permdock 0.4.0 → 0.6.0

package/dist/{kernel-CB3LrIJM.js → kernel-D0NVb1cK.js}

@@ -1,20 +1,21 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as describe } from "./describe-Cgkp7eP0.js";
-import { a as deniedMessage } from "./errors-drnfxYtm.js";
+import { t as describe } from "./describe-BybMRY7A.js";
+import { a as deniedMessage } from "./errors-BKy0EfhN.js";
+import { t as actorMayCallTool } from "./delegation-j6-rc37o.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { t as mayUse } from "./may-use-BOn_dR_w.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-C9YmyBIa.js";
-import { n as resolveOrNull } from "./build-instance-DIIV9DbC.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-BVM7aWNs.js";
+import { c as withApp } from "./permdock-BrAscV28.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-CBYVMjwh.js";
+import { n as resolveOrNull } from "./build-instance-Bu_eDqYw.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-C81Pip9n.js";
 //#region src/agent/denied-text.ts
 /** The hook's text, or `event.text` when there is no hook or it throws or returns no string. */
-function deniedText(hook, event, report) {
+function refusalText(hook, event, report) {
 	if (hook === void 0) return event.text;
 	try {
 		const text = hook(event);
 		if (text === void 0) return event.text;
-		if (typeof text !== "string" || text === "") throw new TypeError("PermDock: onDenied must return a non-empty string or undefined");
+		if (typeof text !== "string" || text === "") throw new TypeError("PermDock: deniedText must return a non-empty string or undefined");
 		return text;
 	} catch (error) {
 		report(error);
@@ -44,7 +45,8 @@ function approvalTokenOf(context) {
 function runDecide(permdock, permission, data, how) {
 	return permdock.decide(permission, data, how);
 }
-function createAgentKernel(policy, options) {
+function createAgentKernel(policy, given) {
+	const options = withApp(policy, given);
 	const cache = /* @__PURE__ */ new WeakMap();
 	const reporters = /* @__PURE__ */ new WeakMap();
 	const report = (permdock, error) => {
@@ -96,6 +98,23 @@ function createAgentKernel(policy, options) {
 		let permdock;
 		try {
 			permdock = await instance(context);
+			if (how.tool !== void 0 && !actorMayCallTool(permdock.subject.actor, how.tool)) {
+				const refused = {
+					outcome: "denied",
+					denials: [{
+						role: null,
+						reason: "agent-tool-not-delegated"
+					}],
+					alternatives: []
+				};
+				return {
+					ok: true,
+					permdock,
+					data: void 0,
+					raw: refused,
+					decision: refused
+				};
+			}
 			let data;
 			if (binding.data !== void 0) {
 				try {
@@ -113,11 +132,16 @@ function createAgentKernel(policy, options) {
 					permdock
 				};
 			}
-			const raw = runDecide(permdock, binding.permission, data, {
+			const raw = runDecide(permdock, binding.permission, data, compact({
 				adapter: options.adapter,
 				boundary,
-				source: how.source
-			});
+				call: how.call,
+				args,
+				operation: binding.meta === void 0 ? void 0 : {
+					name: binding.name ?? "",
+					meta: binding.meta
+				}
+			}));
 			const decision = how.resume ? await resumeDecision({
 				decision: raw,
 				permission: binding.permission,
@@ -142,11 +166,12 @@ function createAgentKernel(policy, options) {
 			});
 		}
 	};
-	const check = (binding, args, context, checkOptions = {}) => run(binding, args, context, {
+	const check = (binding, args, context, checkOptions = {}) => run(binding, args, context, compact({
 		resume: checkOptions.simulate !== true,
-		source: checkOptions.simulate === true ? "simulate" : "adapter",
-		decideOptions: checkOptions
-	});
+		call: checkOptions.simulate === true ? "simulate" : "adapter",
+		decideOptions: checkOptions,
+		tool: checkOptions.tool
+	}));
 	const verdictOf = (checked, binding, toolName) => {
 		if (!checked.ok) {
 			if (checked.failure !== "no-data" || checked.permdock === void 0) return {
@@ -193,18 +218,21 @@ function createAgentKernel(policy, options) {
 		};
 	};
 	const evaluate = async (binding, toolName, args, context, decideOptions = {}) => {
-		const checked = await check(binding, args, context, decideOptions);
+		const checked = await check(binding, args, context, {
+			...decideOptions,
+			tool: toolName
+		});
 		return relabel(verdictOf(checked, binding, toolName), checked.permdock);
 	};
 	const relabel = (verdict, permdock) => {
-		const hook = options.onDenied;
+		const hook = options.deniedText;
 		if (hook === void 0 || verdict.outcome === "granted") return verdict;
 		const onError = (error) => {
 			report(permdock, error);
 		};
 		if (verdict.outcome === "denied") return {
 			...verdict,
-			reason: deniedText(hook, {
+			reason: refusalText(hook, {
 				decision: verdict.decision,
 				permission: verdict.permission,
 				text: verdict.reason
@@ -212,7 +240,7 @@ function createAgentKernel(policy, options) {
 		};
 		return {
 			...verdict,
-			summary: deniedText(hook, {
+			summary: refusalText(hook, {
 				decision: verdict.decision,
 				permission: verdict.permission,
 				text: verdict.summary
@@ -222,7 +250,7 @@ function createAgentKernel(policy, options) {
 	const tokenFor = async (binding, args, context) => {
 		const checked = await run(binding, args, context, {
 			resume: false,
-			source: "adapter",
+			call: "adapter",
 			decideOptions: {}
 		});
 		return checked.ok && checked.raw.outcome === "approval-required" ? checked.raw.token : void 0;
@@ -240,7 +268,7 @@ function createAgentKernel(policy, options) {
 	const allowedToolNames = async (context) => {
 		const permdock = await instance(context);
 		const allowed = /* @__PURE__ */ new Set();
-		for (const [name, binding] of Object.entries(tools)) if (mayUse(permdock, binding.permission)) allowed.add(name);
+		for (const [name, binding] of Object.entries(tools)) if (actorMayCallTool(permdock.subject.actor, name) && permdock.mayUse(binding.permission)) allowed.add(name);
 		return allowed;
 	};
 	return {
@@ -254,4 +282,4 @@ function createAgentKernel(policy, options) {
 	};
 }
 //#endregion
-export { createAgentKernel as n, deniedText as r, approvalTokenOf as t };
+export { createAgentKernel as n, refusalText as r, approvalTokenOf as t };

package/dist/kysely/index.d.ts

@@ -1,6 +1,7 @@
-import { It as WhereResult, jr as Condition, kr as Subject } from "../policy-types-sp9P1iIV.js";
+import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
+import { c as WhereResult } from "../permdock-SV8ZINYT.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-CtTP7eur.js";
+import { s as MembershipsMapping } from "../compile-1bsAezL0.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {
@@ -33,7 +34,8 @@ type KyselyWhereOptions = {
   readonly memberships?: MembershipsMapping;
   /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
   readonly relations?: RelationsMapping;
-  readonly now?: number;
+  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  readonly now?: Instant;
   /** Kysely's `sql` tag, for graph subqueries on runtimes without `require`; loaded from the `kysely` peer by default. */
   readonly sql?: KyselySql;
 };

package/dist/kysely/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { a as assertSafeKey } from "../thenable-QSmvt-vZ.js";
-import { n as escapeLike, t as compileWhere } from "../compile-CcEu2ZQ1.js";
+import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CMqMx_IN.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/kysely/to-where.ts
 function ident(name) {

package/dist/load-BxEtwlBS.js

@@ -0,0 +1 @@
+export { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";

package/dist/{load-C3_oTHyO.js → load-DFS_ry0W.js}

@@ -1,8 +1,16 @@
-import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
-//#region src/cli/load.ts
+//#region src/cli/project/load.ts
+/** A project module the CLI cannot use: the project's to fix, so a usage error. */
+function invalidModule(message, cause) {
+	return new CliError("usage", message, {
+		code: "config_invalid",
+		...cause === void 0 ? {} : { cause }
+	});
+}
 /**
 * Errors Node raises while resolving or parsing a module graph, before any of
 * its code runs, so loading it again through jiti cannot repeat a side effect.
@@ -36,6 +44,14 @@ function importWithJiti(abs, fresh) {
 * returned as written; `default` is not merged into the namespace.
 */
 async function loadModule(abs, options) {
+	try {
+		return await importModule(abs, options);
+	} catch (error) {
+		if (error instanceof CliError) throw error;
+		throw invalidModule(describeError(error), error);
+	}
+}
+async function importModule(abs, options) {
 	let loaded;
 	if (options?.fresh === true) loaded = await importWithJiti(abs, true);
 	else try {
@@ -44,7 +60,7 @@ async function loadModule(abs, options) {
 		if (!loadsWithJiti(error)) throw error;
 		loaded = await importWithJiti(abs, false);
 	}
-	if (loaded === null || typeof loaded !== "object") throw new Error(`PermDock CLI: module '${abs}' did not export an object`);
+	if (loaded === null || typeof loaded !== "object") throw invalidModule(`PermDock CLI: module '${abs}' did not export an object`);
 	return loaded;
 }
 function pickNamed(mod, names) {
@@ -52,11 +68,11 @@ function pickNamed(mod, names) {
 	return mod["default"];
 }
 function asPermissionTree(value) {
-	if (value === null || typeof value !== "object") throw new Error("PermDock CLI: permissions export is not a permission tree");
+	if (value === null || typeof value !== "object") throw invalidModule("PermDock CLI: permissions export is not a permission tree");
 	return value;
 }
 function asPolicy(value) {
-	if (value === null || typeof value !== "object" || !("roles" in value) || !("permissions" in value)) throw new Error("PermDock CLI: policy export is not a Policy");
+	if (value === null || typeof value !== "object" || !("roles" in value) || !("permissions" in value)) throw invalidModule("PermDock CLI: policy export is not a Policy");
 	return value;
 }
 function leavesOf(tree) {
@@ -68,7 +84,7 @@ async function loadPolicyAt(cwd, path, options) {
 }
 /** The `policy` export at `path`; without one, throws `PermDock CLI: <missing>`. */
 function requirePolicy(cwd, path, missing) {
-	return path === void 0 ? Promise.reject(/* @__PURE__ */ new Error(`PermDock CLI: ${missing}`)) : loadPolicyAt(cwd, path);
+	return path === void 0 ? Promise.reject(new CliError("usage", `PermDock CLI: ${missing}`, { code: "config_invalid" })) : loadPolicyAt(cwd, path);
 }
 /** The configured policy export, or `undefined` when unset or unloadable. */
 async function loadConfiguredPolicy(cwd, path, options) {

package/dist/{load-jose-BL6LH4bL.js → load-jose-DZ4dnjri.js}

@@ -1,11 +1,8 @@
 //#region src/jwt/load-jose.ts
-let cached;
 function loadJose() {
-	cached ??= import("jose").catch((cause) => {
-		cached = void 0;
+	return import("jose").catch((cause) => {
 		throw new Error("PermDock: permdock/jwt requires the optional peer \"jose\".", { cause });
 	});
-	return cached;
 }
 //#endregion
 export { loadJose as t };

package/dist/login-Dfe5RlYk.js

@@ -0,0 +1,68 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/login.ts
+const urlFlag = { url: {
+	type: "string",
+	description: "Issuer URL (default PERMDOCK_CLOUD_URL, then https://permdock.com/api)",
+	valueHint: "url"
+} };
+const login = defineLeaf({
+	flags: {
+		...urlFlag,
+		loopback: {
+			type: "boolean",
+			description: "Use a 127.0.0.1 redirect with PKCE instead of the device flow"
+		},
+		scope: {
+			type: "enum",
+			options: ["catalog:write"],
+			repeatable: true,
+			description: "Scopes beyond projects:read and policy:read; catalog:write for permdock cloud push"
+		},
+		open: {
+			type: "boolean",
+			default: true,
+			description: "Open the browser at the verification URL",
+			negativeDescription: "Print the URL only"
+		}
+	},
+	async run(ctx, { flags }) {
+		const { runLogin } = await import("./login-imhuwvn3.js");
+		return runLogin({
+			cwd: ctx.cwd,
+			url: given(flags.url),
+			loopback: flags.loopback,
+			scopes: flags.scope,
+			open: flags.open && ctx.interactive,
+			json: ctx.json,
+			env: ctx.env,
+			io: ctx.io
+		});
+	}
+});
+const logout = defineLeaf({
+	flags: { ...urlFlag },
+	async run(ctx, { flags }) {
+		const { runLogout } = await import("./login-imhuwvn3.js");
+		return runLogout({
+			url: given(flags.url),
+			json: ctx.json,
+			env: ctx.env,
+			io: ctx.io
+		});
+	}
+});
+const whoami = defineLeaf({
+	flags: { ...urlFlag },
+	async run(ctx, { flags }) {
+		const { runWhoami } = await import("./login-imhuwvn3.js");
+		return runWhoami({
+			url: given(flags.url),
+			json: ctx.json,
+			env: ctx.env,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { login, logout, whoami };

package/dist/login-imhuwvn3.js

@@ -0,0 +1,254 @@
+import { h as secondsAt, i as dateAt, s as instantAt } from "./time-DkWjdL98.js";
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BARQ8eYG.js";
+import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
+import { n as httpRequest } from "./http-DXJ37RDA.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-DRLEizbL.js";
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+//#region src/cli/cloud/loopback.ts
+/** How long the loopback listener waits for the browser to come back. */
+const LOOPBACK_TIMEOUT_MS = 3e5;
+function base64url(bytes) {
+	return bytes.toString("base64url");
+}
+function listen(server) {
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			resolve(typeof address === "object" && address !== null ? address.port : 0);
+		});
+	});
+}
+/**
+* RFC 8252 native-app login: an authorization code delivered to a listener on
+* `127.0.0.1` with an ephemeral port, bound by PKCE S256 (RFC 7636) and a
+* `state` that the callback must echo.
+*/
+async function runLoopbackFlow(options, runtime) {
+	const verifier = base64url(randomBytes(32));
+	const challenge = base64url(createHash("sha256").update(verifier).digest());
+	const state = base64url(randomBytes(16));
+	const { promise: callback, resolve: settle } = Promise.withResolvers();
+	const server = createServer((request, response) => {
+		const url = new URL(request.url ?? "/", "http://127.0.0.1");
+		if (url.pathname !== "/callback") {
+			response.writeHead(404).end();
+			return;
+		}
+		const code = url.searchParams.get("code");
+		const error = url.searchParams.get("error");
+		const ok = url.searchParams.get("state") === state && code !== null;
+		response.writeHead(ok ? 200 : 400, { "content-type": "text/plain; charset=utf-8" }).end(ok ? "PermDock login complete. You can close this tab.\n" : "PermDock login failed. Return to the terminal.\n");
+		settle(ok ? {
+			ok: true,
+			code
+		} : {
+			ok: false,
+			error: error ?? "state-mismatch"
+		});
+	});
+	let port;
+	try {
+		port = await listen(server);
+	} catch {
+		return null;
+	}
+	const redirectUri = `http://127.0.0.1:${String(port)}/callback`;
+	const authorize = new URL(options.authorizationEndpoint);
+	authorize.searchParams.set("response_type", "code");
+	authorize.searchParams.set("client_id", options.clientId);
+	authorize.searchParams.set("redirect_uri", redirectUri);
+	authorize.searchParams.set("scope", options.scope);
+	authorize.searchParams.set("state", state);
+	authorize.searchParams.set("code_challenge", challenge);
+	authorize.searchParams.set("code_challenge_method", "S256");
+	options.write(`Open ${authorize.href} to log in\n`);
+	options.open?.(authorize.href);
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			resolve({
+				ok: false,
+				error: "timeout"
+			});
+		}, options.timeoutMs ?? LOOPBACK_TIMEOUT_MS);
+	});
+	const result = await Promise.race([callback, timeout]);
+	clearTimeout(timer);
+	server.closeAllConnections();
+	server.close();
+	if (!result.ok) return null;
+	const body = await postForm(runtime, options.tokenEndpoint, {
+		grant_type: "authorization_code",
+		code: result.code,
+		redirect_uri: redirectUri,
+		client_id: options.clientId,
+		code_verifier: verifier
+	});
+	if (body === null) return null;
+	const token = parseToken(body, secondsAt(runtime.now?.()));
+	return token.ok ? token.credential : null;
+}
+//#endregion
+//#region src/cli/cloud/login.ts
+/** Opens `url` in the default browser; a failure leaves the printed URL to the user. */
+function openBrowser(url) {
+	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
+		"/c",
+		"start",
+		"",
+		url
+	]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+/** RFC 7009 answers 200 with an empty body, also for a token it does not know. */
+async function revoke(runtime, endpoint, fields) {
+	try {
+		return (await httpRequest(runtime.fetch === void 0 ? {} : { fetch: runtime.fetch }, {
+			url: endpoint,
+			method: "POST",
+			service: endpoint,
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(fields)
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+function failed(code, output) {
+	return {
+		code,
+		output
+	};
+}
+async function runLogin(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	const runtime = cliRuntime(input.io, input.env);
+	const inside = credentialsInsideRepository(input.cwd, runtime);
+	if (inside !== null) return failed(2, `permdock login refuses to store credentials inside the repository (${inside}); point XDG_CONFIG_HOME outside it`);
+	const metadata = await issuerMetadata(issuer, runtime);
+	if (metadata === null) return failed(1, `permdock login: ${issuer} publishes no RFC 8414 metadata for that issuer`);
+	const scope = [.../* @__PURE__ */ new Set([...READ_SCOPES, ...input.scopes])].join(" ");
+	const open = input.open ? openBrowser : void 0;
+	const say = (text) => {
+		input.io.stderr(text.replace(/\n$/u, ""));
+	};
+	let credential = null;
+	if (!input.loopback && metadata.deviceAuthorizationEndpoint !== void 0 && metadata.tokenEndpoint !== void 0) credential = await runDeviceFlow({
+		clientId: CLI_CLIENT_ID,
+		scope,
+		authorizationEndpoint: metadata.deviceAuthorizationEndpoint,
+		tokenEndpoint: metadata.tokenEndpoint,
+		...open === void 0 ? {} : { open }
+	}, runtime, say);
+	else if (metadata.authorizationEndpoint !== void 0 && metadata.tokenEndpoint !== void 0) credential = await runLoopbackFlow({
+		authorizationEndpoint: metadata.authorizationEndpoint,
+		tokenEndpoint: metadata.tokenEndpoint,
+		clientId: CLI_CLIENT_ID,
+		scope,
+		write: say,
+		...open === void 0 ? {} : { open }
+	}, runtime);
+	else return failed(1, `permdock login: ${issuer} offers neither the device flow nor an authorization endpoint`);
+	if (credential === null) return failed(1, `permdock login: ${issuer} did not issue a token`);
+	const granted = credential.scope === void 0 ? {
+		...credential,
+		scope
+	} : credential;
+	const storage = await credentialStorage();
+	const where = writeCredentials(storage, issuer, granted, runtime) === "keychain" ? "the OS keychain" : credentialsPath(CREDENTIAL_SERVICE, runtime);
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			scope: granted.scope,
+			storage: where
+		}) : `logged in to ${issuer} (${granted.scope ?? scope}); credentials in ${where}`
+	};
+}
+/** Revokes the stored login (RFC 7009) and deletes it; a revocation failure still deletes it. */
+async function runLogout(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	const runtime = cliRuntime(input.io, input.env);
+	const storage = await credentialStorage();
+	const credential = readCredentials(storage, issuer, runtime);
+	if (credential === null) return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			status: "not logged in"
+		}) : `not logged in to ${issuer}`
+	};
+	const metadata = await issuerMetadata(issuer, runtime);
+	let revoked = false;
+	if (metadata?.revocationEndpoint !== void 0) {
+		const refresh = credential.refresh_token;
+		revoked = await revoke(runtime, metadata.revocationEndpoint, {
+			token: refresh ?? credential.access_token,
+			token_type_hint: refresh === void 0 ? "access_token" : "refresh_token",
+			client_id: CLI_CLIENT_ID
+		});
+	}
+	deleteCredentials(storage, issuer, runtime);
+	const status = revoked ? "revoked" : "deleted";
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			issuer,
+			status
+		}) : `logged out of ${issuer} (${revoked ? "token revoked" : "credentials deleted; the token was not revoked"})`
+	};
+}
+/** The credential the next Cloud call sends, without sending it. */
+async function runWhoami(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	for (const name of ["PERMDOCK_CLOUD_KEY", "PERMDOCK_CLOUD_TOKEN"]) {
+		const value = input.env[name];
+		if (value !== void 0 && value !== "") {
+			const data = {
+				issuer,
+				source: name
+			};
+			return {
+				code: 0,
+				output: input.json ? JSON.stringify(data) : `${issuer}: ${name} from the environment`,
+				data
+			};
+		}
+	}
+	const runtime = cliRuntime(input.io, input.env);
+	const credential = readCredentials(await credentialStorage(), issuer, runtime);
+	if (credential === null) throw new CliError("action", `not logged in to ${issuer}`, {
+		code: "auth_required",
+		next: [{
+			command: "permdock login",
+			when: "to log in"
+		}]
+	});
+	const scopes = (credential.scope ?? "").split(" ").filter((scope) => scope !== "");
+	const expired = credential.expires_at !== void 0 && credential.expires_at <= secondsAt(runtime.now?.()) && credential.refresh_token === void 0;
+	const data = {
+		issuer,
+		source: "login",
+		scopes,
+		...credential.expires_at === void 0 ? {} : { expiresAt: dateAt(instantAt(credential.expires_at)).toISOString() },
+		expired
+	};
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${scopes.join(" ") || "no scopes"})${expired ? "; the login has expired, run permdock login" : ""}`,
+		data
+	};
+}
+//#endregion
+export { runLogin, runLogout, runWhoami };

package/dist/manifest-C8IzW3Do.js

@@ -0,0 +1,42 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as supabaseManifestSchema } from "./manifest-schema-C0kK_8V0.js";
+//#region src/supabase/manifest.ts
+/**
+* Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
+* validates it against `schemas/supabase-manifest-v1.json`. Returns a
+* deep-frozen copy built from own keys; throws `PermDockValidationError`
+* with every issue, so a manifest of another major is refused.
+*/
+function parseSupabaseManifest(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalidManifest([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	const copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	if (issues.length === 0) checkSchema(supabaseManifestSchema, copy, [], issues);
+	if (issues.length > 0) invalidManifest(issues);
+	return freezeDeep(copy);
+}
+function invalidManifest(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "supabase-manifest",
+		issues,
+		message: `PermDock: invalid Supabase manifest${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+//#endregion
+export { parseSupabaseManifest as t };