permdock 0.15.0 → 0.17.0

package/dist/{protected-action-D8x73IGm.d.ts → protected-action-D3S9U4nc.d.ts}

@@ -1,14 +1,21 @@
-import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
-import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle } from "./types-tQB2CEnY.js";
-import { r as ProtectedProps } from "./types-rCRV4Ge-.js";
+import { d as UncheckedData, s as RowData } from "./permdock-DUWZEOLR.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-nalX_HHE.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-g5ctUrOI.js";
+import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
+import { r as ProtectedProps } from "./types-e82uzrTn.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+/**
+ * Adds refresh triggers to the nearest provider while the component is mounted.
+ * Use it where the provider's own `refreshOn` cannot be set, such as below
+ * `permdock/next`'s Server Component provider: functions cannot cross to the
+ * client. Keep `triggers` stable (module scope); a new array resubscribes.
+ */
+declare function useRefreshOn(triggers: readonly RefreshTrigger[]): void;
 declare function usePermission<D>(permission: Permission, data?: UncheckedData<D>): PermissionState;
 declare function usePermission<P extends Permission>(permission: P, data?: RowData<P>): PermissionState;
 declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
@@ -55,4 +62,4 @@ declare function useProtectedAction<T, P extends Permission>(action: ProtectedAc
   readonly mode?: GateMode;
 }): ProtectedActionHandle<T>;
 //#endregion
-export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as g, useSubject as h, useAssignablePermissions as i, useMemberships as l, useRoles as m, Protected as n, useDescribe as o, useRefreshOn as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/{protected-action-QEA8arRB.js → protected-action-qowj6nxN.js}

@@ -1,8 +1,8 @@
-import { n as actionRunner, t as actionApproval } from "./protected-action-DUYqb-Ma.js";
-import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-CD8wuL4Z.js";
-import { n as storeOf } from "./store-options-Dil3lraY.js";
+import { n as actionRunner, t as actionApproval } from "./protected-action-B6n6w7Rl.js";
+import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-TrZYlDnM.js";
+import { n as storeOf } from "./store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BBIT68le.js";
-import { Suspense, use, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";
+import { Suspense, use, useEffect, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/hooks.ts
 function useStore() {
@@ -16,6 +16,16 @@ function usePermDock() {
 	const store = useStore();
 	return useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
 }
+/**
+* Adds refresh triggers to the nearest provider while the component is mounted.
+* Use it where the provider's own `refreshOn` cannot be set, such as below
+* `permdock/next`'s Server Component provider: functions cannot cross to the
+* client. Keep `triggers` stable (module scope); a new array resubscribes.
+*/
+function useRefreshOn(triggers) {
+	const store = useStore();
+	useEffect(() => store.refreshOn(triggers), [store, triggers]);
+}
 function usePermission(permission, data) {
 	const permdock = usePermDock();
 	return useMemo(() => storeOf(permdock).permissionState(permission, data), [
@@ -160,4 +170,4 @@ function useProtectedAction(action, permission, data, options = {}) {
 	]);
 }
 //#endregion
-export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as g, useSubject as h, useAssignablePermissions as i, useMemberships as l, useRoles as m, Protected as n, useDescribe as o, useRefreshOn as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/{provider-C55OGXJ7.js → provider-CY4TSSJo.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as adapterStore } from "./store-options-Dil3lraY.js";
+import { t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { t as adapterStore } from "./store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BBIT68le.js";
 import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-DfLeek9O.d.ts → provider-CjAu39fJ.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-rCRV4Ge-.js";
+import { n as PermDockProviderProps } from "./types-e82uzrTn.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-CaTv00tr.js → provider-store-BQP_pp8s.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
-import { a as isPromiseLike, t as adapterStore } from "./store-options-Dil3lraY.js";
+import { t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { l as isPromiseLike, t as adapterStore } from "./store-options--zWn48PK.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a new

package/dist/pull-CUVdB04v.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-DVoZ0V9_.js";

package/dist/{pull-BBmCxnqX.js → pull-DVoZ0V9_.js}

@@ -1,16 +1,16 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
+import { o as formatCatalogJson } from "./catalog-doc-C4DGfJCO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-BVZpQDad.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
-import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";
+import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
+import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-j3Eu-j4h.js";
 import { n as formatManifestJson } from "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { relative, resolve } from "node:path";

package/dist/{push-Dq_ca4-j.js → push-eJl1Tvqm.js}

@@ -1,15 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { i as loadConfiguredPolicy } from "./load-DjSU5KXO.js";
+import { i as loadConfiguredPolicy } from "./load-BaEamml-.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { r as pushedPolicy } from "./pushed-policy-CDuOL2de.js";
-import { n as runCatalog } from "./catalog-CGlSwU6j.js";
-import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
-import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth--yPyZNgr.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
+import { r as pushedPolicy } from "./pushed-policy-DMXAOmEW.js";
+import { n as runCatalog } from "./catalog-DGDd_ww1.js";
+import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
+import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-j3Eu-j4h.js";
 import "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{pushed-policy-CryQheKq.d.ts → pushed-policy-CUQuvlS3.d.ts}

@@ -1,4 +1,4 @@
-import { An as Grantee, H as WireValidity, T as Policy, Vn as AppObligation, _ as GrantLimit, a as ApprovalRequirement, br as Condition, tn as SnapshotScope, u as BreakGlassSpec, v as GrantMeta } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, Gn as AppObligation, Pn as Grantee, U as WireValidity, d as BreakGlassSpec, o as ApprovalRequirement, rn as SnapshotScope, v as GrantLimit, wr as Condition, y as GrantMeta } from "./policy-types-IRJVABmm.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/{pushed-policy-CDuOL2de.js → pushed-policy-DMXAOmEW.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { n as snapshotScopes } from "./instance-snapshot-DuWf1cT3.js";
+import { n as snapshotScopes } from "./instance-snapshot-BgOGtyCy.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/react/index.d.ts

@@ -1,9 +1,9 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe } from "../describe-nalX_HHE.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-e82uzrTn.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
-import { t as PermDockProvider } from "../provider-DfLeek9O.js";
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D3S9U4nc.js";
+import { t as PermDockProvider } from "../provider-CjAu39fJ.js";
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/index.js

@@ -1,8 +1,8 @@
 "use client";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
-import { t as PermDockProvider } from "../provider-C55OGXJ7.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+import { n as describe } from "../describe-CogP1loh.js";
+import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-qowj6nxN.js";
+import { t as PermDockProvider } from "../provider-CY4TSSJo.js";
+export { PermDockProvider, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DfLeek9O.js";
+import { t as PermDockProvider } from "../provider-CjAu39fJ.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,2 +1,2 @@
 "use client";
-export { t as PermDockProvider } from "../provider-C55OGXJ7.js";
+export { t as PermDockProvider } from "../provider-CY4TSSJo.js";

package/dist/react-native/index.d.ts

@@ -1,14 +1,14 @@
-import { Jt as LocalRowValue, Kt as LocalMembershipRows, Wt as Instant, Xt as LocalSnapshotRows, Yt as LocalSnapshotManifest, Zt as Snapshot, ct as SnapshotSource, fr as Membership, qt as LocalRowColumn, sr as CustomRole } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Jt as LocalMembershipRows, Kt as Instant, Qt as LocalSnapshotRows, Xt as LocalRowValue, Yt as LocalRowColumn, Zt as LocalSnapshotManifest, dr as CustomRole, gr as Membership, lt as SnapshotSource } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CCmbhnxP.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe } from "../describe-nalX_HHE.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BgTYdR3q.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, t as ClientStore, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-e82uzrTn.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, g as ClientStore, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-CWBsAwqn.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D3S9U4nc.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-D29K5ZNP.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /**
@@ -222,4 +222,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, authzChangeRefresh, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -2,20 +2,20 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { h as secondsAt, m as rfc3339 } from "../time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-0Up_UA2t.js";
+import { d as scopeList, o as normalizeMemberships, p as tenantOf$1, s as resolveScope } from "../scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "../compare-DTfyUunF.js";
-import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-5d1zVBvK.js";
-import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXlzi69u.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DCakWRsr.js";
+import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-DvOHHk3-.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-DN_8J27z.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DMlSSo9b.js";
 import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DEiCF4ah.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { i as isJws, n as storeOf, r as eventSourceRefresh, t as adapterStore } from "../store-options-Dil3lraY.js";
+import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { a as eventSourceRefresh, c as isJws, n as storeOf, r as authzChangeRefresh, t as adapterStore } from "../store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BBIT68le.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-qowj6nxN.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -1126,4 +1126,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, authzChangeRefresh, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/refresh-on-L9UOwATg.d.ts

@@ -0,0 +1,49 @@
+//#region src/client/refresh-on.d.ts
+/**
+ * Calls `refresh` when the snapshot may be out of date (a membership event, a
+ * window focus, a realtime message) and returns the unsubscribe. A refresh
+ * re-fetches the signed snapshot; it never grants by itself.
+ */
+type RefreshTrigger = (refresh: () => void) => () => void;
+type EventSourceRefreshOptions = {
+  /**
+   * CloudEvent `type` values that refresh; a trailing `*` matches a prefix.
+   * Defaults to `com.permdock.membership.*` and `com.permdock.catalog.*`.
+   */
+  readonly types?: readonly string[];
+  readonly withCredentials?: boolean;
+};
+/**
+ * A `refreshOn` trigger over Server-Sent Events: each `message` whose data is a
+ * structured CloudEvent with a matching `type` refreshes the snapshot. Without
+ * a global `EventSource` it never fires.
+ */
+declare function eventSourceRefresh(url: string, options?: EventSourceRefreshOptions): RefreshTrigger;
+/** A `refreshOn` trigger on window `focus`. Without a window it never fires. */
+declare function focusRefresh(): RefreshTrigger;
+/**
+ * A `refreshOn` trigger on `visibilitychange` to visible, when a background tab
+ * comes back. Without a `document` it never fires.
+ */
+declare function visibilityRefresh(): RefreshTrigger;
+/**
+ * A `refreshOn` trigger on every message to the `BroadcastChannel` `name`, so
+ * one tab that learns of a change refreshes the others. Without a global
+ * `BroadcastChannel` it never fires.
+ */
+declare function broadcastChannelRefresh(name: string): RefreshTrigger;
+type AuthzChangeRefresh = {
+  /** Pass to `refreshOn`. */
+  readonly trigger: RefreshTrigger;
+  /** Pass to better-supabase's `<SessionProvider onAuthzChange>`. */
+  readonly notify: () => void;
+};
+/**
+ * A `refreshOn` trigger that fires on `notify()`. better-supabase's
+ * `SessionProvider` already listens on the user's `authz:<uid>` topic and
+ * shares changes across tabs, so `onAuthzChange={notify}` refreshes the
+ * snapshot without a second Realtime channel.
+ */
+declare function authzChangeRefresh(): AuthzChangeRefresh;
+//#endregion
+export { broadcastChannelRefresh as a, visibilityRefresh as c, authzChangeRefresh as i, EventSourceRefreshOptions as n, eventSourceRefresh as o, RefreshTrigger as r, focusRefresh as s, AuthzChangeRefresh as t };

package/dist/{replay-Bs9Df2fQ.d.ts → replay-Dc3d8LhG.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-DsHGPtkR.js";
+import { l as ReplayStore } from "./types-CJC1aaoJ.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-Duzdf0cd.js → request-context-Ch052blg.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
-import { t as buildInstance } from "./build-instance-BWXqwQYU.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
+import { t as buildInstance } from "./build-instance-lye7oEqf.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw, an

package/dist/{request-schema-DhX7UbfQ.js → request-schema-CMP8Cmxd.js}

@@ -81,6 +81,11 @@ const APPROVAL_REQUEST_SCHEMA = {
 		vouched: { type: "string" },
 		note: { type: "string" },
 		consumedAt: { $ref: "#/$defs/instant" },
+		fingerprint: {
+			type: "string",
+			pattern: "^[0-9a-f]{64}$",
+			description: "The approvalFingerprint the request was opened under; a resume under another one is refused."
+		},
 		x: {
 			type: "object",
 			description: "The application's own data, set when the request opens: plain JSON, never read by a decision."

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { J as DecisionSink } from "../policy-types-DGIO_gxq.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CN0LsqbK.js";
-import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { Y as DecisionSink } from "../policy-types-IRJVABmm.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-UfpcY575.js";
+import { l as ReplayStore } from "../types-CJC1aaoJ.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /**

package/dist/{resolve-names-Y1Cb22cp.js → resolve-names-1nCei24V.js}

@@ -1,12 +1,12 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
-import "./budget-BELja5A9.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
+import "./budget-BBCPDOGP.js";
 import "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DrGLwM3s.js";
-import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
-import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DyYVEjKC.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BsGE6HBR.js";
+import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 //#region src/cli/rls/permission-holders.ts
 /**
 * `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL

package/dist/{rls-yK2nZUcm.js → rls-BVzoZCn3.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { c as missingInput } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/rls.ts
 const membershipsFlag = { memberships: {
 	type: "string",
@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-BwKXdVEW.js")).runRls(input);
+	return (await import("./rls-ClJRblnR.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {
@@ -215,7 +215,7 @@ const generate = defineLeaf({
 			valueHint: "parts",
 			list: true,
 			async complete() {
-				const { SPLIT_PARTS } = await import("./output-files-BHOIlrfD.js");
+				const { SPLIT_PARTS } = await import("./output-files-BYscrQl-.js");
 				return SPLIT_PARTS;
 			}
 		},

package/dist/{rls-BwKXdVEW.js → rls-ClJRblnR.js}

@@ -1,32 +1,32 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
 import "./sources-C4vkzZJV.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-DVa1faOr.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-BVZpQDad.js";
-import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-BuK9F53f.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-BBmCxnqX.js";
+import { t as fetchProjectPolicy } from "./pull-DVoZ0V9_.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
-import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-Cj85nccs.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BsGE6HBR.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-moSRhxl_.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
-import { t as connectPgPool } from "./pg-DQTqRrou.js";
-import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
-import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CgIpJRcG.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-CGk4YpvC.js";
+import { t as connectPgPool } from "./pg-Ddxsd5ZB.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-CrjL6A49.js";
+import { n as permissionHoldersSql } from "./resolve-names-1nCei24V.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-C8G8D5mk.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-BP_5WAIc.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -2496,7 +2496,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-BJHxQqT5.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BbY5-Khy.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2612,7 +2612,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
-			const { runRlsImport } = await import("./import-CNBF96hB.js");
+			const { runRlsImport } = await import("./import-C1XXpG_m.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,