) ? chalk.gray("never on a key") : s.target ? chalk.gray(`:<${s.target}>`) : "";
+			lines.push(`  ${mark} ${s.scope.padEnd(width)}${extra ? s.label.padEnd(labelWidth) : s.label}${extra}`);
+		}
+		lines.push("");
+	}
+	return lines;
+}
+async function listScopes(rawArgs) {
+	parseCommandArgs({
+		spec: SCOPES_LIST_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "api-keys scopes",
+		maxPositionals: 0
+	});
+	const { client, baseUrl } = connect();
+	let catalogue;
+	try {
+		catalogue = await client.personalKeys.listScopes();
+	} catch (e) {
+		fail("Failed to read the scopes", e, baseUrl);
+	}
+	console.log("");
+	console.log(chalk.bold("  Scopes") + chalk.gray("  (✓ = you hold it; :<target> narrows it to one)"));
+	console.log("");
+	for (const line of describeScopes(catalogue.scopes, catalogue.held)) console.log(line);
+}
+function printApiKeysHelp() {
+	const keyable = ADMIN_SCOPES.filter((scope) => !KEY_MANAGEMENT_SCOPES.includes(scope));
+	console.log(`
+${chalk.bold("rebase api-keys")} — Manage service API keys
+
+${chalk.green.bold("Usage")}
+  rebase api-keys ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}              List the service keys: kind, scopes, roles
+  ${chalk.blue.bold("get")} ${chalk.gray("<id>")}          Show one key
+  ${chalk.blue.bold("create")}            Create a service key
+  ${chalk.blue.bold("revoke")} ${chalk.gray("<id>")}       Revoke a key
+  ${chalk.blue.bold("scopes")}            List the scopes this backend knows, and which you hold
+
+${chalk.green.bold("create Options")}
+  ${chalk.blue("--name, -n")}        Key name ${chalk.gray("(required; or the first argument)")}
+  ${chalk.blue("--scopes")}          What the key may do, comma-separated or repeated
+                    ${chalk.gray("(required unless --full-access)")}
+  ${chalk.blue("--full-access")}     Every scope you hold, less keys:read and keys:write
+  ${chalk.blue("--roles")}           RLS roles the key runs as beside ${chalk.gray("service")}, e.g. admin
+  ${chalk.blue("--rate-limit")}      Requests per 15-min window ${chalk.gray("(default: the server's API-key limit)")}
+  ${chalk.blue("--expires-in")}      Days until the key expires
+  ${chalk.blue("--expires-at")}      Expiry as an ISO date, e.g. 2027-01-31
+
+${chalk.green.bold("get / revoke Options")}
+  ${chalk.blue("--id")}              API key ID ${chalk.gray("(or the first argument)")}
+
+${chalk.green.bold("Scopes")}
+  A scope is ${chalk.blue("resource:action")}, optionally narrowed to one target:
+  ${chalk.blue("data:read:posts")} reads the posts collection and nothing else.
+  Data   ${DATA_PLANE_SCOPES.join(", ")}
+         ${chalk.gray("target: a collection slug, a storage source id (default), a function name")}
+  Admin  ${keyable.join(", ")}
+  App    whatever the app declares under auth.scopes ${chalk.gray("(rebase api-keys scopes)")}
+
+${chalk.green.bold("Examples")}
+  rebase api-keys list
+  rebase api-keys create "Analytics" --scopes data:read:events
+  rebase api-keys create -n "Blog CI" --scopes data:read:posts,data:write:posts --expires-in 90
+  rebase api-keys create -n "Mailer" --scopes "functions:invoke:send-email,storage:read:(default)"
+  rebase api-keys create -n "Ops" --full-access --roles admin --expires-at 2027-01-31
+  rebase api-keys get abc123-def456
+  rebase api-keys revoke abc123-def456
+`);
+}
+//#endregion
+export { API_KEYS_SUBCOMMANDS, apiKeysCommand, describeFailure, resolveBaseUrl };
+
+//# sourceMappingURL=api-keys-Bl1I9q7M.js.map

package/dist/api-keys-Bl1I9q7M.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys-Bl1I9q7M.js","names":[],"sources":["../src/commands/api-keys.ts"],"sourcesContent":["/**\n * CLI command: rebase api-keys <action>\n *\n * The project's service keys, through `/api/admin/api-keys`, authenticated with\n * the service key from `.env`.\n *\n * Subcommands:\n *   list    — List the service keys (masked): kind, scopes, roles\n *   get     — Show one key\n *   create  — Create a service key holding the scopes named on the line\n *   revoke  — Revoke a key\n *   scopes  — List the scopes this backend knows, and which the caller holds\n */\nimport chalk from \"chalk\";\nimport type arg from \"arg\";\nimport { createRebaseClient, RebaseApiError } from \"@rebasepro/client\";\nimport {\n    ADMIN_SCOPES,\n    DATA_PLANE_SCOPES,\n    KEY_MANAGEMENT_SCOPES,\n    parseScope,\n    type ApiKeyMasked,\n    type ApiKeyWithSecret,\n    type CreateApiKeyRequest,\n    type ScopeSummary\n} from \"@rebasepro/types\";\nimport {\n    requireProjectRoot,\n    readEnvFile\n} from \"../utils/project\";\nimport { parseCommandArgs, UsageError, wantsHelp } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { cliUserAgent } from \"../utils/version\";\nimport { serverUnreachableHint } from \"../utils/dev-server\";\nimport fs from \"fs\";\nimport path from \"path\";\n\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const API_KEYS_SUBCOMMANDS = [\"list\", \"get\", \"create\", \"revoke\", \"scopes\"] as const;\n\n/* ═══════════════════════════════════════════════════════════════\n   Env helper — reads SERVICE_KEY and PORT from .env\n   ═══════════════════════════════════════════════════════════════ */\n\n/**\n * Was a hand-rolled `indexOf(\"=\")` loop. It keyed `export KEY=value` as\n * `export KEY` and carried a trailing `# comment` into the value — so a key\n * that was present read as absent, or reached an `Authorization` header with a\n * comment attached and came back 401. See `readEnvFile`.\n */\nconst loadEnv = readEnvFile;\n\n/** The running backend's URL. Shared with `rebase storage`. */\nexport function resolveBaseUrl(env: Record<string, string>, projectRoot?: string): string {\n    // An explicit override always wins.\n    if (env.REBASE_BASE_URL) return env.REBASE_BASE_URL;\n\n    // `rebase dev` runs on a derived per-project port, not the .env PORT, and\n    // records the URL it actually bound. Without this, these commands default to\n    // :3001 and report \"Is the Rebase server running?\" while it is running.\n    if (projectRoot) {\n        try {\n            const urlFile = path.join(projectRoot, \".rebase-dev-url\");\n            if (fs.existsSync(urlFile)) {\n                const devUrl = fs.readFileSync(urlFile, \"utf-8\").trim();\n                if (devUrl) return devUrl;\n            }\n        } catch { /* fall through to the configured port */ }\n    }\n\n    const port = env.PORT || env.REBASE_PORT || \"3001\";\n    return `http://localhost:${port}`;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   The backend, through the SDK\n   ═══════════════════════════════════════════════════════════════ */\n\ntype ProjectClient = ReturnType<typeof createRebaseClient>;\n\ninterface Connection {\n    client: ProjectClient;\n    baseUrl: string;\n}\n\n/**\n * An SDK client for this project's backend, holding the service key.\n *\n * The service key is the project's own machine identity — the `admin` role,\n * every scope — so it is what may list, mint and revoke service keys. It is a\n * static bearer token: no session to restore or refresh, and no socket.\n */\nfunction connect(): Connection {\n    const projectRoot = requireProjectRoot();\n    const env = loadEnv(projectRoot);\n    const baseUrl = resolveBaseUrl(env, projectRoot);\n    const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;\n\n    if (!serviceKey) {\n        console.error(chalk.red(\"✗ SERVICE_KEY not found in .env — required to manage API keys.\"));\n        process.exit(1);\n    }\n\n    const client = createRebaseClient({\n        baseUrl,\n        token: serviceKey,\n        realtime: false,\n        headers: { \"User-Agent\": cliUserAgent() },\n        auth: { persistSession: false, autoRefresh: false }\n    });\n    return { client, baseUrl };\n}\n\n/**\n * What to print when a request fails: the server's error code and message,\n * which is what says why — `SCOPE_EXCEEDS_CREATOR`, `INVALID_SCOPES`,\n * `ROLE_EXCEEDS_CREATOR`, `KEY_MANAGEMENT_SCOPE` — and a hint where one helps.\n *\n * Exported so its tests can read the lines without a server.\n */\nexport function describeFailure(action: string, error: unknown, baseUrl: string): string[] {\n    if (!(error instanceof RebaseApiError)) {\n        return [`✗ ${action}: ${error instanceof Error ? error.message : String(error)}`];\n    }\n    if (error.status === 0 || error.code === \"NETWORK_ERROR\") {\n        return [`✗ ${action}: ${error.message}`, ...serverUnreachableHint(baseUrl)];\n    }\n\n    const label = [error.code, error.status ? `(${error.status})` : undefined].filter(Boolean).join(\" \");\n    const lines = [`✗ ${action}${label ? ` — ${label}` : \"\"}: ${error.message}`];\n\n    if (error.status === 401) {\n        lines.push(`  The server at ${baseUrl} did not accept SERVICE_KEY from .env — is it this project's server?`);\n    }\n    // The message names the target that is not there; what *is* there rides\n    // in `details`, and is the thing to pick from.\n    if (error.code === \"UNKNOWN_SCOPE_TARGET\" && isRecord(error.details)) {\n        for (const [kind, title] of [[\"collections\", \"Collections\"], [\"buckets\", \"Buckets\"], [\"functions\", \"Functions\"]] as const) {\n            const names = error.details[kind];\n            if (Array.isArray(names) && names.length > 0) {\n                lines.push(`  ${title}: ${names.map(String).join(\", \")}`);\n            }\n        }\n    }\n    return lines;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction fail(action: string, error: unknown, baseUrl: string): never {\n    for (const line of describeFailure(action, error, baseUrl)) {\n        console.error(line.startsWith(\"✗\") ? chalk.red(line) : chalk.gray(line));\n    }\n    process.exit(1);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Entry\n   ═══════════════════════════════════════════════════════════════ */\n\nexport async function apiKeysCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    // `--help` is answered before dispatch, never by a handler. `cli.ts` only\n    // rewrites the subcommand to `\"--help\"` when none was named, so\n    // `rebase api-keys list --help` used to *list the keys* and\n    // `rebase api-keys revoke --help` sent `DELETE /api/admin/api-keys/--help`.\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printApiKeysHelp();\n        return;\n    }\n\n    switch (subcommand) {\n        case \"list\":\n            await listKeys(rawArgs);\n            break;\n        case \"get\":\n            await getKey(rawArgs);\n            break;\n        case \"create\":\n            await createKey(rawArgs);\n            break;\n        case \"revoke\":\n            await revokeKey(rawArgs);\n            break;\n        case \"scopes\":\n            await listScopes(rawArgs);\n            break;\n        default:\n            // The shape every other family uses. This one printed a bare line\n            // to stderr *and* the whole help page to stdout, so a typo wrote\n            // twenty lines to a stream a `--json` caller reads, with no `✗`, no\n            // pointer at `--help`, and no did-you-mean — `craete` is one\n            // transposition from `create`.\n            unknownCommand(subcommand, API_KEYS_SUBCOMMANDS, \"api-keys\");\n    }\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Showing a key\n   ═══════════════════════════════════════════════════════════════ */\n\nfunction keyStatus(key: ApiKeyMasked, now: Date): string {\n    if (key.revoked_at) return chalk.red(\"revoked\");\n    if (key.expires_at && new Date(key.expires_at) < now) return chalk.yellow(\"expired\");\n    return chalk.green(\"active\");\n}\n\n/**\n * The lines that describe one key: what it is, what it may do and whom it\n * runs as.\n *\n * A service key runs as the RLS role `service` plus its own `roles`; a\n * personal key runs as its owner's roles as they are when it is used, so it\n * has none of its own to show.\n *\n * Exported so its tests can read the lines without a server.\n */\nexport function describeKey(key: ApiKeyMasked, now: Date = new Date()): string[] {\n    const field = (label: string, value: string) => `  ${chalk.gray(`${label}:`.padEnd(12))}${value}`;\n    const roles = key.kind === \"personal\"\n        ? `its owner's (${key.owner_uid ?? \"unknown\"})`\n        : [\"service\", ...key.roles].join(\", \");\n\n    const lines = [\n        `  ${chalk.bold(key.name)} ${chalk.gray(`[${key.key_prefix}•••]`)} ${keyStatus(key, now)}`,\n        field(\"ID\", key.id),\n        field(\"Kind\", key.kind),\n        field(\"Scopes\", key.scopes.length > 0 ? key.scopes.join(\", \") : chalk.gray(\"none\")),\n        field(\"Roles\", roles)\n    ];\n    if (key.rate_limit !== null) lines.push(field(\"Rate limit\", `${key.rate_limit} requests / 15 min`));\n    if (key.expires_at) lines.push(field(\"Expires\", new Date(key.expires_at).toLocaleDateString()));\n    lines.push(field(\"Created\", new Date(key.created_at).toLocaleDateString()));\n    if (key.last_used_at) lines.push(field(\"Last used\", new Date(key.last_used_at).toLocaleDateString()));\n    return lines;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   list\n   ═══════════════════════════════════════════════════════════════ */\n\n/** The flags `rebase api-keys list` takes: none of its own. */\nexport const LIST_KEYS_FLAGS = {} as const;\n\nasync function listKeys(rawArgs: string[]): Promise<void> {\n    parseCommandArgs({\n        spec: LIST_KEYS_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"api-keys list\",\n        maxPositionals: 0\n    });\n\n    const { client, baseUrl } = connect();\n    let keys: ApiKeyMasked[];\n    try {\n        ({ keys } = await client.apiKeys.listKeys());\n    } catch (e: unknown) {\n        fail(\"Failed to list API keys\", e, baseUrl);\n    }\n\n    console.log(\"\");\n    console.log(chalk.bold(\"  🔑 API Keys\"));\n    console.log(\"\");\n\n    if (keys.length === 0) {\n        console.log(chalk.gray(\"  No API keys found.\"));\n        console.log(\"\");\n        return;\n    }\n\n    const now = new Date();\n    for (const key of keys) {\n        for (const line of describeKey(key, now)) console.log(line);\n        console.log(\"\");\n    }\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   get\n   ═══════════════════════════════════════════════════════════════ */\n\n/** The flags `rebase api-keys get` takes. */\nexport const GET_KEY_FLAGS = {\n    \"--id\": String\n} as const;\n\n/**\n * Which key this invocation names, as a positional or as `--id`.\n *\n * Exported so its tests can drive the real parser rather than a copy of it.\n */\nexport function resolveGetKeyArgs(rawArgs: string[]): { id?: string } {\n    const { flags, positionals } = parseCommandArgs({\n        spec: GET_KEY_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"api-keys get\",\n        maxPositionals: 1\n    });\n\n    return { id: flags[\"--id\"] || positionals[0] };\n}\n\nasync function getKey(rawArgs: string[]): Promise<void> {\n    const { id } = resolveGetKeyArgs(rawArgs);\n    if (!id) {\n        throw new UsageError(\"Key ID is required: rebase api-keys get <key-id> (`rebase api-keys list` shows them).\");\n    }\n\n    const { client, baseUrl } = connect();\n    let key: ApiKeyMasked;\n    try {\n        ({ key } = await client.apiKeys.getKey(id));\n    } catch (e: unknown) {\n        fail(\"Failed to read API key\", e, baseUrl);\n    }\n\n    console.log(\"\");\n    for (const line of describeKey(key)) console.log(line);\n    console.log(\"\");\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   create\n   ═══════════════════════════════════════════════════════════════ */\n\n/** The flags `rebase api-keys create` takes. */\nexport const CREATE_KEY_FLAGS = {\n    \"--name\": String,\n    \"--scopes\": [String],\n    \"--full-access\": Boolean,\n    \"--roles\": [String],\n    \"--rate-limit\": Number,\n    \"--expires-in\": String,\n    \"--expires-at\": String,\n    \"-n\": \"--name\"\n} satisfies arg.Spec;\n\n/**\n * Options `create` refuses by name, each with the flag that does that job.\n *\n * Checked before the line is parsed: the strict parser would answer them\n * \"unknown option\", which does not say what to type instead.\n */\nexport const RETIRED_CREATE_OPTIONS: Readonly<Record<string, string>> = {\n    \"--permissions\":\n        \"--permissions is gone: name what the key may do with --scopes, e.g. \" +\n        \"--scopes data:read:posts,data:write:posts (`rebase api-keys scopes` lists them).\",\n    \"--admin\":\n        \"--admin is gone: give the key the RLS role with --roles admin, and the admin-plane scopes it needs \" +\n        \"with --scopes, e.g. --scopes users:read,schema:read.\",\n    \"--expires\":\n        \"--expires is gone: use --expires-in <days> (e.g. --expires-in 90) or --expires-at <ISO date>.\"\n};\n\n/** Refuse a retired option, wherever on the line and however it is spelled. */\nfunction refuseRetiredOptions(rawArgs: string[]): void {\n    for (const token of rawArgs.slice(2)) {\n        // Past `--` everything is a value, never an option.\n        if (token === \"--\") return;\n        const name = token.split(\"=\", 1)[0];\n        const replacement = Object.prototype.hasOwnProperty.call(RETIRED_CREATE_OPTIONS, name)\n            ? RETIRED_CREATE_OPTIONS[name]\n            : undefined;\n        if (replacement) throw new UsageError(replacement);\n    }\n}\n\n/**\n * A list flag's values, whether repeated (`--scopes a --scopes b`) or\n * comma-separated (`--scopes a,b`) — or both — trimmed and deduplicated.\n * Whitespace separates too: no scope or role name contains any.\n */\nfunction splitList(values: readonly string[] | undefined): string[] {\n    const out = new Set<string>();\n    for (const value of values ?? []) {\n        for (const entry of value.split(/[\\s,]+/)) {\n            if (entry) out.add(entry);\n        }\n    }\n    return [...out];\n}\n\nconst DAY_MS = 86_400_000;\n\nfunction resolveExpiry(expiresIn: string | undefined, expiresAt: string | undefined, now: Date): string | null {\n    if (expiresIn !== undefined && expiresAt !== undefined) {\n        throw new UsageError(\"Pass --expires-in or --expires-at, not both.\");\n    }\n    if (expiresIn !== undefined) {\n        const days = /^\\d+$/.test(expiresIn.trim()) ? Number(expiresIn.trim()) : NaN;\n        if (!Number.isSafeInteger(days) || days < 1) {\n            throw new UsageError(`--expires-in takes a whole number of days, e.g. --expires-in 90 (got \"${expiresIn}\").`);\n        }\n        return new Date(now.getTime() + days * DAY_MS).toISOString();\n    }\n    if (expiresAt !== undefined) {\n        const parsed = new Date(expiresAt);\n        if (isNaN(parsed.getTime())) {\n            throw new UsageError(`--expires-at takes an ISO date, e.g. --expires-at 2027-01-31 (got \"${expiresAt}\").`);\n        }\n        if (parsed.getTime() <= now.getTime()) {\n            throw new UsageError(`--expires-at must be in the future (got ${parsed.toISOString()}).`);\n        }\n        return parsed.toISOString();\n    }\n    return null;\n}\n\n/** What `rebase api-keys create` was asked to mint. */\nexport interface CreateKeyPlan {\n    name: string;\n    /** The scopes named with `--scopes`, or `\"held\"` for `--full-access`. */\n    scopes: string[] | \"held\";\n    /** RLS roles beside `service`. */\n    roles: string[];\n    rate_limit: number | null;\n    expires_at: string | null;\n}\n\n/**\n * What this invocation asks to be created.\n *\n * The name may be given either way — `--name \"My Key\"` or as the single\n * positional — and under the old permissive parse an undeclared flag became\n * that positional: `rebase api-keys create --debug --full-access` created a\n * key called `--debug` with access to everything, and `--debug` is what the\n * CLI prints after every failure as the thing to re-run with. Strict parsing\n * makes the flag an error instead of a name.\n *\n * What the key may do has to be asked for by name — `--scopes` or\n * `--full-access` — never defaulted: a forgotten flag must not mint a key that\n * reaches everything.\n *\n * Exported so its tests can drive the real parser rather than a copy of it.\n */\nexport function resolveCreateKeyArgs(rawArgs: string[], now: Date = new Date()): CreateKeyPlan {\n    refuseRetiredOptions(rawArgs);\n\n    const { flags, positionals } = parseCommandArgs({\n        spec: CREATE_KEY_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"api-keys create\",\n        maxPositionals: 1\n    });\n\n    const name = (flags[\"--name\"] || positionals[0] || \"\").trim();\n    if (!name) {\n        throw new UsageError('A key needs a name: rebase api-keys create \"CI\" --scopes data:read');\n    }\n\n    const named = splitList(flags[\"--scopes\"]);\n    const fullAccess = flags[\"--full-access\"] === true;\n    if (fullAccess && named.length > 0) {\n        throw new UsageError(\"Pass --scopes or --full-access, not both: --full-access already means every scope you hold.\");\n    }\n    if (!fullAccess && named.length === 0) {\n        throw new UsageError(\n            \"Name what the key may do: --scopes data:read:posts,data:write:posts, or --full-access for every \" +\n            \"scope you hold. `rebase api-keys scopes` lists them.\"\n        );\n    }\n\n    const rateLimit = flags[\"--rate-limit\"];\n    if (rateLimit !== undefined && (!Number.isSafeInteger(rateLimit) || rateLimit < 1)) {\n        throw new UsageError(\"--rate-limit takes a whole number of requests per 15-minute window, e.g. --rate-limit 500.\");\n    }\n\n    return {\n        name,\n        scopes: fullAccess ? \"held\" : named,\n        roles: splitList(flags[\"--roles\"]),\n        rate_limit: rateLimit ?? null,\n        expires_at: resolveExpiry(flags[\"--expires-in\"], flags[\"--expires-at\"], now)\n    };\n}\n\n/**\n * The scopes `--full-access` puts on a key: every one the caller holds, less\n * key management, which no key may hold.\n *\n * Exported so its tests can check the subtraction without a server.\n */\nexport function grantableScopes(held: readonly string[]): string[] {\n    const management: readonly string[] = KEY_MANAGEMENT_SCOPES;\n    return held.filter(entry => !management.includes(parseScope(entry)?.scope ?? entry));\n}\n\nasync function createKey(rawArgs: string[]): Promise<void> {\n    const plan = resolveCreateKeyArgs(rawArgs);\n    const { client, baseUrl } = connect();\n\n    let scopes: string[];\n    if (plan.scopes === \"held\") {\n        let held: string[];\n        try {\n            ({ held } = await client.personalKeys.listScopes());\n        } catch (e: unknown) {\n            fail(\"Failed to read the scopes you hold\", e, baseUrl);\n        }\n        scopes = grantableScopes(held);\n        if (scopes.length === 0) {\n            console.error(chalk.red(\"✗ You hold no scope a key may carry, so --full-access has nothing to grant.\"));\n            process.exit(1);\n        }\n    } else {\n        scopes = plan.scopes;\n    }\n\n    const request: CreateApiKeyRequest = {\n        name: plan.name,\n        scopes,\n        ...(plan.roles.length > 0 ? { roles: plan.roles } : {}),\n        ...(plan.rate_limit !== null ? { rate_limit: plan.rate_limit } : {}),\n        ...(plan.expires_at !== null ? { expires_at: plan.expires_at } : {})\n    };\n\n    let created: ApiKeyWithSecret;\n    try {\n        ({ key: created } = await client.apiKeys.createKey(request));\n    } catch (e: unknown) {\n        fail(\"Failed to create API key\", e, baseUrl);\n    }\n\n    console.log(\"\");\n    console.log(chalk.bold.green(\"  ✓ API key created\"));\n    console.log(\"\");\n    for (const line of describeKey(created)) console.log(line);\n    console.log(\"\");\n    console.log(chalk.bold.yellow(\"  ⚠ Copy your key now — it won't be shown again:\"));\n    console.log(\"\");\n    console.log(`  ${chalk.cyan(created.key)}`);\n    console.log(\"\");\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   revoke\n   ═══════════════════════════════════════════════════════════════ */\n\n/** The flags `rebase api-keys revoke` takes. */\nexport const REVOKE_KEY_FLAGS = {\n    \"--id\": String\n} as const;\n\n/**\n * Which key this invocation names.\n *\n * The id is a positional, so the permissive parse handed one straight to the\n * DELETE: `rebase api-keys revoke --foo` sent\n * `DELETE /api/admin/api-keys/--foo`, and `rebase --debug api-keys revoke <id>`\n * shifted the words along and revoked the key named `revoke`.\n *\n * Exported so its tests can drive the real parser rather than a copy of it.\n */\nexport function resolveRevokeKeyArgs(rawArgs: string[]): { id?: string } {\n    const { flags, positionals } = parseCommandArgs({\n        spec: REVOKE_KEY_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"api-keys revoke\",\n        maxPositionals: 1\n    });\n\n    return { id: flags[\"--id\"] || positionals[0] };\n}\n\nasync function revokeKey(rawArgs: string[]): Promise<void> {\n    const { id } = resolveRevokeKeyArgs(rawArgs);\n\n    if (!id) {\n        throw new UsageError(\"Key ID is required: rebase api-keys revoke <key-id> (`rebase api-keys list` shows them).\");\n    }\n\n    const { client, baseUrl } = connect();\n    try {\n        await client.apiKeys.revokeKey(id);\n    } catch (e: unknown) {\n        fail(\"Failed to revoke API key\", e, baseUrl);\n    }\n\n    console.log(\"\");\n    console.log(chalk.bold.green(\"  ✓ API key revoked\"));\n    console.log(`  ${chalk.gray(\"ID:\")} ${id}`);\n    console.log(\"\");\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   scopes\n   ═══════════════════════════════════════════════════════════════ */\n\n/** The flags `rebase api-keys scopes` takes: none of its own. */\nexport const SCOPES_LIST_FLAGS = {} as const;\n\nconst PLANES: ReadonlyArray<{ plane: ScopeSummary[\"plane\"]; title: string; note: string }> = [\n    { plane: \"data\", title: \"Data\", note: \"narrow what a key reaches; row-level security still decides the rows\" },\n    { plane: \"admin\", title: \"Admin\", note: \"nobody holds these unless a role grants them; the admin role holds all\" },\n    { plane: \"app\", title: \"App\", note: \"declared by this app under auth.scopes on the users collection\" }\n];\n\n/**\n * The scope catalogue as printed lines: one section per plane, each scope with\n * its label and what its target names, marked when the caller holds it.\n *\n * Exported so its tests can read the lines without a server.\n */\nexport function describeScopes(scopes: readonly ScopeSummary[], held: readonly string[]): string[] {\n    const management: readonly string[] = KEY_MANAGEMENT_SCOPES;\n    const width = Math.max(0, ...scopes.map(s => s.scope.length)) + 2;\n    const labelWidth = Math.max(0, ...scopes.map(s => s.label.length)) + 2;\n    const lines: string[] = [];\n    for (const { plane, title, note } of PLANES) {\n        const inPlane = scopes.filter(s => s.plane === plane);\n        if (inPlane.length === 0) continue;\n        lines.push(`  ${chalk.bold(title)} ${chalk.gray(`— ${note}`)}`);\n        for (const s of inPlane) {\n            const mark = held.includes(s.scope) ? chalk.green(\"✓\") : \" \";\n            const extra = management.includes(s.scope)\n                ? chalk.gray(\"never on a key\")\n                : s.target ? chalk.gray(`:<${s.target}>`) : \"\";\n            lines.push(`  ${mark} ${s.scope.padEnd(width)}${extra ? s.label.padEnd(labelWidth) : s.label}${extra}`);\n        }\n        lines.push(\"\");\n    }\n    return lines;\n}\n\nasync function listScopes(rawArgs: string[]): Promise<void> {\n    parseCommandArgs({\n        spec: SCOPES_LIST_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"api-keys scopes\",\n        maxPositionals: 0\n    });\n\n    const { client, baseUrl } = connect();\n    let catalogue: { scopes: ScopeSummary[]; held: string[] };\n    try {\n        catalogue = await client.personalKeys.listScopes();\n    } catch (e: unknown) {\n        fail(\"Failed to read the scopes\", e, baseUrl);\n    }\n\n    console.log(\"\");\n    console.log(chalk.bold(\"  Scopes\") + chalk.gray(\"  (✓ = you hold it; :<target> narrows it to one)\"));\n    console.log(\"\");\n    for (const line of describeScopes(catalogue.scopes, catalogue.held)) console.log(line);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Help\n   ═══════════════════════════════════════════════════════════════ */\n\nfunction printApiKeysHelp() {\n    const keyable = ADMIN_SCOPES.filter(scope => !(KEY_MANAGEMENT_SCOPES as readonly string[]).includes(scope));\n    console.log(`\n${chalk.bold(\"rebase api-keys\")} — Manage service API keys\n\n${chalk.green.bold(\"Usage\")}\n  rebase api-keys ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.blue.bold(\"list\")}              List the service keys: kind, scopes, roles\n  ${chalk.blue.bold(\"get\")} ${chalk.gray(\"<id>\")}          Show one key\n  ${chalk.blue.bold(\"create\")}            Create a service key\n  ${chalk.blue.bold(\"revoke\")} ${chalk.gray(\"<id>\")}       Revoke a key\n  ${chalk.blue.bold(\"scopes\")}            List the scopes this backend knows, and which you hold\n\n${chalk.green.bold(\"create Options\")}\n  ${chalk.blue(\"--name, -n\")}        Key name ${chalk.gray(\"(required; or the first argument)\")}\n  ${chalk.blue(\"--scopes\")}          What the key may do, comma-separated or repeated\n                    ${chalk.gray(\"(required unless --full-access)\")}\n  ${chalk.blue(\"--full-access\")}     Every scope you hold, less keys:read and keys:write\n  ${chalk.blue(\"--roles\")}           RLS roles the key runs as beside ${chalk.gray(\"service\")}, e.g. admin\n  ${chalk.blue(\"--rate-limit\")}      Requests per 15-min window ${chalk.gray(\"(default: the server's API-key limit)\")}\n  ${chalk.blue(\"--expires-in\")}      Days until the key expires\n  ${chalk.blue(\"--expires-at\")}      Expiry as an ISO date, e.g. 2027-01-31\n\n${chalk.green.bold(\"get / revoke Options\")}\n  ${chalk.blue(\"--id\")}              API key ID ${chalk.gray(\"(or the first argument)\")}\n\n${chalk.green.bold(\"Scopes\")}\n  A scope is ${chalk.blue(\"resource:action\")}, optionally narrowed to one target:\n  ${chalk.blue(\"data:read:posts\")} reads the posts collection and nothing else.\n  Data   ${DATA_PLANE_SCOPES.join(\", \")}\n         ${chalk.gray(\"target: a collection slug, a storage source id (default), a function name\")}\n  Admin  ${keyable.join(\", \")}\n  App    whatever the app declares under auth.scopes ${chalk.gray(\"(rebase api-keys scopes)\")}\n\n${chalk.green.bold(\"Examples\")}\n  rebase api-keys list\n  rebase api-keys create \"Analytics\" --scopes data:read:events\n  rebase api-keys create -n \"Blog CI\" --scopes data:read:posts,data:write:posts --expires-in 90\n  rebase api-keys create -n \"Mailer\" --scopes \"functions:invoke:send-email,storage:read:(default)\"\n  rebase api-keys create -n \"Ops\" --full-access --roles admin --expires-at 2027-01-31\n  rebase api-keys get abc123-def456\n  rebase api-keys revoke abc123-def456\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAa,uBAAuB;CAAC;CAAQ;CAAO;CAAU;CAAU;AAAQ;;;;;;;AAYhF,IAAM,UAAU;;AAGhB,SAAgB,eAAe,KAA6B,aAA8B;CAEtF,IAAI,IAAI,iBAAiB,OAAO,IAAI;CAKpC,IAAI,aACA,IAAI;EACA,MAAM,UAAU,KAAK,KAAK,aAAa,iBAAiB;EACxD,IAAI,GAAG,WAAW,OAAO,GAAG;GACxB,MAAM,SAAS,GAAG,aAAa,SAAS,OAAO,CAAC,CAAC,KAAK;GACtD,IAAI,QAAQ,OAAO;EACvB;CACJ,QAAQ,CAA4C;CAIxD,OAAO,oBADM,IAAI,QAAQ,IAAI,eAAe;AAEhD;;;;;;;;AAoBA,SAAS,UAAsB;CAC3B,MAAM,cAAc,mBAAmB;CACvC,MAAM,MAAM,QAAQ,WAAW;CAC/B,MAAM,UAAU,eAAe,KAAK,WAAW;CAC/C,MAAM,aAAa,IAAI,eAAe,IAAI;CAE1C,IAAI,CAAC,YAAY;EACb,QAAQ,MAAM,MAAM,IAAI,gEAAgE,CAAC;EACzF,QAAQ,KAAK,CAAC;CAClB;CASA,OAAO;EAAE,QAPM,mBAAmB;GAC9B;GACA,OAAO;GACP,UAAU;GACV,SAAS,EAAE,cAAc,aAAa,EAAE;GACxC,MAAM;IAAE,gBAAgB;IAAO,aAAa;GAAM;EACtD,CACS;EAAQ;CAAQ;AAC7B;;;;;;;;AASA,SAAgB,gBAAgB,QAAgB,OAAgB,SAA2B;CACvF,IAAI,EAAE,iBAAiB,iBACnB,OAAO,CAAC,KAAK,OAAO,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;CAEpF,IAAI,MAAM,WAAW,KAAK,MAAM,SAAS,iBACrC,OAAO,CAAC,KAAK,OAAO,IAAI,MAAM,WAAW,GAAG,sBAAsB,OAAO,CAAC;CAG9E,MAAM,QAAQ,CAAC,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,KAAK,KAAA,CAAS,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CACnG,MAAM,QAAQ,CAAC,KAAK,SAAS,QAAQ,MAAM,UAAU,GAAG,IAAI,MAAM,SAAS;CAE3E,IAAI,MAAM,WAAW,KACjB,MAAM,KAAK,mBAAmB,QAAQ,qEAAqE;CAI/G,IAAI,MAAM,SAAS,0BAA0B,SAAS,MAAM,OAAO,GAC/D,KAAK,MAAM,CAAC,MAAM,UAAU;EAAC,CAAC,eAAe,aAAa;EAAG,CAAC,WAAW,SAAS;EAAG,CAAC,aAAa,WAAW;CAAC,GAAY;EACvH,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,GACvC,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,GAAG;CAEhE;CAEJ,OAAO;AACX;AAEA,SAAS,SAAS,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;AAEA,SAAS,KAAK,QAAgB,OAAgB,SAAwB;CAClE,KAAK,MAAM,QAAQ,gBAAgB,QAAQ,OAAO,OAAO,GACrD,QAAQ,MAAM,KAAK,WAAW,GAAG,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;CAE3E,QAAQ,KAAK,CAAC;AAClB;AAMA,eAAsB,eAAe,YAAgC,SAAkC;CAKnG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,iBAAiB;EACjB;CACJ;CAEA,QAAQ,YAAR;EACI,KAAK;GACD,MAAM,SAAS,OAAO;GACtB;EACJ,KAAK;GACD,MAAM,OAAO,OAAO;GACpB;EACJ,KAAK;GACD,MAAM,UAAU,OAAO;GACvB;EACJ,KAAK;GACD,MAAM,UAAU,OAAO;GACvB;EACJ,KAAK;GACD,MAAM,WAAW,OAAO;GACxB;EACJ,SAMI,eAAe,YAAY,sBAAsB,UAAU;CACnE;AACJ;AAMA,SAAS,UAAU,KAAmB,KAAmB;CACrD,IAAI,IAAI,YAAY,OAAO,MAAM,IAAI,SAAS;CAC9C,IAAI,IAAI,cAAc,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS;CACnF,OAAO,MAAM,MAAM,QAAQ;AAC/B;;;;;;;;;;;AAYA,SAAgB,YAAY,KAAmB,sBAAY,IAAI,KAAK,GAAa;CAC7E,MAAM,SAAS,OAAe,UAAkB,KAAK,MAAM,KAAK,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI;CAC1F,MAAM,QAAQ,IAAI,SAAS,aACrB,gBAAgB,IAAI,aAAa,UAAU,KAC3C,CAAC,WAAW,GAAG,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI;CAEzC,MAAM,QAAQ;EACV,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,GAAG,UAAU,KAAK,GAAG;EACvF,MAAM,MAAM,IAAI,EAAE;EAClB,MAAM,QAAQ,IAAI,IAAI;EACtB,MAAM,UAAU,IAAI,OAAO,SAAS,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC;EAClF,MAAM,SAAS,KAAK;CACxB;CACA,IAAI,IAAI,eAAe,MAAM,MAAM,KAAK,MAAM,cAAc,GAAG,IAAI,WAAW,mBAAmB,CAAC;CAClG,IAAI,IAAI,YAAY,MAAM,KAAK,MAAM,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,mBAAmB,CAAC,CAAC;CAC9F,MAAM,KAAK,MAAM,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,mBAAmB,CAAC,CAAC;CAC1E,IAAI,IAAI,cAAc,MAAM,KAAK,MAAM,aAAa,IAAI,KAAK,IAAI,YAAY,CAAC,CAAC,mBAAmB,CAAC,CAAC;CACpG,OAAO;AACX;;AAOA,IAAa,kBAAkB,CAAC;AAEhC,eAAe,SAAS,SAAkC;CACtD,iBAAiB;EACb,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,EAAE,QAAQ,YAAY,QAAQ;CACpC,IAAI;CACJ,IAAI;EACA,CAAC,CAAE,QAAS,MAAM,OAAO,QAAQ,SAAS;CAC9C,SAAS,GAAY;EACjB,KAAK,2BAA2B,GAAG,OAAO;CAC9C;CAEA,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,eAAe,CAAC;CACvC,QAAQ,IAAI,EAAE;CAEd,IAAI,KAAK,WAAW,GAAG;EACnB,QAAQ,IAAI,MAAM,KAAK,sBAAsB,CAAC;EAC9C,QAAQ,IAAI,EAAE;EACd;CACJ;CAEA,MAAM,sBAAM,IAAI,KAAK;CACrB,KAAK,MAAM,OAAO,MAAM;EACpB,KAAK,MAAM,QAAQ,YAAY,KAAK,GAAG,GAAG,QAAQ,IAAI,IAAI;EAC1D,QAAQ,IAAI,EAAE;CAClB;AACJ;;AAOA,IAAa,gBAAgB,EACzB,QAAQ,OACZ;;;;;;AAOA,SAAgB,kBAAkB,SAAoC;CAClE,MAAM,EAAE,OAAO,gBAAgB,iBAAiB;EAC5C,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,OAAO,EAAE,IAAI,MAAM,WAAW,YAAY,GAAG;AACjD;AAEA,eAAe,OAAO,SAAkC;CACpD,MAAM,EAAE,OAAO,kBAAkB,OAAO;CACxC,IAAI,CAAC,IACD,MAAM,IAAI,WAAW,uFAAuF;CAGhH,MAAM,EAAE,QAAQ,YAAY,QAAQ;CACpC,IAAI;CACJ,IAAI;EACA,CAAC,CAAE,OAAQ,MAAM,OAAO,QAAQ,OAAO,EAAE;CAC7C,SAAS,GAAY;EACjB,KAAK,0BAA0B,GAAG,OAAO;CAC7C;CAEA,QAAQ,IAAI,EAAE;CACd,KAAK,MAAM,QAAQ,YAAY,GAAG,GAAG,QAAQ,IAAI,IAAI;CACrD,QAAQ,IAAI,EAAE;AAClB;;AAOA,IAAa,mBAAmB;CAC5B,UAAU;CACV,YAAY,CAAC,MAAM;CACnB,iBAAiB;CACjB,WAAW,CAAC,MAAM;CAClB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,MAAM;AACV;;;;;;;AAQA,IAAa,yBAA2D;CACpE,iBACI;CAEJ,WACI;CAEJ,aACI;AACR;;AAGA,SAAS,qBAAqB,SAAyB;CACnD,KAAK,MAAM,SAAS,QAAQ,MAAM,CAAC,GAAG;EAElC,IAAI,UAAU,MAAM;EACpB,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;EACjC,MAAM,cAAc,OAAO,UAAU,eAAe,KAAK,wBAAwB,IAAI,IAC/E,uBAAuB,QACvB,KAAA;EACN,IAAI,aAAa,MAAM,IAAI,WAAW,WAAW;CACrD;AACJ;;;;;;AAOA,SAAS,UAAU,QAAiD;CAChE,MAAM,sBAAM,IAAI,IAAY;CAC5B,KAAK,MAAM,SAAS,UAAU,CAAC,GAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,QAAQ,GACpC,IAAI,OAAO,IAAI,IAAI,KAAK;CAGhC,OAAO,CAAC,GAAG,GAAG;AAClB;AAEA,IAAM,SAAS;AAEf,SAAS,cAAc,WAA+B,WAA+B,KAA0B;CAC3G,IAAI,cAAc,KAAA,KAAa,cAAc,KAAA,GACzC,MAAM,IAAI,WAAW,8CAA8C;CAEvE,IAAI,cAAc,KAAA,GAAW;EACzB,MAAM,OAAO,QAAQ,KAAK,UAAU,KAAK,CAAC,IAAI,OAAO,UAAU,KAAK,CAAC,IAAI;EACzE,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,GACtC,MAAM,IAAI,WAAW,yEAAyE,UAAU,IAAI;EAEhH,OAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC,YAAY;CAC/D;CACA,IAAI,cAAc,KAAA,GAAW;EACzB,MAAM,SAAS,IAAI,KAAK,SAAS;EACjC,IAAI,MAAM,OAAO,QAAQ,CAAC,GACtB,MAAM,IAAI,WAAW,sEAAsE,UAAU,IAAI;EAE7G,IAAI,OAAO,QAAQ,KAAK,IAAI,QAAQ,GAChC,MAAM,IAAI,WAAW,2CAA2C,OAAO,YAAY,EAAE,GAAG;EAE5F,OAAO,OAAO,YAAY;CAC9B;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;AA6BA,SAAgB,qBAAqB,SAAmB,sBAAY,IAAI,KAAK,GAAkB;CAC3F,qBAAqB,OAAO;CAE5B,MAAM,EAAE,OAAO,gBAAgB,iBAAiB;EAC5C,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,QAAQ,MAAM,aAAa,YAAY,MAAM,GAAA,CAAI,KAAK;CAC5D,IAAI,CAAC,MACD,MAAM,IAAI,WAAW,sEAAoE;CAG7F,MAAM,QAAQ,UAAU,MAAM,WAAW;CACzC,MAAM,aAAa,MAAM,qBAAqB;CAC9C,IAAI,cAAc,MAAM,SAAS,GAC7B,MAAM,IAAI,WAAW,6FAA6F;CAEtH,IAAI,CAAC,cAAc,MAAM,WAAW,GAChC,MAAM,IAAI,WACN,sJAEJ;CAGJ,MAAM,YAAY,MAAM;CACxB,IAAI,cAAc,KAAA,MAAc,CAAC,OAAO,cAAc,SAAS,KAAK,YAAY,IAC5E,MAAM,IAAI,WAAW,4FAA4F;CAGrH,OAAO;EACH;EACA,QAAQ,aAAa,SAAS;EAC9B,OAAO,UAAU,MAAM,UAAU;EACjC,YAAY,aAAa;EACzB,YAAY,cAAc,MAAM,iBAAiB,MAAM,iBAAiB,GAAG;CAC/E;AACJ;;;;;;;AAQA,SAAgB,gBAAgB,MAAmC;CAC/D,MAAM,aAAgC;CACtC,OAAO,KAAK,QAAO,UAAS,CAAC,WAAW,SAAS,WAAW,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC;AACvF;AAEA,eAAe,UAAU,SAAkC;CACvD,MAAM,OAAO,qBAAqB,OAAO;CACzC,MAAM,EAAE,QAAQ,YAAY,QAAQ;CAEpC,IAAI;CACJ,IAAI,KAAK,WAAW,QAAQ;EACxB,IAAI;EACJ,IAAI;GACA,CAAC,CAAE,QAAS,MAAM,OAAO,aAAa,WAAW;EACrD,SAAS,GAAY;GACjB,KAAK,sCAAsC,GAAG,OAAO;EACzD;EACA,SAAS,gBAAgB,IAAI;EAC7B,IAAI,OAAO,WAAW,GAAG;GACrB,QAAQ,MAAM,MAAM,IAAI,6EAA6E,CAAC;GACtG,QAAQ,KAAK,CAAC;EAClB;CACJ,OACI,SAAS,KAAK;CAGlB,MAAM,UAA+B;EACjC,MAAM,KAAK;EACX;EACA,GAAI,KAAK,MAAM,SAAS,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EACrD,GAAI,KAAK,eAAe,OAAO,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;EAClE,GAAI,KAAK,eAAe,OAAO,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;CACtE;CAEA,IAAI;CACJ,IAAI;EACA,CAAC,CAAE,KAAK,WAAY,MAAM,OAAO,QAAQ,UAAU,OAAO;CAC9D,SAAS,GAAY;EACjB,KAAK,4BAA4B,GAAG,OAAO;CAC/C;CAEA,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,MAAM,qBAAqB,CAAC;CACnD,QAAQ,IAAI,EAAE;CACd,KAAK,MAAM,QAAQ,YAAY,OAAO,GAAG,QAAQ,IAAI,IAAI;CACzD,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,OAAO,kDAAkD,CAAC;CACjF,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,MAAM,KAAK,QAAQ,GAAG,GAAG;CAC1C,QAAQ,IAAI,EAAE;AAClB;;AAOA,IAAa,mBAAmB,EAC5B,QAAQ,OACZ;;;;;;;;;;;AAYA,SAAgB,qBAAqB,SAAoC;CACrE,MAAM,EAAE,OAAO,gBAAgB,iBAAiB;EAC5C,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,OAAO,EAAE,IAAI,MAAM,WAAW,YAAY,GAAG;AACjD;AAEA,eAAe,UAAU,SAAkC;CACvD,MAAM,EAAE,OAAO,qBAAqB,OAAO;CAE3C,IAAI,CAAC,IACD,MAAM,IAAI,WAAW,0FAA0F;CAGnH,MAAM,EAAE,QAAQ,YAAY,QAAQ;CACpC,IAAI;EACA,MAAM,OAAO,QAAQ,UAAU,EAAE;CACrC,SAAS,GAAY;EACjB,KAAK,4BAA4B,GAAG,OAAO;CAC/C;CAEA,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,MAAM,qBAAqB,CAAC;CACnD,QAAQ,IAAI,KAAK,MAAM,KAAK,KAAK,EAAE,GAAG,IAAI;CAC1C,QAAQ,IAAI,EAAE;AAClB;;AAOA,IAAa,oBAAoB,CAAC;AAElC,IAAM,SAAuF;CACzF;EAAE,OAAO;EAAQ,OAAO;EAAQ,MAAM;CAAuE;CAC7G;EAAE,OAAO;EAAS,OAAO;EAAS,MAAM;CAAyE;CACjH;EAAE,OAAO;EAAO,OAAO;EAAO,MAAM;CAAiE;AACzG;;;;;;;AAQA,SAAgB,eAAe,QAAiC,MAAmC;CAC/F,MAAM,aAAgC;CACtC,MAAM,QAAQ,KAAK,IAAI,GAAG,GAAG,OAAO,KAAI,MAAK,EAAE,MAAM,MAAM,CAAC,IAAI;CAChE,MAAM,aAAa,KAAK,IAAI,GAAG,GAAG,OAAO,KAAI,MAAK,EAAE,MAAM,MAAM,CAAC,IAAI;CACrE,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,EAAE,OAAO,OAAO,UAAU,QAAQ;EACzC,MAAM,UAAU,OAAO,QAAO,MAAK,EAAE,UAAU,KAAK;EACpD,IAAI,QAAQ,WAAW,GAAG;EAC1B,MAAM,KAAK,KAAK,MAAM,KAAK,KAAK,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,GAAG;EAC9D,KAAK,MAAM,KAAK,SAAS;GACrB,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,IAAI,MAAM,MAAM,GAAG,IAAI;GACzD,MAAM,QAAQ,WAAW,SAAS,EAAE,KAAK,IACnC,MAAM,KAAK,gBAAgB,IAC3B,EAAE,SAAS,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI;GAChD,MAAM,KAAK,KAAK,KAAK,GAAG,EAAE,MAAM,OAAO,KAAK,IAAI,QAAQ,EAAE,MAAM,OAAO,UAAU,IAAI,EAAE,QAAQ,OAAO;EAC1G;EACA,MAAM,KAAK,EAAE;CACjB;CACA,OAAO;AACX;AAEA,eAAe,WAAW,SAAkC;CACxD,iBAAiB;EACb,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,EAAE,QAAQ,YAAY,QAAQ;CACpC,IAAI;CACJ,IAAI;EACA,YAAY,MAAM,OAAO,aAAa,WAAW;CACrD,SAAS,GAAY;EACjB,KAAK,6BAA6B,GAAG,OAAO;CAChD;CAEA,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,kDAAkD,CAAC;CACnG,QAAQ,IAAI,EAAE;CACd,KAAK,MAAM,QAAQ,eAAe,UAAU,QAAQ,UAAU,IAAI,GAAG,QAAQ,IAAI,IAAI;AACzF;AAMA,SAAS,mBAAmB;CACxB,MAAM,UAAU,aAAa,QAAO,UAAS,CAAE,sBAA4C,SAAS,KAAK,CAAC;CAC1G,QAAQ,IAAI;EACd,MAAM,KAAK,iBAAiB,EAAE;;EAE9B,MAAM,MAAM,KAAK,OAAO,EAAE;oBACR,MAAM,KAAK,WAAW,EAAE;;EAE1C,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,KAAK,MAAM,EAAE;IACxB,MAAM,KAAK,KAAK,KAAK,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE;IAC7C,MAAM,KAAK,KAAK,QAAQ,EAAE;IAC1B,MAAM,KAAK,KAAK,QAAQ,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE;IAChD,MAAM,KAAK,KAAK,QAAQ,EAAE;;EAE5B,MAAM,MAAM,KAAK,gBAAgB,EAAE;IACjC,MAAM,KAAK,YAAY,EAAE,mBAAmB,MAAM,KAAK,mCAAmC,EAAE;IAC5F,MAAM,KAAK,UAAU,EAAE;sBACL,MAAM,KAAK,iCAAiC,EAAE;IAChE,MAAM,KAAK,eAAe,EAAE;IAC5B,MAAM,KAAK,SAAS,EAAE,8CAA8C,MAAM,KAAK,SAAS,EAAE;IAC1F,MAAM,KAAK,cAAc,EAAE,mCAAmC,MAAM,KAAK,uCAAuC,EAAE;IAClH,MAAM,KAAK,cAAc,EAAE;IAC3B,MAAM,KAAK,cAAc,EAAE;;EAE7B,MAAM,MAAM,KAAK,sBAAsB,EAAE;IACvC,MAAM,KAAK,MAAM,EAAE,2BAA2B,MAAM,KAAK,yBAAyB,EAAE;;EAEtF,MAAM,MAAM,KAAK,QAAQ,EAAE;eACd,MAAM,KAAK,iBAAiB,EAAE;IACzC,MAAM,KAAK,iBAAiB,EAAE;WACvB,kBAAkB,KAAK,IAAI,EAAE;WAC7B,MAAM,KAAK,2EAA2E,EAAE;WACxF,QAAQ,KAAK,IAAI,EAAE;uDACyB,MAAM,KAAK,0BAA0B,EAAE;;EAE5F,MAAM,MAAM,KAAK,UAAU,EAAE;;;;;;;;CAQ9B;AACD"}