donebear 0.3.7 → 0.3.8

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-DH561Z1u.mjs";
-import { n as readStdin, t as promptForValue } from "./prompt-BrfcK2Ry.mjs";
+import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-DuCNavgl.mjs";
+import { n as readStdin, t as promptForValue } from "./prompt-GfcWO85b.mjs";
 import { createRequire } from "node:module";
 import { Command, InvalidArgumentError } from "commander";
 import { homedir } from "node:os";
@@ -18,13 +18,13 @@ import { fileURLToPath } from "node:url";
 import Database from "better-sqlite3";
 import { createInterface } from "node:readline";
 //#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
 //#region src/jwt.ts
 const parseJwtBase64Url = (input) => {
 	const normalized = input.replaceAll("-", "+").replaceAll("_", "/");
 	const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
-	return Buffer.from(padded, "base64").toString("utf8");
+	return Buffer.from(padded, "base64").toString("utf-8");
 };
 const parseJwtClaims = (token) => {
 	const payloadPart = token.split(".").at(1);
@@ -115,7 +115,7 @@ const parseAuthFile = (payload) => {
 };
 const readStoredAuthSession = async () => {
 	try {
-		return parseAuthFile(await readFile(AUTH_FILE_PATH, "utf8")).session;
+		return parseAuthFile(await readFile(AUTH_FILE_PATH, "utf-8")).session;
 	} catch (error) {
 		if (isRecord(error) && error.code === "ENOENT") return null;
 		if (error instanceof CliError) throw error;
@@ -132,7 +132,7 @@ const writeStoredAuthSession = async (session) => {
 		recursive: true
 	});
 	await writeFile(AUTH_FILE_PATH, `${JSON.stringify(payload, null, 2)}\n`, {
-		encoding: "utf8",
+		encoding: "utf-8",
 		mode: 384
 	});
 };
@@ -199,19 +199,6 @@ const tokenResponseToStoredSession = (response) => {
 		} : null
 	};
 };
-const getSupabaseUser = async (supabaseUrl, publishableKey, accessToken) => {
-	const response = await fetch(`${supabaseUrl}/auth/v1/user`, { headers: {
-		apikey: publishableKey,
-		authorization: `Bearer ${accessToken}`
-	} });
-	if (!response.ok) throw new CliError(`Failed to load user (${response.status})`, EXIT_CODES.ERROR);
-	const data = await response.json();
-	if (typeof data.id !== "string") throw new CliError("No user returned for current token", EXIT_CODES.ERROR);
-	return {
-		email: typeof data.email === "string" ? data.email : null,
-		id: data.id
-	};
-};
 //#endregion
 //#region src/auth-session.ts
 const expiryFromClaims = (claims) => {
@@ -346,8 +333,8 @@ const requestNdjson = async (context, endpoint, options) => {
 };
 //#endregion
 //#region src/date-codecs.ts
-const ISO_DATE_ONLY_REGEX = /^(\d{4})-(\d{2})-(\d{2})$/;
-const ISO_INSTANT_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+const ISO_DATE_ONLY_REGEX = /^(\d{4})-(\d{2})-(\d{2})$/u;
+const ISO_INSTANT_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/u;
 const pad = (value, length = 2) => String(value).padStart(length, "0");
 const isFiniteEpoch = (value) => typeof value === "number" && Number.isFinite(value);
 const isValidDateOnlyParts = (parts) => {
@@ -681,17 +668,17 @@ const WORKSPACE_HISTORY_QUERY = `
   }
 `;
 const API_KEY_CREATE_MUTATION = `
-  mutation ApiKeyCreate($label: String!) {
-    apiKeyCreate(label: $label) {
+  mutation ApiKeyCreate($label: String!, $scopes: [String!], $workspaceIds: [ID!], $expiresAt: DateTime) {
+    apiKeyCreate(label: $label, scopes: $scopes, workspaceIds: $workspaceIds, expiresAt: $expiresAt) {
       success lastSyncId
-      apiKey { id label keyPrefix createdAt }
+      apiKey { id label keyPrefix scopes workspaceIds expiresAt createdAt }
       token
     }
   }
 `;
 const API_KEYS_QUERY = `
   query ApiKeys {
-    apiKeys { id label keyPrefix lastUsedAt revokedAt createdAt }
+    apiKeys { id label keyPrefix scopes workspaceIds expiresAt lastUsedAt revokedAt createdAt }
   }
 `;
 const API_KEY_REVOKE_MUTATION = `
@@ -875,11 +862,14 @@ const toWorkspaceHistoryEntryFromGraphqlNode = (node) => ({
 });
 const toApiKeyRecordFromGraphqlNode = (node) => ({
 	createdAt: node.createdAt,
+	expiresAt: node.expiresAt,
 	id: node.id,
 	keyPrefix: node.keyPrefix,
 	label: node.label,
 	lastUsedAt: node.lastUsedAt,
-	revokedAt: node.revokedAt
+	revokedAt: node.revokedAt,
+	scopes: node.scopes,
+	workspaceIds: node.workspaceIds
 });
 const toChecklistItemRecord = (value) => {
 	if (typeof value !== "object" || value === null) return null;
@@ -903,6 +893,26 @@ const resolveApiBaseUrl = (context) => {
 	if (fromContext) return normalizeApiUrl(fromContext);
 	return normalizeApiUrl(readEnvValue("DONEBEAR_API_URL") ?? "https://api.donebear.com");
 };
+const VIEWER_QUERY = `
+  query Viewer {
+    viewer {
+      id
+      email
+    }
+  }
+`;
+const loadViewer = async (context, options) => {
+	const data = await requestGraphql(context, `${options.baseUrl}/graphql`, {
+		query: VIEWER_QUERY,
+		token: options.token,
+		variables: {}
+	});
+	if (!data.viewer) throw new CliError("Could not resolve current user. The token may be invalid or revoked.", EXIT_CODES.AUTH_REQUIRED);
+	return {
+		email: data.viewer.email ?? null,
+		id: data.viewer.id
+	};
+};
 const listWorkspaces = async (context, options) => {
 	return (await requestGraphql(context, `${options.baseUrl}/graphql`, {
 		query: MY_WORKSPACES_QUERY,
@@ -1089,10 +1099,15 @@ const listWorkspaceHistory = async (context, options) => {
 	})).workspaceHistory.map(toWorkspaceHistoryEntryFromGraphqlNode);
 };
 const createApiKey = async (context, options) => {
-	const data = await requestGraphql(context, `${options.baseUrl}/graphql`, {
+	const endpoint = `${options.baseUrl}/graphql`;
+	const variables = { label: options.label };
+	if (options.scopes !== void 0) variables.scopes = options.scopes;
+	if (options.workspaceIds !== void 0) variables.workspaceIds = options.workspaceIds;
+	if (options.expiresAt !== void 0) variables.expiresAt = options.expiresAt;
+	const data = await requestGraphql(context, endpoint, {
 		query: API_KEY_CREATE_MUTATION,
 		token: options.token,
-		variables: { label: options.label }
+		variables
 	});
 	return {
 		...toApiKeyRecordFromGraphqlNode(data.apiKeyCreate.apiKey),
@@ -1140,10 +1155,13 @@ const resolveCommandContext = async (context) => {
 		token
 	};
 };
-const requireUserId = (resolvedToken) => {
-	const userId = resolvedToken.user?.id ?? null;
-	if (!(typeof userId === "string" && userId.length > 0)) throw new CliError("Could not determine user id from auth token", EXIT_CODES.AUTH_REQUIRED);
-	return userId;
+const requireUserId = async (context, commandContext) => {
+	const claimUserId = commandContext.resolvedToken.user?.id ?? null;
+	if (typeof claimUserId === "string" && claimUserId.length > 0) return claimUserId;
+	return (await loadViewer(context, {
+		baseUrl: commandContext.apiBaseUrl,
+		token: commandContext.token
+	})).id;
 };
 //#endregion
 //#region src/options.ts
@@ -1238,20 +1256,68 @@ const runWithErrorHandling = async (context, action) => {
 };
 //#endregion
 //#region src/commands/api-key.ts
-const runCreate = async (context, label) => {
+const PERMISSION_SCOPES = {
+	"full-access": [
+		"read",
+		"write",
+		"admin"
+	],
+	"read-only": ["read"]
+};
+const parseDuration = (duration) => {
+	const match = duration.match(/^(\d+)(d|y)$/u);
+	if (!match) throw new CliError(`Invalid duration "${duration}". Use a format like "30d", "90d", or "1y".`, EXIT_CODES.VALIDATION);
+	const [, rawAmount, unit] = match;
+	const amount = Number(rawAmount);
+	const now = /* @__PURE__ */ new Date();
+	if (unit === "d") now.setDate(now.getDate() + amount);
+	else now.setDate(now.getDate() + amount * 365);
+	return now;
+};
+const runCreate = async (context, label, options) => {
 	const { token } = await requireAuthToken(context);
+	const baseUrl = resolveApiBaseUrl(context);
+	let scopes;
+	if (options.permissions !== void 0) {
+		const level = options.permissions;
+		if (!PERMISSION_SCOPES[level]) throw new CliError(`Invalid permissions "${options.permissions}". Use "full-access" or "read-only".`, EXIT_CODES.VALIDATION);
+		scopes = PERMISSION_SCOPES[level];
+	}
+	let workspaceIds;
+	if (options.workspaces !== void 0) {
+		const slugs = options.workspaces.split(",").map((s) => s.trim()).filter(Boolean);
+		if (slugs.length === 0) throw new CliError("No workspace slugs provided for --workspaces.", EXIT_CODES.VALIDATION);
+		const allWorkspaces = await listWorkspaces(context, {
+			baseUrl,
+			token
+		});
+		workspaceIds = [];
+		for (const slug of slugs) {
+			const match = allWorkspaces.find((ws) => ws.urlKey === slug || ws.id === slug || ws.name.toLowerCase() === slug.toLowerCase());
+			if (!match) throw new CliError(`Workspace "${slug}" not found. Run \`donebear workspace list\` to see available workspaces.`, EXIT_CODES.VALIDATION);
+			workspaceIds.push(match.id);
+		}
+	}
+	let expiresAt;
+	if (options.expires !== void 0) expiresAt = parseDuration(options.expires).toISOString();
 	const key = await createApiKey(context, {
-		baseUrl: resolveApiBaseUrl(context),
+		baseUrl,
+		expiresAt,
 		label,
-		token
+		scopes,
+		token,
+		workspaceIds
 	});
 	if (context.json) {
 		writeOutput(context, {
 			createdAt: key.createdAt,
+			expiresAt: key.expiresAt,
 			id: key.id,
 			keyPrefix: key.keyPrefix,
 			label: key.label,
-			token: key.token
+			scopes: key.scopes,
+			token: key.token,
+			workspaceIds: key.workspaceIds
 		});
 		return;
 	}
@@ -1259,6 +1325,10 @@ const runCreate = async (context, label) => {
 	writeInfo(context, "");
 	writeInfo(context, `  ${key.token}`);
 	writeInfo(context, "");
+	writeInfo(context, `  Scopes: ${key.scopes.join(", ")}`);
+	if (key.workspaceIds && key.workspaceIds.length > 0) writeInfo(context, `  Restricted to workspaces: ${key.workspaceIds.join(", ")}`);
+	if (key.expiresAt) writeInfo(context, `  Expires: ${new Date(key.expiresAt).toLocaleDateString()}`);
+	writeInfo(context, "");
 	writeWarning(context, "Save this key now — it will not be shown again.");
 };
 const runList = async (context) => {
@@ -1278,7 +1348,10 @@ const runList = async (context) => {
 	for (const key of keys) {
 		const status = key.revokedAt ? " (revoked)" : "";
 		const lastUsed = key.lastUsedAt ? `Last used: ${new Date(key.lastUsedAt).toLocaleDateString()}` : "Never used";
-		writeInfo(context, `${key.keyPrefix}...  ${key.label}  ${lastUsed}${status}  [${key.id}]`);
+		const scopeStr = `[${key.scopes.join(",")}]`;
+		const wsStr = key.workspaceIds && key.workspaceIds.length > 0 ? ` ws:${key.workspaceIds.length}` : "";
+		const expStr = key.expiresAt ? ` exp:${new Date(key.expiresAt).toLocaleDateString()}` : "";
+		writeInfo(context, `${key.keyPrefix}...  ${key.label}  ${scopeStr}${wsStr}${expStr}  ${lastUsed}${status}  [${key.id}]`);
 	}
 };
 const runRevoke = async (context, keyId) => {
@@ -1301,6 +1374,8 @@ const registerApiKeyCommands = (program) => {
 	const apiKey = program.command("api-key").alias("key").description("Manage personal API keys").addHelpText("after", `
 Examples:
   donebear api-key create "Raycast"
+  donebear api-key create "CI" --permissions read-only --expires 90d
+  donebear api-key create "Scoped" --workspaces my-org,side-project --expires 1y
   donebear api-key list
   donebear api-key revoke <key-id>
 `).action(async (_options, command) => {
@@ -1309,10 +1384,10 @@ Examples:
 			await runList(context);
 		});
 	});
-	apiKey.command("create <label>").description("Create a new personal API key").action(async (label, _options, command) => {
+	apiKey.command("create <label>").description("Create a new personal API key").option("--permissions <value>", "Permission level: \"full-access\" or \"read-only\"", "full-access").option("--workspaces <slugs>", "Comma-separated workspace slugs to restrict the key to").option("--expires <duration>", "Expiration duration, e.g. \"30d\", \"90d\", \"1y\"").action(async (label, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
-			await runCreate(context, label);
+			await runCreate(context, label, options);
 		});
 	});
 	apiKey.command("list").description("List all personal API keys").action(async (_options, command) => {
@@ -1669,7 +1744,7 @@ const resolveTaskView = (task) => {
 const formatEpochDate = (epochMs) => formatInstantEpoch(epochMs);
 //#endregion
 //#region src/command-helpers.ts
-const SHORT_ID_SUFFIX_PATTERN = /-([a-f0-9]{8})$/;
+const SHORT_ID_SUFFIX_PATTERN = /-([a-f0-9]{8})$/u;
 /**
 * Find a record by reference: exact ID, key, ID prefix, slug shortId, or name.
 * Works for any entity with id, key, and name fields.
@@ -1723,7 +1798,7 @@ const taskListLines = (tasks) => tasks.map((task) => {
 });
 //#endregion
 //#region src/workspace-context.ts
-const WORKSPACE_URL_KEY_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const WORKSPACE_URL_KEY_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 const fetchWorkspaces = async (context, options) => {
 	const workspaces = await listWorkspaces(context, {
 		baseUrl: options.apiBaseUrl,
@@ -1782,7 +1857,7 @@ const byReference = (workspaces, reference) => {
 	return null;
 };
 const toWorkspaceUrlKey = (name) => {
-	return name.trim().toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-+|-+$/g, "").replaceAll(/-{2,}/g, "-").slice(0, 50);
+	return name.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "").replaceAll(/-{2,}/gu, "-").slice(0, 50);
 };
 const isValidWorkspaceUrlKey = (value) => WORKSPACE_URL_KEY_REGEX.test(value) && value.length >= 3;
 const resolveWorkspace = async (context, options) => {
@@ -1993,7 +2068,7 @@ const checkAuth = async (context) => {
 };
 const checkWorkspace = async () => {
 	try {
-		const { ensureLocalContext } = await import("./context-store-D0Z9vbaU.mjs");
+		const { ensureLocalContext } = await import("./context-store-CK4yIl9e.mjs");
 		const localContext = await ensureLocalContext();
 		if (!localContext.workspaceId) return {
 			message: "No workspace selected (run `donebear workspace use`)",
@@ -2225,7 +2300,7 @@ const bytesToUuid = (bytes) => {
 };
 const createUuidV5 = (name, namespace) => {
 	const namespaceBytes = uuidToBytes(namespace);
-	const hash = createHash("sha1").update(namespaceBytes).update(Buffer.from(name, "utf8")).digest();
+	const hash = createHash("sha1").update(namespaceBytes).update(Buffer.from(name, "utf-8")).digest();
 	const bytes = Uint8Array.from(hash.subarray(0, 16));
 	const versionByte = bytes.at(6);
 	const variantByte = bytes.at(8);
@@ -2665,7 +2740,6 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 				};
 				return __assign.apply(this, arguments);
 			};
-			Object.create;
 			function __spreadArray(to, from, pack) {
 				if (pack || arguments.length === 2) {
 					for (var i = 0, l = from.length, ar; i < l; i++) if (ar || !(i in from)) {
@@ -2678,7 +2752,6 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 			function __await(v) {
 				return this instanceof __await ? (this.v = v, this) : new __await(v);
 			}
-			Object.create;
 			const callbackiterresult = function(_super) {
 				__extends(CallbackIterResult, _super);
 				function CallbackIterResult(method, args, iterator) {
@@ -3515,7 +3588,8 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 					this.month += months;
 					if (this.month > 12) {
 						var yearDiv = Math.floor(this.month / 12);
-						this.month = pymod(this.month, 12);
+						var monthMod = pymod(this.month, 12);
+						this.month = monthMod;
 						this.year += yearDiv;
 						if (this.month === 0) {
 							this.month = 12;
@@ -4134,8 +4208,7 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 				var month = Math.floor((h + l - 7 * m + 114) / 31);
 				var day = (h + l - 7 * m + 114) % 31 + 1;
 				var date = Date.UTC(y, month - 1, day + offset);
-				var yearStart = Date.UTC(y, 0, 1);
-				return [Math.ceil((date - yearStart) / (1e3 * 60 * 60 * 24))];
+				return [Math.ceil((date - Date.UTC(y, 0, 1)) / (1e3 * 60 * 60 * 24))];
 			}
 			const iterinfo = function() {
 				function Iterinfo(options) {
@@ -4461,7 +4534,8 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 					if (noCache === void 0) noCache = false;
 					this._cache = noCache ? null : new Cache();
 					this.origOptions = initializeOptions(options);
-					this.options = parseOptions(options).parsedOptions;
+					var parsedOptions = parseOptions(options).parsedOptions;
+					this.options = parsedOptions;
 				}
 				RRule.parseText = function(text, language) {
 					return parseText(text, language);
@@ -5152,17 +5226,17 @@ const THINGS_WEEKDAY_TO_RRULE = [
 	"SA"
 ];
 const parseNumericPlistField = (xml, key) => {
-	const match = new RegExp(`<key>${key}</key>\\s*<(integer|real)>([^<]+)</\\1>`).exec(xml);
+	const match = new RegExp(`<key>${key}</key>\\s*<(integer|real)>([^<]+)</\\1>`, "u").exec(xml);
 	if (!match?.[2]) return null;
 	const parsed = Number(match[2]);
 	return Number.isFinite(parsed) ? parsed : null;
 };
-const PLIST_OFFSETS_ARRAY_PATTERN = /<key>of<\/key>\s*<array>([\s\S]*?)<\/array>/;
+const PLIST_OFFSETS_ARRAY_PATTERN = /<key>of<\/key>\s*<array>([\s\S]*?)<\/array>/u;
 const parseOffsets = (xml) => {
 	const arrayMatch = PLIST_OFFSETS_ARRAY_PATTERN.exec(xml);
 	if (!arrayMatch?.[1]) return [];
 	const offsets = [];
-	for (const dictMatch of arrayMatch[1].matchAll(/<dict>([\s\S]*?)<\/dict>/g)) {
+	for (const dictMatch of arrayMatch[1].matchAll(/<dict>([\s\S]*?)<\/dict>/gu)) {
 		const [, fragment] = dictMatch;
 		if (!fragment) continue;
 		const weekday = parseNumericPlistField(fragment, "wd");
@@ -5290,11 +5364,11 @@ const normalizeTitle = (value, fallback) => {
 	const trimmed = value?.trim();
 	return trimmed && trimmed.length > 0 ? trimmed : fallback;
 };
-const NON_ALPHANUMERIC_PATTERN = /[^A-Z0-9]+/g;
-const WHITESPACE_SPLIT_PATTERN = /\s+/;
-const NON_ALPHANUMERIC_STRICT_PATTERN = /[^A-Z0-9]/g;
+const NON_ALPHANUMERIC_PATTERN = /[^A-Z0-9]+/gu;
+const WHITESPACE_SPLIT_PATTERN = /\s+/u;
+const NON_ALPHANUMERIC_STRICT_PATTERN = /[^A-Z0-9]/gu;
 const READABLE_TEXT_PATTERN = /^[\t\n\r\u0020-\u007E\u00A0-\uFFFF]*$/u;
-const EMAIL_SPLIT_PATTERN = /[,\n;]/;
+const EMAIL_SPLIT_PATTERN = /[,\n;]/u;
 const normalizeKeyBase = (value, fallback) => {
 	const initials = value.toUpperCase().replace(NON_ALPHANUMERIC_PATTERN, " ").trim().split(WHITESPACE_SPLIT_PATTERN).filter((word) => word.length > 0).map((word) => word[0] ?? "").join("");
 	const compact = value.toUpperCase().replace(NON_ALPHANUMERIC_STRICT_PATTERN, "");
@@ -5312,7 +5386,7 @@ const buildUniqueKeys = (items, options) => {
 		const base = normalizeKeyBase(normalizeTitle(item.title, options.fallback), options.fallback).slice(0, options.maxLength);
 		let candidate = base || options.fallback;
 		if (used.has(candidate)) {
-			const suffixBase = item.uuid.replaceAll(/[^a-zA-Z0-9]/g, "").slice(-4);
+			const suffixBase = item.uuid.replaceAll(/[^a-zA-Z0-9]/gu, "").slice(-4);
 			const suffix = suffixBase.length > 0 ? suffixBase.toUpperCase() : "X";
 			const headLength = Math.max(1, options.maxLength - suffix.length - 1);
 			candidate = `${candidate.slice(0, headLength)}-${suffix}`;
@@ -5384,7 +5458,7 @@ const pickCompletedAt = (task) => {
 };
 const sortValue = (primary, fallback) => typeof primary === "number" ? primary : fallback;
 const sanitizeBuffer = (buffer) => {
-	const asText = buffer.toString("utf8");
+	const asText = buffer.toString("utf-8");
 	if (!asText.includes("�") && READABLE_TEXT_PATTERN.test(asText)) {
 		const trimmed = asText.trim();
 		if (trimmed.length > 0) return trimmed;
@@ -5998,7 +6072,7 @@ const THINGS_CONTAINER_PATH = join(homedir(), "Library/Group Containers/JLMPQHK8
 const THINGS_BUNDLE_NAME = "Things Database.thingsdatabase";
 const THINGS_SQLITE_FILE = "main.sqlite";
 const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
-const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/i;
+const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/iu;
 const isUrlLike = (value) => URL_SCHEME_PATTERN.test(value);
 const resolveInputPath = (databaseUrl) => {
 	if (!isUrlLike(databaseUrl)) return resolve(databaseUrl);
@@ -6061,7 +6135,7 @@ const toStringValue = (value) => {
 		return trimmed.length > 0 ? trimmed : null;
 	}
 	if (Buffer.isBuffer(value)) {
-		const text = value.toString("utf8").trim();
+		const text = value.toString("utf-8").trim();
 		return text.length > 0 ? text : null;
 	}
 	return null;
@@ -6407,7 +6481,7 @@ const parseMetadataMode = (value) => {
 };
 const runThingsImportCommand = async (context, options, workspaceOverride) => {
 	const commandContext = await resolveCommandContext(context);
-	const creatorId = requireUserId(commandContext.resolvedToken);
+	const creatorId = await requireUserId(context, commandContext);
 	const metadataMode = parseMetadataMode(options.metadataMode);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
 		apiBaseUrl: commandContext.apiBaseUrl,
@@ -6463,7 +6537,7 @@ const isHistoryFile = (value) => {
 };
 const loadHistory = async (historyFile) => {
 	try {
-		const raw = await readFile(historyFile, "utf8");
+		const raw = await readFile(historyFile, "utf-8");
 		const parsed = JSON.parse(raw);
 		if (isHistoryFile(parsed)) return parsed.entries;
 		return [];
@@ -6538,7 +6612,7 @@ const runInteractiveMode = async (context, program) => {
 			recursive: true
 		});
 		await writeFile(HISTORY_FILE, `${JSON.stringify(payload, null, 2)}\n`, {
-			encoding: "utf8",
+			encoding: "utf-8",
 			mode: 384
 		});
 	} catch {}
@@ -6635,7 +6709,7 @@ const runLabelShow = async (context, labelRef, options) => {
 	writeInfo(context, `createdAt: ${formatEpochDate(label.createdAt) ?? "(none)"}`);
 	writeInfo(context, `updatedAt: ${formatEpochDate(label.updatedAt) ?? "(none)"}`);
 };
-const UUID_REGEX$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const UUID_REGEX$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 const resolveTaskForLabel = async (context, options) => {
 	const taskRef = options.taskRef.trim();
 	if (!taskRef) throw new Error("Task id is required.");
@@ -6882,7 +6956,7 @@ const getProjectStatus = (project) => {
 };
 const parseTargetDate = (value) => parseCliDateOnlyToEpoch(value, "target date");
 const generateProjectSlug = (name, id) => {
-	const slug = name.toLowerCase().trim().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-|-$/g, "").slice(0, 39);
+	const slug = name.toLowerCase().trim().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-|-$/gu, "").slice(0, 39);
 	const shortId = id.replaceAll("-", "").slice(0, 8);
 	return slug ? `${slug}-${shortId}` : shortId;
 };
@@ -7002,14 +7076,14 @@ const resolveProjectName = async (context, rawName) => {
 		const trimmed = rawName.trim();
 		if (trimmed.length > 0) return trimmed;
 	}
-	const { promptForValue } = await import("./prompt-FRvfbinv.mjs");
+	const { promptForValue } = await import("./prompt-B7mDo4K7.mjs");
 	const prompted = await promptForValue(context, "Project name");
 	if (prompted) return prompted;
 	throw new CliError("Project name is required.", EXIT_CODES.VALIDATION, "Provide a name: donebear project add \"My project\"");
 };
 const runProjectAdd = async (context, name, options) => {
 	const commandContext = await resolveCommandContext(context);
-	const userId = requireUserId(commandContext.resolvedToken);
+	const userId = await requireUserId(context, commandContext);
 	const normalizedName = await resolveProjectName(context, name);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
 		apiBaseUrl: commandContext.apiBaseUrl,
@@ -7253,7 +7327,7 @@ Agent tip: run "donebear spec project add" for full option reference
 };
 //#endregion
 //#region src/commands/task.ts
-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 const DEFAULT_TASK_LIST_LIMIT = 20;
 const VALID_TASK_VIEWS = new Set([
 	"inbox",
@@ -7417,7 +7491,7 @@ const resolveNotes = async (_context, flagNotes) => {
 };
 const runTaskAdd = async (context, title, options, workspaceOverride) => {
 	const commandContext = await resolveCommandContext(context);
-	const userId = requireUserId(commandContext.resolvedToken);
+	const userId = await requireUserId(context, commandContext);
 	const normalizedTitle = await resolveTitle(context, title);
 	const notes = await resolveNotes(context, options.notes);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
@@ -8161,6 +8235,15 @@ Examples:
 const OVERVIEW = {
 	authentication: "Set DONEBEAR_TOKEN env var, or run: donebear auth login",
 	commands: {
+		"api-key": {
+			description: "Manage personal API keys",
+			quick_example: "donebear api-key list --json",
+			subcommands: [
+				"create",
+				"list",
+				"revoke"
+			]
+		},
 		auth: {
 			description: "Authentication",
 			quick_example: "donebear auth status --json",
@@ -8276,6 +8359,70 @@ const OVERVIEW = {
 	workspace_targeting: "Prefix any command: donebear workspace=<slug> task list"
 };
 const COMMAND_SPECS = {
+	"api-key create": {
+		arguments: { label: {
+			description: "Human-readable label for the key",
+			required: true,
+			type: "string"
+		} },
+		command: "api-key create",
+		examples: [
+			"donebear api-key create \"Raycast\" --json",
+			"donebear api-key create \"CI\" --permissions read-only --expires 90d --json",
+			"donebear api-key create \"Scoped\" --workspaces my-org,side-project --expires 1y --json"
+		],
+		json_output: {
+			createdAt: "string",
+			expiresAt: "string | null",
+			id: "string",
+			keyPrefix: "string",
+			label: "string",
+			scopes: "string[]",
+			token: "string",
+			workspaceIds: "string[] | null"
+		},
+		notes: "The full token is only shown once at creation time. Scopes default to full-access (read, write, admin).",
+		options: {
+			"--expires": {
+				description: "Expiration duration, e.g. \"30d\", \"90d\", \"1y\"",
+				type: "string"
+			},
+			"--permissions": {
+				default: "full-access",
+				description: "\"full-access\" (read, write, admin) or \"read-only\" (read only)",
+				enum: ["full-access", "read-only"],
+				type: "string"
+			},
+			"--workspaces": {
+				description: "Comma-separated workspace slugs to restrict the key to",
+				type: "string"
+			}
+		},
+		usage: "donebear api-key create <label> [options]"
+	},
+	"api-key list": {
+		command: "api-key list",
+		examples: ["donebear api-key list --json"],
+		json_output: { keys: "ApiKeyRecord[]" },
+		notes: "Each key includes scopes, workspaceIds, and expiresAt fields.",
+		options: {},
+		usage: "donebear api-key list"
+	},
+	"api-key revoke": {
+		arguments: { "key-id": {
+			description: "The UUID of the API key to revoke",
+			required: true,
+			type: "string"
+		} },
+		command: "api-key revoke",
+		examples: ["donebear api-key revoke abc12345 --json"],
+		json_output: {
+			id: "string",
+			ok: "boolean"
+		},
+		options: {},
+		usage: "donebear api-key revoke <key-id>"
+	},
 	"auth login": {
 		command: "auth login",
 		examples: [
@@ -8922,6 +9069,16 @@ const COMMAND_SPECS = {
 	}
 };
 const TOP_LEVEL_SPECS = {
+	"api-key": {
+		command: "api-key",
+		description: "Manage personal API keys",
+		subcommands: {
+			create: "Create a new API key (--permissions, --workspaces, --expires)",
+			list: "List all API keys with scopes and expiration",
+			revoke: "Revoke an API key by id"
+		},
+		tip: "donebear spec api-key create  —  get full spec for api-key create"
+	},
 	auth: {
 		command: "auth",
 		description: "Authentication",
@@ -9215,8 +9372,13 @@ Examples:
 //#endregion
 //#region src/commands/whoami.ts
 const runWhoAmI = async (context) => {
-	const config = resolveSupabaseConfig();
-	const resolvedToken = await resolveAuthToken(context, config);
+	let supabaseConfig = null;
+	try {
+		supabaseConfig = resolveSupabaseConfig();
+	} catch {
+		supabaseConfig = null;
+	}
+	const resolvedToken = await resolveAuthToken(context, supabaseConfig);
 	if (!resolvedToken) {
 		process.exitCode = EXIT_CODES.AUTH_REQUIRED;
 		if (context.json) {
@@ -9233,7 +9395,10 @@ const runWhoAmI = async (context) => {
 		writeInfo(context, "Run `donebear auth login`.");
 		return;
 	}
-	const user = await getSupabaseUser(config.url, config.publishableKey, resolvedToken.token);
+	const user = await loadViewer(context, {
+		baseUrl: resolveApiBaseUrl(context),
+		token: resolvedToken.token
+	});
 	if (context.json) {
 		writeOutput(context, {
 			ok: true,
@@ -9594,10 +9759,10 @@ Examples:
 //#endregion
 //#region src/cli.ts
 const packageManifest = createRequire(import.meta.url)("../package.json");
-const WORKSPACE_PREFIX_REGEX = /^workspace=(.+)$/i;
+const WORKSPACE_PREFIX_REGEX = /^workspace=(.+)$/iu;
 const extractWorkspaceTarget = (argv) => {
 	const processedArgv = [...argv];
-	const [, , firstArg] = processedArgv;
+	const firstArg = processedArgv[2];
 	if (firstArg) {
 		const match = WORKSPACE_PREFIX_REGEX.exec(firstArg);
 		if (match?.[1]) {