permdock 0.3.1 → 0.5.0

package/dist/casbin-Dyu2gnUD.js

@@ -0,0 +1,234 @@
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/importers/casbin.ts
+const MATCHER_TERMS = /* @__PURE__ */ new Set([
+	"g(r.sub,p.sub)",
+	"g(r.sub,p.sub,r.dom)",
+	"r.obj==p.obj",
+	"r.act==p.act",
+	"r.dom==p.dom"
+]);
+function sections(text) {
+	const found = /* @__PURE__ */ new Map();
+	let current;
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (line === "" || line.startsWith("#")) continue;
+		const header = /^\[(\w+)\]$/u.exec(line)?.[1];
+		if (header !== void 0) {
+			current = /* @__PURE__ */ new Map();
+			found.set(header, current);
+			continue;
+		}
+		const at = line.indexOf("=");
+		if (current !== void 0 && at > 0) current.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
+	}
+	return found;
+}
+function fieldsOf(value) {
+	return (value ?? "").split(",").map((item) => item.trim());
+}
+/**
+* The model, when it is RBAC (optionally with domains) under the standard
+* matcher; otherwise the terms that are not. Deny rows need `p.eft` and an
+* effect that lets a deny override an allow, as PermDock always does.
+*/
+function readCasbinModel(text) {
+	const model = sections(text);
+	const request = fieldsOf(model.get("request_definition")?.get("r"));
+	const policy = fieldsOf(model.get("policy_definition")?.get("p"));
+	const domains = request.includes("dom");
+	const expected = domains ? [
+		"sub",
+		"dom",
+		"obj",
+		"act"
+	] : [
+		"sub",
+		"obj",
+		"act"
+	];
+	if (request.join(",") !== expected.join(",")) return { refused: `r = ${request.join(", ")}: casbin import reads r = ${expected.join(", ")}` };
+	const withEffect = policy.length === expected.length + 1 && policy.at(-1) === "eft";
+	if (policy.slice(0, expected.length).join(",") !== expected.join(",") || policy.length !== expected.length && !withEffect) return { refused: `p = ${policy.join(", ")}: casbin import reads p = ${expected.join(", ")}[, eft]` };
+	const terms = (model.get("matchers")?.get("m") ?? "").replaceAll(/\s+/gu, "").split("&&").filter((term) => term !== "");
+	const unsupported = terms.filter((term) => !MATCHER_TERMS.has(term));
+	if (terms.length === 0 || unsupported.length > 0) return { refused: `the matcher has terms casbin import cannot read: ${unsupported.join(" && ") || "(empty)"}; it reads g(r.sub, p.sub[, r.dom]), r.dom == p.dom, r.obj == p.obj and r.act == p.act` };
+	const effect = (model.get("policy_effect")?.get("e") ?? "").replaceAll(/\s+/gu, "");
+	const allowOnly = effect === "some(where(p.eft==allow))";
+	const denyOverrides = effect === "some(where(p.eft==allow))&&!some(where(p.eft==deny))";
+	if (!allowOnly && !denyOverrides) return { refused: `e = ${effect}: casbin import reads allow-only or deny-override effects; PermDock's deny always overrides an allow` };
+	return {
+		domains,
+		roles: model.get("role_definition")?.get("g") !== void 0,
+		denies: withEffect && denyOverrides
+	};
+}
+function policyLines(text) {
+	const lines = [];
+	for (const [index, raw] of text.split("\n").entries()) {
+		const line = raw.trim();
+		if (line !== "" && !line.startsWith("#")) lines.push({
+			number: index + 1,
+			text: line,
+			cells: line.split(",").map((cell) => cell.trim())
+		});
+	}
+	return lines;
+}
+/** Every grant `role` holds through `g` role-to-role lines, its own included; a cycle stops. */
+function inherited(role, own, parents) {
+	const seen = /* @__PURE__ */ new Set();
+	const grants = [];
+	const visit = (name) => {
+		if (seen.has(name)) return;
+		seen.add(name);
+		grants.push(...own.get(name) ?? []);
+		for (const parent of parents.get(name) ?? []) visit(parent);
+	};
+	visit(role);
+	return grants;
+}
+/**
+* Casbin RBAC policy lines as PermDock roles. A `p` line whose subject is a
+* role becomes a grant; a role that inherits another (`g, editor, viewer`)
+* holds its grants too, flattened, because code roles do not nest. A `g` line
+* for a user becomes an assignment the application loads as a membership.
+*/
+function importCasbin(model, policy) {
+	const lines = policyLines(policy);
+	const skipped = [];
+	const width = model.domains ? 4 : 3;
+	const roleNames = /* @__PURE__ */ new Set();
+	for (const line of lines) if (line.cells[0] === "g" && line.cells[2] !== void 0) roleNames.add(line.cells[2]);
+	const parents = /* @__PURE__ */ new Map();
+	const assignments = [];
+	for (const line of lines.filter((item) => item.cells[0] === "g")) {
+		const [, member, role, domain] = line.cells;
+		if (member === void 0 || role === void 0) {
+			skipped.push({
+				line: line.number,
+				text: line.text,
+				reason: "malformed",
+				detail: "a g line names a member and a role"
+			});
+			continue;
+		}
+		if (roleNames.has(member)) parents.set(member, [...parents.get(member) ?? [], role]);
+		else assignments.push({
+			user: member,
+			role,
+			...domain === void 0 || domain === "" ? {} : { domain }
+		});
+	}
+	const own = /* @__PURE__ */ new Map();
+	const actions = /* @__PURE__ */ new Map();
+	for (const line of lines.filter((item) => item.cells[0] === "p")) {
+		const cells = line.cells.slice(1);
+		const subject = cells[0] ?? "";
+		const domain = model.domains ? cells[1] : void 0;
+		const [object, action] = cells.slice(model.domains ? 2 : 1);
+		const eft = cells[width];
+		const skip = (reason, detail) => {
+			skipped.push({
+				line: line.number,
+				text: line.text,
+				reason,
+				detail,
+				...eft === "deny" ? { deny: true } : {}
+			});
+		};
+		if (object === void 0 || action === void 0) {
+			skip("malformed", `a p line has ${String(width)} fields`);
+			continue;
+		}
+		if (!roleNames.has(subject)) {
+			skip("user-grant", `${subject} is not a role any g line names; PermDock grants roles, never users`);
+			continue;
+		}
+		if (domain !== void 0 && domain !== "*") {
+			skip("domain-grant", `the grant holds only in domain ${domain}; a per-tenant grant is a custom role (CustomRoleSource)`);
+			continue;
+		}
+		if (eft === "deny" && !model.denies) {
+			skip("deny-without-effect", "the model's effect never applies a deny");
+			continue;
+		}
+		if (!isIdentifier(object) || !isIdentifier(action)) {
+			skip("not-an-identifier", `${object}.${action} is not a permission key; patterns and paths do not import`);
+			continue;
+		}
+		const set = actions.get(object) ?? /* @__PURE__ */ new Set();
+		actions.set(object, set);
+		set.add(action);
+		own.set(subject, [...own.get(subject) ?? [], {
+			effect: eft === "deny" ? "deny" : "allow",
+			resource: object,
+			action
+		}]);
+	}
+	return {
+		actions,
+		roles: [...roleNames].map((name) => ({
+			name,
+			grants: inherited(name, own, parents)
+		})),
+		assignments,
+		skipped
+	};
+}
+function readText(cwd, flag, path) {
+	if (path === void 0) return { error: `casbin import needs ${flag} <file>` };
+	const full = resolve(cwd, path);
+	return existsSync(full) ? readFileSync(full, "utf8") : { error: `casbin import ${flag}: ${path} does not exist` };
+}
+/**
+* `permdock casbin import`: an RBAC model and its policy CSV into a
+* `permissions` and `policy` module, with user assignments as data. Exits 1
+* when a deny line did not import, because leaving one out would widen access.
+*/
+function runCasbinImport(input) {
+	if (input.out === void 0) return {
+		code: 2,
+		output: "casbin import needs --out <file>"
+	};
+	const modelText = readText(input.cwd, "--model", input.model);
+	const policyText = readText(input.cwd, "--policy", input.policy);
+	for (const read of [modelText, policyText]) if (typeof read !== "string") return {
+		code: 2,
+		output: read.error
+	};
+	const model = readCasbinModel(String(modelText));
+	if ("refused" in model) return {
+		code: 2,
+		output: `casbin import --model: ${model.refused}`
+	};
+	const imported = importCasbin(model, String(policyText));
+	applyFiles(input.cwd, [{
+		path: input.out,
+		text: emitPolicyModule({
+			generator: "casbin import",
+			actions: imported.actions,
+			roles: imported.roles,
+			exports: { assignments: imported.assignments }
+		})
+	}]);
+	const droppedDeny = imported.skipped.some((item) => item.deny === true);
+	const code = droppedDeny ? 1 : 0;
+	if (input.json) return {
+		code,
+		output: JSON.stringify({
+			out: input.out,
+			assignments: imported.assignments.length,
+			skipped: imported.skipped
+		})
+	};
+	return {
+		code,
+		output: [...imported.skipped.map((item) => `${item.reason}: line ${String(item.line)} (${item.text}): ${item.detail}`), `casbin import: wrote ${String(imported.roles.length)} role(s) and ${String(imported.assignments.length)} assignment(s) to ${input.out}, skipped ${String(imported.skipped.length)}${droppedDeny ? "; a deny line did not import, so the policy allows more than the model: map it by hand" : ""}`].join("\n")
+	};
+}
+//#endregion
+export { runCasbinImport };

package/dist/casl-64gpT-8x.js

@@ -0,0 +1,24 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/casl.ts
+const caslImport = defineLeaf({
+	flags: {
+		rules: {
+			type: "string",
+			description: "JSON of { [role]: rules }, each role's ability.rules or packRules output",
+			valueHint: "file"
+		},
+		...outFlag
+	},
+	async run(ctx, { flags }) {
+		const { runCaslImport } = await import("./casl-DjEDhTCP.js");
+		return runCaslImport({
+			cwd: ctx.cwd,
+			rules: given(flags.rules),
+			out: fileOut("casl import", flags.out),
+			json: ctx.json
+		});
+	}
+});
+//#endregion
+export { caslImport };

package/dist/casl-DjEDhTCP.js

@@ -0,0 +1,299 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/importers/casl.ts
+const CRUD = [
+	"create",
+	"read",
+	"update",
+	"delete"
+];
+const OPERATORS = {
+	$eq: "eq",
+	$ne: "ne",
+	$gt: "gt",
+	$gte: "gte",
+	$lt: "lt",
+	$lte: "lte",
+	$in: "in",
+	$nin: "notIn"
+};
+const PRINCIPAL_TEMPLATE = /^\$\{user\.([A-Za-z_$][A-Za-z0-9_$]*)\}$/u;
+function list(value) {
+	if (value === void 0) return [];
+	return typeof value === "string" ? [value] : value;
+}
+function isStrings(value) {
+	return typeof value === "string" || Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+/** `packRules` joins a list into one comma-separated string. */
+function split(item) {
+	return typeof item === "string" && item.includes(",") ? item.split(",") : item;
+}
+/** A rule in either shape: the object form, or `packRules`' `[action, subject, conditions, inverted, fields]`. */
+function readRule(value) {
+	if (Array.isArray(value)) {
+		const [action, subject, conditions, inverted, fields] = value;
+		return readRule({
+			action: split(action),
+			subject: split(subject),
+			...isRecord(conditions) ? { conditions } : {},
+			...inverted === 1 || inverted === true ? { inverted: true } : {},
+			...fields === void 0 || fields === 0 ? {} : { fields: split(fields) }
+		});
+	}
+	if (!isRecord(value) || !isStrings(value["action"])) return;
+	const { subject, fields, conditions, inverted } = value;
+	if (subject !== void 0 && !isStrings(subject) || fields !== void 0 && !isStrings(fields) || conditions !== void 0 && !isRecord(conditions) || inverted !== void 0 && typeof inverted !== "boolean") return;
+	return {
+		action: value["action"],
+		...subject === void 0 ? {} : { subject },
+		...fields === void 0 ? {} : { fields },
+		...conditions === void 0 ? {} : { conditions },
+		...inverted === true ? { inverted: true } : {}
+	};
+}
+/** A CASL subject type as a resource key: `BlogPost` becomes `blogPost`. */
+function resourceKey(subject) {
+	return `${subject.slice(0, 1).toLowerCase()}${subject.slice(1)}`;
+}
+function isUnsupported(read) {
+	return "unsupported" in read;
+}
+function readValue(value) {
+	if (typeof value === "string") {
+		const principal = PRINCIPAL_TEMPLATE.exec(value)?.[1];
+		return { value: principal === void 0 ? value : { principal } };
+	}
+	if (value === null || typeof value === "number" || typeof value === "boolean") return { value };
+	if (Array.isArray(value)) {
+		const items = [];
+		for (const item of value) {
+			const read = readValue(item);
+			if (isUnsupported(read)) return read;
+			items.push(read.value);
+		}
+		return { value: items };
+	}
+	return { unsupported: "a nested object value" };
+}
+/** The Mongo-query subset CASL conditions use, as a `where`; anything else is reported by name. */
+function readConditions(conditions) {
+	const parts = [];
+	for (const [key, value] of Object.entries(conditions)) {
+		if (key === "$and" || key === "$or" || key === "$nor") {
+			if (!Array.isArray(value)) return { unsupported: `${key} without a list` };
+			const items = [];
+			for (const item of value) {
+				const read = isRecord(item) ? readConditions(item) : { unsupported: `${key} item` };
+				if (isUnsupported(read)) return read;
+				items.push(read);
+			}
+			parts.push(key === "$and" ? { and: items } : key === "$or" ? { or: items } : { not: { or: items } });
+			continue;
+		}
+		if (key.startsWith("$")) return { unsupported: key };
+		if (key.includes(".")) return { unsupported: `the nested field ${key}` };
+		const read = readField(key, value);
+		if (isUnsupported(read)) return read;
+		parts.push(read);
+	}
+	return parts.length === 1 && parts[0] !== void 0 ? parts[0] : { and: parts };
+}
+function readField(field, value) {
+	if (!isRecord(value)) {
+		const read = readValue(value);
+		return isUnsupported(read) ? read : {
+			field,
+			op: "eq",
+			value: read.value
+		};
+	}
+	const parts = [];
+	for (const [operator, operand] of Object.entries(value)) {
+		if (operator === "$exists") {
+			parts.push({
+				field,
+				op: "isNull",
+				value: operand !== true
+			});
+			continue;
+		}
+		const op = OPERATORS[operator];
+		if (op === void 0) return { unsupported: operator };
+		const read = readValue(operand);
+		if (isUnsupported(read)) return read;
+		parts.push({
+			field,
+			op,
+			value: read.value
+		});
+	}
+	return parts.length === 1 && parts[0] !== void 0 ? parts[0] : { and: parts };
+}
+/** The subjects and the actions each is named with, `all` and `manage` aside. */
+function collectActions(rule, subjects, actionsBySubject) {
+	for (const subject of list(rule.subject).filter((item) => item !== "all")) {
+		subjects.add(subject);
+		const actions = actionsBySubject.get(subject) ?? /* @__PURE__ */ new Set();
+		actionsBySubject.set(subject, actions);
+		for (const action of list(rule.action)) if (action !== "manage") actions.add(action);
+	}
+}
+/**
+* CASL rules per role, as PermDock roles: `inverted` rules are denies,
+* `manage` and `all` expand to every action and subject the rules name, and
+* conditions in the portable Mongo-query subset become `where`. A deny whose
+* condition does not import keeps its effect without the condition, so the
+* import can only deny more, never less.
+*/
+function importCasl(rulesByRole) {
+	const parsed = [];
+	const skipped = [];
+	const subjects = /* @__PURE__ */ new Set();
+	const actionsBySubject = /* @__PURE__ */ new Map();
+	for (const [role, rules] of Object.entries(rulesByRole)) for (const [index, raw] of rules.entries()) {
+		const rule = readRule(raw);
+		if (rule === void 0) {
+			skipped.push({
+				role,
+				rule: index,
+				reason: "not-a-rule",
+				detail: "not a CASL raw rule"
+			});
+			continue;
+		}
+		parsed.push({
+			role,
+			index,
+			rule
+		});
+		collectActions(rule, subjects, actionsBySubject);
+	}
+	const actionsOf = (subject) => {
+		const named = [...actionsBySubject.get(subject) ?? []].filter(isIdentifier);
+		return named.length === 0 ? CRUD : named;
+	};
+	const resources = /* @__PURE__ */ new Map();
+	const roles = /* @__PURE__ */ new Map();
+	for (const { role, index, rule } of parsed) {
+		const grants = roles.get(role) ?? [];
+		roles.set(role, grants);
+		const named = list(rule.subject);
+		if (named.length === 0) {
+			skipped.push({
+				role,
+				rule: index,
+				reason: "no-subject",
+				detail: "a claim-only rule (no subject) has no resource to grant on"
+			});
+			continue;
+		}
+		const effect = rule.inverted === true ? "deny" : "allow";
+		let where;
+		if (rule.conditions !== void 0) {
+			const read = readConditions(rule.conditions);
+			if (isUnsupported(read)) {
+				if (effect === "allow") {
+					skipped.push({
+						role,
+						rule: index,
+						reason: "unsupported-condition",
+						detail: `${read.unsupported} has no portable condition; the allow is left out`
+					});
+					continue;
+				}
+				skipped.push({
+					role,
+					rule: index,
+					reason: "deny-widened",
+					detail: `${read.unsupported} has no portable condition; the deny applies without it`
+				});
+			} else where = read;
+		}
+		const fields = list(rule.fields);
+		const expanded = named.includes("all") ? [.../* @__PURE__ */ new Set([...named.filter((item) => item !== "all"), ...subjects])] : named;
+		for (const subject of expanded) {
+			const key = resourceKey(subject);
+			for (const action of list(rule.action).flatMap((item) => item === "manage" ? actionsOf(subject) : [item])) {
+				if (!isIdentifier(key) || !isIdentifier(action)) {
+					skipped.push({
+						role,
+						rule: index,
+						reason: "not-an-identifier",
+						detail: `${subject}.${action} is not a permission key`
+					});
+					continue;
+				}
+				const actions = resources.get(key) ?? /* @__PURE__ */ new Set();
+				resources.set(key, actions);
+				actions.add(action);
+				grants.push({
+					effect,
+					resource: key,
+					action,
+					...where === void 0 ? {} : { where },
+					...fields.length === 0 ? {} : { fields }
+				});
+			}
+		}
+	}
+	return {
+		actions: resources,
+		roles: [...roles.entries()].map(([name, grants]) => ({
+			name,
+			grants
+		})),
+		skipped
+	};
+}
+/** `permdock casl import`: CASL rules per role into a `permissions` and `policy` module. */
+function runCaslImport(input) {
+	if (input.rules === void 0 || input.out === void 0) return {
+		code: 2,
+		output: "casl import needs --rules <file> and --out <file>"
+	};
+	const path = resolve(input.cwd, input.rules);
+	if (!existsSync(path)) return {
+		code: 2,
+		output: `casl import --rules: ${input.rules} does not exist`
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {
+			code: 2,
+			output: `casl import --rules: ${input.rules} is not JSON`
+		};
+	}
+	if (!isRecord(parsed) || !Object.values(parsed).every((rules) => Array.isArray(rules))) return {
+		code: 2,
+		output: "casl import --rules: expected { [role]: rules }, each role's ability.rules or packRules output"
+	};
+	const imported = importCasl(parsed);
+	applyFiles(input.cwd, [{
+		path: input.out,
+		text: emitPolicyModule({
+			generator: "casl import",
+			actions: imported.actions,
+			roles: imported.roles
+		})
+	}]);
+	if (input.json) return {
+		code: 0,
+		output: JSON.stringify({
+			out: input.out,
+			skipped: imported.skipped
+		})
+	};
+	const grants = imported.roles.reduce((total, role) => total + role.grants.length, 0);
+	return {
+		code: 0,
+		output: [...imported.skipped.map((item) => `${item.reason}: role ${item.role}, rule ${String(item.rule)}: ${item.detail}`), `casl import: wrote ${String(imported.roles.length)} role(s) with ${String(grants)} grant(s) to ${input.out}, skipped ${String(imported.skipped.filter((item) => item.reason !== "deny-widened").length)}`].join("\n")
+	};
+}
+//#endregion
+export { runCaslImport };

package/dist/catalog/index.d.ts

@@ -1,4 +1,56 @@
-import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
+import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { a as PolicyDocument } from "../hosted-DBDX0M-P.js";
+import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-CZTnPFzM.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-Bj_lDUDq.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BImMTTIM.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/catalog/drift.d.ts
+/**
+ * The hosted grants of `document` that `policy` no longer accepts, as drift
+ * findings with the grant id set. A grant dropped for a reason the catalog
+ * cannot cause (`non-portable`, `invalid`) is not a finding.
+ */
+export declare function hostedGrantFindings(policy: Policy, document: PolicyDocument | null): readonly CatalogFinding[];
+type CatalogDriftInput = {
+  readonly previous: CatalogDocument;
+  readonly next: CatalogDocument;
+  /** The policy rebuilt from `next` (`policyFromCatalog`), which live hosted grants must still pass. */
+  readonly policy: Policy;
+  /** The live hosted grants; absent or `null` when the environment has none. */
+  readonly document?: PolicyDocument | null;
+};
+/**
+ * The `data` of a `com.permdock.catalog.drifted` event: the hosted grants
+ * `next` breaks, then the operations whose risk rose or whose approval was
+ * removed between `previous` and `next`.
+ */
+export declare function catalogDrift(input: CatalogDriftInput): CatalogEventData;
+//#endregion
+//#region src/catalog/json-schema-validator.d.ts
+/**
+ * A Standard Schema that validates against a catalog resource's JSON Schema.
+ * `null` (no JSON Schema in the catalog) gives `undefined`. A schema that uses
+ * a keyword outside the supported subset rejects every value, so a hosted
+ * check never validates less than the code did.
+ */
+export declare function resourceSchemaFromJson(json: unknown): StandardSchemaV1 | undefined;
+//#endregion
+//#region src/catalog/operation-findings.d.ts
+/** What `operationFindings` reads of a catalog: a `CatalogDocument` fits. */
+type OperationCatalog = {
+  readonly permissions: readonly {
+    readonly key: string;
+    readonly approvals?: readonly unknown[];
+  }[];
+  readonly operations?: readonly CatalogOperation[];
+};
+/**
+ * Operations, matched by name, whose `meta.risk` rose or whose permission
+ * stopped requiring approval between two catalogs. A new or removed
+ * operation is not a finding.
+ */
+export declare function operationFindings(previous: OperationCatalog, next: OperationCatalog): readonly CatalogFinding[];
+//#endregion
 //#region src/catalog/parse.d.ts
 /**
  * Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
@@ -9,4 +61,24 @@ export declare function parseCatalog(json: unknown): CatalogDocument;
 /** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
 export declare function rowConditionKeys(catalog: CatalogDocument): ReadonlySet<string>;
 //#endregion
-export type { CatalogActivation, CatalogApproval, CatalogBreakGlass, CatalogDelegation, CatalogDocument, CatalogGrant, CatalogPermission, CatalogResource, CatalogRole, CatalogScope, CatalogSupportAccess, CatalogUsage, CatalogValidity };
+//#region src/catalog/policy-from-catalog.d.ts
+type PolicyFromCatalogOptions<TUser = unknown> = {
+  /** Maps the request's user to the subject; the identity function when absent. */
+  readonly subject?: (user: TUser) => Principal | null;
+};
+/**
+ * Rebuilds an evaluable `Policy` from a catalog (`permissions.catalog.json`)
+ * and the policy `permdock cloud push` sent with it, for a service that holds
+ * no application code: the hosted AuthZEN endpoint or a `mergeHostedGrants`
+ * pre-check. Throws `PermDockValidationError` when either input is malformed
+ * or the two disagree.
+ *
+ * What only code can answer fails closed: an allow whose condition is a
+ * closure never grants and such a deny always applies; a resource schema
+ * keyword outside the supported JSON Schema subset rejects every value; a
+ * support role has no one who may consent. Grant levels and OAuth scopes
+ * are not in a catalog, so the rebuilt policy has none.
+ */
+export declare function policyFromCatalog<TUser = unknown>(catalogInput: unknown, pushedInput: unknown, options?: PolicyFromCatalogOptions<TUser>): Policy<TUser>;
+//#endregion
+export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogDelegation, type CatalogDocument, type CatalogDriftInput, type CatalogGrant, type CatalogOAuthScope, type CatalogOperation, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CatalogValidity, PUSHED_POLICY_SCHEMA, type PolicyFromCatalogOptions, type PushedGrant, type PushedPolicy, parsePushedPolicy, pushedPolicy };