permdock 0.3.1 → 0.5.0

package/dist/login-imhuwvn3.js

@@ -0,0 +1,254 @@
+import { h as secondsAt, i as dateAt, s as instantAt } from "./time-DkWjdL98.js";
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BARQ8eYG.js";
+import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
+import { n as httpRequest } from "./http-DXJ37RDA.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-DRLEizbL.js";
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+//#region src/cli/cloud/loopback.ts
+/** How long the loopback listener waits for the browser to come back. */
+const LOOPBACK_TIMEOUT_MS = 3e5;
+function base64url(bytes) {
+	return bytes.toString("base64url");
+}
+function listen(server) {
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			resolve(typeof address === "object" && address !== null ? address.port : 0);
+		});
+	});
+}
+/**
+* RFC 8252 native-app login: an authorization code delivered to a listener on
+* `127.0.0.1` with an ephemeral port, bound by PKCE S256 (RFC 7636) and a
+* `state` that the callback must echo.
+*/
+async function runLoopbackFlow(options, runtime) {
+	const verifier = base64url(randomBytes(32));
+	const challenge = base64url(createHash("sha256").update(verifier).digest());
+	const state = base64url(randomBytes(16));
+	const { promise: callback, resolve: settle } = Promise.withResolvers();
+	const server = createServer((request, response) => {
+		const url = new URL(request.url ?? "/", "http://127.0.0.1");
+		if (url.pathname !== "/callback") {
+			response.writeHead(404).end();
+			return;
+		}
+		const code = url.searchParams.get("code");
+		const error = url.searchParams.get("error");
+		const ok = url.searchParams.get("state") === state && code !== null;
+		response.writeHead(ok ? 200 : 400, { "content-type": "text/plain; charset=utf-8" }).end(ok ? "PermDock login complete. You can close this tab.\n" : "PermDock login failed. Return to the terminal.\n");
+		settle(ok ? {
+			ok: true,
+			code
+		} : {
+			ok: false,
+			error: error ?? "state-mismatch"
+		});
+	});
+	let port;
+	try {
+		port = await listen(server);
+	} catch {
+		return null;
+	}
+	const redirectUri = `http://127.0.0.1:${String(port)}/callback`;
+	const authorize = new URL(options.authorizationEndpoint);
+	authorize.searchParams.set("response_type", "code");
+	authorize.searchParams.set("client_id", options.clientId);
+	authorize.searchParams.set("redirect_uri", redirectUri);
+	authorize.searchParams.set("scope", options.scope);
+	authorize.searchParams.set("state", state);
+	authorize.searchParams.set("code_challenge", challenge);
+	authorize.searchParams.set("code_challenge_method", "S256");
+	options.write(`Open ${authorize.href} to log in\n`);
+	options.open?.(authorize.href);
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			resolve({
+				ok: false,
+				error: "timeout"
+			});
+		}, options.timeoutMs ?? LOOPBACK_TIMEOUT_MS);
+	});
+	const result = await Promise.race([callback, timeout]);
+	clearTimeout(timer);
+	server.closeAllConnections();
+	server.close();
+	if (!result.ok) return null;
+	const body = await postForm(runtime, options.tokenEndpoint, {
+		grant_type: "authorization_code",
+		code: result.code,
+		redirect_uri: redirectUri,
+		client_id: options.clientId,
+		code_verifier: verifier
+	});
+	if (body === null) return null;
+	const token = parseToken(body, secondsAt(runtime.now?.()));
+	return token.ok ? token.credential : null;
+}
+//#endregion
+//#region src/cli/cloud/login.ts
+/** Opens `url` in the default browser; a failure leaves the printed URL to the user. */
+function openBrowser(url) {
+	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
+		"/c",
+		"start",
+		"",
+		url
+	]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+/** RFC 7009 answers 200 with an empty body, also for a token it does not know. */
+async function revoke(runtime, endpoint, fields) {
+	try {
+		return (await httpRequest(runtime.fetch === void 0 ? {} : { fetch: runtime.fetch }, {
+			url: endpoint,
+			method: "POST",
+			service: endpoint,
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(fields)
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+function failed(code, output) {
+	return {
+		code,
+		output
+	};
+}
+async function runLogin(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	const runtime = cliRuntime(input.io, input.env);
+	const inside = credentialsInsideRepository(input.cwd, runtime);
+	if (inside !== null) return failed(2, `permdock login refuses to store credentials inside the repository (${inside}); point XDG_CONFIG_HOME outside it`);
+	const metadata = await issuerMetadata(issuer, runtime);
+	if (metadata === null) return failed(1, `permdock login: ${issuer} publishes no RFC 8414 metadata for that issuer`);
+	const scope = [.../* @__PURE__ */ new Set([...READ_SCOPES, ...input.scopes])].join(" ");
+	const open = input.open ? openBrowser : void 0;
+	const say = (text) => {
+		input.io.stderr(text.replace(/\n$/u, ""));
+	};
+	let credential = null;
+	if (!input.loopback && metadata.deviceAuthorizationEndpoint !== void 0 && metadata.tokenEndpoint !== void 0) credential = await runDeviceFlow({
+		clientId: CLI_CLIENT_ID,
+		scope,
+		authorizationEndpoint: metadata.deviceAuthorizationEndpoint,
+		tokenEndpoint: metadata.tokenEndpoint,
+		...open === void 0 ? {} : { open }
+	}, runtime, say);
+	else if (metadata.authorizationEndpoint !== void 0 && metadata.tokenEndpoint !== void 0) credential = await runLoopbackFlow({
+		authorizationEndpoint: metadata.authorizationEndpoint,
+		tokenEndpoint: metadata.tokenEndpoint,
+		clientId: CLI_CLIENT_ID,
+		scope,
+		write: say,
+		...open === void 0 ? {} : { open }
+	}, runtime);
+	else return failed(1, `permdock login: ${issuer} offers neither the device flow nor an authorization endpoint`);
+	if (credential === null) return failed(1, `permdock login: ${issuer} did not issue a token`);
+	const granted = credential.scope === void 0 ? {
+		...credential,
+		scope
+	} : credential;
+	const storage = await credentialStorage();
+	const where = writeCredentials(storage, issuer, granted, runtime) === "keychain" ? "the OS keychain" : credentialsPath(CREDENTIAL_SERVICE, runtime);
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			scope: granted.scope,
+			storage: where
+		}) : `logged in to ${issuer} (${granted.scope ?? scope}); credentials in ${where}`
+	};
+}
+/** Revokes the stored login (RFC 7009) and deletes it; a revocation failure still deletes it. */
+async function runLogout(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	const runtime = cliRuntime(input.io, input.env);
+	const storage = await credentialStorage();
+	const credential = readCredentials(storage, issuer, runtime);
+	if (credential === null) return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			status: "not logged in"
+		}) : `not logged in to ${issuer}`
+	};
+	const metadata = await issuerMetadata(issuer, runtime);
+	let revoked = false;
+	if (metadata?.revocationEndpoint !== void 0) {
+		const refresh = credential.refresh_token;
+		revoked = await revoke(runtime, metadata.revocationEndpoint, {
+			token: refresh ?? credential.access_token,
+			token_type_hint: refresh === void 0 ? "access_token" : "refresh_token",
+			client_id: CLI_CLIENT_ID
+		});
+	}
+	deleteCredentials(storage, issuer, runtime);
+	const status = revoked ? "revoked" : "deleted";
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			status
+		}) : `logged out of ${issuer} (${revoked ? "token revoked" : "credentials deleted; the token was not revoked"})`
+	};
+}
+/** The credential the next Cloud call sends, without sending it. */
+async function runWhoami(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	for (const name of ["PERMDOCK_CLOUD_KEY", "PERMDOCK_CLOUD_TOKEN"]) {
+		const value = input.env[name];
+		if (value !== void 0 && value !== "") {
+			const data = {
+				issuer,
+				source: name
+			};
+			return {
+				code: 0,
+				output: input.json ? JSON.stringify(data) : `${issuer}: ${name} from the environment`,
+				data
+			};
+		}
+	}
+	const runtime = cliRuntime(input.io, input.env);
+	const credential = readCredentials(await credentialStorage(), issuer, runtime);
+	if (credential === null) throw new CliError("action", `not logged in to ${issuer}`, {
+		code: "auth_required",
+		next: [{
+			command: "permdock login",
+			when: "to log in"
+		}]
+	});
+	const scopes = (credential.scope ?? "").split(" ").filter((scope) => scope !== "");
+	const expired = credential.expires_at !== void 0 && credential.expires_at <= secondsAt(runtime.now?.()) && credential.refresh_token === void 0;
+	const data = {
+		issuer,
+		source: "login",
+		scopes,
+		...credential.expires_at === void 0 ? {} : { expiresAt: dateAt(instantAt(credential.expires_at)).toISOString() },
+		expired
+	};
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${scopes.join(" ") || "no scopes"})${expired ? "; the login has expired, run permdock login" : ""}`,
+		data
+	};
+}
+//#endregion
+export { runLogin, runLogout, runWhoami };

package/dist/manifest-C8IzW3Do.js

@@ -0,0 +1,42 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as supabaseManifestSchema } from "./manifest-schema-C0kK_8V0.js";
+//#region src/supabase/manifest.ts
+/**
+* Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
+* validates it against `schemas/supabase-manifest-v1.json`. Returns a
+* deep-frozen copy built from own keys; throws `PermDockValidationError`
+* with every issue, so a manifest of another major is refused.
+*/
+function parseSupabaseManifest(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalidManifest([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	const copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	if (issues.length === 0) checkSchema(supabaseManifestSchema, copy, [], issues);
+	if (issues.length > 0) invalidManifest(issues);
+	return freezeDeep(copy);
+}
+function invalidManifest(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "supabase-manifest",
+		issues,
+		message: `PermDock: invalid Supabase manifest${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+//#endregion
+export { parseSupabaseManifest as t };

package/dist/manifest-CtKR3GXL.js

@@ -0,0 +1,370 @@
+//#region src/cli/core/manifest.ts
+const DOCS_BASE = "https://permdock.com/docs/cli";
+function leaf(name, summary, options) {
+	return {
+		kind: "leaf",
+		name,
+		summary,
+		...options
+	};
+}
+function group(name, summary, docs, children) {
+	return {
+		kind: "group",
+		name,
+		summary,
+		docs,
+		children
+	};
+}
+const SECTIONS = [
+	{
+		title: "Get started",
+		entries: [
+			leaf("init", "Write a preset's permissions, policy, app and wiring into the project", {
+				examples: [
+					"permdock init --preset p1AQIDBAc",
+					"permdock init --archetype b2b --framework hono --integration mcp",
+					"permdock init --archetype api --auth supabase --backend drizzle --service cloud-decision-log"
+				],
+				docs: "init",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).init
+			}),
+			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
+				examples: ["permdock preset decode p1AQIDBAc"],
+				docs: "preset",
+				effects: [],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).presetDecode
+			}), leaf("url", "Print the permdock.com/create link that opens a code", {
+				examples: ["permdock preset url p1AQIDBAc"],
+				docs: "preset",
+				effects: [],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).presetUrl
+			})]),
+			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
+				leaf("install", "Copy the Agent Skills into the agent folders", {
+					examples: [
+						"permdock skills install",
+						"permdock skills install --for cursor --for claude",
+						"permdock skills install --check"
+					],
+					docs: "skills",
+					effects: ["files"],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).install
+				}),
+				leaf("update", "Replace installed skills with this version's", {
+					examples: ["permdock skills update"],
+					docs: "skills",
+					effects: ["files"],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).update
+				}),
+				leaf("list", "List the skills and where each is installed", {
+					examples: ["permdock skills list"],
+					docs: "skills",
+					effects: [],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).list
+				})
+			]),
+			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
+				examples: [
+					"permdock doctor",
+					"permdock doctor --only imports,references",
+					"permdock doctor --format github"
+				],
+				docs: "doctor",
+				effects: ["files"],
+				config: true,
+				findings: true,
+				load: async () => (await import("./doctor-CxiwSfqH.js")).doctor
+			}),
+			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
+				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
+				docs: "completion",
+				effects: [],
+				config: false,
+				shellOutput: true,
+				load: async () => (await import("./completion-BqhRBJD8.js")).completion
+			})
+		]
+	},
+	{
+		title: "Permissions",
+		entries: [
+			leaf("collect", "Scan the sources for definePermissions() and references; write the catalog and barrel", {
+				examples: [
+					"permdock collect",
+					"permdock collect --check",
+					"permdock collect --watch"
+				],
+				docs: "collect",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./collect-DloHbDVa.js")).collect
+			}),
+			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
+				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
+				docs: "catalog",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./catalog-R_A__RsH.js")).catalog
+			}),
+			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
+				examples: ["permdock usage", "permdock usage --fail-on warning"],
+				docs: "usage",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./usage-DHtE8j4E.js")).usage
+			}),
+			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
+				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
+				docs: "diff",
+				effects: [],
+				config: true,
+				load: async () => (await import("./diff-CxZo9pTq.js")).diff
+			}),
+			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
+				examples: ["permdock config", "permdock config --print"],
+				docs: "config",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./config-B46rm9sc.js")).config
+			})
+		]
+	},
+	{
+		title: "Database",
+		entries: [
+			group("rls", "Generate, import, verify or migrate Postgres RLS policies", "rls", [
+				leaf("generate", "Compile the policy into RLS policies and helpers", {
+					examples: ["permdock rls generate --target sql --out supabase/schemas/permdock.sql", "permdock rls generate --check"],
+					docs: "rls",
+					effects: [
+						"files",
+						"database:read",
+						"network"
+					],
+					config: true,
+					load: async () => (await import("./rls-BA8an5Ap.js")).generate
+				}),
+				leaf("import", "Turn existing RLS policies into a generated definition", {
+					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
+					docs: "rls",
+					effects: ["files", "database:read"],
+					config: true,
+					load: async () => (await import("./rls-BA8an5Ap.js")).importPolicies
+				}),
+				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
+					examples: [
+						"permdock rls verify",
+						"permdock rls verify --kind pgtap",
+						"permdock rls verify --introspect --db-url-stdin"
+					],
+					docs: "rls",
+					effects: ["database:read"],
+					config: true,
+					load: async () => (await import("./rls-BA8an5Ap.js")).verify
+				}),
+				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
+					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
+					docs: "rls",
+					effects: ["rewrite", "files"],
+					config: true,
+					load: async () => (await import("./rls-BA8an5Ap.js")).migrate
+				})
+			]),
+			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
+				examples: ["permdock supabase hook generate --out supabase/schemas/permdock_hook.sql", "permdock supabase hook generate --check"],
+				docs: "supabase",
+				effects: ["files", "database:read"],
+				config: true,
+				load: async () => (await import("./supabase-9pqI57pW.js")).hookGenerate
+			})]), leaf("inspect", "Print or write the hook and helper manifest", {
+				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
+				docs: "supabase",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./supabase-9pqI57pW.js")).inspect
+			})]),
+			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
+				examples: ["permdock powersync generate", "permdock powersync generate --check"],
+				docs: "powersync",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./powersync-BHfuehf3.js")).generate
+			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
+				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
+				docs: "powersync",
+				effects: ["database:read"],
+				config: true,
+				load: async () => (await import("./powersync-BHfuehf3.js")).verify
+			})])
+		]
+	},
+	{
+		title: "Interop",
+		entries: [
+			group("openapi", "Emit security into an OpenAPI document, or import one into a definition", "openapi", [leaf("emit", "Write security and securitySchemes into an OpenAPI document", {
+				examples: ["permdock openapi emit --doc openapi.json --out openapi.secured.json", "permdock openapi emit --doc openapi.json --kind overlay --out overlay.json"],
+				docs: "openapi",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./openapi-ahr8rHu3.js")).emit
+			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
+				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
+				docs: "openapi",
+				effects: ["files", "network"],
+				config: false,
+				load: async () => (await import("./openapi-ahr8rHu3.js")).importDocument
+			})]),
+			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
+				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
+				docs: "arazzo",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./arazzo-B6lebmiQ.js")).check
+			})]),
+			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
+				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
+				docs: "scan",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./scan-BOI5tJ-6.js")).scan
+			}),
+			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
+				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
+				docs: "casl",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./casl-64gpT-8x.js")).caslImport
+			})]),
+			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
+				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
+				docs: "casbin",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./casbin-Cr7RLtA3.js")).casbinImport
+			})])
+		]
+	},
+	{
+		title: "Account and Cloud",
+		entries: [
+			leaf("login", "Log in to PermDock Cloud with the device flow (RFC 8628) or a loopback redirect (RFC 8252)", {
+				examples: ["permdock login", "permdock login --scope catalog:write"],
+				docs: "login",
+				effects: ["network", "files"],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).login
+			}),
+			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
+				examples: ["permdock logout"],
+				docs: "login",
+				effects: ["network", "files"],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).logout
+			}),
+			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
+				examples: ["permdock whoami", "permdock whoami --json"],
+				docs: "login",
+				effects: [],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).whoami
+			}),
+			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
+				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
+				docs: "cloud",
+				effects: ["network", "cloud:write"],
+				config: true,
+				load: async () => (await import("./cloud-CIoHNevm.js")).push
+			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
+				examples: ["permdock cloud pull --project prj_123"],
+				docs: "cloud",
+				effects: ["network", "files"],
+				config: true,
+				load: async () => (await import("./cloud-CIoHNevm.js")).pull
+			})])
+		]
+	},
+	{
+		title: "Upgrade",
+		entries: [leaf("codemod", "Apply a release's renames to files that import permdock; list call sites to edit by hand", {
+			examples: ["permdock codemod 0.5 --dry-run", "permdock codemod 0.5 src"],
+			docs: "codemod",
+			effects: ["rewrite"],
+			config: false,
+			load: async () => (await import("./codemod-Bmj9dWMH.js")).codemod
+		})]
+	}
+];
+/** The hidden leaf shells call for dynamic completion candidates. */
+const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a partial command line", {
+	examples: [],
+	docs: "completion",
+	effects: [],
+	config: false,
+	shellOutput: true,
+	hidden: true,
+	load: async () => (await import("./completion-BqhRBJD8.js")).complete
+});
+const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
+/** Each leaf with its path from the root, in manifest order. */
+function leaves(entry = ROOT, path = []) {
+	return entry.children.flatMap((child) => child.kind === "leaf" ? [{
+		path: [...path, child.name],
+		entry: child
+	}] : leaves(child, [...path, child.name]));
+}
+/**
+* Walks positional tokens down the tree until a leaf. Flags may sit
+* anywhere; only bare words name a child.
+*/
+function resolve(argv) {
+	let node = ROOT;
+	const path = [];
+	const rest = [];
+	for (const [i, token] of argv.entries()) {
+		if (token === "--") {
+			rest.push(...argv.slice(i));
+			break;
+		}
+		if (token.startsWith("-") && token !== "-") {
+			rest.push(token);
+			continue;
+		}
+		const child = node.children.find((item) => item.name === token);
+		if (child === void 0) return {
+			kind: "group",
+			path,
+			entry: node,
+			unknown: token,
+			rest: [...rest, ...argv.slice(i + 1)]
+		};
+		path.push(child.name);
+		if (child.kind === "leaf") return {
+			kind: "leaf",
+			path,
+			entry: child,
+			rest: [...rest, ...argv.slice(i + 1)]
+		};
+		node = child;
+	}
+	return {
+		kind: "group",
+		path,
+		entry: node,
+		rest
+	};
+}
+//#endregion
+export { resolve as a, leaves as i, ROOT as n, SECTIONS as r, DOCS_BASE as t };

package/dist/manifest-json-CAGzls-C.js

@@ -0,0 +1,9 @@
+//#region src/cli/manifest-json.ts
+/** Where `permdock supabase inspect --out` writes the manifest by default. */
+const MANIFEST_FILE = "permdock.manifest.json";
+/** The bytes `permdock supabase inspect --out` and `permdock cloud pull` write. */
+function formatManifestJson(manifest) {
+	return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+//#endregion
+export { formatManifestJson as n, MANIFEST_FILE as t };