intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/auth.js

@@ -0,0 +1,1592 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+function authBoundaries() {
+    return [
+        "CLI auth uses an IntentDNA API token, not MCP authorization.",
+        "dna auth stores local user credentials outside the project repository.",
+        "dna auth does not validate credentials against Supabase until a cloud endpoint exists.",
+        "Auth state does not grant runtime allow/warn/block/validate authority.",
+        "Service role keys are server-only and are rejected as CLI tokens when detected.",
+    ];
+}
+function authIssueBoundaries() {
+    return [
+        "dna auth issue-token uses a Supabase user JWT to request an IntentDNA CLI API token; it is not MCP authorization.",
+        "The Supabase user JWT is used only for the issue request unless explicitly stored through dna auth user-jwt set.",
+        "Raw issued CLI API tokens are consumed from the Edge Function response and stored locally; stdout prints only a masked preview.",
+        "Service role keys, secret keys, and token peppers are server-only and are rejected as user-facing CLI credentials.",
+        "Issued API tokens do not grant runtime allow/warn/block/validate authority.",
+        "dna-hook and local runtime evidence remain runtime truth.",
+    ];
+}
+function authBootstrapAccountBoundaries() {
+    return [
+        "dna auth bootstrap-account uses a Supabase user JWT to create or reuse account org/project records; it is not MCP authorization.",
+        "Account bootstrap does not issue CLI API tokens; run dna auth onboard after bootstrap to create the IntentDNA CLI API token.",
+        "Account bootstrap is an account onboarding mutation only; it does not upload reports, publish templates, read storage object contents, or execute workflows.",
+        "Service role keys, secret keys, token peppers, and CLI API tokens are rejected as user-facing bootstrap credentials.",
+        "Auth/account state does not grant runtime allow/warn/block/validate authority.",
+        "dna-hook and local runtime evidence remain runtime truth.",
+    ];
+}
+function authAccountBoundaries() {
+    return [
+        "dna auth projects and dna auth tokens use a Supabase user JWT for account onboarding; they are not MCP authorization.",
+        "The Supabase user JWT is used only for account requests and may be stored locally only through explicit dna auth user-jwt set.",
+        "Project and API token management receipts are account/auth projections, not runtime allow/warn/block/validate authority.",
+        "Raw API tokens, token hashes, service role keys, secret keys, and token peppers must never be printed by account commands.",
+        "Revoking a CLI API token changes authentication state only; dna-hook and local runtime evidence remain runtime truth.",
+    ];
+}
+function authOnboardBoundaries() {
+    return [
+        "dna auth onboard composes project discovery and CLI API token issuance; it is not MCP authorization.",
+        "Onboarding stores only the issued IntentDNA CLI API token locally and prints masked previews only.",
+        "A Supabase user JWT is an account onboarding credential, not the CLI ingestion API token.",
+        "Multiple account projects require an explicit --project-id; dna auth onboard does not guess.",
+        "Auth onboarding does not grant runtime allow/warn/block/validate authority.",
+        "dna-hook and local runtime evidence remain runtime truth.",
+    ];
+}
+function supabaseUserJwtBoundaries() {
+    return [
+        "dna auth user-jwt stores a Supabase user access token for account onboarding only; it is not the CLI ingestion API token.",
+        "Stored Supabase user JWTs are local user credentials outside the project repository and stdout prints only a masked preview.",
+        "Supabase user JWTs can request project listings, issue CLI API tokens, and manage API token metadata; they do not grant runtime allow/warn/block/validate authority.",
+        "Service role keys, secret keys, token peppers, and CLI API tokens must not be stored through dna auth user-jwt.",
+        "MCP remains hidden transport and is not a visible product auth path.",
+    ];
+}
+export function maskAuthToken(value) {
+    if (!value)
+        return undefined;
+    if (value.length <= 10)
+        return `${value.slice(0, 3)}***${value.slice(-2)}`;
+    return `${value.slice(0, 7)}...${value.slice(-4)}`;
+}
+export function authConfigPath(env = process.env, configDir) {
+    const baseDir = configDir
+        ?? env.INTENTDNA_AUTH_CONFIG_DIR
+        ?? (env.XDG_CONFIG_HOME ? join(env.XDG_CONFIG_HOME, "intentdna") : join(env.HOME ?? homedir(), ".config", "intentdna"));
+    return join(baseDir, "auth.json");
+}
+export function supabaseUserJwtConfigPath(env = process.env, configDir) {
+    const baseDir = configDir
+        ?? env.INTENTDNA_AUTH_CONFIG_DIR
+        ?? (env.XDG_CONFIG_HOME ? join(env.XDG_CONFIG_HOME, "intentdna") : join(env.HOME ?? homedir(), ".config", "intentdna"));
+    return join(baseDir, "supabase-user-jwt.json");
+}
+export async function resolveAuthToken(params = {}) {
+    const env = params.env ?? process.env;
+    const configPath = authConfigPath(env, params.configDir);
+    const envToken = env.INTENTDNA_API_TOKEN?.trim();
+    if (envToken)
+        return { token: envToken, source: "env", configPath };
+    const stored = await readStoredAuth(configPath);
+    if (stored)
+        return { token: stored.token, source: "user_config", configPath };
+    return { source: "none", configPath };
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const normalized = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+        return JSON.parse(Buffer.from(padded, "base64").toString("utf-8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function inspectJwtExpiry(token) {
+    if (!token)
+        return { expired: false };
+    const payload = decodeJwtPayload(token);
+    const exp = payload?.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp))
+        return { expired: false };
+    const expiresAtMs = exp * 1000;
+    return {
+        expiresAt: new Date(expiresAtMs).toISOString(),
+        expired: expiresAtMs <= Date.now(),
+    };
+}
+export function isRejectedServiceRoleToken(token, env) {
+    if (env.SUPABASE_SERVICE_ROLE_KEY && token === env.SUPABASE_SERVICE_ROLE_KEY)
+        return true;
+    const payload = decodeJwtPayload(token);
+    return payload?.role === "service_role";
+}
+function buildIssueTokenEndpoint(opts) {
+    if (opts.endpoint?.trim())
+        return opts.endpoint.trim();
+    const env = opts.env ?? process.env;
+    const cloudUrl = env.INTENTDNA_CLOUD_URL?.trim()
+        ?? env.SUPABASE_URL?.trim()
+        ?? linkedSupabaseProjectUrl(env);
+    if (!cloudUrl)
+        return undefined;
+    return `${cloudUrl.replace(/\/+$/, "")}/functions/v1/issue-api-token`;
+}
+export function buildAccountEndpoint(opts, functionName) {
+    if (opts.endpoint?.trim()) {
+        const normalized = opts.endpoint.trim().replace(/\/+$/, "");
+        const functionRoot = "/functions/v1/";
+        if (normalized.endsWith(`${functionRoot}${functionName}`))
+            return normalized;
+        if (normalized.includes(functionRoot))
+            return `${normalized.slice(0, normalized.indexOf(functionRoot) + functionRoot.length)}${functionName}`;
+        return `${normalized}${functionRoot}${functionName}`;
+    }
+    const env = opts.env ?? process.env;
+    const cloudUrl = env.INTENTDNA_CLOUD_URL?.trim()
+        ?? env.SUPABASE_URL?.trim()
+        ?? linkedSupabaseProjectUrl(env);
+    if (!cloudUrl)
+        return undefined;
+    return `${cloudUrl.replace(/\/+$/, "")}/functions/v1/${functionName}`;
+}
+function deriveOnboardEndpoint(opts, functionName) {
+    const explicit = opts.endpoint?.trim();
+    const env = opts.env ?? process.env;
+    const cloudUrl = explicit || env.INTENTDNA_CLOUD_URL?.trim() || env.SUPABASE_URL?.trim() || linkedSupabaseProjectUrl(env);
+    if (!cloudUrl)
+        return undefined;
+    const normalized = cloudUrl.replace(/\/+$/, "");
+    const functionRoot = "/functions/v1/";
+    const rootIndex = normalized.indexOf(functionRoot);
+    if (rootIndex >= 0)
+        return `${normalized.slice(0, rootIndex)}${functionRoot}${functionName}`;
+    return `${normalized}${functionRoot}${functionName}`;
+}
+function linkedSupabaseProjectUrl(env = process.env, readLinkedFiles = env === process.env) {
+    if (env.INTENTDNA_SUPABASE_DISABLE_LINKED_PROJECT === "1")
+        return undefined;
+    if (env.INTENTDNA_SUPABASE_LINKED_PROJECT_REF?.trim()) {
+        return `https://${env.INTENTDNA_SUPABASE_LINKED_PROJECT_REF.trim()}.supabase.co`;
+    }
+    if (!readLinkedFiles)
+        return undefined;
+    const directRef = existsSync("supabase/.temp/project-ref")
+        ? readFileSync("supabase/.temp/project-ref", "utf-8").trim()
+        : "";
+    if (directRef)
+        return `https://${directRef}.supabase.co`;
+    if (!existsSync("supabase/.temp/linked-project.json"))
+        return undefined;
+    try {
+        const linked = JSON.parse(readFileSync("supabase/.temp/linked-project.json", "utf-8"));
+        return typeof linked.ref === "string" && linked.ref.trim()
+            ? `https://${linked.ref.trim()}.supabase.co`
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function withOnboardEndpoint(opts, functionName) {
+    return {
+        ...opts,
+        endpoint: deriveOnboardEndpoint(opts, functionName),
+    };
+}
+export async function resolveSupabaseUserJwt(opts) {
+    const optionToken = opts.userJwt?.trim();
+    const env = opts.env ?? process.env;
+    const configPath = supabaseUserJwtConfigPath(env, opts.configDir);
+    const resolveToken = (token, source) => {
+        const expiry = inspectJwtExpiry(token);
+        return { token, source, configPath, expiresAt: expiry.expiresAt, expired: expiry.expired };
+    };
+    if (optionToken)
+        return resolveToken(optionToken, "option");
+    const envToken = env.INTENTDNA_SUPABASE_USER_JWT?.trim() ?? env.SUPABASE_USER_ACCESS_TOKEN?.trim();
+    if (envToken)
+        return resolveToken(envToken, "env");
+    const stored = await readStoredSupabaseUserJwt(configPath);
+    if (stored)
+        return resolveToken(stored.token, "user_config");
+    return { source: "none", configPath, expired: false };
+}
+function normalizeIssueScopes(scopes) {
+    const raw = scopes && scopes.length > 0 ? scopes : ["report:ingest"];
+    const normalized = raw
+        .flatMap((scope) => scope.split(","))
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return Array.from(new Set(normalized.length > 0 ? normalized : ["report:ingest"]));
+}
+function buildIssueRequest(opts) {
+    return {
+        schema_version: "intentdna.api_token_issue_request.v1",
+        name: opts.tokenName?.trim() || undefined,
+        organization_id: opts.organizationId?.trim() || undefined,
+        project_id: opts.projectId?.trim() || undefined,
+        scopes: normalizeIssueScopes(opts.scopes),
+        expires_at: opts.expiresAt?.trim() || null,
+    };
+}
+function supabaseUserJwtMissing(jwt) {
+    if (!jwt.token)
+        return "INTENTDNA_SUPABASE_USER_JWT, --user-jwt <supabase-user-access-token>, or dna auth user-jwt set <token>";
+    if (jwt.expired)
+        return "fresh Supabase user JWT from dna auth user-jwt set <token>";
+    return undefined;
+}
+function buildBootstrapAccountRequest(opts) {
+    return {
+        schema_version: "intentdna.account_bootstrap_request.v1",
+        organization_name: opts.orgName?.trim() || opts.organizationId?.trim() || undefined,
+        organization_slug: opts.orgSlug?.trim() || undefined,
+        project_name: opts.projectName?.trim() || opts.projectId?.trim() || undefined,
+        project_slug: opts.projectSlug?.trim() || undefined,
+        local_project_hint: opts.projectHint?.trim() || null,
+    };
+}
+function normalizeTokenLimit(value) {
+    if (!Number.isFinite(value))
+        return 25;
+    const parsed = Math.floor(Number(value));
+    if (parsed <= 0)
+        return 25;
+    return Math.min(parsed, 100);
+}
+function buildProjectsRequest() {
+    return {
+        schema_version: "intentdna.account_projects_request.v1",
+        method: "POST",
+        function: "list-projects",
+        body: null,
+    };
+}
+function buildTokensRequest(opts, action) {
+    return {
+        schema_version: "intentdna.api_tokens_manage_request.v1",
+        action,
+        organization_id: opts.organizationId?.trim() || undefined,
+        project_id: opts.projectId?.trim() || undefined,
+        token_id: opts.tokenId?.trim() || undefined,
+        include_revoked: opts.includeRevoked === true,
+        limit: normalizeTokenLimit(opts.limit),
+    };
+}
+function removeSensitiveFields(value) {
+    if (Array.isArray(value))
+        return value.map((item) => removeSensitiveFields(item));
+    if (!value || typeof value !== "object")
+        return value;
+    const output = {};
+    for (const [key, item] of Object.entries(value)) {
+        const normalized = key.toLowerCase();
+        if (normalized === "raw_token"
+            || normalized === "token_hash"
+            || normalized === "hash"
+            || normalized === "supabase_user_jwt"
+            || normalized === "user_jwt"
+            || normalized === "service_role_key"
+            || normalized === "secret_key"
+            || normalized === "token_pepper") {
+            continue;
+        }
+        output[key] = removeSensitiveFields(item);
+    }
+    return output;
+}
+function sanitizeRecord(value) {
+    const sanitized = removeSensitiveFields(value);
+    if (!sanitized || typeof sanitized !== "object" || Array.isArray(sanitized))
+        return undefined;
+    return sanitized;
+}
+function sanitizeIssueReceipt(value) {
+    const receipt = sanitizeRecord(value);
+    if (!receipt)
+        return undefined;
+    const token = receipt.api_token && typeof receipt.api_token === "object" && !Array.isArray(receipt.api_token)
+        ? receipt.api_token
+        : undefined;
+    const sanitizedToken = token ? { ...token } : undefined;
+    return {
+        ...receipt,
+        api_token: sanitizedToken,
+    };
+}
+function sanitizeProjectsReceipt(value) {
+    return sanitizeRecord(value);
+}
+function sanitizeTokenManagementReceipt(value) {
+    return sanitizeRecord(value);
+}
+function rawTokenFromIssueReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const token = value.api_token;
+    if (!token || typeof token !== "object" || Array.isArray(token))
+        return undefined;
+    const rawToken = token.raw_token;
+    return typeof rawToken === "string" && rawToken.trim() ? rawToken : undefined;
+}
+function statusFromIssueReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const status = value.status;
+    return status === "issued" || status === "pending" || status === "rejected" ? status : undefined;
+}
+function reasonsFromIssueReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return [];
+    const reasons = value.reasons;
+    return Array.isArray(reasons) ? reasons.map((reason) => String(reason)) : [];
+}
+function statusFromProjectsReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const status = value.status;
+    return status === "ready" || status === "pending" || status === "rejected" ? status : undefined;
+}
+function reasonsFromReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return [];
+    const reasons = value.reasons;
+    return Array.isArray(reasons) ? reasons.map((reason) => String(reason)) : [];
+}
+function statusFromTokensReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const status = value.status;
+    return status === "ready" || status === "revoked" || status === "pending" || status === "rejected" ? status : undefined;
+}
+function buildIssueTokenResult(params) {
+    return {
+        schema_version: "intentdna.auth_issue_token_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        request: params.request,
+        auth: {
+            supabase_user_jwt_present: params.jwtPresent,
+            source: params.jwtSource,
+        },
+        local_storage: {
+            stored: params.stored ?? false,
+            config_path: params.configPath,
+            token_preview: params.tokenPreview,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+        },
+        runtime_authority: false,
+        raw_token_printed: false,
+        issue_receipt: sanitizeIssueReceipt(params.issueReceipt),
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: authIssueBoundaries(),
+    };
+}
+function buildBootstrapAccountResult(params) {
+    const bootstrapReceipt = sanitizeRecord(params.bootstrapReceipt);
+    const account = bootstrapReceipt?.account;
+    const projectId = account && typeof account === "object" && !Array.isArray(account)
+        ? account.project_id
+        : undefined;
+    return {
+        schema_version: "intentdna.auth_bootstrap_account_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        request: params.request,
+        auth: {
+            supabase_user_jwt_present: params.jwtPresent,
+            source: params.jwtSource,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+        },
+        mutation_performed: params.mutationPerformed ?? false,
+        runtime_authority: false,
+        bootstrap_receipt: bootstrapReceipt,
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: authBootstrapAccountBoundaries(),
+        next_commands: typeof projectId === "string" && projectId.trim()
+            ? [
+                `Run dna auth onboard --project-id ${projectId} --json to issue and store a CLI API token.`,
+                "Run dna auth status --json to confirm CLI token readiness.",
+                "Run dna report upload <envelope-path> --dry-run --json before live ingestion.",
+            ]
+            : [
+                "Run dna auth bootstrap-account --org <name> --project <name> --dry-run --json.",
+                "Run dna auth bootstrap-account --org <name> --project <name> --json after Supabase auth is available.",
+                "Run dna auth projects --json to discover project ids.",
+            ],
+    };
+}
+function buildProjectsResult(params) {
+    return {
+        schema_version: "intentdna.auth_projects_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        request: params.request,
+        auth: {
+            supabase_user_jwt_present: params.jwtPresent,
+            source: params.jwtSource,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+        },
+        runtime_authority: false,
+        projects_receipt: sanitizeProjectsReceipt(params.projectsReceipt),
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: authAccountBoundaries(),
+    };
+}
+function buildTokensResult(params) {
+    return {
+        schema_version: "intentdna.auth_tokens_result.v1",
+        generated_at: new Date().toISOString(),
+        action: params.action,
+        status: params.status,
+        endpoint: params.endpoint,
+        request: params.request,
+        auth: {
+            supabase_user_jwt_present: params.jwtPresent,
+            source: params.jwtSource,
+        },
+        mutation_confirmed: params.mutationConfirmed ?? false,
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+        },
+        runtime_authority: false,
+        token_management_receipt: sanitizeTokenManagementReceipt(params.tokenManagementReceipt),
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: authAccountBoundaries(),
+    };
+}
+function stringField(record, key) {
+    const value = record[key];
+    return typeof value === "string" && value.trim() ? value : undefined;
+}
+function projectsFromResult(result) {
+    const projects = result.projects_receipt?.projects;
+    if (!Array.isArray(projects))
+        return [];
+    return projects.filter((project) => (Boolean(project)
+        && typeof project === "object"
+        && !Array.isArray(project)));
+}
+function selectOnboardProject(result, explicitProjectId) {
+    const projects = projectsFromResult(result);
+    const projectCount = projects.length;
+    const explicit = explicitProjectId?.trim();
+    if (explicit) {
+        const matched = projects.find((project) => stringField(project, "project_id") === explicit);
+        return {
+            project_id: explicit,
+            organization_id: matched ? stringField(matched, "organization_id") : undefined,
+            project_name: matched ? stringField(matched, "project_name") : undefined,
+            organization_name: matched ? stringField(matched, "organization_name") : undefined,
+            source: "explicit",
+            project_count: projectCount,
+            ambiguous: false,
+        };
+    }
+    if (projectCount === 1) {
+        const project = projects[0];
+        return {
+            project_id: stringField(project, "project_id") ?? stringField(project, "id"),
+            organization_id: stringField(project, "organization_id"),
+            project_name: stringField(project, "project_name") ?? stringField(project, "name"),
+            organization_name: stringField(project, "organization_name"),
+            source: "single_project",
+            project_count: projectCount,
+            ambiguous: false,
+        };
+    }
+    return {
+        source: "unselected",
+        project_count: projectCount,
+        ambiguous: projectCount > 1,
+    };
+}
+function buildOnboardResult(params) {
+    const issueResult = params.issueResult;
+    return {
+        schema_version: "intentdna.auth_onboard_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        selected_project: params.selectedProject,
+        endpoints: {
+            list_projects: params.projectsResult.endpoint,
+            issue_api_token: issueResult?.endpoint ?? deriveOnboardEndpoint({
+                subcommand: "onboard",
+                endpoint: params.projectsResult.endpoint,
+            }, "issue-api-token"),
+        },
+        auth: {
+            supabase_user_jwt_present: params.projectsResult.auth.supabase_user_jwt_present,
+            source: params.projectsResult.auth.source,
+        },
+        local_storage: {
+            stored: issueResult?.local_storage.stored ?? false,
+            config_path: issueResult?.local_storage.config_path ?? params.configPath,
+            token_preview: issueResult?.local_storage.token_preview,
+        },
+        transport: {
+            network_performed: params.projectsResult.transport.network_performed || (issueResult?.transport.network_performed ?? false),
+            hidden_transport: false,
+        },
+        runtime_authority: false,
+        raw_token_printed: false,
+        projects_result: params.projectsResult,
+        issue_result: issueResult,
+        auth_status: params.authStatus,
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: authOnboardBoundaries(),
+        next_commands: params.status === "issued"
+            ? [
+                "Run dna auth status --json to confirm the local CLI API token is present.",
+                "Run dna report upload <envelope-path> --dry-run --json to preview cloud ingestion.",
+            ]
+            : [
+                "Run dna auth onboard --dry-run --json to preview account discovery and token issuance.",
+                "Run dna auth onboard --project-id <id> --json when a project is selected.",
+            ],
+    };
+}
+export async function readStoredAuth(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf-8"));
+        if (parsed.schema_version !== "intentdna.auth_config.v1")
+            return undefined;
+        if (typeof parsed.token !== "string" || parsed.token.length === 0)
+            return undefined;
+        return {
+            schema_version: "intentdna.auth_config.v1",
+            token: parsed.token,
+            token_preview: typeof parsed.token_preview === "string" ? parsed.token_preview : maskAuthToken(parsed.token) ?? "",
+            token_prefix: typeof parsed.token_prefix === "string" ? parsed.token_prefix : parsed.token.slice(0, 7),
+            created_at: typeof parsed.created_at === "string" ? parsed.created_at : new Date(0).toISOString(),
+            updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : new Date(0).toISOString(),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function readStoredSupabaseUserJwt(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf-8"));
+        if (parsed.schema_version !== "intentdna.supabase_user_jwt_config.v1")
+            return undefined;
+        if (typeof parsed.token !== "string" || parsed.token.length === 0)
+            return undefined;
+        return {
+            schema_version: "intentdna.supabase_user_jwt_config.v1",
+            token: parsed.token,
+            token_preview: typeof parsed.token_preview === "string" ? parsed.token_preview : maskAuthToken(parsed.token) ?? "",
+            token_prefix: typeof parsed.token_prefix === "string" ? parsed.token_prefix : parsed.token.slice(0, 7),
+            created_at: typeof parsed.created_at === "string" ? parsed.created_at : new Date(0).toISOString(),
+            updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : new Date(0).toISOString(),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function buildAuthStatus(params = {}) {
+    const resolved = await resolveAuthToken(params);
+    const token = resolved.token;
+    const credentialPresent = Boolean(token);
+    return {
+        schema_version: "intentdna.auth_status.v1",
+        mode: "api_token_auth_status",
+        authenticated: credentialPresent,
+        credential_present: credentialPresent,
+        verified_online: false,
+        network_performed: false,
+        runtime_authority: false,
+        source: resolved.source,
+        config_path: resolved.configPath,
+        token_preview: maskAuthToken(token),
+        missing: credentialPresent ? [] : ["INTENTDNA_API_TOKEN or dna auth token set <token>"],
+        boundaries: authBoundaries(),
+        next_commands: credentialPresent
+            ? [
+                "Run dna report package --json, then dna report sign --package .dna/reports/latest-report-package.json --json and dna report verify <envelope-path> --json for local proof.",
+                "Run dna cloud status --json before optional dna report upload <envelope-path> --json.",
+            ]
+            : ["Run dna auth token set <token> after creating an IntentDNA API token online."],
+    };
+}
+export async function buildSupabaseUserJwtStatus(params = {}) {
+    const resolved = await resolveSupabaseUserJwt({
+        subcommand: "user-jwt",
+        env: params.env,
+        configDir: params.configDir,
+    });
+    const credentialPresent = Boolean(resolved.token);
+    const credentialExpired = credentialPresent && resolved.expired;
+    return {
+        schema_version: "intentdna.supabase_user_jwt_status.v1",
+        mode: "supabase_user_jwt_account_bridge_status",
+        credential_present: credentialPresent,
+        credential_expired: credentialExpired,
+        verified_online: false,
+        network_performed: false,
+        runtime_authority: false,
+        source: resolved.source,
+        config_path: resolved.configPath,
+        token_preview: maskAuthToken(resolved.token),
+        expires_at: resolved.expiresAt,
+        missing: !credentialPresent
+            ? ["INTENTDNA_SUPABASE_USER_JWT, SUPABASE_USER_ACCESS_TOKEN, or dna auth user-jwt set <token>"]
+            : credentialExpired
+                ? ["fresh Supabase user JWT from dna auth user-jwt set <token>"]
+                : [],
+        boundaries: supabaseUserJwtBoundaries(),
+        next_commands: credentialPresent && !credentialExpired
+            ? [
+                "Run dna auth projects --json to discover Supabase projects.",
+                "Run dna auth issue-token --project-id <id> --json to create a CLI API token.",
+            ]
+            : ["Run dna auth user-jwt set <supabase-user-access-token> --json after signing in through Supabase Auth."],
+    };
+}
+export async function storeAuthToken(params) {
+    const env = params.env ?? process.env;
+    const configPath = authConfigPath(env, params.configDir);
+    const token = params.token.trim();
+    if (!token) {
+        return {
+            schema_version: "intentdna.auth_token_result.v1",
+            action: "set",
+            status: "rejected",
+            config_path: configPath,
+            raw_token_printed: false,
+            network_performed: false,
+            runtime_authority: false,
+            reason: "Token is empty.",
+            boundaries: authBoundaries(),
+        };
+    }
+    if (isRejectedServiceRoleToken(token, env)) {
+        return {
+            schema_version: "intentdna.auth_token_result.v1",
+            action: "set",
+            status: "rejected",
+            config_path: configPath,
+            raw_token_printed: false,
+            network_performed: false,
+            runtime_authority: false,
+            reason: "Supabase service role keys are server-only and cannot be stored as CLI API tokens.",
+            boundaries: authBoundaries(),
+        };
+    }
+    const now = new Date().toISOString();
+    const existing = await readStoredAuth(configPath);
+    const config = {
+        schema_version: "intentdna.auth_config.v1",
+        token,
+        token_preview: maskAuthToken(token) ?? "",
+        token_prefix: token.slice(0, 7),
+        created_at: existing?.created_at ?? now,
+        updated_at: now,
+    };
+    await mkdir(dirname(configPath), { recursive: true });
+    await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    await chmod(configPath, 0o600);
+    return {
+        schema_version: "intentdna.auth_token_result.v1",
+        action: "set",
+        status: "stored",
+        config_path: configPath,
+        token_preview: config.token_preview,
+        raw_token_printed: false,
+        network_performed: false,
+        runtime_authority: false,
+        boundaries: authBoundaries(),
+    };
+}
+export async function storeSupabaseUserJwt(params) {
+    const env = params.env ?? process.env;
+    const configPath = supabaseUserJwtConfigPath(env, params.configDir);
+    const token = params.token.trim();
+    if (!token) {
+        return {
+            schema_version: "intentdna.supabase_user_jwt_result.v1",
+            action: "set",
+            status: "rejected",
+            config_path: configPath,
+            raw_token_printed: false,
+            network_performed: false,
+            runtime_authority: false,
+            reason: "Supabase user JWT is empty.",
+            boundaries: supabaseUserJwtBoundaries(),
+        };
+    }
+    if (token.startsWith("idna_")) {
+        return {
+            schema_version: "intentdna.supabase_user_jwt_result.v1",
+            action: "set",
+            status: "rejected",
+            config_path: configPath,
+            raw_token_printed: false,
+            network_performed: false,
+            runtime_authority: false,
+            reason: "IntentDNA CLI API tokens belong in dna auth token set, not dna auth user-jwt.",
+            boundaries: supabaseUserJwtBoundaries(),
+        };
+    }
+    if (isRejectedServiceRoleToken(token, env)) {
+        return {
+            schema_version: "intentdna.supabase_user_jwt_result.v1",
+            action: "set",
+            status: "rejected",
+            config_path: configPath,
+            raw_token_printed: false,
+            network_performed: false,
+            runtime_authority: false,
+            reason: "Supabase service role keys are server-only and cannot be stored as user JWTs.",
+            boundaries: supabaseUserJwtBoundaries(),
+        };
+    }
+    const now = new Date().toISOString();
+    const existing = await readStoredSupabaseUserJwt(configPath);
+    const config = {
+        schema_version: "intentdna.supabase_user_jwt_config.v1",
+        token,
+        token_preview: maskAuthToken(token) ?? "",
+        token_prefix: token.slice(0, 7),
+        created_at: existing?.created_at ?? now,
+        updated_at: now,
+    };
+    await mkdir(dirname(configPath), { recursive: true });
+    await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    await chmod(configPath, 0o600);
+    return {
+        schema_version: "intentdna.supabase_user_jwt_result.v1",
+        action: "set",
+        status: "stored",
+        config_path: configPath,
+        token_preview: config.token_preview,
+        raw_token_printed: false,
+        network_performed: false,
+        runtime_authority: false,
+        boundaries: supabaseUserJwtBoundaries(),
+    };
+}
+export async function clearAuthToken(params = {}) {
+    const configPath = authConfigPath(params.env ?? process.env, params.configDir);
+    const existing = await readStoredAuth(configPath);
+    await rm(configPath, { force: true });
+    return {
+        schema_version: "intentdna.auth_token_result.v1",
+        action: "clear",
+        status: existing ? "cleared" : "already_clear",
+        config_path: configPath,
+        raw_token_printed: false,
+        network_performed: false,
+        runtime_authority: false,
+        boundaries: authBoundaries(),
+    };
+}
+export async function clearSupabaseUserJwt(params = {}) {
+    const configPath = supabaseUserJwtConfigPath(params.env ?? process.env, params.configDir);
+    const existing = await readStoredSupabaseUserJwt(configPath);
+    await rm(configPath, { force: true });
+    return {
+        schema_version: "intentdna.supabase_user_jwt_result.v1",
+        action: "clear",
+        status: existing ? "cleared" : "already_clear",
+        config_path: configPath,
+        raw_token_printed: false,
+        network_performed: false,
+        runtime_authority: false,
+        boundaries: supabaseUserJwtBoundaries(),
+    };
+}
+export async function issueAuthToken(options) {
+    const env = options.env ?? process.env;
+    const configPath = authConfigPath(env, options.configDir);
+    const endpoint = buildIssueTokenEndpoint(options);
+    const request = buildIssueRequest(options);
+    const jwt = await resolveSupabaseUserJwt(options);
+    const missing = [
+        !endpoint ? "INTENTDNA_CLOUD_URL or --endpoint <issue-api-token-url>" : undefined,
+        !request.project_id ? "--project-id <supabase-project-uuid>" : undefined,
+        supabaseUserJwtMissing(jwt),
+    ].filter((item) => Boolean(item));
+    if (jwt.token && isRejectedServiceRoleToken(jwt.token, env)) {
+        return buildIssueTokenResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            configPath,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used to issue CLI API tokens."],
+        });
+    }
+    if (options.dryRun) {
+        return buildIssueTokenResult({
+            status: "dry_run",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            configPath,
+            missing,
+            reasons: missing.length > 0
+                ? ["dry_run: issue-token request shape was built; live issuance still needs missing inputs"]
+                : ["dry_run: issue-token request is ready but no network request was performed"],
+        });
+    }
+    if (missing.length > 0) {
+        return buildIssueTokenResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            configPath,
+            missing,
+            reasons: ["rejected: missing inputs for live API token issuance"],
+        });
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt.token}`,
+            "x-intentdna-cli": "dna auth issue-token",
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!response.ok || !parsed) {
+        return buildIssueTokenResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            configPath,
+            networkPerformed: true,
+            reasons: [`rejected: issue-api-token endpoint returned HTTP ${response.status}`],
+        });
+    }
+    const receiptStatus = statusFromIssueReceipt(parsed);
+    const rawToken = rawTokenFromIssueReceipt(parsed);
+    const receiptReasons = reasonsFromIssueReceipt(parsed);
+    if (receiptStatus !== "issued" || !rawToken) {
+        return buildIssueTokenResult({
+            status: receiptStatus ?? "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            configPath,
+            networkPerformed: true,
+            issueReceipt: parsed,
+            reasons: receiptReasons.length > 0
+                ? receiptReasons
+                : ["rejected: issue-api-token response did not include an issued raw CLI token"],
+        });
+    }
+    const stored = await storeAuthToken({
+        token: rawToken,
+        env,
+        configDir: options.configDir,
+    });
+    if (stored.status === "rejected") {
+        return buildIssueTokenResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            configPath,
+            networkPerformed: true,
+            issueReceipt: parsed,
+            reasons: [stored.reason ?? "rejected: issued CLI API token could not be stored locally"],
+        });
+    }
+    return buildIssueTokenResult({
+        status: "issued",
+        endpoint,
+        request,
+        jwtPresent: true,
+        jwtSource: jwt.source,
+        configPath,
+        stored: true,
+        tokenPreview: stored.token_preview,
+        networkPerformed: true,
+        issueReceipt: parsed,
+        reasons: receiptReasons.length > 0
+            ? receiptReasons
+            : ["issued: CLI API token was issued by Supabase and stored locally"],
+    });
+}
+function statusFromBootstrapReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const status = value.status;
+    return status === "bootstrapped" || status === "pending" || status === "rejected" ? status : undefined;
+}
+export async function bootstrapAccount(options) {
+    const env = options.env ?? process.env;
+    const endpoint = buildAccountEndpoint(options, "bootstrap-account");
+    const request = buildBootstrapAccountRequest(options);
+    const jwt = await resolveSupabaseUserJwt(options);
+    const missing = [
+        !endpoint ? "INTENTDNA_CLOUD_URL or --endpoint <bootstrap-account-url>" : undefined,
+        supabaseUserJwtMissing(jwt),
+    ].filter((item) => Boolean(item));
+    if (jwt.token && isRejectedServiceRoleToken(jwt.token, env)) {
+        return buildBootstrapAccountResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used for account bootstrap."],
+        });
+    }
+    if (jwt.token?.startsWith("idna_")) {
+        return buildBootstrapAccountResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: IntentDNA CLI API tokens cannot bootstrap Supabase account records; use a Supabase user JWT."],
+        });
+    }
+    if (options.dryRun) {
+        return buildBootstrapAccountResult({
+            status: "dry_run",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            missing,
+            reasons: missing.length > 0
+                ? ["dry_run: account bootstrap request shape was built; live bootstrap still needs missing inputs"]
+                : ["dry_run: account bootstrap request is ready but no network request was performed"],
+        });
+    }
+    if (missing.length > 0) {
+        return buildBootstrapAccountResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            missing,
+            reasons: ["rejected: missing inputs for live account bootstrap"],
+        });
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt.token}`,
+            "x-intentdna-cli": "dna auth bootstrap-account",
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!response.ok || !parsed) {
+        return buildBootstrapAccountResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            networkPerformed: true,
+            reasons: [`rejected: bootstrap-account endpoint returned HTTP ${response.status}`],
+        });
+    }
+    const receiptStatus = statusFromBootstrapReceipt(parsed);
+    const receiptReasons = reasonsFromReceipt(parsed);
+    const receipt = sanitizeRecord(parsed);
+    return buildBootstrapAccountResult({
+        status: receiptStatus ?? "rejected",
+        endpoint,
+        request,
+        jwtPresent: true,
+        jwtSource: jwt.source,
+        networkPerformed: true,
+        mutationPerformed: receipt?.mutation_performed === true,
+        bootstrapReceipt: parsed,
+        reasons: receiptReasons.length > 0
+            ? receiptReasons
+            : [receiptStatus ? `${receiptStatus}: bootstrap-account response returned` : "rejected: bootstrap-account response did not include a supported status"],
+    });
+}
+export async function listAuthProjects(options) {
+    const env = options.env ?? process.env;
+    const endpoint = buildAccountEndpoint(options, "list-projects");
+    const request = buildProjectsRequest();
+    const jwt = await resolveSupabaseUserJwt(options);
+    const missing = [
+        !endpoint ? "INTENTDNA_CLOUD_URL or --endpoint <list-projects-url>" : undefined,
+        supabaseUserJwtMissing(jwt),
+    ].filter((item) => Boolean(item));
+    if (jwt.token && isRejectedServiceRoleToken(jwt.token, env)) {
+        return buildProjectsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used for account project discovery."],
+        });
+    }
+    if (options.dryRun) {
+        return buildProjectsResult({
+            status: "dry_run",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            missing,
+            reasons: missing.length > 0
+                ? ["dry_run: projects request shape was built; live listing still needs missing inputs"]
+                : ["dry_run: projects request is ready but no network request was performed"],
+        });
+    }
+    if (missing.length > 0) {
+        return buildProjectsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            missing,
+            reasons: ["rejected: missing inputs for live account project discovery"],
+        });
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt.token}`,
+            "x-intentdna-cli": "dna auth projects",
+        },
+        body: JSON.stringify({ schema_version: request.schema_version }),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!response.ok || !parsed) {
+        return buildProjectsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            networkPerformed: true,
+            reasons: [`rejected: list-projects endpoint returned HTTP ${response.status}`],
+        });
+    }
+    const receiptStatus = statusFromProjectsReceipt(parsed);
+    return buildProjectsResult({
+        status: receiptStatus ?? "rejected",
+        endpoint,
+        request,
+        jwtPresent: true,
+        jwtSource: jwt.source,
+        networkPerformed: true,
+        projectsReceipt: parsed,
+        reasons: reasonsFromReceipt(parsed).length > 0
+            ? reasonsFromReceipt(parsed)
+            : [receiptStatus ? `${receiptStatus}: list-projects response returned` : "rejected: list-projects response did not include a supported status"],
+    });
+}
+export async function manageAuthTokens(options) {
+    const env = options.env ?? process.env;
+    const action = options.tokenAction === "revoke" ? "revoke" : "list";
+    const endpoint = buildAccountEndpoint(options, "manage-api-tokens");
+    const tokenId = options.tokenId ?? options.token;
+    const request = buildTokensRequest({ ...options, tokenId }, action);
+    const jwt = await resolveSupabaseUserJwt(options);
+    const mutationMissing = action === "revoke" && !options.dryRun && !options.yes ? "--yes confirmation required" : undefined;
+    const missing = [
+        !endpoint ? "INTENTDNA_CLOUD_URL or --endpoint <manage-api-tokens-url>" : undefined,
+        supabaseUserJwtMissing(jwt),
+        action === "revoke" && !request.token_id ? "token id argument or --token-id <id>" : undefined,
+        mutationMissing,
+    ].filter((item) => Boolean(item));
+    if (jwt.token && isRejectedServiceRoleToken(jwt.token, env)) {
+        return buildTokensResult({
+            action,
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used for API token management."],
+        });
+    }
+    if (options.dryRun) {
+        return buildTokensResult({
+            action,
+            status: "dry_run",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            mutationConfirmed: action === "revoke" && options.yes === true,
+            missing,
+            reasons: missing.length > 0
+                ? [`dry_run: API token ${action} request shape was built; live request still needs missing inputs`]
+                : [`dry_run: API token ${action} request is ready but no network request was performed`],
+        });
+    }
+    if (missing.length > 0) {
+        return buildTokensResult({
+            action,
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: Boolean(jwt.token),
+            jwtSource: jwt.source,
+            mutationConfirmed: action === "revoke" && options.yes === true,
+            missing,
+            reasons: [`rejected: missing inputs for live API token ${action}`],
+        });
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt.token}`,
+            "x-intentdna-cli": `dna auth tokens ${action}`,
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!response.ok || !parsed) {
+        return buildTokensResult({
+            action,
+            status: "rejected",
+            endpoint,
+            request,
+            jwtPresent: true,
+            jwtSource: jwt.source,
+            mutationConfirmed: action === "revoke" && options.yes === true,
+            networkPerformed: true,
+            reasons: [`rejected: manage-api-tokens endpoint returned HTTP ${response.status}`],
+        });
+    }
+    const receiptStatus = statusFromTokensReceipt(parsed);
+    const receiptReasons = reasonsFromReceipt(parsed);
+    return buildTokensResult({
+        action,
+        status: receiptStatus ?? "rejected",
+        endpoint,
+        request,
+        jwtPresent: true,
+        jwtSource: jwt.source,
+        mutationConfirmed: action === "revoke" && options.yes === true,
+        networkPerformed: true,
+        tokenManagementReceipt: parsed,
+        reasons: receiptReasons.length > 0
+            ? receiptReasons
+            : [receiptStatus ? `${receiptStatus}: manage-api-tokens response returned` : "rejected: manage-api-tokens response did not include a supported status"],
+    });
+}
+export async function onboardAuth(options) {
+    const env = options.env ?? process.env;
+    const configPath = authConfigPath(env, options.configDir);
+    const projectsResult = await listAuthProjects(withOnboardEndpoint(options, "list-projects"));
+    const selectedProject = selectOnboardProject(projectsResult, options.projectId);
+    if (projectsResult.status === "rejected") {
+        return buildOnboardResult({
+            status: "rejected",
+            projectsResult,
+            selectedProject,
+            configPath,
+            missing: projectsResult.missing,
+            reasons: projectsResult.reasons.length > 0
+                ? projectsResult.reasons
+                : ["rejected: account project discovery failed before token issuance"],
+        });
+    }
+    if (options.dryRun) {
+        const issuePreview = await issueAuthToken({
+            ...withOnboardEndpoint(options, "issue-api-token"),
+            projectId: selectedProject.project_id ?? options.projectId,
+            organizationId: options.organizationId ?? selectedProject.organization_id,
+            dryRun: true,
+        });
+        const missing = Array.from(new Set([
+            ...projectsResult.missing,
+            ...issuePreview.missing,
+            !selectedProject.project_id && projectsResult.transport.network_performed ? "--project-id <id> or exactly one account project" : undefined,
+        ].filter((item) => Boolean(item))));
+        return buildOnboardResult({
+            status: "dry_run",
+            projectsResult,
+            selectedProject,
+            issueResult: issuePreview,
+            configPath,
+            missing,
+            reasons: missing.length > 0
+                ? ["dry_run: onboarding plan was built; live issuance still needs missing inputs"]
+                : ["dry_run: onboarding can discover projects and issue a CLI API token without using MCP"],
+        });
+    }
+    if (!selectedProject.project_id) {
+        return buildOnboardResult({
+            status: "pending",
+            projectsResult,
+            selectedProject,
+            configPath,
+            missing: ["--project-id <id>"],
+            reasons: selectedProject.ambiguous
+                ? ["pending: multiple projects are available; rerun with --project-id <id> so onboarding does not guess"]
+                : ["pending: no account project id was available for CLI API token issuance"],
+        });
+    }
+    const issueResult = await issueAuthToken({
+        ...withOnboardEndpoint(options, "issue-api-token"),
+        projectId: selectedProject.project_id,
+        organizationId: options.organizationId ?? selectedProject.organization_id,
+    });
+    if (issueResult.status !== "issued") {
+        return buildOnboardResult({
+            status: issueResult.status === "pending" ? "pending" : "rejected",
+            projectsResult,
+            selectedProject,
+            issueResult,
+            configPath,
+            missing: issueResult.missing,
+            reasons: issueResult.reasons.length > 0
+                ? issueResult.reasons
+                : ["rejected: CLI API token issuance did not complete"],
+        });
+    }
+    const authStatus = await buildAuthStatus({ env, configDir: options.configDir });
+    return buildOnboardResult({
+        status: "issued",
+        projectsResult,
+        selectedProject,
+        issueResult,
+        authStatus,
+        configPath,
+        reasons: ["issued: account project was selected, a CLI API token was issued, and local auth status is ready"],
+    });
+}
+function printJson(value) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+function printAuthStatus(status) {
+    const lines = [
+        `Authenticated: ${status.authenticated ? "yes (local token present, not verified online)" : "no"}`,
+        `Credential source: ${status.source}`,
+        `Verified online: ${status.verified_online}`,
+        `Network performed: ${status.network_performed}`,
+        `Runtime authority: ${status.runtime_authority}`,
+        `Config path: ${status.config_path}`,
+        `Token: ${status.token_preview ?? "missing"}`,
+        `Missing: ${status.missing.length > 0 ? status.missing.join(", ") : "none"}`,
+        ...status.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printTokenResult(result) {
+    const lines = [
+        `Token ${result.status}: ${result.action}`,
+        `Config path: ${result.config_path}`,
+        `Token: ${result.token_preview ?? "not stored"}`,
+        `Raw token printed: ${result.raw_token_printed}`,
+        `Network performed: ${result.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        ...(result.reason ? [`Reason: ${result.reason}`] : []),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printSupabaseUserJwtStatus(status) {
+    const lines = [
+        `Supabase user JWT present: ${status.credential_present ? "yes (local/account credential present, not verified online)" : "no"}`,
+        `Credential source: ${status.source}`,
+        `Verified online: ${status.verified_online}`,
+        `Network performed: ${status.network_performed}`,
+        `Runtime authority: ${status.runtime_authority}`,
+        `Config path: ${status.config_path}`,
+        `Token: ${status.token_preview ?? "missing"}`,
+        `Missing: ${status.missing.length > 0 ? status.missing.join(", ") : "none"}`,
+        ...status.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printSupabaseUserJwtResult(result) {
+    const lines = [
+        `Supabase user JWT ${result.status}: ${result.action}`,
+        `Config path: ${result.config_path}`,
+        `Token: ${result.token_preview ?? "not stored"}`,
+        `Raw token printed: ${result.raw_token_printed}`,
+        `Network performed: ${result.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        ...(result.reason ? [`Reason: ${result.reason}`] : []),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printIssueTokenResult(result) {
+    const lines = [
+        `Issue token: ${result.status}`,
+        `Endpoint: ${result.endpoint ?? "missing"}`,
+        `Project id: ${result.request.project_id ?? "missing"}`,
+        `Supabase user JWT: ${result.auth.supabase_user_jwt_present ? "present" : "missing"}`,
+        `Network performed: ${result.transport.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        `Stored locally: ${result.local_storage.stored}`,
+        `Config path: ${result.local_storage.config_path}`,
+        `Token: ${result.local_storage.token_preview ?? "not stored"}`,
+        `Missing: ${result.missing.length > 0 ? result.missing.join(", ") : "none"}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printBootstrapAccountResult(result) {
+    const account = result.bootstrap_receipt?.account;
+    const accountRefs = account && typeof account === "object" && !Array.isArray(account)
+        ? account
+        : {};
+    const lines = [
+        `Bootstrap account: ${result.status}`,
+        `Endpoint: ${result.endpoint ?? "missing"}`,
+        `Organization: ${result.request.organization_name ?? result.request.organization_slug ?? "default"}`,
+        `Project: ${result.request.project_name ?? result.request.project_slug ?? "default"}`,
+        `Supabase user JWT: ${result.auth.supabase_user_jwt_present ? "present" : "missing"}`,
+        `Network performed: ${result.transport.network_performed}`,
+        `Mutation performed: ${result.mutation_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        `Organization id: ${accountRefs.organization_id ?? "unknown"}`,
+        `Project id: ${accountRefs.project_id ?? "unknown"}`,
+        `Missing: ${result.missing.length > 0 ? result.missing.join(", ") : "none"}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.next_commands.map((command) => `Next: ${command}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printProjectsResult(result) {
+    const receipt = result.projects_receipt;
+    const totals = receipt?.totals && typeof receipt.totals === "object" && !Array.isArray(receipt.totals)
+        ? receipt.totals
+        : undefined;
+    const lines = [
+        `Projects: ${result.status}`,
+        `Endpoint: ${result.endpoint ?? "missing"}`,
+        `Supabase user JWT: ${result.auth.supabase_user_jwt_present ? "present" : "missing"}`,
+        `Network performed: ${result.transport.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        `Organizations: ${totals?.organizations ?? "unknown"}`,
+        `Projects total: ${totals?.projects ?? "unknown"}`,
+        `Missing: ${result.missing.length > 0 ? result.missing.join(", ") : "none"}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printTokensResult(result) {
+    const receipt = result.token_management_receipt;
+    const totals = receipt?.totals && typeof receipt.totals === "object" && !Array.isArray(receipt.totals)
+        ? receipt.totals
+        : undefined;
+    const lines = [
+        `API tokens ${result.action}: ${result.status}`,
+        `Endpoint: ${result.endpoint ?? "missing"}`,
+        `Supabase user JWT: ${result.auth.supabase_user_jwt_present ? "present" : "missing"}`,
+        `Mutation confirmed: ${result.mutation_confirmed}`,
+        `Network performed: ${result.transport.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        `Tokens total: ${totals?.tokens ?? "unknown"}`,
+        `Missing: ${result.missing.length > 0 ? result.missing.join(", ") : "none"}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+function printOnboardResult(result) {
+    const lines = [
+        `Auth onboard: ${result.status}`,
+        `Projects endpoint: ${result.endpoints.list_projects ?? "missing"}`,
+        `Issue endpoint: ${result.endpoints.issue_api_token ?? "missing"}`,
+        `Selected project: ${result.selected_project.project_id ?? "unselected"}`,
+        `Project selection: ${result.selected_project.source}${result.selected_project.ambiguous ? " (ambiguous)" : ""}`,
+        `Supabase user JWT: ${result.auth.supabase_user_jwt_present ? "present" : "missing"}`,
+        `Network performed: ${result.transport.network_performed}`,
+        `Runtime authority: ${result.runtime_authority}`,
+        `Stored locally: ${result.local_storage.stored}`,
+        `Config path: ${result.local_storage.config_path}`,
+        `Token: ${result.local_storage.token_preview ?? "not stored"}`,
+        `Missing: ${result.missing.length > 0 ? result.missing.join(", ") : "none"}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+export async function runAuth(options) {
+    if (options.subcommand === "status") {
+        const status = await buildAuthStatus({ env: options.env, configDir: options.configDir });
+        if (options.json)
+            printJson(status);
+        else
+            printAuthStatus(status);
+        return 0;
+    }
+    if (options.subcommand === "token") {
+        if (options.tokenAction === "set") {
+            const result = await storeAuthToken({
+                token: options.token ?? "",
+                env: options.env,
+                configDir: options.configDir,
+            });
+            if (options.json)
+                printJson(result);
+            else
+                printTokenResult(result);
+            return result.status === "rejected" ? 2 : 0;
+        }
+        if (options.tokenAction === "clear") {
+            const result = await clearAuthToken({ env: options.env, configDir: options.configDir });
+            if (options.json)
+                printJson(result);
+            else
+                printTokenResult(result);
+            return 0;
+        }
+    }
+    if (options.subcommand === "user-jwt") {
+        if (options.userJwtAction === "status" || !options.userJwtAction) {
+            const status = await buildSupabaseUserJwtStatus({ env: options.env, configDir: options.configDir });
+            if (options.json)
+                printJson(status);
+            else
+                printSupabaseUserJwtStatus(status);
+            return 0;
+        }
+        if (options.userJwtAction === "set") {
+            const result = await storeSupabaseUserJwt({
+                token: options.userJwt ?? options.token ?? "",
+                env: options.env,
+                configDir: options.configDir,
+            });
+            if (options.json)
+                printJson(result);
+            else
+                printSupabaseUserJwtResult(result);
+            return result.status === "rejected" ? 2 : 0;
+        }
+        if (options.userJwtAction === "clear") {
+            const result = await clearSupabaseUserJwt({ env: options.env, configDir: options.configDir });
+            if (options.json)
+                printJson(result);
+            else
+                printSupabaseUserJwtResult(result);
+            return 0;
+        }
+        process.stderr.write("Usage: dna auth user-jwt [status|set|clear] [token] [--json]\n");
+        return 2;
+    }
+    if (options.subcommand === "issue-token") {
+        const result = await issueAuthToken(options);
+        if (options.json)
+            printJson(result);
+        else
+            printIssueTokenResult(result);
+        return result.status === "dry_run" || result.status === "issued" ? 0 : 1;
+    }
+    if (options.subcommand === "bootstrap-account") {
+        const result = await bootstrapAccount(options);
+        if (options.json)
+            printJson(result);
+        else
+            printBootstrapAccountResult(result);
+        return result.status === "dry_run" || result.status === "bootstrapped" || result.status === "pending" ? 0 : 1;
+    }
+    if (options.subcommand === "onboard") {
+        const result = await onboardAuth(options);
+        if (options.json)
+            printJson(result);
+        else
+            printOnboardResult(result);
+        return result.status === "dry_run" || result.status === "issued" || result.status === "pending" ? 0 : 1;
+    }
+    if (options.subcommand === "projects") {
+        const result = await listAuthProjects(options);
+        if (options.json)
+            printJson(result);
+        else
+            printProjectsResult(result);
+        return result.status === "dry_run" || result.status === "ready" || result.status === "pending" ? 0 : 1;
+    }
+    if (options.subcommand === "tokens") {
+        if (options.tokenAction !== "list" && options.tokenAction !== "revoke") {
+            process.stderr.write("Usage: dna auth tokens <list|revoke> [token-id] [--json|--dry-run]\n");
+            return 2;
+        }
+        const result = await manageAuthTokens(options);
+        if (options.json)
+            printJson(result);
+        else
+            printTokensResult(result);
+        return result.status === "dry_run" || result.status === "ready" || result.status === "revoked" || result.status === "pending" ? 0 : 1;
+    }
+    process.stderr.write("Usage: dna auth status [--json]\n       dna auth token set <token> [--json]\n       dna auth token clear [--json]\n       dna auth bootstrap-account [--org <name>] [--project <name>] [--json|--dry-run]\n       dna auth onboard [--project-id <id>] [--json|--dry-run]\n       dna auth issue-token --project-id <id> [--json|--dry-run]\n");
+    return 2;
+}