permdock 0.15.0 → 0.17.0

package/dist/supabase/index.js

@@ -1,6 +1,7 @@
-import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CDHMsDD0.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BBCPDOGP.js";
+import { n as AUTHZ_TOPIC, r as authzUserTopic, t as AUTHZ_EVENT } from "../authz-topic-Dbc-HDOS.js";
+import { a as supabaseApprovalStore, i as tableApprovalPolicySource, n as supabaseRls, o as supabaseClaims, r as tableApprovalDelegationSource, s as exchangeCapability, t as authorizeSql } from "../supabase-C8cNzp4i.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-BrjrckDG.js";
 import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };
+export { AUTHZ_EVENT, AUTHZ_TOPIC, AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzUserTopic, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableApprovalPolicySource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,11 +1,11 @@
-import { T as Policy, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { n as ServerAdapterServices } from "../bind-YYjvfpB9.js";
-import { Middleware } from "@supabase/middleware";
+import { i as OpenApiHooks } from "../server-types-Bw-lWqzR.js";
+import { n as ServerAdapterServices } from "../bind-DjFNX0Pq.js";
+import { FetchHandler, Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
  * The verified Supabase Auth access-token payload as `@supabase/server`
@@ -92,4 +92,5 @@ export type SupabaseMiddlewarePermDock<V extends PolicyVocabulary = PolicyVocabu
   readonly openapi: OpenApiHooks;
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
-//#endregion
+//#endregion
+export type { FetchHandler };

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as composeWraps } from "../wrap-B2wziJI_.js";
-import { r as credentialSubject } from "../credential-CyyyvCsL.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { t as composeWraps } from "../wrap-C5PWzgkq.js";
+import { r as credentialSubject } from "../credential-B3Hj4puZ.js";
 import { o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
-import { t as createPermDock$1 } from "../create-BLPKnJKa.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { r as instanceOptions } from "../build-instance-lye7oEqf.js";
+import { t as createPermDock$1 } from "../create-jCPwPWXf.js";
+import { n as attached } from "../bind-BJFeLX1V.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-DYWnT800.js → supabase-C6FyUeSh.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/supabase.ts
 const hookGenerate = defineLeaf({
 	flags: {
@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
+		const { runSupabase } = await import("./supabase-hook-CPBX4dy5.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
+		const { runSupabase } = await import("./supabase-hook-CPBX4dy5.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-CDHMsDD0.js → supabase-C8cNzp4i.js}

@@ -2,13 +2,13 @@ import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { s as ApprovalError } from "./types-CcUXciSj.js";
-import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-RNFvaJJv.js";
-import { a as parseCapability } from "./capability-BqX94r07.js";
+import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-XgBMbfDy.js";
+import { a as parseCapability } from "./capability-zN6T9fxe.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
-import "./budget-BELja5A9.js";
+import "./budget-BBCPDOGP.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { d as keptKeys, l as roleColumn } from "./sources-C4vkzZJV.js";
-import { t as callRpc } from "./postgrest-DAxFltvO.js";
+import { t as callRpc } from "./postgrest-BrjrckDG.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -96,8 +96,6 @@ function checkMembership(item, path, issues) {
 	for (const key of [
 		"scope",
 		"id",
-		"tenant",
-		"team",
 		"via",
 		"granted_by",
 		"reason"
@@ -110,7 +108,7 @@ function checkMembership(item, path, issues) {
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
 	optional(item, "grants", path, issues, isRecord, "an object");
-	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
+	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, or on");
 }
 function checkPermDockClaims(record, tenantClaim, path, issues) {
 	optional(record, "user_role", path, issues, (value) => value === null || typeof value === "string" || isStrings(value), "a string, an array of strings or null");
@@ -341,6 +339,31 @@ function supabaseApprovalStore(client, options = {}) {
 	};
 }
 //#endregion
+//#region src/supabase/approval-policies.ts
+function rowsOf$1(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+/**
+* Approval policies from the table `rls.approvals.tenantPolicies` generates:
+* the subject's tenants' enabled rows and every platform floor. A row whose
+* body is not an object throws, and the evaluator checks every entry with
+* `validateApprovalPolicy`, so a bad row denies every call an allow would grant
+* until it is fixed.
+*/
+function tableApprovalPolicySource(options) {
+	const fn = quoteQualifiedTable(`${options.schema ?? "permdock"}.permdock_approval_policies_for`);
+	return {
+		name: "table",
+		async approvalPoliciesFor(query) {
+			return rowsOf$1(await options.query(`select p.body from ${fn}($1::text[]) p(body)`, [[...query.tenants]])).map((row) => {
+				const body = row["body"];
+				if (!isRecord(body)) throw new TypeError("PermDock: an approval_policies row has a body that is not an object");
+				return body;
+			});
+		}
+	};
+}
+//#endregion
 //#region src/supabase/approval-delegations.ts
 function rowsOf(result) {
 	return Array.isArray(result) ? result : result.rows;
@@ -697,4 +720,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-export { supabaseClaims as a, supabaseApprovalStore as i, supabaseRls as n, exchangeCapability as o, tableApprovalDelegationSource as r, authorizeSql as t };
+export { supabaseApprovalStore as a, tableApprovalPolicySource as i, supabaseRls as n, supabaseClaims as o, tableApprovalDelegationSource as r, exchangeCapability as s, authorizeSql as t };

package/dist/supabase-hook-CPBX4dy5.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-Cj85nccs.js";

package/dist/{supabase-hook-HPgwYb9V.js → supabase-hook-Cj85nccs.js}

@@ -1,30 +1,31 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
-import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMP8Cmxd.js";
+import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import "./budget-BELja5A9.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
+import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
-import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-CDHMsDD0.js";
+import { i as scopeColumn } from "./compile-B_oJqmIg.js";
+import { t as AUTHZ_EVENT } from "./authz-topic-Dbc-HDOS.js";
+import { t as authorizeSql } from "./supabase-C8cNzp4i.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
-import { o as readMemberships } from "./postgrest-DAxFltvO.js";
+import { o as readMemberships } from "./postgrest-BrjrckDG.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
-import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
+import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BsGE6HBR.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
-import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-DI8s3cPl.js";
-import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
+import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-CrjL6A49.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-1nCei24V.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
@@ -1885,6 +1886,94 @@ function customRolesOfSql(parts) {
       );`;
 }
 //#endregion
+//#region src/cli/rls/approval-policies.ts
+/**
+* The objects `rls.approvals.tenantPolicies` adds; `tableApprovalPolicySource`
+* calls the function.
+*/
+const APPROVAL_POLICIES = {
+	table: "approval_policies",
+	read: "permdock_approval_policies_for"
+};
+const KEY = /^[A-Za-z][\w-]*(?:\.[A-Za-z][\w-]*)+$/u;
+/**
+* `rls.approvals.tenantPolicies`: one table of `ApprovalPolicy` bodies, a
+* tenant row per requirement a tenant adds and platform floors with `tenant`
+* null. Members read their tenants' rows and the floors; a holder of `manage`
+* in a tenant writes that tenant's rows; nobody but the owner writes a floor.
+* `permdock_approval_policies_for(p_tenants)` answers the enabled bodies with
+* the row's tenant set, floors first, and only the owner may execute it, since
+* it reads every tenant.
+*/
+function approvalPoliciesSql(ctx, options, actorMayWrite = false) {
+	if (options === null || typeof options !== "object" || !("manage" in options) || typeof options.manage !== "string" || !KEY.test(options.manage)) throw configError("PermDock CLI: rls.approvals.tenantPolicies needs { manage: '<permission key>' }, the permission whose holders in a tenant edit its approval policies");
+	const root = ctx.scopes[0]?.name;
+	if (root === void 0) throw configError("PermDock CLI: rls.approvals.tenantPolicies needs a tenant scope; declare one in the policy's scopes");
+	const table = qualified(ctx, APPROVAL_POLICIES.table);
+	const fn = qualified(ctx, APPROVAL_POLICIES.read);
+	const member = `tenant in (select m.id::text from ${qualified(ctx, memberIdsHelper(root))}() m(id))`;
+	const manages = `exists (
+      select 1
+      from ${qualified(ctx, checkName(permittedByPermissionHelper(root)))}(${quoteLiteral(options.manage)}) i(id)
+      where i.id::text = tenant
+    )`;
+	const writable = actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : "";
+	const own = `tenant is not null and ${subjectIdSql(ctx)} is not null and ${manages}${writable}`;
+	const policy = (name) => quoteIdent(`${APPROVAL_POLICIES.table}_${name}`);
+	return `
+-- approval policies: requirements a tenant keeps as data, plus platform floors (tenant null); tableApprovalPolicySource reads them
+create table if not exists ${table} (
+  id text primary key default gen_random_uuid()::text,
+  tenant text,
+  name text not null,
+  body jsonb not null,
+  enabled boolean not null default true,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint ${quoteIdent(`${APPROVAL_POLICIES.table}_body`)} check (jsonb_typeof(body) = 'object' and body ? 'approval')
+);
+create index if not exists ${quoteIdent(`${APPROVAL_POLICIES.table}_tenant`)} on ${table} (tenant);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, public;
+grant select, insert, update, delete on table ${table} to authenticated;
+drop policy if exists ${policy("read")} on ${table};
+create policy ${policy("read")} on ${table}
+  for select to authenticated
+  using (tenant is null or ${member});
+drop policy if exists ${policy("insert")} on ${table};
+create policy ${policy("insert")} on ${table}
+  for insert to authenticated
+  with check (${own});
+drop policy if exists ${policy("update")} on ${table};
+create policy ${policy("update")} on ${table}
+  for update to authenticated
+  using (${own})
+  with check (${own});
+drop policy if exists ${policy("delete")} on ${table};
+create policy ${policy("delete")} on ${table}
+  for delete to authenticated
+  using (${own});
+
+-- approval policies: the enabled bodies for p_tenants and every floor, with the row's tenant; only the owner executes it
+create or replace function ${fn}(p_tenants text[])
+returns setof jsonb
+language sql
+stable
+set search_path = ''
+as $$
+  select case
+      when p.tenant is null then p.body - 'tenant'
+      else p.body || jsonb_build_object('tenant', p.tenant)
+    end
+  from ${table} p
+  where p.enabled
+    and (p.tenant is null or p.tenant = any(coalesce(p_tenants, '{}')))
+  order by p.tenant nulls first, p.created_at, p.id;
+$$;
+revoke execute on function ${fn}(text[]) from public, anon, authenticated;
+`;
+}
+//#endregion
 //#region src/cli/rls/approvals.ts
 /**
 * `rls.approvals`' approver check; better-supabase's `isApprover` template
@@ -2188,14 +2277,14 @@ grant execute on function ${fn}(jsonb, text) to authenticated;
 }
 /**
 * Everything `rls.approvals` writes: the generated or adopted store, the
-* approver check and, with `delegations: true`, the covers. With
-* `actorMayWrite`, the covers' write policies call
-* `permdock_actor_may_write()`.
+* approver check, with `delegations: true` the covers, and with
+* `tenantPolicies` the tenant approval policies. With `actorMayWrite`, the
+* covers' write policies call `permdock_actor_may_write()`.
 */
 function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 	if (approvals === void 0 || approvals === false) return;
 	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
-	const { table, delegations } = approvals;
+	const { table, delegations, tenantPolicies } = approvals;
 	if (delegations !== void 0 && typeof delegations !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.delegations must be a boolean");
 	let store;
 	if (table === void 0) {
@@ -2212,7 +2301,7 @@ function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 		...approvals,
 		table
 	}, jsonSchema);
-	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite) : "");
+	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite) : "") + (tenantPolicies === void 0 ? "" : approvalPoliciesSql(ctx, tenantPolicies, actorMayWrite));
 }
 /**
 * The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
@@ -2847,6 +2936,10 @@ function hookParts(scopes, config, overrides) {
 		sources: hook.memberships,
 		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
 		version: hook.version !== false,
+		broadcast: hook.version === false || hook.broadcast === false ? void 0 : {
+			topic: hook.broadcast?.topic ?? "permdock:authz",
+			receivePolicy: hook.broadcast?.receivePolicy ?? true
+		},
 		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
 		tenantClaim,
 		users: suspension?.users,
@@ -2964,7 +3057,60 @@ revoke execute on function ${bump}() from public, anon, authenticated;
 ${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${quoteQualified(name)};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after insert or update or delete on ${quoteQualified(name)}
-  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${broadcastSql(parts, versionTable)}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+}
+/**
+* Every version row written is sent as `{ user_id, version }` on the server
+* topic and on the user's `authz:<uid>`, in the shape better-supabase's
+* `subscribeAuthzVersions` and `SessionProvider` read.
+*/
+function broadcastSql(parts, versionTable) {
+	const broadcast = parts.broadcast;
+	if (broadcast === void 0) return "";
+	const send = `${quoteIdent(parts.schema)}.permdock_broadcast_authz_version`;
+	const payload = "jsonb_build_object('user_id', new.user_id, 'version', new.version)";
+	const event = quoteLiteral(AUTHZ_EVENT);
+	const receive = broadcast.receivePolicy ? `
+
+-- each user receives their own authz:<uid> topic, and no user may join the server topic
+do $$
+begin
+  if to_regclass('realtime.messages') is not null and not exists (
+    select 1 from pg_policies
+    where schemaname = 'realtime' and tablename = 'messages'
+      and policyname = 'permdock_authz_version_receive'
+  ) then
+    create policy permdock_authz_version_receive on realtime.messages
+      for select to authenticated
+      using (
+        realtime.messages.extension = 'broadcast'
+        and (select realtime.topic()) = 'authz:' || (select auth.uid())::text
+      );
+  end if;
+end;
+$$;` : "";
+	return `
+
+-- sends every version bump on the server topic and on the user's authz:<uid>
+create or replace function ${send}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if to_regprocedure('realtime.send(jsonb, text, text, boolean)') is not null then
+    perform realtime.send(${payload}, ${event}, ${quoteLiteral(broadcast.topic)}, true);
+    perform realtime.send(${payload}, ${event}, 'authz:' || new.user_id::text, true);
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${send}() from public, anon, authenticated;
+drop trigger if exists permdock_authz_version_broadcast on ${versionTable};
+create trigger permdock_authz_version_broadcast
+  after insert or update on ${versionTable}
+  for each row execute function ${send}();${receive}`;
 }
 function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;

package/dist/{supautils-CGk4YpvC.js → supautils-BP_5WAIc.js}

@@ -1,22 +1,22 @@
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { l as policyLevels } from "./policy-CLQ8__GF.js";
-import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
-import "./budget-BELja5A9.js";
+import { l as policyLevels } from "./policy-DxQyHKPB.js";
+import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
+import "./budget-BBCPDOGP.js";
 import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-HPgwYb9V.js";
-import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
-import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { c as parseSplit } from "./output-files-CM0BnH05.js";
+import { x as resolveAuthorize } from "./supabase-hook-Cj85nccs.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BsGE6HBR.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
-import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-CgIpJRcG.js";
+import { d as orSql, h as branchClauses } from "./fields-CrjL6A49.js";
+import { t as resolveNames } from "./resolve-names-1nCei24V.js";
+import { m as tableFor } from "./verify-C8G8D5mk.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -400,10 +400,11 @@ function permissionCase(key, branches) {
 	const granted = `coalesce((${allow}), false)`;
 	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
 }
-function forUserSql(ctx, fn, helper) {
+function forUserSql(ctx, fn, helper, ids) {
 	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const signature = `${user}, text, jsonb`;
-	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+	const signature = `${user}, text, ${ids ? "text[], " : ""}jsonb`;
+	const call = `${helper}(p_permission${ids ? ", p_ids" : ""})`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, ${ids ? "p_ids text[], " : ""}p_claims jsonb default '{}')
 returns setof text
 language plpgsql
 volatile
@@ -420,7 +421,7 @@ begin
     (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
     true
   );
-  return query select r.id from ${helper}(p_permission) r(id);
+  return query select r.id from ${call} r(id);
   perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
 end
 $$;
@@ -440,7 +441,7 @@ begin
     v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
     perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
   end loop;
-  return query select r.id from ${helper}(p_permission) r(id);
+  return query select r.id from ${call} r(id);
   for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
     perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
   end loop;
@@ -551,7 +552,8 @@ ${rowSql(ctx, name, table, near)}`;
 	if (ctx.dialect === "neon") return rows;
 	return `${rows}
 -- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn, false)}
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn, true)}`;
 }
 /**
 * `permitted_<resource>_rows(p_permission)` for each resource `select` names

package/dist/svelte/index.d.ts

@@ -1,14 +1,14 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe } from "../describe-nalX_HHE.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BtdN3eDO.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/index.js

@@ -1,12 +1,12 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { u as slotContent } from "../views-CD8wuL4Z.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
-import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
+import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { u as slotContent } from "../views-TrZYlDnM.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as getUi, t as getStore } from "../context-DeammvFl.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CBXkOcg9.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-53_kOwPi.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -119,4 +119,4 @@ function Protected$1($$anchor, $$props) {
 const Protected = Protected$1;
 const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-BbFPBSms.js";
+import { n as DescribeMessages } from "../describe-nalX_HHE.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { g as ClientStore } from "../types-tQB2CEnY.js";
-import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
+import { t as ClientStore } from "../store-g5ctUrOI.js";
+import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { u as slotContent } from "../views-CD8wuL4Z.js";
-import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
-import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
+import { u as slotContent } from "../views-TrZYlDnM.js";
+import { n as getUi, t as getStore } from "../context-DeammvFl.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CBXkOcg9.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,14 +1,14 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe } from "../describe-nalX_HHE.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BtdN3eDO.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/source.js

@@ -1,12 +1,12 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
+import { n as describe } from "../describe-CogP1loh.js";
+import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-53_kOwPi.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
 const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };