@uptimizr/collector-server 1.1.1 → 2.0.1

package/dist/audit.js

@@ -0,0 +1,96 @@
+import { serializeAuditParams } from "@uptimizr/db";
+import { isDashboardRequest } from "./auth.js";
+/**
+ * Agent audit log plumbing (#309, ADR 0051 §7).
+ *
+ * Every authenticated request made with a key that is not the dashboard's own
+ * session is recorded: which key, which endpoint, the (bounded, redacted)
+ * parameters, the row count, the duration and the status.
+ *
+ * Two invariants hold everywhere in here:
+ *
+ * - **It never blocks the response.** The row is written from an `onResponse`
+ *   hook, after the reply has been flushed.
+ * - **It never fails a request.** Every store call is fire-and-forget with its
+ *   rejection swallowed into a log line; an unavailable audit table degrades
+ *   the log, not the API.
+ */
+/** How often the retention sweep runs. Daily is plenty for a 30-day window. */
+const PRUNE_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+/**
+ * Register the audit hooks on `app`:
+ *
+ * - `preSerialization` captures the row count when a handler returned an array
+ *   (streamed/hijacked responses simply have none);
+ * - `onResponse` writes the row for authenticated, non-dashboard requests.
+ */
+export function registerAuditHooks(app, store, config) {
+    app.addHook("preSerialization", async (request, _reply, payload) => {
+        if (Array.isArray(payload))
+            request.auditRowCount = payload.length;
+        return payload;
+    });
+    app.addHook("onResponse", async (request, reply) => {
+        const resolved = request.resolvedKey;
+        if (!resolved)
+            return;
+        if (!config.auditDashboardRequests && isDashboardRequest(request))
+            return;
+        // `reply.elapsedTime` is the ms between the request arriving and the
+        // response being sent — exactly the duration the audit log wants.
+        const durationMs = Math.round(reply.elapsedTime);
+        try {
+            void store
+                .recordAudit({
+                projectId: resolved.projectId,
+                keyId: resolved.keyId,
+                surface: "http",
+                // The route pattern (`/api/v1/sessions/:id/events`), not the raw URL:
+                // it groups cleanly and cannot carry a querystring credential.
+                toolOrPath: request.routeOptions.url ?? new URL(request.url, "http://x").pathname,
+                params: serializeAuditParams(request.query),
+                rowCount: request.auditRowCount,
+                durationMs,
+                status: reply.statusCode,
+            })
+                .catch((err) => {
+                request.log.warn({ err }, "failed to write agent audit row");
+            });
+        }
+        catch (err) {
+            // A synchronous throw from the store (or a store that does not implement
+            // the audit surface at all) must never surface on the request path.
+            request.log.warn({ err }, "failed to write agent audit row");
+        }
+    });
+}
+/**
+ * Start the retention sweep: delete audit rows older than
+ * `config.auditRetentionDays` now, then every {@link PRUNE_INTERVAL_MS}. The
+ * delete is idempotent, so a restart loop or several collector instances
+ * sharing one database cost nothing. Returns a stop function; the timer is
+ * `unref`'d so it never keeps the process alive.
+ *
+ * `auditRetentionDays === 0` disables the sweep (keep rows indefinitely).
+ */
+export function startAuditRetention(app, store, config) {
+    if (config.auditRetentionDays <= 0)
+        return () => { };
+    const sweep = () => {
+        const cutoff = Date.now() - config.auditRetentionDays * MS_PER_DAY;
+        try {
+            void store.pruneAudit(cutoff).catch((err) => {
+                app.log.warn({ err }, "agent audit retention sweep failed");
+            });
+        }
+        catch (err) {
+            app.log.warn({ err }, "agent audit retention sweep failed");
+        }
+    };
+    sweep();
+    const timer = setInterval(sweep, PRUNE_INTERVAL_MS);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,KAAqB,EACrB,MAAuB;IAEvB,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,kBAAkB,CAAC,OAAO,CAAC;YAAE,OAAO;QAC1E,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,KAAK,KAAK;iBACP,WAAW,CAAC;gBACX,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,MAAM;gBACf,sEAAsE;gBACtE,+DAA+D;gBAC/D,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ;gBACjF,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC3C,QAAQ,EAAE,OAAO,CAAC,aAAa;gBAC/B,UAAU;gBACV,MAAM,EAAE,KAAK,CAAC,UAAU;aACzB,CAAC;iBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,oEAAoE;YACpE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,KAAqB,EACrB,MAAuB;IAEvB,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC;QACnE,IAAI,CAAC;YACH,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,EAAE,CAAC;IACR,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACpD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,64 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { ApiKeyCapability, ResolvedApiKey } from "@uptimizr/db";
+import type { CollectorStore } from "./store.js";
+/**
+ * Request-boundary authentication and capability checks for the collector
+ * (#309, ADR 0051 §7).
+ *
+ * A key resolves to a **capability set**, not a single capability, so the same
+ * plumbing serves reads (`query`), raw per-session access (`query:raw`, which
+ * additionally requires `ENABLE_RAW_SESSION_RETENTION` — ADR 0003) and the
+ * metadata write path (`annotate`, whose endpoints arrive with #310).
+ *
+ * Resolution happens once per request, in an `onRequest` hook, so that:
+ *
+ * 1. the rate limiter can key on the API key id and honour the key's own
+ *    per-key budget before any handler runs, and
+ * 2. handlers and the audit hook read the already-resolved key instead of
+ *    hitting the metadata store again.
+ */
+declare module "fastify" {
+    interface FastifyRequest {
+        /**
+         * What this request's `x-api-key` resolved to, or `null` when
+         * unauthenticated. This is the key's **record** — project, key id,
+         * capabilities, rate limit — and deliberately never the key itself, which
+         * is read from the header and discarded.
+         */
+        resolvedKey: ResolvedApiKey | null;
+        /** Rows in the response body, when it serialized to an array (audit log). */
+        auditRowCount: number | null;
+    }
+}
+/** Header a first-party UI sets to identify itself (see `isDashboardRequest`). */
+export declare const CLIENT_HEADER = "x-uptimizr-client";
+/**
+ * Whether this request is "the dashboard's own session" — the requests the
+ * audit log deliberately skips so an agent's activity is not buried under a
+ * dashboard's panel refreshes.
+ *
+ * It is identified by the `x-uptimizr-client: dashboard` header that
+ * `@uptimizr/react`'s `CollectorApi` sets by default; the in-browser assistant
+ * and any other agent client send a different value (or none) and are audited.
+ *
+ * This is a **volume filter, not a security boundary**: anyone holding the key
+ * could send the header, and anyone holding the key can already do everything
+ * the key allows. Set `AUDIT_DASHBOARD_REQUESTS=1` to record every
+ * authenticated request without exception.
+ */
+export declare function isDashboardRequest(request: FastifyRequest): boolean;
+/**
+ * Resolve the request's `x-api-key` into {@link FastifyRequest.resolvedKey}.
+ * Never replies and never throws: an absent, unknown or revoked key simply
+ * leaves `resolvedKey` null, and the helpers below turn that into a 401.
+ */
+export declare function attachApiKey(request: FastifyRequest, store: CollectorStore): Promise<void>;
+/**
+ * Require an authenticated key holding `capability`. Sends a 401 (no/invalid
+ * key) or 403 (key lacks the capability) and returns `null` on refusal.
+ *
+ * Reads are always scoped to the authenticated project — a client-supplied
+ * project id is never trusted.
+ */
+export declare function requireCapability(request: FastifyRequest, reply: FastifyReply, store: CollectorStore, capability: ApiKeyCapability): Promise<ResolvedApiKey | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB;;;;;WAKG;QACH,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;QACnC,6EAA6E;QAC7E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B;CACF;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAEnE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAUD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAmBhC"}

package/dist/auth.js

@@ -0,0 +1,71 @@
+/** Header a first-party UI sets to identify itself (see `isDashboardRequest`). */
+export const CLIENT_HEADER = "x-uptimizr-client";
+/**
+ * Whether this request is "the dashboard's own session" — the requests the
+ * audit log deliberately skips so an agent's activity is not buried under a
+ * dashboard's panel refreshes.
+ *
+ * It is identified by the `x-uptimizr-client: dashboard` header that
+ * `@uptimizr/react`'s `CollectorApi` sets by default; the in-browser assistant
+ * and any other agent client send a different value (or none) and are audited.
+ *
+ * This is a **volume filter, not a security boundary**: anyone holding the key
+ * could send the header, and anyone holding the key can already do everything
+ * the key allows. Set `AUDIT_DASHBOARD_REQUESTS=1` to record every
+ * authenticated request without exception.
+ */
+export function isDashboardRequest(request) {
+    return request.headers[CLIENT_HEADER] === "dashboard";
+}
+/**
+ * Resolve the request's `x-api-key` into {@link FastifyRequest.resolvedKey}.
+ * Never replies and never throws: an absent, unknown or revoked key simply
+ * leaves `resolvedKey` null, and the helpers below turn that into a 401.
+ */
+export async function attachApiKey(request, store) {
+    const header = request.headers["x-api-key"];
+    if (typeof header !== "string" || header.length === 0)
+        return;
+    try {
+        request.resolvedKey = await store.resolveApiKey(header);
+    }
+    catch (err) {
+        request.log.warn({ err }, "api key resolution failed");
+    }
+}
+/** The 403 body for each capability a request can be refused for. */
+const CAPABILITY_REFUSALS = {
+    query: "api key not permitted to read",
+    "query:raw": "api key not permitted to read raw session data",
+    annotate: "api key not permitted to write metadata",
+    ingest: "api key not permitted to ingest",
+};
+/**
+ * Require an authenticated key holding `capability`. Sends a 401 (no/invalid
+ * key) or 403 (key lacks the capability) and returns `null` on refusal.
+ *
+ * Reads are always scoped to the authenticated project — a client-supplied
+ * project id is never trusted.
+ */
+export async function requireCapability(request, reply, store, capability) {
+    const header = request.headers["x-api-key"];
+    if (typeof header !== "string" || header.length === 0) {
+        await reply.code(401).send({ error: "missing api key" });
+        return null;
+    }
+    // The `onRequest` hook has normally resolved this already; fall back to a
+    // direct lookup so the helper is usable from a plugin registered without it.
+    if (!request.resolvedKey)
+        await attachApiKey(request, store);
+    const resolved = request.resolvedKey;
+    if (!resolved) {
+        await reply.code(401).send({ error: "invalid api key" });
+        return null;
+    }
+    if (!resolved.capabilities.includes(capability)) {
+        await reply.code(403).send({ error: CAPABILITY_REFUSALS[capability] });
+        return null;
+    }
+    return resolved;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAmCA,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,WAAW,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,KAAqB;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,yCAAyC;IACnD,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,KAAmB,EACnB,KAAqB,EACrB,UAA4B;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cli.js

@@ -2,6 +2,8 @@
 import { randomBytes } from "node:crypto";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { parseCapabilityList } from "@uptimizr/db";
+import { sceneIdSchema, sceneRegionsSchema } from "@uptimizr/schema";
 import { openCliStore, renderEnv, resolveCliStoreKind } from "./cliStore.js";
 /**
  * Unified `uptimizr` CLI (ADR 0029) — collapses the multi-step npm self-host
@@ -13,7 +15,11 @@ import { openCliStore, renderEnv, resolveCliStoreKind } from "./cliStore.js";
  *                          store, mint a first project + API key, and write `.env`.
  * - `serve` (default)    — run the ingestion + query API (see {@link serve}).
  * - `new-project <name>` — mint an additional project + API key.
+ * - `new-key <id>`       — mint an additional API key on an existing project,
+ *                          with an explicit capability set, label and per-key
+ *                          rate limit (#309, ADR 0051 §7).
  * - `migrate`            — apply store migrations.
+ * - `regions set|get`    — declare / read a scene's named regions (ADR 0051 §2).
  *
  * Every command targets the store selected by `COLLECTOR_STORE` — the OSS
  * DuckDB default (no Docker, no external database; ADR 0020), or the optional
@@ -35,6 +41,47 @@ function nameArg(args) {
         .join(" ")
         .trim();
 }
+/**
+ * Split `--flag value` / `--flag=value` pairs out of an argument list, returning
+ * the flags plus whatever positional arguments remain. Deliberately tiny: the
+ * CLI has no dependency on an argument parser.
+ */
+function parseFlags(args) {
+    const flags = {};
+    const rest = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (!arg.startsWith("--") || arg === "--") {
+            if (arg !== "--")
+                rest.push(arg);
+            continue;
+        }
+        const eq = arg.indexOf("=");
+        if (eq > 2) {
+            flags[arg.slice(2, eq)] = arg.slice(eq + 1);
+        }
+        else {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith("--")) {
+                throw new Error(`Missing value for ${arg}`);
+            }
+            flags[arg.slice(2)] = next;
+            i += 1;
+        }
+    }
+    return { flags, rest };
+}
+/** Parse a positive-integer flag, or throw with an actionable message. */
+function intFlag(flags, name) {
+    const raw = flags[name];
+    if (raw === undefined)
+        return undefined;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new Error(`--${name} must be a positive integer (got "${raw}")`);
+    }
+    return value;
+}
 /** Persist a generated secret so `serve` works on the next run. */
 function ensureSecretPersisted(secret, generated, store) {
     try {
@@ -89,6 +136,62 @@ async function cmdNewProject(name) {
     console.error(`  API key (shown once): ${key}`);
     process.stdout.write(`${JSON.stringify({ projectId: project.id, name: project.name, apiKey: key })}\n`);
 }
+/**
+ * Mint an additional API key on an existing project with an explicit capability
+ * set, label and optional per-key rate limit (#309, ADR 0051 §7):
+ *
+ * ```
+ * uptimizr new-key <projectId> --capabilities query,annotate --label "weekly-report-agent"
+ * ```
+ *
+ * Capabilities default to `query` (read-only), matching `init` / `new-project`.
+ * `query:raw` additionally needs `ENABLE_RAW_SESSION_RETENTION` on the collector
+ * before it grants anything (ADR 0003).
+ */
+async function cmdNewKey(args) {
+    loadLocalEnv();
+    const { flags, rest } = parseFlags(args);
+    const projectId = rest[0];
+    if (!projectId) {
+        throw new Error("Usage: uptimizr new-key <projectId> [--capabilities query,annotate] [--label NAME] " +
+            "[--rate-limit-max N --rate-limit-window-ms M]");
+    }
+    const capabilities = parseCapabilityList(flags.capabilities ?? "query");
+    const rateLimitMax = intFlag(flags, "rate-limit-max");
+    const rateLimitWindowMs = intFlag(flags, "rate-limit-window-ms");
+    if ((rateLimitMax == null) !== (rateLimitWindowMs == null)) {
+        throw new Error("--rate-limit-max and --rate-limit-window-ms must be given together");
+    }
+    const db = await openCliStore();
+    try {
+        const { key, record } = await db.createApiKey(projectId, {
+            capabilities,
+            label: flags.label ?? null,
+            rateLimit: rateLimitMax != null && rateLimitWindowMs != null
+                ? { max: rateLimitMax, windowMs: rateLimitWindowMs }
+                : null,
+        });
+        console.error(`✓ API key created for project ${projectId}`);
+        console.error(`  Capabilities: ${record.capabilities.join(", ")}`);
+        if (record.label)
+            console.error(`  Label:        ${record.label}`);
+        if (record.rateLimit) {
+            console.error(`  Rate limit:   ${record.rateLimit.max} requests / ${record.rateLimit.windowMs} ms`);
+        }
+        console.error(`  API key (shown once): ${key}`);
+        process.stdout.write(`${JSON.stringify({
+            projectId,
+            keyId: record.id,
+            capabilities: record.capabilities,
+            label: record.label,
+            rateLimit: record.rateLimit,
+            apiKey: key,
+        })}\n`);
+    }
+    finally {
+        await db.close();
+    }
+}
 async function cmdMigrate() {
     loadLocalEnv();
     // Opening the store applies its migrations, exactly as `serve` does on boot.
@@ -96,6 +199,158 @@ async function cmdMigrate() {
     await db.close();
     console.error(`✓ migrations applied (${resolveCliStoreKind()})`);
 }
+/** Read `--<name> <value>` (or `--<name>=<value>`) out of a command's argv tail. */
+function flagArg(args, name) {
+    const prefix = `--${name}`;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === prefix)
+            return args[i + 1];
+        if (arg.startsWith(`${prefix}=`))
+            return arg.slice(prefix.length + 1);
+    }
+    return undefined;
+}
+/** Positional arguments of a command: everything that is not a flag or its value. */
+function positionalArgs(args, flags) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--")
+            continue;
+        const matched = flags.find((f) => arg === `--${f}`);
+        if (matched) {
+            i++; // skip the flag's value
+            continue;
+        }
+        if (flags.some((f) => arg.startsWith(`--${f}=`)))
+            continue;
+        out.push(arg);
+    }
+    return out;
+}
+/**
+ * Resolve the project a `regions` command targets: `--project <id>`, else
+ * `UPTIMIZR_PROJECT_ID`. There is no "current project" concept in the OSS
+ * collector (a store can hold several), so the id is explicit rather than
+ * guessed — writing a scene's regions under the wrong project would silently
+ * produce an empty-looking registry.
+ */
+function resolveProjectId(args) {
+    const projectId = flagArg(args, "project") ?? process.env.UPTIMIZR_PROJECT_ID;
+    if (!projectId) {
+        throw new Error("No project selected. Pass --project <projectId> (or set UPTIMIZR_PROJECT_ID). " +
+            "`uptimizr init` prints the id it minted.");
+    }
+    return projectId;
+}
+/**
+ * Parse a regions file: either a bare array of regions or the
+ * `{ "regions": [...] }` envelope the HTTP endpoint takes, so the same file
+ * works with `curl -d @regions.json` and with this command. Validated against
+ * `sceneRegionsSchema`, so a bad box or a duplicate id fails here with a precise
+ * message instead of half-writing the set.
+ */
+function readRegionsFile(path) {
+    const absolute = resolve(process.cwd(), path);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(absolute, "utf8"));
+    }
+    catch (err) {
+        throw new Error(`Could not read regions from ${absolute}: ${err.message}`, {
+            cause: err,
+        });
+    }
+    const candidate = Array.isArray(parsed) || parsed == null
+        ? parsed
+        : (parsed.regions ?? parsed);
+    const result = sceneRegionsSchema.safeParse(candidate);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((issue) => `  - ${issue.path.join(".") || "(root)"}: ${issue.message}`)
+            .join("\n");
+        throw new Error(`Invalid regions in ${absolute}:\n${issues}`);
+    }
+    return result.data;
+}
+/** Validate a scene id the same way the collector's route params do. */
+function parseSceneId(value) {
+    const result = sceneIdSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`Invalid scene id ${JSON.stringify(value ?? "")}: expected 1-64 chars of [A-Za-z0-9._:-].`);
+    }
+    return result.data;
+}
+/**
+ * `uptimizr regions set <sceneId> --file regions.json` — replace a scene's
+ * region set in the store the collector serves (ADR 0051 §2). Replace-the-set:
+ * a region left out of the file is removed, and an empty array clears the scene.
+ *
+ * The offline sibling of `PUT /api/v1/scenes/:sceneId/regions`, which requires
+ * an `annotate`-capable key. This command takes no key at all: like
+ * `new-project` and `new-key` it is an **operator** command that opens the store
+ * directly, and store access is already strictly more than any capability grants.
+ */
+async function cmdRegionsSet(args) {
+    loadLocalEnv();
+    const positional = positionalArgs(args, ["file", "project"]);
+    const sceneId = parseSceneId(positional[0]);
+    const file = flagArg(args, "file");
+    if (!file)
+        throw new Error("`uptimizr regions set` needs --file <regions.json>.");
+    const regions = readRegionsFile(file);
+    const projectId = resolveProjectId(args);
+    const db = await openCliStore();
+    try {
+        if (!(await db.getProject(projectId))) {
+            throw new Error(`No project ${JSON.stringify(projectId)} in this store.`);
+        }
+        const stored = await db.putSceneRegions(projectId, sceneId, regions);
+        console.error(`✓ ${stored.length} region(s) set on scene "${sceneId}" (project ${projectId})`);
+        process.stdout.write(`${JSON.stringify(stored, null, 2)}\n`);
+    }
+    finally {
+        await db.close();
+    }
+}
+/** `uptimizr regions get <sceneId>` — print a scene's stored regions as JSON. */
+async function cmdRegionsGet(args) {
+    loadLocalEnv();
+    const positional = positionalArgs(args, ["project"]);
+    const sceneId = parseSceneId(positional[0]);
+    const projectId = resolveProjectId(args);
+    const db = await openCliStore();
+    try {
+        // Check the project first: an unknown id would otherwise read as "this scene
+        // has no regions" rather than "you named the wrong project".
+        if (!(await db.getProject(projectId))) {
+            throw new Error(`No project ${JSON.stringify(projectId)} in this store.`);
+        }
+        const regions = await db.getSceneRegions(projectId, sceneId);
+        console.error(`${regions.length} region(s) on scene "${sceneId}" (project ${projectId})`);
+        process.stdout.write(`${JSON.stringify(regions, null, 2)}\n`);
+    }
+    finally {
+        await db.close();
+    }
+}
+/** Dispatch the `regions` sub-namespace (`set` / `get`). */
+async function cmdRegions(args) {
+    const [sub, ...rest] = args;
+    switch (sub) {
+        case "set":
+            await cmdRegionsSet(rest);
+            return;
+        case "get":
+            await cmdRegionsGet(rest);
+            return;
+        default:
+            throw new Error(`Unknown regions command ${JSON.stringify(sub ?? "")}. ` +
+                "Expected: uptimizr regions set <sceneId> --file <regions.json> | " +
+                "uptimizr regions get <sceneId>");
+    }
+}
 function printUsage() {
     console.error([
         "uptimizr — self-host the OSS 3D-analytics collector (DuckDB by default, no Docker).",
@@ -104,9 +359,27 @@ function printUsage() {
         "  uptimizr init [name]          generate a secret, create the store, mint a project + key, write .env",
         "  uptimizr serve                run the ingestion + query API (default)",
         "  uptimizr new-project <name>   mint an additional project + API key",
+        "  uptimizr new-key <projectId>  mint an additional API key on an existing project",
         "  uptimizr migrate              apply store migrations",
+        "  uptimizr regions set <sceneId> --file <regions.json>",
+        "                                declare a scene's named regions (replaces the set)",
+        "  uptimizr regions get <sceneId>",
+        "                                print a scene's named regions as JSON",
         "  uptimizr help                 show this help",
         "",
+        "new-key options:",
+        "  --capabilities <list>         comma-separated: ingest, query, annotate, query:raw",
+        "                                (default: query). `query:raw` is only honoured when the",
+        "                                collector runs with ENABLE_RAW_SESSION_RETENTION.",
+        '  --label <name>                operator-supplied name, e.g. "weekly-report-agent"',
+        "  --rate-limit-max <n>          per-key request budget (needs --rate-limit-window-ms)",
+        "  --rate-limit-window-ms <ms>   per-key rate-limit window (needs --rate-limit-max)",
+        "",
+        "The regions commands target a project: pass --project <projectId> or set",
+        "UPTIMIZR_PROJECT_ID. The file is either a bare array of",
+        "{ id, label, bounds: [minX,minY,minZ,maxX,maxY,maxZ], description? } or a",
+        '{ "regions": [...] } envelope.',
+        "",
         "Every command targets the store selected by COLLECTOR_STORE (duckdb | postgres | mssql |",
         "clickhouse), using the same connection variables as `serve` (DUCKDB_PATH, POSTGRES_URL,",
         "MSSQL_URL, CLICKHOUSE_*). Unset = duckdb.",
@@ -130,9 +403,15 @@ async function main() {
         case "new-project":
             await cmdNewProject(nameArg(rest) || "Project");
             return;
+        case "new-key":
+            await cmdNewKey(rest);
+            return;
         case "migrate":
             await cmdMigrate();
             return;
+        case "regions":
+            await cmdRegions(rest);
+            return;
         case "help":
         case "--help":
         case "-h":

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAqB,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AAEhD,gGAAgG;AAChG,SAAS,YAAY;IACnB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,IAAc;IAC7B,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACzB,IAAI,CAAC,GAAG,CAAC;SACT,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAAC,MAAc,EAAE,SAAkB,EAAE,KAAmB;IACpF,IAAI,CAAC;QACH,wEAAwE;QACxE,qEAAqE;QACrE,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,uBAAuB,MAAM,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,YAAY,EAAE,CAAC;IAEf,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,GAAG,4CAA4C,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,gCAAgC,IAAI,SAAS,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAClF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,YAAY,EAAE,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,OAAO,CAAC,KAAK,CAAC,yBAAyB,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CACX;QACE,qFAAqF;QACrF,EAAE;QACF,QAAQ;QACR,uGAAuG;QACvG,yEAAyE;QACzE,sEAAsE;QACtE,wDAAwD;QACxD,gDAAgD;QAChD,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,2CAA2C;QAC3C,EAAE;QACF,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,KAAK,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,KAAK,MAAM;YACT,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAClD,OAAO;QACT,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;YAChD,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,UAAU,EAAE,CAAC;YACnB,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,UAAU,EAAE,CAAC;YACb,OAAO;QACT;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAqB,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AAEhD,gGAAgG;AAChG,SAAS,YAAY;IACnB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,IAAc;IAC7B,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACzB,IAAI,CAAC,GAAG,CAAC;SACT,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CAAC,KAA6B,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,qCAAqC,GAAG,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAAC,MAAc,EAAE,SAAkB,EAAE,KAAmB;IACpF,IAAI,CAAC;QACH,wEAAwE;QACxE,qEAAqE;QACrE,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,uBAAuB,MAAM,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,YAAY,EAAE,CAAC;IAEf,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,GAAG,4CAA4C,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,gCAAgC,IAAI,SAAS,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAClF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,SAAS,CAAC,IAAc;IACrC,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE;YACvD,YAAY;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EACP,YAAY,IAAI,IAAI,IAAI,iBAAiB,IAAI,IAAI;gBAC/C,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE;gBACpD,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,mBAAmB,MAAM,CAAC,SAAS,CAAC,GAAG,eAAe,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;YAChB,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,GAAG;SACZ,CAAC,IAAI,CACP,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,YAAY,EAAE,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,OAAO,CAAC,KAAK,CAAC,yBAAyB,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IAC3C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,IAAc,EAAE,KAAwB;IAC9D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC,CAAC,wBAAwB;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE;YACpF,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI;QACrC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAE,MAAgC,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,2CAA2C,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,YAAY,EAAE,CAAC;IACf,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,4BAA4B,OAAO,cAAc,SAAS,GAAG,CAAC,CAAC;QAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,YAAY,EAAE,CAAC;IACf,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,6EAA6E;QAC7E,6DAA6D;QAC7D,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,wBAAwB,OAAO,cAAc,SAAS,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO;QACT,KAAK,KAAK;YACR,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO;QACT;YACE,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI;gBACtD,mEAAmE;gBACnE,gCAAgC,CACnC,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CACX;QACE,qFAAqF;QACrF,EAAE;QACF,QAAQ;QACR,uGAAuG;QACvG,yEAAyE;QACzE,sEAAsE;QACtE,mFAAmF;QACnF,wDAAwD;QACxD,wDAAwD;QACxD,oFAAoF;QACpF,kCAAkC;QAClC,uEAAuE;QACvE,gDAAgD;QAChD,EAAE;QACF,kBAAkB;QAClB,qFAAqF;QACrF,yFAAyF;QACzF,mFAAmF;QACnF,oFAAoF;QACpF,uFAAuF;QACvF,oFAAoF;QACpF,EAAE;QACF,0EAA0E;QAC1E,yDAAyD;QACzD,2EAA2E;QAC3E,gCAAgC;QAChC,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,2CAA2C;QAC3C,EAAE;QACF,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,KAAK,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,KAAK,MAAM;YACT,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAClD,OAAO;QACT,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;YAChD,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,UAAU,EAAE,CAAC;YACnB,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,UAAU,EAAE,CAAC;YACb,OAAO;QACT;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cliStore.d.ts

@@ -1,3 +1,5 @@
+import type { SceneRegion } from "@uptimizr/schema";
+import { type ApiKeyRecord, type CreateApiKeyOptions, type SceneRegionRecord } from "@uptimizr/db";
 /**
  * The persistent stores the `uptimizr` CLI can bootstrap (`init` / `new-project`
  * / `migrate`). Mirrors the `COLLECTOR_STORE` values `serve` accepts, minus
@@ -17,10 +19,26 @@ export interface CliStore {
         id: string;
         name: string;
     }>;
-    /** Issue a query-capable API key; the plaintext is returned exactly once. */
-    createApiKey(projectId: string): Promise<{
+    /**
+     * Issue an API key; the plaintext is returned exactly once. Defaults to the
+     * `query` (read-only) capability when no options are given.
+     */
+    createApiKey(projectId: string, options?: CreateApiKeyOptions): Promise<{
         key: string;
+        record: ApiKeyRecord;
     }>;
+    /** Look a project up so a command can fail fast on a wrong `--project`. */
+    getProject(projectId: string): Promise<{
+        id: string;
+        name: string;
+    } | null>;
+    /**
+     * Replace a scene's region set (ADR 0051 §2) — the CLI's `regions set`, the
+     * offline sibling of `PUT /api/v1/scenes/:sceneId/regions`.
+     */
+    putSceneRegions(projectId: string, sceneId: string, regions: readonly SceneRegion[]): Promise<SceneRegionRecord[]>;
+    /** Read a scene's regions — the CLI's `regions get`. */
+    getSceneRegions(projectId: string, sceneId: string): Promise<SceneRegionRecord[]>;
     close(): Promise<void>;
 }
 /**