permdock 0.3.1 → 0.5.0

package/skills/permdock-wire/references/presets-and-recipes.md

@@ -0,0 +1,58 @@
+# Presets and recipes
+
+## Presets
+
+A preset is an archetype plus the features, auth, backend, framework, integrations and Cloud services an app needs, encoded as a code that starts with `p1` ([presets](https://permdock.com/docs/concepts/presets)). The user builds one at [permdock.com/create](https://permdock.com/create), or you pass flags.
+
+```bash
+npx permdock init --preset <code> --dry-run
+npx permdock init --archetype b2b --framework hono --auth clerk --backend drizzle --feature approvals --dry-run
+npx permdock preset decode <code>
+```
+
+| Flag            | Values                                                                                                                  |
+| --------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `--archetype`   | `b2b`, `agent`, `marketplace`, `api`, `internal`, `consumer`                                                            |
+| `--framework`   | `next`, `hono`, `express`, `none`                                                                                       |
+| `--auth`        | `custom`, `supabase`, `better-auth`, `clerk`, `jwt`                                                                     |
+| `--backend`     | `memory`, `supabase`, `drizzle`, `prisma`                                                                               |
+| `--feature`     | `tenancy`, `custom-roles`, `approvals`, `operations`, `decision-log`, `limits`, `plans`, `ownership`, `api-keys`, `rls` |
+| `--integration` | `ai-sdk`, `mcp`, `shadcn`, `react-native`                                                                               |
+| `--service`     | `cloud-decision-log`, `cloud-approvals`, `cloud-snapshots`, `cloud-hosted-grants`                                       |
+
+`permdock preset decode <code>` ends with the `init` flags that select the same preset.
+
+`init` keeps every file that exists unless `--force` is passed, installs nothing and calls no network. It prints the `npm install` line, the `npx shadcn add` line for the recipes and the docs pages to read. Run what it prints, then `permdock doctor`.
+
+What `init` writes is the app's own code: `src/permissions.ts`, `src/policy.ts`, `src/permdock.ts` (`defineApp` with a `profile` from `NODE_ENV`), `src/session.ts`, `src/data.ts`, the framework file and `permdock.config.ts` ([what each choice writes](https://permdock.com/docs/cli/init#generated-files)). With `--auth custom` the session returns `null` until it is wired, so every check denies; a provider's session calls its `subjectFrom*`. With `--backend memory` the loaders return demo rows: replace them, and do not add rules to them.
+
+### Who owns what
+
+- The `permdock` package owns every rule: evaluation, role ceilings, approval binding, limits, token checks. `npm update` reaches it.
+- The app owns declarations (`definePermissions`, `definePolicy` data, `defineApp` options) and presentation (recipes).
+- Never copy evaluation logic out of the package into the app, and never change a recipe so it decides on its own; it renders what `useGate` returns.
+
+`profile: "prod"` throws at startup when a store or limits a feature needs are missing ([apps and profiles](https://permdock.com/docs/concepts/apps)). Do not switch the profile to silence it; pass the store.
+
+## Recipes
+
+The `@permdock` shadcn registry holds UI built from the app's own components on `useGate` ([recipes](https://permdock.com/docs/concepts/recipes)). PermDock ships no visible component besides `<Protected>`.
+
+```bash
+npx shadcn@latest add https://permdock.com/r/gated-button.json
+npx shadcn@latest add https://permdock.com/r/preset-<code>.json
+```
+
+| Recipe                                         | Use                                                                     |
+| ---------------------------------------------- | ----------------------------------------------------------------------- |
+| `gated-button`                                 | A button that is hidden, disabled with the reason, or asks for approval |
+| `approval-request-dialog`                      | A note and a request for an `approval-required` action                  |
+| `tenant-switcher`                              | The tenants the user is a member of                                     |
+| `role-picker`                                  | Only the roles the user may hand out                                    |
+| `custom-role-editor`                           | Only the permissions the editor holds                                   |
+| `upgrade-prompt`                               | The plans that would grant the action                                   |
+| `gated-button-native`, `upgrade-prompt-native` | The same on React Native Reusables                                      |
+
+Each recipe needs `PermDockProvider` from `permdock/react` or `permdock/react-native`. A recipe hides or disables a control; the server checks the action again, so the guard from the Guard step stays.
+
+✓ The recipe renders `useGate`'s `hidden`, `disabled`, `needsApproval` and `reason`, and the server action it calls asserts the same permission.

package/dist/approvals-DbYAuNkG.js

@@ -1,224 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { s as rootMembershipId } from "./scopes-CVdPrWN-.js";
-import { n as isApprovalError } from "./errors-DRnGZHzF.js";
-import { n as hasCredentials } from "./http-SO7qGttf.js";
-import { l as unauthenticatedProblem } from "./problem-B43ztKIm.js";
-import { n as assertApprover } from "./store-DMAWwAJV.js";
-import { m as approverRelations, p as heldPermissions } from "./helpers-H_KARDVC.js";
-//#region src/approvals/handler.ts
-function problem(status, title, detail, slug) {
-	const body = {
-		type: `${PROBLEM_BASE}/${slug}`,
-		title,
-		status,
-		detail
-	};
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/problem+json" }
-	});
-}
-function json(status, body) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" }
-	});
-}
-function parseRoute(url, method) {
-	const parts = url.pathname.replace(/\/+$/u, "").split("/").filter(Boolean);
-	const last = parts.at(-1);
-	const prev = parts.at(-2);
-	if (last === void 0) return;
-	if (method === "GET" && last === "pending") return { kind: "pending" };
-	if (method === "GET" && last === "mine") return { kind: "mine" };
-	if (method === "POST" && last === "approve" && prev !== void 0) return {
-		kind: "approve",
-		token: decodeURIComponent(prev)
-	};
-	if (method === "POST" && last === "reject" && prev !== void 0) return {
-		kind: "reject",
-		token: decodeURIComponent(prev)
-	};
-	if (method === "GET" && last !== "pending" && last !== "mine") return {
-		kind: "get",
-		token: decodeURIComponent(last)
-	};
-}
-async function resolveSubject(request, resolve) {
-	try {
-		const subject = await resolve(request);
-		if (subject === null || subject === void 0) return null;
-		return subject;
-	} catch {
-		return null;
-	}
-}
-function membershipTenants(subject) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const tenants = /* @__PURE__ */ new Set();
-	if (principal.tenant !== void 0) tenants.add(principal.tenant);
-	for (const membership of principal.memberships ?? []) {
-		const tenant = rootMembershipId(membership);
-		if (tenant !== void 0) tenants.add(tenant);
-	}
-	return [...tenants];
-}
-function belongsToTenant(subject, tenant) {
-	return membershipTenants(subject).includes(tenant);
-}
-async function mayResolve(request, subject, requireDistinct, options) {
-	try {
-		const relations = await approverRelations(request, subject, options);
-		const permissions = await heldPermissions(request, subject, options.permdockFor);
-		assertApprover(request, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function canView(request, subject) {
-	const principal = subject.principal;
-	if (principal === null) return false;
-	if (request.subject.principal?.id === principal.id) return true;
-	const tenant = request.subject.principal?.tenant;
-	if (tenant !== void 0) return belongsToTenant(subject, tenant);
-	return true;
-}
-/**
-* The tenants whose pending requests the approver may list: the requested one,
-* else the active one, else every membership tenant. Requests without a tenant
-* are listed only when no tenant was requested or active.
-*/
-function pageQuery(url) {
-	const limit = url.searchParams.get("limit");
-	const cursor = url.searchParams.get("cursor");
-	return compact({
-		limit: limit === null ? void 0 : Number(limit),
-		cursor: cursor ?? void 0
-	});
-}
-function inboxScope(url, subject) {
-	const requested = url.searchParams.get("tenant");
-	if (requested !== null && requested !== "") {
-		if (!belongsToTenant(subject, requested)) return { ok: false };
-		return {
-			ok: true,
-			tenants: [requested],
-			tenantless: false
-		};
-	}
-	const active = subject.principal?.tenant;
-	if (active !== void 0) return {
-		ok: true,
-		tenants: [active],
-		tenantless: false
-	};
-	return {
-		ok: true,
-		tenants: membershipTenants(subject),
-		tenantless: true
-	};
-}
-function signedApproval(request, signer, audience) {
-	if (signer === void 0 || request.status !== "approved") return Promise.resolve(void 0);
-	const payload = { approval: {
-		token: request.token,
-		permission: request.permission,
-		resource: request.resource,
-		status: request.status
-	} };
-	if (request.subject.principal !== null) payload["sub"] = request.subject.principal.id;
-	return signer.sign(payload, compact({
-		typ: "permdock-approval+jwt",
-		audience,
-		expiresAt: Math.floor(Date.parse(request.expiresAt) / 1e3)
-	}));
-}
-async function readNote(request) {
-	const contentType = request.headers.get("content-type") ?? "";
-	if (request.method !== "POST" || contentType === "") return;
-	if (!contentType.includes("application/json")) return;
-	try {
-		const body = await request.json();
-		if (body !== null && typeof body === "object" && "note" in body && typeof body.note === "string") return body.note;
-	} catch {
-		return;
-	}
-}
-function mapError(error, credentials) {
-	if (!isApprovalError(error)) return problem(500, "Internal error", "approval store failed", "internal");
-	if (error.code === "approval-not-found") return problem(404, "Not found", error.message, "not-found");
-	if (error.code === "approval-not-pending" || error.code === "approval-expired" || error.code === "approver-repeated") return problem(409, "Conflict", error.message, "conflict");
-	if (error.code === "approver-unauthenticated") return unauthenticatedProblem(credentials);
-	return problem(403, "Permission denied", error.message, "denied");
-}
-function approvalsHandler(store, options) {
-	const requireDistinct = options.requireDistinctApprover === true;
-	return async (request) => {
-		const url = new URL(request.url);
-		const route = parseRoute(url, request.method);
-		if (route === void 0) return problem(405, "Method not allowed", "unknown approvals route", "method-not-allowed");
-		await store.expire();
-		const subject = await resolveSubject(request, options.subject);
-		const principal = subject?.principal ?? null;
-		if (subject === null || principal === null) return unauthenticatedProblem(hasCredentials(request));
-		try {
-			if (route.kind === "pending") {
-				const scoped = inboxScope(url, subject);
-				if (!scoped.ok) return problem(403, "Permission denied", "approver does not belong to that tenant", "denied");
-				const page = await store.list({
-					...pageQuery(url),
-					status: "pending"
-				});
-				const tenants = new Set(scoped.tenants);
-				const eligible = await Promise.all(page.items.map(async (item) => {
-					const tenant = item.subject.principal?.tenant;
-					return (tenant === void 0 ? scoped.tenantless : tenants.has(tenant)) && await mayResolve(item, subject, requireDistinct, options);
-				}));
-				return json(200, compact({
-					items: page.items.filter((_, index) => eligible[index] === true),
-					next: page.next
-				}));
-			}
-			if (route.kind === "mine") {
-				const page = await store.list({
-					...pageQuery(url),
-					principalId: principal.id
-				});
-				return json(200, compact({
-					items: page.items,
-					next: page.next
-				}));
-			}
-			if (route.kind === "get") {
-				const current = await store.get(route.token);
-				if (current === null || !canView(current, subject)) return problem(404, "Not found", "approval was not found", "not-found");
-				return json(200, current);
-			}
-			const current = await store.get(route.token);
-			if (current === null) return problem(404, "Not found", "approval was not found", "not-found");
-			const relations = await approverRelations(current, subject, options);
-			const permissions = await heldPermissions(current, subject, options.permdockFor);
-			assertApprover(current, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
-			const note = await readNote(request);
-			const resolved = await store.resolve(route.token, compact({
-				status: route.kind === "approve" ? "approved" : "rejected",
-				by: subject,
-				note,
-				relations,
-				permissions
-			}));
-			const signed = await signedApproval(resolved, options.signer, options.audience);
-			return json(200, compact({
-				...resolved,
-				signed
-			}));
-		} catch (error) {
-			return mapError(error, hasCredentials(request));
-		}
-	};
-}
-//#endregion
-export { approvalsHandler as t };

package/dist/arazzo-C9chp3ST.js

@@ -1,54 +0,0 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/arazzo.ts
-function arazzo(ctx) {
-	return defineCommand({
-		meta: {
-			name: "arazzo",
-			description: COMMAND_DESCRIPTIONS.arazzo
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "check"
-			},
-			doc: {
-				type: "string",
-				description: "Arazzo document",
-				valueHint: "arazzo.json"
-			},
-			openapi: {
-				type: "string",
-				description: "OpenAPI document the workflows call",
-				valueHint: "doc.json"
-			},
-			workflow: {
-				type: "string",
-				description: "Check one workflow",
-				valueHint: "id"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the policy, instead of the config",
-				valueHint: "module"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./arazzo-BAgw9ap6.js")).runArazzo({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				doc: listArg(rawArgs, "doc")[0],
-				openapi: stringArg(parsed.openapi),
-				workflow: stringArg(parsed.workflow),
-				from: stringArg(parsed.from),
-				json: ctx.json
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { arazzo };

package/dist/bind-C_ob3LKa.d.ts

@@ -1,25 +0,0 @@
-import { f as ApprovalStore } from "./types-aqOHTHcp.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
-import { r as PdpFactory } from "./types-DxiCGmmd.js";
-import { o as OtelWrap } from "./types-QCuYJh4q.js";
-import { T as TenantOption, b as WebBotAuthVerifier } from "./create-B1d519XK.js";
-//#region src/server/bind.d.ts
-/** The options of every framework adapter; `TContext` is what its callbacks receive. */
-type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {
-  readonly subject: (context: TContext) => TUser | Promise<TUser>;
-  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
-  readonly actor?: (context: TContext) => unknown;
-  readonly tenant?: TenantOption<TContext>;
-};
-/** The services an adapter hands to its kernel unchanged. */
-type ServerAdapterServices = {
-  readonly store?: ApprovalStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
-};
-//#endregion
-export { ServerAdapterServices as n, ServerAdapterOptions as t };

package/dist/catalog-CRW5Mx_B.js

@@ -1,2 +0,0 @@
-import { t as runCatalog } from "./catalog-DWF5cYqB.js";
-export { runCatalog };

package/dist/catalog-CYj-mX2O.js

@@ -1,48 +0,0 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/catalog.ts
-function catalog(ctx) {
-	return defineCommand({
-		meta: {
-			name: "catalog",
-			description: COMMAND_DESCRIPTIONS.catalog
-		},
-		args: {
-			...globalArgs,
-			format: {
-				type: "enum",
-				options: [
-					"json",
-					"schema",
-					"markdown"
-				],
-				default: "json",
-				description: "Output format"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the permissions, instead of the config",
-				valueHint: "module"
-			},
-			include: {
-				type: "string",
-				description: "Permission keys or prefixes to keep, repeatable",
-				valueHint: "key"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./catalog-CRW5Mx_B.js")).runCatalog({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				format: parsed.format,
-				from: stringArg(parsed.from),
-				include: listArg(rawArgs, "include"),
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { catalog };

package/dist/catalog-DWF5cYqB.js

@@ -1,55 +0,0 @@
-import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
-import { r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
-import { i as scanSources, r as runCollect } from "./collect-DSTE3ml9.js";
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-//#region src/cli/catalog.ts
-async function runCatalog(input) {
-	if (input.format === "schema") return {
-		code: 0,
-		output: `${JSON.stringify(catalogSchemaDocument(), null, 2)}\n`
-	};
-	const from = input.from ?? input.config.permissions;
-	let document;
-	if (from !== void 0) {
-		const abs = resolve(input.cwd, from);
-		if (!existsSync(abs)) return {
-			code: 2,
-			output: `PermDock CLI: module not found: ${from}`
-		};
-		const tree = asPermissionTree(pickNamed(await loadModule(abs), ["permissions"]));
-		const srcPath = input.config.collect?.srcPath ?? defaultSrcPath();
-		const files = listSourceFiles(input.cwd, srcPath);
-		const scan = scanSources(input.cwd, files, new Set(leavesOf(tree).map((leaf) => leaf.key)));
-		document = buildCatalog(tree, scan, input.now.toISOString(), await loadConfiguredPolicy(input.cwd, input.config.policy));
-	} else {
-		const collected = await runCollect({
-			cwd: input.cwd,
-			config: input.config,
-			collect: input.config.collect ?? {},
-			check: false,
-			now: input.now,
-			io: input.io
-		});
-		if (collected.document === void 0) return {
-			code: collected.code,
-			output: collected.message
-		};
-		document = collected.document;
-	}
-	const filtered = input.include.length === 0 ? document : {
-		...document,
-		permissions: document.permissions.filter((permission) => input.include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix))
-	};
-	if (input.format === "markdown") return {
-		code: 0,
-		output: formatCatalogMarkdown(filtered)
-	};
-	return {
-		code: 0,
-		output: formatCatalogJson(filtered)
-	};
-}
-//#endregion
-export { runCatalog as t };

package/dist/cloud-CfwZ39Rl.js

@@ -1,50 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/cloud.ts
-function cloud(ctx) {
-	return defineCommand({
-		meta: {
-			name: "cloud",
-			description: COMMAND_DESCRIPTIONS.cloud
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "push"
-			},
-			"dry-run": {
-				type: "boolean",
-				description: "Print the payload; send nothing"
-			},
-			url: {
-				type: "string",
-				description: "Cloud API base URL",
-				valueHint: "url"
-			},
-			environment: {
-				type: "string",
-				description: "Target environment",
-				valueHint: "env"
-			}
-		},
-		async run({ args: parsed }) {
-			const result = await (await import("./cloud-DWLXO2af.js")).runCloud({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				url: stringArg(parsed.url),
-				environment: stringArg(parsed.environment),
-				dryRun: parsed["dry-run"] === true,
-				json: ctx.json,
-				env: ctx.io.env ?? process.env,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { cloud };

package/dist/cloud-DWLXO2af.js

@@ -1,118 +0,0 @@
-import { t as catalogFingerprint } from "./src-BDwEZWrZ.js";
-import { s as snapshotScopes } from "./permdock-CbgvLnuo.js";
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as loadConfiguredPolicy } from "./load-DhWEB9P1.js";
-import { t as parseCatalog } from "./parse-BuyjxhZV.js";
-import { t as runCatalog } from "./catalog-DWF5cYqB.js";
-//#region src/cli/cloud.ts
-function firstNonEmpty(...values) {
-	for (const value of values) if (value !== void 0 && value !== "") return value;
-	return "";
-}
-function pushedGrant(grant) {
-	const entry = {
-		permission: grant.permission.key,
-		effect: grant.effect,
-		role: grant.role,
-		to: grant.to,
-		where: grant.portable ? grant.where : void 0,
-		check: grant.portable ? grant.check : void 0,
-		approval: grant.approval,
-		scope: grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource },
-		portable: grant.portable ? void 0 : false,
-		fields: grant.fields,
-		limit: grant.limit
-	};
-	return Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== void 0));
-}
-/** The code policy as the hosted AuthZEN endpoint evaluates it; closures travel as `portable: false` and deny there. */
-function pushedPolicy(policy) {
-	const scopes = snapshotScopes(policy);
-	return {
-		fingerprint: policy.fingerprint,
-		...scopes === void 0 ? {} : { scopes },
-		grants: policy.grants.filter((grant) => grant.hosted === void 0).map(pushedGrant)
-	};
-}
-async function runCloud(input) {
-	if (input.rest[0] !== "push") return {
-		code: 2,
-		output: `usage: permdock cloud push [--dry-run] [--url <url>] [--environment <env>]`
-	};
-	const built = await runCatalog({
-		cwd: input.cwd,
-		config: input.config,
-		format: "json",
-		from: void 0,
-		include: [],
-		now: input.now,
-		io: input.io
-	});
-	if (built.code !== 0) return {
-		code: built.code,
-		output: built.output
-	};
-	const catalog = parseCatalog(built.output);
-	const fingerprint = catalogFingerprint(catalog);
-	const loaded = await loadConfiguredPolicy(input.cwd, input.config.policy);
-	const policy = loaded === void 0 ? void 0 : pushedPolicy(loaded);
-	const hostable = catalog.permissions.filter((permission) => permission.hostable === true).map((permission) => permission.key);
-	const summary = {
-		fingerprint,
-		permissions: catalog.permissions.length,
-		hostable,
-		roles: (catalog.roles ?? []).length,
-		plans: (catalog.plans ?? []).length,
-		grants: policy?.grants.length ?? 0
-	};
-	const url = firstNonEmpty(input.url, input.env["PERMDOCK_CLOUD_URL"]).replace(/\/$/u, "");
-	const environment = firstNonEmpty(input.environment, input.env["PERMDOCK_CLOUD_ENV"], input.env["VERCEL_ENV"], "production");
-	const describe = (verb) => input.json ? JSON.stringify({
-		...summary,
-		environment,
-		status: verb
-	}) : `${verb} catalog ${fingerprint} (${String(summary.permissions)} permissions, ${String(hostable.length)} hostable) to ${environment}`;
-	if (input.dryRun) return {
-		code: 0,
-		output: describe("would push")
-	};
-	const key = input.env["PERMDOCK_CLOUD_KEY"] ?? "";
-	if (url === "" || key === "") return {
-		code: 2,
-		output: "permdock cloud push needs PERMDOCK_CLOUD_URL (or --url) and PERMDOCK_CLOUD_KEY in the environment"
-	};
-	const fetchFn = input.io.fetch ?? globalThis.fetch.bind(globalThis);
-	let response;
-	try {
-		response = await fetchFn(`${url}/v1/environments/${encodeURIComponent(environment)}/catalog`, {
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${key}`,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify(policy === void 0 ? {
-				fingerprint,
-				catalog
-			} : {
-				fingerprint,
-				catalog,
-				policy
-			})
-		});
-	} catch (error) {
-		return {
-			code: 1,
-			output: `PermDock Cloud unreachable: ${describeError(error)}`
-		};
-	}
-	if (!response.ok) return {
-		code: 1,
-		output: `PermDock Cloud rejected the catalog: HTTP ${String(response.status)}`
-	};
-	return {
-		code: 0,
-		output: describe("pushed")
-	};
-}
-//#endregion
-export { runCloud };