@rebasepro/cli 0.6.1 → 0.8.0

package/README.md

@@ -23,7 +23,6 @@ The CLI is also bundled with every Rebase project as a local dependency.
 | `rebase db push` | Apply schema directly to database (dev) |
 | `rebase db generate` | Generate SQL migration files |
 | `rebase db migrate` | Run pending migrations |
-| `rebase db studio` | Open Drizzle Studio |
 | `rebase generate-sdk` | Generate a typed TypeScript SDK from collections |
 | `rebase auth reset-password` | Reset a user's password |
 | `rebase doctor` | Detect schema drift between collections, Drizzle schema, and database |

package/dist/commands/api-keys.d.ts

@@ -0,0 +1 @@
+export declare function apiKeysCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/generate_sdk.d.ts

@@ -2,7 +2,7 @@
  * CLI command: generate-sdk
  *
  * Reads collection definitions from a specified directory (default: ./config/collections),
- * generates a typed JS SDK, and writes it to the output directory (default: ./generated/sdk).
+ * generates a typed TypeScript SDK, and writes it to the output directory (default: ./generated/sdk).
  *
  * Uses jiti for dynamic TypeScript import of collection files.
  */

package/dist/index.es.js

@@ -11,6 +11,7 @@ import { fileURLToPath } from "url";
 import crypto from "crypto";
 import { generateSDK } from "@rebasepro/sdk-generator";
 import { execSync, spawn } from "child_process";
+import { createRequire } from "module";
 //#region src/utils/package-manager.ts
 /**
 * Package manager detection and command abstraction.
@@ -130,9 +131,9 @@ function getPMCommands(pm) {
 //#endregion
 //#region src/commands/init.ts
 var access = promisify(fs.access);
-var __filename$2 = fileURLToPath(import.meta.url);
-var __dirname$2 = path.dirname(__filename$2);
-function findParentDir$1(currentDir, targetName) {
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path.dirname(__filename$1);
+function findParentDir(currentDir, targetName) {
 	const root = path.parse(currentDir).root;
 	while (currentDir && currentDir !== root) {
 		if (path.basename(currentDir) === targetName) return currentDir;
@@ -140,7 +141,7 @@ function findParentDir$1(currentDir, targetName) {
 	}
 	return null;
 }
-var cliRoot = findParentDir$1(__dirname$2, "cli");
+var cliRoot = findParentDir(__dirname$1, "cli");
 var PRESET_CHOICES = [
 	{
 		name: "Blog         — Posts, Authors, Tags (with markdown editor)",
@@ -574,7 +575,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 * CLI command: generate-sdk
 *
 * Reads collection definitions from a specified directory (default: ./config/collections),
-* generates a typed JS SDK, and writes it to the output directory (default: ./generated/sdk).
+* generates a typed TypeScript SDK, and writes it to the output directory (default: ./generated/sdk).
 *
 * Uses jiti for dynamic TypeScript import of collection files.
 */
@@ -720,7 +721,7 @@ function findProjectRoot(startDir = process.cwd()) {
 			try {
 				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
 				if (pkg.workspaces && Array.isArray(pkg.workspaces)) {
-					if (pkg.workspaces.some((w) => w === "backend" || w.includes("backend"))) return dir;
+					if (pkg.workspaces.some((w) => w === "backend")) return dir;
 				}
 			} catch {}
 			if (fs.existsSync(path.join(dir, "backend")) && fs.existsSync(path.join(dir, "config"))) return dir;
@@ -811,6 +812,41 @@ function resolveTsx(projectRoot) {
 	return resolveLocalBin(projectRoot, "tsx");
 }
 /**
+* Validate that a resolved tsx binary actually has an intact installation.
+*
+* `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+* exists. If the pnpm content-addressable store was cleaned or a previous
+* install was interrupted, the symlink can exist while critical files inside
+* the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+* confusing MODULE_NOT_FOUND error at runtime.
+*
+* This function follows the symlink, walks up to find the tsx package root
+* (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+* is present. Returns `null` when the installation looks healthy, or an
+* error description string when it appears corrupted.
+*/
+function validateTsxInstallation(tsxBinPath) {
+	try {
+		const realPath = fs.realpathSync(tsxBinPath);
+		let dir = path.dirname(realPath);
+		const fsRoot = path.parse(dir).root;
+		for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {
+			const pkgPath = path.join(dir, "package.json");
+			if (fs.existsSync(pkgPath)) try {
+				if (JSON.parse(fs.readFileSync(pkgPath, "utf-8")).name === "tsx") {
+					const preflightPath = path.join(dir, "dist", "preflight.cjs");
+					if (!fs.existsSync(preflightPath)) return `tsx package at ${dir} is missing dist/preflight.cjs`;
+					return null;
+				}
+			} catch {}
+			dir = path.dirname(dir);
+		}
+		return null;
+	} catch (err) {
+		return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;
+	}
+}
+/**
 * Require the project root or exit with a helpful error.
 */
 function requireProjectRoot() {
@@ -962,7 +998,6 @@ ${chalk.green.bold("Commands")}
   ${chalk.blue.bold("push")}       Apply schema directly to database (development)
   ${chalk.blue.bold("generate")}   Generate migration files
   ${chalk.blue.bold("migrate")}    Run pending migrations
-  ${chalk.blue.bold("studio")}     Open Studio viewer
   ${chalk.blue.bold("branch")}     Database branching (create, list, delete, info)
 
 ${chalk.green.bold("Examples")}
@@ -1156,6 +1191,16 @@ async function devCommand(rawArgs) {
 			console.error(chalk.gray(`    Install it with: ${addCmd}`));
 			process.exit(1);
 		}
+		const tsxValidationError = validateTsxInstallation(tsxBin);
+		if (tsxValidationError) {
+			const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+			console.error(chalk.red("  ✗ tsx installation appears corrupted."));
+			console.error(chalk.gray(`    ${tsxValidationError}`));
+			console.error("");
+			console.error(chalk.gray("    To fix, run:"));
+			console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+			process.exit(1);
+		}
 		const envFile = findEnvFile(projectRoot);
 		const env = { ...process.env };
 		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
@@ -1286,9 +1331,28 @@ async function devCommand(rawArgs) {
 				}
 			});
 		});
+		/** Whether we've already shown a corrupted-modules recovery hint. */
+		let corruptedModulesWarned = false;
 		backendChild.stderr?.on("data", (data) => {
 			data.toString().split("\n").filter(Boolean).forEach((line) => {
 				console.log(`${chalk.cyan.bold("[backend]")}  ${line}`);
+				if (!corruptedModulesWarned) {
+					const cleanLine = stripAnsi(line);
+					if (cleanLine.includes("Cannot find module") && cleanLine.includes("node_modules/.pnpm/")) {
+						corruptedModulesWarned = true;
+						setTimeout(() => {
+							const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+							console.error("");
+							console.error(chalk.red("  ✗ node_modules appears corrupted — a required file is missing."));
+							console.error(chalk.gray("    This usually happens when a previous install was interrupted"));
+							console.error(chalk.gray("    or the package manager store was cleaned."));
+							console.error("");
+							console.error(chalk.gray("    To fix, stop the dev server and run:"));
+							console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+							console.error("");
+						}, 200);
+					}
+				}
 			});
 		});
 		children.push(backendChild);
@@ -1431,19 +1495,90 @@ async function resetPassword(rawArgs) {
 		process.exit(1);
 	}
 	const projectRoot = requireProjectRoot();
+	let envServiceKey;
+	const envFile = findEnvFile(projectRoot);
+	if (envFile && fs.existsSync(envFile)) try {
+		const match = fs.readFileSync(envFile, "utf8").match(/^\s*REBASE_SERVICE_KEY\s*=\s*['"]?(.*?)['"]?\s*$/m);
+		if (match && match[1]) envServiceKey = match[1];
+	} catch {}
+	let baseUrl = process.env.REBASE_BASE_URL;
+	let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;
+	const statePath = path.join(projectRoot, ".rebase", "state.json");
+	if (fs.existsSync(statePath)) try {
+		const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		if (state && typeof state === "object") {
+			if (typeof state.baseUrl === "string" && !baseUrl) baseUrl = state.baseUrl;
+			if (typeof state.serviceKey === "string" && !serviceKey) serviceKey = state.serviceKey;
+		}
+	} catch {}
+	const devUrlPath = path.join(projectRoot, ".rebase-dev-url");
+	if (fs.existsSync(devUrlPath) && !baseUrl) try {
+		baseUrl = fs.readFileSync(devUrlPath, "utf8").trim();
+	} catch {}
+	if (baseUrl && serviceKey) {
+		console.log("Trying API-first reset via running backend...");
+		try {
+			const finalPass = newPassword || "NewPassword123!";
+			const cleanBaseUrl = baseUrl.replace(/\/+$/, "");
+			const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=1`;
+			const searchRes = await fetch(searchUrl, { headers: {
+				"Authorization": `Bearer ${serviceKey}`,
+				"Accept": "application/json"
+			} });
+			if (!searchRes.ok) throw new Error(`Failed to list users: ${searchRes.statusText}`);
+			const searchData = await searchRes.json();
+			if (!searchData || typeof searchData !== "object") throw new Error("Invalid response format from user search API.");
+			let userId;
+			if (Array.isArray(searchData)) {
+				const firstUser = searchData[0];
+				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
+				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
+			} else if ("users" in searchData && Array.isArray(searchData.users)) {
+				const firstUser = searchData.users[0];
+				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
+				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
+			}
+			if (!userId) throw new Error(`User not found with email: ${email}`);
+			const resetUrl = `${cleanBaseUrl}/api/admin/users/${userId}/reset-password`;
+			const resetRes = await fetch(resetUrl, {
+				method: "POST",
+				headers: {
+					"Authorization": `Bearer ${serviceKey}`,
+					"Content-Type": "application/json",
+					"Accept": "application/json"
+				},
+				body: JSON.stringify({ password: finalPass })
+			});
+			if (!resetRes.ok) {
+				const errText = await resetRes.text();
+				throw new Error(`Password reset endpoint failed: ${errText || resetRes.statusText}`);
+			}
+			console.log("API reset successful.");
+			console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (via API)"));
+			console.log("");
+			console.log(`  ${chalk.gray("Email:")} ${email}`);
+			console.log(`  ${chalk.gray("Password:")} ${finalPass}`);
+			console.log("");
+			return;
+		} catch (err) {
+			const errMsg = err instanceof Error ? err.message : String(err);
+			console.warn(chalk.yellow("API reset failed, falling back to direct database update..."));
+			console.warn(chalk.gray(`  Details: ${errMsg}`));
+		}
+	}
 	const backendDir = requireBackendDir(projectRoot);
 	const tsxBin = resolveTsx(projectRoot);
 	if (!tsxBin) {
 		console.error(chalk.red("✗ Could not find tsx binary."));
 		process.exit(1);
 	}
-	const envFile = findEnvFile(projectRoot);
-	const env = { ...process.env };
-	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
-	env.REBASE_RESET_EMAIL = email;
-	env.REBASE_RESET_PASSWORD = newPassword || "NewPassword123!";
-	env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
-	const scriptContent = `
+	try {
+		const env = { ...process.env };
+		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+		env.REBASE_RESET_EMAIL = email;
+		env.REBASE_RESET_PASSWORD = newPassword || "NewPassword123!";
+		env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
+		const scriptContent = `
 import { createPostgresDatabaseConnection } from "@rebasepro/server-postgresql";
 import { hashPassword } from "@rebasepro/server-core";
 import { eq } from "drizzle-orm";
@@ -1497,28 +1632,33 @@ async function resetPassword() {
 
 resetPassword().catch(console.error);
 `;
-	const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
-	fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
-	console.log("");
-	console.log(chalk.bold("  🔑 Rebase Auth — Reset Password"));
-	console.log("");
-	console.log(`  ${chalk.gray("Email:")} ${email}`);
-	if (newPassword) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
-	console.log("");
-	const child = spawn(tsxBin, [tmpScriptPath], {
-		cwd: backendDir,
-		stdio: "inherit",
-		env
-	});
-	return new Promise((resolve) => {
-		child.on("close", (code) => {
-			try {
-				fs.unlinkSync(tmpScriptPath);
-			} catch {}
-			if (code !== 0) process.exit(code ?? 1);
-			resolve();
+		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
+		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
+		console.log("");
+		console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (Direct DB Fallback)"));
+		console.log("");
+		console.log(`  ${chalk.gray("Email:")} ${email}`);
+		if (newPassword) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
+		console.log("");
+		const child = spawn(tsxBin, [tmpScriptPath], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
 		});
-	});
+		return new Promise((resolve) => {
+			child.on("close", (code) => {
+				try {
+					fs.unlinkSync(tmpScriptPath);
+				} catch {}
+				if (code !== 0) process.exit(code ?? 1);
+				resolve();
+			});
+		});
+	} catch (err) {
+		console.error(chalk.red("✗ Direct database update failed."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
 }
 function printAuthHelp() {
 	console.log(`
@@ -1587,8 +1727,7 @@ async function doctorCommand(rawArgs) {
 }
 //#endregion
 //#region src/commands/skills.ts
-var __filename$1 = fileURLToPath(import.meta.url);
-var __dirname$1 = path.dirname(__filename$1);
+var require = createRequire(import.meta.url);
 /** Supported agent environments and their target directories. */
 var AGENTS = {
 	cursor: {
@@ -1632,24 +1771,16 @@ var AGENTS = {
 		})
 	}
 };
-function findParentDir(currentDir, targetName) {
-	const root = path.parse(currentDir).root;
-	while (currentDir && currentDir !== root) {
-		if (path.basename(currentDir) === targetName) return currentDir;
-		currentDir = path.dirname(currentDir);
-	}
-	return null;
-}
-/** Resolve the path to the bundled skills directory. */
+/**
+* Resolve the path to the skills directory from @rebasepro/agent-skills.
+* Works in both workspace (symlink) and published (real files) layouts.
+*/
 function getSkillsSourceDir() {
-	const cliRoot = findParentDir(__dirname$1, "cli");
-	if (cliRoot) {
-		const dir = path.join(cliRoot, "skills");
-		if (fs.existsSync(dir)) return dir;
-	}
-	const distSkills = path.resolve(__dirname$1, "../../skills");
-	if (fs.existsSync(distSkills)) return distSkills;
-	throw new Error("Could not find bundled skills directory. Make sure the CLI was built with `pnpm build`.");
+	const pkgJsonPath = require.resolve("@rebasepro/agent-skills/package.json");
+	const pkgRoot = path.dirname(pkgJsonPath);
+	const skillsDir = path.join(pkgRoot, "skills");
+	if (!fs.existsSync(skillsDir)) throw new Error(`Skills directory not found at ${skillsDir}. Make sure @rebasepro/agent-skills is installed.`);
+	return skillsDir;
 }
 /** Read all skill directories and return their names + content. */
 function loadSkills(skillsDir) {
@@ -1764,6 +1895,272 @@ ${chalk.green.bold("Examples")}
 `);
 }
 //#endregion
+//#region src/commands/api-keys.ts
+/**
+* CLI command: rebase api-keys <action>
+*
+* Subcommands:
+*   list    — List all API keys (masked)
+*   create  — Create a new API key
+*   revoke  — Revoke an existing API key
+*/
+function loadEnv(projectRoot) {
+	const envFile = findEnvFile(projectRoot);
+	const env = {};
+	if (envFile && fs.existsSync(envFile)) {
+		const content = fs.readFileSync(envFile, "utf-8");
+		for (const line of content.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed || trimmed.startsWith("#")) continue;
+			const idx = trimmed.indexOf("=");
+			if (idx > 0) {
+				const key = trimmed.slice(0, idx).trim();
+				let value = trimmed.slice(idx + 1).trim();
+				if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+				env[key] = value;
+			}
+		}
+	}
+	return env;
+}
+function resolveBaseUrl(env) {
+	const port = env.PORT || env.REBASE_PORT || "3001";
+	return env.REBASE_BASE_URL || `http://localhost:${port}`;
+}
+async function apiKeysCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help") {
+		printApiKeysHelp();
+		return;
+	}
+	switch (subcommand) {
+		case "list":
+			await listKeys(rawArgs);
+			break;
+		case "create":
+			await createKey(rawArgs);
+			break;
+		case "revoke":
+			await revokeKey(rawArgs);
+			break;
+		default:
+			console.error(chalk.red(`Unknown api-keys command: ${subcommand}`));
+			console.log("");
+			printApiKeysHelp();
+			process.exit(1);
+	}
+}
+async function listKeys(_rawArgs) {
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const res = await fetch(`${baseUrl}/api/admin/api-keys`, { headers: { Authorization: `Bearer ${serviceKey}` } });
+		if (!res.ok) {
+			const body = await res.text();
+			console.error(chalk.red(`✗ Failed to list API keys: ${res.status} ${body}`));
+			process.exit(1);
+		}
+		const { keys } = await res.json();
+		console.log("");
+		console.log(chalk.bold("  🔑 API Keys"));
+		console.log("");
+		if (keys.length === 0) {
+			console.log(chalk.gray("  No API keys found."));
+			console.log("");
+			return;
+		}
+		for (const key of keys) {
+			const status = key.revoked_at ? chalk.red("revoked") : key.expires_at && new Date(key.expires_at) < /* @__PURE__ */ new Date() ? chalk.yellow("expired") : chalk.green("active");
+			const perms = key.permissions.map((p) => `${p.collection}(${p.operations.join(",")})`).join(", ");
+			console.log(`  ${chalk.bold(key.name)} ${chalk.gray(`[${key.key_prefix}•••]`)} ${status}`);
+			console.log(`  ${chalk.gray("ID:")} ${key.id}`);
+			console.log(`  ${chalk.gray("Permissions:")} ${perms || "none"}`);
+			console.log(`  ${chalk.gray("Created:")} ${new Date(key.created_at).toLocaleDateString()}`);
+			if (key.last_used_at) console.log(`  ${chalk.gray("Last used:")} ${new Date(key.last_used_at).toLocaleDateString()}`);
+			console.log("");
+		}
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+async function createKey(rawArgs) {
+	const args = arg({
+		"--name": String,
+		"--permissions": String,
+		"--admin": Boolean,
+		"--rate-limit": Number,
+		"--expires": String,
+		"-n": "--name"
+	}, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const name = args["--name"] || args._[0];
+	const permissionsRaw = args["--permissions"];
+	if (!name) {
+		console.error(chalk.red("✗ Name is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase api-keys create --name \"My Key\" --permissions '[{\"collection\":\"*\",\"operations\":[\"read\"]}]'"));
+		process.exit(1);
+	}
+	let permissions;
+	if (permissionsRaw) try {
+		permissions = JSON.parse(permissionsRaw);
+	} catch {
+		console.error(chalk.red("✗ Invalid --permissions JSON."));
+		console.log(chalk.gray("  Example: '[{\"collection\":\"*\",\"operations\":[\"read\",\"write\"]}]'"));
+		process.exit(1);
+		return;
+	}
+	else permissions = [{
+		collection: "*",
+		operations: [
+			"read",
+			"write",
+			"delete"
+		]
+	}];
+	let expires_at = null;
+	const expiresFlag = args["--expires"];
+	if (expiresFlag) {
+		const days = {
+			"7d": 7,
+			"30d": 30,
+			"90d": 90,
+			"1y": 365
+		};
+		if (days[expiresFlag]) expires_at = new Date(Date.now() + days[expiresFlag] * 864e5).toISOString();
+		else {
+			const parsed = new Date(expiresFlag);
+			if (isNaN(parsed.getTime())) {
+				console.error(chalk.red("✗ Invalid --expires value. Use 7d, 30d, 90d, 1y, or an ISO date."));
+				process.exit(1);
+			}
+			expires_at = parsed.toISOString();
+		}
+	}
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const body = {
+			name,
+			permissions,
+			admin: args["--admin"] ?? false,
+			rate_limit: args["--rate-limit"] ?? null,
+			expires_at
+		};
+		const res = await fetch(`${baseUrl}/api/admin/api-keys`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${serviceKey}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) {
+			const errBody = await res.text();
+			console.error(chalk.red(`✗ Failed to create API key: ${res.status} ${errBody}`));
+			process.exit(1);
+		}
+		const { key } = await res.json();
+		console.log("");
+		console.log(chalk.bold.green("  ✓ API key created successfully"));
+		console.log("");
+		console.log(`  ${chalk.gray("Name:")}   ${key.name}`);
+		console.log(`  ${chalk.gray("ID:")}     ${key.id}`);
+		console.log(`  ${chalk.gray("Prefix:")} ${key.key_prefix}`);
+		console.log("");
+		console.log(chalk.bold.yellow("  ⚠ Copy your key now — it won't be shown again:"));
+		console.log("");
+		console.log(`  ${chalk.cyan(key.key)}`);
+		console.log("");
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+async function revokeKey(rawArgs) {
+	const args = arg({ "--id": String }, {
+		argv: rawArgs.slice(4),
+		permissive: true
+	});
+	const id = args["--id"] || args._[0];
+	if (!id) {
+		console.error(chalk.red("✗ Key ID is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase api-keys revoke <key-id>"));
+		process.exit(1);
+	}
+	const env = loadEnv(requireProjectRoot());
+	const baseUrl = resolveBaseUrl(env);
+	const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;
+	if (!serviceKey) {
+		console.error(chalk.red("✗ SERVICE_KEY not found in .env — required for admin operations."));
+		process.exit(1);
+	}
+	try {
+		const res = await fetch(`${baseUrl}/api/admin/api-keys/${encodeURIComponent(id)}`, {
+			method: "DELETE",
+			headers: { Authorization: `Bearer ${serviceKey}` }
+		});
+		if (!res.ok) {
+			const errBody = await res.text();
+			console.error(chalk.red(`✗ Failed to revoke API key: ${res.status} ${errBody}`));
+			process.exit(1);
+		}
+		console.log("");
+		console.log(chalk.bold.green("  ✓ API key revoked successfully"));
+		console.log(`  ${chalk.gray("ID:")} ${id}`);
+		console.log("");
+	} catch (e) {
+		console.error(chalk.red(`✗ ${e instanceof Error ? e.message : String(e)}`));
+		console.error(chalk.gray("  Is the Rebase server running?"));
+		process.exit(1);
+	}
+}
+function printApiKeysHelp() {
+	console.log(`
+${chalk.bold("rebase api-keys")} — Manage Service API Keys
+
+${chalk.green.bold("Usage")}
+  rebase api-keys ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("list")}              List all API keys
+  ${chalk.blue.bold("create")}            Create a new API key
+  ${chalk.blue.bold("revoke")}            Revoke an API key
+
+${chalk.green.bold("create Options")}
+  ${chalk.blue("--name, -n")}        Key name ${chalk.gray("(required)")}
+  ${chalk.blue("--permissions")}     JSON array of permissions
+                    ${chalk.gray("Default: [{\"collection\":\"*\",\"operations\":[\"read\",\"write\",\"delete\"]}]")}
+  ${chalk.blue("--admin")}           Grant admin role (access to admin routes)
+  ${chalk.blue("--rate-limit")}      Requests per 15-min window ${chalk.gray("(default: 1000)")}
+  ${chalk.blue("--expires")}         Expiration: 7d, 30d, 90d, 1y, or ISO date
+
+${chalk.green.bold("revoke Options")}
+  ${chalk.blue("--id")}              API key ID to revoke ${chalk.gray("(or positional arg)")}
+
+${chalk.green.bold("Examples")}
+  rebase api-keys list
+  rebase api-keys create --name "Analytics" --permissions '[{"collection":"events","operations":["read"]}]'
+  rebase api-keys create -n "Full Access" --expires 90d
+  rebase api-keys revoke abc123-def456
+`);
+}
+//#endregion
 //#region src/cli.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path.dirname(__filename);
@@ -1798,7 +2195,8 @@ async function entry(args) {
 		"start",
 		"auth",
 		"doctor",
-		"skills"
+		"skills",
+		"api-keys"
 	].includes(command)) {
 		printHelp();
 		return;
@@ -1849,6 +2247,9 @@ async function entry(args) {
 		case "skills":
 			await skillsCommand(effectiveSubcommand, args);
 			break;
+		case "api-keys":
+			await apiKeysCommand(effectiveSubcommand, args);
+			break;
 		default:
 			console.log(chalk.red(`Unknown command: ${command}`));
 			console.log("");
@@ -1877,11 +2278,10 @@ ${chalk.green.bold("Database")}
   ${chalk.blue.bold("db push")}                 Apply schema directly to database ${chalk.gray("(dev)")}
   ${chalk.blue.bold("db generate")}             Generate SQL migration files
   ${chalk.blue.bold("db migrate")}              Run pending migrations
-  ${chalk.blue.bold("db studio")}               Open Drizzle Studio
   ${chalk.blue.bold("db")} ${chalk.gray("--help")}               Show database command help
 
 ${chalk.green.bold("SDK")}
-  ${chalk.blue.bold("generate-sdk")}            Generate a typed JS SDK from collections
+  ${chalk.blue.bold("generate-sdk")}            Generate a typed TypeScript SDK from collections
 
 ${chalk.green.bold("Auth")}
   ${chalk.blue.bold("auth reset-password")}     Reset a user's password
@@ -1893,6 +2293,12 @@ ${chalk.green.bold("Diagnostics")}
 ${chalk.green.bold("AI Agent Skills")}
   ${chalk.blue.bold("skills install")}           Install Rebase agent skills for your AI coding assistant
 
+${chalk.green.bold("API Keys")}
+  ${chalk.blue.bold("api-keys list")}            List all service API keys
+  ${chalk.blue.bold("api-keys create")}          Create a new scoped API key
+  ${chalk.blue.bold("api-keys revoke")}          Revoke an existing API key
+  ${chalk.blue.bold("api-keys")} ${chalk.gray("--help")}          Show API key command help
+
 ${chalk.green.bold("Options")}
   ${chalk.blue("--version, -v")}   Show version number
   ${chalk.blue("--help, -h")}      Show this help message
@@ -1901,6 +2307,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { authCommand, buildCommand, buildInitQuestions, configureEnvFile, createRebaseApp, dbCommand, detectPackageManager, devCommand, doctorCommand, entry, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, generateSdkCommand, getActiveBackendPlugin, getPMCommands, requireBackendDir, requireProjectRoot, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand };
+export { authCommand, buildCommand, buildInitQuestions, configureEnvFile, createRebaseApp, dbCommand, detectPackageManager, devCommand, doctorCommand, entry, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, generateSdkCommand, getActiveBackendPlugin, getPMCommands, requireBackendDir, requireProjectRoot, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, validateTsxInstallation };
 
 //# sourceMappingURL=index.es.js.map