permdock 0.4.0 → 0.5.0

package/dist/pull-BgIfno6w.js

@@ -0,0 +1,256 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
+import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import { a as formatCatalogJson } from "./catalog-doc-C9wjsfNY.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
+import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
+import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
+import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-DRLEizbL.js";
+import { n as formatManifestJson } from "./manifest-json-CAGzls-C.js";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { relative, resolve } from "node:path";
+//#region src/cli/cloud/projects.ts
+function failure(json, command, code, problem) {
+	const { type, ...rest } = problem;
+	return {
+		ok: false,
+		result: {
+			code,
+			output: json ? JSON.stringify({
+				type: type ?? `https://permdock.com/docs/cli/errors#${problem.code}`,
+				...rest,
+				command,
+				exitCode: code
+			}, null, 2) : `${command}: ${problem.detail}`
+		}
+	};
+}
+async function readProblemType(response) {
+	try {
+		const body = await response.json();
+		return isRecord(body) && typeof body["type"] === "string" ? body["type"] : void 0;
+	} catch {
+		return;
+	}
+}
+async function get(input, what) {
+	const response = await httpRequest(input.io, {
+		url: `${input.issuer}${input.path}`,
+		service: "PermDock Cloud",
+		headers: {
+			authorization: `Bearer ${input.bearer}`,
+			accept: "application/json"
+		}
+	});
+	if (response.ok) try {
+		return {
+			ok: true,
+			body: await response.json()
+		};
+	} catch {
+		return failure(input.json, input.command, 1, {
+			code: "request_failed",
+			title: "Unreadable Cloud answer",
+			status: response.status,
+			detail: `PermDock Cloud answered ${what} with a body that is not JSON`
+		});
+	}
+	const type = await readProblemType(response);
+	if (response.status === 404 && type === "https://permdock.com/problems/policy-not-published") return failure(input.json, input.command, 1, {
+		code: "request_failed",
+		type: POLICY_NOT_PUBLISHED,
+		title: "Policy not published",
+		status: 404,
+		detail: "the project has no pushed catalog and policy yet; run permdock cloud push first"
+	});
+	const denied = authFailure(response, response.status === 401 ? "PermDock Cloud rejected the credential" : `the credential may not read ${what}; a PERMDOCK_CLOUD_TOKEN reads only its own environment`, [{
+		command: "permdock login",
+		when: "to log in on this machine"
+	}, {
+		command: "export PERMDOCK_CLOUD_TOKEN=<read-only key>",
+		when: "in CI"
+	}]);
+	if (denied !== void 0) throw denied;
+	const detail = response.status === 429 ? `PermDock Cloud rate-limited the request (HTTP 429); retry after ${response.headers.get("retry-after") ?? "a while"} seconds` : `PermDock Cloud answered ${what} with HTTP ${String(response.status)}`;
+	return failure(input.json, input.command, 1, {
+		code: "request_failed",
+		...type === void 0 ? {} : { type },
+		title: "PermDock Cloud request failed",
+		status: response.status,
+		detail
+	});
+}
+function parseProjectPolicy(body) {
+	if (!isRecord(body) || body["v"] !== 1 || typeof body["project"] !== "string" || typeof body["version"] !== "number" || typeof body["fingerprint"] !== "string" || typeof body["permdockVersion"] !== "string" || !isRecord(body["catalog"]) || body["manifest"] !== void 0 && !isRecord(body["manifest"]) || body["policy"] !== void 0 && !isRecord(body["policy"])) return null;
+	return {
+		v: 1,
+		project: body["project"],
+		version: body["version"],
+		fingerprint: body["fingerprint"],
+		permdockVersion: body["permdockVersion"],
+		catalog: body["catalog"],
+		...isRecord(body["manifest"]) ? { manifest: body["manifest"] } : {},
+		...isRecord(body["policy"]) ? { policy: body["policy"] } : {}
+	};
+}
+async function projectPolicy(request, project) {
+	const fetched = await get({
+		...request,
+		path: `/v1/projects/${encodeURIComponent(project)}/policy`
+	}, `project ${project}`);
+	if (!fetched.ok) return fetched;
+	const value = parseProjectPolicy(fetched.body);
+	return value === null ? failure(request.json, request.command, 1, {
+		code: "request_failed",
+		title: "Unreadable project policy",
+		detail: `PermDock Cloud sent a project policy for ${project} that is not v1`
+	}) : {
+		ok: true,
+		value
+	};
+}
+async function listProjects(request) {
+	const fetched = await get({
+		...request,
+		path: "/v1/projects"
+	}, "the projects");
+	if (!fetched.ok) return fetched;
+	const items = isRecord(fetched.body) && Array.isArray(fetched.body["items"]) ? fetched.body["items"] : [];
+	const projects = [];
+	for (const item of items) if (isRecord(item) && typeof item["id"] === "string") projects.push({
+		id: item["id"],
+		...typeof item["name"] === "string" ? { name: item["name"] } : {}
+	});
+	return {
+		ok: true,
+		value: projects
+	};
+}
+/**
+* `--project`, or with `PERMDOCK_CLOUD_TOKEN` the one project the token is
+* pinned to, read from `GET /v1/projects`.
+*/
+async function resolveProject(request, flag, pinned) {
+	if (flag !== void 0) return {
+		ok: true,
+		value: flag
+	};
+	if (!pinned) return failure(request.json, request.command, 2, {
+		code: "usage",
+		title: "Missing project",
+		detail: "pass --project <id>"
+	});
+	const listed = await listProjects(request);
+	if (!listed.ok) return listed;
+	const [only, ...rest] = listed.value;
+	return only !== void 0 && rest.length === 0 ? {
+		ok: true,
+		value: only.id
+	} : failure(request.json, request.command, 2, {
+		code: "usage",
+		title: "Missing project",
+		detail: `PERMDOCK_CLOUD_TOKEN reads ${String(listed.value.length)} projects; pass --project <id>`
+	});
+}
+//#endregion
+//#region src/cli/cloud/pull.ts
+const COMMAND = "permdock cloud pull";
+/**
+* The project's pushed policy, read with `PERMDOCK_CLOUD_TOKEN` or the stored
+* login. Shared by `cloud pull` and `rls generate --project`.
+*/
+async function fetchProjectPolicy(input) {
+	const issuer = cloudUrl(input.url, input.env);
+	const auth = await readAuth(input.command, issuer, input.env, cliRuntime(input.io, input.env));
+	const request = {
+		issuer,
+		bearer: auth.bearer,
+		io: input.io,
+		json: input.json,
+		command: input.command
+	};
+	const project = await resolveProject(request, input.project, auth.source === "PERMDOCK_CLOUD_TOKEN");
+	if (!project.ok) return project;
+	return projectPolicy(request, project.value);
+}
+function snapshot(path) {
+	return {
+		path,
+		bytes: existsSync(path) ? readFileSync(path, "utf8") : null
+	};
+}
+function restore(files) {
+	for (const file of files) if (file.bytes === null) rmSync(file.path, { force: true });
+	else writeFileEnsuringDir(file.path, file.bytes);
+}
+/**
+* Writes the project's catalog and manifest with the writers `collect` and
+* `supabase inspect --out` use, then re-reads the catalog and requires its
+* fingerprint to match what the Cloud sent; a mismatch restores both files.
+*/
+async function runCloudPull(input) {
+	const fetched = await fetchProjectPolicy({
+		...input,
+		command: COMMAND
+	});
+	if (!fetched.ok) return fetched.result;
+	const pulled = fetched.value;
+	let catalog;
+	try {
+		catalog = parseCatalog(pulled.catalog);
+	} catch (error) {
+		return {
+			code: 1,
+			output: `${COMMAND}: the Cloud sent an invalid catalog: ${describeError(error)}`
+		};
+	}
+	let manifestText;
+	if (pulled.manifest !== void 0) try {
+		manifestText = formatManifestJson(parseSupabaseManifest(pulled.manifest));
+	} catch (error) {
+		return {
+			code: 1,
+			output: `${COMMAND}: the Cloud sent an invalid manifest: ${describeError(error)}`
+		};
+	}
+	const catalogFile = catalogPath(input.config, input.cwd);
+	const manifestFile = resolve(input.cwd, input.manifest ?? "permdock.manifest.json");
+	const before = [snapshot(catalogFile), ...manifestText === void 0 ? [] : [snapshot(manifestFile)]];
+	writeFileEnsuringDir(catalogFile, formatCatalogJson(catalog));
+	if (manifestText !== void 0) writeFileEnsuringDir(manifestFile, manifestText);
+	let written;
+	try {
+		written = catalogFingerprint(parseCatalog(readFileSync(catalogFile, "utf8")));
+	} catch {
+		written = "";
+	}
+	if (written !== pulled.fingerprint || catalog.fingerprint !== void 0 && catalog.fingerprint !== pulled.fingerprint) {
+		restore(before);
+		return {
+			code: 1,
+			output: `${COMMAND}: catalog fingerprint mismatch (Cloud ${pulled.fingerprint}, catalog ${catalog.fingerprint ?? "none"}, written ${written || "unreadable"}); restored the previous files`
+		};
+	}
+	const local = cliVersion();
+	if (pulled.permdockVersion !== local) input.io.stderr(`${COMMAND}: pushed by permdock@${pulled.permdockVersion}, pulled by permdock@${local}; regenerate the manifest locally if its shape changed`);
+	if (pulled.manifest === void 0) input.io.stderr(`${COMMAND}: the push carried no manifest; wrote the catalog only`);
+	const catalogRel = relative(input.cwd, catalogFile);
+	const manifestRel = manifestText === void 0 ? null : relative(input.cwd, manifestFile);
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify({
+			project: pulled.project,
+			version: pulled.version,
+			fingerprint: pulled.fingerprint,
+			permdockVersion: pulled.permdockVersion,
+			catalog: catalogRel,
+			manifest: manifestRel
+		}) : `pulled ${pulled.project} version ${String(pulled.version)}: wrote ${catalogRel}${manifestRel === null ? "" : ` and ${manifestRel}`} (${pulled.fingerprint})`
+	};
+}
+//#endregion
+export { runCloudPull as n, fetchProjectPolicy as t };

package/dist/pull-ByOks_Tg.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-BgIfno6w.js";

package/dist/push-CmFVBOeI.js

@@ -0,0 +1,116 @@
+import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import { i as loadConfiguredPolicy } from "./load-DFS_ry0W.js";
+import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
+import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import { r as pushedPolicy } from "./pushed-policy-DobP7AHI.js";
+import { n as runCatalog } from "./catalog-BECMPrwc.js";
+import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
+import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-DRLEizbL.js";
+import "./manifest-json-CAGzls-C.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/cloud/push.ts
+/** `--manifest`, else `permdock.manifest.json` when it exists; a file that does not parse is an error. */
+function readManifest(cwd, flag) {
+	const path = resolve(cwd, flag ?? "permdock.manifest.json");
+	if (!existsSync(path)) return flag === void 0 ? {
+		ok: true,
+		manifest: void 0
+	} : {
+		ok: false,
+		output: `permdock cloud push: ${flag} does not exist`
+	};
+	try {
+		return {
+			ok: true,
+			manifest: parseSupabaseManifest(readFileSync(path, "utf8"))
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			output: `permdock cloud push: ${flag ?? "permdock.manifest.json"} is not a valid manifest: ${describeError(error)}`
+		};
+	}
+}
+async function runCloud(input) {
+	const manifest = readManifest(input.cwd, input.manifest);
+	if (!manifest.ok) return {
+		code: 2,
+		output: manifest.output
+	};
+	const built = await runCatalog({
+		cwd: input.cwd,
+		config: input.config,
+		format: "json",
+		from: void 0,
+		include: [],
+		now: input.now,
+		io: input.io
+	});
+	if (built.code !== 0) return {
+		code: built.code,
+		output: built.output
+	};
+	const catalog = parseCatalog(built.output);
+	const fingerprint = catalogFingerprint(catalog);
+	const loaded = await loadConfiguredPolicy(input.cwd, input.config.policy);
+	const policy = loaded === void 0 ? void 0 : pushedPolicy(loaded);
+	const hostable = catalog.permissions.filter((permission) => permission.hostable === true).map((permission) => permission.key);
+	const summary = {
+		fingerprint,
+		permissions: catalog.permissions.length,
+		hostable,
+		roles: (catalog.roles ?? []).length,
+		plans: (catalog.plans ?? []).length,
+		grants: policy?.grants.length ?? 0,
+		manifest: manifest.manifest !== void 0
+	};
+	const url = cloudUrl(input.url, input.env);
+	const environment = firstNonEmpty(input.project, input.env["PERMDOCK_CLOUD_ENV"], input.env["VERCEL_ENV"], "production");
+	const describe = (verb) => input.json ? JSON.stringify({
+		...summary,
+		environment,
+		status: verb
+	}) : `${verb} catalog ${fingerprint} (${String(summary.permissions)} permissions, ${String(hostable.length)} hostable${summary.manifest ? ", with manifest" : ""}) to ${environment}`;
+	if (input.dryRun) return {
+		code: 0,
+		output: describe("would push")
+	};
+	const auth = await pushAuth(url, input.env, cliRuntime(input.io, input.env));
+	const response = await httpRequest(input.io, {
+		url: `${url}/v1/environments/${encodeURIComponent(environment)}/catalog`,
+		method: "POST",
+		service: "PermDock Cloud",
+		headers: {
+			authorization: `Bearer ${auth.bearer}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			fingerprint,
+			catalog,
+			...policy === void 0 ? {} : { policy },
+			...manifest.manifest === void 0 ? {} : { manifest: manifest.manifest },
+			permdockVersion: cliVersion()
+		})
+	});
+	const denied = authFailure(response, `PermDock Cloud rejected the ${auth.source === "login" ? "login" : "PERMDOCK_CLOUD_KEY"} for cloud push`, [{
+		command: "permdock login --scope catalog:write",
+		when: "to log in on this machine"
+	}, {
+		command: "export PERMDOCK_CLOUD_KEY=<write key>",
+		when: "in CI"
+	}]);
+	if (denied !== void 0) throw denied;
+	if (!response.ok) return {
+		code: 1,
+		output: `PermDock Cloud rejected the catalog: HTTP ${String(response.status)}`
+	};
+	return {
+		code: 0,
+		output: describe("pushed")
+	};
+}
+//#endregion
+export { runCloud };

package/dist/pushed-policy-BImMTTIM.d.ts

@@ -0,0 +1,57 @@
+import { Gt as SnapshotScope, H as WireValidity, T as Policy, _ as GrantLimit, a as ApprovalRequirement, bn as Grantee, jn as AppObligation, lr as Condition, u as BreakGlassSpec, v as GrantMeta } from "./policy-types-DzwivBgR.js";
+import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+//#region src/catalog/pushed-policy.d.ts
+/**
+ * One code grant as `permdock cloud push` sends it. `portable: false` marks a
+ * grant a snapshot cannot evaluate; `closure: true` marks one whose condition
+ * is code, which `policyFromCatalog` turns into an allow that never matches
+ * and a deny that always applies.
+ */
+type PushedGrant = {
+  readonly permission: string;
+  readonly effect: "allow" | "deny";
+  readonly role: string | null;
+  readonly to: Grantee | readonly Grantee[];
+  readonly where?: Condition;
+  readonly check?: Condition;
+  readonly approval?: "human" | ApprovalRequirement;
+  /** A scope name or one resource; absent for a global grant. */
+  readonly scope?: string | {
+    readonly resource: string;
+  };
+  readonly portable?: false;
+  readonly closure?: true;
+  readonly fields?: readonly string[];
+  readonly limit?: GrantLimit;
+  readonly validity?: WireValidity;
+  readonly name?: string;
+  readonly purpose?: readonly string[];
+  readonly requires?: readonly string[];
+  /** The membership kind (`via`) the grant applies under. */
+  readonly viaOnly?: string;
+  readonly breakGlass?: BreakGlassSpec;
+  readonly obligations?: readonly AppObligation[];
+  readonly meta?: GrantMeta;
+};
+/** PushedPolicy v1: the `policy` of a `permdock cloud push` body, validated by `schemas/pushed-policy-v1.json`. */
+type PushedPolicy = {
+  readonly v: 1;
+  /** The code policy's `fingerprint`. */
+  readonly fingerprint: string;
+  /** As a snapshot carries them; absent without declared scopes. */
+  readonly scopes?: readonly SnapshotScope[];
+  readonly grants: readonly PushedGrant[];
+};
+/** `schemas/pushed-policy-v1.json`; a test keeps the two equal. */
+declare const PUSHED_POLICY_SCHEMA: JsonSchemaNode;
+/** The code policy as `permdock cloud push` sends it; hosted grants are left out. */
+declare function pushedPolicy(policy: Policy): PushedPolicy;
+/**
+ * Validates a pushed policy (parsed, or the JSON text) against
+ * `schemas/pushed-policy-v1.json` and returns a deep-frozen copy. Throws
+ * `PermDockValidationError`, also for a `__proto__`, `constructor` or
+ * `prototype` key anywhere in it.
+ */
+declare function parsePushedPolicy(json: unknown): PushedPolicy;
+//#endregion
+export { pushedPolicy as a, parsePushedPolicy as i, PushedGrant as n, PushedPolicy as r, PUSHED_POLICY_SCHEMA as t };

package/dist/pushed-policy-DobP7AHI.js

@@ -0,0 +1,238 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
+import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
+import { n as snapshotScopes } from "./instance-snapshot-Cxq4ygFc.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
+//#region src/catalog/pushed-policy.ts
+const strings = {
+	type: "array",
+	items: { type: "string" }
+};
+const instant = {
+	type: "string",
+	format: "date-time",
+	pattern: RFC3339_PATTERN
+};
+const grantee = {
+	type: "object",
+	required: ["kind"]
+};
+const condition = {
+	type: "object",
+	required: ["op"]
+};
+/** `schemas/pushed-policy-v1.json`; a test keeps the two equal. */
+const PUSHED_POLICY_SCHEMA = freezeDeep({
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/pushed-policy-v1.json",
+	title: "PushedPolicy v1",
+	type: "object",
+	required: [
+		"v",
+		"fingerprint",
+		"grants"
+	],
+	additionalProperties: false,
+	properties: {
+		v: { const: 1 },
+		fingerprint: {
+			type: "string",
+			minLength: 1
+		},
+		scopes: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["name", "key"],
+				properties: {
+					name: {
+						type: "string",
+						pattern: "^[a-z][a-z0-9_]*$"
+					},
+					key: { type: "string" },
+					within: { type: "string" },
+					resources: strings,
+					fields: {
+						type: "object",
+						additionalProperties: { type: "string" }
+					}
+				}
+			}
+		},
+		grants: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"permission",
+					"effect",
+					"role",
+					"to"
+				],
+				additionalProperties: false,
+				properties: {
+					permission: {
+						type: "string",
+						minLength: 1
+					},
+					effect: { enum: ["allow", "deny"] },
+					role: { type: ["string", "null"] },
+					to: { oneOf: [grantee, {
+						type: "array",
+						items: grantee
+					}] },
+					where: condition,
+					check: condition,
+					approval: { oneOf: [{ const: "human" }, { type: "object" }] },
+					scope: { oneOf: [{ type: "string" }, {
+						type: "object",
+						required: ["resource"],
+						additionalProperties: false,
+						properties: { resource: { type: "string" } }
+					}] },
+					portable: { const: false },
+					closure: { const: true },
+					fields: strings,
+					limit: {
+						type: "object",
+						required: ["count", "per"],
+						properties: {
+							count: {
+								type: "integer",
+								minimum: 0
+							},
+							per: {
+								type: "integer",
+								minimum: 1
+							},
+							mode: { enum: ["hard", "soft"] },
+							alertAt: { type: "number" }
+						}
+					},
+					validity: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							from: instant,
+							until: instant
+						}
+					},
+					name: { type: "string" },
+					purpose: strings,
+					requires: strings,
+					viaOnly: { type: "string" },
+					breakGlass: {
+						type: "object",
+						required: [
+							"overrides",
+							"reason",
+							"obligations"
+						],
+						properties: {
+							overrides: strings,
+							purpose: strings,
+							reason: { type: "boolean" },
+							assurance: { type: "object" },
+							maxDuration: {
+								type: "integer",
+								minimum: 1
+							},
+							obligations: {
+								type: "array",
+								items: { enum: ["notify", "review"] }
+							}
+						}
+					},
+					obligations: {
+						type: "array",
+						items: {
+							type: "object",
+							required: ["kind", "name"],
+							properties: {
+								kind: { const: "app" },
+								name: { type: "string" }
+							}
+						}
+					},
+					meta: { type: "object" }
+				}
+			}
+		}
+	}
+});
+function pushedGrant(grant) {
+	return compact({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		role: grant.role,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		scope: grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource },
+		portable: grant.portable ? void 0 : false,
+		closure: grant.closure === void 0 ? void 0 : true,
+		fields: grant.fields,
+		limit: grant.limit,
+		validity: wireValidity(grant.validity),
+		name: grant.name,
+		purpose: grant.purpose,
+		requires: grant.requires,
+		viaOnly: grant.viaOnly,
+		breakGlass: grant.breakGlass,
+		obligations: grant.obligations,
+		meta: grant.meta === void 0 || Object.keys(grant.meta).length === 0 ? void 0 : grant.meta
+	});
+}
+/** The code policy as `permdock cloud push` sends it; hosted grants are left out. */
+function pushedPolicy(policy) {
+	const scopes = snapshotScopes(policy);
+	return {
+		v: 1,
+		fingerprint: policy.fingerprint,
+		...scopes === void 0 ? {} : { scopes },
+		grants: policy.grants.filter((grant) => grant.hosted === void 0).map(pushedGrant)
+	};
+}
+/**
+* Validates a pushed policy (parsed, or the JSON text) against
+* `schemas/pushed-policy-v1.json` and returns a deep-frozen copy. Throws
+* `PermDockValidationError`, also for a `__proto__`, `constructor` or
+* `prototype` key anywhere in it.
+*/
+function parsePushedPolicy(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch {
+		issues.push({
+			message: "Expected JSON text",
+			path: []
+		});
+	}
+	const copy = issues.length === 0 ? copyJson(input, [], issues, /* @__PURE__ */ new Set()) : void 0;
+	if (issues.length === 0) checkSchema(PUSHED_POLICY_SCHEMA, copy, [], issues);
+	const unsafe = issues.length === 0 ? forbiddenKeyPath(copy) : void 0;
+	if (unsafe !== void 0) issues.push({
+		message: "Unsafe key",
+		path: [...unsafe]
+	});
+	const [first] = issues;
+	if (first !== void 0) {
+		const where = first.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+		throw new PermDockValidationError({
+			code: "invalid-data",
+			permission: "",
+			resource: "",
+			boundary: "pushed-policy",
+			issues,
+			message: `PermDock: invalid pushed policy${where}: ${first.message}`
+		});
+	}
+	return freezeDeep(copy);
+}
+//#endregion
+export { parsePushedPolicy as n, pushedPolicy as r, PUSHED_POLICY_SCHEMA as t };

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe } from "../describe-C3ldA9os.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DHrmBJLH.js";
-import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-B3_P7xuw.js";
-import { t as PermDockProvider } from "../provider-kwHC9CZD.js";
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-tIgIeIKJ.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DEPHc2xV.js";
+import { t as PermDockProvider } from "../provider-DMVt6yYn.js";
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };