permdock 0.7.0 → 0.8.0

package/dist/jwt/index.js

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as epochSeconds, p as nowSeconds } from "../time-DkWjdL98.js";
-import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as epochSeconds, p as nowSeconds } from "../time-nR1JesoH.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-L7NnfhiE.js";
-import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
+import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-BqX94r07.js";
+import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as loadJose } from "../load-jose-DZ4dnjri.js";
-import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-etGIS_Dv.js";
-import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
+import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-BNWCJtmP.js";
+import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 //#region src/jwt/dpop.ts
 const DPOP_WINDOW_SECONDS = 60;
 const PROOF_ALGS = /* @__PURE__ */ new Set([
@@ -147,8 +147,8 @@ async function stores(options, capability, issuedAt, once) {
 }
 /**
 * Resolves a `vnd.permdock.capability+jwt` into the `link` subject it acts as.
-* Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
-* a revoked link, a replayed one-time token, a redeemer the viewer does not
+* Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim, a
+* revoked link, a replayed one-time token, a redeemer the viewer does not
 * satisfy, a `cnf` without a matching DPoP proof, a throwing store) is the
 * anonymous subject, never a throw.
 */
@@ -321,9 +321,9 @@ async function subjectFromCiOidc(token, options) {
 //#region src/jwt/id-token.ts
 /**
 * Verifies an OpenID Connect ID token for a relying party (Core section
-* 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent,
-* `azp` and, when `nonce` is given, `nonce`. It does not check `at_hash`,
-* `c_hash`, `auth_time` or `acr`. Never throws.
+* 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent, `azp`
+* and, when `nonce` is given, `nonce`. It does not check `at_hash`, `c_hash`,
+* `auth_time` or `acr`. Never throws.
 */
 async function verifyIdToken(token, options) {
 	const verifier = options.verifier ?? joseTokenVerifier(compact({
@@ -552,10 +552,10 @@ function mtlsThumbprint(claims) {
 }
 /**
 * The sender constraint to enforce. Without a configured `sender`, a token
-* whose `cnf` binds it to a key or a certificate is held to that binding,
-* never accepted as a bearer token (RFC 9449 section 7.1, RFC 8705
-* section 3). An explicit `sender: "none"` is the opt-out for a gateway
-* that verified the binding upstream.
+* whose `cnf` binds it to a key or a certificate is held to that binding, never
+* accepted as a bearer token (RFC 9449 section 7.1, RFC 8705 section 3). An
+* explicit `sender: "none"` is the opt-out for a gateway that verified the
+* binding upstream.
 */
 function senderFor(options, cnf) {
 	if (options.sender !== void 0) return options.sender;
@@ -670,7 +670,10 @@ async function resolveSubject(token, options, request) {
 //#endregion
 //#region src/jwt/subject-token.ts
 const DEFAULT_MAX_LIFETIME = 300;
-/** Causes a verifier for another issuer answers; a different cause names the token's real fault. */
+/**
+* Causes a verifier for another issuer answers; a different cause names the
+* token's real fault.
+*/
 const OTHER_ISSUER = /* @__PURE__ */ new Set(["wrong-issuer", "unknown-kid"]);
 async function firstAccepted(token, options) {
 	const causes = [];
@@ -703,10 +706,10 @@ async function claimOnce(replay, key, expiresAt) {
 }
 /**
 * Verifies a subject token: an RFC 9068 `at+jwt` naming one subject for one
-* request, such as the `PermDock-Subject` header. The first of `verifiers`
-* that accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`,
-* live at most `maxLifetime` seconds, and present its `jti` once. A replay
-* store that throws refuses the token as `replayed`. Never throws.
+* request, such as the `PermDock-Subject` header. The first of `verifiers` that
+* accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`, live at
+* most `maxLifetime` seconds, and present its `jti` once. A replay store that
+* throws refuses the token as `replayed`. Never throws.
 */
 async function verifySubjectToken(token, options) {
 	const verified = await firstAccepted(token, options);

package/dist/{kernel-DVExUwkp.js → kernel-C-fYydV2.js}

@@ -1,19 +1,22 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { i as stepUpOf } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-DZlnEtLy.js";
-import { a as deniedMessage } from "./errors-BKy0EfhN.js";
-import { t as actorMayCallTool } from "./delegation-C5rOdTp5.js";
-import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
-import { k as activate } from "./evaluate-B_oqFbWC.js";
+import { i as stepUpOf } from "./problem-details-CLDgX1KV.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
+import { a as deniedMessage } from "./errors-B6R_lg2a.js";
+import { t as actorMayCallTool } from "./delegation-CDB6_keF.js";
+import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { k as activate } from "./evaluate-Dd8Ta0Ie.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as delegationAllows } from "./where-scope-wq2coopv.js";
-import { l as withApp } from "./permdock-BfWEeMqk.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DY3vXuGs.js";
-import { n as resolveOrNull } from "./build-instance-DxE7czo9.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-BykKLmyE.js";
+import { n as delegationAllows } from "./where-scope-DlCdCM_8.js";
+import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DJicaG6f.js";
+import { n as resolveOrNull } from "./build-instance-CNWaYJyr.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-C25ilqiJ.js";
 //#region src/agent/denied-text.ts
-/** The hook's text, or `event.text` when there is no hook or it throws or returns no string. */
+/**
+* The hook's text, or `event.text` when there is no hook or it throws or
+* returns no string.
+*/
 function refusalText(hook, event, report) {
 	if (hook === void 0) return event.text;
 	try {
@@ -94,11 +97,11 @@ function activationFor(permdock, permission, data) {
 /**
 * The step-up that could lift `decision`, or `undefined`. A denial with
 * `insufficient-user-authentication` asks for a fresh sign-in when the
-* delegation and the actor still cover the permission; any other
-* denial asks for the first eligible role whose activation the simulated
-* decision grants. A matched deny, a validation failure, an anonymous
-* subject, a delegation that does not cover the call, an undelegated tool
-* and a failed approval resume never step up.
+* delegation and the actor still cover the permission; any other denial asks
+* for the first eligible role whose activation the simulated decision grants. A
+* matched deny, a validation failure, an anonymous subject, a delegation that
+* does not cover the call, an undelegated tool and a failed approval resume
+* never step up.
 */
 function stepUpFor(permdock, permission, data, decision) {
 	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => FINAL.has(denial.reason))) return;
@@ -113,9 +116,9 @@ function stepUpFor(permdock, permission, data, decision) {
 	}
 }
 /**
-* The subject's instance with every eligible role activated, for a tool
-* listing that keeps tools an activation would open. `undefined` when the
-* subject is eligible for nothing.
+* The subject's instance with every eligible role activated, for a tool listing
+* that keeps tools an activation would open. `undefined` when the subject is
+* eligible for nothing.
 */
 function eligiblePreview(permdock) {
 	const held = permdock.subject.principal?.memberships ?? [];
@@ -135,7 +138,10 @@ function eligiblePreview(permdock) {
 		return;
 	}
 }
-/** The URL the user signs in again at, with the RFC 9470 `acr_values` and `max_age` added. */
+/**
+* The URL the user signs in again at, with the RFC 9470 `acr_values` and
+* `max_age` added.
+*/
 function signInUrl(at, stepUp) {
 	let url;
 	try {
@@ -160,7 +166,10 @@ function stepUpText(stepUp, permission, at) {
 }
 //#endregion
 //#region src/agent/kernel.ts
-/** The resume token an agent run carries under the namespaced `permdockApproval` key. */
+/**
+* The resume token an agent run carries under the namespaced `permdockApproval`
+* key.
+*/
 function approvalTokenOf(context) {
 	if (context === null || typeof context !== "object") return;
 	const token = context.permdockApproval;

package/dist/kysely/index.d.ts

@@ -1,30 +1,32 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-B-F-qAZk.js";
-import { u as WhereResult } from "../permdock-Dco6dyCK.js";
-import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-COM2VKuN.js";
-import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
+import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
+import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {
-  select(expr: unknown): KyselySelectQuery;
-  where(column: string, op: string, value: unknown): KyselySelectQuery;
-  where(expression: unknown): KyselySelectQuery;
-  whereRef(left: string, op: string, right: string): KyselySelectQuery;
+  select: (expr: unknown) => KyselySelectQuery;
+  where: {
+    (column: string, op: string, value: unknown): KyselySelectQuery;
+    (expression: unknown): KyselySelectQuery;
+  };
+  whereRef: (left: string, op: string, right: string) => KyselySelectQuery;
 };
 type KyselyExpressionBuilder = {
   (left: unknown, op: string, right: unknown): unknown;
-  and(args: readonly unknown[]): unknown;
-  or(args: readonly unknown[]): unknown;
-  not(value: unknown): unknown;
-  lit(value: unknown): unknown;
-  val(value: unknown): unknown;
-  ref(column: string): unknown;
-  exists?(query: unknown): unknown;
-  selectFrom?(table: string): KyselySelectQuery;
+  and: (args: readonly unknown[]) => unknown;
+  or: (args: readonly unknown[]) => unknown;
+  not: (value: unknown) => unknown;
+  lit: (value: unknown) => unknown;
+  val: (value: unknown) => unknown;
+  ref: (column: string) => unknown;
+  exists?: (query: unknown) => unknown;
+  selectFrom?: (table: string) => KyselySelectQuery;
 };
 /** Kysely's `sql` tag; `import { sql } from 'kysely'`. */
 type KyselySql = {
   (strings: TemplateStringsArray, ...values: unknown[]): unknown;
-  ref(reference: string): unknown;
+  ref: (reference: string) => unknown;
 };
 type KyselyWhereOptions = {
   readonly columns?: Readonly<Record<string, string>>;
@@ -32,38 +34,51 @@ type KyselyWhereOptions = {
   readonly listFields?: readonly string[];
   readonly subject?: Subject;
   readonly memberships?: MembershipsMapping;
-  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  /**
+   * Where the relation graph lives; graph grants compile to Postgres subqueries
+   * with it and are refused without.
+   */
   readonly relations?: RelationsMapping;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
-  /** Kysely's `sql` tag, for graph subqueries on runtimes without `require`; loaded from the `kysely` peer by default. */
+  /**
+   * Kysely's `sql` tag, for graph subqueries on runtimes without `require`;
+   * loaded from the `kysely` peer by default.
+   */
   readonly sql?: KyselySql;
 };
 type KyselyWithSubjectOptions = WithSubjectOptions & {
-  /** Kysely's `sql` tag, on runtimes without `require`; loaded from the `kysely` peer by default. */
+  /**
+   * Kysely's `sql` tag, on runtimes without `require`; loaded from the `kysely`
+   * peer by default.
+   */
   readonly sql?: KyselySql;
 };
 //#endregion
 //#region src/kysely/to-where.d.ts
 export declare function toWhere(input: Condition | WhereResult, table: string, options?: KyselyWhereOptions): (eb: KyselyExpressionBuilder) => unknown;
 type KyselyLike<Trx> = {
-  transaction(): {
-    execute<T>(fn: (trx: Trx) => Promise<T>): Promise<T>;
+  transaction: () => {
+    execute: <T>(fn: (trx: Trx) => Promise<T>) => Promise<T>;
   };
 };
 /**
- * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
- * RLS policies decide for the same subject as the in-process checks.
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+ * the generated RLS policies decide for the same subject as the in-process
+ * checks.
  */
 export declare function withSubject<Trx, T>(db: KyselyLike<Trx>, permdock: {
   readonly subject: Subject;
 }, fn: (trx: Trx) => Promise<T>, options?: KyselyWithSubjectOptions): Promise<T>;
 type KyselySelectable = {
-  selectFrom(table: never): {
-    select(selection: (eb: never) => unknown): {
-      where(where: never): {
-        limit(count: number): {
-          execute(): Promise<readonly {
+  selectFrom: (table: never) => {
+    select: (selection: (eb: never) => unknown) => {
+      where: (where: never) => {
+        limit: (count: number) => {
+          execute: () => Promise<readonly {
             readonly granted?: unknown;
           }[]>;
         };
@@ -72,8 +87,9 @@ type KyselySelectable = {
   };
 };
 /**
- * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
- * permission filter keeps the row. Throws when `key` matches more than one row.
+ * One query for one row: `{ found: false }` when `key` matches nothing,
+ * otherwise whether the permission filter keeps the row. Throws when `key`
+ * matches more than one row.
  */
 export declare function checkRow(db: KyselySelectable, table: string, input: Condition | WhereResult, key: (eb: KyselyExpressionBuilder) => unknown, options?: KyselyWhereOptions): Promise<RowCheck>;
 //#endregion

package/dist/kysely/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as escapeLike, t as compileWhere } from "../compile-BAEO5bOk.js";
-import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
+import { t as assertSafeKey } from "../paths-CUvURzHp.js";
+import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/kysely/to-where.ts
 function ident(name) {
 	assertSafeKey(name, "sql identifier");
@@ -96,8 +96,9 @@ function toWhere(input, table, options = {}) {
 	return (eb) => render(eb, compiled, table, options);
 }
 /**
-* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
-* RLS policies decide for the same subject as the in-process checks.
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+* the generated RLS policies decide for the same subject as the in-process
+* checks.
 */
 function withSubject(db, permdock, fn, options = {}) {
 	const statements = subjectStatements(permdock, options);
@@ -108,8 +109,9 @@ function withSubject(db, permdock, fn, options = {}) {
 	});
 }
 /**
-* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
-* permission filter keeps the row. Throws when `key` matches more than one row.
+* One query for one row: `{ found: false }` when `key` matches nothing,
+* otherwise whether the permission filter keeps the row. Throws when `key`
+* matches more than one row.
 */
 async function checkRow(db, table, input, key, options = {}) {
 	const sql = loadSql(options.sql);

package/dist/{live-options-BaAFCIiu.js → live-options-BBIT68le.js}

@@ -7,8 +7,8 @@ const PermDockSnapshotPromiseContext = createContext(null);
 //#region src/react/keyed.ts
 /**
 * `create()` once per distinct `inputs`, held in state: React may drop a
-* `useMemo` value and rebuild it, and a rebuilt store loses its answers,
-* polls and followed snapshot.
+* `useMemo` value and rebuild it, and a rebuilt store loses its answers, polls
+* and followed snapshot.
 */
 function useKeyed(create, inputs) {
 	const [held, setHeld] = useState(() => ({

package/dist/{load-DxroEzH1.js → load-DjSU5KXO.js}

@@ -1,5 +1,5 @@
-import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
-import { a as describeError, n as CliError } from "./errors-DpP_U6Bf.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
@@ -38,10 +38,10 @@ function importWithJiti(abs, fresh) {
 }
 /**
 * Imports a project module the way its bundler would. Node's own `import()`
-* comes first; a module it cannot resolve or parse (tsconfig `paths`
-* aliases, extensionless relative imports, `enum`, TSX) loads through jiti
-* with the `paths` of the nearest `tsconfig.json` above it. Exports are
-* returned as written; `default` is not merged into the namespace.
+* comes first; a module it cannot resolve or parse (tsconfig `paths` aliases,
+* extensionless relative imports, `enum`, TSX) loads through jiti with the
+* `paths` of the nearest `tsconfig.json` above it. Exports are returned as
+* written; `default` is not merged into the namespace.
 */
 async function loadModule(abs, options) {
 	try {

package/dist/load-Dm0pSYH3.js

@@ -0,0 +1 @@
+export { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";

package/dist/{login-ClSJh5t5.js → login-D-8tMqzo.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-aaeRAdiD.js";
+import { c as given } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/login.ts
 const urlFlag = { url: {
 	type: "string",
@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-WC9HPJpU.js");
+		const { runLogin } = await import("./login-DplQ0s84.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-WC9HPJpU.js");
+		const { runLogout } = await import("./login-DplQ0s84.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-WC9HPJpU.js");
+		const { runWhoami } = await import("./login-DplQ0s84.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{login-WC9HPJpU.js → login-DplQ0s84.js}

@@ -1,10 +1,11 @@
-import { h as secondsAt, i as dateAt, s as instantAt } from "./time-DkWjdL98.js";
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BARQ8eYG.js";
+import { h as secondsAt, i as dateAt, s as instantAt } from "./time-nR1JesoH.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
-import { n as randomToken, t as pkce } from "./pkce-5h8NgMQJ.js";
-import { n as httpRequest } from "./http-Ca3Sr5x1.js";
-import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-CscUX8Sy.js";
+import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { n as httpRequest } from "./http-DOL33cO0.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 //#region src/cli/cloud/loopback.ts
@@ -90,7 +91,10 @@ async function runLoopbackFlow(options, runtime) {
 }
 //#endregion
 //#region src/cli/cloud/login.ts
-/** Opens `url` in the default browser; a failure leaves the printed URL to the user. */
+/**
+* Opens `url` in the default browser; a failure leaves the printed URL to the
+* user.
+*/
 function openBrowser(url) {
 	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
 		"/c",
@@ -172,7 +176,10 @@ async function runLogin(input) {
 		}) : `logged in to ${issuer} (${granted.scope ?? scope}); credentials in ${where}`
 	};
 }
-/** Revokes the stored login (RFC 7009) and deletes it; a revocation failure still deletes it. */
+/**
+* Revokes the stored login (RFC 7009) and deletes it; a revocation failure
+* still deletes it.
+*/
 async function runLogout(input) {
 	const issuer = cloudUrl(input.url, input.env);
 	const runtime = cliRuntime(input.io, input.env);
@@ -242,7 +249,7 @@ async function runWhoami(input) {
 	};
 	return {
 		code: 0,
-		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${scopes.join(" ") || "no scopes"})${expired ? "; the login has expired, run permdock login" : ""}`,
+		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${nonEmptyOr(scopes.join(" "), "no scopes")})${expired ? "; the login has expired, run permdock login" : ""}`,
 		data
 	};
 }