donebear 0.3.7 → 0.3.9

package/dist/cli.mjs

@@ -1,30 +1,261 @@
 #!/usr/bin/env node
-import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-DH561Z1u.mjs";
-import { n as readStdin, t as promptForValue } from "./prompt-BrfcK2Ry.mjs";
+import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-BBEVWudm.mjs";
+import { n as readStdin, t as promptForValue } from "./prompt-GfcWO85b.mjs";
 import { createRequire } from "node:module";
-import { Command, InvalidArgumentError } from "commander";
-import { homedir } from "node:os";
-import { basename, join, resolve } from "node:path";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { accessSync, constants, existsSync, readdirSync, statSync } from "node:fs";
-import { config } from "dotenv";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { basename, join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { homedir } from "node:os";
 import { execSync, spawn } from "node:child_process";
 import { styleText } from "node:util";
 import jmespath from "jmespath";
 import { stringify } from "yaml";
+import { accessSync, constants, existsSync, readdirSync, statSync } from "node:fs";
+import { config } from "dotenv";
+import { Command, InvalidArgumentError } from "commander";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
 import Database from "better-sqlite3";
-import { createInterface } from "node:readline";
 //#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+//#endregion
+//#region src/output.ts
+const writeLine = (stream, message) => {
+	stream.write(`${message}\n`);
+};
+const colorize = (context, format, message) => {
+	if (!context.color) return message;
+	return styleText(format, message);
+};
+const writeJson = (value) => {
+	writeLine(process.stdout, JSON.stringify(value, null, 2));
+};
+const writeYaml = (value) => {
+	process.stdout.write(stringify(value));
+};
+const writeInfo = (context, message) => {
+	writeLine(process.stdout, colorize(context, "cyan", message));
+};
+const writeSuccess = (context, message) => {
+	writeLine(process.stdout, colorize(context, "green", message));
+};
+const writeWarning = (context, message) => {
+	writeLine(process.stderr, colorize(context, "yellow", message));
+};
+const writeError = (context, message) => {
+	writeLine(process.stderr, colorize(context, "red", message));
+};
+const writeDebug = (context, message) => {
+	if (!context.debug) return;
+	writeLine(process.stderr, colorize(context, "gray", `[debug] ${message}`));
+};
+const writeTotal = (context, count) => {
+	writeLine(process.stdout, colorize(context, "cyan", String(count)));
+};
+const escapeCsvField = (value) => {
+	if (value.includes(",") || value.includes("\"") || value.includes("\n")) return `"${value.replaceAll("\"", "\"\"")}"`;
+	return value;
+};
+const writeCsv = (headers, rows) => {
+	writeLine(process.stdout, headers.map(escapeCsvField).join(","));
+	for (const row of rows) writeLine(process.stdout, row.map(escapeCsvField).join(","));
+};
+const writeTsv = (headers, rows) => {
+	writeLine(process.stdout, headers.join("	"));
+	for (const row of rows) writeLine(process.stdout, row.join("	"));
+};
+/**
+* Write structured data to stdout, applying --jq filter and --limit if set.
+* Use this for all JSON/YAML/structured output from commands.
+*/
+const writeOutput = (context, data) => {
+	let result = data;
+	if (context.jq) try {
+		result = jmespath.search(result, context.jq);
+	} catch (error) {
+		throw new CliError(`Invalid --jq expression: ${error instanceof Error ? error.message : String(error)}`, EXIT_CODES.VALIDATION);
+	}
+	if (context.limit !== null && Array.isArray(result)) result = result.slice(0, context.limit);
+	switch (context.format) {
+		case "yaml":
+			writeYaml(result);
+			break;
+		case "json":
+			writeJson(result);
+			break;
+		default:
+			writeJson(result);
+			break;
+	}
+	if (context.copy) copyToClipboard(JSON.stringify(result, null, 2));
+};
+/**
+* Handles --total, --format csv, --format tsv, --format yaml output.
+* Returns true if the format was handled; caller renders text mode if false.
+*/
+const writeFormattedRows = (context, totalCount, headers, rows) => {
+	if (context.total) {
+		writeTotal(context, totalCount);
+		return true;
+	}
+	if (context.format === "yaml") {
+		const objects = rows.map((row) => Object.fromEntries(headers.map((h, i) => [h, row[i]])));
+		writeYaml(objects);
+		if (context.copy) copyToClipboard(stringify(objects));
+		return true;
+	}
+	if (context.format === "csv") {
+		writeCsv(headers, rows);
+		if (context.copy) copyToClipboard([headers.join(","), ...rows.map((r) => r.join(","))].join("\n"));
+		return true;
+	}
+	if (context.format === "tsv") {
+		writeTsv(headers, rows);
+		if (context.copy) copyToClipboard([headers.join("	"), ...rows.map((r) => r.join("	"))].join("\n"));
+		return true;
+	}
+	return false;
+};
+const copyToClipboard = (text) => {
+	try {
+		if (process.platform === "darwin") execSync("pbcopy", { input: text });
+		else if (process.platform === "win32") execSync("clip", { input: text });
+		else try {
+			execSync("xclip -selection clipboard", { input: text });
+		} catch {
+			execSync("xsel --clipboard --input", { input: text });
+		}
+		return true;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/commands/interactive.ts
+const HISTORY_FILE = join(CONFIG_DIR, "history.json");
+const MAX_HISTORY = 200;
+const isHistoryFile = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record.version === 1 && Array.isArray(record.entries) && record.entries.every((e) => typeof e === "string");
+};
+const loadHistory = async (historyFile) => {
+	try {
+		const raw = await readFile(historyFile, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (isHistoryFile(parsed)) return parsed.entries;
+		return [];
+	} catch {
+		return [];
+	}
+};
+const tokenize = (input) => {
+	const tokens = [];
+	let current = "";
+	let inQuote = false;
+	let quoteChar = "";
+	for (const char of input) if (inQuote) if (char === quoteChar) inQuote = false;
+	else current += char;
+	else if (char === "\"" || char === "'") {
+		inQuote = true;
+		quoteChar = char;
+	} else if (char === " ") {
+		if (current.length > 0) {
+			tokens.push(current);
+			current = "";
+		}
+	} else current += char;
+	if (current.length > 0) tokens.push(current);
+	return tokens;
+};
+const buildCompleter = (program) => (line) => {
+	const allCommands = program.commands.flatMap((cmd) => [cmd.name(), ...cmd.aliases()]);
+	const hits = allCommands.filter((c) => c.startsWith(line));
+	return [hits.length > 0 ? hits : allCommands, line];
+};
+const runInteractiveMode = async (context, program) => {
+	const history = await loadHistory(HISTORY_FILE);
+	const rl = createInterface({
+		completer: buildCompleter(program),
+		historySize: MAX_HISTORY,
+		input: process.stdin,
+		output: process.stdout,
+		prompt: "donebear> "
+	});
+	for (const entry of [...history].toReversed()) rl.history.push(entry);
+	writeSuccess(context, "Done Bear interactive mode. Type \"exit\" or Ctrl+D to quit.");
+	writeInfo(context, "Commands: task, workspace, project, label, team, today, search, auth, whoami");
+	rl.prompt();
+	const sessionEntries = [];
+	for await (const line of rl) {
+		const trimmed = line.trim();
+		if (!trimmed) {
+			rl.prompt();
+			continue;
+		}
+		if (trimmed === "exit" || trimmed === "quit" || trimmed === ":q") break;
+		const tokens = tokenize(trimmed);
+		try {
+			await program.parseAsync([
+				"node",
+				"donebear",
+				...tokens
+			]);
+		} catch {}
+		sessionEntries.push(trimmed);
+		rl.prompt();
+	}
+	rl.close();
+	if (sessionEntries.length > 0) try {
+		const payload = {
+			entries: [...await loadHistory(HISTORY_FILE), ...sessionEntries].slice(-MAX_HISTORY),
+			version: 1
+		};
+		await mkdir(CONFIG_DIR, {
+			mode: 448,
+			recursive: true
+		});
+		await writeFile(HISTORY_FILE, `${JSON.stringify(payload, null, 2)}\n`, {
+			encoding: "utf-8",
+			mode: 384
+		});
+	} catch {}
+};
+//#endregion
+//#region src/env.ts
+const DEFAULT_ENV_FILES = [
+	".env.local",
+	".env",
+	"apps/manage-frontend/.env.local",
+	"apps/manage-api/.env"
+];
+let loaded = false;
+const loadCliEnvironmentFiles = () => {
+	if (loaded) return;
+	for (const relativePath of DEFAULT_ENV_FILES) {
+		const absolutePath = resolve(process.cwd(), relativePath);
+		if (!existsSync(absolutePath)) continue;
+		config({
+			override: false,
+			path: absolutePath,
+			quiet: true
+		});
+	}
+	loaded = true;
+};
+const readEnvValue = (key) => {
+	const value = process.env[key];
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+};
 //#endregion
 //#region src/jwt.ts
 const parseJwtBase64Url = (input) => {
 	const normalized = input.replaceAll("-", "+").replaceAll("_", "/");
 	const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
-	return Buffer.from(padded, "base64").toString("utf8");
+	return Buffer.from(padded, "base64").toString("utf-8");
 };
 const parseJwtClaims = (token) => {
 	const payloadPart = token.split(".").at(1);
@@ -115,7 +346,7 @@ const parseAuthFile = (payload) => {
 };
 const readStoredAuthSession = async () => {
 	try {
-		return parseAuthFile(await readFile(AUTH_FILE_PATH, "utf8")).session;
+		return parseAuthFile(await readFile(AUTH_FILE_PATH, "utf-8")).session;
 	} catch (error) {
 		if (isRecord(error) && error.code === "ENOENT") return null;
 		if (error instanceof CliError) throw error;
@@ -132,7 +363,7 @@ const writeStoredAuthSession = async (session) => {
 		recursive: true
 	});
 	await writeFile(AUTH_FILE_PATH, `${JSON.stringify(payload, null, 2)}\n`, {
-		encoding: "utf8",
+		encoding: "utf-8",
 		mode: 384
 	});
 };
@@ -140,34 +371,6 @@ const clearStoredAuthSession = async () => {
 	await rm(AUTH_FILE_PATH, { force: true });
 };
 //#endregion
-//#region src/env.ts
-const DEFAULT_ENV_FILES = [
-	".env.local",
-	".env",
-	"apps/manage-frontend/.env.local",
-	"apps/manage-api/.env"
-];
-let loaded = false;
-const loadCliEnvironmentFiles = () => {
-	if (loaded) return;
-	for (const relativePath of DEFAULT_ENV_FILES) {
-		const absolutePath = resolve(process.cwd(), relativePath);
-		if (!existsSync(absolutePath)) continue;
-		config({
-			override: false,
-			path: absolutePath,
-			quiet: true
-		});
-	}
-	loaded = true;
-};
-const readEnvValue = (key) => {
-	const value = process.env[key];
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : void 0;
-};
-//#endregion
 //#region src/supabase.ts
 const resolveSupabaseConfig = () => {
 	const url = readEnvValue("DONEBEAR_SUPABASE_URL") ?? "https://kdarvputxmlxqemisnbh.supabase.co";
@@ -199,19 +402,6 @@ const tokenResponseToStoredSession = (response) => {
 		} : null
 	};
 };
-const getSupabaseUser = async (supabaseUrl, publishableKey, accessToken) => {
-	const response = await fetch(`${supabaseUrl}/auth/v1/user`, { headers: {
-		apikey: publishableKey,
-		authorization: `Bearer ${accessToken}`
-	} });
-	if (!response.ok) throw new CliError(`Failed to load user (${response.status})`, EXIT_CODES.ERROR);
-	const data = await response.json();
-	if (typeof data.id !== "string") throw new CliError("No user returned for current token", EXIT_CODES.ERROR);
-	return {
-		email: typeof data.email === "string" ? data.email : null,
-		id: data.id
-	};
-};
 //#endregion
 //#region src/auth-session.ts
 const expiryFromClaims = (claims) => {
@@ -346,8 +536,8 @@ const requestNdjson = async (context, endpoint, options) => {
 };
 //#endregion
 //#region src/date-codecs.ts
-const ISO_DATE_ONLY_REGEX = /^(\d{4})-(\d{2})-(\d{2})$/;
-const ISO_INSTANT_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+const ISO_DATE_ONLY_REGEX = /^(\d{4})-(\d{2})-(\d{2})$/u;
+const ISO_INSTANT_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/u;
 const pad = (value, length = 2) => String(value).padStart(length, "0");
 const isFiniteEpoch = (value) => typeof value === "number" && Number.isFinite(value);
 const isValidDateOnlyParts = (parts) => {
@@ -417,118 +607,6 @@ const parseCliDateOnlyToEpoch = (value, fieldLabel) => {
 };
 const dateOnlyEpochFromLocalDate = (now = /* @__PURE__ */ new Date()) => Date.UTC(now.getFullYear(), now.getMonth(), now.getDate());
 //#endregion
-//#region src/output.ts
-const writeLine = (stream, message) => {
-	stream.write(`${message}\n`);
-};
-const colorize = (context, format, message) => {
-	if (!context.color) return message;
-	return styleText(format, message);
-};
-const writeJson = (value) => {
-	writeLine(process.stdout, JSON.stringify(value, null, 2));
-};
-const writeYaml = (value) => {
-	process.stdout.write(stringify(value));
-};
-const writeInfo = (context, message) => {
-	writeLine(process.stdout, colorize(context, "cyan", message));
-};
-const writeSuccess = (context, message) => {
-	writeLine(process.stdout, colorize(context, "green", message));
-};
-const writeWarning = (context, message) => {
-	writeLine(process.stderr, colorize(context, "yellow", message));
-};
-const writeError = (context, message) => {
-	writeLine(process.stderr, colorize(context, "red", message));
-};
-const writeDebug = (context, message) => {
-	if (!context.debug) return;
-	writeLine(process.stderr, colorize(context, "gray", `[debug] ${message}`));
-};
-const writeTotal = (context, count) => {
-	writeLine(process.stdout, colorize(context, "cyan", String(count)));
-};
-const escapeCsvField = (value) => {
-	if (value.includes(",") || value.includes("\"") || value.includes("\n")) return `"${value.replaceAll("\"", "\"\"")}"`;
-	return value;
-};
-const writeCsv = (headers, rows) => {
-	writeLine(process.stdout, headers.map(escapeCsvField).join(","));
-	for (const row of rows) writeLine(process.stdout, row.map(escapeCsvField).join(","));
-};
-const writeTsv = (headers, rows) => {
-	writeLine(process.stdout, headers.join("	"));
-	for (const row of rows) writeLine(process.stdout, row.join("	"));
-};
-/**
-* Write structured data to stdout, applying --jq filter and --limit if set.
-* Use this for all JSON/YAML/structured output from commands.
-*/
-const writeOutput = (context, data) => {
-	let result = data;
-	if (context.jq) try {
-		result = jmespath.search(result, context.jq);
-	} catch (error) {
-		throw new CliError(`Invalid --jq expression: ${error instanceof Error ? error.message : String(error)}`, EXIT_CODES.VALIDATION);
-	}
-	if (context.limit !== null && Array.isArray(result)) result = result.slice(0, context.limit);
-	switch (context.format) {
-		case "yaml":
-			writeYaml(result);
-			break;
-		case "json":
-			writeJson(result);
-			break;
-		default:
-			writeJson(result);
-			break;
-	}
-	if (context.copy) copyToClipboard(JSON.stringify(result, null, 2));
-};
-/**
-* Handles --total, --format csv, --format tsv, --format yaml output.
-* Returns true if the format was handled; caller renders text mode if false.
-*/
-const writeFormattedRows = (context, totalCount, headers, rows) => {
-	if (context.total) {
-		writeTotal(context, totalCount);
-		return true;
-	}
-	if (context.format === "yaml") {
-		const objects = rows.map((row) => Object.fromEntries(headers.map((h, i) => [h, row[i]])));
-		writeYaml(objects);
-		if (context.copy) copyToClipboard(stringify(objects));
-		return true;
-	}
-	if (context.format === "csv") {
-		writeCsv(headers, rows);
-		if (context.copy) copyToClipboard([headers.join(","), ...rows.map((r) => r.join(","))].join("\n"));
-		return true;
-	}
-	if (context.format === "tsv") {
-		writeTsv(headers, rows);
-		if (context.copy) copyToClipboard([headers.join("	"), ...rows.map((r) => r.join("	"))].join("\n"));
-		return true;
-	}
-	return false;
-};
-const copyToClipboard = (text) => {
-	try {
-		if (process.platform === "darwin") execSync("pbcopy", { input: text });
-		else if (process.platform === "win32") execSync("clip", { input: text });
-		else try {
-			execSync("xclip -selection clipboard", { input: text });
-		} catch {
-			execSync("xsel --clipboard --input", { input: text });
-		}
-		return true;
-	} catch {
-		return false;
-	}
-};
-//#endregion
 //#region src/manage-api.ts
 const TASK_FIELDS = `
   id
@@ -681,17 +759,17 @@ const WORKSPACE_HISTORY_QUERY = `
   }
 `;
 const API_KEY_CREATE_MUTATION = `
-  mutation ApiKeyCreate($label: String!) {
-    apiKeyCreate(label: $label) {
+  mutation ApiKeyCreate($label: String!, $scopes: [String!], $workspaceIds: [ID!], $expiresAt: DateTime) {
+    apiKeyCreate(label: $label, scopes: $scopes, workspaceIds: $workspaceIds, expiresAt: $expiresAt) {
       success lastSyncId
-      apiKey { id label keyPrefix createdAt }
+      apiKey { id label keyPrefix scopes workspaceIds expiresAt createdAt }
       token
     }
   }
 `;
 const API_KEYS_QUERY = `
   query ApiKeys {
-    apiKeys { id label keyPrefix lastUsedAt revokedAt createdAt }
+    apiKeys { id label keyPrefix scopes workspaceIds expiresAt lastUsedAt revokedAt createdAt }
   }
 `;
 const API_KEY_REVOKE_MUTATION = `
@@ -875,11 +953,14 @@ const toWorkspaceHistoryEntryFromGraphqlNode = (node) => ({
 });
 const toApiKeyRecordFromGraphqlNode = (node) => ({
 	createdAt: node.createdAt,
+	expiresAt: node.expiresAt,
 	id: node.id,
 	keyPrefix: node.keyPrefix,
 	label: node.label,
 	lastUsedAt: node.lastUsedAt,
-	revokedAt: node.revokedAt
+	revokedAt: node.revokedAt,
+	scopes: node.scopes,
+	workspaceIds: node.workspaceIds
 });
 const toChecklistItemRecord = (value) => {
 	if (typeof value !== "object" || value === null) return null;
@@ -898,11 +979,31 @@ const toChecklistItemRecord = (value) => {
 		workspaceId: row.workspaceId
 	};
 };
-const resolveApiBaseUrl = (context) => {
-	const fromContext = context.apiUrlOverride?.trim();
-	if (fromContext) return normalizeApiUrl(fromContext);
-	return normalizeApiUrl(readEnvValue("DONEBEAR_API_URL") ?? "https://api.donebear.com");
-};
+const resolveApiBaseUrl = (context) => {
+	const fromContext = context.apiUrlOverride?.trim();
+	if (fromContext) return normalizeApiUrl(fromContext);
+	return normalizeApiUrl(readEnvValue("DONEBEAR_API_URL") ?? "https://api.donebear.com");
+};
+const VIEWER_QUERY = `
+  query Viewer {
+    viewer {
+      id
+      email
+    }
+  }
+`;
+const loadViewer = async (context, options) => {
+	const data = await requestGraphql(context, `${options.baseUrl}/graphql`, {
+		query: VIEWER_QUERY,
+		token: options.token,
+		variables: {}
+	});
+	if (!data.viewer) throw new CliError("Could not resolve current user. The token may be invalid or revoked.", EXIT_CODES.AUTH_REQUIRED);
+	return {
+		email: data.viewer.email ?? null,
+		id: data.viewer.id
+	};
+};
 const listWorkspaces = async (context, options) => {
 	return (await requestGraphql(context, `${options.baseUrl}/graphql`, {
 		query: MY_WORKSPACES_QUERY,
@@ -1089,10 +1190,15 @@ const listWorkspaceHistory = async (context, options) => {
 	})).workspaceHistory.map(toWorkspaceHistoryEntryFromGraphqlNode);
 };
 const createApiKey = async (context, options) => {
-	const data = await requestGraphql(context, `${options.baseUrl}/graphql`, {
+	const endpoint = `${options.baseUrl}/graphql`;
+	const variables = { label: options.label };
+	if (options.scopes !== void 0) variables.scopes = options.scopes;
+	if (options.workspaceIds !== void 0) variables.workspaceIds = options.workspaceIds;
+	if (options.expiresAt !== void 0) variables.expiresAt = options.expiresAt;
+	const data = await requestGraphql(context, endpoint, {
 		query: API_KEY_CREATE_MUTATION,
 		token: options.token,
-		variables: { label: options.label }
+		variables
 	});
 	return {
 		...toApiKeyRecordFromGraphqlNode(data.apiKeyCreate.apiKey),
@@ -1140,10 +1246,13 @@ const resolveCommandContext = async (context) => {
 		token
 	};
 };
-const requireUserId = (resolvedToken) => {
-	const userId = resolvedToken.user?.id ?? null;
-	if (!(typeof userId === "string" && userId.length > 0)) throw new CliError("Could not determine user id from auth token", EXIT_CODES.AUTH_REQUIRED);
-	return userId;
+const requireUserId = async (context, commandContext) => {
+	const claimUserId = commandContext.resolvedToken.user?.id ?? null;
+	if (typeof claimUserId === "string" && claimUserId.length > 0) return claimUserId;
+	return (await loadViewer(context, {
+		baseUrl: commandContext.apiBaseUrl,
+		token: commandContext.token
+	})).id;
 };
 //#endregion
 //#region src/options.ts
@@ -1238,20 +1347,68 @@ const runWithErrorHandling = async (context, action) => {
 };
 //#endregion
 //#region src/commands/api-key.ts
-const runCreate = async (context, label) => {
+const PERMISSION_SCOPES = {
+	"full-access": [
+		"read",
+		"write",
+		"admin"
+	],
+	"read-only": ["read"]
+};
+const parseDuration = (duration) => {
+	const match = duration.match(/^(\d+)(d|y)$/u);
+	if (!match) throw new CliError(`Invalid duration "${duration}". Use a format like "30d", "90d", or "1y".`, EXIT_CODES.VALIDATION);
+	const [, rawAmount, unit] = match;
+	const amount = Number(rawAmount);
+	const now = /* @__PURE__ */ new Date();
+	if (unit === "d") now.setDate(now.getDate() + amount);
+	else now.setDate(now.getDate() + amount * 365);
+	return now;
+};
+const runCreate = async (context, label, options) => {
 	const { token } = await requireAuthToken(context);
+	const baseUrl = resolveApiBaseUrl(context);
+	let scopes;
+	if (options.permissions !== void 0) {
+		const level = options.permissions;
+		if (!PERMISSION_SCOPES[level]) throw new CliError(`Invalid permissions "${options.permissions}". Use "full-access" or "read-only".`, EXIT_CODES.VALIDATION);
+		scopes = PERMISSION_SCOPES[level];
+	}
+	let workspaceIds;
+	if (options.workspaces !== void 0) {
+		const slugs = options.workspaces.split(",").map((s) => s.trim()).filter(Boolean);
+		if (slugs.length === 0) throw new CliError("No workspace slugs provided for --workspaces.", EXIT_CODES.VALIDATION);
+		const allWorkspaces = await listWorkspaces(context, {
+			baseUrl,
+			token
+		});
+		workspaceIds = [];
+		for (const slug of slugs) {
+			const match = allWorkspaces.find((ws) => ws.urlKey === slug || ws.id === slug || ws.name.toLowerCase() === slug.toLowerCase());
+			if (!match) throw new CliError(`Workspace "${slug}" not found. Run \`donebear workspace list\` to see available workspaces.`, EXIT_CODES.VALIDATION);
+			workspaceIds.push(match.id);
+		}
+	}
+	let expiresAt;
+	if (options.expires !== void 0) expiresAt = parseDuration(options.expires).toISOString();
 	const key = await createApiKey(context, {
-		baseUrl: resolveApiBaseUrl(context),
+		baseUrl,
+		expiresAt,
 		label,
-		token
+		scopes,
+		token,
+		workspaceIds
 	});
 	if (context.json) {
 		writeOutput(context, {
 			createdAt: key.createdAt,
+			expiresAt: key.expiresAt,
 			id: key.id,
 			keyPrefix: key.keyPrefix,
 			label: key.label,
-			token: key.token
+			scopes: key.scopes,
+			token: key.token,
+			workspaceIds: key.workspaceIds
 		});
 		return;
 	}
@@ -1259,6 +1416,10 @@ const runCreate = async (context, label) => {
 	writeInfo(context, "");
 	writeInfo(context, `  ${key.token}`);
 	writeInfo(context, "");
+	writeInfo(context, `  Scopes: ${key.scopes.join(", ")}`);
+	if (key.workspaceIds && key.workspaceIds.length > 0) writeInfo(context, `  Restricted to workspaces: ${key.workspaceIds.join(", ")}`);
+	if (key.expiresAt) writeInfo(context, `  Expires: ${new Date(key.expiresAt).toLocaleDateString()}`);
+	writeInfo(context, "");
 	writeWarning(context, "Save this key now — it will not be shown again.");
 };
 const runList = async (context) => {
@@ -1278,7 +1439,10 @@ const runList = async (context) => {
 	for (const key of keys) {
 		const status = key.revokedAt ? " (revoked)" : "";
 		const lastUsed = key.lastUsedAt ? `Last used: ${new Date(key.lastUsedAt).toLocaleDateString()}` : "Never used";
-		writeInfo(context, `${key.keyPrefix}...  ${key.label}  ${lastUsed}${status}  [${key.id}]`);
+		const scopeStr = `[${key.scopes.join(",")}]`;
+		const wsStr = key.workspaceIds && key.workspaceIds.length > 0 ? ` ws:${key.workspaceIds.length}` : "";
+		const expStr = key.expiresAt ? ` exp:${new Date(key.expiresAt).toLocaleDateString()}` : "";
+		writeInfo(context, `${key.keyPrefix}...  ${key.label}  ${scopeStr}${wsStr}${expStr}  ${lastUsed}${status}  [${key.id}]`);
 	}
 };
 const runRevoke = async (context, keyId) => {
@@ -1301,6 +1465,8 @@ const registerApiKeyCommands = (program) => {
 	const apiKey = program.command("api-key").alias("key").description("Manage personal API keys").addHelpText("after", `
 Examples:
   donebear api-key create "Raycast"
+  donebear api-key create "CI" --permissions read-only --expires 90d
+  donebear api-key create "Scoped" --workspaces my-org,side-project --expires 1y
   donebear api-key list
   donebear api-key revoke <key-id>
 `).action(async (_options, command) => {
@@ -1309,10 +1475,10 @@ Examples:
 			await runList(context);
 		});
 	});
-	apiKey.command("create <label>").description("Create a new personal API key").action(async (label, _options, command) => {
+	apiKey.command("create <label>").description("Create a new personal API key").option("--permissions <value>", "Permission level: \"full-access\" or \"read-only\"", "full-access").option("--workspaces <slugs>", "Comma-separated workspace slugs to restrict the key to").option("--expires <duration>", "Expiration duration, e.g. \"30d\", \"90d\", \"1y\"").action(async (label, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
-			await runCreate(context, label);
+			await runCreate(context, label, options);
 		});
 	});
 	apiKey.command("list").description("List all personal API keys").action(async (_options, command) => {
@@ -1669,7 +1835,7 @@ const resolveTaskView = (task) => {
 const formatEpochDate = (epochMs) => formatInstantEpoch(epochMs);
 //#endregion
 //#region src/command-helpers.ts
-const SHORT_ID_SUFFIX_PATTERN = /-([a-f0-9]{8})$/;
+const SHORT_ID_SUFFIX_PATTERN = /-([a-f0-9]{8})$/u;
 /**
 * Find a record by reference: exact ID, key, ID prefix, slug shortId, or name.
 * Works for any entity with id, key, and name fields.
@@ -1723,7 +1889,7 @@ const taskListLines = (tasks) => tasks.map((task) => {
 });
 //#endregion
 //#region src/workspace-context.ts
-const WORKSPACE_URL_KEY_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const WORKSPACE_URL_KEY_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 const fetchWorkspaces = async (context, options) => {
 	const workspaces = await listWorkspaces(context, {
 		baseUrl: options.apiBaseUrl,
@@ -1782,7 +1948,7 @@ const byReference = (workspaces, reference) => {
 	return null;
 };
 const toWorkspaceUrlKey = (name) => {
-	return name.trim().toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-+|-+$/g, "").replaceAll(/-{2,}/g, "-").slice(0, 50);
+	return name.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "").replaceAll(/-{2,}/gu, "-").slice(0, 50);
 };
 const isValidWorkspaceUrlKey = (value) => WORKSPACE_URL_KEY_REGEX.test(value) && value.length >= 3;
 const resolveWorkspace = async (context, options) => {
@@ -1924,11 +2090,11 @@ Examples:
 		});
 	});
 };
+const packageManifest = createRequire(import.meta.url)("../package.json");
 //#endregion
 //#region src/commands/doctor.ts
-const packageManifest$1 = createRequire(import.meta.url)("../package.json");
 const checkCliVersion = async () => {
-	const current = packageManifest$1.version;
+	const current = packageManifest.version;
 	try {
 		const response = await fetch("https://registry.npmjs.org/donebear/latest", { signal: AbortSignal.timeout(5e3) });
 		if (!response.ok) return {
@@ -1993,7 +2159,7 @@ const checkAuth = async (context) => {
 };
 const checkWorkspace = async () => {
 	try {
-		const { ensureLocalContext } = await import("./context-store-D0Z9vbaU.mjs");
+		const { ensureLocalContext } = await import("./context-store-ClAx1T2N.mjs");
 		const localContext = await ensureLocalContext();
 		if (!localContext.workspaceId) return {
 			message: "No workspace selected (run `donebear workspace use`)",
@@ -2208,6 +2374,7 @@ const normalizeThingsLabelLookupKey = (value) => value.trim().toLocaleLowerCase(
 //#region src/import/model-id.ts
 const IMPORT_ID_NAMESPACE = "b1f9f0ac-9f76-54ed-8eb0-7d6d3a0a0a31";
 const SYNC_COMPOSITE_ID_NAMESPACE = "92a73695-d772-4b43-9fb4-d79f5fbef300";
+const IDEMPOTENCY_ID_NAMESPACE = "4c8af5e2-1d36-5a0b-9c47-2f81b3d6e955";
 const uuidToBytes = (uuid) => {
 	const normalized = uuid.replaceAll("-", "");
 	if (normalized.length !== 32) throw new Error(`Invalid UUID namespace: ${uuid}`);
@@ -2225,7 +2392,7 @@ const bytesToUuid = (bytes) => {
 };
 const createUuidV5 = (name, namespace) => {
 	const namespaceBytes = uuidToBytes(namespace);
-	const hash = createHash("sha1").update(namespaceBytes).update(Buffer.from(name, "utf8")).digest();
+	const hash = createHash("sha1").update(namespaceBytes).update(Buffer.from(name, "utf-8")).digest();
 	const bytes = Uint8Array.from(hash.subarray(0, 16));
 	const versionByte = bytes.at(6);
 	const variantByte = bytes.at(8);
@@ -2236,6 +2403,7 @@ const createUuidV5 = (name, namespace) => {
 };
 const createCompositeSyncId = (model, parts) => createUuidV5(`${model}:${JSON.stringify(parts)}`, SYNC_COMPOSITE_ID_NAMESPACE);
 const createDeterministicImportId = (params) => createUuidV5(`things:${params.workspaceId}:${params.modelName}:${params.sourceId}`, IMPORT_ID_NAMESPACE);
+const createIdempotentMutationId = (params) => createUuidV5(`idem:${params.workspaceId}:${params.modelName}:${params.part}:${params.key}`, IDEMPOTENCY_ID_NAMESPACE);
 const createTaskLabelId = (params) => createCompositeSyncId("TaskLabel", [
 	params.workspaceId,
 	params.taskId,
@@ -2665,7 +2833,6 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 				};
 				return __assign.apply(this, arguments);
 			};
-			Object.create;
 			function __spreadArray(to, from, pack) {
 				if (pack || arguments.length === 2) {
 					for (var i = 0, l = from.length, ar; i < l; i++) if (ar || !(i in from)) {
@@ -2678,7 +2845,6 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 			function __await(v) {
 				return this instanceof __await ? (this.v = v, this) : new __await(v);
 			}
-			Object.create;
 			const callbackiterresult = function(_super) {
 				__extends(CallbackIterResult, _super);
 				function CallbackIterResult(method, args, iterator) {
@@ -3515,7 +3681,8 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 					this.month += months;
 					if (this.month > 12) {
 						var yearDiv = Math.floor(this.month / 12);
-						this.month = pymod(this.month, 12);
+						var monthMod = pymod(this.month, 12);
+						this.month = monthMod;
 						this.year += yearDiv;
 						if (this.month === 0) {
 							this.month = 12;
@@ -4134,8 +4301,7 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 				var month = Math.floor((h + l - 7 * m + 114) / 31);
 				var day = (h + l - 7 * m + 114) % 31 + 1;
 				var date = Date.UTC(y, month - 1, day + offset);
-				var yearStart = Date.UTC(y, 0, 1);
-				return [Math.ceil((date - yearStart) / (1e3 * 60 * 60 * 24))];
+				return [Math.ceil((date - Date.UTC(y, 0, 1)) / (1e3 * 60 * 60 * 24))];
 			}
 			const iterinfo = function() {
 				function Iterinfo(options) {
@@ -4461,7 +4627,8 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 					if (noCache === void 0) noCache = false;
 					this._cache = noCache ? null : new Cache();
 					this.origOptions = initializeOptions(options);
-					this.options = parseOptions(options).parsedOptions;
+					var parsedOptions = parseOptions(options).parsedOptions;
+					this.options = parsedOptions;
 				}
 				RRule.parseText = function(text, language) {
 					return parseText(text, language);
@@ -5152,17 +5319,17 @@ const THINGS_WEEKDAY_TO_RRULE = [
 	"SA"
 ];
 const parseNumericPlistField = (xml, key) => {
-	const match = new RegExp(`<key>${key}</key>\\s*<(integer|real)>([^<]+)</\\1>`).exec(xml);
+	const match = new RegExp(`<key>${key}</key>\\s*<(integer|real)>([^<]+)</\\1>`, "u").exec(xml);
 	if (!match?.[2]) return null;
 	const parsed = Number(match[2]);
 	return Number.isFinite(parsed) ? parsed : null;
 };
-const PLIST_OFFSETS_ARRAY_PATTERN = /<key>of<\/key>\s*<array>([\s\S]*?)<\/array>/;
+const PLIST_OFFSETS_ARRAY_PATTERN = /<key>of<\/key>\s*<array>([\s\S]*?)<\/array>/u;
 const parseOffsets = (xml) => {
 	const arrayMatch = PLIST_OFFSETS_ARRAY_PATTERN.exec(xml);
 	if (!arrayMatch?.[1]) return [];
 	const offsets = [];
-	for (const dictMatch of arrayMatch[1].matchAll(/<dict>([\s\S]*?)<\/dict>/g)) {
+	for (const dictMatch of arrayMatch[1].matchAll(/<dict>([\s\S]*?)<\/dict>/gu)) {
 		const [, fragment] = dictMatch;
 		if (!fragment) continue;
 		const weekday = parseNumericPlistField(fragment, "wd");
@@ -5290,11 +5457,11 @@ const normalizeTitle = (value, fallback) => {
 	const trimmed = value?.trim();
 	return trimmed && trimmed.length > 0 ? trimmed : fallback;
 };
-const NON_ALPHANUMERIC_PATTERN = /[^A-Z0-9]+/g;
-const WHITESPACE_SPLIT_PATTERN = /\s+/;
-const NON_ALPHANUMERIC_STRICT_PATTERN = /[^A-Z0-9]/g;
+const NON_ALPHANUMERIC_PATTERN = /[^A-Z0-9]+/gu;
+const WHITESPACE_SPLIT_PATTERN = /\s+/u;
+const NON_ALPHANUMERIC_STRICT_PATTERN = /[^A-Z0-9]/gu;
 const READABLE_TEXT_PATTERN = /^[\t\n\r\u0020-\u007E\u00A0-\uFFFF]*$/u;
-const EMAIL_SPLIT_PATTERN = /[,\n;]/;
+const EMAIL_SPLIT_PATTERN = /[,\n;]/u;
 const normalizeKeyBase = (value, fallback) => {
 	const initials = value.toUpperCase().replace(NON_ALPHANUMERIC_PATTERN, " ").trim().split(WHITESPACE_SPLIT_PATTERN).filter((word) => word.length > 0).map((word) => word[0] ?? "").join("");
 	const compact = value.toUpperCase().replace(NON_ALPHANUMERIC_STRICT_PATTERN, "");
@@ -5312,7 +5479,7 @@ const buildUniqueKeys = (items, options) => {
 		const base = normalizeKeyBase(normalizeTitle(item.title, options.fallback), options.fallback).slice(0, options.maxLength);
 		let candidate = base || options.fallback;
 		if (used.has(candidate)) {
-			const suffixBase = item.uuid.replaceAll(/[^a-zA-Z0-9]/g, "").slice(-4);
+			const suffixBase = item.uuid.replaceAll(/[^a-zA-Z0-9]/gu, "").slice(-4);
 			const suffix = suffixBase.length > 0 ? suffixBase.toUpperCase() : "X";
 			const headLength = Math.max(1, options.maxLength - suffix.length - 1);
 			candidate = `${candidate.slice(0, headLength)}-${suffix}`;
@@ -5384,7 +5551,7 @@ const pickCompletedAt = (task) => {
 };
 const sortValue = (primary, fallback) => typeof primary === "number" ? primary : fallback;
 const sanitizeBuffer = (buffer) => {
-	const asText = buffer.toString("utf8");
+	const asText = buffer.toString("utf-8");
 	if (!asText.includes("�") && READABLE_TEXT_PATTERN.test(asText)) {
 		const trimmed = asText.trim();
 		if (trimmed.length > 0) return trimmed;
@@ -5998,7 +6165,7 @@ const THINGS_CONTAINER_PATH = join(homedir(), "Library/Group Containers/JLMPQHK8
 const THINGS_BUNDLE_NAME = "Things Database.thingsdatabase";
 const THINGS_SQLITE_FILE = "main.sqlite";
 const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
-const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/i;
+const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/iu;
 const isUrlLike = (value) => URL_SCHEME_PATTERN.test(value);
 const resolveInputPath = (databaseUrl) => {
 	if (!isUrlLike(databaseUrl)) return resolve(databaseUrl);
@@ -6061,7 +6228,7 @@ const toStringValue = (value) => {
 		return trimmed.length > 0 ? trimmed : null;
 	}
 	if (Buffer.isBuffer(value)) {
-		const text = value.toString("utf8").trim();
+		const text = value.toString("utf-8").trim();
 		return text.length > 0 ? text : null;
 	}
 	return null;
@@ -6407,7 +6574,7 @@ const parseMetadataMode = (value) => {
 };
 const runThingsImportCommand = async (context, options, workspaceOverride) => {
 	const commandContext = await resolveCommandContext(context);
-	const creatorId = requireUserId(commandContext.resolvedToken);
+	const creatorId = await requireUserId(context, commandContext);
 	const metadataMode = parseMetadataMode(options.metadataMode);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
 		apiBaseUrl: commandContext.apiBaseUrl,
@@ -6453,97 +6620,6 @@ Notes:
 	});
 };
 //#endregion
-//#region src/commands/interactive.ts
-const HISTORY_FILE = join(CONFIG_DIR, "history.json");
-const MAX_HISTORY = 200;
-const isHistoryFile = (value) => {
-	if (typeof value !== "object" || value === null) return false;
-	const record = value;
-	return record.version === 1 && Array.isArray(record.entries) && record.entries.every((e) => typeof e === "string");
-};
-const loadHistory = async (historyFile) => {
-	try {
-		const raw = await readFile(historyFile, "utf8");
-		const parsed = JSON.parse(raw);
-		if (isHistoryFile(parsed)) return parsed.entries;
-		return [];
-	} catch {
-		return [];
-	}
-};
-const tokenize = (input) => {
-	const tokens = [];
-	let current = "";
-	let inQuote = false;
-	let quoteChar = "";
-	for (const char of input) if (inQuote) if (char === quoteChar) inQuote = false;
-	else current += char;
-	else if (char === "\"" || char === "'") {
-		inQuote = true;
-		quoteChar = char;
-	} else if (char === " ") {
-		if (current.length > 0) {
-			tokens.push(current);
-			current = "";
-		}
-	} else current += char;
-	if (current.length > 0) tokens.push(current);
-	return tokens;
-};
-const buildCompleter = (program) => (line) => {
-	const allCommands = program.commands.flatMap((cmd) => [cmd.name(), ...cmd.aliases()]);
-	const hits = allCommands.filter((c) => c.startsWith(line));
-	return [hits.length > 0 ? hits : allCommands, line];
-};
-const runInteractiveMode = async (context, program) => {
-	const history = await loadHistory(HISTORY_FILE);
-	const rl = createInterface({
-		completer: buildCompleter(program),
-		historySize: MAX_HISTORY,
-		input: process.stdin,
-		output: process.stdout,
-		prompt: "donebear> "
-	});
-	for (const entry of [...history].toReversed()) rl.history.push(entry);
-	writeSuccess(context, "Done Bear interactive mode. Type \"exit\" or Ctrl+D to quit.");
-	writeInfo(context, "Commands: task, workspace, project, label, team, today, search, auth, whoami");
-	rl.prompt();
-	const sessionEntries = [];
-	for await (const line of rl) {
-		const trimmed = line.trim();
-		if (!trimmed) {
-			rl.prompt();
-			continue;
-		}
-		if (trimmed === "exit" || trimmed === "quit" || trimmed === ":q") break;
-		const tokens = tokenize(trimmed);
-		try {
-			await program.parseAsync([
-				"node",
-				"donebear",
-				...tokens
-			]);
-		} catch {}
-		sessionEntries.push(trimmed);
-		rl.prompt();
-	}
-	rl.close();
-	if (sessionEntries.length > 0) try {
-		const payload = {
-			entries: [...await loadHistory(HISTORY_FILE), ...sessionEntries].slice(-MAX_HISTORY),
-			version: 1
-		};
-		await mkdir(CONFIG_DIR, {
-			mode: 448,
-			recursive: true
-		});
-		await writeFile(HISTORY_FILE, `${JSON.stringify(payload, null, 2)}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-	} catch {}
-};
-//#endregion
 //#region src/commands/label.ts
 const sortLabels = (labels, sort) => {
 	const sorted = [...labels];
@@ -6635,7 +6711,7 @@ const runLabelShow = async (context, labelRef, options) => {
 	writeInfo(context, `createdAt: ${formatEpochDate(label.createdAt) ?? "(none)"}`);
 	writeInfo(context, `updatedAt: ${formatEpochDate(label.updatedAt) ?? "(none)"}`);
 };
-const UUID_REGEX$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const UUID_REGEX$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 const resolveTaskForLabel = async (context, options) => {
 	const taskRef = options.taskRef.trim();
 	if (!taskRef) throw new Error("Task id is required.");
@@ -6882,7 +6958,7 @@ const getProjectStatus = (project) => {
 };
 const parseTargetDate = (value) => parseCliDateOnlyToEpoch(value, "target date");
 const generateProjectSlug = (name, id) => {
-	const slug = name.toLowerCase().trim().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-|-$/g, "").slice(0, 39);
+	const slug = name.toLowerCase().trim().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-|-$/gu, "").slice(0, 39);
 	const shortId = id.replaceAll("-", "").slice(0, 8);
 	return slug ? `${slug}-${shortId}` : shortId;
 };
@@ -7002,14 +7078,14 @@ const resolveProjectName = async (context, rawName) => {
 		const trimmed = rawName.trim();
 		if (trimmed.length > 0) return trimmed;
 	}
-	const { promptForValue } = await import("./prompt-FRvfbinv.mjs");
+	const { promptForValue } = await import("./prompt-B7mDo4K7.mjs");
 	const prompted = await promptForValue(context, "Project name");
 	if (prompted) return prompted;
 	throw new CliError("Project name is required.", EXIT_CODES.VALIDATION, "Provide a name: donebear project add \"My project\"");
 };
 const runProjectAdd = async (context, name, options) => {
 	const commandContext = await resolveCommandContext(context);
-	const userId = requireUserId(commandContext.resolvedToken);
+	const userId = await requireUserId(context, commandContext);
 	const normalizedName = await resolveProjectName(context, name);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
 		apiBaseUrl: commandContext.apiBaseUrl,
@@ -7017,17 +7093,23 @@ const runProjectAdd = async (context, name, options) => {
 		token: commandContext.token,
 		workspaceRef: normalizeWorkspaceRef(options.workspace)
 	});
-	const projectId = randomUUID();
+	const idempotencyId = (part) => options.idempotencyKey ? createIdempotentMutationId({
+		key: options.idempotencyKey,
+		modelName: "Project",
+		part,
+		workspaceId: workspace.id
+	}) : null;
+	const projectId = idempotencyId("model") ?? randomUUID();
 	const now = Date.now();
 	const key = generateProjectSlug(normalizedName, projectId);
 	await mutateModel(context, {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
-			batchId: randomUUID(),
+			batchId: idempotencyId("batch") ?? randomUUID(),
 			transactions: [{
 				action: "INSERT",
-				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
+				clientId: options.idempotencyKey ? "cli-idem" : commandContext.localContext.clientId,
+				clientTxId: idempotencyId("tx") ?? randomUUID(),
 				modelId: projectId,
 				modelName: "Project",
 				payload: {
@@ -7194,7 +7276,7 @@ Agent tip: run "donebear spec project add" for full option reference
 			await runProjectShow(context, projectRef, { workspace: workspaceOverride ?? normalizeWorkspaceRef(options.workspace) ?? void 0 });
 		});
 	});
-	project.command("add").alias("create").description("Create a project").argument("[name]", "Project name (prompted interactively if omitted)").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").option("-d, --description <text>", "Project description").option("--target-date <date>", "Target date (YYYY-MM-DD)").action(async (name, options, command) => {
+	project.command("add").alias("create").description("Create a project").argument("[name]", "Project name (prompted interactively if omitted)").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").option("-d, --description <text>", "Project description").option("--target-date <date>", "Target date (YYYY-MM-DD)").option("--idempotency-key <key>", "Stable key making retries safe (repeated calls create only one project)").action(async (name, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
 			await runProjectAdd(context, name, {
@@ -7253,7 +7335,7 @@ Agent tip: run "donebear spec project add" for full option reference
 };
 //#endregion
 //#region src/commands/task.ts
-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 const DEFAULT_TASK_LIST_LIMIT = 20;
 const VALID_TASK_VIEWS = new Set([
 	"inbox",
@@ -7417,7 +7499,7 @@ const resolveNotes = async (_context, flagNotes) => {
 };
 const runTaskAdd = async (context, title, options, workspaceOverride) => {
 	const commandContext = await resolveCommandContext(context);
-	const userId = requireUserId(commandContext.resolvedToken);
+	const userId = await requireUserId(context, commandContext);
 	const normalizedTitle = await resolveTitle(context, title);
 	const notes = await resolveNotes(context, options.notes);
 	const { workspace, autoSelected } = await resolveWorkspace(context, {
@@ -7435,7 +7517,13 @@ const runTaskAdd = async (context, title, options, workspaceOverride) => {
 		token: commandContext.token,
 		workspaceId: workspace.id
 	}).then((teams) => resolveEntityId(teams, options.team, "Team")) : Promise.resolve(null)]);
-	const taskId = randomUUID();
+	const idempotencyId = (part) => options.idempotencyKey ? createIdempotentMutationId({
+		key: options.idempotencyKey,
+		modelName: "Task",
+		part,
+		workspaceId: workspace.id
+	}) : null;
+	const taskId = idempotencyId("model") ?? randomUUID();
 	const now = Date.now();
 	const view = parseTaskView(options.when);
 	const startFields = buildTaskStartFields(view);
@@ -7443,11 +7531,11 @@ const runTaskAdd = async (context, title, options, workspaceOverride) => {
 	await mutateModel(context, {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
-			batchId: randomUUID(),
+			batchId: idempotencyId("batch") ?? randomUUID(),
 			transactions: [{
 				action: "INSERT",
-				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
+				clientId: options.idempotencyKey ? "cli-idem" : commandContext.localContext.clientId,
+				clientTxId: idempotencyId("tx") ?? randomUUID(),
 				modelId: taskId,
 				modelName: "Task",
 				payload: {
@@ -7809,15 +7897,15 @@ Views:  inbox | anytime | today | upcoming | someday | logbook | trash
 			await runTaskRandom(context, options, workspaceOverride);
 		});
 	});
-	task.command("add").alias("create").description("Create a task").argument("[title]", "Task title (prompted interactively if omitted)").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").option("-n, --notes <text>", "Task notes (or pipe via stdin)").option("--when <view>", "inbox|anytime|today|upcoming|someday", "inbox").option("--deadline <date>", "Deadline (YYYY-MM-DD or ISO datetime)").option("--project <key-or-id>", "Project key or id").option("--team <key-or-id>", "Team key or id").addHelpText("after", `
+	task.command("add").alias("create").description("Create a task").argument("[title]", "Task title (prompted interactively if omitted)").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").option("-n, --notes <text>", "Task notes (or pipe via stdin)").option("--when <view>", "inbox|anytime|today|upcoming|someday", "inbox").option("--deadline <date>", "Deadline (YYYY-MM-DD or ISO datetime)").option("--project <key-or-id>", "Project key or id").option("--team <key-or-id>", "Team key or id").option("--idempotency-key <key>", "Stable key making retries safe (repeated calls create only one task)").addHelpText("after", `
 Examples:
   donebear task add "Fix login bug" --when today --json
-  donebear task add "Write tests" --deadline 2026-03-15 --project PROJ --json
+  donebear task add "Write tests" --deadline 2030-03-15 --project PROJ --json
   donebear task add "Review PR" --when anytime --notes "Check for XSS" --json
   echo "Multi-line notes" | donebear task add "My task"
   donebear task add                       # prompts for title interactively
 
-Date format: YYYY-MM-DD (e.g. 2026-03-15)
+Date format: YYYY-MM-DD (e.g. 2030-03-15)
 View (--when): inbox | anytime | today | upcoming | someday
 `).action(async (title, options, command) => {
 		const context = contextFromCommand(command);
@@ -8161,6 +8249,15 @@ Examples:
 const OVERVIEW = {
 	authentication: "Set DONEBEAR_TOKEN env var, or run: donebear auth login",
 	commands: {
+		"api-key": {
+			description: "Manage personal API keys",
+			quick_example: "donebear api-key list --json",
+			subcommands: [
+				"create",
+				"list",
+				"revoke"
+			]
+		},
 		auth: {
 			description: "Authentication",
 			quick_example: "donebear auth status --json",
@@ -8188,9 +8285,15 @@ const OVERVIEW = {
 			subcommands: ["things"]
 		},
 		label: {
-			description: "List workspace labels",
+			description: "Manage workspace labels and task label assignments",
 			quick_example: "donebear label list --json",
-			subcommands: ["list", "show"]
+			subcommands: [
+				"list",
+				"show",
+				"create",
+				"add",
+				"remove"
+			]
 		},
 		project: {
 			description: "Manage projects",
@@ -8228,6 +8331,7 @@ const OVERVIEW = {
 				"read",
 				"append",
 				"prepend",
+				"random",
 				"checklist"
 			]
 		},
@@ -8276,6 +8380,70 @@ const OVERVIEW = {
 	workspace_targeting: "Prefix any command: donebear workspace=<slug> task list"
 };
 const COMMAND_SPECS = {
+	"api-key create": {
+		arguments: { label: {
+			description: "Human-readable label for the key",
+			required: true,
+			type: "string"
+		} },
+		command: "api-key create",
+		examples: [
+			"donebear api-key create \"Raycast\" --json",
+			"donebear api-key create \"CI\" --permissions read-only --expires 90d --json",
+			"donebear api-key create \"Scoped\" --workspaces my-org,side-project --expires 1y --json"
+		],
+		json_output: {
+			createdAt: "string",
+			expiresAt: "string | null",
+			id: "string",
+			keyPrefix: "string",
+			label: "string",
+			scopes: "string[]",
+			token: "string",
+			workspaceIds: "string[] | null"
+		},
+		notes: "The full token is only shown once at creation time. Scopes default to full-access (read, write, admin).",
+		options: {
+			"--expires": {
+				description: "Expiration duration, e.g. \"30d\", \"90d\", \"1y\"",
+				type: "string"
+			},
+			"--permissions": {
+				default: "full-access",
+				description: "\"full-access\" (read, write, admin) or \"read-only\" (read only)",
+				enum: ["full-access", "read-only"],
+				type: "string"
+			},
+			"--workspaces": {
+				description: "Comma-separated workspace slugs to restrict the key to",
+				type: "string"
+			}
+		},
+		usage: "donebear api-key create <label> [options]"
+	},
+	"api-key list": {
+		command: "api-key list",
+		examples: ["donebear api-key list --json"],
+		json_output: { keys: "ApiKeyRecord[]" },
+		notes: "Each key includes scopes, workspaceIds, and expiresAt fields.",
+		options: {},
+		usage: "donebear api-key list"
+	},
+	"api-key revoke": {
+		arguments: { "key-id": {
+			description: "The UUID of the API key to revoke",
+			required: true,
+			type: "string"
+		} },
+		command: "api-key revoke",
+		examples: ["donebear api-key revoke abc12345 --json"],
+		json_output: {
+			id: "string",
+			ok: "boolean"
+		},
+		options: {},
+		usage: "donebear api-key revoke <key-id>"
+	},
 	"auth login": {
 		command: "auth login",
 		examples: [
@@ -8289,10 +8457,21 @@ const COMMAND_SPECS = {
 			user: "{ id, email }"
 		},
 		non_interactive: "For CI/scripts, set DONEBEAR_TOKEN=<token> instead of using auth login.",
-		options: { "--no-open": {
-			description: "Print auth URL instead of opening browser",
-			type: "boolean"
-		} },
+		options: {
+			"--no-open": {
+				description: "Print auth URL instead of opening browser",
+				type: "boolean"
+			},
+			"--port": {
+				default: 8787,
+				description: "Loopback callback port for the OAuth redirect",
+				type: "number"
+			},
+			"--timeout": {
+				description: "Seconds to wait for the OAuth callback",
+				type: "number"
+			}
+		},
 		usage: "donebear auth login [options]"
 	},
 	"auth status": {
@@ -8414,6 +8593,10 @@ const COMMAND_SPECS = {
 				enum: ["note", "none"],
 				type: "string"
 			},
+			"--skip-teams": {
+				description: "Skip importing Things Areas as Teams and TeamProject links",
+				type: "boolean"
+			},
 			"--workspace": {
 				description: "Workspace id, slug, or name",
 				type: "string"
@@ -8429,7 +8612,15 @@ const COMMAND_SPECS = {
 			ok: "boolean",
 			workspace: "WorkspaceSummary"
 		},
-		options: { "--workspace": { type: "string" } },
+		options: {
+			"--sort": {
+				default: "alpha",
+				description: "Sort order: alpha|count",
+				enum: ["alpha", "count"],
+				type: "string"
+			},
+			"--workspace": { type: "string" }
+		},
 		usage: "donebear label list [options]"
 	},
 	"project add": {
@@ -8448,6 +8639,10 @@ const COMMAND_SPECS = {
 		notes: "URL slug is auto-generated from name (e.g. 'Q2 Launch' → 'q2-launch-a1b2c3d4').",
 		options: {
 			"--description": { type: "string" },
+			"--idempotency-key": {
+				description: "Stable key making retries safe (repeated calls create only one project)",
+				type: "string"
+			},
 			"--target-date": {
 				description: "Target completion date",
 				format: "YYYY-MM-DD",
@@ -8486,8 +8681,25 @@ const COMMAND_SPECS = {
 			ok: "boolean"
 		},
 		options: {
+			"--clear-description": {
+				description: "Clear the project description",
+				type: "boolean"
+			},
+			"--clear-target-date": {
+				description: "Clear the project target date",
+				type: "boolean"
+			},
 			"--description": { type: "string" },
 			"--name": { type: "string" },
+			"--status": {
+				description: "Set status",
+				enum: [
+					"active",
+					"done",
+					"archived"
+				],
+				type: "string"
+			},
 			"--target-date": {
 				format: "YYYY-MM-DD",
 				type: "string"
@@ -8587,6 +8799,10 @@ const COMMAND_SPECS = {
 				format: "YYYY-MM-DD",
 				type: "string"
 			},
+			"--idempotency-key": {
+				description: "Stable key making retries safe (repeated calls create only one task)",
+				type: "string"
+			},
 			"--notes": {
 				description: "Body / description text (or pipe via stdin)",
 				type: "string"
@@ -8677,15 +8893,35 @@ const COMMAND_SPECS = {
 			type: "string"
 		} },
 		command: "task edit",
-		examples: ["donebear task edit abc1 --title \"Updated title\" --json", "donebear task edit abc1 --when today --deadline 2026-03-20 --json"],
+		examples: [
+			"donebear task edit abc1 --title \"Updated title\" --json",
+			"donebear task edit abc1 --when today --deadline 2030-01-15 --json",
+			"donebear task edit abc1 --clear-deadline --json"
+		],
 		json_output: {
 			action: "string",
 			id: "string",
 			ok: "boolean"
 		},
 		options: {
+			"--clear-deadline": {
+				description: "Clear the due date",
+				type: "boolean"
+			},
+			"--clear-notes": {
+				description: "Clear notes/description",
+				type: "boolean"
+			},
+			"--clear-project": {
+				description: "Remove the task from its project",
+				type: "boolean"
+			},
+			"--clear-team": {
+				description: "Remove the task from its team",
+				type: "boolean"
+			},
 			"--deadline": {
-				description: "Set due date (pass empty string to clear)",
+				description: "Set due date",
 				format: "YYYY-MM-DD",
 				type: "string"
 			},
@@ -8922,6 +9158,16 @@ const COMMAND_SPECS = {
 	}
 };
 const TOP_LEVEL_SPECS = {
+	"api-key": {
+		command: "api-key",
+		description: "Manage personal API keys",
+		subcommands: {
+			create: "Create a new API key (--permissions, --workspaces, --expires)",
+			list: "List all API keys with scopes and expiration",
+			revoke: "Revoke an API key by id"
+		},
+		tip: "donebear spec api-key create  —  get full spec for api-key create"
+	},
 	auth: {
 		command: "auth",
 		description: "Authentication",
@@ -8941,9 +9187,12 @@ const TOP_LEVEL_SPECS = {
 	},
 	label: {
 		command: "label",
-		description: "List workspace labels",
+		description: "Manage workspace labels and task label assignments",
 		subcommands: {
+			add: "Add a label to a task",
+			create: "Create a new label",
 			list: "List all labels",
+			remove: "Remove a label from a task",
 			show: "Get label details"
 		}
 	},
@@ -8974,6 +9223,7 @@ const TOP_LEVEL_SPECS = {
 			edit: "Update task fields",
 			list: "List tasks (--state, --view, --search, --limit)",
 			prepend: "Prepend text to task notes",
+			random: "Pick a random task (--state to filter)",
 			read: "Print task notes as plain text",
 			reopen: "Reopen a completed task",
 			show: "Get task details by id",
@@ -9215,8 +9465,13 @@ Examples:
 //#endregion
 //#region src/commands/whoami.ts
 const runWhoAmI = async (context) => {
-	const config = resolveSupabaseConfig();
-	const resolvedToken = await resolveAuthToken(context, config);
+	let supabaseConfig = null;
+	try {
+		supabaseConfig = resolveSupabaseConfig();
+	} catch {
+		supabaseConfig = null;
+	}
+	const resolvedToken = await resolveAuthToken(context, supabaseConfig);
 	if (!resolvedToken) {
 		process.exitCode = EXIT_CODES.AUTH_REQUIRED;
 		if (context.json) {
@@ -9233,7 +9488,10 @@ const runWhoAmI = async (context) => {
 		writeInfo(context, "Run `donebear auth login`.");
 		return;
 	}
-	const user = await getSupabaseUser(config.url, config.publishableKey, resolvedToken.token);
+	const user = await loadViewer(context, {
+		baseUrl: resolveApiBaseUrl(context),
+		token: resolvedToken.token
+	});
 	if (context.json) {
 		writeOutput(context, {
 			ok: true,
@@ -9592,30 +9850,8 @@ Examples:
 	});
 };
 //#endregion
-//#region src/cli.ts
-const packageManifest = createRequire(import.meta.url)("../package.json");
-const WORKSPACE_PREFIX_REGEX = /^workspace=(.+)$/i;
-const extractWorkspaceTarget = (argv) => {
-	const processedArgv = [...argv];
-	const [, , firstArg] = processedArgv;
-	if (firstArg) {
-		const match = WORKSPACE_PREFIX_REGEX.exec(firstArg);
-		if (match?.[1]) {
-			processedArgv.splice(2, 1);
-			return {
-				processedArgv,
-				workspaceOverride: match[1].trim()
-			};
-		}
-	}
-	return {
-		processedArgv,
-		workspaceOverride: null
-	};
-};
-const main = async () => {
-	loadCliEnvironmentFiles();
-	const { processedArgv, workspaceOverride } = extractWorkspaceTarget(process.argv);
+//#region src/program.ts
+const buildProgram = (workspaceOverride = null) => {
 	const program = new Command();
 	program.name(CLI_NAME).description("Done Bear CLI for auth, workspace, and task workflows").version(packageManifest.version, "-v, --version").showHelpAfterError().showSuggestionAfterError();
 	addGlobalOptions(program);
@@ -9659,6 +9895,33 @@ Filtering & output:
 	registerSearchCommand(program, workspaceOverride);
 	registerHistoryCommand(program, workspaceOverride);
 	registerWhoAmICommand(program);
+	return program;
+};
+//#endregion
+//#region src/cli.ts
+const WORKSPACE_PREFIX_REGEX = /^workspace=(.+)$/iu;
+const extractWorkspaceTarget = (argv) => {
+	const processedArgv = [...argv];
+	const firstArg = processedArgv[2];
+	if (firstArg) {
+		const match = WORKSPACE_PREFIX_REGEX.exec(firstArg);
+		if (match?.[1]) {
+			processedArgv.splice(2, 1);
+			return {
+				processedArgv,
+				workspaceOverride: match[1].trim()
+			};
+		}
+	}
+	return {
+		processedArgv,
+		workspaceOverride: null
+	};
+};
+const main = async () => {
+	loadCliEnvironmentFiles();
+	const { processedArgv, workspaceOverride } = extractWorkspaceTarget(process.argv);
+	const program = buildProgram(workspaceOverride);
 	const hasUserArgs = processedArgv.length <= 2;
 	const isTTY = process.stdin.isTTY === true;
 	if (hasUserArgs && isTTY) {